Dynamic Process Isolation
Explore cloud computing security with in-process isolation techniques, addressing vulnerabilities in shared hardware resources while maintaining high performance.
The Firmware Supply-Chain Security Is Broken - Can We Fix It?
Explores firmware supply chain vulnerabilities, outsourcing risks, and security gaps in hardware products. Discusses challenges in fixing known issues and proposes solutions for improved threat modeling and security.
The Hidden RCE Surfaces That Control the Droids
Uncover hidden vulnerabilities in Android OS libraries that process incoming files, potentially leading to remote code execution attacks on various system applications.
To Loot or Not to Loot - That Is Not a Question When State Nexus APT Targets Online Entertainment
Dissecting APT attacks on online entertainment companies, revealing espionage motives beyond financial gain. Analyzes 20+ operations since 2018, exposing tactics and implications for data-rich targets.
AutoSpear - Towards Automatically Bypassing and Inspecting Web Application Firewalls
Explore techniques for automatically bypassing and inspecting web application firewalls, examining vulnerabilities in WAF-as-a-service solutions and cloud security services.
Remote Memory-Deduplication Attacks
Explore remote memory-deduplication attacks in cloud systems, their implications for security, and potential countermeasures. Learn about ASLR breaks, Rowhammer attacks, and application fingerprinting.
Hunting and Exploiting Recursive MMIO Flaws in QEMU KVM
Explore security vulnerabilities in QEMU/KVM hypervisors caused by recursive MMIO handling, uncovering a new attack surface with potential for critical exploits in cloud computing environments.
Start Arbitrary Activity App Components as the System User Vulnerability Affecting Samsung Android
Vulnerability in Samsung Android allows zero-permission apps to execute arbitrary activities as system user, compromising device security across multiple Android versions.
Do You Speak My Language? Make Static Analysis Engines Understand Each Other
Explore a novel framework for cross-language taint-flow analysis, enabling detection of critical security vulnerabilities across multiple codebases and programming languages.
Measure Security Effectively
Learn strategies to quantify cybersecurity effectiveness, determine ROI, and communicate results from the security trenches to the boardroom, addressing a key industry challenge.
Conclusions and Key Takeaways from Black Hat Asia 2022
Insightful discussion on pressing InfoSec issues, trends, and future strategies by Black Hat Asia Review Board members, covering topics like stress testing, sanctions, governance, and emerging technologies.
Hacking Democracy - Will Our Societies Hold?
Explore the impact of digital technologies on democratic societies and the challenges they pose to governance, social cohesion, and political stability in this thought-provoking keynote.
SideWinder Uncoils to Strike
Explore the aggressive SideWinder threat actor's tactics, infection chain, and infrastructure. Learn about their evolving techniques and effective mitigation strategies.
An Offensive Approach to Analyzing Huge and Complex Big Data Infrastructures
Explore attack vectors in Big Data stack layers: ingestion, storage, processing, and access. Learn methodologies to identify vulnerabilities in complex infrastructures handling massive data volumes.
Wibbly Wobbly, Timey Wimey – What's Really Inside Apple's U1 Chip
Explore Apple's U1 Ultra Wideband chip, its capabilities, and potential applications. Dive into firmware, kernel components, and user space modifications for this cutting-edge technology.
Rope - Bypassing Behavioral Detection of Malware with Distributed ROP-Driven Execution
Explore a novel covert distributed execution technique for malware that challenges behavioral detection by AV and EDR solutions, using ROP-driven execution across multiple processes.
Uncovering Planned Obsolescence Practices in Robotics and What This Means for Cybersecurity
Explore systematic "robot teardown" to understand and repair robots, uncovering planned obsolescence practices and their implications for cybersecurity in robotics.
Windows Heap-backed Pool - The Good, the Bad, and the Encoded
Explore Windows kernel pool's evolution, new design complexities, and potential vulnerabilities. Learn about structure changes, exploitation techniques, and analysis tools for kernel pool security.
Typhoon Mangkhut - One-click Remote Universal Root Formed with Two Vulnerabilities
Exploit chain for remote Android root using Chrome and Binder vulnerabilities. Demonstrates bypassing security mitigations to achieve one-click root access on modern Pixel devices.
Smashing the ML Stack for Fun and Lawsuits
Explore legal risks and ethical considerations of testing commercial ML systems' security, with insights on potential lawsuits and regulatory implications for researchers.
Put in One Bug and Pop Out More - An Effective Way of Bug Hunting in Chrome
Discover effective bug hunting techniques in Chrome, leveraging historical vulnerabilities to uncover new ones. Learn to identify shared code patterns and exploit codebase complexity for enhanced security testing.