Security, privacy, and cryptography
Video
When LLMs Go Online: The Emerging Threat of Web-Enabled LLMs
Recent advancements in Large Language Models (LLMs) have established them as agentic systems capable of planning and interacting with various tools. These LLM agents are often paired with web-based tools, enabling access to diverse sources…
Video
A Formal Analysis of Apple’s iMessage PQ3 Protocol
We present the formal verification of Apple’s iMessage PQ3, a highly performant, device-to-device messaging protocol offering strong security guarantees even against an adversary with quantum computing capabilities. PQ3 leverages Apple’s identity services together with a…
Video
Email Spoofing with SMTP Smuggling: How the Shared Email Infrastructures Magnify this Vulnerability
Email spoofing is a critical technique used in phishing attacks to impersonate a trusted sender. SMTP smuggling is a new vulnerability that allows adversaries to perform email spoofing while bypassing existing authentication protocols such as…
Video
A Framework for Abusability Analysis: The Case of Passkeys in Interpersonal Threat Models
The recent rollout of passkeys by hundreds of web services online is the largest attempt yet to achieve the goal of passwordless authentication. However, new authentication mechanisms can often overlook the unique threats faced by…
Video
‘Hey mum, I dropped my phone down the toilet’: Investigating Hi Mum and Dad SMS Scams in the UK
SMS fraud has surged in recent years. Detection techniques have improved along with the fraud, necessitating harder-to-detect fraud techniques. We study one of these where scammers send an SMS to the victim addressing mum or…
Video
zk-promises: Anonymous Moderation, Reputation, & Blocking from Anonymous Credentials with Callbacks
Anonymity is essential for free speech and expressing dissent, but platform moderators need ways to police bad actors. For anonymous clients, this may involve banning their accounts, docking their reputation, or updating their state in…
Video
More is Less: Extra Features in Contactless Payments Break Security
The EMV contactless payment system has many independent parties: payment providers, terminal companies, smartphone companies, banks and regulators. EMVCo publishes a 15 book specification that these companies use to operate together. However, many of these…
Publication
Ordered Consensus with Equal Opportunity
Video
Six Years of Rowhammer: Breakthroughs and Future Directions
This talk presents the work done over the past six years as part of Project STEMA at Microsoft. STEMA stands for Secure, Trusted, and Enhanced Memory for Azure. We discuss our journey in understanding Rowhammer…
Microsoft Research Blog
Crescent library brings privacy to digital identity systems
Crescent helps make digital IDs private by preventing tracking across uses while letting users only disclose what’s necessary from their credentials.
