Are We Getting Better Yet? - Progress Toward Safer Operations
Exploring progress in safer operations, this talk delves into effective incident analysis, organizational learning, and strategic investments for improved reliability and team well-being.
Attack on Titan M, Reloaded - Vulnerability Research on a Modern Security Chip
Explore vulnerability research on Google's Titan M security chip, including fuzzing techniques, impact analysis, and mitigation strategies for modern device protection.
Attacks From a New Front Door in 4G & 5G Mobile Networks
Unveils critical API vulnerabilities in 4G/5G networks, exposing risks for AI, MEC, and IoT applications. Explores attack vectors, security misconfigurations, and potential exploits in commercial providers' systems.
AAD Joined Machines - The New Lateral Movement
Explore new lateral movement techniques in Azure AD joined machines, including Pass-The-Certificate attacks and hunting solutions for enhanced network security.
Better Privacy Through Offense - How to Build a Privacy Red Team
Learn to build and operate a privacy red team, exploring its unique challenges and benefits for enhancing organizational privacy defenses through offensive techniques and real-world examples.
Whip the Whisperer - Simulating Side Channel Leakage
Explore pre-silicon power simulations to detect cryptographic side channel leakage in hardware designs, with case studies on identifying and mitigating vulnerabilities in software and hardware implementations.
Bug Bounty Evolution - Not Your Grandson's Bug Bounty
Explore the evolution of bug bounty programs, their impact on cybersecurity, and future directions. Gain insights into challenges, best practices, and alternative solutions for ethical hackers and organizations.
Taking Kernel Hardening to the Next Level
Explore advanced kernel hardening techniques, focusing on CFI and UAF defense. Learn about new approaches to enhance OS security against evolving exploitation methods.
Bypass CFG in Chrome
Explore advanced techniques for bypassing Control Flow Guard (CFG) in Chrome, including analysis of previous methods and examination of current vulnerabilities.
ChaosDB - How We Hacked Databases of Thousands of Azure Customers
Uncover critical Azure Cosmos DB vulnerability allowing unauthorized admin access to thousands of customer databases. Learn about the discovery, exploitation, and implications of this unprecedented cloud security flaw.
TeamTNT - Explosive Cryptomining
Explore TeamTNT's cryptojacking tactics targeting Linux servers, including their attack methods, credential theft, and evolution from Docker instances to Windows systems.
Recertifying Active Directory Certificate Services
Explore AD CS vulnerabilities, attack vectors, and defense strategies for securing Microsoft's PKI implementation. Learn escalation scenarios, auditing techniques, and incident response.
Zen and the Art of Adversarial Machine Learning
Explore security concerns in machine learning integration, including data extraction, model evasion, and biased outcomes. Learn operational guidance and tools for addressing these challenges.
HTTP/2 - The Sequel is Always Worse
Uncover HTTP/2 vulnerabilities and their impact on web security. Learn about implementation flaws, RFC imperfections, and new attack techniques targeting high-profile websites and various server infrastructures.
Windows Defender - Demystifying and Bypassing ASR by Understanding the AV's Signatures
Explore Windows Defender's undocumented signature format, learn ASR rule implementation, and discover techniques for signature evasion in this comprehensive security analysis.
BadMesher - New Attack Surfaces of Wi-Fi Mesh Network
Explore new attack surfaces in Wi-Fi Mesh networks, focusing on EasyMesh vulnerabilities. Learn about network build and control attacks, and discover MeshFuzzer for identifying security flaws.
Finding Vulnerabilities in TensorFlow
Explore vulnerabilities in TensorFlow through advanced fuzzing techniques, focusing on deep issues hidden in complex code logic and semantic contexts beyond traditional API fuzzing methods.
Security Industry Call-to-Action - We Need a Cloud Vulnerability Database
Explore cloud vulnerabilities in AWS, GCP, and Azure, and learn why a cloud-specific vulnerability database is crucial for improved security in the evolving cloud landscape.
The Bad Guys Win - Analysis of Magecart Vulnerabilities
Comprehensive analysis of Magecart vulnerabilities, exploring attack methods, defense mechanisms, and enterprise challenges in securing third-party scripts and preventing digital supply-chain attacks.
Burning Bridges - Stopping Lateral Movement via the RPC Firewall
Explore Windows RPC security, lateral movement prevention, and the RPC Firewall tool to enhance network defense against remote attacks and ransomware spread.
Inside the Ransomware Negotiation Economics
Explore the economics and negotiation strategies of ransomware attacks, focusing on digital extortion tactics, decision-making processes, and effective countermeasures for organizations.