Malicious Contracts
Explore the potential of smart contracts as anonymous rootkit C2 infrastructure, demonstrating their immutability, anonymity, and scalability for controlling infected devices remotely.
Electro-optical Sound Eavesdropping
Explore electro-optical sound eavesdropping techniques, including Lamphone and Glowworm attacks, to recover speech from physical and virtual conversations using light analysis.
Trapfuzzer - Coverage-Guided Binary Fuzzing with Breakpoints
Coverage-guided binary fuzzing tool for vulnerability discovery, featuring test management, mutation tracking, and visualization. Supports multiple architectures and debuggers, with successful application in finding software vulnerabilities.
Framework to Examine Mobile App Privacy
Framework for examining mobile app privacy, focusing on user control over data, consent, and compliance with global regulations. Includes automatic tools and findings from top apps, highlighting pervasive privacy issues.
Fuzzing RDP Client and Server
Exploring innovative techniques to fuzz RDP protocol using WinAFL, uncovering vulnerabilities in both client and server implementations for enhanced remote connection security.
Securing Webviews and The Story Behind CVE-2021-21136
Exploración detallada de problemas de seguridad en WebViews de aplicaciones móviles, incluyendo validación de URL, aislamiento y filtración de datos. Incluye el descubrimiento de CVE-2021-21136 en Chromium.
Malware Protocol Simulations in Distributed Networks
Explore advanced malware protocol simulations for distributed networks, enhancing threat detection and defense strategies through realistic Command & Control traffic replication without using actual malware.
Container Escape in 2021
Explore new methods for escaping privileged runc containers, focusing on cloud security vulnerabilities and innovative exploit techniques in container environments.
Protective DNS - Why It Matters and Deploying It With No Cloud
Explore on-premise protective DNS using RPZ for network security without cloud reliance. Learn motives, methods, and implementation from internet pioneer Dr. Paul Vixie.
Going Deeper Into Schneider Modicon PAC Security
Exploración profunda de vulnerabilidades en controladores Modicon PAC de Schneider, analizando protocolos de comunicación privados y mecanismos de protección por contraseña. Incluye demostraciones de ataques y recomendaciones defensivas.
IDA2Obj - Static Binary Instrumentation on Steroids
Explore static binary instrumentation with IDA2Obj, a tool for dumping object files from executables. Learn implementation, challenges, and integration with fuzzing engines for efficient code coverage collection.
Scaling Up Offensive Pipelines
Innovative approach to offensive CI/CD pipelines for red and purple team operations, automating weaponization and evasion techniques using Infrastructure as Code and Kubernetes.
Practical AI Red Teaming - A Facial Recognition Case Study
Practical insights into AI red teaming for facial recognition systems, exploring vulnerabilities, attack methods, and defense strategies in real-world environments.
Taking Ghidra to the Next Level
Enhancing Ghidra: BinCraft's modernization efforts, improved decompilation, and integration of advanced techniques like GraalVM for a more powerful reverse engineering tool.
What Modern RF Combat Looks Like in the Next Decade
Exploring the future of RF combat: IoT in defense, cyber-EW convergence, jamming, counter-drone solutions, and RF-focused case studies for next-gen battlefield technology and strategy.
Is Attestation All We Need? Fooling Apple's AppAttest API
Exploración detallada de la API AppAttest de Apple, sus vulnerabilidades y limitaciones como solución anti-manipulación, con ejemplos de implementaciones débiles y escenarios de bypass.
Browser Hacking With ANGLE
Explore browser hacking using ANGLE, covering WebGL basics, vulnerability analysis, and RCE exploitation in macOS. Learn about ANGLE architecture and specific CVEs in Chrome and Safari.
Can A Fuzzer Match A Human
Exploring advanced fuzzing techniques for Solidity compiler testing, focusing on optimizers and code generators to uncover security vulnerabilities in smart contract compilation.
Biometrics System Hacking in the Age of the Smart Vehicle
Explore biometric system vulnerabilities in smart vehicles, including facial recognition and voice-print identification. Learn practical attack methods to bypass security measures and understand potential risks.
ICEFALL - Revisiting A Decade Of OT Insecure-By-Design Practices
Revisiting insecure-by-design practices in OT devices, highlighting persistent security issues across industries and critical infrastructure, with technical deep-dives and implications for risk management.
Fuzzing the MCU of Connected Vehicles for Security and Safety
Fuzzing techniques for MCU security in connected vehicles, using ARM ETM and code coverage-guided approach to enhance vulnerability detection and system robustness.