Data Driven Software Security
Explore Microsoft's data-driven approach to software security, including new mitigation techniques in Windows 10 and analysis of real-world exploits to enhance protection against vulnerabilities.
Dreamboot - A UEFI Bootkit
Exploración detallada de la arquitectura UEFI y desarrollo de un bootkit para Windows 8 x64, analizando riesgos de seguridad y demostrando payloads maliciosos como escalada de privilegios y bypass de autenticación.
Copy-Paste Vulnerabilities
Explores copy-paste vulnerabilities in software development, their impact, detection challenges, and mitigation strategies. Includes case studies and recommendations for prevention.
Introduction to Windows Kernel Mode Debugging
Explore Windows kernel debugging essentials, including symbol servers, BSOD analysis, and live debugging. Learn practical approaches to diagnose CPU issues, deadlocks, and blue screens for improved software security.
From Cockroaches to Marble Floors - What Happens When You Turn On the Lights?
Practical tools and methodologies to transform software security posture by eliminating false distinctions between security bugs and other defects, improving product quality and aligning teams.
An Effective Approach to Software Obfuscation
Explore effective software obfuscation techniques, their limitations, and a novel approach to enhance code protection against reverse engineering and analysis.
Formally Verifying Everybody's Cryptography
Explore formal verification in cryptography: its application, challenges, and impact on securing real-world systems through mathematical reasoning and advanced techniques.
From Coordinated Disclosure to Cooperative Vulnerability Research When Dealing with Critical Software Stacks
Explore evolving approaches to vulnerability disclosure in critical software, emphasizing early cooperation between researchers and vendors for improved security outcomes.
SDL That Won't Break the Bank
Learn cost-effective strategies for implementing a secure development lifecycle in smaller organizations, addressing unique challenges and leveraging available resources.
Stop That Release, There's a Vulnerability!
Explore BlackBerry's software defect tracking system and risk-based release evaluation process for effective security gating in product development.
BinTyper - Type Confusion Detection for C++ Binaries
Explore a novel approach to detect type confusion vulnerabilities in C++ binaries, enhancing software security against malicious code execution attacks.
Wrangling with the Ghost - An Inside Story of Mitigating Speculative Execution Side Channel Vulnerabilities
Explore Microsoft's approach to mitigating speculative execution vulnerabilities, including research, collaboration, and industry-wide efforts. Learn about Spectre, Meltdown, and strategies for robust security measures.
Playback - A TLS 1.3 Story
Explore TLS 1.3's 0-RTT feature, its risks, and real-world replay attacks. Learn about potential solutions and mitigation controls for secure deployment of TLS 1.3-supported software.
Your Software IS - NOT Vulnerable - CSAF, VEX, and the Future of Advisories
Explore the future of software security advisories, focusing on CSAF and VEX, and learn how to manage the increasing volume of vulnerability information effectively.
The Perl Jam 2 - The Camel Strikes Back
Exploring critical vulnerabilities in Perl's core modules and CGI frameworks, demonstrating fundamental language issues through 0-days, and challenging the "developer's fault" narrative.
Exploiting Adobe Flash Player in the Era of Control Flow Guard
Explore techniques for exploiting Adobe Flash Player vulnerabilities, bypassing Control Flow Guard, and executing data-only attacks without shellcode or ROP on Windows systems.
Windows 10 Mitigation Improvements
Explore Microsoft's data-driven approach to software security, including proactive monitoring, analysis of exploits, and mitigation improvements in Windows 10 to enhance protection against vulnerabilities.
The Myths of Software Security
Exposé of common software security myths, debunking industry surveys, best practices, and popular concepts like "shift left" and SBOMs. Challenges conventional wisdom with evidence-based insights.
Hacking .NET C# Applications - The Black Arts
Explore advanced techniques for attacking .NET applications, including creating cracks and malware. Learn about common protections and counter-protection methods for enhanced penetration testing skills.
Software Security
Explore mobile and web app security, including SSL/TLS, authentication, and cross-site scripting. Learn testing techniques and effective report writing for security assessments.
Abusing Over-The-Air Client Provisioning
Uncovers vulnerabilities in major phone brands' network settings, allowing attackers to manipulate user data. Demonstrates attack flows and discusses vendor mitigations for these security risks.