20th USENIX WOOT Conference on Offensive Technologies (WOOT '26)
2026-08-10..2026-08-11
Baltimore, United States
as the organisers put it
The 20th USENIX WOOT Conference on Offensive Technologies (WOOT '26) will take place at the Baltimore Marriott Waterfront in Baltimore, MD, USA, on August 10–11, 2026. The USENIX WOOT Conference aims to present a broad picture of offense and its contributions, bringing together researchers and practitioners across all areas of computer security.
who it's for
offensive security researchers, exploit developers, reverse engineers, hardware security researchers, red teamers, security tool developers, protocol security engineers
topics
AirDrop protocol fuzzing; Netlogon AES-CFB8 takeover; ASN.1 constant-time leakage; agentic exploit generation; Android ART image overwrite; SIM-originating AT commands; cellular baseband fuzzing; AMD SEV power side channels; EM probe placement with particle swarm; infrared recapture attacks; flash body bias injection; ARM TrustZone userspace attack
| title | author | length |
|---|---|---|
| Protocol Prying: Systematic Vulnerability Research in the AirDrop and Android Quick... | Billy Bob Brumley | 20m |
Reverses proprietary AirDrop and Quick Share stacks, reconstructs AirDrop’s seven-layer state machine and DVZip compression, and builds a protocol-aware… | ||
| Onelogon: Taking over Active Directory Accounts via Netlogon | Alexander Neff, Tobias Holl, Kevin Borgolte | 14m |
Onelogon demonstrates practical account takeover of Active Directory by abusing Netlogon’s incorrect AES-CFB8 use: two attack variants let an attacker reset a… | ||
| SoK: The Constant Time Model | Billy Bob Brumley | 24m |
Systematizes constant-time models and finds a specification-level timing bug in private key loading: ASN.1/DER integer canonicalization leads to shorter… | ||
| A Dummy's Guide to Agentic Exploit Generation | Connor Glosner | 31m |
Agentic pipelines wire LLMs into an exploit workflow by combining deterministic tools (scrapers, static analysis, kprobe) with an orchestration agent that… | ||
| Exploiting Android Apps with Counterfeit Art | Rokhaya-Diamil Fall, Philipp Mao, Martin Wagner, Mathias Payer | 15m |
Demonstrates turning arbitrary file-overwrite into persistent code execution by replacing an app’s ART image; builds two exploits: a local ASLR-leak chain that… | ||
| Practical Attacks on a Decentralized Secure Messenger Session | Kota Urushigaki, Hayato Kimura, Atsushi Tanaka, Takanori Isobe | 14m |
Analyzes Session Protocol V1 and demonstrates three concrete exploits: a spoofing/impersonation attack that leverages lack of mutual public key authentication… | ||
| CATana: On the Dangers of SIM-Originating AT Commands | Tomasz Piotr Lisowski, Kristian Covic, Marius Muench | 16m |
The CATana toolkit explores SIM-originating AT commands and finds concrete risks: a survey of 26 devices shows 9 of 26 devices expose SIM AT, yielding four… | ||
| SoK: Insecurity of Cellular Basebands | Henri Carnot, Aurélien Francillon | 20m |
Survey shows baseband firmware are large and opaque — often 19 MB binaries with no symbols, custom ISAs like Hexagon ISA, and limited hardening; CVEs spike… | ||
| PowerHooK: Enabling Software-Based Power Side Channels Against AMD SEV Technologies... | Mathias Oberhuber, Martin Unterguggenberger, Martin Wistauder, Andreas Kogler, Rishub Nagpal, Stefan Mangard | 16m |
PowerHooK repurposes page-fault-based transient replay so a malicious hypervisor repeatedly re-executes victim code and collects denoised software power… | ||
| Swarm in EM Hay: Particle Swarm-guided Probe Placement for EM SCA | Dev Mehta, Seyedmohammad Nouraniboosjin, Maryam S. Safa, Shahin Tajik, Fatemeh Ganji | 13m |
Automated probe placement uses particle swarm optimization guided by matrix-based Rényi entropy and mutual information to find EM leakage on an 11×11 grid… | ||
| Breaking Infrared Recapture Detection: Optical-Synthesis Attacks and Depth-Aware... | Tetsu Ishizue, Sara Rampazzi, Takeshi Sugawara | 14m |
An attack called SynthIR uses an inexpensive hot mirror to split visible and IR paths so the RGB camera sees a monitor image while the IR depth sensor sees a… | ||
| Flash [Re]Loaded: Body Bias Injection on Flash Memory | Valentin Huber, Marc Schink | 14m |
Claims that body bias injection (BBI) can both permanently program flash while powered off and transiently flip reads with DC bias; attacker builds a custom… | ||
| You Have Been LaTeXpOsEd: A Large-Scale Systematic Analysis of Information Leakage... | Richard A. Dubniczky, Bertalan Borsos, Tamas Bisztray, Norbert Tihanyi | 15m |
Analyzes 1.2 TB from 100,000 arXiv submissions using regex and pattern matching for URLs/IPs, plus context classifiers built from pattern filters and LLMs; the… | ||
| Are Neuro-Inspired Multi-Modal Vision-Language Models Resilient to Membership... | David Amebley, Sayanton Dibbo | 16m |
Introduces a neuroscience-inspired topological regularization applied to BLIP, PaLI-Gemma 2 and ViT-GPT2 fine-tuned on COCO, CC3M and NoCaps, measuring… | ||
| LIMA: Defining, Benchmarking and Detecting Cross-Layer Vulnerabilities in LLM... | Sanjib Kumar Sen, Hannah Longoria, Bozhen Liu | 14m |
Study defines the LIF-Model Attack surface (LIMA) and curates 60 disclosed vulnerabilities into a six-class taxonomy, finding 42% LIMA issues that include heap… | ||
| OSS-CRS: Liberating AIxCC Cyber Reasoning Systems for Real-World Open-Source Security | Andrew Chin, Dongkwan Kim, Yu-Fu Fu, Fabian Fleischer, Youngjoon Kim, HyungSeok Han, Cen Zhang, Brian Junekyu Lee, Hanqing Zhao, Taesoo Kim | 15m |
An open, locally deployable framework that ports components from all seven AIxCC finalist CRSs and runs them modularly on OSS-Fuzz projects, using a… | ||
| Defective by Design: Universal Recovery of All Widevine-Protected Content on Desktop... | Florian Roudot, Mohamed Sabt | 14m |
Claim: desktop Widevine leaks decrypted media and can be turned into playable files. The researchers build an LD_PRELOAD wrapper that intercepts the CDM shared… | ||
| Evading and crashing anti-malware solutions via data collection overloading during... | Evgenios Gkritsis, Constantinos Patsakis, George Stergiopoulos | 13m |
Claims a new exploit class called Telemetry Complexity Attacks that breaks analysis pipelines without elevating privileges by recursively spawning process… | ||
| Keynote Address: Click Here to Hack Your Target: A Perspective on the Past... | Bill Marczak | 45m |
Machine-disguised EXE files using the Unicode right‑to‑left trick and fake JPG icons reveal FinFisher infections that phone home to Batelco IPs; researchers… | ||
| HotWire: Real-World Impersonation and Discharge Attacks on Electric Vehicle Charging... | Kuan Yu Chen, Md Hasan Shahriar, Wen Wei Li, Shi Cho Cha, Wenjing Lou | 17m |
Shows a concrete end-to-end exploit: a $180 hardware toolkit (Raspberry Pi + modified HomePlug modem) captures and replays a six-byte EVCCID to replay EVCCID… | ||
| Real-Time Compromise: Investigating RTC Security in Consumer IoT | Victor Goeman, Tom Cordemans, Christoph Sanders, Jorn Lapon, Vincent Naessens | 11m |
Built an RTCInspect open-source framework that processes Wireshark captures and applies heuristics now being upstreamed into Wireshark to flag protocol and… | ||
| DisARMed: Attacking ARM TrustZone from Userspace with Memory Aliasing | Jacqueline Henes, Matthew Bowden, Mihai Ordean, David Oswald | 19m |
Shows a practical exploit that uses memory aliasing from userspace and huge-page spraying to find aliased physical DRAM, modify page tables from an… | ||
| Security Analysis of LTE Connectivity in Connected Cars: A Case Study of Tesla | Evangelos Bitsikas, Jason Veara, Aanjhan Ranganathan | 19m |
Black-box testing of 2025 Tesla Model 3 and Cybertruck inside a Faraday tent uses a Marison box, USRPs, Tesla toolbox and Consumer Reports vehicles to… | ||
| SoK: 20 Years of Power, Privilege, and Peril in x86 System Management Mode | Antonis Louka, Jo Van Bulck | 16m |
Paper systematizes two decades of SMM research into a taxonomy and timeline, consolidating 69 studies and 57 advisories into a classification tree that shows… | ||
| SEMSAN: a Configurable Sanitizer for Detecting System-Level Semantic Bugs | Moritz Sanft, Flavio Toffalini | 16m |
SEMSAN is a configurable sanitizer that instruments kernel events with eBPF-based probes and exposes high-level utilities as Sanitizer Primitives so fuzzers… | ||
| FuzzBT: Holistic-State-Guided Fuzzing for Bluetooth Host Stack in Kernels | Sungwoo Kim, Hui Peng, Imtiaz Karim, Ruoyu Wu, Jianliang Wu, Elisa Bertino, Mathias Payer, Dave (Jing) Tian | 10m |
FuzzBT builds a fuzzer that iterates over kernel Bluetooth configurations and extracts configuration-aware seeds via concolic/symbolic execution, instruments… | ||
| Squeezing Juicy Variant Bugs Out of Modern Browsers | Han Zheng, Flavio Toffalini, Qiang Liu, Mathias Payer | 15m |
GRAPE is a ruleable variant analysis pipeline that models bugs with four elements context, assumption, violation, end use and uses pattern rules to scan large… | ||
| SoK: Multi-Layer Indirect Call Analysis in the Real World | Yufei Du, Vasileios P. Kemerlis, Michalis Polychronakis, Fabian Monrose | 17m |
A systematic evaluation of five multi-layer type analyses (MLTA, DeepType, TFA, HPCFI, Callgraph) plus LLVM-CFI runs on 13 real-world apps and extracts… | ||
| nothing matches | ||