CODE BLUE 2023
2023-11-08..2023-11-09
Tokyo, Japan
[CODE BLUE 2015, CODE BLUE 2016, CODE BLUE 2017, CODE BLUE 2023, CODE BLUE 2024, CODE BLUE 2025]
who it's for
security researchers, embedded security engineers, vulnerability analysts, red teamers, cloud security engineers, incident responders, automotive security engineers, policy makers
topics
IoT modem compromise chains; WDM driver symbolic execution; macOS Gatekeeper bypasses; DHCP-created DNS spoofing; Tesla Model 3 exploitation; cloud compute abuse for cryptomining; smart lock firmware extraction; Linux kernel exploitation techniques; Electron application vulnerabilities; IEC 104 grid-targeting malware; content-disposition filename ambiguity; prompt-injection against chat models
| title | author | length |
|---|---|---|
| Keynote:If It's Smart, It's Vulnerable | Mikko Hypponen | 48m |
Claim that the internet “deletes geography” and modern criminals exploit that by scanning the entire IPv4 space for MOVEit-style or default-credential flaws… | ||
| The Renaissance of Cyber Physical Offensive Capabilities | Daniel Kapellmann Zafra | 39m |
Malware named Cosmic Energy targets electric grids by speaking IEC 104 to RTUs, deploying a second-stage module Light Work that toggles breakers and can… | ||
| A 3-Year Tale of Hacking a Pwn2Own Target: The Attacks, Vendor Evolution, and Lesson Learneds | Orange Tsai | 43m |
Three-year Pwn2Own campaign on Sonos documents concrete exploits, tools, and outcomes: initial black‑box probing via wget upgrade flow and firmware reverse… | ||
| Bypassing macOS Security and Privacy Mechanisms: From Gatekeeper to System Integrity Protectio | Koh M. Nakagawa | 42m |
Shows concrete exploits and working demos: a quarantine propagation bug where the uchg file flag prevents quarantine attributes from being applied after TGZ… | ||
| Hi! My Name Is [What?]: Abusing DHCP To Spoof DNS Records | Ori David | 38m |
Demonstrates an unauthenticated route to create and overwrite Active Directory DNS records by sending an FQDN via a custom DHCP client utility so the DHCP… | ||
| Modems (and telecoms) are also not as secure - 6 0-days to 4 million modems within a week | Ta-Lun Yen | 38m |
Finds an exploit chain that uses a serial console and CFE firmware dump (reduced from ~30 days to 1.3 days), IDA Pro analysis and web command injection to… | ||
| Enhanced Vulnerability Hunting in WDM Drivers with Symbolic Execution and Taint Analysis | Zeze Lin | 32m |
A static analysis pipeline combining symbolic execution and taint analysis targets IRP_MJ_DEVICE_CONTROL handlers in WDM drivers, hooks common kernel APIs, and… | ||
| Open Sesame! The full story behind opening a smart lock | Thomas Bygodt | 37m |
A chain of attacks targets locks from the same Chinese OEM: unprotected debug ports let firmware be dumped with OpenOCD, firmware reveals a hardcoded… | ||
| The Dark Side of Cloud Computing: How Threat Actors Abuse Millions of Dollars of Cloud Compute | Daniel Davrayev, Yossi Weizman | 35m |
Threat actors compromise admin credentials via password spray, credential dumps or phishing, escalate with Elevate access to gain Azure RBAC owner rights, then… | ||
| Unlocking the Drive: Exploiting Tesla Model 3 | Vincent Dehors, David Berard | 40m |
Research demonstrates a full chain against Tesla Model 3 infotainment and gateway: initial Bluetooth OBEX image overflow in the Qt car Bluetooth service yields… | ||
| Pennywise - Invisible privacy risk in the new AI era | Vic Huang, Joy Ho | 42m |
Demonstrates concrete privacy bypasses against ChatGPT, Bard and Bing using prompt-injection and vision tricks: a lyrics prompt hack coerces models to reveal… | ||
| Digital sovereignty - shaping regulatory responses to technological dominance | Przemysław Roguski | 40m |
Digital sovereignty maps to concrete legal and technical levers: the US CLOUD Act lets US‑registered cloud providers hand over data regardless of storage… | ||
| "filename" in Content-Disposition is a landmine - vulnerability caused by ambiguous requiremen | Sato Motoyasu | 38m |
Scans of multipart Content-Disposition handling across browsers, HTTP clients, frameworks and mail libraries uncover concrete flaws: about 80 targets tested… | ||
| Pwning Electron Application : Analysis and Defense of Vulnerabilities in Electron Applications | Inseo An, Jemin Min | 27m |
Unpacks many Electron ASARs using an asar brute‑fix script that changes file size until extraction works, and forces developer tools open with devron; finds… | ||
| Deep-Kernel Treasure Hunt: Finding exploitable structures in the Linux kernel | Yudai Fujiwara | 35m |
A Ghidra-based static analyzer named Malis scans binaries, finds kmalloc calls via CFG traversal and intra-function symbolic propagation, and reports… | ||
| Power Automate C2: Stealth Living-Off-the-Cloud C2 Framework | Haneda Daiki, Fujita Rintaro | 41m |
Demonstrates a working C2 built entirely inside Power Automate: a Python toolkit called Pack2 Python framework generates initial “downloader” flows that fetch… | ||
| stelftools: cross-architecture static library detector for IoT malware | Yuhei Kawakoya | 38m |
SLS Tools identifies statically linked library functions inside IoT binaries by combining signature pattern matching with branch-target analysis… | ||
| OSBT: OpenID Connect Scenario-Based Tester | Yuasa Junki | 41m |
A new test tool called OSBT encodes OpenID Connect attack scenarios as executable scripts, automates browser steps with Playwright, and modifies requests via… | ||
| [CB23]BSides Tokyo 2024 | Aoyama Shinya, Takaoka Tetsuya | 34m |
Community-run security conference born from a 2009 Las Vegas offshoot, running since 2018 in Tokyo with seven organizers and free admission supported by… | ||
| Closing Keynote :Cyber and Security in Times of War | Sergiy Korsunsky | 41m |
War is the first major conflict fought in the era of iPhones, drones, Starlink and generative AI, where phishing becomes the dominant crime and global cyber… | ||
| International Panel Discussion on 'A Comprehensive Study of Active Cyber Defence' | Nick Wobma, Talita Dias | 01h 06m |
Japan's cyber strategy endorses penetration and neutralization of foreign targets to protect national security and critical infrastructure, but those measures… | ||
| nothing matches | ||