Black Hat Europe 2017
2017-12-04..2017-12-07
London, United Kingdom
[Black Hat Europe 2014, Black Hat Europe 2015, Black Hat Europe 2017, Black Hat Europe 2018, Black Hat Europe 2019, Black Hat Europe 2022, Black Hat Europe 2023]
| title | author | length |
|---|---|---|
| Day 1 Keynote: Diplomacy and Combating Evolving International Cyber Threats | Chris Painter | 01h 01m |
Argues that cyber is now a core national-security and foreign-policy issue, backed by concrete moves: creation of a State Department cyber office and roughly… | ||
| Day 2 Keynote: Security Through Distrusting | Joanna Rutkowska | 57m |
Argues for designing systems that distrust nearly everything and gives concrete mitigations: physically removed microphones + Bluetooth headsets to block… | ||
| BlueBorne - A New Class of Airborne Attacks that can Remotely Compromise Any Linux/IoT Device | Ben Seri, Gregory Vishnepolsky | 57m |
BlueBorne describes an airborne Bluetooth attack class that achieves remote code execution by abusing an L2CAP conf_rsp parsing stack overflow and an… | ||
| How to Rob a Bank over the Phone - Lessons Learned from an Actual Social Engineering Engagement | Joshua Crumbaugh | 48m |
A red team recreates a real social‑engineering engagement using recorded audio and recon shows an ISP outage lever to pose as QA, then uses four staged calls… | ||
| Nation-State Moneymule's Hunting Season – APT Attacks Targeting Financial Institutions | Chi-en (Ashley) Shen, Kyoung-ju Kwak, Min-Chang Jang | 01h 02m |
Five recent operations are disclosed against banks, ATM operators and Bitcoin exchanges by Lazarus, Bluenoroff and Andariel: a South Korean major bank breach… | ||
| Intel ME: Flash File System Explained | Dmitry Sklyarov | 53m |
Explains the ME 11.x on-flash layout with precise constants: 8 KB pages, every 12th page is a system page, 64-byte payload chunks, 120/122 chunks per page… | ||
| CLKscrew: Exposing The Perils of Security-Oblivious Energy Management | Adrian Tang, Simha Sethumadhavan, Salvatore Stolfo | 54m |
A new software-only fault class called CLKSCREW manipulates DVFS by writing the memory-mapped regulator registers exposed to drivers/debugfs to push… | ||
| Automatic Discovery of Evasion Vulnerabilities Using Targeted Protocol Fuzzing | Antti Levomäki, Olli-Pekka Niemi | 45m |
Automated fuzzing framework builds and runs realistic exploits (MSRPC, PHP/HTTP, Heartbleed/OpenSSL, SMB) with randomized protocol evasions to find gaps in… | ||
| Attacking NextGen Roaming Networks | Hendrik Schmidt, Daniel Mende | 01h 00m |
Explains how Diameter replaces SS7 for roaming, highlights S6A messages (notably Diameter S6A authentication information request returns SIM crypto keys) and… | ||
| Dealing The Perfect Hand - Shuffling Memory Blocks On z/OS | Ayoub Elaassal | 46m |
Shows how attackers get shells and escalate to SPECIAL/OPERATIONS on IBM Z running z/OS by combining cleartext TN3270 sniffing, brute forcing predictable… | ||
| By-Design Backdooring of Encryption System - Can We Trust Foreign Encryption Algorithms | Eric Filiol, Arnaud Bannier | 50m |
Claims a method to insert a mathematical backdoor into an AES‑like block cipher and demonstrates it by building a working cipher with a secret linear partition… | ||
| Breaking Bad: Stealing Patient Data Through Medical Devices | Saurabh Harit | 58m |
Researchers escalate a Windows 10 digital‑pen to local admin by replacing a manufacturer service binary, reverse‑engineer its proprietary decryption, and… | ||
| Zero Days, Thousands of Nights: The Life & Times of Zero-Day Vulns and Their Exploits | Lillian Ablon | 56m |
RAND analyzes a private dataset of ~200 zero-days spanning 14 years from 64 vendors and finds over half still unknown, an average lifespan of ~7 years, and a… | ||
| Key Reinstallation Attacks: Breaking the WPA2 Protocol | Mathy Vanhoef | 47m |
A practical exploit forces reinstallation of an already-used WPA2 key by replaying a retransmitted Message 3 of the four‑way handshake, which resets the packet… | ||
| Red Team Techniques for Evading, Bypassing & Disabling MS | Chris Thompson | 58m |
Windows Defender ATP runs on over 2 million devices and combines host telemetry with cloud analytics; the talk demonstrates concrete evasion and disabling… | ||
| Jailbreaking Apple Watch | Max Bazaliy | 30m |
Claims a working first public Apple Watch jailbreak that achieves kernel code execution on watchOS 2 and 3 by chaining a sandboxed app extension exploit to a… | ||
| The Spear to Break the Security Wall of S7Commplus | Lei Cheng | 29m |
Demonstrates a practical break of S7CommPlus by reverse‑debugging the Siemens client binary to recover three proprietary encryptions, one simple XOR chain and… | ||
| Becoming You: A Glimpse Into Credential Abuse | Sonia Burney, Brent Maynard | 29m |
Credential abuse is automated credential stuffing and account takeover: attackers use phishing, leaks and buy lists, then verify logins with botnets — a… | ||
| A Universal Controller to Take Over a Z-Wave Network | Loïc Rouch | 20m |
Claims that an attacker can seize an entire Z-Wave installation using only cheap, certified kit: capture the installation Home ID with a DVB‑T SDR, edit the… | ||
| How Samsung Secures Your Wallet and How To Break It | HC MA | 01h 02m |
Reverse engineering shows Samsung Pay uses MST + NFC, a SE embedded in the NFC controller, and a TSM enrollment workflow that creates a supplementary security… | ||
| Fed Up Getting Shattered and Log Jammed? A New Generation of Crypto Is Coming | David Wong | 51m |
SHA-3 (Keccak) wins a five-year, 64-candidate NIST contest and becomes FIPS 202 in 2015; SHAKE XOF and related functions are standardized. A duplex sponge… | ||
| Wi-Fi Direct To Hell: Attacking Wi-Fi Direct Protocol Implementations | Andrés Blanco | 56m |
Wi‑Fi Direct implementations on Android, HP printers and Samsung Smart TVs expose concrete flaws: printers ship as group owners with 12345678 default… | ||
| Enraptured Minds: Strategic Gaming of Cognitive Mindhacks | Vladimir Kropotov, Fyodor Yarochkin, Lion Gu | 55m |
Demonstrates concrete tools, markets and measurements used to manipulate mass opinion: underground sellers offer €7,000 guaranteed top‑5 YouTube placement… | ||
| Inside Android's SafetyNet Attestation | Collin Mulliner, John Kozyrakis | 01h 01m |
SafetyNet is the primary security platform used by Google to keep the Android ecosystem in check. SafetyNet Attestation is a service offered by the SafetyNet… | ||
| A Retrospective Case Study of VMware Guest-to-Host Escape Vulnerabilities | Debasish Mandal, Yakun Zhang | 56m |
Patch diffing of VMware Workstation and Fusion reveals concrete exploit primitives across three surfaces: vmtoolsd.dll RPC send is abused via crafted RPC… | ||
| Ro(o)tten Apples: Vulnerability Heaven in the iOS Sandbox | Adam Donenfeld | 50m |
Finds a chain in the AppleAVE IOKit driver that yields a full kernel privilege escalation bypassing KPP/AMCC and SMAP/PAN by combining an infoleak of IOSurface… | ||
| Heap Layout Optimisation for Exploitation | Sean Heelan | 37m |
Claims an automatic pseudo-random blackbox search that manipulates heap layout by composing PHP fragments, discovers allocator interactions via PHP fragment… | ||
| Breaking Out HSTS (and HPKP) On Firefox, IE/Edge and (Possibly) Chrome | Sheila Berta, Sergio De Los Santos | 46m |
Demonstrates reproducible attacks that make browsers forget or ignore HSTS/HPKP by stuffing their stores: a JavaScript + mitm flow fills Firefox's 24-slot HSTS… | ||
| Exfiltrating Reconnaissance Data from Air-Gapped ICS/SCADA Networks | David Atch, George Lashenko | 47m |
Demonstrates a working exfiltration channel that encodes reconnaissance data from ladder logic on a PLC into low-frequency EM emissions, captured with an SDR… | ||
| CALDERA: Automating Adversary Emulation | Douglas Miller, Andy Applebaum | 52m |
CALDERA is an open source system that automates post‑compromise adversary emulation by encoding MITRE ATT&CK techniques as actions with preconditions and… | ||
| Lost in Transaction: Process Doppelgänging | Tal Liberman, Eugene Kogan | 49m |
Introduces Process Doppelgänging, which writes malicious bytes into a file inside an NTFS transaction, creates a memory section from that transacted file… | ||
| A Process is No One: Hunting for Token Manipulation | Jared Atkinson, Robby Winchester | 54m |
A hypothesis-driven hunt targets access token manipulation by instrumenting 11 Windows hosts with PowerShell remoting, running custom collectors… | ||
| Exposing Hidden Exploitable Behaviors In Programming Languages Using Differential Fuzzing | Fernando Arnaboldi | 26m |
A Python project performs differential fuzzing across JavaScript Perl PHP Python and Ruby implementations and reports concrete, reproducible surprises… | ||
| Attacks Against GSMA's M2M Remote Provisioning | Maxime Meyer | 30m |
Analyzes GSMA eUICC remote-provisioning and shows a protocol flaw where a single-message drop during profile-container creation leaves an orphaned profile… | ||
| I Trust My Zombies: A Trust-Enabled Botnet | Emmanouil Vasilomanolakis, Max Mühlhäuser, Jan Helge Wolf, Leon Böck, Shankar Karuppayah | 31m |
Defending against botnets has always been a cat and mouse game. Cyber-security researchers and government agencies attempt to detect and take down botnets by… | ||
| GDPR and Third Party JS - Can It Be Done? | Avital Grushcovski | 30m |
Demonstrates that adding one remote script can read forms, hijack clicks and exfiltrate credentials (demo against a bank site), notes a real… | ||
| Self-Verifying Authentication – A Framework For Safer Integrations of Single-Sign-On Services | Shuo Chen, Shaz Qadeer, Matt McCutchen, Phuong M. Cao, Ravishankar K. Iyer | 57m |
Finds real SSO logic flaws (Azure AD nodejs identity spoof, Skype locking request forgery, OAuth access‑token misuse) and builds a runtime verification layer… | ||
| DIFUZE: Android Kernel Driver Fuzzing | Aravind Machiry, Chris Salls, Yan Shoshitaishvili, Shuang Hao, Jake Corina | 53m |
Difuze compiles kernel sources to LLVM bitcode, extracts ioctl handlers and device names, recovers command IDs and C struct layouts, then generates concrete… | ||
| How to Hack a Turned-Off Computer, or Running Unsigned Code in Intel Management Engine | Maxim Goryachy, Mark Ermolov | 47m |
They disclose a reproducible exploit that achieves arbitrary unsigned code in Intel ME by abusing an emFS file parser to trigger a stack buffer overflow in Bob… | ||
| Passive Fingerprinting of HTTP/2 Clients | Elad Shuster, Ory Segal | 48m |
Analysis of 10 million HTTP/2 connections and 40,000+ unique user agents from Akamai logs produces fingerprints built from the exact settings frame parameters… | ||
| The Apple of Your EFI: An Updated Study of EFI Security | Rich Smith, Pepijn Bruienne | 01h 01m |
Duo Labs extracts every Apple OS/security update from OS X 10.10 through macOS 10.13, catalogs build number + board ID + EFI version, and compares that to… | ||
| Hiding PIN's Artifacts to Defeat Evasive Malware | Mario Polino, Andrea Continella, Sebastiano Mariani, Lorenzo Fontana, Stefano D'Alessio, Fabio Gritti, Stefano Zanero | 55m |
Describes a DBI-hardening framework built on Intel Pin with a pattern-matching module that patches INT 0x2E and FP checks, a fake read handler module that… | ||
| Locknote: Conclusions and Key Takeaways From Black Hat Europe 2017 | Jeff Moss, Sharon Conheady, Andreas Lindh, Shawn Moyer | 44m |
Conference concludes that hardware trust is broken: Intel ME and UEFI bugs persist, privileged subsystems can be compromised for years without detection… | ||
| nothing matches | ||