Black Hat USA 2016
2016-08-03..2016-08-04
Las Vegas, United States
[Black Hat USA 2014, Black Hat USA 2016, Black Hat USA 2019, Black Hat USA 2023]
| title | author | length |
|---|---|---|
| Keynote: The Hidden Architecture of our Time: Why This Internet Worked, How We Could Lose It... | Dan Kaminsky | 01h 13m |
A cloud-hosted Chrome demo streams a full browser and proves a deployment pattern: frontload VM setup, then hand control to a container and apply seccomp/BPF… | ||
| When the Cops Come A-Knocking: Handling Technical Assistance Demands from Law Enforcement | Jennifer Granick, Riana Pfefferkorn | 44m |
Explains what U.S. orders actually demand: decrypt stored data, hand over keys, install government hardware, or write custom code; legal hooks include All… | ||
| Certificate Bypass: Hiding and Executing Malware from a Digitally Signed Executable | Tom Nipravsky | 26m |
Demonstrates a method to append a PE payload into the PE attribute certificate table (ACT) of a signed Microsoft Office binary, update the security-directory… | ||
| HEIST: HTTP Encrypted Information can be Stolen Through TCP-Windows | Tom Van Goethem, Mathy Vanhoef | 50m |
by Tom Van Goethem & Mathy Vanhoef
Over the last few years, a worryingly number of attacks against SSL/TLS and other secure channels have been discovered… | ||
| A Lightbulb Worm? | Colin O'Flynn | 26m |
Examines Philips Hue internals, shows ability to extract decrypted firmware by forcing bootloader into debug, uses a custom board and clock-glitch attack to… | ||
| AirBnBeware: Short Term Rentals Long Term Pwnage | Jeremy Galloway | 45m |
Airbnb-scale short-term rentals create a real attack surface: an estimated 2 million vulnerable networks worldwide where physical access lets an attacker… | ||
| HTTP Cookie Hijacking in the Wild: Security and Privacy Implications | Suphannee Sivakorn, Jason Polakis | 46m |
An empirical audit of 25 major sites finds 15 support HTTPS but fail to enforce it everywhere, allowing stolen HTTP cookies to reveal names, email, home/work… | ||
| Behind the Scenes of iOS Security | Ivan Krstić | 52m |
Apple describes three concrete iOS 10 changes: a WebKit JIT that splits one 32MB region into executable and secret writable mappings and emits a small… | ||
| Panel: Removing Roadblocks to Diversity | Kelly Jackson Higgins, Jamesha Fisher, Rebekah Brown, Angie Leifson, Chenxi Wang | 01h 41m |
Moderator: Kelly Jackson Higgins, Executive Editor of Dark Reading
Panelists: Jamesha Fisher, Security Operations Engineer at GitHub; Rebekah Brown, Threat… | ||
| Defense at Hyperscale: Technologies and Policies for a Defensible Cyberspace | Jason Healey | 52m |
A task‑force finds defense can be cheaper and more scalable than offense by targeting engineering and policy levers that remove whole attack classes: rollout… | ||
| A Retrospective on the Use of Export Cryptography | David Adrian | 51m |
Three export-era failures enable modern attacks: FREAK lets a man‑in‑the‑middle force RSA export keys (servers briefly hit ~36.7% support; current measurement… | ||
| Abusing Bleeding Edge Web Standards for Appsec Glory | Bryant Zadegan, Ryan Lester | 43m |
Built a tiny library that adds an X-SRI-fallback attribute so third‑party scripts can fallback to a local copy (SRI fallback), demonstrates injecting CSP via… | ||
| Augmenting Static Analysis Using Pintool: Ablation | Paul Mehta | 43m |
Ablation is a PIN-based tool that instruments a process, records each basic block only on first execution, resolves virtual calls (including targets in… | ||
| Beyond the Mcse: Active Directory for the Security Professional | Sean Metcalf | 50m |
Active Directory secures 95% of Fortune 1000 firms and the talk lays out concrete attack and defense artifacts: exploitation of MS14-068 to forge Kerberos… | ||
| Breaking Payment Points of Interaction (POI) | Nir Valtman, Patrick Watson | 50m |
Demonstrates that a production pinpad can be compromised without OS exploits by placing a man‑in‑the‑middle device (Raspberry Pi) on Ethernet or by monitoring… | ||
| Can You Trust Me Now? An Exploration Into the Mobile Threat Landscape | Josh Thomas, Shawn Moyer | 44m |
Survey of the full mobile stack identifies where real risk lives: Qualcomm dominates SoC market (≈60–70% share), OEM/carrier Android forks cause update… | ||
| Capturing 0Day Exploits With Perfectly Placed Hardware Traps | Cody Pierce, Matt Spisak, Kenneth Fitch | 48m |
Prototype enforces runtime CFI by using PMU+LBR traps to break on mispredicted indirect calls, reading LBR to get the true target, and consulting an on-load… | ||
| HTTP/2 & Quic - Teaching Good Protocols to Do Bad Things | Catherine (Kate) Pearce, Carl Vincent | 51m |
HTTP/2 adoption reaches roughly 15% of the Alexa top 1M and QUIC already appears on many Google properties and over a billion Chrome clients, while ~93% of… | ||
| The Linux Kernel Hidden Inside Windows 10 | Alex Ionescu | 52m |
A built-in Ring-0 driver implements a Linux-compatible ABI (not the Linux kernel) that runs unmodified ELF binaries, exposes 216 syscalls, and implements VFS… | ||
| $Hell on Earth: From Browser to System Compromise | Matt Molinyawe, Jasiel Spelman, Abdul Aziz Hariri, Joshua Smith | 49m |
Eight browser-to-system exploit chains are dissected with concrete primitives, payloads and root causes: eight winning chains, 21 vulnerabilities, including… | ||
| A Journey From JNDI/LDAP Manipulation to Remote Code Execution Dream Land | Alvaro Munoz, Oleksandr Mirosh | 48m |
A new class of JNDI vulnerability claims remote code execution via CVE-2015-4902 by abusing dynamic protocol switching so lookups can be pointed at attacker… | ||
| Applied Machine Learning for Data Exfil and Other Fun Topics | Matt Wolff, Brian Wallace, Xuan Zhao | 44m |
Nmap output becomes feature vectors (ports, service banners, script text) and is clustered with K‑means and interactive splitting so a user drills from… | ||
| Exploiting Curiosity and Context: How to Make People Click on a Dangerous Link... | Zinaida Benenson | 43m |
Sent fake email and Facebook messages to over 1600 students claiming links to party photos, serve an “access denied” landing page and log who clicks. When… | ||
| Hackproofing Oracle Ebusiness Suite | David Litchfield | 50m |
A week of code review on a fully patched 11.5 install finds 21 SQL injection bugs, 26 XSS, two simple DoS vectors and dozens of exploitable JSPs via the PL/SQL… | ||
| Measuring Adversary Costs to Exploit Commercial Software... | Sarah Zatko | 50m |
CITL measures how much work an attacker needs to newly exploit commercial binaries by scoring 100,000+ Windows, Linux, and OS X executables using static… | ||
| Memory Forensics Using Virtual Machine Introspection for Cloud Computing | Tobias Zillner | 33m |
A working prototype implements memory-forensics-as-a-service by adding per-node forensic services to an OpenNebula cloud and using LibVMI with Xen to collect… | ||
| Nonce-Disrespecting Adversaries: Practical Forgery Attacks on GCM in TLS | Sean Devlin, Hanno Bock, Aaron Zauner, Philipp Jovanovic | 49m |
Investigates GCM nonce misuse in TLS, demonstrates a Joux-style forgery that recovers the GCM authentication subkey when an 8‑byte nonce repeats, and builds a… | ||
| Subverting Apple Graphics: Practical Approaches to Remotely Gaining Root | Liang Chen, Qidan He, Marco Grassi, Yubin Fu | 54m |
Demonstrates full exploit chains that turn sandboxed browser code into root on El Capitan by abusing WindowServer MIG IPC and IOAccelerator userclients… | ||
| Adaptive Kernel Live Patching: An Open Collaborative Effort... | Yulong Zhang, Tao Wei | 47m |
Framework claims live binary hotpatching for fragmented Android kernels without source by generating adapted patches from device-collected kernel info and… | ||
| Canspy: A Platform for Auditing Can Devices | Arnaud Lebrun, Jonathan-Christopher Demay | 42m |
A low-cost hardware + firmware platform that implements STM32 discovery kit plus a <$40 shield to give two CAN interfaces and SD card logging, designed to… | ||
| Drone Attacks on Industrial Wireless: A New Front in Cyber Security | Jeff Melrose | 43m |
Shows that consumer quadcopters can deliver RF payloads close enough to disrupt industrial wireless: commercial tests with Phantom 4 and Phantom 3 variants… | ||
| Gattacking Bluetooth Smart Devices - Introducing a New BLE Proxy Tool | Slawomir Jasek | 40m |
A new BLE MITM proxy clones advertisements and GATT services (exports/uses JSON) and proxies traffic over WebSockets, runs in NodeJS on minimal hardware (cheap… | ||
| Secure Penetration Testing Operations: Demonstrated Weaknesses in Learning Material and Tools | Wesley McGrew | 47m |
Study shows widely used books and free training omit operational security: of 24 resources reviewed 14 address none of the key issues and only 4 cover more… | ||
| Towards a Holistic Approach in Building Intelligence to Fight Crimeware | Dhia Mahjoub, Mykhailo Sakaly, Thomas Mathew | 50m |
Combines network telemetry (passive DNS, PTR, BGP, Project Sonar scans) with human infiltration of underground forums to map bulletproof hosting… | ||
| 1000 Ways to Die in Mobile Oauth | Yuan Tian, Eric Chen, Shuo Chen, Yutong Pei, Robert Kotcher, Patrick Tague | 47m |
Field study of 600 popular mobile apps finds 149 using OAuth and 59.7% vulnerable; bugs include embedded client secrets, redirect‑URI hijacks, missing consent… | ||
| Xenpwn: Breaking Paravirtualized Devices | Felix Wilhelm | 53m |
Research uses Xenpwn with nested virtualization, LibVMI memory introspection, Capstone disassembly and a zero-trace storage backend to trap EPT violations on… | ||
| AMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It | Nikhil Mittal | 47m |
Windows 10’s AMSI inspects clear-text scripts submitted to the scripting host and Windows Defender blocks in-memory attacks in demos, including detection of… | ||
| An Insider's Guide to Cyber-Insurance and Security Guarantees | Jeremiah Grossman | 51m |
Security spending totals $75 billion security market yearly while cyber‑insurance grows to about $3.5–4 billion, shifting buyer behavior from prevention to… | ||
| I Came to Drop Bombs: Auditing the Compression Algorithm Weapon Cache | Cara Marie | 28m |
Demonstrates concrete decompression bombs and measurements: a 25,500×25,500 JPEG 103 bytes that crashes Preview, nested archives like 42.zip → 4.5 PB… | ||
| Does Dropping USB Drives in Parking Lots and Other Places Really Work? | Elie Bursztein | 34m |
A controlled experiment drops 297 USB sticks across a university campus and finds 98% picked up and about 48% of those clicked files (uploader’s numbers); the… | ||
| Into the Core: In-Depth Exploration of Windows 10 IoT Core | Paul Sabanal | 50m |
Windows 10 IoT Core images use FFU (convertible with ImageMount), ship for four suggested boards (Raspberry Pi 2/3, MinnowBoard, DragonBoard), and expose four… | ||
| Intra-Process Memory Protection for Applications on ARM and X86: Leveraging the ELF ABI | Sergey Bratus, Maxwell Koo, Julian Bangert | 52m |
A system uses the existing ELF ABI and a modified Linux loader to attach per-section access policies so code sections can only read or write designated data… | ||
| Pwning Your Java Messaging With Deserialization Vulnerabilities | Matthias Kaiser | 49m |
Shows that JMS object messages deserialize untrusted data across many brokers, with about 13 vendors vulnerable including Oracle, IBM and RabbitMQ; Apache… | ||
| Recover a RSA Private Key From a TLS Session With Perfect Forward Secrecy | Marco Ortisi | 42m |
Claim: a faulty RSA-CRT signature exposed during the TLS ServerKeyExchange lets an attacker factor N and recover the private key even for 4096-bit… | ||
| Access Keys Will Kill You Before You Kill the Password | Loic Simon | 32m |
Claim: long‑lived AWS access keys are the weakest link, widely stored in plaintext and shared, and possession gives unconditional API access. Practical fix… | ||
| Account Jumping Post Infection Persistency & Lateral Movement in AWS | Dan Amiga, Dor Knafo | 35m |
Shows concrete attacks and defenses for AWS including a live demo where STS temporary tokens continue to work after original access keys are deleted enabling… | ||
| Breaking Kernel Address Space Layout Randomization (KASLR) With Intel TSX | Yeongjin Jang, Sangho Lee, Taesoo Kim | 50m |
A new attack called DrK uses Intel Transactional Synchronization Extensions to time aborted transactions and distinguish unmapped, mapped non‑executable, and… | ||
| Crippling HTTPs With Unholy PAC | Itzik Kotler, Amit Klein | 44m |
Demonstrates forcing browsers to load a malicious PAC via option 252 DHCP spoof or spoofed WPAD DNS, then leaking full HTTPS URLs (including SSO tokens and… | ||
| Design Approaches for Security Automation | Peleus Uhley | 38m |
Built a modular automation framework that runs tools as Docker worker images, talks to a queuing layer with Celery and RabbitMQ, and exposes results via simple… | ||
| GreatFET: Making GoodFET Great Again | Michael Ossmann | 46m |
Project takes control of GoodFET codebase and replaces it with a redesigned board (Aelia → GreatFET One) that swaps the costly TI parts for a single Cortex‑M4… | ||
| Using EMET to Disable EMET | Abdulellah Alsaheel, Raghav Pande | 52m |
Demonstrates a reliable ROP chain that calls DllMain with PROCESS_DETACH to trigger EMET’s unload routine, uses GetModuleHandle to find EMET’s base and… | ||
| Viral Video - Exploiting SSRF in Video Converters | Nikolay Ermishkin, Maxim Andreev | 34m |
Demonstrates that ffmpeg playlist handling enables SSRF and local-file reads by abusing ffmpeg hls m3u8 support and protocols like concat/subfile protocols… | ||
| AVLeak: Fingerprinting Antivirus Emulators for Advanced Malware Evasion | Alexei Bulazel | 28m |
AVLeak is an automated black‑box tool (C core, Python API, Capstone integration) that fingerprints consumer AV emulators—Kaspersky, AVG, Bitdefender engine… | ||
| Brute-Forcing Lockdown Harddrive Pin Codes | Colin O'Flynn | 26m |
Emulates the front‑panel I2C keypad over the header and toggles the chip reset to bypass the lockout, using an ATMega/Arduino dev board to submit guesses and… | ||
| Building a Product Security Incident Response Team: Learnings From the Hivemind | Kymberlee Price | 29m |
Provides concrete playbook pieces: a web-based vulnerability disclosure policy and boilerplate, a checklist of investigation fields and an advisory checklist… | ||
| Cyber War in Perspective: Analysis From the Crisis in Ukraine | Kenneth Geers | 29m |
NATO-funded study of the Ukraine crisis argues cyber operations are real, targeted campaigns that support kinetic moves: photo-geolocation proves Russian tank… | ||
| Security Through Design - Making Security Better By Designing for People | Jelle Niemantsverdriet | 28m |
Argues that “human error” is a symptom of bad systems and offers concrete fixes: operational checklists like pilots use, design thinking and empathy (example… | ||
| Side-Channel Attacks on Everyday Applications | Taylor Hornby | 24m |
Applies the FLUSH+RELOAD L3 cache side channel to real applications to distinguish which Wikipedia page a user visits among a known set. Requires SSH access to… | ||
| The Risk From Power Lines: How to Sniff the G3 and Prime Data and Detect the Interfere Attack | Lei Ji, Yunding Jian | 18m |
Method to sniff narrow-band PLC (G3 vs Prime) by capturing raw samples, band‑pass filtering, computing autocorrelation → FFT power spectrum, and matching… | ||
| Unleash the Infection Monkey: A Modern Alternative to Pen-Tests | Ofri Ziv | 31m |
Open source Infection Monkey runs as a self‑propagating VM, a CNC Monkey Island server and an orchestration Monkey Business that seeds islands across subnets… | ||
| Watching Commodity Malware Get Sold to a Targeted Actor | Israel Barak | 31m |
Research analyzes how mass-click-fraud/adware compromises are re-classified, upgraded and sold on marketplaces where sellers verify live access before listing… | ||
| BadTunnel: How Do I Get Big Brother Power? | Yang Yu | 25m |
Claims a long standing Windows NetBIOS name service design flaw lets a remote host trigger the OS to open a double-direction UDP 137 tunnel through NAT by… | ||
| Blunting the Phisher's Spear: A Risk-Based Approach... | Arun Vishwanath | 27m |
Claims a measurable, individual risk metric replaces one-size-fits-all training: a five-factor SCAM model (suspicion, cognition, automaticity, plus habits and… | ||
| Dungeons Dragons and Security | Tiphaine Romand Latapie | 22m |
A physical role‑playing exercise simulates attackers and defenders vying for a backpack-sized asset in an office building, run as 90–120 minute sessions for… | ||
| Dark Side of the DNS Force | Erik Wu | 25m |
Claims that DNS-based attacks now scale by exploiting massive domain growth from 300 million to over 2 billion and spikes to 5 billion, reusing techniques from… | ||
| Keystone Engine: Next Generation Assembler Framework | NGUYEN Anh Quynh | 24m |
Keystone is an assembler engine that compiles assembly to machine code for many CPUs and returns ready-to-run encodings; it ships as a single, thread-safe… | ||
| Pindemonium: A DBI-Based Generic Unpacker for Windows Executable | Sebastiano Mariani, Lorenzo Fontana | 25m |
PINdemonium is a DBI-based unpacker built on Intel PIN DBI that detects write-then-execute heap regions, dumps main and heap sections, reconstructs IATs via a… | ||
| Samsung Pay: Tokenized Numbers Flaws and Issues | Salvador Mendoza | 19m |
Samsung Pay’s tokenization leaks practical attack surface: MST magnetic transmissions can be captured and replayed with cheap hardware — MST capture via… | ||
| What's the DFIRence for ICS? | Chris Sistrunk, Josh Triplett | 25m |
Concrete collection steps for embedded ICS: pull configs, firmware, logs, memory dumps, and record physical state rather than vague theory. Examples target GE… | ||
| Defense At Hyperscale: Technologies and Policies for a Defensible Cyberspace | Jason Healey | 52m |
A recent task force catalogs concrete interventions that scale: automated updates (the classic million‑x payoff), moving services to a cloud‑based architecture… | ||
| Ouroboros: Tearing Xen Hypervisor With the Snake | Shangcong Luan | 25m |
by Shangcong Luan
The Xen Project has been a widely used virtualization platform powering some of the largest clouds in production today.
Sitting directly on… | ||
| Advanced CAN Injection Techniques for Vehicle Networks | Charlie Miller, Chris Valasek | 50m |
Demonstrations show remote CAN injection achieving steering, braking and acceleration control on a Jeep at real speeds by combining precise bus timing to… | ||
| TCP Injection Attacks in the Wild - a Large Scale Study | Gabi Nakibly | 39m |
Massive survey examines 1.5 Peta-bits from 1.5 million IPs and finds 14 injection groups: eight ad-injection clusters, four delivering malware (malicious APKs… | ||
| The Remote Malicious Butler Did It! | Tal A. Be'ery, Chaim Hoch | 49m |
A network-only version of the Evil Maid attack turns up as the Remote Malicious Butler: a hacked internal host runs a rogue Domain Controller (Bluebox-style)… | ||
| Windows 10 Segment Heap Internals | Mark Vincent Yason | 42m |
Describes Windows 10 Segment Heap internals: back end, VS, LFH and large-block paths, their data structures, free trees and best‑fit with “most committed”… | ||
| The Art of Defense - How Vulnerabilities Help Shape Security Features and Mitigations in Android | Nick Kralevich | 53m |
Android recounts concrete defenses: a kernel pingpong r00t flaw prompts a three‑pronged response—upstream kernel patch in 12 days, closing the generic socket… | ||
| Understanding HL7 2.X Standards, Pen Testing, and Defending HL7 2.X Messages | Anirudh Duggal | 46m |
HL7 v2.x runs in ~95% of hospitals and sends plaintext patient data; scans find HL7 listeners on arbitrary ports (examples: 207, 9001, 10200). Demos show… | ||
| Analysis of the Attack Surface of Windows 10 Virtualization-Based Security | Rafal Wojtczuk | 51m |
Breaks down Windows 10 virtualization based security (VBS) internals, shows two live exploits (one bypassing a VBS feature, one critical firmware compromise)… | ||
| Cunning With CNG: Soliciting Secrets From Schannel | Jake Kambic | 47m |
Demonstrates that Schannel/CNG leaks decryptable secrets from memory so TLS sessions that use ephemeral ECDHE are recoverable by extract master keys and… | ||
| Demystifying the Secure Enclave Processor | Tarjei Mandt, Mathew Solnik, David Wang | 48m |
Breaks down the SEP as a separate ARMv7a core with image4 manifest firmware supplied by the AP at every boot, inline memory encryption for external RAM, and a… | ||
| Hacking Next-Gen ATMs: From Capture to Cashout | Weston Hecker | 33m |
Demonstrates a working attack chain that buys harvested card sessions from a fraud backend, relays EMV/NFC traffic to a remote card emulator and automates PIN… | ||
| Next-Generation of Exploit Kit Detection By Building Simulated Obfuscators | Tongbo Luo, Xing Jin | 23m |
Builds reconstructed obfuscators for six EK families (Angler, Nuclear, Rig, Magnitude, Neutrino, SweetOrange) from ~20,000 malware samples, using JavaScript… | ||
| Investigating DDOS - Architecture Actors and Attribution | Elliott Peterson, Andre Correa | 52m |
Deploys distributed UDP honeypots and indexes PCAPs with Moloch, collecting about 8 million records in 2016 and 30,000 targeted IPs in July; finds booters… | ||
| O-Checker: Detection of Malicious Documents Through Deviation From File Format Specifications | Yuhei Otsubo | 19m |
o-checker inspects files for concrete deviations from format specs (RTF, CFB, PDF) and flags embedded executables that are stored but not displayed… | ||
| Language Properties of Phone Scammers: Cyberdefense At the Level of the Human | Judith Tabron | 49m |
Forensic linguistics analyzes a small YouTube corpus of IRS scam calls and finds reproducible interaction markers: frequent polar tag questions (7–33… | ||
| The Tao of Hardware the Te of Implants | Joe FitzPatrick | 43m |
Demonstrates concrete, reproducible implants: a blind JTAG escalation using a solderPeak/SVF payload that flips a getty flag to gain root (demoed with a… | ||
| BadWPAD | Maxim Goncharov | 25m |
WPAD auto‑proxy resolution still leaks worldwide and is exploitable: a honeypot built with Apache on AWS collects WPAD fetches from airports, hotel hotspots… | ||
| Hardening AWS Environments and Automating Incident Response for AWS Compromises | Andrew J Krug, Alex McCormack | 46m |
Demos a usable toolkit that actually disables compromised IAM keys, snapshots volumes, quarantines instances with a deny‑egress security group and streams live… | ||
| Horse Pill: A New Type of Linux Rootkit | Michael Leibowitz | 49m |
A new Linux rootkit called Horse Pill uses namespace/cgroup container tricks to implant a backdoor into the initramfs so systems with UEFI Secure Boot can be… | ||
| Discovering and Exploiting Novel Security Vulnerabilities in Apple ZeroConf | Luyi Xing, Xiaolong Bai | 42m |
Systematic reverse engineering shows Apple ZeroConf components — Bonjour impersonation, Multipeer Connectivity PID spoofing, AirDrop over the private aw0… | ||
| SGX Secure Enclaves in Practice: Security and Crypto Review | Jean-Philippe Aumasson, Luis Merino | 48m |
Hands-on assessment uses real Skylake hardware and both Intel Windows SDK (requires Visual Studio Professional 2012) and the new Linux SDK from GitHub… | ||
| Weaponizing Data Science for Social Engineering: Automated E2E Spear Phishing on Twitter | John Seymour, Philip Tully | 42m |
An end-to-end system called Snapper clusters Twitter profiles to pick high-value targets, scrapes timelines for topics and active hours, then seeds a recurrent… | ||
| Windows 10 Mitigation Improvements | Matt Miller, David Weston | 51m |
Data-driven exploit analysis finds over 85% of two years of Adobe in-the-wild exploits rely on read/write primitives via vector-length corruption, prompting… | ||
| Bad for Enterprise: Attacking BYOD Enterprise Mobile Security Solutions | Vincent Tan | 39m |
Claims that EMS is impenetrable are false: enterprise protections are bypassed on both jailbroken and non‑jailbroken iOS devices. The researcher builds… | ||
| Breaking FIDO: Are Exploits in There? | Jerrod Chong | 38m |
FIDO U2F uses per-site public/private key pairs generated by the authenticator, transports over USB NFC Bluetooth, and requires a signed, origin-bound… | ||
| Iran's Soft-War for Internet Dominance | Claudio Guarnieri, Collin Anderson | 52m |
Research maps multiple Iranian intrusion campaigns that target journalists, human-rights defenders, diaspora networks and even separatist militants using real… | ||
| OSS Security Maturity: Time to Put on Your Big Boy Pants! | Jake Kouns, Christine Gadsby | 52m |
Claims that unmanaged OSS is a major enterprise risk and shows concrete fixes: BlackBerry measures 536 unique libraries across 75 product variants, finds up to… | ||
| Pangu 9 Internals | Tielei Wang, Hao Xu, Xiaobo Chen | 47m |
Pangu 9 details a chain: an XPC path traversal in an assetd service lets any container app move arbitrary files as mobile for file read/write; mounting an old… | ||
| PLC-Blaster: A Worm Living Solely in the PLC | Ralf Spenneberg, Maik Brüggemann, Hendrik Schwartke | 38m |
Claim: a PLC-only worm that runs entirely on Siemens Simatic S7-1200 v1–v3 PLCs, written in SCL, implements the S7 download protocol over TCP port 102 via… | ||
| The Year in Flash | Natalie Silvanovich | 40m |
Five Adobe Flash vulnerabilities (three nearly identical) surface in the hacking team dump, followed by dozens of fixes: 33 in July, 23 in September, 20 in… | ||
| VoIP Wars: the Phreakers Awaken | Fatih Ozavci | 53m |
Demonstrations show concrete exploits against cloud UC and IMS installations including a method to jailbreak tenant environments and a reproducible MSRP file… | ||
| Web Application Firewalls: Analysis of Detection Logic | Vladimir Ivanov | 40m |
Analysis inspects detection logic of six open‑source WAFs (ModSecurity/CRS 2,3, Comodo, PHPIDS, QuickDefense, Libinjection), reports over 300 potential regex… | ||
| Breaking Hardware-Enforced Security With Hypervisors | Joseph Sharkey | 49m |
Claim: a thin hypervisor rootkit virtualizes SMX, presents a virtual TPM and emulates the TXT memory map so tboot and kernel utilities see valid PCRs while… | ||
| Crumbling the Supercookie and Other Ways the FCC Protects Your Internet Traffic | Travis LeBlanc, Jonathan Mayer | 55m |
The FCC recounts concrete enforcement: it forces Verizon to stop inserting a UIDH supercookie HTTP header unless customers give opt-in consent, settling for… | ||
| DPTrace: Dual Purpose Trace for Exploitability Analysis of Program Crashes | Rodrigo Rubira Branco, Rohit Mothe | 48m |
DPTrace is a semi‑automated crash analysis framework that combines backward and forward taint to map input bytes that reach a faulting instruction and then… | ||
| The Art of Reverse Engineering Flash Exploits | Jeong Wook Oh | 47m |
Claims at least 17 Flash zero‑days/1‑days seen in 2015 and shows concrete reversal methods: use JPEXS and ActionScript Viewer for decompilation, patch the… | ||
| The Beast Within - Evading Dynamic Malware Analysis Using Microsoft COM | Ralf Hund | 50m |
Microsoft COM usage appears in 20% of samples and causes missed behavior, so small C test programs — five 10–20 line C test cases (auto-start, IE browser… | ||
| Timing Attacks Have Never Been So Practical: Advanced Cross-Site Search Attacks | Nethanel Gelernter | 51m |
Demonstrates practical extraction of secrets via timing side channels using browser-based XS-search (cache reloads of a single cached request) and second-order… | ||
| Using An Expanded Cyber Kill Chain Model to Increase Attack Resiliency | Sean Malone | 50m |
Expands the Cyber Kill Chain into an Internal Kill Chain and a Target Manipulation Kill Chain, mapping concrete stages: internal reconnaissance, exploitation… | ||
| When Governments Attack: State Sponsored Malware Attacks Against Activists Lawyers and Journalists | Cooper Quintin, Eva Galperin | 47m |
Research documents a targeted campaign against Kazakh dissidents, lawyers and journalists that uses off‑the‑shelf RATs rather than custom exploits: JRat and… | ||
| An AI Approach to Malware Similarity Analysis: Mapping the Malware Genome With a Deep Neural Network | Konstantin Berlin | 31m |
Describes using a variational autoencoder to remap feature vectors so distances reflect true family relationships, trained on 800,000 VirusTotal samples with… | ||
| An Inconvenient Trust: User Attitudes Toward Security and Usability Tradeoffs... | Patrick Gage Kelley | 28m |
A 52-person lab study uses a modified Mailvelope plugin to compare a manual exchange (PGP-like) model versus a key-directory or registration model (think… | ||
| Attacking SDN Infrastructure: Are We Ready for the Next-Gen Networking? | Changhoon Yoon, Seungsoo Lee | 22m |
Demonstrates practical attacks against OpenDaylight and ONOS, plus OpenFlow switches (HP, Pica8): a Maven supply-chain injection inserts malware into… | ||
| Building Trust & Enabling Innovation for Voice Enabled IoT | Lynn Terwoerds | 35m |
A public toolkit offers 39 Agile security stories for voice‑enabled IoT developers, hosted at ewfusa.com/privacy and promoted via @voiceprivacy, claiming to… | ||
| Call Me: Gathering Threat Intelligence on Telephony Scams to Detect Fraud | Aude Marzuoli | 53m |
A telephony honeypot records over 8 million unsolicited calls, logs 600,000 calls/month and records 100,000 calls to build labeled data; transcripts go through… | ||
| Dangerous Hare: Hanging Attribute References Hazards Due to Vendor Customization | Nan Zhang | 24m |
Analysis of 97 factory images finds 21,557 Hare flaws across 24,000+ preinstalled apps, with some devices showing nearly 600 issues and 400 affected apps… | ||
| Over the Edge: Silently Owning Windows 10's Secure Browser | Erik Bosman, Kaveh Razavi, Herbert Bos, Cristiano Giuffrida | 33m |
Windows 10’s default-on memory deduplication yields a measurable write slowdown that is turned into a one-bit local side channel to recover 64-bit ASLR… | ||
| Pay No Attention to That Hacker Behind the Curtain: A Look Inside the Black Hat Network | Steve Fink | 49m |
Black Hat's network team stages gear in Salt Lake City then ships racks to Vegas, replaces Mandalay Bay distribution closets and installs FortiGate gateways… | ||
| Using Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the Process | Anders Fogh, Daniel Gruss | 43m |
An unprivileged prefetch instruction timing side channel reliably leaks where kernel pages are mapped and often reveals driver locations, breaking KASLR… | ||
| Pwnie Awards 2016 | 50m | |
A rapid awards rundown of real exploits and responses: Cisco ASA heap exploit wins for a multi-stage heap/info‑leak/heap‑manipulation chain; ImageMagick and… | ||
| nothing matches | ||