The Hand That Strikes, Also Blocks
Exploring the interplay between cybersecurity attacks and defenses, this talk examines evolving strategies, stakeholder mindsets, and proactive approaches for a more secure digital future.
An Analysis of Computer Numerical Control Machines in Industry 4.0
Explores security risks in modern CNC machines, demonstrating practical attacks and discussing mitigation strategies for Industry 4.0 vulnerabilities in manufacturing environments.
Privilege Escalation Using DOP in MacOS
Explore privilege escalation in MacOS using Data-Oriented Programming (DOP), a powerful exploit technique that leverages heap buffer overflow vulnerabilities for persistent attacks resistant to kernel code changes.
A Deep Dive Into GarminOS And Its MonkeyC Virtual Machine
Explore GarminOS and MonkeyC VM, uncovering critical vulnerabilities in Garmin devices. Learn about reverse engineering, virtual machine internals, and exploiting low-level security flaws in smart fitness technology.
Active Directory Abuse Primitives and Operation Security
Comprehensive exploration of Active Directory attack techniques, demonstrating real-world abuse primitives and attack paths. Includes practical demonstrations and operational guidance for both offensive and defensive perspectives.
Smart Speaker Shenanigans - Making the SONOS One Sing
Exploring ARM Trusted Firmware, secure boot, and encryption vulnerabilities in smart devices. Demonstrates exploits on Lenovo clock and SONOS One, revealing secrets and breaking security boundaries.
Exploiting IPC With New Desynchronization Primitives
Exploración de vulnerabilidades críticas en SAP, demostrando técnicas avanzadas de explotación HTTP y desincronización para comprometer sistemas empresariales. Incluye demostraciones prácticas y análisis de impacto en la seguridad global.
ChatGPT Please Write Me A Piece of Polymorphic Malware
Explore how ChatGPT can be used to create advanced polymorphic malware, discussing the challenges, implementation techniques, and potential threats posed by AI-generated malicious software.
Automated Black-box Security Testing of Smart Embedded Devices
Innovative approach for IoT black-box fuzzing using "fuzzing triggers" from companion apps to generate optimal inputs, overcoming limitations of existing tools and discovering zero-day vulnerabilities.
How MySQL Servers Can Attack YOU
Novel attack vector using compromised MySQL servers to target clients, demonstrating remote code execution vulnerabilities in MySQL tools and libraries, including a zero-day exploit bypassing security patches.
Bypassing Anti-Cheats and Hacking Competitive Games
Explore game cheating techniques, anti-cheat mechanisms, and bypassing methods in competitive gaming. Gain insights into the evolving landscape of game security and hacking strategies.
A Tale of Building a Real Full Speed Anti-Censorship Router
Comprehensive guide to building a high-speed anti-censorship router, covering GFW history, bypass methods, protocols, deployment strategies, and practical implementation for unrestricted internet access.
Advanced DMA Reentrancy Techniques to Escape QEMU
Explore advanced DMA reentrancy techniques for QEMU escape, including DMA Reflection/Refraction and DMA Oriented Programming. Learn about vulnerabilities, exploit processes, and future challenges in virtualization security.
Hunting Windows Desktop Window Manager Bugs
Exploring Windows Desktop Window Manager vulnerabilities, focusing on DirectComposition UserSpace. Covers architecture, attack surfaces, and specific CVEs, offering insights into bug hunting techniques and security implications.
SOHO Hacking at Pwn2Own
Exploring vulnerabilities in home routers and small business devices, detailing methodologies for finding and exploiting security flaws, and demonstrating real-world attack scenarios in SOHO networks.
Next Generation Virtualization-Based Obfuscators
Explores next-gen virtualization-based code obfuscation techniques, focusing on target-specific instruction sets and intertwined VM components to enhance resilience against deobfuscation attacks.
Nakatomi Space - Lateral Movement as L1 Post-Exploitation in OT
Explore lateral movement techniques in OT networks, focusing on vulnerabilities in L1 devices. Learn about BPCS/SIS architectures, exploit chains, and hardening strategies to enhance industrial control system security.
Syscalls in Shellcode - Techniques for Malicious Functionality
Explore advanced techniques for using Windows syscalls in shellcode, overcoming portability issues, and enhancing malicious functionality. Learn about ShellWasp tool and novel WoW64 syscall invocation methods for stealthy code execution.
XRP Raid Protector - Killing A Critical Bug Worth 40 Billion Dollars
Unveiling a critical 8-year-old vulnerability in XRP Ledger that could compromise $40 billion in assets. Explores the RCE exploit, potential profit methods, and network control implications for blockchain security.
Cyber Immunity - Raising Cyber Security Awareness
Ngo Minh Hieu shares insights on cybersecurity awareness, demonstrating hacking techniques and offering protection strategies for individuals and businesses in an informative and engaging TEDx talk.
Level Up Your Career - A Panel on Staff+ Engineering
Expert panel discusses transitioning from Senior to Staff+ engineering in security, offering insights on career advancement and answering audience questions about high-level roles in cybersecurity.