ThinkstScapes Research Roundup - Q1 - 2024

Revealing more than anticipated, and preventing prying eyesPrintListener: Uncovering the Vulnerability of Fingerprint Authentication via the Finger Friction SoundMan Zhou, Shuao Su, Qian Wang, Qi Li, Yuting Zhou, Xiaojing Ma, and Zhengxiong Li[Paper]ModelGuard: Information-Theoretic Defense Against Model Extraction AttacksMinxue Tang, Anna Dai, Louis DiValentin, Aolin Ding, Amin Hass, Neil Zhenqiang Gong, Yiran Chen, and Hai Li[Paper] [Code]RECORD: A RECeption-Only Region Determination Attack on LEO Satellite UsersEric Jedermann, Martin Strohmeier, Vincent Lenders, and Jens Schmitt[Code] [Paper]Private web search with TiptoeAlexandra Henzinger, Emma Dauterman, Henry Corrigan-Gibbs, and Nickolai Zeldovich[Slides] [Paper] [Video] [Code]Can Virtual Reality Protect Users from Keystroke Inference Attacks?Zhuolin Yang, Zain Sarwar, Iris Hwang, Ronik Bhaskar, Ben Y. Zhao, and Haitao Zheng[Website] [Paper]Backtrace in Time: Revealing Attackers’ Sleep Patterns and Days Off in RDP Brute-Force Attacks with Calendar HeatmapsAndréanne Bergeron[Code] [Blog] [Video]Taking another look with a fresh perspectiveBreaking HTTP Servers, Proxies, and Load Balancers Using the HTTP GardenBen Kallus and Prashant Anantharaman[Code] [Video]Compiler Backdooring For BeginnersMarion Marschalek[Video]Revisiting 2017: AI and Security, 7 years laterThomas Dullien[Video]Automated Large-Scale Analysis of Cookie Notice ComplianceAhmed Bouhoula, Karel Kubicek, Amit Zac, Carlos Cotrini, and David Basin[Paper] [Code Access]Turning Windows into doorsLSA WhispererEvan McBroom[Slides] [Blog] [Code]Wishing: Webhook Phishing in TeamsMatthew Eidelberg[Blog] [Code]Misconfiguration Manager: Overlooked and OverprivilegedDuane Michael and Chris Thompson[Slides] [Blog] [Code]Smoke and Mirrors: How to hide in Microsoft AzureAled Mehta and Christian Philipov[Video]Nifty sundriesBackdoor in XZ Utils allows RCE: everything you need to knowAndres Freund, Merav Bar, Amitai Cohen, Danielle Aminov, and Russ Cox[Initial Disclosure] [Wiz Blog] [Timeline]More Money, Fewer FOSS Security Problems? The Data, Such As It IsJohn Speed Meyers, Sara Ann Brackett, and Stewart Scott[Video]MUDding Around: Hacking for gold in text-based gamesUnix-ninja[Blog]DeGPT: Optimizing Decompiler Output with LLMPeiwei Hu, Ruigang Liang, and Kai Chen[Paper]