Associate Professor of Computer Science and Engineering (@PennStateEECS, @PSUEngineering), Pennsylvania State University (@penn_state)

State College, PA
Joined May 2011
Syed Rafiul Hussain retweeted
18 years ago today, Dan Kaminsky @dakami disclosed the DNS cache poisoning vulnerability at Black Hat USA 2008, triggering one of the largest coordinated patch efforts in internet history. Before public disclosure, Dan organized multiple vendors to fix the flaw in secret. Many more legendary stories than could fit here, like how he exposed Sony’s rootkit across more than 568,000 networks and identified critical certificate vulnerabilities. Dan followed what he cared about and his curiosity. As Michael Tiffany @kubla put it, “Only Dan thought, ‘I could fix the human eye in software.’” He built DanKam, an augmented-reality app that helped colorblind people see color. Michael hosted Dan while he built the first version and described watching a colorblind houseguest sit at the kitchen table, “crying tears of joy seeing red for the first time.” His mother, Trudy Maurer, may have said it best when she accepted his Lifetime Achievement Award at the 2025 Difference Makers. “Daniel was the catalyst for many achievements across the vast internet spectrum, and I believe Dan truly represented the intersection of technology and humanity.” @dotMudge, who presented the award, said: “The Lifetime Achievement Award isn’t about what you achieve in your lifetime. That’s part of it. It’s about how many people you influence and bring in and then take it further.” We lost Dan too early from diabetic ketoacidosis in April 2021 at age 42. Some of you are hearing the name Dan Kaminsky for the first time.  The coordinated, community-first spirit Dan modeled is the bar. If you're in Vegas this week, you're walking the streets that the legends of security who came before you walked, when they also had no idea what they were doing, facing problems nobody had solved before. They had to figure it out as they went. Just like you're going to do. Thanks to those who contributed to this tribute video: Jeff Moss @thedarktangent, @paulvixie, @gadievron, Lena Smart, Derek Hinch and the many others who shared here.
21
116
14
576
46,940
Baseband reverse engineering, emulation, and fuzzing! To learn more about our work, don't forget to attend the talk by Ali and Tianchang at @BlackHatEvents on Thursday at 11:20 am.
Tianchang and I are talking 5G baseband vulnerabilities on Thursday at 11:20am. We’ll share how we emulated Galaxy & Pixel Exynos modems for fuzzing and reverse engineered the binaries to find OTA-triggered memory corruption & RCE paths. Come by if you're around for #BHUSA 2025.
1
379
If you are working on 5G/6G/FutureG, consider submitting your work to the workshop on 6G and Spectrum Security for Critical Communication (6GSECC), co-located with IEEE MILCOM 2025 and co-chaired by Dr. Arup Bhuyan and me. CFP: milcom2025.ieee-milcom.org/w…. Deadline is August 12, 2025
243
Open RAN, Open Risks! Super excited to have our second talk accepted at BlackHat USA'25: blackhat.com/us-25/briefings…. Proud of my students Tianchang Yang, Yilu Dong, Syed Md Mukit Rashid, and Ali Ranjbar! Joint work with Gang (Gary) Tan!
3
306
Even if you sign the broadcast messages to prevent your phone from connecting to fake base stations, relay attackers can still launch attacks unless additional measures, e.g., distance/time bounded solutions are correctly enforced.
1
1
150
Check out our recent paper presented by Yilu Dong at WiSec’25 where we demonstrated such solutions can be integrated with PKI based schemes. Joint work with Tao Wan. Great job, Yilu. dl.acm.org/doi/10.1145/37344…
103
Learn about how you may bypass paywalls of inflight Wi-Fi systems! Great job by @AAIshtiaq1 and the folks from UMass!
Presenting our paper “Cloud Nine Connectivity: Security Analysis of In-Flight Wi-Fi Paywall Systems” today at #WiSec2025! Huge thanks to my coauthors, esp. @RHasnainAnwar. doi.org/10.1145/3734477.3734…
7
580
Congratulations, Ishtiaq! Way to go!
I’m grateful to have been selected for the 2024–25 Vice Provost and Dean of the Graduate School Student Persistence Scholarship at Penn State. This recognition is a meaningful encouragement as I continue my Ph.D. journey. Congratulations to all fellow recipients!
1
1
247
Syed Rafiul Hussain retweeted
Cybersecurity is not about maintaining status quo, cost centers, and accepting risk. It is about creating safe code faster, cheaper, and changing it safely as fast as needed for the mission. Formal methods is the only path to winning in the cyber domain: darpa.mil/formal-methods
4
7
1
32
18,572
Syed Rafiul Hussain retweeted
Papers and slides from the 11th LangSec IEEE Security & Privacy workshop are now posted on the LangSec website: langsec.org/spw25/abstracts.…
7
16
2,122
Syed Rafiul Hussain retweeted
I am looking forward to sharing my thoughts and learnings from DARPA programs on the new kinds of tools we need for maintaining and sustaining software and firmware at @hardwear_io , hardwear.io/usa-2025/speaker…
5
1
25
4,069
Super excited to have LORIS, a stateful analysis and fuzzing framework for commercial baseband firmware, accepted at @blackhatevent this year. See you all in Las Vegas! #BHUSA blackhat.com/us-25/briefings…
Stateful fuzzing on emulated basebands is extremely challenging as it requires complex manual harnessing to identify state variables and to resolve task dependencies in the RTOS baseband. Also, identifying states and corresponding path constraints runs into state explosion issues
1
8
3,714
Stateful fuzzing on emulated basebands is extremely challenging as it requires complex manual harnessing to identify state variables and to resolve task dependencies in the RTOS baseband. Also, identifying states and corresponding path constraints runs into state explosion issues
1
1
1
10
4,154
Today at @IEEESSP, Ali Ranjbar will present how we have addressed these challenges with a new technique called iterative symbolic execution to enable stateful and grammar-aware fuzzing of commercial basebands. Loris uncovered seven zero-days in 5 commercial basebands.
1
2
229
Great teamwork by Ali (@mustbastani), Tianchang, Kai (@HelloTKk), and Saaman! Let us know your feedback to improve it further. Paper: syed-rafiul-hussain.github.i… Code: github.com/SyNSec-den/Loris
4
144
Syed Rafiul Hussain retweeted
Embarking on a new project that needs physical access to an H100 GPU. Any chance anyone is willing to let us borrow one (we promise to return it), in exchange for a security exploration into the land of confidential computing? If so, DM me for further details. Thanks :)
1
1
9
798
With the rollout of microservice-based 5G core networks and the provision of third-party tenants (e.g., MVNOs), the 3GPP's current access control design is not secure. Mujtahid Akon will highlight these design flaws and explain how we found them today at @IEEESSP.
1
2
104
For this, we (Mujtahid, Toufik, and yours truly) developed CoreScan, an assume-guarantee style compositional verification technique that decomposes system model into multiple disjoint components and applies split assertion principle to identify local assumptions and guarantees.
1
73
We tested 61 access control properties with CoreScan and uncovered five new exploitable privilege escalation vulnerabilities in the 5G standards. Paper: syed-rafiul-hussain.github.i… source code: github.com/SyNSec-den/CoreSc…
1
82