USENIX WOOT Conference on Offensive Technologies

WOOT aims to present a broad picture of offense and its contributions, bringing together researchers and practitioners in all areas of computer security

[USENIX WOOT Conference on Offensive Technologies @wootsecurity]

Schedule: https://t.co/CpAdphzKdq
Additionally:
* Monday 5.30 pm - Birds-of-Feather Sesssions
* Tuesday 4.30 pm - Demo/Poster Session and Happy Hour
in Harborside Ballroom C

[USENIX WOOT Conference on Offensive Technologies @wootsecurity]

Living the brand...

[USENIX WOOT Conference on Offensive Technologies @wootsecurity]

The SIM card taking over your phone via AT Commands and file R/W - "CATana Toolkit".

[nSinus-R (@[email protected]) @nSinusR]

Our @wootsecurity'26 paper "CATana" is now available: https://t.co/cfkMearbBF!

In the paper, we find that some phones and many IoT devices execute AT commands sent by the SIM, leading to a wide range of consequences from DoS over 2G downgrade to device compromise.

[USENIX WOOT Conference on Offensive Technologies @wootsecurity]

Android's ART caches C++ mirror objects for app-specific Java classes/methods. That file is typically stored in the app’s private directory, writable by the app itself at runtime. Pretty sure there is nothing that can go wrong with that! https://t.co/yNQmBqNFKY

[USENIX WOOT Conference on Offensive Technologies @wootsecurity]

Congratulations on your Best Paper Award!

[USENIX WOOT Conference on Offensive Technologies @wootsecurity]

GRAPE is cross-context code-pattern scanner that scans the entire Chromium code base in 12 minutes and earned the Authors of "Squeezing Juicy Variant Bugs Out of Modern Browsers" $17k5 for 24 newly-found vulnerabilities.
Pre-print: https://t.co/T9VfppxQAU

[USENIX WOOT Conference on Offensive Technologies @wootsecurity]

"Don't trust your DRAM" -- Jacqueline Henes on attacking ARM TrustZone from userspace with memory aliasing https://t.co/0tB2lNR5kG

[USENIX WOOT Conference on Offensive Technologies @wootsecurity]

"Insecurity of Cellular Basebands" analyzes prior work on vulnerability discovery and attack surfaces; presenting a taxonomy of vulnerabilities, review state-of-the-art analysis techniques, including static analysis, over-the-air testing, and emulation.
https://t.co/O0BNhXQa9r

[USENIX WOOT Conference on Offensive Technologies @wootsecurity]

WebRTC security in IoT remains poorly understood. RTCInspect is an automated analysis framework to detect protocol & cryptographic weaknesses. @DistriNet conducted a comparative study of 21 real-world applications, spanning 11 consumer IoT devices and 10 major web platforms.

[USENIX WOOT Conference on Offensive Technologies @wootsecurity]

Pre-Print: https://t.co/2vOnLysZRo

[USENIX WOOT Conference on Offensive Technologies @wootsecurity]

Finding the right EM probe location is often the tedious, expert-driven part of electromagnetic side-channel attacks. Dev Mehta et al. paper, Swarm in EM Hay, turns this into an adaptive search problem - reducing trace count for AES key recovery by up to 16×.

[USENIX WOOT Conference on Offensive Technologies @wootsecurity]

Project Website: https://t.co/27MSmDDNBS Pre-Print: https://t.co/vRl66GNuGA

[USENIX WOOT Conference on Offensive Technologies @wootsecurity]

Last year, AIxCC showed that cyber reasoning systems (CRSs) perform discovery and patch bugs: most of the 7 open-source CRSs remain largely unusable outside their original infrastructure. @TeamAtlanta24 presents an open, local framework with ported components from every finalist.

[USENIX WOOT Conference on Offensive Technologies @wootsecurity]

What if malware could hide in plain sight? Not by disabling tools, but by drowning them in data. Telemetry Complexity Attacks generate overwhelming nested telemetry that crashes serializers, breaks database inserts, and freezes dashboards. 18 products tested. 7 affected. 3 CVEs

[USENIX WOOT Conference on Offensive Technologies @wootsecurity]

If you want to learn more, checkout the upcoming paper at WOOT'26 "SoK: 20 Years of Power, Privilege, and Peril in x86 System Management Mode". Preprint: https://t.co/Yv13w1vlOa

[USENIX WOOT Conference on Offensive Technologies @wootsecurity]

Your x86 CPU has a hidden mode that no OS can touch, no hypervisor can see, and no security tool can monitor. The security community spent 20 years asking: what could go wrong? Turns out: a lot.

[USENIX WOOT Conference on Offensive Technologies @wootsecurity]

PowerHooK demonstrates that VMs protected by AMD's SEV can still leak secrets through software-based power side channels. By exploiting transient execution to replay victim code paths, a malicious hypervisor can collect clean power traces and recover AES keys @m_oberhuber

[USENIX WOOT Conference on Offensive Technologies @wootsecurity]

Some rooms at conference rate are again available for WOOT: https://t.co/8vUb92CrUr

[USENIX WOOT Conference on Offensive Technologies @wootsecurity]

Pre-Print: https://t.co/8ikA5v73TV

[USENIX WOOT Conference on Offensive Technologies @wootsecurity]

Roudot & Sabt investigate how Widevine, Google's DRM, handles decrypted media inside modern browsers and shows that its output boundary can be intercepted surprisingly easily - on both Linux and Windows - incl. major streaming platforms, namely Netflix and Disney+.

[USENIX WOOT Conference on Offensive Technologies @wootsecurity]

Session currently employs its own uniquely designed messaging protocol, Session Protocol V1, having migrated from the extensively studied Signal Protocol. Three practical attacks: an impersonation attack, a message timestamp forgery attack, and message dropping and replay attacks