Black Hat Asia 2020
2020-09-29..2020-10-02
-- online --
[Black Hat Asia 2015, Black Hat Asia 2016, Black Hat Asia 2018, Black Hat Asia 2019, Black Hat Asia 2020, Black Hat Asia 2021, Black Hat Asia 2022, Black Hat Asia 2023]
| title | author | length |
|---|---|---|
| BitLeaker: Subverting BitLocker with One Vulnerability | Seunghun Han | 38m |
Demonstrates a working exploit that resets TPM PCRs via S3/F3 sleep (CVE-2018-3602 / CVE-2020-0526) on dTPM and fTPM implementations (Intel PTT, many vendors)… | ||
| Complexity Killed Security | Daniel Gruss | 28m |
Shows concrete results: reverse‑engineered DRAM mappings via timing side‑channel and used rowhammer techniques to flip bits across rows; demonstrates that MSR… | ||
| Engineering Cybersecurity for a Nation: What Singapore is Learning from Cars and Sanitation | Gaurav Keerthi | 38m |
Argues Singapore treats cybersecurity like public sanitation, moving from warnings to infrastructure: a safer cyberspace master plan that shifts responsibility… | ||
| The Black Hat NOC: Greatest Hits and Holy...Cows | Bart Stump, Neil R. Wyler | 45m |
The Black Hat NOC describes concrete engineering: partners supply Palo Alto firewalls, Gigamon taps, Ruckus APs, Cisco Threat Grid sandboxing, RSA NetWitness… | ||
| Escaping Virtualized Containers | Yuval Avrahami | 41m |
Shows a concrete escape chain against Kata containers running under Docker: a missing devices cgroup plus the default make_node capability lets a container… | ||
| Patching Loopholes: Finding Backdoors in Applications | Max Chee, Hui Yi Loke | 18m |
Binary analysis with IDA and runtime debugging finds a hidden maintenance backdoor: a startup keypress triggers an answer password flow that computes a… | ||
| What the Log?! So Many Events, so Little Time... | Miriam Wiesner | 41m |
Claims that applying Microsoft security baselines creates many new Windows Event IDs (documentation is 754 pages) and that median breach detection takes >200… | ||
| Securing the Next Version of HTTP: How QUIC and HTTP/3 Compare to HTTP/2 | NICK HARPER | 34m |
QUIC is an always‑encrypted UDP transport carrying HTTP/3 and moves TCP/TLS features into the transport: packet headers are integrity‑protected and header… | ||
| Misuse of DNS, the Second Most Used Protocol | Emilio Couto | 26m |
Claims a practical DNS exfiltration framework called dnsfiltration that splits control and data domains, spoofs many internal source IPs and uses NS queries to… | ||
| Faking a Factory: Creating and Operating a Realistic Honeypot | Charles Perine | 32m |
A realistic ICS honeypot is built with Siemens S7-1200 Omron CP1L and MicroLogix 1100s, an HMI and robotics workstation exposed over VNC, taps into a Raspberry… | ||
| Raiden Glitching Framework | Adam Laurie, Grzegorz Wypych | 43m |
Voltage glitching hardware and a low‑cost FPGA tool called Raiden use precise power/clock pulses to corrupt single instructions. Raiden runs on a Xilinx… | ||
| First Contact - Vulnerabilities in Contactless Payments | Leigh-Anne Galloway, Tim Yunusov | 37m |
Research demonstrates practical bypasses of contactless verification by manipulating EMV fields and modes, including bypass PIN by changing CTQ/TTQ and… | ||
| The Evil Alt-Ego: (ab)using HTTP Alternative Services | David Starobinski, Trishita Tiwari, Ari Trachtenberg | 33m |
HTTP Alt-Svc lets a site tell browsers to fetch content from an equivalent endpoint; researchers demonstrate five attacks that exploit that behavior… | ||
| The Evil of Spy Camera | Shupeng Gao, Ye Zhang | 32m |
Researchers reverse‑engineer cheap hidden cameras, find P2P apps use the same UDP broadcast handshake and build a scanner that detects devices by broadcasting… | ||
| Walking Your Dog in Multiple Forests - Breaking AD Trust Boundaries through Kerberos Vulnerabilities | Dirk-jan Mollema | 35m |
Demonstrates a practical Kerberos/forest-trust exploit that forges inter‑realm TGTs and injects a victim host’s local SID (e.g. RID 500) into tickets so a… | ||
| CDPwn: Taking Over Millions of Enterprise-Things with Layer 2 Zero-Days | Barak Hadad, Ben Seri | 37m |
Five zero-days in Cisco’s CDP implementation let attackers get remote code execution on Nexus, IOS‑XR and NX‑OS devices and on Cisco IP phones and cameras… | ||
| WIFI-Important Remote Attack Surface: Threat is Expanding | Ying Wan, Haikuo Xie, Ye Zhang | 27m |
A black‑box fuzzer that mutates 802.11 management frames and information elements finds 18 zero-day vulnerabilities in six months by running three modes (AP… | ||
| Biometrics & Privacy: Time to Faceoff or is that FaceApp? | Melissa Wingard | 37m |
FaceApp episodes in 2019 prompt concrete claims: FaceApp uploads entire photo library (company says uploads chosen photos to AWS, deletes after 48 hours… | ||
| Attacking and Defending Machine Learning Applications of Public Cloud | Dou Goodman, Yang Wang, Hao Xin | 20m |
Claim: a two-step black‑box attack builds a tiny labeled set (≈200 images, ≤2 queries/image) and trains a substitution model to produce transferable… | ||
| Identifying Multi-Binary Vulnerabilities in Embedded Firmware at Scale | Andrea Continella, Nilo Redini | 33m |
A static multi-binary taint analysis system named Caronte prototype unpacks firmware with binwalk, identifies border binaries via parsing scores, builds a… | ||
| Redback: Advanced Static Binary Injection | Minh Tuan Do Do, Anh Quynh Nguyen | 34m |
Redback is a static binary injector that injects high-level object files compiled from C/C++ into existing executables by appending new sections, fixing… | ||
| Store-to-Leak Forwarding: There and Back Again | Claudio Canella, Lukas Giner, Michael Schwarz | 36m |
Demonstrates that correct store-to-load forwarding still leaks whether a virtual page is mapped and recently used, producing practical primitives called fetch… | ||
| ZombieLoad: Leaking Data on Intel CPUs | Moritz Lipp, Michael Schwarz | 35m |
The publication of Meltdown in January 2018 was the first instance of a hardware vulnerability which broke the security guarantees of modern CPUs. Meltdown… | ||
| Back to the Future. Cross-Protocol Attacks in the Era of 5G | Sergei Puzankov | 26m |
Shows reproduced cross‑protocol attacks that chain SS7, Diameter and GTP messages to intercept calls, track and block subscribers, and bill victims for premium… | ||
| 3d Red Pill: A Guest-to-Host Escape on QEMU/KVM Virtio Device | Zhijian Shao, Matthew Shao, Jian Weng, Yue Zhang | 27m |
Demonstrates a working guest-to-host escape on QEMU/KVM by exploiting virtio-gpu: a protobuf-guided, structure-aware fuzzer finds a null-deref DoS and a… | ||
| Page Cache Attacks: Microarchitectural Attacks on Flawless Hardware | Daniel Gruss, Erik Kraft, Michael Schwarz, Trishita Tiwari | 35m |
Operating-system page cache acts as a software cache and yields non-destructive probes via APIs like mincore and QueryWorkingSet, enabling timing side channels… | ||
| Wi-Fi Brokering | Michael Kruger | 33m |
Demonstrates a working toolchain that relays PEAP/MS‑CHAPv2 instead of cracking hashes: a rogue AP using hostapd‑mana hands inner MS‑CHAPv2 exchanges to a… | ||
| May the Trust be with You: Empowering TrustZone-M with Multiple Trusted Environments | Daniel Bristot de Oliveira, Sandro Pinto | 27m |
Claim: TrustZone‑M’s dual-world model is too big and brittle, so a new microkernel splits an MCU into isolated multiple trusted worlds. Implementation: a 6 KB… | ||
| Kr00k: How KRACKing Amazon Echo Exposed a Billion+ Vulnerable Wi-Fi Devices | Robert Lipovsky, Stefan Svorencik | 35m |
Researchers demonstrate that Broadcom/Cypress FullMAC Wi‑Fi chips let transmitted frames be encrypted with an all-zero encryption key after a disassociation… | ||
| From an URGENT/11 Vulnerability to a Full Take-Down of a Factory, Using a Single Packet | Barak Hadad, Dor Zusman | 29m |
Claims a single crafted packet exploiting an URGENT/11 IP‑options overflow triggers a stack smash that yields control of Rockwell and Schneider PLCs, then uses… | ||
| Hey Google, Activate Spyware! – When Google Assistant Uses a Vulnerability as a Feature | Erez Yalon | 28m |
Research finds Android camera intents that let any app without specific camera permission trigger capture and recording by exploiting no permissions exported… | ||
| Making an Impact from India to the Rest of the World by Building & Nurturing Women Infosec Community | Vandana Verma Sehgal | 34m |
Community built InfoSecGirls launches chapters across India and abroad, claims 28,000 members and roughly 130 local chapters, runs weekly chapter meetups plus… | ||
| Demystify Today's Binary Disassembling and How Modern ABI Makes it Easier | Eric Koskinen, Chengbin Pang, Jun Xu | 21m |
Paper reads source code of eight open tools Ghidra, Angr, McSema, Dyninst, Radare2, Jakstab, Uroboros, Objdump and documents 44 strategies (15 principled, 29… | ||
| Win the 0-Day Racing Game Against Botnet in Public Cloud | Xiaokun Huang, Yue Xu | 23m |
Alibaba Cloud collects network and endpoint logs across >1M customers and uses an automated pipeline that correlates HTTP records with process/file alarms to… | ||
| Tracking the Criminal of Fake News Based on a Unified Embedding | Dou Goodman, Wang Wenhua, Lv Zhonghou | 23m |
Proposes a unified embedding that maps texts to points on a unit sphere and trains with a triplet loss so same-author texts sit closer than others, and adds… | ||
| The Inside Story: There are Apps in Apps and Here is How to Break Them | Hao Xing | 25m |
Compares two instant app architectures: WebView-based instant apps that run page logic in a single service worker per domain and use a JS bridge, and native… | ||
| Adversary Detection Pipelines: Finally Making Your Threat Intel Useful | Xena Olsen | 38m |
Builds an operational pipeline that filters the whole internet down to organization-specific threats by correlating email attack data with internal tickets… | ||
| Dynamic Binary Instrumentation Techniques to Address Native Code Obfuscation | Romain Thomas | 40m |
Shows QBDI dynamic instrumentation used to recover actual function targets, resolve JNI registerNative mappings, and extract decoded strings by record… | ||
| Locknote: Conclusions and Key Takeaways from Day 1 | Ryan Flores, Lidia Giuliano, Ty Miller, Ashley Shen | 41m |
Day one surfaces concrete risks and fixes: contactless payment systems show systemic vulnerabilities, F5 BIG‑IP VPNs had a July zero‑day being actively… | ||
| Locknote: Conclusions and Key Takeaways from Day 2 | Mika Devonshire, Seungjoo Kim, Asuka Nakajima, Neil R. Wyler | 39m |
Remote-work shifts expose simple failures that enable major incidents: employees plugging laptops straight into home modems leads to 80 of 100 systems… | ||
| nothing matches | ||