Black Hat Courses

The Living Dead - Hacking Mobile Face Recognition SDKs with Non-Deepfake Attacks

Explore vulnerabilities in mobile face recognition systems, focusing on non-deepfake attacks that bypass liveness detection. Learn about security flaws in popular SDKs and their implications for critical applications.

• YouTube
• 37 minutes
• On-Demand
• Conference Talk

Video-Based Cryptanalysis - Recovering Cryptographic Keys from Device Using Video of Power LED

Innovative cryptanalysis technique exploits power LED video footage to recover secret keys from devices, using rolling shutter for high-speed sampling and RGB analysis for key extraction.

• YouTube
• 40 minutes
• On-Demand
• Conference Talk

Poisoning Web-Scale Training Datasets is Practical

Explore strategies for creating large datasets and two attacks exploiting these mechanics, revealing vulnerabilities in deep learning models trained on internet-sourced data.

• YouTube
• 33 minutes
• On-Demand
• Conference Talk

Mirage - Cyber Deception Against Autonomous Cyber Attacks

Explore novel cyber deceptions targeting weaknesses in AI-driven attacks and an emulation system for evaluating deceptions and adversaries at scale.

• YouTube
• 31 minutes
• On-Demand
• Conference Talk

The Yandex Leak - How a Russian Search Giant Uses Consumer Data

Explore the implications of Yandex's leaked source code, revealing insights into data collection practices and behavioral analytics technologies used by the Russian search giant.

• YouTube
• 33 minutes
• On-Demand
• Conference Talk

The Most Dangerous Codec in the World - Finding and Exploiting Vulnerabilities in H.264 Decoders

Uncover hidden security risks in H.264 video decoders using H26Forge framework. Learn to craft video files exposing edge cases and potential vulnerabilities in this complex, privileged ecosystem.

• YouTube
• 27 minutes
• On-Demand
• Conference Talk

PPLdump Is Dead - Long Live PPLdump

Explore Windows Protected Process Light (PPL) mechanism, its vulnerabilities, and historical exploits. Learn about PPLdump, its impact on system security, and Microsoft's approach to PPL-related vulnerabilities.

• YouTube
• 30 minutes
• On-Demand
• Conference Talk

PMFault - Voltage Fault Injection on Server Platforms Through the PMBus

Explore voltage fault injection attacks on server platforms via PMBus, revealing vulnerabilities in power management systems and discussing potential security implications for data centers.

• YouTube
• 27 minutes
• On-Demand
• Conference Talk

Prototype Pollution Leads to RCE - Gadgets Everywhere

Explore how Prototype Pollution vulnerabilities in JavaScript can lead to remote code execution, analyzing Node.js core code and NPM packages for potential security risks.

• YouTube
• 40 minutes
• On-Demand
• Conference Talk

Phoenix Domain Attack - Vulnerable Links in Domain Name Delegation and Revocation

Explore a novel DNS attack allowing adversaries to maintain revoked malicious domains, affecting mainstream DNS software and public resolvers. Learn about vulnerabilities in domain name delegation processes.

• YouTube
• 26 minutes
• On-Demand
• Conference Talk

Operation Clairvoyance - How APT Groups Spy on the Media Industry

Explore how APT groups target Taiwan's media industry for cyber espionage, focusing on their tactics, motivations, and impact on daily activities and national security.

• YouTube
• 32 minutes
• On-Demand
• Conference Talk

New Wine in an Old Bottle - Attacking Chrome WebSQL

Explore Chrome WebSQL vulnerabilities and a mutation-based fuzzer for discovering SQLite bugs, enhancing web application security against remote attacks.

• YouTube
• 31 minutes
• On-Demand
• Conference Talk

Technology and the 4 Vs - A Story of Cybersecurity Innovation and Ethics

Explore the intersection of cybersecurity, AI, and ethical innovation as CISA Director Jen Easterly examines how technology narratives shape our collective digital future and security landscape.

• YouTube
• 26 minutes
• On-Demand
• Free Video

QuickShell - Sharing is Caring About an RCE Attack Chain on Quick Share

Discover how researchers uncovered 10 vulnerabilities in Google's Quick Share, leading to QuickShell - a complex RCE attack chain exploiting file sharing protocols on Windows and Android.

• YouTube
• 39 minutes
• On-Demand
• Free Video

DriveThru Car Hacking - Fast Food, Faster Data Breach

Discover how dashcams can be compromised in minutes through automated DriveThru attacks, exposing private data and conversations with live demos and countermeasures.

• YouTube
• 37 minutes
• On-Demand
• Free Video