New Attack Surface in Safari - Using Just One Web Audio Vulnerability to Rule Safari
Explores a novel attack surface in Safari, focusing on vulnerabilities in system libraries like audio. Demonstrates how a single Web Audio vulnerability can be exploited to compromise Safari's security.
The Tangled Webview - Javascriptinterface Once More
Unveils new Android WebView vulnerabilities related to JavascriptInterface, bypassing all verifications. Presents a novel attack model and discusses security implications for mobile app developers.
A Walk Through Historical Correlations Between Vulnerabilities and Stock Prices
Explore the impact of security vulnerabilities and data breaches on stock prices across industries, analyzing recovery patterns and sector-specific effects through historical data analysis.
Analyzing and Fuzzing for Qualcomm Hexagon Processor
Explore techniques for analyzing and fuzzing Qualcomm Hexagon processors, overcoming challenges in firmware analysis, emulation, and hardware-dependent targets for enhanced security research.
In-Field Emulation and Fuzzing of PLCs to Uncover the Next Zero-Day Threat in Industrial Control Systems
Explore innovative techniques for uncovering vulnerabilities in Industrial Control Systems through in-field emulation and fuzzing of PLCs, focusing on proactive security measures beyond network-level exploits.
Manufacturing Hardware Implants from Idea to Mass Production - A Hacker's Journey
Explore the journey of creating and mass-producing hacking devices, from initial concept to final product. Learn about R&D, quality assurance, and manufacturing challenges in hardware development.
Circumventing the Guardians - How the Security Features in State-of-the-Art TLS Inspection Solutions Can Be Exploited for Covert Data Exfiltration
Unveiling a stealthy data exfiltration method that bypasses TLS inspection security solutions. Learn about SNIcat and how it circumvents perimeter defenses, with insights on mitigation and detection strategies.
BinTyper - Type Confusion Detection for C++ Binaries
Explore a novel approach to detect type confusion vulnerabilities in C++ binaries, enhancing software security against malicious code execution attacks.
Jack-in-the-Cache - A New Code Injection Technique through Modifying X86-to-ARM Translation Cache
Explores a novel code injection technique for Windows 10 on ARM, exploiting vulnerabilities in x86-to-ARM translation cache to compromise system security on ARM-based laptops.
FPs Are Cheap - Show Me the CVEs
Evaluating SAST tools: Learn how to assess their effectiveness in finding real vulnerabilities using synthetic test suites and practical examples of CVEs.
Shield with Hole - New Security Mitigation Helps Us Escape Chrome Sandbox to Exfiltrate User Privacy
Explore how new security measures in Chrome can be exploited to bypass the sandbox and compromise user privacy, revealing potential vulnerabilities in browser protection mechanisms.
Graph Convolutional Network-Based Suspicious Communication Pair Estimation for Industrial Control Systems
Explore graph convolutional networks for detecting suspicious communication pairs in industrial control systems, enhancing security monitoring beyond traditional whitelisting methods.
The Subtle Art of Chaining Headers - IKEv2 Attack Surface Case Study
Explore IKEv2 attack surface through header chaining, uncovering vulnerabilities in IPsec VPNs. Learn techniques for identifying and exploiting weaknesses in Internet Key Exchange implementations.
Fingerprint-Jacking - Practical Fingerprint Authorization Hijacking in Android Apps
Practical exploration of fingerprint authorization vulnerabilities in Android apps, demonstrating attack techniques and suggesting mitigation strategies for developers.
Light Commands - Hacking Voice Assistants with Lasers
Explore how lasers can manipulate voice-activated IoT devices, revealing potential security vulnerabilities in smart home technology and microphone systems.
Design Pitfalls in Commercial Mini-Programs on Android and iOS
Explore security vulnerabilities in app-in-app paradigms for Android and iOS, focusing on mini-programs' design flaws and potential risks to user privacy and data protection.
A New Hope - The One Last Chance to Save Your SSD Data
Explore SSD data recovery techniques, uncovering hidden management methods and confidential controller information to maximize chances of retrieving lost data from solid-state drives.
Quantum Security and Cryptography - You Are - Probably - Doing it Wrong
Explore quantum cryptography beyond basic qubit exchange, delving into exotic applications and quantum effects for securing information that traditional cryptography cannot achieve.
My Ticks Don't Lie - New Timing Attacks for Hypervisor Detection
Explore new timing attacks for hypervisor detection, crucial for sandbox evasion in malware analysis. Learn about hardware-assisted virtualization vulnerabilities and low-level measurement techniques.
It's Not Finished - The Evolving Maturity in Ransomware Operations
Explore the evolving sophistication of ransomware operations, focusing on European targets, attack strategies, and the lifecycle of Rival ransomware. Learn about emerging trends and future threats in cybersecurity.
Hermes Attack - Steal DNN Models in AI Privatization Deployment Scenarios
Unveils a novel attack exploiting PCIe bus vulnerabilities to reconstruct DNN models in AI privatization scenarios, discussing challenges, techniques, and countermeasures.