Black Hat Courses

Leveraging the Apple ESF for Behavioral Detections

Explore Apple's Endpoint Security Framework for macOS threat detection. Learn to utilize ESF data for basic and advanced behavioral-based detections, comparing old and new detection methods.

• YouTube
• 37 minutes
• Self-Paced
• Conference Talk

Let's Dance in the Cache - Destabilizing Hash Table on Microsoft IIS

Explore Microsoft IIS's Dynamic Hashing algorithm and its vulnerabilities. Learn about potential collision attacks on hash tables in web server architecture and their implications for cybersecurity.

• YouTube
• 43 minutes
• Self-Paced
• Conference Talk

Is WebAssembly Really Safe? - Wasm VM Escape and RCE Vulnerabilities Have Been Found in New Way

Explore WebAssembly security vulnerabilities through a new fuzzing framework, focusing on VM escape and RCE risks in Wasm runtimes for edge computing and web applications.

• YouTube
• 27 minutes
• Self-Paced
• Conference Talk

Invisible Finger - Practical Electromagnetic Interference Attack on Touchscreen-based Devices

Uncover vulnerabilities in touchscreen devices through electromagnetic interference attacks, exploring practical methods to compromise security and user interaction on smartphones and tablets.

• YouTube
• 39 minutes
• Self-Paced
• Conference Talk

Kubernetes Privilege Escalation - Container Escape Equals Cluster Admin

Explore Kubernetes security vulnerabilities, privilege escalation techniques, and container escape risks. Learn to identify powerful system pods and implement mitigations to protect your cluster from potential attacks.

• YouTube
• 36 minutes
• Self-Paced
• Conference Talk

Internal Server Error - Exploiting Inter-Process Communication in SAP's HTTP Server

Explore SAP's HTTP server vulnerabilities and learn advanced exploitation techniques for memory corruption in the Internet Communication Manager, with real-world examples and demonstrations.

• YouTube
• 39 minutes
• Self-Paced
• Conference Talk

Industroyer2 - Sandworm's Cyberwarfare Targets Ukraine's Power Grid Again

Detailed analysis of Industroyer2 malware targeting Ukraine's power grid, comparing it to the original Industroyer and exploring its communication with ICS hardware using industrial protocols.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

In Need of 'Pair' Review - Vulnerable Code Contributions by GitHub Copilot

Explore GitHub Copilot's vulnerabilities in code generation, including SQL injections and buffer overflows. Learn about the risks of AI-generated code and strategies for responsible use in software development.

• YouTube
• 37 minutes
• Self-Paced
• Conference Talk

Harm Reduction - A Framework for Effective & Compassionate Security Guidance

Explore harm reduction principles in cybersecurity, challenging traditional approaches. Learn pragmatic strategies for effective risk management, reducing costs, and mitigating practitioner burnout.

• YouTube
• 34 minutes
• Self-Paced
• Conference Talk

AEPIC Leak - Architecturally Leaking Uninitialized Data from the Microarchitecture

Systematic analysis of CPU vulnerabilities, exploring root causes and connections between transient-execution attacks and architectural vulnerabilities. Identifies blank spots in CPU security research.

• YouTube
• 22 minutes
• Self-Paced
• Conference Talk

Stalloris - RPKI Downgrade Attack

Demonstration of novel downgrade attacks against RPKI, exposing networks to prefix hijacks by disabling RPKI validation through malicious publication points.

• YouTube
• 27 minutes
• Self-Paced
• Conference Talk

No One Is Entitled to Their Own Facts, Except in Cybersecurity - Presenting an Investigation Handbook to Develop a Shared Narrative of Major Cyber Incidents

Explore a new playbook for major cyber incident investigations, drawing lessons from aviation safety to create actionable insights and build a shared historical narrative in cybersecurity.

• YouTube
• 32 minutes
• Self-Paced
• Conference Talk

Talent Need Not Apply - Tradecraft and Objectives of Job-themed APT Social Engineering

Unmasking APT recruitment tactics: Analysis of North Korean and Iranian threat actors using job-themed social engineering to compromise victims, including tradecraft and objectives.

• YouTube
• 36 minutes
• Self-Paced
• Conference Talk

Detecting Kernel Exploits with eBPF

Explore eBPF's evolution in Linux, its expanding capabilities, and its potential for detecting kernel exploits, with insights on probes, challenges, and performance implications.

• YouTube
• 24 minutes
• Self-Paced
• Conference Talk

A Fully Trained Jedi, You Are Not

Explore essential security knowledge for software engineers to build secure systems, addressing common issues and establishing a shared understanding of security principles.

• YouTube
• 41 minutes
• Self-Paced
• Conference Talk