AutoSpill - Zero Effort Credential Stealing from Mobile Password Managers
Unveiling a novel attack on Android password managers, exploiting autofill vulnerabilities to steal credentials without user interaction. Discusses impact, root causes, and proposes countermeasures.
REDIScovering HeadCrab - A Technical Analysis of a Novel Malware and the Mind Behind It
Uncover the secrets of HeadCrab, an advanced malware utilizing Redis Modules. Explore its sophisticated techniques, worldwide infiltration, and the mind of its creator in this technical analysis.
Orchestrate This! Kubernetes Rootkit
Explore container-focused rootkits in Kubernetes, their anatomy, potential consequences, and strategies for mitigating risks and securing clusters against such attacks.
Vault 활용 및 통합사례 - HashiCorp Strategy Day Korea 2024
Vault의 활용 사례와 다양한 솔루션과의 통합을 통한 접근제어 고도화 방법을 소개하는 23분 길이의 영상. 실제 사례를 통해 Vault의 실용적인 적용 방법을 학습할 수 있습니다.
Nation-State Moneymule's Hunting Season - APT Attacks Targeting Financial Institutions
Unveiling recent APT campaigns targeting financial institutions, including banks, ATM companies, and Bitcoin exchanges, with insights on malware, vulnerabilities, and attack vectors.
Server Tailgating - A Chosen-Plaintext Attack on RDP
Uncover a chosen-plaintext attack on Windows authentication, exploiting a vulnerability in common protocols. Learn about the attack's mechanics, implications for network security, and mitigation strategies.
Hacking Hardware with a $10 SD Card Reader
Explore firmware extraction techniques using affordable SD card readers, bypassing expensive tools and complex setups for efficient hardware hacking and analysis.
ShieldFS - The Last Word in Ransomware Resilient File Systems
Innovative file system solution to combat ransomware attacks, offering preventive and reactive security measures beyond traditional detection approaches for enhanced data protection.
Web Cache Deception Attack
Explore the Web Cache Deception attack, a new vector exposing sensitive user data through server and caching manipulation. Learn about risks, conditions, and mitigation strategies.
Practical Tips for Defending Web Applications in the Age of DevOps
Practical tips for adapting application security to modern DevOps practices, covering static analysis, dynamic scanning, and security visibility for rapid development cycles.
3G - 4G Intranet Scanning and Its Application on the WormHole Vulnerability
Explore large-scale 3G/4G intranet scanning techniques and their application in detecting the WormHole vulnerability across millions of mobile devices in China's major ISPs.
The Irrelevance of K-Bytes Detection - Building a Robust Pipeline for Malicious Documents
Learn best practices for building a robust document analysis pipeline to detect malicious content, covering file type detection, sandboxing, content inspection, and evasion techniques used by attackers.
The Industrial Revolution of Lateral Movement
Explore advancements in targeted attacks and lateral movement techniques, examining their impact on cybersecurity and potential parallels to the Industrial Revolution.
Escalating Insider Threats Using VMware's API
Discover how VMware's API can be exploited to escalate insider threats, bypassing security measures that separate infrastructure and guest machine domains in enterprise environments.
Challenges of Cooperation Across Cyberspace
Exploring challenges in cyberspace governance, including insufficient awareness among communities, international security dialogues, and the struggle to address war and peace issues in the digital realm.
Game of Chromes - Owning the Web with Zombie Chrome Extensions
Explore how malicious Chrome extensions can create botnets, distribute themselves, and exploit vulnerabilities. Learn about attack patterns, extension capabilities, and security measures.
By-Design Backdooring of Encryption System - Can We Trust Foreign Encryption Algorithms
Explores mathematical backdoors in encryption algorithms, discussing design, detection, and implications for cryptographic trust and control. Examines historical cases and future challenges in algorithm security.
Skype and Type - Keystroke Leakage over VoIP
Revealing how VoIP software can leak keystroke information through audio, compromising user privacy. Presents S&T tool to demonstrate vulnerability in popular platforms like Skype and Google Hangouts.
Intel SGX Remote Attestation is Not Sufficient
Explore the limitations of Intel SGX Remote Attestation for ensuring confidentiality and integrity of unmodified cloud applications.
RBN Reloaded - Amplifying Signals from the Underground
Explore how combining SIGINT and HUMINT enhances threat intelligence, providing deeper insights into adversary tactics, intent, and vulnerabilities for improved cybersecurity decision-making.
Free-Fall - Hacking Tesla from Wireless to CAN Bus
Detailed exploration of Tesla's security vulnerabilities, from wireless attacks to CAN bus access, including Tesla's response and new mitigation strategies.