CS 858: Topics on Mobile and IoT Security -- Spring 2026

Syllabus

Catalog Description

Cybercriminals are increasingly targeting mobile and IoT devices. This course examines common framework and application vulnerabilities exploited by adversaries and analyzes the security mechanisms employed by smart-device operating systems—particularly Android—to mitigate these threats. Core topics include access control, IoT security policies, and framework- and application-level security models. The course also explores recent advances in program analysis, as well as modern machine learning approaches, including large language models (LLMs), for assessing and strengthening mobile and IoT security.

Location and Time

  • Wed 1:00pm - 3:50pm in TBD

Instructor

  • Name: Yousra Aafer
  • Email: yaafer AT uwaterloo DOT ca
  • Office hours: By appointment

Course Requirements

The expectations for all CS 858 students are the following:
  1. Participation: Students are expected to attend every class and actively participate in classroom discussions.
  2. Reading: Assigned papers must be read prior to each class.
  3. Weekly Critiques: Each student is required to submit a peer-review-style critique (minimum 400 words) for each assigned paper before it is discussed in class. Each critique should include: (1) a summary of the problem and the paper’s approach, (2) key strengths, (3) weaknesses, (4) potential improvement(s), and (5) questions for class discussion.
  4. Paper Presentation: Each student will present two papers during the semester (approximately 25 minutes each) and lead the corresponding discussion. Additional details will be provided in the introductory session.
  5. Term Project: Students are expected to complete a research project in mobile or IoT security (topics in systems and network security are also acceptable). The primary deliverable is a conference-style paper submitted at the end of the semester. Project topics must be discussed with the instructor within the first three weeks of class. Projects may be completed individually or in pairs. Further details will be provided during the first class.

Paper Selection

Select a paper to present using the signup sheet (link shared via email); selections are first come, first served.

Grading

Component Weight
Paper Presentations 20%
Classroom Participation 15%
Weekly Critique 25%
Final Project 40% (5% for the Progress Presentation, 10% for the Progress Report, 10% for Project Final Presentation, 15% for Project Report and Artifact

Policy for Late Submissions

Late submissions within 72 hours will be graded with 15% penalty for each day. Late submissions beyond 72 hours will not be graded. Exceptions may only be granted case by case with strong evidence presented.

Schedule

(Tentative; specific topics to be covered will be updated soon)
Date Topics Lecture Notes Announcement
13/05 Admin Details, Syllabus and Overview Poirot: Probabilistically Recommending Protections for the Android Framework. (CCS'22)


20/05 Mobile Access Control
(Framework):
Access Control Mappings
AXPlorer: On Demystifying the Android Application Framework: Re-Visiting Android Permission Specification Analysis. (Sec'16)

Bringing Balance to the Force: Dynamic Analysis of the Android Application Framework. (NDSS'21)

27/05
Detecting Vulnerabilities
in Mobile frameworks
Auditing Framework APIs via Inferred App-side Security Specifications. (Sec'23)

FReD: Identifying File Re-Delegation in Android System Services. (Sec'22)

03/06 Mobile App Security Code Speaks Louder: Exploring Security and Privacy Relevant Regional Variations in Mobile Applications (S & P'25)

Understanding Real-world Threats to Deep Learning Models in Android Apps. (CCS'22)

DarkFleece: Probing the Dark Side of Android Subscription Apps. (Sec'24)
Proposal DUE
10/06 Supply Chain
Security
Union under Duress: Understanding Hazards of Duplicate Resource Mismediation in Android Software Supply Chain (Sec'23)

Understanding and Analyzing Privacy Risks in Mobile Consent-Management Platforms. (NDSS'24)

17/06 App-in-App :
Security and Privacy
Uncovering and Exploiting Hidden APIs in Mobile Super Apps (CCS'23)

I Can Tell Your Secrets: Inferring Privacy Attributes from Mini-app Interaction History in Super-apps. (Sec'25)

24/06
Malware detection
Beyond Conventional Triggers: Auto-Contextualized Covert Triggers for Android Logic Bombs. (NDSS'26)

Project Progress Discussion / Presentation
01/07 No Class Canada Day
Project Progress Report DUE 03/07
08/07 Mobile / IoT Privacy:
policies, trackers,
Post-GDPR Threat Hunting on Android Phones: Dissecting OS-level Safeguards of User-unresettable Identifiers.. (NDSS'23)

Are You Spying on Me? Large-Scale Analysis on IoT Data Exposure through Companion Apps. (Sec'23)

15/07 IoT Security:
Evaluation of Security Policies
and Vulnerability Vetting
Understanding IoT Security from a Market-Scale Perspective. (CCS'22)

Android SmartTVs Vulnerability Discovery via Log-Guided Fuzzing. (Sec'21)

22/07 LLMs For:
IoT Security
FirmAgent: Leveraging Fuzzing to Assist LLM Agents with IoT Firmware Vulnerability Discovery. (NDSS'26)

From One Thousand Pages of Specification to Unveiling Hidden Bugs: Large Language Model Assisted Fuzzing of Matter IoT Devices. (Sec'24)

29/07 IoT Security:
Security Enhancement
ARGUS: Context-Based Detection of Stealthy IoT Infiltration Attacks. (Sec'23)

IOTGUARD: Dynamic Enforcement of Security and Safety Policy in Commodity IoT. (NDSS'19)

05/08 Project Presentations Final Report DUE AUG 7