Hey Man, Have You Forgotten to Initialize Your Memory?
Exploiting uninitialized memory in 64-bit IE to bypass ASLR, CFG, and EPM sandbox. Techniques for remote code execution and privilege escalation on Windows 8.1 demonstrated through Pwn2Own contest example.
Cybercrime in the Deep Web
Explore automated detection of cybercrime in anonymous networks beyond TOR, including I2P and FreeNET. Learn about DeWA system for identifying emerging threats in the Deep Web.
Authenticator Leakage Through Backup Channels on Android
Explore Android authentication vulnerabilities through backup channels. Learn about security risks, attack vectors, and mitigation strategies for app developers and protocol analysts.
Watching the Watchdog - Protecting Kerberos Authentication With Network Monitoring
Explore advanced Kerberos attack detection techniques and learn to protect Windows networks using network monitoring. Includes a novel "Diamond PAC" attack variant and the "Kerberos Leash" tool.
Exploit Delivery With Steganography and Polyglots
Explore innovative exploit delivery techniques using steganography and polyglots, focusing on encoding browser exploits in image files for undetectable payload transmission.
The Tactical Application Security Program - Getting Stuff Done
Aprenda a implementar um programa de segurança tático e eficaz, focando em avaliações ágeis, resposta a incidentes e gerenciamento de bugs. Descubra por que abordagens táticas podem ser mais efetivas que estratégias de longo prazo.
The Battle for Free Speech on the Internet
Explore the challenges and strategies for preserving online freedom of speech, examining the impact of censorship and the role of tech companies in protecting lawful content.
Spread Spectrum Satcom Hacking - Attacking The Globalstar Simplex Data Service
Explore reverse engineering and exploitation of GlobalStar's simplex satcom protocol, uncovering vulnerabilities in satellite communications and demonstrating interception and spoofing capabilities.
FileCry - The New Age of XXE
Explore critical XXE vulnerabilities in enterprise software, including 0-day exploits in Java and Internet Explorer. Learn detection, exploitation, and prevention techniques.
Critical Vulnerabilities and Bug Bounty Programs
Explore critical vulnerabilities discovered through bug bounty programs, their impact on customers, and strategies for improving submission quality and researcher participation.
Assessing and Exploiting BigNum Vulnerabilities
Explore vulnerabilities in multi-precision integer arithmetic used in cryptography implementations. Learn bug patterns, exploitation techniques, and strategies for automated vulnerability detection.
Bypass Control Flow Guard Comprehensively
Analyze CFG's weaknesses and explore a new technique to bypass it, enabling previously prevented exploit methods and opening avenues for developing more advanced exploit techniques.
Return to Where? You Can't Exploit What You Can't Find
Explore advanced techniques for detecting and preventing memory corruption vulnerabilities, including execute-only memory and code pointer hiding, to enhance software security against sophisticated exploitation methods.
Certifi-gate - Front-Door Access To Pwning Millions Of Androids
Explore Android vulnerabilities affecting millions of devices, including Lollipop. Learn about exploits, technical root causes, and remediation strategies for these critical security flaws.
Attacking ECMAScript Engines With Redefinition
Explore vulnerabilities in ECMAScript engines through function redefinition, examining implementation differences and strategies for identifying security issues in various targets.
Abusing Silent Mitigations - Understanding Weaknesses Within Internet Explorer
Explore Internet Explorer's silent exploit mitigations, their weaknesses, and potential attack vectors. Learn techniques to bypass these security measures and gain insights into hardening browser defenses.
Why Security Data Science Matters and How It's Different
Explore security data science challenges and solutions, including machine learning for attack detection, threat intelligence, and malware analysis, with focus on overcoming unique security-specific obstacles.
Exploiting Out-of-Order Execution for Covert Cross-VM Communication
Explore a novel side channel attack exploiting CPU out-of-order execution for covert cross-VM communication in cloud environments, with live demos and mitigation techniques.
Deep Learning on Disassembly
Explore deep learning techniques applied to disassembly for malware identification, covering the process from raw binaries to model training and evaluation against active malware feeds.
Broadcasting Your Attack - Security Testing DAB Radio in Cars
Explore vulnerabilities in DAB radio systems in cars, potential security risks, and implications for automotive cybersecurity using Software Defined Radio and custom testing tools.
ZigBee Exploited - The Good, The Bad, And The Ugly
Explore ZigBee's security vulnerabilities in IoT devices, focusing on smart home applications. Learn about weaknesses, practical exploits, and a new security-testing framework for this widespread communication standard.