Conference Talks

Black Hat

EBPF ELFs JMPing Through the Windows

A deep dive into Windows eBPF’s attack surface, showing how fuzzing uncovered vulnerabilities across its verifier, JIT engine, and kernel implementation.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

Black Hat

Backdoor Investigation and Incident Response - From Zero to Profit

A breach investigation traces a stealthy gaming backdoor that manipulated database transactions and evaded enterprise security controls for eight months.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

Black Hat

DroidGuard - A Deep Dive into SafetyNet

A technical look inside SafetyNet and DroidGuard, including how their virtual machine and security checks detect rooted devices, emulators, Magisk, and Pegasus.

• YouTube
• 30 minutes
• Self-Paced
• Conference Talk

Black Hat

AutoSpear - Towards Automatically Bypassing and Inspecting Web Application Firewalls

A study of whether web application firewalls, including WAF-as-a-service, can be automatically bypassed and inspected.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

Black Hat

Do You Speak My Language? Make Static Analysis Engines Understand Each Other

A framework lets separate static analyzers share taint information to trace data flows across languages and repositories, helping uncover vulnerabilities that span codebases.

• YouTube
• 38 minutes
• Self-Paced
• Conference Talk

Black Hat

Measure Security Effectively

A keynote on quantifying security return on investment and determining whether security work is moving the needle.

• YouTube
• 59 minutes
• Self-Paced
• Conference Talk

Black Hat

SideWinder Uncoils to Strike

A technical walkthrough traces SideWinder from obfuscated JavaScript delivery through its .NET stages to its backdoor and command-and-control infrastructure.

• YouTube
• 41 minutes
• Self-Paced
• Conference Talk

Black Hat

The Next Gen PlugX - ShadowPad - A Dive into the Emerging China-Nexus Modular Trojan, Pangolin8RAT

An investigation of Pangolin8RAT, an emerging modular trojan viewed as a possible successor to PlugX and ShadowPad, with its attack timeline and outlook.

• YouTube
• 42 minutes
• Self-Paced
• Conference Talk

Black Hat

Hardware Security Module - Executing Unsigned Code in HSM TEE

An attack on a LunaSP HSM’s JAR signature verification shows how ZIP rewriting can bypass checks and run unsigned code in its protected application layer.

• YouTube
• 33 minutes
• Self-Paced
• Conference Talk

Black Hat

With Friends Like eBPF, Who Needs Enemies?

See how eBPF grew from a network monitoring tool into a way to monitor and trace activity throughout the Linux kernel.

• YouTube
• 41 minutes
• Self-Paced
• Conference Talk

Black Hat

PCIe Device Attacks - Beyond DMA - Exploiting PCIe Switches, Messages and Errors

A look at attacks that exploit PCIe switches and Translation Layer Packets, extending hardware threats beyond familiar DMA attacks.

• YouTube
• 34 minutes
• Self-Paced
• Conference Talk

Black Hat

Over the Air Baseband Exploit - Gaining Remote Code Execution on 5G Smartphones

A 5G baseband vulnerability becomes an over-the-air path to remote code execution on smartphones.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

Black Hat

Wibbly Wobbly, Timey Wimey – What's Really Inside Apple's U1 Chip

A look inside Apple’s U1 chip traces its UWB capabilities through firmware and kernel components, including modifying firmware interaction from user space.

• YouTube
• 33 minutes
• Self-Paced
• Conference Talk

Black Hat

Windows Heap-backed Pool - The Good, the Bad, and the Encoded

A look at how Windows’ heap-backed kernel pool changes allocation structures, complicates analysis, and reshapes exploitation and mitigation.

• YouTube
• 39 minutes
• Self-Paced
• Conference Talk

Unity

Enhance a Top-Down Game with URP 2D Lights

Build dynamic lighting and shadows for a top-down 2D game with Unity URP, using normal maps for depth and projected shadows.

• YouTube
• 20 minutes
• Self-Paced
• Conference Talk