Don't Trust Anything - Real-world Uses For WebAssembly
Explore WebAssembly's real-world applications beyond browsers, focusing on secure execution of untrusted code. Learn about WASI, sandboxing techniques, and case studies from Shopify and Mozilla Firefox.
The Most Dangerous Codec in the World - Finding and Exploiting Vulnerabilities in H.264 Decoders
Uncover hidden security risks in H.264 video decoders using H26Forge framework. Learn to craft video files exposing edge cases and potential vulnerabilities in this complex, privileged ecosystem.
The Yandex Leak - How a Russian Search Giant Uses Consumer Data
Explore the implications of Yandex's leaked source code, revealing insights into data collection practices and behavioral analytics technologies used by the Russian search giant.
Mirage - Cyber Deception Against Autonomous Cyber Attacks
Explore novel cyber deceptions targeting weaknesses in AI-driven attacks and an emulation system for evaluating deceptions and adversaries at scale.
Becoming a Dark Knight - Adversary Emulation Demonstration for ATT&CK Evaluations
Explore adversary emulation for cybersecurity, learning how to study advanced threats, develop scenarios, and execute operations to improve industry defenses through MITRE ATT&CK Evaluations.
Know Thy Enemy - The Taxonomies That Meta Uses to Map the Offensive Privacy Space
Explore Meta's privacy-inclusive taxonomies for tracking weaknesses, adversarial tactics, and scaling detection efforts. Learn how these frameworks enhance privacy threat understanding and align security teams.
BingBang - Hacking Bing.com with Azure Active Directory
Discover a novel technique for identifying Azure Active Directory misconfigurations, exposing vulnerabilities in cloud-managed environments and their potential impact on major platforms like Bing.com.
Unsafe at Any Speed - CISA's Plan to Foster Tech Ecosystem Security
Explore CISA's strategy for enhancing tech ecosystem security, covering safe-by-design products, memory safety, open-source security, insurance, and addressing the security poverty line.
MTLS - When Certificate Authentication is Done Wrong
Explore novel attacks on mTLS authentication in zero-trust networks, examining vulnerabilities and complexities associated with X509 certificate-based client authentication.
Why Security Initiatives Are Doomed to Fail and What You Can Do About It
Explore strategies to overcome security initiative failures in enterprises. Learn about business architecture, agile security challenges, and effective planning for optimal outcomes in complex organizational environments.
I Watched You Roll the Die - Unparalleled RDP Monitoring Reveal Attackers' Tradecraft
Unparalleled RDP monitoring reveals attackers' tactics through PyRDP, an open-source tool. Analysis of 3-year honeynet data exposes threat actors' methods, providing insights into RDP-based attacks and ransomware outbreaks.
Uncovering Azure's Silent Threats - A Journey into Cloud Vulnerabilities
Explore security vulnerabilities in Azure ML, uncovering potential threats in cloud-based machine learning platforms and discussing implications for AI/ML system adoption.
Interpretable Incident Inspector Based on Large-Scale Language Model and Association Mining
Explainable AI-powered incident inspector combining language models and association mining for robust, interpretable cybersecurity analysis of large-scale events.
Unleashing the Power of Decompilation for x86 Deep Neural Network Executables
Explore BTD, a decompiler for deep neural network executables, enabling reverse engineering of compiled DL models on various hardware platforms to enhance security and transparency.
Enrolling Millions of Developers in 2FA - Here's What Happened
Behind-the-scenes look at GitHub's 2FA initiative: strategic considerations, challenges, and lessons learned from scaling security measures for millions of developers.
When a Zero Day and Access Keys Collide in the Cloud - Responding to the SugarCRM 0-Day Vulnerability
Explore AWS environment attacks using MITRE ATT&CK, learn prevention strategies, and understand the complexities of cloud security through the lens of the SugarCRM 0-day vulnerability.
Does Public Disclosure of Vulnerabilities Affect Hacker Participation in Bug Bounty Programs?
Explore the impact of public vulnerability disclosure on bug bounty programs, examining its effects on hacker participation and organizational security strategies.
Close Encounters of the Advanced Persistent Kind - Leveraging Rootkits for Post-Exploitation
Explore advanced Windows kernel post-exploitation techniques, including 0-day vulnerability exploitation, DKOM for altering OS telemetry, and NDIS modules for disrupting EDR cloud telemetry and establishing covert persistence.
Crypto Heist - The Aftermath of a Government Website Cryptojacking Attack
Uncover a massive cryptojacking attack on government websites, explore its investigation, and learn preventive measures against similar threats in this eye-opening cybersecurity presentation.
NPM and Sigstore - Provenance Comes to the World's Largest OSS Ecosystem
Explore GitHub's efforts to secure the Javascript ecosystem through provenance integration and Sigstore partnership, enhancing npm's security against malware and supply chain attacks.
Making and Breaking NSA's Codebreaker Challenge
Explore NSA's Codebreaker Challenge: a competitive program mimicking real-world cybersecurity problems, featuring code analysis and reverse engineering tasks of increasing difficulty for US students.