19th USENIX WOOT Conference on Offensive Technologies (WOOT '25)
2025-08-11..2025-08-12
Seattle, United States
who it's for
security researchers, embedded engineers, firmware developers, penetration testers, reverse engineers, automotive security engineers
topics
BGP prefix hijacks with uRPF; FIB passive voltage contrast extraction; EM side-channel on ARM Cortex-A72; WhatsApp prekey depletion attack; CSV formula injection detection; PHP extract injection analysis; automated kernel exploit generation; stealthy bootkit persistence techniques; guided clock glitch fault injection; Bluetooth Classic automotive testing; FRAM fault injection effects; LLM-assisted acoustic side-channel attacks
| title | author | length |
|---|---|---|
| Stealth BGP Hijacks with uRPF Filtering | Haya Schulmann, Shujie Zhao | 21m |
Paper demonstrates a new attack called SBA-uRPF that uses prefix hijacks to flip uRPF filtering and stealthily blackhole legitimate traffic. A simulator built… | ||
| Extraction of Secrets from 40nm CMOS Gate Dielectric Breakdown Antifuses by FIB... | Andrew D. Zonenberg, Antony Moor, Daniel Slone, Lain Agan, Mario Cop | 23m |
Extraction of keys from a 40nm microcontroller using FIB passive voltage contrast recovers the bitwise OR of adjacent rows, allowing antifuse OTP arrays to be… | ||
| Reality Check on Side-Channels: Lessons learnt from breaking AES on ARM Cortex-A72... | Harishma Boyapally, Dirmanto Jap, Qianmei Wu, Fan Zhang, Shivam Bhasin | 19m |
Evaluates EM side‑channel attacks on an ARM Cortex-A72 (Raspberry Pi 4B) using an EM probe + LCRO oscilloscope, TVLA/SNR for leakage checks, and CNN‑based deep… | ||
| Prekey Pogo: Investigating Security and Privacy Issues in WhatsApp's Handshake Mechanism | Gabriel Karl Gegenhuber, Philipp É. Frenzel, Maximilian Günther, Aljosha Judmayer | 19m |
Demonstrates a targeted prekey depletion attack that uses a small command-line client to repeatedly request one-time prekeys (WhatsApp stores ~800 per device… | ||
| Comma Separated Vulnerabilities: Detecting Formula Injection in the Wild | Manuel Karl, Louis Bettels, Martin Johns, David Klein | 15m |
Claims that CSV files enable remote data exfiltration and even code execution by embedding spreadsheet formulas, and backs it with a tool and measurements… | ||
| Extract: A PHP Foot-Gun Case Study | Jannik Hartung, Simon Koch, Martin Johns | 22m |
Claims that extract routinely enables attackers to overwrite important variables, backed by a static-analysis pass over a code property graph and manual review… | ||
| SoK: Automating Kernel Vulnerability Discovery and Exploit Generation | Anil Kurmus, Andrea Mambretti, Alessandro Sorniotti, Vincent Lenders, Damian Pfammatter, Bernhard Tellenbach | 23m |
Systematization analyzes 41 papers from 2013–2023 and finds 22 works on vulnerability discovery (14 static, 8 fuzzers), nine on later exploit stages, and ten… | ||
| BOOTKITTY: A Stealthy Bootkit-Rootkit Against Modern Operating Systems | Junho Lee, Jihoon Kwon, HyunA Seo, Myeongyeol Lee, Hyungyu Seo, Jinho Jung, Hyungjoon Koo | 17m |
BOOTKITTY is a hybrid bootkit-rootkit that successfully compromises Windows Linux and Android by exploiting firmware and bootloader flaws to break the chain of… | ||
| Keynote Presentation: Escaping Cantor's Find-Fix Cycle | Falcon Darkstar Momot | 48m |
Argues that recurring vulnerabilities fall into an eight‑level hierarchy from immediate constraint violations up to undecidable or societal specification… | ||
| Security through Transparency: Tales from the RP2350 Hacking Challenge | Marius Muench, Aedan Cullen, Kévin Courdesses, Thomas Roth, Andrew D. Zonenberg | 24m |
Demonstrates five practical attacks that break RP2350 secure-boot guarantees: voltage, EM and laser fault injection to skip signature checks and re-enable… | ||
| GlitchGlück: Enabling Software Vulnerabilities through Guided Hardware Fault Injection | Zhenyuan Liu, Dillibabu Shanmugam, Patrick Schaumont | 21m |
GLITCHGLÜCK presents a guided fault-injection pipeline that builds a Dynamic State Transition Graph (DSTG) from register outputs in simulation, uses… | ||
| Bluetooth Security Testing with BlueToolkit: a Large-Scale Automotive Case Study | Vladyslav Zubkov, Tommaso Sacchetti, Daniele Antonioli, Martin Strohmeier | 18m |
BlueToolkit is an open-source Bluetooth Classic security framework that performs over-the-air black-box testing with no vendor firmware required, using… | ||
| No Key, No Problem: Vulnerabilities in Master Lock Smart Locks | Chengsong Diao, Danielle Dang, Sierra Lira, Angela Tsai, Miro Haller, Nadia Heninger | 18m |
The paper reverse engineers the Master Lock Vault Enterprise Android app and BLE protocol and demonstrates five concrete flaws: session replay using fixed… | ||
| Making Acoustic Side-Channel Attacks on Noisy Keyboards Viable with LLM-Assisted... | Seyyed Ali Ayati, Jin Hyun Park, Yichen Cai, Marcus Botacin | 15m |
Vision transformers replace CNNs and reach or beat the CoAtNet baseline on keystroke spectrogram classification, while additive Gaussian noise causes the prior… | ||
| DeepRed: A Deep Learning–Powered Command and Control Framework for Multi-Stage Red... | Mehrdad Hajizadeh, Pegah Golchin, Ehsan Nowroozi, Maria Rigaki, Verónica Valeros, Sebastián García, Mauro Conti, Thomas Bauschert | 22m |
Paper presents DeepRed, a Python C2 framework (HTTP + WebSocket) that converts GAN-derived feature-space deltas into protocol-compliant packet-level… | ||
| FUZZVPN: Finding Vulnerabilities in OpenVPN | Anqi Chen, Cristina Nita-Rotaru | 20m |
FUZZVPN is a man‑in‑the‑middle fuzzer that learns OpenVPN’s control‑channel MSC (passive + active learning) and runs 1,000 scenarios (60 s each, 5–6 hours)… | ||
| Be Write Back: An in-depth Study of Fault Injection Effects on FRAM Technology | Valentin Huber, Marc Schink | 19m |
Presents a practical attack that leverages the FRAM write-back exploitation to corrupt rows and reactivate MSP430FR JTAG, demonstrated on external chips (FM25… | ||
| Oops, It Halted Again: Exploiting PLC Memory for Fun and Profit in Industrial Control... | Wooyeon Jo, Irfan Ahmed | 21m |
Automated framework uses machine-learning SVM classifier on windowed, entropy and structural features (depth and indegree, byte-correlation) and acquires… | ||
| SecurePoC: A Helping Hand to Identify Malicious CVE Proof of Concept Exploits in GitHub | Soufian El Yadmani, Robin The, Olga Gadyatskaya | 18m |
A tool called SecurePoC modular tool triages GitHub-hosted CVE PoCs by extracting encoded blobs, IOCs, URLs and binaries and querying VirusTotal/AbuseIPDB; the… | ||
| nothing matches | ||