Black Hat Europe 2015
2015-11-10..2015-11-13
Amsterdam, Netherlands
[Black Hat Europe 2014, Black Hat Europe 2015, Black Hat Europe 2017, Black Hat Europe 2018, Black Hat Europe 2019, Black Hat Europe 2022, Black Hat Europe 2023]
| title | author | length |
|---|---|---|
| Keynote: What Got Us Here Wont Get Us There | Haroon Meer | 58m |
Claim: the industry is losing — big breaches (Target, OPM, Sony) happen despite big budgets because fundamentals break: one compromised external vendor or one… | ||
| Bypassing Self-Encrypting Drives (SED) in Enterprise Environments | Daniel Boteanu, Kevvie Fowler | 59m |
Claims a widespread design gap: Opal / eDrive SEDs unlock on wake and stay unlocked until power‑cycled or an explicit lock command, so physical access while a… | ||
| Breaking Access Controls with Blekey | Eric Evenchick, Mark Baseggio | 50m |
Blekey is a coin‑cell powered implant (18×30 mm) built on an nRF51822 module that hides behind a reader and attaches to the Wiegand lines with a punchdown… | ||
| Cybersecurity for Oil and Gas Industries: How Hackers Can Manipulate Oil Stocks | Alexander Polyakov, Mathieu Geli | 01h 01m |
Claim: enterprise ERP breaches lead into OT and let attackers falsify inventory and trigger physical damage. The presenters demonstrate an attack chain from… | ||
| Panel: What You Need To Know About The Changing Regulatory Landscape In Information Security | Vincenzo Iozzo, Dr. Richard Tynan, Halvar Flake, Paul Timmers, Marietje Schaake | 59m |
Quick status and concrete asks: EU consultation closed October 15 and a formal proposal is due by end Q1 2016, with debate to follow; policymakers push to… | ||
| Attacking The XNU Kernel In El Capitain | Luca Todesco | 37m |
Demonstrates a working El Capitan kernel exploit that bypasses System Integrity Protection by adapting the old vm_map_copy corruption to the new structure… | ||
| Automating Linux Malware Analysis Using Limon Sandbox | Monnappa K A | 56m |
Limon is a Python sandbox that runs static, dynamic and memory forensics analysis using Yara, ssdeep, tcpdump, strace/strace-like tracing and Volatility; it… | ||
| Even The Lastpass Will Be Stolen, Deal With It! | Alberto Garcia, Martin Vigo | 53m |
Reversing LastPass browser plugins reveals concrete attacks: AES‑256 with ECB/CBC and pbkdf2 that moved from 500 to 5,000 rounds but still leaks parameters… | ||
| Silently Breaking ASLR In The Cloud | Antonio Barresi, Kaveh Razavi, Mathias Payer, Thomas Gross | 53m |
Demonstrates a practical side‑channel that uses memory deduplication (KSM/Page‑fusion) by measuring slow copy‑on‑write times to detect shared pages, then… | ||
| A Peek Under the Blue Coat | Raphael Rigo | 50m |
Detailed reverse engineering of Blue Coat ProxySG SGOS (appliance and VMware, versions up to 6.5) extracts bcfs images and ELF binaries, maps a tiny 800 KB… | ||
| Androbugs Framework: An Android Application Security Vilnerability Scanner | Yu-Cheng Lin | 50m |
An open‑source Python scanner called AndroBugs Framework statically analyzes smali via Androguard, flags concrete weaknesses (world‑readable files, exported… | ||
| Stegospolit - Exploit Delivery With Steganography and Polyglots | Saumil Udayan Shah | 58m |
Claim: browser exploits are fully encoded into image pixels and hidden inside valid JPG/PNG files, then fused with a JavaScript decoder to form an HTML+Image… | ||
| Watching The Watchdog: Protecting Kerberos Authentication With Network Monitoring | Tal A. Be'ery, Michael Cherny | 50m |
Describes concrete detections for four Kerberos forgeries—Skeleton Key, Golden Ticket, MS14-068 fake PAC and a new diamond PAC variant—showing how each alters… | ||
| Authenticator Leakage Through Backup Channels on Android | Guangdong Bai | 47m |
Finds that Android apps store session tokens and cookies in app internal storage and common backup tools leak those authenticators through ADB- and… | ||
| Cybercrime in The Deep Web | Marco Balduzzi, Vincenzo Ciancaglini | 55m |
A prototype crawler called DeWA automatically collects and analyzes DeepWeb content via a universal gateway, Splash headless browser, Scrapy middlewares and… | ||
| Hey Man, Have You Forgotten To Intialize Your Memory? | Yuki Chen, Linan Hao | 51m |
A single uninitialized CAttributeValue in 64‑bit IE leads to an info leak via a relative heap spray, allowing construction of fake VARIANTs and a fake JS array… | ||
| Unboxing The White-Box: Practical Attacks Against Obfuscated Ciphers | Eloi Sanfelix, Job de Haas, Cristofaro Mune | 57m |
Shows that hardware DFA and side‑channel methods port to white‑box ciphers: custom scripts using GDB, Unicorn, Pin and emulators inject flip‑bit fault… | ||
| Commix: Detecting and Exploiting Command Injection Flaws | Anastasios Stasinopoulos, Christoforos Ntantogian, Christos Xenakis | 30m |
An open source Python tool named Commix automates detection and exploitation of command injection via generated attack vectors, HTTP headers and enumeration… | ||
| Is Your Timespace Safe? - Time and Position Spoofing Opensourcely | Wang Kang, Shuhua Chen, Aimin Pan | 33m |
Demonstrates working GPS spoofing using open tools: GPS-SDR-SIM fed to cheap SDRs (HackRF/BladeRF/USRP) at hardware cost ~ $300–$400, producing baseband… | ||
| Lessons From Defending The Indefensible | Marek Majkowski | 30m |
Cloudflare defensive checklist with numbers and actual results: use BPF bytecode in iptables to drop payload-matching UDP/DNS floods (reduces false positives)… | ||
| Your Scripts In My Page - What Could Possibly Go Wrong? | Ben Stock, Martin Johns, Sebastian Lekies | 29m |
Demonstrates a practical attack called cross-domain script inclusion and a browser extension that fetches scripts with and without cookies to detect… | ||
| Continuous Intrusion: Why CI Tools Are An Attacker's Best Friends | Nikhil Mittal | 01h 00m |
Live demos show Jenkins, TeamCity, Go, CruiseControl and Hudson abused to run arbitrary commands and PowerShell reverse shells by a low‑permission user who… | ||
| Going Auth The Rails On A Crazy Train | Jeff Jarmoc, Tomek Rabczak | 59m |
Rails apps use has_secure_password (bcrypt) but still leave session choice, expiration and reset flows to developers; cookie sessions serialize/encrypt state… | ||
| Hiding In Plain Sight - Advances In Malware Covert Communication Channels | Pierre-Marc Bureau, Christian Dietrich | 57m |
Analysis documents three real malware families using covert channels: Stegoloader, Vawtrak, Lurk all embed data via LSB steganography in ICO, BMP and PNG files… | ||
| LTE & IMSI Catcher Myths | Ravishankar Borgaonkar, Altaf Shaik, N Asokan, Valtteri Niemi, Jean-Pierre Seifert | 01h 06m |
Build an LTE IMSI-catcher from a laptop + USRP and modified OpenLTE code for about €1,250 and show it works against popular phones. Two classes of flaws… | ||
| How To Break XML Encryption - Automatically | Juraj Somorovsky | 43m |
Automatic adaptive chosen-ciphertext attacks decrypt XML-encrypted messages and recover session keys by abusing parsers and error responses, implemented as a… | ||
| Implementing Practical Electrical Glitching Attacks | Brett Giller | 43m |
Reproduces end-to-end electrical glitch exploits: uses a De0 Nano FPGA and simple test rigs to trigger clock glitching pulses (60–80 ns) and voltage… | ||
| (In-)Security of Backend-As-A-Service | Siegfried Rasthofer, Steven Arzt | 54m |
Claims that automated analysis of ~2 million Android apps yields widespread BaaS misconfiguration, with tools that extract embedded credentials (even… | ||
| Defending Against Malicious Application Compatibility Shims | Sean Pierce | 57m |
Shows how the Application Compatibility Toolkit (ACT) builds and installs shim database sdb files that hook the import table, inject code (example: inject dll)… | ||
| Exploiting Adobe Flash Player In The Era Of Control Flow Guard | Francisco Falcon | 58m |
Shows a concrete CFG bypass via JIT codegen that locates a method pointer at bytearray->vtable+0xD4 and turns an unguarded JIT indirect call into a ROP start… | ||
| Fuzzing Android: A Recipe For Uncovering Vulnerabilities Inside System Components In Android | Alexandru Blanda | 45m |
Describes a practical fuzzing recipe that targets core Android components — Stagefright, mediaserver, installd, dex2oat/ART — using a toolchain (BFF based on… | ||
| VOIP Wars: Destroying Jar Jar Lync | Fatih Ozavci | 01h 05m |
by Fatih Ozavci
Enterprise companies are increasingly using Microsoft Lync 2010/2013 (a.k.a Skype for Business 2015) services as call centre, internal… | ||
| Faux Disk Encryption: Realities of Secure Storage On Mobile Devices | Daniel Mayer, Drew Suarez | 57m |
Mobile devices store long‑lived tokens and offline caches, and attackers succeed because whole‑stack weaknesses matter: iOS ties file keys to hardware plus a… | ||
| New (And Newly - Changed) Fully Qualified Doman Names: A View of Worldwide Changes to DNS | Paul Vixie | 58m |
Farsight builds two real‑time feeds — a newly‑observed FQDN stream (roughly 150–300 new hostnames per second, about one new delegation per second or… | ||
| Self-Driving and Connected Cars: Fooling Sensors and Tracking Drivers | Jonathan Petit | 01h 06m |
Remote attacks use cheap optics and hobby electronics to blind cameras and spoof LiDAR: a Mobileye-style camera is sensitive to 650 nm lasers and 940 nm LED… | ||
| Vulnerability Exploitation In Docker Container Environments | Anthony Bettini | 49m |
Analysis finds over 90% official images vulnerable and an average >20 CVEs per image on Docker Hub, with examples like a MySQL image showing ~30 CVEs and an… | ||
| All your Root Checks Belong To Us: The Sad State of Root Detection | Azzedine Benameur, Nathan Evans, Yun Shen | 31m |
Static analysis of popular consumer and enterprise Android security/MDM apps finds most root checks are trivial: looking for /system/xbin/su, PATH entries… | ||
| Bypassing Local Windows Authentication To Defeat Full Disk Encryption | Ian Haken | 26m |
Demonstrates a platform‑independent way to defeat BitLocker when no pre‑boot authentication is set by running a fake domain controller (using samba) that… | ||
| New Tool For Discovering Flash player 0-Day Attacks in the Wild from Various Channels | Peter Pi | 17m |
Claims 2015 is the Year of Flash and documents finding several Flash 0-days (starting CVE-2015-0310 through CVE-2015-7645) and reporting dozens of Android bugs… | ||
| Triaging Crashed With Backward Taint Analysis For Arm Architecture | Kim Dongwoo, Sangwho Kim | 24m |
A set of tools is developed for crash analysis on Linux ARM: ARM-Tracer is a ptrace-based DBI that records execution until a crash, handling ARM/thumb… | ||
| Locknote: Conclusions and Key Takeaways from | Jeff Moss, Marion Marschalek, Haroon Meer, Jennifer Savage | 45m |
Conference totals hit a record 1,500 attendees and ~30 sponsors, and organizers move Black Hat to London Nov 1–4 next year. Key specifics: cheap attacks… | ||
| nothing matches | ||