HITBSecConf2023 - Amsterdam
The final Hack In The Box conference in the Netherlands: a dual-track program plus the free CommSec track, opening with Mark Curphey's keynote and featuring a jailbreak-era iOS / OS X panel, with talks on Windows DWM bugs, Pwn2Own SOHO hacking, iOS malware detection, OT lateral movement, game anti-cheat bypasses and Web3 OSINT.
→ See editor’s top picks at HITBSecConf2023 - Amsterdam
- The Myths Of Software Security — Mark Curphey
In his characteristically frank and uncompromising style, Mark Curphey, founder of Crash Override, delivered a provocative talk at HITB Amsterdam titled "The Myths Of Software Security." Curphey’s…
- Current State Of IOS Malware Detection — Matthias Frielingsdorf
In "Poisoned Apples: The Current State Of IOS Malware Detection," Matthias Frielingsdorf, a Security Researcher on the iVerify team at Trail of Bits, delivered a critical assessment of the evolving…
- XRP Raid Protector: Killing A Critical Bug Worth 40 Billion Dollars — Haoyu Yang
In a groundbreaking presentation at HITB Amsterdam, Haoyu Yang, a security researcher at Tencent Security Xuanwu Lab, unveiled a critical vulnerability within the core infrastructure of the XRP…
- Nakatomi Space: Lateral Movement As L1 Post-Exploitation In OT — Jos Wetzels
In the realm of Operational Technology (OT) security, traditional lateral movement discussions often revolve around traversing higher-level network segments within the Purdue model, such as the…
- Syscalls In Shellcode: Techniques For Malicious Functionality — Bramwell Brizendine
In this insightful talk from HITB Amsterdam, Dr. Bramwell Brizendine, a leading expert in vulnerability and exploitation research, delves into advanced techniques for leveraging Windows syscalls…
- SOHO Hacking At Pwn2Own — Alex Plaskett, McCaulay Hudson
This talk, "SOHO Hacking At Pwn2Own," delivered by Alex Plaskett and McCaulay Hudson from NCC Group's Exploit Development Group (EDG), delves into their experiences and the vulnerabilities they…
- Next Generation Virtualization-Based Obfuscators — Tim Blazytko, Moritz Schloegel
In the ever-escalating arms race between software obfuscation and deobfuscation, virtualization-based obfuscation (VBO) has long stood as a formidable defense mechanism. This talk, "Next Generation…
- Hunting Windows Desktop Window Manager Bugs — Zhang WangJunjie, YiSheng He, Wenyue Li
This talk, "Hunting Windows Desktop Window Manager Bugs," presented by Zhang WangJunjie, Wenyue Li, and YiSheng He from Hillstone Networks, delves into the vast and often overlooked attack surface…
- A Tale Of Building A REAL Full Speed Anti-Censorship Router — KaiJern Lau
In this compelling talk at HITB Amsterdam, KaiJern Lau, founder of the Qiling Framework, shared his personal journey and technical expertise in circumventing the sophisticated censorship mechanisms…
- Bypassing Anti-Cheats And Hacking Competitive Games — Rohan Aggarwal
In this comprehensive talk from HITB Amsterdam, Rohan Aggarwal, founder of DefCore Security, delves into the intricate world of competitive game hacking, offering a detailed exploration of…
- Panel: iOS / OS X Security — Tarjei Mandt, Nikias Bassen, David Wang, Joshua Hill, Dhillon Kannabhiran
This panel discussion, featuring a reunion of prominent figures from the iOS jailbreaking community, delved into the evolving landscape of iOS and macOS security. Moderated by Dhillon Kannabhiran of…
- How MySQL Servers Can Attack YOU — Alexander Rubin, Martin Rakhmanov
In a groundbreaking presentation at HITB Amsterdam, Alexander Rubin and Martin Rakhmanov from Amazon Web Services' Relational Database as a Service Red Team unveiled a critical client-side remote…
- Automated Black-box Security Testing Of “Smart” Embedded Devices — Andrea Continella
In this insightful talk, Andrea Continella, an Assistant Professor at the University of Twente, delves into the critical challenges and innovative solutions for automated security testing of "smart"…
- ChatGPT Please Write Me A Piece Of Polymorphic Malware — Eran Shimony, Omer Tsarfati
In a groundbreaking presentation at HITB Amsterdam, CyberArk Labs researchers Eran Shimony and Omer Tsarfati unveiled "Chatty Cathy," an open-source framework demonstrating how Generative…
- Exploiting IPC With New Desynchronization Primitives — Martin Doyhenard
In this compelling talk, Martin Doyhenard, a Security Researcher at Onapsis, unveils a series of critical vulnerabilities impacting SAP's Internet Communication Manager (ICM), a foundational…
- Smart Speaker Shenanigans: Making The SONOS One Sing — Peter Geissler
This article delves into an extensive security research journey presented by Peter Geissler at HITB Amsterdam, detailing his efforts to compromise the Sonos One smart speaker. Initially motivated by…
- Active Directory Abuse Primitives And Operation Security — Mars Cheng, Dexter Chen
This talk, presented by Mars Cheng and Dexter Chen of TXOne Networks at HITB Amsterdam, delves into advanced Active Directory (AD) abuse primitives and the critical role of Operation Security…
- A Deep Dive Into GarminOS And Its MonkeyC Virtual Machine — Tao Sauvage
In this insightful talk from HITB Amsterdam, Tao Sauvage of Anvil Secure takes attendees on a deep dive into the proprietary operating system and virtual machine powering Garmin's widely popular…
- Privilege Escalation Using DOP In MacOS — Yoochan Lee, Jeongsu Choi, Junoh Lee, Sangjun Song
In this insightful presentation from HITB Amsterdam, the research team GYG, comprising Yoochan Lee, Jeongsu Choi, Junoh Lee, and Sangjun Song, unveiled a compelling demonstration of privilege…
- An Analysis Of Computer Numerical Control Machines In Industry 4.0 — Marco Balduzzi
In this compelling talk at HITB Amsterdam, Marco Balduzzi, a Senior Threat Researcher at Trend Micro, presented groundbreaking research into the security posture of Computer Numerical Control (CNC)…
- Investigating Web3 With OSINT — Dhia Mahjoub
In his HITB Amsterdam talk, "Investigating Web3 With OSINT," independent researcher Dhia Mahjoub offers a comprehensive exploration of the Web3 ecosystem through the lens of open-source…
- API Security In The Age Of Microservices — Ali Abdollahi
In an era increasingly defined by distributed systems, microservices and APIs form the backbone of modern applications, enabling agile development and scalable architectures. However, this…
- Upgrading Rollback Agnostic Replay Attacks — Carlos Gomez
In this compelling talk at HITB Amsterdam, Carlos Gomez from Picnic Technologies unveiled a significant advancement in car hacking techniques: the Rollback Agnostic Replay Attack. This research…
- All You Always Wanted To Know About AntiViruses — Marcus Botacin
In his HITB Amsterdam talk, "All You Always Wanted To Know About AntiViruses," Marcus Botacin, a Computer Science Professor at Texas A&M University, offered a comprehensive and demystifying look…
- Exploring JARM – An Active TLS Fingerprinting Algorithm — Mohamad Mokbel
In this insightful talk at HITB Amsterdam, Mohamad Mokbel, a Senior Security Researcher at Trend Micro, delved into the intricacies of JARM, an active TLS fingerprinting algorithm. The presentation…
- Nomadic Honeypots: How To Create Actionable CTI — Laurent Oudot
In an era where cyber threats evolve rapidly and attackers become increasingly sophisticated, traditional static defense mechanisms often fall short. Laurent Oudot, Co-founder and CTO of TEHTRIS…
- Panel: Evolution Of Learning: What Cyber Security Training Looks Like In 2023 — Matteo Beccaro
The "Evolution Of Learning: What Cyber Security Training Looks Like In 2023" panel at HITB Amsterdam brought together a diverse group of experts to dissect the shifting landscape of cybersecurity…
- Red Wizard – A User-friendly Infrastructure For Red Teams — Ben Brucker
In the dynamic and often unforgiving realm of red teaming, the efficient and secure deployment of operational infrastructure is paramount to success. Ben Brucker, a seasoned Penetration Tester and…
- Feeding Gophers To Ghidra — Max Kersten
In "Feeding Gophers To Ghidra," Max Kersten, a Malware Analyst and Reverse Engineer at Trellix, delves into the intricate challenges of analyzing Golang (Go) binaries using the NSA's open-source…
- Kubernetes Security Detection Engineering — Madhu Akula
In this insightful talk from HITB Amsterdam, Madhu Akula, the renowned creator of Kubernetes Goat, delves into the intricate world of Kubernetes security detection engineering. The presentation…
- The Return Of Stack Overflows In The Linux Kernel — Davide Ornaghi
In this compelling talk at HITB Amsterdam, Davide Ornaghi, an Offensive Security Specialist at Intré, challenges the prevailing notion that stack overflows in the Linux kernel are a relic of the…