Luigi Gubello Relatore

Lista Talk

• Propaganda grew, and so did Twitter The interference of the Russian government in the 2016 US elections has now been established, also by spreading disinformation through social networks, including Twitter. Five years later, disinformation spreading on social networks has not stopped, it has grown. Over the years, other actors - both pro-government and non-governmental - have begun to exploit similar techniques previously used by the Russian government, for one simple reason: they work. In this talk, we will see how the Russian government and the Chinese government have spread propaganda and disinformation on Twitter in recent years, and what lessons we can learn from the datasets shared by Twitter. - 12:15/13:00, 06 Nov 2021
• app.alert(1) is the new alert(1): PDFs as a vector to inject JavaScript code in web applications. PDFs - rise, decline, and revival: a journey across how we have changed our way of viewing and editing PDF files by moving from offline clients to online services, and how this is changing the role of PDF files as attack vectors. A talk on how we have moved from local clients (Adobe, etc) to browsers and online services to render, view, edit, and sign PDF files, and how this has changed the role of PDFs in attacks and exploitations. From the false-positive vulnerabilities (CVE-2020-26505, CVE-2023-0108, CVE-2023-5873, and other CVEs that were not vulnerabilities) to vulnerabilities in client-side PDF SDKs. During the talk, we will investigate some cross-site-scripting vulnerabilities exploited in the real world (e.g. bug bounty programs), focusing in particular on PDF.js (CVE-2018-5158, and CVE-2024-4367) and Apryse Webviewer (CVE-2024-4327, and CVE-2024-29359). - 12:15/13:00, 21 Nov 2026