APTs Go Teleworking - The Rise of VPN Exploits
Explore the rise of VPN exploits amid increased remote work, focusing on Pulse Secure vulnerabilities, incident response challenges, and threat actor tactics in cyber espionage campaigns.
Practical HTTP Header Smuggling - Sneaking Past Reverse Proxies to Attack AWS and Beyond
Explore HTTP header smuggling techniques to bypass security measures, attack web applications, and exploit vulnerabilities in proxy servers and AWS services.
Certified Pre-Owned - Abusing Active Directory Certificate Services
Explore AD CS vulnerabilities for credential theft, persistence, and domain escalation. Learn offensive and defensive techniques to secure Active Directory PKI implementations.
Bypassing Windows Hello for Business and Pleasure
Explore vulnerabilities in Windows Hello's face recognition, demonstrating how attackers can bypass this passwordless authentication using a crafted USB device.
A New Class of DNS Vulnerabilities Affecting Many DNS-as-Service Platforms
Explore novel DNS vulnerabilities affecting major cloud providers, their impact on corporate networks, and potential information leakage. Learn about root causes, exploitation methods, and mitigation strategies.
Bridging Security Infrastructure Between the Data Center and AWS Lambda
Explore secure integration of serverless technology with data center services, focusing on workload identity in AWS Lambda and bridging identity between on-premises and cloud environments.
Breaking Secure Bootloaders
Explore techniques to bypass secure bootloaders, including signature verification vulnerabilities, memory analysis, and firmware update exploits. Learn to identify and exploit weaknesses in modern device protection mechanisms.
Cloudy with a Chance of APT - Novel Microsoft 365 Attacks in the Wild
Explore novel APT techniques targeting Microsoft 365, including persistent access methods and data extraction. Learn technical details, potential extensions, and prepare for emerging threats.
A Broken Chain - Discovering OPC UA Attack Surface and Exploiting the Supply Chain
Explore OPC-UA protocol vulnerabilities and potential cyberattack vectors in industrial communication systems. Learn about attack surfaces, exploitation techniques, and security implications for Industry 4.0 environments.
Can You Roll Your Own SIEM
Explore building a custom cloud-native SIEM solution, discussing considerations, requirements, and benefits compared to vendor options. Learn about cost savings and improved capabilities.
5G IMSI Catchers Mirage
Investigates 5G security mechanisms against IMSI catchers, exploring vulnerabilities and protection techniques through practical experiments with commercial devices.
Electromagnetic Fault Injection & Automotive Systems
Explore electromagnetic fault injection to bypass security in automotive ECUs, demonstrating potential vulnerabilities in modern vehicle systems through practical examples and live demonstrations.
Embedding a Human-Centric Approach Into a Global Cyber Security Program
Explore a human-centric approach to cybersecurity, challenging traditional views and examining how Airbus integrates this perspective into their global program for enhanced protection.
Come to the Dark Side, We Have Apples - Turning macOS Management Evil
Explore advanced offensive techniques for exploiting macOS management platforms, including MDM and Jamf, to gain unauthorized access and control over enterprise systems.
Hacking a Capsule Hotel - Ghost in the Bedrooms
Explore IoT vulnerabilities in capsule hotels, revealing how six exploits can be combined to control bedrooms and potentially disrupt noisy neighbors.
Deepfake Social Engineering - Creating a Framework for Synthetic Media Social Engineering
Explore the risks of deepfake technology in social engineering, learn about a new framework for understanding these attacks, and discover practical countermeasures to protect against synthetic media threats.
IPvSeeYou - Exploiting Leaked Identifiers in IPv6 for Street-Level Geolocation
Explore a data fusion attack on IPv6 home routers for precise street-level geolocation, uncovering millions of devices worldwide and discussing privacy implications.
FragAttacks - Breaking Wi-Fi through Fragmentation and Aggregation
Explore Wi-Fi vulnerabilities, including design and implementation flaws, and learn how attackers can exploit them for packet injection and data exfiltration in networks.
Generating YARA Rules by Classifying Malicious Byte Sequences
Explore an interpretable ML model for generating optimized malware detection signatures, balancing high detection rates with minimal false positives in ELF executables.
Applying AI as a Service to Targeted Phishing and Defending Against AI Generated Attacks
Explore AI-generated phishing attacks and defense strategies. Learn about AIaaS, its impact on cybersecurity, and techniques to detect and mitigate AI-powered threats.
Zero - The Funniest Number in Cryptography
Explore cryptographic vulnerabilities in BLS signature libraries, focusing on the number zero. Learn about "splitting zero" attacks and their impact on proof-of-possession aggregate signature schemes.