Demystifying Key Stretching and PAKEs
Explore key stretching and PAKEs: their history, best practices, and applications in encrypted cloud services. Learn to create toy algorithms and understand their importance in cybersecurity.
DNSSEC Downgrade Attacks
Explore DNSSEC vulnerabilities and cryptographic agility risks, revealing how adversaries can manipulate DNS responses to compromise security and prevent DNSSEC validation.
The Battle Against the Billion-Scale Internet Underground Industry - Advertising Fraud Detection
Explore the escalating war between internet advertising fraud and anti-fraud efforts. Analyze typical underground industry gangs and their evolving tactics in this high-stakes technological confrontation.
Trying to Be Everything to Everyone - Let’s Talk About Burnout
Explore burnout in computer security, its causes, and mitigation strategies. Learn to set boundaries, manage anxiety, and maintain passion in a high-stress industry facing significant workforce shortages.
From Hackathon to Hacked - Web3's Security Journey
Explore Web3 and blockchain security challenges, examining the risks of emerging tech, high-stakes environments, and immutable transactions. Learn about current vulnerabilities and potential solutions.
Dive Into Apple IO80211Family Vol. 2
Explore Apple's Wi-Fi kernel extensions, uncovering new vulnerabilities and attack surfaces in the ever-evolving landscape of iOS security. Gain insights into the ongoing cat-and-mouse game of bug fixes and emerging threats.
Charged by an Elephant - An APT Fabricating Evidence to Throw You in Jail
Explore ModifiedElephant's decade-long operation, incriminating activists through planted evidence. Uncover the concerning ties to commercial surveillance and multiple regional threat actors targeting victims.
Fault-Injection Detection Circuits - Design, Calibration, Validation and Tuning
Explores Intel's tunable replica circuit for detecting fault-injection attacks in processors, focusing on design, implementation, and effectiveness in preventing timing failures and unauthorized code execution.
The Cyber Safety Review Board - Studying Incidents to Drive Systemic Change
Explore the Cyber Safety Review Board's analysis of the Log4j vulnerability, key findings, and recommendations for industry and government to enhance cybersecurity and drive systemic change.
EBPF ELFs JMPing Through the Windows
Explore eBPF for Windows: capabilities, security model, design, and attack surface. Uncover vulnerabilities, witness fuzzing demos, and discuss exploitation challenges in Windows Protected Process.
Backdoor Investigation and Incident Response - From Zero to Profit
Uncover how attackers breached an online gaming company, exploited a database backdoor, and manipulated transactions. Learn detection methods and incident response strategies for similar cyber attacks.
Codema Attack - Controlling Your Smart Home Through Dangling Management Channels
Análisis de vulnerabilidades en dispositivos IoT populares y desarrollo de CGuard, un nuevo marco de control de acceso para proteger a los usuarios finales de amenazas en canales de gestión.
SMS PVA Services Fueled by Compromised Supply-Chain Mobile Botnets
Uncover the operations of SMS PVA services and mobile botnets, exploring device infection methods, threat actor misuse, and the implications for supply chain security in mobile ecosystems.
Cooper Knows the Shortest Stave - Finding 134 Bugs in the Binding Code of Scripting Languages
Innovative approach to finding bugs in scripting languages through cooperative mutation, combining script code and native input modifications to uncover hidden vulnerabilities in binding code.
DroidGuard - A Deep Dive into SafetyNet
Explore SafetyNet's internal mechanisms, VM design, and security checks for detecting Magisk, emulators, rooted devices, and Pegasus in this comprehensive analysis of DroidGuard.
Explosion - The Hidden Mines in the Android ION Driver
Uncover vulnerabilities in Android's ION driver, explore root causes, and learn how to achieve privilege escalation. Gain insights into preventing similar security issues in the Android ecosystem.
Non-Intrusive Vulnerability Localization and Hotpatching for Industrial Control Systems
Explore non-intrusive techniques for identifying and patching vulnerabilities in Industrial Control Systems, focusing on specialized requirements of devices like PLCs.
The Little Seal Bug - Optical Sound Recovery from Lightweight Reflective Objects
Explore an optical side-channel attack that recovers sound from reflective objects in home offices, revealing potential vulnerabilities in remote work environments.
USMA - Share Kernel Code With Me
Explore Linux kernel attack methods, focusing on gadgets and CFI mitigation. Learn about innovative techniques to overcome limitations and enhance kernel exploitation strategies.
Like Lightning From the Cloud - Finding RCEs in an Embedded TLS Library
Explore techniques for discovering remote code execution vulnerabilities in embedded TLS libraries, with insights on improving security in IoT and embedded systems.
Unix Domain Socket - A Hidden Door Leading to Privilege Escalation in the Android Ecosystem
Explore Unix domain socket vulnerabilities in Android, revealing potential privilege escalation risks and security implications for third-party applications and vendor implementations.