Oh My Hack 2024
| title | author | length |
|---|---|---|
| 6 edycja konferencji! | 01m | |
Conference report summarizes measurable outcomes from the Oh My Hack 6 edition: 1300 participants, 59 speakers across 48 talks and 6 tracks, and a concise… | ||
| ScamBook | Piotr Zarzycki, Paweł Srokosz | 43m |
The talk examines how scammers use Facebook for fake ads, frauds, and manipulation, detailing the most dangerous online scam techniques. Presenters Piotr… | ||
| You Got 10 Million PDFs from the Ministry. Now What? | Tomasz Zieliński | 47m |
Processing 10 million ministerial PDF reports into a working public service: the talk covers extracting text from massive PDF collections, detecting and… | ||
| Tough Cases: Ransomware Recovery in High-Availability Environments | Maciej Ogórkiewicz | 47m |
A case study of ransomware risk and recovery for a digital bank that cannot tolerate downtime, describing challenges of maintaining high availability during an… | ||
| Automation of Automation, or Fuzzing in the Age of GPT-4o & Gemini and Others | Kamil Frankowicz | 42m |
The talk explains how to test large language models and machine-learning frameworks by using other AI models (e.g., GPT-4o and Gemini) to perform modern… | ||
| Scams, Malware and Pseudo-Moderation — the Hidden Side of Social Media | Jakub Mrugalski | 44m |
Jakub Mrugalski uses Facebook as a testbed to investigate how social media enable cybercrime by interviewing fraudsters, executing and analyzing malicious… | ||
| A Short Talk on How Cyber Communication Could Be Better! | Iwona Prószyńska | 32m |
Prószyńska explains how to communicate about cybersecurity clearly and accurately during incidents, covering how to describe DDoS attacks, data leaks and… | ||
| Fake Deepfakes, or Not Everything Has to Be Deep | Anna Wasilewska-Śpioch, Adam Haertle | 49m |
Explains that many purported deepfakes are not actually created with deep-learning techniques but are used as excuses by fraudsters; examines multiple… | ||
| Infostealer Log Injection — a Potential Form of Information Flow Control | Bartosz Wawrzyniak | 43m |
Bartosz Wawrzyniak describes injecting fake logs into C2 communications of infostealer malware (examples: Lumma, RedLine, Agent Tesla) to actively manipulate… | ||
| On the Theatre of Cyber Operations — Defending NATO's Eastern Flank | Karol Molenda | 43m |
General Karol Molenda outlines Poland's and NATO allies' cyber defense efforts for the eastern flank, focusing on protecting critical infrastructure… | ||
| Developing Cryptocurrency Crime | Dominik Konopacki | 41m |
Presentation explains investigative techniques for tracing cryptocurrency crime, specifically methods to analyze and dismantle money laundering, cryptocurrency… | ||
| Emacs through BBS | Mateusz Kocielski | 37m |
A researcher recounts discovering a vulnerability in old BBS software that allowed obtaining a shell. The talk demonstrates how legacy processes and services… | ||
| The Neverending Story: Who Watches the Watchers | Marek Szustak | 36m |
Examines who controls systems that record users by presenting risk management and vulnerability research on popular web session-replay tools and employee… | ||
| Chinese Network Hardware: Risks, Potential and Reverse Engineering | Wojciech Cybowski | 43m |
Examines Chinese network hardware by analysing risks, backdoor presence, and reverse-engineering techniques; covers hands-on methods for modifying devices and… | ||
| War in the Russian Darknet | Anna Wasilewska-Śpioch | 41m |
The talk examines the fallout after the shutdown of Hydra, the dominant Russian darknet drug market, analyzing how other darknet forums compete to fill the… | ||
| Challenges, Facts, and Myths About Building Red Team Competencies in Organizations | Tomasz Bukowski | 44m |
The talk examines challenges, facts and myths around building Red Team capabilities in organizations, emphasizing that Red Teaming involves planning… | ||
| Which Web Vulnerabilities Are Especially Dangerous in Blockchain? | Łukasz Mikuła, Jakub Heba | 36m |
The talk examines which common web vulnerabilities become especially dangerous when present in blockchain-related applications, naming exploitation scenarios… | ||
| Hardware Hacking — Recovering a TPM Key Using a Retro Console | Michał Kłaput | 35m |
A practical demonstration of recovering TPM keys using a retro game console and a Raspberry Pi Pico to unlock an encrypted hard drive. The talk shows how the… | ||
| Once | Paweł Jałowiczor, Damian Kuczaty | 39m |
A municipal IT team modernized city office infrastructure and implemented advanced security procedures over several years through commitment and determination… | ||
| The Seven Deadly Sins of Web Apps, or a Bit About SSO Bugs | Mateusz Olejarka | 37m |
A talk about common implementation mistakes in Single Sign-On and the OAuth and OpenID Connect protocols, focusing on how subtle issues and multitenancy weaken… | ||
| AI Code Generator — Friend or Foe? | Marek Zmysłowski, Konrad Jędrzejczyk, Piotr Duszyński | 45m |
The talk examines AI code generators, covering their benefits and security risks. It discusses potential vulnerabilities introduced by generated code, the… | ||
| Vishing, Likejacking, Quishing and Other Pickup Techniques | Adam Paciuszkiewicz | 29m |
Covers common online and telephone social-engineering scams such as vishing (voice phishing), likejacking, and quishing (QR-code phishing). Explains how to… | ||
| Exfiltration: Level hard | Paweł Maziarz | 45m |
The talk examines advanced data exfiltration techniques beyond common channels like HTTPS, DNS, and ICMP, evaluating whether more “elegant” methods can be used… | ||
| Life, 42, the global routing table and answers to other questions | Łukasz Bromirski | 42m |
Examines routing security at three levels—internal networks, network edges, and the Internet—by discussing routing protocols, segmentation, and policy… | ||
| Threat Modeling at Allegro Scale: From STRIDE to Success | Piotr Żabrowski | 39m |
Allegro describes implementing a scalable threat modeling process that integrates STRIDE-based threat modeling into the existing software development lifecycle… | ||
| Is Quantum Cryptography the Future of Secure Communication? | Łukasz Dolny | 29m |
Introduces the basics of quantum cryptography and examines its potential to provide secure communication once quantum computers exist. Covers recent advances… | ||
| Between the hash and the paragraph | Zbigniew Krüger | 48m |
Legal and ethical issues around hacking are examined, covering freedom of speech, privacy rights, computer crime and digital evidence, and regulations for… | ||
| Online Hate — Evidence and Traces That Make Identifying the Perpetrator Easier | Krzysztof Bińkowski | 48m |
Covers practical methods for collecting online evidence and traces that can help identify people responsible for online hate speech. Shows simple… | ||
| TLPT Testing — a New Approach to Conducting Red Team | Krzysztof Zieliński, Paweł Piekutowski | 40m |
Presents TLPT, a new Red Team testing approach that combines Threat Intelligence, coordinated Purple Team collaboration, and external oversight to provide a… | ||
| Secret? Midnight? Blizzard? | Maciej Broniarz | 30m |
A presentation reconstructs a January 2024 cyberattack where Russian services broke into Microsoft infrastructure and a Polish NGO lost control of its Office… | ||
| Deterrence and Strategic Response to Cyber Operations | Kamil Bojarski | 40m |
Examines strategic deterrence and responses to cyber operations, covering sanctions, indictments, and the doctrine of persistent engagement (proactive actions… | ||
| How APT Groups Abuse Edge Devices for Espionage Operations | Łukasz Lamparski | 41m |
Covers advanced techniques and tools used by APT groups to attack and spy through edge devices such as VPNs, routers, firewalls, and remote access consoles… | ||
| Adventures in analyzing a backdoor in xz/liblzma | Bartosz Kisiel | 41m |
A forensic analysis of a supply-chain backdoor inserted into the liblzma (XZ Utils) library. It covers the malicious code, concealment techniques used to hide… | ||
| It will slip by, or about Side Channels | Mateusz Chrobok | 36m |
An overview of side-channel attacks at the intersection of physics and computer science, presenting the most interesting side-channel techniques. The talk… | ||
| Midnight Blizzard versus Microsoft: Analysis and conclusions | Konrad Kałużny, Wojciech Lesicki | 41m |
Examines the APT29 (Midnight Blizzard) attack against Microsoft, outlining the likely incident timeline, the techniques the attackers used, and the main… | ||
| Phishing? — No Thanks. How the Landscape of APT Techniques and Tactics Has Changed | Ireneusz Tarnowski | 45m |
A presenter examines how APT groups are shifting away from phishing toward using zero-day exploits and supply-chain attacks. The talk uses real-world examples… | ||
| Who Did It? And Why (insert any country here), but Only by 21.37%? | Marcin Ratajczyk | 43m |
The talk explains methods for attributing cyberattacks to specific countries, discussing analyst challenges and the limits of “digital fingerprints.” It uses… | ||
| How to Secure Thousands of Web Applications at Once | Michał Bentkowski | 36m |
The talk explains how to protect thousands of web applications at once by using CI/CD integrations and security automation to reduce manual work. It describes… | ||
| macOS application isolation and its exploitation | Wojciech Reguła | 45m |
Examines macOS sandboxing and notarization weaknesses by demonstrating how malicious apps can still exfiltrate data from password managers. Describes specific… | ||
| Cyber Recovery: Your Power-Up in the World of IT Security | Anna Rydel, Artur Kamiński | 44m |
Covers building an isolated, attack-resilient backup zone for IT systems, methods for automated integrity verification of backups, and procedures for rapid… | ||
| Hunting for Vulnerabilities in Microsoft SharePoint: Case Study | Piotr Bazydło | 46m |
Presentation demonstrates techniques for finding vulnerabilities in Microsoft SharePoint, a complex and well-studied product. It analyzes two real-world flaws… | ||
| Life with an Armored Phone and Its Mitigations | Michał Purzyński | 33m |
Examines MTE (Memory Tagging Extension) as a memory-error detection technology, comparing its accuracy and performance to HWSan. Presents Android test results… | ||
| nothing matches | ||