Mathy Vanhoef

Interview with SecureW2, where we look back on various Wi-Fi attacks and give network security advice to handle future attacks, especially in the age of AI securew2.com/signal/sneak... tl;dr: ensure a layered defense

Signal is the gold standard for secure messengers. We broke Signal’s integrity (twice) in this paper via message injection attacks. @kientuong114.bsky.social presented this week at #USENIX and he and Noemi will present it again at #WAC (Crypto workshop) this weekend. Catch their talk if you can!

In 2023, @nature.com published 'Papers and patents are becoming less disruptive over time', receiving world-wide media attention. Our Matters Arising, published after a 32 month delay (more on that soon), shows that the reported decline can largely be attributed to dataset artefacts. 🧵

I have run into situations where people want to set duress passwords on things and there are really three possibilities.

Where these tools shine is literature searches. I’m increasingly of the opinion that we need to write papers for LLMs to read. It’s frustrating that many ePrint sites actually block these tools. This is the first tool that can find the “small result” you left as a footnote in Appendix B that I need.

Nominate yourself to help review papers for USENIX Security 2027! sec-rms.com/submit-appli... (or rms.swag.cispa.de/submit-appli... ). Deadline: May 28, 2026. We're looking for both senior and junior people. See Andrei Sabelfeld's LinkedIn post for more info: www.linkedin.com/feed/update/...

In addition to being absolutely brilliant, amazing & charming in her own right, we all know she was raised by a single dad w/4 siblings and that he came to the US bc of persecution bc of his participation in the ‘89 Tiananmen democracy uprising, right?

this is one of the most amazing papers I have ever read eprint.iacr.org/2026/058.pdf

The NDSS Symposium 2026 program is live. With 265 accepted papers and 8 workshops, the quality of security research this year is staggering. It is a testament to the community's dedication to keeping the digital world safe. www.ndss-symposium.org/ndss2026/pro... 1/4

The US government is considering punishing American scientists who worked with Chinese researchers *years ago, retroactively*.

I've found AI tools to be quite useful too look for related work. And apparently so do others, searching Google Scholar for "utm_source=chatgpt.com" gives 13,900+ hits ;) scholar.google.com/scholar?star...

Russia is blocking mobile phones being brought back into the country from abroad for 24 hours, in an attempt to mitigate drone attacks. Seems like this can probably be bypassed using relay "worm hole" attacks, though it adds some complexity. novayagazeta.eu/articles/202...

woo! $10 MM USD in grants from ICANN... amazing. And great grantees here! "ICANN Announces First Cohort of Grant Program Recipients" www.icann.org/en/announcem...

Last chance to (self-) nominate for USENIX Security'26 Artifact Evaluation Committee! You should expect a low load of ~1 artifact for functionality/reproducibility assessments per cycle (max 3 for the whole year). Please support Open Science and fill the form by Oct 17: forms.gle/WoYRX4govNY1... 🚀

I have been learning more about PDFs than I really wanted to for maybe the absolutely most funny reason possible - letting agency forgery: mjg59.dreamwidth.org/73317.html

The West has a blindspot when it comes to alternative CPU designs.

 We’re so entrenched in the usual x86, ARM, RISC-V world, that most people have no idea what’s happening over in China.

 LoongArch is a fully independent ISA that’s sorta MIPS…sorta RISC-V…and sorta x87!

At USENIX Security? Then check out: Studying the Use of CVEs in Academia, won distinguished paper award www.usenix.org/conference/u... Discovering and Exploiting Vulnerable Tunnelling Hosts, won most innovative research Pwnie @ DEFCON www.usenix.org/conference/u... Big thanks to all co-authors!!

I'm thrilled to announce that after months of intensive work, the complete materials for my Applied Cryptography course at the American University of Beirut are now finished: both Part 1 (Provable Security) and Part 2 (Real-World Cryptography)!

Breaking: NSF is suspending roughly 300 grants with UCLA, following a DOJ finding on Tuesday that the university violated Title VI by "creating a hostile educational environment for Jewish and Israeli students."

Our research on open tunneling servers got nominated for the Most Innovative Research award :) The work will be presented by Angelos Beitis at Black Hat and also at USENIX Security Brief summary and code: github.com/vanhoefm/tun... Paper: papers.mathyvanhoef.com/usenix2025-t...

Also in Poland. It was used by Russia in 2023 to stop about 20 trains.

Reminder that the MSCA postdoctoral program exists. If you have a PhD and want to work in a European lab, you have until September to apply. Just contact them now. ec.europa.eu/info/funding...

Senate GOP budget bill has little-noticed provision that could hurt your Wi-Fi arstechnica.com/tech-policy/... ==> Possibly no 6GHz for Wi-Fi 7

Reminder to apply to be part of the artifact evaluation committee of NDSS'26! And share with your colleagues :) We'll likely close this form around the end of next week.

All papers should publish their code. Help realize this by becoming an artifact reviewer at NDSS'26, apply here: docs.google.com/forms/d/e/1F... You'll review artifacts of accepted papers. We especially encourage junior/senior PhD students & PostDocs to help. Distinguished reviews will get awards!

Lee Jae-myung, the South Korean politician who climbed the fence of the parliament to get inside and vote against martial law, has been elected president. Pretty cooool

All papers should publish their code. Help realize this by becoming an artifact reviewer at NDSS'26, apply here: docs.google.com/forms/d/e/1F... You'll review artifacts of accepted papers. We especially encourage junior/senior PhD students & PostDocs to help. Distinguished reviews will get awards!

Calling researchers: EU #grantconsultancy 🚨 Have you worked with private grant consultants for EU research funding (Horizon, EIC, etc.)—Have you had positive or negative experiences? 📩 Share your story: kaspernollet@gmail.com / thordeyaert@hotmail.be (@thordeyaert.bsky.social) 🔁 RT appreciated!

Haven't seen this on Bluesky yet: S&P 2027 will take place in Montreal, Canada!

New version of the IEEE 802.11 standard that underpins Wi-Fi was has been released. A total of 5969 pages! The number of pages clearly keeps increasing. That includes more features to defend networks, but also more features to potentially abuse 👀

In two weeks, @vanhoefm.bsky.social , professor at DistriNet at KU Leuven, takes the stage for our next #DistinguishedLecture. He will present current strategies to strengthen Wi-Fi #security based on recent attacks on networks and previously detected design flaws. All information: buff.ly/gslCMCB

February 2025 Android Security Bulletin includes a heap buffer overflow in a Linux kernel USB peripheral driver (CVE-2024-53104) marked exploited in the wild. It's likely one of the USB bugs exploited by forensic data extraction tools. We block them using these. source.android.com/docs/securit...

Does the culture you grow up in shape the way you see the world? In a new Psych Review paper, @chazfirestone.bsky.social & I tackle this centuries-old question using the Müller-Lyer illusion as a case study. Come think through one of history's mysteries with us🧵(1/13):

The PC is Dead: It’s Time to Make Computing Personal Again

mitmproxy 11.1 is out! 🥳 We now support *Local Capture Mode* on Windows, macOS, and - new - Linux! This allows users to intercept local applications even if they don't have proxy settings. More details are at mitmproxy.org/posts/local-.... Super proud of this team effort. 😃

Using Play Integrity API is an incredibly anti-privacy and anti-security practice despite being wrongly portrayed as a security feature. The notification will include a link for leaving a rating and review for the app via sandboxed Play Store to make it very convenient for people to send complaints.