@String{MADWeb="Workshop on Measurements, Attacks, and Defenses for the Web (MADWeb)"}
@String{PETS="Privacy Enhancing Technologies Symposium (PETS)"}
@STRING{CCS="ACM SIGSAC Conference on Computer and Communications Security (CCS)"}
@STRING{USENIXSEC="USENIX Security Symposium"}
@STRING{NDSS="Network and Distributed System Security (NDSS) Symposium"}
@STRING{SAC="ACM SIGAPP Symposium on Applied Computing (SAC)"}
@STRING{WOOT="USENIX Conference on Offensive Technologies (WOOT)"}
@STRING{ACSAC="Annual Computer Security Applications Conference (ACSAC)"}
@string{MetaCRISP = "Workshop on Metascience and Critical Reflections in Security & Privacy (MetaCRISP)"}

@inproceedings{METACRISP:Koch:2026,
   title       = {On the Mismatch of Disclosure Practices in Security and Privacy Research},
   author      = {Koch, Simon and Hartung, Jannik and Böhme, Rainer and Klein, David},
   year        = {2026},
   booktitle   = MetaCRISP,
   doi         = {10.1109/SPW72489.2026.00031}
}

@inproceedings{ACSAC:Karl:2025,
   title       = {Uncovering Bigger Truths: Deobfuscating PHP with Phoebe},
   author      = {Karl, Manuel and Koch, Simon and Klein, David and Johns, Martin},
   year        = {2025},
   booktitle   = ACSAC,
   doi         = {10.1109/ACSAC67867.2025.00061}
}

@inproceedings{WOOT:Hartung:2025,
   title       = {Extract: A PHP Foot-Gun Case Study},
   author      = {Hartung, Jannik and Koch, Simon and Johns, Martin},
   year        = {2025},
   booktitle   = WOOT,
   url         = {https://www.usenix.org/conference/woot25/presentation/hartung},
}

@inproceedings{USENIX:Schloegel:2025,
   title       = {Confusing Value with Enumeration: Studying the Use of CVEs in Academia},
   author      = {Schloegel, Moritz and Klischies, Daniel and Koch, Simon and Klein, David and Gerlach, Lukas and Wessels, Malte and Trampert, Leon and Johns, Martin and Vanhoef, Mathy and Schwarz, Michael and Holz, Thorsten and Van Bulck, Jo},
   year        = {2025},
   booktitle   = USENIXSEC,
   url         = {https://www.usenix.org/conference/usenixsecurity25/presentation/schloegel}
}

@inproceedings{USENIX:Wessels:2025,
   title       = {HyTrack: Resurrectable and Persistent Tracking Across Android Apps and the Web},
   author      = {Wessels, Malte and Koch, Simon and Dreschner, Jan Niklas and Bettels, Louis and Klein, David and Johns, Martin},
   year        = {2025},
   booktitle   = USENIXSEC,
   url         = {https://www.usenix.org/conference/usenixsecurity25/presentation/wessels},
}

@inproceedings{PETS:Koch:2024,
   title       = {The Impact of Default Mobile SDK Usage on Privacy and Data Protection},
   author      = {Koch, Simon and Karl, Manuel and Kirchner, Robin and Wessels, Malte and Paschke, Anne and Johns, Martin},
   booktitle   = PETS,
   year        = {2025},
   doi         = {10.56553/popets-2025-0042}
}

@inproceedings{USENIX:Wessels:2024,
   title       = {SSRF vs Developers: A Study of SSRF-Defenses in PHP Applications},
   author      = {Wessels, Malte and Koch, Simon and Pellegrino, Giancarlo and Johns, Martin},
   booktitle   = USENIXSEC,
   year        = {2024},
   doi         = {10.5555/3698900.3699279}
}

@inproceedings{PETS:Kirchner:2024,
   title       = {{A Black-Box Privacy Analysis of Messaging Service Providers’ Chat Message Processing}},
   author      = {Kirchner, Robin and Koch, Simon and Kamangar, Noah and Klein, David and Johns, Martin},
   booktitle   = PETS,
   year        = {2024},
   doi         = {10.56553/popets-2024-0099}
}

@inproceedings{MADWeb:Koch:2024,
  title        = {{The Fault in Our Stars: An Analysis of GitHub Stars as an Importance Metric for Web Source Code}},
  author       = {Koch, Simon and Klein, David and Johns, Martin},
  booktitle    = MADWeb,
  year         = {2024},
  doi          = {10.14722/madweb.2024.23004}
}

@inproceedings{CCS:Koch:2023,
 title         = {{Poster: The Risk of Insufficient Isolation of Database Transactions in Web Applications}},
 author        = {Koch, Simon and Wessels, Malte and Klein, David and Johns, Martin},
 booktitle     = CCS,
 year          = {2023},
 doi           = {10.1145/3576915.3624394}
}

@inproceedings{USENIX:Koch:2023,
 title        = {{The OK is Not Enough: Large Scale Study of Consent Dialogs in Smartphone Applications}},
 author       = {Koch, Simon and Altpeter, Benjamin and Johns, Martin},
 booktitle    = USENIXSEC,
 isbn         = {978-1-939133-37-3},
 year         = {2023}
}


@inproceedings{NDSS:Koch:2023,
 title        = {{FUZZILLI: Fuzzing for JavaScript JIT Compiler Vulnerabilities}},
 author       = {Groß, Samuel and Koch, Simon and Bernhardt, Lukas and Holz, Thorsten and Johns, Martin},
 booktitle    = NDSS,
 year         = {2023},
 selected     = {true},
 doi          = {10.14722/ndss.2023.2429}
}

@inproceedings{PETS:Koch:2022,
 title        = {{Keeping Privacy Labels Honest}},
 author       = {Koch, Simon and Wessels, Malte and Altpeter, Benjamin and Olvermann, Madita and Johns, Martin},
 booktitle    = PETS,
 year         = {2022},
 doi          = {10.56553/popets-2022-0119},
}

@inproceedings{SAC:Koch:2020,
 title        = {{Raccoon: Automated Verification of Guarded Race Conditions in Web Applications}},
 author       = {Koch, Simon and Sauer, Tim and Johns, Martin and Pellegrino, Giancarlo},
 booktitle    = SAC,
 year         = {2020},
 doi          = {10.1145/3341105.3373855}
}

@inproceedings{CCS:Pellegrino:2017,
 title        = {{Deemon: Detecting CSRF with dynamic analysis and property graphs}},
 author       = {Pellegrino, Giancarlo and Johns, Martin and Koch, Simon and Backes, Michael and Rossow, Christian},
 booktitle    = CCS,
 year         = {2017},
 doi          = {10.1145/3133956.3133959}
}

@inproceedings{CCS:Backes:2015,
 title        = {{Poster: In the net of the Spider: Measuring the Anonymity-Impact of Network-level Adversaries Against Tor}},
 author       = {Backes, Michael and Koch, Simon and Meiser, Sebastian and Mohammadi, Esfandiar and Rossow, Christian},
 booktitle    = CCS,
 doi          = {10.1145/2810103.2810115},
 year         = {2015}
}