research.
publications.
Publications

Publications

Conferences

  • Sikkerhetsfestivalen 2024 - Beyond the Standards: Unmasking a Weakness in PKCS7 and PKCS12 Implementations
  • Sikkerhetsfestivalen 2024 - Red Teaming Large Language Models
  • Sikkerhetsfestivalen 2024 - Demystifying AI - What does the C-suite need to know?
  • Sikkerhetsfestivalen 2024, NTNU malware forum 2024 - Howling at the Moon: Spotting Werewolves among Bears
  • SecAppDev 2024, HelloStavanger 2024 - Secure coding: Back to basics
  • RSA Conference 2023 - The Hidden Risk in Undocumented API Behavior
  • Sikkerhetsfestivalen 2022, NDC Security 2023 - Attacking through the Software Supply Chain
  • NTNU malware forum 2022 – Ember Bears are no Saints
  • NDC Security 2022, Øredev 2022, JavaZone 2021 – Secure coding: Back to basics
  • Øredev 2019 – Threat modeling workshop
  • Øredev 2019 – An introduction to Threat modeling
  • NDC Security 2020 – Modern web application vulnerabilities 2020
  • Øredev 2019, NDC Minnesota 2019, NDC Sydney 2018 – Modern web application vulnerabilities
  • NDC Minnesota 2018, NDC Sydney 2018, NDC London 2017, JavaZone 2016 – Broken crypto is broken
  • BoosterConf 2018 – Threat modeling workshop
  • JavaZone 2018 – Kubernetes Security with Isio
  • NDC TechTown 2018 – Fuzzing with AFL
  • NDC 2018, Oslo – Hack Back – bug hunting on the dark side
  • JavaZone 2017, NDC TechTown 2017 – An introduction to Threat modeling
  • O’Reilly Security 2016, VelocityConf 2016, JavaZone 2015 – Continuous security
  • InfoSecurity London 2016 – Evasion and Anti-Evasion: An Ongoing Game of Cat & Mouse
  • OWASP AppSec 2016 – Bug Hunting on the Dark Side
  • InfoSecurity London 2015 – Rethinking Enterprise Security: Lifecycle Defense
  • RSA Conference, San Francisco 2015 – Bug hunting on the Dark Side
  • DefCon 2014 – NinjaTV – Increasing Your Smart TV’s IQ Without Bricking It
  • NDC London 2014 – A fragile internet of things
  • JavaZone 2014, EUNIS 2014 (track keynote) – Your web application is already out of date
  • NDC Oslo 2014, NDC Lodon 2013, OWASP AppSec Research EU 2013, WebRebels 2012 – Securing a modern JavaScript based single page web application
  • OWASP AppSec Research EU 2013, Javazone 2012 – RESTful Security
  • BoosterConf 2013 – JavaScript security workshop
  • HackPra 2011 – Practical attacks on web application crypto
  • NDC Oslo 2011 – Avoiding Cross Site Scripting – Not as easy as you might think
  • OWASP AppSec EU 2009 – Agile security
  • CCDCOE Conference on Cyber Warfare 2009 – Proactive Botnet Countermeasures – An Offensive Approacht
  • Microsoft DCC 2009 – Botnet Takeovers
  • T2 2009 – Don’t do this at Home: 0wning Botnets
  • CCC Congress 2008 – Owning the Storm Botnet

Research Papers

  • A Case Study in Ethical Decision Making Regarding Remote Mitigation of Botnets
  • Finding and Extracting Crypto Routines from Malware
  • Banksafe information stealer detection inside the web browser
  • Classification and Detection of Metamorphic Malware using Value Set Analysis
  • On the arms race around botnets – Setting up and taking down botnets
  • Current Trends in Botnet Development and Defense
  • Proactive Botnet Countermeasures – An Offensive Approach.
  • Containing Conficker – To Tame A Malware.
  • NGBPA – Next Generation BotNet Protocol Analysis.
  • Stormfucker – Owning the Storm Botnet.
  • Parallelization of Radio Algorithms for Multi-Processor Platforms.
  • Combining Cognitive Radio and Software Radio Approach for Low Complexity Receiver Architecture.
  • Evaluation Architecture For Digital Radio Mondiale Multimedia Applications.
  • Performance Evaluation of current Mobile Phone Architectures with Respect to Multimedia Applications
  • DDoS detection based on traffic profiles
  • Inception Framework
  • Operation Hangover – Unveiling an Indian Cyberattack Infrastructure
  • Systematic cyber attacks against Israeli and Palestinian targets going on for a year
  • The many faces of Gh0st Rat
  • The Syrian Spyware

Patents

  • Creating an execution safety container for unreliable exploits
  • Systems and methods for safely executing unreliable malware
  • Universal tracing of side-channel processes in computing environments
  • Systems and methods for utilizing a browser extension to encrypt online payment information
  • Systems and methods for protecting customer payment data against malware attacks on inline frame payment forms
  • Systems and methods for enforcing strict network connectivity and storage access during online payments
  • Communications system having security apparatus, security apparatus and method herefor