ThinkstScapes

ThinkstScapes Research Roundup - Q4 - 2025

NETWORKING BEYOND PLUG-AND-PLAY GET /LARGE FILE HTTP/1.1: CONNECTION-BASED TCP AMPLIFICATION ATTACKS Yepeng Pan, Lars Richter, and Christian Rossow [Paper [https://cispa.saarland/group/rossow/papers/tcp-amp-acsac25.pdf]] [Code [https://github.com/acsac2025-tcp-amp/acsac2025_tcp_amp]] WAFFLED: EXPLOITING PARSING DISCREPANCIES TO BYPASS WEB APPLICATION FIREWALLS Seyed Ali Akhavani, Bahruz Jabiyev, Ben Kallus, Cem Topcuoglu, Sergey Bratus, and Engin Kirda [Paper [https://arxiv.org/abs/2503.10846v1]] [Code [https://github.com/sa-akhavani/waffled]] EXCUSE ME, WHAT PRECISE TIME IS IT? Oliver Ettlin [Video [https://www.youtube.com/watch?v=dOt-zRIG5co]] CUT TO THE QUIC: SLASHING QUIC'S PERFORMANCE WITH A HASH DOS Paul Bottinelli [Slides [https://i.blackhat.com/BH-EU-25/EU-25-Bottinelli-CutToTheQUIC-Wednesday-Final.pdf]] [Code [http://github.com/pbottine/quic-hash-collisions]] HIGH-IMPACT SECURITY AT THE FOUNDATIONS UNDERSTANDING THE SECURITY IMPACT OF CHERI ON THE OPERATING SYSTEM KERNEL Zhaofeng Li, Jerry Zhang, Joshua Tlatelpa-Agustin, Xiangdong Chen, and Anton Burtsev [Code [https://github.com/mars-research/cheri-impact-artifact]] [Paper [https://mars-research.github.io/doc/2025-cheri-acsac25.pdf]] CUDA DE GRÂCE: OWNING AI CLOUD INFRASTRUCTURE WITH GPU EXPLOITS Valentina Palmiotti and Samuel Lovejoy [Video [https://www.youtube.com/watch?v=Lvz2_ZHj3lo]] DEFEATING KASLR BY DOING NOTHING AT ALL Seth Jenkins [Blog post [https://projectzero.google/2025/11/defeating-kaslr-by-doing-nothing-at-all.html]] [Code [https://project-zero.issues.chromium.org/issues/434208461]] BUILD A FAKE PHONE, FIND REAL BUGS: QUALCOMM GPU EMULATION AND FUZZING WITH LIBAFL QEMU Romain Malmain and Scott Bauer [Code [https://github.com/rmalmain/39C3-build-a-fake-phone-find-real-bugs]] [Video [https://www.youtube.com/watch?v=kRzF2LXSLgk]] RUST IN ANDROID: MOVE FAST AND FIX THINGS  Jeff Vander Stoep [Blog post [https://security.googleblog.com/2025/11/rust-in-android-move-fast-fix-things.html]] [Rust course [https://google.github.io/comprehensive-rust/]] SKYNET STARTER KIT: FROM EMBODIED AI JAILBREAK TO REMOTE TAKEOVER OF HUMANOID ROBOTS Shipei Qu, Zikai Xu, and Xuangan Xiao [Video [https://www.youtube.com/watch?v=qjA__5-Bybs]] WINS AND LOSSES WITH LLMS AND SECURITY SCALING AGENTIC ARCHITECTURES FOR AUTONOMOUS SECURITY TESTING AND OFFENSIVE OPERATIONS Jason Garman, Jake Coyne, and Aaron Brown [Slides [https://drive.google.com/file/d/12KP0QUOdBGLLLQoYQ_0lDD75-1DthHH3/view]] [Code [https://github.com/westonbrown/Cyber-AutoAgent]] FORCED DESCENT: GOOGLE ANTIGRAVITY PERSISTENT CODE EXECUTION VULNERABILITY Aaron Portnoy [Blog post [https://mindgard.ai/blog/google-antigravity-persistent-code-execution-vulnerability]] FLAW AND ORDER: FINDING THE NEEDLE IN THE HAYSTACK OF CODEQL USING LLMS Simcha Kosman [Slides [https://i.blackhat.com/BH-EU-25/eu-25-Kosman-Flaw-And-Order-Final.pdf]] [Blog post [https://www.cyberark.com/resources/threat-research-blog/vulnhalla-picking-the-true-vulnerabilities-from-the-codeql-haystack]] [Code [https://github.com/cyberark/Vulnhalla]] RESCUING THE UNPOISONED: EFFICIENT DEFENSE AGAINST KNOWLEDGE CORRUPTION ATTACKS ON RAG SYSTEMS Kim Minseok, Lee Hankook, and Koo Hyungjoon [Code [https://github.com/SecAI-Lab/RAGDefender]] [Paper [https://arxiv.org/pdf/2511.01268]] WHISPER LEAK: A NOVEL SIDE-CHANNEL ATTACK ON REMOTE LANGUAGE MODELS  Jonathan Bar Or and Geoff McDonald [Blog post [https://www.microsoft.com/en-us/security/blog/2025/11/07/whisper-leak-a-novel-side-channel-cyberattack-on-remote-language-models/]] [Paper [https://arxiv.org/abs/2511.03675]] [Code [http://github.com/yo-yo-yo-jbo/whisper_leak]] NIFTY SUNDRIES FORMAT-PRESERVING COMPRESSION-TOLERATING AUTHENTICATED ENCRYPTION FOR IMAGES Alexandra Boldyreva, Kaishuo Cheng, and Jehad Hussein [Slides [https://kaishuocheng.github.io/slides/AC25.pptx]] [Paper [https://link.springer.com/content/pdf/10.1007/978-981-95-5119-4_4.pdf?pdf=inline+link]] WHY QUANTUM CRYPTANALYSIS IS BOLLOCKS Peter Gutmann [Video [https://www.youtube.com/watch?v=xa4Ok7WNFHY]] [Slides [https://www.cs.auckland.ac.nz/~pgut001/pubs/bollocks.pdf]] UNMASKING ORGANIZATIONS' SECURITY POSTURES: INSIGHTS FROM PHISHING-RESISTANT AUTHENTICATION Fei Liu [Slides [https://i.blackhat.com/BH-EU-25/BHEU25-Liu-Unmasking-Security-Postures.pdf]] THOSE WHO DO NOT LEARN FROM ADVISORIES ARE DOOMED TO REPEAT THEM Louis Nyffenegger [Video [https://www.youtube.com/watch?v=gL1xIK81HqY]]

ThinkstScapes Research Roundup - Q3 - 2025

Q3’25 THINKSTSCAPES MICROSOFT-INDUCED SECURITY WOES ONE TOKEN TO RULE THEM ALL - OBTAINING GLOBAL ADMIN IN EVERY ENTRA ID TENANT VIA ACTOR TOKENS Dirk-jan Mollema [Blog post [https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens/]] TURNING MICROSOFT'S LOGIN PAGE INTO OUR PHISHING INFRASTRUCTURE Keanu Nys [Slides [https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Keanu%20Nys%20-%20Turning%20Microsoft%27s%20Login%20Page%20into%20our%20Phishing%20Infrastructure.pdf]] [Video [https://www.youtube.com/watch?v=B4pVpByWOcI&pp=0gcJCQYKAYcqIYzv]] YOU SNOOZE YOU LOSE: RPC-RACER WINNING RPC ENDPOINTS AGAINST SERVICES Ron Ben Yizhak [Slides [https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Ron%20Ben%20Yizhak%20-%20You%20snooze%20you%20lose%20RPC-Racer%20winning%20RPC%20endpoints%20against%20services.pdf]] [Code [https://github.com/SafeBreach-Labs/RPC-Racer]] [Video [https://www.youtube.com/watch?v=vBz8TBVxwk4]] INTERNAL DOMAIN NAME COLLISION 2.0 Philippe Caturegli [Slides [https://romhack.io/wp-content/uploads/sites/2/2025/10/RomHack-2025-Internal-Domain-Name-Collision-Philippe-Caturegli.pdf]] [Video [https://www.youtube.com/watch?v=yFeYiWqQ6RE]] LOGS ARE NOT ALWAYS AS THEY APPEAR SOURCE IP SPOOFING IN CLOUD LOGS: A HANDS-ON LOOK ACROSS AWS, AZURE, AND GCP Eliav Livneh [Video [https://www.youtube.com/live/2UZl85Y4nRo?si=lsvqahghENXsQgHw&t=17061]] I'M IN YOUR LOGS NOW, DECEIVING YOUR ANALYSTS AND BLINDING YOUR EDR Olaf Hartong [Slides [https://i.blackhat.com/BH-USA-25/Presentations/Hartong-Im-in-your-logs-now.pdf]] [Code [https://github.com/olafhartong/BamboozlEDR]] FROM SPOOFING TO TUNNELING: NEW RED TEAM'S NETWORKING TECHNIQUES FOR INITIAL ACCESS AND EVASION Shu-Hao Tung [Slides [http://i.blackhat.com/BH-USA-25/Presentations/USA-25-Tung-From-Spoofing-To-Tunneling-New.pdf]] [Paper [https://i.blackhat.com/BH-USA-25/Presentations/USA-25-Tung-From-Spoofing-To-Tunneling-New-wp.pdf]] [Video [https://www.youtube.com/watch?v=aS5FszcQeIE]] AUTOBOTS ROLL OUT! AUTOMATING SOFTWARE SECURITY WITH LLMS Tyler Nighswander [Site [https://theori-io.github.io/aixcc-public/]] [Code [https://github.com/theori-io/aixcc-afc-archive]] [Video [https://www.youtube.com/watch?v=q2zmAXEDDkA]] AGENTS BUILT FROM ALLOYS Albert Ziegler [Blog post [https://xbow.com/blog/alloy-agents]] [Dataset [https://drive.google.com/file/d/1lsQbD9_MCWcZQ8MCyWzhixh2GkHD5kCp/view?usp=sharing]] AI AGENTS FOR OFFSEC WITH ZERO FALSE POSITIVES Brendan Dolan-Gavitt [Slides [https://i.blackhat.com/BH-USA-25/Presentations/US-25-Dolan-Gavitt-AI-Agents-for-Offsec-with-Zero-False-Positives-Thursday.pdf]] ARE CAPTCHAS STILL BOT-HARD? GENERALIZED VISUAL CAPTCHA SOLVING WITH AGENTIC VISION LANGUAGE MODEL Xiwen Teoh, Yun Lin, Siqi Li, Ruofan Liu, Avi Sollomoni, Yaniv Harel, and Jin Song Dong [Site [https://halligan.pages.dev/]] [Paper [https://www.usenix.org/system/files/usenixsecurity25-teoh.pdf]] [Code [https://zenodo.org/records/15709075]] GOOD VIBRATIONS INVISIBLE EARS AT YOUR FINGERTIPS: ACOUSTIC EAVESDROPPING VIA MOUSE SENSORS Mohamad Habib Fakih, Rahul Dharmaji, Youssef Mahmoud, Halima Bouzidi, and Mohammad Abdullah Al Faruque [Site [https://sites.google.com/view/mic-e-mouse]] [Paper [https://arxiv.org/pdf/2509.13581]] TIMETRAVEL: REAL-TIME TIMING DRIFT ATTACK ON SYSTEM TIME USING ACOUSTIC WAVES Jianshuo Liu, Hong Li, Haining Wang, Mengjie Sun, Hui Wen, Jinfa Wang, and Limin Sun [Paper [https://www.usenix.org/system/files/usenixsecurity25-liu-jianshuo.pdf]] NIFTY SUNDRIES CRESCENT LIBRARY BRINGS PRIVACY TO DIGITAL IDENTITY SYSTEMS Christian Paquin, Guru-Vamsi Policharla, and Greg Zaverucha [Blog post [https://www.microsoft.com/en-us/research/blog/crescent-library-brings-privacy-to-digital-identity-systems/]] [Paper [https://eprint.iacr.org/2024/2013.pdf]] [Code [https://github.com/microsoft/crescent-credentials/]] JOURNEY TO THE CENTER OF THE PSTN: HOW I BECAME A PHONE COMPANY, AND HOW YOU CAN TOO Enzo Damato [Slides [https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Enzo%20Damato%20-%20Journey%20to%20the%20center%20of%20the%20PSTN%20How%20I%20became%20a%20phone%20company%2C%20and%20why%20you%20should%20too..pdf]] [Video [https://www.youtube.com/watch?v=cA-ZQJ8EZSs]] SAFE HARBOR OR HOSTILE WATERS: UNVEILING THE HIDDEN PERILS OF THE TORCHSCRIPT ENGINE IN PYTORCH Ji'an Zhou and Lishuo Song [Slides [https://i.blackhat.com/BH-USA-25/Presentations/US-25-Jian-Lishuo-Safe-Harbor-or-Hostile-Waters.pdf]] GHOSTS IN THE MACHINE CHECK – CONJURING HARDWARE FAILURES FOR CROSS-RING PRIVILEGE ESCALATION Christopher Domas [Slides [https://i.blackhat.com/BH-USA-25/Presentations/US-25-Domas-Ghosts-in-the-Machine-Check-Wednesday.pdf]] [Code [https://github.com/xoreaxeaxeax/mchammer]] [Video [https://www.youtube.com/watch?v=B6dC_KVLn6Q]] MACHINE AGAINST THE RAG: JAMMING RETRIEVAL-AUGMENTED GENERATION WITH BLOCKER DOCUMENTS Avital Shafran, Roei Schuster, and Vitaly Shmatikov [Paper [https://www.usenix.org/system/files/usenixsecurity25-shafran.pdf]] [Code [https://zenodo.org/records/14730889]] INVERTING THE XORSHIFT128+ RANDOM NUMBER GENERATOR Scott Contini [Blog post [https://littlemaninmyhead.wordpress.com/2025/08/31/inverting-the-xorshift128-random-number-generator/]] [Code [https://github.com/ScottContini/a_better_xorshift128-inverter]]

ThinkstScapes Research Roundup - Q2 - 2025

ThinkstScapes Q2’25 NETWORKING IS ALWAYS TRICKY BEYOND THE HORIZON: UNCOVERING HOSTS AND SERVICES BEHIND MISCONFIGURED FIREWALLS Qing Deng, Juefei Pu, Zhaowei Tan, Zhiyun Qian, and Srikanth V. Krishnamurthy [Paper [https://www.cs.ucr.edu/~zhiyunq/pub/oakland25_firewall_misconfig.pdf]] 0.0.0.0 DAY: EXPLOITING LOCALHOST APIS FROM THE BROWSER Avi Lumelsky and Gal Elbaz [Blog post [https://www.oligo.security/blog/0-0-0-0-day-exploiting-localhost-apis-from-the-browser]] [Video [https://www.youtube.com/watch?v=Q9CuyEpEbVQ]] LOCAL MESS: COVERT WEB-TO-APP TRACKING VIA LOCALHOST ON ANDROID Aniketh Girish, Gunes Acar, Narseo Vallina-Rodriguez, Nipuna Weerasekara, and Tim Vlummens [Website [https://localmess.github.io/]] TRANSPORT LAYER OBSCURITY: CIRCUMVENTING SNI CENSORSHIP ON THE TLS-LAYER Niklas Niere, Felix Lange, Juraj Somorovsky, and Robert Merget [Code [https://github.com/tls-attacker/Censor-Scanner]] [Paper [https://ris.uni-paderborn.de/download/59824/59826/TLS_Obscurity.pdf]] LANGUAGE MODELS LARGE AND SMALL THE ROAD TO TOP 1: HOW XBOW DID IT Nico Waisman [Blog post [https://xbow.com/blog/top-1-how-xbow-did-it/]] AI AND SECURE CODE GENERATION Dave Aitel and Dan Geer [Blog post [https://www.lawfaremedia.org/article/ai-and-secure-code-generation]] A LOOK AT CLOUDFLARE’S AI-CODED OAUTH LIBRARY Neil Madden [Blog post [https://neilmadden.blog/2025/06/06/a-look-at-cloudflares-ai-coded-oauth-library/]] HOW I USED O3 TO FIND CVE-2025-37899, A REMOTE ZERODAY VULNERABILITY IN THE LINUX KERNEL’S SMB IMPLEMENTATION Sean Heelan [Blog post [https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/]] [Code [https://github.com/SeanHeelan/o3_finds_cve-2025-37899]] ENHANCING SECRET DETECTION IN CYBERSECURITY WITH SMALL LMS Danny Lazarev and Erez Harush [Blog post [https://www.wiz.io/blog/small-language-model-for-secrets-detection-in-code]] [Video [https://www.youtube.com/watch?v=1GIdQE1EuWM]] BAIT: LARGE LANGUAGE MODEL BACKDOOR SCANNING BY INVERTING ATTACK TARGET Guangyu Shen, Siyuan Cheng, Zhuo Zhang, Guanhong Tao, Kaiyuan Zhang, Hanxi Guo, Lu Yan, Xiaolong Jin, Shengwei An, Shiqing Ma, and Xiangyu Zhang [Code [https://github.com/SolidShen/BAIT]] [Paper [https://www.cs.purdue.edu/homes/shen447/files/paper/sp25_bait.pdf]] WHEN PARSING GOES RIGHT, AND WHEN IT GOES WRONG 3DGEN: AI-ASSISTED GENERATION OF PROVABLY CORRECT BINARY FORMAT PARSERS Sarah Fakhoury, Markus Kuppe, Shuvendu K. Lahiri, Tahina Ramananandro, and Nikhil Swamy [Slides [https://langsechq.gitlab.io/spw25/papers/ramananandro-invited-talk.pdf]] [Paper [https://arxiv.org/pdf/2404.10362]] GDBMINER: MINING PRECISE INPUT GRAMMARS ON (ALMOST) ANY SYSTEM Max Eisele, Johannes Hägele, Christopher Huth, and Andreas Zeller [Paper [https://drops.dagstuhl.de/entities/document/10.4230/LITES.10.1.1]] [Code [https://github.com/boschresearch/gdbminer]] PARSER DIFFERENTIALS: WHEN INTERPRETATION BECOMES A VULNERABILITY Joernchen / Joern Schneeweisz [Slides [https://0day.click/parser-diff-talk-oc25/]] [Video [https://www.youtube.com/watch?v=Dq_KVLXzxH8]] INBOX INVASION: EXPLOITING MIME AMBIGUITIES TO EVADE EMAIL ATTACHMENT DETECTORS Jiahe Zhang, Jianjun Chen, Qi Wang, Hangyu Zhang, Shengqiang Li, Chuhan Wang, Jianwei Zhuge, and Haixin Duan [Slides [https://i.blackhat.com/Asia-25/Asia-25-Zhang-Inbox-Invasion-Exploiting-MIME-Ambiguities.pdf]] [Paper [https://eki.im/publication/mimeminer-paper/mimeminer-paper.pdf]] [Code [https://github.com/MIME-miner/MIMEminer]] NIFTY SUNDRIES IMPOSTOR SYNDROME: HACKING APPLE MDMS USING ROGUE DEVICE ENROLMENTS Marcell Molnár and Magdalena Oczadły [Slides [https://i.blackhat.com/Asia-25/Asia-25-Molnar-Impostor-Syndrome-Hacking-Apple-MDMs.pdf]]  YOUR CABLE, MY ANTENNA: EAVESDROPPING SERIAL COMMUNICATION VIA BACKSCATTER SIGNALS Lina Pu, Yu Luo, Song Han, and Junming Diao [Paper [https://www.computer.org/csdl/proceedings-article/sp/2025/223600d710/26EkH5QQ1Ko]] GOSONAR: DETECTING LOGICAL VULNERABILITIES IN MEMORY SAFE LANGUAGE USING INDUCTIVE CONSTRAINT REASONING Md Sakib Anwar, Carter Yagemann, and Zhiqiang Lin [Paper [https://www.computer.org/csdl/proceedings-article/sp/2025/223600a043/21B7QweuVUs]] [Code [https://github.com/mdsakibanwar/gosonar]] SHOW ME YOUR ID(E)!: HOW APTS ABUSE IDES Tom Fakterman and Daniel Frank [Slides [https://static.rainfocus.com/rsac/us25/sess/1727366815392001bIC6/finalwebsite/2025_USA25_HT-M01_01_Show_Me_Your_ID%28E%29_How_APTs_Abuse_IDEs_1745448278421001Kcgl.pdf]] [Video [https://www.youtube.com/watch?v=lkiI8VGR7Vc]] INVITER THREAT: MANAGING SECURITY IN A NEW CLOUD DEPLOYMENT MODEL Meg Ashby [Video [https://www.youtube.com/watch?v=ilnOvSV0QtY]] CARRIER TOKENS—A GAME-CHANGER TOWARDS SMS OTP FREE WORLD! Kazi Wali Ullah [Slides [https://static.rainfocus.com/rsac/us25/sess/1727347141252001LtRC/finalwebsite/2025_USA25_IDY-M06_01_Carrier-Tokens-a-Game-Changer-Towards-SMS-OTP-Free-World_1744928556459001Cibw.pdf]] [Code [https://github.com/camaraproject/NumberVerification]] [Video [https://www.youtube.com/watch?v=cCp3O6q4oqg]]

ThinkstScapes Research Roundup - Q1 - 2025

THINKSTSCAPES Q1’25 PUTTING IT INTO PRACTICE HOMOMORPHIC ENCRYPTION ACROSS APPLE FEATURES Rehan Rishi, Haris Mughees, Fabian Boemer, Karl Tarbe, Nicholas Genise, Akshay Wadia, and Ruiyu Zhu [Code [https://github.com/apple/swift-homomorphic-encryption]] [Paper [https://arxiv.org/abs/2406.06761]] [Video [https://www.youtube.com/live/R1NEfuv3iMk?si=ORdgievrYHTfoGvn&t=17061]] BEYOND THE HOOK: A TECHNICAL DEEP DIVE INTO MODERN PHISHING METHODOLOGIES Alexandre Nesic [Blog [https://blog.quarkslab.com/technical-dive-into-modern-phishing.html]]  HOW TO BACKDOOR LARGE LANGUAGE MODELS Shrivu Shankar [Blog [https://blog.sshh.io/p/how-to-backdoor-large-language-models]] [Code [https://huggingface.co/sshh12/badseek-v2/tree/main]]  BUCCANEERS OF THE BINARY: PLUNDERING COMPILER OPTIMIZATIONS FOR DECOMPILATION TREASURE Zion Leonahenahe Basque [Code [https://github.com/angr/angr-management]] [Video [https://www.youtube.com/watch?v=VP29biKLoSw]] SOFTWARE SCREWS AROUND, REVERSE ENGINEERING FINDS OUT: HOW INDEPENDENT, ADVERSARIAL RESEARCH INFORMS GOVERNMENT REGULATION Andy Sellars and Michael A. Specter [Video [https://youtu.be/wXbnUm88IJw?list=PLnKSfJ5rXw95HSPVl5L7dqhKpVAx3q_j0&t=11045]] [Website [https://ftcreverse.engineering/#]] UNDERSTANDING THINGS ALL THE WAY DOWN PHANTOMLIDAR: CROSS-MODALITY SIGNAL INJECTION ATTACKS AGAINST LIDAR Zizhi Jin, Qinhong Jiang, Xuancun Lu, Chen Yan, Xiaoyu Ji, and Wenyuan Xu [Paper [https://arxiv.org/pdf/2409.17907v1]] [Demo Videos [https://sites.google.com/view/phantomlidar]] FULL-STACK REVERSE ENGINEERING OF THE ORIGINAL MICROSOFT XBOX Markus Gaasedelen [Video [https://www.youtube.com/watch?v=hGlIkgmhZvc]] WALLBLEED: A MEMORY DISCLOSURE VULNERABILITY IN THE GREAT FIREWALL OF CHINA Shencha Fan, Jackson Sippe, Sakamoto San, Jade Sheffey, David Fifield, Amir Houmansadr, Elson Wedwards, and Eric Wustrow [Paper [https://www.ndss-symposium.org/wp-content/uploads/2025-237-paper.pdf]] SCALING SOFTWARE (IN)SECURITY LOW-EFFORT DENIAL OF SERVICE WITH RECURSION Alexis Challande and Brad Swain [Paper [https://resources.trailofbits.com/input-driven-recursion-white-paper]] [Video [https://www.youtube.com/watch?v=7DKwB-jCLvU]] IS THIS MEMORY SAFETY HERE IN THE ROOM WITH US? Thomas Dullien (Halvar Flake) [Slides [https://docs.google.com/presentation/d/1-CgBbVuFE1pJnB84wfeq_RadXQs13dCvHTFFVLPYTeg/edit?usp=sharing]] [Video [https://www.youtube.com/watch?v=4pHZg8bKvmU]] HOW TO GAIN CODE EXECUTION ON MILLIONS OF PEOPLE AND HUNDREDS OF POPULAR APPS Eva [Blog [https://kibty.town/blog/todesktop/]] NODE IS A LOADER Tom Steele [Blog [https://www.atredis.com/blog/2025/3/7/node-is-a-loader]] MIXING UP PUBLIC AND PRIVATE KEYS IN OPENID CONNECT DEPLOYMENTS Hanno Böck [Blog [https://blog.hboeck.de/archives/909-Mixing-up-Public-and-Private-Keys-in-OpenID-Connect-deployments.html]] [Code [https://github.com/badkeys/badkeys]] NIFTY SUNDRIES WILL IT RUN? FOOLING EDRS WITH COMMAND LINES USING EMPIRICAL DATA Wietze Beukema [Tool site [https://argfuscator.net/]] [Code [https://www.github.com/wietze/Invoke-ArgFuscator]] [Video [https://www.youtube.com/watch?v=CNeUwrapJiQ]] HOMOGLYPH-BASED ATTACKS: CIRCUMVENTING LLM DETECTORS Aldan Creo [Paper [https://arxiv.org/abs/2406.11239]] [Code [https://github.com/ACMCMC/silverspeak]] [Video [https://www.youtube.com/watch?v=F2RGYKKoqp0]] 28 MONTHS LATER - THE ONGOING EVOLUTION OF RUSSIA'S CYBER OPERATIONS The Grugq [Slides [https://strapi.ootb.net/uploads/28_months_later_final_1357291282.pdf]] [Podcast interview [https://youtu.be/3w7E4Hhtubw?t=3791]] ‘IT'S NOT PARANOIA IF THEY'RE REALLY AFTER YOU’: WHEN ANNOUNCING DECEPTION TECHNOLOGY CAN CHANGE ATTACKER DECISIONS Andrew Reeves and Debi Ashenden [Paper [https://scholarspace.manoa.hawaii.edu/server/api/core/bitstreams/6c188375-03f6-4d66-afee-296308c9f2c0/content]] OFF-PATH TCP HIJACKING IN WI-FI NETWORKS: A PACKET-SIZE SIDE CHANNEL ATTACK Ziqiang Wang, Xuewei Feng, Qi Li, Kun Sun, Yuxiang Yang, Mengyuan Li, Ganqiu Du, Ke Xu, and Jianping Wu [Paper [https://arxiv.org/pdf/2402.12716]] [Code [https://github.com/Internet-Architecture-and-Security/Packet-Size-Side-Channel-Attack]]

ThinkstScapes Research Roundup - Q4 - 2024

ThinkstScapes Q4’24 WINS AND LOSSES IN THE MICROSOFT ECOSYSTEM POINTER PROBLEMS - WHY WE’RE REFACTORING THE WINDOWS KERNEL Joe Bialek [Video [https://www.youtube.com/watch?v=-3jxVIFGuQw]] DEFENDING OFF THE LAND Casey Smith, Jacob Torrey, and Marco Slaviero [Slides [https://github.com/thinkst/defending-off-the-land/blob/main/slides/BHEU24-TorreySlaviero.pdf]] [Code [https://github.com/thinkst/defending-off-the-land]] UNVEILING THE POWER OF INTUNE: LEVERAGING INTUNE FOR BREAKING INTO YOUR CLOUD AND ON-PREMISE Yuya Chudo [Slides [http://i.blackhat.com/EU-24/Presentations/EU-24-Chudo-Unveiling-the-Power-of-Intune-Leveraging-Intune-for-Breaking-Into-Your-Cloud-and-On-Premise.pdf]] [Code [https://github.com/secureworks/pytune]] FROM SIMULATION TO TENANT TAKEOVER Vaisha Bernard [Video [https://media.ccc.de/v/38c3-from-simulation-to-tenant-takeover]] FROM CONVENIENCE TO CONTAGION: THE LIBARCHIVE VULNERABILITIES LURKING IN WINDOWS 11 NiNi Chen [Slides [https://hitcon.org/2024/CMT/slides/From_Convenience_to_Contagion_The_Libarchive_Vulnerabilities_Lurking_in_Windows_11.pdf]] [Video [https://media.ccc.de/v/38c3-from-convenience-to-contagion-the-libarchive-vulnerabilities-lurking-in-windows-11]] LLM HYPE CONTINUES, AS DO THE SECURITY ISSUES THINGS WE LEARNED ABOUT LLMS IN 2024 Simon Willison [Blog [https://simonwillison.net/2024/Dec/31/llms-in-2024/]] AI MEETS GIT: UNMASKING SECURITY FLAWS IN QODO MERGE Nils Amiet [Slides [https://fahrplan.events.ccc.de/congress/2024/fahrplan/media/38c3/submissions/XXXSWE/resources/qodo-merge-38c3-slides_b7maUtc.pdf]] [Video [https://media.ccc.de/v/38c3-ai-meets-git-unmasking-security-flaws-in-qodo-merge]] [Blog [https://research.kudelskisecurity.com/2024/08/29/careful-where-you-code-multiple-vulnerabilities-in-ai-powered-pr-agent/]] SUICIDE BOT: NEW AI ATTACK CAUSES LLM TO PROVIDE POTENTIAL “SELF-HARM” INSTRUCTIONS Gadi Evron [Blog [https://www.knostic.ai/blog/introducing-a-new-class-of-ai-attacks-flowbreaking]] DIVING DEEP, THEN DIVING DEEPER BREAKING NATO RADIO ENCRYPTION Lukas Stennes [Paper [https://eprint.iacr.org/2023/1314.pdf]] [Video [https://media.ccc.de/v/38c3-breaking-nato-radio-encryption]] EXPLOITING FILE WRITES IN HARDENED ENVIRONMENTS Stefan Schiller [Blog [https://www.sonarsource.com/blog/why-code-security-matters-even-in-hardened-environments/]] [Video [https://www.youtube.com/watch?v=ltmZNTP2KX4]] HACKING YOURSELF A SATELLITE - RECOVERING BEESAT-1 PistonMiner [Video [https://media.ccc.de/v/38c3-hacking-yourself-a-satellite-recovering-beesat-1]] IRIS: NON-DESTRUCTIVE INSPECTION OF SILICON Andrew 'bunnie' Huang [Blog [https://www.bunniestudios.com/blog/2023/infra-red-in-situ-iris-inspection-of-silicon/]] [Paper [https://arxiv.org/pdf/2303.07406]] [Video [https://media.ccc.de/v/38c3-iris-non-destructive-inspection-of-silicon]] SQL INJECTION ISN'T DEAD Paul Gerste [Slides [https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Paul%20Gerste%20-%20SQL%20Injection%20Isn%27t%20Dead%20Smuggling%20Queries%20at%20the%20Protocol%20Level.pdf]] [Video [https://www.youtube.com/watch?v=N1FAOb1krBk]] NIFTY SUNDRIES WHAT DEVELOPERS GET FOR FREE? Louis Nyffenegger [Video [https://www.youtube.com/watch?v=8HSXgbSbkCA]] DIALING INTO THE PAST: RCE VIA THE FAX MACHINE – BECAUSE WHY NOT? Rick de Jager and Carlo Meijer [Video [https://www.youtube.com/watch?v=ZcV3esnIDF4]] BROKEN ISOLATION - DRAINING YOUR CREDENTIALS FROM POPULAR MACOS PASSWORD MANAGERS Wojciech Reguła [Slides [https://objectivebythesea.org/v7/talks/OBTS_v7_wRegula.pdf]] [Video [https://youtu.be/DqYyw2WjQPc]] I'LL BE THERE FOR YOU! PERPETUAL AVAILABILITY IN THE A8 MVX SYSTEM André Rösti, Stijn Volckaert, Michael Franz, and Alexios Voulimeneas [Code [https://github.com/andrej/a8]] [Paper [https://alexios-voulimeneas.github.io/papers/a8acsac2024.pdf]] EXPLORING AND EXPLOITING AN ANDROID “SMART POS” PAYMENT TERMINAL Jacopo Jannone [Video [https://www.youtube.com/watch?v=a9BFGlxP71Y]]