Black Hat USA 2019
2019-08-03..2019-08-08
Las Vegas, United States
[Black Hat USA 2014, Black Hat USA 2016, Black Hat USA 2019, Black Hat USA 2023]
| title | author | length |
|---|---|---|
| Ghidra - Journey from Classified NSA Tool to Open Source | Brian Knighton, Chris Delikat | 48m |
Ghidra is an NSA-built, project-based SRE framework that combines disassembly, a decompiler, debugger workbench, and a file-system browser with project-based… | ||
| DevSecOps : What, Why and How | Anant Shrivastava | 53m |
In this talk, we shall focus on how a DevOps pipeline can easily be metamorphosed into a DevSecOps and the benefits which can be achieved with this… | ||
| Keynote: Every Security Team is a Software Team Now | Dino Dai Zovi | 01h 04m |
As software is eating the world, every company is becoming a software company. This doesn’t mean that every company is shipping software products, it means… | ||
| Behind the scenes of iOS and Mac Security | Ivan Krstić | 44m |
Apple describes a Mac secure boot built on the T2 security chip that initializes before x86, adds the first industry PCIe bus 0 DMA protections, and runs an… | ||
| Reverse Engineering WhatsApp Encryption for Chat Manipulation and More | Roman Zaikin, Oded Vanunu | 23m |
Reverse engineers recover WhatsApp Web keys, translate its JS crypto into Python and build a BurpSuite extension that parses the 144-byte secret, performs ECDH… | ||
| Selling 0-Days to Governments and Offensive Security Companies | Maor Shwartz | 39m |
Overview of the market, value drivers and concrete deal mechanics: vulnerability brokers and buyers pay highest for 0-click/fat unicorn vectors, typical deals… | ||
| Process Injection Techniques - Gotta Catch Them All | Itzik Kotler, Amit Klein | 49m |
A comprehensive catalog claims to enumerate nearly all Windows 10 x64 medium->medium integrity no privilege elevation process injection methods, breaking each… | ||
| Attacking and Defending the Microsoft Cloud (Office 365 & Azure AD) | Sean Metcalf, Mark Morowczynski | 50m |
Scans of public DNS and MX/TXT records reveal installed SaaS and federation setups; extracting ADFS token‑signing certs enables golden SAML with tools like ATF… | ||
| Detecting Malicious Files with YARA Rules as They Traverse the Network | David Bernal | 20m |
Integrates Zeek IDS file extraction with YARA rules plus a custom Python daemon that scans extracted files every minute, copies matches to long-term storage… | ||
| MITRE ATT&CK: The Play at Home Edition | Katie Nickels, Ryan Kovar | 48m |
Small company maps ATT&CK to Splunk, authors 41 technique detections and visualizes coverage in the ATT&CK Navigator, then uses Atomic Red Team to emulate… | ||
| WebAuthn 101 - Demystifying WebAuthn | Christiaan Brand | 26m |
WebAuthn is now a W3C-recommended way to stop phishing by signing a server challenge plus the current web origin with a key that never leaves the device… | ||
| GDPArrrrr: Using Privacy Laws to Steal Identities | James Pavur | 22m |
An experiment treats GDPR's Right of Access as an attack surface, sending 150 right-of-access requests via a Python script while the attacker knows only name… | ||
| Inside the Apple T2 | Mikhail Davidov, Jeremy Erickson | 45m |
Reverse engineers extract BridgeOS firmware, map the T2 as an A10‑based controller with a masked ROM root of trust and SEP, and show it becomes the arbiter of… | ||
| The Path Less Traveled: Abusing Kubernetes Defaults | Ian Coldwater, Duffie Cooley | 48m |
Live demos exploit common defaults: using sigs.k8s.io/kind (kubeadm-backed) to direct-schedule a pod onto the control plane and read etcd, extract a… | ||
| Death to the IOC: What's Next in Threat Intelligence | Bhavna Soman | 26m |
Claims automated extraction of actor, malware and technique names from unstructured TI text using ML and a proof‑of‑concept web app that highlights entities in… | ||
| Denial of Service with a Fistful of Packets: Exploiting Algorithmic Complexity Vulnerabilities | Nathan Hauke, David Renardy | 47m |
Demonstrates three exploit classes and practical POCs: PDF “napalm” using FlateDecode followed by repeated ASCIIHexDecode to produce a small (≈5KB) file that… | ||
| New Vulnerabilities in 5G Networks | Altaf Shaik, Ravishankar Borgaonkar | 44m |
Demonstrates that device radio capabilities are sent before security, enabling a passive/active MNmap device fingerprinting that classifies baseband maker… | ||
| Breaking Samsung's ARM TrustZone | Maxime Peterlin, Alexandre Adamski, Joffrey Guilbon | 43m |
Exploits chain from normal Android to Samsung TrustZone: buffer overflows in a trusted app and a secure driver on a Galaxy S7 (Android 7) lead to EL3 code… | ||
| Infiltrating Corporate Intranet Like NSA - Pre-auth RCE on Leading SSL VPNs | Orange Tsai, Meh Chang | 46m |
Claims exploit chains deliver pre-auth RCE against major SSL VPNs (FortiGate and Pulse/Pearl Secure), affecting millions; techniques include VM memory… | ||
| Securing the System: A Deep Dive into Reversing Android Pre-Installed Apps | Maddie Stone | 48m |
Reverse engineering of pre-installed Android apps focuses on concrete surprises: analysis of more than 1,000 OEM build images reveals why emulator sandboxes… | ||
| Biometric Authentication Under Threat: Liveness Detection Hacking | Yu Chen, Bin Ma, Zhuo Ma | 25m |
Built a hardware rig that converts HDMI to CSI and a separate audio-in module to inject perfect video/audio streams so liveness checks see native sensor input… | ||
| Practical Approach to Automate the Discovery & Eradication of Open-Source Software Vulnerabilities | Aladdin Almubayed | 51m |
Netflix builds an automated pipeline that discovers, triages and remediates OSS flaws at microservice scale: it ingests commercial vulnerability feeds and NVD… | ||
| A Compendium of Container Escapes | Brandon Edwards, Nick Freeman | 43m |
Covers concrete escape paths and working demos: shows how runc race and an exposed overlay upperdir regex let a container write host files; demonstrates… | ||
| The Enemy Within: Modern Supply Chain Attacks | Eric Doerr | 51m |
Microsoft treats supply chain as layered risks and gives concrete responses: after Wipro staffing alarms it audits vendor access across 135,000 employees and… | ||
| Flying a False Flag: Advanced C2, Trust Conflicts, and Domain Takeover | Nick Landers | 44m |
Demonstrates three concrete C2 builds and attack chains: Post Office (EWS mail C2 using stolen Outlook creds, WinINet/NTLM, hiding tasking in X-headers and… | ||
| Backdooring Hardware Devices by Injecting Malicious Payloads on Microcontrollers | Sheila Ayelen Berta | 39m |
Demonstrates three concrete backdoor methods for microcontrollers: overwrite the reset-entry hex to run injected opcodes at boot, hijack interrupt vectors to… | ||
| Automation Techniques in C++ Reverse Engineering | Rolf Rolles | 51m |
Method hooks malloc/free/realloc via DLL injection and records allocation metadata, then logs accesses either with DBI or with a custom page-fault tracking… | ||
| Going Beyond Coverage-Guided Fuzzing with Structured Fuzzing | Jonathan Metzman | 25m |
Argues that adding format awareness to coverage-guided fuzzers yields more bugs and control: uses AFL and libFuzzer plus a custom libprotobuf mutator workflow… | ||
| Woke Hiring Won't Save Us: An Actionable Approach to Diversity Hiring and Retention | Rebecca Lynch | 22m |
Diversity hiring alone fails because fewer women enter CS and women leave at double the male rate: 41% leave STEM by year ten and 37% cite unfairness as the… | ||
| Command Injection in F5 iRules | Christoffer Jerkeby | 49m |
F5 BigIP iRules allow unquoted or command-substituted TCL arguments that lead to remote code execution and persistent in-memory implants; demo exploits use… | ||
| Attacking iPhone XS Max | Tielei Wang, Hao Xu | 35m |
Identifies an XNU Unix domain socket race that creates a use‑after‑free via UNP bind temporary unlock and shows a concrete exploit chain: close sockets… | ||
| Rogue7: Rogue Engineering-Station Attacks on S7 Simatic PLCs | Uriel Malin, Sara Bitan, Avishai Wool, Eli Biham | 44m |
Demonstrates practical attacks on Simatic S7‑1500 PLCs by abusing weaknesses in the S7 P3 handshake: a single shared PLC public key (the one ring to rule them… | ||
| Exploiting the Hyper-V IDE Emulator to Escape the Virtual Machine | Joe Bialek | 50m |
A Hyper‑V IDE emulation bug gives a relative 32‑bit read/write primitive: attacker‑controlled 23 high bits from a 512‑aligned drive offset plus 9 low bits from… | ||
| Shifting Knowledge Left: Keeping up with Modern Application Security | Mark Stanislav, Fletcher Heisler | 51m |
Claims that OWASP Top 10 and annual slide decks aren’t enough, citing GitLab’s finding that 70% of developers are expected to write secure code while fewer… | ||
| Behind the Scenes of Intel Security and Manageability Engine | Shai Hasarfaty, Yanai Moyal | 53m |
Deep dive into CSME internals: architecture (1.5 MB SRAM, ROM immutable, DRNG, SKS hardware slots), secure boot chain with ROM-derived chipset keys… | ||
| Breaking Encrypted Databases: Generic Attacks on Range Queries | Marie-Sarah Lacharite | 44m |
Encrypted range queries leak either access patterns or volumes, and those leaks let an attacker reconstruct numeric data. Using a PQ tree algorithm and about n… | ||
| Infighting Among Russian Security Services in the Cyber Sphere | Kimberly Zenz | 47m |
A decade of on‑the‑ground research traces escalating competition between Russia’s FSB, GRU, Interior Ministry and private firms, with observable outcomes: 35… | ||
| Fantastic Red-Team Attacks and How to Find Them | Casey Smith, Ross Wolf | 40m |
Provides concrete tools and outcomes: Atomic Red Team supplies YAML-mapped, single-command tests tied to MITRE that generate telemetry; a 350,000‑event… | ||
| The Discovery of a Government Malware and an Unexpected Spy Scandal | Lorenzo Franceschi-Bicchierai | 45m |
Investigation shows an Italian contractor called eSurv sells spyware named Exodus via 25 Play Store apps that install a two‑stage implant: a dropper that… | ||
| Dragonblood: Attacking the Dragonfly Handshake of WPA3 | Mathy Vanhoef | 47m |
WPA3’s Dragonfly/SAE leaks a reproducible password “signature” via timing and cache side channels: timing side channel and flush+reload cache attack. On… | ||
| The Most Secure Browser? Pwning Chrome from 2016 to 2019 | Zhen Feng, Gengming Liu | 43m |
Claims multiple Chrome wins from 2016–2019 with three different sandbox escapes and practical exploits that run code (a 13-line calc PoC mentioned). Uses a… | ||
| Look, No Hands! -- The Remote, Interaction-less Attack Surface of the iPhone | Natalie Silvanovich | 42m |
The research demonstrates about ten fully remote, interaction‑less iPhone bugs across SMS/MMS, Visual Voicemail/IMAP, Mail and iMessage; tooling includes a SMS… | ||
| Messaging Layer Security: Towards a New Era of Secure Group Messaging | Benjamin Beurdouche, Raphael Robert, Katriel Cohn-Gordon | 51m |
A new group messaging protocol is proposed that replaces pairwise fanout with a TreeKEM binary trees state so group key updates run in O(log n) not O(n)… | ||
| Preventing Authentication Bypass: A Tale of Two Researchers | Terry Zhang, Ron Chan, Ravi Jaiswal | 37m |
An internal Outlook endpoint returns an unsigned JWT with "alg":"none" that contains an oid, smtp and tenant id; replaying that token in REST calls lets one… | ||
| Cyber Insurance 101 for CISO’s | Jeffrey Smith | 44m |
Explains how cyber policies actually work: splits coverage into first-party event response (forensics, PR, credit monitoring, business interruption) and… | ||
| PicoDMA: DMA Attacks at Your Fingertips | Joel Sandin, Ben Blaxill | 50m |
A pocket-sized M.2 implant built from the $220 PicoEVB FPGA and a Pycom radio performs remote DMA: it executes 64-bit streaming reads and writes, an… | ||
| Five Years of 'Make 0Day Hard' | Ben Hawkes | 53m |
Project Zero describes five years of active vulnerability research, exploit writing and advocacy that measurably shifts attacker economics: 1500+… | ||
| Hacking Ten Million Useful Idiots: Online Propaganda as a Socio-Technical Security Project | David Perlman, Pablo Breuer | 51m |
Argues that coordinated propaganda is a socio-technical attack that can routinize deepfakes, botnets, spoof and takeover accounts, and targeted fringe… | ||
| Chip.Fail - Glitching the Silicon of the Connected World | Thomas Roth, Josh Datko | 46m |
Voltage glitching reliably breaks modern IoT chips using cheap gear: the team builds an open $100 kit and a $5 ATTiny85 variant, combines an FPGA + analog… | ||
| Everybody be Cool, This is a Robbery! | Gabriel Campana, Jean-Baptiste Bédrune | 48m |
Evaluation targets a FIPS 140-2 L3 PCIe HSM and demonstrates pre-auth arbitrary code execution via PKCS#11 parsing and memory-corruption bugs found by an… | ||
| All the 4G Modules Could be Hacked | Shupeng Gao, Haikuo Xie, Zheng Huang, Zhang Ye | 49m |
Over thirty commercial 4G modules test positive for remote takeover: open telnet/ADB ports, default or extractable passwords, hard‑coded private keys and… | ||
| Exploiting Qualcomm WLAN and Modem Over The Air | Xiling Gong, Peter Pi | 45m |
Research demonstrates full over‑the‑air compromise of Qualcomm WLAN firmware and escalation into the modem and Linux kernel. A real-time debugger plus a Wi‑Fi… | ||
| 0-days & Mitigations: Roadways to Exploit and Secure Connected BMW Cars | Zhiqiang Cai, Aohui Wang, Wenkai Zhang, Michael Gruffke, Hendrik Schweppe | 51m |
Researchers disclose multiple exploitable bugs: a race condition in the diagnostic service lets an attacker win a TOCTOU to write a signed update and get root… | ||
| Adventures in the Underland: The CQForensic Toolkit as a Unique Weapon Against Hackers | Paula Januszkiewicz | 54m |
Tool demo extracts 17 corrupted EVTx records from memory and rebuilds consistent logs, dumps RDP cache tiles, recovers files from MFT (small files ~700 bytes)… | ||
| HTTP Desync Attacks: Smashing into the Cell Next Door | James Kettle | 50m |
Remote unauthenticated attackers can break HTTP request isolation to splice a malicious prefix into another user’s request, enabling header injection, cache… | ||
| Breaking Through Another Side: Bypassing Firmware Security Boundaries from Embedded Controller | Alex Matrosov, Alexandre Gazet | 49m |
Reverse engineering of Lenovo ThinkPad EC firmware (Microchip 16xx family) reveals a static password in the DXE update flow and a race between verify and flash… | ||
| How Do Cyber Insurers View The World? | Matt Prevost | 57m |
Cyber insurers report a growing $4.2 billion market with roughly 700 markets each seeing multiple cyber incidents daily and typically at least one ransom or… | ||
| Selling 0-Days to Governments and Offensive Security Companies | Maor Shwartz | 50m |
Overview of the zero‑day market: a vulnerability brokerage model (example: Q-recon) connects researchers to governments and offensive security firms, with… | ||
| Finding Our Path: How We're Trying to Improve Active Directory Security | Andy Robbins, Rohan Vazarkar, Will Schroeder | 45m |
BloodHound maps Active Directory into graph problems and the team shows concrete results: data collection by SharpHound takes about 48 hours in a large… | ||
| How to Detect Your Domains Being Abused for Phishing Using DNS | Arnold Hölzel, Karl Lovink | 47m |
Explains email-security standards (STARTTLS, SPF, DKIM, DMARC, DANE, MTA-STS) and advanced SPF options, and shows how to use DNS and those protocols to detect… | ||
| Moving from Hacking IoT Gadgets to Breaking into One of Europe's Highest Hotel Suites | Ray, Michael Huebler | 48m |
Tools and methods include sniffers (Ubertooth, Adafruit Bluefruit), a three‑channel micro:bit setup flashed with Little Jack firmware, Wireshark, mitmproxy and… | ||
| HostSplit: Exploitable Antipatterns in Unicode Normalization | Jonathan Birch | 40m |
A new class of Unicode normalization exploits lets a URL parse as one hostname but resolve as another, enabling URL-filter bypass and domain impersonation. The… | ||
| Responding to a Cyber Attack with Missiles | Mikko Hypponen | 49m |
Governments publicly reserve the right to reply to cyber attacks with kinetic force, but attribution remains the core obstacle: cheap, deniable cyber weapons… | ||
| Towards Discovering Remote Code Execution Vulnerabilities in Apple FaceTime | Tao Huang, Tielei Wang | 34m |
Reverse engineering of FaceTime reveals concrete exploit paths: the APNS/PSD notification chain yields a zero-click notification path that accepts… | ||
| Controlled Chaos: The Inevitable Marriage of DevOps & Security | Kelly Shortridge, Nicole Forsgren | 54m |
Large-scale survey data shows elite teams optimize four metrics—lead time for changes, release frequency, change fail rate and time to restore (MTTR)—and are… | ||
| Behind the Scenes: The Industry of Social Media Manipulation Driven by Malware | Masarah Paquet-Clouston, Olivier Bilodeau | 48m |
Four years of traces link an IoT botnet called Linux Moos to a multilayered SMM economy: infected routers run proxies, a handful of whitelisted IPs each manage… | ||
| Paging All Windows Geeks – Finding Evil in Windows 10 Compressed Memory | Omar Sardar, Dimiter Andonov | 49m |
This presentation focuses on the details of the memory compression implementation in Windows 10, and explores the undocumented structures and algorithms… | ||
| Arm IDA and Cross Check: Reversing the Boeing 787's Core Network | Ruben Santamarta | 51m |
First public reverse engineering of Boeing 787 core network firmware (black‑level 2016 images) reveals multiple exploitable bugs: TFTP/FTS manager, ODLF and… | ||
| API-Induced SSRF: How Apple Pay Scattered Vulnerabilities Across the Web | Joshua Maddux | 33m |
Shows that Apple Pay Web’s validation flow lets merchants proxy arbitrary URLs, leading to widespread SSRF; demos use curl and redeployments of vulnerable… | ||
| Lessons From Two Years of Crypto Audits | Jean-Philippe Aumasson | 46m |
Findings include a hard-coded nonce that breaks ChaCha20-Poly1305 allowing ciphertext recovery, use of plain SHA-256 for password-derived keys instead of… | ||
| MINimum Failure - Stealing Bitcoins with Electromagnetic Fault Injection | Colin O'Flynn | 25m |
A practical attack uses EMFI through the enclosure to induce a skip of the wLength USB descriptor check, causing the device to return up to 65K of memory and… | ||
| Women in Security: Building a Female InfoSec Community in Korea, Japan, and Taiwan | Asuka Nakajima, Suhee Kang, Hazel Yen | 43m |
Three regional female InfoSec communities show concrete results: Korea’s Power of XX runs 80+ teams in qualifiers with 6–8 finalists since 2011, invites… | ||
| Internet-Scale Analysis of AWS Cognito Security | Andres Riancho | 45m |
Internet-scale scan extracts ~3,100 Cognito IDs (2,500 usable), uses APKMirror/APKPure, Common Crawl and GitHub to pull IDs, then CC Lambda (1,000 concurrent… | ||
| Critical Zero Days Remotely Compromise the Most Popular Real-Time OS | Ben Seri, Dor Zusman | 44m |
Research finds 11 zero-days in the VxWorks IPnet TCP/IP stack that affect hundreds of millions of devices out of ~2 billion VxWorks installs. Exploits include… | ||
| Lessons and Lulz: The 5th Annual Black Hat USA NOC Report | Neil R. Wyler, Bart Stump | 54m |
Black Hat NOC describes the deployed stack: Palo Alto firewalls with Panorama, Gigamon taps, RSA NetWitness for full‑packet hunting, Cisco Threat Grid… | ||
| Monsters in the Middleboxes: Building Tools for Detecting HTTPS Interception | Luke Valenta, Gabriele Fisher | 27m |
An open-source Go library called Monster-in-the-Middle Engine fingerprints TLS client hellos and compares them to HTTP User-Agent strings to flag mismatches… | ||
| ClickOnce and You're in - When Appref-ms Abuse is Operating as Intended | William Burke | 25m |
Research shows ClickOnce’s AppRef-MS file reliably delivers and executes payloads: saved as UTF‑16 LE with app name, token, culture and arch, it runs from… | ||
| All Your Apple are Belong to Us: Unique Identification and Cross-Device Tracking of Apple Devices | Min (Spark) Zheng, Xiaolong Bai | 40m |
Study demonstrates concrete methods to fingerprint and link Apple devices across reboots using public APIs, hardware identifiers and disclosed vulnerabilities… | ||
| He Said, She Said – Poisoned RDP Offense and Defense | Dana Baril, Eyal Itkin | 49m |
Connecting to a malicious RDP server can silently compromise the client by abusing clipboard file-copy formats: code audits find 11 critical bugs in rdesktop… | ||
| Defense Against Rapidly Morphing DDOS | Mudit Tyagi, Mikhail Fedorov | 36m |
Built an attack toolkit called soda that reproduces the ProtonMail incident and a containerized lab for safe Red Team testing, the team runs continuous… | ||
| Exploring the New World : Remote Exploitation of SQLite and Curl | Wenxiang Qian, YuXiang Li, HuiYu Wu | 47m |
Fuzzing plus manual auditing uncovers multiple real-world bugs: Magellan (CVE-2018-20346, CVE-2018-20505, CVE-2018-20506) is three SQLite heap overflows/data… | ||
| Legal GNSS Spoofing and its Effects on Autonomous Vehicles | Victor Murray | 26m |
Demonstrates a legal, repeatable method to spoof GNSS against an autonomy kit on a Lincoln MKZ using an RTK reference, a software-defined radio and remote… | ||
| Debug for Bug: Crack and Hack Apple Core by Itself | Lilang Wu, Moony Li | 43m |
Fuzzing plus an LLDB scripting harness finds dozens of kernel bugs and discloses 10 disclosed vulnerabilities including double free and out‑of‑bounds… | ||
| Making Big Things Better The Dead Cow Way | Joseph Menn, Peiter "Mudge" Zatko, Christien Rioux, Luke Benfey | 52m |
A 35‑year history of the Cult of the Dead Cow maps concrete actions: releasing Back Orifice to expose Windows security flaws (process injection, DLL injection… | ||
| Transparency in the Software Supply Chain: Making SBOM a Reality | Allan Friedman | 30m |
NTIA convenes a multistakeholder initiative to make SBOMs routine, with four working groups producing drafts by Sept 5, 2019; two usable formats are SPDX and… | ||
| Testing Your Organization's Social Media Awareness | Jacob Wilkin | 25m |
Automates cross‑site profile correlation with two open‑source tools: Social Mapper uses Selenium‑driven Firefox plus facial recognition to match LinkedIn names… | ||
| Playing Offense and Defense with Deepfakes | Mike Price, Matt Price | 51m |
Step‑by‑step deepfake internals: face extraction with MT‑CNN, autoencoder training in Keras (original FaceSwap/face‑flop architecture), and conversion that… | ||
| A Decade After Bleichenbacher '06, RSA Signature Forgery Still Works | Sze Yiu Chau | 24m |
Researchers use dynamic symbolic execution to generate concolic tests and extract verification formulas, releasing the toolchain and artifacts. The analysis… | ||
| Cybersecurity Risk Assessment for Safety-Critical Systems | Ly Vessels, Ken Heffner, Daniel Johnson | 26m |
Honeywell describes a reproducible five-step iterative framework for space and other safety‑critical cyber‑physical systems that maps perimeters, assets… | ||
| Managing for Success: Maintaining a Healthy Bug Bounty Program Long Term | Chloe Brown | 38m |
Advice on running a long‑term bounty program: set clear scope and changelogs, publish known issues, and uplift payout bands as the product hardens (example… | ||
| The Future of Securing Intelligent Electronic Devices Using the IEC 62351-7 Standard for Monitoring | Andrea Carcano, Alessandro Di Pinto, Younes Dragoni | 26m |
Demonstrates IEC 62351-7 applied to real SCADA gear: devices expose health indicators and support smart polling so monitoring is built in. A lab hydrodam with… | ||
| Finding a Needle in an Encrypted Haystack | Marina Simakov, Yaron Zinar | 47m |
Claim: three new practical NTLM relay bypasses let attackers authenticate to targets even when server signing or channel binding are enabled. Exploit… | ||
| Breaking Encrypted Databases: Generic Attacks on Range Queries | Marie-Sarah Lacharite | 44m |
Shows two concrete attacks that recover numeric column values from encrypted databases using only side channels: access pattern leakage is turned into a full… | ||
| Firmware Cartography: Charting the Course for Modern Server Compromise | Nathan Keltner, Dionysus Blazakis | 51m |
Methodology maps firmware binaries and inter-component paths to find remaining attack windows on hardened servers, with the operational rule to assume host… | ||
| Battle of Windows Service: A Silver Bullet to Discover File Privilege Escalation Bugs Automatically | Wenxu Wu | 21m |
Framework targets ALPC interfaces and other RPC paths, uses RPC Viewer to export interfaces, IDA Pro for triage and a hotpatched Process Monitor turned into a… | ||
| The Future of ATO | Philip Martin | 51m |
Coinbase reports ~30 million users in 103 countries and sees ~10% of ATO attempts as targeted ATO; credential-stuffing yields ~2.5% validated pairs so defenses… | ||
| Hunting for Bugs, Catching Dragons | Nicolas Joly | 43m |
Microsoft research demonstrates concrete Outlook and Exchange attack chains, with working demos, PoCs and patches. Examples include a preview pane exploit that… | ||
| Bounty Operations: Best Practices and Common Pitfalls to Avoid in the First 6-12 Months | Jarek Stanley, Shannon Sabens, Greg Caswell, Josh Jay | 53m |
Panelists report concrete pitfalls and fixes from early bounty life: unexpected spikes in submissions, payment headaches, and scope creep. Examples include… | ||
| Attacking Electric Motors for Fun and Profit | Matthew Jablonski, Duminda Wijesekera | 48m |
A reusable seven‑layer motor threat model maps attacks against operator, sensor, control, drive, power, motor and load. Experiments use a hackRF One to seize a… | ||
| On Trust: Stories from the Front Lines | Jamil Farshchi | 21m |
Recounts being personally affected by the Equifax breach that exposed 150 million records and triggered a 40% market‑cap drop, executive departures and a… | ||
| Zombie Ant Farming: Practical Tips for Playing Hide and Seek with Linux EDRs | Dimitry Snezhkov | 47m |
Explains how attackers load and assemble payloads entirely in memory using LD_PRELOAD, ELF constructors and weak symbols, and cross-process descriptors via… | ||
| Bypassing the Maginot Line: Remotely Exploit the Hardware Decoder on Smartphone | Xiling Gong, Peter Pi | 23m |
We focus on the hardware decoder named Venus on Qualcomm based smartphone. Venus is the dedicated video hardware decoder, which is a subsystem like Baseband… | ||
| Integration of Cyber Insurance Into A Risk Management Program | Jake Kouns | 54m |
Provides concrete numbers and operational details: mid‑2019 shows 3,800 breaches and 4.1 billion exposed records, up ~54% frequency and ~52% records year over… | ||
| Operational Templates for State-Level Attack and Collective Defense of Countries | Gregory Conti, Robert Fanelli | 50m |
Operational templates map concrete campaigns — e.g., critical infrastructure control (accessing ICS, undersea cables, satellite jamming), large-scale denial… | ||
| Detecting Deep Fakes with Mice | George Williams, Jonathan Saunders, Alex Comerford | 26m |
States that humans hit a median 88% and current algorithms about 92% on the same dataset, while a spectral bicoherence+SVM approach reaches 95% on LJ Speech… | ||
| PeriScope: An Effective Probing and Fuzzing Framework for the Hardware-OS Boundary | Dokyung Song | 27m |
PeriScope implements an in-kernel probe that marks MMIO and DMA pages not-present and intercepts accesses via page-fault hooking, enabling on-the-fly… | ||
| Sensor and Process Fingerprinting in Industrial Control Systems | Martin Ochoa, Mujeeb Ahmed Chuadhry | 50m |
Experiments run on the SWaT water treatment testbed use ultrasonic, flow and pressure sensors and show sensor and process noise can fingerprint devices and… | ||
| SSO Wars: The Token Menace | Alvaro Munoz, Oleksandr Mirosh | 22m |
Two .NET flaws let forged SSO tokens bypass verification and run code: an algorithm-to-type mapping allows arbitrary constructor invocation via unvalidated… | ||
| Hacking Your Non-Compete | Gregory Stone, Brian Dykstra | 50m |
Real cases: a departing seller accused of stealing client files that forensic metadata proves 3 years old; a sales team of five members who ran a side firm and… | ||
| Come Join the CAFSA - Continuous Automated Firmware Security Analysis | Collin Mulliner | 44m |
A continuous automated firmware security analysis pipeline is built and open sourced: a firmware-analyzer that unpacks final firmware bundles, runs file system… | ||
| Mobile Interconnect Threats: How Next-Gen Products May be Already Outdated | Guillaume Teissier | 26m |
Audit of SS7/Sigtran stacks finds concrete faults: IP fragmentation and SCTP segmentation evade detection, SCCP global-title offsets and length fields allow… | ||
| Worm Charming: Harvesting Malware Lures for Fun and Profit | Pedram Amini | 47m |
A pipeline uses YARA rules over VirusTotal Intelligence to pull interesting lures from ~1.3M daily uploads, applying decompilers (CFR, JD), PDF/RTF tools… | ||
| Rough and Ready: Frameworks to Measure Persistent Engagement and Deterrence | Jason Healey, Neil Jenkins | 47m |
Proposes three concrete ways to judge whether U.S. persistent engagement reduces or increases cyber attacks: use the government’s incident severity schema to… | ||
| Securing Apps in the Open-By-Default Cloud | Winston Howes, Michael Wozniak | 43m |
Describes an automated system that enforces authentication and authorization from project creation through production, built to work across AWS and GCP and to… | ||
| I'm Unique, Just Like You: Human Side-Channels and Their Implications for Security and Privacy | Matt Wixey | 48m |
Defines human side-channels as unintended behavioral identifiers (keystroke timing, mouse cadence, interaction rhythms) and shows concrete attacks that turn… | ||
| nothing matches | ||