Ya están disponibles los vídeos de las presentaciones de App Sec USA 2016

• Cleaning Your Applications' Dirty Laundry with Scumblr - AppSecUSA 2016
• Everything is Terrible: Three Perspectives on Building, Configuring, and Securing Software
• HTTPS & TLS in 2016: Security practices from the front lines - AppSecUSA 2016
• Justin Collins - Practical Static Analysis for Continuous Application Security - AppSecUSA 2016
• Using language-theoretics and runtime visibility to align AppSec with DevOps - AppSecUSA 2016
• Manideep Konakandla - Breaking and Fixing your ‘Docker’ ized environments - AppSecUSA 2016
• Chris Gates & Ken Johnson - DevOops: Redux - AppSecUSA 2016
• Zane Lackey - Practical tips for web application security in the age of agile and DevOps
• Chenxi Wang - Protect Containerized Applications With System Call Profiling - AppSecUSA 2016
• Scaling Security Assessment at the Speed of DevOps - AppSecUSA 2016
• Yair Amit - The Ways Hackers Are Taking To Win The Mobile Malware Battle - AppSecUSA 2016
• Your License for Bug Hunting Season - AppSecUSA 2016
• When encryption is not enough: Attacking Wearable - AppSecUSA 2016
• Jimmy Mesta - Containerizing your Security Operations Center - AppSecUSA 2016
• Practical Tips For Running A Successful Bug Bounty Program - AppSecUSA 2016
• Simon Thorpe - Why using SMS in the authentication chain is risky - AppSecUSA 2016
• Marco Lancini - Needle: Finding Issues within iOS Applications - AppSecUSA 2016
• Patterns of Authentication and Self-Announcement in IoT - AppSecUSA 2016
• [AUDIO] Should there be an Underwriters Laboratories certification for software in IoT products?
• Arshan Dabirsiaghi - How To Find The Next Great Deserialization CVE - AppSecUSA 2016
• Stephen De Vries - Threat Modeling With Architectural Risk Patterns - AppSecUSA 2016
• Kevin Johnson & Jason Gillam - Next Gen Web Pen Testing - AppSecUSA 2016
• Dave Lewis - Barbarians at the Gate(way) - AppSecUSA 2016
• Eric Johnson - Continuous Integration: Live Static Analysis using Visual Studio & the Roslyn API
• Matt Tesauro - AppSec++ Take the best of Agile, DevOps and CI/CD into your AppSec Program
• Dan Kuykendall - SPArring with the Security of Single Page Applications - AppSecUSA 2016
• Automating API Penetration Testing using fuzzapi - AppSecUSA 2016
• James Kettle - Exploiting CORS Misconfigurations for Bitcoins and Bounties - AppSecUSA 2016
• Evan Johnson - Misconfigured CORS and why web appsec is not getting easier - AppSecUSA 2016
• Ofer Maor - Putting an 'I' in Code Review Turning Code Reviewing Interactive - AppSecUSA 2016

• La tercera edición de este evento organizado por el Instituto Nacional de Ciberseguridad (INCIBE) se celebrará del 1 al 4 de diciembre en León y está dirigida a todos los públicos 
• Conferencias, talleres, foro de empleo y talento o actividades para toda la familia son algunas de las propuestas de este evento para aprender a usar Internet de forma segura

León, 03 de noviembre de 2016.- Expertos, profesionales de la ciberseguridad, jóvenes talentos, familias, centros educativos y público en general interesados en hacer un uso seguro de Internet, tienen una cita ineludible con CyberCamp 2016, el gran evento de la ciberseguridad que se celebrará del 1 al 4 de diciembre en León, ciudad que releva a Madrid en esta edición coincidiendo con el décimo aniversario del Instituto Nacional de Ciberseguridad, organismo perteneciente a la Secretaría de Estado de Telecomunicaciones y para la Sociedad de la Información.

Ya se encuentran disponibles las presentaciones de otra de las ediciones de Black Hat, la edición europea de 2016 en este caso.

• (Pen)Testing Vehicles with CANToolz eu-16-Sintsov-Pen-Testing-Vehicles-With-Cantoolz.pdf
• 50 Thousand Needles in 5 Million Haystacks: Understanding Old Malware Tricks to Find New Malware Families eu-16-Valeros-50-Thousand-Needles-In-5-Million-Haystacks-Understanding-Old-Malware-Tricks-To-Find-New-Malware-Families.pdf
• AI based Antivirus: Can AlphaAV Win the Battle in which Man Has Failed? eu-16-Wang-AI-Based-Antivirus-Can-Alphaav-Win-The-Battle-In-Which-Man-Has-Failed.pdf
• Another Brick Off the Wall: Deconstructing Web Application Firewalls Using Automata Learning eu-16-Argyros-Another-Brick-Off-The-Wall-Deconstructing-Web-Application-Firewalls-Using-Automata-Learning.pdf eu-16-Argyros-Another-Brick-Off-The-Wall-Deconstructing-Web-Application-Firewalls-Using-Automata-Learning-wp.pdf eu-16-Argyros-Another-Brick-Off-The-Wall-Deconstructing-Web-Application-Firewalls-Using-Automata-Learning-too-lightbulb-framework.zip
• ARMageddon: How Your Smartphone CPU Breaks Software-Level Security and Privacy eu-16-Lipp-ARMageddon-How-Your-Smartphone-CPU-Breaks-Software-Level-Security-And-Privacy.pdf eu-16-Lipp-ARMageddon-How-Your-Smartphone-CPU-Breaks-Software-Level-Security-And-Privacy-wp.pdf armageddon
• Attacking Windows by Windows eu-16-Liang-Attacking-Windows-By-Windows.pdf
• Automating Incident Response: Sit Back and Relax Bots are Taking Over… eu-16-Hovor-Automating-Incident-Investigations-Sit-Back-And-Relax-Bots-Are-Taking-Over.pdf
• Backslash Powered Scanning: Hunting Unknown Vulnerability Classes eu-16-Kettle-Backslash-Powered Scanning-Hunting-Unknown-Vulnerability-Classes.pdf eu-16-Kettle-Backslash-Powered Scanning-Hunting-Unknown-Vulnerability-Classes-wp.pdf eu-16-Kettle-Backslash-Powered Scanning-Hunting-Unknown-Vulnerability-Classes-backslashPoweredScanner.zip eu-16-Kettle-Backslash-Powered Scanning-Hunting-Unknown-Vulnerability-Classes-distributeDamage.zip
• Breaking BHAD: Abusing Belkin Home Automation Devices eu-16-Tenaglia-Breaking-Bhad-Abusing-Belkin-Home-Automation-Devices.pdf
• Breaking Big Data: Evading Analysis of the Metadata of Your Life eu-16-Venable-Breaking-Big-Data-Evading-Analysis-Of-The-Metadata-Of-Your-Life.pdf
• Bypassing Clang's SafeStack for Fun and Profit
• Bypassing Secure Boot Using Fault Injection eu-16-Timmers-Bypassing-Secure-Boot-Using-Fault-Injection.pdf
• Chasing Foxes by the Numbers: Patterns of Life and Activity in Hacker Forums eu-16-Ahlberg-Chasing-Foxes-By-The-Numbers-Patterns-Of-Life-And-Activity-In-Hacker-Forums.pdf
• Code Deobfuscation: Intertwining Dynamic Static and Symbolic Approaches eu-16-David-Code-Deobfuscation-Intertwining-Dynamic-Static-And-Symbolic-Approaches.pdf
• CTX: Eliminating BREACH with Context Hiding eu-16-Karakostas-Ctx-Eliminating-BREACH-With-Context-Hiding.pdf eu-16-Karakostas-Ctx-Eliminating-BREACH-With-Context-Hiding-wp.pdf
• Cyber Judo: Offensive Cyber Defense eu-16-Beery-Grady-Cyber-Judo-Offensive-Cyber-Defense.pdf
• Detach Me Not - DoS Attacks Against 4G Cellular Users Worldwide from your Desk eu-16-Holtmanns-Detach-Me-Not.pdf
• DRAMA: How Your DRAM Becomes a Security Problem eu-16-Schwarz-How-Your-DRAM-Becomes-A-Security-Problem.pdf eu-16-Schwarz-How-Your-DRAM-Becomes-A-Security-Problem-wp.pdf eu-16-Schwarz-How-Your-DRAM-Becomes-A-Security-Problem-tool.zip
• Effective File Format Fuzzing – Thoughts Techniques and Results eu-16-Jurczyk-Effective-File-Format-Fuzzing-Thoughts-Techniques-And-Results.pdf
• EGO MARKET: When People's Greed for Fame Benefits Large-Scale Botnets eu-16-Paquet-Clouston-Ego-Market_When-Greed-for-Fame-Benefits-Large-Scale-Botnets.pdf eu-16-Paquet-Clouston-Ego-Market_When-Greed-for-Fame-Benefits-Large-Scale-Botnets-wp.pdf
• Flip Feng Shui: Rowhammering the VM's Isolation eu-16-Razavi-Flip-Feng-Shui-Rowhammering-The-VMs-Isolation.pdf eu-16-Razavi-Flip-Feng-Shui-Rowhammering-The-VMs-Isolation-wp.pdf
• Ghost in the PLC: Designing an Undetectable Programmable Logic Controller Rootkit eu-16-Abbasi-Ghost-In-The-PLC-Designing-An-Undetectable-Programmable-Logic-Controller-Rootkit.pdf eu-16-Abbasi-Ghost-In-The-PLC-Designing-An-Undetectable-Programmable-Logic-Controller-Rootkit-wp.pdf
• GPU Security Exposed eu-16-Taft-GPU-Security-Exposed.pdf
• How to Fool an ADC Part II or Hiding Destruction of Turbine with a Little Help of Signal Processing eu-16-Gonzalez-How-To-Fool-An-ADC-Part-II-Or-Hiding-Destruction-Of-Turbine-With-A-Little-Help-Of-Signal-Processing.pdf
• I Know What You Saw Last Minute - The Chrome Browser Case eu-16-Dubin-I-Know-What-You-Saw-Last-Minute-The-Chrome-Browser-Case.pdf eu-16-Dubin-I-Know-What-You-Saw-Last-Minute-The-Chrome-Browser-Case-WP.pdf
• Inside Web Attacks: The Real Payloads
• Locknote: Conclusions and Key Takeaways from Black Hat Europe 2016
• Mobile Espionage in the Wild: Pegasus and Nation-State Level Attacks eu-16-Bazaliy-Mobile-Espionage-in-the-Wild-Pegasus-and-Nation-State-Level-Attacks.pdf
• Narcos Counterfeiters and Scammers: An Approach to Visualize Illegal Markets eu-16-Lewman-Narcos-Counterfeiters-And-Scammers-An-Approach-To-Visualize-Illegal-Markets.pdf
• Pocket-Sized Badness: Why Ransomware Comes as a Plot Twist in the Cat-Mouse Game eu-16-Maggi-Pocket-sized Badness-Why-Ransomware Comes-as-a-Plot-Twist-in-the-Cat-Mouse-Game.pdf heldroid
• Randomization Can't Stop BPF JIT Spray eu-16-Reshetova-Randomization-Can't-Stop-BPF-JIT-Spray.pdf eu-16-Reshetova-Randomization-Can't-Stop-BPF-JIT-Spray-wp.pdf
• Real-World Post-Quantum Cryptography: Introducing the OpenQuantumSafe Software Project
• Rooting EVERY Android: From Extension to Exploitation eu-16-Shen-Rooting-Every-Android-From-Extension-To-Exploitation.pdf eu-16-Shen-Rooting-Every-Android-From-Extension-To-Exploitation-wp.pdf eu-16-Shen-Rooting-Every-Android-From-Extension-To-Exploitation-wp.pdf
• Signing Into One Billion Mobile App Accounts Effortlessly with OAuth2.0 eu-16-Yang-Signing-Into-Billion-Mobile-Apps-Effortlessly-With-OAuth20.pdf eu-16-Yang-Signing-Into-Billion-Mobile-Apps-Effortlessly-With-OAuth20-wp.pdf
• Stumping the Mobile Chipset eu-16-Donenfeld-Stumping-The-Mobile-Chipset.pdf eu-16-Donenfeld-Stumping-The-Mobile-Chipset-wp.pdf
• Talking Behind Your Back: Attacks and Countermeasures of Ultrasonic Cross-Device Tracking eu-16-Mavroudis-Talking-Behind-Your-Back-Attacks-And-Countermeasures-Of-Ultrasonic-Cross-Device-Tracking.pdf
• Towards a Policy-Agnostic Control-Flow Integrity Implementation eu-16-Sullivan-Towards-A-Policy-Agnostic-Control-Flow-Integrity-Implementation.pdf
• Use-After-Use-After-Free: Exploit UAF by Generating Your Own eu-16-Wen-Use-After-Use-After-Free-Exploit-UAF-By-Generating-Your-Own.pdf eu-16-Wen-Use-After-Use-After-Free-Exploit-UAF-By-Generating-Your-Own-wp.pdf
• When Virtualization Encounter AFL: A Portable Virtual Device Fuzzing Framework with AFL eu-16-Li-When-Virtualization-Encounters-AFL-A-Portable-Virtual-Device-Fuzzing-Framework-With-AFL.pdf eu-16-Li-When-Virtualization-Encounters-AFL-A-Portable-Virtual-Device-Fuzzing-Framework-With-AFL-wp.pdf
• WiFi-Based IMSI Catcher eu-16-OHanlon-WiFi-IMSI-Catcher.pdf
• Witchcraft Compiler Collection: Towards Self Aware Computer Programs eu-16-Brossard-Witchcraft-Compiler-Collection-Towards-Self-Aware-Computer-Programs.pdf eu-16-Brossard-Witchcraft-Compiler-Collection-Towards-Self-Aware-Computer-Programs-wp.pdf

Los miembros de PentesterLab han creado un paquete con material para presentaciones y enseñanza basado en un laboratorio de prácticas sobre inyección de SQL.

El objetivo es proveerte con una serie de diaspositivas y guía, además de una prácticas ya preparadas, para la enseñanza de ataques a aplicaciones web, explotando vulnerabilidades de inyección de SQL.

El paquete lo han titulado Meetup pack for “From SQL Injection to Shell”. El curso en el que está basado es From SQL Injection to Shell (ISO del curso), el cual puedes hospedar tú mismo o usar la versión online (para éste necesita tener una cuenta PRO). Las diapositivas se encuentran en este enlace. También hay disponibles vídeos sobre dicho laboratorio, pero de nuevo, sólo son accesible con una cuenta PRO.

Ya podemos acceder a las presentaciones de Ruxcon Security Conference 2016:

• Windows Metafiles: An Analysis of the EMF Attack Surface & Recent Vulnerabilities
• Forcing A Targeted LTE Cellphone Into An Unsafe Network
• $hell on Earth: From Browser to System Compromise
• Demystifying the Secure Enclave Processor
• Strolling into Ring-0 via I/O Kit Drivers
• Rainbow Over the Windows: More Colors Than You Could Expect
• Hacker-Machine Interface - State of the Union for SCADA HMI Vulnerabilities
• Breaking out of QEMU
• Make iOS App more Robust and Security through Fuzzing
• Exploiting COF Vulnerabilities In The Linux Kernel
• Of Mice and Keyboards: On the Security of Modern Wireless Desktop Sets
• Firmware Biopsy: Towards Taming The Lunacy
• Leaking Windows Kernel Pointers
• FRAPL - Next Generation Reverse Engineering Framework
• Documented to Fail
• Writing Malware While The Blue Team Is Staring At You
• Fighting Metamorphism using Deep Neural Network with Fourier
• On Her Majesty’s Secret Service – GRX and a Spy Agency
• Orbiting The Saturn: Investigating A Decades-Old DRM System
• Make Event Tracing Great Again

La Universidad de Helsinki, en colaboración con F-Secure han creado Cyber Security Base, una serie de cursos sobre ciberseguridad.

Actualmente sólo el primero de los cursos está disponible, el resto se irán haciendo públicos a medida que vayan creando el material asociado a los mismos. Los cursos son los siguientes:

• Introduction to Cyber Security
• Securing Software
• Course Project I
• Advanced Topics
• Course Project II
• Capture The Flag

Si quieres mantenerte informado cada vez que publiquen un nuevo curso deberías suscribirte.

A través de esta serie de cursos se estudiarán conceptos sobre varias temas tales como: introducción a la ciberseguridad y seguridad operacional, desarrollo de aplicaciones web, vulnerabilidades típicas en aplicaciones web, cómo se descubren y cómo protegerse de dichas vulnerabilidades y conceptos avanzados como arquitectura de software seguro y criptografía.

Incibe, el instituto sobre ciberseguridad español, celebra de su segundo evento anual sobre ciberseguridad CyberCamp del 1 al 4 de diciembre en León, España.

Este año, edición 16, trae dos nuevas iniciativas: novedades en el Hackathon y un torneo sobre desarrollo de software seguro.

Un Hackathon o “maratón de hacking”, es una actividad que está muy de moda en los círculos de la programación y el desarrollo de software. Esto no es necesariamente una competición, de hecho muchos grupos de desarrolladores se reúnen de forma mensual o cada X tiempo, para desarrollar aplicaciones para la comunidad, empresas sin ánimo de lucro, etc. En el caso de CyberCamp es una competición por equipos que se llevará a cabo durante los días del evento y cuyo objetivo es crear alguna herramienta nueva o mejorar alguna ya existente. El plazo de inscripción está actualmente abierto hasta el 1 de noviembre. La novedad, es que este año hay un apartado enfocado a los sistemas industriales SCADA, Supervisory Control And Data Acquisition (Supervisión, Control y Adquisición de Datos). Los participantes que se interesen por esta temática recibirán con antelación información adicional sobre la arquitectura de la plataforma industrial a utilizar en el evento. Además de esto y como un aliciente a las nuevas promesas del sector, se otorgaran créditos ECTS a todos los estudiantes universitarios que deseen participar en el evento

Junto con las presentaciones de DEF CON 24, ya también tenemos acceso a los vídeos:

• WIFI 204 Insteon, Inste off, Inste open
• WIFI 202 Evil ESP
• WIFI 201 WCTF Day 2 Kickoff
• WIFI 105 Introducing the HackMeRF
• WIFI 104 Handing Full Control of the Radio Spectrum Over to the Machines
• WIFI 103 How Do IBLE Hacking
• WIFI 102 Decoding LoRa Exploring Next Gen Wireless
• WIFI 101 Wireless Capture the Flag Inbrief
• Weaponizing Data Science for Social Engineering Automated E2E spear phishing on Twit
• weaponize your feature codes
• VLAN hopping, ARP poisoning & MITM Attacks in Virtualized Environments
• Use Their Machines Against Them Loading Code with a Copier
• Universal Serial aBUSe Remote physical access attacks
• toxic proxies bypassing HTTPS and VPNs to pwn your online identity
• The Remote Metamorphic Engine Detecting, Evading, Attacking the AI and Reverse Engin
• the next gen of emergency ph0nage
• T1 Jeopardy 2
• T1 Jeopardy 1
• Stumping the Mobile Chipset
• sticky keys to the kingdom
• Stargate Pivoting Through VNC To Own Internal Networks
• so you think you want to be a pentester
• Slouching Towards Utopia The State of the Internet Dream
• Sk3wlDbg Emulating all well many of the things with Ida
• Six Degrees of Domain Admin
• Side channel attacks on high security electronic safe locks
• sentient storage do ssd's have a mind of their own
• secure penetration testing operations
• SE 301 The Live SE Podcast
• SE 205 Advanced Social Engineering Techniques and The Rise of Cyber Scam Industrial
• SE 204 How to Un Work your job Revolutionism Radicals, and Engineering by Committee
• SE 203 SCAM CALL Call Dropped
• SE 202 Total Fail and Bad Mistakes I've Made a Few
• SE 201 Human Hacking You ARE the weakest link
• SE 105 You are being manipulated
• SE 104 US Interrogation Techniques and Social Engineering
• SE 103 7 Jedi Mind Tricks Influence Your Target without a Word
• SE 102 The Wizard of Oz Painting a reality through deception
• SE 101 Does Cultural differences become a barrier for social engineering
• Samsung Pay Tokenized Numbers, Flaws and Issues
• Robot Hacks Video Games How TASBot Exploits Consoles with Custom Controllers
• Retweet to win How 50 lines of Python made me the luckiest guy on Twitter
• Research on the Machines Help the FTC Protect Privacy & Security
• real time bluetooh device detection with blue hydra
• propaganda and you
• Project CITL
• Playing Through the Pain The Impact of Secrets and Dark Knowledge
• Platform Agnostic Kernel Fuzzing
• pin2pwn How to Root an Embedded Linux Box with a Sewing Needle
• Picking Bluetooth Low Energy Locks from a Quarter Mile Away
• phishing without failure and frustration
• PH 301 Packet Hacking Village, Block 5
• PH 202 Packet Hacking Village, Block 4
• PH 201 Packet Hacking Village, Block 3
• PH 102 Packet Hacking Village, Block 2
• PH 101 Packet Hacking Village, Block 1
• network protocol reverse engineering
• Mr Robot Panel
• MouseJack Injecting Keystrokes into Wireless Mice
• mouse jiggler offense and defense
• malware command and control channels a journey into darkness
• Maelstrom are you plaing with a full deck
• Machine Duping Pwning deep learning systems
• LOCK 302 Sesame Style Pad Locks
• LOCK 203 Intro to LockpickingPower
• LOCK 202 Intro to LockpickingPower
• LOCK 201 Intro to LockpickingDuffley
• LOCK 104 Intro to Lock PickingFitzhugh
• LOCK 102 Locking Picking 101
• LOCK 101 Locking Picking 101
• Light Weight Protocol! Serious Equipment! Critical Implications!
• Let's Get Physical Network Attacks Against Physical Security Systems
• Jittery MacGyver Lessons Learned from Building a Bionic Hand out of a Coffee Maker
• I've got 99 Problems, but LittleSnitch ain't one
• IOT 203 Tranewreck More Internet, More Problems
• IOT 202 Reversing and Exploiting Embedded Devices
• IOT 103 Is Your Internet Light On Protecting Consumers In the Age of Connected Every
• IOT 102 Btlejuice The Bluetooth Smart Mitm Framework
• Introduction the Wichcraft Compiler Collection Towards universal code theft
• inexpensive coordinated gsm anomaly detection
• I Fight For The Users, Episode I Attacks Against Top Consumer Products
• How To Remote Control An Airliner Security Flaws in Avionics
• How to overthrow a Government
• How to Make Your Own DEF CON Black Badge
• how to launch or improve your vulnerablitity research game
• how to generate a 4tbs DDOS for $5
• How to do it Wrong Smartphone Antivirus and Security Applications Under Fire
• How to design distributed systems resilient despite malicious participants
• how to build a processor in 10 minutes or less
• Honey Onions Exposing Snooping Tor HSDir Relays Guevara Noubir & Amirali Sanatinia
• Hiding Wookiees in HTTP HTTP smuggling
• HH 301 Basics of EAGLE CAD and PCB design tips
• HH 201 Basic Firmware Extraction
• HH 102 Why Amateur Radio in the Age of the Internet
• HH 101 Building malicious hardware out of analog circuits
• Help, I've got ANTs!!!
• Hacking Next Gen ATM's From Capture to Cashout
• Hacking Hotel Keys and Point of Sale systems
• hacking boarding passes for fun and profit
• Hacker Machine Interface State of the Union for SCADA HMI Vulnerabilities
• Game over, man! Reversing Video Games to Create an Unbeatable AI Player
• frontrunning the frontrunners
• Forcing a Targeted LTE Cellphone into Unsafe Network
• feds and 0days from before hearthbleed to after FBI apple
• Exploiting and attacking seismological networks remotely
• exploit mitigation techniques on iOS
• Examining the Internet's pollution
• esoteric exfiltration
• escaping the sandbox by not breaking it
• Drunk Hacker History Hacker Stories Powered by C2H6O for Fun & Profit
• Drones Hijacking multi dimensional attack vectors & countermeasures
• DIY Nukeproofing a new dig at data mining
• Discovering and Triangulating Rogue Cell Towers
• Direct Memory Attack the Kernel
• Developing Managed Code Rootkits for the Java Runtime Environment
• DEF CON Welcome & Badge Talk
• def con 101 panel III rise of the noobs
• DC 202
• DARPA Cyber Grand Challenge Award Ceremony
• Cyber Who Done It! Attribution Analysis Through Arrest History
• Cyber Grand Shellphish
• Cunning with CNG Soliciting Secrets from Schannel
• Crypto State of the Law
• CP 301 My Usability Goes to 11 A Hacker's Guide to User Experience Research
• CP 203 Catching a cheat practical exercise in code breaking
• CP 202 Blue Coat SSL Visibility Exposed
• CP 103 How to Backdoor Diffie Hellman
• CP 102 Security Logs Aren't Good Enough
• CP 101 Revocation, the Frailty of PKI
• compelled decryption state of the art doctrinal perversions
• Closing Ceremonies
• Cheap Tools for Hacking Heavy Trucks
• CH 201
• CH 301 Understanding Heavy Truck Event Data
• CH 203 Security Flaws in Automotive Immobilizer
• CH 202 Deep Learning on CAN BUS
• CH 103 Hacking the CHV Badge
• CH 102 The Mitsubishi Hack Explained
• CH 101 Vehicle to Infrastructure V2X
• CANSPY A Framework for Auditing CAN Devices
• Can You Trust Autonomous Vehicles Contactless Attacks
• CAN i haz car secret plz
• Bypassing Captive Portals and Limited Networks
• BSODomizer
• Breaking the Internet of Vibrating Things
• BlockFighting with a Hooker BlockfFghter2!
• BIO 305 Attention Hackers Cannabis Needs Your Help!
• BIO 304 Implants
• BIO 303 Hacking Perception
• BIO 302 CrisprCas9 Newest Tools for Biohacking Fun!
• BIO 301 Nootropics Better Living Through Chemistry or Modern Day Prometheus
• BIO 206 Transcranial Direct Current Stimulation Brain Stimulation the Do It Yourself
• BIO 205 Intro to Brain Based Authentication
• BIO 204 The Next Big Thing in Bioterrorism
• BIO 203 The Era of Bio Big Data Benefits and Challenges for Information Security, He
• BIO 202 The Bioethics of BioHacking
• BIO 201 Oday for the Soul
• Beyond the MCSE Red teaming active directory
• Backdooring the Frontdoor
• auditing 6loWPAN networks
• Attacking BaseStations an Odyssey through a Telco's Network
• Ask the EFF
• anti forensics AF
• An introduction to Pinworm man in the middle for your metadata
• All Your Solar Panels are belong to Me
• ADD 3 SDR Tips and Tricks
• ADD 2 Covert Cupid Under 11 Veil Approach for Covert WiFi
• ADD 1 I Amatuer Radio And So Can You!
• Abusing Bleeding Edge Web Standards for AppSec Glory
• A Monitor Darkly Reversing and Exploiting Ubiquitous
• 401 a frame work for managing security allerts
• 101 ways to brick your hardware
• Abusing Smart Cities the dark age of modern mobility

Ya también están disponibles de los vídeos de Black Hat USA 2016, así como el material presentado:

• Why This Internet Worked How We Could Lose It and the Role Hackers Play
• A Journey From JNDI/LDAP Manipulation to Remote Code Execution Dream Land
• The Art of Defense - How Vulnerabilities Help Shape Security Features and Mitigations in Android
• Call Me: Gathering Threat Intelligence on Telephony Scams to Detect Fraud
• Applied Machine Learning for Data Exfil and Other Fun Topics
• Canspy: A Platform for Auditing Can Devices
• Dangerous Hare: Hanging Attribute References Hazards Due to Vendor Customization
• Over the Edge: Silently Owning Windows 10's Secure Browser
• How to Make People Click on a Dangerous Link Despite Their Security Awareness
• Certificate Bypass: Hiding and Executing Malware From a Digitally Signed Executable
• Pay No Attention to That Hacker Behind the Curtain: A Look Inside the Black Hat Network
• Drone Attacks on Industrial Wireless: A New Front in Cyber Security
• Hackproofing Oracle Ebusiness Suite
• Using Undocumented CPU Behavior to See Into Kernel Mode and Break Kaslr in the Process
• Gattacking Bluetooth Smart Devices - Introducing a New BLE Proxy Tool
• Measuring Adversary Costs to Exploit Commercial Software
• Removing Roadblocks to Diversity
• HEIST: HTTP Encrypted Information Can Be Stolen Through TCP-Windows
• Memory Forensics Using Virtual Machine Introspection for Cloud Computing
• Secure Penetration Testing Operations: Demonstrated Weaknesses in Learning Material and Tools
• Nonce-Disrespecting Adversaries: Practical Forgery Attacks on GCM in TLS
• Towards a Holistic Approach in Building Intelligence to Fight Crimeware
• Subverting Apple Graphics: Practical Approaches to Remotely Gaining Root
• The Remote Malicious Butler Did It!
• Xenpwn: Breaking Paravirtualized Devices
• PWNIE
• An Open Collaborative Effort to Ameliorate Android N-Day Root Exploits
• Understanding HL7 2.X Standards, Pen Testing, and Defending HL7 2.X Messages
• 1000 Ways to Die in Mobile Oauth
• A Retrospective on the Use of Export Cryptography
• Windows 10 Segment Heap Internals
• Abusing Bleeding Edge Web Standards for Appsec Glory
• AMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It
• Analysis of the Attack Surface of Windows 10 Virtualization-Based Security
• Augmenting Static Analysis Using Pintool: Ablation
• An Insider's Guide to Cyber-Insurance and Security Guarantees
• Cunning With Cng: Soliciting Secrets From Schannel
• Beyond the Mcse: Active Directory for the Security Professional
• Does Dropping Usb Drives in Parking Lots and Other Places Really Work?
• Demystifying the Secure Enclave Processor
• I Came to Drop Bombs: Auditing the Compression Algorithm Weapon Cache
• Breaking Payment Points of Interaction (POI)
• Into the Core: In-Depth Exploration of Windows 10 IoT Core
• Hacking Next-Gen Atms: From Capture to Cashout
• Can You Trust Me Now? An Exploration Into the Mobile Threat Landscape
• Investigating DDOS - Architecture Actors and Attribution
• Intra-Process Memory Protection for Applications on ARM and X86: Leveraging the ELF ABI
• Capturing 0Day Exploits With Perfectly Placed Hardware Traps
• Next-Generation of Exploit Kit Detection By Building Simulated Obfuscators
• HTTP/2 & Quic - Teaching Good Protocols to Do Bad Things
• Pwning Your Java Messaging With Deserialization Vulnerabilities
• Language Properties of Phone Scammers: Cyberdefense At the Level of the Human
• Recover a RSA Private Key From a TLS Session With Perfect Forward Secrecy
• The Linux Kernel Hidden Inside Windows 10
• O-Checker: Detection of Malicious Documents Through Deviation From File Format Specifications
• The Tao of Hardware the Te of Implants
• Access Keys Will Kill You Before You Kill the Password
• Hell on Earth: From Browser to System Compromise
• Discovering and Exploiting Novel Security Vulnerabilities in Apple Zeroconf
• BadWPAD
• Breaking Kernel Address Space Layout Randomization (Kaslr) With Intel TSX
• Airbnbeware: Short Term Rentals Long Term Pwnage
• Account Jumping Post Infection Persistency & Lateral Movement in AWS
• Captain Hook: Pirating Avs to Bypass Exploit Mitigations
• Hardening AWS Environments and Automating Incident Response for AWS Compromises
• Crippling HTTPs With Unholy PAC
• Horse Pill: A New Type of Linux Rootkit
• Design Approaches for Security Automation
• Greatfet: Making Goodfet Great Again
• SGX Secure Enclaves in Practice: Security and Crypto Review
• Using EMET to Disable EMET
• Weaponizing Data Science for Social Engineering: Automated E2E Spear Phishing on Twitter
• Viral Video - Exploiting Ssrf in Video Converters
• AVLeak: Fingerprinting Antivirus Emulators for Advanced Malware Evasion
• Windows 10 Mitigation Improvements
• Brute-Forcing Lockdown Harddrive Pin Codes
• Building a Product Security Incident Response Team: Learnings From the Hivemind
• Bad for Enterprise: Attacking BYOD Enterprise Mobile Security Solutions
• Cyber War in Perspective: Analysis From the Crisis in Ukraine
• Breaking Fido: Are Exploits in There?
• Security Through Design - Making Security Better By Designing for People
• Iran's Soft-War for Internet Dominance
• Side-Channel Attacks on Everyday Applications
• The Risk From Power Lines: How to Sniff the G3 and Prime Data and Detect the Interfere Attack
• Unleash the Infection Monkey: A Modern Alternative to Pen-Tests
• OSS Security Maturity: Time to Put on Your Big Boy Pants!
• Watching Commodity Malware Get Sold to a Targeted Actor
• PanGu 9 Internals
• A Lightbulb Worm?
• BadTunnel: How Do I Get Big Brother Power?
• PLC-Blaster: A Worm Living Solely in the PLC
• A Risk-Based Approach for Defining User Training and Awarding Administrative Privileges
• Dungeons Dragons and Security
• The Year in Flash
• Dark Side of the DNS Force
• VoIP Wars: the Phreakers Awaken
• Keystone Engine: Next Generation Assembler Framework
• Pindemonium: A DBI-Based Generic Unpacker for Windows Executable
• Web Application Firewalls: Analysis of Detection Logic
• Defense At Hyperscale: Technologies and Policies for a Defensible Cyberspace

Ya tenemos acceso a los vídeos de las charlas de GrrCON 2016, celebrada en Michigan los pasados 6 y 7 de octubre.

• 116 Security Guards LOL Brent White Tim Roberts
• 115 Attacking the Hospitality and Gaming Industries Tracking an Attacker Around the World in 7 Years
• 318 Welcome to The World of Yesterday Tomorrow Joel Cardella
• 317 On being an Eeyore in Infosec Stefan Edwards
• 217 Phish your employees for fun Kristoffer Marshall
• 216 Binary Ninja Jared Demott
• 316 Piercing the Air Gap Network Steganography for Everyone John Ventura
• 315 So Youve Inherited a Security Department Now What Amanda Berlin
• 215 Whats in your Top Ten Intelligent Application Security Prioritization Tony Miller
• 214 Tales from the Cryptanalyst Jeff Man
• 114 Breaking Android Apps for Fun and Profit Bill Sempf
• 113 Back to the Future Understanding our future but following the past Kevin Johnson
• 313 Alignment of business and IT Security Shane Harsch
• 213 Money Fame Power Build your success as a security professional Nathan Dragun
• 212 Machine Duping Pwning Deep Learning Systems Clarence Chio
• 211 Magnetic Stripes 101 Tyler Keeton
• 112 Guarding Lunch J Wolfgang Goerlich
• 111 Predator to Prey Tracking Criminals with Trojans and Data Mining for Fun and Profit Ken Westin
• 110 and bad mistakes Ive made a few Jayson Street
• 312 Contracting Privacy Security and 3rd Party Nathan Steed Kenneth Coleman
• 312 Contracting Privacy Security and 3rd Party Nathan Steed Kenneth Coleman
• 110 and bad mistakes Ive made a few Jayson Street (only first 30 min or so)
• 210 Encryption Mobility Cloud Oh My Bill Harmer
• 209 Using Virus Total Intelligence to track the latest Phishing Document campaigns Wyatt Roersma
• 311 Stop attacking your mothers car Charles Parker II
• 208 Cruise Ship Pentesting OR Hacking the High Seas Chad M Dewey
• 207 Quick and Easy Windows Timelines with Pyhon MySQL and Shell Scripting Dr Phil Polstra
• 310 How to Implement Crypto Poorly Sean Cassidy
• 309 Reality Checking Your AppSec Program Darren Meyer
• 308 Bad Guys Look Just Like You Justin Beard
• 205 Threat Detection Response with Hipara J Brett Cunningham
• 204 Reversing and Exploiting Embedded Devices Walking the software and hardware stack Elvis Collado
• 203 Surreal Paradigms Automotive Culture Crash D0xt0r Z3r0
• 108 Secure Dicks Michael Kemp
• 206 still broken after all these years aka utility security for smarties doug nibbelink
• 307 Getting to the Root of Advanced Threats Before Impact Josh Fazio
• 306 Fighting the Enemy Within Matt Crowe
• 305 How Do You Secure What You Dont Control Dimitri Vlachos
• 304 Pentester to customerI will 0wn your network Customer to pentesterNo I will make you cry David F
• 303 Make STEHM Great Again David HealWHans Schwartzberg
• 205 Threat Detection Response with Hipara J Brett Cunningham
• 204 Reversing and Exploiting Embedded Devices Walking the software and hardware stack Elvis Collado
• 203 Surreal Paradigms Automotive Culture Crash D0xt0r Z3r0
• 105 Abnormal Behavior Detection in Large Environments Dave Kennedy
• 302 Five Nights At Freddys What We Can Learn About Security From Possessed Bears Nick Jacob
• 300 Securing Trust Defending Against Next generation Attacks John Muirhead Gould
• 202 What do you mean Im pwnd I turned on automatic updates Scott Thomas Jeff Baruth
• 201 So You Want to Be a Pentester Absolute0x0
• 200 Internet of Things IoT radio frequency RF Analysis With Software Defined Radio Kevin Bong
• 103 Becoming a Cyborg The First Step Into Implantable Technology Michael Vieau
• 102 Weaponizing Nanotechnology and hacking humans defining the boundaries Chris Roberts
• 100 Act Three The Evolution of Privacy Finux