Black Hat Courses

Bringing the Power of Symbolic Execution to the Fight Against Malicious Excel 4 Macros

Explore Symbexcel, a tool using symbolic execution to analyze and detect malicious Excel 4.0 macros, enhancing cybersecurity against this common attack vector.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

Your Software IS - NOT Vulnerable - CSAF, VEX, and the Future of Advisories

Explore the future of software security advisories, focusing on CSAF and VEX, and learn how to manage the increasing volume of vulnerability information effectively.

• YouTube
• 24 minutes
• Self-Paced
• Conference Talk

How I Used a JSON Deserialization 0day to Steal Your Money on the Blockchain

Explore a JSON deserialization vulnerability in Fastjson, its exploitation for remote code execution, and implications for blockchain security.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

Disappeared Coins - Steal Hashrate in Stratum Secretly

Unveils two novel man-in-the-middle attack schemes on Stratum, the main communication protocol for cryptocurrency mining pools, potentially compromising miners' computing power.

• YouTube
• 27 minutes
• Self-Paced
• Conference Talk

The Cost of Complexity - Different Vulnerabilities While Implementing the Same RFC

Exploring security vulnerabilities in DNS implementations due to complexity and ambiguity in RFC 1035, focusing on message compression and its impact on TCP/IP stacks.

• YouTube
• 36 minutes
• Self-Paced
• Conference Talk

Hunting Vulnerabilities of gRPC Protocol Armed Mobile - IoT Applications

Explore security vulnerabilities in gRPC-powered mobile and IoT apps. Learn about common pitfalls, attack vectors, and strategies to enhance protection in this high-performance protocol.

• YouTube
• 33 minutes
• Self-Paced
• Conference Talk

Racing the Dark - A New TOCTTOU Story From Apple's Core

Unveils macOS kernel vulnerabilities, highlighting memory mapping issues and race conditions that bypass security updates. Emphasizes the need to reevaluate macOS/iOS memory mapping mechanisms.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

We Are About to Land - How CloudDragon Turns a Nightmare Into Reality

Explore CloudDragon's advanced cyber tactics, including supply chain and cross-platform attacks. Gain insights into APT group operations and their evolving techniques in this cybersecurity analysis.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

Pre-built JOP Chains with the JOP ROCKET - Bypassing DEP without ROP

Explore Jump-oriented Programming (JOP) as an alternative to ROP for code-reuse attacks. Learn about the JOP ROCKET tool for creating pre-built JOP chains to bypass DEP without ROP.

• YouTube
• 37 minutes
• Self-Paced
• Conference Talk

Hey, You, Get off My Private Data - Do Apps Respect Your Privacy as They Claim?

Explore multinational data protection regulations and assess app compliance. Learn about privacy policies, GDPR principles, and techniques for evaluating personal data handling in mobile applications.

• YouTube
• 37 minutes
• Self-Paced
• Conference Talk

Vibe Check - Why Students May Shy Away From Cyber in a Surveillance State

Explores impact of surveillance and strict laws on cyber talent in Asia Pacific, discussing challenges for ethical hacking and threat research in a censorship-heavy environment.

• YouTube
• 37 minutes
• Self-Paced
• Conference Talk

A Mirage of Safety - Bug Finding & Exploit Techniques of Top Android Vendor's Privacy Protection Apps

Uncovers vulnerabilities in popular Android privacy protection apps, revealing security flaws and exploit techniques. Offers insights on improving mobile data security and privacy safeguards.

• YouTube
• 22 minutes
• Self-Paced
• Conference Talk

Alarm.DISARM - Remotely Exploiting & Disarming Popular Physical Security System from Public Internet

Explore remote code execution vulnerabilities in physical security systems, learning to exploit and disarm alarms through reverse engineering and network protocol analysis.

• YouTube
• 36 minutes
• Self-Paced
• Conference Talk

New Attack Surface in Safari - Using Just One Web Audio Vulnerability to Rule Safari

Explores a novel attack surface in Safari, focusing on vulnerabilities in system libraries like audio. Demonstrates how a single Web Audio vulnerability can be exploited to compromise Safari's security.

• YouTube
• 27 minutes
• Self-Paced
• Conference Talk

The Tangled Webview - Javascriptinterface Once More

Unveils new Android WebView vulnerabilities related to JavascriptInterface, bypassing all verifications. Presents a novel attack model and discusses security implications for mobile app developers.

• YouTube
• 22 minutes
• Self-Paced
• Conference Talk