🇦🇹 Team Austria placed 8th at #HITCON #CTF as part of the qualifier for #ECSC2025 in Warsaw. Everyone did a fantastic job, so proud of the team. We'll select the 10 final members in the next days, stay tuned! @hitcon.org @tuwien.at @informatics.tuwien.ac.at @cysecwien.bsky.social @hofhackerei.at

Meanwhile, our plane here in Vegas is "too heavy" and we can't take off. They are asking people to leave to reduce the weight. Please tell me this is perfectly normal.

After a great run at #defcon33 #CTF, I'm heading to Seattle to attend #USENIX Sec. DM me if you'd like to meet up and join us Thursday at midday for our talk on #TapTrap (track 4) with @beerphilipp.bsky.social ! taptrap.click @lindorfer.in @cysecwien.bsky.social @informatics.tuwien.ac.at

From starting @mhackeroni.bsky.social in 2018 to heading @hofhackerei.at to 9th place at @defcon.bsky.social #CTF finals this year: what a journey. This team is amazing, I couldn't be prouder of all of them and the best is yet to come! 🔥 @cysecwien.bsky.social @tuwien.at @informatics.tuwien.ac.at

First wave of our team (me included) is on the way to @defcon.bsky.social #CTF. Huge thx to the companies and unis backing us, we're extremely grateful. Special shoutout to @tuwien.at for the early support, as well as everyone who joined after. We'll give our best, wish us luck! See you Vegas 🌴🚩

I'm part of the team that discovered the #TapTrap vulnerability. We confirmed that @grapheneos.org has properly fixed it, as detailed on our site taptrap.click Despite a small factual error, it's good to see #GrapheneOS getting some media attention.

foxnews.com/tech/new-and... > GrapheneOS, a security-focused operating system based on Android, confirmed that its current version is also affected. However, it plans to release a fix in its next update. No, we said that on July 7 and then shipped grapheneos.org/releases#202... fixing it.

ECSC 2025 prep has begun! First Team Austria qualifier wrapped up with 30 participants focusing on #ENOWARS and #DUCTF. Great vibes. Thanks to Ikarus Security for hosting us and everyone who joined! #ECSC2025 @tuwien.at @informatics.tuwien.ac.at @cysecwien.bsky.social

Our #TapTrap attack got covered in @tuwien.at's news! This was such a fun project. Congrats to @beerphilipp.bsky.social on his second first-author paper at a top-tier conference ❤️ We'll present the paper at #USENIX in Seattle on August 14 . Looking forward to catching up with some of you there!

For the second year in a row, @tuwien.at students have nominated our Introduction to Security course among the finalists for the Best Teaching Award! Balancing research, teaching & outreach isn't easy, but we give it our all. 🔗 www.tuwien.at/tu-wien/aktu... CC @informatics.tuwien.ac.at

Our new Android attack, #TapTrap, is getting media coverage — so here's a quick explainer. It's a new tapjacking technique that exploits Android's UI animations to hijack user taps without requiring any permissions. @beerphilipp.bsky.social will present it at #USENIX Sec'25. 🌐 taptrap.click

It has been an honor to organize the bootcamp for 3 years in a row, and I am proud that it's getting better every time. Thanks to CSA, @cysecwien.bsky.social, ENISA, Joe Pichlmayer, Manuel Reinsperger and the entire team for making this possible. See you all next year ♥️ #CYBER #ECSC2025

Help us choose our mascot! 🐾 Nautilus Institute is asking us to send them a animal mascot for the DEFCON CTF, and we need your help to pick the cutest contender! Dive into the threat to meet the 8 adorable candidates. #KuKHofhackerei #defcon33 #ctf #Mascot

My team @kukhofhackerei.bsky.social is heading to the DEF CON CTF finals this August in Las Vegas 🔥 We're now looking for sponsors to help cover the trip. If you're interested in supporting us, please get in touch or share this around. Call for sponsors at hofhackerei.at 🇦🇹 Thank you! #CTF #DC33

After many years of battles with @mhackeroni.bsky.social, I'm blown away to announce that we've qualified for the #DEFCON CTF finals with KuK Hofhackerei 🇦🇹 this year! New friends, same love. Couldn't be prouder of this team. Thanks to nautilus.institute for organizing and see you in Vegas! 🚩

The 2nd wave of challenges for the Austria Cyber Security Challenge #ACSC will be live in 1h! You have 1 month left to compete and prove your skills! I contributed a hard web challenge this time, let's see who can solve it 👀 Ready? 👉 acsc.land @informatics.tuwien.ac.at @cysecwien.bsky.social

And the best paper award sponsored by @paloaltonetworks.bsky.social goes to... 📜 Can Public IP Blocklists Explain Internet Radiation? by D. Ravalico, S. Cossaro, R. Valentim, M. Trevisan, and I. Drago! Congratulations 👏 #MADWeb #NDSSsymposium2025

Can't wait for Friday? Get a sneak peek at #MADWeb '25 papers now! 📄✨ All papers are live on our website: madweb.work Safe travels, and see you in San Diego! ✈️ #NDSSsymposium2025

We're thrilled to announce Nick Nikiforakis (Stony Brook University) as our first keynote speaker of #MADWeb '25! 🎤 Building on Top of Shifting Sands: Web Security Through the Lens of Content Integrity Don't miss it! See the full program at madweb.work

Our 2nd Keynote is here! 🚨 We're excited to have Frederik Braun @freddyb.bsky.social (Mozilla) at #MADWeb '25! 🎤 With Carrots & Sticks: Can the Browser Handle Web Security? Join us in San Diego to attend this session! Full program: madweb.work#program

The #MADWeb '25 program is live! We've got 9 full papers, 3 work-in-progress papers, and 2 exciting keynotes lined up. Huge thanks to all the authors and the program committee! Check out the details and get ready for a great event! 🔥 🔗 madweb.work#program See you in San Diego! #NDSS #websecurity

Nominations are now open for the Top 10 Web Hacking Techniques of 2024! Browse the contestants and submit your own here: portswigger.net/research/top...

🚨 Deadline Extended 🚨 By popular demand, the #MADWeb submission deadline is now January 14, 2025 (AoE)! 🗓️ You still have 1 week to send your papers and join us in San Diego! 📜 Submit here: madweb25.hotcrp.com 🔗 Details: madweb.work Spread the word! #websec #cfp #ndss

Please consider submitting your work and help us spread the word! #MADWeb

Help us make this year's edition of #MADWeb the best one yet! 📅 Deadline: January 9, 2025 (AoE) 📜 Submit here: madweb25.hotcrp.com 🔗 Website: madweb.work #CfP #websec #websecurity

Websec folks, this is a good opportunity to join our team in Vienna. Feel free to contact me if you have any questions!

Yesterday my first PHP CVE was published: CVE-2024-11234. In some specific configurations, this vulnerability could allow for CRLF injection when using stream contexts. sec.leonardini.dev/blog/cve-202... Many thanks to @minimalblue.bsky.social for reviewing my original report

We have 3 tenure-track openings on "Transforming Science with AI/ML” at TU Wien, as part of the competitive WWTF Vienna Research Group for Young Investigators grant (1.6M EUR). Researchers working at the intersection between Security & AI are encouraged to apply! cysec.wien/calls/call_w...

Sharing CVE-2024-11234 affecting PHP. This vulnerability could lead to CRLF injection when using Stream Contexts under certain conditions. Discovered and reported by @p1anka.bsky.social, I only reviewed the report some time ago! github.com/php/php-src/...

TIL you can access your profile via <nickname>.bsky.social, like minimalblue.bsky.social. Thanks to @mebeim.bsky.social for sharing the tip.

I appreciate all of you who use the Alt-text description for the images you post. As a blind dude I feel so much more included here. For those of you who forget: Did you know there’s a reminder in Settings/Accessibility to toggle on & then it won’t let you post image without Alt-text. Thanks 🙏😎

Post a pic YOU took (no description) to bring some zen to the timeline

👀

I'm in the process of creating a *web security* starter pack and need your help finding more webbies here. Please share and recommend folks passionate about web security in comments below so we can get this community started here 🙂 go.bsky.app/Uf8dZhz

The submission site for #SecWeb '24 is now live at secweb24.secpriv.tuwien.ac.at. The deadline is on Feb 22, just 2 weeks from now! It's time to get your papers ready, we are looking forward to your submissions! secweb.work

The call for papers of the #SecWeb '24 workshop (co-located with IEEE S&P) is now online! Deadline Feb 22 secweb.work SecWeb is THE workshop to discuss provocative advancements in Web security, get feedback on early-stage research, and get in touch with amazing people (academic and not).

Our work "Cookie Crumbles: Breaking and Fixing Web Session Integrity" is among the nominations for the PortSwigger top-10 Web hacking techniques of 2023! Consider voting for us if you enjoyed our BlackHat and USENIX talks or liked the research. Video & paper here ⤵️ www.usenix.org/conference/u...

Our paper "Tabbed Out: Subverting the Android Custom Tab Security Model" got accepted at IEEE S&P 2024! Watch out this space for the preprint if you're into #mobile & #web (in)security. Congrats to my coauthors from TU Wien: Philipp Beer, Lorenzo Veronese and Martina Lindorfer! #ieeesp

Had the pleasure of being interviewed by our amazing communications team at TU Wien Informatics! Here are some behind-the-scenes of the preparation of Team Austria for the European Cybersecurity Challenge next week in Norway: informatics.tuwien.ac.at/news/2513 #ECSC2023