CODE BLUE 2015
2015-10-28..2015-10-29
Tokyo, Japan
[CODE BLUE 2015, CODE BLUE 2016, CODE BLUE 2017, CODE BLUE 2023, CODE BLUE 2024, CODE BLUE 2025]
| title | author | length |
|---|---|---|
| 1; mode=attack XSS Attacks By Abusing the XSS Filter | Masato Kinugawa | 31m |
Demonstrates that IE/Edge built‑in XSS filter can be abused to turn safe pages vulnerable by rewriting request strings into the response, using DLL binary… | ||
| Backdoor master key for MS Office | Shigeo Mitsunari, Yoshinori Takesako | 54m |
Claims that Excel 2010/2013 files saved under a specific sequence reuse the same internal secret key (SK) so any file produced that way can be decrypted… | ||
| Threat Analysis of Windows 10 IoT Core | Naohide Waguri | 27m |
Research investigates Windows 10 IoT Core security and finds DEP ASLR and CFG present but many unsafe defaults: Windows Update disabled, Windows Firewall… | ||
| Is there an EFI monster inside your apple? | Pedro Vilaça | 01h 13m |
A disclosed EFI firmware zero day lets software write the Mac EFI flash (uses 8MB SPI chips) after a sleep/wake sequence, enabling persistent EFI rootkits that… | ||
| PANDEMONIUM: Automated Identification of Cryptographic Algorithms | Yuma Kurogome | 26m |
A system called PANDEMONIUM runs malware under dynamic binary instrumentation (PANDA/QEMU), translates executed code into LLVM IR, applies llvm optimizations… | ||
| A new exploitation method to bypass stack canaries | Yuki Koike | 26m |
Proposes master canary forging by forcing glibc to mmap a heap region adjacent to TLS then using a large malloc plus a heap overflow to overwrite the master… | ||
| Ninja Correlation of APT Binaries | Bhavna Soman | 36m |
Dataset of 25 APT white papers (Jan–Mar 2015) yields binaries from VirusTotal (>10% malicious) and compares three similarity methods: imphash, ssdeep, sdhash… | ||
| The Only Way to Tell the Truth is in Fiction | Richard Thieme | 01h 13m |
Argument: fiction becomes the only vehicle to state sensitive realities because official secrecy and media manufacture public belief. Examples: 35 stories… | ||
| Practical network defense at scale | Travis Carelock | 01h 05m |
Built a scalable SIEM around the ELK stack that ingests about 1,000,000 log lines in 12s on eight nodes and correlates sFlow/NetFlow, firewall, DHCP/DNS, bro… | ||
| Cybersecurity of SmartGrid | Aleksandr Timorin, Sergey Gordeychik | 53m |
Research shows Internet-exposed SmartGrid gear with reproducible flaws: 65,000 Solar-Log inverters exposed and about 80,000 SMA WebBox instances with default… | ||
| Abusing Adobe Reader’s JavaScript APIs | Abdul Aziz Hariri, Brian Gorenc | 37m |
Research describes auditing SpiderMonkey bytecode in Adobe's jas bin to find nearly 100 JavaScript-API bugs and chains that achieve RCE without memory… | ||
| Revealing the Attack Operations Targeting Japan | Shusei Tomonaga, Yuu Nakamura | 55m |
JPCERT/CC traces two long‑running campaigns that infect at least 130 Japanese organizations between April and September 2015, with a concentrated Flash… | ||
| Extortion and Cooperation in the Zero-day Market | Alfonso De Gregorio | 57m |
Builds a game‑theory model called the 0‑day dilemma and shows cooperation can emerge without escrow if the seller can credibly punish defecting buyers by… | ||
| Wireless security testing with attack | Keiichi Horiai | 59m |
Demonstrates practical wireless attacks using GNURadio and cheap SDRs (RTL‑SDR ≈ $20, HackRF ≈ $300) to do two reproducible hacks: a working 2.4 GHz… | ||
| Defeating Firefox | Muneaki Nishimura | 44m |
Reports 23 Firefox bugs and $45,000 in bounties and demonstrates concrete, repeatable failures: missing spec checks let arbitrary request headers slip through… | ||
| An Abusive Relationship with AngularJS | Mario Heiderich | 51m |
Detailed catalog of real exploits against AngularJS 1.x: multiple sandbox bypasses across AngularJS 1.x (constructor/proto/getPrototype tricks, array sort and… | ||
| Making & Breaking Machine Learning Anomaly Detectors in Real Life | Clarence Chio | 01h 00m |
Live demos show a practical model-poisoning attack that slowly injects crafted web-log traffic into PCA-based detectors; implementation uses PCA and a robust… | ||
| How South Korea Invests in Human Capital for Cyber-Security | Seungjoo Gabriel Kim | 58m |
South Korea documents 75,472 cyberattacks (2010–Oct 2014) and NIS estimates about 6,800 full‑time North Korean cyber operators, so the state funds concentrated… | ||
| New immune system of information security from CHINA | Xiaodun Fang | 01h 00m |
This talk is about the introduction of Wooyun.
WooYun is a platform where security researchers report vulnerabilities and vendors give feedbacks. While WooYun… | ||
| (In)Security of Medical Devices | Florian Grunow | 01h 01m |
Research finds hard-coded passwords in hundreds of devices and demonstrates concrete exploits: a broadcast DoS script reboots and freezes patient monitors; an… | ||
| Keynote:The Singularity is Near | Takuya Matsuda | 51m |
Claims that Ray Kurzweil’s Singularity arrives by 2045 and AGI by 2029 are backed here with concrete numbers: an Oxford study saying 47% of US jobs are… | ||
| nothing matches | ||