Black Hat Asia 2023
2023-05-09..2023-05-12
-- online --
[Black Hat Asia 2015, Black Hat Asia 2016, Black Hat Asia 2018, Black Hat Asia 2019, Black Hat Asia 2020, Black Hat Asia 2021, Black Hat Asia 2022, Black Hat Asia 2023]
| title | author | length |
|---|---|---|
| Highlights | 03m | |
Check out all the highlights from Black Hat Asia 2023 at the Marina Bay Sands Singapore. Visit our Flickr page for the event photos… | ||
| A New Attack Interface in Java Applications | Peter Mularien (PeterM), Xu Yuanzhen | 40m |
Finds multiple concrete JDBC attack paths and ready POCs rather than theory. An IBM driver exposes a JNDI injection via writable connection properties and a… | ||
| A Run a Day Won't Keep the Hacker Away: Inference Attacks in Fitness Tracking Social Networks | Karel Dhondt, Victor Le Pochat | 39m |
Claim: endpoint privacy zones on major fitness networks are vulnerable to inference attacks that recover homes/workplaces. Method: filter protected endpoints… | ||
| Abusing Azure Active Directory: From MFA Bypass to Listing Global Administrators | Sravan Akkaram, Nestori Syynimaa | 38m |
Demonstrates a concrete exploit chain: attackers with a stolen password can log into certain B2C/fallback resource tenants without triggering home-tenant MFA… | ||
| Alice in Kernel Land: Lessons Learned From the eBPF Rabbit Hole | Juan José López Jaimez, Valentina Palmiotti, Simon Scannell | 38m |
Automatic fuzzing targets the ebpf verifier and finds logic and branch-pruning bugs rather than just memory corruptions. A first prototype compiles verifier… | ||
| Attacking the WebAssembly Compiler of WebKit | Zong Cao (P1umer), Yeqi Fu (Q1IQ), Fangming Gu (afang5472), Bohan Liu, Zheng Wang (xmzyshypnc) | 27m |
Shows an end-to-end technique that migrates a Wasm generator into the WebKit backend so a fuzzer built for V8 exercises WebAssembly in Safari without heavy… | ||
| Behind the Scenes: How Criminal Enterprises Pre-infect Millions of Mobile Devices | Zhengyu Dong, Vladimir Kropotov, Paul Christian Pajares, Fyodor Yarochkin | 44m |
Criminal enterprise pre-infects phones via compromised SDKs, modified OTA components and a tampered Android runtime that injects a main plugin DEX downloader… | ||
| Breaking Managed Data Services in the Cloud | Yoav Alon, Tzah Pahima, Yanir Tsarimi | 40m |
Research finds two concrete cross-tenant takeovers: a full AWS Glue compromise (Super Glue) and an Azure Synapse takeover, plus an Azure Automation bug that… | ||
| Breaking the Chain: An Attacker's Perspective on Supply Chain Vulnerabilities and Flaws | Ilay Goldman, Yakir Kadkoda | 35m |
Demo uploads of an impersonated VS Code extension named prettier with one t reach over 1,000 installs in 48 hours, proving marketplace spoofing and leaked… | ||
| Bypassing Anti-Cheats & Hacking Competitive Games | Rohan Aggarwal | 38m |
Presentation demonstrates a working kernel driver that hijacks a system call, injects shellcode to forward read/write requests to kernel space, and uses a KD… | ||
| Cloudy With a Chance of Exploits: Compromising Critical Infrastructure Through IIoT Cloud Solutions | Roni Gavrilov | 42m |
Cloud-managed IIoT router platforms can be hijacked end-to-end to get remote code execution on fleets, shown across three major vendors with lab demos and… | ||
| Dilemma in IoT Access Control: Revealing Novel Attacks and Design Challenges in Mobile-as-a-Gateway | Jiale Guan (Jalon), Zhiyun Qian, Luyi Xing, Xin'an Zhou | 39m |
Bought and reverse-engineered 10 real-world devices (mainly smart locks and trackers) and finds every vendor drops critical semantics when translating cloud… | ||
| Dirty Bin Cache: A New Code Injection Poisoning Binary Translation Cache | Koh M. Nakagawa | 40m |
Claims a new code‑injection method called AOT poisoning that corrupts Rosetta 2 AOT files by modifying an x86_64 binary via mmap without calling msync so the… | ||
| Dirty Stream Attack, Turning Android Share Targets Into Attack Vectors | Dimitrios Valsamaras | 32m |
Crafted a malicious ContentProvider that spoofs the display_name and returns a file descriptor stream so a share-target app caches or writes… | ||
| E-Meet (or Emit?) My Keystrokes: How Benign Screen-sharing Meetings Could Leak Typing Behaviors | Andry Chowanda, Chrisando Ryan | 42m |
Computer vision algorithms recover keystroke timing and error patterns from ordinary screen‑sharing recordings, not camera footage, by tracking the blinking… | ||
| Engaging the Next Generation of Cybersecurity Professionals: The Power of Security Zines | Rohit Sehgal | 28m |
Security Zines uses hand‑drawn comics and one‑page flyers to teach concrete bugs (SSTI, IDOR, JWT, phishing) and hosts 38 flyers and 12 zines free on the… | ||
| Fireside Chat | Jeff Moss, Gaurav Keerthi | 44m |
Singapore describes an outcomes-first approach: a national cyber security labeling scheme that rates routers 1–4 stars and nudges buyers to pay a little more… | ||
| firmWar: An Imminent Threat to the Foundation of Computing | Vlad Babkin, Nate Warfield | 41m |
Leaked AMI firmware for AMI MegaRAC SP‑X yields a post‑auth Redfish command injection that leads to reliable remote code execution and persistence, plus a… | ||
| Forward Focus – The Impact of Artificial Intelligence | Maxine Holt, Marina Krotofil, Tara Seals, Fyodor Yarochkin, Stefano Zanero | 42m |
AI augments detection and automates routine tasks but produces concrete risks: hallucinations that fabricate facts, model poisoning that embeds backdoors in… | ||
| Fuzzing the Native NTFS Read-Write Driver (NTFS3) in the Linux Kernel | Edward Lo, Chiachih Wu | 39m |
Built a Janus-based image+syscall fuzzer (open-sourced as peppera) that mutates NTFS3 metadata and generates context-aware syscall sequences, upgrades Linux… | ||
| Grand Theft House: RF Lock Pick Tool to Unlock Smart Door Lock | Seokhie Hong, Kwonyoup Kim, Seungjoon Lee | 41m |
Analyzes over 20+ models and shows rolling‑code implementations that store counters insecurely, enabling rollback and a new “loop playback” exploit that… | ||
| Hacked on National Television | Linus Kvarnhammar | 33m |
A TV experiment uses phishing, malicious USBs, Wi‑Fi implants and social engineering to seize real accounts: all 20 participants give usable credentials via a… | ||
| Hand Me Your SECRET, MCU! Microarchitectural Timing Attacks on Microcontrollers are Practical | Sandro Pinto, Cristiano Rodrigues | 41m |
Researchers expose a new bus arbitration timing side channel on ARM Cortex‑M MCUs that leaks secrets by measuring delays when CPU and DMA/peripherals contend… | ||
| Insider Threats Packing Their Bags With Corporate Data | Colin Estep, Dagmawi Mulugeta | 26m |
Analysis on 4.7 million active users shows 58,314 users drop from activity; about 15% upload to personal cloud before departure and 2% perform policy‑violating… | ||
| Keynote - Preparing the Long Journey for Data Security | Xiaosheng Tan | 55m |
China implements the Data Security Law and Personal Information Protection Law (2022) and a national “20 measures” plan, positioning data as a fifth production… | ||
| Leveraging Streaming-Based Outlier Detection and SliceLine to Stop Heavily Distributed Bot Attacks | Konstantina Kontoudi, Antoine Vastel | 40m |
A production pipeline detects distributed layer‑7 bot attacks by computing time‑series aggregates (requests, unique UAs, IPs, sessions, countries) and flagging… | ||
| Nakatomi Space: Lateral Movement as L1 Post-exploitation in OT | Jos Wetzels | 46m |
Demonstration exploits a pre-auth FTP stack overflow on a Wago 750 to proxy Modbus, replays UMass authentication and abuses an undocumented UMass CSA 0x50… | ||
| New Wine in an Old Bottle: Attacking Chrome WebSQL | Ziling Chen, Hongli Han, Nan Wang | 31m |
Chrome exposes SQLite via WebSQL and the team builds a mutation-based BNF fuzzer and an AST-guided mutator that generate and mutate SQL-like statements with… | ||
| Operation Clairvoyance: How APT Groups Spy on the Media Industry | Yue-Tien Chen, Zih-Cing Liao (DuckLL) | 32m |
Taiwanese media endure focused APT campaigns that pivot from web flaws to long-term access: operators use SQL injection with sqlmap to get in, run credential… | ||
| Phoenix Domain Attack: Vulnerable Links in Domain Name Delegation and Revocation | Xiang Li | 26m |
Claim: Phoenix Domain lets revoked domains stay resolvable at scale by abusing DNS cache operations; two exploit types (T1 injects NS records as cached entries… | ||
| PMFault: Voltage Fault Injection on Server Platforms Through the PMBus | Zitai Chen, David Oswald | 27m |
Demonstrates a remote voltage-fault chain against Supermicro X11 servers by controlling the PMBus (found at address 0x20) via BMC paths: initial proof uses… | ||
| PPLdump Is Dead. Long Live PPLdump! | Gabriel Landau | 30m |
Demonstrates a new chain that achieves arbitrary code execution inside PPL processes on Windows 11 by combining a cloud filter rehydration callback, loopback… | ||
| Prototype Pollution Leads to RCE: Gadgets Everywhere | Mikhail Shcherbakov | 40m |
Claims automated analysis finds over 10 real RCEs by chaining Prototype Pollution into usable gadgets across Node core and popular NPM packages, with concrete… | ||
| Revisiting Stealthy Sensitive Information Collection from Android Apps | Guangdong Bai, Guangshuai Xia, Qing Zhang | 36m |
This work claims modern Android privacy controls miss many channels and builds a low-level detector that uses hooking String constructors and ART runtime hooks… | ||
| Security Advocacy Shouldn't Be for Security Professionals: How the Industry Misses the Mark... | Sarah Young | 42m |
Analysis of 200 pieces of content scores vendor, nonprofit and indie materials on a score out of six that checks plain language, no assumed knowledge, clear… | ||
| Stealing With Style: Using CSS to Exploit ProtonMail & Friends | Paul Gerste | 40m |
Finds critical XSS and RCE in ProtonMail, Skiff and Tutanota by abusing post-sanitization changes to DOMPurify and parser differences to turn SVG/style blocks… | ||
| Sweet Dreams: Abusing Sleep Mode to Break Wi-Fi Encryption and Disrupt WPA2/3 Networks | Domien Schepers, Mathy Vanhoef | 40m |
Two novel attacks abuse Wi‑Fi power‑save: one forces APs to buffer frames, then removes or changes keys so buffered traffic is sent under an undefined context… | ||
| The NOC Report | Neil R. Wyler, Bart Stump | 40m |
Black Hat NOC runs an enterprise network in two days using Palo Alto 5280s, Arista 7280 tap aggregation, NetWitness packet decoding and Umbrella DNS; it… | ||
| The Various Shades of Supply Chain: SBOM, N-Days and Zero Trust | Richard Hughes, Alex Matrosov, Kai Michaelis | 33m |
Campaigns expose OEM signing keys (notably MSI and LCFC leaks), enabling authenticated bootloader installs; an Intel OEM debug key also appears leaked. Binary… | ||
| Trends and Top Takeaways | Sudhanshu Chauhan, Ty Miller, Jeff Moss, Asuka Nakajima, Pamela O'Shea | 01h 03m |
Panel reports AI landing mostly as defensive automation for log and anomaly triage rather than instant offensive magic, with concrete value in reducing… | ||
| Deception at Scale: How Malware Abuses Trust | Gerardo Fernandez | 30m |
Analysis of VirusTotal data finds 1.1 million signed samples that hold valid certificates at submission, 2.6 million suspicious downloads from >400 Alexa… | ||
| Two Bugs With One PoC: Rooting Pixel 6 From Android 12 to Android 13 | Yong Wang | 38m |
Pixel 6 is the first phone to rock the new Tensor chip, fully designed and developed by Google. Shipping with Linux kernel 5.10, there are many new changes and… | ||
| Weaponizing Mobile Infrastructure: Are Politically Motivated Cyber Attacks a Threat to Democracy? | Imran Saleem | 40m |
Claims that mobile roaming interconnects get weaponized: attackers run fuzzing against SS7/SIGTRAN signaling, inject malformed TCAP and SCP messages (including… | ||
| When Knowledge Graph Meets TTPs: Automated & Adaptive Executable TTP Intelligence for Security | Porot Mo, Jack Tang, Lorin Wu | 41m |
Builds a TTP Knowledge Graph from automated extraction of reports using Transformer models with Chinese word tokenization and three optimizations (primary vs… | ||
| You Can Run, but You Can't Hide - Finding the Footprints of Hidden Shellcode | John Uhlmann | 32m |
Describes three concrete detection techniques and three tools being released: monitoring ETW ProtectVM events to count virtualprotect toggles and alert on… | ||
| nothing matches | ||