Locknote: Conclusions and Key Takeaways from Day 1 locknote

on YouTube ↗41m

" summary

Day one surfaces concrete, actionable findings: a legacy SQL injection chain uses WebDAV and the Jet engine to fetch attacker‑controlled files, fuzzing finds dozens of bugs in a month or two across IIS/SQL Server and 20 years of Windows builds with possible token‑kidnap privilege escalation; CAN fuzzing of Tesla superchargers produces a Raspberry Pi “CAN spy” prototype and forthcoming code; Android unprotected broadcasts on Pixel 3/4 enable arbitrary command execution and contact overwrites; RFC ambiguity yields DNS/TCP stacks where 50% of seven implementations are vulnerable and even 1% of devices could mean ~100 million at risk.

AI-written summary · about

" chapters (10)

1. 0:00Introduction
2. 2:43Pams Favourite Talk
3. 8:04Mika
4. 10:45Fyodor
5. 14:10Tom
6. 29:10My take on ransomware
7. 31:20Copy and paste attacks
8. 33:20Ransomware extortion
9. 36:20Buy time
10. 38:40Releasing data

" related talks

• 51mLocknote: Conclusions and Key TakeawaysChris Wysopal, Dino Dai Zovi, Jeff Moss, Vincenco Iozzo · Black Hat Asia 2016
• 41mLocknote: Conclusions and Key Takeaways from Day 1Ryan Flores, Ty Miller, Lidia Giuliano, Ashley Shen · Black Hat Asia 2020
• 30mLocknote: Conclusions and Key Takeaways from Day 1Jeff Moss, Meadow Ellis, Stefano Zanero, Sharon Conheady, Matt Suiche · Black Hat Europe 2022
• 39mLocknote: Conclusions and Key Takeaways from Day 2Neil R. Wyler, Asuka Nakajima, Seungjoo Kim, Mika Devonshire · Black Hat Asia 2020
• 48mConclusions and Key Takeaways from Day 1Jeff Moss, Marina Krotofil, Daniel Cuthbert, Meadow Ellis, Saša Zdjelar · Black Hat Europe 2023
• 48mLocknote: Conclusions and Key Takeaways from Black Hat Europe 2018Jeff Moss · Black Hat Europe 2018
• 44mLocknote: Conclusions and Key Takeaways From Black Hat Europe 2017Jeff Moss, Andreas Lindh, Shawn Moyer, Sharon Conheady · Black Hat Europe 2017
• 45mLocknote: Conclusions and Key Takeaways fromJeff Moss, Haroon Meer, Jennifer Savage, Marion Marschalek · Black Hat Europe 2015