Mathy Vanhoef
where else to find them
bluesky:vanhoefm.bsky.social
x:vanhoefm
what they talk about
where they keep going back
- Black Hat Europe3 editions2017–2023
- Black Hat USA2 editions2016–2019
all 5 in the filters
on a stage with
all 15 in the filters
who talks about the same things
- Domien Schepers2 talks
- Tom Van Goethem9 talks
- Dor Zusman3 talks
- Niall Merrigan19 talks
- James Kettle13 talks
- Ben Seri5 talks
| title | conference | date |
|---|---|---|
| Confusing Value with Enumeration: Studying the Use of CVEs in Academia | USENIX Security '25 | 2025-08-13 |
Analysis of 1,803 CVEs claimed in 304 papers finds 34% unconfirmed or disputed, 274 reserved, 288 with no maintainer response, and 52 where maintainers say… | ||
| TunnelCrack: Leaking VPN Traffic by Manipulating Routing Tables | Black Hat Europe 2023 | 2023-12-04 |
Two novel attacks leak VPN traffic by manipulating the OS routing table: a local-net spoof that advertises public IPs inside the local subnet so clients send… | ||
| Sweet Dreams: Abusing Sleep Mode to Break Wi-Fi Encryption and Disrupt WPA2/3 Networks | Black Hat Asia 2023 | 2023-05-09 |
Two novel attacks abuse Wi‑Fi power‑save: one forces APs to buffer frames, then removes or changes keys so buffered traffic is sent under an undefined context… | ||
| Practical Side-Channel Attacks Against WPA-TKIP | Black Hat Europe 2019 | 2019-12-02 |
Wardriving finds 44.81% of encrypted Wi‑Fi networks still allow WPA‑TKIP, so the team develops practical side‑channel decryptions that recover the last 12… | ||
| Dragonblood: Attacking the Dragonfly Handshake of WPA3 | Black Hat USA 2019 | 2019-08-03 |
WPA3’s Dragonfly/SAE leaks a reproducible password “signature” via timing and cache side channels: timing side channel and flush+reload cache attack. On… | ||
| Key Reinstallation Attacks: Breaking the WPA2 Protocol | Black Hat Europe 2017 | 2017-12-04 |
A practical exploit forces reinstallation of an already-used WPA2 key by replaying a retransmitted Message 3 of the four‑way handshake, which resets the packet… | ||
| Request and Conquer: Exposing Cross-Origin Resource Size | USENIX Security '16 | 2016-08-10 |
Describes two concrete size‑leak techniques that recover exact cross‑origin resource lengths in seconds: a channel‑based evil twin man‑in‑the‑middle that… | ||
| Predicting, Decrypting, and Abusing WPA2/802.11 Group Keys | USENIX Security '16 | 2016-08-10 |
Shows that 802.11 group keys are predictable, recoverable and abusible: Mediatek routers use a weak jiffies-based RNG so predicting group keys is practical… | ||
| HEIST: HTTP Encrypted Information can be Stolen Through TCP-Windows | Black Hat USA 2016 | 2016-08-03 |
by Tom Van Goethem & Mathy Vanhoef
Over the last few years, a worryingly number of attacks against SSL/TLS and other secure channels have been discovered… | ||
| nothing matches | ||