The Little Seal Bug - Optical Sound Recovery from Lightweight Reflective Objects
Explore an optical side-channel attack that recovers sound from reflective objects in home offices, revealing potential vulnerabilities in remote work environments.
USMA - Share Kernel Code With Me
Explore Linux kernel attack methods, focusing on gadgets and CFI mitigation. Learn about innovative techniques to overcome limitations and enhance kernel exploitation strategies.
Like Lightning From the Cloud - Finding RCEs in an Embedded TLS Library
Explore techniques for discovering remote code execution vulnerabilities in embedded TLS libraries, with insights on improving security in IoT and embedded systems.
Unix Domain Socket - A Hidden Door Leading to Privilege Escalation in the Android Ecosystem
Explore Unix domain socket vulnerabilities in Android, revealing potential privilege escalation risks and security implications for third-party applications and vendor implementations.
The Firmware Supply-Chain Security Is Broken - Can We Fix It?
Explores firmware supply chain vulnerabilities, outsourcing risks, and security gaps in hardware products. Discusses challenges in fixing known issues and proposes solutions for improved threat modeling and security.
The Hidden RCE Surfaces That Control the Droids
Uncover hidden vulnerabilities in Android OS libraries that process incoming files, potentially leading to remote code execution attacks on various system applications.
To Loot or Not to Loot - That Is Not a Question When State Nexus APT Targets Online Entertainment
Dissecting APT attacks on online entertainment companies, revealing espionage motives beyond financial gain. Analyzes 20+ operations since 2018, exposing tactics and implications for data-rich targets.
AutoSpear - Towards Automatically Bypassing and Inspecting Web Application Firewalls
Explore techniques for automatically bypassing and inspecting web application firewalls, examining vulnerabilities in WAF-as-a-service solutions and cloud security services.
Remote Memory-Deduplication Attacks
Explore remote memory-deduplication attacks in cloud systems, their implications for security, and potential countermeasures. Learn about ASLR breaks, Rowhammer attacks, and application fingerprinting.
Hunting and Exploiting Recursive MMIO Flaws in QEMU KVM
Explore security vulnerabilities in QEMU/KVM hypervisors caused by recursive MMIO handling, uncovering a new attack surface with potential for critical exploits in cloud computing environments.
Start Arbitrary Activity App Components as the System User Vulnerability Affecting Samsung Android
Vulnerability in Samsung Android allows zero-permission apps to execute arbitrary activities as system user, compromising device security across multiple Android versions.
Do You Speak My Language? Make Static Analysis Engines Understand Each Other
Explore a novel framework for cross-language taint-flow analysis, enabling detection of critical security vulnerabilities across multiple codebases and programming languages.
Measure Security Effectively
Learn strategies to quantify cybersecurity effectiveness, determine ROI, and communicate results from the security trenches to the boardroom, addressing a key industry challenge.
Conclusions and Key Takeaways from Black Hat Asia 2022
Insightful discussion on pressing InfoSec issues, trends, and future strategies by Black Hat Asia Review Board members, covering topics like stress testing, sanctions, governance, and emerging technologies.
Hacking Democracy - Will Our Societies Hold?
Explore the impact of digital technologies on democratic societies and the challenges they pose to governance, social cohesion, and political stability in this thought-provoking keynote.
SideWinder Uncoils to Strike
Explore the aggressive SideWinder threat actor's tactics, infection chain, and infrastructure. Learn about their evolving techniques and effective mitigation strategies.
10 Things I Wish I Knew Before My First Incident
Essential insights for effective incident response, covering crucial aspects often overlooked by beginners. Learn from real-world experiences to enhance your preparedness and decision-making during critical cybersecurity events.
Jumping the Air Gap - 15 Years of Nation-State Efforts
Explore nation-state techniques for breaching air-gapped networks, analyzing similarities across frameworks and providing practical advice to enhance security and detect potential attacks.
An Offensive Approach to Analyzing Huge and Complex Big Data Infrastructures
Explore attack vectors in Big Data stack layers: ingestion, storage, processing, and access. Learn methodologies to identify vulnerabilities in complex infrastructures handling massive data volumes.
Rope - Bypassing Behavioral Detection of Malware with Distributed ROP-Driven Execution
Explore a novel covert distributed execution technique for malware that challenges behavioral detection by AV and EDR solutions, using ROP-driven execution across multiple processes.
Uncovering Planned Obsolescence Practices in Robotics and What This Means for Cybersecurity
Explore systematic "robot teardown" to understand and repair robots, uncovering planned obsolescence practices and their implications for cybersecurity in robotics.