Fighting Secrets in Source Code with TruffleHog
Discover TruffleHog: a tool for identifying secrets in source code, its applications in DevOps, and new approaches to detecting secrets in package managers like npm and pypi.
From Cockroaches to Marble Floors - What Happens When You Turn On the Lights?
Practical tools and methodologies to transform software security posture by eliminating false distinctions between security bugs and other defects, improving product quality and aligning teams.
Purple is the New Black - Modern Approaches to Application Security
Explore modern application security approaches combining defense, offense, automation, and continuous learning for various app types, including zero trust, supply chain, and microservices.
Resilient Microservices Without the Chaos
Explore resilient microservices design using Service-Level Fault Injection Testing. Learn about Filibuster, a tool that verifies application behavior under failure, combining static analysis and test synthesis for robust systems.
Streaming Video Analysis in Rust Using Pravega
Explore building a scalable real-time video analysis pipeline using Rust, GStreamer, and Pravega. Learn challenges, patterns, and how to leverage Rust's features for complex applications.
Artisanal, Machine-Generated API Libraries
Explore Stripe's journey in automating API library generation across multiple languages, delving into the custom-built compiler tool and valuable insights gained during development.
Whoops! I Rewrote it in Rust
Explore rewriting a C caching framework in Rust, discussing performance challenges, benefits of Rust tooling, and new features like efficient TTL sorting and PMEM support.
Visualization Driven Development
Interactive visualizations for understanding algorithms: techniques and examples using HTML, CSS, JavaScript, and D3 to supplement traditional testing and improve code comprehension.
Redback - Advanced Static Binary Injection
Explore advanced static binary injection techniques to insert external code into executables, modifying run-time behavior. Learn from experts about this powerful yet underutilized method.
OTRazor - Static Code Analysis for Vulnerability Discovery in Industrial Automation Scripts
Explore industrial robot programming security, focusing on vulnerabilities in automation scripts. Learn about a static code analyzer for detecting unsafe patterns and discuss mitigation strategies.
Reversing the Root - Identifying the Exploited Vulnerability in 0-Days Used In-The-Wild
Explore techniques for identifying root cause vulnerabilities in exploited 0-days, including binary patch diffing, exploit minimization, and reverse engineering, to enhance cybersecurity analysis and threat mitigation.
ECMO - Rehost Embedded Linux Kernels via Peripheral Transplantation
Innovative technique for rehosting embedded Linux kernels in QEMU using peripheral transplantation, enabling dynamic analysis of firmware images from diverse embedded devices.
There Will Be Glitches - Extracting and Analyzing Automotive Firmware Efficiently
Explore automotive firmware extraction and analysis techniques, focusing on fault injection and emulation for uncovering vulnerabilities in vehicle security systems.
ACSploit - Exploit Algorithmic Complexity Vulnerabilities
Explore techniques to identify and exploit algorithmic complexity vulnerabilities, focusing on inefficient worst-case scenarios and their impact on program performance and security.
Over-the-Air - How We Remotely Compromised the Gateway, BCM, and Autopilot ECUs of Tesla Cars
Detailing Tesla car hacking techniques, including remote compromises of gateway, BCM, and Autopilot ECUs. Explores vulnerabilities, attack chains, and Tesla's security enhancements in response.
Automated Discovery of Deserialization Gadget Chains
Explore automated discovery of deserialization gadget chains, understanding vulnerabilities, and learning techniques to find and mitigate exploits in Java libraries and applications.
Squeezing a Key through a Carry Bit
Explore a practical key recovery attack on Go's P-256 elliptic curve implementation, targeting JSON Web Encryption through a subtle carry bit bug.
The Cost of Complexity - Different Vulnerabilities While Implementing the Same RFC
Exploring security vulnerabilities in DNS implementations due to complexity and ambiguity in RFC 1035, focusing on message compression and its impact on TCP/IP stacks.
Analyzing and Fuzzing for Qualcomm Hexagon Processor
Explore techniques for analyzing and fuzzing Qualcomm Hexagon processors, overcoming challenges in firmware analysis, emulation, and hardware-dependent targets for enhanced security research.
In-Field Emulation and Fuzzing of PLCs to Uncover the Next Zero-Day Threat in Industrial Control Systems
Explore innovative techniques for uncovering vulnerabilities in Industrial Control Systems through in-field emulation and fuzzing of PLCs, focusing on proactive security measures beyond network-level exploits.
FPs Are Cheap - Show Me the CVEs
Evaluating SAST tools: Learn how to assess their effectiveness in finding real vulnerabilities using synthetic test suites and practical examples of CVEs.