Material De Usenix Security 17, sesiones técnicas y talleres

Hace una semana se celebró en Canadá la conferencia “académica” sobre ciber seguridad Usenix junto a un puñado de talleres. Todo el material está disponible de forma gratuita para descarga de ambos eventos: Sesiones Técnicas y Talleres. Aquí tenéis la lista completa de las charlas y sus correspondientes enlaces: Sesiones técnicas de Usenix Security ‘17 When Your Threat Model Is “Everything”: Defensive Security in Modern Newsrooms Erinn Clark, Lead Security Architect, First Look Media/The Intercept How Double-Fetch Situations turn into Double-Fetch Vulnerabilities: A Study of Double Fetches in the Linux Kernel Paper Slides Postmortem Program Analysis with Hardware-Enhanced Post-Crash Artifacts Paper Ninja: Towards Transparent Tracing and Debugging on ARM Paper Slides Prime+Abort: A Timer-Free High-Precision L3 Cache Attack using Intel TSX Paper On the effectiveness of mitigations against floating-point timing channels Paper Slides Constant-Time Callees with Variable-Time Callers Paper Slides Neural Nets Can Learn Function Type Signatures From Binaries Paper CAn’t Touch This: Software-only Mitigation against Rowhammer Attacks targeting Kernel Memory Paper Efficient Protection of Path-Sensitive Control Security Paper Digtool: A Virtualization-Based Framework for Detecting Kernel Vulnerabilities Paper kAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels Paper Venerable Variadic Vulnerabilities Vanquished Paper Towards Practical Tools for Side Channel Aware Software Engineering: ‘Grey Box’ Modelling for Instruction Leakages Paper Slides Strong and Efficient Cache Side-Channel Protection using Hardware Transactional Memory Paper Slides CacheD: Identifying Cache-Based Timing Channels in Production Software Paper An Ant in a World of Grasshoppers Ellen Cram Kowalczyk, Microsoft From Problems to Patterns to Practice: Privacy and User Respect in a Complex World Lea Kissner, Google BinSim: Trace-based Semantic Binary Diffing via System Call Sliced Segment Equivalence Checking Paper PlatPal: Detecting Malicious Documents with Platform Diversity Paper Slides Malton: Towards On-Device Non-Invasive Mobile Malware Analysis for ART Paper Global Measurement of DNS Manipulation Paper Characterizing the Nature and Dynamics of Tor Exit Blocking Paper DeTor: Provably Avoiding Geographic Regions in Tor Paper SmartAuth: User-Centered Authorization for the Internet of Things Paper AWare: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings Paper Slides 6thSense: A Context-aware Sensor-based Attack Detector for Smart Devices Paper Identifier Binding Attacks and Defenses in Software-Defined Networks Paper HELP: Helper-Enabled In-Band Device Pairing Resistant Against Signal Cancellation Paper Attacking the Brain: Races in the SDN Control Plane Paper Detecting Credential Spearphishing in Enterprise Settings Paper SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data Paper When the Weakest Link is Strong: Secure Collaboration in the Case of the Panama Papers Paper Slides Hacking in Darkness: Return-oriented Programming against Secure Enclaves Paper vTZ: Virtualizing ARM TrustZone Paper Slides Inferring Fine-grained Control Flow Inside SGX Enclaves with Branch Shadowing Paper AuthentiCall: Efficient Identity and Content Authentication for Phone Calls Paper Picking Up My Tab: Understanding and Mitigating Synchronized Token Lifting and Spending in Mobile Payment Paper Slides TrustBase: An Architecture to Repair and Strengthen Certificate-based Authentication Paper Transcend: Detecting Concept Drift in Malware Classification Models Paper Syntia: Synthesizing the Semantics of Obfuscated Code Paper Predicting the Resilience of Obfuscated Code Against Symbolic Execution Attacks via Machine Learning Paper Differential Privacy: From Theory to Deployment Abhradeep Guha Thakurta, University of California, Santa Cruz OSS-Fuzz - Google’s continuous fuzzing service for open source software Slides Kostya Serebryany, Google Extension Breakdown: Security Analysis of Browsers Extension Resources Control Policies Paper CCSP: Controlled Relaxation of Content Security Policies by Runtime Policy Composition Paper Same-Origin Policy: Evaluation in Modern Browsers Paper Locally Differentially Private Protocols for Frequency Estimation Paper BLENDER: Enabling Local Search with a Hybrid Differential Privacy Model Paper Computer Security, Privacy, and DNA Sequencing: Compromising Computers with Synthesized DNA, Privacy Leaks, and More Paper BootStomp: On the Security of Bootloaders in Mobile Devices Paper Slides Seeing Through The Same Lens: Introspecting Guest Address Space At Native Speed Paper Oscar: A Practical Page-Permissions-Based Scheme for Thwarting Dangling Pointers Paper PDF Mirage: Content Masking Attack Against Information-Based Online Services Paper Loophole: Timing Attacks on Shared Event Loops in Chrome Paper Game of Registrars: An Empirical Analysis of Post-Expiration Domain Name Takeovers Paper Speeding up detection of SHA-1 collision attacks using unavoidable attack conditions Paper Phoenix: Rebirth of a Cryptographic Password-Hardening Service Paper Vale: Verifying High-Performance Cryptographic Assembly Code Paper Exploring User Perceptions of Discrimination in Online Targeted Advertising Paper Measuring the Insecurity of Mobile Deep Links of Android Paper How the Web Tangled Itself: Uncovering the History of Client-Side Web (In)Security Paper Towards Efficient Heap Overflow Discovery Paper DR.
Leer más

Presentaciones de DEF CON 25

DEF CON 25 Pues ahora le toca el turno a DEF CON, en este caso la edición 25 que se acaba de celebrar y ya tienes también acceso a las presentaciones: 5A1F/ 5A1F-Demystifying-Kernel-Exploitation-By-Abusing-GDI-Objects-WP.pdf 5A1F-Demystifying-Kernel-Exploitation-By-Abusing-GDI-Objects.pdf Cheng Lei/ Cheng-Lei-The-Spear-to-Break-the-Security-Wall-of-S7CommPlus-WP.pdf Cheng-Lei-The-Spear-to-Break-the-Security-Wall-of-S7CommPlus.pdf Denton Gentry/ Denton-Gentry-I-Know-What-You-Are-By-The-Smell-Of-Your-Wifi-WP.pdf Denton-Gentry-I-Know-What-You-Are-By-The-Smell-Of-Your-Wifi.pdf Dimitry Snezhkov/ Dimitry Snezhkov - Extras/ Dimitry-Snezhkov-Abusing-Web-Hooks.pdf Dor Azouri/ Dor-Azouri-BITSInject-WP.pdf Dor-Azouri-BITSInject.pdf Duncan Woodbury and Nicholas Haltmeyer/ Woodbury-and-Haltmeyer-Linux-Stack-Based-V2X-Framework-Hack-Connected-Vehicles-WP.
Leer más

Presentaciones de Black Hat USA 2017

BlackHat 2017 Ya están disponible las presentaciones de Black Hat USA 2017: Stepping Up Our Game: Re-focusing the Security Community on Defense and Making Security Work for Everyone ‘Ghost Telephonist’ Link Hijack Exploitations in 4G LTE CS Fallback Yuwei-Ghost-Telephonist-Link-Hijack-Exploitations-In-4G-LTE-CS-Fallback.pdf (in)Security in Building Automation: How to Create Dark Buildings with Light Speed Brandstetter-insecurity-In-Building-Automation-How-To-Create-Dark-Buildings-With-Light-Speed.pdf Brandstetter-insecurity-In-Building-Automation-How-To-Create-Dark-Buildings-With-Light-Speed-wp.pdf A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!
Leer más

Presentaciones de Black Hat Asia 2017

Black Hat Asia 2017 Ya podemos acceder a muchas de las presentaciones de la edición asiática de Black Hat de este año: The Seven Axioms of Security Why We are Not Building a Defendable Internet Man-in-the-SCADA: Anatomy of Data Integrity Attacks in Industrial Control Systems 24 Techniques to Gather Threat Intel and Track Actors 3G/4G Intranet Scanning and its Application on the WormHole Vulnerability All Your Emails Belong to Us: Exploiting Vulnerable Email Clients via Domain Name Collision Anti-Plugin: Don’t Let Your App Play as an Android Plugin asia-17-Luo-Anti-Plugin-Don’t-Let-Your-App-Play-As-An-Android-Plugin.
Leer más

Presentaciones de Black Hat Europe 2016

Ya se encuentran disponibles las presentaciones de otra de las ediciones de Black Hat, la edición europea de 2016 en este caso. (Pen)Testing Vehicles with CANToolz eu-16-Sintsov-Pen-Testing-Vehicles-With-Cantoolz.pdf 50 Thousand Needles in 5 Million Haystacks: Understanding Old Malware Tricks to Find New Malware Families eu-16-Valeros-50-Thousand-Needles-In-5-Million-Haystacks-Understanding-Old-Malware-Tricks-To-Find-New-Malware-Families.pdf AI based Antivirus: Can AlphaAV Win the Battle in which Man Has Failed? eu-16-Wang-AI-Based-Antivirus-Can-Alphaav-Win-The-Battle-In-Which-Man-Has-Failed.pdf Another Brick Off the Wall: Deconstructing Web Application Firewalls Using Automata Learning eu-16-Argyros-Another-Brick-Off-The-Wall-Deconstructing-Web-Application-Firewalls-Using-Automata-Learning.
Leer más

Presentaciones de Ruxcon 2016

Ya podemos acceder a las presentaciones de Ruxcon Security Conference 2016: Windows Metafiles: An Analysis of the EMF Attack Surface & Recent Vulnerabilities Forcing A Targeted LTE Cellphone Into An Unsafe Network $hell on Earth: From Browser to System Compromise Demystifying the Secure Enclave Processor Strolling into Ring-0 via I/O Kit Drivers Rainbow Over the Windows: More Colors Than You Could Expect Hacker-Machine Interface - State of the Union for SCADA HMI Vulnerabilities Breaking out of QEMU Make iOS App more Robust and Security through Fuzzing Exploiting COF Vulnerabilities In The Linux Kernel Of Mice and Keyboards: On the Security of Modern Wireless Desktop Sets Firmware Biopsy: Towards Taming The Lunacy Leaking Windows Kernel Pointers FRAPL - Next Generation Reverse Engineering Framework Documented to Fail Writing Malware While The Blue Team Is Staring At You Fighting Metamorphism using Deep Neural Network with Fourier On Her Majesty’s Secret Service – GRX and a Spy Agency Orbiting The Saturn: Investigating A Decades-Old DRM System Make Event Tracing Great Again
Leer más

Presentaciones de LinuxCon Europa 2016

Del 4 al 6 de octubre se ha celebrado la LinuxCon edición Europa en Berlín, Alemania. Como puedes imaginar ésta, es una conferencia alrededor del kernel de Linux. Desde la web de la Fundación Linux puedes acceder a dichas presentaciones, que a continuación listo: Linux Kernel Security Update Ceph and Flash Efficient kernel backporting Making More Open: Creating open source infrastructure for your open source project Flowgrind: a TCP traffic generator for developers Efficient unit test and fuzz tools for kernel/libc porting Adding CPU frequency scaling for your ARM platform to Linux kernel entry_*.
Leer más

Presentaciones de DEF CON 24

Una vez más una de las conferencias sobre seguridad informática ha llegado a su fin: DEF CON 24. Por ahora, se han puesto disponible las diapositivas y algún material extra de las presentaciones que se pudieron presenciar. Amro-Abdelgawad-Extras/ Jonathan-Brossard-Extras/ Lucas-Lundgren-Extras/ Mike-Rich-Extras/ Regilero-Extras/ Robert-Olson-Extras/ Seymour-Tully-Extras/ SixVolts-and-Haystack-Extras/ Wesley-McGrew-Extras/ 3alarmlampscoot-DIY-Nukeproofing.pdf Adam-Donenfeld-Stumping-The-Mobile-Chipset.pdf Allan-Cecil-dwangoAC-Tasbot-The-Perfectionist.pdf Amro-Abdelgawad-The-Remote-Metamorphic-Engine.pdf Anch-So-you-want-to-be-a-pentester-DC101.pdf Anto-Joseph-Fuzzing-Android-Devices.pdf Arnaud-Soullie-Workshop-Pentesting-ICS-101.pdf Ashmastaflash-Sitch-Inexpensive-Coordinated-GSM-Anomaly-Detection-Writeup.pdf Ashmastaflash-Sitch-Inexpensive-Coordinated-GSM-Anomaly-Detection.pdf Benjamin-Holland-Developing-Managed-Code-Rootkits-For-Java-Runtime.pdf Bertin-Bervis-James-Jara-Exploiting-And-Attacking-Seismological-Networks-Remotely.pdf Bigezy-Saci-Pinworm-MITM-for-Metadata.pdf Brad-Dixon-Pin2Pwn-How-to-Root-An-Embedded-Linux-Box-With-A-Sewing-Needle.pdf Brad-Woodberg-Malware-Command-And-Control-Channels-A-Journey-Into-Darkness.pdf Bryant-Zadegan-Ryan-Lester-Abusing-Bleeding-Edge-Web-Standards-For-Appsec-Glory.pdf Chapman-Stone-Toxic-Proxies-Bypassing-HTTPS-and-VPNs.pdf Chris-Rock-How-to-overthrow-a-Government-Kuwait-Coup-WP.pdf Chris-Rock-How-to-overthrow-a-Government.pdf Clarence-Chio-Machine-Duping-101.pdf Demay-Auditing-6LoWPAN-Networks-Using-Standard-Penetration-Testing-Tools-WP.pdf Demay-Auditing-6LoWPAN-Networks-Using-Standard-Penetration-Testing-Tools.pdf Demay-Lebrun-Canspy-A-Platorm-For-Auditing-Can-Devices.pdf Dr-Phil-Polstra-Mouse-Jigglers.
Leer más

Presentaciones de CanSecWest 2016

Ya se ha publicado el material de las presentaciones dadas en CanSecWest 2016, celebrada en Vancouver, Canadá: Csw2016 freingruber bypassing_application_whitelisting Csw2016 chen grassi-he-apple_graphics_is_compromised Csw2016 song li-smart_wars Csw2016 tang virtualization_device emulator testing technology Csw2016 macaulay eh_trace-rop_hooks Csw2016 d antoine_automatic_exploitgeneration Csw2016 gawlik bypassing_differentdefenseschemes Csw2016 wang docker_escapetechnology Csw2016 gong pwn_a_nexus_device_with_a_single_vulnerability Csw2016 wheeler barksdale-gruskovnjak-execute_mypacket Csw2016 economou nissim-getting_physical Csw2016 chaykin having_funwithsecuremessengers_and_androidwear Csw2016 julien moinard-hardsploit Csw2016 evron sysman_apt_reports_and_opsec_evolution Csw2016 li xu-bad_winmail_and_emailsecurityoutlook_final Csw2016 nicolas joly-0_days_exploits_and_bug_bounties
Leer más

Material de Black Hat Asia 2016

Una de las conferencias sobre seguridad referente a nivel mundial, Black Hat, ya ha publicado el material de la edición Asia 2016. Devaluing Attack: Disincentivizing Threats Against the Next Billion Devices A New CVE-2015-0057 Exploit Technology asia-16-Wang-A-New-CVE-2015-0057-Exploit-Technology.pdf asia-16-Wang-A-New-CVE-2015-0057-Exploit-Technology-wp.pdf Android Commercial Spyware Disease and Medication asia-16-Saad-Android-Commercial-Spyware-Disease-And-Medication.pdf asia-16-Saad-Android-Commercial-Spyware-Disease-And-Medication-wp.pdf Automated Detection of Firefox Extension-Reuse Vulnerabilities Automated Dynamic Firmware Analysis at Scale: A Case Study on Embedded Web Interfaces asia-16-Costin-Automated-Dynamic-Firmware-Analysis-At-Scale-A-Case-Study-On-Embedded-Web-Interfaces.pdf asia-16-Costin-Automated-Dynamic-Firmware-Analysis-At-Scale-A-Case-Study-On-Embedded-Web-Interfaces-wp.pdf Break Out of the Truman Show: Active Detection and Escape of Dynamic Binary Instrumentation asia-16-Sun-Break-Out-Of-The-Truman-Show-Active-Detection-And-Escape-Of-Dynamic-Binary-Instrumentation.
Leer más