Hacking in the Far East
Explore security challenges and hacking techniques in Japan, South Korea, and Hong Kong. Gain insights into corporate policies, smart cards, social engineering, and unique cultural aspects affecting cybersecurity in East Asia.
Web Applications Bug Hunting - Fundamentals
Explore web application security fundamentals, attack vectors, and tools for bug hunting. Learn key concepts to kickstart your career in application security.
The Hardware Pivot
Explore physical attack risks in large-scale device networks, focusing on modchips and counterfeit parts. Learn about threat propagation and strategies for securing hardware infrastructure.
Desert Falcons on a Cyberhunt
Explore the tactics of cyber espionage group Desert Falcons, including their infection methods, social media exploitation, and targeted campaigns in the Middle East.
XSS Mitigation - The State of the Art
Comprehensive overview of XSS attacks and modern defense strategies, covering browser-based, server-side, and framework-specific mitigations for web developers and security professionals.
No More XSS - Deploying CSP with Nonces and Strict-Dynamic
Learn to implement Content Security Policy with nonces and strict-dynamic to prevent XSS attacks. Discover practical deployment strategies for Pinterest and Instapaper, and understand potential vulnerabilities.
Hanging on the Telephone - Hacking VoIP
Explore VoIP vulnerabilities and hacking techniques, from historical phone phreaking to modern threats like toll fraud and vishing, with insights on protecting communication systems.
Bye-Bye False Positives - Using AI to Improve Detection
Explore AI-based injection detection using neural networks to reduce false positives in security solutions. Learn about architecture, implementation, and real-world applications.
Phishy Little Liars - Pretexts That Kill
Discover advanced techniques for creating specialized, custom pretexts in penetration testing, using target-specific data to enhance effectiveness and avoid detection.
Prevent Phishing & Impersonation
Explore innovative approaches to prevent phishing and impersonation attacks in digital systems. Learn about trust-based identity models and a prototype address book that enhances security without compromising usability.
Win the 0-Day Racing Game Against Botnet in Public Cloud
Explore techniques for capturing 0-day attack payloads automatically in public cloud environments, with real-world examples and insights on model performance and monitoring strategies.
Uncommon Sense - Detecting Exploits with Novel Hardware Performance Counters and ML Magic
Explore novel hardware performance counters and machine learning techniques to detect advanced exploits like speculative execution, Rowhammer, and ROP, enhancing cybersecurity defenses against evolving threats.
Exploiting Excel Online
Explore Excel Online vulnerabilities, focusing on integer overflow in fnConcatenate formula. Learn about chaining formulas for remote code execution and potential security implications.
Hardware Security Module - Executing Unsigned Code in HSM TEE
Explore a novel attack on HSM digital signature verification, enabling execution of unsigned code in protected environments. Insights applicable to similar systems.
Breaking Network Segregation Using Esoteric Command & Control Channels
Explore novel techniques for lateral movement in segregated networks using unconventional command and control channels, enhancing penetration testing and attack simulation capabilities.
Over the Air Baseband Exploit - Gaining Remote Code Execution on 5G Smartphones
Explore 5G network security, baseband vulnerabilities, and remote code execution on smartphones through hands-on research, methodology, and live demonstrations.
A Brief History of Mitigation - The Path to EL1 in iOS 11
Explore the async_wake exploit for iOS 11.1.2, examining each step and the mitigations overcome. Gain insights into iOS security vulnerabilities and exploitation techniques.
Edge Side Include Injection - Abusing Caching Servers into SSRF and Transparent Session Hijacking
Explore Edge Side Include injection, a web attack vector exploiting caching servers. Learn how this legacy technology can lead to SSRF and session hijacking vulnerabilities in modern web infrastructure.
Winter is Coming Back - Defeating the Most Advanced Rowhammer Defenses to Gain Root and Kernel Privileges
A novel exploit breaking advanced rowhammer defenses, allowing unprivileged applications to gain root and kernel privileges. Stealthier and more efficient than existing exploits, this talk presents key steps and implications.
Over-the-Air - How We Remotely Compromised the Gateway, BCM, and Autopilot ECUs of Tesla Cars
Detailing Tesla car hacking techniques, including remote compromises of gateway, BCM, and Autopilot ECUs. Explores vulnerabilities, attack chains, and Tesla's security enhancements in response.
Outsmarting the Smart City
Explore vulnerabilities in smart city tech, privacy implications, and future trends. Learn to identify city systems and understand attack consequences.