Black Hat Courses

Squeezing a Key through a Carry Bit

Explore a practical key recovery attack on Go's P-256 elliptic curve implementation, targeting JSON Web Encryption through a subtle carry bit bug.

• YouTube
• 46 minutes
• Self-Paced
• Conference Talk

Your Voice is My Passport

Explore machine learning's impact on voice authentication security, including synthetic audio generation and potential vulnerabilities in financial and home automation systems.

• YouTube
• 36 minutes
• Self-Paced
• Conference Talk

Are You Trading Stocks Securely? Exposing Security Flaws in Trading Technologies

Exposing security vulnerabilities in electronic trading platforms, highlighting risks in mobile, desktop, and web applications for investors of all levels.

• YouTube
• 51 minutes
• Self-Paced
• Conference Talk

ARTist - A Novel Instrumentation Framework for Reversing and Analyzing Android Apps and the Middleware

Explore Android Runtime security with ARTist, a novel instrumentation framework for analyzing apps and middleware. Learn deployment, modules, and creation techniques.

• YouTube
• 20 minutes
• Self-Paced
• Conference Talk

Subverting Sysmon - Application of a Formalized Security Product Evasion Methodology

Explore methodologies for subverting Sysmon, a security monitoring tool, through data collector strategies and configuration analysis to enhance adversarial techniques against enterprise defenses.

• YouTube
• 50 minutes
• Self-Paced
• Conference Talk

I, for One, Welcome Our New Power Analysis Overlords

Introduces ChipWhisperer-Lint, an open-source tool for automating power analysis attacks on devices using ChipWhisperer hardware, enhancing security testing capabilities.

• YouTube
• 26 minutes
• Self-Paced
• Conference Talk

Lessons from Virginia - A Comparative Forensic Analysis of WinVote Voting Machines

Forensic analysis of WinVote machines reveals security flaws and vulnerabilities in electronic voting systems, highlighting the importance of robust election technology and auditing processes.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk

Two-Factor Authentication, Usable or Not? - A Two-Phase Usability Study of the FIDO U2F Security Key

Explore the usability of FIDO U2F Security Keys for two-factor authentication through a comprehensive two-phase study, evaluating effectiveness and user experience.

• YouTube
• 22 minutes
• Self-Paced
• Conference Talk

Decompiler Internals - Microcode

Explore the intermediate language used in Hex-Rays Decompiler, understanding its simplicity and power in representing complex programs.

• YouTube
• 50 minutes
• Self-Paced
• Conference Talk

The Air-Gap Jumpers

Explore covert channels for breaching air-gap isolation, including electromagnetic, acoustic, and optical methods. Learn about 'Bridgeware' malware and new air-jumping techniques.

• YouTube
• 24 minutes
• Self-Paced
• Conference Talk

Why so Spurious? Achieving Local Privilege Escalation on Operating Systems

Explore a critical x86 architecture vulnerability exploitable for local privilege escalation across Windows, macOS, and Linux. Learn about this widespread security issue and its implications.

• YouTube
• 49 minutes
• Self-Paced
• Conference Talk

The Problems and Promise of WebAssembly

Explore WebAssembly's features, vulnerabilities, and future security concerns in this comprehensive overview, with practical examples and insights.

• YouTube
• 21 minutes
• Self-Paced
• Conference Talk

Breaking Parser Logic - Take Your Path Normalization Off and Pop 0days Out

Explore path normalization vulnerabilities, their impact on web security, and techniques to exploit them for bypassing access controls and achieving remote code execution.

• YouTube
• 43 minutes
• Self-Paced
• Conference Talk

Snooping on Cellular Gateways and Their Critical Role in ICS

Explore vulnerabilities in cellular devices used for IoT and ICS connectivity, focusing on Sierra Wireless and other manufacturers' products. Learn about the security implications of always-on, available-anywhere connectivity.

• YouTube
• 45 minutes
• Self-Paced
• Conference Talk

Behind the Speculative Curtain - The True Story of Fighting Meltdown and Spectre

Insider account of the urgent response to Meltdown and Spectre vulnerabilities, revealing the challenges and decisions faced by cybersecurity experts during a critical disclosure situation.

• YouTube
• 48 minutes
• Self-Paced
• Conference Talk