RuhrSec 2023
2023-05-11..2023-05-12
Bochum, Germany
RuhrSec ·
[RuhrSec 2016, RuhrSec 2017, RuhrSec 2019, RuhrSec 2020 #StayAtHome Edition, RuhrSec 2023, RuhrSec 2025]
| title | author | length |
|---|---|---|
| Conference Opening | Marcus Niemietz | 05m |
Conference opening gives logistics and history: Hackmanit is founded in 2014 in Bochum and runs security trainings, penetration tests and threat analysis; the… | ||
| Keynote: Crypto War 3 – from the DMA to Chatcontrol | Ross Anderson | 43m |
RuhrSec is the annual English speaking IT security conference with cutting-edge security talks by renowned experts. RuhrSec is organized by Hackmanit.
🔽 More… | ||
| SQUIP or Why We Need to Study Processors Like Nature | Stefan Gast, Daniel Gruss | 35m |
Introduces SQUIP as a scheduler-queue contention side channel that forces pipeline stalls by flooding scheduler queues with dependent multiplies and slow… | ||
| ShowTime: CPU Timing Attacks With the Human Eye | Antoon Purnal, Marton Bognar | 35m |
ShowTime presents a concrete framework that converts tiny microarchitectural leaks into huge, observable delays and proves humans can visually distinguish… | ||
| You Can't Always Get What You Want – How Web Sites... | Sebastian Roth, Ben Stock | 41m |
Measured across top 10,000 sites with five fresh requests per test using varying user agents, VPN/Tor and language settings, the team finds 321 sites with… | ||
| Everything You Wanted to Know About DOM Clobbering (But Were... | Soheil Khodayari | 35m |
Presents concrete results: an automated static+dynamic detector (available at joe.me) and a markup generator (domcloud.xyz) that exhaustively tests clobbering… | ||
| Security of Push Messaging | Jörg Schwenk | 42m |
Compares SMS email and instant messengers, claiming email remains stateless so it lacks forward secrecy while messengers using double ratchet (WhatsApp/Signal)… | ||
| Your Wi-Fi Is the Eavesdropper’s Radar: How to Counter Privacy Threats... | Paul Staat | 42m |
A prototype 256‑element IRS (≈30×40 cm, ≈$100) operating near 5.35 GHz toggles 5% of elements 20×/s with periodic full inversions; this IRShield introduces… | ||
| Keynote: Towards High-Assurance Cryptographic Software | Karthikeyan Bhargavan | 39m |
Formal verification and security-oriented languages are used end-to-end: mechanized proofs (ProVerif, Tamarin, F, EasyCrypt) validate protocol designs like… | ||
| We Really Need to Talk About Session Tickets: A Large-Scale Analysis... | Sven Hebrok | 32m |
Large-scale scans collect TLS session tickets from Tranco Top 100k and full IPv4 space, store tickets for offline analysis and run online modification tests… | ||
| Content-Type: multipart/oracle – Tapping Into Format Oracles in... | Fabian Ising | 37m |
Surveys 19 OpenPGP and S/MIME clients and shows two practical exploits: Google Workspaces’ SMTP behavior creates a CBC padding oracle enabling classic… | ||
| Server-Side Browsers: Exploring the Web’s Hidden Attack Surface | Marius Musch | 35m |
Automated headless browsers replace curl for link previews and expand attack surface: a Puppeteer/Playwright setup crawls ~100,000 sites (2.6M pages), triggers… | ||
| Hand Sanitizers in the Wild: A Large-Scale Study of Custom JavaScript... | David Klein | 36m |
Built an automated pipeline using a Firefox fork with taint tracking to extract sanitizer functions from the top 20K sites, symbolically model each sanitizer… | ||
| CPU Fuzzing: Automatic Discovery of... | Daniel Weber, Michael Schwarz | 42m |
Automated toolchain searches CPU behavior and reports concrete primitives and exploits: Osiris fuzzes three-instruction sequences to find timing side channels… | ||
| Federated Learning and Its Application... | Veelasha Moonsamy, Rafa Gálvez | 38m |
LiM is an Android malware classifier built with federated, semi‑supervised ensemble learning that reduces shared model dimensionality to five parameters so… | ||
| nothing matches | ||