CODE BLUE 2017
2017-11-07..2017-11-10
Tokyo, Japan
[CODE BLUE 2015, CODE BLUE 2016, CODE BLUE 2017, CODE BLUE 2023, CODE BLUE 2024, CODE BLUE 2025]
who it's for
Android security researchers, exploit developers and reverse engineers, incident responders and threat hunters, industrial control systems security engineers, digital forensics practitioners, virtualization and cloud security engineers, security policy and legal advisors
topics
Android kernel use-after-free exploitation; Dalvik bytecode dataflow analysis; PowerShell AMSI hooking and visibility; HTTP/2 passive fingerprinting; SSRF via URL parser inconsistencies; Automotive CAN bus reverse engineering; VMware RPC guest-to-host exploitation; Smart TV forensic image extraction; STIX-based cyber threat intelligence indicators; Industroyer industrial control malware analysis; iOS jailbreak toolchains and firmware patching
| title | author | length |
|---|---|---|
| Keynote: Make your car self-driving using open-source software | George Hotz | 46m |
Walks through concrete jailbreak tools and results: reverse engineers CAN traffic with Cabana and crowdsources DBC files to open DBC, ships hardware (a panda… | ||
| Learning Detection Indicators from Cyber Threat Intelligence and Their Applications | Tsuyoshi Taniguchi | 40m |
Describes a machine-learning approach that ingests daily-shared cyber threat intelligence (CTI) — specifically indicators like IPs and domains that attackers… | ||
| Legal Issues of Investigating Private Domains in Cybercrime | Takahashi Ikuo | 45m |
Examines legal issues around law enforcement investigations into private domains in cybercrime cases, comparing approaches across jurisdictions and identifying… | ||
| National Security and Public-Private Partnership for Cybersecurity: Strengths and Challenges | Stefano Mele | 59m |
European and national programs focus on concrete instruments: the EU launches a public–private research partnership that pledges €1.8bn Horizon 2020 PPP by… | ||
| Track the Attacker’s Actions — Understanding and Investigating Cross‑Cutting Intrusions Based on Behavior Patterns | Tomonaga Hideshige, Rokuda Keisuke | 51m |
The talk analyzes lateral-movement behaviors used in targeted intrusions by examining attackers’ C2 servers and malware communications to reconstruct… | ||
| A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! | Orange Tsai, Cheng-Da Tsai | 50m |
Demonstrates a practical exploit chain that turns URL parser inconsistencies into SSRF bypasses and real RCE: a custom fuzzing tool finds parsing mismatches… | ||
| Passive Fingerprinting of HTTP/2 Clients. | Ory Segal | 43m |
Akamai analysts extract fingerprints from 10 million+ HTTP/2 connections and claim distinct fingerprints for 40,000 unique user agents, using Settings, Window… | ||
| Inside Shell: Enhancing PowerShell Visibility Using .NET Hacking Techniques | Tanda Ken | 53m |
Describes using native-code hooking techniques against .NET programs to increase visibility into PowerShell execution. Explains extending and removing known… | ||
| LG vs. Samsung Smart TV: Which Is Better for Tracking You? | Sangmin Lee | 56m |
Researchers demonstrate that LG webOS 3.0 yields extractable forensic artifacts by leveraging a webOS emulator command‑injection to obtain root, imaging MMC… | ||
| For the Greater Good: Leveraging VMware's RPC Interface for fun and profit | Jasiel Spelman | 44m |
Demonstrates how VMware guest-to-host RPC can be recorded with piKD RPC sniffing and exercised from userland via a C++ DLL or a Python layer using ctypes… | ||
| Androsia: A step ahead in securing in-memory Android application data | Samit Anwer | 51m |
Androsia is a static analyzer that finds each object’s last use and instruments Dalvik bytecode to wipe sensitive contents (StringBuilder and destroyable… | ||
| The Art of Exploiting Unconventional Use-after-free Bugs in Android Kernel | Di Shen | 45m |
Discloses two Android kernel UAFs with concrete exploitation steps: CVE-2017-0403 uses iovec/readv–writev and the pipe subsystem to convert a 16‑byte overwrite… | ||
| Take a Jailbreak -Stunning Guards for iOS Jailbreak- | Otsuka Kaoru | 50m |
Combines three public bugs to move from app to root then to kernel: uses CVE-2016-7637 port uref corruption to man‑in‑the‑middle IPC, runs a 62‑iteration… | ||
| Trueseeing: Effective Dataflow Analysis over Dalvik Opcodes | Yoshimura Takahiro, Yoshimura Kenya | 41m |
Trueseeing performs direct Dalvik opcode analysis without a decompiler, ingesting APKs with apktool, storing code in an SQLite-backed codebase, and using… | ||
| Industroyer: biggest threat to industrial control systems since Stuxnet | Robert Lipovsky | 33m |
Claims that Industroyer is the first malware built to attack power grids and the largest ICS threat since Stuxnet are backed by code that controls switches via… | ||
| The Big Picture of APT Attacks Targeting Japan — APT Incident STIX Database | Kubo Keiji, Soeda Yoji | 48m |
JPCERT/CC describes a system that converts incident records of Japan-targeting APT attacks into STIX 2.0 and stores them in an open-source database on GitHub… | ||
| Possibility of Arbitrary Code Execution via Step‑Oriented Programming | Hiroaki Sakai | 49m |
Explains how embedded devices use a simple on-device debugger stub that communicates with a host debugger over the Remote Serial Protocol (RSP), and shows that… | ||
| Fun and Practice for exercising your ARM(64) | Jack Tang, Moony Li | 01m |
Presents a practical fuzzer that combines ARM64 hardware trace with Angr-based hybrid symbolic execution to reduce generated inputs and hit more driver code… | ||
| (In)Security of Domestic IT Asset Management Software | Muneaki Nishimura | 49m |
The talk analyzes security flaws in four widely used Japanese IT asset management products (software that admins install on employee endpoints to prevent data… | ||
| nothing matches | ||