HITBSecConf 2019 Amsterdam
2019-05-06..2019-05-10
Amsterdam, Netherlands
| title | author | length |
|---|---|---|
| Hacking The 0day Market | Andrea Zapparoli Manzoni | 24m |
Crowdfense says it normalizes the chaotic 0day market by running a $10M bug‑bounty (2018) and a dedicated Vulnerability Research Hub (launched Sept 2018) that… | ||
| WiCy: Monitoring 802.11AC Networks At Scale | Vivek Ramachandran | 28m |
802.11ac networks bring in significant monitoring complexities with features such as multi-user MIMO, advanced beamforming, up to 8 spatial streams, extremely… | ||
| Hacking LTE Public Warning Systems | Weiguang Li | 22m |
Finds that LTE public warning messages are sent in cleartext and lack signature or authentication, so a malicious LTE cell can forge alerts. Uses a low‑cost… | ||
| V1 Bounty: Building A Coordinated Bug Disclosure Bridge For The EU | Benjamin Kunz | 53m |
A coordinated EU–Asia bug bounty bridge is built: a V1 Bounty platform using the Amber framework, hosted in Germany (Frankfurt) and designed to be GDPR|DSGV… | ||
| Social Networks: Can We Fix Them? | Joel Hernandez | 18m |
A new social network called OpenBook claims to replace engagement-for-profit with privacy and community rules, publishing open source mobile and web app code… | ||
| Ghost Tunnel 2.0: Blue Ghost | Yongtao Wang | 26m |
GhostTunnel 2.0 implements a covert Bluetooth channel that embeds data in BLE advertising/scan frames using a manufacturer-specific AD field and a custom… | ||
| Hiding A Secret Distributed Chat System In 802.11 Management Frames | Yago Hansen | 38m |
Implements a working distributed chat that hides messages and files inside 802.11 management frames, packing an AES-encrypted payload in probe requests (PoC… | ||
| VoLTE Phreaking | Ralph Moonen | 33m |
Research shows VoLTE SIP signaling exposes real weaknesses across European networks: on rooted Android devices the RMNET1 IPv6 interface carries SIP over an… | ||
| Infrared: Old Threat Meets New Devices | Wang Kang | 30m |
Shows that 960 fps smartphone slow‑motion video plus ffmpeg frame extraction recovers 940 nm IR remote pulses well enough to decode NEC timings, aligning to a… | ||
| A Decade Of Infosec Tools | Thomas Debize | 32m |
Quantitative analysis of 2000+ InfoSec projects pulls metadata from four publication sources and GitHub and shows a surprising GitHub monopoly (thousands of… | ||
| Wireless Hacking With HackCUBE-Special | Jie Fu, Kunzhe Chai | 35m |
A pocket HackCUBE-special builds on a CC1101-based radio and a separate low‑frequency board to attack garage remotes and 125 kHz tags; it captures and decodes… | ||
| How To Dump, Parse, And Analyze i.MX Flash Memory Chips | Damien Cauquil | 47m |
Shows how to recover filesystems from i.MX6 NAND dumps by parsing the vendor’s custom layout, locating the FCB structure, removing metadata and ECC bits, then… | ||
| Overcoming Fear: Reversing With Radare2 | Arnau Gàmez i Montolio | 02h 05m |
Claim: radare2 is approachable and practical for real reversing tasks; demos show concrete results. The session patches a crackme by patching conditional jump… | ||
| Attacking GSM - Alarms, Smart Homes, Smart Watches And More | Alex Kolchanov | 01h 17m |
This 120-minute workshop will cover different attacks on popular GSM-devices: alarms, smart home systems, access control systems and smartwatches for kids… | ||
| The End Is The Beginning Is The End: Ten Years In The NL Box | D. Kannabhiran | 40m |
Conference origin story from Malaysia (2003) to Netherlands (2009) with a local crew that grows to ~90 volunteers and 60–70 core crew members; 200+ CFPs with… | ||
| Make ARM Shellcode Great Again | Saumil Udayan Shah | 57m |
Compared to x86, ARM shellcode has made little progress. The x86 hardware is largely homogenous. ARM, however, has several versions and variants across devices… | ||
| TOCTOU Attacks Against Secure Boot And BootGuard | Trammell Hudson, Peter Bosch | 39m |
Demonstrates a new TOCTOU technique that changes firmware after Intel BootGuard’s signature check by disabling the cache-as-RAM environment and forcing… | ||
| Finding Vulnerabilities In iOS/MacOS Networking Code | Kevin Backhouse | 50m |
Finds multiple XNU networking bugs in mbuf processing that lead to crashes and were credited as 8 CVEs (including several RCEs). Uses Semmle QL variant… | ||
| The Birdman: Hacking Cospas-Sarsat Satellites | Hao Jingli | 43m |
Built portable receivers and transmitters and using GNU Radio plus SDR hardware (Airspy, HackRF, USRP, ProtoSDR), the research demonstrates COSPAS‑SARSAT… | ||
| Deobfuscate UEFI/BIOS Malware And Virtualized Packers | Alexandre Borges | 01h 09m |
Shows concrete deobfuscation steps: use Metasm and Miasm to backtrace virtualized handlers and collapse dozens of VM-translated instructions into original x86… | ||
| A Successful Mess Between Hardening And Mitigation | Weichselbaum, Spagnuolo | 01h 01m |
Google reports deploying nonce-based CSP across ~62% of outgoing traffic and shows CSP mitigated ~60% of externally reported XSS in one year; on 11 very… | ||
| SeasCoASA: Exploiting A Small Leak In A Great Ship | Kaiyi Xu, Lily Tang | 39m |
A new 0day in Cisco ASA’s WebVPN AnyConnect (embedded Lua 5.0.2) uses an forprep OOB to gain arbitrary PC in the Lua VM, then builds arbitrary read/write by… | ||
| Pwning Centrally-Controlled Smart Homes | Sanghyun Park, Seongjoon Cho | 41m |
Smart homes are very popular in South Korea where the internet is well developed. There are varieties of IoT (Internet of Things) devices for each household… | ||
| Hourglass Fuzz: A Quick Bug Hunting Method | M. Li, T. Han, L. Jiang, L. Wu | 58m |
Hourglass Fuzz is a system that funnels normal user activity through an hourglass bottleneck to force inputs into deep kernel and user-mode paths. It runs on… | ||
| Hidden Agendas: Bypassing GSMA Recommendations On SS7 Networks | Kirill Puzankov | 55m |
Demonstrates that SS7 TCAP’s ability to carry multiple MAP components lets an attacker hide malicious MAP operations behind benign ones to bypass SS7 firewalls… | ||
| fn_fuzzy: Fast Multiple Binary Diffing Triage With IDA | Takahiro Haruyama | 41m |
Tool computes per-function ssdeep hash of code bytes (ignoring relocation/fixups) and a Machoc hash of call-flow, stores all hashes in one database file, then… | ||
| Duplicating Black Box Machine Learning Models | Rewanth Cool, Nikhil Joshi | 39m |
The trained Machine learning models are core components of proprietary products. Business models are entirely built around these ML powered products. Such… | ||
| Researching New Attack Interfaces On iOS And OSX | Lilang Wu, Moony Li | 53m |
Automated static and dynamic analysis generates automatic external method extraction for IOUserClient vectors, a custom kernel-extension analysis agent builds… | ||
| For The Win: The Art Of The Windows Kernel Fuzzing | Guangming Liu | 46m |
A kernel fuzzing framework targets Windows kernel objects — GDI and menu/cursor objects — by enumerating API functions with WinDbg, scripting… | ||
| H(ack)DMI: Pwning HDMI For Fun And Profit | Jeonghoon Shin, Changhyeon Moon | 42m |
Explains HDMI attack surface by mapping TMDS, CEC, DDC and ARC to concrete exploit primitives, describes a custom fuzzer made by authors that exercises… | ||
| Automated Discovery Of Logical Priv. Esc. Bugs In Win10 | Wenxu Wu, Shi Qin | 50m |
An automated system simulates UI actions and invokes exposed interfaces to trigger and validate logical privilege-escalation patterns in Windows 10 services… | ||
| Hey Attacker! I Can See You! | Ross Bevington | 32m |
Built a simulated Linux environment and protocol emulators to study human attackers rather than bots, using Linux emulator plus custom SSH fingerprinting and… | ||
| Rise Of The WarPi | Kevin McPeake | 31m |
Claims a personal toolkit that logs over five million unique Wi‑Fi APs, routinely captures 20–30k SSIDs per day and records bursts like 100,000 SSIDs in a day… | ||
| Attacking Encrypted VOIP Protocols | Ivica Stipovic | 30m |
Demonstrates decrypting TLS-wrapped SIP by chaining mitm_relay.py to Burp to convert SIP into editable HTTP-like requests, then parsing that text to… | ||
| PatrOwl - The Red Flavour Of SOC Automation And Orchestration | Nicolas Mattiocco | 21m |
PatrOwl automates and orchestrates continuous security checks by calling around 40 tools and online services, both commercial and open source, centralizing… | ||
| Secure And Scalable Anomaly-Based Network Intrusion Detection | Philipp Mieden | 32m |
A memory-safe network capture framework written in Go decodes packets with gopacket, serializes type-safe audit records as compressed protocol buffers, and… | ||
| Demystifying IoT/OT Hacks With SDR | Harshit Agrawal, Himanshu Mehta | 30m |
Demonstrates low-cost RF tooling that captures and replays real device signals: HackRF replay of car lock/unlock recorded with an RTL-SDR and inspected in… | ||
| Reverse Engineering Custom ASICs By Exploiting Supply-Chain Leaks | Thomas Weber | 27m |
Custom Siemens S7-1200 SoCs are bought as leaked boards on Chinese marketplaces, probed with an oscilloscope, simple resistance measurements and decapped with… | ||
| I Own Your Building (Management System) | Gjoko Krstic | 37m |
Research identifies internet‑exposed building management and access control products with firmware and web interfaces that permit chained attacks from trivial… | ||
| Reversing Mobile Malware | Abdullah Joseph | 30m |
Live analysis of the simbad campaign shows a long‑running over service that polls a Parse C2, returns app lists or an apk module and either opens store URLs… | ||
| Might As Well JUMP: Exploit Development For Java Serialization | Jameel Nabbo | 23m |
Demonstrates a working 0day exploit chain against an Apache MyFaces app on current Tomcat that builds a Python payload, encrypts it with DES-ECB encryption… | ||
| GSEC Lucky Draw: Win A Trip To Singapore | Cherry | 05m |
Stage raffle at HITBSecConf Amsterdam hands out three staged prizes: first is a hacking box anniversary kit containing posters and an limited edition towel (20… | ||
| Securing Journalists | Runa A. Sandvik | 43m |
Built a newsroom security program that scales from baseline password/TOTP work to bespoke support for investigations, travel and source handling; the org… | ||
| Compiler Bugs And Bug Compilers | Marion Marschalek | 01h 04m |
Shows concrete compiler modifications that reliably insert exploitable behavior into Linux binaries using GCC plugins and direct GCC changes. Demo replaces a… | ||
| Muraena: The Unexpected Phish | Michele Orru, Giuseppe Trotta | 41m |
Demonstrates a working phishing pipeline that defeats SMS/OTP/push/software 2FA (U2F only resists), using a Go reverse proxy Muraena to transparently MiTM… | ||
| Hacking Jenkins | Orange Tsai | 38m |
Finds and chains together a dynamic URL-loading ACL bypass and Groovy meta-programming to achieve a full pre-auth RCE. Uses Stapler’s dynamic routing to… | ||
| Sneaking Past Device Guard | Philip Tsukerman | 51m |
Shows concrete Device Guard bypasses that actually run unsigned code: a trusted-location registry write that makes Office run macros with no user action, an… | ||
| Attacking Industrial Remote Controllers | Marco Balduzzi, Federico Maggi | 55m |
Researchers survey seven vendors, find radio controllers from cranes to drillers that lack crypto and enforceable rolling codes, and release 10 advisories… | ||
| The Beginning Of The End? A Return To The Abyss For A Quick Look | R. Thieme | 01h 01m |
25 years of field experience tracks a shift from libertarian cyberspace myth to industrialized surveillance where tools are dual use and fixes create profit… | ||
| Closing Ceremony & CTF Prize Giving Ceremony | 20m | |
Conference wraps with a record number of villages and competitions and prize details: car hacking winners include Bram; an AI self‑racing: AI vs human, AI… | ||
| nothing matches | ||