AI Assisted Decision Making of Security Review Needs for New Features
Explore AI-assisted decision-making for identifying security review needs in new features, addressing challenges in modern SDLC and improving security oversight in fast-paced development environments.
MaginotDNS - Attacking the Boundary of DNS Caching Protection
Unveils MaginotDNS, a potent cache poisoning attack exploiting DNS server vulnerabilities. Demonstrates how attackers can compromise entire DNS zones, including top-level domains, surpassing previous attack capabilities.
All Cops Are Broadcasting - Breaking TETRA After Decades in the Shadows
Unveiling TETRA's security vulnerabilities: A groundbreaking analysis of the encrypted radio standard used by government agencies, emergency services, and critical infrastructure worldwide.
MoustachedBouncer - AitM-Powered Surveillance via Belarus ISPs
Uncovers advanced espionage group using AitM attacks and ISP-level tampering in Belarus to target diplomats with custom malware, highlighting sophisticated surveillance techniques.
Shuffle Up and Deal - Analyzing the Security of Automated Card Shufflers
Explore security vulnerabilities in automated card shufflers used in casinos, including communication protocols, hardware analysis, and potential exploits, with insights on improving gambling security.
Weaponizing Plain Text - ANSI Escape Sequences as a Forensic Nightmare
Explore how ANSI escape sequences can be exploited to inject, vandalize, and weaponize logfiles, combining old terminal injection techniques with modern features to create chaos in cloud CLIs and DevOps environments.
Jailbreaking an Electric Vehicle in 2023 - What It Means to Hotwire Tesla's x86-Based Seat Heater
Explore Tesla's advanced car computers and potential hacks to unlock premium features without payment. Delve into attacks on AMD-based infotainment systems in recent models.
Smashing the State Machine - The True Potential of Web Race Conditions
Explore advanced web race-condition attacks beyond limit-overrun exploits. Learn to exploit state machines in websites, enabling data forgery, token misrouting, and backdoor masking across high-profile platforms.
16 Zero-Day Vulnerabilities Affecting CODESYS Framework Leading to Remote Code Execution
Découverte de 16 vulnérabilités zero-day dans CODESYS, un framework logiciel pour automates programmables industriels, affectant potentiellement des millions d'appareils dans divers secteurs industriels.
Three New Attacks Against JSON Web Tokens
Discover three novel attacks on JSON Web Tokens, exploring vulnerabilities in authentication and session management. Gain insights into cryptographic design flaws and complexity issues in JWT implementations.
Core Escalation - Unleashing the Power of Cross-Core Attacks on Heterogeneous System
Explore cross-core attacks on complex smartphone SoCs, examining vulnerabilities in multi-processor systems and their impact on overall device security. Learn about real-world examples and potential defense strategies.
Over the Air, Under the Radar - Attacking and Securing the Pixel Modem
Explore Android Red Team's proactive security approach for Google Pixel devices, focusing on modem vulnerabilities and protection strategies against remote compromises.
The Hat Trick - Exploit Chrome Twice from Runtime to JIT
Explore Chrome vulnerabilities in V8's Maglev compiler, uncovering security risks in JS optimization and compilation processes for advanced browser exploitation techniques.
Devising and Detecting Phishing - Large Language Models vs. Smaller Human Models
Explore the effectiveness of AI-generated phishing emails compared to traditional methods, revealing surprising results and implications for cybersecurity strategies.
Single Instruction Multiple Data Leaks in Cutting-edge CPUs - AKA Downfall
Unveiling Downfall attacks: new transient execution vulnerabilities in Intel CPUs. Exploits Gather instruction to leak data across security boundaries, defeating previous defenses and necessitating critical hardware fixes.
Dismantling DDoS - Lessons in Scaling
Explore global DDoS attack trends, their impact on cybercrime, and insights into future threats through data analysis and geopolitical context.
ODDFuzz - Hunting Java Deserialization Gadget Chains via Structure-Aware Directed Greybox Fuzzing
Innovative approach to efficiently detect Java deserialization vulnerabilities using structure-aware directed greybox fuzzing, addressing challenges in existing tools and improving precision in gadget chain hunting.
Reflections on Trust in the Software Supply Chain
Explore software supply chain security challenges, evaluate current efforts, and discover promising solutions like binary-source validation to enhance trustworthiness in software development.
Zero-Touch-Pwn - Abusing Zoom's Zero Touch Provisioning for Remote Attacks on Desk Phones
Uncover vulnerabilities in Zoom's Zero Touch Provisioning for desk phones, exploring potential remote attacks and security implications in cloud communication platforms.
Chained to Hit - Discovering New Vectors to Gain Remote and Root Access in SAP Enterprise Software
Unveiling critical vulnerabilities in SAP enterprise software through analysis of the "P4" protocol, demonstrating tactics and techniques for remote and root access exploitation in mission-critical business systems.
You Can Run, but You Can't Hide - Finding the Footprints of Hidden Shellcode
Explore advanced techniques for detecting hidden shellcode on Windows systems, including innovative approaches to overcome attacker obfuscation methods and enhance memory scanning defenses.