Black Hat Europe 2023
2023-12-04..2023-12-07
London, United Kingdom
[Black Hat Europe 2014, Black Hat Europe 2015, Black Hat Europe 2017, Black Hat Europe 2018, Black Hat Europe 2019, Black Hat Europe 2022, Black Hat Europe 2023]
| title | author | length |
|---|---|---|
| Why Attend the World's Premier Technical Cybersecurity Conference | 01m | |
Join us live, in-person in London, December 4-7 at the ExCel for Black Hat Europe 2023! The world's premier technical cybersecurity conference… | ||
| Highlights | 01m | |
Music-only clip with no spoken audio but the video is a rapid montage of conference segments that shows short demo clips and on-screen captions naming exploits… | ||
| Highlights | 03m | |
Check out all the highlights from Black Hat Europe 2023 at the ExCel London, United Kingdom. December 4-7.
Visit our Flickr page for the event photos… | ||
| A Security RISC? The State of Microarchitectural Attacks on RISC-V | Lukas Gerlach, Michael Schwarz, Daniel Weber | 47m |
Analysis targets two commercial RISC‑V cores (Allwinner D1 / c906 and SiFive U74) and releases working proof‑of‑concepts on GitHub. Findings: split… | ||
| REDIScovering HeadCrab - A Technical Analysis of a Novel Malware and the Mind Behind It | Asaf Eitani, Nitzan Yaakov | 39m |
Detailed technical forensics of HeadCrab shows a malware framework that abuses Redis slaveof/replicaof to drop and modu load payloads, implements custom Redis… | ||
| TsuKing: Coordinating DNS Resolvers and Queries into Potent DoS Amplifiers | Haixin Duan, Xiang Li, Chaoyi Lu, Wei Xu | 23m |
A new DNS amplification method called TsuKing coordinates vulnerable resolvers via crafted referral chains and an attacker-controlled authoritative king to… | ||
| Millions of Patient Records at Risk: The Perils of Legacy Protocols | Ibrahim Akkulak, Sina Yazdanmehr | 37m |
Internet-wide scans find 3,800 DICOM servers exposed on ports 104/4242/11112 and reveal over 59 million records (about 16M PII, 43M health records). Simple… | ||
| Security Through Transparency: Scaling Your Customer Trust Program | Ayoub Fandi | 37m |
Company publishes core policies and evidence on the open web, builds a public-facing wiki, a trust center with gated NDA access for sensitive reports, and a… | ||
| How I Learned to Stop Worrying and Build a Modern Detection & Response Program | Allyn Stott | 38m |
A four‑phase framework maps assess/analyze, design/develop, implement, and evaluate/report to turn noisy legacy SOCs into proactive programs that prioritize… | ||
| AutoSpill: Zero Effort Credential Stealing from Mobile Password Managers | Ankit Gangwal, Shubham Singh, Abhijeet Srivastava | 35m |
AutoSpill is an Android WebView attack that exfiltrates saved credentials during autofill: a custom autofill service captures the OS-provided assist structure… | ||
| Orchestrate This! Kubernetes Rootkit | Andrew Hughes, Nick Lang | 14m |
A container-focused rootkit called Cube kit is built as a loadable kernel module plus a user-space JSON handler that hides pods across the control plane and… | ||
| Hacking Your Documentation: Who Should WTFM? | Elliott Grey | 17m |
Argues that dedicated technical writers measurably improve security and productivity: Google Cloud finds teams with good docs are 2.4× more productive and 3.8×… | ||
| Reviving JIT Vulnerabilities: Unleashing the Power of Maglev Compiler Bugs on Chrome Browser | Bohan Liu, Zheng Wang | 37m |
Compares Maglev to Turbofan, maps concrete attack surfaces (graph building, register allocation, deoptimization), and claims use of Crash-based Fuzzing… | ||
| Attacking NPUs of Multiple Platforms | Shupeng Gao, Zheng Huang, Le Wu, Ye Zhang | 37m |
Audit and firmware-reverse work finds concrete flaws in Exynos, Apple NPU and Qualcomm drivers: stable double free in Exynos mailbox handling, multiple… | ||
| TunnelCrack: Leaking VPN Traffic by Manipulating Routing Tables | Mathy Vanhoef | 38m |
Two novel attacks leak VPN traffic by manipulating the OS routing table: a local-net spoof that advertises public IPs inside the local subnet so clients send… | ||
| LogoFAIL: Security Implications of Image Parsing During System Boot | Alex Ermolov, Anton Ivanov, Alex Matrosov, Fabio Pagani, Sam Thomas, Yegor Vasilenko | 44m |
Research shows UEFI image parsers that render vendor boot logos read images from the EFI System Partition or unsigned firmware update sections and are parsed… | ||
| Evils in the Sparse Texture Memory: Exploit Kernel Based on Undefined Behaviors of Graphic APIs | Xingyu Jin, Tony Mendez, Richard Neal | 40m |
Finds multiple physical-page use-after-free bugs in Imagination Technologies PowerVR GPU sparse texture handling, outlines how mishandled PMR/PMR refcounts and… | ||
| A Decade After Stuxnet: How Siemens S7 is Still an Attacker's Heaven | Tom Dohrmann, Colin Finck | 39m |
Reverse engineering produces a decrypted S7‑1500 software‑controller ELF, a Ghidra plugin and QEMU patches on GitHub, and a full reproduction of the handshake… | ||
| Deleting Your Domain? Preventing Data Leaks at TLD Scale | Maarten Wullink | 40m |
SIDN builds LEMMINGS, a system that watches .nl DNS for mail MX queries and alerts former registrants when deleted domains still receive mail-related traffic… | ||
| Breaking Theoretical Limits: The Gap Between Virtual NICs and Physical Network Cards | A Ben, Qian Chen, Ruiqi Chen, Luo Quan | 23m |
Code review of netvsp.ko and Hyper‑V VM switch logic reveals a practical method to craft guest packets that bypass link‑layer length checks by using VM bus… | ||
| Illegitimate Data Protection Requests - To Delete or to Address? | Larisa Munteanu, Mark Povey | 41m |
Attackers send weaponized data‑subject requests that carry executable attachments or obfuscated PDFs that drop credential‑stealing malware, and a 2019 study of… | ||
| Unmasking APTs: An Automated Approach for Real-World Threat Attribution | Aakanksha Saha | 44m |
An automated system called ADAPT clusters heterogeneous malware artifacts (22+ file types) collected from AlienVault and downloaded from VirusTotal, with an… | ||
| How We Taught ChatGPT-4 to Break mbedTLS AES With Side-Channel Attacks | Witold Waligóra | 39m |
Shows GPT‑4 generating device‑under‑test and driver C code, building a leakage model and orchestrating USB passthrough to cloud oscilloscopes (ChipWhisperer /… | ||
| HODOR: Reducing Attack Surface on Node.js via System Call Limitation | Wang Gao, Dawu Gu, Xingwei Lin, Wenya Wang, Jingyi Wang | 22m |
HODOR builds cross-language static-dynamic call graphs for JavaScript and native layers, applies JS-specific optimizations and partial context-sensitive C/C++… | ||
| VoBERT: Unstable Log Sequence Anomaly Detection: Introducing Vocabulary-Free BERT | Eduardo Barbaro, Daan Hofman, Anna Lukina, Yury Zhauniarovich | 41m |
VoBERT claims to detect anomalies in unstable log sequences by replacing fixed vocabularies with vocabulary-free embeddings and doing element-level masking so… | ||
| Indirect Prompt Injection Into LLMs Using Images and Sounds | Ben Nassi, Eugene Bagdasaryan | 28m |
Creates adversarial images and audio with a per-token iterative FGSM algorithm that encodes a desired sentence into model embeddings, then feeds that media… | ||
| Hiding in the Clouds: Abusing Azure DevOps Services to Bypass Microsoft Sentinel Analytic Rules | Brett Hawkins | 38m |
Research shows Azure DevOps Services allows trivial evasion of default Microsoft Sentinel rules: 18 built-in rules tested and several bypassed by using the… | ||
| Sweet QuaDreams or Nightmare Before Christmas? Dissecting an iOS 0-Day | Christine Fossaceca, Bill Marczak | 39m |
Analysis ties forensic traces to a QuaDream/Rain iOS zero‑click exploit that abuses iCloud Calendar via calendar CalDAV CDATA XML injection to reach the… | ||
| Vulnerabilities in Old Third-Party Software Components- Importance of Having SBoM for IoT/OT Devices | Stanislav Dashevskyi, Francesco La Spina | 39m |
Security research finds 21 vulnerabilities across Helios and third‑party code, with 15 in open source; analysis uses Docker, QEMU, libFuzzer and static/dynamic… | ||
| Breaching the Perimeter via Cloud Synchronized Browser Settings | Edward Prior | 34m |
Cloud-synced browser settings allow extraction of passwords, credit cards and full-history GET parameters and can silently save passwords via three Edge… | ||
| Off The Record - Weaponizing DHCP DNS Dynamic Updates | Ori David | 40m |
Unauthenticated on‑network clients can use DHCP DNS Dynamic Update (by sending an FQDN via DHCP with dhclient) to make Microsoft DHCP register or overwrite AD… | ||
| One Million ASUS Routers Under Control: Exploiting ASUS DDNS to MITM Admin Credentials | Masaki Kubo, Yoshiki Mori, Kanta Okugawa | 30m |
Researchers demonstrate a reliable method to overwrite ASUS DDNS entries and force the official ASUS Router App to connect to attacker servers, using an… | ||
| Kidnapping Without Hostages: Virtual Kidnapping and the Dark Road Ahead | Craig Gibson, Vladimir Kropotov | 30m |
Virtual kidnapping is now a scalable, profitable criminal business that uses ChatGPT-generated scripts, deepfake audio/video and tools like FaceSwap.py to make… | ||
| When The Front Door Becomes a Backdoor: The Security Paradox of OSDP | Ariel Harush, Roy Hodir, Eran Jacob | 36m |
Demonstrates that properly configured OSDP readers still allow practical attacks: a man‑in‑the‑middle on RS‑485 (tested with Melon and a laptop) uses an… | ||
| Something Rotten in the State of Data Centers | Jesse Chick, Kasimir Schulz | 40m |
Finds eight critical zero‑days across a popular DDI appliance and an Avocent KVM that lead to complete tenant takeover and control of attached hosts. On the… | ||
| The Pool Party You Will Never Forget: New Process Injection Techniques Using Windows Thread Pools | Alon Leviev | 35m |
Claims eight new, fully undetectable process‑injection techniques that abuse the Windows user‑mode threadpool and a released tool Pool Party tool that… | ||
| Through the Looking Glass: How Open Source Projects See Vulnerability Disclosure | Marta Rybczynska | 27m |
Open source projects typically reply in five concrete ways: fixed in release, not a security issue, needs testing, submit a patch, or we do not issue CVEs… | ||
| New Techniques for Split-Second DNS Rebinding | Daniel Thatcher | 31m |
Shows two practical, fast DNS-rebinding techniques that exploit IPv6/DNS timing (a quad A timing trick for Safari and an IPv6-then-IPv4 ordering trick for… | ||
| Collide+Power: The Evolution of Software-based Power Side-Channels Attacks | Andreas Kogler | 36m |
Collide+Power demonstrates a generic software-only power side channel that targets shared CPU hardware (cache memory subsystem) rather than specific… | ||
| A World-View of IP Spoofing in L4 Volumetric DoS Attacks - and a Call to Enable BCP38 | Vasileios Giotsas | 28m |
Cloudflare analyzes 3 months of L4 DoS traces and builds spoofing detectors using unicast RPF plus anycast catchment learning and packet-signature matching… | ||
| The Magnetic Pull of Mutable Protection: Worked Examples in Cryptographic Agility | Mark Carney, Daniel Cuthbert, Niroshan Rajadurai, Benjamin Rodes | 45m |
Scans use GitHub CodeQL multi-repository variant analysis to build a cryptographic bill of materials for each repository, running across the top 1,000 GitHub… | ||
| My Invisible Adversary: Burnout | Johan Berggren, Matt Linton | 41m |
Operational teams at Google split burnout into situational and chronic and adopt concrete fixes: an incident commander monitors team fatigue during responses… | ||
| The Black Hat Europe Network Operations Center (NOC) Report | Neil R. Wyler, Bart Stump | 38m |
Black Hat NOC teams describe running a vendor-integrated network with Palo Alto, NetWitness, Cisco, Corite, Arista and ThousandEyes, capturing every packet… | ||
| Industrialising Cyber Defence in an Asymmetric World | Ollie Whitehouse | 41m |
Argues for industrialising defence by scaling the National Cyber Security Centre’s active cyber defence program, demanding vendor telemetry/log access, and… | ||
| My Lessons from the Uber Case | Joe Sullivan | 01h 05m |
Convicted on two felony counts tied to a 2016 Uber breach and now appealing, the account lays out exactly what happened: a bug bounty engagement that led to… | ||
| Conclusions and Key Takeaways from Day 1 | Jeff Moss, Daniel Cuthbert, Meadow Ellis, Marina Krotofil, Saša Zdjelar | 48m |
Day one surfaces concrete trends: surprisingly few AI or Web3 submissions, a surge in hardware-track proposals that focus on firmware and software reverse… | ||
| Conclusions and Key Takeaways from Day 2 | Jeff Moss, Ali Abbasi, Jiska Classen, Vandana Verma Sehgal, Kenneth White | 48m |
Panel lists concrete takeaways: SBOMs help but often act as a checklist rather than risk maps, so a proposed netbom (allowed API endpoints and hosts) surfaces… | ||
| nothing matches | ||