| 2026 | NDSS | Hey there! You are using WhatsApp: Enumerating Three Billion Accounts for Security and Privacy. | Gabriel K. Gegenhuber, Philipp . Frenzel, Maximilian Gnther, Johanna Ullrich, Aljosha Judmayer |
| 2026 | NDSS | Continuous User Behavior Monitoring using DNS Cache Timing Attacks. | Hannes Weissteiner, Roland Czerny, Simone Franza, Stefan Gast, Johanna Ullrich, Daniel Gruss |
| 2025 | ESORICS | Zero-Click SnailLoad: From Minimal to No User Interaction. | Stefan Gast, Nora Puntigam, Simone Franza, Sudheendra Raghav Neela, Daniel Gruss, Johanna Ullrich |
| 2025 | IMC | Tracking Internet Disruptions in Ukraine: Insights from Three Years of Active Full Block Scans. | Florian Holzbauer, Sebastian Strobl, Johanna Ullrich |
| 2025 | RAID | Careless Whisper: Exploiting Silent Delivery Receipts to Monitor Users on Mobile Instant Messengers. | Gabriel K. Gegenhuber, Maximilian Gnther, Markus Maier, Aljosha Judmayer, Florian Holzbauer, Philipp . Frenzel, Johanna Ullrich |
| 2024 | IMC | Destination Reachable: What ICMPv6 Error Messages Reveal About Their Sources. | Florian Holzbauer, Markus Maier, Johanna Ullrich |
| 2022 | USENIX | Not that Simple: Email Delivery in the 21st Century. | Florian Holzbauer, Johanna Ullrich, Martina Lindorfer, Tobias Fiebig |
| 2019 | PAM | Measuring Cookies and Web Privacy in a Post-GDPR World. | Adrian Dabrowski, Georg Merzdovnik, Johanna Ullrich, Gerald Sendera, Edgar R. Weippl |
| 2018 | RAID | Proof-of-Blackouts? How Proof-of-Work Cryptocurrencies Could Affect Power Grids. | Johanna Ullrich, Nicholas Stifter, Aljosha Judmayer, Adrian Dabrowski, Edgar R. Weippl |
| 2017 | ACSAC | Grid Shock: Coordinated Load-Changing Attacks on Power Grids: The Non-Smart Power Grid is Vulnerable to Cyber Attacks as Well. | Adrian Dabrowski, Johanna Ullrich, Edgar R. Weippl |
| 2016 | ESORICS | The Beauty or The Beast? Attacking Rate Limits of the Xen Hypervisor. | Johanna Ullrich, Edgar R. Weippl |
| 2015 | RAID | Privacy is Not an Option: Attacking the IPv6 Privacy Extension. | Johanna Ullrich, Edgar R. Weippl |
| 2014 | CCS | QR Inception: Barcode-in-Barcode Attacks. | Adrian Dabrowski, Katharina Krombholz, Johanna Ullrich, Edgar R. Weippl |
| 2013 | CCS | Cloudoscopy: services discovery and topology mapping. | Amir Herzberg, Haya Schulmann, Johanna Ullrich, Edgar R. Weippl |