Embracing an Adversarial Mindset for C++ Security
Talkat CppCon 2024 · on Wednesday, 2024-09-18· at 10:30· Adams A, 6700 North Gaylord Rockies Boulevard·
summary
Covers concrete C++ security work: walkthroughs of real Windows exploits (BLF heap-spray privilege escalation and printer RPC RCE) that are used in the wild, measured trends showing heap corruption remains dominant, and bug-bounty incentives with bug bounties pay up to $250,000. Describes tools and practices that actually ship—fuzzing as a service, compiler mitigations (CFG, ASAN, shadow stacks), threat modeling and architecture changes like isolate parsing in low-integrity process so you can judge practical value.
AI-written summary · about
chapters (13)
- 0:00Adversarial mindset for C++ security
- 3:03What is the adversarial mindset and why it matters
- 8:59Attacker motivations and privilege escalation
- 12:11Security trends and C++ vulnerabilities
- 16:05Memory safety and heap corruption
- 23:38Real-world C++ exploits
- 34:27Threat modeling to reduce vulnerabilities
- 40:26Secure coding and attack surface reduction
- 54:20Windows trust boundaries and integrity levels
- 1:04:09Isolation techniques and secure enclaves
- 1:05:13Fuzzing for C++ security
- 1:08:05Security-focused C++ development
- 1:09:55Final takeaways and Q&A session
related talks
01h 00m“Secure Coding Best Practices: Your First Line Is The Last Line Of Defense (1 of 2)”
47mBinary Exploitation 101: Offensive C Security
23mSecure Code, Safe Future: Mastering Security in Critical Software Development
01h 03m“Secure Coding Best Practices: Your First Line Is The Last Line Of Defense (2 of 2)”
31mThe Art of Cybersecurity Mastery: From Entry-Level to Staff+
01h 06mHacking and Securing C++
01h 01mSoftware Security
01h 24mCode Red: Navigating the Minefield of Security Programming Blunders