Black Hat Europe 2018
2018-12-03..2018-12-06
London, United Kingdom
[Black Hat Europe 2014, Black Hat Europe 2015, Black Hat Europe 2017, Black Hat Europe 2018, Black Hat Europe 2019, Black Hat Europe 2022, Black Hat Europe 2023]
who it's for
security researchers, incident responders, vulnerability researchers, exploit developers, security engineers, malware analysts, blockchain engineers, hardware security engineers
topics
DeepPhish AI phishing generation; BLE firmware vulnerabilities in APs; UEFI SPI flash rootkits; XNU kernel fuzzing and sanitizers; per-driver EPT isolation; powerbank-based data exfiltration; blockchain wallet and smart contract bugs; container sandbox attacks for microservices; elliptic curve implementation measurements; guest-to-host VM SVGA escapes; secure boot fault attack simulations; physical adversarial attacks and deepfakes
| title | author | length |
|---|---|---|
| Black Hat Europe 2018 Keynote | Marina Kaljurand | 45m |
Estonia’s 2007 DDoS crisis is presented as the catalyst for national cyber policy: nationwide resilience, e‑government services (e‑residency that enables… | ||
| DeepPhish: Simulating Malicious AI | Alejandro Correa Bahnsen | 51m |
Builds practical models that actually work: a char-level LSTM URL classifier trained on millions of URLs hits ~99% accuracy and runs on mobile; a certificate… | ||
| BLEEDINGBIT: Your APs Belong to Us | Ben Seri, Armis Dor Zusman | 47m |
Claims two zero‑days in Texas Instruments BLE chips embedded in Cisco/Meraki/Aruba APs: one is a custom OAD path in Aruba that accepts a hardcoded OAD unlock… | ||
| Attacking and Defending Blockchains: From Horror Stories to Secure Wallets | Jean-Philippe Aumasson | 49m |
Survey of real failures: 2010 Bitcoin overflow fixed in five hours, DAO reentrancy steals tens of millions, Parity library init bug freezes wallets, plus a… | ||
| Under the SEA - A Look at the Syrian Electronic Army's Mobile Tooling | Kristin Del Rosso, Michael Flossman | 26m |
The Syrian Electronic Army builds and operates a custom Android surveillance family called SilverHawk (active since mid‑2016) that trojanizes WhatsApp/Telegram… | ||
| Drill Apple Core: Up and Down - Fuzz Apple Core Component in Kernel and User Mode for Fun and Profit | Dongyang Wu, Yuefeng Li, Juwei Lin | 49m |
A fuzzing platform adds code-coverage in XNU and kernel sanitizers (KASAN-like shadow memory, init-memory checks), implements a Mersenne-twister seedable… | ||
| Malware Buried Deep Down the SPI Flash: Sednit's First UEFI Rootkit Found in the Wild | Jean-Ian Boutin, Frederic Vachon | 50m |
Claimed Sednit (Fancy Bear/APT28) implants a UEFI rootkit in SPI flash and it is the first such sample found live; attackers use an unsigned kernel driver (the… | ||
| No Free Charge Theorem 2.0: How to Steal Private Information from a Mobile Device Using a Powerbank | Riccardo Spolaor, Riccardo Bonafede, Veelasha Moonsamy, Mauro Conti | 39m |
Demonstrates a practical covert channel that encodes data as CPU-driven current bursts measured over the charging line, claims successful exfiltration from… | ||
| SDL at Scale: Growing Security Champions | Ryan O'Boyle | 54m |
Claim: embedding two champions per team scales product security to agile release cadence. Program grows over 5 years using CTF sessions, lunch‑and‑learns and… | ||
| DeepPhish: Simulating Malicious AI | Alejandro Correa Bahnsen | 51m |
A char-level RNN/LSTM model runs on URLs and reaches about 98–99% accuracy on ~2 million samples, implemented in Python/Keras and runnable on mobile; a second… | ||
| Divide et Impera: MemoryRanger Runs Drivers in Isolated Kernel Spaces | Igor Korkin | 51m |
MemoryRanger claims to stop driver code-dumps, data theft and PROCESS privilege escalation by running each third-party driver in per-driver EPT enclaves… | ||
| Real-Time Detection of Attacks Leveraging Domain Administrator Privilege | Wataru Matsuda, Mariko Fujimoto, Takuho Mitsunaga | 25m |
Claims a real-time detection method that flags activities using Domain Administrator privileges — including Golden Ticket impersonation — by ingesting only… | ||
| Attacking and Defending Blockchains: From Horror Stories to Secure Wallets | Jean-Philippe Aumasson | 49m |
Survey of concrete failures and fixes: a 2010 Bitcoin integer overflow briefly creates billions and is patched in 25 hours; the DAO smart contract loses… | ||
| Eternal War in XNU Kernel Objects | Min (Spark) Zheng, Xiaolong Bai | 37m |
Claims that Apple mitigations are bypassable by corrupting IPC objects and formalizes the attack as ipc_port Kernel Object-Oriented Programming; uses XNU… | ||
| Where 2 Worlds Collide: Bringing Mimikatz et al to UNIX | Tim (Wadhwa-)Brown | 44m |
Claims that Active Directory–joined UNIX boxes let attackers escalate into the AD forest with concrete artifacts: proof-of-concept mimikatz-like Unix tools… | ||
| A Measured Response to a Grain of Rice | Joe FitzPatrick | 51m |
Shows concrete, tested attacks and cheap proofs of concept: fake USB security tokens (DoB key fake YubiKey), an RSA token opened and soldered with a Bluetooth… | ||
| Container Attack Surface Reduction Beyond Name Space Isolation | Azzedine Benameur, Chien-An (Jay) Chen, Lei Ding, Michalis Polychronakis | 50m |
Analyzes hundreds of Docker images with Clair scanner and finds thousands of vulnerabilities living in dependencies and unused binaries, then implements a… | ||
| Keeping Secrets: Emerging Practice in Database Encryption | Kenn White | 41m |
Provides concrete advice for protecting high‑sensitivity databases: threat models show volume encryption protects only against disk repurposing, not insiders… | ||
| The Undeniable Truth | Lachlan Gunn, Ricardo Vieitez Parra, N Asokan | 50m |
Claim: remote attestation lets an attacker turn cryptographic deniability into transferable proof. Implementation: modified Signal CLI that moves Signal’s… | ||
| Video Killed the Text Star: OSINT Approach | Francisco Gomez, Cesar Jimenez | 38m |
Real-time pipeline ingests YouTube frames with OpenCV + Apache Storm, detects faces with HOG for speed and trains models offline with CNNs, producing 128‑dim… | ||
| When Everyone's Dog is Named Fluffy | Magal Baz, Tom Sela | 23m |
Demonstrates a working domain‑wide persistence method that remotely writes JSON answers into LSA secrets by changing registry ACLs (proof‑of‑concept Python)… | ||
| AI Gone Rogue: Exterminating Deep Fakes Before They Cause Menace | Vijay Thaware, Niranjan Agnihotri | 30m |
Prototype uses FaceNet encodings to fingerprint faces and compares per-frame vectors against a labeled database; experiments run on a small set including 26… | ||
| Broken Links: Emergence and Future of Software-Supply Chain Compromises | Ryan Kazanciyan | 30m |
Charting real incidents shows supply-chain compromises using signed binaries, package repos and app stores to reach millions: HandBrake distributes Proton Mac… | ||
| In Search of CurveSwap: Measuring Elliptic Curve Implementations in the Wild | Nick Sullivan, Luke Valenta | 26m |
Internet-wide ZMap scans contact 41 million IPv4 hosts and find 28.8 million supporting ECDH, with 22% of TLS servers reusing ephemeral keys and 8,000+ servers… | ||
| The Last Line of Defense: Understanding and Attacking Apple File System on iOS | Xiaolong Bai, Min (Spark) Zheng | 25m |
Shows a concrete exploit that bypasses APFS snapshot-based remount mitigation to make the read-only root appear writable by swapping mount internals: create a… | ||
| Deep Impact: Recognizing Unknown Malicious Activities from Zero Knowledge | Hiroshi Suzuki, Hisao Nashiwa | 50m |
Converts per-host proxy logs into 60×1 images and trains a CNN on synthetic C2 patterns (no malware IOCs) to flag periodic beaconing; model detects all 11 live… | ||
| RustZone: Writing Trusted Applications in Rust | Eric Evenchick | 48m |
Claim: Rust can replace C for ARM TrustZone trusted apps by eliminating many memory bugs. The project uses bindgen to convert OP-TEE C headers to Rust… | ||
| Straight Outta VMware: Modern Exploitation of the SVGA Device for Guest-to-Host Escapes | Zisis Sialveras | 48m |
Analyzes modern exploitation of VMware Workstation's virtual SVGA graphics device to achieve guest-to-host code execution. Covers the SVGA graphics pipeline… | ||
| Attacking Hardware Systems Using Resonance and the Laws of Physics | Ivan Reedman | 46m |
Finds that tiny mixed‑signal logic can be forced into a resonance — observed around 23.236 MHz resonant peak — producing an analog AC on outputs that… | ||
| Evolving Security Experts Among Teenagers | Nahman Khayet, Shlomi Boutnaru | 48m |
Claims a scalable pipeline built in Israel that turns middle- and high-schoolers into hireable security talent: public programs like Maximum national cyber… | ||
| I Block You Because I Love You: Social Account Identification Attack Against a Website Visitor | Takuya Watanabe | 40m |
A practical side-channel attack is demonstrated that reveals which social web service account belongs to a visitor of an attacker-controlled website. The… | ||
| Perfectly Deniable Steganographic Disk Encryption | Dominic Schaub | 50m |
A working steganographic disk system is implemented as a Linux kernel module (about 30,000 lines) plus tiny assembly bootstraps that self‑bootstrap from… | ||
| BLEEDINGBIT: Your APs Belong to Us | Ben Seri, Dor Zusman | 47m |
Two zero‑day bugs in Texas Instruments BLE chips (used in Cisco, Meraki, Aruba APs) allow unauthenticated over‑the‑air compromise: an OAD over‑the‑air firmware… | ||
| Network Defender Archeology: An NSM Case Study in Lateral Movement with DCOM | Justin Warner, Alex Sirr | 50m |
Shows that DCOM can execute code remotely (PowerShell executeShellCommand and Excel loading an arbitrary DLL) and popped calc.exe via DCOM during demos. Walks… | ||
| Perception Deception: Physical Adversarial Attack Challenges | Zhenyu Zhong, Weilin Xu, Yunhan Jia, Tao Wei | 55m |
Demonstrates adapting digital adversarial methods to create printable physical patches that fool YOLOv3 under white‑box conditions. Uses differentiable resize… | ||
| Cutting Edge: Microsoft Browser Security — From People Who Owned It | Chuanda Ding, Zhipeng Huo, Wei Wei | 44m |
Deep dive into Edge internals reveals concrete exploit chains: researchers extract how UWP lowbox tokens are derived from package seeds, enumerate IPC (RPC… | ||
| Secure Boot Under Attack: Simulation to Enhance Fault Attacks & Defenses | Martijn Bogaard, Niek Timmers | 51m |
Claims that a carefully modeled voltage-glitch simulation finds concrete bypass points in Secure Boot by flipping instruction or data bits, and that those… | ||
| Level Up Your Security Mindset | Nathan Hamiel | 48m |
Argues that security needs a concrete mindset shift: prioritize engineering security by default, measure risk reduction instead of chasing worst‑case… | ||
| How to Build Synthetic Persons in Cyberspace | Fernando Maymi, Alex Nickels | 50m |
Built a family of Cyberspace Cognitive agents — CyCog-A, CyCog-D — inside a single VM that runs standard tools (nmap, sqlmap, snort, iptables) with an IRC C2… | ||
| When Machines Can't Talk | Federico Maggi, Davide Quarta | 45m |
Security analysis of MQTT & CoAP finds specification flaws, implementation bugs and mass misconfiguration: message leaks from CNCs, laser cutters and… | ||
| Cloud-Native Sandboxes for Microservices: Understanding New Threats and Attacks | Tongbo Luo, Zhaoyan Xu | 25m |
A container-native sandbox integrates with Kubernetes via a CRD to reconstruct real execution environments from Dockerfiles, image names or live cluster… | ||
| Off-Path Attacks Against PKI | Haya Shulman, Elias Heftrig | 24m |
An off path attacker forges a CA-signed certificate by forcing DNS responses to fragment, guessing the IP ID and UDP checksum, and injecting a spoofed second… | ||
| The Mummy 2018 – Microsoft Accidentally Summons Back Ugly Attacks from the Past | Ran Menscher | 24m |
Windows' IP ID generator has a trivial init bug: a random table alloc is 0x8000 bytes but only eight bytes get filled, leaving uninitialized kernel memory in… | ||
| Thermanator and the Thermal Residue Attack | Tyler Kaczmarek, Ercan Ozturk, Gene Tsudik | 25m |
Thermanator demonstrates that thermal residue on plastic external keyboards lets an attacker with a midrange thermal camera recover entire passwords up to… | ||
| Locknote: Conclusions and Key Takeaways from Black Hat Europe 2018 | Jeff Moss | 48m |
Community says attackers keep finding bugs quickly while defenders struggle to fix them, with many teams automating repetitive tasks but still burning out… | ||
| Decisions and Revisions - The Ever Evolving Face of the Black Hat NOC | Neil R. Wyler, Bart Stump | 45m |
Black Hat NOC moves from taped-on consumer kit to enterprise partners: PA‑30/50 active/passive for core, 28 Ruckus APs for Wi‑Fi serving ~1,100+ unique devices… | ||
| nothing matches | ||