Practical verification of WPA-TKIP vulnerabilities. - Mathy Vanhoef; Frank Piessens (AsiaCCS, 2013)

Information Flow Control for Web Scripts. - Willem De Groef; Dominique Devriese; Mathy Vanhoef; Frank Piessens (FOSAD, 2013)

Advanced Wi-Fi attacks using commodity hardware. - Mathy Vanhoef; Frank Piessens (ACSAC, 2014)

Stateful Declassification Policies for Event-Driven Programs. - Mathy Vanhoef; Willem De Groef; Dominique Devriese; Frank Piessens; Tamara Rezk (CSF, 2014)

All Your Biases Belong to Us: Breaking RC4 in WPA-TKIP and TLS. - Mathy Vanhoef; Frank Piessens (USENIX Security Symposium, 2015)

Why MAC Address Randomization is not Enough: An Analysis of Wi-Fi Network Discovery Mechanisms. - Mathy Vanhoef; Célestin Matte; Mathieu Cunche; Leonardo S. Cardoso; Frank Piessens (AsiaCCS, 2016)

Request and Conquer: Exposing Cross-Origin Resource Size. - Tom van Goethem; Mathy Vanhoef; Frank Piessens; Wouter Joosen (USENIX Security Symposium, 2016)

Predicting, Decrypting, and Abusing WPA2/802.11 Group Keys. - Mathy Vanhoef; Frank Piessens (USENIX Security Symposium, 2016)

Defeating MAC Address Randomization Through Timing Attacks. - Célestin Matte; Mathieu Cunche; Franck Rousseau; Mathy Vanhoef (WISEC, 2016)

Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2. - Mathy Vanhoef; Frank Piessens (CCS, 2017)

Discovering Logical Vulnerabilities in the Wi-Fi Handshake Using Model-Based Testing. - Mathy Vanhoef; Domien Schepers; Frank Piessens (AsiaCCS, 2017)

Release the Kraken: New KRACKs in the 802.11 Standard. - Mathy Vanhoef; Frank Piessens (CCS, 2018)

Operating Channel Validation: Preventing Multi-Channel Man-in-the-Middle Attacks Against Protected Wi-Fi Networks. - Mathy Vanhoef; Nehru Bhandaru; Thomas Derham; Ido Ouzieli; Frank Piessens (WISEC, 2018)

Symbolic Execution of Security Protocol Implementations: Handling Cryptographic Primitives. - Mathy Vanhoef; Frank Piessens (WOOT @ USENIX Security Symposium, 2018)

Practical Side-Channel Attacks against WPA-TKIP. - Domien Schepers; Aanjhan Ranganathan; Mathy Vanhoef (AsiaCCS, 2019)

Improving Privacy Through Fast Passive Wi-Fi Scanning. - Frederik Goovaerts; Gunes Acar; Rafael Galvez; Frank Piessens; Mathy Vanhoef (NordSec, 2019)

Dragonblood: A Security Analysis of WPA3's SAE Handshake. - Mathy Vanhoef; Eyal Ronen (IACR Cryptol. ePrint Arch., 2019)

Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd. - Mathy Vanhoef; Eyal Ronen (SP, 2020)

Timeless Timing Attacks: Exploiting Concurrency to Leak Secrets over Remote Connections. - Tom van Goethem; Christina Pöpper; Wouter Joosen; Mathy Vanhoef (USENIX Security Symposium, 2020)

Protecting wi-fi beacons from outsider forgeries. - Mathy Vanhoef; Prasant Adhikari; Christina Pöpper (WISEC, 2020)

Let numbers tell the tale: measuring security trends in wi-fi networks and best practices. - Domien Schepers; Aanjhan Ranganathan; Mathy Vanhoef (WISEC, 2021)

A framework to test and fuzz wi-fi devices. - Domien Schepers; Mathy Vanhoef; Aanjhan Ranganathan (WISEC, 2021)

Fragment and Forge: Breaking Wi-Fi Through Frame Aggregation and Fragmentation. - Mathy Vanhoef (IACR Cryptol. ePrint Arch., 2021)

A Time-Memory Trade-Off Attack on WPA3's SAE-PK. - Mathy Vanhoef (APKC@AsiaCCS, 2022)

The Closer You Look, The More You Learn: A Grey-box Approach to Protocol State Machine Learning. - Chris McMahon Stone; Sam L. Thomas; Mathy Vanhoef; James Henderson; Nicolas Bailluet; Tom Chothia (CCS, 2022)

On the Robustness of Wi-Fi Deauthentication Countermeasures. - Domien Schepers; Aanjhan Ranganathan; Mathy Vanhoef (WISEC, 2022)

Time Will Tell: Exploiting Timing Leaks Using HTTP Response Headers. - Vik Vanderlinden; Tom van Goethem; Mathy Vanhoef (ESORICS (2), 2023)

Framing Frames: Bypassing Wi-Fi Encryption by Manipulating Transmit Queues. - Domien Schepers; Aanjhan Ranganathan; Mathy Vanhoef (USENIX Security Symposium, 2023)

Bypassing Tunnels: Leaking VPN Client Traffic by Abusing Routing Tables. - Nian Xue; Yashaswi Malla; Zihang Xia; Christina Pöpper; Mathy Vanhoef (USENIX Security Symposium, 2023)

Testing and Improving the Correctness of Wi-Fi Frame Injection. - Mathy Vanhoef; Xianjun Jiao; Wei Liu 019; Ingrid Moerman (WISEC, 2023)

A Security Analysis of WPA3-PK: Implementation and Precomputation Attacks. - Mathy Vanhoef; Jeroen Robben (ACNS (2), 2024)

Netfuzzlib: Adding First-Class Fuzzing Support to Network Protocol Implementations. - Jeroen Robben; Mathy Vanhoef (ESORICS (2), 2024)

SSID Confusion: Making Wi-Fi Clients Connect to the Wrong Network. - Héloïse Gollier; Mathy Vanhoef (WISEC, 2024)

Saecred: A State-Aware, Over-the-Air Protocol Testing Approach for Discovering Parsing Bugs in SAE Handshake Implementations of COTS Wi-Fi Access Points. - Muhammad Daniyal Pirwani Dar; Robert Lorch; Aliakbar Sadeghi; Vincenzo Sorcigli; Héloïse Gollier; Cesare Tinelli; Mathy Vanhoef; Omar Chowdhury (SP, 2025)

Fragile Frames: Wi-Fi's Fraught Fight Against FragAttacks. - Siebe Devroe; Héloïse Gollier; Mathy Vanhoef (WISEC, 2025)

LANShield: Analysing and Protecting Local Network Access on Mobile Devices. - Angelos Beitis; Jeroen Robben; Alexander Matern; Zhen Lei; Yijia Li; Nian Xue; Yongle Chen; Vik Vanderlinden; Mathy Vanhoef (Proc. Priv. Enhancing Technol., 2025)