Server Tailgating - A Chosen-Plaintext Attack on RDP
Uncover a chosen-plaintext attack on Windows authentication, exploiting a vulnerability in common protocols. Learn about the attack's mechanics, implications for network security, and mitigation strategies.
Datacenter Orchestration Security and Insecurity - Assessing Kubernetes, Mesos, and Docker at Scale
Explore security challenges and solutions for large-scale datacenter orchestration platforms like Kubernetes, Mesos, and Docker, focusing on cloud-scale infrastructure and software-defined datacenters.
Hacking Hardware with a $10 SD Card Reader
Explore firmware extraction techniques using affordable SD card readers, bypassing expensive tools and complex setups for efficient hardware hacking and analysis.
OpenCrypto - Unchaining the JavaCard Ecosystem
Explore OpenCrypto, a library enabling full utilization of JavaCard capabilities across vendors. Learn about cryptographic coprocessors and ecosystem advancements in smart card technology.
ShieldFS - The Last Word in Ransomware Resilient File Systems
Innovative file system solution to combat ransomware attacks, offering preventive and reactive security measures beyond traditional detection approaches for enhanced data protection.
Web Cache Deception Attack
Explore the Web Cache Deception attack, a new vector exposing sensitive user data through server and caching manipulation. Learn about risks, conditions, and mitigation strategies.
Practical Tips for Defending Web Applications in the Age of DevOps
Practical tips for adapting application security to modern DevOps practices, covering static analysis, dynamic scanning, and security visibility for rapid development cycles.
3G - 4G Intranet Scanning and Its Application on the WormHole Vulnerability
Explore large-scale 3G/4G intranet scanning techniques and their application in detecting the WormHole vulnerability across millions of mobile devices in China's major ISPs.
The Irrelevance of K-Bytes Detection - Building a Robust Pipeline for Malicious Documents
Learn best practices for building a robust document analysis pipeline to detect malicious content, covering file type detection, sandboxing, content inspection, and evasion techniques used by attackers.
The Industrial Revolution of Lateral Movement
Explore advancements in targeted attacks and lateral movement techniques, examining their impact on cybersecurity and potential parallels to the Industrial Revolution.
Escalating Insider Threats Using VMware's API
Discover how VMware's API can be exploited to escalate insider threats, bypassing security measures that separate infrastructure and guest machine domains in enterprise environments.
Honey, I Shrunk the Attack Surface - Adventures in Android Security Hardening
Explore Android's attack surface reduction strategies, their impact on security, and future improvements. Gain insights into technical approaches and specific bug mitigation in this comprehensive overview.
Challenges of Cooperation Across Cyberspace
Exploring challenges in cyberspace governance, including insufficient awareness among communities, international security dialogues, and the struggle to address war and peace issues in the digital realm.
Game of Chromes - Owning the Web with Zombie Chrome Extensions
Explore how malicious Chrome extensions can create botnets, distribute themselves, and exploit vulnerabilities. Learn about attack patterns, extension capabilities, and security measures.
By-Design Backdooring of Encryption System - Can We Trust Foreign Encryption Algorithms
Explores mathematical backdoors in encryption algorithms, discussing design, detection, and implications for cryptographic trust and control. Examines historical cases and future challenges in algorithm security.
Skype and Type - Keystroke Leakage over VoIP
Revealing how VoIP software can leak keystroke information through audio, compromising user privacy. Presents S&T tool to demonstrate vulnerability in popular platforms like Skype and Google Hangouts.
Intel SGX Remote Attestation is Not Sufficient
Explore the limitations of Intel SGX Remote Attestation for ensuring confidentiality and integrity of unmodified cloud applications.
RBN Reloaded - Amplifying Signals from the Underground
Explore how combining SIGINT and HUMINT enhances threat intelligence, providing deeper insights into adversary tactics, intent, and vulnerabilities for improved cybersecurity decision-making.
Garbage In, Garbage Out - How Purportedly Great Machine Learning Models Can Be Screwed Up by Bad Data
Explores how data quality impacts machine learning models for malicious URL detection, comparing results across different datasets and analyzing feature activations in neural networks.
Free-Fall - Hacking Tesla from Wireless to CAN Bus
Detailed exploration of Tesla's security vulnerabilities, from wireless attacks to CAN bus access, including Tesla's response and new mitigation strategies.
Quantifying Risk in Consumer Software at Scale - Consumer Reports' Digital Standard
Explore methodologies for quantifying software security risks, predicting vulnerabilities, and evaluating consumer products using the Digital Standard developed by Consumer Reports and CITL.