Repurposing OnionDuke - A Single Case Study Around Reusing Nation State Malware
Explore the process of reverse engineering and repurposing OnionDuke, a suspected Russian government malware, for use in other tools. Learn about malware analysis and ethical considerations in cybersecurity research.
TrustKit - Code Injection on iOS 8 for the Greater Good
Explore iOS 8's new code packaging rules and their impact on security. Learn about TrustKit, an open-source library for easy SSL public key pinning implementation in iOS apps without source code modification.
Bring Back the Honeypots
Explore modern honeypot techniques for enhanced network security. Learn about application traps, booby-trapped documents, and cloud-based deception to detect and prevent breaches effectively.
Big Game Hunting - The Peculiarities of Nation-State Malware Research
Explore nation-state malware research, focusing on attribution challenges and novel techniques for linking binaries. Gain insights into the complexities of threat intelligence and state-sponsored cyber espionage.
Stagefright - Scary Code in the Heart of Android
Exploring Android's Stagefright framework vulnerabilities, focusing on discovery techniques, OS internals, and security implications. Demonstrates proof-of-concept code and discusses mitigation strategies.
Dance Like Nobody's Watching - Encrypt Like Everyone Is - A Peek Inside the Black Hat Network
Explore the inner workings of the Black Hat network, one of the most hostile environments created. Learn about its planning, deployment, and maintenance, as well as the unique challenges it faces.
The Lifecycle of a Revolution
Exploring the evolution of the internet, from idealistic beginnings to current challenges, and examining future trends in digital security, privacy, and freedom.
Bringing a Machete to the Amazon
Explore AWS security challenges, vulnerabilities, and solutions. Learn assessment techniques and tools to protect your cloud infrastructure and applications.
Lights Off - The Darkness of the Smart Meters
Explore security vulnerabilities in smart power meters, including remote control capabilities and potential risks. Learn about device reverse engineering and its implications for connected home technology.
Exploring Yosemite - Abusing Mac OS X 10.10
Comprehensive analysis of Mac OS X 10.10 Yosemite's security features, demonstrating vulnerabilities, offensive techniques, and introducing a new security tool for detecting rootkits and abnormalities.
C++11 Metaprogramming Applied to Software Obfuscation
Explore advanced C++11 metaprogramming techniques for software obfuscation, including compile-time code generation, polymorphism, and practical applications like string encryption and call obfuscation.
Two Factor Failure
Explore vulnerabilities in Two-Factor Authentication systems, including a new attack on mobile TOTP. Learn best practices for secure 2FA deployment in enterprise and web applications.
PDF Attack - A Journey from the Exploit Kit to the Shellcode
Explore advanced PDF exploitation techniques, from obfuscated JavaScript analysis to shellcode extraction. Learn to modify and obfuscate malicious PDFs for pentesting and understand cybercriminals' latest tricks.
Evasion of High-End IDPS Devices at the IPv6 Era
Explore IPv6 security vulnerabilities and evasion techniques against high-end IDPS devices, with demonstrations and proposed mitigation strategies for network protection.
Scala Security - Examining the Play and LiftWeb Frameworks
Explore security aspects of Scala's Play and LiftWeb frameworks, including OWASP Top 10 vulnerabilities, exploitation mitigations, and a new Scala library for SSRF prevention.
Attacking the Linux PRNG on Android
Explore vulnerabilities in Android's Linux PRNG, focusing on early boot attacks and real-world exploitation vectors. Learn about potential security risks and mitigations for embedded platforms.
Reflected File Download - A New Web Attack Vector
Explore a new web attack vector that allows attackers to download malicious files from trusted domains without uploading them, potentially bypassing security measures and spreading across social networks.
Ret2dir - Deconstructing Kernel Isolation
Explore kernel exploitation technique ret2dir, bypassing isolation protections by leveraging direct-mapped memory. Learn about vulnerabilities, attack models, and mitigation strategies for Linux kernels.
Gyrophone - Eavesdropping Using a Gyroscope
Explore how smartphone gyroscopes can be exploited to eavesdrop on nearby speech, bypassing microphone permissions and posing privacy risks. Learn about potential attacks and defenses.
Next Level Cheating and Leveling Up Mitigations
Explore sophisticated attacks on anti-cheat systems in multiplayer gaming, including practical demonstrations and implications for game security and the future of cheat prevention.
Freeze Drying for Capturing Environment-Sensitive Malware Alive
Innovative techniques for capturing and analyzing environment-sensitive malware through "freeze drying" and live process migration, enabling dynamic analysis of sophisticated threats like Citadel and ZeuS/GameOver.