Thinking Outside the JIT Compiler - Understanding and Bypassing StructureID Randomization with Generic and Old-School Methods
Explore generic methods to bypass StructureID Randomization, gaining arbitrary Read/Write ability without relying on JIT compiler-related techniques. Learn innovative approaches to inspire better security mitigations.
Fatal Fury on ESP32 - Time to Release Hardware Exploits
Methodical exploration of defeating ESP32 security features using low-cost hardware techniques, including voltage glitching and analog side-channels, with implications for IoT device security.
HTTP Desync Attacks - Request Smuggling Reborn
Explore HTTP request smuggling techniques to bypass security, manipulate web infrastructure, and exploit vulnerabilities. Learn detection, confirmation, and exploitation methods for various attack scenarios.
Far Sides of Java Remote Protocols
Explore critical flaws in Java RMI and CORBA protocols, uncovering vulnerabilities in vendor implementations and learning attack techniques for cross-process communications.
3D Red Pill - A Guest-to-Host Escape on QEMU/KVM Virtio Device
Demonstration of a guest-to-host escape exploit on QEMU/KVM virtio-gpu devices, showcasing vulnerability analysis, exploitation techniques, and potential security solutions.
Windows Kernel Patch Protection - Achilles Heel - PatchGuard
Explore critical flaws in Windows Kernel Patch Protection, learn attack techniques to disable PatchGuard, and discover proposed mitigations for enhanced system security.
Exploiting Android Messengers with WebRTC
Explore WebRTC vulnerabilities in Android messaging apps, their exploitation, and mitigation strategies. Learn about security research techniques and mobile application security.
The Art of Bootloader Unlocking - Exploiting Samsung Sboot
Explore Samsung bootloader security, uncovering hidden protocols and vulnerabilities. Learn about anti-tamper mechanisms, memory corruption, and techniques for unlocking Android devices.
ROP is Still Dangerous - Breaking Modern Defenses
Explores advanced Return Oriented Programming attacks, demonstrating vulnerabilities in modern defense mechanisms and proposing strategies to overcome security measures like kBouncer and ROPecker.
Cisco SMB Products - Critical Vulnerabilities - 0-Day Release
Detailed examination of critical 0-day vulnerabilities in Cisco SMB switches, including web application and API exploits, leading to complete endpoint compromise and data leakage.
Bypass CFG in Chrome
Explore advanced techniques for bypassing Control Flow Guard (CFG) in Chrome, including analysis of previous methods and examination of current vulnerabilities.
Enter Sandbox
Explore automated seccomp filter generation for Linux applications, enhancing security through sandboxing and system call restrictions without manual developer intervention.
Exploring and Exploiting the SQLite
Explore SQLite vulnerabilities, auditing strategies, and fuzzing techniques. Learn about Magellan 2.0, shadow tables, and bypassing defense mechanisms for remote code execution in Chrome and SQLite binaries.
Over the Edge - Pwning the Windows Kernel
Exploración detallada del subsistema gráfico de Windows, vulnerabilidades del kernel y técnicas de escape del sandbox de Edge, con demostraciones de exploits para elevar privilegios desde el proceso de contenido de Edge a SYSTEM.
Hacking Jenkins
Exploring Jenkins vulnerabilities, including dynamic routing misuse and Groovy sandbox escape. Learn to build custom gadgets and exploit Jenkins through unconventional methods.
Uncommon Sense - Detecting Exploits with Novel Hardware Performance Counters and ML Magic
Explore novel hardware performance counters and machine learning techniques to detect advanced exploits like speculative execution, Rowhammer, and ROP, enhancing cybersecurity defenses against evolving threats.
Exploiting Excel Online
Explore Excel Online vulnerabilities, focusing on integer overflow in fnConcatenate formula. Learn about chaining formulas for remote code execution and potential security implications.
A Brief History of Mitigation - The Path to EL1 in iOS 11
Explore the async_wake exploit for iOS 11.1.2, examining each step and the mitigations overcome. Gain insights into iOS security vulnerabilities and exploitation techniques.
Winter is Coming Back - Defeating the Most Advanced Rowhammer Defenses to Gain Root and Kernel Privileges
A novel exploit breaking advanced rowhammer defenses, allowing unprivileged applications to gain root and kernel privileges. Stealthier and more efficient than existing exploits, this talk presents key steps and implications.
Over-the-Air - How We Remotely Compromised the Gateway, BCM, and Autopilot ECUs of Tesla Cars
Detailing Tesla car hacking techniques, including remote compromises of gateway, BCM, and Autopilot ECUs. Explores vulnerabilities, attack chains, and Tesla's security enhancements in response.
Pre-built JOP Chains with the JOP ROCKET - Bypassing DEP without ROP
Explore Jump-oriented Programming (JOP) as an alternative to ROP for code-reuse attacks. Learn about the JOP ROCKET tool for creating pre-built JOP chains to bypass DEP without ROP.