Come to the Dark Side, We Have Apples - Turning macOS Management Evil
Explore advanced offensive techniques for exploiting macOS management platforms, including MDM and Jamf, to gain unauthorized access and control over enterprise systems.
Hacking a Capsule Hotel - Ghost in the Bedrooms
Explore IoT vulnerabilities in capsule hotels, revealing how six exploits can be combined to control bedrooms and potentially disrupt noisy neighbors.
Deepfake Social Engineering - Creating a Framework for Synthetic Media Social Engineering
Explore the risks of deepfake technology in social engineering, learn about a new framework for understanding these attacks, and discover practical countermeasures to protect against synthetic media threats.
IPvSeeYou - Exploiting Leaked Identifiers in IPv6 for Street-Level Geolocation
Explore a data fusion attack on IPv6 home routers for precise street-level geolocation, uncovering millions of devices worldwide and discussing privacy implications.
FragAttacks - Breaking Wi-Fi through Fragmentation and Aggregation
Explore Wi-Fi vulnerabilities, including design and implementation flaws, and learn how attackers can exploit them for packet injection and data exfiltration in networks.
Generating YARA Rules by Classifying Malicious Byte Sequences
Explore an interpretable ML model for generating optimized malware detection signatures, balancing high detection rates with minimal false positives in ELF executables.
Applying AI as a Service to Targeted Phishing and Defending Against AI Generated Attacks
Explore AI-generated phishing attacks and defense strategies. Learn about AIaaS, its impact on cybersecurity, and techniques to detect and mitigate AI-powered threats.
Zero - The Funniest Number in Cryptography
Explore cryptographic vulnerabilities in BLS signature libraries, focusing on the number zero. Learn about "splitting zero" attacks and their impact on proof-of-possession aggregate signature schemes.
Timeless Timing Attacks
Explore novel timing attacks resilient to network jitter, uncovering vulnerabilities in cryptosystems and applications. Learn about cross-site and Wi-Fi password brute-forcing techniques.
The Devil is in the GAN - Defending Deep Generative Models Against Adversarial Attacks
Exploring vulnerabilities in Deep Generative Models, this talk introduces a threat model for training-time attacks and demonstrates backdooring techniques, while proposing effective detection methods through static and dynamic inspections.
Enter Sandbox
Explore automated seccomp filter generation for Linux applications, enhancing security through sandboxing and system call restrictions without manual developer intervention.
Give Me a SQL Injection, I Shall PWN IIS and SQL Server
Explore SQL injection vulnerabilities in IIS and SQL Server, uncovering unexpected attack vectors and their implications for Microsoft's ecosystem security.
Threat Hunting in Active Directory Environment
Explore advanced threat hunting techniques in Active Directory, focusing on attacker persistence methods, privilege escalation, and covert system control. Learn to detect and mitigate sophisticated APT threats.
Domain Borrowing - Catch My C2 Traffic if You Can
Explore a new method to hide C2 traffic using CDN, circumventing censorship and detection. Learn about domain borrowing, HTTPS certificate abuse, and CDN vulnerabilities for red team operations.
Reverse Engineering Compliance
Explore reverse engineering techniques applied to compliance standards, shifting from checkbox mentality to understanding the spirit of requirements for more effective security practices.
The B-MAD Approach to Threat Modeling
Discover the B-MAD approach to threat modeling, exploring its pitfalls and organizational impacts. Learn effective strategies for implementing threat modeling across your organization and improving overall security.
How I Can Unlock Your Smart Door - Security Pitfalls in Cross-Vendor IoT Access Control
Explores security vulnerabilities in cross-vendor IoT access control, focusing on delegation chains and authorization flaws in smart home devices and cloud platforms.
The Motion Sensor Western - The Good, the Bad, and the Ugly
Explore security and privacy risks of motion sensors in IoT devices, including attacks on integrity, availability, confidentiality, and user privacy. Learn about implications and potential vulnerabilities.
Supply Chain Infections and the Future of Contactless Deliveries
Explore supply chain risks, their consequences, and industry mitigation strategies in light of recent challenges. Gain insights into software integrity and future security measures.
HTTP/2 - The Sequel is Always Worse
Explore HTTP/2 vulnerabilities, implementation flaws, and RFC imperfections. Learn advanced request smuggling techniques and their impact on major platforms like Netflix and Amazon.
Cross-Site Escape - Pwning macOS Safari Sandbox the Unusual Way
Explore a novel attack on macOS Safari sandbox using Cross-Site Scripting, achieving native code execution outside the sandbox without re-exploiting WebKit twice.