Black Hat USA 2023
2023-08-05..2023-08-10
Las Vegas, United States
[Black Hat USA 2014, Black Hat USA 2016, Black Hat USA 2019, Black Hat USA 2023]
| title | author | length |
|---|---|---|
| Black Hat USA 2023 Highlights | 03m | |
A fast-paced montage of Black Hat USA 2023 at Mandalay Bay showing keynote clips, live exploit demos, vendor booths and hands-on workshops, with on-stage… | ||
| Black Hat USA 2023 Preview Video | 01m | |
Six-day Black Hat USA program returns to Mandalay Bay with four days of specialized trainings (Aug 5–10), a two-day main conference (Aug 9–10) that schedules… | ||
| Chained to Hit: Discovering New Vectors to Gain Remote and Root Access in SAP Enterprise Software | Pablo Artuso, Yvan Genuer | 36m |
Three independent research streams combine into a working exploitation chain that yields unauthenticated remote root on SAP systems. Findings include a… | ||
| Zero-Touch-Pwn: Abusing Zoom's Zero Touch Provisioning for Remote Attacks on Desk Phones | Moritz Abrell | 31m |
Zoom zero touch provisioning plus an AudioCodes C450 reveal an exploit chain: an unauthenticated vendor redirect exposes config files, hardcoded crypto keys… | ||
| ODDFuzz: Hunting Java Deserialization Gadget Chains via Structure-Aware Directed Greybox Fuzzing | Biao He, Haowen Mu, Yu Ouyang | 34m |
Combines a lightweight static analyzer with structure-aware directed greybox fuzzing to find and validate Java deserialization gadget chains by constructing… | ||
| Reflections on Trust in the Software Supply Chain | Jeremy Long | 39m |
Survey of current defenses (SLSA, SBOM/CycloneDX 1.5, code signing) shows gaps: build plugins and extensions can inject payloads during CI/CD. Demo uses a… | ||
| Dismantling DDoS - Lessons in Scaling | Elliott Peterson, Cameron Schroeder | 56m |
Operation chronology: a 2018 sweep seizes 15 booters and charges operators; by December 2022 authorities seize 49 domains, run fake booter sites and Google… | ||
| Single Instruction Multiple Data Leaks in Cutting-edge CPUs, AKA Downfall | Daniel Moghimi | 35m |
Exploits the x86 SIMD Gather instruction via a new Gather Data Sampling primitive that reads remnants of vector registers; experiments show 2–22 bytes per leak… | ||
| Exploiting OPC-UA in Every Possible Way: Practical Attacks Against Modern OPC-UA Architectures | Sharon Brizinov, Noam Moshe | 40m |
Research finds about 50 CVEs and develops 12 attack concepts across OPC-UA stacks; a custom client, fuzzers and coverage harnesses uncover widespread issues… | ||
| A Pain in the NAS: Exploiting Cloud Connectivity to PWN Your NAS | Sharon Brizinov, Noam Moshe | 39m |
Chain of vulnerabilities lets an attacker impersonate Synology and Western Digital NAS devices by harvesting device GUIDs from TLS certificates and CT logs… | ||
| Devising and Detecting Phishing: Large Language Models vs. Smaller Human Models | Jeremy Bernstein, Fredrik Heiding, Bruce Schneier, Arun Vishwanath | 34m |
A controlled study sends tailored emails to 112 participants and compares GPT‑4 generated, human‑crafted V‑Triad, hybrid V‑Triad+GPT, and generic control… | ||
| Core Escalation: Unleashing the Power of Cross-Core Attacks on Heterogeneous System | Guanxing Wen | 34m |
Shows a concrete cross‑core escalation chain that wins full SoC control: abusing ion buffer ID reuse and SL interfaces to map attacker pages into TrustZone… | ||
| Three New Attacks Against JSON Web Tokens | Tom Tervoort | 40m |
Three concrete attacks against JWT implementations: sign-encrypt confusion lets an attacker swap a signed JWT for an encrypted one and force a validator to… | ||
| CoDe16; 16 Zero-Day Vulnerabilities Affecting CODESYS Framework Leading to Remote Code Execution | Vladimir Eliezer Tokarev | 34m |
Finds 16 zero-days in the CODESYS SDK that yield remote code execution on millions of devices across hundreds of vendors; analysis uses firmware dumps, IDA… | ||
| The Hat Trick: Exploit Chrome Twice from Runtime to JIT | Nan Wang, Zhenghang Xiao | 35m |
Claims two remote RCE chains against V8: one exploits Promise.any hole extraction to place the sentinel into a JS Map, force a Map negative size -> OOB write… | ||
| Smashing the State Machine: The True Potential of Web Race Conditions | James Kettle | 38m |
Introduces the single packet attack implemented as a Turbo Intruder update that sends 20–30 requests in one packet so servers process them within a median ~1… | ||
| Weaponizing Plain Text: ANSI Escape Sequences as a Forensic Nightmare | fr Alexander | 41m |
Demonstrates that unescaped ANSI/OSC sequences written into logs can alter and corrupt forensic evidence: injecting colored output and titles in Docker logs… | ||
| Shuffle Up and Deal: Analyzing the Security of Automated Card Shufflers | Enrique Nissim, Ethan Shackelford, Joseph Tartaro | 42m |
Reverse engineering of ShuffleMaster Deckmate One and Deckmate 2 finds no secure boot, a predictable LCG seeded from a timer, universal hardcoded credentials… | ||
| All Cops Are Broadcasting: Breaking TETRA After Decades in the Shadows | Wouter Bokslag, Carlo Meijer, Jos Wetzels | 37m |
Researchers reverse engineer TETRA crypto from a Motorola MTM5400 (TI OMAP L138), chain a format‑string + MPU misconfig + AES timing set of zero days to… | ||
| MoustachedBouncer: AitM-Powered Surveillance via Belarus ISPs | Matthieu Faou | 37m |
MoustachedBouncer uses ISP-level SORM/DPI interception in Belarus to perform targeted AitM, redirecting specific embassy IPs during the Windows captive-portal… | ||
| MaginotDNS: Attacking the Boundary of DNS Caching Protection | Xiang Li, Zhou Li, Qifan Zhang | 29m |
MaginotDNS is a cache‑poisoning technique that targets CDNS (resolvers that forward and recurse) by breaking bailiwick checking and injecting forged NS records… | ||
| AI Assisted Decision Making of Security Review Needs for New Features | Mrityunjay Gautam, Pavan Kolachoor | 37m |
Claim: natural language processing plus deep learning reliably flags which new features need security review. Implementation uses Apache Spark and Spark NLP… | ||
| Diving into Windows Remote Access Service for Pre-Auth Bugs | Yuki Chen | 39m |
Finds dozens of pre-auth crashes by combining multi-threaded fuzzers with manual reverse engineering, then confirms root causes: use-after-free, null… | ||
| CodeQL: Also a Powerful Binary Analysis Engine | Haiquan Zhang | 32m |
Reverse engineers CodeQL’s closed engine and adds binary support by building a new DB schema, an extractor pipeline using Ad Pro to emit TRAP files, and an… | ||
| Oven Repair (The Hardware Hacking Way) | Colin O'Flynn | 39m |
A Samsung oven reports 325°F while running much cooler, so the bootloader on a 2012 TMP91 (TLCS-900/L1) microcontroller is extracted and attacked: power… | ||
| Lost Control-Breaking Hardware-Assisted Kernel Control-Flow Integrity with Page-Oriented Programming | Seunghun Han | 36m |
Claims a new exploit called page-oriented programming that uses a kernel read/write bug plus modified hypervisor page-table control to remap physical pages and… | ||
| Video-Based Cryptanalysis: Recovering Cryptographic Keys from Device Using Video of Power LED | Etay Iluz, Ben Nassi | 40m |
Video of a device power LED yields measurable power traces via rolling shutter on commodity cameras, enabling key recovery. Exploits use an iPhone 13 Pro Max… | ||
| Lemons and Liability: Cyber Warranties as an Experiment in Software Regulation | Daniel Woods | 33m |
Several security vendors voluntarily promise payouts for product failures and this paper measures that experiment: warranties begin at Black Hat 2014 (WhiteHat… | ||
| The Living Dead: Hacking Mobile Face Recognition SDKs with Non-Deepfake Attacks | Wing Cheong Lau, Kaixuan Luo, Xianbo Wang | 37m |
Researchers demonstrate practical attacks that bypass mobile liveness checks by unpacking SDKs, hooking app code (Frida-style), and replacing or replaying… | ||
| Poisoning Web-Scale Training Datasets is Practical | Will Pearce | 33m |
Demonstrates that buying expired domains listed in massive URL-only datasets like LAION‑5B lets an attacker inject training samples into web‑scale models; the… | ||
| Second Breakfast: Implicit and Mutation-Based Serialization Vulnerabilities in .NET | Will Pearce | 24m |
Demonstrates concrete RCEs by crafting serialized payloads and showstopping mutations that turn innocuous key/value maps into gadgets, successfully exploiting… | ||
| Evasive Maneuvers: Trends in Phishing Evasion & Anti-Evasion | Din Serussi | 30m |
Shows concrete evasion techniques: attackers insert Unicode homoglyphs and no‑break spaces to turn “password” into an undetectable token that bypasses static… | ||
| Make KSMA Great Again: The Art of Rooting Android Devices by GPU MMU Features | Yong Wang | 35m |
With more and more hardware and software mitigations, rooting Android 13 devices now requires better bugs and more advanced exploitation techniques. Five years… | ||
| Bad io_uring: A New Era of Rooting for Android | Zhaofeng Chen, Kang Li, Zhenpeng Lin, Xinyu Xing | 27m |
Exploit traces a CVE-2022-20409 use-after-free in io_uring identity that frees an iouring_task object when copy-on-write races across threads, then reclaims… | ||
| Small Leaks, Billions Of Dollars: Practical Cryptographic Exploits That Undermine Crypto Wallets | Arik Galansky, Nikolaos Makriyannis, Oren Yomtov | 36m |
Research shows four novel exploits (three zero days) that recover MPC wallet private shares from popular implementations, with Lindell 2017 and GG18/GG20 as… | ||
| Route to Bugs: Analyzing the Security of BGP Message Parsing | Amine Amri, Stanislav Dashevskyi, Daniel dos Santos, Simon Guiot, Oussama Kerro | 35m |
Analysis targets popular BGP stacks, runs a custom fuzzer against open and update parsing, and finds 3 new CVEs in an FRRouting-derived implementation; all… | ||
| Civil Cyber Defense-Defend Non-Profits as They Combat Human Trafficking/Subvert Authoritarian Regime | Tiffany Rad, Austin Shamlin | 39m |
A university-run civil cyber defense clinic trains a 14-student team for six weeks on aliases, Tor, VPNs and a student-built Ghost Protocol cloud VPN, then… | ||
| Input Output + Syslog (iO+S): Obtaining Data From Locked iOS Devices via Live Monitoring | Nicholas Dubois, Jessica Hyde | 35m |
Demonstrates recovering rich forensic data from locked iOS devices by monitoring USB traffic and live sysdiagnose output, using usbpcap, libimobiledevice… | ||
| HARry Parser and the Cursed Tracker: Breaking the Spell of Online Data Collection | Ash Edmondson, Matt Edmondson | 32m |
A small Python tool parses HAR files into spreadsheets, joins results to Tracker Radar, base64-decodes payloads and flags selectors; it surfaces concrete… | ||
| Apple's Predicament: NSPredicate Exploits on iOS and macOS | Austin Emmitt | 36m |
Claim: Apple limits on NSPredicate are fully bypassable on iOS 16.3 beta using serialization tricks and existing Foundation APIs to get arbitrary writes and… | ||
| Physical Attacks Against Smartphones | Christopher Wade | 36m |
A Chinese OEM 2019 Android fork yields a command injection in recovery filename that, when paired with an exFAT/EXT4 SD payload, disables SELinux, enables ADB… | ||
| Mac-ing Sense of the 3CX Supply Chain Attack: Analysis of the macOS Payloads | Patrick Wardle | 42m |
Analysis shows the attackers implant a macOS backdoor called pool rat on the 3CX build machine, which surveys the host, decrypts hardcoded strings and fetches… | ||
| Becoming a Dark Knight: Adversary Emulation Demonstration for ATT&CK Evaluations | Cat Self, Kate Esprit | 43m |
MITRE ATT&CK Evaluations recreates a Latin‑American APT called Blind Eagle by building an AsyncRAT implant and a stripped‑down FSociety DLL to reproduce… | ||
| Over the Air, Under the Radar: Attacking and Securing the Pixel Modem | Xiling Gong, Farzan Karimi, Eugene Rodionov, Xuan Xing | 40m |
Team achieves over‑the‑air, no‑click remote code execution against a Pixel 6 modem by chaining ASN.1 decoder heap out‑of‑bounds writes into an unsafe‑unlink… | ||
| What Does an LLM-Powered Threat Intelligence Program Look Like? | Ron Graf, John Miller | 40m |
Defines a three-part CTI framework: visibility, processing, interpretation, and shows LLMs converting large raw sources (logs, packets, slide images) into… | ||
| A Manufacturer's Post-Shipment Approach to Fend-Off IoT Malware in Home Appliances | Satoru Higuchi, Satoshi Ito, Manabu Nakano, Yuki Osawa, Takayuki Uchiyama | 23m |
Manufacturer runs a physical honeypot network for over 5 years and turns captured IoT malware into analyzed signals via a sandbox plus MITRE ATT&CK mapping and… | ||
| Windows Agentless C2: (Ab)using the MDM Client Stack | Marcos Oviedo, Zach Wasserman | 39m |
Claims an unprivileged logical flaw lets an attacker programmatically enroll Windows devices into a rogue MDM server and then push commands. The team builds a… | ||
| Cookie Crumbles: Unveiling Web Session Integrity Vulnerabilities | Pedro Adão, Marco Squarcina | 28m |
Demonstrates concrete attacks that bypass cookie integrity: a nameless-cookie serialization collision lets a subdomain set cookies that impersonate… | ||
| Nothing but Net: Leveraging macOS's Networking Frameworks to Heuristically Detect Malware | Patrick Wardle | 48m |
Shows concrete macOS techniques to detect malware by observing host network activity: enumerates sockets via proc_pid APIs, extracts remote endpoints and… | ||
| Risks of AI Risk Policy: Five Lessons | Jonathon Penney, Ram Shankar Siva Kumar | 34m |
AI policy proliferation hits specifics: 21 draft standards appeared last year and two flagships are NIST AI RMF and the draft EU AI Act; real systems contain… | ||
| EDR = Erase Data Remotely, By Cooking An Unforgettable (Byte) Signature Dish | Tomer Bar, Shmuel Cohen | 39m |
Researchers disclose CVE-2023-24860 showing how minimal byte signatures can be implanted into log files, database fields, VM config and other writable data to… | ||
| Jailbreaking an Electric Vehicle in 2023 or What It Means to Hotwire Tesla's x86-Based Seat Heater | Oleg Drokin, Hans Niklas Jacob, Niclas Kühnapfel, Christian Werling | 41m |
Researchers bypass AMD platform secure boot on MCU-Z infotainment boards bought for about $400 on eBay, use voltage glitching (Teensy-driven SVI2 commands… | ||
| All You Need is Guest | Michael Bargury | 38m |
Azure AD guest accounts can abuse Power Platform connections that business users share org‑wide to harvest credentials and call API Management proxies… | ||
| Low-level RASP: Protecting Applications Implemented in High-level Programming Languages | Zhuonan Li, Qi Li, Zimin Lin | 34m |
A low-level RASP hooks native entry points (JVM native call, system.load/native library loader, Node/V8 native APIs, PHP/Zend and Python C APIs, Ruby C API)… | ||
| Me and My Evil Digital Twin: The Psychology of Human Exploitation by AI Assistants | Matthew Canham, Ben D. Sawyer | 43m |
Claims that humans see LLMs as sentient long before AGI and that digital twins already act on users’ behalf, exemplified by Karen AI (an influencer clone)… | ||
| One Drive, Double Agent: Clouded OneDrive Turns Sides | Or Yair | 40m |
Research shows OneDrive local logs expose an odls token leak that lets an unprivileged process steal the victim’s cloud token after creating Junction symlink… | ||
| Defender-Pretender: When Windows Defender Updates Become a Security Risk | Omer Attias, Tomer Bar | 39m |
Researchers disclose a flaw in Windows Defender’s update verification that lets a low‑privilege user craft delta actions to merge unsigned VDMs and push… | ||
| Kill Latest MPU-based Protections in Just One Shot: Targeting All Commodity RTOSes | Yueqi Chen, Minghao Lin, Chaoyang Lin, Minghang Shen, Jiahe Wang, Zicheng Wang | 25m |
Finds universal MPU deployment mistakes in six commodity RTOSes (FreeRTOS, MbedOS, Azure ThreadX, TizenRT, rt-thread and others) that let unprivileged tasks… | ||
| Evading Logging in the Cloud: Bypassing AWS CloudTrail | Nick Frichette | 26m |
Demonstrates concrete CloudTrail bypasses: changing the Content-Type header from JSON 1.1 to 1.0 hides API calls (over 645 actions across 40 services)… | ||
| Fast, Ever-Evolving Defenders: The Resilience Revolution | Kelly Shortridge | 45m |
Argues for a resilience paradigm that copies attacker advantages: faster operational tempo via infrastructure as code (Terraform demo updating a Binary Defense… | ||
| Badge of Shame: Breaking into Secure Facilities with OSDP | Dan Petro, David Vargas | 40m |
Demonstrates concrete attacks on OSDP: a Melon man‑in‑the‑middle and ESPKey‑style recorder that captures badges, a downgrade via capability bit that forces… | ||
| How NOT to Train Your Hack Bot: Dos and Don'ts of Building Offensive GPTs | Shane Caldwell, Ariel Herbert-Voss | 36m |
Demonstrates concrete experiments: using GPT-4 and gpt-3.5-turbo with vector search and retrieved context, models parse bug-bounty scopes ~70% on 30 samples… | ||
| Lifting the Fog of War - Monitoring, Identifying and Mitigating MS-RPC Based Threats | Stiv Kupchik | 35m |
Claims that ETW’s RPC provider plus TCP/SMB ETW can map RPC opnum→operation to network addresses by correlating RPC server call events with TCP “accept… | ||
| Dive into Apple UserFS (Userspace Filesystem) | Zuozhi Fan | 26m |
Apple moves FAT/exFAT handling into a user-space framework where a USB mount flows: lockd triggers UserFSD, UserFSD calls UVFS service which loads plugins and… | ||
| Reverse Engineering the Customized Pointer Authentication Hardware Implementation on Apple M1 | Zechao Cai, Wenbo Shen, Yu Wang, Yutian Yang watchd0g, Jiaxun Zhu Sean | 40m |
Reverse engineering of Apple M1 PAC reveals a custom hardware pipeline: new Apple-specific system register encodings, a control register plus 128-bit… | ||
| Synthetic Trust: Exploiting Biases at Scale | Esty Scheiner | 39m |
AI voice cloning already produces real financial harm: a 7,000-person, 11-country survey finds 1 in 4 people affected (India 50%), average losses above… | ||
| From Dead Data to Digestion: Extracting Windows Fibers for Your Digital Forensics Diet | Daniel Jary | 27m |
Reverse engineers Windows fiber internals, finds fiber objects allocated as 0x530 allocation size on the heap and no thread ID in the object, uses the… | ||
| npm and Sigstore: Provenance Comes to the World's Largest OSS Ecosystem | Trevor Rosen, Zach Steindler | 39m |
npm adds verifiable build provenance to a registry that sees ~70 billion requests/month and ~40k daily publishes, offering a public beta since April with… | ||
| Making and Breaking NSA's Codebreaker Challenge | Rita Doerr | 41m |
NSA runs an annual Codebreaker challenge that presents nine progressive tasks (this year launches Sept 28 and runs to Dec 21) combining reverse engineering… | ||
| Close Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation | Ruben Boonen, Valentina Palmiotti | 38m |
Demonstrates a full-chain Windows kernel post‑exploit: a discovered AFD n‑day turned into a working exploit in ~24 hours to load a signed vulnerable driver on… | ||
| Does Public Disclosure of Vulnerabilities Affect Hacker Participation in Bug Bounty Programs? | Ali Ahmed, Amit Deokar, Brian Lee | 30m |
Scrapes of HackerOne produce a panel dataset (~368 programs, 2012–2021, ~830k closed reports, ~8k publicly disclosed, ~6,000 hackers) and the main claim is… | ||
| I Was Tasked With Enrolling Millions of Developers in 2FA - Here's What Happened | John Swanson | 38m |
GitHub plans to require all code contributors to enable 2FA by end of 2023 after voluntary adoption sits under 20%, and the rollout uses push-based 2FA, a new… | ||
| Radiation Spikes Detected in Chernobyl During Russian Invasion Show Possible Evidence of Fabrication | Ruben Santamarta | 39m |
Claims that Chernobyl radiation spikes during the Russian invasion are implausible and likely fabricated, supported by reverse engineering of Bakutech… | ||
| The Accidental Discovery of a New Vulnerability in Google's OAuth Implementation | Brian Smith-Sweeney | 48m |
Early 2021 discovery shows a client impersonation vulnerability in Google first‑party apps: stolen client IDs and secrets let an attacker present as Chrome or… | ||
| When a Zero Day and Access Keys Collide in the Cloud: Responding to the SugarCRM 0-Day Vulnerability | Margaret Zimmermann | 24m |
A SugarCRM RCE (CVE-2023-22952) leads to EC2 compromise where attackers harvest long‑term AWS keys from ~/.aws/credentials (AKIA prefix), run pacu and… | ||
| Identifying and Reducing Permission Explosion in AWS: A Graph-Based and Analytical Approach | Pankaj Moolrajani | 25m |
Claims a 63% cut in AWS permissions by applying three concrete steps: revoke permissions not accessed in 90 days, drop permissions with a Permission… | ||
| BTD: Unleashing the Power of Decompilation for x86 Deep Neural Network Executables | Tianxiang Li, Wenqiang Li, Zhibo Liu, Shuai Wang, Xiaofei Xie, Yuanyuan Yuan | 24m |
BTD decompiler reconstructs high‑level DNN models from x86 executables by combining trace-based symbolic execution, an LSTM opcode classifier to map assembly… | ||
| IRonMAN: InterpRetable Incident Inspector Based ON Large-Scale Language Model and Association miNing | Chung-Kuan Chen ckchen, Sian-Yao Eric Huang, Cheng-Lin Yang clyang | 40m |
System combines CMD GPT embedding with a traditional association-mining filter to surface human-readable “significant tokens” by measuring embedding similarity… | ||
| Uncovering Azure's Silent Threats: A Journey into Cloud Vulnerabilities | David Fiser, Magno Logan, Nitesh Surana | 41m |
Investigates Azure Machine Learning and demonstrates concrete failures: storage account keys logged in cleartext in startup and agent environment files, JWTs… | ||
| Compromising LLMs: The Advent of AI Malware | Sahar Abdelnabi, Christoph Endres, Mario Fritz, Kai Greshake, Shailesh Mishra | 36m |
Claim: prompt injections enable a new class of malware that runs entirely inside LLMs and can compromise many instances at once. Demonstrations include a… | ||
| I Watched You Roll the Die: Unparalleled RDP Monitoring Reveal Attackers' Tradecraft | Andréanne Bergeron, Olivier Bilodeau | 39m |
An RDP interception platform called PyRDP records screen, mouse, keyboard, clipboard and file transfers from cloud honeynets run for three years and produces… | ||
| Endoscope: Unpacking Android Apps with VM-Based Obfuscation | Fan Wu, Xuankai Zhang | 29m |
Shows a practical method that recovers original Dalvik bytecode from VM‑obfuscated Android apps by combining hooking of native registration (keeps hook… | ||
| Unsafe At Any Speed: CISA's Plan to Foster Tech Ecosystem Security | Jack Cable, Bob Lord | 40m |
CISA outlines a concrete plan: a published April white paper, an RFI on open-source security and memory-safe rewrites, and a Defcon workshop to co-design a… | ||
| mTLS: When Certificate Authentication is Done Wrong | Michael Stepankin | 22m |
Mutual TLS deployments often break when apps trust the wrong certificate in the chain: Java TLS verifies the first certificate only, but some code iterates and… | ||
| BingBang: Hacking Bing.com (and much more) with Azure Active Directory | Hillai Ben-Sasson | 34m |
A single misconfiguration — a single checkbox when creating a multitenant Azure AD app — allows authentication bypass by spoofing tenant IDs, enabling edits to… | ||
| Know Thy Enemy: The Taxonomies That Meta Uses to Map the Offensive Privacy Space | Zach Miller, David Renardy | 40m |
Meta builds two taxonomies: the Privacy Adversarial Framework — a privacy‑exclusive TTP layer integrated into MITRE ATT&CK Navigator covering about 180… | ||
| Mirage: Cyber Deception Against Autonomous Cyber Attacks | Ron Alford, Michael Kouremetis, Dean Lawrence | 31m |
A fully implemented system called Mirage emulates autonomous cyber adversaries using Caldera and a cloud-deployable Caldera range, implements two adversary… | ||
| The Most Dangerous Codec in the World: Finding and Exploiting Vulnerabilities in H.264 Decoders | Stephen Checkoway, Hovav Shacham, Willy R. Vasquez | 27m |
H26Forge is a toolkit that programmatically mutates H.264 syntax elements (30,000+ lines of Rust, Python transforms) to generate test videos; batches of 100… | ||
| The Yandex Leak: How a Russian Search Giant Uses Consumer Data | Kaileigh McCrea | 33m |
A 45 GB source dump reveals code for AppMetrica SDK in hundreds of millions of apps, the Crypta behavioral engine, and matching services that glue hashed and… | ||
| TSSHOCK: Breaking MPC Wallets and Digital Custodians for $BILLION$ Profit | Duy Hieu Nguyen, Anh Khoa Nguyen, Huu Giap Nguyen, Thanh Nguyen, Anh Quynh Nguyen | 27m |
Claims private key extraction from popular GG18/GG20 threshold ECDSA stacks via three 0‑day flaws, demonstrated against real MPC wallet/custodian deployments… | ||
| A SSLippery Slope: Unraveling the Hidden Dangers of Certificate Misuse | Bill Demirkapi | 32m |
Finds concrete EKU validation failures that let a low‑assurance DV/SSL certificate be used where a code‑signing cert is required, demonstrates a working… | ||
| International Threat Actors are Targeting Children to Steal Money from Banks & Major Corporations | Zach Edwards | 42m |
Claims that a commercialized affiliate network called CPA build hijacks legitimate .gov/.edu/.org hosts to generate thousands of SEO‑poisoned PDFs and landing… | ||
| Diversity Microtalks: Perspectives on Creating Change | Sherri Davidoff, Andy Ellis, Meghan Jacquot, Aastha Sahni | 40m |
A data-driven survey of 76 participants finds about 60 say they cannot attend international conferences and ~30% report no familiarity with visa or scholarship… | ||
| 34231 WhyCyberInsuranceShouldbeYourSOCsNewBestFriend v2 | Catherine Lyle | 39m |
Explains that cyber insurers underwrite to technology not to PII, using active scanning and daily security scoring; reports 76% of breaches begin with… | ||
| The Integration Cyber Security and Insurance: The Journey of | Kirsten Bay | 34m |
A cyber insurance MGU builds a certification + warranty that pulls telemetry via API from vendor stacks and enrolls customers automatically, then continuously… | ||
| Bridging Cyber and Insurance | John Caruthers | 31m |
Argues cyber insurance is a business hedge not a replacement for security and it motivates better security programs by forcing minimum controls like MFA… | ||
| Leverage and Demonstrate Value with your Cyber Insurance Renewal | Erik Decker | 29m |
Describes a real renewal at Intermountain Health and the exact controls underwriters demand: MFA on internet‑exposed assets, 24/7 EDR monitoring, secure… | ||
| The 9th Annual Black Hat USA Network Operations Center (NOC) Report | Bart Stump, Neil R. Wyler | 40m |
NOC report lists concrete changes and failures: the festival network runs on 2×10‑gig circuits from Lumen, Arista switching with Rista APs, Palo Alto firewalls… | ||
| Lessons Learned from the KA-SAT Cyberattack: Response, Mitigation and Information Sharing | Mark Colaluca, Craig Miller, Nick Saunders, Michael Sutton, Kristina Walter | 44m |
KA-SAT suffers a credentialed VPN compromise that places a toolkit on an FTP node and pushes a wiper binary targeting MyIPS into terminals, causing a rapid… | ||
| A Q&A with a16z's Zane Lackey: Unlocking the Secrets of Cybersecurity Entrepreneurship | Zane Lackey | 37m |
Built a company (Signal Sciences) to $30M ARR and exit with 150 employees, then moves into venture at Andreessen Horowitz to back the convergence of dev tools… | ||
| Idea to Realization: Cybersecurity Entrepreneurship | Jon Oberheide | 39m |
recounts building Duo Security from 2009 into a cloud‑delivered MFA business that uses mobile phones (the Duo Mobile app and Duo Push experience) to simplify… | ||
| Forward Focus: Perspectives on AI, Hype, and Security | Nathan Hamiel, Rich Harang, Ariel Herbert-Voss, Ram Shankar Siva Kumar | 39m |
Large language models show real capabilities but lack open benchmarks, so claims are mixed: companies must register foundational models under the EU AI Act and… | ||
| Keynote: Guardians of the AI Era: Navigating the Cybersecurity Landscape of Tomorrow | Maria Markstedter | 01h 01m |
Argues that AI shifts enterprise threat models from deterministic features to non‑deterministic autonomous agents that can fetch internet data, act on it and… | ||
| What We Can Learn from Ukraine's Cyber Defenders about Building a More Resilient Future | Jen Easterly, Lily Hay Newman, Victor Zhora | 41m |
Ukraine reports a shift from noisy destructive hacks to targeted intelligence operations against battlefield situational‑awareness and supply‑chain networks… | ||
| Discusses the National Cybersecurity Strategy and Workforce Efforts | Kemba Walden | 01h 01m |
White House releases a public implementation plan that lists 69 action items with leads, deadlines and agency commitments and uses budget review authority to… | ||
| Sure, Let Business Users Build Their Own. What Could Go Wrong? | Michael Bargury | 44m |
Slides and demos reproduce a Power Platform HR onboarding app that stores SSNs in a shared Dataverse table and shows automation logs store PII, proving the app… | ||
| Entrepreneur's Dilemma: Managing Growth and Dedication to Product Quality | Mario Vuksan | 42m |
Company bootsrapped eight years, grows to 80+ people, then a single incident — the SolarWinds Orion compromise — becomes a product moment: toolchain analyzes a… | ||
| Houston, We Have a Problem: Analyzing the Security of Low Earth Orbit Satellites | Johannes Willbold | 40m |
Analyzes three real LEO satellites, successfully compromising two: a university 3U CubeSat via a memcpy telecommand allowing arbitrary memory writes and an ESA… | ||
| nothing matches | ||