Bypassing Local Windows Authentication to Defeat Full Disk Encryption
Exploit bypasses Windows authentication and BitLocker encryption, allowing unauthorized access to sensitive data on encrypted disks without cryptographic brute-forcing or hardware manipulation.
All Your Root Checks Belong to Us - The Sad State of Root Detection
Explores root detection methods in Android security and BYOD apps, revealing vulnerabilities. Presents AndroPoser tool to bypass root checks, highlighting the need for improved mobile security measures.
Vulnerability Exploitation in Docker Container Environments
Explore Docker container vulnerabilities, exploitation techniques, and security risks. Learn about cgroups, namespaces, and mitigation strategies for protecting critical data in containerized environments.
New and Newly - Changed Fully Qualified Domain Names - A View of Worldwide Changes to DNS
Innovative approach to monitoring DNS changes, enabling better detection of security threats, phishing, and malicious behavior. Practical examples and demo included.
Faux Disk Encryption - Realities of Secure Storage on Mobile Devices
Explore mobile device data security challenges, debunk full-disk encryption myths, and learn sophisticated secure storage techniques for iOS and Android to protect against physical access attacks.
VOIP Wars - Destroying Jar Jar Lync
Explore vulnerabilities in Microsoft Lync/Skype for Business, including VoIP attacks, security design flaws, and client-side threats. Learn about attack vectors and practical threats with live demonstrations.
Fuzzing Android - A Recipe for Uncovering Vulnerabilities Inside System Components in Android
Explore a fuzzing approach to uncover vulnerabilities in Android's core system components. Learn about data generation, test execution, logging, and triage mechanisms for effective vulnerability detection.
Exploiting Adobe Flash Player in the Era of Control Flow Guard
Explore techniques for exploiting Adobe Flash Player vulnerabilities, bypassing Control Flow Guard, and executing data-only attacks without shellcode or ROP on Windows systems.
Defending Against Malicious Application Compatibility Shims
Explore advanced techniques for creating and detecting malicious application compatibility shims, including in-memory patching, obfuscation, and system subversion. Learn defensive strategies and tools for protection.
In-Security of Backend-As-A-Service
Explore the vulnerabilities in Backend-as-a-Service solutions for mobile apps, revealing widespread security flaws and potential data breaches in cloud-based storage systems.
Implementing Practical Electrical Glitching Attacks
Explore non-invasive electrical glitching techniques to bypass software protections and create exploitable conditions in target devices, including clock and voltage manipulation methods.
How to Break XML Encryption - Automatically
Explore automated attacks on XML Encryption, including vulnerability detection and exploitation techniques. Learn about recent developments, implementation challenges, and practical security implications.
LTE & IMSI Catcher Myths
Explore LTE security vulnerabilities and IMSI catcher techniques. Learn how popular phones can be exploited on 4G networks, with live demonstrations and in-depth analysis of baseband software weaknesses.
Hiding In Plain Sight - Advances In Malware Covert Communication Channels
Explores recent malware techniques using steganography and covert channels to evade detection. Analyzes real-world examples from cybercrime and targeted attacks, detailing implementation and discussing implications.
Going Auth The Rails On A Crazy Train
Explore common authentication and authorization pitfalls in Rails applications, and learn about a new dynamic analysis tool for penetration testing and securing large-scale Rails projects.
Continuous Intrusion - Why CI Tools Are An Attacker's Best Friends
Explore how CI tools can be exploited for attacks, including command execution, credential theft, and privilege escalation, with live demonstrations on popular open-source and proprietary platforms.
Your Scripts In My Page - What Could Possibly Go Wrong?
Explore the security risks of cross-domain script inclusion, including potential data leaks and account compromises. Learn detection methods and defensive measures to protect against these vulnerabilities.
Lessons From Defending The Indefensible
Optimizing infrastructure to defend against DDoS attacks: techniques, experiences, and lessons learned from protecting HTTP/S and DNS services at scale.
Is Your Timespace Safe? - Time and Position Spoofing Opensourcely
Explore GPS spoofing techniques affecting smartphones and smartwatches, including map apps and LBS vulnerabilities. Learn about time spoofing and other positioning methods like WiFi and BLE, with prevention strategies.
Commix - Detecting and Exploiting Command Injection Flaws
Automated tool for detecting and exploiting command injection vulnerabilities in web applications. Covers various exploitation scenarios and reveals 0-day vulnerabilities across different platforms.
Unboxing the White-Box - Practical Attacks Against Obfuscated Ciphers
Explore practical attacks on obfuscated ciphers, focusing on White-Box Cryptography. Learn techniques to assess security, understand vulnerabilities, and evaluate robustness against key extraction in software implementations.