Arm IDA and Cross Check - Reversing the Boeing 787's Core Network
Uncover vulnerabilities in Boeing 787's Core Network through reverse engineering, revealing security flaws and their implications for aircraft systems and passenger safety.
Winter is Coming Back - Defeating the Most Advanced Rowhammer Defenses to Gain Root and Kernel Privileges
A novel exploit breaking advanced rowhammer defenses, allowing unprivileged applications to gain root and kernel privileges. Stealthier and more efficient than existing exploits, this talk presents key steps and implications.
PicoDMA - DMA Attacks at Your Fingertips
Explore PicoDMA, a compact FPGA-based platform for DMA attacks. Learn about its capabilities, hardware, and potential security implications using the affordable PicoEVB board.
A Decade After Bleichenbacher '06, RSA Signature Forgery Still Works
Explores RSA signature forgery vulnerabilities, revealing new CVEs and discussing prevention strategies through dynamic symbolic execution analysis of signature verification implementations.
SSO Wars - The Token Menace
Explore critical vulnerabilities in SSO implementations, focusing on token parsing issues in major libraries. Learn about potential attacks and their impact on authentication systems.
Detecting Deep Fakes with Mice
Explore innovative techniques for detecting AI-generated speech using biological systems, focusing on mice's auditory perception and neural responses to distinguish authentic from synthetic voices.
Attacking and Defending the Microsoft Cloud - Office 365 & Azure AD
Explore common attacks on Microsoft Cloud, learn effective defenses, and gain insights into securing Office 365 and Azure AD environments. Applicable to other cloud providers.
Battle of Windows Service - A Silver Bullet to Discover File Privilege Escalation Bugs Automatically
Discover file privilege escalation bugs automatically in Windows services using Advanced Local Procedure Call analysis and process monitoring techniques for enhanced system security.
Where 2 Worlds Collide - Bringing Mimikatz et al to UNIX
Explore techniques for attacking Active Directory forests from UNIX systems integrated with AD, examining tools and procedures that bridge these two worlds in cybersecurity.
I Block You Because I Love You - Social Account Identification Attack Against a Website Visitor
Practical side-channel attack to identify social web service accounts of website visitors, compromising anonymity through user profiles and activities.
Container Attack Surface Reduction Beyond Name Space Isolation
Explore techniques to reduce container vulnerabilities by analyzing and removing unnecessary dependencies, binaries, and permissions, enhancing security beyond namespace isolation.
DeepPhish - Simulating Malicious AI
Explore AI-driven phishing simulation techniques, including neural networks and URL prediction, to enhance cybersecurity defenses against sophisticated email-based attacks.
Eternal War in XNU Kernel Objects
Systematic assessment of Apple's kernel security, demonstrating bypasses through ipc_port Kernel Object-Oriented Programming and showcasing realistic attack scenarios for full XNU control.
Level Up Your Security Mindset
Upgrade your security approach with collaboration, innovation, and risk-based technology. Learn to adapt to business needs, find the right solutions, and move beyond traditional "no" responses.
Broken Links - Emergence and Future of Software-Supply Chain Compromises
Explore software supply chain attacks, their rise, attacker motivations, and practical enterprise defense strategies in this comprehensive examination of a critical cybersecurity threat.
A Measured Response to a Grain of Rice
Explore hardware security vulnerabilities, implants, and detection challenges in modern devices. Learn about potential threats and protective measures in this comprehensive overview.
In Search of CurveSwap - Measuring Elliptic Curve Implementations in the Wild
Comprehensive survey of elliptic curve implementations in TLS, SSH, and IPsec protocols, analyzing support and behaviors across internet-wide scans and passive measurements.
Deep Impact - Recognizing Unknown Malicious Activities from Zero Knowledge
Innovative approach to detect unknown malicious activities using machine learning and image processing techniques on standard device logs, overcoming limitations of traditional security methods.
When Machines Can't Talk
Security analysis of MQTT & CoAP protocols, revealing design flaws, vulnerable implementations, and widespread unsecured deployments in machine-to-machine communication.
Thermanator and the Thermal Residue Attack
Explore thermal side-channel attacks on keyboards, revealing password vulnerabilities through heat residue analysis. Learn about Thermanator's capabilities in compromising password security.
SDL at Scale - Growing Security Champions
Explore strategies for building a successful Security Champion program, including role value, team commitment, champion selection, and expected benefits for all stakeholders.