ThinkstScapes Research Roundup - Q3 - 2023

Cryptography still isn’t easycertmitm: automatic exploitation of TLS certificate validation vulnerabilitiesAapo Oksman[Slides] [Code] [Video]Escaping Phishermen Nets: Cryptographic Methods Unveiled in the Fight Against Reverse Proxy AttacksKsandros Apostoli[Blog]mTLS: When certificate authentication is done wrongMichael Stepankin[Slides] [Blog]Ultrablue: User-friendly Lightweight TPM Remote Attestation over BluetoothNicolas Bouchinet, Loïc Buckwell, and Gabriel Kerneis[Slides] [Code] [Video]HECO: Fully Homomorphic Encryption CompilerAlexander Viand, Patrick Jattke, Miro Haller, and Anwar Hithnawi[Slides] [Paper] [Code][Continued] attack of the side-channelsFreaky Leaky SMS: Extracting User Locations by Analyzing SMS TimingsEvangelos Bitsikas, Theodor Schnitzler, Christina Pöpper, and Aanjhan Ranganathan[Paper] [Code]Downfall: Exploiting Speculative Data GatheringDaniel Moghimi[Code] [Paper] Your Clocks Have Ears – Timing-Based Browser-Based Local Network Port ScannerDongsung Kim[Slides] [Demo] [Video]Composition is hard in the cloudUsing Cloudflare to bypass CloudflareFlorian Schweitzer and Stefan Proksch[Blog] The GitHub Actions Worm: Compromising GitHub repositories through the Actions dependency treeAsaf Greenholts[Slides] [Blog] [Video]All You Need is GuestMichael Bargury[Slides] [Code]Nifty sundriesContactless Overflow: Critical contactless vulnerabilities in NFC readers used in point of sales and ATMsJosep Pi Rodriguez[Slides] [Video]Defender-Pretender: When Windows Defender Updates Become a Security RiskOmer Attias and Tomer Bar[Slides] [Code] Fuzz target generation using LLMsDongge Liu, Jonathan Metzman, and Oliver Chang[Results] [Report] [Blog]Route to Bugs: Analyzing the Security of BGP Message ParsingDaniel dos Santos, Simon Guiot, Stanislav Dashevskyi, Amine Amri, and Oussama Kerro[Slides] [Code]It was harder to sniff Bluetooth through my mask during the pandemic…Xeno Kovah[Slides] [Data]