Infrastructure under renewed scrutiny
Lost in Translation: Text Message Spoofing via Email
Sumanth Rao, Ye Shu, Stefan Savage, Aaron Schulman, Geoffrey M. Voelker, and Enze Liu
[Code] [Paper]
Hack the Source, Of the Source
Tsi-Lin Ng
[Slides]
RebirthDay Attack: Reviving DNS Cache Poisoning with the Birthday Paradox
Xiang Li, Yuqi Qiu, Mingming Zhang, Zuyao Xu, Lu Sun, Baojun Liu, Jia Zhang, Xiaofeng Zheng, Haixin Duan, Zheli Liu, Yunhai Zhang, Dunqiu Fan, and Fasheng Miao
[Slides] [Paper]
Strange Inputs, Critical outputs: Attacking Infrastructure Through Innocuous Network Protocol Fields
Sasha Romijn
[Blog post] [Video]
Clouds raining data
Sub:jugation – Hijacking Cloud Identities by Recycling Namespaces in Global OIDC Issuers
Tal Skverer
[Blog post] [Video]
Rain: Transiently Leaking Data from Public Clouds Using Old Vulnerabilities
Mathé Hertogh, Dave Quakkelaar, Thijs Raymakers, Mahesh Hari Sarma, Marius Muench, Herbert Bos, and Erik van der Kouwe
[Code] [Paper] [Site]
OCInferno: An Offensive Security Toolkit for OCI
Scott Weston
[Code] [Lightning Talk Video] [Video]
Zapocalypse: Compromising every Zapier user through a Lambda memory leak
Yair Balilti
[Video] [Website]
Sharp edges in Windows ecosystems
Breaking Hybrid Boundaries Across Azure and Windows
Ilan Kalendarov and Ben Zamir
[Slides]
PhantomRPC: A New Privilege Escalation Flaw in Windows RPC
Haidar Kabibo
[Slides] [Code]
Iron Giant: When the vault becomes the victim
Erik Egsgard
[Video]
Hunting with models, and models being hunted
RadKey: An LLM-Guided RF Backscatter System for Through-Wall Keystroke Inference
Qijun Wang, Chunqi Qian, and Huacheng Zeng
[Code] [Paper] [Site]
Revelio: Blurred Images Can Still Disclose Your Identity
Haoyu Zhai, Shuo Wang, Pirouz Naghavi, Qingying Hao, and Gang Wang
[Site] [Paper]
Bad Vibes: Pwning Coding Agents 70 Times With The Same Bugs
Philip Tsukerman, Nil Ashkenazi, and Alon Zahavi
[Slides]
System Over Model, Tested: Reproducing Mythos's FreeBSD Find on Local Open-Weight Models
John McIntosh
[Blog post] [Code]
Nifty sundries
Protecting Cookies with Device Bound Session Credentials
Benjamin Ackerman, Daniel Rubery, and Guillaume Ehinger
[Blog post] [Documentation]
Turning Spam Filters Into Your Greatest Enemy: Intrusions Via RCEs in E-Mail Spam Filters
Ting-Wei Hsieh and Kai-Ching Wang
[Slides]
AirSnitch: Breaking Client Isolation in Wi-Fi Networks
Mathy Vanhoef, Zhiyun Qian, Xin'an Zhou, Juefei Pu, Zhutian Liu, Zhaowei Tan, and Srikanth Krishnamurthy
[Slides] [Paper] [Code]
