Black Hat Courses

Bug Hunters Dump User Data - Can They Keep It? Well They're Keeping It Anyway

Explores legal and ethical implications of security researchers handling sensitive user data during bug bounty disclosures, examining responsibilities and potential consequences for all parties involved.

• YouTube
• 37 minutes
• Self-Paced
• Conference Talk

The Growth of Global Election Disinformation - The Role and Methodology of Government-Linked Cyber Actors

Explore how government-linked cyber actors influence elections through disinformation campaigns, focusing on a case study from Colombia's 2022 elections and strategies for detecting such operations.

• YouTube
• 30 minutes
• Self-Paced
• Conference Talk

The Journey of Hunting In-the-Wild Windows LPE 0day

Explore techniques for detecting and capturing in-the-wild Windows Local Privilege Escalation vulnerabilities, including methodology development and continuous improvement strategies.

• YouTube
• 32 minutes
• Self-Paced
• Conference Talk

Scaling the Security Researcher to Eliminate OSS Vulnerabilities Once and For All

Explore automated security vulnerability detection and fixing in open-source software, including techniques like OpenRewrite and control flow analysis for efficient, large-scale remediation.

• YouTube
• 38 minutes
• Self-Paced
• Conference Talk

DirectX - The New Hyper-V Attack Surface

Explore vulnerabilities in Hyper-V's GPU-Paravirtualization feature, examining 4 fixed DirectX component issues and their implications for virtualization security.

• YouTube
• 28 minutes
• Self-Paced
• Conference Talk

Revealing the Secrets of Siemens S7 PLCs

Uncover vulnerabilities in Siemens ET 200SP SoftPLC, exploring its architecture, boot process, and potential attack vectors. Learn about PC-based PLCs and their security implications in industrial control systems.

• YouTube
• 29 minutes
• Self-Paced
• Conference Talk

Chasing Your Tail With a Raspberry Pi

Methodology for detecting wireless signal tracking using low-cost hardware and Python. Covers SIGINT techniques, MAC address randomization, and provides code for DIY implementation.

• YouTube
• 28 minutes
• Self-Paced
• Conference Talk

Eliminating Triage Intermediaries for Zero-day Exploits Using a Decentralised Payout Protocol

Explore a protocol for collectivizing security bounties, enabling companies to showcase software security and ethical hackers to retrieve bounties without ambiguity, eliminating subjectivity in triage processes.

• YouTube
• 23 minutes
• Self-Paced
• Conference Talk

Déjà Vu - Uncovering Stolen Algorithms in Commercial Products

Techniques for detecting unauthorized use of algorithms in commercial products, including search methods, reverse-engineering, and a real-world case study. Provides strategies for addressing IP theft and prevention.

• YouTube
• 26 minutes
• Self-Paced
• Conference Talk

Ghost in the Wireless - iwlwifi Edition

Explore Intel Wi-Fi chip vulnerabilities through reverse-engineering, uncovering firmware exploits and code execution risks in complex features like Wake-on-WLAN and TDLS.

• YouTube
• 28 minutes
• Self-Paced
• Conference Talk

Cautious - A New Exploitation Method! No Pipe but as Nasty as Dirty Pipe

Unveils a novel exploitation technique surpassing Dirty Pipe, enabling arbitrary file overwriting and privilege escalation through double-free vulnerabilities, applicable across affected kernel versions.

• YouTube
• 31 minutes
• Self-Paced
• Conference Talk

Controlling the Source - Abusing Source Code Management Systems

Explore vulnerabilities in Source Code Management systems, including reconnaissance, user role manipulation, and repository takeover. Learn attack scenarios and defensive strategies for GitHub, GitLab, and Bitbucket.

• YouTube
• 37 minutes
• Self-Paced
• Conference Talk

Do Not Trust the ASA, Trojans

Explore vulnerabilities in Cisco ASA firewalls, including ASDM package verification issues and FirePOWER module exploits. Learn to create malicious packages and gain root access.

• YouTube
• 32 minutes
• Self-Paced
• Conference Talk

Go With the Flow - Enforcing Program Behavior Through Syscall Sequences and Origins

Explore syscall-flow-integrity protection (SFIP) to enhance application security by limiting control flow across user-to-kernel transfers, addressing vulnerabilities in complex software systems.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

How Firefox Uses In-process Sandboxing to Protect Itself From Exploitable Libraries

Explore Firefox's innovative approach to mitigating zero-day attacks using in-memory sandboxes for third-party C libraries, enhancing security against memory safety vulnerabilities.

• YouTube
• 23 minutes
• Self-Paced
• Conference Talk