Hack In The Box Amsterdam 2018
2018-04-09..2018-04-13
Amsterdam, Netherlands
| title | author | length |
|---|---|---|
| Welcome Address: Improving Incentives for Cybersecurity | Michel van Eeten | 17m |
Argues that failures stem from incentives not just design and demonstrates this with large-scale incident and vulnerability data, DNS/AS-level infection maps… | ||
| KEYNOTE 1: The Future, The Past, and … Wait, Where the Hell are We Now? | M. Marschalek | 52m |
Argues that threat detection is stuck chasing patterns and that defensive AI fails when features are wrong, documents a shift into CPU microarchitecture with a… | ||
| D1T1 - Real World Attacks Against Secure Elements | Don Bailey | 59m |
Demonstrates a practical attack against Apple’s global MFi/WAC provisioning that lets an attacker sitting nearby impersonate any accessory, relay mDNS via… | ||
| D1T1 - Brida: When Burp Suite meets Frida | Federico Dotta, Piergiovanni Cipolloni | 53m |
Brida integrates Burp Suite with Frida, letting Burp call an app’s internal routines to decrypt, encrypt, and sign network traffic on-device. It demonstrates a… | ||
| D1T1 - Covert Data Exfiltration Channel | Hongjian Cao, Kunzhe Chai, Jun Li | 31m |
Claims a USB HID delivers a first-stage payload then a removable covert Wi‑Fi C2 uses Ghost Tunnel built on 802.11 management frames to exfiltrate and command… | ||
| D1T1 - Abusing The Travel Industry | V. Kropotov, F. Yarochkin, M. Fuentes, L. Gu | 46m |
Underground marketplaces sell flights, hotels, cars and forged IDs, often for 40–70% discounts by using stolen credit cards, account takeovers or hacked… | ||
| D1T1 - How to Analyze and Find Bugs in MacOS and iOS Kernel Drivers | X. Bai, M. Zheng | 45m |
Open-source tool Ryuk recovers C++ classes, vtables and function names from closed Apple kernel drivers to enable static and manual analysis. The work finds… | ||
| D1T1 - Fuzzing Javascript Engines for Fun and Pwnage | Areum Lee, Jeonghoon Shin | 31m |
Built a JavaScript fuzzing factory that runs in Docker with a Node.js web UI and EC2 nodes (4 vCPU, 8GB), uses in‑memory input by patching engines to cut disk… | ||
| D1T2 - Smashing Ethereum Smart Contracts for Fun and ACTUAL Profit | Bernhard Mueller | 48m |
Shows concrete exploits against real Ethereum contracts and explains why Mythril (the “nmap of Ethereum”) plus symbolic execution find bugs that static linting… | ||
| D1T2 - Attacking Microsoft’s .NET Framework Through CLR | Yu Hong, Shikang Xing | 56m |
Research maps concrete CLR attack paths and tools and shows working exploits and measurements. A SQL Server CLR exploit and automation load arbitrary MSIL into… | ||
| D1T2 - Techniques FOR %F IN (-style) DO (S-level CMD Obfuscation) | Daniel Bohannon | 01h 04m |
Claim: cmd.exe offers powerful, under‑documented obfuscation primitives that attackers already exploit and defenders largely miss. Demonstrated techniques… | ||
| D1T2 - Pwning KNX & ZigBee Networks | HuiYu Wu, YuXiang Li, Yong Yang | 46m |
Researchers demonstrate remote compromise of KNX/IP routers to eavesdrop or DoS building bus and reprogram group tables to control devices across rooms in a… | ||
| D1T2 - Rooting Android 8 with a Kernel Space Mirroring Attack | Yong Wang, Yang Song | 42m |
Details an out‑of‑bounds write in the media codec that writes 0x80-bytes into process memory when decoding a crafted 0x80-filled mp4, uses shared memory… | ||
| D1T2 - Applying Machine Learning to User Behavior Anomaly Analysis | Eugene Neyolov | 01h 01m |
R&D for a user-behavior analytics prototype uses clustering for feature selection, serial-correlation checks for data quality, frequency-tuned scoring and… | ||
| CommSec D1 - The Life & Death of Kernel Object Abuse | Salf ElSherei, Ian Kronquist | 40m |
Survey of concrete exploit techniques against Win32k GDI: shows GDI Bitmaps (surf) and GDI Palettes abused to get relative/arbitrary kernel read/write, using… | ||
| CommSec D1 - Steganography Ante Portas | Steffen Wendzel | 31m |
A survey of decades of papers yields an explicit taxonomy of eleven covert-channel size modulation and value modulation patterns plus timing varieties like… | ||
| CommSec D1 - Behaviors and Patterns of Rogue Hosting Providers | D. Mahjoub, S. Brown | 39m |
Large-scale threat intel uses 150 billion DNS lookups/day and a Hadoop + Elasticsearch pipeline with ML and graph algorithms to turn raw lookups into… | ||
| CommSec D1 - An Isolated Data Center Security Policy Model Using SmartNICs | Ofir Arkin | 01h 00m |
Argues that placing policy on SmartNICs isolates infrastructure from tenant hosts, offloads control and data planes, and restores performance lost to… | ||
| CommSec D1 - Keynterceptor: Press Any Key to Continue | Niels van Dijkhuizen | 30m |
Proof-of-concept Keynterceptor is an in-keyboard implant built from off‑the‑shelf parts (Teensy-like microcontroller, battery-backed RTC, EEPROM and a radio)… | ||
| CommSec D1 - How to Find and Exploit Bugs in IoT Devices | Kelvin Wong | 30m |
Demonstrates hardware hacks that recover full firmware and config from routers and voice hubs: JTAG on a Linksys WRT54G yields a kernel and memory dump, opens… | ||
| CommSec D1 - Faster, Wider, Greater: Modern Pentest Tricks | Thomas Debize | 33m |
Shows how to process massive recon and tool output into CSV pipelines, using CSVKit to clean, join and SQL-query million-row scans (IPv4/masscan scale) and… | ||
| CommSec D1 - A Deep Dive Into Malicious Documents | Josh Stroschein | 25m |
Step‑by‑step techniques for dissecting maldocs: use Oledump to list streams and extract userform blobs that store ASCII‑encoded PE bytes, open the project in… | ||
| CommSec D1 - Attacking IoT Speakers | Stephen Hilt | 32m |
Analysis of Sonos and Bose shows unauthenticated HTTP APIs (notably port 1400 /status) leaking topology, accounts and current track info; over 5,000+ Sonos and… | ||
| KEYNOTE 2 - A Risk Assessment of Logo Disclosures | Jennifer Leggio | 45m |
Argues that branded “logo disclosures” and press‑release-first tactics create real risk: cites the Heartbleed logo by Codenomicon that amplified chaos… | ||
| D2T1 - Sandbox Evasion Using VBA Referencing | Aviv Grafi, Amit Dori | 42m |
Attackers host a remote VBA project and a tracking image, craft an Excel file that references the remote project, and use the request order — image-before-code… | ||
| D2T1 - Uncovering the Android Patch Gap | Karsten Nohl, Jakob Lell | 49m |
Research measures which Android security patches actually appear in firmware by comparing extracted function code to precompiled signatures built from patched… | ||
| D2T1 - Backdooring & Remotely Controlling Cars | Sheila A Berta, Claudio Carraciolo | 40m |
A hardware CAN backdoor called The Bicho (evolved from early DeVito prototypes) injects higher-priority CAN frames fast enough to override legitimate messages… | ||
| D2T1 - Establishing Covert Channels By Abusing GSM AT Commands | A. Munoz, J. C. Saez | 52m |
Demonstrates covert data exfiltration by issuing GSM AT commands to a DIY handset built from a SIM900 GSM module and recycled parts, using AT dialing and… | ||
| D2T1 - Expanding Your WMI Lateral Movement Arsenal | Philip Tsukerman | 45m |
Demonstrates concrete WMI lateral techniques that avoid Win32_Process create and beat common network IDS by changing execution vectors: class derivation to… | ||
| CLOSING KEYNOTE - Security is What We Make of It - Blockchain and Beyond | Amber Baldet | 51m |
Argues blockchain is fundamentally an information‑security product and distinguishes public chains (world‑readable, pseudonymous) from permissioned ledgers… | ||
| D2T2 - Mallet: Towards a Generic Intercepting Proxy | Rogan Dawes | 57m |
Mallet is a Netty-based intercepting proxy that actually wires protocol decoders into a drag-and-drop graph UI, letting users build pipelines from existing… | ||
| D2T2 - Over The Edge: Pwning The Windows Kernel | Rancho Han | 46m |
15+ kernel vulnerabilities in the Windows graphics stack lead to multiple Edge-to-SYSTEM escapes with full exploits and demos, including previously disclosed… | ||
| D2T2 - A New Fuzzing Method for Android | Zhang Qing, Guangdong Bai | 20m |
A new Android fuzzer generates combinations of function points (read/write/open/etc.) and repeatedly invokes targeted functions to force quantitative change to… | ||
| D2T2 - Exposing Hidden Exploitable Behaviors Using EDF | Fernando Arnaboldi | 50m |
A Python-based differential-fuzzing framework compares outputs across interpreters, OSes and versions and finds more than 20 distinct issue classes. It… | ||
| D2T2 - Defense-in-Depth Techniques for Modern Web Apps | M. Spagnuolo, L. Weichselbaum | 47m |
Describes concrete defenses and rollout results: nonce and strict-dynamic CSPs deployed to protect against XSS (CSP enforced on over 50% of Google text/html… | ||
| CommSec D2 - Hiding Tasks via Hardware Task Switching | Kyeong Joo Jung | 26m |
Claims that IA-32 hardware task switching can run a hidden scheduler that the OS and standard tools miss, demonstrated by installing a driver to achieve ring 0… | ||
| CommSec D2 - Automatic Generation of ROP Chains | Ricardo. J. Rodríguez, Daniel Uroz | 35m |
A Python 3 tool named EasyROP searches a binary with Capstone for gadgets implementing random‑access‑machine ops (load constant, move, load/store, ALU, branch)… | ||
| CommSec D2 - ProdSec: A Technical Approach | Jeremy Brown | 32m |
Nvidia shifts product security from reactive bug triage to measurable engineering: build a centralized fuzzing lab that runs AFL and unit-test-derived fuzzers… | ||
| CommSec D2 - PyREBox: Making Dynamic Instrumentation Great Again | X. Ugarte-Pedrero | 01h 00m |
PyREBox (Python scriptable Reverse Engineering Sandbox) is an open-source tool focused on reverse engineering that provides instrumentation and debugging… | ||
| CommSec D2 - Hacking a Hospital for Fun and Profit | Asaf Cohen, Ofir Kamil | 26m |
Hospital LAN has an open WiFi in the cafeteria that exposes a flat network, live RJ45 jacks give immediate IPs, and a kiosk runs Windows 7 with local admin and… | ||
| CommSec D2 - Smart Contract (In)Security | Ben Schmidt | 25m |
Shows concrete exploits and countermeasures: the Parity library delegatecall + uninitialized library bug that locks $160–300M by letting an attacker become… | ||
| nothing matches | ||