Like Lightning From the Cloud - Finding RCEs in an Embedded TLS Library
Explore techniques for discovering remote code execution vulnerabilities in embedded TLS libraries, with insights on improving security in IoT and embedded systems.
Optimized Fuzzing IOKit in iOS
Optimized fuzzing approach for iOS IOKit interfaces, dynamically resolving symbols and parameters to improve efficiency and effectiveness in vulnerability discovery.
Stagefright - Scary Code in the Heart of Android
Exploring Android's Stagefright framework vulnerabilities, focusing on discovery techniques, OS internals, and security implications. Demonstrates proof-of-concept code and discusses mitigation strategies.
Bypassing Browser Security Policies for Fun and Profit
Explore mobile browser vulnerabilities and security policy bypasses, including Same Origin Policy and Content Security Policy. Learn testing methodologies and see real-world examples of Android browser exploits.
Fuzzing Android - A Recipe for Uncovering Vulnerabilities Inside System Components in Android
Explore a fuzzing approach to uncover vulnerabilities in Android's core system components. Learn about data generation, test execution, logging, and triage mechanisms for effective vulnerability detection.
Hey, Your Parcel Looks Bad - Fuzzing and Exploiting Parcelization Vulnerabilities in Android
Explore Android's Binder IPC vulnerabilities through fuzzing and exploitation techniques. Learn to identify, analyze, and exploit "BadParcel" issues for privilege escalation in high-privilege processes.
Reversing SR IOV For Fun and Profit
Explore PCIe device reverse engineering, focusing on SR-IOV standard. Learn techniques to analyze vulnerabilities and extract valuable information from these interconnected components.
Ground Truth - 18 Vendors, 6000 Firmware Images, 2.7 Million Binaries, and a Flaw in the Linux-MIPS Stack
Presentation of data from analysis of 6000+ firmware images, revealing trends in software hardening and a critical flaw in Linux/MIPS stack affecting security across embedded devices.
Security Theatre
Explore web security threats, vulnerabilities, and best practices. Learn about encryption, authentication, and strategies to protect against hacks and social engineering in this comprehensive talk.
Augmenting Static Analysis Using Pintool - Ablation
Extracts runtime information to enhance static analysis, resolving virtual calls in C++ binaries and visually comparing samples for efficient vulnerability research and code auditing.
XRP Raid Protector - Killing A Critical Bug Worth 40 Billion Dollars
Unveiling a critical 8-year-old vulnerability in XRP Ledger that could compromise $40 billion in assets. Explores the RCE exploit, potential profit methods, and network control implications for blockchain security.
Bypassing DEP With Jump-Oriented Programming
Explore Jump-Oriented Programming (JOP) for code-reuse attacks, including its fundamentals, the JOP ROCKET tool, and techniques to bypass DEP and ASLR in Windows environments.
Fuzzing Javascript Engines for Fun and Pwnage
Discover methods for finding vulnerabilities in Javascript Engines through fuzzing techniques, including crash classification, parallel fuzzing, and custom pattern generation for enhanced web browser security.
Building Next-Gen Security Analysis Tools With Qiling Framework
Explore Qiling Framework for advanced security analysis, including cross-platform emulation, fuzzing, malware sandboxing, and IoT vulnerability research. Learn to build customized tools efficiently.
Open Bottle - Security Industry Panel Discussion
Security experts discuss industry trends, vulnerabilities, and ethical hacking in an open panel. Topics include fuzzing, e-commerce security, IPv6 research, and experiences from diverse cybersecurity backgrounds.
iOS 6 Security
Comprehensive analysis of iOS 6 kernel security enhancements, discussing new exploit mitigation technologies, their impact on attack methodologies, and potential future exploitation techniques.
Implementing Your Own Generic Unpacker
Detailed guide on creating a stealthy, efficient generic unpacker for Windows, covering kernel mechanisms, memory management, and PE loading. Includes implementation details and results on real-world samples.
The Ransomware Protection Full Of Holes
Exposé des failles de la protection contre les ransomwares de Windows, démonstration de méthodes de contournement et d'attaques à distance, avec vidéos à l'appui.
Suborner - Windows Bribery for Invisible Persistence
Discover a stealthy Windows persistence technique that creates invisible machine accounts, evades detection, and impersonates existing users. Learn about the Suborner Attack's implementation and effectiveness.
One-Click to Completely Takeover a MacOS Device
Explore vulnerabilities in MacOS security features and learn how to bypass them for a one-click takeover of both Apple Silicon and Intel Mac devices. Includes live demo and expert insights.
Exploiting a Limited UAF on Ubuntu 22.04 to Achieve LPE
Detailed exploration of exploiting a Linux kernel vulnerability in Ubuntu 22.04 to achieve local privilege escalation, focusing on advanced exploitation techniques and bypass methods.