WOOT '20
as the organisers put it
With safety in mind, the upcoming 14th USENIX Workshop on Offensive Technologies (WOOT '20) will take place as a virtual event. It will be held on August 11, 2020. WOOT aims to present a broad picture of offense and its contributions, bringing together researchers and practitioners in all areas of computer security. WOOT provides a forum for high-quality, peer-reviewed work discussing tools and techniques for attack.
who it's for
security researchers, embedded security engineers, firmware engineers, mobile security researchers, reverse engineers, bluetooth protocol engineers, os kernel developers, exploit developers
topics
hardware trusted execution vulnerabilities; firmware reverse engineering techniques; kernel pointer leak exploitation; printable x86 shellcode generation; enclave page-fault side channels; smartphone NFC research toolkit; bluetooth reconnection spoofing attacks; bluetooth randomness weaknesses; iOS bluetooth stack exploitation; coverage-guided fuzzing improvements (AFL++); network predictability covert channels; office document security and privacy
| title | author | length |
|---|---|---|
| Hardware Security Is Hard: How Hardware Boundaries Define Platform Security | Alex Matrosov | 40m |
Claim: modern platforms split hardware and firmware across vendors, producing cross‑boundary gaps and a rising number of firmware CVEs in NVD. Evidence… | ||
| Exploiting Uses of Uninitialized Stack Variables in Linux Kernels to Leak Kernel Pointers | Haehyun Cho, Jinbum Park, Joonwon Kang, Tiffany Bao, Ruoyu Wang, Yan Shoshitaishvili, Adam Doupé, Gail-Joon Ahn | 18m |
Presents an automated pipeline that turns stack-based uninitialized-data leaks into kernel pointer leaks that defeat KASLR by computing a precise leak offset… | ||
| Automatic Generation of Compact Printable Shellcodes for x86 | Dhrumil Patel, Aditya Basu, Anish Mathuria | 18m |
Tool PSC generates printable x86 shellcode by encoding every two input bytes into three output bytes and adding 0x3F so encoded bytes lie in 0x3F–0x7E, then… | ||
| When Oblivious is Not: Attacks against OPAM | Nirjhar Roy, Nikhil Bansal, Gourav Takhar, Nikhil Mittal, Pramod Subramanyan | 21m |
Shows a practical break of InvisiPage/OPAM: shuffling and single-page transfers occur outside the enclave without re‑encryption, so the OS observes which page… | ||
| Unearthing the TrustedCore: A Critical Review on Huawei’s Trusted Execution Environment | Marcel Busch, Johannes Westphal, Tilo Mueller | 22m |
Reverse-engineering of Huawei’s TrustedCore (TC) reveals concrete breaks: a white‑box AES in the global loader lets attackers decrypt any TA (119 of 133… | ||
| NFCGate: Opening the Door for NFC Security Research with a Smartphone-Based Toolkit | Steffen Klee, Alexandros Roussos, Max Maass, Matthias Hollick | 18m |
A smartphone toolkit that hooks into Android’s NCI layer to set static tech data and capture APDUs turns ordinary phones into full NFC labs, adding relay and… | ||
| OS Security Is Hard: Why All the Fuzzers in the World Won't Change the Way... | Alex Ionescu | 35m |
Argues that fuzzers find many simple, recurring OS bugs but don't fix root causes: shows a vp9 array-of-5 overflow and a Windows syscall that writes to bayes… | ||
| One Exploit to Rule Them All? On the Security of Drop-in Replacement and Counterfeit... | Johannes Obermaier, Marc Schink, Kosma Moczek | 18m |
Analyzes six devices from four manufacturers including the STM32F1 original and finds all six are independently developed silicon with multiple novel… | ||
| ToothPicker: Apple Picking in the iOS Bluetooth Stack | Dennis Heinze, Jiska Classen, Matthias Hollick | 21m |
Built an in-process Frida fuzzer called ToothPicker that forges virtual Bluetooth connections inside bluetoothd, exercises ACL and BLE handlers, and reports… | ||
| BLESA: Spoofing Attacks against Reconnections in Bluetooth Low Energy | Jianliang Wu, Yuhong Nan, Vireshwar Kumar, Dave (Jing) Tian, Antonio Bianchi, Mathias Payer, Dongyan Xu | 18m |
Formal analysis finds two BLE reconnection design flaws that let an attacker impersonate a previously paired device and inject spoofed data. The authors build… | ||
| Firmware Insider: Bluetooth Randomness is Mostly Random | Jörn Tillmanns, Jiska Classen, Felix Rohrbach, Matthias Hollick | 17m |
Evaluation of Broadcom and Cypress Bluetooth chips finds that many firmwares keep an insecure PRNG fallback and that some popular devices—including a Samsung… | ||
| AFL++ : Combining Incremental Steps of Fuzzing Research | Andrea Fioraldi, Dominik Maier, Heiko Eißfeldt, Marc Heuse | 20m |
AFL++ is an open-source rework that bundles state-of-the-art fuzzing patches into one engine, shipping a Custom Mutator API (C and Python) to plug structured… | ||
| Bankrupt Covert Channel: Turning Network Predictability into Vulnerability | Dmitrii Ustiugov, Plamen Petrov, M. R. Siavash Katebzadeh, Boris Grot | 19m |
Bankrupt turns RDMA predictability into a cross-node covert timing channel that steers RDMA reads to a single memory bank on an intermediary and probes… | ||
| Office Document Security and Privacy | Jens Muller, Fabian Ising, Christian Mainka, Vladislav Mladenov, Sebastian Schinzel, Jörg Schwenk | 20m |
Systematic analysis of OOXML and ODF finds five concrete exploit classes: denial‑of‑service using compression bombs that force huge decompression, silent… | ||
| When Is a Proof Actually Not? | Vanessa Teague | 39m |
Finds concrete forgeries: a flawed Pedersen key generation in SwissPost-Scytl-iVote mixing and decryption proofs lets someone who knows the discrete log open… | ||
| nothing matches | ||