Black Hat USA 2014
2014-08-02..2014-08-07
Las Vegas, United States
[Black Hat USA 2014, Black Hat USA 2016, Black Hat USA 2019, Black Hat USA 2023]
who it's for
security researchers, reverse engineers, exploit developers, malware analysts, cloud security engineers, security operations center analysts
topics
Windows kernel graphics driver attacks; TLB-splitting hypervisor attacks; hypervisor shared folders bugs; OpenStack at-scale security; multi-architecture disassembly framework; Android device exploitation; ransomware and CryptoLocker analysis; DNS and IP-based malware detection; software defined radio pentesting; malicious USB accessories (BadUSB); Memcached injection techniques; TLS failures and BEAST attacks
| title | author | length |
|---|---|---|
| Windows Kernel Graphics Driver Attack Surface | Ilja van Sprundel | 56m |
Windows WDDM kernel drivers expose four concrete kernel entry points — escape, render, allocation, query adapter — many callbacks (40–60) and per-driver… | ||
| Abusing Microsoft Kerberos: Sorry You Guys Don't Get It | Alva Duckwall, Benjamin Delpy | 51m |
Demonstrates concrete attacks using Mimikatz to read Kerberos keys from LSASS memory, inject NTLM/AES keys, and forge tickets; recovers a krbtgt key that often… | ||
| MoRE Shadow Walker: The Progression of TLB-Splitting on x86 | Jacob I. Torrey | 44m |
Presents a method to re-create TLB-splitting on Core i–series by using an EPT and VPID-based hypervisor that traps EP faults, tags TLB entries per-VM, and… | ||
| Computrace Backdoor Revisited | Vitaliy Kamluk, Sergey Belov, Anibal Sacco | 01h 06m |
Firmware‑resident RPCnetP/RPCnet instances persistently reinstall a Windows service, accept unauthenticated commands and implement simple memory read/write… | ||
| Poacher Turned Gamekeeper: Lessons Learned from Eight Years of Breaking Hypervisors | Rafal Wojtczuk | 54m |
Eight years of breakage yields concrete fixes: three of four recent VirtualBox issues come from shared folders bugs — a non‑terminated path write, POSIX… | ||
| Understanding TOCTTOU in the Windows Kernel Font Scaler Engine | Yu Wang | 53m |
Finds a concrete TOCTTOU exploitation path in the Windows kernel Font Scaler: kernel code precomputes sizes for CG3/CG4, double‑fetches user buffers, and a… | ||
| OpenStack Cloud at Yahoo Scale: How to Avoid Disaster | Anders Beitnes | 27m |
Yahoo runs OpenStack worldwide with 13,000 development VMs and 170 PB mail storage, and secures it by slicing networks into VLANed security domains and… | ||
| Why Control System Cyber-Security Sucks… | Dr. Stefan Lüders | 58m |
CERN control networks, device tests and red-team exercises reveal concrete failures: 53 commercial devices scanned in 2007, about 17% crash on malformed… | ||
| Capstone: Next Generation Disassembly Framework | Quynh Nguyen Anh | 52m |
An open source disassembly engine named Capstone implements eight architectures (x86, ARM, ARM64, MIPS, PowerPC, SPARC, SystemZ, XCore), ships bindings for… | ||
| The Big Chill: Legal Landmines that Stifle Security Research and How to Disarm Them | Trey Ford, Marcia Hofmann, Kevin Bankston | 50m |
Outlines which statutes actually stop researchers: vague CFAA authorization language that can turn routine testing into a felony, the DMCA’s anti‑circumvention… | ||
| A Scalable, Ensemble Approach for Building and Visualizing Deep Code-Sharing Networks | Joshua Saxe | 22m |
An ensemble system estimates code sharing by combining instruction engrams, dynamic API traces, PE/header and byte-sequence features, and then compresses… | ||
| "Nobody is Listening to Your Phone Calls." Really? A Debate and Discussion on the NSA's Activities | Mark Jaycox, Michael Allen | 52m |
Debate lays out concrete authorities and outcomes: Section 215 Verizon order (bulk telephony records), PRISM and Upstream under Section 702, plus EO 12333… | ||
| Miniaturization | Jason Larsen | 47m |
Demonstrates miniaturized SCADA attacks that fit inside commodity pressure sensors by extracting shock-wave timing and spoofing operator displays. Uses… | ||
| ICSCorsair: How I Will PWN Your ERP Through 4-20 mA Current Loop | Alexander Bolshev, Gleb Cherbov | 44m |
A custom open‑hardware attack board, ICSCorsair board, connects to 4–20 mA HART loops to jam the line, impersonate masters, change a transmitter’s long tag and… | ||
| Reverse Engineering Flash Memory for Fun and Benefit | Matt Oh | 45m |
Desolder NAND with hot air, attach a cheap SOIC socket and FTDI breakout to talk the NAND bus, and use a Python tool to dump raw pages including OOB, ECC and… | ||
| Governments As Malware Authors: The Next Generation | Mikko Hypponen | 55m |
States hack CAs to mint DigiNotar rogue certs (Iran-linked) and a CA’s secret disclosure causes bankruptcy; at least 20–30 countries legally deploy… | ||
| Defeating the Transparency Feature of DBI | Kang Li, Xiaoning Li | 24m |
Shows concrete detectors and exploit code that distinguish native, DBI and VM runs by triggering real failures and measurable artifacts. Demonstrates a stack… | ||
| Internet Scanning - Current State and Lessons Learned | Mark Schloesser | 26m |
Project Sonar runs continuous IPv4-wide scans with ZMap-derived probes and publishes raw datasets plus databases, a search engine and a trending DB; weekly… | ||
| Badger - The Networked Security State Estimation Toolkit | Edmond Rogers, William Rogers, Gabe Weaver | 22m |
Open-sourced Cyber Physical Topology Language (CPTL) and the Badger toolkit provide automated network security state estimation by ingesting syslog, SNMP and… | ||
| Network Attached Shell: N.A.S.ty Systems that Store Network Accessible Shells | Jacob Holcomb | 52m |
Independent Security Evaluators report dozens of critical bugs across Seagate, D‑Link and Netgear NAS, with 100% of devices vulnerable in preliminary testing… | ||
| Abuse of CPE Devices and Recommended Fixes | Jonathan M. Spring, Paul Vixie, Chris Hallenbeck | 27m |
Carnegie Mellon measurement finds roughly 21 million open DNS resolvers, nearly half sitting on DSL home links, and many misconfigured inside cheap home… | ||
| 802.1x and Beyond! | Brad Antoniewicz | 32m |
Demonstrates a practical attack chain against 802.1x/EAP and RADIUS: builds Peach-based Peach fuzzer models and custom publishers to fuzz EAP inside TLS… | ||
| Leviathan: Command and Control Communications on Planet Earth | Kenneth Geers, Kevin Thompson | 39m |
Eighteen months of telemetry shows about 30 million malware callbacks and roughly 600–700k unique callbacks coming from sensors in 200+ countries, with… | ||
| VoIP Wars: Attack of the Cisco Phones | Fatih Ozavci | 01h 02m |
Hosted Cisco VoIP deployments are vulnerable to practical attacks demonstrated with the Viproy (VRO) toolkit (a dozen modules) and a custom MITM proxy… | ||
| Multipath TCP: Breaking Today's Networks with Tomorrow's Protocols | Catherine Pearce, Patrick Thomas | 47m |
Multipath TCP extends TCP so one logical connection uses multiple TCP subflows and can change IP mid-session, and that lets the packet sender split a payload… | ||
| Evasion of High-End IPS Devices in the Age of IPv6 | Antonios Atlasis, Enno Rey | 25m |
Three novel techniques exploit IPv6 extension headers and fragmentation to make high-end IDPSes blind, demonstrated with a custom packet-builder and layer‑3… | ||
| Mobile Device Mismanagement | Stephen Breen | 48m |
Penetration testing of enterprise MDMs finds predictable enrollment tokens (TinyURL‑style), secret tokens leaked in certificate CNs, default admin credentials… | ||
| Unwrapping the Truth: Analysis of Mobile Application Wrapping Solutions | Ron Gutierrez, Stephen Komal | 54m |
Reverse engineers test major commercial MAM/app‑wrapping products for iOS and Android, diffing binaries (Mach‑O, LC_LOAD_DYLIB), using dex2jar and ASM dex… | ||
| Researching Android Device Security with the Help of a Droid Army | Joshua 'jduck' Drake | 58m |
Built a heterogeneous Android cluster (about 48 devices in the demo) to measure fragmentation, automate provisioning and run commands in parallel, using… | ||
| Understanding IMSI Privacy | Ravishankar Borgaonkar, Swapnil Udar | 47m |
An Android research app turns a rooted Galaxy S3/S2 into a passive GSM/3G monitor that logs system information type 3 messages every minute, shows A5/A51/A53… | ||
| A Practical Attack Against VDI Solutions | Daniel Brodie, Michael Shaulov | 48m |
A proof‑of‑concept shows a malicious mobile app using screen scraping and off‑the‑shelf RATs to capture VDI sessions, stealing credentials via clipboard… | ||
| It Just (Net)works: The Truth About iOS 7's Multipeer Connectivity Framework | Alban Diquet | 30m |
Shows the actual network stack: Bonjour service advertisement, a TCP plist exchange that sends peer IDs and a list of candidate IP/UDP ports, ICE connectivity… | ||
| Android FakeID Vulnerability Walkthrough | Jeff Forristal | 30m |
A flaw in Android certificate handling lets a malicious app inject a fake certificate chain and gain privileged identities on devices shipped since January… | ||
| Reflections on Trusting TrustZone | Dan Rosenberg | 39m |
Reverse-engineered Qualcomm TrustZone (QSE/QCE) firmware with IDA Pro and firmware images pulled via DD, finds an integer overflow in SMC command length checks… | ||
| Catching Malware En Masse: DNS and IP Style | Dhia Mahjoub, Thibault Reuille, Andree Toonk | 59m |
Presents concrete methods: a Hadoop batch + streaming DNS pipeline that extracts fast‑flux bipartite graphs, flags ~900 zbot fast‑flux domains (TTL 150s)… | ||
| Static Detection and Automatic Exploitation of Intent Message Vulnerabilities in Android | Daniele Gallingani | 17m |
A static analysis pipeline converts Android bytecode to GIMPLE, finds intent payload reads, tracks dataflow across methods with IFDS, extracts path… | ||
| Secure Because Math: A Deep-Dive on Machine Learning-Based Monitoring | Alex Pinto | 59m |
Marketing promises "because math" while research still leans on old benchmarks like KDD99 (6,300+ citations) and lab claims such as ~95% detection that… | ||
| Sidewinder Targeted Attack Against Android in the Golden Age of Ad Libs | Tao Wei, Yulong Zhang | 17m |
Demonstrates a concrete attack chain that harvests plaintext GPS from ad libraries, identifies high‑value locations, then injects code via… | ||
| Threat Intelligence Library - A New Revolutionary Technology to Enhance the SOC Battle Rhythm! | Ryan Trost | 37m |
Argues that a threat library / threat intelligence management platform becomes the SOC cornerstone by automating ingestion, deduplication, enrichment and… | ||
| PWNIE Awards at Black Hat USA 2014 | Ralf-Philipp Weinmann, James Forshaw, Daniel Genkin, Adi Shamir, Eran Tromer, Yuny Bulygin, Andrea Bittau | 43m |
A rapid roundup of concrete results: a Chrome bug gives an arbitrary read/write primitive by overloading an ArrayBuffer length field, a pair of exploits bypass… | ||
| What Goes Around Comes Back Around - Exploiting Fundamental Weaknesses in Botnet C&C Panels! | Aditya K Sood | 27m |
Methodology shows reverse attacks against real C&C panels over months, combining malware reverse engineering to extract RC4 auth keys and automated Google-dork… | ||
| Prevalent Characteristics in Modern Malware | Rodrigo BSDaemon, Gabriel Negreira Barbosa | 47m |
Cataloged characteristics across 12 million PE samples using static-only analysis with simple detectors that flag detected/evidence/not-detected and run on a… | ||
| Creating a Spider Goat: Security with Intel CPU Transactional Memory Support | Igor Muttik, Alex Nayshtut | 01h 00m |
Shows how Intel TSX (Haswell/Xeon) uses XBEGIN/XEND to run a dedicated security thread that repeatedly reads protected RAM so any concurrent write triggers a… | ||
| Reverse-Engineering the Supra iBox: Exploitation of a Hardened MSP430-Based Device | Braden Thomas | 48m |
Reverse engineering targets an MSP430 147 on Supra iBox hardware using a GoodFET, JTAG tests, external crystal and a camera xenon flash. Voltage glitching and… | ||
| Full System Emulation: Achieving Successful Automated Dynamic Analysis of Evasive Malware | Christopher Kruegel | 51m |
Argues that full system emulation—CPU- and hardware-level emulation running a real Windows guest—combines visibility and fidelity to defeat common sandbox… | ||
| Exposing Bootkits with BIOS Emulation | Lars Haukli | 47m |
Claims a practical detector that reads true disk sectors via the signed miniport dispatch routine (recovered by recursive disassembly), boots those sectors… | ||
| The New Scourge of Ransomware: A Study of CryptoLocker and Its Friends | Lance James, John Bambenek | 51m |
CryptoLocker uses a public key model where the private key never touches the victim and a domain generation algorithm spits out roughly 1,200 candidate domains… | ||
| GRR: Find All the Badness, Collect All the Things | Greg Caste | 58m |
GRR is an open source remote live‑forensics system that installs an agent on Windows, macOS and Linux and performs targeted triage and fleet hunts, able to… | ||
| One Packer to Rule Them All | Alaeddine Mesbahi, Arne Swinnen | 26m |
Empirical test of anti-virus static, emulation and runtime stages shows a custom packer called Becker + two novel techniques—in-line packer and resource… | ||
| A Journey to Protect Points-of-Sale | Nir Valtman | 59m |
Claims that most POS breaches come from memory scraping and weak local privileges; demonstrates an open‑source memory scraper (GitHub) that finds PANs every… | ||
| Why You Need to Detect More Than PtH | Matt Hathaway, Jeff Myers | 29m |
Compromised credentials remain inevitable so detection focuses on specifics not slogans: Rapid7 lab reproduces a hash dump, metasploit/psexec lateral use, and… | ||
| Investigating PowerShell Attacks | Ryan Kazanciyan, Matt Hastings | 25m |
Targeted attackers use PowerShell for command-and-control and lateral movement, often over WSMan/WinRM remoting, with PowerShell 2.0 present by default on… | ||
| SecSi Product Development | Joseph FitzPatrick | 32m |
Manual RTL inspection of open-source Verilog cores finds concrete, exploitable mistakes: OpenRISC has a JTAG one‑hot state machine whose uneven LUT packing… | ||
| How to Wear Your Password | Markus Jakobsson | 26m |
Claims a usable replacement for passwords via a smart bracelet with Bluetooth LE, an accelerometer and a clasp that breaks a circuit when opened; it acquires… | ||
| APT Attribution and DNS Profiling | Frankie Li | 22m |
Claims that APT operators maintain stable DNS‑IP pairs and register many themed domains (often Pinyin domain naming), based on manual and passive DNS/WHOIS… | ||
| Bitcoin Transaction Malleability Theory in Practice | Daniel Chechik, Ben Hayak | 48m |
Explains the concrete exploit: grab a pending raw transaction hex, edit the scriptSig by inserting OP_PUSHDATA2 and a zero byte while updating the overall… | ||
| Exploiting Unpatched iOS Vulnerabilities for Fun and Profit | Yeongjin Jang, Tielei Wang, Byoungyoung Lee, Billy Lau | 44m |
Reconstructs and rechains vulnerabilities in iOS 7.1.x to run unsigned code as root without a kernel exploit: starts from the evasion7 nine chained… | ||
| Write Once, Pwn Anywhere | Yang Yu | 50m |
Claims two new DEP bypasses and two ASLR bypasses that avoid ROP, JIT, plugins or non-ASLR modules and work across OS/CPU. Demonstrates JScript5 BSTR… | ||
| Thinking Outside the Sandbox - Violating Trust Boundaries in Uncommon Ways | Brian Gorenc, Jasiel Spelman | 41m |
Four concrete sandbox bypasses from Pwn2Own 2014 are dissected with root cause and fixes: a Flash use‑after‑free chains to presentation host elevation policy… | ||
| Stay Out of the Kitchen: A DLP Security Bake-Off | Zach Lanier, Kelly Lum | 54m |
Hands-on testing of Trend Micro, Websense/Triton, Sophos, OpenDLP and others shows real attack paths: 30+ XSS findings in management consoles, CSRF that lets… | ||
| Extreme Privilege Escalation on Windows 8/UEFI Systems | Corey Kallenberg, Xeno Kovah, Samuel Cornwell | 57m |
Claims a userland Windows 8 process can escalate from administrator (ring 3) into platform firmware and SMM by abusing the UEFI variable interface, discloses… | ||
| Abusing Performance Optimization Weaknesses to Bypass ASLR | Byoungyoung Lee, Yeongjin Jang, Tielei Wang | 45m |
Shows that performance-driven choices leak pointer-sized identifiers so ASLR can be defeated. Empirical survey of Python, Ruby, PHP, Java(DVM/JVM) and JS hash… | ||
| Lifecycle of a Phone Fraudster: Exposing Fraud Activity | Vijay Balasubramaniyan, Raj Bandyopadhyay, Telvis Calhoun | 54m |
Analysis of 105 million call records finds about 1 fraudulent call per 2,900 (≈30,000 frauds) and $59M in losses, with attackers using ANI spoofing, VoIP… | ||
| When the Lights Go Out: Hacking Cisco EnergyWise | Matthias Luft, Ayhan Soner Koca | 01h 02m |
Claims a reversible, practical attack on Cisco EnergyWise: researchers reverse-engineer the proprietary protocol, extract its HM (SHA1-based) scheme, and… | ||
| Hacking the Wireless World with Software Defined Radio - 2.0 | Balint Seeber | 53m |
Live demos use USRP B200/B210 and GNU Radio flowgraphs to capture and inject real signals: POCSAG and proprietary pager protocols are decoded and spoofed… | ||
| Dynamic Flash Instrumentation for Fun and Profit | Timo Hirvonen | 50m |
An open source dynamic instrumentation tool called suo uses Intel Pin to intercept ActionScript method calls, dump loadBytes-constructed objects and extract… | ||
| From Attacks to Action - Building a Usable Threat Model to Drive Defensive Choices | Tony Sager | 27m |
A community process maps the Verizon Data Breach Report categories into a short, prioritized set of actions drawn from the Critical Security Controls, starting… | ||
| Point of Sale System Architecture and Security | Lucas Zaichkowsky | 23m |
Live demonstration captures full card numbers and expiration dates in plain text from an EMV chip read by doing a memory dump with a free Microsoft tool and… | ||
| Unveiling the Open Source Visualization Engine for Busy Hackers | Andrew Hay, Thibault Reuille | 01h 00m |
An open source visualization engine named OpenGraffiti converts CSV/JSON or bro/Zeek logs into graphs via a Python semantic net pipeline, NetworkX helpers and… | ||
| SAP, Credit Cards, and the Bird that Talks Too Much | Ertunga Arsal | 49m |
Demonstrates real remote code execution via third‑party add‑ons (example: OpenText) to reactivate admin accounts and alter vendor bank details for large… | ||
| Data-Only Pwning Microsoft Windows Kernel | Nikita Tarakanov | 25m |
New technique targets Windows 8.1 kernel pool: it turns a single pool overflow into arbitrary memory read/write, hijack of execution flow and adjacent… | ||
| The Devil Does Not Exist - The Role of Deception in Cyber | Mark Mateski, Matt Devost | 45m |
Presents a practical taxonomy—eye-to-eye, con, hypercon—that maps attacker and defender perceptions and shows how deception flips risk into opportunity… | ||
| The Library of Sparta | David Raymond, Greg Conti, Tom Cross | 52m |
Claims that military doctrine supplies repeatable processes defenders can apply: adopt disciplined OPSEC and an intelligence cycle for predictive threat… | ||
| Digging for IE11 Sandbox Escapes Part 1 | James Forshaw | 57m |
Describes discovery of 4 sandbox escapes in IE11 during a 30‑day bug bounty, with working exploit chains that use COM brokers, registry symbolic links and NT… | ||
| The Beast is in Your Memory | Ahmad-Reza Sadeghi, Daniel Lehmann | 55m |
Claims that coarse-grained CFI (kBouncer, ROPGuard, ROPecker and EMET) stop ROP are false: researchers transform publicly available Windows exploits to bypass… | ||
| Babar-ians at the Gate: Data Protection at Massive Scale | Davi Ottenheimer | 50m |
The talk catalogues concrete failures and fixes in Hadoop deployments: delegation tokens leak in URLs and logs, Kerberos keytabs are written to world‑readable… | ||
| Digging for IE11 Sandbox Escapes Part 2 | James Forshaw | 40m |
Claims four concrete sandbox escapes found in a 30-day bounty, with sample source on GitHub and all now patched. Demonstrates reading the elevation policy to… | ||
| My Google Glass Sees Your Passwords! | Xinwen Fu, Qinggang Yue, Zhen Ling | 24m |
A computer-vision attack records fingertip motion with Google Glass, webcams or camcorders and maps touch points to a reference keyboard using planar… | ||
| Learn How to Control Every Room at a Luxury Hotel Remotely | Jesus Nomeames | 21m |
Hotel room iPads sit on the guest Wi‑Fi and send unencrypted UDP KNX frames to a KNX/IP gateway; the deployment uses predictable three‑part KNX addresses and… | ||
| A Survey of Remote Automotive Attack Surfaces | Charlie Miller, Chris Valasek | 58m |
Survey catalogs network diagrams for dozens of makes, scores cars by a three-step model (remote ECU compromise → CAN message injection → cyber‑physical… | ||
| The BEAST Wins Again: Why TLS Keeps Failing to Protect HTTP | Antoine Delignat-Lavaud | 53m |
Demonstrates three concrete exploits that bypass HTTPS assumptions: a renegotiation-style attack re-enabled by implementation quirks, a truncation exploit that… | ||
| 48 Dirty Little Secrets Cryptographers Don’t Want You To Know | Thomas Ptacek, Big Ol Al | 51m |
A collection of 48 hands‑on crypto challenges yields per‑language exploit code and a Rosetta‑Code site, with 10,000 participants submitting solutions from x86… | ||
| Smart Nest Thermostat: A Smart Spy in Your Home | Yier Jin, Grant Hernandez, Daniel Buentello | 50m |
Researchers demonstrate full device compromise by using the TI SoC’s peripheral USB boot to upload a custom x‑loader and u‑boot, mount the filesystem and… | ||
| Protecting Data In-Use from Firmware and Physical Attacks | Steve Weis | 27m |
Survey of concrete exploits and countermeasures: SMM bootkits that persist below the OS, hard‑drive firmware tampering, DMA exfiltration via off‑the‑shelf PCI… | ||
| How Smartcard Payment Systems Fail | Ross Anderson | 59m |
EMV deployment proves fragile: researchers build a laptop-controlled man-in-the-middle PIN bypass that lets stolen chip cards approve transactions with PIN… | ||
| Probabilistic Spying on Encrypted Tunnels | Brandon Niemczyk, Prasad Rao | 22m |
An open-source pacen toolkit trains on labeled pcaps and classifies encrypted tunnels by counting packet sizes in 10s windows, using modified decision trees… | ||
| I Know Your Filtering Policy Better than You Do | Ben Williams | 49m |
A lightweight JavaScript agent called webfeet requests many file types and harvests modified responses and headers (Via, cache, X-) so external attackers learn… | ||
| Fingerprinting Web Application Platforms by Variations in PNG Implementations | Dominique Bongard | 18m |
Generates malformed PNG/MNG/jNG test images that exploit decoder differences and uses a Python tool to upload them and match response patterns to specific… | ||
| Pulling Back the Curtain on Airport Security: Can a Weapon Get Past TSA? | Billy Rios | 32m |
Shows concrete failures: RapidScan 522B ships with plaintext service creds, a buggy TIP mode that injects fake threat images into screener displays, and runs… | ||
| Contemporary Automatic Program Analysis | Julian Cohen | 42m |
Automated and manual analysis combine to find real bugs: a simple script GitHub G.P. runs thousands of code-search queries and surfaces ~1.5M PHP… | ||
| The New Page of Injections Book: Memcached Injections | Ivan Novikov | 49m |
Shodan shows ~118,000 exposed memcached instances; research tests drivers for Go, Ruby, Java, Python, PHP, Lua and .NET and finds concrete exploits… | ||
| Call To Arms: A Tale of the Weaknesses of Current Client-Side XSS Filtering | Martin Johns, Ben Stock, Sebastian Lekies | 55m |
Analysis shows Chrome's XSS Auditor has concrete weaknesses: a static code review finds 17 flaws, an automatic exploit generator (taint-tracking patched… | ||
| How to Leak a 100-Million-Node Social Graph in Just One Week? | Pili Hu, Wing C. Lau | 31m |
Demonstrates an OAuth 2.0 implicit-authorization-grant flow + bearer-token abuse that lets an attacker obtain app access tokens without the app secret, then… | ||
| Epidemiology of Software Vulnerabilities: A Study of Attack Surface Spread | Kymberlee Price, Jake Kouns | 28m |
Study shows third-party libraries spread single bugs across products: OpenSSL has 45 vulnerabilities and a 5.39 average CVSS with 1–6 releases/year; FreeType… | ||
| Finding and Exploiting Access Control Vulnerabilities in Graphical User Interfaces | Collin Mulliner | 55m |
Defines GEMs as UI-element misuse that lets attackers bypass in-app access control, documents three concrete classes (unauthorized callback execution… | ||
| Building Safe Systems at Scale - Lessons from Six Months at Yahoo | Alex Stamos | 01h 00m |
Six months running security at a billion-user web company yields specific lessons: tens of thousands of front-end servers and 200+ petabytes of storage break… | ||
| Attacking Mobile Broadband Modems Like a Criminal Would | Andreas Lindh | 25m |
Shows concrete, web-based attacks that let an attacker reroute traffic and push firmware updates without code signing: a simple DNS profile CSRF can add a… | ||
| Time Trial: Racing Towards Practical Timing Attacks | Daniel A. Mayer, Joel Sandin | 50m |
A measurement framework called time trial implements the percentile-based Box test and finds what is and isn’t exploitable: LAN and EC2 networks distinguish… | ||
| CloudBots: Harvesting Crypto Coins Like a Botnet Farmer | Rob Ragan, Oscar Salazar | 51m |
Demonstrates a working cloud-based botnet built from free trials by automating account signup, confirmation, and control: Google App Engine inbound mail… | ||
| Pivoting in Amazon Clouds | Andres Riancho | 56m |
A remote file include on a front-end EC2 lets an attacker proxy requests to 169.254 metadata and pull user-data and instance profile credentials; released… | ||
| RAVAGE - Runtime Analysis of Vulnerabilities and Generation of Exploits | Xiaoran Wang, Yoel Gluck | 47m |
RAVAGE is a Java runtime analysis tool that tracks taint across wrapped objects to produce complete data flows and JSON-formatted issue reports, integrates… | ||
| SVG: Exploiting Browsers without Image Parsing Bugs | Rennie deGraaf | 24m |
Shows concrete SVG pitfalls and browser behaviour: test files and a Node.js server demonstrate that Internet Explorer applies external stylesheets and even… | ||
| Bringing Software Defined Radio to the Penetration Testing Community | Jean-Michel Picod, Jonathan-Christofer Demay, Arnaud Lebrun | 37m |
A usable toolkit called scapy-radio integrates GNU Radio flowgraphs with scapy to let pen testers capture and inject real RF packets; it works with USRP… | ||
| SATCOM Terminals: Hacking by Air, Sea, and Land | Ruben Santamarta | 48m |
Static firmware reverse engineering targets more than 20 widely deployed SATCOM terminals and finds 100% of devices could be abused through hardcoded… | ||
| Saving Cyberspace | Jason Healey | 51m |
Argues that attackers hold the advantage for roughly 35 years and that the internet risks a systemic shock like a “Lehman moment” for cloud providers that… | ||
| Cellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol | Mathew Solnik, Marc Blanchou | 52m |
Reverse engineering of basebands and SyncML clients shows over 2 billion devices expose carrier-managed device control, with a single vendor (Redbend VDirect)… | ||
| Mission mPOSsible | Nils, Jon Butler | 38m |
Research demonstrates code execution on consumer mPOS terminals by chaining three real vectors: a firmware update handler that triggers on USB unplug… | ||
| The State of Incident Response | Bruce Schneier | 55m |
Argues incident response grows urgent because control of IT shrinks (cloud, locked devices), attacks rise in skill and focus, and governments escalate — three… | ||
| BadUSB - On Accessories that Turn Evil | Karsten Nohl, Jakob Lell | 45m |
Off-the-shelf USB controllers are reprogrammed to change device class: leaked firmware updaters and Wireshark traces let the team reverse engineers 8051… | ||
| Breaking the Security of Physical Devices | Silvio Cesare | 44m |
Demonstrates concrete breaks: eavesdrops 40 MHz AM baby monitors with cheap software‑defined radio, builds an Arduino/Raspberry Pi $50 replay device that… | ||
| Oracle Data Redaction is Broken | David Litchfield | 46m |
Oracle 12c’s Data Redaction promises masked output but is trivial to bypass: XMLQuery and XMLTable return redacted columns, RETURNING INTO on updates leaks… | ||
| Cybersecurity as Realpolitik | Dan Geer | 55m |
Proposes mandatory CDC-style reporting for high‑severity breaches plus a voluntary MITRE-like anonymized near‑miss sharing system, a two‑clause software… | ||
| nothing matches | ||