-
The March 2025 Security Update Review
We’ve reached the third Patch Tuesday of 2025, and, as expected, Microsoft and Adobe have released their latest security offerings. Take a break from your scheduled activities and join us as we review the details of their latest security alerts. If you’d rather watch the full video recap covering the entire release, you can check…
-
CVE-2024-43639: Remote Code Execution in Microsoft Windows KDC Proxy
In this excerpt of a Trend Micro Vulnerability Research Service vulnerability report, Simon Humbert and Guy Lederfein of the Trend Micro Research Team detail a recently patched code execution vulnerability in the Microsoft Windows Key Distribution Center (KDC) Proxy. This bug was originally discovered by k0shl and Wei in Kunlun Lab with Cyber KunLun. Successful…
-
Blockchain-Based Decentralized Domain Name System
ePrint Report: Blockchain-Based Decentralized Domain Name System Guang Yang, Peter Trinh, Alma Nkemla, Amuru Serikyaku, Edward Tatchim, Osman Sharaf The current Domain Name System (DNS) infrastructure faces critical vulnerabilities including poisoning attacks, censorship mechanisms, and centralized points of failure that compromise internet freedom and security. Recent incidents such as DNS poisoning attacks on ISP customers…
-
Announcing Pwn2Own Berlin and Introducing an AI Category
If you just want to read the contest rules, click here. Willkommen, meine Damen und Herren, zu unserem ersten Wettbewerb in Berlin! That’s correct (if Google translate didn’t steer me wrong). While the Pwn2Own competition started in Vancouver in 2007, we always want to ensure we are reaching the right people with our choice of…
-
Quantum Composable and Contextual Security Infrastructure (Q2CSI) : A Modular Architecture for Legally Explainable Cryptographic Signatures
ePrint Report: Quantum Composable and Contextual Security Infrastructure (Q2CSI) : A Modular Architecture for Legally Explainable Cryptographic Signatures Thierry Emmanuel MINKA MI NGUIDJOI, MANI ONANA Flavien Serge, DJOTIO NDIÉ Thomas, BOUETOU BOUETOU Thomas The fundamental incompatibility between confidentiality, reliability, and le gal opposability, formalized as the CRO trilemma, imposes an entropic bound Γ_CRO on cryptographic…
-
The February 2025 Security Update Review
We’ve survived Pwn2Own Automotive and made it to the second Patch Tuesday of 2025. As always, Microsoft and Adobe have released their latest security patches. Take a break from your scheduled activities and join us as we review the details of their latest security alerts. If you’d rather watch the full video recap covering the…
-
Enhancing Scale and Shift Invariance in Deep Learning-based Side-channel Attacks through Equivariant Convolutional Neural Networks
ePrint Report: Enhancing Scale and Shift Invariance in Deep Learning-based Side-channel Attacks through Equivariant Convolutional Neural Networks David Perez, Sengim Karayalcin, Stjepan Picek, Servio Paguada Deep learning-based side-channel analysis (DLSCA) has demonstrated remarkable performance over the past few years. Even with limited preprocessing and feature engineering, DLSCA is capable of breaking protected targets, sometimes requiring…
-
Looking Back at the Trend ZDI Activities from 2024
It’s a new year, but before we look forward to breaking all of our resolutions, let’s pause to take a look at the year that was for Trend Zero Day Initiative™ (ZDI). Pwn2Own Competitions Keep Exceeding Expectations Even though we just completed Pwn2Own Automotive 2025, we would be remiss if we didn’t mention the inaugural…
-
Tight Lower Bound on Witness Update Frequency in Additive Positive Accumulators
ePrint Report: Tight Lower Bound on Witness Update Frequency in Additive Positive Accumulators Wei Qi We study additive positive accumulators, which maintain a short digest of a growing set such that each value in the set can prove membership via a generated witness. Due to compactness of the digest, previously added values may require updated…
-
More Practical Non-interactive Encrypted Conjunctive Search with Leakage and Storage Suppression
ePrint Report: More Practical Non-interactive Encrypted Conjunctive Search with Leakage and Storage Suppression Huu Ngoc Duc Nguyen, Shujie Cui, Shangqi Lai, Tsz Hon Yuen, Joseph K. Liu Searchable symmetric encryption allows clients to outsource their databases to a semi-trusted cloud server while enabling private searches. The Oblivious Cross-Tag (OXT) protocol is a fundamental approach to…