Victor van der Veen

Hi. I am an engineer in Qualcomm's Product Security Initiative (QPSI) and you reached my personal homepage. Prior to joining Qualcomm, I obtained my PhD cum laude in the VUSec group at Vrije Universiteit Amsterdam. I use this page as an archive to keep track of my publications - including slides, if available - and other cool stuff.

Publications

Conferences & Workshops

• Pietro Frigo, Emanuele Vannacci, Hasan Hassan, Victor van der Veen, Onur Mutlu, Cristiano Giuffrida, Herbert Bos, and Kaveh Razavi, TRRespass: Exploiting the Many Sides of Target Row Refresh, In Proceedings of the 41^st Symposium on Security and Privacy (S&P 2020) [PDF|BibTex]
  Best paper award!
• Andre Pawlowski, Victor van der Veen, Dennis Andriesse, Erik van der Kouwe, Thorsten Holz, Cristiano Giuffrida, and Herbert Bos, VPS: Excavating High-Level C++ Constructs from Low-Level Binaries to Protect Dynamic Dispatching, In Proceedings of the 35^th Annual Computer Security Applications Conference (ACSAC 2019) [PDF|BibTex]
• Victor van der Veen, Martina Lindorfer, Yanick Fratantonio, Harikrishnan Padmanabha Pillai, Giovanni Vigna, Christopher Kruegel, Herbert Bos, and Kaveh Razavi, GuardION: Practical Mitigation of DMA-based Rowhammer Attacks on ARM, in Proceedings of the 15^th Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA 2018) [PDF|BibTex|PPTX|website]
• Victor van der Veen, Dennis Andriesse, Manolis Stamatogiannakis, Xi Chen, Herbert Bos, and Cristiano Giuffrida, The Dynamics of Innocent Flesh on the Bone: Code Reuse Ten Years Later, in Proceedings of the 24^th Conference on Computer and Communications Security (CCS 2017) [PDF|BibTex|PPTX]
• Andre Pawlowski, Moritz Contag, Victor van der Veen, Chris Ouwehand, Thorsten Holz, Herbert Bos, Elias Athanasopoulos, and Cristiano Giuffrida, MARX: Uncovering Class Hierarchies in C++ Programs, in Proceedings of the 24^th Annual Network and Distributed System Security Symposium (NDSS 2017) [PDF|BibTex]
• Victor van der Veen, Yanick Fratantonio, Martina Lindorfer, Daniel Gruss, Clémentine Maurice, Giovanni Vigna, Herbert Bos, Kaveh Razavi, and Cristiano Giuffrida, Drammer: Deterministic Rowhammer Attacks on Mobile Platforms, in Proceedings of the 23^rd Conference on Computer and Communications Security (CCS 2016) [PDF|BibTex|Slides|PPTM|github|VUSec]
  Nominated for, and won the Dutch Cyber Security Research best paper (DCSRP) Award 2017!
  I presented extended/modified versions of Drammer - sometimes in combination with Flip Feng Shui and Dedup Est Machina, and sometimes together with Kaveh - at the SURF Security- en Privacyconferentie in Wageningen (February 2017 | pptm), at the KPN Guest Hacker Program in The Hague (February 2017 | pptm), at the 2^nd Android Security Symposium in Vienna (March 2017 | pptm), at 7^th edition of Awesome IT in Amsterdam (April 2017 | pptm), at Hack in the Box in Amsterdam (April 2017 | pptm), and at NCSC One in The Hague (May 2017 | pptm).
• Dennis Andriesse, Xi Chen, Victor van der Veen, Asia Slowinska, and Herbert Bos, An In-Depth Analysis of Disassembly on Full-Scale x86/x64 Binaries, in Proceedings of the 25^th USENIX Security Symposium (USENIX Sec 2016) [PDF|BibTeX|Slides|VUSec]
• Victor van der Veen, Enes Göktaş (joint first author), Moritz Contag, Andre Pawloski, Xi Chen, Sanjay Rawat, Herbert Bos, Thorsten Holz, Elias Athanasopoulos, and Cristiano Giuffrida, A Tough call: Mitigating Advanced Code-Reuse Attacks At The Binary Level, in Proceedings of the 37^th Symposium on Security and Privacy (S&P 2016) [PDF|BibTeX|Slides|Video]
• Radhesh Krishnan Konoth, Victor van der Veen (joint first author), and Herbert Bos, How Anywhere Computing Just Killed Your Phone-Based Two-Factor Authentication, in Proceedings of the 20^th Conference on Financial Cryptography and Data Security (FC 2016) [PDF|BibTeX|VUSec]
  I presented BAndroid at the 1^st Android Security Sympsoium in Vienna (September 2015) and later during the Black Hat Sessions XIV in Ede (June 2016 | interview).
• Alberto Coletta, Victor van der Veen, and Federico Maggi, DroydSeuss: A Mobile Banking Trojan Tracker - Short Paper, in Proceedings of the 20^th Conference on Financial Cryptography and Data Security (FC 2016) [PDF|BibTeX|droydseuss]
• Victor van der Veen, Dennis Andriesse (joint first author), Enes Göktaş, Ben Gras, Lionel Sambuc, Asia Slowinska, Herbert Bos, and Cristiano Giuffrida, Practical Context-Sensitive CFI, in Proceedings of the 22nd Conference on Computer and Communications Security (CCS 2015) [PDF|BibTeX|Slides|github|VUSec]
  Nominated for the Dutch Cyber Security Research Award 2016
• Martina Lindorfer, Matthias Neugschwandtner, Lukas Weichselbaum, Yanick Fratantonio, Victor van der Veen, and Christian Platzer, ANDRUBIS - 1,000,000 Apps Later: A View on Current Android Malware Behaviors, in Proceedings of the 3^rd International Workshop on Building Analysis Datasets and Gathering Experience Returns for Security (BADGERS 2014) [PDF|BibTeX|Slides]
• Sebastian Neuner, Victor van der Veen, Martina Lindorfer, Markus Huber, Georg Merzdovnik, Martin Mulazzani, and Edgar Weippl, Enter Sandbox: Android Sandbox Comparision, in Proceedings of the IEEE Mobile Security Technologies Workshop (MoST 2014) [PDF|BiBTeX]
• Victor van der Veen, Nitish dutt-Sharma, Lorenzo Cavallaro, and Herbert Bos, Memory Errors: The Past, the Present, and the Future, in Proceedings of the 15h International Symposium on Research in Attacks, Intrusions, and Defenses (RAID 2012) [PDF|BibTeX|Prezi|github|Trends]

Technical Reports and Theses

• Victor van der Veen, When Memory Serves Not So Well: Memory errors 30 years later, PhD Thesis, Vrije Universiteit Amsterdam, October 2019 [PDF|BibTex|VU]
  Awarded cum laude!
• Lukas Weichselbaum, Matthias Neugschwandtner, Martina Lindorfer, Yanick Fratantonio, Victor van der Veen, and Christian Platzer, Andrubis: Android Malware Under The Magnifying Glass, Technical Report TR-ISECLAB-0414-001, Vienna University of Technology, April 2014 [PDF|BibTex]
• Victor van der Veen, Dynamic Analysis of Android Malware, MSc. Thesis, Vrije Universiteit Amsterdam, August 2013 [PDF|BibTex|Prezi]
  I presented my work at the Hack in the Box security conference in October 2013 and gave an invited talk about it at the OWASP Benelux day in November 2013.
• Victor van der Veen, A Scrutiny of Frederickson's Distributed Breadth-First Search Algorithm, BSc. Thesis, Vrije Universiteit Amsterdam, September 2008 [PDF|BibTex|Slides]

Projects

Research

• Our work on deterministic Rowhammer attacks on mobile platforms - a.k.a., Drammer (PDF) - was shown on Dutch television, covered by popular media (including ArsTechnica and WIRED), and ultimately won the Dutch Cyber Security Research Paper award! You can find more details on our Drammer project page or inspect the source code at github.
• Our work on how Google silently killed two-factor authentication generated some (international) interest and was picked up by several media. You can find a detailed story on our BAndroid project page.
• I did a small write-up on hooking system calls on x86_64 by overwriting the MSR_LSTAR register.
• TraceDroid used to be a dynamic analysis tool for Android apps and was the result of my Master thesis. The webpage allowed researchers to submit unknown Android applications (.apk files) for automated analysis. Results include, among others, a complete method trace of the targetted application as observed during runtime, network traffic and a visualized call graph of the application. The online submission system is unfortunately no longer available, but you can still have a look at example output for the OBAD malware here.
• As part of our Memory Errors paper, I crafted a web page that shows trends in reported vulnerabilities and exploits and it is open source!
• In the past, I did some work on implementing incremental packet writing support for MINIX 3 that allows you to write lots of data to a writable CD or DVD over a long period in time. The implementation was specifically designed to be used within a voting machine setup, but some people may still find the final document useful.

Teaching

• Teaching Assistent during the Hardware Security course (fall 2018).
• Teaching Assistent and responsible for the web challenges during the Computer & Network Security course (spring 2015, spring 2016, fall 2016, fall 2017).
• Teaching Assistent during the Secure Software course (fall 2016, fall 2017).
• Teaching Assistent during the Academic English course (spring 2015).
• Local Chair and co-author of the practical assignments during the 2nd SysSec Summerschool: Two Days of Android Malware Reverse Engineering in Amsterdam (September 2014).

Personal

• VUdraadloos is a tiny website that helps students and employees of Vrije Universiteit Amsterdam to connect their mobile device to the university's wireless networks. In addition, I also wrote a tiny Android app to ease the VU wireless setup for Android devices.