Yuchen Zhou's research

This is Yuchen Zhou, currently working at Palo Alto Networks as a senior web security researcher. I earned my Doctoral degree at University of Virginia, under advisor Prof. David Evans, with dissertation titled: Improving Security and Privacy of Integrated Web Applications.

Most of my Ph.D work are focused on improving the security and privacy of web application/third-party service. My internship mentor at Microsoft Research is Dr. Shuo Chen. I have so far published five first-author papers, four of which in top-tier conferences such as IEEE S&P (Oakland) and USENIX. For more details, please click on individual projects on the left side, or browse down the page for a brief introduction on each project.

The ScriptInspector project helps web developers understand and monitor the behavior of embedded third-party JavaScripts on their websites. The instrumented Firefox browser records access to sensitive resources and visualizes them to web developers. Policy can be generated and enforced on popular scripts to rein in their runtime behavior.

Our paper appeared at Oakland (IEEE Security & Privacy) 2015.

SSOScan is an automated scanner of web applications for Single Sign-On (SSO) vulnerabilities. This tool requires no user interaction and revealed more than 300 authentication/authorization implementation bugs in high profile websites. Our paper is published at the 23rd USENIX Security Symoposium (2014).

The goal of Explicating SDKs project is to systematically uncover implicit assumptions that are important to applications' security properties, this work is published at the 22nd USENIX Security Symposium (2013). I did this project while I interned at Microsoft Research, and I had the great honor to work with two excellent researchers Shuo Chen (my mentor) and Rui Wang (my co-first author).

The goal of DOMinator is to build a browser that can enforce fine-grained access control policies for third-party JavaScripts. This work is published at ESORICS 11'.

This short paper is presented at W2SP 10' (co-hosted with Oakland 10'), and I looked at the history and current status of how well HTTP-only cookies are deployed, and give some suggestions about how future security works can improve themselves to achieve a higher deploy rate.