Black Hat Europe 2022
2022-12-05..2022-12-08
London, United Kingdom
[Black Hat Europe 2014, Black Hat Europe 2015, Black Hat Europe 2017, Black Hat Europe 2018, Black Hat Europe 2019, Black Hat Europe 2022, Black Hat Europe 2023]
| title | author | length |
|---|---|---|
| Black Hat Europe 2022, ExCel London | 01m | |
Uploader blurb is a generic conference description and the machine transcript contains only intro music and a lone "thank you" so there is no technical… | ||
| Android Parcels: The Bad, the Good and the Better - Introducing Android's Safer Parcel | Hao Ke, Bernardo Rufino, Maria Uretsky, Yang Yang | 39m |
Explains concrete Parcel exploits and fixes: reproduces Bundle Feng Shui self‑changing bundles that enable TOCTOU attacks, and the Android 12 chain that yields… | ||
| Breaking Kerberos' RC4 Cipher and Spoofing Windows PACs | Tom Tervoort | 41m |
Finds a pre-hash bug in Kerberos RC4-HMAC that lets MD5 collisions produce matching PAC signatures, then turns it into a working exploit: uses a chosen-prefix… | ||
| Back-connect to the Connected Car. Search for Vulnerabilities in the VW Electric Car. | Alexey Kondikov, Sergey Razmakhnin, Khaled Sakr, Yuriy Serdyuk | 34m |
Penetration testing on VW ID3/ID4/ID5 reveals practical exploits: local USB or SD/MMC access lets attackers dump SPI/MMC, mount partitions and drop a… | ||
| Bridging the Gap Between Research and Practice in Intelligently Bypassing WAF | Cheng Chi | 26m |
Claims an automated bypass pipeline that uses PPO reinforcement learning to sequence small, expert-derived atomic mutations and a grammar- and lexical-based… | ||
| Choo Choo, Network Train - The One to Rule Your Perimeter | Martin Hron | 39m |
Concrete results and demos: scans find ~80% Mosquitto installations and a rise to 85,000 open servers in 2020 from ~32,000 in 2018, many allowing anonymous… | ||
| Confidence in Chaos: Strategies for World-Class Security Operations | Kathryn Knerler, Ingrid Parker, Carson Zimmerman | 32m |
Covers a concrete, actionable roadmap: an 11‑strategy SOC model (updated from 10) with a 41‑function inventory to pick from, recommendations to consolidate… | ||
| Cross-Contract Ricochet Attacks & Off-Chain-On-Chain Manipulation of Billion Dollar NFT Collections | Nitesh Dhanjani | 28m |
Shows a concrete exploit chain: list for zero off-chain on marketplaces that don’t validate listings drives the advertised floor to zero, triggers panic… | ||
| CSI:Rowhammer: Closing the Case of Half-Double and Beyond | Jonas Juffinger, Andreas Kogler | 38m |
Claims that TRR and ECC stop Rowhammer are false: Half-Double combines heavy distant hammers with a few near aggressors to force flips inside the 64 ms refresh… | ||
| Deep into Android Bluetooth Bug Hunting: New Attack Surfaces and Weak Code Patterns | Zinuo Han | 35m |
Maps Android Bluetooth internals to concrete attack surfaces and shows repeatable bugs: integer underflows in PT_HDR/deserialize math, use‑after‑free across… | ||
| DataBinding2Shell: Novel Pathways to RCE Web Frameworks | Biao He, Haowen Mu | 37m |
Researchers analyze data binding across Spring, Struts, Grails, Rails and others, report many bugs and 2 lead to remote code execution. They reverse-engineer… | ||
| Dirty Vanity: A New Approach to Code Injection & EDR Bypass | Eliran Nissan | 38m |
Dirty Vanity claims a reliable EDR bypass by abusing Windows forking: it writes shellcode into a parent process, then triggers a remote fork so execution runs… | ||
| DnD: Decompiling Deep Neural Network Compiled Binary | Antonio Bianchi, Taegyu Kim, Dave (Jing) Tian, Ruoyu Wu, Dongyan Xu | 32m |
DnD claims a recoverable high level ONNX model from CPU compiled DNN binaries by locating operator functions, doing loop analysis and symbolic execution… | ||
| Event-based Fuzzing, Patch-based Research, and Comment Police: Finding Bugs Through a Bug | Qingyu Li, Huinian Yang | 29m |
Claims a reproducible pipeline that finds 40+ Chrome and Android bugs by combining patch-analysis, event-driven fuzzing, and pattern scans. Builds a targeted… | ||
| Fail Harder: Finding Critical 0-Days in Spite of Ourselves | Philippe Laulheret, Douglas McKee | 38m |
Series of real-case failures that still lead to critical zero-days: pulled a flash chip, reprogrammed it and gets a root shell from serial console after crude… | ||
| Exploring a New Class of Kernel Exploit Primitive | Rohit Mothe, Andrew Ruddick | 33m |
Microsoft MSRC evaluates an arbitrary kernel pointer read primitive that returns no data and asks whether it can yield code execution by targeting device MMIO… | ||
| Fuzzing and Breaking Security Functions of SIMATIC PLCs | Gao Jian | 29m |
Claims cracking TLS on S7‑1500/S7‑1200 and extracting keys to build a rogue engineer station that performs S7‑1500 run stop upload project and modify control… | ||
| Good Motive but Bad Design: Pitfalls in MPU Usage in Embedded Systems in the Wild | Le Guan, Zhouqi Jiang, Wei Zhou | 32m |
Comprehensive audit of popular microcontroller RTOS finds MPU support rare and defaults minimal: only a few OS enable DEP and stack guard, and many leave MPU… | ||
| Grand Theft Drone: Reaching Breaking Point in Drone Proprietary RF Link Security | Seokhie Hong, Kwonyoup Kim, Seungjoon Lee | 40m |
Analysis shows Fr Sky access RC uses 47 channels with an exposed hopping index and a fixed hop distance 7, letting a sniffer reconstruct the base sequence… | ||
| How We Organize Large-Scale DDoS Exercises in the Netherlands | Karl Lovink, Mieke van Ulden | 35m |
A national voluntary coalition of 17 ISPs, banks, exchanges, scrubbing centers and government agencies runs twice‑yearly DDoS drills using a purpose‑built open… | ||
| Design Flaws and Deployment Chaos in Cloud-based IoT Access Control Policies | Yiwei Fang, Yan Jia, Ze Jin, Qixu Liu, Luyi Xing, Bin Yuan | 32m |
Analyzes actual cloud IoT deployments and finds concrete flaws: policy semantic gap between MQTT topic wildcards and cloud policy semantics lets hashes/plus… | ||
| Knockout Win Against TCC - 20+ NEW Ways to Bypass Your MacOS Privacy Mechanisms | Csaba Fitzl, Wojciech Reguła | 40m |
Claim: 20+ practical TCC bypasses that still work (or did) on Big Sur/Monterey/Ventura, with demos and PoCs. Examples include a CoreMedia IO plugin load that… | ||
| LCDPwn: Breaking Enterprise-Things with Layer 2 Discovery Protocol Vulnerabilities Again | Qian Chen | 35m |
Series of zero days target CDP and LLDP parsing code across vendors rather than a protocol-level claim the work finds nearly 70 affected device models from… | ||
| Locknote: Conclusions and Key Takeaways from Day 2 | Jeff Moss, Jiska Classen, Federico Maggi, Leigh-Anne Galloway, Anant Shrivastava | 32m |
Panel summarizes concrete tensions: industry incentives beat ideal fixes, so companies choose analytics-friendly choices like certificate transparency over… | ||
| Microsoft Defender for Office 365 Evasion - The Story of Confirmed Vulnerability | Sergey Chubarov | 37m |
Demonstrates a concrete evasion of Microsoft Defender for Office 365: the Safe Attachments sandbox is a Windows 10 Hyper‑V template with ~1 GB RAM and one… | ||
| From Finding New Type of Logical Flaw at Linux Kernel To Developing New Heap Exploitation Technique | Yuseok Jeon, Junesoo Kang, Jinhan Kwak, Yoochan Lee, Byoungyoung Lee (lifeasageek) | 26m |
A new technique called Pspray uses a timing side-channel to detect the slowpath slab creation in the Linux kernel, catch the moment a fresh slab gets a single… | ||
| Locknote: Conclusions and Key Takeaways from Day 1 | Sharon Conheady, Meadow Ellis, Jeff Moss, Matt Suiche, Stefano Zanero | 30m |
Discussion argues that memory safety cuts ~70% of exploited bugs but is not a silver bullet and migration to Rust/compilers/tooling remains slow; cloud shifts… | ||
| Practically-exploitable Cryptographic Vulnerabilities in Matrix | Martin Albrecht, Sofia Celi, Benjamin Dowling, Dan Jones | 34m |
Researchers demonstrate several practical exploits against Matrix and Element that let a malicious Home Server eavesdrop, impersonate accounts, and decrypt… | ||
| Real-World Detection Evasion Techniques in the Cloud | Matt Muir | 39m |
Three cloud campaigns reveal concrete evasion: CoinStomp time-stomps binaries with touch -t and obfuscates chmod/chattr usage, opens a /dev/tcp reverse shell… | ||
| Scammers Who Scam Scammers, Hackers Who Hack Hackers: Exploring a Sub-economy on Cybercrime Forums | Angela Gunn, Matt Wixey | 38m |
Analysis of 12 months on Exploit, XSS and Breach Forums shows about $2.5M lost to scams, with Exploit logging ~2,500 reports and XSS ~760, mean losses similar… | ||
| Select Bugs From Binary Where Pattern Like CVE-1337-Days | Ken Hsu, Bo Qu, Tao Yan (@Ga1ois) | 39m |
A custom binary pattern-search engine named Leviathan pattern search tool uses Python plus IDA/Hex-Rays APIs and offers SQL+script modes to match… | ||
| Writing Your Own Ticket to the Cloud Like APT: A Dive to AD FS Attacks, Detections, and Mitigations | Roberto Rodriguez, Nestori Syynimaa | 42m |
Eighty-eight percent of Fortune 500s use Azure AD and ~68% of those use federation, so AD FS remains a high-value target. The workflow shows four practical… | ||
| {JS-ON: Security-OFF}: Abusing JSON-Based SQL Queries | Noam Moshe | 23m |
Finds that JSON-in-SQL payloads let simple SQL injection reach databases despite WAFs, demonstrates a real CN Maestro SQLi that exfiltrates tokens, SSH keys… | ||
| Abusing CNC Technologies | Marco Balduzzi, Leandro Pierguidi, Francesco Sortino | 38m |
A security audit of major CNC controller vendors (Okuma, FANUC and others) uses simulators and real machines, Metasploit and vendor SDKs (Think API), and… | ||
| The Hacker's Guide to Policyland | Jen Ellis, Irfan Hemani | 43m |
Overview of what UK government is actually doing: a new national cyber strategy with five pillars (technology security, organizational resilience, cyber… | ||
| Vlind Glitch: Blind VCC Glitching Technique to Bypass the Secure Boot of Qualcomm MSM8916 Mobile SoC | Vicente Arnau, Hector Marco | 37m |
Describes a practical Blind VCC (Vlind) glitch that forces Qualcomm MSM8916/APQ8016 into EDL during root-hash verification by briefly lowering an exposed APC… | ||
| Aikido: Turning EDRs to Malicious Wipers Using 0-day Exploits | Or Yair | 33m |
Demonstrates a concrete exploit chain that lets an unprivileged account force privileged EDR/AV processes to delete arbitrary files by combining a held-open… | ||
| The Aftermath of a Social Engineering Pentest - Are We Being Ethically Responsible? | Ragnhild "Bridget" Sageng | 34m |
Social engineering tests use phishing emails, physical pretexting and fake IDs and produce concrete harms: a 2011 conference yielded 66% click rate among… | ||
| Strengthening Cyber Resiliency in a Time of Geopolitical Crises... | Ondrej Nekovar, Jan Pohl | 40m |
Long-term monitoring of Russian forums and Telegram feeds feeds into a custom MISP CTI pipeline and an ACD Loop that pairs detection engineering with active… | ||
| Thresholds Are for Old Threats: Demystifying AI and Machine Learning to Enhance SOC Detection | Carole Boijaud | 29m |
Credit Agricole SOC processes ~300k events/sec (≈10 TB/day, ~4 PB/yr) and tests unsupervised ML on proxy logs: 15 days (~15 GB) aggregated to daily profiles… | ||
| Searching for RPC Functions to Coerce Authentications in Microsoft Protocols | Remi Gascou (Podalirius) | 30m |
Automates parsing Microsoft OpenSpecs and IDL to extract RPC interfaces, operation numbers and parameter names, translates IDL types into Impacket structures… | ||
| Keynote - Our Kryptonite: A Defendable Internet | Daniel Cuthbert | 01h 00m |
Argues the internet remains largely undefendable because vendors ship insecure products, memory-safety bugs persist, and convenient lock‑ins create a wealthy… | ||
| Unwinding the Stack for Fun and Profit | Victor Duta, Fabian Freyer, Cristiano Giuffrida, Marius Muench, Fabio Pagani | 36m |
Claims that exception unwinding can be hijacked to restore return-based exploits using a technique called Chop (Handler Oriented Programming), which corrupts… | ||
| The Black Hat Europe NOC Report | Bart Stump, Neil R. Wyler | 33m |
Black Hat NOC shows the actual setup: Gigamon taps feeding NetWitness, IronNet NDR, Palo Alto firewalls and Cisco Meraki Wi‑Fi, with Threat Grid sandboxing for… | ||
| Keynote - Cybersecurity: The Next Generation | Jen Ellis | 48m |
Security enters a second generation where the stakes shift: IoT creates virtual-to-physical harm, cloud concentration makes single providers juicy targets, and… | ||
| nothing matches | ||