Rich Authorization in Resource-Constrained Devices - TPM 2.0 Design and Use Cases
Explore TPM 2.0's advanced authorization capabilities in resource-constrained devices. Learn policy design, calculation, and satisfaction, with practical use cases and a complex example.
Matching CVEs and Source Code for Vulnerability Detection
Explore techniques for mapping CVEs to source code, including parsing CVE data and quantifying correspondence statistics. Learn about open-source tools and potential AI applications for vulnerability detection.
USB Arsenal for Masses - Open Source Tools for USB Traffic Analysis
Explore open-source tools for USB traffic monitoring, modification, and security testing. Learn about usbmon, OpenVizsla, USBProxy, GoodFET, and more for cost-effective USB analysis and research.
Building a Secure IoT Device
Explore challenges and solutions for building secure IoT devices, covering provisioning, trust, integrity, connectivity, attestation, and firmware updates in the context of PSA and Trusted Firmware M.
Knockout Win Against TCC - New Ways to Bypass Your MacOS Privacy Mechanisms
Explore techniques to bypass MacOS privacy mechanisms, including vulnerabilities in TCC framework, code injections, and system tool abuse. Compare security improvements between Monterey and Big Sur.
Grand Theft Drone - Reaching Breaking Point in Drone Proprietary RF Link Security
Explore vulnerabilities in drone remote control systems, focusing on proprietary protocols and their security implications. Learn about potential risks and the importance of open design principles in drone technology.
LCDPwn - Breaking Enterprise-Things with Layer 2 Discovery Protocol Vulnerabilities Again
Explore Layer 2 Discovery Protocol vulnerabilities in enterprise devices, uncovering neglected attack surfaces and analyzing recent research to improve network security.
Exploring a New Class of Kernel Exploit Primitive
Uncover innovative kernel exploit techniques using limited primitives, focusing on turning seemingly benign bugs into powerful attack vectors for code execution and privilege escalation.
Design Flaws and Deployment Chaos in Cloud-Based IoT Access Control Policies
Uncovers security vulnerabilities in IoT access control policies on cloud platforms, revealing design flaws and deployment issues that pose risks for manufacturers and users.
Writing Your Own Ticket to the Cloud Like APT - A Deep Dive to AD FS Attacks, Detections, and Mitigations
Explore AD FS attacks, detections, and mitigations for Azure AD security. Learn about identity federation vulnerabilities and strategies to protect cloud-based resources from unauthorized access.
Microsoft Defender for Office 365 Evasion - The Story of Confirmed Vulnerability
Unveiling vulnerabilities in Microsoft Defender for Office 365's Safe Attachments and Safe Links features, exposing potential evasion techniques and security implications for organizations.
Practically-Exploitable Cryptographic Vulnerabilities in Matrix
Uncover critical cryptographic vulnerabilities in Matrix's federated communication standard, compromising confidentiality and authentication claims against malicious servers.
Abusing CNC Technologies
Explore vulnerabilities in modern CNC machines, including network security risks, code leaks, and potential for sabotage. Learn about countermeasures to protect critical industrial assets.
Blind VCC Glitching Technique to Bypass the Secure Boot of Qualcomm MSM8916 Mobile SoC
Explore a blind VCC glitching technique to bypass secure boot mechanisms on mobile SoCs, demonstrated on Qualcomm MSM8916/APQ8016. Learn practical application and see a live demo of this effective method.
The Aftermath of a Social Engineering Pentest - Are We Being Ethically Responsible?
Explore ethical challenges and solutions in handling social engineering pentest aftermath, focusing on responsibility, consequences, and improving security culture.
Searching for RPC Functions to Coerce Authentications in Microsoft Protocols
Automated discovery of RPC functions in Microsoft protocols to find authentication coercion vulnerabilities, with focus on parsing documentation and generating proof-of-concept code.
Strengthening Cyber Resiliency in a Time of Geopolitical Crises - Applying Threat Intelligence and Active Defense to Protecting Critical Information Infrastructures
Explore strategies for enhancing cyber resilience during geopolitical crises, focusing on threat intelligence and active defense to protect critical information infrastructures.
Unwinding the Stack for Fun and Profit
Explore stack-based buffer overflow exploitation techniques, bypassing modern mitigations by leveraging exception handling mechanisms to resurrect old exploits and achieve successful attacks.
Cybersecurity - The Next Generation
Exploring cybersecurity's evolution, challenges, and future direction. Discusses lessons from the past, current trends, and strategies for shaping the industry's destiny in an increasingly connected world.
IAM The One Who Knocks
Exposing hidden risks in multi-cloud IAM, detailing access flaws, misconfigurations, and inconsistencies that can lead to unintended access and privilege escalation across cloud providers.
I Am Whoever I Say I Am - Infiltrating Identity Providers Using a 0-Click Exploit
Explore unauthenticated remote code execution in popular IAM solutions, covering past attacks, audit approaches, and vulnerability chaining for infiltrating identity providers.