Search: “USENIX”

9 stories in the last 30d

Seminal 1999 USENIX study finds most novice users cannot correctly sign and encrypt email with PGP 5.0 in 90 minutes.

Whitten and Tygar's USENIX Security Symposium paper evaluates whether cryptography novices can use PGP 5.0 effectively, using cognitive walkthrough analysis and a laboratory user test. The majority of test participants failed to successfully sign and encrypt a message within 90 minutes, despite PGP 5.0 having a well-regarded graphical interface. The authors argue that security requires usability standards beyond those of general consumer software and propose domain-specific UI design principles for security. The paper is a foundational reference in usable security research.

Lobsters · securitySep 9, 06:47 UTC · 9d agoResearch

Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments

UMass Amherst researchers demonstrate Zombie Card, an NFC relay attack that revives expired Visa contactless cards for in-store purchases without breaking cryptography.

Researchers at the University of Massachusetts Amherst presented the Zombie Card attack at USENIX Security 2026, showing that Visa's Kernel 3 does not cryptographically bind the Application Expiration Date (tag 5F24) the terminal reads with the Track 2 expiry seen by the issuer. By positioning an NFC man-in-the-middle relay, an attacker can rewrite the terminal-facing expiration date of an expired card and complete contactless purchases, provided the account remains open under the same PAN and the bank does not independently re-check expiry. Testing across five major US banks found three distinct policies; Visa Kernel 3 accepted the modified date, while Mastercard, American Express, and Discover kernels declined modified transactions. Findings were disclosed to Visa and affected banks in May 2025, no CVE has been assigned, and no exploitation has been reported.

The Hacker NewsAug 20, 18:30 UTC · 28d agoResearch

Researchers find a loophole that lets expired credit cards make unauthorized payments

UMass Amherst researchers showed at USENIX Security 2026 that NFC relay attacks can rewrite unprotected expiration dates, letting expired Visa contactless cards keep making payments.

UMass Amherst researchers presented the Zombie Card attack at USENIX Security 2026, using two smartphones to relay and modify NFC payment data from expired Visa cards. The expiration date lies outside the card's digital signature coverage in Visa Kernel 3, and one major US bank accepted $1-$500 test purchases plus live $2.79 and $3.19 purchases with rewritten dates. Mastercard, American Express, and Discover rejected tampered dates; researchers notified Visa in May 2025 and no CVE or confirmed fix existed at publication.

Help Net SecurityAug 20, 00:00 UTC · 29d agoResearch

Researchers find way to listen in on headphones from afar

Researchers unveiled InjectEave, an electromagnetic injection side-channel attack that recovers audio from headphones and landline phones up to 30 meters away through walls.

Researchers from HKUST and The Hong Kong Polytechnic University presented InjectEave at USENIX Security 2026, an active EM side-channel attack that injects 0-9 MHz RF signals into nonlinear components such as amplifiers, ADCs, and power converters to modulate and leak target audio. Tested on 11 off-the-shelf devices including Sony, HP, Philips, Apple, and Xiaomi products, the attack recovered intelligible headphone audio from up to 30 meters with an RF amplifier, generally 1-6 meters otherwise, including through walls. The attack uses commodity gear such as a USRP B210 SDR and a Siglent spectrum analyzer, is immune to digital defenses like encryption, and is only partially mitigated by shielding, twisted-pair wiring, and filtering.

The Register · SecuritySep 17, 19:36 UTC · 18h agoResearch

Are Unreachable Nodes Truly Safe? Fully Eclipsing Monero's P2P Network!

Researchers present Nyx and Moros, the first eclipse attacks against Monero nodes behind NATs, requiring no inbound access and demonstrated on mainnet.

The paper presents the first eclipse attacks tailored to unreachable Monero nodes operating behind NATs, requiring no inbound access to the victim. The attacks poison the peerlists of reachable nodes, which relay contamination to unreachable nodes' whitelists, then exploit Monero's outbound connection refresh logic to evict benign neighbors and monopolize all outbound connections. Nyx achieves a complete, persistent eclipse of long-running unreachable nodes in large-scale SEED Emulator simulations, while Moros stealthily eclipses newly joined nodes during bootstrapping and was demonstrated on the Monero mainnet. Countermeasures are proposed.

arXiv cs.CRSep 9, 14:43 UTC · 8d agoResearch

China's AI-Enabled APT Operations Are Getting Interesting

Bitdefender links seven RAT families, five previously undocumented, to China-nexus espionage actor SilkParasite using AI-assisted malware development against Central Asian governments.

A Bitdefender report attributes seven remote access tool families to a single actor dubbed SilkParasite, with medium confidence a China-nexus group targeting governments in Uzbekistan, Turkmenistan and Kazakhstan. The RATs are written in .NET, C++, Go and JavaScript, use C2 via Google Drive and protocols like HTTP, DNS and TCP, and employ modular plugin architectures with regular rotation of infrastructure, encryption material and persistence artifacts. Evidence of AI-assisted development includes leftover test functions, placeholder encryption keys, and GoginRAT and NomadRAT sharing a high-level architecture despite different languages, suggesting a specification implemented twice with AI. The newsletter also covers the US Operation Economic Outcast sanctioning six MOIS-linked Iranian hackers, including hands-on-keyboard operators who targeted US critical infrastructure.

Risky Business NewsAug 27, 05:05 UTC · 22d agoThreat actor1

Week in review: Records allegedly stolen from Azure tenants, Medusa ransomware hits 500+ orgs

Week in review: Medusa ransomware hit 500+ orgs per CISA, millions of Azure tenant records allegedly stolen, SafePal and French tax authority breaches disclosed.

Help Net Security's weekly roundup covers the FBI, CISA, and HHS joint advisory update reporting Medusa ransomware has breached more than 500 organizations since June 2021, and threat actor TheHatman's claim of millions of employee records stolen from Azure tenants of Fortune 500 firms including McDonald's, Vodafone, Kyndryl, and Tata Consultancy Services, per Hudson Rock. It also covers the SafePal breach affecting 39,798 customers, France's DGFiP breach exposing data on 678,000 individuals, and UT San delaying its fall semester after a cyberattack. Security items include critical unauthenticated GitLab flaw CVE-2026-19478, an actively exploited patched macOS Screen Sharing flaw deploying a cryptominer, US charges against 17 Mabna Institute Iranian hackers over 31TB of stolen academic data, and Google Mandiant's AI agents finding 100+ high-severity vulnerabilities.

Help Net SecurityAug 23, 00:00 UTC · 26d agoData breach in the wildCVE-2026-19478

Your Shredded Visa Card May Still Work at the Checkout

UMass Amherst researchers demonstrated expired Visa contactless cards can complete real purchases via relay attacks exploiting Visa Kernel 3's unsigned expiry date handling.

University of Massachusetts Amherst researchers presented at USENIX Security 2026 that expired Visa contactless cards can be revived for real purchases through an NFC man-in-the-middle attack on Visa's Kernel 3. The attack alters the expiry date the terminal sees (tag 5F24) while leaving the Track 2 Equivalent Data (tag 57) sent to the issuing bank unchanged, and the card's cryptographic signature does not cover the expiry date. Two Android phones emulating card and terminal relayed transactions within Visa's 500-millisecond limit. Mastercard, American Express, and Discover kernels blocked the attack, while Visa Kernel 3 did not; researchers also modified the Consumer Device Cardholder Verification Method flag at five US banks, and attackers can also exploit Terminal Verification Results zero-filling. Visa was notified in May 2025 and December 2025; no CVE has been assigned.

Security AffairsAug 21, 18:04 UTC · 27d agoResearch

Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall

Academics linked Chinese vendor Geedge Networks' Tiangou Secure Gateway source code to one of the Great Firewall's three traffic filtering capabilities.

US researchers presenting at USENIX Security reconstructed Geedge Networks' Tiangou Secure Gateway firmware from over 100,000 leaked files, including Git repositories with commit history, and matched its filtering behavior to sections of China's Great Firewall. They found only 1 of 3 characterized DNS injectors matched Geedge code, noted the system relies on memory-unsafe C components and copied third-party code, and said its bugs could aid future circumvention tools. Geedge also exports censorship tools to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The newsletter additionally rounds up multiple breaches.

Risky Business NewsAug 21, 02:55 UTC · 28d agoResearch2