We Are About to Land - How CloudDragon Turns a Nightmare Into Reality
Explore CloudDragon's advanced cyber tactics, including supply chain and cross-platform attacks. Gain insights into APT group operations and their evolving techniques in this cybersecurity analysis.
Pre-built JOP Chains with the JOP ROCKET - Bypassing DEP without ROP
Explore Jump-oriented Programming (JOP) as an alternative to ROP for code-reuse attacks. Learn about the JOP ROCKET tool for creating pre-built JOP chains to bypass DEP without ROP.
Hey, You, Get off My Private Data - Do Apps Respect Your Privacy as They Claim?
Explore multinational data protection regulations and assess app compliance. Learn about privacy policies, GDPR principles, and techniques for evaluating personal data handling in mobile applications.
Vibe Check - Why Students May Shy Away From Cyber in a Surveillance State
Explores impact of surveillance and strict laws on cyber talent in Asia Pacific, discussing challenges for ethical hacking and threat research in a censorship-heavy environment.
A Mirage of Safety - Bug Finding & Exploit Techniques of Top Android Vendor's Privacy Protection Apps
Uncovers vulnerabilities in popular Android privacy protection apps, revealing security flaws and exploit techniques. Offers insights on improving mobile data security and privacy safeguards.
Alarm.DISARM - Remotely Exploiting & Disarming Popular Physical Security System from Public Internet
Explore remote code execution vulnerabilities in physical security systems, learning to exploit and disarm alarms through reverse engineering and network protocol analysis.
New Attack Surface in Safari - Using Just One Web Audio Vulnerability to Rule Safari
Explores a novel attack surface in Safari, focusing on vulnerabilities in system libraries like audio. Demonstrates how a single Web Audio vulnerability can be exploited to compromise Safari's security.
The Tangled Webview - Javascriptinterface Once More
Unveils new Android WebView vulnerabilities related to JavascriptInterface, bypassing all verifications. Presents a novel attack model and discusses security implications for mobile app developers.
A Walk Through Historical Correlations Between Vulnerabilities and Stock Prices
Explore the impact of security vulnerabilities and data breaches on stock prices across industries, analyzing recovery patterns and sector-specific effects through historical data analysis.
Analyzing and Fuzzing for Qualcomm Hexagon Processor
Explore techniques for analyzing and fuzzing Qualcomm Hexagon processors, overcoming challenges in firmware analysis, emulation, and hardware-dependent targets for enhanced security research.
In-Field Emulation and Fuzzing of PLCs to Uncover the Next Zero-Day Threat in Industrial Control Systems
Explore innovative techniques for uncovering vulnerabilities in Industrial Control Systems through in-field emulation and fuzzing of PLCs, focusing on proactive security measures beyond network-level exploits.
Manufacturing Hardware Implants from Idea to Mass Production - A Hacker's Journey
Explore the journey of creating and mass-producing hacking devices, from initial concept to final product. Learn about R&D, quality assurance, and manufacturing challenges in hardware development.
Circumventing the Guardians - How the Security Features in State-of-the-Art TLS Inspection Solutions Can Be Exploited for Covert Data Exfiltration
Unveiling a stealthy data exfiltration method that bypasses TLS inspection security solutions. Learn about SNIcat and how it circumvents perimeter defenses, with insights on mitigation and detection strategies.
BinTyper - Type Confusion Detection for C++ Binaries
Explore a novel approach to detect type confusion vulnerabilities in C++ binaries, enhancing software security against malicious code execution attacks.
Jack-in-the-Cache - A New Code Injection Technique through Modifying X86-to-ARM Translation Cache
Explores a novel code injection technique for Windows 10 on ARM, exploiting vulnerabilities in x86-to-ARM translation cache to compromise system security on ARM-based laptops.
FPs Are Cheap - Show Me the CVEs
Evaluating SAST tools: Learn how to assess their effectiveness in finding real vulnerabilities using synthetic test suites and practical examples of CVEs.
Shield with Hole - New Security Mitigation Helps Us Escape Chrome Sandbox to Exfiltrate User Privacy
Explore how new security measures in Chrome can be exploited to bypass the sandbox and compromise user privacy, revealing potential vulnerabilities in browser protection mechanisms.
Graph Convolutional Network-Based Suspicious Communication Pair Estimation for Industrial Control Systems
Explore graph convolutional networks for detecting suspicious communication pairs in industrial control systems, enhancing security monitoring beyond traditional whitelisting methods.
The Subtle Art of Chaining Headers - IKEv2 Attack Surface Case Study
Explore IKEv2 attack surface through header chaining, uncovering vulnerabilities in IPsec VPNs. Learn techniques for identifying and exploiting weaknesses in Internet Key Exchange implementations.
Fingerprint-Jacking - Practical Fingerprint Authorization Hijacking in Android Apps
Practical exploration of fingerprint authorization vulnerabilities in Android apps, demonstrating attack techniques and suggesting mitigation strategies for developers.
Light Commands - Hacking Voice Assistants with Lasers
Explore how lasers can manipulate voice-activated IoT devices, revealing potential security vulnerabilities in smart home technology and microphone systems.