Security, privacy, and cryptography
Video
Email Spoofing with SMTP Smuggling: How the Shared Email Infrastructures Magnify this Vulnerability
Email spoofing is a critical technique used in phishing attacks to impersonate a trusted sender. SMTP smuggling is a new vulnerability that allows adversaries to perform email spoofing while bypassing existing authentication protocols such as…
Video
A Framework for Abusability Analysis: The Case of Passkeys in Interpersonal Threat Models
The recent rollout of passkeys by hundreds of web services online is the largest attempt yet to achieve the goal of passwordless authentication. However, new authentication mechanisms can often overlook the unique threats faced by…
Video
‘Hey mum, I dropped my phone down the toilet’: Investigating Hi Mum and Dad SMS Scams in the UK
SMS fraud has surged in recent years. Detection techniques have improved along with the fraud, necessitating harder-to-detect fraud techniques. We study one of these where scammers send an SMS to the victim addressing mum or…
Video
zk-promises: Anonymous Moderation, Reputation, & Blocking from Anonymous Credentials with Callbacks
Anonymity is essential for free speech and expressing dissent, but platform moderators need ways to police bad actors. For anonymous clients, this may involve banning their accounts, docking their reputation, or updating their state in…
Video
More is Less: Extra Features in Contactless Payments Break Security
The EMV contactless payment system has many independent parties: payment providers, terminal companies, smartphone companies, banks and regulators. EMVCo publishes a 15 book specification that these companies use to operate together. However, many of these…
Publication
Ordered Consensus with Equal Opportunity
Video
Six Years of Rowhammer: Breakthroughs and Future Directions
This talk presents the work done over the past six years as part of Project STEMA at Microsoft. STEMA stands for Secure, Trusted, and Enhanced Memory for Azure. We discuss our journey in understanding Rowhammer…
Microsoft Research Blog
Crescent library brings privacy to digital identity systems
Crescent helps make digital IDs private by preventing tracking across uses while letting users only disclose what’s necessary from their credentials.
Event
Pre-USENIX Security Mini-Conference
This is an invite-only event, unless you are a Microsoft employee. You must have received an invitation email from the organizers to register and attend. This is not an official USENIX Security-affiliated event. The event…
