Networking beyond plug-and-play
GET /large file HTTP/1.1: Connection-Based TCP Amplification Attacks
Yepeng Pan, Lars Richter, and Christian Rossow
[Paper] [Code]
WAFFLED: Exploiting Parsing Discrepancies to Bypass Web Application Firewalls
Seyed Ali Akhavani, Bahruz Jabiyev, Ben Kallus, Cem Topcuoglu, Sergey Bratus, and Engin Kirda
[Paper] [Code]
Excuse me, what precise time is it?
Oliver Ettlin
[Video]
Cut To The QUIC: Slashing QUIC's Performance With A Hash DoS
Paul Bottinelli
[Slides] [Code]
High-impact security at the foundations
Understanding the Security Impact of CHERI on the Operating System Kernel
Zhaofeng Li, Jerry Zhang, Joshua Tlatelpa-Agustin, Xiangdong Chen, and Anton Burtsev
[Code] [Paper]
CUDA de Grâce: Owning AI Cloud Infrastructure with GPU Exploits
Valentina Palmiotti and Samuel Lovejoy
[Video]
Defeating KASLR by Doing Nothing at All
Seth Jenkins
[Blog post] [Code]
Build a Fake Phone, Find Real Bugs: Qualcomm GPU Emulation and Fuzzing with LibAFL QEMU
Romain Malmain and Scott Bauer
[Code] [Video]
Rust in Android: move fast and fix things
Jeff Vander Stoep
[Blog post] [Rust course]
Skynet Starter Kit: From Embodied AI Jailbreak to Remote Takeover of Humanoid Robots
Shipei Qu, Zikai Xu, and Xuangan Xiao
[Video]
Wins and losses with LLMs and security
Scaling agentic architectures for autonomous security testing and offensive operations
Jason Garman, Jake Coyne, and Aaron Brown
[Slides] [Code]
Forced Descent: Google Antigravity Persistent Code Execution Vulnerability
Aaron Portnoy
[Blog post]
Flaw And Order: Finding The Needle In The Haystack Of CodeQL Using LLMs
Simcha Kosman
[Slides] [Blog post] [Code]
Rescuing the Unpoisoned: Efficient Defense against Knowledge Corruption Attacks on RAG Systems
Kim Minseok, Lee Hankook, and Koo Hyungjoon
[Code] [Paper]
Whisper Leak: A novel side-channel attack on remote language models
Jonathan Bar Or and Geoff McDonald
[Blog post] [Paper] [Code]
Nifty sundries
Format-Preserving Compression-Tolerating Authenticated Encryption for Images
Alexandra Boldyreva, Kaishuo Cheng, and Jehad Hussein
[Slides] [Paper]
Why Quantum Cryptanalysis is Bollocks
Peter Gutmann
[Video] [Slides]
Unmasking Organizations' Security Postures: Insights From Phishing-Resistant Authentication
Fei Liu
[Slides]
Those Who Do Not Learn from Advisories Are Doomed to Repeat Them
Louis Nyffenegger
[Video]
