Conference Talks

Black Hat

When TLS Hacks You

This talk shows how TLS features can enable cross-platform SSRF attacks against internal services.

• YouTube
• 30 minutes
• Self-Paced
• Conference Talk

Black Hat

Decade of the RATs – Custom Chinese Linux Rootkits for Everyone

A detailed account of a decade-long state-sponsored espionage campaign using handcrafted Linux malware, including kernel rootkits and an attacker control panel.

• YouTube
• 36 minutes
• Self-Paced
• Conference Talk

Black Hat

Whispers Among the Stars - A Practical Look at Perpetrating Satellite Eavesdropping Attacks

Explore how inexpensive television equipment can intercept satellite broadband communications and how custom software evaluates vulnerabilities across DVB-S MPE and DVB-S2 GSE protocols.

• YouTube
• 37 minutes
• Self-Paced
• Conference Talk

Black Hat

Remote Timing Attacks on TPMs - AKA TPM-Fail

A black-box analysis of TPM 2.0 devices reveals secret-dependent execution times that enable remote timing attacks on commodity computers.

• YouTube
• 39 minutes
• Self-Paced
• Conference Talk

Black Hat

Routopsy - Modern Routing Protocol Vulnerability Analysis and Exploitation

Examines how misconfigurations in dynamic routing and first-hop redundancy protocols enable man-in-the-middle attacks and network discovery.

• YouTube
• 42 minutes
• Self-Paced
• Conference Talk

Black Hat

About Directed Fuzzing and Use-After-Free - How to Find Complex & Silent Bugs

Explores directed fuzzing for reproducing bugs, testing patches, and uncovering complex, silent vulnerabilities such as use-after-free.

• YouTube
• 31 minutes
• Self-Paced
• Conference Talk

Black Hat

Virtually Private Networks

Examines whether enterprise VPNs truly provide secure remote access for mobile workforces, questioning the security assumptions behind always-connected devices.

• YouTube
• 47 minutes
• Self-Paced
• Conference Talk

Black Hat

All You Ever Wanted to Know about the AMD Platform Security Processor and Were Afraid to Emulate - Inside a Deeply Embedded Security Processor

Examine AMD’s proprietary Platform Secure Processor, an embedded ARM trust anchor that bootstraps Zen systems and supports secure memory-encrypted virtualization.

• YouTube
• 55 minutes
• Self-Paced
• Conference Talk

Black Hat

Black-Box Laser Fault Injection on a Secure Memory

A vulnerability study demonstrates black-box laser fault injection against the ATECC508A secure memory, exposing physical attacks on cryptographic secrets.

• YouTube
• 41 minutes
• Self-Paced
• Conference Talk

Black Hat

Escaping Virtualized Containers

Explore how shared-kernel vulnerabilities enable container escapes and how unikernels, lightweight VMs, and userspace kernels strengthen isolation.

• YouTube
• 43 minutes
• Self-Paced
• Conference Talk

Black Hat

Portable Document Flaws 101

Explore the PDF specification’s insecure features and analyze how malicious PDF documents can exploit vulnerabilities in major PDF viewers.

• YouTube
• 50 minutes
• Self-Paced
• Conference Talk

Black Hat

Compromising the macOS Kernel through Safari by Chaining Six Vulnerabilities

A Black Hat talk on chaining six Safari vulnerabilities to achieve remote macOS kernel code execution despite browser and kernel mitigations.

• YouTube
• 41 minutes
• Self-Paced
• Conference Talk

Black Hat

Breaking Samsung's Root of Trust - Exploiting Samsung S10 Secure Boot

An analysis of vulnerabilities in Samsung S10 S-Boot and its USB request handling that can break the device’s secure-boot root of trust.

• YouTube
• 37 minutes
• Self-Paced
• Conference Talk

Black Hat

Lamphone - Real-Time Passive Reconstruction of Speech Using Light Emitted from Lamps

Lamphone demonstrates a real-time, passive side-channel attack that reconstructs speech by analyzing a lamp’s sound-induced frequency response with a remote electro-optical sensor.

• YouTube
• 37 minutes
• Self-Paced
• Conference Talk

Black Hat

Breaking Bootloaders on the Cheap

Reverse-engineering three microcontroller bootloaders reveals how a critical LPC1343 vulnerability can bypass readout protection with software-based attacks.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk