martinjohns.com Open in urlscan Pro
217.160.0.220  Public Scan

Form analysis
0 forms found in the DOM

Text Content

mj AT martinjohns.com



PROF. DR. MARTIN JOHNS

> Email: mj at martinjohns dot com
> Tel: +49 - (0)531-391-7466
> Fax: +49 - (0)531-391-8111

Office Address

> TU Braunschweig
> Institute for Application Security
> Mühlenpfordtstr. 23
> 38106 Braunschweig, Germany
> [web]

Links

   
 * LinkedIn profile
 * Xing profile

Publications
 * David Klein, Thomas Barber, Souphiane Bensalim, Ben Stock, Martin Johns: Hand
   Sanitizers in the Wild: A Large-scale Study of Custom JavaScript Sanitizer
   Functions in 7th IEEE European Symposium on Security and Privacy (EuroSP'22),
   June 2022 (to appear)
 * Marius Musch, Robin Kirchner, Max Boll, and Martin Johns: Server-Side
   Browsers: Exploring the Web’s Hidden Attack Surface in Proc. of the 17th ACM
   Asia Conference on Computer and Communications Security (AsiaCCS'22), May
   2022 (to appear)
 * Marius Musch, Martin Johns: U Can’t Debug This: Detecting JavaScript
   Anti-Debugging Techniques in the Wild in 30th USENIX Security Symposium
   (Usenix Sec'21), August 2021 (pdf, bib)
 * Alexandra Dirksen, David Klein, Robert Michael, Tilman Stehr, Konrad Rieck,
   Martin Johns: LogPicker: Strengthening Certificate Transparency Against
   Covert Adversaries in Proceedings on Privacy Enhancing Technologies
   (PoPETS'21), July 2021 (pdf, bib)
 * Souphiane Bensalim, David Klein, Thomas Barber, Martin Johns: Talking About
   My Generation: Targeted DOM-based XSS Exploit Generation using Dynamic Data
   Flow Analysis in Proceedings of the 14th European Workshop on Systems
   Security (EuroSec'21), April 2021 (pdf, bib)
 * Marius Steffens, Marius Musch, Martin Johns, Ben Stock: Who’s Hosting the
   Block Party? Studying Third-Party Blockage of CSP and SRI in Network and
   Distributed Systems Security Symposium (NDSS 21), February 2021 (pdf, bib)
 * Martin Johns, Alexandra Dirksen: Towards Enabling Secure Web-based Cloud
   Services using Client-side Encryption in ACM Workshop on Cloud Computing
   Security (CCSW'20), 2020 (pdf, bib)
 * Erwin Quiring, David Klein, Daniel Arp, Martin Johns, Konrad Rieck:
   Adversarial Preprocessing: Understanding and Preventing Image-Scaling Attacks
   in Machine Learning in 29th USENIX Security Symposium (Usenix Sec 20), August
   2020 (pdf, bib)
 * Simon Koch, Tim Sauer, Martin Johns, Giancarlo Pellegrino: Raccoon: Automated
   Verification of Guarded Race Conditions in Web Applications in 35th
   ACM/SIGAPP Symposium on Applied Computing (ACM SAC 20), March 2020 (pdf, bib)
 * Florian D. Loch, Martin Johns, Martin Hecker, Martin Mohr, Gregor Snelting:
   Hybrid Taint Analysis for Java EE in 35th ACM/SIGAPP Symposium on Applied
   Computing (ACM SAC 20), March 2020 (pdf, bib)
 * Marius Musch, Christian Wressnegger, Martin Johns, Konrad Rieck: Thieves in
   the Browser: Web-based Cryptojacking in the Wild in 14th Int. Conference on
   Availability, Reliability and Security (ARES 19), August 2019 (pdf, bib)
 * Marius Musch, Marius Steffens, Sebastian Roth, Ben Stock, and Martin Johns:
   ScriptProtect: Mitigating Unsafe Third-Party JavaScript Practices, in ACM
   Asia Conference on Computer and Communications Security (ASIACCS’19), July
   2019 (pdf).
 * Marius Musch, Christian Wressnegger, Martin Johns, Konrad Rieck: New Kid on
   the Web: A Study on the Prevalence of WebAssembly in the Wild in 16th
   Conference on Detection of Intrusions and Malware & Vulnerability Assessment
   (DIMVA '19), June 2019 (pdf, bib)
 * Marius Steffens, Christian Rossow, Martin Johns, Ben Stock: Don’t Trust The
   Locals: Investigating the Prevalence of Persistent Client-Side Cross-Site
   Scripting in the Wild, in Network and Distributed System Security Symposium
   (NDSS'19), February 2019 (pdf)
 * Marius Musch, Martin Härterich, Martin Johns: Towards an Automatic Generation
   of Low-Interaction Web Application Honeypots, in 13th Int. Conference on
   Availability, Reliability and Security (ARES'18), 2018 (pdf).
 * Sebastian Lekies, Krzysztof Kotowicz, Samuel Groß, Eduardo Vela, Martin
   Johns: Code-reuse attacks for the Web: Breaking Cross-Site Scripting
   Mitigations via Script Gadgets, in 24th ACM Conference on Computer and
   Communications Security, 2017 (CCS 2017), November 2017 (pdf)
 * Giancarlo Pellegrino, Martin Johns, Simon Koch, Michael Backes, Christian
   Rossow: Deemon: Detecting CSRF with Dynamic Analysis and Property Graphs, in
   24th ACM Conference on Computer and Communications Security, 2017 (CCS 2017),
   November 2017 (pdf)
 * Ben Stock, Martin Johns, Marius Steffens and Michael Backes: How the Web
   Tangled Itself: Uncovering the History of Client-Side Web (In)Security, in
   26th USENIX Security Symposium (USENIX Security '17), August 2017 (pdf)
 * Michael Felderer, Mathias Büchler, Martin Johns, Achim Brucker, Ruth Breu,
   Alexander Pretschner: Security Testing: A Survey, in Ali Hurson, Atif Memon,
   editors: Advances in Computers, Vol 101, ADCOM, UK: Academic Press, 2016, pp.
   1-51.
 * Ben Stock, Giancarlo Pellegrino, Christian Rossow, Martin Johns and Michael
   Backes: Hey, You Have a Problem: On the Feasibility of Large-Scale Web
   Vulnerability Notification, in 25th USENIX Security Symposium (USENIX
   Security '16), August 2016 (pdf)
 * Willem De Groef, Deepak Subramanian, Martin Johns, Frank Piessens and Lieven
   Desmet: Ensuring Endpoint Authenticity in WebRTC Peer-to-peer Communication,
   in 31st ACM/SIGAPP Symposium on Applied Computing (SAC 2016), April 2016
   (pdf).
 * Ben Stock, Stephan Pfistner, Bernd Kaiser, Sebastian Lekies and Martin Johns:
   From Facepalm to Brain Bender: Exploring Client-Side Cross-Site Scripting, in
   22th ACM Conference on Computer and Communications Security (ACM CCS'15),
   October 2015 (pdf).
 * Sebastian Lekies, Ben Stock, Martin Wenzel and Martin Johns: The Unexpected
   Dangers of Dynamic JavaScript, in 24th USENIX Security Symposium (USENIX
   Security '15), August 2015 (pdf).
 * Bastian Braun, Korbinian Pauli, Joachim Posegga and Martin Johns. LogSec:
   Adaptive Protection for the Wild Wild Web, in 30th ACM/SIGAPP Symposium on
   Applied Computing (SAC 2015), April 2015.
 * Ben Stock, Sebastian Lekies, Tobias Mueller, Patrick Spiegel und Martin
   Johns: Precise Client-side Protection against DOM-based Cross-Site Scripting,
   in 23rd USENIX Security Symposium (USENIX Security '14), August 2014 (pdf).
 * Martin Johns: Script-Templates for the Content Security Policy, Journal of
   Information Security and Applications, Volume 19 Issue 3, Elsevier, July 2014
   (pdf).
 * Bastian Braun, Johannes Köstler, Joachim Posegga und Martin Johns: A Trusted
   UI for the Mobile Web, in 29th IFIP International Information Security and
   Privacy Conference (IFIP SEC 2014), Juni 2014 (pdf).
 * Ben Stock, Martin Johns: Protecting Users Against XSS-based Password Manager
   Abuse, in 9th ACM Symposium on Information, Computer and Communications
   Security (ASIACCS 2014), Juni 2014 (pdf).
 * Ben Stock, Sebastian Lekies, Martin Johns: DOM-basiertes Cross-Site Scripting
   im Web: Reise in ein unerforschtes Land, in 6th conference on "Sicherheit,
   Schutz und Zuverlässigkeit" (GI Sicherheit’14), Lecture Notes in Informatics
   (LNI), März 2014.
 * Bastian Braun, Martin Johns, Johannes Köstler, and Joachim Posegga.
   PhishSafe: Leveraging Modern JavaScript APIs for Transparent and Robust
   Protection. In Fourth ACM Conference on Data and Application Security and
   Privacy (ACM CODASPY 2014), March 2014 (pdf).
 * Sebastian Lekies, Ben Stock, Martin Johns: 25 Million Flows Later -
   Large-scale Detection of DOM-based XSS, in 20th ACM Conference on Computer
   and Communications Security (ACM CCS'13), November 2013 (pdf)
 * Martin Johns, Sebastian Lekies: Tamper-resistant LikeJacking Protection, in
   16th International Symposium on Research in Attacks, Intrusions and Defenses
   (RAID'13), October 2013 (pdf)
 * Martin Johns, Sebastian Lekies, Ben Stock: Eradicating DNS Rebinding with the
   Extended Same-Origin Policy, in 22nd USENIX Security Symposium (USENIX
   Security '13), August 2013 (pdf)
 * Martin Johns: PreparedJS: Secure Script-Templates for JavaScript, in 10th
   Conference on Detection of Intrusions and Malware & Vulnerability Assessment
   (DIMVA '13), July 2013 (pdf)
 * Martin Johns, Sebastian Lekies, Bastian Braun, and Benjamin Flesch:
   BetterAuth: Web Authentication Revisited, in 28th Annual Computer Security
   Applications Conference (ACSAC '12), December 2012 (pdf)
 * Sebastian Lekies, Nick Nikiforakis, Walter Tighzert, Frank Piessens, and
   Martin Johns: DEMACRO: Defense against Malicious Cross-domain Requests. In
   15th International Symposium on Research in Attacks, Intrusions and Defenses
   (RAID'12), September 2012 (pdf)
 * Bastian Braun, Stefan Kucher, Martin Johns, and Joachim Posegga: A User-level
   Authentication Scheme to Mitigate Web Session-Based Vulnerabilities. In 9th
   International Conference on Trust, Privacy, and Security in Digital Business
   (TrustBus '12), September 2012 (to appear)
 * Se­bas­ti­an Le­kies, Mario Hei­de­rich, Den­nis Ap­pelt, Thors­ten Holz, and
   Mar­tin Johns: On the fragility and limitations of current Browser-provided
   Clickjacking protection schemes, in 6th USE­NIX Work­shop on Of­fen­si­ve
   Tech­no­lo­gies (WOOT '12), August 2012 (pdf)
 * Sebastian Lekies and Martin Johns: Lightweight Integrity Protection for Web
   Storage Content Caching. In 6th Workshop on Web 2.0 Security and Privacy
   (W2SP 2012), May 2012 (pdf)
 * Martin Johns: HTML5-Security - Sicherer Umgang mit den neuen JavaScript APIs.
   In Datenschutz und Datensicherheit, 36(4): 231-235, April 2012
 * Anke Weidlich, Harald Vogt, Wolfgang Krauss, Patrik Spiess, Marek Jawurek,
   Martin Johns, and Stamatis Karnouskos: Decentralized intelligence in energy
   efficient power systems. In A. Sorokin et al., editors, Handbook of networks
   in power systems, ISBN 978-3-642-23192-6, Springer, 2012
 * Sebastian Lekies, Walter Tighzert, Martin Johns: Towards stateless,
   client-side driven Cross-Site Request Forgery protection for Web
   applications, in in 5th conference on "Sicherheit, Schutz und
   Zuverlässigkeit" (GI Sicherheit 2012), Lecture Notes in Informatics (LNI),
   March 2012 (pdf)
 * Marek Jawurek, Martin Johns, and Konrad Rieck: Smart Metering
   De-Pseudonymization, in 27th Annual Computer Security Applications Conference
   (ACSAC 2011), December 2011 (pdf)
 * Martin Johns, Sebastian Lekies: Biting the Hand That Serves You: A closer
   look at client-side Flash proxies for cross-domain requests. In 8th
   Conference on Detection of Intrusions and Malware & Vulnerability Assessment
   (DIMVA 2011), July 2011 (pdf)
 * Marek Jawurek, Martin Johns, Florian Kerschbaum: Plug-in privacy for Smart
   Metering billing. In 11th Privacy Enhancing Technologies Symposium (PETS
   2011), July 2011 (pdf)
 * Martin Johns: Code-injection Vulnerabilities in Web Applications -
   Exemplified at Cross-site Scripting. it - Information Technology 53(5):
   256-259, May 2011 (pdf)
 * Sebastian Lekies, Martin Johns, Walter Tighzert: The State of the
   Cross-domain Nation. In 5th workshop on Web 2.0 Security and Privacy (W2SP
   2011), May 2011 (pdf)
 * Nick Nikiforakis, Wouter Joosen, Martin Johns: Abusing Locality in Shared Web
   Hosting. In 4th European Workshop on System Security (EUROSEC'11), April 2011
   (pdf)
 * Martin Johns, Moritz Jodeit: Scanstud: A Methodology for Systematic,
   Fine-grained Evaluation of Static Analysis Tools, in Second International
   Workshop on Security Testing (SECTEST'11), March 2011 (pdf)
 * Martin Johns, Bastian Braun, Michael Schrank, Joachim Posegga: Reliable
   Protection Against Session Fixation Attacks, 26th ACM Symposium on Applied
   Computing (SAC 2011), Security Track, March 2011 (pdf)
 * Nick Nikiforakis, Wannes Meert, Yves Younan, Martin Johns, Wouter Joosen:
   SessionShield: Lightweight Protection against Session Hijacking, in 3rd
   International Symposium on Engineering Secure Software and Systems (ESSoS
   '11), February 2011 (pdf)
 * Moritz Jodeit, Martin Johns: USB Device Drivers: A Stepping Stone into your
   Kernel, in 6th European Conference on Computer Network Defense (EC2ND 2010),
   October 2010 (pdf)
 * Marek Jawurek, Martin Johns: Security Challenges of a Changing Energy
   Landscape. in Information Security Solutions Europe (ISSE 2010), Vieweg
   Verlag, October 2010 (pdf)
 * Michael Schrank, Bastian Braun, Martin Johns, Joachim Posegga: Session
   Fixation - the Forgotten Vulnerability?, in 5th conference on "Sicherheit,
   Schutz und Zuverlässigkeit" (GI Sicherheit 2010), Lecture Notes in
   Informatics (LNI), October 2010 (pdf)
 * Martin Johns, Christian Beyerlein, Rosemaria Giesecke, Joachim Posegga:
   Secure Code Generation for Web Applications, in 2nd International Symposium
   on Engineering Secure Software and Systems (ESSoS '10), LNCS 5965, Seiten 96
   - 113, Springer, February 2010 (pdf)
 * Martin Johns, Bjoern Engelmann, Joachim Posegga: XSSDS: Server-side detection
   of cross-site scripting attacks. In 24th Annual Computer Security
   Applications Conference (ACSAC '08), pp. 335 - 344, IEEE Computer Society,
   December 2008 (pdf)
 * Martin Johns: On JavaScript Malware and related threats - Web page based
   attacks revisited. In Journal in Computer Virology, Volume 4, Number 3, pp.
   161 - 178, Springer Paris, August 2008 (doi, pdf)
   
 * Martin Johns, Daniel Schreckling: Automatisierter Code-Audit -
   Sicherheitsanalyse von Source Code in Theorie und Praxis. In Datenschutz und
   Datensicherheit - DuD, Volume 31, Number 12, Vieweg Verlag, pp. 888-893,
   December 2007 (doi)
 * Martin Johns, Justus Winter: Protecting the Intranet Against "JavaScript
   Malware" and Related Attacks. In Detection of Intrusions and Malware &
   Vulnerability Assessment (DIMVA 2007), Springer, LNCS 4579, pp. 40-59, July
   2007 (pdf)
 * Martin Johns, Christian Beyerlein: SMask: Preventing Injection Attacks in Web
   Applications by Approximating Automatic Data/Code Separation. In 22nd ACM
   Symposium on Applied Computing (SAC 2007), Security Track, March 2007 (pdf)
   
 * Martin Johns: SessionSafe: Implementing XSS Immune Session Handling. In
   European Symposium on Research in Computer Security (ESORICS 2006), Springer,
   LNCS 4189, pp. 444-460, September 2006 (pdf)
 * Martin Johns, Justus Winter: RequestRodeo: Client Side Protection against
   Session Riding. In Proceedings of the OWASP Europe 2006 Conference, Report
   CW448, Departement Computerwetenschappen, KU Leuven, May 2006 (pdf)
 * Martin Johns: Pseudonyme Biometrik - Ein signaturbasierter Ansatz in
   Biometrics and Electronic Signatures (BIOSIG 2003), Lecture Notes in
   Informatics (LNI), P-31, July 2003 (paper)

Publications (invited / other)
 * Martin Johns, Nick Nikiforakis, Melanie Volkamer, John Wilander: Web
   Application Security (Dagstuhl Seminar 18321). Dagstuhl Reports 8(8): 1-17
   (2018)
 * Alexandra Dirksen, Sebastian Gajek, Martin Johns, Robert Michael: Pretty Good
   Facebook Privacy - Securing users against a curious platform, Poster, 2nd
   IEEE European Symposium on Security and Privacy, 2017.
 * Ben Stock, Giancarlo Pellegrino, Christian Rossow, Martin Johns, Michael
   Backes: Mapping the Landscape of Large-Scale Vulnerability Notifications,
   Poster, ACM CCS 2016.
 * Philippe De Ryck, Lieven Desmet, Frank Piessens and Martin Johns: Primer on
   Client-Side Web Security, Book, Briefs in Computer Science, Springer,
   December 2014
 * Lieven Desmet, Martin Johns, Benjamin Livshits, Andrei Sabelfeld: Web
   Application Security (Dagstuhl Seminar 12401). Dagstuhl Reports 2(10): 1-37,
   2012 (pdf)
 * Martin Johns and Joachim Posegga: WebSand: Server-Driven Outbound
   Web-Application Sandboxing. In 9th International Conference on Trust,
   Privacy, and Security in Digital Business (TrustBus'12), September 2012 (pdf)
 * Martin Johns: Code-injection Verwundbarkeiten in Web Anwendungen am Beispiel
   von Cross-site Scripting. In Ausgezeichnete Informatikdissertationen 2010,
   Lecture Notes in Informatics (LNI), Bonner Köllen Verlag, Darmstadt, Germany,
   2010 (pdf)
 * Martin Johns: Session Hijacking Attacks. In the second edition of
   Encyclopedia of Cryptography and Security, Springer, 2010.
 * Isabel Thomas, Anke Weidlich, Martin Johns: IT-Gestützte Geschäftsprozesse in
   zukünftigen E-Mobility Szenarien. In VDE Kongress 2010 - E-Mobility, ISBN
   978-3-8007-3304-0, Germany, 2010
 * Dan Boneh, Ulfar Erlingsson, Martin Johns, and Benjamin Livshits: Dagstuhl
   Seminar 09141: Web Application Security (Executive summary), Schloss Dagstuhl
   - Leibniz-Zentrum fuer Informatik, Germany, 2009 (pdf)
 * Martin Johns: Kirk und Eine Hamburger Nacht. In Me, Making Funny Faces,
   Luftschacht Verlag, ISBN 978-3-902373-50-2, Wien, 2009
 * Martin Johns: A First Approach to Counter "JavaScript Malware" In Proceedings
   of the 23rd Chaos Communication Congress, Verlag Art d'Ameublement,
   Bielefeld, ISBN 978-3-934-63605-7, pages 160 - 167, December 2006 (pdf)

Theses
 * Martin Johns: Code Injection Vulnerabilities in Web Applications -
   Exemplified at Cross-site Scripting, PhD Thesis, University of Passau,
   Germany, July 2009 (pdf).
 * Martin Johns: Anwendung von Wavelets für die biometrische Authentikation,
   Diploma (Master's) Thesis, University of Hamburg, Germany, February 2003
   (pdf)

Talks
 * "Eavesdropping on WebRTC Communication with Funny Cat Pictures", Ruhrsec, 29.
   April 2016, Bochum, Germany
 * "Your Scripts in My Page - What Could Possibly Go Wrong?" (with Ben Stock and
   Sebastian Lekies), Black Hat Europe, 12th November 2015, Amsterdam,
   Netherlands
 * "Protecting your Web Application with Content Security Policy (CSP)",
   lightning training at OWASP AppSec USA, 24. September 2015, San Francisco,
   USA
 * "WebRTC, Or How Secure Is P2P Browser Communication?" (with Lieven Desmet),
   OWASP AppSec EU, 21th May 2015, Amsterdam, Netherlands
 * "Client-side protection against DOM-based XSS done right (tm)" (with
   Sebastian Lekies and Ben Stock), Black Hat Asia, 16. March 2015, Singapore
   (pdf)
 * "Session Identifier Are For Now, Passwords Are Forever - XSS-Based Abuse Of
   Browser Password Managers" (with Sebastian Lekies and Ben Stock), Black Hat
   Europe, 16. October 2014, Amsterdam, Netherlands
 * "Call To Arms: A Tale Of The Weaknesses Of Current Client-Side XSS Filtering"
   (with Sebastian Lekies and Ben Stock), Black Hat Briefings, 06. August 2014,
   Las Vegas, USA
 * "25 Million Flows Later – Large-scale Detection of DOM-based XSS" (with
   Sebastian Lekies and Ben Stock), OWASP AppSec EU 2014, 26.06.2014, Cambridge,
   UK
 * "Web Application Security", invited tutorial at the 6th International
   Symposium on Engineering Secure Software and Systems (ESSoS 2014), February
   26th, 2014, Munich, Germany
 * "Relax Everybody: HTML5 Is Securer Than You Think", talk at the RSA
   Conference Europe'13, October 29-31 2013, Amsterdam, Netherlands
 * "Towards Server-driven Web Security“, invited talk at the Intel Research
   Conference (ERIC 2012), 23.10.2012, Barcelona, Spain
 * "Web Security – Are we there yet?“, keynote at the 2nd Dagstuhl Seminar on
   Web Application Security, 01.10.2012, Schloss Dagstuhl, Germany
 * "Clickjacking Protection Under Non-trivial Circumstances" and "Got Your Nose"
   (with Sebastian Lekies, Mario Heiderich, and Thorsten Holz), talks at the
   "WWWTF" Caro Workshop 2012, May 14-15 2012, Munich, Germany
 * "Security Pitfalls of client-side cross-domain HTTP requests", talk at the
   19. DFN Workshop "Sicherheit in vernetzten Systemen", 22.02.2012, Hamburg,
   Germany
 * "Web Application Security testing as a tool for ongoing developer training",
   talk at the German Testing Day 2011, 9.11.2011, Frankfurt, Germany
 * "Biting the Hand That Serves You: A closer look at client-side Flash proxies
   for cross-domain requests", talk at the Gothenborg OWASP Kick-off, April 14th
   2011, Gothenborg, Sweden
 * "The Mess We Are In - the Past, Present, and Future of Web Security", keynote
   at the 6th Workshop on Security and Trust Management (STM 2010), September
   24th, Athens, Greece
 * "Session Fixation - the Forgotten Vulnerability?" (with Henrich C. Poehls,
   Michael Schrank, and Bastian Braun), OWASP Research 2010, June 23rd 2010,
   Stockholm, Sweden
 * "Cross-site requests - One mechanism, many attacks", talk given at the RUB
   HackPra, June 18th 2010, Bochum, Germany
 * "Cross-site requests and other offenders... " (slides) and "Secure Code
   Generation for Web Applications" (slides), both held at the Dagstuhl Seminar
   on Web Application Security, March/April 2009, Dagstuhl, Germany
 * "Secure Code Generation for Web Applications", talk given at Microsoft
   Research, December 15th 2008, Redmond, USA (slides)
 * "XSSDS und noXSS - Server- und Browser-basierte XSS Erkennung" (with Jeremias
   Reith), OWASP Germany Conference, November 25th 2008, Frankfurt, Germany
   (slides)
 * "Scanstud - Evaluating static analysis tools" (with Moritz Jodeit, Wolfgang
   Koeppl, and Martin Wimmer), OWASP AppSec 2008, May 22nd, 2008, Ghent, Belgium
   (slides)
 * "The three faces of CSRF", talk at the DeepSec2007 conference, November 23th
   2007, Vienna, Austria (slides, video)
 * "Exploiting the Intranet with a Webpage", talk at the HITBSecConf2007
   conference, September 3-6 2007, Kuala Lumpur, Malaysia (slides, video).
   
 * "CSRF, the Intranet and You" (with Justus Winter), talk at the 23C3, December
   27-30 2006, Berlin, Germany (video)
 * "On CSRF and why you should care", talk at the PacSec 2006 conference,
   November 27-30 2006, Tokio, Japan (slides english/japanese).
 * "Using the same-origin policy to disarm XSS vulnerabilities", talk at
   ph-neutral 0x7d6, 27th May 2006, Berlin, Germany (slides)
   
 * "Finding and Preventing Buffer Overflows - An overview of static and dynamic
   approaches", talk at the 22C3, 27.12.2005, Berlin, Germany (slides, video)

Professional Activities

 * Member of organizing committees: ESORICS 2006 (workshop chair), German OWASP
   Day 2012 (pc co-chair), OWASP AppSec Research 2013 (pc co-chair), WASR 2013
   (general chair), STRINT 2014, German OWASP Day 2014, 2015, 2016, 2017, 2018,
   2019 & 2020 (pc chair), Dagstuhl Seminars on Web Application Security 2009,
   2012 and 2018 (co-organizer)
 * Member of program committees: OWASP Europe 2007, NordSec 2007, OWASP Europe
   2008, DIMVA 2008, OWASP Research 2010, W2SP 2010, EC2ND 2010, STM 2010, ESSoS
   2011, DIMVA 2011, STM 2011, EC2ND 2011, W2SP 2011, ESSoS 2012, WWW 2012,
   WISTP 2012, EuroSec 2012, DIMVA 2012, ISC 2012, EuroSec 2013, DIMVA 2013,
   ESSoS 2014, IOT 2014, SETOP 2014, STM 2014, ESSoS 2015, ACM SAC 2015, OWASP
   Research 2015, ICWE 2015, IFIP SEC 2015, ICISS 2015, ACM CODASPY 2016, ESSoS
   2016, IFIP SEC 2016, ACM SAC 2016, USENIX Security 2016, CODASPY 2017, ACM
   SAC 2017, IFIP SEC 2017, DIMVA 2017, EuroUSEC 2017, USENIX Security 2017, FPS
   2017, ACSAC 2017, ACM SAC 2018, CODASPY 2018, ISSTA 2018, IEEE EuroS&P 2018,
   ACSAC 2018, ACM SAC 2019, CODASPY 2019, ICWE 2019, ACSAC 2019, ACM SAC 2020,
   CODASPY 2020, ICWE 2020, ACSAC 2020, IEEE EuroS&P 2020, WWW 2020, ACM SAC
   2021, ACM CodaSpy 2021, ARES 2021, ACSAC 2021, WWW 2021, IEEE S&P 2022
 * Reviewer for program committees/journals: sOc-EUSAI 2005, CARDIS 2006, SEC
   2006, ISAS 2006, SEC 2007, WISTP 2007, International Journal of Information
   Security, WISTP 2008, CARDIS 2008, SECRYPT 2008, TrustBus 2009, NTMS 2009,
   INC 2010, IOT 2010, Computers & Security, ACSAC 2015.
 * Member of the CEPS Task Force on Critical Infrastructure Protection in the EU
   (2010)
 * Board Member of the German OWASP Chapter (since 2012)

Private
   
 * Twitter
 * Instagram