ThinkstScapes Research Roundup - Q3 - 2023

Cryptography still isn’t easy

certmitm: automatic exploitation of TLS certificate validation vulnerabilities

Aapo Oksman

[Slides] [Code] [Video]

Escaping Phishermen Nets: Cryptographic Methods Unveiled in the Fight Against Reverse Proxy Attacks

Ksandros Apostoli

[Blog]

mTLS: When certificate authentication is done wrong

Michael Stepankin

[Slides] [Blog]

Ultrablue: User-friendly Lightweight TPM Remote Attestation over Bluetooth

Nicolas Bouchinet, Loïc Buckwell, and Gabriel Kerneis

[Slides] [Code] [Video]

HECO: Fully Homomorphic Encryption Compiler

Alexander Viand, Patrick Jattke, Miro Haller, and Anwar Hithnawi

[Slides] [Paper] [Code]

[Continued] attack of the side-channels

Freaky Leaky SMS: Extracting User Locations by Analyzing SMS Timings

Evangelos Bitsikas, Theodor Schnitzler, Christina Pöpper, and Aanjhan Ranganathan

[Paper] [Code]

Downfall: Exploiting Speculative Data Gathering

Daniel Moghimi

[Code] [Paper] 

Your Clocks Have Ears – Timing-Based Browser-Based Local Network Port Scanner

Dongsung Kim

[Slides] [Demo] [Video]

Composition is hard in the cloud

Using Cloudflare to bypass Cloudflare

Florian Schweitzer and Stefan Proksch

[Blog] 

The GitHub Actions Worm: Compromising GitHub repositories through the Actions dependency tree

Asaf Greenholts

[Slides] [Blog] [Video]

All You Need is Guest

Michael Bargury

[Slides] [