Gattacking Bluetooth Smart Devices - Introducing a New BLE Proxy Tool
Explore BLE security vulnerabilities and learn to intercept communication between smart devices using a new open-source MITM proxy tool. Discover common flaws and best practices for IoT device security.
Cyber War in Perspective - Analysis From the Crisis in Ukraine
Explore the reality of cyber warfare through the lens of the Russia-Ukraine conflict. Gain insights into the strategic impacts, limitations, and implications of digital operations in modern geopolitical crises.
Access Keys Will Kill You Before You Kill the Password
Explore AWS API security, focusing on access key risks and MFA implementation. Learn strategies and tools for enhancing authentication without compromising workflow efficiency.
Account Jumping Post Infection Persistency & Lateral Movement in AWS
Explore AWS security vulnerabilities, infection methods, and post-infection techniques. Learn about account jumping, resource manipulation, and best practices for protecting cloud environments.
Does Dropping USB Drives in Parking Lots and Other Places Really Work?
Explores the effectiveness of USB drive-based attacks through a campus experiment, revealing high success rates and analyzing factors influencing user behavior. Discusses mitigation strategies and demonstrates new tools.
Secure Penetration Testing Operations - Demonstrated Weaknesses in Learning Material and Tools
Explores vulnerabilities in penetration testing practices, demonstrating weaknesses in learning materials and tools. Provides guidance on securing testing procedures and includes a live demonstration of hijacking techniques.
Using EMET to Disable EMET
Explore techniques to bypass EMET's security mitigations, including targeted evasion methods and generic disabling approaches applicable to various endpoint protection products.
Brute-Forcing Lockdown Harddrive Pin Codes
Explore techniques for bypassing AES-256 encrypted hard drive security through front-panel keyboard spoofing and internal design analysis, building on previous research.
Building a Product Security Incident Response Team - Learnings From the Hivemind
Building a Product Security Incident Response Team: Best practices, templates, and actionable recommendations for small to medium companies to establish effective PSIRT processes and respond to vulnerability reports.
Side-Channel Attacks on Everyday Applications
Explore FLUSH+RELOAD side-channel attacks beyond cryptography, demonstrating their potential to leak information from everyday applications like web browsers and text editors.
Unleash the Infection Monkey - A Modern Alternative to Pen-Tests
Explore a new open-source tool for testing network security resilience. Learn how the Infection Monkey simulates attacks, uncovers vulnerabilities, and provides a cost-effective alternative to traditional penetration testing methods.
Security Through Design - Making Security Better by Designing for People
Explore user-centered design methods to create more effective and user-friendly security processes, tools, and communication strategies, improving corporate productivity and security.
Breaking the Chain - An Attacker's Perspective on Supply Chain Vulnerabilities and Flaws
Explore cloud development vulnerabilities across 5 phases, from IDE to artifacts. Learn attacker strategies and exploitation techniques in this comprehensive supply chain security analysis.
Breaking Managed Data Services in the Cloud
Exploring vulnerabilities in core cloud infrastructure, revealing cross-tenant boundary breaches in major cloud vendors' services and their potential impact on customer security.
Dirty Bin Cache - A New Code Injection Poisoning Binary Translation Cache
Uncover a novel code injection vulnerability in Rosetta 2, exploring its impact on Apple Silicon Macs and discussing potential security implications for binary translation caches.
Dirty Stream Attack - Turning Android Share Targets Into Attack Vectors
Explore Android's intent system vulnerabilities, focusing on how file-sharing mechanisms can be exploited to target and attack applications, with insights on potential security risks and mitigation strategies.
Dilemma in IoT Access Control - Revealing Novel Attacks and Design Challenges in Mobile-as-a-Gateway
Explore novel attacks and design challenges in Mobile-as-a-Gateway IoT devices, focusing on security vulnerabilities in access control systems for smart locks and item trackers.
Deception at Scale - How Malware Abuses Trust
Explore evolving techniques used by attackers to disguise malware as legitimate, including stolen certificates, hiding in legitimate apps, and exploiting trusted distribution channels. Learn about trends and countermeasures.
FirmWar - An Imminent Threat to the Foundation of Computing
Explore the overlooked risks of enterprise device firmware in IT supply chains, uncovering vulnerabilities and discussing their impact on computing security and industry practices.
Engaging the Next Generation of Cybersecurity Professionals - The Power of Security Zines
Discover how Security Zines use comics and visuals to make cybersecurity education fun and accessible for all ages, inspiring the next generation of infosec professionals.
E-Meet or Emit My Keystrokes - How Benign Screen-sharing Meetings Could Leak Typing Behaviors
Reveals how screen-sharing during video meetings can expose typing behaviors, potentially compromising privacy. Explores exploitation algorithms to extract individual typing patterns from recorded sessions.