[ { "id": "imc26-honey-configs", "url": "https://xsl.fyi/papers/imc26-honey-configs/", "key": "pauley_honey_2026", "kind": "conference", "title": "Honey Configs: Measuring The Emerging Exploitation of Cloud IP Address Reuse", "authors": [ "Eric Pauley", "Yohan Beugin", "Paul Barford", "Patrick Traynor", "Patrick McDaniel" ], "year": 2026, "venue": "ACM IMC 2026", "venueLong": "Proceedings of the 2026 ACM Internet Measurement Conference (IMC '26)", "topics": [ "cloud" ], "featured": false, "links": {} }, { "id": "imc26-split-alignment", "url": "https://xsl.fyi/papers/imc26-split-alignment/", "key": "hamza_split_2026", "kind": "conference", "title": "Split Alignment: Diffusing SPF Vulnerabilities With DMARC", "authors": [ "Muhammad Hamza", "Mattijs Jonker", "Raffaele Sommese", "Simon Fernandez", "Olivier Hureau", "Eric Pauley", "Taejoong Chung" ], "year": 2026, "venue": "ACM IMC 2026", "venueLong": "Proceedings of the 2026 ACM Internet Measurement Conference (IMC '26)", "topics": [ "email" ], "featured": false, "links": {} }, { "id": "msec25-cloud-honeypots", "url": "https://xsl.fyi/papers/msec25-cloud-honeypots/", "key": "pauley_clouds_2025", "kind": "magazine", "title": "Clouds Are Where the (Security) Action Is: Have Honeypots Been Left in the Dust?", "authors": [ "Eric Pauley", "Paul Barford", "Patrick McDaniel" ], "year": 2025, "venue": "IEEE Security & Privacy", "venueLong": "IEEE Security & Privacy", "doi": "10.1109/MSEC.2025.3603410", "topics": [ "telescopes", "cloud" ], "featured": false, "links": {} }, { "id": "ndss25-ip-allocation", "url": "https://xsl.fyi/papers/ndss25-ip-allocation/", "key": "pauley_secure_2025", "kind": "conference", "title": "Secure IP Address Allocation at Cloud Scale", "authors": [ "Eric Pauley", "Kyle Domico", "Blaine Hoak", "Ryan Sheatsley", "Quinn Burke", "Yohan Beugin", "Engin Kirda", "Patrick McDaniel" ], "year": 2025, "venue": "NDSS 2025", "venueLong": "2025 Network and Distributed Systems Security Symposium (NDSS)", "topics": [ "cloud" ], "featured": true, "links": { "pdf": "https://pauley.me/publication/2025/ndss25/ndss25.pdf", "code": "https://github.com/MadSP-McDaniel/eipsim" }, "abstract": "Public clouds necessitate dynamic resource allocation and sharing. However, the dynamic allocation of IP addresses can be abused by adversaries to source malicious traffic, bypass rate limiting systems, and even capture traffic intended for other cloud tenants. As a result, both the cloud provider and their customers are put at risk, and defending against these threats requires a rigorous analysis of tenant behavior, adversarial strategies, and cloud provider policies. In this paper, we develop a practical defense for IP address allocation through such an analysis. We first develop a statistical model of cloud tenant deployment behavior based on literature and measurement of deployed systems. Through this, we analyze IP allocation policies under existing and novel threat models. In response to our stronger proposed threat model, we design IP scan segmentation, an IP allocation policy that protects the address pool against adversarial scanning even when an adversary is not limited by number of cloud tenants. Through empirical evaluation on both synthetic and real-world allocation traces, we show that IP scan segmentation reduces adversaries' ability to rapidly allocate addresses, protecting both address space reputation and cloud tenant data. In this way, we show that principled analysis and implementation of cloud IP address allocation can lead to substantial security gains for tenants and their users." }, { "id": "ethics23-measurement-ethics", "url": "https://xsl.fyi/papers/ethics23-measurement-ethics/", "key": "pauley_understanding_2023", "kind": "workshop", "title": "Understanding the Ethical Frameworks of Internet Measurement Studies", "authors": [ "Eric Pauley", "Patrick McDaniel" ], "year": 2023, "venue": "EthiCS 2023", "venueLong": "The 2nd International Workshop on Ethics in Computer Security (EthiCS 2023)", "doi": "10.14722/ethics.2023.239547", "topics": [ "ethics" ], "award": "Best Paper", "featured": true, "links": { "pdf": "https://pauley.me/publication/2023/ethics23/ethics23.pdf", "slides": "https://pauley.me/publication/2023/ethics23/ethics23-slides.pdf" }, "abstract": "Measurement of network data received from or transmitted over the public Internet has yielded a myriad of insights towards improving the security and privacy of deployed services. Yet, the collection and analysis of this data necessarily involves the processing of data that could impact human subjects, and anonymization often destroys the very phenomena under study. As a result, Internet measurement faces the unique challenge of studying data from human subjects who could not conceivably consent to its collection, and yet the measurement community has tacitly concluded that such measurement is beneficial and even necessary for its positive impacts. We are thus at an impasse: academics and practitioners routinely collect and analyze sensitive user data, and yet there exists no cohesive set of ethical norms for the community that justifies these studies. In this work, we examine the ethical considerations of Internet traffic measurement and analysis, analyzing the ethical considerations and remediations in prior works and general trends in the community. We further analyze ethical expectations in calls-for-papers, finding a general lack of cohesion across venues. Through our analysis and recommendations, we hope to inform future studies and venue expectations towards maintaining positive impact while respecting and protecting end users." }, { "id": "imc23-cve-wayback-machine", "url": "https://xsl.fyi/papers/imc23-cve-wayback-machine/", "key": "10.1145/3618257.3624810", "kind": "conference", "title": "The CVE Wayback Machine: Measuring Coordinated Disclosure from Exploits against Two Years of Zero-Days", "authors": [ "Eric Pauley", "Paul Barford", "Patrick McDaniel" ], "year": 2023, "venue": "ACM IMC 2023", "venueLong": "Proceedings of the 2023 ACM on Internet Measurement Conference", "doi": "10.1145/3618257.3624810", "topics": [ "disclosure", "telescopes" ], "award": "Best Paper Runner-Up", "featured": true, "links": { "pdf": "https://pauley.me/publication/2023/imc23/imc23.pdf", "slides": "https://pauley.me/publication/2023/imc23/imc23-slides.pdf" }, "abstract": "Software security depends on coordinated vulnerability disclosure (CVD) from researchers, a process that the community has continually sought to measure and improve. Yet, CVD practices are only as effective as the data that informs them. In this paper, we use DScope, a cloud-based interactive Internet telescope, to build statistical models of vulnerability lifecycles, bridging the data gap in over 20 years of CVD research. By analyzing application-layer Internet scanning traffic over two years, we identify real-world exploitation timelines for 63 threats. We bring this data together with six additional datasets to build a complete birth-to-death model of these vulnerabilities, the most complete analysis of vulnerability lifecycles to date. Our analysis reaches three key recommendations: (1) CVD across diverse vendors shows lower effectiveness than previously thought, (2) intrusion detection systems are underutilized to provide protection for critical vulnerabilities, and (3) existing data sources of CVD can be augmented by novel approaches to Internet measurement. In this way, our vantage point offers new opportunities to improve the CVD process, achieving a safer software ecosystem in practice." }, { "id": "usenix23-dscope", "url": "https://xsl.fyi/papers/usenix23-dscope/", "key": "pauley_dscope_2023", "kind": "conference", "title": "DScope: A Cloud-Native Internet Telescope", "authors": [ "Eric Pauley", "Paul Barford", "Patrick McDaniel" ], "year": 2023, "venue": "USENIX Security 2023", "venueLong": "Proceedings of the 32nd USENIX Security Symposium (USENIX Security 2023, to appear)", "topics": [ "telescopes", "cloud" ], "award": "CSAW Applied Research Competition finalist", "featured": true, "links": { "pdf": "https://pauley.me/publication/2023/usenix23-dscope/usenix23-dscope.pdf", "slides": "https://pauley.me/publication/2023/usenix23-dscope/usenix23-dscope-slides.pdf", "project": "https://dscope.org" }, "abstract": "Data from Internet telescopes that monitor routed but unused IP address space has been the basis for myriad insights on malicious, unwanted, and unexpected behavior. However, service migration to cloud infrastructure and the increasing scarcity of IPv4 address space present serious challenges to traditional Internet telescopes. This paper describes DScope, a cloud-based Internet telescope designed to be scalable and interactive. We describe the design and implementation of DScope, which includes two major components. Collectors are deployed on cloud VMs, interact with incoming connection requests, and capture pcap traces. The data processing pipeline organizes, transforms, and archives the pcaps from deployed collectors for post-facto analysis. In comparing a sampling of DScope's collected traffic with that of a traditional telescope, we see a striking difference in both the quantity and phenomena of behavior targeting cloud systems, with up to 450× as much cloud-targeting as expected under random scanning. We also show that DScope's adaptive approach achieves impressive price performance: optimal yield of scanners on a given IP address is achieved in under 8 minutes of observation. Our results demonstrate that cloud-based telescopes achieve a significantly broader and more comprehensive perspective than traditional techniques." }, { "id": "cns22-binary-fuzzing", "url": "https://xsl.fyi/papers/cns22-binary-fuzzing/", "key": "pauley_performant_2022", "kind": "conference", "title": "Performant Binary Fuzzing without Source Code using Static Instrumentation", "authors": [ "Eric Pauley", "Gang Tan", "Danfeng Zhang", "Patrick McDaniel" ], "year": 2022, "venue": "IEEE CNS 2022", "venueLong": "2022 IEEE Conference on Communications and Network Security (CNS)", "topics": [ "systems" ], "featured": false, "links": { "pdf": "https://pauley.me/publication/2022/cns22/cns22.pdf", "slides": "https://pauley.me/publication/2022/cns22/cns22-slides.pdf" }, "abstract": "Advancements in fuzz testing have achieved the ability to quickly and comprehensively find security-critical faults in software systems. Yet, some of these techniques rely on access to source code, which is often unavailable in practice. In this paper, we explore techniques to replicate the depth and efficiency of source-code available fuzzers via static binary instrumentation. Developing such instrumentation is difficult because compilation is a lossy process, and much of the source-level semantics leveraged by these techniques are not available in binaries. We recover much of this information via heuristic control flow reconstruction, a shadow stack for function identification, and a novel technique for instrumenting comparison instructions. We evaluate RWFUZZ on the LAVA-M dataset, achieving the same effectiveness as a best-in-class source-available fuzzer with a 3.4× execution time overhead (lower than existing dynamic fuzzing approaches). In this way, we show that techniques for binary fuzzing may approach the functional ability of source-available fuzzing." }, { "id": "oakland22-cloud-squatting", "url": "https://xsl.fyi/papers/oakland22-cloud-squatting/", "key": "pauley_measuring_2022", "kind": "conference", "title": "Measuring and Mitigating the Risk of IP Reuse on Public Clouds", "authors": [ "Eric Pauley", "Ryan Sheatsley", "Blaine Hoak", "Quinn Burke", "Yohan Beugin", "Patrick McDaniel" ], "year": 2022, "venue": "IEEE S&P 2022", "venueLong": "2022 IEEE Symposium on Security and Privacy (SP)", "doi": "10.1109/SP46214.2022.00094", "topics": [ "cloud", "telescopes" ], "featured": true, "links": { "pdf": "https://arxiv.org/abs/2204.05122", "faq": "https://pauley.me/post/2022/cloud-squatting/" }, "abstract": "Public clouds provide scalable and cost-efficient computing through resource sharing. However, moving from traditional on-premises service management to clouds introduces new challenges; failure to correctly provision, maintain, or decommission elastic services can lead to functional failure and vulnerability to attack. In this paper, we explore a broad class of attacks on clouds which we refer to as cloud squatting. In a cloud squatting attack, an adversary allocates resources in the cloud (e.g., IP addresses) and thereafter leverages latent configu- ration to exploit prior tenants. To measure and categorize cloud squatting we deployed a custom Internet telescope within the Amazon Web Services us-east-1 region. Using this apparatus, we deployed over 3 million servers receiving 1.5 million unique IP addresses (≈ 56% of the available pool) over 101 days beginning in March of 2021. We identified 4 classes of cloud services, 7 classes of third-party services, and DNS as sources of exploitable latent configurations. We discovered that exploitable configurations were both common and in many cases extremely dangerous; we received over 5 million cloud messages, many containing sensitive data such as financial transactions, GPS location, and PII. Within the 7 classes of third-party services, we identified dozens of exploitable software systems spanning hundreds of servers (e.g., databases, caches, mobile applications, and web services). Lastly, we identified 5446 exploitable domains spanning 231 eTLDs—including 105 in the top 10 000 and 23 in the top 1000 popular domains. Through tenant disclosures we have identified several root causes, including (a) a lack of organizational controls, (b) poor service hygiene, and (c) failure to follow best practices. We conclude with a discussion of the space of possible mitigations and describe the mitigations to be deployed by Amazon in response to this study." }, { "id": "ms-thesis-static-instrumentation", "url": "https://xsl.fyi/papers/ms-thesis-static-instrumentation/", "key": "pauley_static_2020", "kind": "thesis", "title": "Static Instrumentation for Performant Binary Fuzzing", "authors": [ "Eric Pauley" ], "year": 2020, "venue": "M.S. thesis, Penn State", "venueLong": "Pennsylvania State University", "topics": [ "systems" ], "featured": false, "links": {} } ]