A Practical Guide to Fuzz Testing Embedded Software in a CI Pipeline - Dennis Kengo Oka - Ekoparty 2021: Hardware Hacking Space
Practical guide to implementing automated fuzz testing in CI pipelines for embedded software, using Zephyr RTOS as an example. Learn strategies, execution, and vulnerability detection.
Why I Wrote My Own Rsync - Michael Stapelberg - Media.CCC.De
Explore the creation of a custom rsync implementation in Go, delving into rsync's inner workings, performance improvements, and integration with home networking projects.
Exploring Novelty Ways in Building Botnets - Simon Rich and Daniel Mende - Ekoparty Security Conference - 2008
Innovative approaches to botnet construction using network protocols and technologies, exploring SNMP, DNS, HTTP, and other methods for communication and control.
Security Vulnerabilities in DVB-C Networks - Rahul Sasi - Ekoparty Security Conference - 2014
Explore security vulnerabilities in DVB-C networks, including middleware server attacks, protocol bugs, and MPEG stream fuzzing. Learn to hijack TV streams and manipulate cable broadcasting systems.
WiFi-based IMSI Catcher
Explore WiFi-based IMSI catchers, their potential for easier smartphone tracking, and learn about mitigation strategies for vendors, operators, and users to address privacy concerns.
Securing the Next Version of HTTP - How QUIC and HTTP-3 Compare to HTTP-2
Explore QUIC and HTTP/3 protocols, their security features, and improvements over HTTP/2. Learn about encryption, handshakes, and performance enhancements in next-gen web communication.
Adventures in Attacking Wind Farm Control Networks
Explore vulnerabilities in wind farm control networks and potential attack scenarios, with insights on securing these critical renewable energy infrastructures.
A Linux Kernel Implementation of the Homa Transport Protocol
Explore Homa/Linux: a high-performance transport protocol outperforming TCP and DCTCP in latency and congestion control, with potential for further optimization through software overhead reduction.
AAD Joined Machines - The New Lateral Movement
Explore new lateral movement techniques in Azure AD joined machines, including Pass-The-Certificate attacks and hunting solutions for enhanced network security.
Common Flaws in ICS Network Protocols
Análisis de vulnerabilidades comunes en protocolos de red ICS, incluyendo públicos y privados. Demuestra ataques potenciales como inyección de comandos y sniffing de tráfico sin cifrado en infraestructuras críticas.
A Surprise Encounter With a Telco APT
Exposé of a sophisticated telco hack, revealing methodologies, tools, and protocols used by a suspected state actor. Insights from a live session observation and forensic analysis of a mobile network operator intrusion.
Alarm.DISARM - Remotely Exploiting & Disarming Popular Physical Security System from Public Internet
Explore remote code execution vulnerabilities in physical security systems, learning to exploit and disarm alarms through reverse engineering and network protocol analysis.
Industrial Control Systems - Pentesting PLCs 101
Hands-on workshop exploring penetration testing techniques for industrial control systems, focusing on PLCs. Learn to identify vulnerabilities and attack Siemens and Schneider devices.
HEIST - HTTP Encrypted Information can be Stolen Through TCP-Windows
Unveils HEIST, a browser-based attack exploiting SSL/TLS vulnerabilities without network access. Demonstrates how to leak cross-origin response sizes, enabling compression-based attacks and sensitive information extraction from popular websites.
Anonymity Trilemma - Strong Anonymity, Low Bandwidth Overhead, Low Latency - Choose Two
Explores fundamental constraints in anonymous communication protocols, analyzing trade-offs between anonymity, bandwidth, and latency against global passive adversaries.
Connection-Oriented DNS to Improve Privacy and Security
Enhancing DNS privacy and security through TCP and TLS, addressing eavesdropping, spoofing, and DoS attacks while maintaining performance with careful implementation choices.
HTTP/2 & QUIC - Teaching Good Protocols to Do Bad Things
Explore multiplexing attacks in QUIC and HTTP/2 protocols, their impact on network security, and defense strategies against potential threats in modern web technologies.
Investigating DDOS - Architecture, Actors, and Attribution
Explore DDOS attacks, their evolution, and novel techniques for measuring, studying, and attributing them. Learn about honeypots, attack testing, and the individuals behind these cyber threats.
BadWPAD
Explores WPAD protocol vulnerabilities through experiments, revealing widespread risks in networks and DNS. Presents surprising findings and discusses implications for cybersecurity.
RHINE - Robust and High-performance Internet Naming with E2E Authenticity
Explores RHINE, a secure Internet naming system offering end-to-end authentication, robust trust model, and improved performance over DNSSEC. Addresses DNS vulnerabilities with novel approaches.
Operation Escalation - How Commodity Programs Are Evolving Into Advanced Threats
Explore how common programs transform into sophisticated threats, examining indicators, processes, and impacts across various sectors and geographic regions.