Black Hat
Black Hat
  • Видео 2 607
  • Просмотров 12 823 380

Видео

Startup Spotlight Competition at Black Hat
Просмотров 1,3 тыс.Месяц назад
The Startup Spotlight Competition at Black Hat returns for 2024. Submit your 5-minute video pitch by June 12 to enter for the chance to exhibit in Startup City at Black Hat USA and present your product/service to Black Hat Judges and our live audience. Learn more here: www.blackhat.com/us-24/spotlight.html #cybersecurity #infosec #blackhat #bhusa #startup
Locknote: Conclusions and Key Takeaways from Day 2
Просмотров 9762 месяца назад
At the end of day two, join Black Hat Founder Jeff Moss and Black Hat Europe Review Board members for an insightful conversation on the most pressing issues facing the InfoSec community. This Locknote will feature a candid discussion on the key takeaways coming out of Day 2 of the conference and how these trends will impact future InfoSec strategies. By: Jeff Moss, Ali Abbasi , Jiska Classen , ...
Locknote: Conclusions and Key Takeaways from Day 1
Просмотров 5812 месяца назад
At the end of day one, join Black Hat Founder Jeff Moss and Black Hat Europe Review Board members for an insightful conversation on the most pressing issues facing the InfoSec community. This Locknote will feature a candid discussion on the key takeaways coming out of Day 1 of the conference and how these trends will impact future InfoSec strategies. By: Jeff Moss, Daniel Cuthbert , Meadow Elli...
Keynote: My Lessons from the Uber Case
Просмотров 2,8 тыс.2 месяца назад
In a case closely watched and debated by security professionals globally, Joe Sullivan was convicted of two felonies related to a security incident at Uber that the company had labeled a coverup when it fired him.... Today, Sullivan mentors security leaders and consults on security best practices, in addition to serving as volunteer CEO of the nonprofit humanitarian relief organization Ukraine ...
Keynote: Industrialising Cyber Defence in an Asymmetric World
Просмотров 1,4 тыс.2 месяца назад
In this keynote, Ollie Whitehouse will outline a future in which we industrialise our approaches to cyber defence against adversaries who are not constrained by the same legal, moral, or ethical frameworks. This talk will begin by exploring the challenge and need before going on to discuss possible approaches and the research challenges which underpin them and continue to remain unanswered. By:...
The Black Hat Europe Network Operations Center (NOC) Report
Просмотров 1,1 тыс.2 месяца назад
Back with another year of soul-crushing statistics, the Black Hat NOC team will be sharing all of the data that keeps us equally puzzled, and entertained, year after year. We'll let you know all the tools and techniques we're using to set up, stabilize, and secure the network, and what changes we've made over the past year to try and keep doing things better. Of course, we'll be sharing some of...
My Invisible Adversary: Burnout
Просмотров 2,8 тыс.2 месяца назад
It seems that lately, Burnout is an invisible member of every operational security team. Attackers grow more capable every year, the attacks faster and harder, and regulations even more strict about how quickly and completely your team must perform its mission. With the growing complexity of battle and so much on the line in defending users, operational response teams are under more stress than...
The Magnetic Pull of Mutable Protection: Worked Examples in Cryptographic Agility
Просмотров 8832 месяца назад
...How do you go about fully understanding what cryptography you have, how it is used and if it's good or bad? This was the question we started to ask ourselves and set about trying to answer using static analysis tools such as GitHub's CodeQL. Given how we all rely heavily on open-source projects, we set about scanning the top 1000 GitHub open-source projects to identify insecure cryptographic...
A World-View of IP Spoofing in L4 Volumetric DoS Attacks - and a Call to Enable BCP38
Просмотров 1,1 тыс.2 месяца назад
...In this talk we will analyze the global view of spoofing from Cloudflare, to understand IP spoofing on network-layer DoS attacks, and analyze geographic, longitudinal and network-specific characteristics of spoofing sources. We developed and applied IP spoofing detection techniques on three months of network-layer DoS traces, and used the insights to understand where and why BCP38 is most ur...
Collide+Power: The Evolution of Software-based Power Side-Channels Attacks
Просмотров 8912 месяца назад
Power side channels exploit leakage that is fundamentally a result of how we build processors. Over the recent years, these attacks evolved to target general-purpose desktop and server CPUs purely from software. In this talk, we explore this evolution to its most recent addition: Collide Power, a novel technique to exploit the fundamental way we share components in modern general-purpose CPUs. ...
Through the Looking Glass: How Open Source Projects See Vulnerability Disclosure
Просмотров 8882 месяца назад
A security researcher submits their vulnerability report to an open source project (when they can find a confidential way to do so!). That launches several events in the affected project. In this talk, Marta will explain the reasons behind typical reactions. The main part will focus on common myths, misunderstandings, and communication errors that arise in these situations. The goal is to foste...
New Techniques for Split-Second DNS Rebinding
Просмотров 1,5 тыс.2 месяца назад
...In this talk, I will present two new techniques that can be used to achieve reliable, split-second DNS rebinding in Chrome, Edge, and Safari on hosts with IPv6 access, along with a method to bypass Chrome's restrictions on requests to the local network. I will also walk through a real-world attack against a web application resulting in AWS credentials to demonstrate how achievable rebinding ...
Something Rotten in the State of Data Centers
Просмотров 8 тыс.2 месяца назад
...This talk details our findings in the data center device management domain, showcasing the most impactful vulnerabilities and exploits unearthed in our broader effort to investigate the security of critical data center components. Specifically, we will reveal 8 critical vulnerabilities across two common data center appliances: a popular DDI solution and a KVM. Continuing, we delve into the t...
When The Front Door Becomes a Backdoor: The Security Paradox of OSDP
Просмотров 8832 месяца назад
Ever imagined that the modern Physical Access Control Systems (PACS) at the front door of your facility could actually serve as an entry point into your internal IP network? Surprisingly, this is not as far-fetched as it seems. In this talk, we will demonstrate how to go through doors, protected with the latest advancements in building access control security - both physically and digitally. We...
The Pool Party You Will Never Forget: New Process Injection Techniques Using Windows Thread Pools
Просмотров 2,2 тыс.2 месяца назад
The Pool Party You Will Never Forget: New Process Injection Techniques Using Windows Thread Pools
Kidnapping Without Hostages: Virtual Kidnapping and the Dark Road Ahead
Просмотров 1,2 тыс.2 месяца назад
Kidnapping Without Hostages: Virtual Kidnapping and the Dark Road Ahead
TsuKing: Coordinating DNS Resolvers and Queries into Potent DoS Amplifiers
Просмотров 7143 месяца назад
TsuKing: Coordinating DNS Resolvers and Queries into Potent DoS Amplifiers
One Million ASUS Routers Under Control: Exploiting ASUS DDNS to MITM Admin Credentials
Просмотров 1,4 тыс.3 месяца назад
One Million ASUS Routers Under Control: Exploiting ASUS DDNS to MITM Admin Credentials
Off The Record - Weaponizing DHCP DNS Dynamic Updates
Просмотров 1,8 тыс.3 месяца назад
Off The Record - Weaponizing DHCP DNS Dynamic Updates
Breaching the Perimeter via Cloud Synchronized Browser Settings
Просмотров 8053 месяца назад
Breaching the Perimeter via Cloud Synchronized Browser Settings
Hiding in the Clouds: Abusing Azure DevOps Services to Bypass Microsoft Sentinel Analytic Rules
Просмотров 1,7 тыс.3 месяца назад
Hiding in the Clouds: Abusing Azure DevOps Services to Bypass Microsoft Sentinel Analytic Rules
Vulnerabilities in Old Third-Party Software Components- Importance of Having SBoM for IoT/OT Devices
Просмотров 1,7 тыс.3 месяца назад
Vulnerabilities in Old Third-Party Software Components- Importance of Having SBoM for IoT/OT Devices
Indirect Prompt Injection Into LLMs Using Images and Sounds
Просмотров 1,1 тыс.3 месяца назад
Indirect Prompt Injection Into LLMs Using Images and Sounds
VoBERT: Unstable Log Sequence Anomaly Detection: Introducing Vocabulary-Free BERT
Просмотров 8103 месяца назад
VoBERT: Unstable Log Sequence Anomaly Detection: Introducing Vocabulary-Free BERT
HODOR: Reducing Attack Surface on Node.js via System Call Limitation
Просмотров 5453 месяца назад
HODOR: Reducing Attack Surface on Node.js via System Call Limitation
How We Taught ChatGPT-4 to Break mbedTLS AES With Side-Channel Attacks
Просмотров 2,4 тыс.3 месяца назад
How We Taught ChatGPT-4 to Break mbedTLS AES With Side-Channel Attacks
Unmasking APTs: An Automated Approach for Real-World Threat Attribution
Просмотров 1,5 тыс.3 месяца назад
Unmasking APTs: An Automated Approach for Real-World Threat Attribution
Black Hat USA 2024 - Short Reel
Просмотров 175 тыс.3 месяца назад
Black Hat USA 2024 - Short Reel
Calling all Cybersecurity Pros! Join Us at Black Hat USA 2024 at the Mandalay Bay.
Просмотров 46 тыс.3 месяца назад
Calling all Cybersecurity Pros! Join Us at Black Hat USA 2024 at the Mandalay Bay.

Комментарии

  • @caliniaru1673
    @caliniaru1673 2 дня назад

    Extremely captivating!

  • @aibok42
    @aibok42 2 дня назад

    I feel like the e=0 efficiency joke at the beginning did not get enough laughs. Here's an extra LOL on me: 🤣

  • @MatthewHill
    @MatthewHill 3 дня назад

    This really should be a much bigger scandal than it is.

  • @stevehageman6785
    @stevehageman6785 4 дня назад

    I'm glad you are on 'our side' - Ha, ha, ha, ha..... ;-)

  • @NicholasHarsin
    @NicholasHarsin 8 дней назад

    If audience is any indicator, BH USA is a hell of a lot more fun than BH EU.

  • @naranggakhoirulutama422
    @naranggakhoirulutama422 15 дней назад

    good information, helpful video

  • @MouatassimMajhoul
    @MouatassimMajhoul 17 дней назад

    Why not dissassemble with nanoscope ?

  • @tkothadev
    @tkothadev 21 день назад

    22:26 ok this part genuinely looks like what you would see in hollywood movies

  • @electronikeur6741
    @electronikeur6741 25 дней назад

    I discover this talk and love it some ten years after.

  • @user-yi4ef2gk1o
    @user-yi4ef2gk1o Месяц назад

    Great video you are the MAN Matt😁

  • @ChaplainDaveSparks
    @ChaplainDaveSparks Месяц назад

    When you mentioned _"came in with a B-210"_ ... I'm just old enough to think of a certain 1970s era *Datsun* (before it was rebranded as _"Nissan'.)_ Now all we need is for someone to hack _Microsoft Flight Simulator_ to import realtime ADS-B data ...

  • @ChaplainDaveSparks
    @ChaplainDaveSparks Месяц назад

    That encryption scheme - maybe the _”Puzzle Palace”_ should take notes … Just kidding - sort of. Or maybe .. it’s so _”ridiculous”_ that it might be useful because no one would suspect such a naive implementation. (Or use something _”super secure”,_ like *ROT13.)*

  • @KatyYoder-cq1kc
    @KatyYoder-cq1kc Месяц назад

    NOW on LIFE SUPPORT: All militia, governments, supremacists, and communists: Cease and desist all malicious use of AI against myself and my family. We are not your property

  • @mikehibbett3301
    @mikehibbett3301 Месяц назад

    They aren't secret, they are just side effects of the hardware.

  • @Queenema-yd4lq
    @Queenema-yd4lq Месяц назад

    WHITEDUMPS thanks for put me thru with apple method + cc-fullz, I was able to hit easily without op required glad on easy cash out steps you walk me thru. hit twice and still hitting

  • @Karlavaegen
    @Karlavaegen Месяц назад

    It's obvious that you dont know what you are talking about... but anyway, hope you have learned anything during the joureny. Please tell what qVSDC is in terms of EMV

  • @i.am.abhi747
    @i.am.abhi747 Месяц назад

    Found this after lot of digging after 9 years

  • @bbuggediffy
    @bbuggediffy Месяц назад

    Is this still valid? Calling over Wifi was deprecated some time in 2021 am I right?

  • @olbluelips
    @olbluelips Месяц назад

    Still my favourite talk

  • @caliniaru1673
    @caliniaru1673 Месяц назад

    Very good research. Thank you!

  • @thakursahabofficial7377
    @thakursahabofficial7377 2 месяца назад

    that a important information given by you SIR ....thankyou

  • @abdougaming9905
    @abdougaming9905 2 месяца назад

    Great content🔥

  • @subxi5744
    @subxi5744 2 месяца назад

    34:16 - Not entirely true. You can actually use `PAGE_READWRITE` during the mem alloc phase, write the code and then switch the permission to `PAGE_EXECUTE_READ` using `VirtualProtectEx`. This method provides you with a RW buffer for data copy which becomes an RX buffer for execution. By the way, malfind is dependent on `vadinfo` plugin, `vadinfo` shows the original protection only, meaning you'll not see the `PAGE_EXECUTE_READ` memory segment, so there's that. EDIT: Props to Monnappa for this demonstration. Not many people have the guts to demonstrate and explain such topics.

  • @DROPSHIPCAPTAIN
    @DROPSHIPCAPTAIN 2 месяца назад

    Cool!

  • @arashinoatode
    @arashinoatode 2 месяца назад

    such simple presemtation. loved it

  • @apple.3947
    @apple.3947 2 месяца назад

    what the fuck is this.

  • @blitzkrieg19397
    @blitzkrieg19397 2 месяца назад

    16:06

  • @lingdatang669
    @lingdatang669 2 месяца назад

    29:29 BOOKmark

  • @Koenfred19
    @Koenfred19 2 месяца назад

    Is there a Adguard or Pihole blocklist for the domain's of pegasus so Day2Day users can have a extra (Little) layer of protection against them?

  • @lingdatang669
    @lingdatang669 2 месяца назад

    24:14 bookmark

  • @0xbitbybit
    @0xbitbybit 2 месяца назад

    Would be interested to see how the first phase was done, how the "light bulb" strings are actually generated, I get they are different function calls but what the process looks like and the tools used and how it's actually done would be good to see!

  • @CyberDeck-pg7sf
    @CyberDeck-pg7sf 2 месяца назад

    Is it possible to get the sample you are analyzing ?

  • @florencetown4024
    @florencetown4024 2 месяца назад

    05:00

  • @miralnuruyev9177
    @miralnuruyev9177 3 месяца назад

    Up

  • @DerIchBinDa
    @DerIchBinDa 3 месяца назад

    "Intel has a 95% market share" - oh boy did that not age well 😅

  • @Lou-sassole3
    @Lou-sassole3 3 месяца назад

    Oh hell yea

  • @MikeTheSapien3
    @MikeTheSapien3 3 месяца назад

    Interesting. Even if this is more than 2 decades old, it's still applicable today.

  • @ack1299
    @ack1299 3 месяца назад

    Very insightful session. Thanks a lot!

  • @marianarlt
    @marianarlt 3 месяца назад

    Cat tries to eat plushy fish: 80mio views in two days Very good in-depth talk about the technologies that run our world that are still valuable years later:

  • @KatyYoder-cq1kc
    @KatyYoder-cq1kc 4 месяца назад

    All militia, governments, white supremacists, and communists: Cease and desist all malicious use of AI against myself and my family. We are not your property.

  • @GullKhan006
    @GullKhan006 4 месяца назад

    Am from Pakistan 🎉

  • @GullKhan006
    @GullKhan006 4 месяца назад

    I love My heroes ❤

  • @jimmyblaze_4115
    @jimmyblaze_4115 4 месяца назад

    I'm suffering terrorism issues in Sudbury Ontario they are using SSL or tsl packets and illegal communications or even Pegasus.

  • @jimmyblaze_4115
    @jimmyblaze_4115 4 месяца назад

    I'm suffering terrorism issues in Sudbury Ontario they are using SSL or tsl packets and illegal communications.

  • @jimmyblaze_4115
    @jimmyblaze_4115 4 месяца назад

    I'm suffering terrorism issues in Sudbury Ontario they are using SSL or tsl packets and illegal communications.

  • @OhMyVideology
    @OhMyVideology 4 месяца назад

    Great talk

  • @shubham_srt
    @shubham_srt 4 месяца назад

    ayoooo

  • @ihacksi
    @ihacksi 4 месяца назад

    Best memory forensics presentation ever! Thank you sir!

  • @Shinesunny-sg6qc
    @Shinesunny-sg6qc 4 месяца назад

    a good idea about treat definder

  • @tcmatg
    @tcmatg 4 месяца назад

    legend