CERIAS Weekly Security Seminar - Purdue University

Twenty years ago, the first post on the CERIAS blog took apart the rule that passwords must be changed every month. NIST retired the practice in 2017; some standards still require it. That is how a security myth works: a plausible claim, repeated in enough checklists, becomes infrastructure, and nobody audits infrastructure that seems to be working. The newest myth is that AI makes security profes...

In contemporary digital environments, individuals increasingly exchange personal privacy for the convenience afforded by online services, often without full awareness of the breadth or implications of this trade-off. This study examines this phenomenon through a comparative analysis of the data practices of major communication, social networking, and dating applications, including Meta, Instagram,...

Internet users increasingly interact through emerging digital platforms and communities, which create complex online safety, security and privacy challenges that aredifficult to navigate. This talk will present insights from our research to understand the rising online safety landscape and improve online safety governance. I will first present our work characterizing online community responses to...

In the past few years, blockchains have emerged as a new class of decentralized systems with wide-ranging applications. But the promise of blockchains has been marred by hype, speculation, and a plethora of high-profile attacks. The purpose of this talk is to demonstrate, through examples from my research, why blockchain security is challenging. Blockchains operate in a radically new, highly adver...

Modern machine learning systems are only as reliable as the data and pipelines that support them, yet improving their behavior often requires navigating enormous spaces of possible data and system configurations. These systems are complex enough that improving them by changing everything at once is both inefficient and unreliable. This talk explores a simple principle for building smarter data and...

In this talk, I will provide an overview of our NSF-sponsored award, TianoShield, focused on enhancing the security posture and the software maintenance process of the open-source core of the UEFI Firmware, called EDK II, and maintained by the TianoCore community. The talk will highlight our ongoing collaborations with our industrial partners, including Intel Corporation, Arm, AMI, Insyde Software...

You may find yourself attending a CERIAS Security Seminar, and you may ask yourself "Well, how did we get here?" Once upon a time, not long ago, there was no cybersecurity industry or careers. This talk transports attendees on a retrospective journey through time to highlight the advancements which paved the way here. We further explore historic attack vectors to understand how they relate to the...

Cybersecurity practitioners face a persistent methodological problem: how should we reason about intelligent adversaries who observe our defenses, adapt their tactics, and choose targets based on our vulnerabilities? The field has responded with a fragmented toolkit. Quantitative risk assessment borrowed from safety engineering treats threat, vulnerability, and consequence as independent terms. Th...

The rapid evolution of connected devices and technologies has transformed the Internet of Things (IoT) into increasingly intelligent and autonomous systems. This talk focuses on the progression from traditional IoT to the Artificial Intelligence of Things (AIoT), and further toward Agent-Based IoT (AB-IoT), also referred to as Agentic AI-enabled IoT. As intelligent agents become embedded within Io...

Ransomware has evolved from basic digital extortion into a sophisticated, AI-powered threat that's faster,smarter, and more devastating than ever before. In this session, we'll explore how threat actors are weaponizing artificial intelligence to supercharge their operations—from automated reconnaissance and hyper-realistic phishing to malware that adapts in real-time to evade detection. We'll also...

Annual Security Symposium. Visit: https://ceri.as/2026 Artificial intelligence is rapidly transforming both the opportunities and risks within cybersecurity, creating a new landscape that today's students and researchers will soon inherit and shape. This keynote explores how AI is evolving from a supporting tool to a decision-making system, fundamentally changing how cyber threats are created, det...

The rapid adoption of mobile applications for managing consumer whole-house battery and energy systems has introduced new questions about software supply chain security. While these applications are not currently integrated with critical infrastructure, their growing role in connected energy environments highlights the importance of understanding the dependencies,permissions, and external services...

 Software signing is a foundational mechanism for improving software supply-chain security because it helps establish artifact provenance, integrity, and authenticity across organizational boundaries. Yet the security value of software signing depends not only on cryptographic design, but also on whether signing is adopted, integrated, and used correctly in practice. This research examines these q...

As foundation models, including large language models and multimodal models, are increasingly deployed in complex and high-stakes settings, ensuring their safety has become more important than ever. In this talk, I present a probabilistic perspective on AI safety: safety risks are treated as structured distributions to be discovered and controlled, rather than isolated failures to be patched. I fi...

Many organizations adopt security frameworks but struggle to turn them into day-to-day operations that reduce risk without slowing delivery. This talk presents a practical operating model that pairs ISO/IEC 27001 (as the certifiable management system that runs governance, risk management, internal audit, and continual improvement) with NIST Cybersecurity Framework 2.0 (as the outcome-focused "dash...

Deepfake voice technology is rapidly advancing, but how well do current detection systems handle differences in language and writing style? Most existing work focuses on robustness to acoustic variations such as background noise or compression, while largely overlooking how linguistic variation shapes both deepfake generation and detection. Yet language matters: psycholinguistic features such as s...

The rise of Industry 4.0 has transformed manufacturing through the integration of cyber-physical systems, connectivity, and real-time data exchange into increasingly automated and intelligent platforms. While these advances improve productivity and efficiency, they also introduce vulnerabilities to cyber-physical attacks that can degrade product quality, damage equipment, and pose safety risks. Ef...

Parental sharing, sometimes termed "sharenting," refers to ways that parents share information about their children online and is a common mechanism through which young children are exposed to social media. Parental sharing is controversial due to its significant benefits and risks, with researchers highlighting broader concerns regarding long-term implications for children's developing privacy st...

Hardware security is not a new problem, but it is rapidly expanding in both consumer and medical domains due to hyperconnectivity. Medical devices and counterfeit medicines represent a fundamental security challenge. In particular, although counterfeit medicines are not a new issue,the problem continues to worsen as counterfeiting practices become increasingly sophisticated. The counterfeiting of...

AI-driven machine vision systems are becoming essential in mechanical engineering applications such as fastener classification, yet their increasing connectivity exposes them to adversarial cyberattacks. Model evasion attacks like FGSM can subtly alter input images and cause misclassification, raising concerns about reliability in automated manufacturing. This talk focuses on the role of Explainab...

Collaborative robots and machine-learning-based virtual agents are increasingly entering the human workspace with the aim of increasing productivity, enhancing safety, and improving the quality of our lives. These agents will dynamically interact with a wide variety of people in dynamic and novel contexts, increasing the prevalence of human-machine teams in applications spanning from healthcare an...

Over the past several years, CL0P has executed multiple mass exploitation campaigns using zero-day vulnerabilities in popular software products that resulted in mass data exfiltration. In this talk we'll take a look at the vulnerabilities that enabled their access, discuss ways defenders could have detected the exploits, and explore hardening recommendations to make public facing applications hard...

In this talk, I will discuss recent research projects at the intersection of software security and automated reasoning. Specifically, I will present our work on assessing the exploitability of the Android kernel and developing complex exploits for it, as well as our efforts to uncover bugs in Rust's unsafe code through fuzzing. Throughout the talk, I will highlight how Large Language Models (LLMs)...

Online video games have evolved into vast financial ecosystems where real and virtual value mix at scale. This presentation shows how these spaces serve as efficient laundering channels, converting illicit funds from organized crime, sanctions evasion, terrorist financing, and digital fraud into assets that appear legitimate. Illicit value typically enters via card not present transactions, stolen...

Reasoning—the process of drawing conclusions from prior knowledge—is a hallmark of intelligence. Large language models, and more recently, large reasoning models have demonstrated impressive results on many reasoning-intensive benchmarks. Careful studies over the past few years have revealed that LLMs may exhibit some reasoning behavior, and larger models tend to do better on reasoning tasks. Howe...