Black Hat Europe 2014
2014-10-14..2014-10-17
Amsterdam, Netherlands
[Black Hat Europe 2014, Black Hat Europe 2015, Black Hat Europe 2017, Black Hat Europe 2018, Black Hat Europe 2019, Black Hat Europe 2022, Black Hat Europe 2023]
who it's for
security researchers, penetration testers, kernel security researchers, web application security engineers, industrial control system engineers, mobile security engineers, cloud security engineers
topics
Play and Lift framework security; return-to-direct-mapped-memory exploit; reflected file download attack; C++11 compile-time string obfuscation; kernel MDL mapping game cheats; AWS metadata endpoint abuse; Siemens S7-1200 PLC pentesting; process freeze-drying live migration; unsigned kext loading on Yosemite; OpenFlow SDN controller impersonation; Hadoop insecure default configurations; gyrophone gyroscope eavesdropping
| title | author | length |
|---|---|---|
| Scala Security: Examining the Play and LiftWeb Frameworks | Erik Cabetas, Paolo Soto | 54m |
Compares LiftWeb and Play against the OWASP Top 10 with concrete findings: Lift’s built-in sitemap and DOM-based CSRF give strong defaults but can be weakened… | ||
| ret2dir: Deconstructing Kernel Isolation | Vasileios P. Kemerlis | 01h 03m |
ret2dir claims a practical bypass of KERNEXEC/UDEREF and hardware SMEP/SMAP/PXN by exploiting the kernel’s direct‑mapped physical memory region: it maps… | ||
| Reflected File Download - A New Web Attack Vector | Oren Hafif | 50m |
Claims a new web vector that lets attackers craft URLs that download without upload from sites like Google or Bing, produce a file named via path parameters… | ||
| C++11 Metaprogramming Applied to Software Obfuscation | Sebastien Andrivet | 41m |
Uses C++11 template metaprogramming to emit compile-time encrypted string literals (variadic templates + index sequences) and per-string randomized keys via a… | ||
| Next Level Cheating and Leveling Up Mitigations | Joel St. John, Nicolas Guigo | 47m |
Describes two concrete attacks: a kernel-based cheat that uses kernel MDL mapping to expose game pages to a protected user process (demo maps Notepad memory… | ||
| Bringing a Machete to the Amazon | Erik Peterson | 47m |
Demonstrates that a single exposed credential lets an attacker treat AWS like physical access: clone AMIs or EBS volumes, snapshot RDS, and exfiltrate data or… | ||
| Industrial Control Systems : Pentesting PLCs 101 (Part 1/2) | Arnaud Soullie | 58m |
Hands-on workshop that shows how to find and attack real PLCs: Siemens S7-1200 and Schneider M340 are targeted live, with a Kali VM and tools… | ||
| Freeze Drying for Capturing Environment-Sensitive Malware Alive | Yosuke Chubachi | 41m |
A system called Sweetspot implements freeze drying by suspending suspicious processes on an endpoint, serializing process context and heap with MessagePack… | ||
| Exploring Yosemite: Abusing Mac OS X 10.10 | Sung-ting Tsai, Ming-chieh Pan | 57m |
Claims that Mac OS X 10.10 still allows serious kernel abuse: a method to load unsigned kext without warnings (no kextutil patching), a host_priv escalation to… | ||
| Abusing Software Defined Networks | Gregory Pickett | 48m |
Current SDN controllers (Floodlight, OpenDaylight) ship with clear-text APIs, optional or missing TLS, no node authentication, debug ports and weak defaults… | ||
| Hadoop Security: Seven Ways to Kill an Elephant | Davi Ottenheimer | 01h 09m |
Claim: Hadoop distributions ship insecure defaults and show concrete failures — Kerberos is treated as a flip‑switch so teams issue long‑lived tokens… | ||
| Industrial Control Systems : Pentesting PLCs 101 (Part 2/2) | Arnaud Soullie | 51m |
Hands-on demo uses MBTget, a Metasploit Modbus client auxiliary module, plcscan, Snap7 Python scripts and Wireshark against a Schneider M340 and Siemens… | ||
| Android Kernel and OS Security Assessment with Iron Crow | Akhil Arora, Sumanth Naropanth | 19m |
Tool named Iron Crow scans shipped Android platform images for configuration weaknesses rather than code bugs, flagging real issues: NX bit disabled by PAE… | ||
| Revisiting XSS Sanitization | Ashar Javed | 01h 02m |
Breaks the sanitization of 25 WYSIWYG editors (TinyMCE, CKEditor, Froala, Jive and more) to produce stored XSS on sites including Amazon, GitHub, Twitter and… | ||
| Counterfeiting the Pipes with FakeNet 2.0 (Part 2/2) | Michael Sikorski, Andrew Honig | 18m |
FakeNet 2.0 is a Windows network simulator that mimics HTTP SSL and DNS, logs traffic to PCAP and supports Python extensions; the lab uses it to intercept a… | ||
| WebKit Everywhere: Secure or Not? | Liang Chen | 33m |
Shows a full exploitation chain that turns a CSS selector bug into reliable RCE on x64 Safari and a second demo targeting mobile apps, using a restrictive… | ||
| Gyrophone: Eavesdropping Using a Gyroscope | Gabi Nakibly, Yan Michalevsky | 49m |
Claim: phone gyroscopes pick up acoustic vibrations so apps or webpages that need no mic permission can eavesdrop. Experimental setup uses speakers and a… | ||
| Session Identifier are for Now, Passwords are Forever - XSS-Based Abuse of Browser Password Managers | Sebastian Lekies, Ben Stock | 55m |
Cross-site scripting lets JavaScript read passwords because browser managers insert plaintext into the DOM; major browsers differ — only Internet Explorer… | ||
| SSL Validation Checking vs. Go(ing) to Fail | Thomas Brandstetter | 26m |
Built a Python tool around mitmproxy called SVF SSL-Validation-Fuzzer that intercepts handshakes, mutates server certificates and feeds them back to clients to… | ||
| Two Factor Failure | Ryan Lackey | 24m |
Claims that many 2FA deployments are undermined by real-world design and operational mistakes: a practical TOTP (RFC 6238) attack leverages paired phones and… | ||
| Lessons Learned from Eight Years of Breaking Hypervisors | Rafal Wojtczuk | 55m |
Eight years of exploitation yields concrete lessons: dozens of real hypervisor bugs (first found in 2006) include Xen SA‑108 information leak via out‑of‑bounds… | ||
| Evasion of High-End IDPS Devices at the IPv6 Era | Antonios Atlasis, Enno Rey, Rafael Schaefer | 58m |
Claims that IPv6 extension headers plus fragmentation let crafted packets bypass high-end IDPSes; researchers test four IDPS products (snort, suata, Source… | ||
| Analyzing UEFI BIOSes from Attacker & Defender Viewpoints | Xeno Kovah | 01h 04m |
Shows that UEFI makes firmware analyzable but also easier to exploit, reports finding real exploitable memory bugs in the Intel reference code within weeks… | ||
| Attacking the Linux PRNG on Android | Sagi Kedmi | 57m |
Claim: a practical attack reconstructs the Linux non-blocking pool seed on many Android devices given a leaked 16-byte at_random (from zygote) or a leaked IPv6… | ||
| Blended Web and Database Attacks on Real-Time, In-Memory Platforms | Juan Perez-Etchegoyen, Willis Vandevanter | 56m |
Covers concrete attacks and demos against SAP HANA: a novel SQL injection path abusing TIME TRAVEL history tables to recover deleted rows; code injection and… | ||
| Firmware.RE: Firmware Unpacking, Analysis and Vulnerability-Discovery as a Service | Jonas Zaddach | 45m |
A large-scale pipeline unpacks and recursively carves firmware, yielding 32K firmware images expanded into 1.7M files, with automated static checks (fuzzy-hash… | ||
| DTM Components: Shadow Keys to the ICS Kingdom | Alexander Bolshev, Gleb Cherbov | 49m |
Research analyzes FDT/DTM components for field devices and finds concrete failures: fuzzing with a custom hard parser, DTM fuzzer and Fast Frame uncovers 29… | ||
| Hack Your ATM with Friend's Raspberry.Py | Alexey Osipov, Olga Kochetova | 42m |
Researchers drop a Raspberry Pi in service slot and use USB‑to‑serial adapters, PySerial/PyUSB and Facedancer to perform a USB/COM man‑in‑the‑middle that… | ||
| PDF Attack: A Journey from the Exploit Kit to the Shellcode (Part 1/2) | Jose Miguel Esparza | 49m |
Hands‑on walkthrough of extracting and deobfuscating exploit‑kit JavaScript to reach the second‑stage payloads, focused on PDF exploits and using peepdf plus… | ||
| PDF Attack: A Journey from the Exploit Kit to the Shellcode (Part 2/2) | Jose Miguel Esparza | 01h 06m |
Step-by-step manual techniques for extracting obfuscated JavaScript from PDFs, decoding chained stream filters, and recovering hidden older object versions… | ||
| A Practical Attack Against VDI Solutions | Dan Koretsky | 27m |
A proof‑of‑concept shows a malicious app and remote‑access trojans can silently extract VDI credentials and screen content: demo uses MSpy and Emotet‑style… | ||
| Charge Your Device with the Latest Malware | André Pereira | 23m |
Vendor Android USB interfaces accept AT and proprietary commands over USB on some Samsung and HTC models, exposing a path to flashing a compromised boot… | ||
| Hacking the Wireless World with Software Defined Radio - 2.0 | Balint Seeber | 01h 02m |
Uses GNU Radio and USRP hardware (B200/B210/X300) to capture and recreate real RF systems: a working OpenBTS GSM base station on a tiny board; decoding and… | ||
| Quantified Self - A Path to Self-Enlightenment or Just a Security Nightmare? | Candid Wueest | 59m |
Analysis of top free QS apps finds 52% of apps lack privacy policies, apps contact on average five external services (some up to 14), and 20% send passwords in… | ||
| The Power of Pair: One Template that Reveals 100+ UAF IE Vulnerabilities | ChienHua Lu | 34m |
Claims a single pair template strategy uncovers over 100 Internet Explorer use‑after‑free flaws and leads to dozens of CVEs; implementation is a custom C‑based… | ||
| Hide Android Applications in Images | Axelle Apvrille | 22m |
Demonstrates a working proof‑of‑concept that encrypts an APK with AES CBC IV and crafts the ciphertext to match a target PNG so the file is both a valid image… | ||
| Quantum Key Distribution and the Future of Encryption | Konstantinos Karagiannis | 27m |
BT, Toshiba and NPL send quantum keys over 26 km of live, multiplexed fiber (four 10G channels) using a BB84-derived protocol called T12, detecting photons by… | ||
| Don't Trust Your USB! How to Find Bugs in USB Device Drivers | Sergej Schumilo, Ralf Spenneberg, Hendrik Schwartke | 25m |
A virtual USB fuzzer called vUSBf framework uses QEMU/KVM, the QEMU USB redirection protocol and Python device emulators to simulate millions of USB device… | ||
| Endrun - Secure Digital Communications for Our Modern Dystopia | Brendan O'Connor, Grant Dobbe | 51m |
Endrun adapts Delay/Disruption-Tolerant Networking into a working, pre-alpha system that moves encrypted git bundles over offline transports: git bundles… | ||
| Man in the Binder: He Who Controls IPC, Controls the Droid | Nitay Artenstein, Idam Revivo | 32m |
Demonstrates a working POC rootkit that, once a device is rooted (TowerRoot-style exploits available up to KitKat), injects native code into a target process… | ||
| Same Origin Method Execution (SOME) - Exploiting a Callback for Same Origin Policy Bypass | Ben Hayak | 45m |
A new exploit abuses JSONP callback parameters to execute methods inside a same-origin page by opening timed windows/frames, controlling the callback name… | ||
| Lights Off! The Darkness of the Smart Meters | Alberto Garcia Illera, Javier Vazquez Vidal | 56m |
Smart power meter hardware exposes live attack paths: firmware gets dumped over SWD, PLC flash is pulled, and a logic analyzer on the I2C/EO link reveals the… | ||
| Bypassing HTTP Strict Transport Security | Jose Selvi | 46m |
Shows that HSTS can be bypassed by shifting the client clock forward via spoofed NTP responses, letting HTTPS policies expire and enabling SSLStrip-style… | ||
| Network Attached Shell: N.A.S.ty Systems that Store Network Accessible Shells | Jacob Holcomb | 56m |
Ten evaluated NAS models from vendors like Seagate, D‑Link, Netgear and Western Digital are 100% vulnerable to code execution or admin compromise, with at… | ||
| APTs Way: Evading Your EBNIDS | Ali Abbasi, Jos Wetzels | 41m |
Shows concrete evasion techniques that reliably bypass two emulation‑based NIDS prototypes used for evaluation: emulation escapes via context keying (decoder… | ||
| Cellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol | Mathew Solnik | 01h 01m |
Reverse‑engineered baseband and userland clients speak SyncML/WBXML, built custom servers and used OpenBTS and a USRP B210 to deliver WAP push and bootstrap… | ||
| Welcome & Introduction to | Jeff Moss | 01h 09m |
Announces Black Hat Amsterdam 2014 logistics: ~800 attendees from 68 countries, a new academic program placing 50–60 students, encouragement of live Q&A and… | ||
| nothing matches | ||