Daniele Antonioli
Recently, I presented the ZOBS principles in a keynote at ACM WiSec'26 . Thanks again to Vincent Lenders and Gerhard Hancke for the invitation! Keynote abstract: The Zen of Bluetooth Security (ZOBS) is a collection of Bluetooth security principles developed by the speaker to systematize seven years of research on Bluetooth security protocols. The talk explores Bluetooth security research through…
Here is Tommaso Sacchetti demonstrating the BLERP peripheral impersonation attack against a vulnerable Android 13 build (2024). In this setup, an attacker in proximity impersonates a trusted mouse, triggers an unauthenticated re-pairing, and takes over the input channel. Recent Android versions have addressed this issue.
Last summer, Marco Casagrande and I talked about E-Trojans: Ransomware, Tracking, DoS, and Data Leaks on Xiaomi Electric Scooters at Black Hat USA 2025 . Our presentation is online:
The call for submission for the first edition of the DCS-CI conference is online . The Design of Cyber-Secure Critical Infrastructure (DCS-CI) 26 conference invites researchers, practitioners, and thought leaders to submit original work that advances our collective understanding of how to design, deploy, and maintain secure critical infrastructure systems. We welcome submissions from diverse…
I am excited to chair the WiSec Demo and Poster session . Please submit your great posters and demos via this HotCRP instance ! All poster titles must be prefixed with POSTER: and all demo titles with DEMO: . Deadlines: Submission: April 7, 2026 (AOE) Notification: April 21, 2026 Camera-ready: May 5, 2026 Please also share the word!
In mid 2024, Tom and I looked at BLE re-pairing, an underlooked attack surface. We uncovered four critical re-pairing attacks and design-level vulnerabilities that allow device impersonation and MitM of arbitrary devices in BLE range. The attacks work even in the most secure BLE modes, like authenticated pairing and Secure Connections Only, and require 0-click or 1-click interactions. As part of…
The DEF CON 33 Hackers’ Almanack just dropped . We would like to thank Paul Chang and their team for featuring CTRAPS in the Right to Repair section. Read and share the Almanack!. Links: CTRAPS paper and DEF CON talk .
Marco and I talked about CTRAPS with Stephen Sims from Off By One Security about CTRAPS: CTAP Impersonation and API Confusion on FIDO2 . Thank you Stephen and Randall for inviting us and keep up with the awesome content in your YouTube channel!
This week we presented at IEEE Euro S&P'25 CTRAPS: CTAP Impersonation and API Confusion on FIDO2 , a paper about the security and privacy of FIDO2, a widespread standard used for single-factor and multi-factor authentication. We focus on the Client to Authenticator Protocol (CTAP) , an application layer protocol spoken by a FIDO2 authenticator (e.g., a YubiKey) and a client (e.g., a smartphone or…
Talk on CTRAPS attacks on FIDO2 as part of ETHZ ZISC seminars.
Mathy Vanhoef and I are co-chairing NDSS'26 Artifact Evaluation (AE) . We are looking for motivated PhD and Postdocs to self-nominate themselves for the NDSS'26 Artifact Evaluation Committee (AEC) . Joining it would offer them practical experience and may ease developing artifact submissions for their papers. The self nomination form is open until June 25th and available here . NDSS'26 AEC call is…
Alfred Menezes has published a fantastic online course on real-world cryptography called Crypto 101: Real-World Deployments . It is an honor to be featured in the Bluetooth Security Lecture (Lecture 4) which talks about the KNOB attack.
Talk on FP-tracer and browser fingerprinting at Privasky'25 .
Talk on Automotive Bluetooth Security at AMUSEC'25 . Cars are some of the most security-critical consumer devices. On the one hand, owners expect rich infotainment features, including audio, hands-free calls, contact management, or navigation through their connected mobile phone. On the other hand, the infotainment unit exposes exploitable wireless attack surfaces. This talk focuses on…
The call for papers for the 4th Workshop on Automotive Cyber Security (ACSW) co-located with IEEE EuroS&P 2025 is closing today, Feb 3rd AoE. Please submit your automotive security work! For more information see the ACSW website and its past editions .
The ADF framework is described in a paper published in the ACM TECS journal in 2024 titled AttackDefense Framework (ADF): Enhancing IoT Devices and Lifecycles Threat Modeling and available on GitHub .
We release the AttackDefense Framework (ADF) , a threat modeling framework for IoT devices and their life cycles. The ADF employs a flexible and generic threat data structure called the AttackDefense (AD) object . An AD can model attack and defense aspects, like attack vectors, surfaces, models and defense policies and mechanisms, at the same time. With the ADF, we can model, among others,…
In this talk we will explore recent research on real world wireless security protocols. We will cover standard protocols such as Bluetooth pairing and session establishment and proprietary ones such as IoT application layer protocols used to secure traffic between companion mobile applications and electric scooters and fitness trackers.
Keynote given at ACSW'24 (EuroS&P Workshop) covering Automotive Bluetooth Security and E-Spoofer.
Modern websites use attribute-based browser fingerprinting to track us(ers) using our browser’s JavaScript API. They can track us without cookies, and regardless of what we click on websites’ consent banners. With FP-tracer , we present a new and effective method to detect attribute-based browser fingerprinting using a taint tracking aware browser, and joint entropy thresholds. With…
Keynote given at RESSI'24 covering, among others, BLUFFS , E-Spoofer , and BreakMi .
Talk covering, among others, BLUFFS , E-Spoofer , and BreakMi .
YouTube (37c3)
YouTube (WiSec'23)
Salut, Marco Casagrande will talk about E-Spoofer and I will talk about BLUFFS at the 2024 Toulouse Hacking Convention (THCON)! Both research works are funded by the ORSHIN Horizon Europe research grant. E-Spoofer talk: 4th April 2024, 10:15-10:45 BLUFFS talk: 4th April 2024, 11:15-10:45 Where: Marthe Condat auditorium, Paul Sabatier University, Toulouse THCON program See you in Toulouse 🇫🇷 at…
This lecture overviews recent and impactful research on Bluetooth security and privacy. We will cover protocol-level vulnerabilities in the Bluetooth specification affecting billions of devices, such as KNOB, BIAS, BLUR, and BLUFFS. Moreover, we will explore works about insecure and proprietary protocols built on Bluetooth, including BreakMi exploiting Xiaomi and Fitbit fitness tracker protocols…
YouTube Media CCC More here .
See you in Hamburg 🇩🇪 at 37c3
Breaking and fixing the Bluetooth standard. One More Time. Paper Slides Toolkit CVE-2023-24023 BT SIG note
Marco Casagrande’s presentation of our E-Spoofer paper about Xiaomi e-scooters' security and privacy recorded at ACM WiSec'23
In this lecture we cover an Introduction about Bluetooth security, its main transports (BC, BLE), procedures (discovery, connect) and logical entities (Host, Controller, HCI). Then we look at Bluetooth security architecture and the specific BC/BLE algorithms and protocols. We conclude by talking about state of the art attacks that we developed against this protocols including KNOB, BIAS, and BLUR.…
Riccardo Cestaro’s master thesis, done at EURECOM in my group as a visiting student from UniPD, won the second prize in the CLUSIT (Italian Association for Information Security) thesis contest. CLUSIT yearly awards some of the best Information security theses in Italy. The list of winners is available here . Riccardo’s thesis contributed to the E-Spoofer paper that we recently…