Black Hat Asia 2022
2022-05-10..2022-05-13
-- online --
[Black Hat Asia 2015, Black Hat Asia 2016, Black Hat Asia 2018, Black Hat Asia 2019, Black Hat Asia 2020, Black Hat Asia 2021, Black Hat Asia 2022, Black Hat Asia 2023]
| title | author | length |
|---|---|---|
| Bypass CFG in Chrome | Yunhai Zhang | 27m |
In this presentation, more than ten CFG bypass techniques will be reviewed, and then examined in Chrome to see if they are still valid to bypass CFG directly… | ||
| AMSI & Bypass: Review of Known AMSI Bypass Techniques and Introducing a New One | Maor Korkos | 39m |
Claims a new, undocumented AMSI bypass that modifies provider code instead of amsi.dll, implemented as PowerShell PoCs that locate provider vtables, change… | ||
| Hunting and Exploiting Recursive MMIO Flaws in QEMU KVM | Qiuhao Li, Gaoning Pan, Hui He, Chunming Wu | 22m |
Finds and weaponizes a class of QEMU/KVM recursive MMIO bugs where DMA writes re-enter MMIO handlers, causing use‑after‑free, OOB and infinite recursion. Uses… | ||
| The Virtual Battlefield in 2022: Russia Ukraine War & Its Policy Implications | Kenneth Geers | 40m |
Chronicles specific cyber operations tied to the Russia–Ukraine war: a malicious firmware update bricks VSAT satellite modems an hour before the February 24… | ||
| Taking Kernel Hardening to the Next Level | Jinbum Park, Haehyun Cho, Seolheui Kim, Yeji Kim, Bumhan Kim, Taesoo Kim, Sungbae Yoo | 38m |
Proposes two concrete kernel defenses: KL tightens PA-based CFI by mixing type, object type and an invariant per-instance field and, when applied to Linux… | ||
| Start Arbitrary Activity App Components as the System User Vulnerability Affecting Samsung Android | Ryan Johnson, Mohamed Elsabagh, Angelos Stavrou | 26m |
Any local app on affected Samsung devices can hand a crafted Intent to com.android.server.telecom (running as the system user) which extracts and starts the… | ||
| Remote Memory-Deduplication Attacks | Erik Kraft, Daniel Gruss, Martin Schwarzl | 31m |
Remote memory‑deduplication is practical over the Internet without running attacker code: sending and overwriting pages via memcache d (tested on KVM on Ubuntu… | ||
| AutoSpear: Towards Automatically Bypassing and Inspecting Web Application Firewalls | Zhenqing Qu, Xiang Ling, Chunming Wu | 35m |
AutoSpear is an automated framework that generates semantics-preserving SQLi variants by parsing queries into a hierarchical SQL tree and mutating nodes with a… | ||
| To Loot or Not to Loot? That Is Not a Question When State Nexus APT Targets Online Entertainment | Che Chang, Charles Li | 37m |
TeamT5 chronicles 20+ targeted campaigns since 2018 showing five China‑nexus APT clusters repeatedly hit online gambling operators for both data collection and… | ||
| The Next Generation of Windows Exploitation: Attacking the Common Log File System | Shijie Xu, Jianyang Song, Linshuang Li | 30m |
Research on the Windows Common Log File System discovers parsing and error‑handling bugs in BLF structures, including CVE-2022-21916 (control record index OOB… | ||
| The Hidden RCE Surfaces That Control the Droids | Qidan He, Juntao Wu | 42m |
Finds multiple real RCEs: a Chromium leaf pack processor RCE (CVE-2020-0224 / 0240 class) that yields arbitrary read/write and a reverse shell in platform… | ||
| The Firmware Supply-Chain Security Is Broken: Can We Fix It? | Alex Matrosov, Alex Ermolov, Kai Michaelis, Richard Hughes | 37m |
Firmware supply-chain problems are concrete: analysis finds 43 high-severity firmware CVEs from repeated code patterns (USBRT, SMM, IBV) and supply-chain… | ||
| Backdooring of Real Time Automotive OS Devices | Shaked Delarea, Ariel Kadyshevitch | 29m |
A buffer overflow in a CAN‑FD handler copies a 64‑byte CAN‑FD frame into a smaller buffer, letting attackers overwrite pointer primitive so a subsequent frame… | ||
| Dynamic Process Isolation | Pietro Borrello, Andreas Kogler, Martin Schwarz | 25m |
Cloudflare Workers use in-process isolation for speed but allow Spectre-style transient attacks from JavaScript: a V8-based type‑confusion primitive reads… | ||
| Like Lightning From the Cloud: Finding RCEs in an Embedded TLS Library | Niels Buchmann, Thomas Kemmer | 29m |
Researchers find eight critical flaws in a closed-source TLS library (nanoSSL) that lead to pre-auth remote code execution across Aruba switches, Avaya portals… | ||
| Unix Domain Socket: A Hidden Door Leading to Privilege Escalation in the Android Ecosystem | Dongxiang Ke, Lewei Qu, Han Yan, Daozheng Lin | 43m |
UDS endpoints in vendor daemons expose real attack paths: 12 issues across four vendors (three acknowledged) show misconfiguration, invalid access control… | ||
| USMA: Share Kernel Code With Me | Yong Liu, Jun Yao, Xiaodong Wang | 27m |
The gadget is a mainstream attack method in the Linux kernel. It requires attackers to find available gadgets based on the vulnerability. This is a… | ||
| The Little Seal Bug: Optical Sound Recovery from Lightweight Reflective Objects | Ben Nassi, Raz Swissa, Boris Zadov | 35m |
Shows that passive lightweight shiny objects (empty can, Rubik’s cube, venetian blinds, phone stand) vibrate with nearby speech and allow intelligible recovery… | ||
| SMS PVA Services Fueled by Compromised Supply-Chain Mobile Botnets | Paul Christian Pajares, Vladimir Kropotov, Zhengyu Dong | 33m |
Researchers uncover a supply‑chain mobile botnet that arrives on low‑cost phones as preinstalled guerrilla/triada loaders, hooks the zygote process, and pushes… | ||
| Non-Intrusive Vulnerability Localization and Hotpatching for Industrial Control Systems | Prashant Hari Narayan Rajput, Michail Maniatakos | 29m |
Framework locates and hotpatches buffer and control-flow bugs in Codesys IEC applications without reboot by rehosting execution in angr rehosting, building a… | ||
| macOS Vulnerabilities Hiding in Plain Sight | Csaba Fitzel | 36m |
Three concrete macOS bugs: a CFPreferences daemon flaw (CVE-2021-1815) lets an unprivileged process create a directory with root ownership via mkdirat… | ||
| DroidGuard: A Deep Dive into SafetyNet | Romain Thomas | 30m |
DroidGuard implements a 256-register VM that runs a unique bytecode downloaded per attestation (updated roughly every two weeks) to check for root, Magisk… | ||
| ExplosION: The Hidden Mines in the Android ION Driver | Le Wu, Xuen Li, Tim Xia | 34m |
Research exposes over 40 vulnerabilities in the Android ION driver (branded ExplosION) that stem from ION design and vendor changes: upstream missing patches… | ||
| Cooper Knows the Shortest Stave: Finding 134 Bugs in the Binding Code of Scripting Languages | Xu Peng, Yanhao Wang, Hong Hu, Purui Su | 30m |
In our talk, we propose cooperative mutation, which modifies both the script code and the program native input to trigger bugs in binding code. Our insight is… | ||
| Codema Attack: Controlling Your Smart Home Through Dangling Management Channels | Yan Jia, Bin Yuan, Luyi Xing | 26m |
Analyzes 14 top-rated devices and finds real-world takeover paths where unused management channels let an attacker control locks and lights by binding to a… | ||
| Backdoor Investigation and Incident Response: From Zero to Profit | Anthony LAI, Ken Wong, Alan Ho, Zetta Ke | 40m |
An online gaming company suffers a breach where an SSL VPN exploit yielding credentials lets attackers access Active Directory, create administrative accounts… | ||
| Using Zero to Attack Zero-Knowledge Proof (ZKP) PLONK | Quan Thoi Minh Nguyen | 37m |
A C++ PLONK implementation allows an attacker to submit all-zero point bytes for elliptic points and produce a forged proof that verifies universally. The… | ||
| Keynote: Fireside Chat with U.S. National Cyber Director Chris Inglis | Chris Inglis | 41m |
Argues for a concrete “new social contract” that reallocates responsibilities across government, industry and individuals, and describes a working model at… | ||
| Keynote: Measure Security Effectively | George Do | 59m |
Argues that security measurement must start from a risk register mapped to business objectives not from tools, and shows how to turn top risks (ransomware… | ||
| Locknote: Conclusions and Key Takeaways from Black Hat Asia 2022 | Ryan Flores, Lidia Giuliano, Vandana Verma Sehgal, Stefano Zanero, Jeff Moss | 47m |
Conference review board says COVID forces a one‑year jump to cloud adoption, Trend Micro reports cloud security sales growth, and a polytechnic spins up 900… | ||
| Keynote: #HackingDemocracy: Will Our Societies Hold? | Samir Saran | 52m |
Argues that large platforms and authoritarian states are already weaponizing code to reshape democracies, citing MongoDB deletion of Russian users, emergence… | ||
| SideWinder Uncoils to Strike | Noushin Shabab | 41m |
SideWinder (aka RattleSnake / T-APT-04) runs over a thousand attacks since April 2020 and keeps hundreds of domains; campaigns use RTF/oxml/lnk lures that drop… | ||
| The Next Gen PlugX/ShadowPad? A Dive into the Emerging China-Nexus Modular Trojan, Pangolin8RAT | Silvia Yeh, Leon Chang | 42m |
Pangolin8RAT emerges mid‑2020 as a modular RAT that downloads modular plugins (DLLs) from C2, keeps key components as memory-only modules, and expands… | ||
| nothing matches | ||