Pepe Vila

Hi! I'm Pepe Vila and I'm interested in things. Below there is some of the stuff I've done.

research

Flushgeist: Cache Leaks from Beyond the Flush [EN] - may'20 (arXiv.org)
Pepe Vila, Andreas Abel, Marco Guarnieri, Boris Köpf, and Jan Reineke
technical report

CacheQuery: Learning Replacement Policies from Hardware Caches [EN] - dec'19 (arXiv.org)
Pepe Vila, Pierre Ganty, Marco Guarnieri, and Boris Köpf
to appear in Proceedings of the 41st ACM SIGPLAN Conference on Programming Language Design and Implementation, 2020 (BibTeX)

Theory and Practice of Finding Eviction Sets [EN] - oct'18 (arXiv.org, computer.org)
Pepe Vila, Boris Köpf, and José F. Morales
in Proceedings of the 40th IEEE Symposium on Security and Privacy, 2019 (BibTeX)

Loophole: Timing Attacks on Shared Event Loops in Chrome [EN] - jun'17 (arXiv.org, usenix.org)
Pepe Vila and Boris Köpf
in Proceedings of the 26th USENIX Security Symposium, 2017 *** Distinguished Paper Award *** (BibTeX)

Practical Experiences on NFC Relay Attacks with Android: Virtual Pickpocketing Revisited [EN] - jun'15
Pepe Vila and Ricardo J. Rodríguez
in Proceedings of the 11th Workshop on RFID Security (RFIDsec), 2015 (BibTeX)

Ataques de relay NFC con dispositivos Android [ES] - sep'14
Proyecto de Fin de Carrera (Universidad de Zaragoza)

tools

CacheQuery - hardware abstract interface for specific cache sets

Polca - learn automata models for cache replacement policies

Evsets - find minimal eviction sets using group testing (includes JavaScript/Wasm poc)

my xs-search library (see also xsleaks)

Loopscan (github) - monitor shared event loops with JavaScript

browser stuff

Cloudflare's pages injection tricks

PoC: Leaking text nodes via CSS injection

Writeup: Stealing local files by abusing liberal CSS parsing in Chrome (CVE-2018-16075)

Covert channels in the SOP

GIFJS generator using optional charsets

Polychars: JS running as different charsets at the same time

test several charsets in <script> elements

xdomain brute force (1M words in ~2s)

unicode.toUpperCase()

location vs. domain

nothing to see here

misc

Alert(1)ToWin [ES] - feb'14

Clientside attacks: the browser way. [ES] - jan'14

challenges

list of my tasks for Navaja Negra's CTFs - 6th, 7th, 8th, and 9th editions

XSSmas15 by cure53 (slides) - feb'16

JSON hijacking with UTF-16be (Writeup) - jul'15

talks

The '80s never died: automata theory for reversing modern CPUs - RootedCON 2020 - Madrid, Spain [slides]

CacheQuery: Learning Replacement Policies from Hardware Caches - S3 IMDEA Software Institute (2020) - Madrid, Spain

Theory and Practice of Finding Eviction Sets - IEEE SP 2019 - San Francisco, US [slides, video, video abstract]

Cache and Syphilis - RootedCON 2019 - Madrid, Spain [slides, video es/en]

CSS Injection Attacks: or how to leak content with <style> - S3 IMDEA Software Institute (2019) - Madrid, Spain [slides]

RFID Security Module - Lecture for UPM's Master in Software and Systems - Madrid, Spain [slides]

Loophole: Timing Attacks on Shared Event Loops in Chrome - CRYPTACUS 2017 - Nijmegen, Netherlands[slides]

Loophole: Timing Attacks on Shared Event Loops in Chrome - USENIX 2017 - Vancouver, Canada [slides, video]

A bug bounty tale: Chrome, stylesheets, cookies, and AES - S3 IMDEA Software Institute (2017) - Madrid, Spain [slides]

Loophole: Timing Attacks on Shared Event Loops in Chrome - RootedCON 2017 - Madrid, Spain [video es/en]

A XSSmas carol - FAQin congress 2016 - Madrid, Spain [slides]

Loophole: Timing Attacks on Shared Event Loops in Chrome - S3 IMDEA Software Institute (2016) - Madrid, Spain [slides]

Relay Attacks in EMV Contactless Cards with Android OTS Devices - HITBSecConf 2015 - Amsterdam, Netherlands [slides]

On relaying NFC Payment transactions using Android devices - RootedCON 2015 - Madrid, Spain [slides, video es/en]

Ataques de relay en tarjetas EMV NFC con dispositivos Android - VIII Jornadas STIC CCN-CERT (2014) - Madrid, Spain [slides]

(slides mirror)