BlackHatEurope 2020 Dec. 7, 2020 to Dec. 10, 2020, Virtual, Virtual
Tell us about missing data
Tell us about missing data
| Title | Speakers | Summary | Topic Types |
|---|---|---|---|
| Hacking Government Cybersecurity | Pete Cooper | This session delivered by Pete Cooper, the Deputy Director for Cyber Defence at the Cabinet ... | |
| Finding Bugs Compiler Knows but Doesn't Tell You: Dissecting Undefined Behavior Optimizations in LLVM | Wei Liu , Zekai Wu , Mingyue Liang , Kai Song | "Undefined Behavior", like signed integer overflow or accessing null pointer, is an erroneous action that ... | |
| It's not FINished: The Evolving Maturity in Ransomware Operations | Mitchell Hall | Ransom demands are becoming larger, attackers smarter, and intrusions longer. Ransomware threat actors are hitting ... | |
| Jack-in-the-Cache: A New Code injection Technique through Modifying X86-to-ARM Translation Cache | Ko Oshiba | Recently, the adoption of ARM processors for laptop computers is becoming popular due to its ... | |
| Shield with Hole: New Security Mitigation Helps Us Escape Chrome Sandbox to Exfiltrate User Privacy | Yongke Shi | More security mitigations always mean securer software and more exploit cost. Chrome browser keeps introducing ... | |
| A New Hope: The One Last Chance to Save Your SSD Data | Taehyun Kim , Taewon Kim , Hanjun Chung , Seungjoon Lee , Kwonyoup Kim | There are some reasons why vendors keep their details of controller and flash chip information ... | |
| Graph Convolutional Network-Based Suspicious Communication Pair Estimation for Industrial Control Systems | Tatsumi Oba | Whitelisting is considered an effective security monitoring method for networks used in industrial control systems, ... | |
| The Subtle Art of Chaining Headers - IKEv2 Attack Surface Case Study | Antonios Atlasis | Internet Key Exchange (IKE) is a significant component of IP Security (IPsec), a suite of ... | |
| Debug Resurrection on Nordic nRF52 Series | N/a | Nordic nRF52 System-on-Chips (SoCs) are unquestionably dominating the IoT dedicated platforms market today, especially for ... | |
| From Zero to Sixty: The Story of North Korea's Rapid Ascent to Becoming a Global Cyber Superpower | Jason Burgess | In a relatively short period of time, North Korea has evolved its offensive cyber capability ... | |
| LadderLeak: Breaking ECDSA with Less than One Bit of Nonce Leakage | Diego Takahashi | Although one of the most popular signature schemes, ECDSA presents a number of implementation pitfalls, ... | |
| Design Pitfalls in Commercial Mini-Programs on Android and iOS | Luyi Xing , Xiaojing Liao , Haoran Lu | A new, commercial mobile-computing paradigm, dubbed app-in-app, is gaining high popularity in the past years. ... | |
| Discovering 20 Year Old Vulnerabilities in Modern Windows Kernel | Rancho Han | With the continuous upgrade by Microsoft, the latest windows 10 version has become more and ... | |
| FPs are Cheap. Show me the CVEs! | Bas Backhouse | SAST tools are notoriously hard to evaluate and benchmark. The most important thing you want ... | |
| Manufacturing Hardware Implants from Idea to Mass Production: A Hacker's Journey | Luca Bongiorni | This presentation wants to be a motivational talk for all those hackers out there that ... | |
| efiXplorer: Hunting for UEFI Firmware Vulnerabilities at Scale with Automated Static Analysis | Andrey Labunets , Alex Matrosov , Yegor Vasilenko , Philip Lebedev | Existing UEFI analysis instruments lack systemic approach to firmware vulnerability research focused on specifics of ... | |
| Hermes Attack: Steal DNN Models In AI Privatization Deployment Scenarios | Yueqiang Cheng , Husheng Zhou , Yuankun Zhu | The AI privatization deployment is becoming a big market in China and the US. For ... | |
| How Embedded TCP/IP Stacks Breed Critical Vulnerabilities | Jos Wetzels , Stanislav Dashevskyi , Daniel Dos Santos , Amine Amri | In the past few years, there's been a rise in critical vulnerabilities affecting embedded TCP/IP ... | |
| IAM Concerned: OAuth Token Hijacking in Google Cloud (GCP) | Jenko Hwong | Imagine you've protected your production Google Cloud environment from compromised credentials, using MFA and a ... | |
| Locknote: Conclusions and Key Takeaways from Day 1 | Federico Maggi , Sharon Conheady , Elisabeth Oswald , Thomas Brandstetter | Join members of the Black Hat Review Board for an insightful conversation on the most ... | |
| Precursor: Towards Evidence-Based Trust in Hardware | Andrew "bunnie" Huang | In hardware, the status quo is that we may have faith in our wares, but ... | |
| BinTyper: Type Confusion Detection for C++ Binaries | Dongju Kim | Type confusion bug (or bad casting) is a popular vulnerability class that attacks C++ software ... | |
| Bypassing NGAV for Fun and Profit | Ishai Meir | In this talk, we demonstrate the first methodological approach to "reverse engineer" a NGAV model ... | |
| Fingerprint-Jacking: Practical Fingerprint Authorization Hijacking in Android Apps | Wing Cheong Lau , Ronghai Yang , Xianbo Wang , Shangcheng Shi , Yikang Chen | Many mobile devices carry a fingerprint scanner nowadays. Mobile apps utilize the fingerprint scanner to ... | |
| This is for the Pwners : Exploiting a WebKit 0-day in PlayStation 4 | Quentin Talbi | Despite an active console hacking community, only few public PlayStation 4 exploits have been released. ... | |
| Effective Vulnerability Discovery with Machine Learning | Ming Sharma | Software Composition Analysis (SCA) products report vulnerabilities in third-party dependencies by comparing libraries detected in ... | |
| My Ticks Don't Lie: New Timing Attacks for Hypervisor Detection | Daniele Cono D'elia | Hypervisor detection is a pillar of sandbox evasion techniques. While hardware-assisted virtualization solutions are indispensable ... | |
| POSWorld. Should You be Afraid of Hands-On Payment Devices? | Aleksei Yunusov | The dark market is full of cloned Point of Sales terminals and offers for fake ... | |
| Portable Data exFiltration: XSS for PDFs | Gareth Heyes | PDF documents and PDF generators are ubiquitous on the web, and so are injection vulnerabilities. ... | |
| Quantum Security and Cryptography: You Are (Probably) Doing it Wrong | Tommaso Gagliardoni | Quantum Cryptography is not just Alice and Bob exchanging qubits: There is a whole world ... | |
| The Hunt for Major League IoT-ICS Threats: A Deep Dive into IoT Threat Terrain | Mars Kuo | Because the Internet of Things is a major part of modern life, security threats are ... | |
| Circumventing the Guardians: How the Security Features in State-of-the-Art TLS Inspection Solutions can be Exploited for Covert Data Exfiltration | Morten Malvica | In this talk, we will reveal a new stealthy method of data exfiltration that specifically ... | |
| Cross-Site Escape: Pwning macOS Safari Sandbox the Unusual Way | Zhi Zhou | Sandbox escape plays a vital role in a full chain exploit. For the past few ... | |
| How to Better Fuzz Windows 10 Directx Kernel at Present | Xiaoliang Liu | DirectX is the engine that handles rendering on the Windows platform. Many outstanding people have ... | |
| Light Commands: Hacking Voice Assistants with Lasers | Sara Rampazzi , Benjamin Genkin | In the near future, our homes will employ potentially dozens of IoT devices. These devices ... | |
| Permission Mining in GCP | Colin Estep | Do you know exactly what each user can do in your Google Cloud Platform (GCP) ... | |
| Please Make a Dentist Appointment ASAP: Attacking IOBluetoothFamily HCI and Vendor-Specific Commands | Yu Wang | In order to control the firmware link manager and baseband controller, Bluetooth stacks usually abstract ... | |
| Story of Jailbreaking iOS 13 | 08tc3wbb | Jailbreaking refers to obtaining the kernel privilege of iOS, by means of the development of ... | |
| Locknote: Conclusions and Key Takeaways from Day 2 | Daniel Cuthbert , Marina Krotofil , James Kettle , Leigh-anne Galloway | Join members of the Black Hat Review Board for an insightful conversation on the most ... |