Nullcon Berlin 2025
as the organisers put it
Join over 200 experts at Nullcon Berlin 2025, exploring AI security, cloud post-exploitation, advanced malware, and more in Europe's premier offensive security event.
| title | author | length |
|---|---|---|
| Panel: Industrial Systems In The Crosshairs: What It Really Takes To Defend OT | 52m | |
Panelists lay out concrete failures and mitigations for OT in 2025: internet‑exposed HMIs and a dam incident, USBs and service techs carrying malware, and… | ||
| Stealing All macOS Sensitive Info with a Single Vulnerability | Koh M. Nakagawa | 29m |
A macOS privilege error grants gcore the com.apple.system-task-ports.read entitlement so a one-line PoC dumps any process—even with SIP—by running gcore… | ||
| Derandomizing Kernel Object Locations w Software Hardware-Induced Side Channels | Lukas Maar | 37m |
Two separate, practical location-disclosure attacks: a hash-table timing method that uses POSIX-timer and futex syscalls to detect bucket occupancy, induces… | ||
| Your MCP Server Executes Commands - But From Whom? | Simcha Kosman | 35m |
Every byte an MCP server sends can be weaponized: fuzzing the auto‑generated JSON schema produces Full‑Schema Poisoning (FSP) where malicious payloads hide in… | ||
| Finding Bugs in V8: A Formal Verification Approach | Simon Gerst | 37m |
Formal verification of V8 Turboshaft range analysis using ESBMC bounded model checking targets the abstract addition/division operators and models IEEE floats… | ||
| A Deep Dive into A Vulnerability Apple Deems Unexploitable | Mickey Jin | 33m |
Finds a narrow race condition in copy APIs in Apple's copyfile/fclone implementation and builds a reliable exploit that uses mounting the destination to force… | ||
| Unlock hidden Superpowers in MediaTek Wi-Fi Chips | Edoardo Mantovani, Daniel Wegemer | 41m |
Reverse engineering of MediaTek Wi‑Fi firmware on NDS32 and RISC‑V chips yields working methods to dump ROMs despite CRC checks and XOR/ AES protections, a… | ||
| LiveWire: Remote Command Execution Through Unmarshalling | Rémi Matasse, Pierre Martin | 34m |
Livewire’s JSON synthesizers allow instantiation of arbitrary PHP classes via the CLCTN type, and by controlling the meta/class and value fields an attacker… | ||
| LPEPM - Tricking Microsoft EPM To Do Our Bidding | Philip Tsukerman, Rotem Salinas | 34m |
Workable local privilege escalation against Microsoft EPM that turns any allowed rule into an admin execution by exploiting a double-fetch TOCTOU in the… | ||
| Linux Kernel Runtime Guard (LKRG) 1.0 | Solar Designer | 48m |
LKRG 1.0 is an out‑of‑tree Linux kernel module that performs runtime integrity checking of kernel image, CPU security flags, and per‑task credentials, and… | ||
| RDP and The Power of Deterministic Snapshot Fuzzing | Pascal Beyer | 41m |
SNAFUzz uses a custom emulator and VM snapshot workflow to run deterministic snapshot fuzzing, reliably reproducing crashes and producing reprofiles that… | ||
| Finding insecure cryptographic keys in DKIM, DNSSEC, OpenID Connect & elsewhere | Hanno Bock | 24m |
An open source scanner named badkeys automatically harvests keys from GitHub, firmware, DNS records and mailing‑list archives, normalizes many key formats and… | ||
| My Other ClassLoader is Your ClassLoader Reloaded: Reviving Parcelable Objects | Dimitrios Valsamaras | 29m |
Shows how a malicious app with no permissions can intercept an Intent, extract a Parcelable, write it to disk, edit a field (for example the URL or user token)… | ||
| DHCPwned: Owning Cameras One Lease at a Time | Emanuele Barbeno | 27m |
Pwn2Own entry achieves an unauthenticated RCE via DHCP domain-name JSON injection against an Ubiquiti AI Bullet camera by abusing UDHCPC_CB, which broadcasts… | ||
| Constructing Domain-Specific Fuzzer for WebGPU Shader Compilers | Lukas Bernhard | 27m |
A domain-specific fuzzer with a custom IR for semantically valid mutations and a harness that extracts Dawn’s tint and interfaces to user‑mode drivers runs… | ||
| LLMs everywhere: The future is now and the past keeps repeating itself | Joern Schneeweisz | 39m |
Demonstrates live demos against Claude and Gemini that turn rendered HTML, hidden text and downscaled images into working prompt injection exploits, shows an… | ||
| nothing matches | ||