Black Hat Asia 2018
2018-03-20..2018-03-23
Singapore, Singapore
[Black Hat Asia 2015, Black Hat Asia 2016, Black Hat Asia 2018, Black Hat Asia 2019, Black Hat Asia 2020, Black Hat Asia 2021, Black Hat Asia 2022, Black Hat Asia 2023]
| title | author | length |
|---|---|---|
| National Cyber-Aggression and Private-Sector Internet Infrastructure | Bill Woodcock | 46m |
Work traces early technical fixes like anycast routing and the build-out of nearly 300 internet exchange points to concrete harms: state attacks reuse vendor… | ||
| A Short Course in Cyber Warfare | The Grugq | 55m |
Argues cyber is a distinct 5th war dimension with four intersections — active/passive/physical/cognitive — and that real advantage comes from bureaucracy and… | ||
| Server Tailgating - A Chosen-PlainText Attack on RDP | Eyal Karni, Yaron Zinar, Roman Blachman | 41m |
Millions of networks are relying on Windows authentication protocols to secure their logins, and consequently, their network's integrity. In this talk, we will… | ||
| Nation-State Moneymule's Hunting Season – APT Attacks Targeting Financial Institutions | Chi-en (Ashley) Shen, Kyoung-ju Kwak, Min-Chang Jang | 55m |
Four documented campaigns show Lazarus, Bluenoroff, Andariel and Reaper pivoting to theft: a VDI named‑pipe VDI escape lets Manuscript crawl VLANs to harvest… | ||
| Hourglass Model 2.0: Case Study of Southeast Asia Underground Services Abusing Global 2FA | Anna Chung | 41m |
Hourglass Model 2.0 is a collection framework that maps four underground communication flows and turns marketplace chatter into operational leads; applied to a… | ||
| KSMA: Breaking Android Kernel Isolation and Rooting with ARM MMU Features | Yong Wang, Chengming Yang, Baozeng Ding, Yang Song | 35m |
Claims a practical rooting chain that affects devices shipping with Linux 3.18 by chaining a Use‑After‑Free race in notification/slab handling into a kernel… | ||
| Mac-A-Mal: An Automated Platform for Mac Malware Hunting | Duy-Phuc Pham, Fabio Massacci | 18m |
Mac-A-Mal is an automated macOS malware analysis platform built on Cuckoo that runs macOS guests on VMware/VirtualBox/QEMU, hooks kernel syscalls to capture… | ||
| Death Profile: Now iOS Has Been Compromised to Suspected Ransomware | Ju Zhu, Moony Li | 30m |
Claims a remote iOS ransomware vector that installs malicious configuration/provisioning profiles — dubbed death profile — which deploys many web‑clip icons… | ||
| Breaking the Attack Graph: How to Leverage Graphs to Strengthen Security in a Domain Environment | Marina Simakov | 26m |
Describes using graphs built from domain group memberships, local admin lists and domain controller logs to find and cut attack paths; demonstrates Bloodhound… | ||
| New Compat Vulnerabilities in Linux Device Drivers | Pengfei Ding, Chenfu Bao | 24m |
Prior audits find 30+ compat bugs; this work identifies a new class in device-driver ioctl paths where mixed compat ioctl mixing causes validation and… | ||
| A Deal with the Devil: Breaking Smart Contracts | David Wong, Mason Hemmel | 51m |
A practical toolkit for finding real vulnerabilities in deployed contracts, showing concrete failures: reentrancy drain $50M (DAO), Parity multi‑sig: $30M… | ||
| Analyzing & Breaking QNX Exploit Mitigations and PRNGs For Embedded Systems | Jose vessels | 54m |
Dissects QNX exploit mitigations and PRNGs, showing user-space /dev/random moves from a broken Yarrow variant to Heimdall Fortuna while a new kernel RNG draws… | ||
| International Problems: Serialized Fuzzing for ICU Vulnerabilities | Yuan Deng | 36m |
ICU libraries contain multiple exploitable bugs discovered by applying serialized fuzzing to JavaScript ICU bindings, feeding crafted locale/time/number… | ||
| Detecting Security Hazards in SEAndroid Vendor Customizations via Large-Scale Supervised ML | Xiangyu Liu, Yang Song, Yi Zhang | 46m |
A tool called VSPMiner builds a training set from differential analysis of ~10,000 AOSP commits to label ~25,000 positive and ~24,000 negative SELinux rules… | ||
| Counter-Infiltration: Future-Proof Counter Attacks Against Exploit Kit Infrastructure | Yin Minn Pa Pa, Hiroshi Kumagai, Masaki Kamizono, Takahiro Kasama | 59m |
Team redeploys leaked kits (33 collected, four fully rebuilt) in a lab and identifies concrete choke points: an unauthenticated API that allows API exhaustion… | ||
| XOM-switch: Hiding Your Code from Advanced Code Reuse Attacks In One Shot | Mingwei Zhang, Ravi Sahita, Daiping Liu | 49m |
Claims a working tool XOM-switch that flips userland code pages to execute‑only using CPU PKU support, applied to deployed Linux binaries without needing… | ||
| When Good Turns Evil: Using Intel SGX to Stealthily Steal Bitcoins | Michael Schwarz, Moritz Lipp | 54m |
Demonstrates that malware inside Intel SGX can stealthily exfiltrate keys by running an attacker enclave that builds an SGX-resident key extractor and uses… | ||
| XOM-switch: Hiding Your Code from Advanced Code Reuse Attacks In One Shot | Mingwei Zhang, Ravi Sahita, Daiping Liu | 34m |
A deployable tool called XOM-switch statically patches ld.so to enable executable-only pages on Intel CPUs using PKU/protection keys without source or heavy… | ||
| Breach Detection At Scale With AWS Honey Tokens | Dan Bourke, Daniel Grzelak | 25m |
Demonstrates generating inert AWS access keys instrumented to trigger logging and alerts, builds an open source CloudFormation deployment called Project Space… | ||
| All Your Payment Tokens Are Mine: Vulnerabilities of Mobile Payment Systems | Zhe Zhou | 23m |
Shows that offline mobile payment tokens sent over QR, audio or MST are trivially sniffed and replayed: researchers extend MST range to 2-meter MST sniff… | ||
| Prison Break Season 6: Defeating the Mitigations Adopted by Android OEMs | Jun Yao, Tong Lin | 41m |
Disclosure of multiple OEM kernel protections and concrete bypasses: decrypt OTA images by reversing the recovery to recover an AES-ECB key extracted from… | ||
| Tales from the NOC: Going Public in Asia | Neil R. Wyler, Bart Stump | 47m |
Black Hat Asia runs a public NOC that writes every packet to disk (data deleted after the show) using Palo Alto for the edge, RSA NetWitness for deep… | ||
| Shadow-Box v2: The Practical and Omnipotent Sandbox for ARM | Seunghun Han, Jun-Hyeok Park | 39m |
Shadow-box v2 claims a ring‑1 style protector for ARM that runs inside a TEE using OP-TEE and enforces kernel integrity via IMA plus a page‑hash verifier with… | ||
| Securing Your In-Ear-Fitness Coach: Challenges in Hardening Next Generation Wearables | Kavya Racharla, Sumanth Naropanth | 54m |
Case study on Radar Pace shows concrete failures and fixes: mobile apps can read encrypted Bluetooth traffic if granted Bluetooth permissions, allowing a… | ||
| A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! | Orange Tsai | 47m |
A custom URL-parser fuzzer tests many languages (Python, PHP, Perl, Ruby, Java, JavaScript, Wget, cURL) against a local DNS/webserver/iptables setup and finds… | ||
| return-to-csu: A New Method to Bypass 64-bit Linux ASLR | Hector Marco-Gisbert, Ismael Ripoll | 57m |
Claim: return-to-csu is a generic 64‑bit Linux ASLR bypass that uses the startup/CSU code always attached to dynamically linked executables, not the target… | ||
| nothing matches | ||