| Website | https://minimalblue.com |
| https://twitter.com/blueminimal | |
| Twitch | https://www.twitch.tv/blueminimal |
| GitHub | https://github.com/lavish |
The Austria Cyber Security Challenge #ACSC '26 has started! š¦š¹
ā¢ Qualifications are live 1 March - 1 May
ā¢ Juniors, Seniors & Open categories
ā¢ Challenges from Web to Pwn, Crypto, Rev & more
ā¢ Finale in Linz this September
Join us & spread the word š https://acsc.land/
#ACSC2026 #Cybersecurity #CTF #CyberSecurityAustria #TUWien #CySec #CyberTalent #Infosec
Few days left to submit your work to #MADWeb '26!
The CfP is open until Dec 11 (AOE). We welcome all Web-related submissions from full papers (10 pages) to work-in-progress papers (6 pages, no proceedings).
It's a great chance to present your work in the sunny San Diego, connect with an amazing community, or get early feedback to improve your research. Don't miss out and spread the word!
š https://madweb.work/
https://foxnews.com/tech/new-android-attack-tricks-you-giving-dangerous-permissions
> GrapheneOS, a security-focused operating system based on Android, confirmed that its current version is also affected. However, it plans to release a fix in its next update.
No, we said that on July 7 and then shipped https://grapheneos.org/releases#2025070700 fixing it.
The road to #ECSC2025 has officially kicked off! We just wrapped up our first qualifier event to select the 10 members of Team Austria who will compete in the European Cyber Security Challenge #ECSC in Warsaw later this year.
Over the weekend, 30 participants focused on attack/defense training with #ENOWARS CTF and tackled some great challenges from #DownUnderCTF. Nice to see so many young and motivated hackers in action.
Huge thanks to IKARUS Security Software for hosting us, to my co-coach Manuel Reinsperger, and to everyone who spent the weekend hacking, learning, and having fun together. Looking forward to the next round.
#CTF #tuwien #enisa #TeamAT #TeamAustria @enoflag @DownUnderCTF
Our new Android attack, #TapTrap, is getting media coverage. Here's a quick explainer.
It's a new tapjacking technique that exploits Android's UI animations to hijack user taps without requiring any permissions. @beerphilipp will present it at #USENIX Sec'25.
Unlike classic tapjacking, TapTrap uses Android's built-in activity transition animations to launch a transparent activity on top of the attacker's app. The user thinks they're tapping a harmless button, but the tap goes to a permission/system prompt, a browser, or a sensitive app without notice.
It works on Android 15 & 16, while @GrapheneOS has recently issued a fix. Major browsers such as Chrome and Firefox promptly patched after we disclosed the vulnerability. We also analyzed ~100K Play Store apps finding that TapTrap is currently not being exploited in the wild.
This effort is the result of a collaboration with @beerphilipp, Sebastian Roth and @lindorferin. Kudos to Philipp for discovering the issue and doing the heavy lifting. And thanks Vienna Science and Technology Fund (WWTF) for making this research possible and supporting us ā„ļø
See you at #USENIX in Seattle next month!
@beerphilipp @minimalblue @elgregor @lindorferin We only became aware of the issue a few days ago and needed to finish our high priority port to Android 16 first. It's now dealt with in the straightforward way of disabling the transition animations unless they're between the app's own activities. You can see the change listed here:
https://grapheneos.org/releases#2025070700
We would have fixed it earlier if we were aware since from our perspective it's quite serious and far worse than most similar problems.
After our Android 16 port was completed yesterday, we started fixing an Android tapjacking vulnerability disclosed last month:
We have a fix implemented and it will be included in our next release, likely with the monthly Android 16 update tomorrow.
After many years of battles with @mhackeroni, I'm blown away to announce that we've qualified for the #DEFCON CTF finals with KuK Hofhackerei š¦š¹ this year!
New friends, same love. Couldn't be prouder of this team.
Thanks to @nautilusinstitute for organizing and see you in Vegas! š©
Results at game end:
1. Maple Mallard Magistrates 4,427
2. SuperDiceCode 4,000
3. mhackeroni 3,964
4. Nu1L 3,800
5. Shellphish 3,494
6. KuK Hofhackerei 3,391
7. this year's organizers 3,140
8. Cold Fusion 3,085
9. HypeBoy 2,868
10. [:] 2,688
11. Blue Water 2,468
12. Zer0RocketWrecks 2,333
13. fewer 2,324
14. RePokemonedCollections 2,141
15. Never Stop Exploiting 1,910
GrapheneOS
Nautilus Institute