Black Hat Courses

Crash & Pay - How to Own and Clone Contactless Payment Devices

Explore NFC payment vulnerabilities, cloning techniques, and security mechanisms. Learn to set up a testing lab and conduct fraudulent transactions using off-the-shelf devices.

• YouTube
• 39 minutes
• Self-Paced
• Conference Talk

Back Doors and Front Doors - Breaking the Unbreakable System

Exploring government demands for backdoor access to encrypted data, examining proposed solutions, and discussing the balance between security and privacy in digital communications.

• YouTube
• 51 minutes
• Self-Paced
• Conference Talk

SMBv2 - Sharing More Than Just Your Files

Unveils a new attack vector against SMBv2, affecting all IE versions. Demonstrates remote credentials theft and user impersonation from the internet, exploiting bugs for complete user compromise without interaction.

• YouTube
• 43 minutes
• Self-Paced
• Conference Talk

How Federal Prosecutors Use The CFAA

Explore the Computer Fraud and Abuse Act through a federal prosecutor's lens. Gain insights into charging decisions, sentencing factors, and balancing security research with law enforcement needs.

• YouTube
• 1 hour 9 minutes
• Self-Paced
• Conference Talk

Social Engineering the Windows Kernel - Finding and Exploiting Token Handling Vulnerabilities

Explore Windows kernel token handling vulnerabilities, learn to identify and exploit them for privilege escalation, and understand patterns for conducting security reviews.

• YouTube
• 43 minutes
• Self-Paced
• Conference Talk

Pen Testing a City

Comprehensive methodology for reverse engineering and securing cities' IT infrastructure, exploring vulnerabilities and developing strategies for penetration testing and defense at the urban scale.

• YouTube
• 50 minutes
• Self-Paced
• Conference Talk

Fingerprints on Mobile Devices - Abusing and Leaking

Explore vulnerabilities in mobile fingerprint authentication, including authorization attacks, sensor spying, and backdoors. Learn to secure fingerprints and mitigate risks in this eye-opening analysis.

• YouTube
• 39 minutes
• Self-Paced
• Conference Talk

Universal Android Rooting Is Back

Explore universal Android rooting through kernel exploitation, focusing on a Use-After-Free bug affecting all Linux versions. Learn about innovative techniques for 64-bit devices and bypassing modern kernel mitigations.

• YouTube
• 42 minutes
• Self-Paced
• Conference Talk

The Memory Sinkhole - Unleashing An X86 Design Flaw Allowing Universal Privilege Escalation

Unveiling a critical x86 design flaw allowing privilege escalation, exploring forgotten backdoors, and demonstrating how to exploit vulnerabilities in processor architecture.

• YouTube
• 47 minutes
• Self-Paced
• Conference Talk

Commercial Mobile Spyware - Detecting The Undetectable

Uncover techniques to detect and protect against commercial mobile spyware, safeguarding personal privacy and corporate security in an era of increasing digital surveillance.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk

Attacking Hypervisors Using Firmware and Hardware

Explore vulnerabilities in hypervisors through firmware and hardware emulation, demonstrating attacks and their impacts. Learn about firmware rootkits and new testing modules for hypervisor security.

• YouTube
• 51 minutes
• Self-Paced
• Conference Talk

GameOver Zeus - Badguys and Backends

Detailed exploration of GameOver Zeus botnet, covering its operators, law enforcement investigation, and innovative legal strategies used to dismantle the cybercriminal network.

• YouTube
• 50 minutes
• Self-Paced
• Conference Talk

Winning the Online Banking War

Explore advanced techniques to combat banking malware, including evasion methods and a novel Zero Knowledge Protocol-based approach for securing client-server communications.

• YouTube
• 49 minutes
• Self-Paced
• Conference Talk

Android Security State of the Union

Explore key factors driving Android security using data from millions of devices, establishing a baseline and identifying areas for community focus and research.

• YouTube
• 49 minutes
• Self-Paced
• Conference Talk

From False Positives to Actionable Analysis

Modeling human behavior in network traffic to automatically label security events, using distributed forensic AI for threat detection and response optimization.

• YouTube
• 45 minutes
• Self-Paced
• Conference Talk