Identifying Multi-Binary Vulnerabilities in Embedded Firmware at Scale
Explore techniques for identifying vulnerabilities in embedded firmware, focusing on multi-binary analysis, dynamic and static approaches, and scalable solutions for IoT device security.
Cutting Edge - Microsoft Browser Security — From People Who Owned It
Deep dive into Microsoft Edge security architecture, exploring sandbox initialization, browser broker implementation, and renderer security isolation.
Applied Self-Driving Car Security
Explore self-driving car security with industry experts, covering technology, potential attacks, and defense strategies for this emerging field.
Drill Apple Core - Up and Down - Fuzz Apple Core Component in Kernel and User Mode for Fun and Profit
Explore kernel sanitizers, XNU syscall API patterns, and code coverage techniques for Apple systems. Live demo of macOS root access using 0-day vulnerabilities discovered through fuzzing.
Wrangling with the Ghost - An Inside Story of Mitigating Speculative Execution Side Channel Vulnerabilities
Explore Microsoft's approach to mitigating speculative execution vulnerabilities, including research, collaboration, and industry-wide efforts. Learn about Spectre, Meltdown, and strategies for robust security measures.
Follow the White Rabbit - Simplifying Fuzz Testing Using FuzzExMachina
Explore FuzzExMachina, a framework for efficient fuzz testing. Learn how it uncovered 11 crashes and 6 exploitable vulnerabilities in Arch Linux packages, simplifying security analysis.
EBPF ELFs JMPing Through the Windows
Explore eBPF for Windows: capabilities, security model, design, and attack surface. Uncover vulnerabilities, witness fuzzing demos, and discuss exploitation challenges in Windows Protected Process.
Cooper Knows the Shortest Stave - Finding 134 Bugs in the Binding Code of Scripting Languages
Innovative approach to finding bugs in scripting languages through cooperative mutation, combining script code and native input modifications to uncover hidden vulnerabilities in binding code.
Dynamic Process Isolation
Explore cloud computing security with in-process isolation techniques, addressing vulnerabilities in shared hardware resources while maintaining high performance.
Do You Speak My Language? Make Static Analysis Engines Understand Each Other
Explore a novel framework for cross-language taint-flow analysis, enabling detection of critical security vulnerabilities across multiple codebases and programming languages.
Put in One Bug and Pop Out More - An Effective Way of Bug Hunting in Chrome
Discover effective bug hunting techniques in Chrome, leveraging historical vulnerabilities to uncover new ones. Learn to identify shared code patterns and exploit codebase complexity for enhanced security testing.
Bringing the Power of Symbolic Execution to the Fight Against Malicious Excel 4 Macros
Explore Symbexcel, a tool using symbolic execution to analyze and detect malicious Excel 4.0 macros, enhancing cybersecurity against this common attack vector.
The Dark Age of Memory Corruption Mitigations in the Spectre Era
Explores how speculative execution attacks can bypass memory corruption defenses, challenging established security measures and revealing vulnerabilities in modern computer systems.
Optimized Fuzzing IOKit in iOS
Optimized fuzzing approach for iOS IOKit interfaces, dynamically resolving symbols and parameters to improve efficiency and effectiveness in vulnerability discovery.
Lessons Learned from Eight Years of Breaking Hypervisors
Explore vulnerabilities in popular hypervisors, examining security features, attack surfaces, and design flaws. Gain insights on improving hypervisor security through real-world examples and expert recommendations.
Firmware.RE - Firmware Unpacking, Analysis and Vulnerability-Discovery as a Service
Large-scale analysis of firmware images reveals vulnerabilities across embedded systems, highlighting security challenges and the need for improved tools and techniques in firmware analysis.
The Power of Pair - One Template that Reveals 100+ UAF IE Vulnerabilities
Discover a unique fuzzing strategy that revealed over 100 IE use-after-free vulnerabilities. Learn about the vulnerability hunting system and techniques used to find critical browser security flaws.
How to Find Bugs in USB Device Drivers
Explore USB device driver vulnerabilities using vUSBf framework. Learn about fuzzing techniques, bug detection, and potential security risks in USB implementations across various operating systems.
The Node.js Highway - Attacks Are At Full Throttle
Explore Node.js security issues and effective measures for secure application development. Learn about weak cryptography, testing, MongoDB, and see a practical demo.
Freeze Drying for Capturing Environment-Sensitive Malware Alive
Innovative techniques for capturing and analyzing environment-sensitive malware through "freeze drying" and live process migration, enabling dynamic analysis of sophisticated threats like Citadel and ZeuS/GameOver.
Counterfeiting the Pipes with FakeNet 2.0
Explore network simulation for malware analysis using FakeNet 2.0. Learn to mimic protocols, configure settings, and capture network signatures efficiently in this hands-on workshop.