Attacking and Defending the Microsoft Cloud - Office 365 & Azure AD
Explore common attacks on Microsoft Cloud, learn effective defenses, and gain insights into securing Office 365 and Azure AD environments. Applicable to other cloud providers.
Battle of Windows Service - A Silver Bullet to Discover File Privilege Escalation Bugs Automatically
Discover file privilege escalation bugs automatically in Windows services using Advanced Local Procedure Call analysis and process monitoring techniques for enhanced system security.
Where 2 Worlds Collide - Bringing Mimikatz et al to UNIX
Explore techniques for attacking Active Directory forests from UNIX systems integrated with AD, examining tools and procedures that bridge these two worlds in cybersecurity.
I Block You Because I Love You - Social Account Identification Attack Against a Website Visitor
Practical side-channel attack to identify social web service accounts of website visitors, compromising anonymity through user profiles and activities.
Container Attack Surface Reduction Beyond Name Space Isolation
Explore techniques to reduce container vulnerabilities by analyzing and removing unnecessary dependencies, binaries, and permissions, enhancing security beyond namespace isolation.
DeepPhish - Simulating Malicious AI
Explore AI-driven phishing simulation techniques, including neural networks and URL prediction, to enhance cybersecurity defenses against sophisticated email-based attacks.
Eternal War in XNU Kernel Objects
Systematic assessment of Apple's kernel security, demonstrating bypasses through ipc_port Kernel Object-Oriented Programming and showcasing realistic attack scenarios for full XNU control.
Level Up Your Security Mindset
Upgrade your security approach with collaboration, innovation, and risk-based technology. Learn to adapt to business needs, find the right solutions, and move beyond traditional "no" responses.
Broken Links - Emergence and Future of Software-Supply Chain Compromises
Explore software supply chain attacks, their rise, attacker motivations, and practical enterprise defense strategies in this comprehensive examination of a critical cybersecurity threat.
A Measured Response to a Grain of Rice
Explore hardware security vulnerabilities, implants, and detection challenges in modern devices. Learn about potential threats and protective measures in this comprehensive overview.
In Search of CurveSwap - Measuring Elliptic Curve Implementations in the Wild
Comprehensive survey of elliptic curve implementations in TLS, SSH, and IPsec protocols, analyzing support and behaviors across internet-wide scans and passive measurements.
Deep Impact - Recognizing Unknown Malicious Activities from Zero Knowledge
Innovative approach to detect unknown malicious activities using machine learning and image processing techniques on standard device logs, overcoming limitations of traditional security methods.
When Machines Can't Talk
Security analysis of MQTT & CoAP protocols, revealing design flaws, vulnerable implementations, and widespread unsecured deployments in machine-to-machine communication.
Thermanator and the Thermal Residue Attack
Explore thermal side-channel attacks on keyboards, revealing password vulnerabilities through heat residue analysis. Learn about Thermanator's capabilities in compromising password security.
SDL at Scale - Growing Security Champions
Explore strategies for building a successful Security Champion program, including role value, team commitment, champion selection, and expected benefits for all stakeholders.
The Mummy 2018 - Microsoft Accidentally Summons Back Ugly Attacks from the Past
Explores how Microsoft inadvertently revived old IP fragmentation vulnerabilities, allowing packet interception, modification, and denial of service attacks. Discusses implications for network security.
Decisions and Revisions - The Ever Evolving Face of the Black Hat NOC
Explore the decision-making process behind Black Hat's network operations center, including equipment selection and service deployment strategies for optimal cybersecurity infrastructure.
PASTA - Portable Automotive Security Testbed with Adaptability
Explore PASTA, a portable testbed for automotive security analysis, enabling research, development, and education in vehicle cybersecurity without ECU restrictions.
How Can Someone with Autism Specifically Enhance the Cyber Security Workforce
Explore unique skills individuals with Autism Spectrum Disorder bring to cybersecurity, enhancing workforce diversity and effectiveness in addressing complex security challenges.
Over-the-Air - How We Remotely Compromised the Gateway, BCM, and Autopilot ECUs of Tesla Cars
Detailing Tesla car hacking techniques, including remote compromises of gateway, BCM, and Autopilot ECUs. Explores vulnerabilities, attack chains, and Tesla's security enhancements in response.
Last Call for SATCOM Security
Explore vulnerabilities in satellite communication systems, including potential cyber-physical attacks on maritime, aviation, and military sectors. Learn about security flaws and their real-world implications.