When Governments Attack - State Sponsored Malware Attacks Against Activists, Lawyers, and Journalists
Explores state-sponsored malware attacks targeting activists, lawyers, and journalists. Discusses technical details, presents new research, and highlights the role of security professionals in combating these threats.
The Beast Within - Evading Dynamic Malware Analysis Using Microsoft COM
Explore COM's role in malware evasion and dynamic analysis challenges. Learn practical approaches for monitoring COM calls and overcoming obstacles in automated malware detection.
Timing Attacks Have Never Been So Practical - Advanced Cross-Site Search Attacks
Explore advanced cross-site search attacks, including browser-based and second-order techniques, to extract sensitive data from web services through timing side-channel vulnerabilities.
DPTrace - Dual Purpose Trace for Exploitability Analysis of Program Crashes
Explore advanced crash analysis techniques combining backward and forward taint propagation to enhance exploitability assessment and speed up vulnerability triage for security researchers and exploit writers.
Using an Expanded Cyber Kill Chain Model to Increase Attack Resiliency
Explore an expanded Cyber Kill Chain model to enhance attack resiliency. Learn about internal and target manipulation kill chains, and implement controls to frustrate adversaries at each stage.
The Art of Reverse Engineering Flash Exploits
Explore advanced techniques for reverse engineering Flash exploits, including debugging tactics, memory analysis, and understanding obfuscated code. Learn to interpret exploit methods and assess mitigation strategies.
Web Application Firewalls - Analysis of Detection Logic
Explores detection logic in Web Application Firewalls, focusing on regular expressions. Analyzes security flaws in popular WAFs and introduces tools for identifying vulnerabilities in regex patterns.
Crumbling the Supercookie and Other Ways the FCC Protects Your Internet Traffic
Overview of FCC's role in protecting internet privacy and security, including enforcement actions against ISPs and proposed rules for data sharing. Explains rulemaking process and invites audience engagement.
VoIP Wars - The Phreakers Awaken
Explore cutting-edge VoIP attacks, vulnerabilities, and security testing techniques for modern unified communications, with focus on cloud-based solutions and enterprise networks.
Breaking Hardware-Enforced Security With Hypervisors
Explore how hypervisors can bypass Intel's Trusted Execution Environment and capture keys from AES-NI instructions, revealing vulnerabilities in hardware-enforced security mechanisms and offering insights on robust deployment strategies.
PLC-Blaster - A Worm Living Solely in the PLC
Demonstration of a self-contained worm targeting Siemens Simatic S7-1200 PLCs, showcasing its ability to scan, compromise, and remotely control devices without external support, while evading detection and analysis.
OSS Security Maturity - Time to Put on Your Big Boy Pants
Explore open source software risks, evaluation strategies, and a maturity model for organizations. Learn to manage vulnerabilities, assess costs, and implement effective security practices in product development.
Crippling HTTPS with Unholy PAC
Explore how malicious Proxy AutoConfiguration can compromise HTTPS security, leak sensitive data, and enable cross-platform attacks, even on secure networks and browsers.
Intra-Process Memory Protection for Applications on ARM and X86 - Leveraging the ELF ABI
Explore intra-process memory protection techniques for ARM and X86 architectures using ELF ABI. Learn about ELFbac system implementation, policy enforcement, and practical applications in software security.
Ways to Die in Mobile OAuth
Comprehensive analysis of OAuth vulnerabilities in mobile apps, revealing widespread implementation flaws and security risks. Offers insights for developers to enhance mobile OAuth security.
Viral Video - Exploiting SSRF in Video Converters
Exploiting SSRF vulnerabilities in video converters using HLS playlists, potentially leading to critical security breaches in cloud-based services. Includes demonstration of attacks on major platforms.
Auditing the Compression Algorithm Weapon Cache
Explore decompression bomb attacks, their impact on applications, and strategies for prevention. Learn about various compression algorithms and their vulnerabilities in this security-focused presentation.
Recover a RSA Private Key From a TLS Session With Perfect Forward Secrecy
Explore RSA private key recovery from TLS sessions with Perfect Forward Secrecy, focusing on faulty digital signatures and hardware vulnerabilities in network devices.
AVLeak - Fingerprinting Antivirus Emulators for Advanced Malware Evasion
Explore AVLeak, a tool for fingerprinting antivirus emulators through automated testing. Learn advanced techniques for detecting and evading popular consumer antivirus products.
Towards a Holistic Approach in Building Intelligence to Fight Crimeware
Holistic approach to combat cybercrime by analyzing network attack surfaces and actor behaviors. Explores bulletproof hosting, fast flux networks, and underground forums to proactively identify and block malicious infrastructure.
An Insider's Guide to Cyber-Insurance and Security Guarantees
Explore the rise of cyber-insurance and security guarantees in the InfoSec industry. Learn about their impact, implementation challenges, and potential benefits for businesses and security vendors.