No Such Thing as a Stupid Question - Why Knowledge Shaming is Making Us Less Secure
Explores how knowledge shaming hinders cybersecurity progress, offering guidelines for effective knowledge sharing and consumption to foster a more secure and collaborative industry environment.
Who Did It - How We Attributed Campaigns of a Cyber Mercenary
Uncover the tactics of a cyber mercenary operating in underground forums, exploring their global campaigns, targeting methods, and strategic operations from 2016-2021.
Practical Attacks Against Attribute-based Encryption
Explore practical attacks on attribute-based encryption, examining vulnerabilities in multi-authority schemes and their implications for cloud security and IoT applications.
Hardware Security Module - Executing Unsigned Code in HSM TEE
Explore a novel attack on HSM digital signature verification, enabling execution of unsigned code in protected environments. Insights applicable to similar systems.
A Survivor-Centric, Trauma-Informed Approach to Stalkerware
Comprehensive overview of stalkerware, its impact, and survivor-centric approaches to support victims, emphasizing trauma-informed practices and ethical considerations.
Action Bias and the Two Most Dangerous Words in Cybersecurity
Explore action bias in cybersecurity, examining when immediate responses are beneficial or counterproductive, and learn strategies for effective decision-making during crises.
Another Road Leads to the Host - From a Message to VM Escape on Nvidia vGPU
Explore vulnerabilities in NVIDIA vGPU, focusing on security risks in cloud infrastructures. Learn about potential VM escape techniques and their implications for AI, deep learning, and cloud gaming.
Fixing a Memory Forensics Blind Spot - Linux Kernel Tracing
Explore Linux kernel tracing infrastructure and its impact on memory forensics. Learn about blind spots in defensive research and strategies to enhance detection of sophisticated attackers.
Mobius Band - Explore Hyper-V Attack Interface through Vulnerabilities Internals
Explore Hyper-V vulnerabilities and attack interfaces, focusing on 3 RCE vulnerabilities in Microsoft's virtualization solution. Gain insights into cloud security and potential risks.
Government-Mandated Front Doors - A Global Assessment of Legalized Government Access to Data
Explore global trends in government-mandated data access, examining policies, tactics, and implications for privacy and intellectual property across various countries and regions.
MFA-ing the Un-MFA-ble - Protecting Auth Systems' Core Secrets
Explore advanced techniques for securing authentication systems against credential compromise, focusing on protecting core secrets and implementing multi-factor authentication for critical components.
CnCHunter - An MITM-Approach to Identify Live CnC Servers
Systematic tool for efficiently discovering live CnC servers using MITM approach, overcoming challenges of changing locations, proprietary protocols, and encryption in botnet communication.
Disinformation at Scale - Using GPT-3 Maliciously for Information Operations
Explores the potential misuse of GPT-3 for large-scale disinformation campaigns, examining its capabilities to generate convincing fake news and the implications for society and information integrity.
Crashing Your Way to Medium-IL - Exploiting the PDB Parser for Privilege Escalation
Discover vulnerabilities in Windows PDB parser, learn exploitation techniques for privilege escalation, and explore the intricacies of memory corruption in DbgHelp.dll.
Greybox Program Synthesis - A New Approach to Attack Dataflow Obfuscation
Explore cutting-edge program synthesis techniques for deobfuscation, focusing on intellectual property protection in mobile and embedded systems. Learn about latest advances and practical applications.
Next-Gen DFIR - Mass Exploits & Supplier Compromise
Explore real-world cases of large-scale cyber incidents, focusing on service and software provider compromises. Learn to adapt DFIR processes for global threats and improve incident visibility.
Breaking Network Segregation Using Esoteric Command & Control Channels
Explore novel techniques for lateral movement in segregated networks using unconventional command and control channels, enhancing penetration testing and attack simulation capabilities.
HPE iLO5 Firmware Security - Go Home Cryptoprocessor, You're Drunk!
Explore vulnerabilities in HPE Gen10 servers' iLO5 management technology, focusing on the "silicon root of trust" and its implications for server security.
PCIe Device Attacks - Beyond DMA - Exploiting PCIe Switches, Messages and Errors
Explore advanced PCIe security threats targeting switches and Translation Layer Packets. Learn about novel attack vectors beyond traditional DMA exploits in high-bandwidth peripheral connections.
Over the Air Baseband Exploit - Gaining Remote Code Execution on 5G Smartphones
Explore 5G network security, baseband vulnerabilities, and remote code execution on smartphones through hands-on research, methodology, and live demonstrations.
The Problems and Promise of WebAssembly
Explore WebAssembly's features, vulnerabilities, and future security concerns in this comprehensive overview, with practical examples and insights.