Ret2dir - Deconstructing Kernel Isolation
Explore kernel exploitation technique ret2dir, bypassing isolation protections by leveraging direct-mapped memory. Learn about vulnerabilities, attack models, and mitigation strategies for Linux kernels.
Gyrophone - Eavesdropping Using a Gyroscope
Explore how smartphone gyroscopes can be exploited to eavesdrop on nearby speech, bypassing microphone permissions and posing privacy risks. Learn about potential attacks and defenses.
Next Level Cheating and Leveling Up Mitigations
Explore sophisticated attacks on anti-cheat systems in multiplayer gaming, including practical demonstrations and implications for game security and the future of cheat prevention.
Freeze Drying for Capturing Environment-Sensitive Malware Alive
Innovative techniques for capturing and analyzing environment-sensitive malware through "freeze drying" and live process migration, enabling dynamic analysis of sophisticated threats like Citadel and ZeuS/GameOver.
Abusing Software Defined Networks
Explore vulnerabilities in Software Defined Networks, including clear-text protocols, weak authentication, and open APIs. Learn to identify, exploit, and protect against these weaknesses in leading SDN platforms.
Hadoop Security - Seven Ways to Kill an Elephant
Explore Hadoop security challenges and solutions in Big Data environments. Learn seven key strategies to mitigate risks and protect sensitive information in Hadoop ecosystems.
Industrial Control Systems - Pentesting PLCs 101
Hands-on workshop exploring ICS security, focusing on PLC vulnerabilities. Learn to assess and exploit industrial control systems using real-world examples and practical techniques.
Industrial Control Systems - Pentesting PLCs 101
Hands-on workshop exploring penetration testing techniques for industrial control systems, focusing on PLCs. Learn to identify vulnerabilities and attack Siemens and Schneider devices.
Revisiting XSS Sanitization
Explore XSS vulnerabilities in popular WYSIWYG editors and learn an effective sanitization technique using minimal characters and regular expressions to prevent attacks across various contexts.
Counterfeiting the Pipes with FakeNet 2.0
Explore network simulation for malware analysis using FakeNet 2.0. Learn to mimic protocols, configure settings, and capture network signatures efficiently in this hands-on workshop.
WebKit Everywhere - Secure or Not?
Explore WebKit security, vulnerabilities, and exploitation techniques across platforms. Learn about security enhancements, mitigation strategies, and advanced exploit methods with real-world demos.
Session Identifier are for Now, Passwords are Forever - XSS-Based Abuse of Browser Password Managers
Explore XSS-based attacks on browser password managers, their vulnerabilities, and potential solutions. Learn about password field usage on popular websites and get recommendations for protection.
Certificate Bypass - Hiding and Executing Malware from a Digitally Signed Executable
Innovative technique for concealing malware within digitally signed files, evading detection by security solutions. Explores PE file structure, certificate table manipulation, and memory-based execution without disk writing.
When the Cops Come A-Knocking - Handling Technical Assistance Demands from Law Enforcement
Guidance on handling law enforcement demands for technical assistance, covering types of requests, legal authority, and response options for companies protecting user data and privacy.
The Hidden Architecture of Our Time - Why This Internet Worked, How We Could Lose It
Exploring the Internet's success, its underlying principles, and the potential threats to its architecture. Emphasizes the importance of cryptography, open networks, and hacking in shaping a functional global network.
Practical New Developments in The Breach Attack
Explore advanced techniques for exploiting SSL vulnerabilities, including new methods to bypass encryption, optimize attacks, and implement persistent command-and-control strategies. Novel mitigation approaches are also discussed.
The Perl Jam 2 - The Camel Strikes Back
Exploring critical vulnerabilities in Perl's core modules and CGI frameworks, demonstrating fundamental language issues through 0-days, and challenging the "developer's fault" narrative.
Exploiting Linux and Pax ASLR's Weaknesses on 32-Bit and 64-Bit Systems
Uncover vulnerabilities in Linux and PaX ASLR implementations, exploring low entropy, distribution issues, and object correlations. Learn to bypass Full ASLR and discover ASLR-NG, a new design addressing current weaknesses.
Bypassing Browser Security Policies for Fun and Profit
Explore mobile browser vulnerabilities and security policy bypasses, including Same Origin Policy and Content Security Policy. Learn testing methodologies and see real-world examples of Android browser exploits.
Devaluing Attack - Disincentivizing Threats Against The Next Billion Devices
Explore economic strategies to reduce cyberattack incentives by lowering attacker value rather than raising costs. Examine defense approaches for both financial and state-sponsored threats to secure future devices.
Triaging Crashed with Backward Taint Analysis for ARM Architecture
Explore tools for analyzing crashes on Linux and ARM, using dynamic binary instrumentation and backward taint analysis to determine exploitability. Learn about ARM-Tracer and ARM-Analyzer for efficient crash analysis.