Black Hat Courses

Automatic Discovery of Evasion Vulnerabilities Using Targeted Protocol Fuzzing

Explore automatic discovery of evasion vulnerabilities in network protocols using targeted fuzzing. Learn about NGFW/IPS traffic inspection, protocol complexities, and strategies to detect and mitigate evasive attacks.

• YouTube
• 45 minutes
• On-Demand
• Conference Talk

Dealing the Perfect Hand - Shuffling Memory Blocks on Z/OS

Explore mainframe hacking techniques, from network protocols to buffer overflows, and learn to exploit z/OS vulnerabilities for critical system access.

• YouTube
• 46 minutes
• On-Demand
• Conference Talk

The Apple of Your EFI - An Updated Study of EFI Security

Comprehensive analysis of Apple's EFI security, examining updates across Mac models and OS versions. Explores EFI update mechanisms and controls, providing insights into Apple's security support practices.

• YouTube
• 1 hour 1 minute
• On-Demand
• Conference Talk

How to Rob a Bank Over the Phone - Lessons Learned from an Actual Social Engineering Engagement

Explore real-world social engineering tactics and defense strategies through an actual bank heist phone call, offering valuable insights for both attackers and defenders in cybersecurity.

• YouTube
• 48 minutes
• On-Demand
• Conference Talk

Self-Verifying Authentication - A Framework for Safer Integrations of Single-Sign-On Services

Explore SSO vulnerabilities and learn about SVX code verification for safer authentication integrations. Discover real-world applications of SVAuth in web apps.

• YouTube
• 57 minutes
• On-Demand
• Conference Talk

Nation-State Moneymule's Hunting Season – APT Attacks Targeting Financial Institutions

Unveiling recent operations by North Korean APT groups Lazarus, Bluenoroff, and Andariel, focusing on cyber heists and attacks targeting financial institutions.

• YouTube
• 1 hour 2 minutes
• On-Demand
• Conference Talk

Passive Fingerprinting of HTTP - 2 Clients

Explore passive fingerprinting techniques for HTTP/2 clients, analyzing millions of connections to extract unique user agent fingerprints across various implementations.

• YouTube
• 48 minutes
• On-Demand
• Conference Talk

Hiding PIN's Artifacts to Defeat Evasive Malware

Practical approach to enhance DBI tools' stealth and resilience against anti-instrumentation attacks, improving malware analysis and evasion detection techniques.

• YouTube
• 55 minutes
• On-Demand
• Conference Talk

By-Design Backdooring of Encryption System - Can We Trust Foreign Encryption Algorithms

Explores mathematical backdoors in encryption algorithms, discussing design, detection, and implications for cryptographic trust and control. Examines historical cases and future challenges in algorithm security.

• YouTube
• 50 minutes
• On-Demand
• Conference Talk

Skype and Type - Keystroke Leakage over VoIP

Revealing how VoIP software can leak keystroke information through audio, compromising user privacy. Presents S&T tool to demonstrate vulnerability in popular platforms like Skype and Google Hangouts.

• YouTube
• 24 minutes
• On-Demand
• Conference Talk

Intel SGX Remote Attestation is Not Sufficient

Explore the limitations of Intel SGX Remote Attestation for ensuring confidentiality and integrity of unmodified cloud applications.

• YouTube
• 50 minutes
• On-Demand
• Conference Talk

RBN Reloaded - Amplifying Signals from the Underground

Explore how combining SIGINT and HUMINT enhances threat intelligence, providing deeper insights into adversary tactics, intent, and vulnerabilities for improved cybersecurity decision-making.

• YouTube
• 34 minutes
• On-Demand
• Conference Talk

Garbage In, Garbage Out - How Purportedly Great Machine Learning Models Can Be Screwed Up by Bad Data

Explores how data quality impacts machine learning models for malicious URL detection, comparing results across different datasets and analyzing feature activations in neural networks.

• YouTube
• 28 minutes
• On-Demand
• Conference Talk

Free-Fall - Hacking Tesla from Wireless to CAN Bus

Detailed exploration of Tesla's security vulnerabilities, from wireless attacks to CAN bus access, including Tesla's response and new mitigation strategies.

• YouTube
• 45 minutes
• On-Demand
• Conference Talk

Quantifying Risk in Consumer Software at Scale - Consumer Reports' Digital Standard

Explore methodologies for quantifying software security risks, predicting vulnerabilities, and evaluating consumer products using the Digital Standard developed by Consumer Reports and CITL.

• YouTube
• 39 minutes
• On-Demand
• Conference Talk