34th USENIX Security Symposium
→ See editor’s top picks at 34th USENIX Security Symposium
- Malicious LLM-Based Conversational AI Makes Users Reveal Personal Information — Xiao Zhan, Juan Carlos Carrillo, VRAIN, William Seymour, Jose Such, King's College London, VRAIN
This groundbreaking research paper, "Malicious LLM-Based Conversational AI Makes Users Reveal Personal Information," presented at USENIX Security, unveils a novel and concerning threat posed by…
- An Industry Interview Study of Software Signing for Supply Chain Security — Kelechi G. Kalu, Tanmay Singla, Chinenye Okafor, Santiago Torres-Arias, James C. Davis
This article delves into the findings of "An Industry Interview Study of Software Signing for Supply Chain Security," a qualitative research paper presented at USENIX Security. The study addresses a…
- Characterizing and Detecting Propaganda-Spreading Accounts on Telegram — Klim Kireev, EPFL, Yevhen Mykhno, Carmela Troncoso, EPFL, Rebekah Overdorf, Ruhr University Bochum (RUB), Research Center Trustworthy Data Science, Security in University Alliance Ruhr
This distinguished paper from USENIX Security 2025, titled "Characterizing and Detecting Propaganda-Spreading Accounts on Telegram," addresses the critical and evolving cybersecurity threat of…
- LLMmap: Fingerprinting for Large Language Models — Dario Pasquini, Evgenios M. Kornaropoulos, Giuseppe Ateniese
The proliferation of Large Language Models (LLMs) into mainstream applications has introduced a new frontier for cybersecurity research, particularly concerning their inherent vulnerabilities. This…
- Refusal Is Not an Option: Unlearning Safety Alignment of Large Language Models — Minkyoo Song, Hanna Kim, Jaehan Kim, Seungwon Shin, Sooel Son
This article delves into a critical security vulnerability in Large Language Models (LLMs) uncovered by researchers from KAIST, presented at USENIX Security. The paper, titled "Refusal Is Not an…
- Narrowbeer: A Practical Replay Attack Against the Widevine DRM — Florian Roudot, Mohamed Sabt, Univ Rennes, CNRS
This technical article delves into the research presented in "Narrowbeer: A Practical Replay Attack Against the Widevine DRM," a paper by Florian Roudot and Mohamed Sabt from IRISA, Univ Rennes, and…
- My ZIP isn't your ZIP: Identifying and Exploiting Semantic Gaps Between ZIP Parsers — Yufan You, Jianjun Chen, Zhongguancun Laboratory, Qi Wang, Haixin Duan, Zhongguancun Laboratory
The ubiquitous ZIP file format, a foundational component for everything from office documents and Android applications to Java archives and browser extensions, harbors a pervasive and under-explored…
- SoK: Towards a Unified Approach to Applied Replicability for Computer Security — Daniel Olszewski, Tyler Tucker, Kevin R. B. Butler, Patrick Traynor
In an era where scientific rigor and empirical validation are paramount, the computer security community, like many other scientific disciplines, faces increasing calls for improved research…
- X.509DoS: Exploiting and Detecting Denial-of-Service Vulnerabilities in Cryptographic Libraries using Crafted X.509 Certificates — Bing Shi, Wenchao Li, Yuchen Wang, Xiaolong Bai, Luyi Xing
This article details the findings presented in the USENIX Security paper "X.509DoS: Exploiting and Detecting Denial-of-Service Vulnerabilities in Cryptographic Libraries using Crafted X.509…
- EvilEDR: Repurposing EDR as an Offensive Tool — Kotaiba Alachkar, Dirk Gaastra, Eduardo Barbaro, Michel van Eeten, Yury Zhauniarovich
Endpoint Detection and Response (EDR) systems are widely adopted in enterprises for their continuous monitoring, threat detection, and response capabilities, forming a cornerstone of modern security…
- TAPAS: An Efficient Online APT Detection with Task-guided Process Provenance Graph Segmentation and Analysis — Bo Zhang, Yansong Gao, Changlong Yu, Boyu Kuang, Zhi Zhang, Hyoungshick Kim, Anmin Fu
Advanced Persistent Threats (APTs) represent one of the most formidable challenges in modern cybersecurity, characterized by their sophisticated, stealthy, and long-duration attack campaigns. While…
- Nothing is Unreachable: Automated Synthesis of Robust Code-Reuse Gadget Chains for Arbitrary Exploitation Primitives — Nicolas Bailluet, Univ Rennes, Inria, CNRS, Emmanuel Fleury, Univ Bordeaux, CNRS, Isabelle Puaut, Erven Rohou, Univ Rennes, Inria, CNRS
This groundbreaking paper introduces **ARCANIST**, a novel approach and proof-of-concept tool for the automated synthesis of code-reuse gadget chains. Addressing a critical gap in modern exploit…
- Email Spoofing with SMTP Smuggling: How the Shared Email Infrastructures Magnify this Vulnerability — Chuhan Wang, Chenkai Wang, Songyi Yang, Sophia Liu, Jianjun Chen, Haixin Duan, Gang Wang
This groundbreaking research paper delves into the profound implications of **SMTP smuggling**, a sophisticated email spoofing vulnerability that bypasses established authentication protocols like…
- The Silent Danger in HTTP: Identifying HTTP Desync Vulnerabilities with Gray-box Testing — Keran Mu, Jianjun Chen, Jianwei Zhuge, Qi Li, Haixin Duan, Zhongguancun Laboratory, Nick Feamster
HTTP Desynchronization (HTTP Desync) represents a critical and pervasive security threat in the modern, decentralized Internet landscape. This talk, based on a peer-reviewed paper presented at…
- Catch-22: Uncovering Compromised Hosts using SSH Public Keys — Cristian Munteanu, Georgios Smaragdakis, Anja Feldmann, Tobias Fiebig
This distinguished paper from USENIX Security 2025 presents a novel, scalable methodology to identify compromised SSH (Secure Shell) servers across the Internet. Authored by researchers from the Max…
- Exposing the Guardrails: Reverse-Engineering and Jailbreaking Safety Filters in DALL·E Text-to-Image Pipelines — Corban Villa, Shujaat Mirza, Christina Pöpper
This groundbreaking paper, "Exposing the Guardrails: Reverse-Engineering and Jailbreaking Safety Filters in DALL·E Text-to-Image Pipelines," delves into the opaque world of safety mechanisms…
- TORCHLIGHT: Shedding LIGHT on Real-World Attacks on Cloudless IoT Devices Concealed within the Tor Network — Yumingzhi Pan, Zhen Ling, Yue Zhang, Hongze Wang, Guangchi Liu, Junzhou Luo, Xinwen Fu
This groundbreaking research, titled "TORCHLIGHT: Shedding LIGHT on Real-World Attacks on Cloudless IoT Devices Concealed within the Tor Network," uncovers a critical and previously under-explored…
- CloudFlow: Identifying Security-sensitive Data Flows in Serverless Applications — Giuseppe Raffa, Royal Holloway, Jorge Blasco, Dan O'Keeffe, Royal Holloway, Santanu Kumar Dash
The rapid adoption of the serverless computing paradigm has revolutionized cloud application development, offering developers the advantage of focusing solely on business logic while abstracting…
- Exploring and Exploiting the Resource Isolation Attack Surface of WebAssembly Containers — Zhaofeng Yu, Dongyang Zhan, Lin Ye, Haining Yu, Hongli Zhang, Zhihong Tian
This article delves into the critical security vulnerabilities present in WebAssembly (Wasm) runtimes, specifically focusing on their **resource isolation attack surface**. Authored by Zhaofeng Yu…
- TDXploit: Novel Techniques for Single-Stepping and Cache Attacks on Intel TDX — Fabian Rauscher, Luca Wilke, Hannes Weissteiner, Thomas Eisenbarth, Daniel Gruss
Intel Trust Domain Extensions (**TDX**) represent the second generation of Trusted Execution Environments (TEEs), designed to protect entire virtual machines (VMs), known as trust domains (TDs)…
- Approve Once, Regret Forever: On the Exploitation of Ethereum's Approve-TransferFrom Ecosystem — Nicola Ruaro, Fabio Gritti, Dongyu Meng, Robert McLaughlin, University of California, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, University of California
This research paper, "Approve Once, Regret Forever: On the Exploitation of Ethereum's Approve-TransferFrom Ecosystem," presented at USENIX Security, delves into a critical class of vulnerabilities…
- Deanonymizing Ethereum Validators: The P2P Network Has a Privacy Issue — Lioba Heimbach, Yann Vonlanthen, Juan Villacis, Lucianna Kiffer, Roger Wattenhofer
This research paper, presented at USENIX Security, unveils a critical privacy vulnerability within the **Ethereum peer-to-peer (P2P) network**. Authored by a team of researchers from ETH Zurich…
- Am I Infected? Lessons from Operating a Large-Scale IoT Security Diagnostic Service — Takayuki Sasaki, Tomoya Inazawa, Youhei Yamaguchi, Simon Parkin, Michel van Eeten, Katsunari Yoshioka, Tsutomu Matsumoto
The proliferation of Internet of Things (IoT) devices in homes has introduced a significant security challenge: users are often ill-equipped to secure these devices, lacking both the information and…
- I Know What You Said: Unveiling Hardware Cache Side-Channels in Local Large Language Model Inference — Zibo Gao, Junjie Hu, Feng Guo, Yixin Zhang, Yinglong Han, Siyuan Liu, Haiyang Li, Zhiqiang Lv, Institute of Information Engineering, Chinese Academy of Sciences, School of Cyber Security
This paper, presented at USENIX Security, unveils a critical and previously unexplored security vulnerability in locally deployed Large Language Models (LLMs): **hardware cache side-channel…
- When LLMs Go Online: The Emerging Threat of Web-Enabled LLMs — Hanna Kim, Minkyoo Song, Seung Ho Na, Seungwon Shin, Kimin Lee
This groundbreaking paper, "When LLMs Go Online: The Emerging Threat of Web-Enabled LLMs," presented by researchers from the Korea Advanced Institute of Science and Technology (KAIST), delves into…
- A Mixed-Methods Study of Open-Source Software Maintainers On Vulnerability Management and Platform Security Features — Jessy Ayala, Yu-Jye Tung, Joshua Garcia, University of California
In the rapidly evolving landscape of modern software development, open-source software (**OSS**) forms the backbone of countless applications and services. However, this pervasive reliance on OSS…
- "I wasn't sure if this is indeed a security risk": Data-driven Understanding of Security Issue Reporting in GitHub Repositories of Open Source npm Packages — Rajdeep Ghosh, Shiladitya De, Mainack Mondal
This paper presents a critical, data-driven investigation into the effectiveness and challenges of security issue reporting within the vast **npm (Node Package Manager)** ecosystem. Given npm's…
- StruQ: Defending Against Prompt Injection with Structured Queries — Sizhe Chen, Julien Piet, Chawin Sitawarin, David Wagner
The proliferation of Large Language Models (LLMs) has ushered in a new era of LLM-integrated applications, from intelligent chatbots to sophisticated data analysis tools. However, this rapid…
- Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack — Mark Russinovich, Ahmed Salem, Ronen Eldan
The rapid proliferation of Large Language Models (LLMs) across various applications has brought their impressive capabilities into the spotlight, alongside increasing scrutiny of their security and…
- SoK: So, You Think You Know All About Secure Randomized Caches? — Anubhav Bhatla, Hari Rohit Bhavsar, Sayandeep Saha, Biswabandan Panda
This Systematization of Knowledge (SoK) paper, titled "SoK: So, You Think You Know All About Secure Randomized Caches?", delivers a comprehensive and systematic analysis of the microarchitectural…
- Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection — Matej Bölcskei, Flavien Solt, Katharina Ceesay-Seitz, Kaveh Razavi
The research presented in "Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection" addresses a critical challenge in hardware security: the lack of a standardized and effective methodology for…
- FLOP: Breaking the Apple M3 CPU via False Load Output Predictions — Jason Kim, Jalen Chuang, Daniel Genkin, Yuval Yarom
This article delves into "FLOP: Breaking the Apple M3 CPU via False Load Output Predictions," a significant research paper presented at USENIX Security. The work, authored by Jason Kim, Jalen…
- Branch Privilege Injection: Compromising Spectre v2 Hardware Mitigations by Exploiting Branch Predictor Race Conditions — Sandro Rüegge, Johannes Wikner, Kaveh Razavi
This groundbreaking paper from ETH Zurich introduces **Branch Predictor Race Conditions (BPRC)**, a novel class of microarchitectural vulnerabilities that undermine hardware-enforced mitigations…
- Confusing Value with Enumeration: Studying the Use of CVEs in Academia — Moritz Schloegel, Daniel Klischies, Simon Koch, David Klein, Lukas Gerlach, Malte Wessels, Leon Trampert, Martin Johns, Mathy Vanhoef, DistriNet, Michael Schwarz, Thorsten Holz, Jo Van Bulck, DistriNet
This distinguished paper from USENIX Security 2025, titled "Confusing Value with Enumeration: Studying the Use of CVEs in Academia," presents a critical and systematic examination of how Common…
- Demystifying the (In)Security of QR Code-based Login in Real-world Deployments — Xin Zhang, Xiaohan Zhang, Bo Zhao, Yuhong Nan, Zhichen Liu, Jianzhou Chen, Huijun Zhou, Min Yang
QR code-based Login, or **QRLogin**, has rapidly gained traction as a user-friendly alternative to traditional username and password authentication for web accounts. Its appeal lies in simplifying…
- Universal Cross-app Attacks: Exploiting and Securing OAuth 2.0 in Integration Platforms — Kaixuan Luo, Xianbo Wang, Pui Ho Adonis Fung, Wing Cheong Lau, Julien Lecomte
This article delves into the critical security vulnerabilities discovered in **integration platforms** that leverage **OAuth 2.0** for **account linking**. The paper, authored by Kaixuan Luo and…
- TapTrap: Animation-Driven Tapjacking on Android — Philipp Beer, Marco Squarcina, Sebastian Roth, Martina Lindorfer
"TapTrap: Animation-Driven Tapjacking on Android" introduces a novel and stealthy attack vector that exploits Android's activity transition animations to circumvent the platform's permission model…
- POPS: From History to Mitigation of DNS Cache Poisoning Attacks — Yehuda Afek, Harel Berger, Anat Bremler-Barr
This article delves into "POPS: From History to Mitigation of DNS Cache Poisoning Attacks," a pivotal work presented at USENIX Security. Authored by Yehuda Afek, Harel Berger, and Anat Bremler-Barr…
- DNS FLaRE: A Flush-Reload Attack on DNS Forwarders — Gilad Moav, Yehuda Afek, Anat Bremler-Barr, Amit Klein
In an era where digital footprints increasingly reveal personal information, the privacy of online browsing activity remains a critical concern. The paper "DNS FLaRE: A Flush-Reload Attack on DNS…
- Assessing the Aftermath: the Effects of a Global Takedown against DDoS-for-hire Services — Anh V. Vu, Ben Collier, Daniel R. Thomas, John Kristoff, Richard Clayton, Alice Hutchings
This article delves into the findings of a comprehensive research paper presented at USENIX Security, titled "Assessing the Aftermath: the Effects of a Global Takedown against DDoS-for-hire…
- BGP Vortex: Update Message Floods Can Create Internet Instabilities — Felix Stöger, Henry Birge-Lee, Giacomo Giuliari, Jordi Subira-Nieto, Adrian Perrig
The Border Gateway Protocol (**BGP**), the foundational inter-domain routing protocol of the Internet, faces persistent challenges in maintaining stability and ensuring rapid convergence of routing…
- ImpROV: Measurement and Practical Mitigation of Collateral Damage in RPKI Route Origin Validation — Weitong Li, Yuze Li, Taejoong Chung
The internet's foundational routing protocol, the **Border Gateway Protocol (BGP)**, was not designed with robust security in mind, leaving it vulnerable to various attacks, most notably **prefix…
- We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs — Joseph Spracklen, Raveen Wijewickrama, A H M Nazmus Sakib, Anindya Maiti, Bimal Viswanath, Murtuza Jadliwala
This distinguished paper, "We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs," delves into a critical and emerging threat to the software supply…
- Are CAPTCHAs Still Bot-hard? Generalized Visual CAPTCHA Solving with Agentic Vision Language Model — Xiwen Teoh, National University of Singapore, Yun Lin, Siqi Li, Ruofan Liu, Avi Sollomoni, Yaniv Harel, Jin Song Dong
This paper introduces **Halligan**, the first generalized visual CAPTCHA solver built upon state-of-the-art **vision language models (VLMs)**. Authored by a team of researchers from Shanghai Jiao…
- Make Agent Defeat Agent: Automatic Detection of Taint-Style Vulnerabilities in LLM-based Agents — Fengyu Liu, Yuan Zhang, Jiaqi Luo, Jiarun Dai, Tian Chen, Letian Yuan, Zhengmin Yu, Youkun Shi, Ke Li, Chengyuan Zhou, Hao Chen, Min Yang
The rapid proliferation of Large Language Models (LLMs) has led to a new paradigm in software development: **LLM-based agents**. These AI-powered applications are designed to understand natural…
- Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents — Avital Shafran, Roei Schuster, Vitaly Shmatikov
This paper introduces and rigorously evaluates a novel class of denial-of-service vulnerabilities in **Retrieval-Augmented Generation (RAG)** systems, termed **jamming attacks**. Authored by Avital…
- PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models — Wei Zou, Runpeng Geng, Binghui Wang, Jinyuan Jia
This article delves into "PoisonedRAG," a groundbreaking research paper presented at USENIX Security that uncovers a critical new attack surface in Retrieval-Augmented Generation (RAG) systems. RAG…
- BarraCUDA: Edge GPUs do Leak DNN Weights — Peter Horvath, Lukasz Chmielewski, Masaryk University, Léo Weissbart, Lejla Batina, Yuval Yarom
This article delves into BarraCUDA, a groundbreaking side-channel attack meticulously detailed in a paper presented at USENIX Security. The research, spearheaded by Peter Horvath and a team from…
- The Doom of Device Drivers: Your Android Device (Most Likely) has N-Day Kernel Vulnerabilities — Lukas Maar, Florian Draschbacher, Lorenz Schumm, Ernesto Martínez García, Stefan Mangard
This groundbreaking paper, "The Doom of Device Drivers: Your Android Device (Most Likely) has N-Day Kernel Vulnerabilities," presented by Lukas Maar and his colleagues from Graz University of…
- NASS: Fuzzing All Native Android System Services with Interface Awareness and Coverage — Philipp Mao, Marcel Busch, Mathias Payer
This article details the research presented in the USENIX Security paper "NASS: Fuzzing All Native Android System Services with Interface Awareness and Coverage." The paper introduces NASS, a novel…
- Tracking You from a Thousand Miles Away! Turning a Bluetooth Device into an Apple AirTag Without Root Privileges — Junming Chen, Xiaoyue Ma, Lannan Luo, Qiang Zeng
This groundbreaking research introduces **nRootTag**, a novel attack method that weaponizes Apple's ubiquitous Find My network to maliciously track Bluetooth-enabled devices, transforming them into…
- ChoiceJacking: Compromising Mobile Devices through Malicious Chargers like a Decade ago — Florian Draschbacher, Lukas Maar, Mathias Oberhuber, Stefan Mangard
This paper introduces **ChoiceJacking**, a novel family of USB-based attacks that effectively bypass the existing mitigations against **JuiceJacking** attacks, which were discovered about a decade…
- PATCHAGENT: A Practical Program Repair Agent Mimicking Human Expertise — Zheng Yu, Ziyi Guo, Yuhang Wu, Jiahao Yu, Meng Xu, Dongliang Mu, Yan Chen, Xinyu Xing
The increasing complexity of modern software has led to a proliferation of vulnerabilities, posing significant challenges for developers to identify and fix them promptly. Automated Program Repair…
- APPATCH: Automated Adaptive Prompting Large Language Models for Real-World Software Vulnerability Patching — Yu Nong, Haoran Yang, Long Cheng, Hongxin Hu, Haipeng Cai
Software vulnerabilities pose an incessant and critical threat to digital security, with their volume and sophistication growing rapidly. Timely and effective patching is paramount, yet manual…
- DISPATCH: Unraveling Security Patches from Entangled Code Changes — Shiyu Sun, Yunlong Xing, Xinda Wang, Shu Wang, Palo Alto Networks, Qi Li, Kun Sun
This article delves into **DISPATCH**, a novel patch decomposition system designed to disentangle individual security patches from complex, multi-purpose code changes. Presented by researchers from…
- MalGuard: Towards Real-Time, Accurate, and Actionable Detection of Malicious Packages in PyPI Ecosystem — Xingan Gao, Xiaobing Sun, Sicong Cao, Kaifeng Huang, Di Wu, Xiaolei Liu, Xingwei Lin, Yang Xiang
The Python Package Index (PyPI), the official third-party software repository for Python, has become an increasingly attractive target for malicious actors. With a staggering 704,102 malicious…
- The Ransomware Decade: The Creation of a Fine-Grained Dataset and a Longitudinal Study — Armin Sarabi, Ziyuan Huang, Chenlan Wang, Tai Karir, Mingyan Liu
This comprehensive paper, "The Ransomware Decade: The Creation of a Fine-Grained Dataset and a Longitudinal Study," presents an in-depth analysis of the evolving ransomware landscape over the past…
- DarkGram: A Large-Scale Analysis of Cybercriminal Activity Channels on Telegram — Sayak Saha Roy, Elham Pourabbas Vafa, Kobra Khanmohamaddi, Shirin Nilizadeh
This article delves into the critical findings presented in the USENIX Security paper "DarkGram: A Large-Scale Analysis of Cybercriminal Activity Channels on Telegram." The research, conducted by…
- A Formal Analysis of Apple's iMessage PQ3 Protocol — Felix Linker, Ralf Sasse, David Basin
This article delves into the formal verification of Apple's **iMessage PQ3** protocol, a cutting-edge device-to-device messaging protocol designed to offer robust security, even against adversaries…
- OwlC: Compiling Security Protocols to Verified, Secure, High-Performance Libraries — Pratap Singh, Joshua Gancher, Bryan Parno
This article delves into **OwlC**, a groundbreaking compiler presented at USENIX Security that addresses a critical gap in the security of cryptographic protocols. While high-level designs of…
- Gotta Detect 'Em All: Fake Base Station and Multi-Step Attack Detection in Cellular Networks — Kazi Samin Mubasshir, Imtiaz Karim, Elisa Bertino
Cellular networks, with billions of connected devices globally, are critical infrastructure and, consequently, prime targets for malicious actors. A significant and persistent threat in this…
- CoreCrisis: Threat-Guided and Context-Aware Iterative Learning and Fuzzing of 5G Core Networks — Yilu Dong, Tianchang Yang, Abdullah Al Ishtiaq, Syed Md Mukit Rashid, Ali Ranjbar, Kai Tu, Tianwei Wu, Md Sultan Mahmud, Syed Rafiul Hussain
The rapid evolution of 5G cellular networks, driven by a new service-based architecture (SBA), introduces unprecedented flexibility and scalability but also presents complex security challenges. The…
- eSIMplicity or eSIMplification? Privacy and Security Risks in the eSIM Ecosystem — Maryam Motallebighomi, Jason Veara, Evangelos Bitsikas, Aanjhan Ranganathan
eSIM technology, the digital successor to the traditional physical SIM card, is rapidly transforming mobile connectivity by allowing users to activate cellular services remotely without hardware…
- ECC.fail: Mounting Rowhammer Attacks on DDR4 Servers with ECC Memory — Nureddin Kamadan, Walter Wang, Stephan van Schaik, Christina Garman, Daniel Genkin, Yuval Yarom
The "ECC.fail" paper presents a groundbreaking study on the persistent hardware vulnerability known as **Rowhammer**, specifically targeting server platforms equipped with **DDR4 ECC memory**…
- GPUHammer: Rowhammer Attacks on GPU Memories are Practical — Chris S. Lin, Joyce Qu, Gururaj Saileshwar
The USENIX Security paper "GPUHammer: Rowhammer Attacks on GPU Memories are Practical" unveils a groundbreaking discovery: the first successful **Rowhammer attack** against discrete NVIDIA GPUs…
- How Transparent is Usable Privacy and Security Research? A Meta-Study on Current Research Transparency Practices — Jan H. Klemmer, Juliane Schmüser, Fabian Fischer, Jacques Suray, Jan-Ulrich Holtgrave, Simon Lenau, Byron M. Lowens, Florian Schaub, Sascha Fahl
This distinguished paper from USENIX Security 2025 presents a groundbreaking **meta-study** examining the state of research transparency within the **Usable Privacy and Security (UPS)** community…
- Fuzzing the PHP Interpreter via Dataflow Fusion — Yuancheng Jiang, Chuqi Zhang, Bonan Ruan, Jiahao Liu, Manuel Rigger, Roland H. C. Yap, Zhenkai Liang
This article delves into FlowFusion, a groundbreaking automatic fuzzing framework designed to uncover memory errors within the PHP interpreter. Developed by a team from the National University of…
- ChainFuzz: Exploiting Upstream Vulnerabilities in Open-Source Supply Chains — Peng Deng, Lei Zhang, Yuchuan Meng, Zhemin Yang, Yuan Zhang, Min Yang
The "ChainFuzz: Exploiting Upstream Vulnerabilities in Open-Source Supply Chains" paper introduces **CHAINFUZZ**, an innovative automated approach designed to validate the exploitability of upstream…
- Bundled Authenticated Key Exchange: A Concrete Treatment of Signal's Handshake Protocol and Post-Quantum Security — Keitaro Hashimoto, Shuichi Katsumata, Thom Wiggers
This technical article delves into a significant research paper presented at USENIX Security, titled "Bundled Authenticated Key Exchange: A Concrete Treatment of Signal's Handshake Protocol and…
- Pig in a Poke: Automatically Detecting and Exploiting Link Following Vulnerabilities in Windows File Operations — Bocheng Xiang, Yuan Zhang, Fengyu Liu, Hao Huang, Zihan Lin, Min Yang
This article delves into the critical security research presented in "Pig in a Poke: Automatically Detecting and Exploiting Link Following Vulnerabilities in Windows File Operations." The paper…
- Towards Internet-Based State Learning of TLS State Machines — Marcel Maehren, Nurullah Erinola, Robert Merget, Jörg Schwenk, Juraj Somorovsky
This paper presents a groundbreaking approach to understanding the real-world behavior of Transport Layer Security (TLS) implementations by applying **state machine learning (SML)** techniques at an…
- Haunted by Legacy: Discovering and Exploiting Vulnerable Tunnelling Hosts — Angelos Beitis, Mathy Vanhoef, DistriNet
This groundbreaking research paper, "Haunted by Legacy: Discovering and Exploiting Vulnerable Tunnelling Hosts," systematically investigates the widespread prevalence and severe security…
- Password Guessing Using Large Language Models — Yunkai Zou, Maoxiang An, Ding Wang
This groundbreaking paper introduces **PassLLM**, an innovative framework that leverages **Large Language Models (LLMs)** with **Low-Rank Adaptation (LoRA)** techniques for advanced password…
- Phishing Attacks against Password Manager Browser Extensions — Claudio Anliker, Daniele Lain, Srdjan Capkun
This article delves into a critical security research paper titled "Phishing Attacks against Password Manager Browser Extensions," presented by Claudio Anliker, Daniele Lain, and Srdjan Capkun from…
- STEK Sharing is Not Caring: Bypassing TLS Authentication in Web Servers using Session Tickets — Sven Hebrok, Tim Leonhard Storm, Felix Matthias Cramer, Maximilian Radoy, Juraj Somorovsky
This article delves into a critical security vulnerability discovered in how modern web servers handle TLS session resumption, particularly in virtual hosting environments. Researchers from…