WOOT '24
as the organisers put it
The 18th USENIX WOOT Conference on Offensive Technologies (WOOT '24) will take place at the Philadelphia Downtown Marriott in Philadelphia, PA, USA, on August 12–13, 2024. The USENIX WOOT Conference aims to present a broad picture of offense and its contributions, bringing together researchers and practitioners across all areas of computer security.
who it's for
embedded firmware engineers, hardware security engineers, IoT security researchers, offensive security researchers, penetration testers, network operators, application security engineers
topics
secure boot RSA bypass; AES bitstream readback; WhatsApp multi-device leakage; binary libification for testing; PowerShell from natural language; NSEC3 DNS exhaustion; SMS-timing location inference; Shimano Di2 wireless attacks; backdoored ECDSA bitcoin wallets; O-RAN indoor base station exploits; TI MSP430/432 register exfiltration; IoT device firmware reverse engineering
| title | author | length |
|---|---|---|
| Achilles Heel in Secure Boot: Breaking RSA Authentication and Bitstream Recovery from... | Prasanna Ravi, Arpan Jati, Shivam Bhasin | 22m |
A bug in the open-source FSBL for Zynq-7000 lets the boot code authenticate PHT2 but boot from an unverified PHT1 (a double-fetch PHT bug), enabling RSA-2048… | ||
| WhatsApp with privacy? Privacy issues with IM E2EE in the Multi-device setting | Tal A. Be'ery | 24m |
Finds and demos that WhatsApp’s multi-device implementation leaks mobile + up to 4 linked devices to any querier, including any user including blocked and… | ||
| Introduction to Procedural Debugging through Binary Libification | Jonathan Brossard | 16m |
Claims a method to turn arbitrary dynamically linked ELF executables into shared libraries so vulnerable functions can be called directly, separating… | ||
| The Power of Words: Generating PowerShell Attacks from Natural Language | Pietro Liguori, Christian Marescalco, Roberto Natella, Vittorio Orbinato, Luciano Pianese | 20m |
Paper shows NMT models fine tuned to PowerShell with domain-adaptive pretraining on about 990,000 scripts and supervised fine tuning on ~1,100 offensive… | ||
| Attacking with Something That Does Not Exist: 'Proof of Non-Existence' Can Exhaust DNS... | Olivia Gruza, Elias Heftrig, Oliver Jacobsen, Haya Schulmann, Niklas Vogel, Michael Waidner | 16m |
A containerized testbed generates large NSEC3-signed zones and measures resolvers (Bind, Unbound, PowerDNS, Knot) under crafted NX records. The evaluation… | ||
| Amplifying Threats: The Role of Multi-Sender Coordination in SMS-Timing-Based Location... | Evangelos Bitsikas, Theodor Schnitzler, Christina Pöpper, Aanjhan Ranganathan | 21m |
Systematic experiments use three synchronized SMS senders, collect over 260,000 SMS, and extract per-sender timing plus fused statistical features to train a… | ||
| MakeShift: Security Analysis of Shimano Di2 Wireless Gear Shifting in Bicycles | Maryam Motallebighomi, Earlence Fernandes, Aanjhan Ranganathan | 17m |
Shimano Di2 wireless shifting has no timestamps or sequence numbers and allows replay attacks up to 10 m using captured packets with no cryptographic keys… | ||
| Engineering a backdoored bitcoin wallet | Adam Scott, Sean Andersen | 18m |
A backdoor modifies ECDSA signing to embed a wallet seed into normal-looking signatures by choosing nonces that encode linear combinations of seed bits… | ||
| Oh No, My RAN! Breaking Into an O-RAN 5G Indoor Base Station | Leon Janzen, Lucas Becker, Colin Wiesenäcker, Matthias Hollick | 17m |
Assessment targets an Air Velocity 2700 indoor radio unit reachable with simple Ethernet (C1 capability). Recon finds four vulnerabilities: a broadcasting port… | ||
| RIPencapsulation: Defeating IP Encapsulation on TI MSP Devices | Prakhar Sah, Matthew Hicks | 22m |
RIPencapsulation demonstrates that Texas Instruments IP Encapsulation on MSP430 and MSP432 devices fails because lack of call‑site enforcement and unsanitized… | ||
| Reverse Engineering the Eufy Ecosystem: A Deep Dive into Security Vulnerabilities... | Victor Goeman, Dairo de Ruck, Tom Cordemans, Jorn Lapon, Vincent Naessens | 16m |
Reverse engineering of the Eufy doorbell and Homebase recovers keys and decrypts stored images by extracting serial-derived credentials (MD5 then base64 then… | ||
| SoK: Where’s the “up”?! A Comprehensive (bottom-up) Study on the Security of... | Xi Tan, Zheyuan Ma, Sandro Pinto, Le Guan, Ning Zhang, Jun Xu, Zhiqiang Lin, Hongxin Hu, Ziming Zhao | 21m |
Comprehensive audit collects over 7,000 firmware samples and validates 1,797 real-world firmware, scans ~500 related CVEs, and releases tooling on GitHub; key… | ||
| Not Quite Write: On the Effectiveness of Store-Only Bounds Checking | Adriaan Jacobs, Stijn Volckaert | 21m |
Store-only bounds checking omits read checks but invalid reads still let attackers control subsequent writes by loading crafted pointers and metadata, so… | ||
| SoK: On the Effectiveness of Control-Flow Integrity in Practice | Lucas Becker, Matthias Hollick, Jiska Classen | 20m |
Systematic cataloging of deployed CFI schemes pairs with a large-scale binary analysis of 33 Android images (seven vendors) and two Windows builds across… | ||
| Exploiting Android’s Hardened Memory Allocator | Philipp Mao, Elias Valentin Boschung, Marcel Busch, Mathias Payer | 16m |
Scudo is the default native heap on Android since Android 11 and the paper shows two concrete exploitation techniques that trick Scudo into allocating a chunk… | ||
| Breaking Espressif’s ESP32 V3: Program Counter Control with Computed Values using... | Jeroen Delvaux, Cristofaro Mune, Mario Romero, Niek Timmers | 21m |
Claim: Espressif ESP32 V3’s Secure Boot and Flash Encryption are bypassable with a single EM glitch that transfers a crafted pointer into the program counter… | ||
| Basilisk: Remote Code Execution by Laser Excitation of P–N Junctions Without... | Joe Loughry, Kasper Rasmussen | 15m |
Demonstrates an external attacker using a raster‑scanned laser and linear actuators plus an Arduino to bias P–N junctions (LEDs and ESD diodes) and flip logic… | ||
| SOK: 3D Printer Firmware Attacks on Fused Filament Fabrication | Muhammad Haris Rais, Muhammad Ahsan, Irfan Ahmed | 22m |
Proposes a classification tree and an Attack Feasibility Index covering 48 scenarios, implements nine concrete firmware attacks on Marlin firmware, and shows… | ||
| Lightning Talks | Zheyuan Ma, Wil Gibbs, Adam Doupé | 16m |
Study of 2023–24 eCTF submissions and interviews shows recurring failures: misunderstandings of privilege separation on microcontrollers, assuming compiler NX… | ||
| Lightning Talk: Lessons Learned from the Embedded Capture-the-Flag (eCTF) competitions | Zheyuan Ma | 05m |
Study of the 2023–24 eCTF competitions collected and analyzed all teams' submissions including source code documentation firmware and interviews and finds… | ||
| Lightning Talk: AI Cyber Challenge | Adam Doupé | 05m |
Qualification round runs five challenge problems: Linux kernel, engine x, SQL light, Jenkins, and Tika, each CRS getting four hours and $100 of LLM credit to… | ||
| nothing matches | ||