Bill Marczak, Senior Researcher at The Citizen Lab
The mercenary spyware industry sells hacking tools and services to governments, purportedly to fight crime and terrorism. In some cases, the products are used this way. However, all too often, this powerful technology is abused to spy on dissidents, journalists, and political opposition. Despite bug-fixes, security mitigations, threat intelligence work, government regulations, and even sanctions, the industry's efforts continue apace, to the detriment of civil society. My talk will highlight the cat-and-mouse game between the mercenary spyware industry and the defenders, explaining the state of play, how we got here, and what the future may hold.
Kuan Yu Chen, National Taiwan University of Science and Technology; Md Hasan Shahriar, Virginia Tech; Wen Wei Li and Shi Cho Cha, National Taiwan University of Science and Technology; Wenjing Lou, Virginia Tech
Electric vehicle (EV) charging infrastructures continue to depend heavily on the legacy DIN 70121 protocol, which lacks cryptographic authentication and exposes critical control messages in plaintext. Although prior studies have noted conceptual weaknesses, the feasibility and impact of practical, end-to-end attacks against real charging ecosystems remain insufficiently understood. We present HotWire, a systematic security analysis of DIN 70121 and the first demonstration of two practical, production-grade exploits: (i) unauthorized Autocharge activation via identifier impersonation, and (ii) unauthorized energy extraction through protocol-driven battery-state manipulation. In the first attack, an adversary replays a captured EV identifier (EVCCID) to initiate fraudulent Autocharge sessions on commercial networks using a low-cost hardware toolkit. Our experiments show that attackers can repeatedly obtain full charging sessions commonly valued at 35–45 without triggering existing fraud-detection mechanisms. In the second attack, we exploit insecure battery management system (BMS) state transitions by injecting protocol-compliant voltage claims, inducing controlled forced discharge, and enabling persistent energy loss. Furthermore, we validate these attacks across production vehicles and multiple public charging networks using a physical hardware-in-the-loop testbed, revealing widespread trust in protocol state over physical verification. We release open-source auditing tools and describe responsible disclosure outcomes, which have already prompted firmware updates and additional authentication safeguards by several vendors.
Victor Goeman, Tom Cordemans, Christoph Sanders, Jorn Lapon, and Vincent Naessens, DistriNet, KU Leuven
Real-time communication (RTC) is increasingly adopted in the Internet of Things (IoT), enabling interactive capabilities in smart cameras, home assistants, and industrial devices. However, the security of RTC in IoT remains poorly understood. Unlike standardized WebRTC deployments on the web, IoT implementations are heterogeneous, employing either proprietary protocols or custom WebRTC stacks.
To address this heterogeneity, we present RTCInspect, an open-source framework for automated analysis of RTC traffic to detect protocol and cryptographic weaknesses. Using this framework, we conducted, to our knowledge, the first comparative security study of 21 real-world applications, spanning 11 consumer IoT devices and 10 major web platforms.
Our findings reveal a divide between the security practices of WebRTC in web applications and IoT devices. Web applications mainly rely on WebRTC and adhere to security best practices, although many still depend on centralized trust models. In contrast, IoT devices exhibit weaknesses, including unencrypted signaling, exposing long-term credentials, and mismanagement of certificates and keys, enabling Manin-the-Middle (MITM) attacks.
By exposing these weaknesses and releasing an automated analysis tool, our study offers both a security overview for RTC systems and practical support for developers and researchers.
Jacqueline Henes, Matthew Bowden, and Mihai Ordean, University of Birmingham; David Oswald, Durham University
Modern systems security relies on memory isolation mechanisms like trusted execution environments and kernel privilege separation to enforce strong isolation boundaries. However, many of these mechanisms place implicit trust in system memory, leaving them open to hardware attacks on external DRAM. In this paper, we introduce DisARMed, an attack on ARM processors that exploits memory aliasing techniques from userspace, compromising both the Linux kernel and ARM TrustZone. We demonstrate for the first time that memory aliasing attacks are practical for adversaries that do not have access to the kernel. We additionally implement and evaluate a mitigation for DisARMed, using a lightweight alias detection mechanism. Our solution has minimal impact on boot time of about one second. Finally, we discuss the wider applicability of DisARMed, considering other relevant potential attack vectors, applicable memory massaging techniques, and security mechanisms that may be affected.
Evangelos Bitsikas, Jason Veara, and Aanjhan Ranganathan, Northeastern University
Modern connected vehicles rely on persistent LTE connectivity to enable remote diagnostics, over-the-air (OTA) updates, and safety-relevant services. While mobile network vulnerabilities are well documented in the smartphone ecosystem, their impact in safety-relevant automotive settings remains insufficiently examined. We conduct a black-box case study of LTE security in Tesla's Model 3 and Cybertruck, revealing systemic protocol weaknesses and architectural misconfigurations in connected vehicles. We find that Tesla's telematics stack is susceptible to IMSI catching, rogue base station hijacking, and insecure fallback mechanisms that may silently degrade service availability. Furthermore, legacy control-plane configurations allow for silent SMS injection and broadcast message spoofing without driver awareness. While the vulnerabilities are grounded in Tesla, this case study suggests broader implications for connected-vehicle telematics and for regulatory frameworks such as ISO/SAE 21434 and UN R155/R156, which assume secure, traceable, and resilient telematics in modern vehicles.
Antonis Louka and Jo Van Bulck, DistriNet, KU Leuven
System Management Mode (SMM) is a highly privileged execution mode present in x86 processors since the early 1990s. With full control over hardware and system memory, SMM has long been a prime target for powerful attacks and persistent rootkits, including cases linked to nation-state adversaries. However, despite widespread deployment and unlike other x86 isolation mechanisms such as Intel SGX and AMD SEV, SMM has received relatively little academic attention, with insights primarily scattered across industry disclosures and hacker community contributions.
We present the first comprehensive systematization of SMM attack research, covering over two decades of work. We consolidate architectural details, trace the evolution of hardware and the firmware ecosystem, and introduce an extensible taxonomy of attack vectors. Organizing the landscape into three eras, we highlight a shift from configuration-based exploits to sophisticated software vulnerabilities and the growing importance of automated analysis tools. Finally, we identify knowledge gaps, outline research priorities, and distill lessons transferable to privileged firmware beyond x86.
Moritz Sanft and Flavio Toffalini, Ruhr-Universität Bochum
During software testing, analysts use sanitizers like ASan and UBSan to effectively detect memory corruption and undefined behavior. However, existing sanitizers cannot detect semantic bugs. These vulnerabilities arise from incorrect program environment interactions that lead to formally valid but unintended system states. Semantic bugs, which include path traversals, command injections, and arbitrary file writes, require tedious manual analysis to identify.
We present SEMSAN, a generic framework to identify semantic bugs during testing. SEMSAN enables analysts to define Sanitizer Primitives, which are small programs that monitor kernel events and validate security invariants at runtime. SEMSAN provides high-level utilities for inspecting filesystem metadata, process credentials, and namespace configurations, enabling the expression of complex invariants without low-level kernel knowledge. Our eBPF-based implementation integrates seamlessly with coverage-guided fuzzers while introducing negligible runtime overhead on production workloads.
We evaluate SEMSAN through both micro- and macro-benchmarks, successful reproduction of ten known CVEs, and real-world deployment. Macro-benchmarks on Apache and PostgreSQL demonstrate less than 1% overhead, while micro-benchmarks show 3--20% overhead in worst-case scenarios with continuous sanitizer triggering. SEMSAN discovered five previously unknown vulnerabilities, including privilege escalations in Git and Docker, a 21-year-old path traversal in ViewVC, and a remote code execution in Grafana. All vulnerabilities were responsibly disclosed and are either patched or in the process of being patched.
Sungwoo Kim, Purdue University; Hui Peng, Google, Inc.; Imtiaz Karim, The University of Texas at Dallas; Ruoyu Wu, Purdue University; Jianliang Wu, Simon Fraser University; Elisa Bertino, Purdue University; Mathias Payer, EPFL; Dave (Jing) Tian, Purdue University
Bluetooth is both pervasive and vulnerable, yet fuzzing Bluetooth is challenging. While research on Bluetooth fuzzing has advanced to emulate Bluetooth devices and generate effective inputs for controllers, the host stack has been overlooked. The host stack is responsible for issuing commands to controllers, providing API abstractions for user applications, establishing logical links for asynchronous connections, and multiplexing channels. Thus, a systematic approach to identifying vulnerabilities in a Bluetooth host stack is required, but still lacking.
The primary challenges in testing the Bluetooth host stack are (1) configuration diversity and (2) statefulness. The host stack can be configured with over 3,000 options, each of which may introduce configuration-specific bugs. Also, the host stack state is inherently complex because multiple protocols comprise it. To address the aforementioned challenges, we design FuzzBT, a state-guided fuzzer that adopts (1) configuration iteration and (2) stack-level state exploration. Specifically, we iterate over configurations across fuzzing campaigns and explore each configuration's unique logic using configuration-aware seeds extracted from the source code via concolic execution. For stack-level state, we aggregate the states of individual protocols via compiler instrumentation. We applied FuzzBT to two Bluetooth host stack implementations, the Linux and Zephyr kernels, and identified 18 previously unknown bugs with 9 CVEs.
Han Zheng, EPFL; Flavio Toffalini, Ruhr-Universität Bochum; Qiang Liu and Mathias Payer, EPFL
Complex software systems, like web browsers, integrate multiple tightly-coupled components. While code reviews and fuzzing enhance code quality, eliminating all bugs remains infeasible due to large-scale projects, unpredictable cross-context interactions, and complex cross-domain dependencies. This dire situation calls for an approach that scales to this unprecedented complexity.
Inspired by informal variant analysis developed by the hacker community, we create GRAPE, a structured approach that supports analysts in writing rules to detect bugs. By focusing on code patterns, GRAPE scales effectively to large-scale code projects. Moreover, our novel variant bug model enables analysis of cross-context interactions and exploitability verification using existing bug reports, eliminating the need for cross-domain dependencies. GRAPE represents the first systematic approach to variant analysis, introducing principles for variant pattern development.
We implement a prototype of GRAPE, which scans the entire Chromium code base in only 12 minutes. GRAPE discovered 24 new bugs, with four assigned CVEs and 17, 500 USD in rewards from Chrome’s Vulnerability Rewards Program. These discoveries impact modern web browser and security-critical complex software like OpenSSL. Beyond browsers, GRAPE uncovered three logic bugs in VSCode and Azure Data Studio, one of which received a CVE from Microsoft.
Yufei Du, Georgia Institute of Technology; Vasileios P. Kemerlis, Brown University; Michalis Polychronakis, Stony Brook University; Fabian Monrose, Georgia Institute of Technology
Call graph analysis is foundational to a wide range of security-critical applications. A central requirement for these applications is the precise and sound identification of indirect call targets. Of late, type-based indirect call analysis (which matches address-taken functions and code pointers based on their types) has become a widely adopted solution for meeting that requirement. While scalable and nominally sound, traditional type-based analyses suffer from limited precision. In response, multi-layer type analysis was proposed as a remedy, augmenting type information with additional layers of reasoning to improve precision while retaining scalability and soundness. However, the complexity of these techniques has fueled an ongoing debate regarding both their practical precision gains and soundness guarantees in real-world settings.
In this work, we present the first systematic study of multi-layer type-based indirect call analysis, by evaluating the precision and soundness of five state-of-the-art multi-layer analysis techniques. Our study reveals a gap between the design of such techniques and their actual implementations, causing incomplete results with many indirect-call target sets missing or empty. In addition, our soundness experiments demonstrate that compiler optimizations cause every multi-layer approach to fall short of soundness. Furthermore, we conduct a case study to demonstrate that for control-flow integrity---one of the most popular downstream security applications of call graph analysis---existing multi-layer type-based techniques fall short in preventing attacks that exploit type collisions.
Dev Mehta, Seyedmohammad Nouraniboosjin, Maryam S. Safa, Shahin Tajik, and Fatemeh Ganji, Worcester Polytechnic Institute
Despite decades of research in electromagnetic (EM) side-channel analysis (SCA), practical attacks still require manual effort and domain expertise to identify informative probe locations on target devices. Existing approaches rely heavily on exhaustive grid scanning or handcrafted alignment, limiting attack scalability and realism. In this work, we present the first automated and adaptive EM SCA framework that uses particle swarm optimization (PSO) to navigate the probe. Particles are guided by mutual information (MI) leakage maps, enabling efficient recovery of secret-dependent emissions. We introduce a novel application of the Nyström approximation to accelerate MI estimation across EM trace windows, allowing real-time swarm guidance without full kernel computations. Unlike prior work, our method requires no leakage templates, manual tuning, or alignment assistance—enabling automated attacks with minimal assumptions. We validate our framework on both microcontroller and FPGA platforms running AES-128. PSO-guided scanning identifies high-leakage points faster than grid search and reduces the number of traces required for successful CPA-based key recovery by up to a factor of 16, i.e., saving tens of thousands of traces.
Tetsu Ishizue, The University of Electro-Communications; Sara Rampazzi, University of Florida; Takeshi Sugawara, University of Electro-Communications
This paper presents a novel optical-synthesis attack and defense methodology for recaptured image detection systems that rely on infrared (IR) depth sensors. We first introduce SynthIR, which evades detection by independently manipulating the views of the RGB camera and the IR depth sensor across different optical spectra through an inexpensive optical filter that splits and recombines different colors of light. We validate the attack on portrait scenarios by constructing paired RGB images and physical 3D objects that bypass state-of-the-art detection methods, either using low-cost cardboard objects or by generating images geometrically consistent with a target 3D object without requiring precise alignment. The attack further generalizes to multi-frame video scenarios and, when applied to printed images rather than monitors, successfully circumvents both depth-based and image-only recapture detectors. To address the fundamental limitations of these IR-based two-sensor approaches, we propose a new defense pipeline based on dual-pixel image sensors, already deployed in modern smartphone cameras, which capture RGB and stereo images within the same optical spectrum. Our method estimates a depth map from the stereo pair and verifies its consistency with the RGB image, enabling robust recapture detection. Our experimental results demonstrate that the proposed defense detects all recaptured images without falsely rejecting any genuine images.
Mathias Oberhuber, Martin Unterguggenberger, and Martin Wistauder, Graz University of Technology; Andreas Kogler, Graz University of Technology Alumni; Rishub Nagpal and Stefan Mangard, Graz University of Technology
Confidential computing technologies, such as AMD SEV, enable secure execution of cloud workloads on shared physical hardware. AMD SEV technologies implement the VM trust model through AMD SEV-ES, encrypting memory and CPU register state, and AMD SEV-SNP, providing integrity protection for VM memory. While AMD SEV provides heavy-weight architectural isolation, it remains unclear whether it is susceptible to power side channels.
In this paper, we present PowerHooK, a new attack on AMD SEV technologies that enables software-based power side channels by speculatively replaying victim code paths via transient execution. Specifically, we repurpose page-fault-based transient replay to establish a transient-execution replay hook for power measurements. PowerHooK allows a malicious hypervisor to re-execute vulnerable victim code paths, thereby enabling continuous collection of power traces, reducing significant system noise. This capability allows the attacker to perform power analysis attacks on denoised datasets.
We demonstrate PowerHooK’s methodology by recovering AES key bytes across all AMD SEV defenses. Here, the attacker only needs to consider 1320 samples to perform a CPA on AES-NI executed in AMD SEV-SNP running in an experimental setting. We systematically analyze architectural, speculative, and transient power leakage across different AMD CPU generations and evaluate how AMD’s virtualization levels affect PowerHooK. Moreover, we present a real-world AES key byte recovery attack targeting VM-isolated cloud workers that run OpenSSL's constant-cycle AES-NI CBC implementation. Thereby, we demonstrate that transient replay gadgets are present in the OpenSSL library, showcasing that PowerHooK effectively enables the extraction of secrets.
Valentin Huber and Marc Schink, Fraunhofer AISEC, Technical University of Munich (TUM)
Body bias injection (BBI) has received attention as a technique to induce transient faults in digital logic, yet its impact on non-volatile memory (NVM) remains largely unexplored. In this work, we present the first in-depth security analysis of BBI targeting embedded flash memory, the predominant NVM technology used in microcontrollers. We introduce a novel method to program flash cells in powered-off state using BBI, in contrast to existing techniques, such as laser or UV radiation, which are limited to erasing cells. Furthermore, we propose a new BBI technique that uses DC biases to manipulate flash memory read operations. We provide a detailed electrical model that explains the physical mechanisms underlying the induced faults and demonstrate the feasibility of the attacks by reactivating the debug interfaces of two microcontrollers. Based on these findings, we conclude by discussing potential countermeasures.
Richard A. Dubniczky and Bertalan Borsos, Eötvös Loránd University; Tamas Bisztray, HUN-REN Sztaki; Norbert Tihanyi, Technology Innovation Institute
In this work, we present the first large-scale security audit of the arXiv preprint repository, analyzing over 1.2 TB of data from 100,000 arXiv submissions to report on systemic sensitive information leakage. When authors upload submissions, they publish not only a PDF but also auxiliary code, images, and LaTeX source files containing embedded comments. In the absence of sanitization, these files often disclose sensitive information that adversaries can harvest using open-source intelligence. Operating under a strict ethical framework of passive verification, we introduce LaTeXpOsEd, a pipeline that integrates pattern matching, logical filtering, and large language models (LLMs) to detect context-dependent secrets within LaTeX comments and unreferenced auxiliary files. To evaluate the secret-detection capability of LLMs, we introduce LLMSec-DB, a benchmark on which we tested 25 state-of-the-art models. Analyzing publicly available arXiv submissions, we uncover thousands of PII exposures, hundreds of instances of exposed credentials, private Google Drive links, API keys, and various semantic leaks, including internal disputes and confidential peer reviews. We show that this large-scale extraction of sensitive information is economically viable for low-resource adversaries leveraging open-weight models and constitutes a serious security and reputational threat to individuals and institutions. We urge the research community and repository operators to take immediate action to close these hidden security gaps. To support open science and in accordance with responsible disclosure standards, we have published our toolset and benchmarks on GitHub and Zenodo.
David Amebley and Sayanton Dibbo, The University of Alabama
The growing deployment of multi-modal models (MMs) has introduced new attack vectors that can leak sensitive training data, leading to privacy leakage. This paper investigates black-box membership inference attack (MIA) privacy attack on multi-modal vision-language models (VLMs). State-of-the-art research analyzes privacy vulnerabilities primarily to unimodal AI systems, while recent studies indicate MMs can also be vulnerable to privacy attacks. On the other hand, researchers have demonstrated that biologically inspired neural network representations can enhance the resilience of unimodal systems against adversarial attacks. However, the privacy vulnerability of neuro-inspired MMs remains unexplored. In this work, we introduce a systematic neuroscience-inspired topological regularization framework and expose the resilience of MM VLMs against image-text-based MIA vulnerabilities. We examine this MIA vulnerability using three different VLMs: BLIP, PaliGemma 2, and ViT-GPT2, across three benchmark datasets: COCO, CC3M, and NoCaps. We compare the baseline and neuro VLMs (with topological regularization) defined as neuro (τ =2) and another variant neuro++ (τ =3). Our results on the BLIP model using the COCO dataset demonstrate that neuro-inspired regularization significantly reduces MIA attack success, with neuro (τ=2) achieving an approximately 24% reduction in mean ROC-AUC, while preserving or improving utility as measured by MPNet and ROUGE-2. Additional evaluations on BLIP, PaliGemma 2, and ViT-GPT2 across CC3M and NoCaps indicate that privacy improvements are architecture and dataset-dependent, with stronger regularization (τ =3) generally required to achieve consistent reductions in membership inference risk. This research contributes to the growing understanding of privacy risks in MMs and a pathway to design privacy threat-resilient VLMs.
Sanjib Kumar Sen, Hannah Longoria, and Bozhen Liu, Texas A&M University - Corpus Christi
Local Inference Frameworks (LIFs) such as llama.cpp, vLLM, Ollama, and LocalAI enable users to run large language models on their own hardware, avoiding data exposure to remote services. However, these frameworks often load community-shared model files that can carry malicious payloads. We define the LIF-Model Attack surface (LIMA) as the set of vulnerabilities triggered when LIFs process untrusted model artifacts. To understand the impact of LIMA, we collected 60 publicly disclosed vulnerabilities across the above four popular open-source LIFs, resulting in a curated dataset for our study. We analyzed their root causes and derived a six-class taxonomy, where LIMA accounts for 42% and leads to serious attacks including heap buffer overflows, path traversal, and even remote code execution. This demonstrates that a single crafted model file can attack during model load time, before any user prompt or inference takes place. We further build LIMABench, an automated reproduction framework for our collected dataset for consistent verification. To systematically uncover LIMA vulnerabilities, we develop LIMAScan, a taxonomy-driven dynamic testing tool that generates LIMA-pattern-derived payloads and tests them against live LIF instances to detect unsafe GGUF metadata handling patterns, through which we discover and successfully exploit 7 previously unknown vulnerabilities in the latest stable releases of the four LIFs. We release LIMABench and LIMAScan as an open-source artifact.
Andrew Chin, Georgia Institute of Technology; Dongkwan Kim, Microsoft; Yu-Fu Fu, Fabian Fleischer, and Youngjoon Kim, Georgia Institute of Technology; HyungSeok Han and Cen Zhang, Microsoft; Brian Junekyu Lee and Hanqing Zhao, Georgia Institute of Technology; Taesoo Kim, Georgia Institute of Technology and Microsoft
DARPA's AI Cyber Challenge (AIxCC) showed that cyber reasoning systems (CRSs) can go beyond vulnerability discovery to autonomously confirm and patch bugs: seven teams built such systems and open-sourced them after the competition. Yet the majority of open-sourced CRSs remain largely unusable outside their original teams, each bound to the competition cloud infrastructure that no longer exists. We present OSS-CRS, an open, locally deployable framework for running and combining CRS techniques against real-world open-source projects, with budget-aware resource management. We ported components from every AIxCC finalist CRS. Using the first-place system (Atlantis), we discovered 7 previously unknown bugs (one of high severity) across 6 OSS-Fuzz projects. OSS-CRS is publicly available as a sandbox project in the OpenSSF.
Florian Roudot and Mohamed Sabt, Univ Rennes, CNRS, IRISA
Nowadays, streaming services, such as Netflix, rely on Digital Rights Management (DRM) systems to deliver their protected content. These systems aim to prevent piracy. Specifically, non-subscribers are prevented from accessing the content altogether, while subscribers are prevented from acquiring decrypted copies of the media to avoid uncontrolled distribution. Among the currently deployed DRM systems, Google Widevine is the most widely used, especially on desktops, where it provides a fully software-based solution.
In this paper, we investigate Widevine's decryption interface and its integration in modern web browsers. We show that Widevine's boundary (i.e., its output after media decryption) is inherently unprotected and can be intercepted with relative ease. Under an attacker merely observing this interface, we show that audio content can be trivially recovered because the decrypted samples are returned prior to decoding. We further identify that, under a commonly used Widevine configuration, the same "decrypt only" behavior also applies to video, enabling direct recovery of video frames. When this misconfiguration is absent, we show that Widevine still outputs decrypted and decoded frames that can be efficiently re-encoded with negligible quality degradation.
Based on our findings, we build an attack that "downloads" any content protected by Widevine into a playable format on both Linux and Windows. Finally, we assess the effectiveness of our attack by applying it to premium streaming platforms.
Evgenios Gkritsis, Athens University of Economics and Business; Constantinos Patsakis, University of Piraeus and Information Management Systems Institute of Athena Research Centre; George Stergiopoulos, Athens University of Economics and Business
Malware analysis systems, including dynamic-analysis sandboxes and digital forensics and incident response (DFIR) platforms, rely on telemetry pipelines comprising collection agents, serializers, and database backends to capture and present program behavior to analysts. We show that these data-handling components constitute an exploitable attack surface that can lead to denial-of-analysis (DoA) states without disabling sensors or requiring elevated privileges. We present Telemetry Complexity Attacks (TCAs), a new class of vulnerabilities that exploit mismatches between unbounded collection mechanisms and bounded processing capabilities. Our method recursively spawns child processes to generate deeply nested and oversized objects that stress serialization and storage boundaries, as well as visualization layers, e.g., JSON/BSON depth and size limits. Depending on the product, this leads to truncated or missing behavioral reports, rejected database inserts, serializer recursion and size errors, and unresponsive dashboards, with some cases also exhibiting normal malicious execution that was not recorded or presented to analysts. We evaluate our technique against 18 commercial and open-source malware analysis platforms and endpoint detection and response (EDR) solutions. Seven products fail at different stages of the telemetry pipeline; two CVE identifiers have been assigned (CVE-61301 and CVE-61303); one more is pending; one has been assigned to an underlying library, and others have issued patches or configuration changes. We discuss root causes and propose mitigation strategies to prevent DoA attacks triggered by adversarial telemetry.
Alexander Neff, Tobias Holl, and Kevin Borgolte, Ruhr University Bochum
Microsoft's Active Directory (AD) is a critical component of the IT infrastructure of numerous enterprises. Thus, security vulnerabilities in AD can have dire consequences for the security posture of an organization's IT infrastructure. At the core of the AD architecture is the Netlogon Remote Protocol, which is used to manage computer accounts, delegate authentication requests, and various other management tasks.
In 2020, Tervoort identified Zerologon, a critical vulnerability in Netlogon, which allowed attackers to fully compromise an AD management domain. In turn, Microsoft released two patches: one aiming to rectify the cryptographic vulnerability that enabled the attack, and the second one to ensure that all Netlogon communication is signed and sealed.
In this paper, we analyze these patches and show that they are insufficient to mitigate the underlying vulnerabilities. We show that the cryptographic patch can be bypassed by an unprivileged attacker within the AD domain. We introduce the Onelogon attack with two distinct variants for varying attacker capabilities, both of which allow an attacker to take over a vulnerable AD account in approximately 30 minutes. If this AD account belongs to a Domain Controller, an attacker can leverage Onelogon to fully compromise the AD domain.
With the goal of mitigating the attacks, we identified their underlying root cause: the incorrect use of AES-CFB8 encryption. Both the earlier Zerologon attack and our new attack exploit how Netlogon incorrectly uses AES-CFB8. Finally, we provide and compare various mitigation and detection approaches for Microsoft and AD operators to prevent account takeover attacks and authentication bypasses in the short term and fundamentally. Unfortunately, addressing the underlying root cause requires a backward-incompatible change to Netlogon: reimplementing AES-CFB8 correctly.
We disclosed this issue to Microsoft and CERT-Bund, but do not expect any fixes to be forthcoming. In the meantime, we advise users to apply the mitigation and detection strategies outlined in this paper.
Billy Bob Brumley, Rochester Institute of Technology
Constant time programming patterns is the primary defense against timing attacks on cryptographic implementations, yet what "constant time" means varies across academia and industry. This work systematizes constant time models and their evolution, identifies a recurring gap between what models protect and what specifications assume, and distills an offensive methodology for discovering timing vulnerabilities that originate outside the cryptographic primitive boundary. Applying this methodology, we locate a specification-level vulnerability related to private key loading, and confirm the leak in both OpenSSL and BoringSSL. Counterintuitively, BoringSSL's per-observation signal is several orders of magnitude stronger than OpenSSL's, despite an explicitly stricter threat model.
Agentic AI has reduced the time between "I found a vulnerability" and "I have a working proof-of-concept", but that speed is only an asset if it comes with discipline. This talk walks through how LLM-driven agents can be wired into an exploit generation workflow: automating the tedious parts of testing, such as synthesis, payload iteration, and PoC scaffolding against scoped targets, while keeping a human firmly in the loop on the decisions that matter. Using the Linux kernel as a case study, the talk illustrates how this approach can turn crashes found by fuzzers into working proof-of-concepts.
Arash Ale Ebrahim and Nils Ole Tippenhauer, CISPA Helmholtz Center for Information Security
Apple AirDrop and Google/Samsung Quick Share are proximity file-transfer protocols used by over five billion devices, yet their application-layer security properties remain largely unstudied because both stacks are proprietary and undocumented. Both protocols are reachable from wireless proximity without any prior pairing and process complex serialized content (binary plists, CPIO archives, Protocol Buffers, UKEY2handshakes)inside privileged daemons,making them attractive zero-click targets across multiple operating systems. We perform the first cross-platform reverse engineering and protocol-aware fuzzing study of both stacks. We reconstruct AirDrop’s seven-layer state machine and DVZip adaptive compression from binary analysis, build AIRFUZZ, a protocol-aware fuzzer that mutates pre-compression representations, and complement it with targeted hand-written analyses of Samsung’s Quick Share service and Google’s Quick Share for Windows. We discover six vulnerabilities (V1-V6): three pre-authentication issues in macOS/iOS Air Drop (V1: Swift fatalError DoS in the HTTP path router; V2: unbounded XML plist recursion in Foundation, V3: NULL deref in Network.framework’s HTTP/1.1 parser), two protocol-layer flaws in Samsung Quick Share (V4: pre-authentication OfflineFrame dispatch, V5: D2D encryption bypass for three frame types), and a heap use-after-free in Google Quick Share for Windows (V6) for which Google awarded a bounty. We responsibly disclosed all findings, Apple, Samsung, and Google have acknowledged the reports.
Rokhaya-Diamil Fall and Philipp Mao, EPFL; Martin Wagner, Asymmetric Research; Mathias Payer, EPFL
Arbitrary file overwrite vulnerabilities are common in Android apps. However, the security impact of such vulnerabilities has so far been highly app-dependent. We present a new, app-agnostic, persistent technique that turns arbitrary file overwrites into code execution by targeting the runtime-generated app image file. This file is used by the Android Runtime to cache a snapshot of the app’s classes and is writable within an app’s sandbox. By replacing this file with a malicious image, attackers gain code execution when the app restarts.
We describe two exploitation strategies: a local attack that, assuming an ASLR leak, leverages an arbitrary memory write during image decompression to corrupt Android Runtime objects and hijack control flow. More importantly, we demonstrate a remote attack that requires no ASLR leak and instead abuses image relocation logic to inject and execute attacker-controlled Dalvik bytecode.
We demonstrate the practicality of both techniques by exploiting real n-day or 0-day arbitrary file overwrite vulnerabilities on commercial phones. We showcase the local technique with a zero-click privilege escalation chain from an untrusted app to the system user, exploiting an arbitrary file overwrite in the OnePlus backup app. We present the remote technique by exploiting the same file overwrite vulnerability over the network. To further demonstrate the remote technique, we present a new variant of the Pwn2Own24 Galaxy S24 chain, which leveraging our remote technique, now achieves code execution in the privileged platform_app context. We reveal the security impact of arbitrary file overwrite vulnerabilities in Android apps and present memory corruption exploitation in the Android Runtime.
Kota Urushigaki, The University of Osaka; Hayato Kimura, NICT and The University of Osaka; Atsushi Tanaka and Takanori Isobe, The University of Osaka
Session is a widely deployed decentralized messenger application that emphasizes user anonymity and privacy through end-to-end encryption. Session currently employs its own uniquely designed messaging protocol, Session Protocol V1, having migrated from the extensively studied Signal Protocol. In this paper, we conduct a comprehensive, implementation-driven security analysis of the Session Protocol V1, focusing on its 1-to-1 and closed-group communication mechanisms. Our analysis reveals two fundamental design vulnerabilities: the absence of mutual public key authentication and the lack of cryptographic bindings to monotonic sequence counters. Exploiting these weaknesses within the context of actual application environments, we demonstrate three practical attacks: an impersonation attack, a message timestamp forgery attack, and message dropping and replay attacks. These attacks allow malicious server nodes or unprivileged malicious insiders to substitute public keys, silently suppress or duplicate messages, and manipulate the perceived chronological order of conversations. The findings highlight that these exploits severely undermine the fundamental security guarantees of the messenger. Finally, we propose immediate, actionable mitigation strategies to address the identified flaws and secure the protocol against these threats.
Tomasz Lisowski, University of Birmingham; Kristian Covic, Fuzzware; Marius Muench, University of Birmingham
Hostile SIMs have been discussed as an attack vector against Mobile Equipment (ME) connected to cellular networks. One main attack path are proactive commands sent from the SIM to the victim device. In this work, we examine the threats posed by the RUN AT command which are SIM-originating requests for the ME to execute a specified AT command, effectively creating a SIM AT interface.
To explore this interface, we introduce the CATana toolkit and use it to analyze real-world devices. Despite existing community knowledge on proactive commands and the dangers of AT commands, our investigation shows that SIM AT commands pose a significant security risk for MEs.
We survey 26 different MEs (8 IoT devices and 18 smartphones) and find that 9 expose the SIM AT interface, leading to the discovery of 4 vulnerabilities. We present case studies demonstrating the impact of discovered vulnerabilities, including command execution, arbitrary file read, downgrading connections to 2G, and Denial-of-Service (DoS) of the ME. Crucially, our work emphasizes the security benefit of hardening, deprecating, or disabling, the SIM AT interface.
Henri Carnot, Avantix and EURECOM; Aurélien Francillon, EURECOM
Cellular basebands are critical components in mobile devices, enabling connectivity with cellular networks. Their notorious complexity, proprietary design, insufficient security hardening, and support for multiple generations of complex cellular protocols make them a prime target for attacks. Although billions of devices rely on these components, and despite the many papers published in recent years, baseband security remains poorly explored. This paper provides a systematization of knowledge on baseband security, analyzing prior work on vulnerability discovery and attack surfaces. We present a taxonomy of vulnerabilities, review state-of-the-art analysis techniques, including static analysis, over-the-air testing, and emulation, and discuss their respective strengths and limitations. Finally, we outline promising research directions to address gaps in current methodologies. Our goal is to provide a comprehensive framework that guides future work and strengthens the security of cellular ecosystems.
