Black Hat Courses

The Paramedic's Guide to Surviving Cybersecurity

Lessons from emergency medical response show cybersecurity practitioners how to handle incidents more effectively while protecting their mental resilience.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

The Dark Side of the Cloud - How a Lack of EMR Security Controls Helped Amplify the Opioid Crisis

A security gap in Practice Fusion’s clinical decision support let a pharmaceutical company influence opioid treatment recommendations and contribute to the crisis.

• YouTube
• 32 minutes
• Self-Paced
• Conference Talk

CloudLeak - DNN Model Extractions from Commercial MLaaS Platforms

Examines how deep neural network models can be extracted from commercial machine learning as a service platforms.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

Hunting Invisible Salamanders - Cryptographic Insecurity with Attacker-Controlled Keys

Examines how attacker-known or guessable keys expose weaknesses in authenticated encryption, including GCM and encrypted messaging protocols.

• YouTube
• 31 minutes
• Self-Paced
• Conference Talk

When Lightning Strikes Thrice - Breaking Thunderbolt 3 Security

Thunderspy demonstrates attacks that defeat Thunderbolt 1, 2, and 3 security claims, including trusted-device authorization and cryptographic connection authentication.

• YouTube
• 42 minutes
• Self-Paced
• Conference Talk

NoJITsu - Locking Down JavaScript Engines

An examination of data-only attacks that corrupt optimizing JIT compiler representations and defenses for JavaScript engines.

• YouTube
• 32 minutes
• Self-Paced
• Conference Talk

Building a Vulnerability Disclosure Program That Works for Election Vendors and Hackers

Examines how election vendors and security researchers can build vulnerability disclosure programs through collaboration, crowdsourced testing, and continuous security work.

• YouTube
• 39 minutes
• Self-Paced
• Conference Talk

Uncommon Sense - Detecting Exploits with Novel Hardware Performance Counters and ML Magic

A security briefing on using less familiar hardware performance counters and machine learning to detect exploits that known counters may miss.

• YouTube
• 44 minutes
• Self-Paced
• Conference Talk

Policy Implications of Faulty Cyber Risk Models and How to Fix Them

Examines how flawed estimates of cyber incident frequency and losses shape security policy, and how better historical data can improve them.

• YouTube
• 46 minutes
• Self-Paced
• Conference Talk

Room for Escape - Scribbling Outside the Lines of Template Security

Examines how template engines and SharePoint controls can be escaped to expose server-side resources.

• YouTube
• 39 minutes
• Self-Paced
• Conference Talk

Breaking Brains, Solving Problems - Lessons Learned from 2 Years of Setting Puzzles for InfoSec Pros

Two years of designing puzzles for security professionals reveal how people solve problems, where they get stuck, and how they can improve.

• YouTube
• 41 minutes
• Self-Paced
• Conference Talk

Exploiting Excel Online

A case study of exploiting Excel Online, from an integer overflow in fnConcatenate to server-side code execution through chained formulas.

• YouTube
• 41 minutes
• Self-Paced
• Conference Talk

Dive into Apple IO80211FamilyV2

An examination of Apple’s IO80211FamilyV2 Wi-Fi driver architecture through vulnerability cases, reverse engineering, root-cause analysis, and Wi-Fi fuzzing.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

Reversing the Root - Identifying the Exploited Vulnerability in 0-Days Used In-The-Wild

Methods for tracing exploited zero-days to their root cause, from patch diffing and test-case minimization to manual exploit reverse engineering.

• YouTube
• 42 minutes
• Self-Paced
• Conference Talk

Experimenting with Real-Time Event Feeds

A security operations talk on testing real-time event feeds to decide which events merit collection, detection, and storage.

• YouTube
• 28 minutes
• Self-Paced
• Conference Talk