OWASP SAMM 2 - Your Dynamic Software Security Journey
Explore OWASP SAMM 2, a dynamic framework for software security. Learn principles, assessment tools, and critical success factors to enhance your organization's security maturity.
OWASP Standard Classification - Rough Consensus - An OWASP Story
Explore OWASP's journey in establishing software security standards through rough consensus, highlighting challenges, achievements, and future directions in the field.
Temporal - The Future Is Simple - Introducing the CRE
Introducing the Common Requirement Enumeration (CRE) initiative: a unified framework linking security standards to simplify and integrate application security across domains and stakeholders.
Topics of Interest - Automatic Vulnerability Remediation - The Trusted and Secure Road to Developer Happiness
Explore automatic vulnerability remediation's potential to expedite product releases, free up development resources, and enhance software security while addressing developer trust concerns.
Introduction to Reverse Engineering
Explore techniques used by crackers to bypass security, access firmware, and find vulnerabilities in hardware and software. Learn to protect your products from reverse engineering.
C-FLAT - Control-Flow Attestation for Embedded Systems Software
Control-flow attestation for embedded systems: detect runtime attacks, ensure software integrity. Novel approach combines remote attestation with control-flow monitoring for enhanced security in IoT devices.
The Aftermath of a Fuzz Run - What to Do About Those Crashes?
Explore tools and techniques for analyzing crashes from fuzz runs, focusing on reducing, triaging, and finding root causes to fix vulnerabilities in software applications.
Securing Your In-Ear Fitness Coach - Challenges in Hardening Next Generation Wearables
Explore security challenges and solutions for next-gen wearables, focusing on a custom Security Development Lifecycle for hardware, software, and cloud components in IoT ecosystems.
CLKscrew - Exposing the Perils of Security-Oblivious Energy Management
Explore CLKSCREW attack: software-based fault attacks exploiting energy management vulnerabilities, enabling security breaches without physical access to devices or specialized equipment.
Silicon - Security's New Layer
Explore hardware security challenges, from supply chain vulnerabilities to chip-level attacks. Learn about emerging threats and best practices for securing technology stacks from silicon to software.
Continuous Skills Improvement For Everyone
Explore continuous skills improvement strategies, from hands-on labs to bug bounty programs. Learn to stand out professionally, set goals, and develop both technical and soft skills.
Pushing Security Left by Mutating Byte Code
Explore techniques for building secure software through bytecode mutation, including obfuscation, encryption, and cross-compilation to protect against reverse engineering and enhance product security.
The Impact of Software Security Practice Adoption Quantified
Quantitative analysis of software security practices' impact on risk outcomes, based on data from 200 Comcast teams. Insights on effective strategies for enhancing cybersecurity in diverse tech environments.
Freeing the Software That Runs Our Elections
Explore open-source software projects for US elections, focusing on San Francisco's initiative. Learn about voting systems, ballot processing, and the advantages of transparent election technology.
The Security of Classic Game Consoles
Explore classic game console security measures, their exploits, and lessons for modern software. Journey through gaming history to understand hardware, media, and software protection techniques.
Reverse Engineering a Classic Video Game
Explore reverse engineering techniques using a classic 90s game as an example. Learn about file structures, compression, graphics, and audio while rebuilding the game in C#.
The Developer's Field Guide to Software Security
Practical guide for integrating security into DevOps without slowing down. Learn strategies, tools, and best practices to improve software security posture while maintaining rapid deployment.
The Guard's Dilemma - Efficient Code-Reuse Attacks Against Intel SGX
Explores novel exploitation techniques against Intel SGX, demonstrating vulnerabilities in enclave code without requiring kernel privileges or crashes, even with existing randomization approaches.
Malicious Management Unit - Why Stopping Cache Attacks in Software is Harder Than You Think
Explores indirect cache attacks bypassing software-based defenses by exploiting MMU operations, challenging existing security measures and revealing vulnerabilities in cache isolation techniques.
Small World with High Risks - A Study of Security Threats in the npm Ecosystem
Analyzes security risks in npm ecosystem, revealing vulnerabilities due to dependencies, maintainer influence, and lack of maintenance. Discusses potential mitigations for the JavaScript community.
Reimplementing Local RPC in .Net
Reimplementing Windows RPC in .NET for privilege escalation, covering ALPC implementation, NDR parsing, and PowerShell integration. Includes bug discovery and tooling demonstration.