Speakers 2022

James Forshaw

These Are My Principals, If You Don't like Them, I Have Others.

Relaying NTLM authentication is still a serious problem on Windows domain networks almost 20 years after it was initially published. While Microsoft have introduced many changes to NTLM authentication such as Extended Protection for Authentication one common recommendation is to just disable NTLM entirely and revert to using Kerberos. The obvious question to ask, is disabling NTLM sufficient to solve authentication relay attacks on Windows networks? Read more...

Samuel Groß and Amanda Burnett

Attacking JavaScript Engines in 2022

Exploits targeting JavaScript engines have risen to prominence in recent years and are today frequently used to compromise the renderer process in a typical browser exploit chain. This talk aims to give an overview of the current state of JavaScript engine security. It will cover various JavaScript engine internals, common bug types and how they are typically exploited, as well as the state of present and potential future exploit mitigations. It will then hopefully become clear why JavaScript engines are currently favoured by attackers. Read more...

Mark Brand and Sergei Glazunov

Data-only Sandbox Escapes

A round-up of the state-of-the-art in modern Chromium-based browser IPC sandbox-escape exploitation, and a look towards the future. We'll start with a brief overview of the techniques that we've used in our own past exploits, and seen in public and in-the-wild exploit samples, and then move on to describing a more futuristic approach and its interaction with current and prospective exploit mitigations. Read more...

Federico Menarini and Martijn Bogaard

Bug Hunting S21’s 10ADAB1E FW

Exynos-based Samsung phones contain an encrypted blob of highly privileged firmware known as the loadable firmware of which little is (publicly) known, but that implements many of the most security critical operations related to efuses, cryptographic keys, memory protection, etc. In this presentation we will demonstrate how we extracted the decrypted firmware of last year’s Galaxy S21 and some of the bugs we found while reverse engineering the firmware, resulting in several ways to fully compromise the Trusted Execution Environment from a rooted Android environment. Read more...

Eneko Cruz Elejalde

Building a DIY Baseband Debugger from Scratch

Modern basebands are an attractive exploitation vector to target smartphones and cellular-connected devices. Baseband vulnerability research remains complex, as researchers often lack means of debugging these components. This submission presents how standard communication interfaces present on all baseband chips can be used to write a target-agnostic debugger, provided that partially overwriting baseband firmware is possible. The decisions taken during development are explained and the construction of such a debugger is explained step by step. Finally, to demonstrate the debugger, a breakpoint is created and a GSM message delivered from a rogue cellular base station is observed live in the baseband memory. Read more...

Tamas K Lengyel and Bálint Varga-Perke

Case Studies of Fuzzing with Xen

Kernel Fuzzer for Xen (KF/x), the Xen-based snapshot fuzzer has been open-source for over a year now and it has resulted in finding bugs in a variety of Linux kernel modules. As the name of the tool implies,it was intended to target hard-to-reach parts of the OS and allow deterministic fuzzing by running the target code in lightweight VM forks. Read more...

Alex Ermolov, Alex Matrosov and Yegor Vasilenko

UEFI Firmware Vulnerabilities: Past, Present and Future

For any device, the supply chain is extremely complex and it plays a significant role in the platform security. The UEFI System Firmware relies heavily on its supply chain with many parties involved, including OBV, IBV, OEM etc. each following their own development lifecycle, mitigations policy and impacting different security models and update delivery timeline for endpoint devices. Read more...

Luca Todesco

Life of an *OS Attacker

The landscape of offensive security for *OS has evolved over the years due to ever-increasing mitigations. This talk will shed some light on what it takes to successfully attack *OS in current times and how things have changed compared to a few years ago. Read more...

Simon Scannell, Niklas Breitfeld and Carl Smith

Counter-Strike: Global Offsets - A journey into exploiting the Source Engine

From Parser Differentials to Sandbox Escapes, Valve's Source Engine isn't just fun for players, but for Exploit Developers as well. In this talk, we map out client and server-side attack surface that affects dozens of millions of users, detail exploitation strategies and share our journey into developing a 100% reliable, wormable RCE chain. Learn how to find, validate, and profit from bugs affecting some of the most popular multiplayer games. Read more...

Radek Domanski and Pedro Ribeiro

Pwn2Own’ing Your Router over the Internet

Hacking through the WAN (Wide Area Network) interface of a consumer or enterprise network router requires different approaches and techniques than hacking through the LAN (Local Area Network) interfaces. WAN interface services are usually much better protected and firewalled than in a LAN interface, and usually there are no network services accessible from the WAN. However, using the techniques we have developed we were able to demonstrate 6 unique successful WAN exploits during our Pwn2Own adventures. In this talk, we will present our exploits and methodology that we kept private for our own use until now. Read more...

Maddie Stone

Real World 0-days: A Year-in-Review of 0-day Exploits Used In-the-Wild in 2021

In 2021, a record-breaking XX [51 as of Oct 21, 2021] 0-day exploits were detected in-the-wild, up from 25 in 2020. That means we have XX [51 so far] data points to learn what attackers are actually doing with 0-day exploits. This talk synthesizes what we can learn from the 0-days detected in-the-wild in 2021: the trends, the lessons learned, the novel bugs & methods. All of this will be backed up with detailed walk-throughs of some of the most notable aspects of the in-the-wild 0-day exploits seen in 2021. Read more...

Hany Ragab and Enrico Barberis

Rage Against the Machine Clear

Since the discovery of the Spectre and Meltdown vulnerabilities, transient execution attacks have increasingly gained momentum. However, while the security community has investigated several variants to trigger attacks during transient execution, much less attention has been devoted to the analysis of the root causes of transient execution itself. Most transient attack variants simply build on well-known causes, such as branch misprediction and aborts of Intel TSX—which is no longer supported on many recent processors. Read more...

Erik Egsgard

BlackSwan - Exploiting a Gaggle of Windows Privilege Escalation Bugs

During research this past spring multiple privilege elevation vulnerabilities were discovered that affect all versions of Windows since Vista. Most of the vulnerabilities are memory corruption bugs and, despite modern mitigations, were easy to exploit. This talk will cover the discovery of the bugs and the techniques used to create reliable exploits. Read more...

Maxim Goryachy, Dmitry Sklyarov and Mark Ermolov

Chip Red Pill: How we Achieved the Arbitrary [micro]Code Execution inside Intel Atom CPUs

All the modern Intel CPUs have RISC-core inside the chip. The core implements abstraction layer that interprets user-visible instruction set to invisible hardware-internal RISC instructions. RISC core has maximum privileges accessing the data. The microcode program is built into chip, but the OS and UEFI may apply some patches – microcode updates. Unfortunately, they are encrypted and there is poor public information on how it is working. Due to this, there are no public researchers about internal structure of Intel CPU microcode. Now we found the way that you can use to get an access to it on public-available platform. Read more...

Patrick Ventuzelo

Beaconfuzz - A Journey into Ethereum 2.0 Blockchain Fuzzing and Vulnerability Discovery

This talk is about our journey and step-by-step process into fuzzing Ethereum 2.0 implementations software. We will start with a brief introduction to Ethereum 2.0 specification and ecosystem. Then, we will explain the architecture of this type of software and the kind of bugs we were looking for (DoS, logic/consensus bugs). We will also detail the complexity behind fuzzing 5 differents under-development software written in 5 different languages (Rust, Go, Java, Nim, JS) by 5 different teams. Finally, we will go chronologically through all the different fuzzing frameworks and techniques (dumb, coverage-guided, differential, structural) we used and why we choose them in the first place. In the end, this project leads us to find more than 30 critical bugs across all implementations. Read more...