Black Hat
Black Hat
  • 2 607
  • 12 823 380

Відео

Startup Spotlight Competition at Black Hat
Переглядів 1,3 тис.Місяць тому
The Startup Spotlight Competition at Black Hat returns for 2024. Submit your 5-minute video pitch by June 12 to enter for the chance to exhibit in Startup City at Black Hat USA and present your product/service to Black Hat Judges and our live audience. Learn more here: www.blackhat.com/us-24/spotlight.html #cybersecurity #infosec #blackhat #bhusa #startup
Locknote: Conclusions and Key Takeaways from Day 2
Переглядів 9762 місяці тому
At the end of day two, join Black Hat Founder Jeff Moss and Black Hat Europe Review Board members for an insightful conversation on the most pressing issues facing the InfoSec community. This Locknote will feature a candid discussion on the key takeaways coming out of Day 2 of the conference and how these trends will impact future InfoSec strategies. By: Jeff Moss, Ali Abbasi , Jiska Classen , ...
Locknote: Conclusions and Key Takeaways from Day 1
Переглядів 5812 місяці тому
At the end of day one, join Black Hat Founder Jeff Moss and Black Hat Europe Review Board members for an insightful conversation on the most pressing issues facing the InfoSec community. This Locknote will feature a candid discussion on the key takeaways coming out of Day 1 of the conference and how these trends will impact future InfoSec strategies. By: Jeff Moss, Daniel Cuthbert , Meadow Elli...
Keynote: My Lessons from the Uber Case
Переглядів 2,8 тис.2 місяці тому
In a case closely watched and debated by security professionals globally, Joe Sullivan was convicted of two felonies related to a security incident at Uber that the company had labeled a coverup when it fired him.... Today, Sullivan mentors security leaders and consults on security best practices, in addition to serving as volunteer CEO of the nonprofit humanitarian relief organization Ukraine ...
Keynote: Industrialising Cyber Defence in an Asymmetric World
Переглядів 1,4 тис.2 місяці тому
In this keynote, Ollie Whitehouse will outline a future in which we industrialise our approaches to cyber defence against adversaries who are not constrained by the same legal, moral, or ethical frameworks. This talk will begin by exploring the challenge and need before going on to discuss possible approaches and the research challenges which underpin them and continue to remain unanswered. By:...
The Black Hat Europe Network Operations Center (NOC) Report
Переглядів 1,1 тис.2 місяці тому
Back with another year of soul-crushing statistics, the Black Hat NOC team will be sharing all of the data that keeps us equally puzzled, and entertained, year after year. We'll let you know all the tools and techniques we're using to set up, stabilize, and secure the network, and what changes we've made over the past year to try and keep doing things better. Of course, we'll be sharing some of...
My Invisible Adversary: Burnout
Переглядів 2,8 тис.2 місяці тому
It seems that lately, Burnout is an invisible member of every operational security team. Attackers grow more capable every year, the attacks faster and harder, and regulations even more strict about how quickly and completely your team must perform its mission. With the growing complexity of battle and so much on the line in defending users, operational response teams are under more stress than...
The Magnetic Pull of Mutable Protection: Worked Examples in Cryptographic Agility
Переглядів 8832 місяці тому
...How do you go about fully understanding what cryptography you have, how it is used and if it's good or bad? This was the question we started to ask ourselves and set about trying to answer using static analysis tools such as GitHub's CodeQL. Given how we all rely heavily on open-source projects, we set about scanning the top 1000 GitHub open-source projects to identify insecure cryptographic...
A World-View of IP Spoofing in L4 Volumetric DoS Attacks - and a Call to Enable BCP38
Переглядів 1,1 тис.2 місяці тому
...In this talk we will analyze the global view of spoofing from Cloudflare, to understand IP spoofing on network-layer DoS attacks, and analyze geographic, longitudinal and network-specific characteristics of spoofing sources. We developed and applied IP spoofing detection techniques on three months of network-layer DoS traces, and used the insights to understand where and why BCP38 is most ur...
Collide+Power: The Evolution of Software-based Power Side-Channels Attacks
Переглядів 8912 місяці тому
Power side channels exploit leakage that is fundamentally a result of how we build processors. Over the recent years, these attacks evolved to target general-purpose desktop and server CPUs purely from software. In this talk, we explore this evolution to its most recent addition: Collide Power, a novel technique to exploit the fundamental way we share components in modern general-purpose CPUs. ...
Through the Looking Glass: How Open Source Projects See Vulnerability Disclosure
Переглядів 8882 місяці тому
A security researcher submits their vulnerability report to an open source project (when they can find a confidential way to do so!). That launches several events in the affected project. In this talk, Marta will explain the reasons behind typical reactions. The main part will focus on common myths, misunderstandings, and communication errors that arise in these situations. The goal is to foste...
New Techniques for Split-Second DNS Rebinding
Переглядів 1,5 тис.2 місяці тому
...In this talk, I will present two new techniques that can be used to achieve reliable, split-second DNS rebinding in Chrome, Edge, and Safari on hosts with IPv6 access, along with a method to bypass Chrome's restrictions on requests to the local network. I will also walk through a real-world attack against a web application resulting in AWS credentials to demonstrate how achievable rebinding ...
Something Rotten in the State of Data Centers
Переглядів 8 тис.2 місяці тому
...This talk details our findings in the data center device management domain, showcasing the most impactful vulnerabilities and exploits unearthed in our broader effort to investigate the security of critical data center components. Specifically, we will reveal 8 critical vulnerabilities across two common data center appliances: a popular DDI solution and a KVM. Continuing, we delve into the t...
When The Front Door Becomes a Backdoor: The Security Paradox of OSDP
Переглядів 8832 місяці тому
Ever imagined that the modern Physical Access Control Systems (PACS) at the front door of your facility could actually serve as an entry point into your internal IP network? Surprisingly, this is not as far-fetched as it seems. In this talk, we will demonstrate how to go through doors, protected with the latest advancements in building access control security - both physically and digitally. We...
The Pool Party You Will Never Forget: New Process Injection Techniques Using Windows Thread Pools
Переглядів 2,2 тис.2 місяці тому
The Pool Party You Will Never Forget: New Process Injection Techniques Using Windows Thread Pools
Kidnapping Without Hostages: Virtual Kidnapping and the Dark Road Ahead
Переглядів 1,2 тис.2 місяці тому
Kidnapping Without Hostages: Virtual Kidnapping and the Dark Road Ahead
TsuKing: Coordinating DNS Resolvers and Queries into Potent DoS Amplifiers
Переглядів 7143 місяці тому
TsuKing: Coordinating DNS Resolvers and Queries into Potent DoS Amplifiers
One Million ASUS Routers Under Control: Exploiting ASUS DDNS to MITM Admin Credentials
Переглядів 1,4 тис.3 місяці тому
One Million ASUS Routers Under Control: Exploiting ASUS DDNS to MITM Admin Credentials
Off The Record - Weaponizing DHCP DNS Dynamic Updates
Переглядів 1,8 тис.3 місяці тому
Off The Record - Weaponizing DHCP DNS Dynamic Updates
Breaching the Perimeter via Cloud Synchronized Browser Settings
Переглядів 8053 місяці тому
Breaching the Perimeter via Cloud Synchronized Browser Settings
Hiding in the Clouds: Abusing Azure DevOps Services to Bypass Microsoft Sentinel Analytic Rules
Переглядів 1,7 тис.3 місяці тому
Hiding in the Clouds: Abusing Azure DevOps Services to Bypass Microsoft Sentinel Analytic Rules
Vulnerabilities in Old Third-Party Software Components- Importance of Having SBoM for IoT/OT Devices
Переглядів 1,7 тис.3 місяці тому
Vulnerabilities in Old Third-Party Software Components- Importance of Having SBoM for IoT/OT Devices
Indirect Prompt Injection Into LLMs Using Images and Sounds
Переглядів 1,1 тис.3 місяці тому
Indirect Prompt Injection Into LLMs Using Images and Sounds
VoBERT: Unstable Log Sequence Anomaly Detection: Introducing Vocabulary-Free BERT
Переглядів 8103 місяці тому
VoBERT: Unstable Log Sequence Anomaly Detection: Introducing Vocabulary-Free BERT
HODOR: Reducing Attack Surface on Node.js via System Call Limitation
Переглядів 5453 місяці тому
HODOR: Reducing Attack Surface on Node.js via System Call Limitation
How We Taught ChatGPT-4 to Break mbedTLS AES With Side-Channel Attacks
Переглядів 2,4 тис.3 місяці тому
How We Taught ChatGPT-4 to Break mbedTLS AES With Side-Channel Attacks
Unmasking APTs: An Automated Approach for Real-World Threat Attribution
Переглядів 1,5 тис.3 місяці тому
Unmasking APTs: An Automated Approach for Real-World Threat Attribution
Black Hat USA 2024 - Short Reel
Переглядів 175 тис.3 місяці тому
Black Hat USA 2024 - Short Reel
Calling all Cybersecurity Pros! Join Us at Black Hat USA 2024 at the Mandalay Bay.
Переглядів 46 тис.3 місяці тому
Calling all Cybersecurity Pros! Join Us at Black Hat USA 2024 at the Mandalay Bay.

КОМЕНТАРІ

  • @caliniaru1673
    @caliniaru1673 День тому

    Extremely captivating!

  • @aibok42
    @aibok42 День тому

    I feel like the e=0 efficiency joke at the beginning did not get enough laughs. Here's an extra LOL on me: 🤣

  • @MatthewHill
    @MatthewHill 3 дні тому

    This really should be a much bigger scandal than it is.

  • @stevehageman6785
    @stevehageman6785 4 дні тому

    I'm glad you are on 'our side' - Ha, ha, ha, ha..... ;-)

  • @NicholasHarsin
    @NicholasHarsin 8 днів тому

    If audience is any indicator, BH USA is a hell of a lot more fun than BH EU.

  • @naranggakhoirulutama422
    @naranggakhoirulutama422 14 днів тому

    good information, helpful video

  • @MouatassimMajhoul
    @MouatassimMajhoul 16 днів тому

    Why not dissassemble with nanoscope ?

  • @tkothadev
    @tkothadev 20 днів тому

    22:26 ok this part genuinely looks like what you would see in hollywood movies

  • @electronikeur6741
    @electronikeur6741 25 днів тому

    I discover this talk and love it some ten years after.

  • @user-yi4ef2gk1o
    @user-yi4ef2gk1o 29 днів тому

    Great video you are the MAN Matt😁

  • @ChaplainDaveSparks
    @ChaplainDaveSparks Місяць тому

    When you mentioned _"came in with a B-210"_ ... I'm just old enough to think of a certain 1970s era *Datsun* (before it was rebranded as _"Nissan'.)_ Now all we need is for someone to hack _Microsoft Flight Simulator_ to import realtime ADS-B data ...

  • @ChaplainDaveSparks
    @ChaplainDaveSparks Місяць тому

    That encryption scheme - maybe the _”Puzzle Palace”_ should take notes … Just kidding - sort of. Or maybe .. it’s so _”ridiculous”_ that it might be useful because no one would suspect such a naive implementation. (Or use something _”super secure”,_ like *ROT13.)*

  • @KatyYoder-cq1kc
    @KatyYoder-cq1kc Місяць тому

    NOW on LIFE SUPPORT: All militia, governments, supremacists, and communists: Cease and desist all malicious use of AI against myself and my family. We are not your property

  • @mikehibbett3301
    @mikehibbett3301 Місяць тому

    They aren't secret, they are just side effects of the hardware.

  • @Queenema-yd4lq
    @Queenema-yd4lq Місяць тому

    WHITEDUMPS thanks for put me thru with apple method + cc-fullz, I was able to hit easily without op required glad on easy cash out steps you walk me thru. hit twice and still hitting

  • @Karlavaegen
    @Karlavaegen Місяць тому

    It's obvious that you dont know what you are talking about... but anyway, hope you have learned anything during the joureny. Please tell what qVSDC is in terms of EMV

  • @i.am.abhi747
    @i.am.abhi747 Місяць тому

    Found this after lot of digging after 9 years

  • @bbuggediffy
    @bbuggediffy Місяць тому

    Is this still valid? Calling over Wifi was deprecated some time in 2021 am I right?

  • @olbluelips
    @olbluelips Місяць тому

    Still my favourite talk

  • @caliniaru1673
    @caliniaru1673 Місяць тому

    Very good research. Thank you!

  • @thakursahabofficial7377
    @thakursahabofficial7377 2 місяці тому

    that a important information given by you SIR ....thankyou

  • @abdougaming9905
    @abdougaming9905 2 місяці тому

    Great content🔥

  • @subxi5744
    @subxi5744 2 місяці тому

    34:16 - Not entirely true. You can actually use `PAGE_READWRITE` during the mem alloc phase, write the code and then switch the permission to `PAGE_EXECUTE_READ` using `VirtualProtectEx`. This method provides you with a RW buffer for data copy which becomes an RX buffer for execution. By the way, malfind is dependent on `vadinfo` plugin, `vadinfo` shows the original protection only, meaning you'll not see the `PAGE_EXECUTE_READ` memory segment, so there's that. EDIT: Props to Monnappa for this demonstration. Not many people have the guts to demonstrate and explain such topics.

  • @DROPSHIPCAPTAIN
    @DROPSHIPCAPTAIN 2 місяці тому

    Cool!

  • @arashinoatode
    @arashinoatode 2 місяці тому

    such simple presemtation. loved it

  • @apple.3947
    @apple.3947 2 місяці тому

    what the fuck is this.

  • @blitzkrieg19397
    @blitzkrieg19397 2 місяці тому

    16:06

  • @lingdatang669
    @lingdatang669 2 місяці тому

    29:29 BOOKmark

  • @Koenfred19
    @Koenfred19 2 місяці тому

    Is there a Adguard or Pihole blocklist for the domain's of pegasus so Day2Day users can have a extra (Little) layer of protection against them?

  • @lingdatang669
    @lingdatang669 2 місяці тому

    24:14 bookmark

  • @0xbitbybit
    @0xbitbybit 2 місяці тому

    Would be interested to see how the first phase was done, how the "light bulb" strings are actually generated, I get they are different function calls but what the process looks like and the tools used and how it's actually done would be good to see!

  • @CyberDeck-pg7sf
    @CyberDeck-pg7sf 2 місяці тому

    Is it possible to get the sample you are analyzing ?

  • @florencetown4024
    @florencetown4024 2 місяці тому

    05:00

  • @miralnuruyev9177
    @miralnuruyev9177 3 місяці тому

    Up

  • @DerIchBinDa
    @DerIchBinDa 3 місяці тому

    "Intel has a 95% market share" - oh boy did that not age well 😅

  • @Lou-sassole3
    @Lou-sassole3 3 місяці тому

    Oh hell yea

  • @MikeTheSapien3
    @MikeTheSapien3 3 місяці тому

    Interesting. Even if this is more than 2 decades old, it's still applicable today.

  • @ack1299
    @ack1299 3 місяці тому

    Very insightful session. Thanks a lot!

  • @marianarlt
    @marianarlt 3 місяці тому

    Cat tries to eat plushy fish: 80mio views in two days Very good in-depth talk about the technologies that run our world that are still valuable years later:

  • @KatyYoder-cq1kc
    @KatyYoder-cq1kc 4 місяці тому

    All militia, governments, white supremacists, and communists: Cease and desist all malicious use of AI against myself and my family. We are not your property.

  • @GullKhan006
    @GullKhan006 4 місяці тому

    Am from Pakistan 🎉

  • @GullKhan006
    @GullKhan006 4 місяці тому

    I love My heroes ❤

  • @jimmyblaze_4115
    @jimmyblaze_4115 4 місяці тому

    I'm suffering terrorism issues in Sudbury Ontario they are using SSL or tsl packets and illegal communications or even Pegasus.

  • @jimmyblaze_4115
    @jimmyblaze_4115 4 місяці тому

    I'm suffering terrorism issues in Sudbury Ontario they are using SSL or tsl packets and illegal communications.

  • @jimmyblaze_4115
    @jimmyblaze_4115 4 місяці тому

    I'm suffering terrorism issues in Sudbury Ontario they are using SSL or tsl packets and illegal communications.

  • @OhMyVideology
    @OhMyVideology 4 місяці тому

    Great talk

  • @shubham_srt
    @shubham_srt 4 місяці тому

    ayoooo

  • @ihacksi
    @ihacksi 4 місяці тому

    Best memory forensics presentation ever! Thank you sir!

  • @Shinesunny-sg6qc
    @Shinesunny-sg6qc 4 місяці тому

    a good idea about treat definder

  • @tcmatg
    @tcmatg 4 місяці тому

    legend