Cyber-attacks are estimated to cost the world economy more than $400 billion annualy. From botnets to advanced persistent threats to targeted attacks, system vulnerabilities in combination with a successful exploit can grant an attacker unauthorized access to a computing system, entailing the possibility to exfiltrate sensitive data of valuable individuals, companies, and critical infrastructures.

Zero-day exploits can be used to leverage unknown vulnerabilities in order to gain access in a stealthy way to systems believed to be secure. And they are very valuable, being traded for considerable sums in the upper six-digit range, which reflects the months of work that it takes highly skilled professionals to develop a working exploit.

Visit our blog here.

Our goal is to pro­tect trusted sys­tems by re­duc­ing the prob­a­bil­ity of com­pro­mise and in­creas­ing the cost of craft­ing ex­ploits, while stay­ing with­in per­for­mance tar­gets and usa­bil­ity re­quire­ments.

—Anil Kurmus, IBM scientist

Proactive defense

To address the increasingly complex task of securing modern systems, we follow a three-pronged strategy

Finding vulnerabilities from the code base

We use static and dynamic program analysis methods such as fuzz testing to discover vulnerabilities before attackers do.

Preventing vulnerabilities from being reachable

Bugs in the code that are not available to the attacker cannot turn into vulnerabilities. Using attack surface reduction, we limit the exposed APIs and code paths to the absolute minimum.

Preventing exploitation of reachable vulnerabilities

We harden programs to make them more robust so that attackers cannot make use of bugs to craft an exploit.

Ask the experts

Alessandro Sorniotti

Alessandro Sorniotti
IBM Research scientist

Andrea Mambretti

Andrea Mambretti
Security Researcher

Anil Kurmus

Anil Kurmus
IBM Research scientist

Kevin Tavukciyan

Kevin Tavukciyan
Security Researcher


[1] A. Mambretti, M. Neugschwandtner, A., E. Kirda, W. Robertson, A. Kurmus
Speculator: A Tool to Analyze Speculative Execution Attacks and Mitigations
To appear in: Proceedings of the 35th Annual Computer Security Applications Conference (ACSAC’19).

[2] A. Bhattacharyya, A. Sandulescu, M. Neugschwandtner, A. Sorniotti, B. Falsafi, M. Payer, A. Kurmus
SMoTherSpectre: exploiting speculative execution through port contention
To appear in: Proceedings of the 26th ACM Conference on Computer and Communications Security (ACM CCS’19) 2019.

[3] A. Mambretti, A. Sandulescu, M. Neugschwandtner, A. Sorniotti, A. Kurmus
Two methods for exploiting speculative control flow hijacks
In: Proceedings of the 13th USENIX Workshop on Offensive Technologies (WOOT’19) 2019.

[4] M. Neugschwandtner, A. Sorniotti, A. Kurmus
Memory Categorization: Separating Attacker-Controlled Data
In: Proceedings of the 16th Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA’19) 2019.

[5] A. Kurmus, N. Ioannou, M. Neugschwandtner, N. Papandreou, T. Parnel
Is there a ‘rowhammer’ for MLC NAND flash SSDs? An analysis of filesystem attack vectors
In: Proceedings of the Workshop on Offensive Technologies (WOOT’17) 2017.

[6] N. Weichbrodt, A. Kurmus, P. Pietzuch, Rüdiger Kapitza
AsyncShock: Exploiting synchronisation bugs in Intel SGX enclaves
In: Proceedings of the European Symposium on Research in Computer Security (ESORICS’16) 2016.

[7] M. Neugschwandtner, A. Beitler, A. Kurmus
A transparent defense against USB eavesdropping attacks
In: Proceedings of the 9th European Workshop on System Security (EUROSEC’16) 2016.

[8] M. Neugschwandtner, C. Mulliner, W. Robertson, E. Kirda
Runtime Integrity Checking for Exploit Mitigation on Lightweight Embedded Devices
In: Proceedings of the International Conference on Trust and Trustworthy Computing (TRUST’16) 2016.

[9] C. Mulliner, M. Neugschwandtner
Breaking Payloads with Runtime Code Stripping and Image Freezing
In: Proceedings of 18th Black Hat USA, 2015.

[10] M. Neugschwandtner, P. Milani Comparetti, I. Haller, H. Bos
Nanoprobing Binaries for Buffer Overreads
In: Proceedings of the ACM Conference on Data and Application Security and Privacy (CODASPY’15) 2015.

[11] A. Kurmus, R. Zippel
A Tale of Two Kernels: Towards Ending Kernel Hardening Wars with Split Kernel
In: Proceedings of the ACM Conference on Computer and Communications Security (CCS’14) 2014.

[12] A. Kurmus, S. Dechand, R. Kapitza
Quantifiable Run-time Kernel Attack Surface Reduction
In: Proceedings of the 10th International Conference on Detection of Intrusions and Malware, Vulnerability Assessment (DIMVA’14) 2014.

[13] J. Zaddach, A. Kurmus, D. Balzarotti, E.-O. Blass, A. Francillon, T. Goodspeed, M. Gupta, I. Koltsidas
Implementation and Implications of a Stealth Hard-Drive Backdoor
In: Proceedings of Annual Computer Security Applications Conference (ACSAC’13) Best student paper award, 2013.

[14] A. Kurmus, R. Tartler, D. Dorneanu, B. Heinloth, V. Rothberg, A. Ruprecht, W. Schröder-Preikschat, D. Lohmann and R. Kapitza
Attack Surface Metrics and Automated Compile-Time OS Kernel Tailoring
In: Proceedings of the 20th Network and Distributed System Security Symposium (NDSS’13) 2013.

[15] A. Kurmus, A. Sorniotti, R. Kapitza
Attack Surface Reduction For Commodity OS Kernels
In: Proceedings of the 4th European Workshop on System Security (EUROSEC’11) 2011.