Return of the Insecure Brazilian Voting Machines
Análise detalhada da segurança do software de votação brasileiro, baseada em resultados de um desafio de hacking restrito organizado pela autoridade eleitoral nacional.
Pen-Testing the Supply Chain
Explore software supply chain risks through enhanced security testing and adversary simulation. Learn to identify vulnerabilities, assess vendor risks, and implement effective security measures.
The Windows Sandbox Paradox
Explore Windows sandboxing challenges, security vulnerabilities, and OS limitations. Learn about unexpected behaviors, bugs in popular applications, and strategies for auditing sandbox implementations.
Secure Software Development Framework - An Industry and Public Sector Approach
Explore industry-led framework for secure software development, addressing regulatory challenges, open source, metrics, and emerging technologies like AI in cybersecurity.
Attack on Titan M, Reloaded - Vulnerability Research on a Modern Security Chip
Explore vulnerability research on Google's Titan M security chip, including fuzzing techniques, impact analysis, and mitigation strategies for modern device protection.
POSWorld - Should You Be Afraid of Hands-On Payment Devices
Explore the vulnerabilities of Point of Sale terminals, uncovering security flaws in hardware, software, and file systems that enable cloning and fraud in the dark market.
Physical to Cyber and Back - Fingerprint Scanner Security
Exploring vulnerabilities in fingerprint scanners and access control systems, demonstrating physical-to-virtual attacks, and discussing network persistency techniques in IoT devices.
The Evolving Attack Surface
Explore the expanding vulnerabilities in industrial control systems, from traditional security to blockchain, with insights on hardware attacks, supply chain risks, and network hijacking.
The Hardware Pivot
Explore physical attack risks in large-scale device networks, focusing on modchips and counterfeit parts. Learn about threat propagation and strategies for securing hardware infrastructure.
A Decade After Bleichenbacher '06, RSA Signature Forgery Still Works
Explores RSA signature forgery vulnerabilities, revealing new CVEs and discussing prevention strategies through dynamic symbolic execution analysis of signature verification implementations.
SDL That Won't Break the Bank
Learn cost-effective strategies for implementing a secure development lifecycle in smaller organizations, addressing unique challenges and leveraging available resources.
Stop That Release, There's a Vulnerability!
Explore BlackBerry's software defect tracking system and risk-based release evaluation process for effective security gating in product development.
JIT Leaks - Inducing Timing Side Channels through Just-In-Time Compilation
Explore how just-in-time compilation can introduce timing side channels in software, enabling attackers to infer sensitive information through observable resource usage imbalances.
Side-Channel Attacks on Everyday Applications
Explore FLUSH+RELOAD side-channel attacks beyond cryptography, demonstrating their potential to leak information from everyday applications like web browsers and text editors.
Unikernels and Docker - From Revolution to Evolution
Explore unikernels' integration with Docker, enhancing virtual machine and container deployments. Learn about Docker for Mac/Windows and MirageOS unikernels augmenting LAMP stacks using Docker toolchain.
Developers and Application Security - Who is Responsible?
Explore findings on security responsibilities in software development, discussing implications of IoT and open-source components in everyday devices and applications.
Exploiting QSEE, The Raelize Way
Exploiting vulnerabilities in Qualcomm's Trusted Execution Environment through software and hardware attacks, achieving arbitrary code execution and compromising device security.
Bug Collisions Meet Government Vulnerability Disclosure
Explore the Vulnerability Equities Process and its impact on software vulnerability disclosure, examining the likelihood of multiple parties discovering the same security flaws.
Anti-Forensics - Reverse Engineering a Leading Phone Forensic Tool
Explore vulnerabilities in Cellebrite UFED through reverse engineering, uncovering potential impacts on court cases and discussing the ethical implications of forensic software flaws.
Reverse Engineering and Exploiting Font Rasterizers - The OpenType Saga
Explore critical vulnerabilities in OpenType font handling across popular software, revealing potential for arbitrary code execution and bypassing exploit mitigations. Learn about reverse-engineering techniques and in-depth vulnerability analysis.
Sysadmins' Introduction to Vulnerability Scanning
Explore vulnerability scanning essentials for sysadmins, covering software vulnerabilities, networking, scanning tools, and server inspection. Learn how ops involvement can enhance overall security processes.