Papers
21 posts
2026
- A Programming Paradigm for Spatiotemporal ComposabilityThe paper gives dynamic software composition a formal foundation by splitting it into two orthogonal problems. Temporal composability asks whether a component…
- KernelSnitch Side-Channel Attacks on Kernel Data StructuresKernelSnitch presents a new class of software-induced timing side-channel attacks targeting Linux kernel data container structures (hash tables, radix trees,…
- SOK Agentic Supply Chain RuntimeThis SoK systematizes security threats to LLM-based agentic systems arising from their dynamic runtime supply chain — the inference-time data and tool…
- Bluetooth Method Confusion Fixes InsufficientBluetooth Method Confusion attacks — where devices are manipulated into using conflicting key establishment methods leading to compromised keys — were thought…
- Cascading Spy Sheets CSS FingerprintingThis paper demonstrates CSS-based browser/email fingerprinting that works even when JavaScript is completely disabled — directly threatening Tor Browser and…
- CHAOS Exploiting 802.11 Timing Synchronization Covert ChannelCHAOS is a novel WiFi covert channel that exploits the Timing Synchronization Function (TSF) inherent to 802.11 beacon frames. It encodes data through two…
- Cross-layer RTTs Fingerprinting Proxy TrafficThis paper reveals a protocol-agnostic fingerprint for detecting obfuscated circumvention proxy traffic: the misalignment of transport-layer and…
- Cross-Origin Attacks via HTTP2 and SXGThis paper reveals how HTTP/2 Server Push and Signed HTTP Exchange (SXG) — two modern web performance features — can be exploited to break the Same-Origin…
- Fuchsia gVisor Network Stack Security AnalysisFirst holistic security analysis of Google Fuchsia's network stack (shared with gVisor). Fuchsia is Google's "clean-slate" OS expected to eventually replace…
- IDBLEED Deanonymizing IoT via Exclusive-Use Side ChannelIDBLEED introduces a boolean side channel in exclusive-use wireless communication (BLE/WiFi) where devices only communicate with trusted peers. By observing…
- IMSI-Catcher Detection via Cellular Identity MessagesThis paper presents a new approach to detecting IMSI-catchers (stingrays) — devices used to covertly track mobile phone users. Unlike prior work that relies…
- LeakyBeam WiFi Beamforming Feedback PrivacyLeakyBeam exploits a new WiFi side channel: beamforming feedback information (BFI) packets. Unlike analog CSI signals that attenuate through walls, BFI is…
- LEO Satellite Time-varying Bottleneck AttacksThis paper performs the first security analysis of time-varying bottlenecks unique to Low-Earth Orbit (LEO) satellite networks like Starlink. As satellites…
- MineShark Cryptomining Traffic DetectionMineShark addresses the growing cryptojacking threat with a scalable cryptomining traffic detection system. As regulatory bans on cryptomining increase and…
- Off-Path TCP Hijacking in Wi-Fi Packet-Size Side ChannelThis paper unveils a fundamental side channel in all Wi-Fi networks: the observable size of encrypted wireless frames. Despite WPA2/WPA3 encryption, an…
- PROXY Protocol Large-Scale MeasurementFirst Internet-scale measurement of HAProxy's PROXY protocol reveals widespread misconfiguration: 170,000+ hosts accept PROXY protocol data from arbitrary…
- ReDAN Remote DoS against NAT NetworksReDAN demonstrates that Internet attackers outside a NAT can launch remote Denial-of-Service attacks against hosts inside the NAT — challenging the common…
- SketchFeature In-Network Flow Feature ExtractionSketchFeature enables in-network ML-based attack detection on programmable data planes. It addresses the critical bottleneck of per-flow feature extraction —…
- Can AI Agents AgreeThis paper investigates whether LLM-based agents can reliably reach consensus in a "no-stake" scalar agreement game, even in the presence of Byzantine…
- Incompressible Knowledge ProbesThis paper introduces Incompressible Knowledge Probes (IKPs), a method to estimate the parameter counts of closed-source LLMs by measuring their factual…
- Taint-Style Bug Detection in Linux KernelBUGLENS is a post-refinement framework that uses Large Language Models (LLMs) guided through structured reasoning steps to dramatically reduce false positives…