Hack The Bridge
Explore blockchain bridge designs, security vulnerabilities, and real-world exploits. Learn about smart contract risks, best practices, and the impact of hacks on cross-chain value transfer systems.
Do We Get Stuff Done? We Don't Get Stuff Done? Or Do We? Or Will We?
Exploring web security's 20-year stagnation, this talk examines past mistakes and proposes future solutions, aiming to renovate mindsets and break the cycle of recurring vulnerabilities.
Breaking Formation - From an Error Message to Internal AWS Infrastructure
Explore a critical AWS CloudFormation vulnerability, its impact on cloud security, and the disclosure process. Gain insights into cloud infrastructure vulnerabilities and future research directions.
Analysis - The Dangerous Role of Deep Links
Explore the security risks of deep links in Android apps, focusing on vulnerabilities in Samsung's camera app that allow unauthorized access to sensitive features without permissions.
Reversing and De-Obfuscating Malware with Software Emulation
Hands-on lab exploring real malware samples, demonstrating how software emulation aids in quick analysis of simple and complex malware, including techniques for interacting with and understanding obfuscated code.
Attack Surfaces for 5G Networks
Practical insights into 5G network security, comparing with previous generations. Explores vulnerabilities, implementation differences, and experimental findings. Discusses expectations for the second phase of 5G networks.
Badkeys - Finding Weak Cryptographic Keys At Scale
Discover how to detect weak cryptographic keys at scale using the badkeys tool and service. Learn about past vulnerabilities and new findings in TLS certificates and IoT devices.
CXO Panel Web3 - The Great Debate
Expert panel discussion on Web3's future, featuring insights from leaders at Trail of Bits, Brave Software, and Ledger. Explores potential impacts, challenges, and opportunities in the evolving blockchain and cryptocurrency landscape.
GPG Memory Forensics
Techniques for retrieving passphrases and encryption keys from memory dumps of GPG processes, including Volatility3 plugins for key material extraction and potential defensive applications against ransomware.
How to Bypass AM-PPL & Disable EDRs - A Red Teamer's Story
Explore techniques to bypass Microsoft's AM-PPL technology and disable EDR products, presented by experienced red team leaders. Learn about vulnerabilities in Windows security measures and their potential exploitation.
A Broken Commercial Metaverse-Based Virtual Office Platform
Exposé des vulnérabilités critiques dans les plateformes de bureau virtuel du m étavers, avec démonstrations d'attaques et recommandations de sécurité pour les développeurs et utilisateurs.
Diversity in Bug Hunting
Panel discussion featuring women leaders in tech exploring strategies to increase diversity in bug hunting and cybersecurity, sharing insights and experiences from their roles at major tech companies.
Bug Bounty - Great! Now What?
Panel discussion on bug bounty programs: processes, rewards, transparency, and improving relationships between organizations and security researchers.
Finding and Exploiting Bugs in TLS Libraries Used by Smart UPS Devices
Explore zero-click vulnerabilities in smart UPS devices, uncovering potential remote takeover risks and physical threats. Includes demonstration of exploits and discussion on cybersecurity implications.
Careful Who You Trust - Compromising P2P Cameras At Scale
Explore vulnerabilities in P2P protocols used by smart cameras, including Kalay Platform analysis, device-specific exploits, and remote code execution demonstrations. Learn about IoT security risks and mitigation strategies.
Digital Identity in the Age of Fintech
CXO panel explores digital identity protection in fintech, discussing latest security technologies and strategies to safeguard user data in the evolving financial technology landscape.
Fuzzware - Automating & Scaling Fuzzing For Firmware
Automated firmware testing using Fuzzware: emulate and fuzz embedded systems without hardware. Discover vulnerabilities in network stacks and scale security analysis for diverse devices.
GNU Anastasis - Privacy-Preserving Key Backup And Recovery
Explore GNU Anastasis, a privacy-focused key backup and recovery system. Learn about its cryptographic design, system architecture, and integration possibilities for enhanced digital security and self-custody solutions.
High-Assurance Code Reviews - How Consulting Works When the Risks Are High
Insights into high-stakes code reviews for critical software. Learn techniques for rapid, effective security assessments of cryptographic libraries, cloud-native software, and smart contracts from Trail of Bits' CEO.
Ransomware Considered Hazardous To Your Health
Explore evolving ransomware threats and tactics, analyzing data from thousands of incidents to provide deep insights and contrarian perspectives on this critical cybersecurity issue.
Cloud Security Posture Management & Threat Protection
Learn cloud security best practices, resource hardening, security posture tracking, and threat protection from industry experts. Gain insights on securing cloud resources and improving visibility.