PhD student at @vu5ec - (u)arch attacks && memory_safety
Amsterdam, The Netherlands
Joined October 2011
- Tweets97
- Following436
- Followers177
- Likes528
Emanuele Vannacci retweeted
This strange tweet got >25k retweets. The author sounds confident, and he uses lots of hex and jargon. There are red flags though... like what's up with the DEI stuff, and who says "stack trace dump"? Let's take a closer look... 🧵1/n
My code doesn't work in one specific case. I find a bug. I fix the bug. Code does not work anymore. Why did my code work before? Another bug cancels the first bug in all but that one case. Hypothesis: My code works iff the number of bugs is even.
I'm thrilled to announce that our paper "Speculation@Fault" @USENIXSecurity is online! Read about how we automatically find information leakages arising from CPU exceptions by fuzzing against speculative contracts.
Thanks to all my co-authors @jana_tweets_cs @oleksii_o Cédric Fournet and @socialboris for the amazin work. And thanks @vu5ec for supporting me in this project!
Emanuele Vannacci retweeted
POV: @JakobKoschel and I (with @vu5ec) accidentally getting the Linux kernel to upgrade to modern C
[$] Moving the kernel to modern C lwn.net/Articles/885941/rss
Emanuele Vannacci retweeted
Introducing #FPVI and #SCSB, two new transient execution vulnerabilities based on previously unexplored causes of Machine Clear. See vusec.net/projects/fpvi-scsb. We use FPVI to read arbitrary memory in Firefox via attacker-controlled and transiently-injected floating-point results:
Emanuele Vannacci retweeted
While we showed earlier that DDR4 is vulnerable to Rowhammer, we could not launch attacks from JavaScript. Until now.
By synchronizing memory requests with DRAM refresh commands, we show that web users are at risk also.
Page: vusec.net/projects/smash/
Demo: youtube.com/watch?v=k2D4D-kF…
Emanuele Vannacci retweeted
Our #PIBE paper @ASPLOSConf and code are now online. We show how to greatly reduce the overhead of mitigations such as LVI-CFI and retpoline on the kernel using PGO. Joint work by @victor_duta (who did all the hard work!) @c_giuffrida @herbertbos @EKouwe:
download.vusec.net/papers/pi…
Emanuele Vannacci retweeted
Three pages of nominations and looks like #TRRespass is the lucky winner of this year's most innovative research pwnie! Congrats to all @pit_frg @vanema94 @ArthasSin @vvdveen @_onurmutlu_ @c_giuffrida @herbertbos
Emanuele Vannacci retweeted
#BlindSide’s source code is now online. We also released 2 new kernel exploit demo videos, e.g., Exploit 2: a single buffer overflow to speculatively break arbitrary randomization and mount an architectural data-only exploit
to leak the root password hash:
vusec.net/projects/blindside
Emanuele Vannacci retweeted
Best paper award @IEEEEUROSP! @rk_konoth didn't give up after the 1st, 2ed .. rejects. Kept improving the paper, formal verification, more features, integrations. Apparently there is sometimes a big light at the end of the tunnel! Talk on Thursday at 16:30 CEST
Our paper #SecurePay won the best paper award at
@IEEEEUROSP 2020. Thank you @elathan @herbertbos @kavehrazavi et al. @vu5ec! Enjoy download.vusec.net/papers/se…
Emanuele Vannacci retweeted
We tried something new! A virtual hardware Capture the Flag competition. Congratulations to @noopwafel, @hanyrax, @vanema94, and Koen Koning from @vu5ec, who took first place. #57thDac
Emanuele Vannacci retweeted
Next up on #HITBLockdown002 Track 1:
"A Journey Into the Secret Flaws of In-DRAM RowHammer Mitigations"
Presented by @vanema94 & @pit_frg
Starts 15:00 SGT at youtu.be/siylg59I6FA
Ask questions via our Slido channel #askinthebox
Emanuele Vannacci retweeted
Our #TagBleed paper is now online. We show Tagged TLB's performance benefits come at a security cost. TL;DR Confused-deputy side-channel attacks based on Tagged TLBs can break #KASLR even in face of ideal #KPTI or state-of-the-art KASLR mitigations:
download.vusec.net/papers/ta…
Looking forward for me and @pit_frg to present "A journey into the secret flaws of in-DRAM RowHammer mitigations" at @HITBSecConf2020 ! Don't miss it! #HITBLockdown002
Intel CPUs Vulnerable to New 'SGAxe' and 'CrossTalk' Side-Channel Attacks thehackernews.com/2020/06/in… via @TheHackersNews
Emanuele Vannacci retweeted
Introducing #CrossTalk (#SRBDS), the first #MDS cross-core attack which can leak stale data from an offcore staging buffer shared across cores. See vusec.net/projects/crosstalk where we also show how to leak #Intel #SGX enclave private keys across cores in 1s with just 1 signature: