Timeless Timing Attacks
Explore novel timing attacks resilient to network jitter, uncovering vulnerabilities in cryptosystems and applications. Learn about cross-site and Wi-Fi password brute-forcing techniques.
Securing the Public - Who Is in Charge?
Explore cyber security as a public responsibility, addressing transparency, accountability, and regulation issues. Gain insights on creating better incentives and updating requirements for a safer digital world.
The Devil is in the GAN - Defending Deep Generative Models Against Adversarial Attacks
Exploring vulnerabilities in Deep Generative Models, this talk introduces a threat model for training-time attacks and demonstrates backdooring techniques, while proposing effective detection methods through static and dynamic inspections.
Enter Sandbox
Explore automated seccomp filter generation for Linux applications, enhancing security through sandboxing and system call restrictions without manual developer intervention.
Give Me a SQL Injection, I Shall PWN IIS and SQL Server
Explore SQL injection vulnerabilities in IIS and SQL Server, uncovering unexpected attack vectors and their implications for Microsoft's ecosystem security.
Threat Hunting in Active Directory Environment
Explore advanced threat hunting techniques in Active Directory, focusing on attacker persistence methods, privilege escalation, and covert system control. Learn to detect and mitigate sophisticated APT threats.
Domain Borrowing - Catch My C2 Traffic if You Can
Explore a new method to hide C2 traffic using CDN, circumventing censorship and detection. Learn about domain borrowing, HTTPS certificate abuse, and CDN vulnerabilities for red team operations.
Reverse Engineering Compliance
Explore reverse engineering techniques applied to compliance standards, shifting from checkbox mentality to understanding the spirit of requirements for more effective security practices.
The B-MAD Approach to Threat Modeling
Discover the B-MAD approach to threat modeling, exploring its pitfalls and organizational impacts. Learn effective strategies for implementing threat modeling across your organization and improving overall security.
How I Can Unlock Your Smart Door - Security Pitfalls in Cross-Vendor IoT Access Control
Explores security vulnerabilities in cross-vendor IoT access control, focusing on delegation chains and authorization flaws in smart home devices and cloud platforms.
The Price of Compatibility - Defeating macOS Kernel Using Extended File Attributes
Explore macOS kernel vulnerabilities through FAT filesystem implementation flaws, focusing on extended file attributes and their potential for launching attacks on the operating system.
The Motion Sensor Western - The Good, the Bad, and the Ugly
Explore security and privacy risks of motion sensors in IoT devices, including attacks on integrity, availability, confidentiality, and user privacy. Learn about implications and potential vulnerabilities.
Unprotected Broadcasts in Android 9 and 10
Uncover a critical Android vulnerability allowing unauthorized apps to send protected broadcast messages, impacting system security and user privacy across versions 9, 10, and 11 Developer Preview.
Supply Chain Infections and the Future of Contactless Deliveries
Explore supply chain risks, their consequences, and industry mitigation strategies in light of recent challenges. Gain insights into software integrity and future security measures.
HTTP/2 - The Sequel is Always Worse
Explore HTTP/2 vulnerabilities, implementation flaws, and RFC imperfections. Learn advanced request smuggling techniques and their impact on major platforms like Netflix and Amazon.
Cross-Site Escape - Pwning macOS Safari Sandbox the Unusual Way
Explore a novel attack on macOS Safari sandbox using Cross-Site Scripting, achieving native code execution outside the sandbox without re-exploiting WebKit twice.
The Hunt for Major League IoT-ICS Threats - A Deep Dive into IoT Threat Terrain
Explore IoT security threats, automated threat hunting techniques, and advanced analysis methods to protect against malicious actions targeting millions of connected devices.
Attacking IOBluetoothFamily HCI and Vendor-Specific Commands
Explores vulnerabilities in Bluetooth stacks, focusing on Host-Controller Interface (HCI) and vendor-specific commands. Demonstrates attack techniques and discusses security implications for MacOS and iOS devices.
Bypassing NGAV for Fun and Profit
Explore methodologies to reverse engineer and bypass next-generation anti-virus (NGAV) models, focusing on adversary learning techniques and challenges in cybersecurity.
LadderLeak - Breaking ECDSA with Less than One Bit of Nonce Leakage
Explores ECDSA vulnerabilities, focusing on nonce leakage attacks. Presents LadderLeak, a novel technique breaking ECDSA with minimal nonce exposure, and discusses implications for cryptographic implementations.
POSWorld - Should You Be Afraid of Hands-On Payment Devices
Explore the vulnerabilities of Point of Sale terminals, uncovering security flaws in hardware, software, and file systems that enable cloning and fraud in the dark market.