Black Hat Courses

Securing the Public - Who Is in Charge?

Explore cyber security as a public responsibility, addressing transparency, accountability, and regulation issues. Gain insights on creating better incentives and updating requirements for a safer digital world.

• YouTube
• 49 minutes
• Self-Paced
• Conference Talk

The Devil is in the GAN - Defending Deep Generative Models Against Adversarial Attacks

Exploring vulnerabilities in Deep Generative Models, this talk introduces a threat model for training-time attacks and demonstrates backdooring techniques, while proposing effective detection methods through static and dynamic inspections.

• YouTube
• 39 minutes
• Self-Paced
• Conference Talk

Enter Sandbox

Explore automated seccomp filter generation for Linux applications, enhancing security through sandboxing and system call restrictions without manual developer intervention.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

Give Me a SQL Injection, I Shall PWN IIS and SQL Server

Explore SQL injection vulnerabilities in IIS and SQL Server, uncovering unexpected attack vectors and their implications for Microsoft's ecosystem security.

• YouTube
• 36 minutes
• Self-Paced
• Conference Talk

Threat Hunting in Active Directory Environment

Explore advanced threat hunting techniques in Active Directory, focusing on attacker persistence methods, privilege escalation, and covert system control. Learn to detect and mitigate sophisticated APT threats.

• YouTube
• 37 minutes
• Self-Paced
• Conference Talk

Domain Borrowing - Catch My C2 Traffic if You Can

Explore a new method to hide C2 traffic using CDN, circumventing censorship and detection. Learn about domain borrowing, HTTPS certificate abuse, and CDN vulnerabilities for red team operations.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

Reverse Engineering Compliance

Explore reverse engineering techniques applied to compliance standards, shifting from checkbox mentality to understanding the spirit of requirements for more effective security practices.

• YouTube
• 31 minutes
• Self-Paced
• Conference Talk

The B-MAD Approach to Threat Modeling

Discover the B-MAD approach to threat modeling, exploring its pitfalls and organizational impacts. Learn effective strategies for implementing threat modeling across your organization and improving overall security.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk

How I Can Unlock Your Smart Door - Security Pitfalls in Cross-Vendor IoT Access Control

Explores security vulnerabilities in cross-vendor IoT access control, focusing on delegation chains and authorization flaws in smart home devices and cloud platforms.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

The Price of Compatibility - Defeating macOS Kernel Using Extended File Attributes

Explore macOS kernel vulnerabilities through FAT filesystem implementation flaws, focusing on extended file attributes and their potential for launching attacks on the operating system.

• YouTube
• 36 minutes
• Self-Paced
• Conference Talk

The Motion Sensor Western - The Good, the Bad, and the Ugly

Explore security and privacy risks of motion sensors in IoT devices, including attacks on integrity, availability, confidentiality, and user privacy. Learn about implications and potential vulnerabilities.

• YouTube
• 30 minutes
• Self-Paced
• Conference Talk

Unprotected Broadcasts in Android 9 and 10

Uncover a critical Android vulnerability allowing unauthorized apps to send protected broadcast messages, impacting system security and user privacy across versions 9, 10, and 11 Developer Preview.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk

HTTP/2 - The Sequel is Always Worse

Explore HTTP/2 vulnerabilities, implementation flaws, and RFC imperfections. Learn advanced request smuggling techniques and their impact on major platforms like Netflix and Amazon.

• YouTube
• 38 minutes
• Self-Paced
• Conference Talk

Cross-Site Escape - Pwning macOS Safari Sandbox the Unusual Way

Explore a novel attack on macOS Safari sandbox using Cross-Site Scripting, achieving native code execution outside the sandbox without re-exploiting WebKit twice.

• YouTube
• 26 minutes
• Self-Paced
• Conference Talk

The Hunt for Major League IoT-ICS Threats - A Deep Dive into IoT Threat Terrain

Explore IoT security threats, automated threat hunting techniques, and advanced analysis methods to protect against malicious actions targeting millions of connected devices.

• YouTube
• 31 minutes
• Self-Paced
• Conference Talk