Black Hat 2018预览：上百个议题将发表

演讲组织

演讲人数

Microsoft

10

Riscure

9

Tencent  Keen Security Lab

8

Google

6

Graz  University of Technology

6

EURECOM

5

IBM  Research

5

Duo  Security

4

Endgame

4

Global  Commission on the Stability of Cyberspace

4

KAIST

4

Positive  Technologies

4

Keynote

Optimistic  Dissatisfaction with the Status Quo: Steps We Must Take to Improve Security  in Complex Landscapes

WEDNESDAY  | 9:00AM

AWS上检测凭证被窃

Detecting Credential Compromise in AWS

WEDNESDAY  | 10:30AM

识别online scanners

Dissecting  Non-Malicious Artifacts: One IP at a Time

WEDNESDAY  | 10:30AM

ESI引擎漏洞挖掘

Edge  Side Include Injection: Abusing Caching Servers into SSRF and Transparent  Session Hijacking

WEDNESDAY  | 10:30AM

钓鱼邮件安全意识

Exposing  the Bait: A Qualitative Look at the Impact of Autonomous Peer Communication  to Enhance Organizational Phishing Detection

WEDNESDAY  | 10:30AM

Xori自动反编译分析恶意软件

Finding  Xori: Malware Analysis Triage with Automated Disassembly

WEDNESDAY  | 10:30AM

安全从业人员人文关怀

Holding  on for Tonight: Addiction in InfoSec

WEDNESDAY  | 10:30AM

SBOM物联网政策

How I  Learned to Stop Worrying and Love the SBOM

WEDNESDAY  | 10:30AM

恶意软件检测

Measuring  the Speed of the Red Queen's Race; Adaption and Evasion in Malware

WEDNESDAY  | 10:30AM

硬件钱包

Software  Attacks on Hardware Wallets

WEDNESDAY  | 10:30AM

Hyper-V漏洞挖掘

A Dive  in to Hyper-V Architecture & Vulnerabilities

WEDNESDAY  | 11:15AM

以太坊智能合约区块链漏洞挖掘

Blockchain  Autopsies - Analyzing Ethereum Smart Contract Deaths

WEDNESDAY  | 11:15AM

深度学习神经网络做安全检测

Deep  Neural Networks for Hackers: Methods, Applications, and Open Source Tools

WEDNESDAY  | 11:15AM

机器人的法律探讨

From  Bot to Robot: How Abilities and Law Change with Physicality

WEDNESDAY  | 11:15AM

Keen  team的iOS越狱

KeenLab  iOS Jailbreak Internals: Userland Read-Only Memory can be Dangerous

WEDNESDAY  | 11:15AM

Miasm工程框架

Miasm:  Reverse Engineering Framework

WEDNESDAY  | 11:15AM

JavaScript引擎内置的即时（JIT）编译器漏洞挖掘

New  Trends in Browser Exploitation: Attacking Client-Side JIT Compilers

WEDNESDAY  | 11:15AM

黑客与压力

Stress  and Hacking: Understanding Cognitive Stress in Tactical Cyber Ops

WEDNESDAY  | 11:15AM

TRITON工控

TRITON:  How it Disrupted Safety Systems and Changed the Threat Landscape of  Industrial Control Systems, Forever

WEDNESDAY  | 11:15AM

软件定义SD-WAN攻击

CANCELLED:  Too Soft[ware Defined] Networks: SD-WAN VulnerabilityAssessment

WEDNESDAY  | 1:30PM

VPN攻击

Compression  Oracle Attacks on VPN Networks

WEDNESDAY  | 1:30PM

ICS防火墙

Deep  Dive into an ICS Firewall, Looking for the Fire Hole

WEDNESDAY  | 1:30PM

法律政策

Legal  Landmines: How Law and Policy are Rapidly Shaping Information Security

WEDNESDAY  | 1:30PM

地缘政治与恶意软件分析

No  Royal Road … Notes on Dangerous Game

WEDNESDAY  | 1:30PM

UEFI  firmware固件攻击

Remotely  Attacking System Firmware

WEDNESDAY  | 1:30PM

无线SD卡攻击

Reversing  a Japanese Wireless SD Card - From Zero to Code Execution

WEDNESDAY  | 1:30PM

侧信道攻击解密

Screaming  Channels: When Electromagnetic Side Channels Meet Radio Transceivers

WEDNESDAY  | 1:30PM

汽车固件ECU攻击

There  will be Glitches: Extracting and Analyzing Automotive Firmware Efficiently

WEDNESDAY  | 1:30PM

检测twitter机器人

Don't @  Me: Hunting Twitter Bots at Scale

WEDNESDAY  | 2:40PM

ROSE远程在线社工

Every  ROSE has its Thorn: The Dark Art of Remote Online Social Engineering

WEDNESDAY  | 2:40PM

工作站到域控的攻击

From  Workstation to Domain Admin: Why Secure Administration isn't Secure and How  to Fix it

WEDNESDAY  | 2:40PM

Meltdown详解

Meltdown:  Basics, Details, Consequences

WEDNESDAY  | 2:40PM

黑客的心理健康

Mental  Health Hacks: Fighting Burnout, Depression and Suicide in the Hacker  Community

WEDNESDAY  | 2:40PM

Sysmon高级玩法

Subverting  Sysmon: Application of a Formalized Security Product Evasion Methodology

WEDNESDAY  | 2:40PM

BMC攻击

The  Unbearable Lightness of BMC's

WEDNESDAY  | 2:40PM

威胁建模

Threat  Modeling in 2018: Attacks, Impacts and Other Updates

WEDNESDAY  | 2:40PM

WireGuard密码学攻击VPN

WireGuard:  Next Generation Secure Network Tunnel

WEDNESDAY  | 2:40PM

iOS 11的async_wake漏洞利用

A Brief  History of Mitigation: The Path to EL1 in iOS 11

WEDNESDAY  | 4:00PM

Meltdown漏洞响应的背后故事

Behind  the Speculative Curtain: The True Story of Fighting Meltdown and Spectre

WEDNESDAY  | 4:00PM

新型web攻击面path normalization漏洞挖掘

Breaking  Parser Logic: Take Your Path Normalization off and Pop 0days Out!

WEDNESDAY  | 4:00PM

工控网关漏洞

Breaking  the IIoT: Hacking industrial Control Gateways

WEDNESDAY  | 4:00PM

LET网络注入恶意包

LTE  Network Automation Under Threat

WEDNESDAY  | 4:00PM

针对用于移动和物联网设备的微软Cortana攻击

Open  Sesame: Picking Locks with Cortana

WEDNESDAY  | 4:00PM

GO语言漏洞

Squeezing  a Key through a Carry Bit

WEDNESDAY  | 4:00PM

X86架构下的提取漏洞

Why so  Spurious? How a Highly Error-Prone x86/x64 CPU "Feature" can be  Abused to Achieve Local Privilege Escalation on Many Operating Systems

WEDNESDAY  | 4:00PM

零信任网络的威胁

ZEROing  Trust:  Do Zero Trust Approaches  Deliver Real Security?

WEDNESDAY  | 4:00PM

AFL的盲点

AFL's  Blindspot and How to Resist AFL Fuzzing for Arbitrary ELF Binaries

WEDNESDAY  | 5:05PM

加密货币IOTA的攻击

A  Tangled Curl: Attacks on the Curl-P Hash Function Leading to Signature  Forgeries in the IOTA Signature Scheme

WEDNESDAY  | 5:05PM

KVM  Hypervisor安全设计

Back to  the Future: A Radical Insecure Design of KVM on ARM

WEDNESDAY  | 5:05PM

区块链分散和抗删除的域名技术对抗

Beating  the Blockchain by Mapping Out Decentralized Namecoin and Emercoin  Infrastructure

WEDNESDAY  | 5:05PM

安全社区的X骚扰事件

How can  Communities Move Forward After Incidents of Sexual Harassment or Assault?

WEDNESDAY  | 5:05PM

开源工具ChipWhisperer-Lint在硬件侧信到攻击中使用

I, for  One, Welcome Our New Power Analysis Overlords

WEDNESDAY  | 5:05PM

腐败对信息安全社区的影响

InfoSec  Philosophies for the Corrupt Economy

WEDNESDAY  | 5:05PM

黑手党是否接管了网络犯罪

Is the  Mafia Taking Over Cybercrime?

WEDNESDAY  | 5:05PM

针对物理隔离Air-Gap的攻击

The  Air-Gap Jumpers

WEDNESDAY  | 5:05PM

安卓ARTist逆向分析工具

ARTist  - A Novel Instrumentation Framework for Reversing and Analyzing Android Apps  and the Middleware

THURSDAY  | 9:00AM

网络安全的PTSD创伤后应激障碍

Demystifying  PTSD in the Cybersecurity Environment

THURSDAY  | 9:00AM

基于主机的Mac OS防火墙研究

Fire  & Ice: Making and Breaking macOS Firewalls

THURSDAY  | 9:00AM

WinVote  Voting Machines必胜投票机取证

Lessons  from Virginia - A Comparative Forensic Analysis of WinVote Voting Machines

THURSDAY  | 9:00AM

用网上情报资源预测支付欺诈

Money-rity  Report: Using Intelligence to Predict the Next Payment Card Fraud Victims

THURSDAY  | 9:00AM

deception欺骗检测技术的弱点

Real  Eyes, Realize, Real Lies: Beating Deception Technologies

THURSDAY  | 9:00AM

BlackBerry产品安全管理经验

Stop  that Release, There's a Vulnerability!

THURSDAY  | 9:00AM

WebAssembly漏洞挖掘

The  Problems and Promise of WebAssembly

THURSDAY  | 9:00AM

YubiKey双因子

Two-Factor  Authentication, Usable or Not? A Two-Phase Usability Study of the FIDO U2F  Security Key

THURSDAY  | 9:00AM

ATM机攻击设备

Black  Box is Dead. Long Live Black Box!

THURSDAY  | 9:45AM

SSO  SAML漏洞挖掘

Identity  Theft: Attacks on SSO Systems

THURSDAY  | 9:45AM

内核攻击

Kernel  Mode Threats and Practical Defenses

THURSDAY  | 9:45AM

网络安全外交

New  Norms and Policies in Cyber-Diplomacy

THURSDAY  | 9:45AM

VSS备份特性攻击

Reconstruct  the World from Vanished Shadow: Recovering Deleted VSS Snapshots

THURSDAY  | 9:45AM

iot领域蜂窝设备的漏洞挖掘

Snooping  on Cellular Gateways and Their Critical Role in ICS

THURSDAY  | 9:45AM

女网络安全工程师的招聘

The  Science of Hiring and Retaining Female Cybersecurity Engineers

THURSDAY  | 9:45AM

针对Windows Notification的攻击

The  Windows Notification Facility: Peeling the Onion of the Most Undocumented  Kernel Attack Surface Yet

THURSDAY  | 9:45AM

构造语音认证攻击

Your  Voice is My Passport

THURSDAY  | 9:45AM

macOS  MDM安全

A Deep  Dive into macOS MDM (and How it can be Compromised)

THURSDAY  | 11:00AM

对机器学习算法的攻击

AI  & ML in Cyber Security - Why Algorithms are Dangerous

THURSDAY  | 11:00AM

交易安全Trading Stocks

Are You  Trading Stocks Securely? Exposing Security Flaws in Trading Technologies

THURSDAY  | 11:00AM

微码安全研究

Decompiler  Internals: Microcode

THURSDAY  | 11:00AM

检测恶意云账号行为

Detecting  Malicious Cloud Account Behavior: A Look at the New Native Platform  Capabilities

THURSDAY  | 11:00AM

针对OpenPGP and S/MIME攻击

Efail:  Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels

THURSDAY  | 11:00AM

x86处理器的硬件后门

GOD MODE UNLOCKED -  Hardware Backdoors in x86 CPUs

THURSDAY  | 11:00AM

医疗领域hl7协议漏洞挖掘

Pestilential  Protocol: How Unsecure HL7 Messages Threaten Patient Lives

THURSDAY  | 11:00AM

移动端的监听技术

Stealth  Mango and the Prevalence of Mobile Surveillanceware

THURSDAY  | 11:00AM

自动驾驶的安全

Applied  Self-Driving Car Security

THURSDAY  | 12:10PM

视频水印的攻击

None of  My Pixel is Your Business: Active Watermarking Cancellation Against Video  Streaming Service

THURSDAY  | 12:10PM

智慧城市的漏洞挖掘

Outsmarting  the Smart City

THURSDAY  | 12:10PM

TLS 1.3安全

Playback:  A TLS 1.3 Story

THURSDAY  | 12:10PM

增强机器学习抗攻击能力

Protecting  the Protector, Hardening Machine Learning Defenses Against Adversarial  Attacks

THURSDAY  | 12:10PM

域控攻击

So I  became a Domain Controller

THURSDAY  | 12:10PM

TLB的侧信道攻击

TLBleed:  When Protecting Your CPU Caches is Not Enough

THURSDAY  | 12:10PM

WebAssembly漏洞挖掘

WebAssembly:  A New World of Native Exploits on the Browser

THURSDAY  | 12:10PM

缓解speculative漏洞的故事

Wrangling  with the Ghost: An Inside Story of Mitigating Speculative Execution Side  Channel Vulnerabilities

THURSDAY  | 12:10PM

关于DRAM的漏洞Rowhammer

Another  Flip in the Row

THURSDAY  | 2:30PM

反序列化漏洞自动发现

Automated  Discovery of Deserialization Gadget Chains

THURSDAY  | 2:30PM

社工攻击研究

Catch  me, Yes we can! – Pwning Social Engineers using Natural  Language Processing Techniques in Real-Time

THURSDAY  | 2:30PM

智能手机baseband攻击

Exploitation  of a Modern Smartphone Baseband

THURSDAY  | 2:30PM

自动漏洞利用(内核)

From  Thousands of Hours to a Couple of Minutes: Automating Exploit Generation for  Arbitrary Types of Kernel Vulnerabilities

THURSDAY  | 2:30PM

Autism  Spectrum Disorder研究

How can  Someone with Autism Specifically Enhance the Cyber Security Workforce?

THURSDAY  | 2:30PM

SATCOM安全研究

Last  Call for SATCOM Security

THURSDAY  | 2:30PM

iot漏洞的合法责任

Legal  Liability for IOT Cybersecurity Vulnerabilities

THURSDAY  | 2:30PM

widnows  Defender的仿真器

Windows  Offender: Reverse Engineering Windows Defender's Antivirus Emulator

THURSDAY  | 3:50PM

mPOSl漏洞挖掘

For the  Love of Money: Finding and Exploiting Vulnerabilities in Mobile Point of  Sales Systems

THURSDAY  | 3:50PM

微软OSR团队对Hyper-V漏洞的挖掘

Hardening  Hyper-V through Offensive Security Research

THURSDAY  | 3:50PM

IoT恶意软件的综合调查分析框架

IoT  Malware: Comprehensive Survey, Analysis Framework and Case Studies

THURSDAY  | 3:50PM

通过深度学习来帮助侧信道攻击

Lowering  the Bar: Deep Learning for Side Channel Analysis

THURSDAY  | 3:50PM

大型机漏洞挖掘

Mainframe  [z/OS] Reverse Engineering and Exploit Development

THURSDAY  | 3:50PM

web缓存中毒攻击

Practical  Web Cache Poisoning: Redefining 'Unexploitable'

THURSDAY  | 3:50PM

小型组织创建SDL的实践

SDL  That Won't Break the Bank

THURSDAY  | 3:50PM

无线电紧急系统的攻击

SirenJack: Cracking  a 'Secure' Emergency Warning Siren System

THURSDAY  | 3:50PM

植入式医疗设备的漏洞挖掘

Understanding  and Exploiting Implanted Medical Devices

THURSDAY  | 3:50PM

docker攻击

An  Attacker Looks at Docker: Approaching Multi-Container Applications

THURSDAY  | 5:00PM

IBM的AI攻击DeepLocker研究DeepLocker - Concealing Targeted Attacks with AI Locksmithing

DeepLocker  - Concealing Targeted Attacks with AI Locksmithing

THURSDAY  | 5:00PM

模糊测试Fuzz研究

Follow  the White Rabbit: Simplifying Fuzz Testing Using FuzzExMachina

THURSDAY  | 5:00PM

PHP的非序列漏洞研究

It's a  PHP Unserialization Vulnerability Jim

THURSDAY  | 5:00PM

NOC BH统计分析报告

Lessons  and Lulz: The 4th Annual Black Hat USA NOC Report

THURSDAY  | 5:00PM

NOC报告

Lessons  and Lulz: The 4th Annual Black Hat USA NOC Report

THURSDAY  | 5:00PM

Keen  team对特斯拉攻击的分享

Over-the-Air:  How we Remotely Compromised the Gateway, BCM, and Autopilot ECUs of Tesla  Cars

THURSDAY  | 5:00PM

TLS漏洞分析

Return  of Bleichenbacher's Oracle Threat (ROBOT)

THURSDAY  | 5:00PM

SDN的渗透测试框架

The  Finest Penetration Testing Framework for Software-Defined Networks

THURSDAY  | 5:00PM

移动恶意软件攻击技术分析

Unpacking  the Packed Unpacker: Reverse Engineering an Android Anti-Analysis Native  Library

THURSDAY  | 5:00PM