DCART - Decoupled Components for Automated Ransomware Testing
Explore a framework for controlled ransomware testing, focusing on decoupled components for detonation and detection. Learn about design, development, and automated testing methodologies for behavioral ransomware analysis.
Hourglass Fuzz - A Quick Bug Hunting Method
Introducción a Hourglass Fuzz, un método rápido de búsqueda de errores para Android que supera las limitaciones de los sistemas de fuzzing típicos, con ejemplos de vulnerabilidades descubiertas en controladores gráficos y Bluetooth.
A New Fuzzing Method for Android
Innovative Android fuzzing method combining function points to find vulnerabilities. Proven effective with 50+ bugs discovered on major OEM devices, inspiring new approaches in mobile security research.
Web Applications Bug Hunting - Fundamentals
Explore web application security fundamentals, attack vectors, and tools for bug hunting. Learn key concepts to kickstart your career in application security.
Evading Anti-APT Technologies
Learn advanced techniques to bypass anti-APT technologies, including sandbox weaknesses, timing attacks, and dynamic analysis. Gain insights into evading endpoint security and improving your cybersecurity skills.
Crimeware Chaos - Empirical Analysis of HTTP-Based Botnet C&C Panels
Empirical analysis of HTTP-based botnet C&C panels, exploring design, technologies, and characteristics of crimeware control systems used by cybercriminals for managing botnets and other malicious operations.
From Cockroaches to Marble Floors - What Happens When You Turn On the Lights?
Practical tools and methodologies to transform software security posture by eliminating false distinctions between security bugs and other defects, improving product quality and aligning teams.
Whoops! I Rewrote it in Rust
Explore rewriting a C caching framework in Rust, discussing performance challenges, benefits of Rust tooling, and new features like efficient TTL sorting and PMEM support.
OTRazor - Static Code Analysis for Vulnerability Discovery in Industrial Automation Scripts
Explore industrial robot programming security, focusing on vulnerabilities in automation scripts. Learn about a static code analyzer for detecting unsafe patterns and discuss mitigation strategies.
Reversing the Root - Identifying the Exploited Vulnerability in 0-Days Used In-The-Wild
Explore techniques for identifying root cause vulnerabilities in exploited 0-days, including binary patch diffing, exploit minimization, and reverse engineering, to enhance cybersecurity analysis and threat mitigation.
ECMO - Rehost Embedded Linux Kernels via Peripheral Transplantation
Innovative technique for rehosting embedded Linux kernels in QEMU using peripheral transplantation, enabling dynamic analysis of firmware images from diverse embedded devices.
There Will Be Glitches - Extracting and Analyzing Automotive Firmware Efficiently
Explore automotive firmware extraction and analysis techniques, focusing on fault injection and emulation for uncovering vulnerabilities in vehicle security systems.
The Cost of Complexity - Different Vulnerabilities While Implementing the Same RFC
Exploring security vulnerabilities in DNS implementations due to complexity and ambiguity in RFC 1035, focusing on message compression and its impact on TCP/IP stacks.
Analyzing and Fuzzing for Qualcomm Hexagon Processor
Explore techniques for analyzing and fuzzing Qualcomm Hexagon processors, overcoming challenges in firmware analysis, emulation, and hardware-dependent targets for enhanced security research.
In-Field Emulation and Fuzzing of PLCs to Uncover the Next Zero-Day Threat in Industrial Control Systems
Explore innovative techniques for uncovering vulnerabilities in Industrial Control Systems through in-field emulation and fuzzing of PLCs, focusing on proactive security measures beyond network-level exploits.
FPs Are Cheap - Show Me the CVEs
Evaluating SAST tools: Learn how to assess their effectiveness in finding real vulnerabilities using synthetic test suites and practical examples of CVEs.
Identifying Multi-Binary Vulnerabilities in Embedded Firmware at Scale
Explore techniques for identifying vulnerabilities in embedded firmware, focusing on multi-binary analysis, dynamic and static approaches, and scalable solutions for IoT device security.
Drill Apple Core - Up and Down - Fuzz Apple Core Component in Kernel and User Mode for Fun and Profit
Explore kernel sanitizers, XNU syscall API patterns, and code coverage techniques for Apple systems. Live demo of macOS root access using 0-day vulnerabilities discovered through fuzzing.
Follow the White Rabbit - Simplifying Fuzz Testing Using FuzzExMachina
Explore FuzzExMachina, a framework for efficient fuzz testing. Learn how it uncovered 11 crashes and 6 exploitable vulnerabilities in Arch Linux packages, simplifying security analysis.
EBPF ELFs JMPing Through the Windows
Explore eBPF for Windows: capabilities, security model, design, and attack surface. Uncover vulnerabilities, witness fuzzing demos, and discuss exploitation challenges in Windows Protected Process.
Cooper Knows the Shortest Stave - Finding 134 Bugs in the Binding Code of Scripting Languages
Innovative approach to finding bugs in scripting languages through cooperative mutation, combining script code and native input modifications to uncover hidden vulnerabilities in binding code.