AI/ML in securityInjecting into LLM-adjacent componentsJohann Rehberger

[Blog 1] [Blog 2]

Teams of LLM Agents can Exploit Zero-Day VulnerabilitiesRichard Fang, Rohan Bindu, Akul Gupta, Qiusi Zhan, and Daniel Kang

[Paper]

Project Naptime: Evaluating Offensive Security Capabilities of Large Language Models Sergei Glazunov and Mark Brand

[Blog]

LLMs Cannot Reliably Identify and Reason About Security Vulnerabilities (Yet?): A Comprehensive Evaluation, Framework, and BenchmarksSaad Ullah, Mingji Han, Saurabh Pujar, Hammond Pearce, Ayse Kivilcim Coskun, and Gianluca Stringhini

[Paper] [Code]

The Impact of Backdoor Poisoning Vulnerabilities on AI-Based Threat DetectorsDmitrijs Trizna, Luca Demetrio, Battista Biggio, and Fabio Roli

[Slides] [Paper] [Code]

Looking at the whole systemSystems Alchemy: The Transmutation of HackingThaddeus grugq

[Video]

The Boom, the Bust, the Adjust and the UnknownMaor Shwartz

[Slides]

Poisoning Web-Scale Training Datasets is PracticalNicholas Carlini, Matthew Jagielski, Christopher A. Choquette-Choo, Daniel Paleka, Will Pearce, Hyrum Anderson, Andreas Terzis, Kurt Thomas, and Florian Tramèr

[Paper]

Intercloud Identities: The Risks and Mitigations of Access Between Cloud ProvidersNoam Dahan and Ari Eitan

[Video]

New modalities with which to inflict painGPU.zip: On the Side-Channel Implications of Hardware-Based Graphical Data CompressionYingchen Wang, Riccardo Paccagnella, Zhao Gang, Willy R. Vasquez, David Kohlbrenner, Hovav Shacham, and Christopher W. Fletcher

[Paper]

AquaSonic: Acoustic Manipulation of Underwater Data Center Operations and Resource ManagementJennifer Sheldon, Weidong Zhu, Adnan Abdullah, Sri Hrushikesh Varma Bhupathiraju, Takeshi Sugawara, Kevin Butler, Md Jahidul Islam, and Sara Rampazzi

[Paper] [Video]

Video-Based Cryptanalysis: Extracting Cryptographic Keys from Video Footage of a Device’s Power LED Captured By Standard Video CamerasBen Nassi, Etay Iluz, Or Cohen, Ofek Vayner, Dudi Nassi, Boris Zadov, and Yuval Elovici

[Site] [Paper] [Video]

Old components showing the strainExploiting Sequence Number Leakage: TCP Hijacking in NAT-Enabled Wi-Fi NetworksYuxiang Yang, Xuewei Feng, Qi Li, Kun Sun, Ziqiang Wang, and Ke Xu

[Blog] [Paper]

Reliable Payload Transmission Past the Spoofed TCP HandshakeYepeng Pan and Christian Rossow

[Paper] [Code]

Parse Me, Baby, One More Time: Bypassing HTML Sanitizer via Parsing DifferentialsDavid Klein and Martin Johns

[Paper] [Code]

Practical Exploitation of Registry Vulnerabilities in the Windows KernelMateusz Jurczyk

[Blog] [Video]

Nifty sundriesAn Analysis of Recent Advances in Deepfake Image Detection in an Evolving Threat LandscapeSifat Muhammad Abdullah, Aravind Cheruvu, Shravya Kanchi, Taejoong Chung, Peng Gao, Murtuza Jadliwala, and Bimal Viswanath

[Code] [Paper]

Tracking illicit phishermen in the deep blue AzureJacob Torrey

[Slides] [Code]

SEVeriFast: Minimizing the root of trust for fast startup of SEV microVMsBenjamin Holmes, Jason Waterman, and Dan Williams

[Paper] [Code]

Certiception: The ADCS Honeypot We Always WantedBalthasar Martin and Niklas van Dornick

[Blog] [Code] [Slides]