Attack Surface Analysis Courses and Certifications

Black Hat

Reflections on Trusting TrustZone

Explore TrustZone security, vulnerabilities, and exploitation techniques in ARM devices. Gain insights into real-world implications and see a live demonstration of bootloader unlocking.

• YouTube
• 39 minutes
• On-Demand
• Conference Talk

Black Hat

PinPadPwn

Explore vulnerabilities in payment terminals, including memory corruption issues and potential attack vectors. Learn about code execution risks and discuss profitable payloads for attackers.

• YouTube
• 59 minutes
• On-Demand
• Conference Talk

Black Hat

BLEEDINGBIT - Your APs Belong to Us

Explore zero-day vulnerabilities in BLE chips, allowing unauthenticated network penetration. Learn about BLEEDINGBIT, its impact on enterprise APs, and potential attack scenarios.

• YouTube
• 47 minutes
• On-Demand
• Conference Talk

OWASP Foundation

OWASP IoT Top 10 - Understanding Security Issues in Internet of Things

Explore key security vulnerabilities in IoT technologies and learn strategies to build, deploy, and assess IoT systems more securely with insights from the OWASP Internet of Things Project.

• YouTube
• 21 minutes
• On-Demand
• Free Video

Black Hat

Analyzing & Breaking QNX Exploit Mitigations and PRNGs for Embedded Systems

Dissection of QNX's security features, including exploit mitigations and random number generators, for embedded systems in automotive, industrial, defense, and medical sectors.

• YouTube
• 54 minutes
• On-Demand
• Conference Talk

OffensiveCon

Embedded Threats: A Deep Dive into the Attack Surface and Security Implications of eSIM Technology

Explore the attack surface and security implications of eSIM technology through a comprehensive deep dive into embedded threats.

• YouTube
• 54 minutes
• On-Demand
• Free Video

Comparing Risks: Why Asset Management Is Broken and How to Fix It

Explore innovative approaches to asset management in cybersecurity, focusing on risk comparison, vulnerability prioritization, and effective remediation strategies for improved security outcomes.

• YouTube
• 52 minutes
• On-Demand
• Free Video

Hacking Identity - A Pen Tester's Guide to IAM - Jerod Brennen

Comprehensive guide to identity and access management security, covering attack surfaces, pen testing processes, and best practices for securing user lifecycles and admin privileges.

• YouTube
• 1 hour 2 minutes
• On-Demand
• Conference Talk

USENIX

Hell of a Handshake - Abusing TCP for Reflective Amplification DDoS Attacks

Explores TCP-based amplification DDoS attacks, revealing vulnerabilities in the handshake process and identifying thousands of potential amplifiers through Internet-wide scans of common TCP protocols.

• YouTube
• 16 minutes
• On-Demand
• Conference Talk

HackerOne

Security at Government Agencies - Hacking the US Government

Experts discuss hacking US government systems, vulnerability disclosure programs, and cybersecurity challenges in federal agencies. Insights on bug bounties, tech surges, and public-facing systems.

• YouTube
• 41 minutes
• On-Demand
• Free Video

Recon Conference

Subverting Your Server Through Its BMC - The HPE iLO4 Case

Exploración profunda de la seguridad de HP iLO4, incluyendo análisis del firmware, vulnerabilidades y una nueva técnica de explotación para comprometer el sistema operativo del servidor host a través de DMA.

• YouTube
• 49 minutes
• On-Demand
• Conference Talk

Black Hat

Hunting for Bugs, Catching Dragons

Explore email exploit research, focusing on Outlook and Exchange vulnerabilities. Learn about attack surfaces, RTF issues, and various entry points for discovering and addressing security flaws.

• YouTube
• 43 minutes
• On-Demand
• Conference Talk

Black Hat

Subverting Sysmon - Application of a Formalized Security Product Evasion Methodology

Explore methodologies for subverting Sysmon, a security monitoring tool, through data collector strategies and configuration analysis to enhance adversarial techniques against enterprise defenses.

• YouTube
• 50 minutes
• On-Demand
• Conference Talk

Black Hat

Understanding the Attack Surface and Attack Resilience of Project Spartan's New EdgeHTML Rendering Engine

Explore EdgeHTML's attack surface, compare it with MSHTML, and analyze exploit mitigations in Windows 10's new rendering engine for enhanced web security understanding.

• YouTube
• 40 minutes
• On-Demand
• Conference Talk

BSidesLV

Managing Security with the OWASP Assimilation Project

Explore continuous discovery, scalability, and human monitoring in cybersecurity with the OWASP Assimilation Project. Learn about architecture, attack surface analysis, and practical demonstrations.

• YouTube
• 40 minutes
• On-Demand
• Conference Talk