UCL InfoSec

Twitter Page of UCL's Information Security Research Group & the Academic Centre of Excellence in Cybersecurity Research

[UCL InfoSec @uclisec]

“Phishing at the Front Desk: Usable Security in Luxury Hotels” by Tania Maynard-Browne, a post on Bentham’s Gaze. https://t.co/OaFB1mXLAE

[Arthur Gervais @HatforceSec]

Aussieland, we're coming to NeurIPS!

[Arthur Gervais @HatforceSec]

Our paper on AI security agents was accepted at #NeurIPS2026 🎉

The question: does safety training make AI models worse at security work?

We gave 4 open models and their uncensored versions the same 30 sandboxed vulnerability tasks, 1,500 runs in total

Joint work with the @Zaddyzaddy

[Steven Murdoch @sjmurdoch]

It’s #NationalCodingWeek next week, so I've published a resource on using the BBC @microbit_edu to play a game that explores how radio waves travel, get blocked by/reflected off obstacles, and the challenges of measuring strong signals that can overload sensors.

[Steven Murdoch @sjmurdoch]

National COVID-19 figures couldn’t tell a department whether to hold a seminar next week. So from 2020 to 2022 I collected UCL’s daily case counts and turned them into an early-warning chart. I’ve now archived all of it plus 168 newsletters for context. https://t.co/jbLnUOx648

[Arthur Gervais @HatforceSec]

Glad you asked, the main differences I see right now:

+ Gumu offers sovereign on-prem + local model support (if you don't want to send your research to OpenAI)
+ PDF diff mode
+ auto-recompile after edits
+ GitHub integration
+ author profiles for writing in your academic style
+ one-click paper helpers (see image)

Prism’s UI is nice and fast though, and backend/VM compute looks broadly comparable.

[Steven Murdoch @sjmurdoch]

I was interviewed for Computerphile on my analysis of hidden messages within the GPS signals and what message they might carry (and to whom). https://t.co/Av1tGNwjQn

[Steven Murdoch @sjmurdoch]

The corrected and expanded article on my exploration of GPS special messages is available at https://t.co/4lREix0OJA. Additionally, this is now mobile-friendly and accompanied by detailed footnotes, allowing results to be verified against the published dataset. 5/

[Arthur Gervais @HatforceSec]

New paper out with @Zaddyzaddy

tldr: Security patches are also attack maps. Patch2Vuln asks whether an offline LLM agent can look only at old/new Linux binary packages, no source patch, no advisory text, and infer what vulnerability was fixed.

It builds a local pipeline around ELF extraction, Ghidra/Ghidriff binary diffing, changed-function ranking, dossier generation, and agentic audit/validation.

On 25 Ubuntu .deb package pairs, it found the correct security-relevant patched function in 10/20 real security updates and the accepted root-cause class in 11/20, while correctly treating all 5 negative controls as unknown.

The fascinating bit: this is basically post-patch vulnerability archaeology. It shows that once a binary security update ships, an agent can sometimes reconstruct the hidden bug from the patch artifact alone.

But the main bottleneck is not yet “LLM reasoning”; it is whether the binary diff/ranking stage surfaces the right function and whether local validation can turn the hypothesis into behavioral evidence.

[Steven Murdoch @sjmurdoch]

For 19 years, GPS satellites have secretly broadcast a “numbers station” in their public signals. We decoded 12M messages: a 2011 flash where 31 of 32 satellites flipped in hours, “ghost” substrings repeating years apart, and a “TEXT” prefix spreading now. https://t.co/xz3svmqiDa

[SaTML Conference @satml_conf]

The program chairs for #SaTML2027 will be Fabio Pierazzi (@fbpierazzi) and Florian Tramèr (@florian_tramer)! We're in for a great conference under their leadership.

[Economics Observatory @EconObservatory]

JUST PUBLISHED – Trust and technology: what went wrong with the Post Office?

By J Dwyer-Joyce (@uclisec)

https://t.co/upSnDdaE4Y

[Steven Murdoch @sjmurdoch]

Reuters were accused of acting illegally in guessing the URL of an unreleased report in 2002. I didn’t hear anything after the initial reports so presume it was quietly dropped or settled. https://t.co/XumoiInMwW

[Sharad Agarwal, PhD @shad1126]

I was quoted in @AsianVoiceNews alongside Jonathan Ellison from @NCSC, helping raise #scamawareness ahead of the #BlackFriday rush! @uclisec @uclcs @ucl
#InternationalFraudAwarenessWeek #ScamAware #BBCScamSafe @bbcasiannetwork @bbceducation @TakeFive @UKFtweets

[Sharad Agarwal, PhD @shad1126]

Honoured and humbled to share that we (#StopScamsUK) won the @theTECAs Outstanding Private/Third Sector Initiative Award 🏆 Thanks to all our members and the team ❤️ Onwards and upwards 🚀
#TacklingEconomicCrimeAwards #TECAs #OnlineFraud #Scams #Teamwork

[Fabio Pierazzi @fbpierazzi]

[1/n] Competitive opportunity for a 4-year PhD scholarship at @uclcs

Deadline: Jan 5, 2026 @ 1pm

We're seeking exceptional PhD applicants with expertise in AI and cybersecurity for a competitive opportunity to work with myself and @lcavallaro #PhD #Cybersecurity #AI @uclisec

[George Danezis @GDanezis]

If you are going to ACM CCS in Taipei, and you have an interest in distributed systems or blockchains, you are invited to the Sui Academic event: https://t.co/SsS4MNhKrH

[Sharad Agarwal, PhD @shad1126]

‼️New paper alert 📣
Our latest paper on understanding SMS phishing infrastructure and strategies using public user reports (w/ @a_papasavva, @gsuareztangil, and @mjvasek) has been accepted @ACM_IMC_2025 📝📱@uclisec @uclcs @ucl @IMDEAInstitutes #cybercrime #smsscams #smishing

[SpaLab Research Lab @SpaLabUCR]

Emiliano will be back at UCL for a talk on Monday

📍 169 Euston Road, GF Seminar Room
📅 September 22
🕑 2:00 PM

Swing by if you’re in town and interested in synthetic data and privacy or just want to say hi.

https://t.co/NH4uPbAkrK

[Sharad Agarwal, PhD @shad1126]

Looking forward to presenting and discussing our paper (w/ @mjvasek) in collaboration with #StopScamsUK on #CNPfraud @NspWorkshop in Germany over the next few days! @uclisec @uclcs @ucl @StopScamsUK #onlinefraud #smishing #smscsams @Paymentology #NSPW #remotefraud #cardfraud