Black Hat Courses

The Case for a National Cybersecurity Safety Board

Explores the need for a National Cybersecurity Safety Board to investigate and prevent cyber attacks, drawing parallels with the NTSB and addressing critical infrastructure vulnerabilities.

• YouTube
• 32 minutes
• On-Demand
• Conference Talk

President's Cup Cyber Competition - Finding the Best Cyber Talent in the US Government

Explore the behind-the-scenes story of the President's Cup Cybersecurity Competition, designed to identify and challenge top US government cyber talent.

• YouTube
• 34 minutes
• On-Demand
• Conference Talk

Bringing the Power of Symbolic Execution to the Fight Against Malicious Excel 4 Macros

Explore Symbexcel, a tool using symbolic execution to analyze and detect malicious Excel 4.0 macros, enhancing cybersecurity against this common attack vector.

• YouTube
• 35 minutes
• On-Demand
• Conference Talk

The Dark Age of Memory Corruption Mitigations in the Spectre Era

Explores how speculative execution attacks can bypass memory corruption defenses, challenging established security measures and revealing vulnerabilities in modern computer systems.

• YouTube
• 35 minutes
• On-Demand
• Conference Talk

Your Software IS - NOT Vulnerable - CSAF, VEX, and the Future of Advisories

Explore the future of software security advisories, focusing on CSAF and VEX, and learn how to manage the increasing volume of vulnerability information effectively.

• YouTube
• 24 minutes
• On-Demand
• Conference Talk

How I Used a JSON Deserialization 0day to Steal Your Money on the Blockchain

Explore a JSON deserialization vulnerability in Fastjson, its exploitation for remote code execution, and implications for blockchain security.

• YouTube
• 40 minutes
• On-Demand
• Conference Talk

Disappeared Coins - Steal Hashrate in Stratum Secretly

Unveils two novel man-in-the-middle attack schemes on Stratum, the main communication protocol for cryptocurrency mining pools, potentially compromising miners' computing power.

• YouTube
• 27 minutes
• On-Demand
• Conference Talk

The Cost of Complexity - Different Vulnerabilities While Implementing the Same RFC

Exploring security vulnerabilities in DNS implementations due to complexity and ambiguity in RFC 1035, focusing on message compression and its impact on TCP/IP stacks.

• YouTube
• 36 minutes
• On-Demand
• Conference Talk

Hunting Vulnerabilities of gRPC Protocol Armed Mobile - IoT Applications

Explore security vulnerabilities in gRPC-powered mobile and IoT apps. Learn about common pitfalls, attack vectors, and strategies to enhance protection in this high-performance protocol.

• YouTube
• 33 minutes
• On-Demand
• Conference Talk

Racing the Dark - A New TOCTTOU Story From Apple's Core

Unveils macOS kernel vulnerabilities, highlighting memory mapping issues and race conditions that bypass security updates. Emphasizes the need to reevaluate macOS/iOS memory mapping mechanisms.

• YouTube
• 35 minutes
• On-Demand
• Conference Talk

We Are About to Land - How CloudDragon Turns a Nightmare Into Reality

Explore CloudDragon's advanced cyber tactics, including supply chain and cross-platform attacks. Gain insights into APT group operations and their evolving techniques in this cybersecurity analysis.

• YouTube
• 35 minutes
• On-Demand
• Conference Talk

Pre-built JOP Chains with the JOP ROCKET - Bypassing DEP without ROP

Explore Jump-oriented Programming (JOP) as an alternative to ROP for code-reuse attacks. Learn about the JOP ROCKET tool for creating pre-built JOP chains to bypass DEP without ROP.

• YouTube
• 37 minutes
• On-Demand
• Conference Talk

Hey, You, Get off My Private Data - Do Apps Respect Your Privacy as They Claim?

Explore multinational data protection regulations and assess app compliance. Learn about privacy policies, GDPR principles, and techniques for evaluating personal data handling in mobile applications.

• YouTube
• 37 minutes
• On-Demand
• Conference Talk

Vibe Check - Why Students May Shy Away From Cyber in a Surveillance State

Explores impact of surveillance and strict laws on cyber talent in Asia Pacific, discussing challenges for ethical hacking and threat research in a censorship-heavy environment.

• YouTube
• 37 minutes
• On-Demand
• Conference Talk

A Mirage of Safety - Bug Finding & Exploit Techniques of Top Android Vendor's Privacy Protection Apps

Uncovers vulnerabilities in popular Android privacy protection apps, revealing security flaws and exploit techniques. Offers insights on improving mobile data security and privacy safeguards.

• YouTube
• 22 minutes
• On-Demand
• Conference Talk