When the Cops Come A-Knocking - Handling Technical Assistance Demands from Law Enforcement
Guidance on handling law enforcement demands for technical assistance, covering types of requests, legal authority, and response options for companies protecting user data and privacy.
The Hidden Architecture of Our Time - Why This Internet Worked, How We Could Lose It
Exploring the Internet's success, its underlying principles, and the potential threats to its architecture. Emphasizes the importance of cryptography, open networks, and hacking in shaping a functional global network.
Practical New Developments in The Breach Attack
Explore advanced techniques for exploiting SSL vulnerabilities, including new methods to bypass encryption, optimize attacks, and implement persistent command-and-control strategies. Novel mitigation approaches are also discussed.
The Perl Jam 2 - The Camel Strikes Back
Exploring critical vulnerabilities in Perl's core modules and CGI frameworks, demonstrating fundamental language issues through 0-days, and challenging the "developer's fault" narrative.
Exploiting Linux and Pax ASLR's Weaknesses on 32-Bit and 64-Bit Systems
Uncover vulnerabilities in Linux and PaX ASLR implementations, exploring low entropy, distribution issues, and object correlations. Learn to bypass Full ASLR and discover ASLR-NG, a new design addressing current weaknesses.
Bypassing Browser Security Policies for Fun and Profit
Explore mobile browser vulnerabilities and security policy bypasses, including Same Origin Policy and Content Security Policy. Learn testing methodologies and see real-world examples of Android browser exploits.
Devaluing Attack - Disincentivizing Threats Against The Next Billion Devices
Explore economic strategies to reduce cyberattack incentives by lowering attacker value rather than raising costs. Examine defense approaches for both financial and state-sponsored threats to secure future devices.
Triaging Crashed with Backward Taint Analysis for ARM Architecture
Explore tools for analyzing crashes on Linux and ARM, using dynamic binary instrumentation and backward taint analysis to determine exploitability. Learn about ARM-Tracer and ARM-Analyzer for efficient crash analysis.
Bypassing Local Windows Authentication to Defeat Full Disk Encryption
Exploit bypasses Windows authentication and BitLocker encryption, allowing unauthorized access to sensitive data on encrypted disks without cryptographic brute-forcing or hardware manipulation.
All Your Root Checks Belong to Us - The Sad State of Root Detection
Explores root detection methods in Android security and BYOD apps, revealing vulnerabilities. Presents AndroPoser tool to bypass root checks, highlighting the need for improved mobile security measures.
Vulnerability Exploitation in Docker Container Environments
Explore Docker container vulnerabilities, exploitation techniques, and security risks. Learn about cgroups, namespaces, and mitigation strategies for protecting critical data in containerized environments.
New and Newly - Changed Fully Qualified Domain Names - A View of Worldwide Changes to DNS
Innovative approach to monitoring DNS changes, enabling better detection of security threats, phishing, and malicious behavior. Practical examples and demo included.
Faux Disk Encryption - Realities of Secure Storage on Mobile Devices
Explore mobile device data security challenges, debunk full-disk encryption myths, and learn sophisticated secure storage techniques for iOS and Android to protect against physical access attacks.
VOIP Wars - Destroying Jar Jar Lync
Explore vulnerabilities in Microsoft Lync/Skype for Business, including VoIP attacks, security design flaws, and client-side threats. Learn about attack vectors and practical threats with live demonstrations.
Fuzzing Android - A Recipe for Uncovering Vulnerabilities Inside System Components in Android
Explore a fuzzing approach to uncover vulnerabilities in Android's core system components. Learn about data generation, test execution, logging, and triage mechanisms for effective vulnerability detection.
Exploiting Adobe Flash Player in the Era of Control Flow Guard
Explore techniques for exploiting Adobe Flash Player vulnerabilities, bypassing Control Flow Guard, and executing data-only attacks without shellcode or ROP on Windows systems.
Defending Against Malicious Application Compatibility Shims
Explore advanced techniques for creating and detecting malicious application compatibility shims, including in-memory patching, obfuscation, and system subversion. Learn defensive strategies and tools for protection.
In-Security of Backend-As-A-Service
Explore the vulnerabilities in Backend-as-a-Service solutions for mobile apps, revealing widespread security flaws and potential data breaches in cloud-based storage systems.
Implementing Practical Electrical Glitching Attacks
Explore non-invasive electrical glitching techniques to bypass software protections and create exploitable conditions in target devices, including clock and voltage manipulation methods.
How to Break XML Encryption - Automatically
Explore automated attacks on XML Encryption, including vulnerability detection and exploitation techniques. Learn about recent developments, implementation challenges, and practical security implications.
LTE & IMSI Catcher Myths
Explore LTE security vulnerabilities and IMSI catcher techniques. Learn how popular phones can be exploited on 4G networks, with live demonstrations and in-depth analysis of baseband software weaknesses.