PWNIE Awards at Black Hat USA 2014
summary
A rapid roundup of concrete results: a Chrome bug gives an arbitrary read/write primitive by overloading an ArrayBuffer length field, a pair of exploits bypass Windows 8.1 mitigations and win a large bounty, and a Windows driver escalation lands as the privilege-escalation winner. Research demonstrates acoustic RSA key extraction and EM leakage that recover real keys from a laptop with a nearby phone, with implemented attacks. Surprises include Heartbleed sitting in widely used code for two years and Apple’s duplicated goto causing a catastrophic auth bypass.
AI-written summary · about
chapters (20)
- 0:00Welcome to the 25th Annual Pwny Awards
- 4:00Introducing the nominees for best server-side bug
- 6:29Accepting the award for best server-side bug
- 8:37First musical performance: CSSP parody
- 10:22Nominees for best client-side bug
- 12:29Accepting the award for best client-side bug
- 13:12Second musical performance: Memory Corruption
- 15:10Nominees for best privilege escalation bug
- 17:35Accepting the award for best privilege escalation bug
- 18:18Third musical performance: Expect Us
- 20:09Nominees for most innovative research
- 24:31Accepting the award for most innovative research
- 25:38Fourth musical performance: SSL Smiley Song
- 27:06Nominees for most epic fail
- 31:32Accepting the award for most epic fail
- 32:37Fifth musical performance: Security Kate
- 33:49Nominees for most epic ownage
- 37:32Accepting the award for most epic ownage
- 38:20Sixth musical performance: SSL Smiley Song reprise
- 42:00Closing remarks and thank yous
related talks
50mPwnie Awards 2016
51mExploiting Hardware Glitches And Side Channels In Perfect Software
55mHow hacking works
42m"Vulnerabilities from a grave. Forever dead or maybe alive..."
43mA 3-Year Tale of Hacking a Pwn2Own Target: The Attacks, Vendor Evolution, and Lesson Learneds
45mThe Top 10 Web Hacks of 2014
01h 16mClassic Vulnerabilities
33mWebKit Everywhere: Secure or Not?