About Me

Born in Curitiba city, Brazil, Matheus is currently a Research Fellow at Singapore University of Technology and Design (SUTD) and integrant of ASSET Research Group. He has a background in Electronics Engineering (2019 B.Eng) from Pontifical Catholic University of Paraná and always loves to mess with low-level software and hardware.

In 2023, he achieved a Ph.D in Computer Science (Wireless Software Fuzz Testing) and a 2024 Outstanding Thesis Award from SUTD under supervision of Professor Sudipta Chattopadhyay.

Matheus is known for the discovery of a collection of wireless vulnerabilities such as Sweyntooth, Braktooth and 5Ghoul.

Download CV
Interests
  • Wireless Security
  • Cyber-physical Systems and IoTs
  • Embedded Systems
  • Software/Hardware engineering
  • Advanced Wireless Fuzzing
Education

  • PhD in Computer Science

    Singapore University of Technology and Design (SUTD)

  • BEng in Electronics Engineering

    Pontifical Catholic University of Paraná (PUCPR)

Featured Publications
VaktBLE: A Benevolent Man-in-the-Middle Bridge to Guard against Malevolent BLE Connections (ACSAC 2024 Prepublication)
AirBugCatcher: Automated Wireless Reproduction of IoT Bugs (ACSAC 2024 Prepublication)
U-Fuzz: Stateful Fuzzing of IoT Protocols on COTS Devices (ICST 2024)
Towards Automated Fuzzing of 4G/5G Protocol Implementations Over the Air (GLOBECOM 2022)
BrakTooth: Causing Havoc on Bluetooth Link Manager via Directed Fuzzing (Usenix Security 2022)
SweynTooth: Unleashing Mayhem over Bluetooth Low Energy (Usenix ATC)
Recent Publications
Geovani Benita, Matheus E. Garbelini, S. Chattopadhyay (2024). VaktBLE: A Benevolent Man-in-the-Middle Bridge to Guard against Malevolent BLE Connections (ACSAC 2024 Prepublication). Annual Computer Security Applications Conference (ACSAC 2024) (Prepublication).
Guoqiang Hua, Matheus E. Garbelini, S. Chattopadhyay (2024). AirBugCatcher: Automated Wireless Reproduction of IoT Bugs (ACSAC 2024 Prepublication). Annual Computer Security Applications Conference (ACSAC 2024) (Prepublication).
Zewen Shang, Matheus E. Garbelini, S. Chattopadhyay (2024). U-Fuzz: Stateful Fuzzing of IoT Protocols on COTS Devices (ICST 2024). IEEE Conference on Software Testing, Verification and Validation (ICST 2024).
PDF Cite Code
See all publications
Vulnerability Disclosures
ESP32/ESP8266 EAP client crash (CVE-2019-12586)
ESP32/ESP8266 EAP client crash (CVE-2019-12586)

Crashing ESP devices connected to enterprise networks

Sep 3, 2019

ESP8266 Beacon Frame Crash (CVE-2019-12588)
ESP8266 Beacon Frame Crash (CVE-2019-12588)

Easily crashing ESP8266 Wi-Fi devices

Sep 3, 2019

Zero PMK Installation (CVE-2019-12587)
Zero PMK Installation (CVE-2019-12587)

Hijacking ESP32/ESP8266 clients connected to enterprise networks

Sep 3, 2019