mathyvanhoef.com
Mathy Vanhoef: Publications
http://www.mathyvanhoef.com/p/publications.html
Postdoctoral Researcher in Computer Security @ KU Leuven. For a quick summary of a paper, I recommend viewing the corresponding presentation! A Security Analysis of the WPA-TKIP and TLS Security Protocols. July 201 6. PhD thesis, accepted. And F Piessens. Predicting, Decrypting, and Abusing WPA2/802.11 Group Keys. In USENIX Security Symposium. T Van Goethem, M. Vanhoef. F Piessens, and W. Joosens. Request and Conquer: Exposing Cross-Origin Resource Size. In USENIX Security Symposium. Xi'an, China, 2016.
mathyvanhoef.com
Mathy Vanhoef: Unmasking a Spoofed MAC Address (CVE-2013-4579)
http://www.mathyvanhoef.com/2013/11/unmasking-spoofed-mac-address.html
Postdoctoral Researcher in Computer Security @ KU Leuven. Sunday, 10 November 2013. Unmasking a Spoofed MAC Address (CVE-2013-4579). This vulnerability has been fixed in kernel 3.8.13.16. Certain Atheros wireless drivers do not properly update the MAC address when changed (spoofed) by a user. This allows an active attacker to retrieve the original MAC address. In short, spoofing your MAC address does not always hide the original MAC address. While working on the ath9k htc driver (. To clarify, consider a...
mathyvanhoef.com
Mathy Vanhoef: WhatsApp Considered Insecure
http://www.mathyvanhoef.com/2012/05/whatsapp-considered-insecure.html
Postdoctoral Researcher in Computer Security @ KU Leuven. Tuesday, 22 May 2012. The views expressed here reflect the views of the author alone, and do not necessarily reflect. The views of any of their organizations. Since this post gets many hits let's start right away with the conclusion: I consider WhatsApp to be insecure. Personally I'd never use it to send serious/secret/sensitive messages. And you should never blindly trust incoming messages! Quick links: WhatsApp Security Advisory MVSA-1. You send...
mathyvanhoef.com
Mathy Vanhoef: November 2013
http://www.mathyvanhoef.com/2013_11_01_archive.html
Postdoctoral Researcher in Computer Security @ KU Leuven. Sunday, 10 November 2013. Unmasking a Spoofed MAC Address (CVE-2013-4579). This vulnerability has been fixed in kernel 3.8.13.16. Certain Atheros wireless drivers do not properly update the MAC address when changed (spoofed) by a user. This allows an active attacker to retrieve the original MAC address. In short, spoofing your MAC address does not always hide the original MAC address. While working on the ath9k htc driver (. To clarify, consider a...
mathyvanhoef.com
Mathy Vanhoef: March 2015
http://www.mathyvanhoef.com/2015_03_01_archive.html
Postdoctoral Researcher in Computer Security @ KU Leuven. Monday, 23 March 2015. Codegate 2015 Good Crypto: Advanced WEP Cracking. In the Codegate CTF. There was challenge based on a wireless network capture. Since I do research on wireless security, I had. To solve this one! We recently intercepted some kind of encrypted traffic. Can you help us recover the password? Update: Due to a crappy javascript programmer there's one line of code missing, but I'm sure you can figure out which one. Containing all ...
blog.client9.com
SQLi and Implicit type conversion in MySQL
http://blog.client9.com/2013/04/11/sqli-and-implicit-type-conversion-in.html
SQLi and Implicit type conversion in MySQL. This was inspired by vagosec.org. Article on MySQL Implicit Type Conversion. I enumerated all the different operators to see how MySQL does type conversions. The results are surprising in many cases. String Operator Different String. SELECT A AND B = C. SELECT A & B = C. SELECT A = B = C. SELECT A := B = C. SELECT A BINARY B = C. SELECT A and B = C. SELECT A B = C. SELECT A B = C. SELECT A B = C. SELECT A CASE B = C. SELECT A DIV B = C. SELECT A / B = C. SELECT...
mathyvanhoef.com
Mathy Vanhoef: Backtrack 5 and Windows Dual Boot with Full Disk Encryption
http://www.mathyvanhoef.com/2011/08/backtrack-5-and-windows-dual-boot-with.html
Postdoctoral Researcher in Computer Security @ KU Leuven. Sunday, 7 August 2011. Backtrack 5 and Windows Dual Boot with Full Disk Encryption. Truecrypt will be used to encrypt the Windows installation and dm-crypt using LUKS to encrypt Backtrack. The requirements to follow this guide are having the Windows and Backtrack installation CD ready to use. Which is also provided by truecrypt. To defend against these kinds of attacks we will overwrite the complete hard drive data several times with random data.
mathyvanhoef.com
Mathy Vanhoef: September 2014
http://www.mathyvanhoef.com/2014_09_01_archive.html
Postdoctoral Researcher in Computer Security @ KU Leuven. Wednesday, 24 September 2014. CSAW 2014: xorcise challenge. Last weekend our CTF team participated in CSAW. One of the challenges was particularly interesting, and this blog post gives a (somewhat) detailed overview on how to solve it. The source code. Were given. This write-up is also available on the awesome write-ups repository. Length checking vulnerabilities: Part One. Int process connection(int sockfd). Cipher data encrypted; ssize t bytes r...
mathyvanhoef.com
Mathy Vanhoef: Codegate 2015 Good_Crypto: Advanced WEP Cracking
http://www.mathyvanhoef.com/2015/03/codegate-2015-goodcrypto-advanced-wep.html
Postdoctoral Researcher in Computer Security @ KU Leuven. Monday, 23 March 2015. Codegate 2015 Good Crypto: Advanced WEP Cracking. In the Codegate CTF. There was challenge based on a wireless network capture. Since I do research on wireless security, I had. To solve this one! We recently intercepted some kind of encrypted traffic. Can you help us recover the password? Update: Due to a crappy javascript programmer there's one line of code missing, but I'm sure you can figure out which one. Containing all ...
mathyvanhoef.com
Mathy Vanhoef: April 2013
http://www.mathyvanhoef.com/2013_04_01_archive.html
Postdoctoral Researcher in Computer Security @ KU Leuven. Saturday, 6 April 2013. UCSB iCTF: Hacking Nuclear Plants and Pwning ASLR/NX. The following story took place on a Friday evening, with the sun long gone from the horizon, in a dimly lit room where a few hackers teamed up to do what they do best: fuck shit up. A former security researcher at KU Leuven took his fifth coffee this hour. Or was it the sixth? They were after - the reason they were already awake for 16 hours. Unfortunately the self-d...
SOCIAL ENGAGEMENT