1

Denied by Border: Denial-of-Service Attack Exploiting Location Restrictions in Non-Terrestrial Networks

Impact Denied by Border demonstrates that 3GPP’s integrity protection for 5GMM cause #78 does not eliminate relay-based attacks. The work reveals a remaining design-level …

Kwangmin Kim
•

LLFuzz: An Over-the-Air Dynamic Testing Framework for Cellular Baseband Lower Layers

Impact LLFuzz uncovered 11 previously unknown vulnerabilities across 15 commercial smartphones from major vendors including Qualcomm, MediaTek, Samsung, and Apple. Seven of these …

Tuan Dinh Hoang
•

LLFuzz: An Over-the-Air Dynamic Testing Framework for Cellular Baseband Lower Layers

Impact LLFuzz uncovered 11 previously unknown vulnerabilities across 15 commercial smartphones from major vendors including Qualcomm, MediaTek, Samsung, and Apple. Seven of these …

Tuan Dinh Hoang
•

LLFuzz: An Over-the-Air Dynamic Testing Framework for Cellular Baseband Lower Layers

Impact LLFuzz uncovered 11 previously unknown vulnerabilities across 15 commercial smartphones from major vendors including Qualcomm, MediaTek, Samsung, and Apple. Seven of these …

Tuan Dinh Hoang
•

CITesting: Systematic Testing of Context Integrity Violations in LTE Core Networks

🏆 Distinguished Paper Award Impact We uncovered 29, 22, 16, and 59 distinct CIVs in Open5GS, srsRAN, Amarisoft, and Nokia LTE cores, respectively. These allow remote detachment, …

Mincheol Son
•

CITesting: Systematic Testing of Context Integrity Violations in LTE Core Networks

🏆 Distinguished Paper Award Impact We uncovered 29, 22, 16, and 59 distinct CIVs in Open5GS, srsRAN, Amarisoft, and Nokia LTE cores, respectively. These allow remote detachment, …

Mincheol Son
•

CITesting: Systematic Testing of Context Integrity Violations in LTE Core Networks

🏆 Distinguished Paper Award Impact We uncovered 29, 22, 16, and 59 distinct CIVs in Open5GS, srsRAN, Amarisoft, and Nokia LTE cores, respectively. These allow remote detachment, …

Mincheol Son
•

A Systematic Study of Physical Sensor Attack Hardness

Hyungsub Kim
•

A Systematic Study of Physical Sensor Attack Hardness

Hyungsub Kim
•

A Systematic Study of Physical Sensor Attack Hardness

Hyungsub Kim
•

Preventing SIM Box Fraud Using Device Model Fingerprinting

Impact We are currently testing our solution with a major operator in Korea.

Beomseok Oh
•

Preventing SIM Box Fraud Using Device Model Fingerprinting

Impact We are currently testing our solution with a major operator in Korea.

Beomseok Oh
•

Preventing SIM Box Fraud Using Device Model Fingerprinting

Impact We are currently testing our solution with a major operator in Korea.

Beomseok Oh
•

LTESniffer: An Open-source LTE Downlink/Uplink Eavesdropper

Impact LTESniffer is open-sourced at https://github.com/SysSec-KAIST/LTESniffer). It is very popular in github, receiving 1,212 stars with 128 forked project. There are at least …

Tuan Dinh Hoang
•

LTESniffer: An Open-source LTE Downlink/Uplink Eavesdropper

Impact LTESniffer is open-sourced at https://github.com/SysSec-KAIST/LTESniffer). It is very popular in github, receiving 1,212 stars with 128 forked project. There are at least …

Tuan Dinh Hoang
•

LTESniffer: An Open-source LTE Downlink/Uplink Eavesdropper

Impact LTESniffer is open-sourced at https://github.com/SysSec-KAIST/LTESniffer). It is very popular in github, receiving 1,212 stars with 128 forked project. There are at least …

Tuan Dinh Hoang
•

Watching the Watchers: Practical Video Identification Attack in LTE Networks

Impact Although it is too early to determine the impact of the video identification work, it was discussed in 2022 August 3GPP meeting (S3-221922). We plan to exploit information …

Sangwook Bae
•

Watching the Watchers: Practical Video Identification Attack in LTE Networks

Impact Although it is too early to determine the impact of the video identification work, it was discussed in 2022 August 3GPP meeting (S3-221922). We plan to exploit information …

Sangwook Bae
•

Watching the Watchers: Practical Video Identification Attack in LTE Networks

Impact Although it is too early to determine the impact of the video identification work, it was discussed in 2022 August 3GPP meeting (S3-221922). We plan to exploit information …

Sangwook Bae
•

HearMeOut: detecting voice phishing activities in Android

Media Coverage IT Media

Joongyum Kim
•

HearMeOut: detecting voice phishing activities in Android

Media Coverage IT Media

Joongyum Kim
•

HearMeOut: detecting voice phishing activities in Android

Media Coverage IT Media

Joongyum Kim
•

DoLTEst: In-depth Downlink Negative Testing Framework for LTE Devices

Impact This paper was discussed in a 3GPP SA3 meeting. It is currently open-sourced at https://github.com/SysSec-KAIST/DoLTEst. We uncovered 26 implementation flaws from 43 devices …

CheolJun Park
•

DoLTEst: In-depth Downlink Negative Testing Framework for LTE Devices

Impact This paper was discussed in a 3GPP SA3 meeting. It is currently open-sourced at https://github.com/SysSec-KAIST/DoLTEst. We uncovered 26 implementation flaws from 43 devices …

CheolJun Park
•

DoLTEst: In-depth Downlink Negative Testing Framework for LTE Devices

Impact This paper was discussed in a 3GPP SA3 meeting. It is currently open-sourced at https://github.com/SysSec-KAIST/DoLTEst. We uncovered 26 implementation flaws from 43 devices …

CheolJun Park
•

Cellular Security: Why is it difficult?

Yongdae Kim
•

Cellular Security: Why is it difficult?

Yongdae Kim
•

Cellular Security: Why is it difficult?

Yongdae Kim
•

Are There Wireless Hidden Cameras Spying on Me?

Jeongyoon Heo
•

Are There Wireless Hidden Cameras Spying on Me?

Jeongyoon Heo
•

Are There Wireless Hidden Cameras Spying on Me?

Jeongyoon Heo
•

Touching the Untouchables: Dynamic Security Analysis of the LTE Control Plane

Impact Immediately after the paper is published online, we’ve received inquiries from many operators such as Deutche Telecom, Google Project Fi, Singtel, etc if we can visit their …

Hongil Kim
•

Touching the Untouchables: Dynamic Security Analysis of the LTE Control Plane

Impact Immediately after the paper is published online, we’ve received inquiries from many operators such as Deutche Telecom, Google Project Fi, Singtel, etc if we can visit their …

Hongil Kim
•

Touching the Untouchables: Dynamic Security Analysis of the LTE Control Plane

Impact Immediately after the paper is published online, we’ve received inquiries from many operators such as Deutche Telecom, Google Project Fi, Singtel, etc if we can visit their …

Hongil Kim
•

Is Stellar As Secure As You Think?

Media Coverage Cointelegraph: Stellar’s Blockchain Briefly Goes Offline Confirming the Project Lacks Decentralization Safety vs. Liveness in the Stellar Network David Mazières

Minjeong Kim
•

Hiding in Plain Signal: Physical Signal Overshadowing Attack on LTE

Impact The initial response from GSMA was disappointing as they viewed this work as only academically interesting. However, it turned out to be important for both academia and …

Hojoon Yang
•

Hiding in Plain Signal: Physical Signal Overshadowing Attack on LTE

Impact The initial response from GSMA was disappointing as they viewed this work as only academically interesting. However, it turned out to be important for both academia and …

Hojoon Yang
•

Hiding in Plain Signal: Physical Signal Overshadowing Attack on LTE

Impact The initial response from GSMA was disappointing as they viewed this work as only academically interesting. However, it turned out to be important for both academia and …

Hojoon Yang
•

GUTI Reallocation Demystified: Cellular Location Tracking with Changing Temporary Identifier

Impact Our first paper in 2012 was discussed in three SA3 meetings held in 2017 across multiple documents: TSG3_086_Sophia meeting as part of 86th 3GPP meeting held in Sophia …

Byeongdo Hong
•

GUTI Reallocation Demystified: Cellular Location Tracking with Changing Temporary Identifier

Impact Our first paperkune2012location in 2012 was discussed in three SA3 meetings held in 2017 across multiple documents: TSG3_086_SophiaSA3 meeting as part of 86th 3GPP meeting …

Byeongdo Hong
•

GUTI Reallocation Demystified: Cellular Location Tracking with Changing Temporary Identifier

Impact Our first paperkune2012location in 2012 was discussed in three SA3 meetings held in 2017 across multiple documents: TSG3_086_SophiaSA3 meeting as part of 86th 3GPP meeting …

Byeongdo Hong
•

Be Selfish and Avoid Dilemmas: Fork After Withholding (FAW) Attacks on Bitcoin

Media Coverage ACM The Morning Paper

Yujin Kwon
•

Decoder-Free Sino-Korean Shellcode

Ji-Hyeon Yoon
•

Decoder-Free Sino-Korean Shellcode

Ji-Hyeon Yoon
•

Decoder-Free Sino-Korean Shellcode

Ji-Hyeon Yoon
•

Security Analysis of FHSS-type Drone Controller

Hocheol Shin
•

Security Analysis of FHSS-type Drone Controller

Hocheol Shin
•

Security Analysis of FHSS-type Drone Controller

Hocheol Shin
•

BurnFit: Analyzing and Exploiting Wearable Devices

Dongkwan Kim
•

BurnFit: Analyzing and Exploiting Wearable Devices

Dongkwan Kim
•

BurnFit: Analyzing and Exploiting Wearable Devices

Dongkwan Kim
•

Breaking and Fixing VoLTE: Exploiting Hidden Data Channels and Mis-implementations

Impact At the time, only South Korea and the United States had widely deployed Voice over LTE (VoLTE) technology, so no other countries were affected. The vulnerabilities were …

Hongil Kim
•

Breaking and Fixing VoLTE: Exploiting Hidden Data Channels and Mis-implementations

Impact At the time, only South Korea and the United States had widely deployed Voice over LTE (VoLTE) technology, so no other countries were affected. The vulnerabilities were …

Hongil Kim
•

Breaking and Fixing VoLTE: Exploiting Hidden Data Channels and Mis-implementations

Impact At the time, only South Korea and the United States had widely deployed Voice over LTE (VoLTE) technology, so no other countries were affected. The vulnerabilities were …

Hongil Kim
•

Bittersweet ADB: Attacks and Defenses

Sungjae Hwang
•

Bittersweet ADB: Attacks and Defenses

Sungjae Hwang
•

Bittersweet ADB: Attacks and Defenses

Sungjae Hwang
•

Gaining Control of Cellular Traffic Accounting by Spurious TCP Retransmission

Impact We discovered that Korean operators are more concerned with over-charging than charging bypass. This is because over-charging can result in penalties from the government. …

Younghwan Go
•

Gaining Control of Cellular Traffic Accounting by Spurious TCP Retransmission

Impact We discovered that Korean operators are more concerned with over-charging than charging bypass. This is because over-charging can result in penalties from the government. …

Younghwan Go
•

Gaining Control of Cellular Traffic Accounting by Spurious TCP Retransmission

Impact We discovered that Korean operators are more concerned with over-charging than charging bypass. This is because over-charging can result in penalties from the government. …

Younghwan Go
•

Trustworthy distributed computing on social networks

Abedelaziz Mohaisen
•

Trustworthy distributed computing on social networks

Abedelaziz Mohaisen
•

Trustworthy distributed computing on social networks

Abedelaziz Mohaisen
•

Towards accurate accounting of cellular data for TCP retransmission

Impact We discovered that Korean operators are more concerned with over-charging than charging bypass. This is because over-charging can result in penalties from the government. …

Younghwan Go
•

Towards accurate accounting of cellular data for TCP retransmission

Impact We discovered that Korean operators are more concerned with over-charging than charging bypass. This is because over-charging can result in penalties from the government. …

Younghwan Go
•

Towards accurate accounting of cellular data for TCP retransmission

Impact We discovered that Korean operators are more concerned with over-charging than charging bypass. This is because over-charging can result in penalties from the government. …

Younghwan Go
•

Ghost Talk: Mitigating EMI Signal Injection Attacks against Analog Sensors

Media Coverage The Register

Denis Foo Kune
•

Ghost Talk: Mitigating EMI Signal Injection Attacks against Analog Sensors

Media Coverage The Register

Denis Foo Kune
•

Ghost Talk: Mitigating EMI Signal Injection Attacks against Analog Sensors

Media Coverage The Register

Denis Foo Kune
•

Dynamix: anonymity on dynamic social structures

Abedelaziz Mohaisen
•

Dynamix: anonymity on dynamic social structures

Abedelaziz Mohaisen
•

Dynamix: anonymity on dynamic social structures

Abedelaziz Mohaisen
•

Private Over-Threshold Aggregation Protocols

Myungsun Kim
•

Private Over-Threshold Aggregation Protocols

Myungsun Kim
•

Private Over-Threshold Aggregation Protocols

Myungsun Kim
•

Location leaks over the GSM air interface

Impact Our first paper in 2012 was discussed in three SA3 meetings held in 2017 across multiple documents: TSG3_086_Sophia meeting as part of 86th 3GPP meeting held in Sophia …

Denis Foo Kune
•

Location leaks over the GSM air interface

Impact Our first paperkune2012location in 2012 was discussed in three SA3 meetings held in 2017 across multiple documents: TSG3_086_SophiaSA3 meeting as part of 86th 3GPP meeting …

Denis Foo Kune
•

Location leaks over the GSM air interface

Impact Our first paperkune2012location in 2012 was discussed in three SA3 meetings held in 2017 across multiple documents: TSG3_086_SophiaSA3 meeting as part of 86th 3GPP meeting …

Denis Foo Kune
•

Losing Control of the Internet: Using the Data Plane to Attack the Control Plane

Media Coverage New Scientist ZDNet The Register

Max Schuchard
•

Timing attacks on PIN input devices

Denis Foo Kune
•

Timing attacks on PIN input devices

Denis Foo Kune
•

Timing attacks on PIN input devices

Denis Foo Kune
•

Recruiting new tor relays with BRAIDS

Rob Jansen
•

Recruiting new tor relays with BRAIDS

Rob Jansen
•

Recruiting new tor relays with BRAIDS

Rob Jansen
•

Measuring the mixing time of social graphs

Abedelaziz Mohaisen
•

Measuring the mixing time of social graphs

Abedelaziz Mohaisen
•

Measuring the mixing time of social graphs

Abedelaziz Mohaisen
•

Losing control of the internet: using the data plane to attack the control plane

Media Coverage New Scientist ZDNet The Register

Max Schuchard
•

Losing control of the internet: using the data plane to attack the control plane

Media Coverage New Scientist ZDNet The Register

Max Schuchard
•

Balancing the shadows

Max Schuchard
•

Balancing the shadows

Max Schuchard
•

Balancing the shadows

Max Schuchard
•

Why Kad Lookup Fails

Hun Jeong Kang
•

Why Kad Lookup Fails

Hun Jeong Kang
•

Why Kad Lookup Fails

Hun Jeong Kang
•

Towards complete node enumeration in a peer-to-peer botnet

Brent ByungHoon Kang
•

Towards complete node enumeration in a peer-to-peer botnet

Brent ByungHoon Kang
•

Towards complete node enumeration in a peer-to-peer botnet

Brent ByungHoon Kang
•

Scalable onion routing with torsk

Jon McLachlan
•

Scalable onion routing with torsk

Jon McLachlan
•

Scalable onion routing with torsk

Jon McLachlan
•

Membership-concealing overlay networks

Eugene y. vasserman
•

Membership-concealing overlay networks

Eugene y. vasserman
•

Membership-concealing overlay networks

Eugene y. vasserman
•

Attacking the Kad network

Peng Wang
•

Attacking the Kad network

Peng Wang
•

Attacking the Kad network

Peng Wang
•

Realistic Sensing Area Modeling

Joengmin Hwang
•

Realistic Sensing Area Modeling

Joengmin Hwang
•

Realistic Sensing Area Modeling

Joengmin Hwang
•

Detecting Phantom Nodes in Wireless Sensor Networks

Joengmin Hwang
•

Detecting Phantom Nodes in Wireless Sensor Networks

Joengmin Hwang
•

Detecting Phantom Nodes in Wireless Sensor Networks

Joengmin Hwang
•

Timed-Release and Key-Insulated Public Key Encryption

Jung Hee Cheon
•

Privacy Preserving Nearest Neighbor Search

Mark Shaneck
•

Privacy Preserving Nearest Neighbor Search

Mark Shaneck
•

Privacy Preserving Nearest Neighbor Search

Mark Shaneck
•

Achieving realistic sensing area modeling

Joengmin Hwang
•

Achieving realistic sensing area modeling

Joengmin Hwang
•

Achieving realistic sensing area modeling

Joengmin Hwang
•

Batch Verifications with ID-Based Signatures

HyoJin Yoon
•

Batch Verifications with ID-Based Signatures

HyoJin Yoon
•

Batch Verifications with ID-Based Signatures

HyoJin Yoon
•

Security model for a multi-agent marketplace

Ashutosh Jaiswal
•

Security model for a multi-agent marketplace

Ashutosh Jaiswal
•

Security model for a multi-agent marketplace

Ashutosh Jaiswal
•

Admission Control in Peer Groups

Yongdae Kim
•

Admission Control in Peer Groups

Yongdae Kim
•

Admission Control in Peer Groups

Yongdae Kim
•

Secure Group Services for Storage Area Networks

Yongdae Kim
•

Secure Group Services for Storage Area Networks

Yongdae Kim
•

Secure Group Services for Storage Area Networks

Yongdae Kim
•

Exploring Robustness in Group Key Agreement

Yair Amir
•

Exploring Robustness in Group Key Agreement

Yair Amir
•

Exploring Robustness in Group Key Agreement

Yair Amir
•

Communication-Efficient Group Key Agreement

Yongdae Kim
•

Communication-Efficient Group Key Agreement

Yongdae Kim
•

Communication-Efficient Group Key Agreement

Yongdae Kim
•