it works...

Hi! I'm Pepe Vila and I'm interested in things. Below there is some stuff I've done.

publications

Theory and Practice of Finding Eviction Sets [EN] - oct'18 (arXiv.org, computer.org)
in Proceedings of the 40th IEEE Symposium on Security and Privacy 2019 (BibTeX)

Loophole: Timing Attacks on Shared Event Loops in Chrome [EN] - jun'17 (arXiv.org, usenix.org)
in Proceedings of the 26th USENIX Security Symposium, 2017 *** Distinguished Paper Award *** (BibTeX)

Practical Experiences on NFC Relay Attacks with Android: Virtual Pickpocketing Revisited [EN] - jun'15
in Proceedings of the 11th Workshop on RFID Security (RFIDsec), 2015 (BibTeX)

Ataques de relay NFC con dispositivos Android [ES] - sep'14
Proyecto de Fin de Carrera (Universidad de Zaragoza)

browser stuff

my xs-search library (see also xsleaks)

PoC: Leaking text nodes via CSS injection

Writeup: Stealing local files by abusing liberal CSS parsing in Chrome (CVE-2018-16075)

Loopscan: Monitor shared event loops with Javascript (github)

Covert channels in the SOP

GIFJS generator using optional charsets

Polychars: JS running as different charsets at the same time

test several charsets in <script> elements

xdomain brute force (1M words in ~2s)

unicode.toUpperCase()

<meta http-equiv=redirect>

location vs. domain

misc

Alert(1)ToWin [ES] - feb'14

Clientside attacks: the browser way. [ES] - jan'14

challenges

PDF RIIICK (source) - oct'17

XSSmas15 by cure53 (slides) - feb'16

JSON hijacking with UTF-16be (Writeup) - jul'15

talks

Theory and Practice of Finding Eviction Sets - IEEE SP 2019 - San Francisco, US [slides, video]

Cache and Syphilis - RootedCON 2019 - Madrid, Spain [slides]

CSS Injection Attacks: or how to leak content with <style> - S3 IMDEA Software Institute (2019) - Madrid, Spain [slides]

RFID Security Module - Lecture for UPM's Master in Software and Systems - Madrid, Spain [slides]

Loophole: Timing Attacks on Shared Event Loops in Chrome - CRYPTACUS 2017 - Nijmegen, Netherlands[slides]

Loophole: Timing Attacks on Shared Event Loops in Chrome - USENIX 2017 - Vancouver, Canada [slides, video]

A bug bounty tale: Chrome, stylesheets, cookies, and AES - S3 IMDEA Software Institute (2017) - Madrid, Spain [slides]

Loophole: Timing Attacks on Shared Event Loops in Chrome - RootedCON 2017 - Madrid, Spain [video es/en]

Loophole: Timing Attacks on Shared Event Loops in Chrome - S3 IMDEA Software Institute (2016) - Madrid, Spain [slides]

Relay Attacks in EMV Contactless Cards with Android OTS Devices - HITBSecConf 2015 - Amsterdam, Netherlands [slides]

On relaying NFC Payment transactions using Android devices - RootedCON 2015 - Madrid, Spain [slides, video es/en]

Ataques de relay en tarjetas EMV NFC con dispositivos Android - VIII Jornadas STIC CCN-CERT (2014) - Madrid, Spain [slides]

(slides mirror)