Engineering Cybersecurity for a Nation - What Singapore is Learning from Cars and Sanitation
Singapore's approach to national cybersecurity, drawing lessons from cars and sanitation to build a Smart Nation and challenge traditional security paradigms.
Conclusions and Key Takeaways from Day 2
Insightful discussion on pressing InfoSec issues by Black Hat Review Board members, highlighting key takeaways and conclusions from the conference's second day.
Adversary Detection Pipelines - Finally Making Your Threat Intel Useful
Learn to maximize your threat intelligence program's value, enhancing security across teams with practical strategies for effective adversary detection and intel utilization.
Discovering Hidden Properties to Attack the Node.js Ecosystem
Novel attack method against Node.js platform using hidden property abusing. Explores vulnerabilities in JavaScript data exchange to tamper with critical program states in server-side applications.
iOS Kernel PAC, One Year Later
Análisis de la evolución y vulnerabilidades de la autenticación de punteros del kernel de iOS, con demostraciones de nuevos métodos para eludir la seguridad en iOS 13.3.
Detecting Fake 4G Base Stations in Real Time
Learn to detect and understand 4G/LTE IMSI-catchers, explore their capabilities, and discover software solutions for identifying fake base stations. Gain insights into cell network security improvements.
Demigod - The Art of Emulating Kernel Rootkits
Explore advanced techniques for emulating and analyzing kernel rootkits, enhancing cybersecurity defenses against high-privilege malware operating at the OS level.
A Decade After Stuxnet's Printer Vulnerability - Printing is Still the Stairway to Heaven
Explore the enduring security risks in Windows Print Spooler service, a decade after Stuxnet's infamous exploit, and learn about current vulnerabilities in printing systems.
When TLS Hacks You
Explore how TLS features can be exploited for attacks, focusing on Server-Side Request Forgery. Learn about a novel, cross-platform method to leverage TLS for targeting internal services.
Heroku Abuse Operations - Hunting Wolves in Sheep's Clothing
Explore techniques for detecting and responding to malicious activity disguised as legitimate use in cloud platforms. Learn to identify and mitigate abuse scenarios that bypass traditional security measures.
FASTCash and INJX_Pure - How Threat Actors Use Public Standards for Financial Fraud
Explore how cybercriminals exploit public standards to conduct ATM fraud through INJX_Pure and Lazarus FASTCash malware, showcasing their programming skills and understanding of financial transactions.
Decade of the RATs – Custom Chinese Linux Rootkits for Everyone
Uncovers a decade-long, state-sponsored cyber espionage campaign targeting Linux servers, revealing custom malware and rootkits used in strategic attacks on government and industry infrastructure.
Whispers Among the Stars - A Practical Look at Perpetrating Satellite Eavesdropping Attacks
Experimental exploration of satellite broadband vulnerabilities using affordable equipment. Demonstrates eavesdropping techniques across land, air, and sea communications with minimal detection risk.
EtherOops - Exploring Practical Methods to Exploit Ethernet Packet-in-Packet Attacks
Explore practical methods to exploit Ethernet packet-in-packet attacks, bypassing firewalls and NAT solutions. Learn how attackers can establish man-in-the-middle positions to eavesdrop on corporate communications.
Beyond Root - Custom Firmware for Embedded Mobile Chipsets
Explore reverse engineering techniques to bypass protections and expand functionality of embedded mobile chipsets, going beyond traditional rooting methods for complete device control.
OAuth vs. SAML vs. OpenID Connect
Explore key identity federation protocols: OAuth, SAML, and OpenID Connect. Compare features, security levels, and use cases to make informed decisions for your application's single sign-on implementation.
Architecting a Security Program for the Future
Interactive workshop on risk-based security management, using role-playing to assess, prioritize, and mitigate risks in a fictional company. Provides practical tools and strategies for modern cybersecurity challenges.
Don't Touch Me That Way
Explore iOS fingerprint API security: correct usage, vulnerabilities, and potential attacks. Hands-on demo with code, tools, and test applications for mobile app developers and security professionals.
It's 10pm, Do You Know Where Your Access Keys Are?
Strengthen AWS infrastructure against attacks: Learn to secure environments, monitor for threats, and recover from incidents using AWS tools like Config, CloudWatch, and IAM.
LangSec for the Masses
Explore AWS security best practices, including hardening, monitoring, and recovery techniques. Learn to protect your infrastructure against common attacks and respond to security breaches effectively.
Leveling Up Your Bug Bounty Program
Explore bug bounty programs: benefits, pitfalls, and implementation strategies. Learn from Indeed.com's experience in leveraging diverse skills to enhance security and uncover critical vulnerabilities.