Chatzoglou Eftsratios

Abstract:
Race conditions have long been regarded as stochastic, unreliable vulnerabilities. To date, the principle of exploitation has been Single-Packet Attacks (SPA) over HTTP/2 and HTTP/3. However, SPA relies entirely on aligning network delivery, making it inherently fragile and frequently neutralized by standard proxy buffering. This research obsoletes this field, proving that attackers no longer need to race the network; they can now deterministically orchestrate the server itself. In this Briefing, we will introduce two novel attack classes -- Temporal Hijacking and Server-Side Race Orchestration (SSRO) -- comprising in total nine attack variants that shift timing control to the protocol's internal state. By manipulating HTTP/3 QPACK Head-of-Line blocking, dynamic table saturation, and RFC 9218 priorities, we build an internal "crowded waiting room" within the proxy's memory. Unlike SPA, our SSRO techniques exploit the very buffers meant to protect the backend, maintaining high precision regardless of network jitter. We demonstrate how Temporal Hijacking reliably forces out-of-order execution to invert backend state transitions, while SSRO achieves 96.4% execution precision and triggers 20x transaction limit violations across major edge architectures. We also release TimeOrch, a novel open-source tool to automate these attacks. Backed by an analysis of 10,000 top-ranked domains revealing an 87% vulnerability rate, this research exposes a critical architectural void. With major vendors dismissing these findings as "working as intended", this talk equips attendees with the only remaining lifelines: recompiling binaries with security-hardened settings and adopting the pessimistic locking strategies required to survive these unpatchable, microsecond-level bursts.

Abstract:
Realistic, large-scale, and well-labeled cybersecurity datasets are essential for training and evaluating Intrusion Detection Systems (IDS). However, they remain difficult to obtain due to privacy constraints, data sensitivity, and the cost of building controlled collection environments such as testbeds and cyber ranges. This paper investigates whether Large Language Models (LLMs) can operate as controlled knowledge-to-data engines for generating structured synthetic network traffic datasets suitable for IDS research. We propose a methodology that combines protocol documentation, attack semantics, and explicit statistical rules to condition LLMs without fine-tuning or access to raw samples. Using the AWID3 IEEE~802.11 benchmark as a demanding case study, we generate labeled datasets with four state-of-the-art LLMs and assess fidelity through a multi-level validation framework including global similarity metrics, per-feature distribution testing, structural comparison, and cross-domain classification. Results show that, under explicit constraints, LLM-generated datasets can closely approximate the statistical and structural characteristics of real network traffic, enabling gradient-boosting classifiers to achieve F1-scores up to 0.956 when evaluated on real samples. Overall, the findings suggest that constrained LLM-driven generation can facilitate on-demand IDS experimentation, providing a testbed-free, privacy-preserving alternative that overcomes the traditional bottlenecks of physical traffic collection and manual labeling.

Abstract:
Password management has long been a persistently challenging task. This led to the introduction of password management software, which has been around for at least 25 years in various forms, including desktop and browser-based applications. This work assesses the ability of two dozen password managers, 12 desktop applications and 12 browser plugins, to effectively protect the confidentiality of secret credentials in six representative scenarios. Our analysis focuses on the period during which a Password Manager (PM) resides in the RAM. Despite the sensitive nature of these applications, our results show that across all scenarios, only three desktop PM applications and two browser plugins do not store plaintext passwords in the system memory. Oddly enough, only one vendor recognized the exploit as a vulnerability, assigning it the at the time of writing reserved CVE-2023-23349, while the rest chose to disregard or underrate the issue.

Abstract:
Being on a mushrooming spree since at least 2013, malware can take a large toll on any system. In a perpetual cat-and-mouse chase with defenders, malware writers constantly conjure new methods to hide their code so as to evade detection by security products. In this context, focusing on the MS Windows platform, this work contributes a comprehensive empirical evaluation regarding the detection capacity of popular, off-the-shelf antivirus and endpoint detection and response engines when facing legacy malware obfuscated via more or less uncommon but publicly known methods. Our experiments exploit a blend of seven traditional AV evasion techniques in 16 executables built in C++, Go, and Rust. Furthermore, we conduct an incipient study regarding the ability of the ChatGPT chatbot in assisting threat actors to produce ready-to-use malware. The derived results in terms of detection rate are highly unexpected: approximately half of the 12 tested AV engines were able to detect less than half of the malware variants, four AVs exactly half of the variants, while only two of the rest detected all but one of the variants.

Abstract:
Despite Wi-Fi is at the eve of its seventh generation, security concerns regarding this omnipresent technology remain in the spotlight of the research community. This work introduces two new denial of service attacks against contemporary Wi-Fi 5 and 6 networks. Differently to similar works in the literature which focus on 802.11 management frames, the introduced assaults exploit control frames. Both the attacks target the central element of any infrastructure-based 802.11 network, i.e., the access point (AP), and result in depriving the associated stations from any service. We demonstrate that, at the very least, the attacks affect a great mass of off-the-self AP implementations by different renowned vendors, and it can be mounted with inexpensive equipment, little effort, and a low level of expertise. With reference to the latest standard, namely, 802.11-2020, we elaborate on the root cause of the respected vulnerabilities, pinpointing shortcomings. Following a coordinated vulnerability disclosure process, our findings have been promptly communicated to each affected AP vendor, already receiving positive feedback as well as a – currently reserved – common vulnerabilities and exposures (CVE) ID, namely CVE-2022-32666.