Extreme Privilege Escalation on Windows 8 - UEFI Systems
Explore extreme privilege escalation techniques on Windows 8/UEFI systems, uncovering vulnerabilities in firmware interfaces and demonstrating exploitation methods for elevated system access.
Abusing Performance Optimization Weaknesses to Bypass ASLR
Explore vulnerabilities in performance-oriented software designs that can bypass ASLR, focusing on hash table implementations and Android's Zygote process creation model. Includes real-world attack demonstrations.
Lifecycle of a Phone Fraudster - Exposing Fraud Activity
Exposing phone fraudsters' tactics in account takeovers through acoustic analysis and graph theory, revealing reconnaissance patterns and providing insights to enhance call center security.
When the Lights Go Out - Hacking Cisco EnergyWise
Explore Cisco EnergyWise vulnerabilities and potential for large-scale blackouts. Learn reverse-engineered protocol details, attack methods, and defense strategies in IP-based energy management systems.
Hacking the Wireless World with Software Defined Radio - 2.0
Explore wireless hacking using software-defined radio. Learn to analyze, reverse engineer, and exploit RF signals in various systems, from pagers to satellites, using open-source tools and affordable hardware.
Dynamic Flash Instrumentation for Fun and Profit
Explore dynamic analysis of malicious Flash files using binary instrumentation, enabling faster and more detailed automatic analysis without decompilation.
From Attacks to Action - Building a Usable Threat Model to Drive Defensive Choices
Translating threat intelligence into actionable defensive strategies using community-driven approach. Explores evolution of threat modeling and its integration with risk management frameworks.
Point of Sale System Architecture and Security
Explore POS system architecture, integrated payment processing, and security vulnerabilities. Learn attack vectors and mitigation strategies to protect businesses from financial breaches.
Unveiling the Open Source Visualization Engine for Busy Hackers
Open source engine for creating advanced data visualizations, enabling visual learners to interpret complex data sets efficiently. Useful for security practitioners, incident responders, and malware researchers.
SAP, Credit Cards, and the Bird that Talks Too Much
Explore exploits in SAP applications to extract money, payment info, and credit card data from major organizations' business backbones. Follow the bird for intriguing data tweets.
Data-Only Pwning Microsoft Windows Kernel
Explore a novel technique for exploiting Windows kernel pool overflows, enabling privilege escalation without shellcode or ROP. Learn about security enhancements and bypass methods.
The Devil Does Not Exist - The Role of Deception in Cyber
Explore deception in cybersecurity: how attackers deceive, how to recognize it, and how defenders can use deception against attackers. Learn from traditional and emerging research on deception and game theories.
The Library of Sparta
Explore military doctrine to enhance cybersecurity strategies. Learn to apply tactical, operational, and strategic concepts for effective defense against advanced adversaries in today's militarized Internet landscape.
Digging for IE11 Sandbox Escapes Part 1
Explore IE11 sandbox vulnerabilities, focusing on logic bugs and Enhanced Protected Mode. Learn techniques to investigate, analyze, and exploit sandbox weaknesses in Windows 8.1.
The Beast is in Your Memory
Explore advanced exploitation techniques and control-flow integrity mechanisms. Learn about Return-Oriented Programming, its countermeasures, and how to bypass emerging CFI solutions.
Babar-ians at the Gate - Data Protection at Massive Scale
Explore data protection challenges and solutions for Big Data environments, focusing on security considerations for Hadoop and emerging vulnerabilities in large-scale data management systems.
Digging for IE11 Sandbox Escapes Part 2
Explore IE11 sandbox vulnerabilities, focusing on logic bugs and Enhanced Protected Mode. Learn to investigate, analyze, and exploit sandbox escapes discovered during a bug bounty program.
My Google Glass Sees Your Passwords
Innovative computer vision attack automatically recognizes touch screen inputs from a distance, posing significant security risks. Countermeasures include a context-aware privacy-enhancing keyboard for sensitive information.
Learn How to Control Every Room at a Luxury Hotel Remotely
Descubre cómo controlar remotamente todos los dispositivos de un hotel de lujo, explorando vulnerabilidades en sistemas de automatización y sus implicaciones para la seguridad hotelera y de los huéspedes.
A Survey of Remote Automotive Attack Surfaces
Comprehensive analysis of remote automotive attack surfaces across various manufacturers, exploring vulnerabilities and potential security improvements in modern vehicles.
The BEAST Wins Again - Why TLS Keeps Failing to Protect HTTP
Explores three new attacks against TLS on the web, revealing vulnerabilities in cryptographic protocols, implementation issues, and HTTPS deployment. Discusses attacker capabilities and mitigation strategies.