publications

2024

1. A*

   Formal Security Analysis of Widevine through the W3C EME Standard

   Stéphanie Delaune, Joseph Lallemand, Gwendal Patat, Florian Roudot, and Mohamed Sabt

   In 33rd USENIX Security Symposium (USENIX Security 24), Aug 2024

   Bib PDF Slides

   @inproceedings{299820,
     author = {Delaune, St{\'e}phanie and Lallemand, Joseph and Patat, Gwendal and Roudot, Florian and Sabt, Mohamed},
     title = {Formal Security Analysis of Widevine through the {W3C} {EME} Standard},
     booktitle = {33rd USENIX Security Symposium (USENIX Security 24)},
     year = {2024},
     isbn = {978-1-939133-44-1},
     address = {Philadelphia, PA},
     pages = {6399--6415},
     url = {https://www.usenix.org/conference/usenixsecurity24/presentation/delaune},
     publisher = {USENIX Association},
     month = aug,
   }

2023

1. A

   Your DRM Can Watch You Too: Exploring the Privacy Implications of Browsers (mis)Implementations of Widevine EME

   Gwendal Patat, Mohamed Sabt, and Pierre-Alain Fouque

   In 23rd Proceedings on Privacy Enhancing Technologies, PETS 2023, Lausanne, Switzerland, July 10-15, Aug 2023

   Mozilla Hall of Fame Bib PDF Slides

   We entered the Mozilla Security Bug Bounty Program Hall of Fame.

   @inproceedings{conf/pets/PatatSF23,
     author = {Patat, Gwendal and Sabt, Mohamed and Fouque, Pierre{-}Alain},
     title = {Your DRM Can Watch You Too: Exploring the Privacy Implications of Browsers (mis)Implementations of Widevine EME},
     doi = {10.56553/popets-2023-0112},
     url = {https://doi.org/10.56553%2Fpopets-2023-0112},
     year = {2023},
     booktitle = {23rd Proceedings on Privacy Enhancing Technologies, {PETS} 2023, Lausanne, Switzerland, July 10-15},
     volume = {2023},
     number = {4},
     pages = {306--321},
   }

2022

1. A

   WideLeak: How Over-the-Top Platforms Fail in Android

   Gwendal Patat, Mohamed Sabt, and Pierre-Alain Fouque

   In 52nd Annual IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2022, Baltimore, MD, USA, June 27-30, Aug 2022

   Netflix Hall of Fame Bib PDF Slides

   We entered the Netflix, Inc., BugHunter Hall of Fame.

   @inproceedings{DBLP:conf/dsn/PatatSF22,
     author = {Patat, Gwendal and Sabt, Mohamed and Fouque, Pierre{-}Alain},
     title = {WideLeak: How Over-the-Top Platforms Fail in Android},
     booktitle = {52nd Annual {IEEE/IFIP} International Conference on Dependable Systems
                    and Networks, {DSN} 2022, Baltimore, MD, USA, June 27-30},
     pages = {501--508},
     publisher = {{IEEE}},
     year = {2022},
     url = {https://doi.org/10.1109/DSN53405.2022.00056},
     doi = {10.1109/DSN53405.2022.00056},
     timestamp = {Fri, 29 Jul 2022 16:33:36 +0200},
     biburl = {https://dblp.org/rec/conf/dsn/PatatSF22.bib},
     bibsource = {dblp computer science bibliography, https://dblp.org},
   }

2. Workshop

   Exploring Widevine for Fun and Profit

   Gwendal Patat, Mohamed Sabt, and Pierre-Alain Fouque

   In 43rd IEEE Security and Privacy, SP Workshops 2022, San Francisco, CA, USA, May 22-26, Aug 2022

   CVE & Google Hall of Fame Bib PDF Slides

   We received CVE-2021-0639 and entered the Google Vulnerability Reward Program (VRP) Hall of Fame.

   @inproceedings{DBLP:conf/sp/PatatSF22,
     author = {Patat, Gwendal and Sabt, Mohamed and Fouque, Pierre{-}Alain},
     title = {Exploring Widevine for Fun and Profit},
     booktitle = {43rd {IEEE} Security and Privacy, {SP} Workshops 2022, San Francisco,
                    CA, USA, May 22-26},
     pages = {277--288},
     publisher = {{IEEE}},
     year = {2022},
     url = {https://doi.org/10.1109/SPW54247.2022.9833867},
     doi = {10.1109/SPW54247.2022.9833867},
     timestamp = {Fri, 29 Jul 2022 10:34:36 +0200},
     biburl = {https://dblp.org/rec/conf/sp/PatatSF22.bib},
     bibsource = {dblp computer science bibliography, https://dblp.org},
   }

2020

1. National

   Please Remember Me: Security Analysis of U2F Remember Me Implementations in The Wild

   Gwendal Patat, and Mohamed Sabt

   In Actes SSTIC 2020, 18ème Symposium sur la sécurité des technologies de l’information et des communications (SSTIC 2020), Aug 2020

   Bib PDF

   @inproceedings{patat:hal-02865105,
     title = {{Please Remember Me: Security Analysis of U2F Remember Me Implementations in The Wild}},
     author = {Patat, Gwendal and Sabt, Mohamed},
     url = {https://hal.inria.fr/hal-02865105},
     booktitle = {{Actes SSTIC 2020, 18{\`e}me Symposium sur la s{\'e}curit{\'e} des technologies de l'information et des communications (SSTIC 2020)}},
     address = {Rennes, France},
     year = {2020},
     hal_id = {hal-02865105},
     hal_version = {v1},
   }