DevSecOps - What, Why and How
Explore the transformation of DevOps into DevSecOps, covering open-source tools and cultural shifts needed for implementation, along with associated benefits and practical insights.
Controlled Chaos - The Inevitable Marriage of DevOps and Security
Explore DevOps basics, resilience, and chaos engineering. Discover factors behind elite organizations and how DevOps aligns with modern infosec goals in today's software-driven landscape.
Reverse Engineering WhatsApp Encryption for Chat Manipulation and More
Decrypting WhatsApp traffic and creating tools for vulnerability research, including a Burp Suite extension for investigating encrypted communications.
Dragonblood - Attacking the Dragonfly Handshake of WPA3
Uncover vulnerabilities in WPA3's Dragonfly handshake, including side-channel attacks and password partitioning techniques. Learn about design flaws and implementation issues affecting Wi-Fi security protocols.
Internet-Scale Analysis of AWS Cognito Security
Reveals findings from large-scale AWS Cognito security analysis, exposing vulnerabilities in identity pools granting access to thousands of S3 buckets, DynamoDB tables, and Lambda functions.
All the 4G Modules Could Be Hacked
Explores vulnerabilities in 4G modules, demonstrating methods to probe and exploit weaknesses in car entertainment systems for remote control of vehicles.
Responding to a Cyber Attack with Missiles
Explore the blurred lines between cyber and physical warfare, examining government responses to cyber attacks and the evolving rules of engagement in modern conflicts.
Lessons From Two Years of Crypto Audits
Explore fascinating security issues and risks in memory-safe languages like Rust, based on insights from two years of cryptocurrency audits.
MITRE ATT&CK - The Play at Home Edition
Learn how various cybersecurity teams can leverage MITRE ATT&CK framework to enhance threat tracking and protection strategies, with practical insights for immediate implementation.
Detecting Malicious Files with YARA Rules as They Traverse the Network
Learn to detect malicious files using YARA rules and Zeek IDS for early-stage attack identification, enhancing network security with improved performance and targeted scanning techniques.
The Most Secure Browser? Pwning Chrome from 2016 to 2019
Explore Chrome browser security vulnerabilities and exploitation techniques from 2016 to 2019, presented by researchers who successfully pwned Nexus 6P in Mobile Pwn2Own 2016.
Bypassing the Maginot Line - Remotely Exploit the Hardware Decoder on Smartphone
Explore vulnerabilities in Qualcomm's Venus hardware decoder, learn its architecture, and discover remote exploitation techniques for smartphone security research.
How to Build Synthetic Persons in Cyberspace
Explore the development of AI agents simulating attackers and defenders in cybersecurity, enhancing training for both defensive and offensive roles in network security.
No Free Charge Theorem 2.0 - How to Steal Private Information from a Mobile Device Using a Powerbank
Exploiting hidden communication channels in smartphone charging to steal private data, despite Android's "Charging only" mode safeguards. Demonstrates vulnerability in public charging stations and powerbanks.
Zombie POODLE, GOLDENDOODLE, and How TLSv1.3 Can Save Us All
Explore advanced CBC padding oracle attacks, including a resurrected POODLE vulnerability and the faster GOLDENDOODLE attack. Learn how TLSv1.3 addresses these security issues.
Writing Trusted Applications in Rust
Explore using Rust for Trusted Applications, leveraging its security features like memory safety and error handling for system-level code development in secure environments.
Secure Boot Under Attack - Simulation to Enhance Fault Attacks & Defenses
Explore fault injection attacks on Secure Boot, their impact on embedded systems, and strategies for enhancing defenses through simulation techniques.
So I Became a Domain Controller
Explore Active Directory replication vulnerabilities, focusing on SAMBA implementation and mimikatz's DCSync feature. Learn techniques for extracting secrets and impersonating domain controllers.
Mainframe Z-OS Reverse Engineering and Exploit Development
Explore mainframe security vulnerabilities, reverse engineering techniques, and exploit development for z/OS systems, challenging common assumptions about mainframe invulnerability.
SirenJack - Cracking a Secure Emergency Warning Siren System
Explore the SirenJack vulnerability affecting emergency warning sirens, its potential impact, and the surprisingly simple methods used to exploit this critical infrastructure weakness.
The Finest Penetration Testing Framework for Software-Defined Networks
Introducing DELTA: A powerful ONF-supported penetration testing tool for Software-Defined Networks. Learn about its capabilities and applications in enhancing SDN security.