ThinkstScapes Research Roundup - Q1 - 2024

Revealing more than anticipated, and preventing prying eyes PrintListener: Uncovering the Vulnerability of Fingerprint Authentication via the Finger Friction Sound Man Zhou, Shuao Su, Qian Wang, Qi Li, Yuting Zhou, Xiaojing Ma, and Zhengxiong Li [Paper] ModelGuard: Information-Theoretic Defense Against Model Extraction Attacks Minxue Tang, Anna Dai, Louis DiValentin, Aolin Ding, Amin Hass, Neil Zhenqiang Gong, Yiran Chen, and Hai Li [Paper] [Code] RECORD: A RECeption-Only Region Determination Attack on LEO Satellite Users Eric Jedermann, Martin Strohmeier, Vincent Lenders, and Jens Schmitt [Code] [Paper] Private web search with Tiptoe Alexandra Henzinger, Emma Dauterman, Henry Corrigan-Gibbs, and Nickolai Zeldovich [Slides] [Paper] [Video] [Code] Can Virtual Reality Protect Users from Keystroke Inference Attacks? Zhuolin Yang, Zain Sarwar, Iris Hwang, Ronik Bhaskar, Ben Y. Zhao, and Haitao Zheng [Website] [Paper] Backtrace in Time: Revealing Attackers’ Sleep Patterns and Days Off in RDP Brute-Force Attacks with Calendar Heatmaps Andréanne Bergeron [Code] [Blog] [Video] Taking another look with a fresh perspective Breaking HTTP Servers, Proxies, and Load Balancers Using the HTTP Garden Ben Kallus and Prashant Anantharaman [Code] [Video] Compiler Backdooring For Beginners Marion Marschalek [Video] Revisiting 2017: AI and Security, 7 years later Thomas Dullien [Video] Automated Large-Scale Analysis of Cookie Notice Compliance Ahmed Bouhoula, Karel Kubicek, Amit Zac, Carlos Cotrini, and David Basin [Paper] [Code Access] Turning Windows into doors LSA Whisperer Evan McBroom [Slides] [Blog] [Code] Wishing: Webhook Phishing in Teams Matthew Eidelberg [Blog] [Code] Misconfiguration Manager: Overlooked and Overprivileged Duane Michael and Chris Thompson [Slides] [Blog] [Code] Smoke and Mirrors: How to hide in Microsoft Azure Aled Mehta and Christian Philipov [Video] Nifty sundries Backdoor in XZ Utils allows RCE: everything you need to know Andres Freund, Merav Bar, Amitai Cohen, Danielle Aminov, and Russ Cox [Initial Disclosure] [Wiz Blog] [Timeline] More Money, Fewer FOSS Security Problems? The Data, Such As It Is John Speed Meyers, Sara Ann Brackett, and Stewart Scott [Video] MUDding Around: Hacking for gold in text-based games Unix-ninja [Blog] DeGPT: Optimizing Decompiler Output with LLM Peiwei Hu, Ruigang Liang, and Kai Chen [Paper]