Black Hat Asia 2021
2021-05-04..2021-05-07
-- online --
[Black Hat Asia 2015, Black Hat Asia 2016, Black Hat Asia 2018, Black Hat Asia 2019, Black Hat Asia 2020, Black Hat Asia 2021, Black Hat Asia 2022, Black Hat Asia 2023]
| title | author | length |
|---|---|---|
| Locknote: Conclusions and Key Takeaways from Day 1 locknote | Mika Devonshire, Ty Miller, Pamela O'Shea, Fyodor Yarochkin | 41m |
Day one surfaces concrete, actionable findings: a legacy SQL injection chain uses WebDAV and the Jet engine to fetch attacker‑controlled files, fuzzing finds… | ||
| Insights and Predictions: What's Next in InfoSec | Lidia Giuliano, Vitaly Kamluk, Vandana Verma Sehgal, Jeff Wilson, Neil R. Wyler | 57m |
Pandemic-driven digital transformation forces rapid, messy changes: one vendor scales from 50,000 to 250,000 concurrent VPN sessions in weeks and home networks… | ||
| In-Field Emulation & Fuzzing of PLCs to Uncover the Next Zero-Day in Industrial Control Systems | Michail Maniatakos, Dimitrios Tychalas | 39m |
Recent years have been pivotal in the field of Industrial Control Systems (ICS) security, with a large number of high-profile attacks exposing the lack of a… | ||
| Vibe Check: IDK About This…. Why Students May Shy Away From Cyber in a Surveillance State | Mika Devonshire | 37m |
Students in Asia Pacific avoid malware/ethical hacking because pervasive CCTV, ISP monitoring and strict laws (Singapore Computer Misuse Act, Hong Kong cap… | ||
| In-Depth Analyzing and Fuzzing for Qualcomm Hexagon Processor | Xiling Gong, Bo Zhang | 38m |
Hexagon processors have been widely used on Qualcomm platforms. Almost all vital peripheral subsystems (e.g., baseband, WLAN, ADSP, NPU) are lade onto Hexagon… | ||
| The Rise of Potatoes: Privilege Escalations in Windows Services | Antonio Cocomazzi | 42m |
Documents recent, concrete privilege‑escalation chains that turn service accounts into NT AUTHORITY\SYSTEM by abusing Windows service behavior and… | ||
| A General Approach to Bypassing Many Kernel Protections and its Mitigation | Yueqi Chen, Zhenpeng Lin, Xinyu Xing | 41m |
Shows that kernel “elastic” (flexible) objects let a limited heap write become a powerful info‑leak primitive that defeats KASLR, reveals stack canaries, heap… | ||
| (Un)protected Broadcasts in Android 9 and 10 | Mohamed Elsabagh, Ryan Johnson, Angelos Stavrou | 25m |
AOSP bug lets apps declare protected broadcast actions but the system fails to honor them when the declaring APK is in non-privileged system locations, so… | ||
| A Walk Through Historical Correlations Between Vulnerabilities & Stock Prices | Alejandro Hernandez | 29m |
Dataset of historical vulnerabilities and breaches maps each event to daily stock moves and days until price returns to pre-event level; findings show… | ||
| The Motion Sensor Western: The Good, the Bad, and the Ugly | Ben Nassi | 30m |
Motion sensors enable cheap IMU features but also allow concrete attacks: resonant acoustic injection uses chirps in device-specific resonant bands (gyros… | ||
| The Price of Compatibility: Defeating macOS Kernel Using Extended File Attributes | Zuozhi Fan | 36m |
Finds two macOS kernel flaws in the FAT compatibility layer that parses AppleDouble ._ files, turning malformed extended-attribute headers into an… | ||
| How I Can Unlock Your Smart Door: Security Pitfalls in Cross-Vendor IoT Access Control | Yan Jia, Luyi Xing, Bin Yuan, Dongfang Zhao | 35m |
Demonstrates concrete attacks that turn temporary guest access into persistent control of smart locks by exploiting cross-cloud delegation gaps (Google Home… | ||
| The Tangled Webview ----- Javascriptinterface Once More | Ce Qin | 22m |
Claims a new class of WebView addJavascriptInterface flaws that bypass all verifications by exploiting differences between browser‑ and renderer‑initiated… | ||
| The B-MAD Approach to Threat Modeling | Adam Shostack | 25m |
Argues that the common instruction bring me a diagram creates needless conflict and late-stage fixes by turning a collaborative design step into a blame-driven… | ||
| Reverse Engineering Compliance | Adam Shostack | 31m |
Applies classic reverse engineering (GDB and assembler dumps from past work) to the PCI DSS v3.2.1 rulebook, mapping its 139 pages of requirements into a… | ||
| New Attack Surface in Safari: Using Just One Web Audio Vulnerability to Rule Safari | JunDong Xie | 27m |
Demonstrates a single WebAudio decoder bug that bypasses Safari heap isolation to get arbitrary code execution: fuzzing audio_file_stream and extended audio… | ||
| Scavenger: Misuse Error Handling Leading to Qemu/KVM Escape | Xingwei Lin, Gaoning Pan, Jiashui Wang, Chunming Wu, Xinlei Ying Ying | 35m |
Directed greybox fuzzing of QEMU’s NVMe device finds an uninitialized free in nvme_map_prp caused by misused error-handling goto cleanup paths. The researchers… | ||
| Hunting Vulnerabilities of gRPC Protocol Armed Mobile/IoT Applications | Shijie Cao, Hao Zhao | 33m |
Claims an almost fully automated pipeline that finds gRPC flaws in mobile/IoT apps by combining static and dynamic work: IDA Python recursive analysis to… | ||
| Apple Neural Engine Internal: From ML Algorithm to HW Registers | Wish Wu | 30m |
Claim that SEP firmware contains FaceID keys in plaintext and that FaceID logic and neural weights are reachable; toolchain work reproduces… | ||
| X-in-the-Middle: Attacking Fast Charging Piles and Electric Vehicles | HuiYu Wu, YuXiang Li | 29m |
A custom MITM device called X charger sits between DC piles and vehicles, relays and fuzzes CAN/GB/T frames, and captures protocol fields that include VINs… | ||
| Racing the Dark: A New TOCTTOU Story From Apple's Core | Yu Wang | 35m |
Researcher presents more than a dozen macOS kernel memory-mapping zero-days and traces how weak input validation and mapping rules create TOCTTOU and… | ||
| How Did the Adversaries Abusing the Bitcoin Blockchain Evade Our Takeover? | Christian Doerr, Tsuyoshi Taniguchi | 24m |
Malware encodes CNC IPs into Bitcoin payments using two satoshi-coded transactions (amounts translate to IP octets), and clients poll specific wallets; miners… | ||
| Give Me a SQL Injection, I Shall PWN IIS and SQL Server | Qi Deng, Bo Qu, Tao Yan (@Ga1ois) | 36m |
SQL injection into any app that lets SQL Server or Access call the ancient Jet 4.0/ACE 12.0 provider lets a remote attacker point the engine at an… | ||
| Hey, You, Get off My Private Data: Do Apps Respect Your Privacy as They Claim? | Guangdong Bai, Qing Zhang | 37m |
Framework that auto-audits Android apps for real data flows and regulatory gaps, with four tools: domain reputation checks, an API scanner, network-traffic… | ||
| Alarm.DISARM - Remotely Exploiting & Disarming Popular Physical Security System from Public Internet | Omri Ben-Bassat | 36m |
Two RCEs (CVE-2020-25189 and CVE-2020-25185) exist in a Paradox IP150 internet module’s lwIP-based web login: unsafe strcpy and hex-decoding loops allow buffer… | ||
| A Mirage of Safety: Bug Finding & Exploit Techniques of Top Android Vendor's Privacy Protection Apps | Huiming Liu, Xiangqian Zhang | 22m |
Top Android vendors’ “privacy” apps (Secure Folder, PrivateSpace, Safe, App Lock) contain concrete failures: weak encryption like AES‑ECB with keys derived… | ||
| Domain Borrowing: Catch My C2 Traffic if You Can | Tianze Ding, Junyu Zhou | 35m |
Claim: a technique called domain borrowing lets a C2 use CDN infrastructure with SNI equals Host and a legitimately issued certificate borrowed from other… | ||
| Pre-built JOP Chains with the JOP ROCKET: Bypassing DEP without ROP | Austin Babcock, Bramwell Brizendine | 37m |
Tool claims to build pre-built JOP chains that bypass DEP without ROP by statically finding dispatcher gadgets, dispatch tables and functional gadgets from… | ||
| "We Are About to Land": How CloudDragon Turns a Nightmare Into Reality | Jhih-Lin Kuo, Zih-Cing Liao (DuckLL), Zih-Cing (DuckLL) | 35m |
Research separates Kimsuky into two clusters and attributes a persistent North Korean APT named CloudDragon that operates since 2017 using specific toolchains… | ||
| The Cost of Complexity: Different Vulnerabilities While Implementing the Same RFC | Daniel dos Santos, Shlomi Oberman | 36m |
Analysis of RFC 1035 message compression across diverse TCP/IP stacks finds widespread, concrete faults: invalid compression pointers that forward or loop and… | ||
| Threat Hunting in Active Directory Environment | Anurag Khanna, Thirumalai Natarajan Muthiah | 37m |
Mandiant teams report concrete backdoors: attackers set constrained delegation or msDS-AllowedToActOnBehalfOfOtherIdentity via PowerShell to impersonate users… | ||
| Mining and Exploiting (Mobile) Payment Credential Leaks in the Wild | Wing Cheong Lau, Shangcheng Shi, Xianbo Wang | 34m |
Built an automated scanner called pk miner that crawls GitHub, ~1 million Android APKs and merchant servers, parses repo history and APKs, and validates leaks… | ||
| Mem2Img: Memory-Resident Malware Detection via Convolution Neural Network | Charles Li, Aragorn Tseng | 28m |
Mem2Img converts process memory dumps into RGB images where the red channel is raw byte values, the green channel is local entropy and the blue channel is… | ||
| Hiding Objects from Computer Vision by Exploiting Correlation Biases | Masaki Kamizono, Yin Minn Pa Pa, Paul Ziegler | 27m |
Automated composites exploit an implicit correlation bias in vision models trained on COCO 2017 to hide objects: round shapes near dogs become frisbees, stop… | ||
| Disappeared Coins: Steal Hashrate in Stratum Secretly | Rui Chong, Yuanyuan Huang, Xin Liu, Yingli Zhang, Qingguo Zhou | 27m |
Two novel MITM schemes reliably steal miner hashrate from Stratum v1: a stealthy set_extranonce job-injection proxy that intercepts subscription/authorize… | ||
| A New Era of One-Click Attacks: How to Break Install-Less Apps | Bo Li, Yimin Wu, Zhiyang Zeng | 28m |
Finds multiple practical exploits across Install‑Less platforms and demonstrates working attacks: one‑click remote RCE on QuickApp by abusing the downloadFile… | ||
| Wideshears: Investigating and Breaking Widevine on QTEE | Qi Zhao | 27m |
Widevine on QTEE gets a practical break: a Widevine TA command parser accepts a subsample out-of-bounds on offset that permits precise one-byte and multi-byte… | ||
| Enter Sandbox | Claudio Canella, Michael Schwarz, Mario Werner | 35m |
Automatic seccomp generation named Chestnut combines a compiler plugin (Sourcealyzer), a binary analyzer (Binalyzer), and a runtime tracer (Finalizer) plus… | ||
| Anti-Forensics: Reverse Engineering a Leading Phone Forensic Tool | Matt Bergin | 31m |
Reverse engineering of Cellebrite UFED reveals practical weaknesses: encrypted extractor archives use AES-256-CBC envelopes that are peeled in three stages to… | ||
| Keynote: Lessons From 11 Billion Breached Records | Troy Hunt | 46m |
Creator of Have I Been Pwned processes 11 billion records and now accepts data from FBI, HTCU and BKA, cataloguing incidents such as TalkTalk’s £77M impact… | ||
| nothing matches | ||