Breaking Bad - Stealing Patient Data Through Medical Devices
Explore risks of connected healthcare devices, including attack surfaces, data vulnerabilities, and real-world case studies of medical IoT security breaches and their implications.
Intel ME - Flash File System Explained
Detailed explanation of Intel Management Engine's flash file system, covering storage methods, supported file systems, and security features in ME 11.x.
Breaking XSS Mitigations Via Script Gadgets
Explore a novel web hacking technique that bypasses XSS mitigations using script gadgets. Learn about HTML sanitizers, CSP, and practical demonstrations of this powerful attack method.
Bot vs. Bot for Evading Machine Learning Malware Detection
Explore automated evasion techniques against machine learning-based malware detection, including AI-driven approaches and strategies for model hardening.
Practical Approach to Automate the Discovery and Eradication of Open-Source Software Vulnerabilities
Discover and eradicate open-source vulnerabilities in web applications at scale. Learn Netflix's pragmatic approach to identifying risks, triaging vulnerabilities, and implementing effective remediation strategies.
The Active Directory Botnet
Explore how botnets and C&C servers can infiltrate organizations, bypass network controls, and render security measures ineffective, with a focus on Active Directory vulnerabilities.
All Your SMS & Contacts Belong to ADUPS & Others
Uncover Android firmware vulnerabilities exposing user data to third parties without consent. Learn about ADUPS and other threats to mobile privacy and security.
Cache Side Channel Attack - Exploitability and Countermeasures
Explore dangerous cache attacks, their characteristics, and real-world applications. Learn about exploitability, countermeasures, and key takeaways for protecting against these privacy-violating threats.
The Power of Data-Oriented Attacks - Bypassing Memory Mitigation Using Data-Only Exploitation Techniques
Explore data-oriented attacks that bypass memory mitigation techniques, focusing on exploiting vulnerabilities without altering control flow. Learn about innovative exploitation methods and their implications for cybersecurity.
Phishing for Funds - Understanding Business Email Compromise
Explore the surge in Business Email Compromise, its global impact, and strategies to protect organizations from this lucrative cybercrime targeting various market segments.
GPU Security Exposed
Explore GPU security vulnerabilities, including shared memory risks and privilege escalation issues, with insights on protecting popular devices from potential exploits.
Beyond the Blacklists - Detecting Malicious URL Through Machine Learning
Explore machine learning techniques for detecting malicious URLs beyond traditional blacklists, focusing on HTTP-based communications and behavioral modeling for improved malware detection.
Talking Behind Your Back - Attacks and Countermeasures of Ultrasonic Cross-Device Tracking
Explore ultrasonic cross-device tracking: its marketing potential, privacy implications, and vulnerabilities. Learn about attacks, countermeasures, and the future of this emerging technology.
Code Deobfuscation - Intertwining Dynamic, Static and Symbolic Approaches
Explore advanced code deobfuscation techniques combining dynamic, static, and symbolic approaches to enhance software analysis and reverse engineering capabilities.
Attacking Windows by Windows
Explore a novel method for exploiting Windows kernel vulnerabilities across multiple OS versions, bypassing security measures to gain system privileges.
Use-After-Use-After-Free - Exploit UAF by Generating Your Own
Explore a novel exploitation technique for UAF vulnerabilities in Adobe Flash, transforming them into multi-class type confusions for full memory access despite recent mitigations.
WiFi-Based IMSI Catcher
Explore new WiFi-based IMSI catcher techniques for tracking mobile devices, exploiting authentication protocols and discussing potential mitigations for operators and users.
The Path Less Traveled - Abusing Kubernetes Defaults
Explore Kubernetes vulnerabilities, attack paths, and mitigations in default configurations through live demonstrations, focusing on cluster takeovers and host escapes.
Command Injection in F5 iRules
Explore command injection vulnerabilities in F5 iRules, focusing on syntax, exploitation techniques, and security implications for BigIP F5 products used in high-performance web traffic routing.
GDPRrrrr - Using Privacy Laws to Steal Identities
Explores how GDPR's Right of Access can be exploited by social engineers to steal sensitive information, highlighting vulnerabilities in data protection laws and offering insights for businesses and legislators.
Woke Hiring Won't Save Us - An Actionable Approach to Diversity Hiring and Retention
Explore actionable strategies for improving diversity in tech beyond hiring, addressing systemic issues in education and workplace retention for underrepresented groups in STEM fields.