Agenda

Speaker: Valentino Dalla Valle, CISPA

Titolo: Exploring the Potential of Web Platform Tests for Automating the Evaluation of Browser Security Properties

Abstract:
The Web Platform Tests (WPT) project is a cross-browser test suite designed to assess compliance with web platform standards.
It is integrated into the development pipelines of the major web browsers, providing vendors with feedback on specification adherence and cross-browser compatibility.
The suite includes over 50,000 tests, covering a wide range of Topics from HTML and CSS to Web APIs and browser security features.

This presentation will explore how the WPT suite can be leveraged to evaluate security properties within the web stack.
We will examine how the suite was used to automatically identify vulnerabilities in client-side security mechanisms, as demonstrated in the paper "Web Platform Threats: Automated Detection of Web Security Issues with WPT" presented at the 33rd USENIX Security Symposium.
Additionally, we will discuss using the WPT suite to assess browser fingerprintability by running tests under different browser configurations.
Finally, we will explore expanding the Web Platform Threats framework by building a fuzzer that uses tests as seeds and receives dual feedback from the browser and the SMT solver Z3.

Bio Sketch:
Valentino Dalla Valle is a PhD student at CISPA Helmholtz Center for Information Security in Saarbrücken, Germany.
His research focuses on Web security and Privacy with interests in browser fingerprinting and vulnerability detection, as well as the detection of malicious web extensions.
In 2023 he joined the Security and Privacy research group of TU Wien to work as a research assistant.
He previously studied at Cà Foscari University of Venice, where he obtained his Master's degree under the supervision of Prof. Stefano Calzavara.