We present a novel class of content subversion attacks against information-based services, causing documents to appear to humans dissimilar to the underlying content extracted by information-based services. We demonstrate the significant impact of these attacks on real-world systems through five distinct variants. Our first attack allows academic paper writers and reviewers to collude via subverting the automatic reviewer assignment systems in current use by academic conferences including INFOCOM, which we reproduced. Our second attack renders ineffective plagiarism detection software, particularly Turnitin, targeting specific small plagiarism similarity scores to appear natural and evade detection. In our third attack, we place masked content into the indexes for Google, Bing, Yahoo!, and DuckDuckGo, which renders information entirely different from the keywords used to locate it, enabling spam, profane, or possibly illegal content to go unnoticed by these search engines but still returned in unrelated search results. Furthermore, we provide compelling demonstrations of the content subversion attack's efficacy on widely employed QR codes and one-dimensional barcodes. Finally, considering the prevalent avoidance of optical character recognition (OCR) due to computational overhead, we propose a comprehensive and lightweight alternative mitigation method.

Programmable Logic Controllers (PLCs) serve as the operational backbone of Industrial Control Systems (ICS), orchestrating critical physical processes across various industrial environments. Given their central role, the security posture of PLCs has a direct impact on the safety and reliability of industrial operations. However, the closed and proprietary nature of commercial PLCs continues to hinder security research, particularly in developing accurate and flexible emulation environments necessary for systematic vulnerability analysis. In this work, we present a specialized emulation framework tailored to Siemens S7 series PLCs, aiming to replicate low-level execution behaviors with high fidelity. Our design emphasizes faithful reproduction of peripheral I/O operations and interruptdriven control flows, which are often overlooked in generic embedded system emulation. To bridge the gap between proprietary constraints and practical analysis needs, we implement a suite of mechanisms that extract and reinterpret vendor-specific runtime behavior without relying on access to internal documentation or source code. To evaluate the robustness of our emulation, we conduct extensive analysis across 211 firmware versions, covering a wide range of device configurations and firmware updates. By integrating this emulation framework with a two-stage fuzzing methodology—combining hardware-assisted fuzzing and whitebox fuzzing in a controlled virtual environment—we identify multiple previously undocumented security weaknesses, underscoring the utility of our platform in facilitating vulnerability discovery at scale. While we refrain from disclosing exploit specifics, our findings reveal systemic patterns of insecurity that merit further attention from both researchers and vendors.

The prevalence and monetary value of mobile devices, coupled with their compact and, indeed, mobile nature, lead to frequent theft due to a lack of proper anti-theft mechanisms. Currently, there only exist damage control efforts such as remote wiping the device's memory or GPS tracking, but nothing to notify users of theft while it takes place. We propose such a mechanism which utilizes the unique walking patterns inherent to humans and differentiate our work from other walking behavior studies by using it as first-order authentication and developing matching methods fast enough to act as an actual anti-theft system. We test our system with the aid of 45 volunteers and demonstrate detection of unauthorized movement within 10 to 20 steps with an accuracy of 96.4 to 98.4 percent, while simultaneously distinguishing owners as themselves with 97.8 percent accuracy.