Black Hat Europe 2019
2019-12-02..2019-12-05
London, United Kingdom
[Black Hat Europe 2014, Black Hat Europe 2015, Black Hat Europe 2017, Black Hat Europe 2018, Black Hat Europe 2019, Black Hat Europe 2022, Black Hat Europe 2023]
| title | author | length |
|---|---|---|
| Black Hat Europe 2019 Highlights | 02m | |
-- no description -- | ||
| Unveiling the Underground World of Anti-Cheats | Joel Noguera | 41m |
Shows concrete bypasses: inject a DLL into LSASS and tunnel commands over a named-pipe to use its process handle, then replace pipes with file-mapping without… | ||
| Mobile Network Hacking, IP Edition | Karsten Nohl, Luca Melette, Sina Yazdanmehr | 48m |
Measurements show about 100 networks advertise RCS support (rough lower bound) and DNS scans find ~200 VoLTE and ~150 VoWiFi deployments. Custom tooling crafts… | ||
| HTTP Desync Attacks: Request Smuggling Reborn | James Kettle | 48m |
Remote unauthenticated HTTP desync lets an attacker make a backend treat an injected prefix as a separate request by abusing mismatched parsing of… | ||
| Implementing the Lessons Learned From a Major Cyber Attack | Andy Powell | 51m |
Maersk recounts that NotPetya knocks out most services within seven minutes and does the bulk of damage in an hour, wiping online backups and all but one… | ||
| Blue to Red: Traversing the Spectrum | Amanda Rousseau | 01h 27m |
Blue to Red: Traversing the Spectrum
by Amanda Rousseau
The rising demand for talent to fill thousands of open roles in the security industry has resulted in… | ||
| Simple Spyware: Android's Invisible Foreground Services and How to (Ab)use Them | Thomas Sutter, Bernhard Tellenbach | 25m |
Researchers demonstrate a simple-to-implement Android spyware that abuses invisible foreground services to collect sensitive data despite the platform’s… | ||
| How to Break PDF Encryption | Jens Muller, Fabian Ising | 44m |
PDF encryption contains two concrete, working break techniques: PDF X uses PDF’s partial-encryption and form/hyperlink actions to siphon plaintext (demo leaks… | ||
| Exploiting Windows Hello for Business | Michael Grafnetter | 40m |
Ability to write arbitrary public keys into MSDS-KeyCredentialLink on Windows Server 2016 DCs with KDC certs enables persistence: a self-signed cert injected… | ||
| Conducting a Successful False Flag Cyber Operation (Blame it on China) | Jake Williams | 49m |
False-flag operations target every phase of the kill chain: buy VPS in patsy countries (WHMTop), change user-agent/accept-language to Yandex/Baidu, use SSH… | ||
| Chain of Fools: An Exploration of Certificate Chain Validation Mishaps | James Barclay, Nick Mooney, Olabode Anise | 48m |
Paper argues poor crypto APIs and bad online advice let implementers accept attacker-supplied intermediates, demonstrating misuse in PI OpenSSL x.509 store… | ||
| Advanced VBA Macros Attack & Defence | Philippe Lagadec | 51m |
VBA macros remain a primary malware delivery vector in 2019, with campaigns like Emotet sending hundreds of thousands of phishing emails daily; attackers use… | ||
| ClusterFuzz: Fuzzing at Google Scale | Abhishek Arya, Oliver Chang | 01h 00m |
ClusterFuzz runs fuzzing at Google scale: a public infrastructure powering OSS-Fuzz and Google fuzzing across 25,000 cores, about 2,500 targets, and finds over… | ||
| New Exploit Technique In Java Deserialization Attack | Yongtao Wang, Lucas Zhang, Kunzhe Chai | 51m |
An analysis of 10,000+ libraries uncovers two practical exploit vectors: a URLConnection path that causes Java to leak NTLM creds and enables an HTTP-to-SMB… | ||
| Booting the iOS Kernel to an Interactive Bash Shell on QEMU | Jonathan Afek | 41m |
Boots an unpatched iOS kernel (iOS 12.1 for iPhone 6s Plus) on QEMU, runs the secure monitor in EL3 and the kernel in EL1, and presents a working interactive… | ||
| Breaking Bootloaders on the Cheap | Qais Temeiza, David Oswald | 25m |
Reverse‑engineers target NXP LPC1343, ST STM32F4 and ST STM8 bootloaders and find a LPC1343 vulnerability: the bootloader’s Write to RAM command lacks… | ||
| Alexa, Hack My Server(less) Please | Tal Melamed | 48m |
Demonstrates concrete serverless failures: exploiting node-serialize code injection and command injection in Lambda functions to read /tmp and pull down… | ||
| What the Fuzz | Cornelius Aschermann, Sergej Schumilo | 50m |
A binary-only, coverage-guided hypervisor fuzzer uses Intel PT traces and implements Fast VM reloads to reach up to 6,000 VM reloads/sec and sustain as many as… | ||
| Fatal Fury on ESP32: Time to Release Hardware Exploits | Limited Results | 48m |
Methodical, hands-on account of breaking ESP32 hardware security: uses low-cost rigs (glitcher based on MAX4619, USB FTDI JTAG, oscilloscope, Python… | ||
| Fuzzing and Exploiting Virtual Channels in Microsoft Remote Desktop Protocol for Fun and Profit | Chun Sung Park, Yeongjin Jang, Seungjoo Kim, Ki Taek Lee | 39m |
A custom WinAFL fork is adapted to send mutated inputs over RDP virtual channels using WinAFL with DynamoRIO process mode and seed logging from the SND… | ||
| Side Channel Attacks in 4G and 5G Cellular Networks | Syed Hussain | 25m |
This talk first presents how the fixed nature of paging occasions can be exploited as a side-channel by an adversary in the vicinity of a victim to associate… | ||
| Locknote: Conclusions and Key Takeaways | Jeff Moss, Daniel Cuthbert, Leigh-Anne Galloway, Marina Krotofil | 52m |
Review board members describe spending dozens of hours (one estimates ~30) vetting submissions and note 14 talks from Microsoft and Google and a joint… | ||
| OEM Finder: Hunting Vulnerable OEM IoT Devices at Scale | Asuka Nakajima | 20m |
A tool named OEM Finder analyzes image keypoints with a Cazza-style object recognition, Manhattan-distance matching, relative neighborhood graphs and a… | ||
| Practical Side-Channel Attacks Against WPA-TKIP | Domien Schepers, Mathy Vanhoef | 34m |
Wardriving finds 44.81% of encrypted Wi‑Fi networks still allow WPA‑TKIP, so the team develops practical side‑channel decryptions that recover the last 12… | ||
| Trust in Apple's Secret Garden: Exploring & Reversing Apple's Continuity Protocol | Ta-Lun Yen | 40m |
Reverse engineering of Apple Continuity reveals concrete privacy failures: protocol messages and handoff counters leak OS version, device type, battery and… | ||
| Money Doesn't Stink - Cybercriminal Business Insight of A New Android Botnet | Sebastián García, María José Erquiaga, Anna Shirokova | 51m |
Researchers execute an HD bot inside a lab, intercept bidirectional traffic and reconstruct a separate Android botnet (called Geost/Girls) that exfiltrates SMS… | ||
| Reverse Engineering and Exploiting Builds in the Cloud | Etienne Stalmans, Chris Le Roy, Matthias Luft | 47m |
Shows concrete exploits against cloud CI: Google Cloud Build demo uses Docker ADD to bypass intermediate-network isolation, fetch metadata and an OAuth token… | ||
| BluePill: Neutralizing Anti-Analysis Behavior in Malware Dissection | Daniele Cono D'Elia | 20m |
BluePill is a DBI-based framework (Intel PIN) that intercepts system calls and low-level instructions to observe, check, replace evasive queries, fuzzing… | ||
| Thinking Outside the JIT Compiler | Yong Wang | 22m |
Describes a generic, non-JIT method that bypasses WebKit’s StructureID Randomization to build addrOf/fakeObj primitives and achieve arbitrary Read/Write. Uses… | ||
| Understanding the IoT Threat Landscape | Hikohiro Y Lin, Yuki Osawa | 29m |
Panasonic describes a deployed IoT Threat Intelligence Platform that collects via software and nine physical honeypots and analyzes samples with automated… | ||
| Unleashing the Power of My 20+ Years Old Car | Stanislas Lejay | 18m |
A 1997 manufacturer model (factory 300 hp) has its ECU dumped (64 KB) over XSM1 serial protocol at ~5 queries/sec, taking nine hours. Reverse engineering… | ||
| Inside Out - The Cloud has Never been so Close | Igal Gofman, Yaron Shani | 22m |
Claims that mapping real AWS IAM, Lambda, EC2 and S3 metadata into a graph uncovers concrete privilege escalation chains, for example stolen long‑term keys on… | ||
| Doors of Durin: The Veiled Gate to Siemens S7 Silicon | Ali Abbasi, Tobias Scharnowski, Thorsten Holz | 48m |
Research uncovers a UART MFGT1 handshake in the S7-1200 bootloader that opens a diagnostic console; bootloader uses CRC32 (not cryptographic) for firmware… | ||
| Bring Your Own Token to Replace the Traditional Smartcards for Strong Authentication and Signing | Karthik Ramasamy, Eric Hampshire | 51m |
Cisco replaces badge-based smartcards with a Bring-Your-Own-Token system using YubiKey 4/5 (firmware ≥4.3.5) and PIV/CCID, adds a self-service Crypto ID portal… | ||
| Is Your Mental Health for Sale? | Eliot Bendinelli, Frederike Kaltheuner | 50m |
136 popular mental‑health pages across France, Germany and the UK are scanned with WebXRay and HTTP Toolkit; 97.78% of pages contact third parties and many set… | ||
| Far Sides of Java Remote Protocols | An Trinh | 45m |
Research finds 100% of products tested expose at least one exploitable flaw in Java RMI/CORBA stacks; concrete attacks include sending crafted RMI headers then… | ||
| BlueMaster: Bypassing and Fixing Bluetooth-based Proximity Authentication | Youngman Jung, Junbum Shin, Yeongjin Jang | 46m |
Researchers disclose three practical attacks that bypass Android Smart Lock and Windows Dynamic Lock by abusing Bluetooth properties: SDP-based spoofing lets… | ||
| Detecting (un)Intentionally Hidden Injected Code by Examining Page Table Entries | Frank Block | 27m |
Demonstrates that common memory-forensic plugins (malfind, hashtest, psinfo) miss injected, executable code when page protections are manipulated per-page or… | ||
| Decisions and Revisions - The Ever Evolving Face of the Black Hat NOC | Neil R. Wyler, Bart Stump | 47m |
Black Hat NOC describes concrete tooling and results: core firewall is Palo Alto, packet collection uses Gigamon taps, sandboxing goes to Cisco Threat Grid and… | ||
| Bypassing KPTI Using the Speculative Behavior of the SWAPGS Instruction | Andrei Lutas, Dan Lutas | 49m |
Claim: SWAPGS executes speculatively and can be abused to swap GS bases during a mispredicted kernel path, letting unprivileged code make the kernel… | ||
| Tackling Privilege Escalation with Offense and Defense | Abdul Aziz Hariri, Edgar Pek | 48m |
Researchers report a sequence of concrete exploits and fixes against Acrobat’s JavaScript engine: a decompiled folder-level bin reveals folder‑level trusted… | ||
| Hackers, Journalists and the Ethical Swamp | Geoff White | 51m |
Five concrete cases show how leaks and hacks are weaponized: LulzSec hacked CMS to swap The Sun’s front page at the Sky News review (members go to prison)… | ||
| Hands Off and Putting SLAB/SLUB Feng Shui in a Blackbox | Yueqi Chen, Xinyu Xing, Jimmy Su | 44m |
Automated technique maps kernel allocation sites to usable objects and system calls, builds a kernel object database via static analysis plus targeted fuzzing… | ||
| Security Holes in the Integration and Management of Messaging Protocols on Commercial IoT Clouds | Yan Jia, Luyi Xing, Yuqing Zhang | 37m |
In this presentation, we report the first systematic study on the protection that leading commercial IoT clouds (e.g., AWS IoT Core, IBM Watson IoT, Azure IoT… | ||
| nothing matches | ||