Black Hat Courses

Living Off the Walled Garden - Abusing the Features of the Early Launch Antimalware Ecosystem

Explore methodology for assessing ELAM drivers, demonstrating how overly-permissive rules enable adversary tradecraft opportunities through abuse of intended functionality, with practical demonstrations and insights.

• YouTube
• 36 minutes
• Self-Paced
• Conference Talk

Breaking Firmware Trust From Pre-EFI - Exploiting Early Boot Phases

Explore recent UEFI firmware security changes, focusing on Intel CPUs. Covers firmware mitigations in SMM/DXE and new attacks on Intel PPAM, offering unique insights from an offensive security perspective.

• YouTube
• 36 minutes
• Self-Paced
• Conference Talk

Malware Classification With Machine Learning Enhanced by Windows Kernel Emulation

Explore hybrid machine learning for malware classification using static and dynamic analysis, Windows kernel emulation, and neural networks. Learn about adversarial ML and future developments.

• YouTube
• 27 minutes
• Self-Paced
• Conference Talk

Bug Hunters Dump User Data - Can They Keep It? Well They're Keeping It Anyway

Explores legal and ethical implications of security researchers handling sensitive user data during bug bounty disclosures, examining responsibilities and potential consequences for all parties involved.

• YouTube
• 37 minutes
• Self-Paced
• Conference Talk

The Growth of Global Election Disinformation - The Role and Methodology of Government-Linked Cyber Actors

Explore how government-linked cyber actors influence elections through disinformation campaigns, focusing on a case study from Colombia's 2022 elections and strategies for detecting such operations.

• YouTube
• 30 minutes
• Self-Paced
• Conference Talk

The Journey of Hunting In-the-Wild Windows LPE 0day

Explore techniques for detecting and capturing in-the-wild Windows Local Privilege Escalation vulnerabilities, including methodology development and continuous improvement strategies.

• YouTube
• 32 minutes
• Self-Paced
• Conference Talk

Scaling the Security Researcher to Eliminate OSS Vulnerabilities Once and For All

Explore automated security vulnerability detection and fixing in open-source software, including techniques like OpenRewrite and control flow analysis for efficient, large-scale remediation.

• YouTube
• 38 minutes
• Self-Paced
• Conference Talk

DirectX - The New Hyper-V Attack Surface

Explore vulnerabilities in Hyper-V's GPU-Paravirtualization feature, examining 4 fixed DirectX component issues and their implications for virtualization security.

• YouTube
• 28 minutes
• Self-Paced
• Conference Talk

Revealing the Secrets of Siemens S7 PLCs

Uncover vulnerabilities in Siemens ET 200SP SoftPLC, exploring its architecture, boot process, and potential attack vectors. Learn about PC-based PLCs and their security implications in industrial control systems.

• YouTube
• 29 minutes
• Self-Paced
• Conference Talk

Chasing Your Tail With a Raspberry Pi

Methodology for detecting wireless signal tracking using low-cost hardware and Python. Covers SIGINT techniques, MAC address randomization, and provides code for DIY implementation.

• YouTube
• 28 minutes
• Self-Paced
• Conference Talk

Eliminating Triage Intermediaries for Zero-day Exploits Using a Decentralised Payout Protocol

Explore a protocol for collectivizing security bounties, enabling companies to showcase software security and ethical hackers to retrieve bounties without ambiguity, eliminating subjectivity in triage processes.

• YouTube
• 23 minutes
• Self-Paced
• Conference Talk

Déjà Vu - Uncovering Stolen Algorithms in Commercial Products

Techniques for detecting unauthorized use of algorithms in commercial products, including search methods, reverse-engineering, and a real-world case study. Provides strategies for addressing IP theft and prevention.

• YouTube
• 26 minutes
• Self-Paced
• Conference Talk

Ghost in the Wireless - iwlwifi Edition

Explore Intel Wi-Fi chip vulnerabilities through reverse-engineering, uncovering firmware exploits and code execution risks in complex features like Wake-on-WLAN and TDLS.

• YouTube
• 28 minutes
• Self-Paced
• Conference Talk

Cautious - A New Exploitation Method! No Pipe but as Nasty as Dirty Pipe

Unveils a novel exploitation technique surpassing Dirty Pipe, enabling arbitrary file overwriting and privilege escalation through double-free vulnerabilities, applicable across affected kernel versions.

• YouTube
• 31 minutes
• Self-Paced
• Conference Talk

Controlling the Source - Abusing Source Code Management Systems

Explore vulnerabilities in Source Code Management systems, including reconnaissance, user role manipulation, and repository takeover. Learn attack scenarios and defensive strategies for GitHub, GitLab, and Bitbucket.

• YouTube
• 37 minutes
• Self-Paced
• Conference Talk