Asem Ghaleb

I work at the intersection of security research and software engineering, taking ideas from problem to production: framing the problem, designing the approach, building it, benchmarking it against the state of the art, and shipping it. At Huawei Technologies Canada, I research and build security detection technologies used in endpoint systems, network gateways, and cloud sandboxes.

What I work on

AI-agent security. Detecting malicious AI-agent skills, a new malware channel where most of the malicious content sits in natural-language instruction files that code scanners cannot read. The engine combines static analysis with an LLM-based semantic judgment stage hardened against prompt injection.
Binary analysis and AI-based malware detection. A binary analysis engine that turns PE and ELF executables into AI-model-ready features, with a custom disassembler and function discovery, used for AV scanning, code similarity, and LLM-assisted analysis.
CPU emulation and dynamic binary translation. Redesigning the antivirus engine’s malware-unpacking emulator from a pure interpreter into a hybrid LLVM-based JIT, making emulation up to 4x faster, plus an offline pre-translation scheme for firewalls and other constrained devices on AMD64 and AArch64.
Program analysis for vulnerability detection. My PhD at the University of British Columbia, with Karthik Pattabiraman and Julia Rubin, built static analysis techniques that find vulnerabilities by reasoning about root causes rather than matching code patterns, applied to Ethereum smart contracts. The work appeared at ICSE and ISSTA, and the tools (SolidiFI, eTainter, AChecker) are open source.

Before the PhD, I completed two security-focused master’s degrees, at the University of Victoria and KFUPM, with research on agentless security monitoring of computing hosts, behavior-based ransomware detection, and the security of SCADA systems, including attacks on live Siemens PLCs. My career began with several years in industry, building core banking software for microfinance institutions and running enterprise databases and ERP systems.

news

Dec 2024	Received the Individual Gold Medal, the highest individual honor at Huawei.
Nov 2024	Promoted to Senior Research Engineer at Huawei Technologies Canada.
May 2024	Received the Chief Expert Golden Network Individual Award at Huawei Technologies Canada.
Nov 2023	Received the Future Star award at Huawei Technologies Canada.
Jul 2023	Completed my Ph.D. at UBC! Thesis: Static Analysis Approaches for Finding Vulnerabilities in Smart Contracts.
Jun 2023	Joined Huawei Technologies Canada in Vancouver as a Research Engineer, working on security detection technologies for endpoint, gateway, and cloud products.
May 2023	Presented our paper `AChecker: Statically Detecting Smart Contract Access Control Vulnerabilities` at ICSE 2023 in Melbourne, Australia.
Feb 2023	Received the `Artifact Evaluated Reusable` and `Artifact Available` badges from the ICSE 2023 Artifact Evaluation for our paper “AChecker: Statically Detecting Smart Contract Access Control Vulnerabilities”!

selected publications

ICSE 2023

AChecker: Statically Detecting Smart Contract Access Control Vulnerabilities

Asem Ghaleb, Julia Rubin, and Karthik Pattabiraman

2023

Abs HTML PDF Code

As most smart contracts have a financial nature and handle valuable assets, smart contract developers use access control to protect assets managed by smart contracts from being misused by malicious or unauthorized people. Unfortunately, programming languages used for writing smart contracts, such as Solidity, were not designed with a permission-based security model in mind. Therefore, smart contract developers implement access control checks based on their judgment and in an ad-hoc manner, which results in several vulnerabilities in smart contracts, called access control vulnerabilities. Further, the inconsistency in implementing access control makes it difficult to reason about whether a contract meets access control needs and is free of access control vulnerabilities. In this work, we propose AChecker – an approach for detecting access control vulnerabilities. Unlike prior work, AChecker does not rely on pre-defined patterns or contract transactions history. Instead, it infers access control implemented in smart contracts via static data-flow analysis. Moreover, the approach performs further symbolic-based analysis to distinguish cases when unauthorized people can obtain control of the contract as intended functionality. We evaluated AChecker on three public datasets of real-world smart contracts, including one which consists of contracts with assigned access control CVEs, and compared its effectiveness with eight analysis tools. The evaluation results showed that AChecker outperforms these tools in terms of both precision and recall. In addition, AChecker flagged vulnerabilities in 21 frequently-used contracts on Ethereum blockchain with 90% precision.
ISSTA 2022

eTainter: Detecting Gas-Related Vulnerabilities in Smart Contracts

Asem Ghaleb, Julia Rubin, and Karthik Pattabiraman

2022

Abs PDF Code Slides

The execution of smart contracts on the Ethereum blockchain consumes gas paid for by users submitting contracts’ invocation requests. A contract execution proceeds as long as the users dedicate enough gas, within the limit set by Ethereum. If insufficient gas is provided, the contract execution halts and changes made during execution get reverted. Unfortunately, contracts may contain code patterns that increase execution cost, causing the contracts to run out of gas. These patterns can be manipulated by malicious attackers to induce unwanted behavior in the targeted victim contracts, e.g., Denial-of-Service (DoS) attacks. We call these gas-related vulnerabilities. We propose eTainter, a static analyzer for detecting gas-related vulnerabilities based on taint tracking in the bytecode of smart contracts. We evaluate eTainter by comparing it with the prior work, MadMax, on a dataset of annotated contracts. The results show that eTainter outperforms MadMax in both precision and recall, and that eTainter has a precision of 90% based on manual inspection. We also use eTainter to perform large-scale analysis of 60,612 real-world contracts on the Ethereum blockchain. We find that gas-related vulnerabilities exist in 2,763 of these contracts, and that eTainter analyzes a contract in eight seconds, on average.
ISSTA 2020

How Effective Are Smart Contract Analysis Tools? Evaluating Smart Contract Static Analysis Tools Using Bug Injection

Asem Ghaleb, and Karthik Pattabiraman

2020

Abs PDF Code Slides

Security attacks targeting smart contracts have been on the rise, which have led to financial loss and erosion of trust. Therefore, it is important to enable developers to discover security vulnerabilities in smart contracts before deployment. A number of static analysis tools have been developed for finding security bugs in smart contracts. However, despite the numerous bug-finding tools, there is no systematic approach to evaluate the proposed tools and gauge their effectiveness. This paper proposes SolidiFI, an automated and systematic approach for evaluating smart contracts’ static analysis tools. SolidiFI is based on injecting bugs (i.e., code defects) into all potential locations in a smart contract to introduce targeted security vulnerabilities. SolidiFI then checks the generated buggy contract using the static analysis tools, and identifies the bugs that the tools are unable to detect (false-negatives) along with identifying the bugs reported as false-positives. SolidiFI is used to evaluate six widely-used static analysis tools, namely, Oyente, Securify, Mythril, SmartCheck, Manticore and Slither, using a set of 50 contracts injected by 9369 distinct bugs. It finds several instances of bugs that are not detected by the evaluated tools despite their claims of being able to detect such bugs, and all the tools report many false positives.
IJCIP

On PLC network security

Asem Ghaleb, Sami Zhioua, and Ahmad Almulhem

International Journal of Critical Infrastructure Protection 2018

Abs HTML

Programmable Logic Controller (PLC) is an important component in modern Industrial Control Systems (ICS) particular in Supervisory Control and Data Acquisition (SCADA) systems. Disturbing the normal operation of PLCs can lead to significant damages ranging from minor annoyance to large scale incidents threatening the life of people. While most of existing work in the SCADA security literature focuses on the communication between PLCs and field devices, this paper presents a network security analysis of the communication between PLCs and the engineering stations in charge of setting up and configuring them. Interestingly, this aspect of SCADA security was exploited by the most famous SCADA attack, namely, Stuxnet. Using a testbed with a common PLC device, we successfully carried out three network attacks leading to serious compromise of typical PLCs.