HITBSecConf2023 - Phuket
Hack In The Box in Thailand: a dual-track conference plus the free CommSec track and labs, covering hypervisor escapes from VMware and QEMU/KVM, printer and automotive exploitation, Bluetooth and VoLTE hacking, crypto wallet and blockchain bugs, Azure ML zero-days and Lazarus Group operations.
→ See editor’s top picks at HITBSecConf2023 - Phuket
- Bugs In Blocks — Karsten Nohl
In this insightful presentation at HITB Phuket, Karsten Nohl of SRLabs, alongside researchers Lou and Gabri, delved into the often-overlooked yet critically important domain of blockchain security…
- Shining A Light On Solar System Cyber Security — Sick Codes
In an era defined by a rapid global transition to renewable energy, the cybersecurity of critical infrastructure faces unprecedented challenges. This talk, "Shining A Light On Solar System Cyber…
- ALPChecker: Detecting Spoofing/Blinding Attacks — Anastasiia Kropova, Igor Korkin
This talk, presented by Anastasiia Kropova and Igor Korkin at HITB Phuket, delves into a critical and under-addressed attack surface within the Windows operating system: the Asynchronous Local…
- Automated Incident Response — Valentine Mairet, Harjeet Sharma
In this comprehensive talk and workshop at HITB Phuket, Valentine Mairet and Harjeet Sharma from GitLab's Security Incident Response Team (SIRT) unveiled their sophisticated approach to Automated…
- Hardware Backdooring An eScooter — Arun Mane
In his compelling talk at HITB Phuket, Arun Mane of Amynasec Labs unveiled critical cybersecurity vulnerabilities within modern electric scooters, demonstrating how a simple, inexpensive hardware…
- How I Learned To Stop Reversing And Love The Strings — Paolo Montesel
In this insightful talk from HITB Phuket, Paolo Montesel, known as mhackeroni, presents "How I Learned To Stop Reversing And Love The Strings," a project aimed at drastically reducing the time…
- The Tragedy Of Bluetooth Low Energy — Linfeng Xiao, Dalin Yang
In "The Tragedy Of Bluetooth Low Energy," Linfeng Xiao and Dalin Yang from the Xiaomi security team unveil a series of critical vulnerabilities impacting Bluetooth Low Energy (BLE) implementations…
- A Practical Method Of Finding Vulnerabilities In IoT — IeckChae Euom
In an era where Internet of Things (IoT) devices are seamlessly integrating into every facet of daily life, the security implications of these interconnected systems have become a paramount concern…
- The Future Of Hacking: OpenAI’s GPT-4 Code Interpreter — Dexter Ng
In this compelling talk at HITB Phuket, Dexter Ng, Chief Technology Officer of Privacy Ninja, illuminated the transformative impact of OpenAI's GPT-4 Code Interpreter on the cybersecurity landscape…
- Unveiling The Trails Of Infostealer Malware Ecosystems — Pavan Karthick M
In this insightful HITB Phuket talk, Pavan Karthick M from CloudSEK sheds light on the rapidly evolving and increasingly sophisticated ecosystem behind information stealer malware. The presentation…
- Embracing Failure To Be A Better Hacker (and Human) — Joe Grand
In a refreshing departure from typical security conference fare, renowned hardware hacker Joe Grand delivered a keynote at HITB Phuket titled "Embracing Failure To Be A Better Hacker (and Human)."…
- Exploiting The Lexmark PostScript Stack — Aaron Adams
In this insightful talk from HITB Phuket, Aaron Adams of NCC Group delves into the intricacies of exploiting the custom PostScript stack implemented in Lexmark printers. Stemming from his team's…
- gVisor: Modern Linux Sandboxing Technology — Li Qiang
In this insightful talk from HITB Phuket, Li Qiang, a Platform Security Engineer at Ant Group, delves into the critical challenges of modern Linux sandboxing and presents Ant Group's innovative…
- It Was Harder To Sniff Bluetooth Through My Mask During The Pandemic — Xeno Kovah
In this insightful presentation from HITB Phuket, Xeno Kovah, founder of Open Security Training 2, delves into the pervasive yet often overlooked realm of Bluetooth device identification and…
- Extracting Info From Automotive Internet Units — Alexey Kondikov, Yuriy Serdyuk
In their compelling presentation at HITB Phuket, Alexey Kondikov and Yuriy Serdyuk, cyber security researchers from Navinfo Europe, unveiled their meticulous methodology for extracting information…
- Lazarus Group’s Undercover Operations 2022–2023 — Taewoo Lee, Seulgi Lee, Dongwook Kim
This talk, "Lazarus Group’s Undercover Operations 2022–2023," presented by analysts from the Korea Internet and Security Agency (KISA / KrCERT/CC), unveils the sophisticated tactics, techniques, and…
- Analyzing And Reverse Engineering Antivirus Signatures — Dobin Rutishauser
In "Cracked Shield: Analyzing and Reverse Engineering Antivirus Signatures," Dobin Rutishauser, a Red Team Lead at Raiffeisen Schweiz, delves into the often-overlooked mechanics of how antivirus…
- Escaping From VMware Workstation Through The Disk Controller — Wenxu Yin
In this compelling presentation at HITB Phuket, Wenxu Yin from Qihoo 360 Alpha Lab detailed a critical VMware Workstation vulnerability, CVE-2023-20872, that allows a malicious guest virtual machine…
- Injecting Brains Into Blind SQL Injection — Jakub Pruzinec, Quynh Anh Nguyen
This talk, "Injecting Brains Into Blind SQL Injection," delivered by Jakub Pruzinec (representing Nanyang Technological University, with supervisor Quynh Anh Nguyen from Capstone, Unicorn & Keystone…
- How NTLM Relay Ruins Your Exchange Servers — Tianze Ding
In this compelling talk, Tianze Ding from Tencent Security Xuanwu Lab delves into the persistent and critical threat of NTLM Relay attacks against Microsoft Exchange Server environments. The…
- Writing A New Decompiler Just For A Security Audit — Dominic Couture
In "Writing A New Decompiler Just For A Security Audit," Dominic Couture, a Staff Security Engineer at GitLab and an avid bug bounty hunter, shares his journey into building a specialized decompiler…
- Timekiller: Escape From QEMU/KVM — Yongkang Jia, Xiao Lei, Yiming Tao, Gaoning Pan, Chunming Wu
In a compelling presentation at HITB Phuket, researchers from Zhejiang University unveiled "Timekiller," a novel exploitation technique targeting QEMU/KVM. The talk, delivered by Yongkang Jia, Xiao…
- KeyBleed: Attacking The OneKey Mini — Eric Michaud
In the rapidly evolving, yet often immature, landscape of cryptocurrency, the security of digital assets remains a paramount concern. This talk, "KeyBleed: Attacking The OneKey Mini," delivered by…
- Breaking ML Services: Finding 0-days In Azure Machine Learning — Nitesh Surana
In this insightful talk from HITB Phuket, Nitesh Surana, a Cloud and Container Threat Researcher at Trend Micro, delves into critical security vulnerabilities discovered within Azure Machine…
- Locate Vulnerabilities Of Ethereum Smart Contracts — Boik Su
In this insightful talk from HITB Phuket, Boik Su, a Senior Security Researcher at CyCraft, delves into the critical and rapidly evolving domain of Ethereum smart contract security. With the Web3…
- Breaking MPC Wallets And Digital Custodians — Huu Giap Nguyen, Anh Khoa Nguyen
In this compelling talk titled "TS Shock: Cracking MPC Wallets and Digital Custodians for Billions of Profits," Verichains researchers Huu Giap Nguyen and Anh Khoa Nguyen unveil critical…
- Hacking Into IOS’s VOLTE Implementation — Rajanish Pathak, Hardik Mehta
In an insightful presentation at HITB Phuket, Rajanish Pathak and Hardik Mehta from KATIM unveiled a critical design flaw within Apple’s Voice over LTE (VoLTE) implementation, impacting iOS devices…
- Scarlet OT: OT Adversary Emulation For Fun And Profit — Sol Yang, Vic Huang
In the realm of industrial control systems (ICS) and operational technology (OT), the landscape of cybersecurity threats is rapidly evolving. Traditional IT security tools and methodologies often…
- Take A Picture Of Your App Code: Android MRI Interpreter — SungHyoun Song
In this insightful talk, SungHyoun Song from South Korea's Financial Security Institute (FSI) introduced the Android MRI Interpreter, a novel approach to analyzing Android applications and…
- Hunting For Amazon Cognito Security Misconfigurations — Yassine Aboukir
In this insightful talk from HITB Phuket, Yassine Aboukir, an Application Security Consultant at HackerOne, delves into the prevalent security misconfigurations affecting Amazon Cognito…
- NVMe: New Vulnerabilities Made Easy — Tal Lossos
In this insightful presentation from HITB Phuket, Tal Lossos, a Vulnerability Researcher at CyberArk, demystifies the process of finding critical vulnerabilities within the Linux kernel…
- A Deep Dive Into Two (Windows) Exploits Demonstrated At Pwn2Own — Thomas Imbert
In this highly technical talk from HITB Phuket, Thomas Imbert, a Security Engineer at Synacktiv, meticulously details two distinct Windows kernel local privilege escalation (LPE) exploits he…
- A Story Of Unexpected Intrusion Testing Results — Yvan Genuer
In "A Story Of Unexpected Intrusion Testing Results," Yvan Genuer, a seasoned Security Researcher at Onapsis, unveils a critical journey into the often-overlooked security posture of SAP systems…