Certifi-gate - Front-Door Access To Pwning Millions Of Androids
Explore Android vulnerabilities affecting millions of devices, including Lollipop. Learn about exploits, technical root causes, and remediation strategies for these critical security flaws.
Attacking ECMAScript Engines With Redefinition
Explore vulnerabilities in ECMAScript engines through function redefinition, examining implementation differences and strategies for identifying security issues in various targets.
Abusing Silent Mitigations - Understanding Weaknesses Within Internet Explorer
Explore Internet Explorer's silent exploit mitigations, their weaknesses, and potential attack vectors. Learn techniques to bypass these security measures and gain insights into hardening browser defenses.
Why Security Data Science Matters and How It's Different
Explore security data science challenges and solutions, including machine learning for attack detection, threat intelligence, and malware analysis, with focus on overcoming unique security-specific obstacles.
Exploiting Out-of-Order Execution for Covert Cross-VM Communication
Explore a novel side channel attack exploiting CPU out-of-order execution for covert cross-VM communication in cloud environments, with live demos and mitigation techniques.
Deep Learning on Disassembly
Explore deep learning techniques applied to disassembly for malware identification, covering the process from raw binaries to model training and evaluation against active malware feeds.
Broadcasting Your Attack - Security Testing DAB Radio in Cars
Explore vulnerabilities in DAB radio systems in cars, potential security risks, and implications for automotive cybersecurity using Software Defined Radio and custom testing tools.
ZigBee Exploited - The Good, The Bad, And The Ugly
Explore ZigBee's security vulnerabilities in IoT devices, focusing on smart home applications. Learn about weaknesses, practical exploits, and a new security-testing framework for this widespread communication standard.
How to Implement IT Security After a Cyber Meltdown
Implementing IT security post-cyber attack: strategies, challenges, and lessons learned from Saudi Aramco's 2012 incident and subsequent security unit establishment at Aramco Overseas Company.
Bringing A Cannon To A Knife Fight
Explore China's Great Cannon: its inception, functionality as a Man-in-the-Middle proxy, weaponization of users, political motivations, and future implications. Learn protective measures against this powerful censorship tool.
ROPInjector - Using Return Oriented Programming for Polymorphism and Antivirus Evasion
Explore advanced polymorphism techniques using Return Oriented Programming for antivirus evasion, with practical demonstrations of the ROPInjector tool and its effectiveness against detection methods.
Back Doors and Front Doors - Breaking the Unbreakable System
Exploring government demands for backdoor access to encrypted data, examining proposed solutions, and discussing the balance between security and privacy in digital communications.
SMBv2 - Sharing More Than Just Your Files
Unveils a new attack vector against SMBv2, affecting all IE versions. Demonstrates remote credentials theft and user impersonation from the internet, exploiting bugs for complete user compromise without interaction.
How Federal Prosecutors Use The CFAA
Explore the Computer Fraud and Abuse Act through a federal prosecutor's lens. Gain insights into charging decisions, sentencing factors, and balancing security research with law enforcement needs.
Social Engineering the Windows Kernel - Finding and Exploiting Token Handling Vulnerabilities
Explore Windows kernel token handling vulnerabilities, learn to identify and exploit them for privilege escalation, and understand patterns for conducting security reviews.
Pen Testing a City
Comprehensive methodology for reverse engineering and securing cities' IT infrastructure, exploring vulnerabilities and developing strategies for penetration testing and defense at the urban scale.
Fingerprints on Mobile Devices - Abusing and Leaking
Explore vulnerabilities in mobile fingerprint authentication, including authorization attacks, sensor spying, and backdoors. Learn to secure fingerprints and mitigate risks in this eye-opening analysis.
Universal Android Rooting Is Back
Explore universal Android rooting through kernel exploitation, focusing on a Use-After-Free bug affecting all Linux versions. Learn about innovative techniques for 64-bit devices and bypassing modern kernel mitigations.
The Memory Sinkhole - Unleashing An X86 Design Flaw Allowing Universal Privilege Escalation
Unveiling a critical x86 design flaw allowing privilege escalation, exploring forgotten backdoors, and demonstrating how to exploit vulnerabilities in processor architecture.
Commercial Mobile Spyware - Detecting The Undetectable
Uncover techniques to detect and protect against commercial mobile spyware, safeguarding personal privacy and corporate security in an era of increasing digital surveillance.
Attacking Hypervisors Using Firmware and Hardware
Explore vulnerabilities in hypervisors through firmware and hardware emulation, demonstrating attacks and their impacts. Learn about firmware rootkits and new testing modules for hypervisor security.