RESEARCH
November 2025: broken enclaves, credentials in apps, the real cost of IOCs
November 2025 is dominated by the ACM CCS proceedings. Three attacks crack confidential computing, from AMD SEV-SNP to Intel SGX and Arm GPUs. Thousands of mobile apps ship working credentials, and indicators of compromise are often published after attackers have already moved on. The month also brings kernel bugs once deemed unexploitable and a windshield turned into a loudspeaker.
Archive: reconstruction written in November 2026
1. RMP ocalypse : How a Catch-22 Breaks AMD SEV-SNP
ACM Conference on Computer and Communications Security · Benedict Schlüter, Shweta Shinde · Hardware & Side Channels
In short: RMPocalypse abuses AMD SEV-SNP's start-up phase to break confidential virtual machines.
AMD SEV-SNP shields confidential VMs from an untrusted hypervisor through the Reverse Map Table, which must also protect itself. At start-up the table is initialised by the Platform Security Processor, yet the x86 cores can control part of its initial state. The authors enable debug on production VMs, fake attestation, replay VM state and inject code.
Why it matters. Many cloud services sell confidential computing as a guarantee against the provider itself: a hardware flaw puts that promise in question.
2. WireTap: Breaking Server SGX via DRAM Bus Interposition
ACM Conference on Computer and Communications Security · Alex Seto, Oytun Kuday Duran, Samy Amer, Jalen Chuang et al. · Hardware & Side Channels
In short: With cheap hardware on the memory bus, WireTap extracts the SGX attestation key from a trusted server.
Physical attacks on SGX are thought to need lab equipment. The authors build a DRAM bus interposer from parts bought online and exploit the weaker, deterministic memory encryption used on servers. They extract the attestation key from a machine in fully trusted status and show the impact on SGX-backed blockchain networks.
Why it matters. Where server operators have a financial incentive to cheat, hardware guarantees are not enough: low-cost physical attacks must be considered.
3. MOLE : Breaking GPU TEE with GPU-Embedded MCU
ACM Conference on Computer and Communications Security · Hongyi Lu, Yunjie Deng, J. Sukarno Mertoguno, Shuai Wang et al. · Hardware & Side Channels
In short: MOLE injects malicious firmware into the microcontroller of Arm Mali GPUs and bypasses GPU enclaves.
GPU trusted execution environments protect the data they process, such as machine-learning workloads, even from a compromised operating system. MOLE targets Arm Mali GPUs through their embedded microcontroller: by injecting malicious firmware it extracts sensitive data or alters the results of AES encryption and object detection. The finding led Arm to harden its GPU firmware supply chain.
Why it matters. Firmware in internal components is a blind spot for hardware and supply-chain security.
4. Leaky Apps: Large-scale Analysis of Secrets Distributed in Android and iOS Apps
ACM Conference on Computer and Communications Security · David A. Schmidt, Sebastian Schrittwieser, Edgar R. Weippl · Web & Mobile Security
In short: 10,331 Android and iOS apps hold 416 working credentials, including Git keys to thousands of private repositories.
Mobile apps embed API keys and cryptographic material that anyone can extract by reverse engineering. Across 10,331 Android and iOS apps the authors find 416 valid credentials for 65 services, including 13 Git credentials opening 218 public and 2,440 private repositories. iOS apps expose more secrets, and developers who remove a key in later versions often forget to revoke it.
Why it matters. A key left in an app is ready-made access for attackers: secret inventory and revocation are controls worth checking.
5. Can IOCs Impose Cost? The Effects of Publishing Threat Intelligence on Adversary Behavior
ACM Conference on Computer and Communications Security · Xander Bouwman, Aksel Ethembabaoglu, Bart Hermans, Carlos Gañán et al. · Malware & Threat Intelligence
In short: By the time indicators of compromise are published, attackers have almost always abandoned them.
Governments and firms publish indicators of compromise partly to 'impose cost' on attackers. The authors match IOCs from two leading commercial providers against a large dataset of real traffic metadata, 150 days before and after publication. Most of the listed resources were already abandoned, and for one provider publication lagged peak activity by 30 days.
Why it matters. Threat-intelligence feeds help reconstruct incidents more than stop ongoing ones: worth keeping in mind when weighing them as a control.
6. Analyzing PDFs like Binaries: Adversarially Robust PDF Malware Analysis via Intermediate Representation and Language Model
ACM Conference on Computer and Communications Security · Side Liu, Jiang Ming, Guodong Zhou, Xinyi Liu et al. · Malware & Threat Intelligence
In short: A new classifier analyses PDFs like programs and resists adversarial attacks with 0.07% false positives.
Malicious PDFs remain a common attack vector, and machine-learning classifiers are fooled by adversarial edits because they rest on dated, unstable features. The authors translate PDF objects into an assembly-like intermediate representation, extract semantics with a language model and structure with an object reference graph. The result is robust with a false-positive rate of 0.07%.
Why it matters. PDF attachments are a frequent way into companies: a more robust filter cuts initial infections.
7. Reviving Discarded Vulnerabilities: Exploiting Previously Unexploitable Linux Kernel Bugs Through Control Metadata Fields
ACM Conference on Computer and Communications Security · Hao Zhang, Jian Liu, Jie Lu, Shaomin Chen et al. · Systems & Software Security
In short: Through control metadata fields, 12 Linux kernel bugs dismissed as unusable become exploitable.
Kernel vulnerabilities offering only weak primitives are often filed as unexploitable. The authors make them useful by manipulating objects' control metadata fields instead of pointers: the method bypasses pointer authentication and needs no precise alignment. Their MetaXploit tool finds 54 exploitable fields on Ubuntu and Debian and succeeds with 18 of 20 real bugs.
Why it matters. Patch priorities based only on stated exploitability can understate risk: minor bugs still need fixing.
8. P rome F uzz : A Knowledge-Driven Approach to Fuzzing Harness Generation with Large Language Models
ACM Conference on Computer and Communications Security · Yuwei Liu, Junquan Deng, Xiangkun Jia, Yanhao Wang et al. · Systems & Software Security
In short: PromeFuzz pairs an LLM with a knowledge base to write fuzzing harnesses and finds 25 new vulnerabilities.
API-level fuzzing finds subtle bugs, but writing harnesses is hard and LLMs tend to hallucinate. PromeFuzz builds a knowledge base from code metadata, documentation and real call patterns, then uses it to generate and refine harnesses. On 22 open-source projects it reaches up to 3.88 times more branch coverage than existing tools and uncovers 25 unknown vulnerabilities.
Why it matters. Tools like this lower the cost of bug hunting, for defenders and attackers alike.
9. BACScan: Automatic Black-Box Detection of Broken-Access-Control Vulnerabilities in Web Applications
ACM Conference on Computer and Communications Security · Fengyu Liu, Yuan Zhang, Enhao Li, Wei Meng et al. · Identity & Authentication
In short: BACScan finds 89 access-control flaws in 20 real web applications, earning 35 new CVEs.
Broken access control has topped the OWASP Top 10 for years: it lets attackers read or change data without permission. Existing tools only compare responses and spot unauthorised reads. BACScan, a black-box approach, infers the pages tied to an operation and analyses its effect, so it also catches unauthorised changes. Across 20 applications it finds 89 flaws, 54 previously unreported.
Why it matters. Access-control flaws are behind many data breaches: better automated testing helps cut them before release.
10. Threat from Windshield: Vehicle Windows as Involuntary Attack Sources on Automotive Voice Assistants
ACM Conference on Computer and Communications Security · Penghao Wang, Shuo Huai, Yetong Cao, Chao Liu et al. · CPS & IoT Security
In short: A tiny piezo element on the windshield turns the glass into a speaker that commands the car's voice assistant.
Attacking a car's voice assistant with inaudible sound was thought to require being inside the vehicle. ShieldSpear attaches a tiny piezo element, easily hidden in a sticker, to the outside of the windshield, turning the glass into both speaker and microphone. It records the driver's voice and mimics it in fake commands: across five mainstream vehicles the attack succeeds 90.9% of the time.
Why it matters. Connected cars widen the physical attack surface: unauthorised voice commands can affect the driver's safety and data.
Trends of the month
Hardware & Side Channels
44 papers this month on this topic
Confidential computing ends the month with three cracks. RMPocalypse breaks AMD SEV-SNP's start-up, WireTap pulls Intel SGX's attestation key with cheap hardware, and MOLE goes through the microcontroller in Arm GPUs. The hardware guarantees behind confidential cloud and protected AI should be treated as mitigations, not certainties.
Papers cited:
- RMP ocalypse : How a Catch-22 Breaks AMD SEV-SNP
- WireTap: Breaking Server SGX via DRAM Bus Interposition
- MOLE : Breaking GPU TEE with GPU-Embedded MCU
Malware & Threat Intelligence
68 papers this month on this topic
Two papers measure how well widespread defences work. Indicators of compromise are often published late, after attackers have changed infrastructure, while a classifier that reads PDFs like programs better withstands adversarial edits. A control's value depends on how long it stays useful against an adapting adversary.
Papers cited:
- Can IOCs Impose Cost? The Effects of Publishing Threat Intelligence on Adversary Behavior
- Analyzing PDFs like Binaries: Adversarially Robust PDF Malware Analysis via Intermediate Representation and Language Model
Systems & Software Security
71 papers this month on this topic
In software, the gap between bug and exploit is shrinking. Linux kernel vulnerabilities dismissed as useless become exploitable again, an LLM with the right knowledge base writes fuzzing harnesses that find new flaws, and thousands of apps ship valid credentials that stay active even after being removed from the code.
Papers cited:
- Reviving Discarded Vulnerabilities: Exploiting Previously Unexploitable Linux Kernel Bugs Through Control Metadata Fields
- P rome F uzz : A Knowledge-Driven Approach to Fuzzing Harness Generation with Large Language Models
- Leaky Apps: Large-scale Analysis of Secrets Distributed in Android and iOS Apps
How this digest is made
This issue belongs to the digest archive, reconstructed after the fact. The month's papers were collected from arXiv, the IACR ePrint archive and the main security conferences and journals; the selection also weighs the citations received since publication. An AI model assessed the candidates and wrote the summaries, which are based on the abstracts: the original paper is the reference for details.
Papers of the month assessed: 1838.