Building Identity for an Open Perimeter
Explore Netflix's cloud-first security approach, focusing on identity as the new perimeter through SSO, MFA, and adaptive authentication for a location-independent strategy.
Building an Effective Intrusion Detection Program
Learn to build an effective intrusion detection program using affordable tools. Covers cloud apps, endpoints, network security monitoring, and crowdsourced incident response to catch breaches quickly.
Hanging on the Telephone - Hacking VoIP
Explore VoIP vulnerabilities and hacking techniques, from historical phone phreaking to modern threats like toll fraud and vishing, with insights on protecting communication systems.
WHOIS Calling the 80s to Get Their Finger Back
Explore creating a remote access trojan using TCP services like Whois and Finger, discussing implementation, detection, and mitigation strategies for this Live Off the Land technique.
Non-Political Security Learnings from the Mueller Report
Explore forensic evidence from the Mueller Report to understand network compromises, access methods, and defensive strategies for organizations.
Back to the Future - Cross-Protocol Attacks in the Era of 5G
Explore vulnerabilities in mobile network protocols across generations and learn about cross-protocol attacks in 5G networks, presented by security expert Sergey Puzankov.
Kr00k - Serious Vulnerability Affected Encryption of Billion+ Wi-Fi Devices
Explore the Kr00k vulnerability affecting Wi-Fi encryption on billions of devices. Learn about its impact, technical details, and see a live demonstration of exploiting this security flaw in popular Wi-Fi chips.
ChaosDB - How We Hacked Databases of Thousands of Azure Customers
Uncover the critical ChaosDB vulnerability in Azure Cosmos DB, allowing unauthorized access to thousands of customer databases. Learn about the discovery, exploitation, and implications of this unprecedented cloud security flaw.
Breaking Network Segregation Using Esoteric Command & Control Channels
Explore novel techniques for lateral movement in segregated networks using unconventional command and control channels, enhancing penetration testing and attack simulation capabilities.
HPE iLO5 Firmware Security - Go Home Cryptoprocessor, You're Drunk!
Explore vulnerabilities in HPE Gen10 servers' iLO5 management technology, focusing on the "silicon root of trust" and its implications for server security.
The Unbearable Lightness of BMC's
Explore vulnerabilities in data center Baseboard Management Controllers (BMCs), uncovering potential security risks and their implications for critical infrastructure.
Compression Oracle Attacks on VPN Networks
Explore compression oracle attacks on VPN networks, including browser requests and ESP compression. Learn detection methods, setup requirements, and potential future threats.
Finding a Needle in an Encrypted Haystack
Discover new techniques to exploit NTLM authentication, including a critical zero-day vulnerability enabling domain-wide machine takeover, even with strict security configurations.
Arm IDA and Cross Check - Reversing the Boeing 787's Core Network
Uncover vulnerabilities in Boeing 787's Core Network through reverse engineering, revealing security flaws and their implications for aircraft systems and passenger safety.
In Search of CurveSwap - Measuring Elliptic Curve Implementations in the Wild
Comprehensive survey of elliptic curve implementations in TLS, SSH, and IPsec protocols, analyzing support and behaviors across internet-wide scans and passive measurements.
The Mummy 2018 - Microsoft Accidentally Summons Back Ugly Attacks from the Past
Explores how Microsoft inadvertently revived old IP fragmentation vulnerabilities, allowing packet interception, modification, and denial of service attacks. Discusses implications for network security.
Lessons and Lulz - The Annual Black Hat USA NOC Report
Insights into setting up, stabilizing, and securing the Black Hat conference network. Learn about tools, techniques, and improvements made by the NOC team to enhance network operations and security.
Disappeared Coins - Steal Hashrate in Stratum Secretly
Unveils two novel man-in-the-middle attack schemes on Stratum, the main communication protocol for cryptocurrency mining pools, potentially compromising miners' computing power.
Graph Convolutional Network-Based Suspicious Communication Pair Estimation for Industrial Control Systems
Explore graph convolutional networks for detecting suspicious communication pairs in industrial control systems, enhancing security monitoring beyond traditional whitelisting methods.
The Subtle Art of Chaining Headers - IKEv2 Attack Surface Case Study
Explore IKEv2 attack surface through header chaining, uncovering vulnerabilities in IPsec VPNs. Learn techniques for identifying and exploiting weaknesses in Internet Key Exchange implementations.
CDPwn - Taking Over Millions of Enterprise-Things with Layer 2 Zero-Days
Unveiling critical zero-day vulnerabilities in layer 2 protocols, demonstrating their impact on enterprise device and network security, and exploring potential exploitation techniques.