USENIX Workshop on Offensive Technologies (WOOT) Talks & Presentations

USENIX

AFL++ - Combining Incremental Steps of Fuzzing Research

AFL++: A community-driven fuzzing tool combining state-of-the-art research, offering novel features like Custom Mutator API. Enhances fuzzing process, enables quick testing of new techniques, and evaluates effectiveness individually and in combination.

• YouTube
• 20 minutes
• On-Demand
• Conference Talk

USENIX

Unearthing the TrustedCore - A Critical Review on Huawei’s Trusted Execution Environment

Unveils critical security flaws in Huawei's TrustedCore, exposing vulnerabilities in trusted execution environments and demonstrating weaknesses in hardware-backed cryptography on mobile devices.

• YouTube
• 22 minutes
• On-Demand
• Conference Talk

USENIX

Cloning Credit Cards - A Combined Pre-play and Downgrade Attack on EMV Contactless

Reveals a novel attack on EMV contactless payment cards, allowing creation of functional clones with pre-played authorization codes for unauthorized transactions at any EMV contactless terminal.

• YouTube
• 27 minutes
• On-Demand
• Conference Talk

USENIX

Security Impact of High Resolution Smartphone Cameras

Explores security risks of high-res smartphone cameras, including keystroke capture via facial reflections and fingerprint extraction, with potential for authentication bypass and identity fraud. Proposes mitigation strategies.

• YouTube
• 15 minutes
• On-Demand
• Conference Talk

USENIX

Inaudible Sound as a Covert Channel in Mobile Devices

Explores ultrasonic and vibration-based covert channels in mobile devices for data exfiltration, bypassing security measures. Proposes solutions to regulate sound-based vulnerabilities in information flow control.

• YouTube
• 19 minutes
• On-Demand
• Conference Talk

USENIX

Printed Circuit Board Deconstruction Techniques

Explore effective PCB reverse engineering techniques, from affordable home solutions to advanced technologies, for analyzing component interconnections and system functionality.

• YouTube
• 20 minutes
• On-Demand
• Conference Talk

USENIX

Hell of a Handshake - Abusing TCP for Reflective Amplification DDoS Attacks

Explores TCP-based amplification DDoS attacks, revealing vulnerabilities in the handshake process and identifying thousands of potential amplifiers through Internet-wide scans of common TCP protocols.

• YouTube
• 16 minutes
• On-Demand
• Conference Talk

USENIX

IPv6 Security - Attacks and Countermeasures in a Nutshell

Comprehensive overview of IPv6 security vulnerabilities and countermeasures, discussing current challenges and future research directions in network protocol security.

• YouTube
• 16 minutes
• On-Demand
• Conference Talk

USENIX

An Experience Report on Extracting and Viewing Memory Events via Wireshark

Innovative system for monitoring low-level memory events using Wireshark, enhancing debugging, reverse engineering, and security analysis. Offers efficient, non-invasive memory event tracking with wide-ranging applications.

• YouTube
• 19 minutes
• On-Demand
• Conference Talk

USENIX

Through the Looking-Glass, and What Eve Found There

Exploring security vulnerabilities in looking-glass web applications used by Autonomous Systems, revealing potential exploits that could lead to remote command execution on backbone routers and compromise Internet infrastructure.

• YouTube
• 17 minutes
• On-Demand
• Conference Talk

USENIX

Lowering the USB Fuzzing Barrier by Transparent Two-Way Emulation

Innovative USB testing framework enabling cost-effective, flexible analysis and modification of USB communication. Introduces two-way emulation for enhanced fuzzing and vulnerability detection.

• YouTube
• 19 minutes
• On-Demand
• Conference Talk

USENIX

Automated Reverse Engineering Using Lego

Innovative use of Lego robots for automated reverse engineering of smartcard readers, revealing security vulnerabilities through state machine learning and fuzzing techniques.

• YouTube
• 17 minutes
• On-Demand
• Conference Talk

USENIX

Tick Tock - Building Browser Red Pills from Timing Side Channels

Exploring browser-based red pills to detect virtual environments, their impact on web malware scanners, and potential mitigations for enhanced cybersecurity.

• YouTube
• 20 minutes
• On-Demand
• Conference Talk

USENIX

Zippier ZMap - Internet-Wide Scanning at 10 Gbps

Optimizations to ZMap network scanner achieving 10-fold increase in scan rate, enabling comprehensive TCP port scanning across IPv4 address space in 4.5 minutes. Discusses implications and potential applications.

• YouTube
• 20 minutes
• On-Demand
• Conference Talk

USENIX

Green Lights Forever - Analyzing the Security of Traffic Infrastructure

Researchers expose security vulnerabilities in traffic signal systems, demonstrating potential for disruption and safety risks. Recommendations for improving embedded systems security are provided.

• YouTube
• 22 minutes
• On-Demand
• Conference Talk