Publications

2025

”Sorry for bugging you so much.“ Exploring Developers’ Behavior Towards Privacy-Compliant Implementation
Stefan Albert Horstmann, Sandy Hong, David Klein, Raphael Serafini, Martin Degeling, Martin Johns, Veelasha Moonsamy, and Alena Naiakshina
46th IEEE Symposium on Security and Privacy, 2025

HyTrack: Resurrectable and Persistent Tracking Across Android Apps and the Web
Malte Wessels, Simon Koch, Jan Drescher, Louis Bettels, David Klein, and Martin Johns
34th USENIX Security Symposium, 2025 [BIB]

Wemby’s Web: Hunting for Memory Corruption in WebAssembly
Oussama Draissi, Tobias Cloosters, David Klein, Michael Rodler, Marius Musch, Martin Johns, and Lucas Davi
34th ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA), 2025

The Impact of Default Mobile SDK Usage on Privacy and Data Protection
Simon Koch, Manuel Karl, Robin Kirchner, Malte Wessels, Anne Paschke, and Martin Johns
Privacy Enhancing Technologies Symposium (PETS'25), 2025

2024

Don't Patch the Researcher, Patch the Game: A Systematic Approach for Responsible Research via Federated Ethics Boards
Alexandra Dirksen, Sebastian Giessler, Hendrik Erz, Martin Johns, Tobias Fiebig
In Proceedings of the New Security Paradigms Workshop 2024.

Dancer in the Dark: Synthesizing and Evaluating Polyglots for Blind Cross-Site Scripting
Robin Kirchner, Jonas Möller, Marius Musch, David Klein, Konrad Rieck, Martin Johns
Proc. of the 33rd USENIX Security Symposium, 2024, Philadelphia, PA, USA. [USENIX] [Slides] [BIB] [Artifact] [Video]
>>> Distinguished Paper Award Winner <<<

SSRF vs Developers: A Study of SSRF-Defenses in PHP Applications
Malte Wessels*, Simon Koch*, Giancarlo Pellegrino, Martin Johns
Proc. of the 33rd USENIX Security Symposium, 2024, Philadelphia, PA, USA. [USENIX] [Slides] [BIB] [Artifact] [Video]

A Black-Box Privacy Analysis of Messaging Service Providers’ Chat Message Processing
Robin Kirchner, Simon Koch, Noah Kamangar, David Klein, and Martin Johns
Proc. of the 24th Privacy Enhancing Technologies Symposium (PETS), 2024, Bristol, UK. [BIB] [Artifact]

FP-tracer: Fine-grained Browser Fingerprinting Detection via Taint-tracking and Multi-level Entropy-based Thresholds
Soumaya Boussaha, Lukas Hock, Miguel Bermejo, Ruben Cuevas Rumin, Angel Cuevas Rumin, David Klein, Martin Johns, Luca Compagna, Daniele Antonioli, and Thomas Barber
Proc. of the 24th Privacy Enhancing Technologies Symposium (PETS), 2024, Bristol, UK. [BIB]

The Fault in Our Stars: An Analysis of GitHub Stars as an Importance Metric for Web Source Code
Simon Koch, David Klein, and Martin Johns
Workshop on Measurements, Attacks, and Defenses for the Web (MADWeb), 2024. [BIB]

Parse Me, Baby, One More Time: Bypassing HTML Sanitizer via Parsing Differentials
David Klein, Martin Johns
45th IEEE Symposium on Security and Privacy (S&P), 2024. [BIB]

2023

General Data Protection Runtime: Enforcing Transparent GDPR Compliance for Existing Applications
David Klein, Benny Rolle, Thomas Barber, Manuel Karl, Martin Johns
ACM Conference on Computer and Communications Security (CCS), 2023  [BIB]

Poster: The Risk of Insufficient Isolation of Database Transactions in Web Applications
Simon Koch, Malte Wessels, David Klein, Martin Johns
30th ACM Conference on Computer and Communications Security (CCS), 2023  [BIB]

Network Responses to Russia’s Invasion of Ukraine in 2022: A Cautionary Tale for Internet Freedom
Reethika Ramesh, Ram Sundara Raman, Apurva Virkud, Alexandra Dirksen, Armin Huremagic, David Fifield Dirk Rodenburg, Rod Hynes, Doug Madory, Roya Ensafi
USENIX Security Symposium, 2023
>>> Best Practical Paper Award Winner (FOCI'24) <<<

The OK is Not Enough: Large Scale Study of Consent Dialogs in Smartphone Applications
Simon Koch, Benjamin Altpeter, Martin Johns
USENIX Security Symposium, 2023

FUZZILLI: Fuzzing for JavaScript JIT Compiler Vulnerabilities
Samuel Groß, Simon Koch, Lukas Bernhard, Thorsten Holz, Martin Johns 
Network and Distributed System Security (NDSS) Symposium, 2023

2022

Accept All Exploits: Exploring the Security Impact of Cookie Banners
David Klein*, Marius Musch*, Thomas Barber, Moritz Kopmann, and Martin Johns
Proc. of the 37th Annual Computer Security Applications Conference (ACSAC), 2022  [BIB]

No Keys to the Kingdom Required: A Comprehensive Investigation of Missing Authentication Vulnerabilities in the Wild
Manuel Karl*, Marius Musch*, Guoli Ma, Martin Johns, and Sebastian Lekies
Proc. of the 22nd ACM Internet Measurement Conference (IMC), 2022

Keeping Privacy Labels Honest: Developer conformity to self declared data collection via Apple Privacy Labels
Simon Koch, Malte Wessels, Benjamin Altpeter, Madita Olvermann, and Martin Johns
Proc. of the 22nd Privacy Enhancing Technologies Symposium (PETS), 2022

Hand Sanitizers in the Wild: A Large-scale Study of Custom JavaScript Sanitizer Functions
David Klein, Thomas Barber, Souphiane Bensalim, Ben Stock, and Martin Johns
Proc. of the IEEE European Symposium on Security and Privacy (Euro S&P 2022), 2022  [BIB]

Server-Side Browsers: Exploring the Web’s Hidden Attack Surface
Marius Musch, Robin Kirchner, Max Boll, and Martin Johns
Proc. of the 17th ACM Asia Conference on Computer and Communications Security (ASIA CCS), 2022 [BIB]

2021

​​​​​​U Can’t Debug This: Detecting JavaScript Anti-Debugging Techniques in the Wild
Marius Musch and Martin Johns
Proc. of the 30th USENIX Security Symposium, 2021

LogPicker: Strengthening Certificate Transparency Against Covert Adversaries
Alexandra Dirksen, David Klein, Robert Michael, Tilman Stehr, Konrad Rieck and Martin Johns.
Proceedings on Privacy Enhancing Technologies (PETS'21)  [BIB]

Talking About My Generation: Targeted DOM-based XSS Exploit Generation using Dynamic Data Flow Analysis
Souphiane Bensalim, David Klein, Thomas Barber, Martin Johns
Proceedings of the 14th European Workshop on Systems Security (EuroSec '21) [BIB]

Who’s Hosting the Block Party? Studying Third-Party Blockage of CSP and SRI
Marius Steffens, Marius Musch, Martin Johns, and Ben Stock
Network and Distributed System Security Symposium (NDSS),  2021

2020

Towards Enabling Secure Web-based Cloud Services using Client-side Encryption
Martin Johns, Alexandra Dirksen
Proceedings of ACM Workshop on Cloud Computing Security (CCSW’20) [BIB]

Adversarial Preprocessing: Understanding and Preventing Image-Scaling Attacks in Machine Learning
Erwin Quiring, David Klein, Daniel Arp, Martin Johns and Konrad Rieck
Proc. of the 29th USENIX Security Symposium, August 2020 [BIB]

Raccoon: Automated Verification of Guarded Race Conditions in Web Applications
Simon Koch, Tim Sauer, Martin Johns, Giancarlo Pellegrino
Proc. of the 35th ACM/SIGAPP Symposium on Applied Computing (SAC), 2020

Hybrid Taint Analysis for Java EE
Florian D. Loch, Martin Johns, Martin Hecker, Martin Mohr, Gregor Snelting 
Proc. of the 35th ACM/SIGAPP Symposium on Applied Computing (SAC), 2020

2019

Thieves in the Browser: Web-based Cryptojacking in the Wild  *Best Paper Award Runner-up*
Marius Musch, Christian Wressnegger, Martin Johns, and Konrad Rieck
Proc. of 14th Int. Conference on Availability, Reliability and Security (ARES), 2019

ScriptProtect: Mitigating Unsafe Third-Party JavaScript Practices
Marius Musch, Marius Steffens, Sebastian Roth, Ben Stock, and Martin Johns
Proc. of 14th ACM Asia Conference on Computer and Communications Security (ASIACCS), 2019

New Kid on the Web: A Study on the Prevalence of WebAssembly in the Wild  *Best Paper Award Runner-up*
Marius Musch, Christian Wressnegger, Martin Johns, and Konrad Rieck
Proc. of 16th Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA), 2019

Don’t Trust The Locals: Investigating the Prevalence of Persistent Client-Side Cross-Site Scripting in the Wild
Marius Steffens, Christian Rossow, Martin Johns, Ben Stock
Proc. of  26th Network and Distributed System Security Symposium (NDSS'19), February 2019