Trackers like Apple's FindMy devices have seen an incredible boom throughout the last few years and are used for a variety of use-cases such as tracking lost luggage, stolen bikes, or simply finding one's lost keys. But they may also be used by stalkers to track their victims. Our goal …
read moreOther articles
Exploiting Android Apps with Counterfeit Art
Arbitrary file overwrite vulnerabilities are, unfortunately, quite common in Android apps. Often the adversary can control some part of the path to partially or fully overwrite files in the file system of the application. The attacker thereby has the power to modify any file writable by the application. The attacker …
read moreGrape: Squeezing Juicy Variant Bugs Out of Modern Browsers
Fuzzing has become the dominant dynamic testing approach to find bugs in software. For complex software like Chrome, we observed that fuzzing only reaches around 30% of coverage, i.e., 70% of code is not executed and therefore not tested. While not all code will be reachable in practice, there's …
read moreSymCTS: Untangling Symbolic Execution and Fuzzing
Bug discovery has long been a key concern in the field of software security. Bugs are plentiful and many impact security. When bugs are discovered and fixed, the underlying risk is mitigated. A wide variety of techniques exist from formal verification over symbolic execution to fuzzing.
Out of those techniques …
read moreIEEE Symposium on Security and Privacy (Oakland) '26
What a great time at the IEEE Symposium on Security and Privacy (informally called Oakland) in San Francisco. With about 700 attendees, Oakland now seems the smallest of the top four security conferences. It was great to meet many friends and make new ones during the three days of the …
read moreTÄMU: Emulating Trusted Applications
Android runs sensitive applications in the so-called "secure world". These trusted applications (TAs) handle sensitive operations such as authentication, key management, or DRM. As they interact with regular Android applications from the normal world, vulnerabilities in these applications compromise the secure world and give adversaries access to privileged data. Our …
read moreThe AIpocalypse or how LLM-based exploitation is the new normal
In the last 3-4 months, AI models have made an immense jump in exploitation capabilities. Several talks and blog posts highlight the "new" capabilities of frontier AI models. The agents have learned from countless CTF writeups, research papers on exploitation techniques, and conference talks/demonstrations on how to automate diverse …
read moreSysyphuzz: the pressure for more coverage
Fuzzing faces a key challenge: after running for an extensive time, coverage plateaus and will no longer increase despite extensive mutations. Only new seed inputs or mutation operators will likely change that. We have observed that for Syzbot fuzzing in the Linux kernel has essentially plateaued due to Google's multi-year …
read more39c3: Master reset in Hamburg
Another year, another CCC. As every year, I went to Hamburg to appreciate all galactic life forms in their diverse multi-dimensional environment. My goal this year was the usual meet ups with friends I haven't seen in a long time, get inspired for new research directions, to catch some talks …
read more