Analyzing the Feasibility and Generalizability of Fingerprinting Internet of Things Devices

Dilawer Ahmed, Anupam Das, and Fareed Zaffar

[Code] [Paper]

Watching the Watchers: Practical Video Identification Attack in LTE Networks

Sangwook Bae, Mincheol Son, Dongkwan Kim, CheolJun Park, Jiho Lee, Sooel Son, and Yongdae Kim

[Website] [Paper] [Video]

Can one hear the shape of a neural network?: Snooping the GPU via Magnetic Side Channel

Henrique Teles Maia, Chang Xiao, Dingzeyu Li, Eitan Grinspun, and Changxi Zheng

[Slides] [Paper]

LTrack: Stealthy Tracking of Mobile Phones in LTE

Martin Kotuliak, Simon Erni, Patrick Leu, Marc Röschlin, and Srdjan Čapkun

[Slides] [Paper]

IRMA's Idemix core: Understanding the crypto behind selective, unlinkable attribute disclosure

Maja Reissner and Sietse Ringers

[Site] [Code] [Video]

CryptPad: a zero knowledge collaboration platform

Ludovic Dubost

[Code] [Video] [Site]

drand: publicly verifiable randomness explained

Yolan Romailler

[Video] [Code]

A dead man’s full-yet-responsible-disclosure system

Yolan Romailler

[Slides] [Code]

Oops... Code Execution and Content Spoofing: The First Comprehensive Analysis of OpenDocument Signatures

Simon Rohlmann, Christian Mainka, Vladislav Mladenov, and Jörg Schwenk

[Slides] [Paper]

My data in your signed code

Alex Ivkin

[Code] [Video]

Can You Trust a File’s Digital Signature? New Zloader Campaign exploits Microsoft’s Signature Verification

Golan Cohen

[Video] [Blog]

TLS-Anvil: Adapting Combinatorial Testing for TLS Libraries

Marcel Maehren, Philipp Nieting, Sven Hebrok, Robert Merget, Juraj Somorovsky, Jörg Schwenk

[Slides] [Website] [Code]

Arbiter: Bridging the Static and Dynamic Divide in Vulnerability Discovery on Binary Programs

Jayakrishna Vadayath, Moritz Eckert, Kyle Zeng, Nicolaas Weideman, Gokulkrishna Praveen Menon, Yanick Fratantonio, Davide Balzarotti, Adam Doupé, Tiffany Bao, Ruoyu Wang, Christophe Hauser, and Yan Shoshitaishvili

[Paper] [Code]

In Need of 'Pair' Review: Vulnerable Code Contributions by GitHub Copilot

Hammond Pearce, Benjamin Tan, Brendan Dolan-Gavitt, and Baleegh Ahmad

[Slides] [Paper]

Catch Me If You Can: Deterministic Discovery of Race Conditions with Fuzzing

Ned Williamson

[Slides] [Code]

Someone’s Been Messing With My Subnormals!

Brendan Dolan-Gavitt

[Blog]

Attacking AAD by abusing the Sync API: The story behind $40K in bounties

Nestori Syynimaa

[Slides] [Code] [Video]

Towards a Tectonic Traffic Shift? Investigating Apple’s New Relay Network

Patrick Sattler , Juliane Aulbach , Johannes Zirngibl , Georg Carle

 [Paper] 

Hiding malware in Docker Desktop's secret virtual machine

Alex Hope

[Blog] [Video]

Let's Dance in the Cache - Destabilizing Hash Table on Microsoft IIS

Orange Tsai

[Slides] [Blog]

Using Trātṛ to tame Adversarial Synchronization

Yuvraj Patel, Chenhao Ye, Akshat Sinha, Abigail Matthews, Andrea C. Arpaci-Dusseau, Remzi H. Arpaci-Dusseau, and Michael M. Swift

[Slides] [Paper]

I am become loadbalancer, owner of your network

Nate Warfield

[Slides]

Evil Never Sleeps: When Wireless Malware Stays On After Turning Off iPhones

Jiska Classen, Alexander Heinrich, Robert Reith, and Matthias Hollick

[Slides] [Paper]

AirTag of the Clones: Shenanigans with Liberated Item Finders

Thomas Roth, Fabian Freyer, Matthias Hollick, and Jiska Classen

[Paper] [Code]

Are Blockchains Decentralised?

Evan Sultanik, Alexander Remie, Felipe Manzano, Trent Brunson, Sam Moelius, Eric Kilmer, Mike Myers, Talley Amir, and Sonya Schriner

[Blog] [Paper] [Audio]

What Log4j teaches us about the Software Supply Chain

Stephen Magill

[Slides] [Video]

Kani Rust Verifier

Daniel Schwartz-Narbonne and Zyad Hassan

[Slides] [Video] [Code]

Cross-Language Attacks

Samuel Mergendahl, Nathan Burow, and Hamed Okhravi

[Paper]

Software Updates Strategies: A Quantitative Evaluation Against Advanced Persistent Threats

Giorgio Di Tizio, Michele Armellini, and Fabio Massacci

[Paper] [Data]

AMD Secure Processor for Confidential Computing Security Review

Cfir Cohen, James Forshaw, Jann Horn, and Mark Brand

[Blog] [Paper]

Living Off the Walled Garden: Abusing the Features of the Early Launch Antimalware Ecosystem

Matt Graebar

[Slides]

A Kernel Hacker Meets Fuchsia OS

Alexander Popov

[Blog] [Video]

Adaptive Multi-objective Optimization in Gray-box Fuzzing

Gen Zhang, Pengfei Wang, Tai Yue, Xiangdong Kong, Shan Huang, Xu Zhou, and Kai Lu

[Paper]

Cooper Knows the Shortest Stave: Finding 134 Bugs in the Binding Code of Scripting Languages with Cooperative Mutation

Xu Peng, Yanhao Wang, Hong Hu, and Purui Su

[Slides] [Paper] [Code]

Bypassing CSP with dangling iframes

Gareth Heyes

[Blog] 

Bypassing Dangling Markup Injection Mitigation Bypass in Chrome

SeungJu Oh

 [Bug report] [Blog]

Pre-hijacked accounts: An Empirical Study of Security Failures in User Account Creation on the Web

Avinash Sudhodanan and Andrew Paverd

[Blog] [Paper]

Hyntrospect: a fuzzer for Hyper-V devices

Diane Dubois

[Slides] [Paper] [Code] [Video]

Put an io_uring on it: Exploiting the Linux Kernel

Valentina Palmiotti

[Blog]

The AMD Branch (Mis)predictor: Where No CPU has Gone Before

Pawel Wieczorkiewicz

[Blog part 1] [Blog part 2]

Dynamic Process Isolation

Martin Schwarzl, Pietro Borrello, Andreas Kogler, Kenton Varda, Thomas Schuster, Daniel Gruss, and Michael Schwarz

[Paper]

Another Brick in the Wall: Uncovering SMM Vulnerabilities in HP Firmware

Itai Liba, and Assaf Carlsbad

[Blog] [Code]

Confidential Containers: Bringing Confidential Computing to the Kubernetes Workload Masses

Samuel Ortiz

[Video]

Kubernetes Meets Confidential Computing - The Different Ways of Scaling Sensitive Workloads

Moritz Eckert

[Video]

Implementing Post-quantum Cryptography for Developers

Julius Hekkala, Kimmo Halunen, and Visa Vallivaara

[Paper]

CMUA-Watermark: A Cross-Model Universal Adversarial Watermark for Combating Deepfakes

Hao Huang, Yongtao Wang, Zhaoyu Chen, Yu Ze Zhang, Yuheng Li, Zhi Tang, Wei Chu, Jingdong Chen, Weisi Lin, and Kai-Kuang Ma

[Paper] [Code]

Leashing the Inner Demons: Self-Detoxification for Language Models

Canwen Xu, Zexue He, Zhankui He, and Julian McAuley

[Paper] [Code]

Fooling the Eyes of Autonomous Vehicles: Robust Physical Adversarial Examples Against Traffic Sign Recognition Systems

Wei Jia, Zhaojun Lu, Haichun Zhang, Zhenglin Liu, Jie Wang, and Gang Qu

[Paper]

Synthetic Disinformation Attacks on Automated Fact Verification Systems

Yibing Du, Antoine Bosselut, Christopher D. Manning

[Paper]

Why No One Pwned Synology at Pwn2Own and Tianfu Cup in 2021

Eugene Lim, and Loke Hui Yi

[Slides]

DRAWN APART: A Device Identification Technique based on Remote GPU Fingerprinting

Tomer Laor, Naif Mehanna, Antonin Durey, Vitaly Dyadyuk, Pierre Laperdrix, Clémentine Maurice, Yossi Oren, Romain Rouvoy, Walter Rudametkin, and Yuval Yarom

[Paper] [Code]

Attacking JavaScript Engines in 2022

Samuel Groß, and Amanda Burnett

[Slides]

Security Analysis of MTE Through Examples

Saar Amar

[Slides] [Video]

An Armful of CHERIs

Saar Amar, Nicholas Joly, David Chisnall, Manuel Costa, Sylvan Clebsch, Wes Filardo, Boris Köpf, Robert Norton-Wright, and Matthew Parkison

[Blog]

Sponge Examples: Energy-Latency Attacks on Neural Networks

Ilia Shumailov, Yiren Zhao, Daniel Bates, Nicolas Papernot, Robert Mullins, and Ross Anderson

[Slides] [Paper] [Video]

How to Use Cheated Cryptography to Overload a Server

Szilárd Pfeiffer

[Slides]

Bestie: Very Practical Searchable Encryption with Forward and Backward Security

Tuanyang Chen, Peng Xu, Wei Wang, Yubo Zheng, Willy Susilo, and Hai Jin

[Paper]

Symgrate: A Symbol Recovery Service for ARM Firmware

Travis Goodspeed & EVM

[Site] 

From Graph Queries to Vulnerabilities in Binary Code

claudiu, fabs, and niko

[Slides]

Fast verified post-quantum software

Daniel J. Bernstein

[Slides]

AIModel-Mutator: Finding Vulnerabilities in TensorFlow

Qian Feng, Zhaofeng Chen, Zhenyu Zhong, Yakun Zhang, Ying Wang, Zheng Huang, Kang Li, Jie Hu and Heng Yin

[Slides]

DAMAS: Control-Data Isolation at Runtime through Dynamic Binary Modification

Camille Le Bon, Erven Rohou, Frederic Tronel, and Guillaume Hiet

[Paper]

Trojan Source: Invisible Vulnerabilities

Nicholas Boucher and Ross Anderson

[Paper] [Code]

Who owns your hybrid Active Directory? Hunting for adversary techniques!

Thirumalai Natarajan Muthiah & Anurag Khanna

[Paper]

Breaking Azure AD joined endpoints in zero-trust environments

Dirk-jan Mollema

[Slides] [Video]

Going Deeper into Schneider Modicon PAC Security

Gao Jian

[Slides] [Video]

New Ways of IPv6 Scanning

Shupeng Gao, Xingru Wu, and Jie Gao

[Slides]

DIY cheap gigabit data diode

Magnus

[Code]

Bridge your service mesh and AWS

Santosh Ananthakrishnan & Harihara K Narayanan

[Slides]

GALILEO: In GPS We Trust?

Áron Szabó, Levente Kovács, and Péter Ligeti

[Slides]

“We wait, because we know you.” Inside the ransomware negotiation economics.

Pepijn Hack & Harihara K Narayanan

[Paper]

Privacy of DNS-over-HTTPS: Requiem for a dream?

Levente Csikor, Himanshu Singh, Min Suk Kang, and Dinil Mon Divakaran

[Slides] 

Sleight of ARM: Demystifying Intel Houdini

Brian Hong

[Slides] [Video]

IntroductionEpisode 1 - 2021/Q3

Thinkst Trends and Takeaways is a show released in conjunction with ThinkstScapes, a written quarterly review of information security research published in both industry and academic venues. Thinkst Labs allocates time to tracking industry research so you don’t have to, specifically looking for novel and unusual work that is impactful--this is not simply a report on bugs or vulnerabilities. Work covered here will include both offensive and defensive topics, and we explore academic publications with the same gusto as industry work. Our target listeners are primarily security practitioners in organizations who are tasked with defending their turf, but offensive-minded folks will also be exposed to new ideas and research we’ve come across.

Full bibliography of referenced works:

Embedded security research

• Precursor: Towards Evidence-Based Trust in Hardware
  • Andrew ‘bunnie’ Huang
  • [Video]
• Kernel Pwning with eBPF: a Love Story
  • Valentina Palmiotti (@chompie1337)
  • [Paper]
• InternalBlue / Frankenstein / Spectra
  • Jan Ruge, Jiska Classen, Francesco Gringoli, and Matthias Hollick
  • [Slides] [Slides] [Video]
• HALucinator: Firmware Re-hosting Through Abstraction Layer Emulation
  • Abraham Clements, Eric Gustafson, Tobias Scharnowski, Paul Grosen, David Fritz, Christopher Kruegel, Giovanni Vigna, Saurabh Bagchi, and Mathias Payer
  • [Slides] [Paper] [Video]
• Device-agnostic Firmware Execution is Possible: A Concolic Execution Approach for Peripheral Emulation
  • Chen Cao, Le Guan, Jiang Ming, and Peng Liu
  • [Paper]
• Remote Timing Attacks on TPMs, AKA TPM-Fail
  • Daniel Moghimi
  • [Slides]
• Breaking VSM by Attacking SecureKernel
  • Saar Amar and Daniel King
  • [Slides]
• Whispers Among the Stars: Perpetrating (and Preventing) Satellite Eavesdropping Attacks
  • James Pavur
  • [Slides] [Video]

Exploiting 'Differences of opinion'

• HTTP/2: The Sequel is Always Worse
  • James Kettle
  • [Paper]
• Differential Fuzzing of x86-64 Instruction Decoders
  • William Woodruff, Niki Carroll, and Sebastiaan Peters
  • [Paper] [Video]
• EtherOops: Exploring Practical Methods to Exploit Ethernet Packet-in-Packet Attacks
  • Ben Seri, Gregory Vichnepolsky, and Yevgeny Yusepovsky
  • [Slides] [Paper]
• Light Commands: Laser-Based Audio Injection on Voice-Controllable Systems
  • Takeshi Sugawara, Benjamin Cyr, Sara Rampazzi, Daniel Genkin, and Kevin Fu
  • [Slides]
• Interpretable Deep Learning Under Fire
  • Xinyang Zhang, Ningfei Wang, Hua Shen, Shouling Ji, Xiapu Luo, and Ting Wang
  • [Slides] [Paper] [Video]
• Hiding Objects from Computer Vision by Exploiting Correlation Biases
  • Yin Minn Pa Pa, Paul Ziegler, and Masaki Kamizono
  • [Slides]
• Disrupting Continuity of Apple’s Wireless Ecosystem Security: New Tracking, DoS, and MitM Attacks on iOS and macOS Through Bluetooth Low Energy, AWDL and Wi-Fi
  • Milan Stute, Alexander Heinrich, Jannik Lorenz, and Matthias Hollick
  • [Paper]

Defence

• Entangled Watermarks as a Defense Against Model Extraction
  • Hengrui Jia, Christopher A. Choquette-Choo, Varun Chandrasekaran, Nicolas Papernot
  • [Paper]
• Hopper: Modeling and Detecting Lateral Movement
  • Grant Ho, Mayank Dhiman, Devdatta Akhawe, Vern Paxson, Stefan Savage, Geoffrey Voelker, and David Wagner
  • [Paper]
• Faking a Factory: Creating and Operating a Realistic Honeypot
  • Charles Perine
  • [Slides] [Paper] [Video]
• Do You Speak My Language? Making Static Analysis Engines Understand Each Other
  • Ibrahim Mohamed and Manuel Fahndrich
  • [Slides]
• Practical Defenses Against Adversarial Machine Learning
  • Ariel Herbert-Voss
  • [Video]

Nifty sundries

• Remote Side-Channel Attacks on Anonymous Transactions
  • Florian Tramer, Dan Boneh, and Kenneth G. Paterson
  • [Paper]
• An Observational Investigation of Reverse Engineers’ Processes
  • Daniel Votipka, Seth Rabin, Kristopher Micinski, Jeffrey Foster, and Michelle Mazurek
  • [Paper] [Video]
• On the Feasibility of Automating Stock Market Manipulation
  • Carter Yagemann, Simon Chung, Erkam Uzun, Sai Ragam, Brendan Saltaformaggio, and Wenke Lee
  • [Paper]
• IoT Skimmer: Energy Market Manipulation through High-Wattage IoT Botnets
  • Tohid Shekari and Raheem Beyah
  • [Slides]
• The Dark Age of Memory Corruption Mitigations in the Spectre Era
  • Andrea Mambretti and Alexandra Sandulescu
  • [Slides]
• Everything Old is New Again: Binary Security of WebAssembly
  • Daniel Mehmann, Johannes Kinder, and Michael Pradel
  • [Slides] [Paper] [Video]
• ProxyLogon is Just the Tip of the Iceberg: A New Attack Surface on Microsoft Exchange Server!
  • Orange Tsai
  • [Slides]

brought to you by 

Most companies find out way too late that they've been breached. Thinkst Canary changes this. Canaries deploy in under 4 minutes and require 0 ongoing admin overhead. They remain silent till they need to chirp, and then, you receive that single alert.

When.it.matters.

Find out why some of the smartest security teams in the world swear by Thinkst Canary https://canary.love