CODE BLUE 2024
2024-11-14..2024-11-15
Tokyo, Japan
[CODE BLUE 2015, CODE BLUE 2016, CODE BLUE 2017, CODE BLUE 2023, CODE BLUE 2024, CODE BLUE 2025]
who it's for
security researchers, red teamers, reverse engineers, vulnerability researchers, incident responders, soc engineers, malware analysts
topics
Edge WebUI XSS exploitation; Windows kernel streaming bugs; PlayStation TLS interception; transformer for Windows API inference; software bill of materials VEX; railroad signaling spoofing; IDA and Ghidra anti-debug plugins; RAG robustness and prompt poisoning; ETW forensic recovery tooling; symbolic execution Windows kernel fuzzing; WebAssembly V8 sandbox exploitation; Android NFC ATM relay malware
| title | author | length |
|---|---|---|
| Piloting Edge Copilot | Jun Kokatsu | 31m |
Edge’s WebUI enforces strong CSP and TrustedTypes and is served from the browser binary, but Bing endpoints expose ~10 distinct XSS vectors and privileged… | ||
| Proxying to Kernel:Streaming vulnerabilities from Windows Kernel | Angelboy Yang | 39m |
Walks through concrete Windows kernel-streaming bugs: a double-fetch in property handling and a KSQL/Ktrunk path that turns a property set into an arbitrary… | ||
| Defeating PlayStation 5 network encryption | Aapo Oksman | 39m |
A new automated MITM tool CMM replays 10–20 year old TLS tricks to fuzz client validation and finds 200 vulnerable apps, about half still unpatched; combined… | ||
| Attention Is All You Need for Semantics Detection:A Novel Transformer on Neural… | Mars Cheng, Yi-An Lin, Sheng-Hao Ma | 40m |
A neural-symbolic Transformer called KU (Kur Ida) is built to infer unknown Windows APIs from static binaries by combining a symbolic engine that extracts… | ||
| SBOM and Security Transparency - How it all fits together | Allan Friedman | 22m |
SBOMs become concrete: CISA runs a program, publishes a software identification ecosystem paper and pushes VEX machine-readable assertions and a vul enrichment… | ||
| Abusing legacy railroad signaling systems | David Melendez | 34m |
Claim: many legacy track beacons are passive LC resonators that encode signals by resonant frequency (examples: ~111 kHz base, red at ~95 kHz) and have no… | ||
| Hacking Google - Lessons learned running and growing an internal red team | Stefan Friedli | 39m |
An internal red team recounts using malicious USB plasma-globe implants to gain initial access to engineers working on Google Glass, then escalating over… | ||
| Automatic Detection of Anti‑Debugging with IDA/Ghidra and Debugging Process Efficiency via Support Features | Takahiro Takeda | 36m |
Using IDA and Ghidra, the talk presents methods to automatically detect anti-debugging techniques and provide tooling support to streamline the debugging… | ||
| BullyRAG:A Multi-Perspective RAG Robustness Evaluation Framework | Sian-Yao Eric Huang, Cheng-Lin Yang, Yen-Shan Chen | 43m |
BullyRAG is an open-source RAG robustness evaluator that runs attacks out of the box against OpenAI, Anthropic and Hugging Face inference, using a weekly arXiv… | ||
| EchidnaTermApp: A Penetration Testing Support and Learning Tool | Yu Terada | 29m |
EchidnaTermApp is a tool for assisting and teaching penetration testing that integrates with terminal workflows. It focuses on hands-on support for security… | ||
| Event Tracing for Windows Internals | Shusei Tomonaga | 44m |
Explains how Event Tracing for Windows stores events (controller/provider/consumer/session), demonstrates that Windows ships 1000+ ETW providers (≈200 actively… | ||
| Modern SOC:Less Than One and More Than Infinity | Alexander Rodchenko, Farid Dzhugunusov | 30m |
Argues SOC is essential and demonstrates concrete detections: shows golden ticket evidence by comparing token group memberships produced by mimikatz forged PK… | ||
| NTLMv1 reversion to NTLM with hashcat and the NTLMv1-multi tool | Dustin EvilMog Heywood | 27m |
NTLMv1 challenge/response is reversible: captured 8‑byte server and client challenges plus the 24‑byte NT response convert into three DES keys (21‑byte… | ||
| Did Subdomain Abuse by BlackTech “Evolve”? | Tsuyoshi Taniguchi, Kotaro Ohsugi | 40m |
Analysis shows BlackTech stops using Dynamic DNS in 2018, registers new parent domains yearly since 2019, and by September 2023 reuses parent domains across… | ||
| PkgFuzz Project: A New Continuous Fuzzing for Open Source Software | Yuhei Kawakoya, Eitaro Shioji, Yuto Otsuki | 38m |
PkgFuzz Project presents a new continuous fuzzing system for open-source software that targets package ecosystems. It describes an approach to continuously run… | ||
| Behind Enemy Lines:Engaging and Disrupting Ransomware Web Panels | Vangelis Stykas | 36m |
Scans of live C2 and leak sites use deers/Deeprs, ffuf, Burp Suite, Tor Browser, sandboxes and DigitalOcean droplets to catch short-lived panels; results are… | ||
| V for Vendetta:Dissecting a Global Phishing Platform After Being Phished | Mangatas Tondang | 30m |
Investigation starts after a booking.com chat link that exposes booking details and leads to five confirmed phishing attempts across four countries; analysis… | ||
| NGate:Novel Android malware for unauthorized ATM withdrawals via NFC relay | Lukas Štefanko, Jakub Osmani | 27m |
NGate is Android malware that steals bank PINs via phishing then performs a live NFC relay to cash out ATMs; researchers find six samples all signed with one… | ||
| From Snowflake to Snowstorm:Navigating Breaches and Detections | Roei Sherman | 41m |
A campaign against Snowflake compromises 165 organizations by buying stolen credentials and logging in — no zero days, no custom malware — then using native… | ||
| 1-Click-Fuzz：Systematically Fuzzing the Windows Kernel Driver with Symbolic Execution. | Sangjun Park, Yunjin Park, Jongseong Kim | 34m |
1-Click-Fuzz combines a static analyzer plus symbolic execution with angr to extract IRP field constraints and global-variable dependencies, then generates… | ||
| WebAssembly Is All You Need:Exploiting Chrome and the V8 Sandbox 10+ times with WASM | Seunghyun Lee | 43m |
Claims that WebAssembly lets attackers turn parser bugs into full exploits and demonstrates 10+ Chrome/V8 sandbox escapes using concrete primitives and tools… | ||
| nothing matches | ||