Black Hat Asia 2016
2016-03-29..2016-04-01
Singapore, Singapore
[Black Hat Asia 2015, Black Hat Asia 2016, Black Hat Asia 2018, Black Hat Asia 2019, Black Hat Asia 2020, Black Hat Asia 2021, Black Hat Asia 2022, Black Hat Asia 2023]
who it's for
security researchers, mobile security engineers, embedded and IoT security engineers, incident responders and SOC analysts, browser security engineers, penetration testers, product security engineers
topics
Same Origin Policy bypasses; Android WebView exploitation; ASLR entropy weaknesses; BREACH variants and Rupture; passive DNS history analysis; hardware performance counter rootkit detection; Firefox extension privilege escalation; iOS app repackaging and DYLIB injection; embedded web interface firmware analysis; PLC worm exploitation; automotive CAN/Canbus exploitation; breaking Google reCAPTCHA
| title | author | length |
|---|---|---|
| Keynote: Devaluing Attack: Disincentivizing Threats Against The Next Billion Devices | Dino Dai Zovi | 01h 06m |
Argues that defenders should reduce value to attackers instead of only raising attack cost, demonstrating concrete tools: encryption and tokenization (mobile… | ||
| Bypassing Browser Security Policies for Fun and Profit | Rafay Baloch | 27m |
Demonstrates concrete Android browser failures: multiple Same Origin Policy bypasses in WebView (pre‑4.4) exploited with null‑byte and object/iframe tricks, a… | ||
| Exploiting Linux and Pax ASLR's Weaknesses on 32-Bit and 64-Bit Systems | Hector Marco-Gisbert, Ismael Ripoll | 58m |
Four implementation flaws are measured and exploited: too low entropy (executable often only ~15–28 bits), non‑uniform distributions (triangular sums reduce… | ||
| The Perl Jam 2: The Camel Strikes Back | Netanel Rubin Blaier | 27m |
Shows concrete exploits: a 5-line CGI example turns into RCE via piped open because CGI input can become arrays or hashes and bracketed file reads treat ARGV… | ||
| Practical New Developments in The Breach Attack | Dionysios Zindros, Dimitris Karakostas | 53m |
Extends BREACH to work against block ciphers and noisy endpoints and demonstrates a persistent command‑and‑control over injected HTTP that issues authenticated… | ||
| Multivariate Solutions To Emerging Passive DNS Challenges | Paul Vixie | 58m |
Shows that passive DNS still works when combined with other signals: use passive DNS history to find pre-proxy IPs (example: pillsToronto.net with records back… | ||
| The Tactical Application Security Program: Getting Stuff Done | Cory Scott, David Cintz | 58m |
A lightweight team runs an intake->execute->deliver pipeline that completes 400+ assessments a year, with an on-call pentester triaging reports under a 4-hour… | ||
| Numchecker: A System Approach for Kernel Rootkit Detection | Xueyang Wang, Xiaofei Guo | 53m |
NumChecker is a VMM‑level system that detects control‑flow kernel rootkits by measuring low‑level events with Hardware Performance Counters and comparing… | ||
| The Security Wolf of Wall Street: Fighting Crime With High-Frequency Classification and... | Thibault Reuille, Jeremiah O'Connor | 58m |
OpenDNS builds a real‑time pipeline that processes ~80 billion DNS queries/day by replaying S3 log chunks into an Avalanche stream framework (Python + ZeroMQ… | ||
| Automated Detection of Firefox Extension-Reuse Vulnerabilities | Ahmet Salih Buyukkayhan, William Robertson | 57m |
Legacy Firefox extensions share a global JavaScript namespace and no sandboxing, enabling adversaries to stitch together capabilities from multiple benign… | ||
| Su-A-Cyder: Homebrewing Malware for IOS Like a BO$$! | Chilik Tamir | 02h 39m |
Tool su-A-Cyder automatically repackages an existing IPA, injects a DYLIB built with Theos+fastlane, signs it via Xcode 7’s Apple ID flow and installs it on a… | ||
| The Kitchen's Finally Burned Down: DLP Security Bakeoff | Zach Lanier, Kelly Lum | 54m |
Researchers test commercial and open‑source DLP stacks (Trend Micro, Sophos, Websense/Forcepoint, OpenDLP and anonymized vendors) and find concrete failures… | ||
| Automated Dynamic Fireware Analysis At Scale: A Case Study on Embedded Web Interfaces | Andrei Costin | 01h 08m |
A fully automated framework performs large-scale dynamic firmware analysis by unpacking images, preparing filesystems, and running them under QEMU with chroot… | ||
| Android Commercial Spyware Disease and Medication | Mustafa Saad | 29m |
Demonstrates a working proof-of-concept spyware called Cameleon that registers broadcast receivers for received SMS, outgoing and incoming calls, reads… | ||
| PLC-Blaster: A worm Living Solely In The PLC | Ralf Spenneberg, Maik Brueggemann, Hendrik Schwartke | 55m |
A self-contained PLC-only worm that runs entirely in SCL targets Siemens S7-1200 v1–3, implements the S7‑COMPP+ program-transfer protocol in ICShell, and uses… | ||
| Hacking a Professional Drone | Nils Rodday | 28m |
Professional-grade UAV with a $30–35k price tag and 2 km telemetry link is vulnerable: using an off‑the‑shelf XBee chip and a USB serial adapter the attacker… | ||
| Cantact: An Open Tool for Automative Exploitation | Eric Evenchick | 54m |
Open-source CANtact hardware provides a low-cost USB-to-CAN interface with jumper-selectable DB9 pinout and full schematics; companion Java cross-platform GUI… | ||
| DSCOMPROMISED: A Windows DSC Attack Framework | Ryan Kazanciyan, Matt Hastings | 59m |
PowerShell toolkit DSCompromised leverages Windows Desired State Configuration to host configs on an internet server (tested in AWS), generate payloads (demo… | ||
| A New CVE-2015-0057 Exploit Technology | Yu Wang | 52m |
Demonstrates working exploit techniques that turn CVE-2015-0057’s user‑mode callback use‑after‑free into reliable kernel primitives, with a live demo yielding… | ||
| Enterprise Apps: Bypassing the IOS Gatekeeper | Avi Bashan, Ohad Bobrov | 37m |
Demonstrates a practical zero-day attack that uses a malicious configuration profile to perform a MITM on MDM traffic, modify wake-up commands and force… | ||
| Rapid Radio Reversing | Michael Ossmann | 01h 01m |
Shows a practical hybrid method: use HackRF One and Inspectrum to find a 315 MHz carrier, identify on‑off keying with a three‑symbol pulse (long=110… | ||
| Break Out of The Truman Show: Active Detection and Escape of Dynamic Binary Instrumentation | Ke Sun, Xiaoning Li | 45m |
Shows concrete, reproducible DBI detection and full escape techniques against Pin and DynamoRIO: uses far-return/32↔64 cross‑mode switch to force a native… | ||
| Let's See What's Out There - Mapping the Wireless IOT | Tobias Zillner | 49m |
Claims that the wireless IoT is a massive blind spot with 26 billion devices predicted and homes getting up to 500 devices, shows concrete failures: finding an… | ||
| Never Trust Your Inputs: Causing 'Catastrophic Physical Consequences' From The Sensor... | Alexander Bolshev, Marina Krotofil | 54m |
Shows how an attacker makes one analog line mean 7 V to a controller and 1 V to logging by abusing ADC timing, phase and amplitude. Demos use Arduino + signal… | ||
| Hey, Your Parcel Looks Bad - Fuzzing and Exploiting Parcel -Ization Vulnerabilties in Android | Qidan He | 35m |
Binder IPC accepts crafted parcels and fuzzing plus code audit uncovers BadParcel flaws that let a zero‑permission app gain code execution in mediaserver and… | ||
| Incident Response @ Scale-Building a Next Generation SOC | Omer Cohen | 17m |
Argues for automating incident response across APIs so alerts drive enriched context gathering from asset management, Active Directory, DNS and ThreatExchange… | ||
| I'm Not a Human: Breaking the Google Recaptcha | Iasonas Polakis, Suphannee Sivakorn | 28m |
Describes a working attack that combines browser cookie reuse and image-semantic solvers: creating Google cookies (valid ~9 days) and harvesting 63,000 cookies… | ||
| Locknote: Conclusions and Key Takeaways | Jeff Moss, Dino Dai Zovi, Chris Wysopal, Vincenco Iozzo | 51m |
Conference wrap lists concrete findings not platitudes: firmware analysis finds 12 Netgear routers sharing the same command‑injection bug; cars ship with 40… | ||
| nothing matches | ||