Compromising LLMs - The Advent of AI Malware
Explore the security risks of AI integration, focusing on prompt injections and potential malware in language models. Learn about future challenges and consequences for AI assistants.
Nothing but Net - Leveraging macOS's Networking Frameworks to Heuristically Detect Malware
Explore macOS network frameworks for malware detection, focusing on unauthorized access and traffic analysis techniques to enhance security on Apple systems.
Mac-ing Sense of the 3CX Supply Chain Attack - Analysis of the macOS Payloads
Detailed analysis of the 3CX supply chain attack's macOS payloads, exploring the first "chained" supply chain attack and its impact on macOS systems. Insights into advanced cybersecurity threats and defenses.
Physical Attacks Against Smartphones
Explore vulnerabilities in modern Android smartphones, focusing on Recovery mode exploits and physical access attacks, despite existing security measures.
Civil Cyber Defense - Use Your Resources to Defend Non-Profits as They Combat Human Trafficking and Subvert Authoritarian Regimes
Volunteers and students use cyber skills to protect non-profits, activists, and journalists from threats like human trafficking and authoritarian regimes, utilizing academic resources and open-source tools to defend human rights.
Apple's Predicament - NSPredicate Exploits on iOS and macOS
Explore NSPredicate vulnerabilities in iOS and macOS, including FORCEDENTRY sandbox escape and new research on circumventing Apple's restrictions for potential code execution in privileged processes.
Input Output + Syslog - Obtaining Data From Locked iOS Devices via Live Monitoring
Discover techniques to extract significant data from locked iOS devices through USB monitoring and live system log capture, without needing passwords or device unlocks.
Harry Parser and the Cursed Tracker - Breaking the Spell of Online Data Collection
Uncover hidden secrets of online tracking and data collection. Learn about first-party and third-party trackers, regulatory loopholes, and OSINT techniques to understand how companies collect and share your online data.
Small Leaks, Billions of Dollars - Practical Cryptographic Exploits That Undermine Crypto Wallets
Explore vulnerabilities in Multi-Party Computation protocols used by major cryptocurrency wallets, revealing potential security risks and challenges in protecting billions in digital assets.
Bad io_uring - A New Era of Rooting for Android
Explore privilege escalation on Android devices using io_uring vulnerabilities, focusing on CVE-2022-20409 exploitation on Google Pixel 6 and Samsung S22.
Route to Bugs - Analyzing the Security of BGP Message Parsing
Explore vulnerabilities in BGP message parsing, crucial for Internet routing and data center operations. Uncover security risks in open-source implementations following Network Function Disaggregation trends.
Evasive Maneuvers - Trends in Phishing Evasion & Anti-Evasion
Explore cutting-edge phishing evasion tactics and anti-evasion strategies across various digital channels. Learn to identify and counter sophisticated threats in today's evolving cybersecurity landscape.
Second Breakfast - Implicit and Mutation-Based Serialization Vulnerabilities in .NET
Novel attacks against .NET serialization bypassing current mitigations, including exploits on platforms without well-known serializers and mutation attacks. Demonstrates vulnerabilities in popular databases and serializers.
Make KSMA Great Again - The Art of Rooting Android Devices by GPU MMU Features
Explores advanced Android rooting techniques using GPU MMU features, overcoming hardware and software mitigations in Android 13 devices through innovative exploitation methods.
Poisoning Web-Scale Training Datasets is Practical
Explore strategies for creating large datasets and two attacks exploiting these mechanics, revealing vulnerabilities in deep learning models trained on internet-sourced data.
Video-Based Cryptanalysis - Recovering Cryptographic Keys from Device Using Video of Power LED
Innovative cryptanalysis technique exploits power LED video footage to recover secret keys from devices, using rolling shutter for high-speed sampling and RGB analysis for key extraction.
The Living Dead - Hacking Mobile Face Recognition SDKs with Non-Deepfake Attacks
Explore vulnerabilities in mobile face recognition systems, focusing on non-deepfake attacks that bypass liveness detection. Learn about security flaws in popular SDKs and their implications for critical applications.
CodeQL - Also a Powerful Binary Analysis Engine
Unveiling CodeQL's potential as a binary static analysis tool, exploring its engine capabilities and applications beyond traditional static analysis for enhanced software security.
Lost Control - Breaking Hardware-Assisted Kernel Control-Flow Integrity with Page-Oriented Programming
Explore techniques to bypass hardware-assisted kernel control-flow integrity using page-oriented programming, revealing vulnerabilities in modern operating system security mechanisms.
Diving into Windows Remote Access Service for Pre-Auth Bugs
Explore unauthenticated remote code execution vulnerabilities in Windows Remote Access Service, focusing on high-impact bugs and their implications for offensive and defensive security research.
Oven Repair - The Hardware Hacking Way
Discover how hardware hacking techniques like power analysis and firmware reverse engineering can be used to repair a malfunctioning oven, saving it from becoming e-waste.