Black Hat Courses

Lemons and Liability - Cyber Warranties as an Experiment in Software Regulation

1 review

Explore cyber warranties as a voluntary liability model for software security, examining their implications for policy-makers and the cybersecurity industry.

• YouTube
• 33 minutes
• On-Demand
• Conference Talk

From Dead Data to Digestion - Extracting Windows Fibers for Your Digital Forensics Diet

1 review

Explore Windows Fibers' undocumented internals, reverse APIs, and create detection telemetry from process memory. Learn about a new open-source tool for threat hunting and EDR development.

• YouTube
• 27 minutes
• On-Demand
• Conference Talk

Securing Your Big Data Environment

1 review

Explore strategies for securing big data environments, focusing on Hadoop. Learn about control frameworks, data protection techniques, and effective risk management for sensitive information.

• YouTube
• 42 minutes
• On-Demand
• Conference Talk

Owning a Building - Exploiting Access Control and Facility Management Systems

1 review

Explore vulnerabilities in building access control and facility management systems, uncovering potential security risks and exploitation techniques.

• YouTube
• 1 hour 5 minutes
• On-Demand
• Conference Talk

Supply Chain Infections and the Future of Contactless Deliveries

1 review

Explore supply chain risks, their consequences, and industry mitigation strategies in light of recent challenges. Gain insights into software integrity and future security measures.

• YouTube
• 1 hour 4 minutes
• On-Demand
• Conference Talk

Dynamic Binary Instrumentation Techniques to Address Native Code Obfuscation

1 review

Explore dynamic binary instrumentation techniques for tackling obfuscated Android app code, aiding reverse engineers in overcoming anti-analysis protections.

• YouTube
• 40 minutes
• On-Demand
• Conference Talk

A Run a Day Won't Keep the Hacker Away - Inference Attacks in Fitness Tracking Social Networks

Explore inference attacks on fitness tracking social networks, revealing vulnerabilities in endpoint privacy zones and discussing implications for user privacy and location protection.

• YouTube
• 39 minutes
• On-Demand
• Conference Talk

A New Attack Interface in Java Applications

Explores a newly discovered attack surface in Java applications, focusing on JDBC vulnerabilities in cloud-native systems and customized database management services.

• YouTube
• 40 minutes
• On-Demand
• Conference Talk

Alice in Kernel Land - Lessons Learned From the eBPF Rabbit Hole

Explore eBPF technology for kernel-level programming, runtime code loading, and performance optimization. Learn key concepts, security implications, and practical applications in this deep dive.

• YouTube
• 38 minutes
• On-Demand
• Conference Talk

Abusing Azure Active Directory - From MFA Bypass to Listing Global Administrators

Explore Azure AD vulnerabilities, including MFA bypass and global admin listing, to understand potential security risks in this widely-used identity management solution.

• YouTube
• 38 minutes
• On-Demand
• Conference Talk

Back-Connect to the Connected Car - Search for Vulnerabilities in the VW Electric Car

Exploración de vulnerabilidades en vehículos eléctricos Volkswagen, demostrando acceso root a módulos de infoentretenimiento y puerta de enlace, e implicaciones para la seguridad de los coches conectados.

• YouTube
• 34 minutes
• On-Demand
• Conference Talk

DataBinding2Shell - Novel Pathways to RCE Web Frameworks

Explores security vulnerabilities in DataBinding mechanisms of popular web frameworks, uncovering novel remote code execution pathways and highlighting overlooked risks in automatic parameter binding.

• YouTube
• 37 minutes
• On-Demand
• Conference Talk

Fail Harder - Finding Critical 0-Days in Spite of Ourselves

Explore the journey of vulnerability researchers, including failures and challenges, in discovering critical zero-day bugs across various projects. Learn persistence strategies for success in cybersecurity.

• YouTube
• 38 minutes
• On-Demand
• Conference Talk

Confidence in Chaos - Strategies for World-Class Security Operations

Actionable strategies for enhancing cybersecurity operations in dynamic environments, focusing on threat intelligence, data collection, and analyst workflow optimization to address evolving challenges.

• YouTube
• 32 minutes
• On-Demand
• Conference Talk

Breaking Kerberos' RC4 Cipher and Spoofing Windows PACs

Explore vulnerabilities in Kerberos RC4 encryption, including cryptographic flaws and potential exploits in Active Directory, with insights on computing MD5 collisions and PAC authorization data manipulation.

• YouTube
• 41 minutes
• On-Demand
• Conference Talk