Publications

@inproceedings{METACRISP:Koch:2026,
author = {Koch, Simon and Hartung, Jannik and Böhme, Rainer and Klein, David},
booktitle = {Workshop on Metascience and Critical Reflections in Security \& Privacy (MetaCRISP)},
doi = {10.1109/SPW72489.2026.00031},
title = {On the Mismatch of Disclosure Practices in Security and Privacy Research},
year = {2026},
}

@inproceedings{USENIX:Schloegel:2025,
author = {Schloegel, Moritz and Klischies, Daniel and Koch, Simon and Klein, David and Gerlach, Lukas and Wessels, Malte and Trampert, Leon and Johns, Martin and Vanhoef, Mathy and Schwarz, Michael and Holz, Thorsten and Van Bulck, Jo},
booktitle = {USENIX Security Symposium},
title = {Confusing Value with Enumeration: Studying the Use of CVEs in Academia},
url = {https://www.usenix.org/conference/usenixsecurity25/presentation/schloegel},
year = {2025},
}

@inproceedings{WOOT:Hartung:2025,
author = {Hartung, Jannik and Koch, Simon and Johns, Martin},
booktitle = {USENIX Conference on Offensive Technologies (WOOT)},
title = {Extract: A PHP Foot-Gun Case Study},
url = {https://www.usenix.org/conference/woot25/presentation/hartung},
year = {2025},
}

@inproceedings{USENIX:Wessels:2025,
author = {Wessels, Malte and Koch, Simon and Dreschner, Jan Niklas and Bettels, Louis and Klein, David and Johns, Martin},
booktitle = {USENIX Security Symposium},
title = {HyTrack: Resurrectable and Persistent Tracking Across Android Apps and the Web},
url = {https://www.usenix.org/conference/usenixsecurity25/presentation/wessels},
year = {2025},
}

@inproceedings{PETS:Koch:2024,
author = {Koch, Simon and Karl, Manuel and Kirchner, Robin and Wessels, Malte and Paschke, Anne and Johns, Martin},
booktitle = {Privacy Enhancing Technologies Symposium (PETS)},
doi = {10.56553/popets-2025-0042},
title = {The Impact of Default Mobile SDK Usage on Privacy and Data Protection},
year = {2025},
}

@inproceedings{ACSAC:Karl:2025,
author = {Karl, Manuel and Koch, Simon and Klein, David and Johns, Martin},
booktitle = {Annual Computer Security Applications Conference (ACSAC)},
doi = {10.1109/ACSAC67867.2025.00061},
title = {Uncovering Bigger Truths: Deobfuscating PHP with Phoebe},
year = {2025},
}

@inproceedings{PETS:Kirchner:2024,
author = {Kirchner, Robin and Koch, Simon and Kamangar, Noah and Klein, David and Johns, Martin},
booktitle = {Privacy Enhancing Technologies Symposium (PETS)},
doi = {10.56553/popets-2024-0099},
title = {{A Black-Box Privacy Analysis of Messaging Service Providers’ Chat Message Processing}},
year = {2024},
}

@inproceedings{USENIX:Wessels:2024,
author = {Wessels, Malte and Koch, Simon and Pellegrino, Giancarlo and Johns, Martin},
booktitle = {USENIX Security Symposium},
doi = {10.5555/3698900.3699279},
title = {SSRF vs Developers: A Study of SSRF-Defenses in PHP Applications},
year = {2024},
}

@inproceedings{MADWeb:Koch:2024,
author = {Koch, Simon and Klein, David and Johns, Martin},
booktitle = {Workshop on Measurements, Attacks, and Defenses for the Web (MADWeb)},
doi = {10.14722/madweb.2024.23004},
title = {{The Fault in Our Stars: An Analysis of GitHub Stars as an Importance Metric for Web Source Code}},
year = {2024},
}

@inproceedings{NDSS:Koch:2023,
author = {Groß, Samuel and Koch, Simon and Bernhardt, Lukas and Holz, Thorsten and Johns, Martin},
booktitle = {Network and Distributed System Security (NDSS) Symposium},
doi = {10.14722/ndss.2023.2429},
selected = {true},
title = {{FUZZILLI: Fuzzing for JavaScript JIT Compiler Vulnerabilities}},
year = {2023},
}

@inproceedings{CCS:Koch:2023,
author = {Koch, Simon and Wessels, Malte and Klein, David and Johns, Martin},
booktitle = {ACM SIGSAC Conference on Computer and Communications Security (CCS)},
doi = {10.1145/3576915.3624394},
title = {{Poster: The Risk of Insufficient Isolation of Database Transactions in Web Applications}},
year = {2023},
}

@inproceedings{USENIX:Koch:2023,
author = {Koch, Simon and Altpeter, Benjamin and Johns, Martin},
booktitle = {USENIX Security Symposium},
isbn = {978-1-939133-37-3},
title = {{The OK is Not Enough: Large Scale Study of Consent Dialogs in Smartphone Applications}},
year = {2023},
}

@inproceedings{PETS:Koch:2022,
author = {Koch, Simon and Wessels, Malte and Altpeter, Benjamin and Olvermann, Madita and Johns, Martin},
booktitle = {Privacy Enhancing Technologies Symposium (PETS)},
doi = {10.56553/popets-2022-0119},
title = {{Keeping Privacy Labels Honest}},
year = {2022},
}

@inproceedings{SAC:Koch:2020,
author = {Koch, Simon and Sauer, Tim and Johns, Martin and Pellegrino, Giancarlo},
booktitle = {ACM SIGAPP Symposium on Applied Computing (SAC)},
doi = {10.1145/3341105.3373855},
title = {{Raccoon: Automated Verification of Guarded Race Conditions in Web Applications}},
year = {2020},
}

@inproceedings{CCS:Pellegrino:2017,
author = {Pellegrino, Giancarlo and Johns, Martin and Koch, Simon and Backes, Michael and Rossow, Christian},
booktitle = {ACM SIGSAC Conference on Computer and Communications Security (CCS)},
doi = {10.1145/3133956.3133959},
title = {{Deemon: Detecting CSRF with dynamic analysis and property graphs}},
year = {2017},
}

@inproceedings{CCS:Backes:2015,
author = {Backes, Michael and Koch, Simon and Meiser, Sebastian and Mohammadi, Esfandiar and Rossow, Christian},
booktitle = {ACM SIGSAC Conference on Computer and Communications Security (CCS)},
doi = {10.1145/2810103.2810115},
title = {{Poster: In the net of the Spider: Measuring the Anonymity-Impact of Network-level Adversaries Against Tor}},
year = {2015},
}