Demonstration venue · read-only. Every page can be browsed; the buttons that would change it are switched off. Create an account to run TaxoReview on your own data. A simulation from public publication records: the people listed were not invited and did not agree to review.
? Tutorial for this page

Dong-uk Kim

dblp:129/7136 · DBLP profile ↗
← Back
1ranked-venue papers
1as first author
1since 2021 · last 2025
0009-0003-8663-0731ORCID · reported

Domains — the database's venue-derived domains; a paper can count in several

Security and privacy · 1 · 1 first-author · 1 since 2021

Expertise — from the expertise taxonomy: the topics of the expert's papers under the CCF categories. A weight counts papers with recency: 1 for a paper about the topic, 0.3 when the topic is its context, halved every five years.

Network and information security
1 paper
Systems and software security · 100%
Software engineering, system software, and programming languages
1 paper
Empirical software engineering · 100%

Topics — the 4 heaviest of 4, each with the papers that count most for it

TopicWeightPapersLastEvidence papers
Systems and software security
file system security
0.912025
Windows plays Jenga: Uncovering Design Weaknesses in Windows File System Security · CCS 2025
Systems and software security
operating system security
0.912025
Windows plays Jenga: Uncovering Design Weaknesses in Windows File System Security · CCS 2025
Systems and software security › operating system security
privilege escalation
0.912025
Windows plays Jenga: Uncovering Design Weaknesses in Windows File System Security · CCS 2025
Empirical software engineering
developer studies
0.312025
Windows plays Jenga: Uncovering Design Weaknesses in Windows File System Security · CCS 2025

Methods — techniques the papers use, named apart from their topics

user study · 1.7cross-OS comparison · 1.7compatibility layer analysis · 1.7
YearPublicationVenuePosition
2025 Windows plays Jenga: Uncovering Design Weaknesses in Windows File System Security
abstract
File systems are essential components of modern operating systems, with Windows being one of the most dominant platforms. Recently, a series of attacks have exploited the Windows file system to trigger serious security threats such as privilege escalation. Over the past several years, dozens of such attacks have been reported and even exploited in the wild. However, Microsoft has consistently addressed these issues with targeted patches rather than fundamental redesigns — resembling a precarious game of Jenga where security measures are stacked upon an unstable foundation. In this paper, we present a five-step comprehensive analysis of the Windows file system's design weaknesses. First, we analyze how Windows differs from another operating system, Linux. Second, we investigated how these discrepancies lead to security vulnerabilities in real-world applications and identified 13 high-impact vulnerabilities, including 11 previously unknown ones. Third, we show that current compatibility layers in modern programming languages fail to handle these discrepancies properly. Specifically, we examined compatibility layers in six programming languages and found 27 non-compliant and 9 inconsistencies, rendering these layers unreliable. Fourth, through a user study involving 21 experienced developers, we found that most were unfamiliar with OS-level file system discrepancies and rarely implemented appropriate mitigations. Finally, we analyze existing countermeasures and discuss their limitations. Our findings reveal critical yet largely obscured security risks resulting from design flaws in the Windows file system. Furthermore, we suggest that Microsoft rethink its strategy and address these fundamental weaknesses.
Dong-uk Kim, Sanghak Oh, Hyoungshick Kim, Insu Yun
CCS1