Black Hat Courses

Compromising LLMs - The Advent of AI Malware

Explore the security risks of AI integration, focusing on prompt injections and potential malware in language models. Learn about future challenges and consequences for AI assistants.

• YouTube
• 36 minutes
• Self-Paced
• Conference Talk

Risks of AI Risk Policy - Five Lessons

Explores challenges in implementing AI risk management frameworks, highlighting five key roadblocks faced by stakeholders when operationalizing standards like NIST AI RMF and EU AI Act.

• YouTube
• 34 minutes
• Self-Paced
• Conference Talk

EDR - Erase Data Remotely, By Cooking An Unforgettable Byte Signature Dish

Discover a new vulnerability allowing remote deletion of critical files through endpoint security controls' byte signature detection logic, potentially causing severe data loss and DOS attacks.

• YouTube
• 39 minutes
• Self-Paced
• Conference Talk

Devising and Detecting Phishing - Large Language Models vs. Smaller Human Models

Explore the effectiveness of AI-generated phishing emails compared to traditional methods, revealing surprising results and implications for cybersecurity strategies.

• YouTube
• 34 minutes
• Self-Paced
• Conference Talk

The Hat Trick - Exploit Chrome Twice from Runtime to JIT

Explore Chrome vulnerabilities in V8's Maglev compiler, uncovering security risks in JS optimization and compilation processes for advanced browser exploitation techniques.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

Over the Air, Under the Radar - Attacking and Securing the Pixel Modem

Explore Android Red Team's proactive security approach for Google Pixel devices, focusing on modem vulnerabilities and protection strategies against remote compromises.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

Core Escalation - Unleashing the Power of Cross-Core Attacks on Heterogeneous System

Explore cross-core attacks on complex smartphone SoCs, examining vulnerabilities in multi-processor systems and their impact on overall device security. Learn about real-world examples and potential defense strategies.

• YouTube
• 34 minutes
• Self-Paced
• Conference Talk

Make KSMA Great Again - The Art of Rooting Android Devices by GPU MMU Features

Explores advanced Android rooting techniques using GPU MMU features, overcoming hardware and software mitigations in Android 13 devices through innovative exploitation methods.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

Second Breakfast - Implicit and Mutation-Based Serialization Vulnerabilities in .NET

Novel attacks against .NET serialization bypassing current mitigations, including exploits on platforms without well-known serializers and mutation attacks. Demonstrates vulnerabilities in popular databases and serializers.

• YouTube
• 24 minutes
• Self-Paced
• Conference Talk

Evasive Maneuvers - Trends in Phishing Evasion & Anti-Evasion

Explore cutting-edge phishing evasion tactics and anti-evasion strategies across various digital channels. Learn to identify and counter sophisticated threats in today's evolving cybersecurity landscape.

• YouTube
• 30 minutes
• Self-Paced
• Conference Talk

Route to Bugs - Analyzing the Security of BGP Message Parsing

Explore vulnerabilities in BGP message parsing, crucial for Internet routing and data center operations. Uncover security risks in open-source implementations following Network Function Disaggregation trends.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

Bad io_uring - A New Era of Rooting for Android

Explore privilege escalation on Android devices using io_uring vulnerabilities, focusing on CVE-2022-20409 exploitation on Google Pixel 6 and Samsung S22.

• YouTube
• 27 minutes
• Self-Paced
• Conference Talk

Small Leaks, Billions of Dollars - Practical Cryptographic Exploits That Undermine Crypto Wallets

Explore vulnerabilities in Multi-Party Computation protocols used by major cryptocurrency wallets, revealing potential security risks and challenges in protecting billions in digital assets.

• YouTube
• 36 minutes
• Self-Paced
• Conference Talk

Harry Parser and the Cursed Tracker - Breaking the Spell of Online Data Collection

Uncover hidden secrets of online tracking and data collection. Learn about first-party and third-party trackers, regulatory loopholes, and OSINT techniques to understand how companies collect and share your online data.

• YouTube
• 32 minutes
• Self-Paced
• Conference Talk

Input Output + Syslog - Obtaining Data From Locked iOS Devices via Live Monitoring

Discover techniques to extract significant data from locked iOS devices through USB monitoring and live system log capture, without needing passwords or device unlocks.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk