Publications

2026

1. Devilray: A Systematic Adversarial Model Revealing Blind Spots in Fake Base Station Detection

   Taekkyung Oh, Duckwoo Kim, Hansung Bae, and 8 more authors

   2026
2. ASN1spect: Uncovering ASN.1 Compiler-Generated Vulnerabilities in Critical Infrastructure

   Seaver Thorn, Nathaniel Bennett, Kevin Butler, and 2 more authors

   In Proceedings of the 2026 ACM Secure Development Conference, 2026

   Abs DOI

   ASN.1 is widely used for communication protocols in critical infrastructure. Many projects avoid parsing vulnerabilities by using ASN.1 compilers to automatically generate parsing code directly from complex protocol specifications. However, ASN.1 compilers can themselves have vulnerabilities, propagating vulnerable parsing routines to projects that use them. This paper proposes ASN1spect, a novel approach to identifying known vulnerable code generated by vulnerable ASN.1 compilers. Our analysis of vulnerabilities related to ASN.1 type constraints show that known and silently fixed vulnerabilities propagate to actively-maintained downstream projects and remain undetected for years. While our primary focus is on silently fixed supply-chain vulnerabilities, our analysis also uncovered two previously unknown vulnerabilities in asn1c. We apply ASN1spect to 93 open-source projects containing asn1c-generated parsing code and detect vulnerable parsing code in 40 (43%). We further demonstrate proof-of-concept payloads that can cause denial-of-service and logic vulnerabilities in electrical grid and satellite communication projects. These results motivate managing code generators such as ASN.1 compilers as versioned components in the software supply chain.

3. Practical Attacks on AFC Clients in Wi-Fi Access Points

   Yilu Dong, Tianchang Yang, Nathaniel Bennett, and 2 more authors

   In 2026 IEEE International Symposium on Spectrum Innovation (DySPAN), 2026

   DOI
4. Fizzle: A Framework for Deterministic and Reproducible Network Fuzzing

   Nathaniel Bennett, Tyler Tucker, Carson Stillman, and 3 more authors

   In Proceedings of the 47th IEEE Symposium on Security and Privacy, 2026

   DOI
5. On the Security of 6 GHz Automated Frequency Coordination (AFC)

   Nathaniel Bennett, Arupjyoti Bhuyan, and Nicholas Kaminski

   In Proceedings of the 2nd Workshop on Security and Privacy of Next-Generation Networks (FutureG), 2026

   DOI

2025

1. Reproducibility in Applied Security Conferences: An 11-Year Review on Artifacts and Evaluation Committees

   Daniel Olszewski, Allison Lu, Anna Crowder, and 10 more authors

   In Proceedings of the 3rd ACM Conference on Reproducibility and Replicability, 2025

   Abs DOI

   Reproducible research ensures a foundation for credible and progressive scientific advancement. Calls for reproducibility in the computer security and privacy community resulted in ACM WiSec and ACSAC in 2017 creating artifact evaluation committees (AECs) to foster more reproducible outcomes. Upon acceptance to ACM WiSec and ACSAC, authors may submit experimental artifacts to the committee to demonstrate that their artifacts effectively support their paper. While this may seem to address reproducibility, it is unknown whether AECs have actually improved reproducibility. Furthermore, AECs only assess artifacts submitted to the committee, and thus, may not holistically reflect the status of reproducibility (e.g., artifacts that did not go through the AEC). We conduct an indirect (i.e., availability) and a direct (i.e., running code) reproducibility studies to measure and evaluate the potential and realized reproducibility by classifying and running artifacts associated with individual papers. We collect over 2,000 papers and 550 artifacts to measure the state of reproducibility within four established applied security conferences between 2013 and 2023, two of which have AECs and two comparable conferences without AECs. We find that only 10% of research provides runnable artifacts, and only 3.9% of published papers produce a reproducible artifact. More importantly, our work shows that including an AEC alone does not necessarily result in more reproducible artifacts; specifically, ACM WiSec artifacts are more or less in line with the two control conferences, whereas ACSAC ultimately achieves 90% of artifacts participating in the AEC, with 40% of artifacts running. As such, our work shows that while the security community is developing mechanisms to foster reproducible research, there are significant improvements needed to progress reproducibility within computer security and privacy research.

2. Modeling DNS Queries and Caching to Evaluate the Merits of QNAME Minimization

   Casey Deccio, Robert Richardson, Nathaniel Bennett, and 1 more author

   In Proceedings of the 33rd IEEE International Conference on Network Protocols, 2025

   DOI
3. Detecting IMSI-Catchers by Characterizing Identity Exposing Messages in Cellular Traffic

   Tyler Tucker, Nathaniel Bennett, Martin Kotuliak, and 4 more authors

   In Proceedings of the 32nd Conference on Network and Distributed Systems Security, 2025

   Abs DOI

   IMSI-Catchers allow parties other than cellular network providers to covertly track mobile device users. While the research community has developed many tools to combat this problem, current solutions focus on correlated behavior and are therefore subject to substantial false classifications. In this paper, we present a standards-driven methodology that focuses on the messages an IMSI-Catcher must use to cause mobile devices to provide their permanent identifiers. That is, our approach focuses on causal attributes rather than correlated ones. We systematically analyze message flows that would lead to IMSI exposure (most of which have not been previously considered in the research community), and identify 53 messages an IMSI- Catcher can use for its attack. We then perform a measurement study on two continents to characterize the ratio in which connections use these messages in normal operations. We use these benchmarks to compare against open-source IMSI-Catcher implementations and then observe anomalous behavior at a large- scale event with significant media attention. Our analysis strongly implies the presence of an IMSI-Catcher at said public event (p << 0.005), thus representing the first publication to provide evidence of the statistical significance of its findings.

2024

1. RANsacked: A Domain-Informed Approach for Fuzzing LTE and 5G RAN-Core Interfaces

   Nathaniel Bennett, Weidong Zhu, Benjamin Simon, and 4 more authors

   In Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security, 2024

   Abs DOI

   Cellular network infrastructure serves as the backbone of modern mobile wireless communication. As such, cellular cores must be proactively secured against external threats to ensure reliable service. Compromised base station attacks against the core are a rising threat to cellular networks, while user device inputs have long been considered as an attack vector; despite this, few techniques exist to comprehensively test RAN-Core interfaces against malicious input. In this work, we devise a fuzzing framework that performantly fuzzes cellular interfaces accessible from a base station or user device, overcoming several challenges in fuzzing specific to LTE/5G network components. We also introduce ASNFuzzGen, a tool that compiles ASN.1 specifications into structure-aware fuzzing modules, thereby facilitating effective fuzzing exploration of complex cellular protocols. We run fuzzing campaigns against seven open-source and commercial cores and discover 119 vulnerabilities, with 93 CVEs assigned. Our results reveal common implementation mistakes across several cores that lead to vulnerabilities, and the successful coordination of patches for these vulnerabilities across several vendors demonstrates the practical impact ASNFuzzGen has on hardening user-exposed cellular systems.

2. Examining Cryptography and Randomness Failures in Open-Source Cellular Cores

   K. Virgil English, Nathaniel Bennett, Seaver Thorn, and 3 more authors

   In Proceedings of the 14th ACM Conference on Data and Application Security and Privacy, 2024

   Abs DOI

   Industry is increasingly adopting private 5G networks to securely manage their wireless devices in retail, manufacturing, natural resources, and healthcare. As with most technology sectors, open-source software is well poised to form the foundation of deployments, whether it is deployed directly or as part of well-maintained proprietary offerings. This paper seeks to examine the use of cryptography and secure randomness in open-source cellular cores. We design a set of 13 CodeQL static program analysis rules for cores written in both C/C++ and Go and apply them to 7 open-source cellular cores implementing 4G and 5G functionality. We identify two significant security vulnerabilities, including predictable generation of TMSIs and improper verification of TLS certificates, with each vulnerability affecting multiple cores. In identifying these flaws, we hope to correct implementations to fix downstream deployments and derivative proprietary projects.

2022

1. SPFail: Discovering, Measuring, and Remediating Vulnerabilities in Email Sender Validation

   Nathaniel Bennett, Rebekah Sowards, and Casey Deccio

   In Proceedings of the 22nd ACM Internet Measurement Conference, Nice, France, 2022

   Abs DOI

   Email is an important medium for Internet communication. Secure email infrastructure is therefore of utmost importance. In this paper we discuss two software vulnerabilities discovered in libSPF2, a library used by mail servers across the Internet for email sender validation with the Sender Policy Framework (SPF). We describe a technique to remotely detect the vulnerabilities in a production mail server, and we use that technique to quantify the vulnerability of Internet mail servers. We also monitor the patch rate of affected servers by performing continuous measurement over a period of roughly four months. We identify thousands of vulnerable mail servers, some associated with high-profile mail providers. Even after private notifications and public disclosure of the vulnerabilities roughly 80% of the vulnerable servers remain vulnerable.

2021

1. Measuring Email Sender Validation in the Wild

   Casey Deccio, Tarun Yadav, Nathaniel Bennett, and 6 more authors

   In Proceedings of the 17th International Conference on Emerging Networking EXperiments and Technologies, 2021

   Abs DOI

   Email is a critical Internet application, and its security is important. The Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) were developed to enable mail servers to detect and reject email coming from fraudulent sources. In this paper we study the state of SPF, DKIM, and DMARC validation across a large number of mail servers, the first such study at scale that we know of. We consider two behaviors of sender-validating mail servers: behavior when an email with a valid sender is received and behavior when an email from a invalid sender is received. Our techniques allow us to elicit SPF, DKIM, and DMARC validation behavior of the servers without spam. We find that as many as 85% of mail servers are deploying SPF validation, and over half are deploying all three mechanisms: SPF, DKIM, and DMARC. We also observe there are some nuanced behaviors with regard to adherence to the SPF specification.