Breaking Parser Logic - Take Your Path Normalization Off and Pop 0days Out
Explore path normalization vulnerabilities, their impact on web security, and techniques to exploit them for bypassing access controls and achieving remote code execution.
Snooping on Cellular Gateways and Their Critical Role in ICS
Explore vulnerabilities in cellular devices used for IoT and ICS connectivity, focusing on Sierra Wireless and other manufacturers' products. Learn about the security implications of always-on, available-anywhere connectivity.
Behind the Speculative Curtain - The True Story of Fighting Meltdown and Spectre
Insider account of the urgent response to Meltdown and Spectre vulnerabilities, revealing the challenges and decisions faced by cybersecurity experts during a critical disclosure situation.
Stealth Mango and the Prevalence of Mobile Surveillanceware
Unveiling nation-state mobile surveillance tools Stealth Mango and Tangelo, exploring their capabilities and impact on government and military targets across multiple countries.
Detecting Malicious Cloud Account Behavior - A Look at the New Native Platform Capabilities
Explore new native cloud platform capabilities for detecting suspicious account activity, including attack lifecycle, detection methods, and practical examples from major providers.
Don't @ Me - Hunting Twitter Bots at Scale
Explore the Twitter bot economy and learn a three-step methodology to track down bots: dataset building, attribute identification, and classifier development for accurate large-scale detection.
A Brief History of Mitigation - The Path to EL1 in iOS 11
Explore the async_wake exploit for iOS 11.1.2, examining each step and the mitigations overcome. Gain insights into iOS security vulnerabilities and exploitation techniques.
Attacks on the Curl-P Hash Function Leading to Signature Forgeries in the IOTA Signature Scheme
Análisis de vulnerabilidades en la función hash Curl-P de IOTA, revelando debilidades criptográficas que permiten falsificar firmas digitales en esta criptomoneda de alto perfil para el Internet de las Cosas.
Enhancing Cybersecurity Through Differentiated Access to Domain Name Registration Data
Explore new technology bridging privacy and access gaps in domain name registration data, enhancing cybersecurity through differentiated access and automated systems.
From Bot to Robot - How Abilities and Law Change with Physicality
Explore the evolving landscape of bots and robots, their impact on society, and the legal implications as they transition from digital to physical realms.
The Unbearable Lightness of BMC's
Explore vulnerabilities in data center Baseboard Management Controllers (BMCs), uncovering potential security risks and their implications for critical infrastructure.
Blockchain Autopsies - Analyzing Ethereum Smart Contract Deaths
Explore Ethereum smart contract vulnerabilities, reverse engineering techniques, and new tools for analyzing blockchain attacks through real-world examples and practical demonstrations.
There Will Be Glitches - Extracting and Analyzing Automotive Firmware Efficiently
Explore automotive firmware extraction and analysis techniques, focusing on fault injection and emulation for uncovering vulnerabilities in vehicle security systems.
Compression Oracle Attacks on VPN Networks
Explore compression oracle attacks on VPN networks, including browser requests and ESP compression. Learn detection methods, setup requirements, and potential future threats.
No Royal Road - Notes on Dangerous Game
Explores attribution fatigue in cybersecurity, examining nation-state hacking, stolen toolchains, and the evolution of cyber threats beyond espionage into active operations.
Remotely Attacking System Firmware
Explore remote attack vectors targeting system firmware, including networking and updates. Learn about exploiting UEFI vulnerabilities for installing persistent implants at scale.
Finding Xori - Malware Analysis Triage with Automated Disassembly
Explore automated malware analysis using Xori, an open-source disassembler. Learn to identify suspicious functionality and contribute to this valuable cybersecurity tool.
How I Learned to Stop Worrying and Love the SBOM
Explore the potential of Software Bill of Materials (SBOM) to revolutionize information security, addressing industry resistance and highlighting its benefits for transparency and enterprise value.
Exploring How Memory-Mapped Files Hide From AV and Execute Malicious Code
Explore techniques for using memory-mapped files to conceal malicious payloads and execute code, evading antivirus detection.
Reversing a Japanese Wireless SD Card - From Zero to Code Execution
Discover how to reverse engineer a wireless SD card's firmware using open-source tools, uncovering its architecture and operating system to achieve code execution.
Edge Side Include Injection - Abusing Caching Servers into SSRF and Transparent Session Hijacking
Explore Edge Side Include injection, a web attack vector exploiting caching servers. Learn how this legacy technology can lead to SSRF and session hijacking vulnerabilities in modern web infrastructure.