Conference Talks

Black Hat

Trust in Apple's Secret Garden - Exploring and Reversing Apple's Continuity Protocol

An exploration of Apple's Continuity protocols, including AirDrop and iMessage, examining seamless device sharing and its privacy and security implications.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

Black Hat

BlueMaster - Bypassing and Fixing Bluetooth-Based Proximity Authentication

Analyse les failles de sécurité de l’authentification de proximité Bluetooth et présente trois attaques contre Android Smart Lock et Windows Dynamic Lock.

• YouTube
• 46 minutes
• Self-Paced
• Conference Talk

Black Hat

New Exploit Technique in Java Deserialization Attack

Explores a new technique for exploiting Java deserialization vulnerabilities across third-party libraries and real-world attack scenarios.

• YouTube
• 51 minutes
• Self-Paced
• Conference Talk

Black Hat

Fuzzing and Exploiting Virtual Channels in Microsoft Remote Desktop Protocol for Fun and Profit

Coverage-based fuzzing of Microsoft RDP virtual channels targets crashes in complex sound, graphics, USB, filesystem, and smart-card functionality.

• YouTube
• 39 minutes
• Self-Paced
• Conference Talk

Black Hat

Chain of Fools - An Exploration of Certificate Chain Validation Mishaps

Examine how insecure certificate-chain validation and poorly designed cryptographic APIs enable exploits, with recommendations for misuse-resistant implementations.

• YouTube
• 48 minutes
• Self-Paced
• Conference Talk

Black Hat

A Compendium of Container Escapes

Explores how attackers escape container isolation, from exposed orchestrators and Docker sockets to /proc abuse and kernel exploitation.

• YouTube
• 43 minutes
• Self-Paced
• Conference Talk

Black Hat

Automation Techniques in C++ Reverse Engineering

Automate C++ reverse engineering with DLL injection to trace structure usage and infer function-argument types during program execution.

• YouTube
• 51 minutes
• Self-Paced
• Conference Talk

Black Hat

Backdooring Hardware Devices by Injecting Malicious Payloads on Microcontrollers

Explore three approaches to backdoor microcontrollers by injecting malicious payloads, from firmware entry-point attacks to advanced techniques.

• YouTube
• 39 minutes
• Self-Paced
• Conference Talk

Black Hat

The Discovery of a Government Malware and an Unexpected Spy Scandal

A case study of eSurv exposes Italy’s government spyware market and traces the evolution of lawful intercept and police-grade surveillance malware.

• YouTube
• 45 minutes
• Self-Paced
• Conference Talk

Black Hat

Hacking Ten Million Useful Idiots - Online Propaganda as a Socio-Technical Security Project

An integrated approach to analyzing online propaganda as a socio-technical security project using data science, psychology, and security thinking.

• YouTube
• 51 minutes
• Self-Paced
• Conference Talk

Black Hat

Securing the System - A Deep Dive into Reversing Android Pre-Installed Apps

Explores how reversing pre-installed Android apps differs from user-space apps, including emulator limitations, component collusion, and privileged execution.

• YouTube
• 48 minutes
• Self-Paced
• Conference Talk

Black Hat

Controlled Chaos - The Inevitable Marriage of DevOps and Security

Explores how DevOps, resilience, chaos engineering, and information security converge, using survey data to identify practices associated with elite software organizations.

• YouTube
• 54 minutes
• Self-Paced
• Conference Talk

Black Hat

Dragonblood - Attacking the Dragonfly Handshake of WPA3

Examines side-channel vulnerabilities in WPA3’s Dragonfly (SAE) handshake and how leaked information enables password partitioning attacks.

• YouTube
• 47 minutes
• Self-Paced
• Conference Talk

Black Hat

Lessons From Two Years of Crypto Audits

Lessons from crypto audits, examining security issues and risks in the memory-safe Rust language.

• YouTube
• 46 minutes
• Self-Paced
• Conference Talk

Black Hat

No Free Charge Theorem 2.0 - How to Steal Private Information from a Mobile Device Using a Powerbank

Shows how a powerbank can exploit a hidden charging-current channel to steal private data from an Android smartphone.

• YouTube
• 39 minutes
• Self-Paced
• Conference Talk