SecTor 2025 | AI, Deepfakes, and the Next Evolution of Digital Identity Verification
The SecTor 2025 session focused on the emerging threat of AI‑generated synthetic identities and deepfakes, arguing that the next security frontier is proving a user is truly human rather than merely confirming a name. Speakers illustrated how fraud rings, hostile states, and criminal syndicates now create convincing digital personas in seconds, turning identity theft into a mass‑scale operation. Key data points underscored the urgency: document‑fraud incidents jumped 311% in North America in Q1 2024, while deepfake usage surged 1,100% over the same period. Historical case studies—Bernie Madoff’s fabricated investors, the Equifax breach caused by unpatched Apache Struts, and the Nigerian bank SWIFT hack that siphoned $81 million—demonstrated how outdated verification and patching practices enable massive losses. The presenters highlighted practical defenses: an eight‑point visual checklist for spotting deepfake faces, biometric cues such as jawline and eye movement, and the use of geolocation and typing‑rhythm analytics to flag impossible travel patterns. Real‑world anecdotes, like the Obama photo deepfake and a forged Canadian ID missing holographic elements, showed how simple visual anomalies can betray fraudulent identities. The overarching implication is clear: organizations must adopt AI‑enhanced, multi‑modal identity verification that continuously validates human behavior, not just static credentials. Regulatory bodies are already tightening requirements, and businesses that fail to modernize risk exposure to unprecedented synthetic‑identity attacks.
SecTor 2025 | Security and Safety Testing for Agentic AI
The SecTor 2025 talk highlighted the urgent need for robust security and safety testing of agentic AI systems. Presented by a ServiceNow AI R&D leader, the speaker framed the discussion around the explosive growth of AI adoption—200 million weekly ChatGPT users,...
SecTor 2025 | Foreign Information Manipulation and Interference (FIMI) (Disinformation 2.0)
The SecTor 2025 session titled “Foreign Information Manipulation and Interference (FIMI)” examined how state‑backed actors deliberately inject distorted content into the information ecosystem to sway public opinion and policy. Speaker Frankie Sagerman traced disinformation from Cold‑War KGB operations to today’s AI‑enhanced...
SecTor 2025 | Ghost SIM Attack: Hacking Mobile Network Authentication Policies
The SecTor 2025 presentation introduced the GOIM attack, a technique that extracts critical SIM card data—such as IMSI and ICCID—and leverages weak mobile‑network authentication policies to commit fraud across 2G, 3G, 4G, and 5G systems. The speakers detailed multiple extraction methods,...
SecTor 2025 | CAN Bus for Car Nerds and Security People Who Should Know Better
The presentation at SecTor 2025 focused on the Controller Area Network (CAN) bus, demystifying its operation for both automotive enthusiasts and security professionals. The speaker, a former IT security specialist turned EV builder, explained why modern vehicles—especially those built after...
SecTor 2025 | Hacking Policy for the Public Good
Tanya Jen, a former Canadian government security lead turned independent advocate, used her SecTor 2025 talk to spotlight the nation’s glaring absence of a mandatory, detailed secure‑coding policy for federal agencies. Drawing on her 13‑year tenure—including pentesting the prime minister’s...
SecTor 2025 | Behind Closed Doors - Bypassing RFID Readers & Physical Access Controls
The SecTor 2025 presentation demonstrates practical methods for breaching physical access controls, emphasizing that RFID readers are only one layer of a broader security ecosystem. Julius Dunuk, a red‑team specialist, showcases low‑tech tactics—such as using an under‑door tool to catch...
SecTor 2025 | Interactive Network Visualization of Data Poisoning Attacks
The SecTor 2025 talk introduced an interactive approach to visualizing data‑poisoning attacks by treating machine‑learning training sets as network graphs. By mapping nodes and edges that represent data points and their relationships, the presenter demonstrated how clean and compromised datasets...
SecTor 2025 | EDR Bypass Testing: A Systematic Approach to Validating Endpoint Defenses
The SecTor 2025 session introduced a systematic methodology for testing endpoint detection and response (EDR) defenses, emphasizing that modern attackers focus on bypassing rather than merely evading these solutions. Jacob and Ryan from Canadian MDR provider Eentire traced the evolution...
SecTor 2025 | Tracing Adversary Steps Through Cyber-Physical Attack Lifecycle
The SecTor 2025 presentation examined why breaching a cyber‑physical system does not automatically translate into physical damage. Using recent water‑utility incidents and a live HMI demonstration, the speaker showed that system safeguards—such as valve‑size limits and automatic shut‑offs—can absorb malicious...
SecTor 2025 | Unmasking a North Korean IT Farm
Signia’s director Abby Samira presented at SecTor 2025 a detailed case study of a North Korean‑run “IT farm,” where threat actors masquerade as legitimate IT employees to breach enterprises worldwide. The briefing linked the operation to recent FBI alerts that...
SecTor 2025 | How Adversaries Beat User-Mode Protection Engines for Over a Decade
At SecTor 2025, researcher Omri Misgav presented a decade‑long study of how adversaries bypass user‑mode endpoint protection engines. By analyzing open‑source tools, 55 data sources and high‑profile malware families such as Emotet, Hive ransomware and Winnti, the team identified 27...
SecTor 2025 | Investigate & Respond to Attacks on GenAI Chatbots
The SecTor 2025 session, led by Airbnb senior engineer Alan Sto, examined how organizations can investigate and respond to attacks on generative‑AI chatbots. Sto framed the discussion around a practical incident‑response playbook, emphasizing the need to understand chatbot architecture, threat...
SecTor 2025 | From Days to Hours: Accelerating Cyber Threat Response with AI Agents
At SecTor 2025, Ival, a veteran of Israel’s 8200 unit and director of security research at Hunters, unveiled a weekend‑project AI platform that compresses cyber‑threat response cycles from days into hours. The talk framed the problem around the "black" and...
SecTor 2025 | The (Un)Rightful Heir: My dMSA Is Your New Domain Admin
The SecTor 2025 talk unveiled a critical Active Directory flaw tied to the newly introduced Delegated Managed Service Account (DMSA). The speaker, Yval Gordon, walked through the DMSA migration workflow—linking a legacy service account, granting temporary authentication rights, and finally...
SecTor 2025 | What Happens When Your Digital Voice Clone Goes Rogue
The presentation detailed Microsoft’s experimental "Speak for Me" feature, an accessibility tool that records a user’s voice before it deteriorates and later synthesizes speech in that personal voice. The workflow involves capturing voice samples, uploading them to Azure’s Custom Neural...
Black Hat Stories | David Oswald, Cyber Security Professor at Durham University
Professor David Oswald of Durham University explains why Black Hat is valuable for academia, highlighting its practical, hands‑on keynotes that differ from traditional scholarly conferences. He notes the event brings together a diverse crowd—academics, independent consultants, and security‑focused companies—creating a fertile...
SecTor 2025 | DriveThru Hacking: Now with Delivery
The video presents a research project titled “Drive‑Thru Hacking: Now with Delivery,” demonstrating how dash‑cam devices can be compromised when a vehicle stops at a drive‑through. The team, led by Benjamin So and colleagues, scanned over 1,000 Wi‑Fi SSIDs in...
SecTor 2025 | Sharing Is Caring About an RCE Attack Chain on Quick Share
At SecTor 2025, SafeReach researchers Orya and Cohen unveiled a sophisticated remote‑code‑execution (RCE) attack chain targeting Google’s Quick Share, now available on Windows. The talk detailed how the team reverse‑engineered the Nearby Connections protocol, built a custom "QuickSniff" logger, and leveraged...
SecTor 2025 | Leading Across the Generations
The talk at SecTor 2025 focused on leading across generations in cybersecurity, emphasizing that technical expertise alone isn’t enough; leaders must grasp the cultural and motivational traits of each age cohort. The speaker highlighted how adoption timelines for technologies have shrunk—from...
SecTor 2025 | One Agent to Rule Them All: How One Malicious Agent Hijacks A2A System
The SecTor 2025 talk highlighted a growing security dilemma: multi‑agent generative‑AI systems, exemplified by Google’s A2A (Agent‑to‑Agent) protocol, can be weaponized by a single malicious agent that hijacks an entire automation ecosystem. The presenters, senior AI security researchers from Zenity...
Black Hat USA 2025 | ReVault! Compromised by Your Secure SoC
At Black Hat USA 2025, Cisco Talos senior researcher Firo Verity presented his findings on Dell’s Control Vault secure‑on‑chip (SoC) and how it can be compromised. Verity showed that the Broadcom‑based BCM58202 chip, used in over 100 Dell Latitude and Precision models,...
Black Hat USA 2025 | LLM-Driven Reasoning for Automated Vulnerability Discovery Behind Hall-of-Fame
The Black Hat USA 2025 talk introduced “Whisper,” a large‑language‑model‑driven system that automatically discovers vulnerabilities in stripped ARM64 binaries. The presenter, a researcher guiding an undergraduate team, explained how the tool earned a Hall of Fame award at Samsung...
Black Hat USA 2025 | Leveraging Jamf for Red Teaming in Enterprise Environments
The Black Hat USA 2025 session highlighted how adversary emulation teams can weaponize Jamf Pro—Apple’s enterprise‑device management platform—to conduct red‑team operations in Fortune‑500 environments. Speakers Lance Kane and Dan Mayer described Jamf’s prevalence in developer‑heavy organizations, its default “set‑and‑forget” configuration,...
Black Hat USA 2025 | 2 Cops 2 Broadcasting: TETRA End-To-End Under Scrutiny
Midnight Blue, a Dutch cyber‑security consultancy, presented at Black Hat USA 2025 a deep dive into the end‑to‑end encryption layer of the Tetra terrestrial trunked radio standard. Tetra, widely adopted for police, military and SCADA communications, has long kept its...
Black Hat USA 2025 | The 5G Titanic
The presentation likened the 5G architecture to the Titanic, arguing that, like the ship’s supposedly watertight compartments, 5G’s control‑plane and user‑plane are assumed to be isolated but in practice lack vertical sealing. The speaker outlined how the network’s design—AMF, SMF...
Black Hat USA 2025 | AI Agents for Offsec with Zero False Positives
Brendan Dolan‑Gavitt opened his Black Hat USA 2025 talk by warning that the promise of AI‑driven offensive security is haunted by a spectre of false positives. Drawing on his decade‑long experience in software security and recent work on GitHub Copilot,...
Black Hat USA 2025 | Protecting Small Organizations in the Era of AI Bots
The presentation at Black Hat USA 2025 focused on defending small, resource‑constrained organizations against the surge of AI‑driven bots. Citing the Impreva 2025 BadBot report, the speaker highlighted that 51% of all internet traffic is now non‑human, and that 80%...
Black Hat USA 2025 | Kernel-Enforced DNS Exfiltration Security
The presentation by independent researcher Vang Parnes focuses on the growing threat of DNS‑based command‑and‑control (C2) and tunneling techniques targeting Linux systems, especially in cloud environments. He outlines why DNS is the favored back‑door for advanced persistent threats (APTs), citing...
Black Hat USA 2025 | Burning, Trashing, Spacecraft Crashing
The Black Hat USA 2025 session, led by Mileno Star and Andre of Vision Space, highlighted the growing cyber‑risk landscape for space systems. With commercial constellations such as Starlink and OneWeb proliferating alongside renewed military satellite launches, the orbital environment now presents a...
Black Hat USA 2025 | Universal and Context-Independent Triggers for Precise Control of LLM Outputs
The Black Hat presentation introduced a novel class of prompt‑injection attacks called universal adversarial triggers, which allow attackers to hijack large language model (LLM) outputs with a single, reusable token sequence. By decoupling the malicious payload from the trigger,...
Black Hat Stories | Or Yair, Security Research Team Lead at SafeBreach
Ori Yair, security research team lead at SafeBreach, reflects on his Black Hat experiences, from his first nerve‑wracking speaking slot to his ongoing focus on Windows‑based vulnerability research. He frames the conference as a catalyst for turning technical curiosity into...
Black Hat USA 2025 | Ghost Calls: Abusing Web Conferencing for Covert Command & Control
The Black Hat USA 2025 talk introduced “ghost calls,” a technique that hijacks commercial web‑conferencing platforms to create covert, short‑term command‑and‑control (C2) channels. Presenter Adam Crosser explained that traditional C2 methods—socks proxies, long‑term implants, or peer‑to‑peer tunnels—often suffer from latency,...
Black Hat USA 2025 | Practical Attacks on Nostr, a Decentralized Censorship-Resistant Protocol
The Black Hat USA 2025 session, led by HKuma of NICT Japan, examined practical attacks on Nostr, a decentralized, censorship‑resistant social networking protocol. The talk highlighted how Nostr shifts trust to client devices, eliminating central servers, and presented the researchers’...
Black Hat USA 2025 | Uncovering and Responding to the Tj-Actions Supply Chain Breach
The presentation detailed a supply‑chain breach that hit the popular TJ‑actions/change‑files GitHub Action. On March 14, an automated alert flagged an unexpected outbound request, leading the Step Security team to discover that the action’s release tags had been repointed to a...
Black Hat USA 2025 | More Flows, More Bugs: Empowering SAST with LLMs and Customized DFA
The Black Hat USA 2025 talk, presented by Yuan of Tencent Security Winding Lab, detailed a novel approach to strengthening static application security testing (SAST) by marrying large language models (LLMs) with a customized data‑flow analysis (DFA) engine. The session...
Black Hat Asia 2026 Welcome Video
Black Hat Asia 2026, the premier cybersecurity conference for the Asia‑Pacific region, will convene at Singapore’s Marina Bay Sands this April. President Susie Pallet’s welcome video frames the event as a critical gathering of the region’s top security professionals. The agenda...
Black Hat USA 2025 | Evaluating Autonomous Vehicle Resilience
The Black Hat USA 2025 presentation from Zuks engineers focused on the resilience of autonomous‑driving vehicles through a human‑in‑the‑loop teleoperation model. Jan Hu and Shane Gupta explained how a remote operator can intervene when the AI’s confidence drops, sending waypoint...
Black Hat USA 2025 | Use and Abuse of Personal Information -- Politics Edition
The Black Hat USA 2025 presentation revealed a five‑year research project that generated 1,400 realistic fake voter identities to probe how political campaigns collect and use personal data during the 2024 election cycle. By automating sign‑ups for newsletters and phone lines, the...
Black Hat USA 2025 | Smart Charging, Smarter Hackers: The Unseen Risks of ISO 15118
The Black Hat USA 2025 talk examined ISO 15118, the emerging standard that underpins smart‑charging and vehicle‑to‑grid (V2G) communication for electric vehicles. By allowing chargers to modulate demand and feed power back to the grid, the protocol promises to alleviate...
Black Hat Asia 2026 Speaker Spotlight - Tal Be'ery
Tal Be'ery returned to Black Hat Asia 2026 to spotlight a growing crisis: billions of WhatsApp users are exposed to newly uncovered flaws that allow strangers to hijack their devices. Leveraging the conference’s blend of cutting‑edge research and Singapore’s relaxed vibe, he framed the...
Black Hat USA 2025 | HTTP/1.1 Must Die! The Desync Endgame
The Black Hat presentation titled “HTTP/1.1 Must Die! The Desync Endgame” warned that the fundamental design flaw in HTTP/1.1—its inability to reliably delineate where one request ends and the next begins—continues to enable powerful desynchronisation attacks. While many organisations have...
Black Hat USA 2025 | Peril at the Plug: Investigating EV Charger Security and Safety Failures
The Black Hat USA 2025 presentation titled “Peril at the Plug” examined the alarming security and safety gaps in electric‑vehicle (EV) chargers, drawing on findings from the PON (Pon Automotive) hacking contest. The speakers outlined the extensive attack surface—multiple CPUs,...
Black Hat USA 2025 | Hackers Dropping Mid-Heist Selfies
The Black Hat USA 2025 talk focused on a novel AI‑driven approach to dissecting “mid‑heist selfies” – screenshots harvested by information‑stealer malware. These malware families exfiltrate credentials, crypto wallets, password managers and system details without needing admin rights, then...
Black Hat USA 2025 | Analyzing Smart Farming Automation Systems for Fun and Profit
The Black Hat USA 2025 talk examined the rapid rise of smart‑farming automation kits that retrofit conventional tractors with GPS‑guided steering, tablet HMI, and cloud‑connected services. The presenters, Felix and Bernhard, highlighted how inexpensive add‑on solutions—typically $5‑10 k—are being sold...
Black Hat USA 2025 | BitUnlocker: Leveraging Windows Recovery to Extract BitLocker Secrets
At Black Hat USA 2025, Microsoft’s Storm team unveiled “Bit Unlocker,” a proof‑of‑concept that abuses the Windows Recovery Environment (WinRE) to extract BitLocker keys and decrypt protected volumes. The researchers explained that WinRE runs from a separate recovery partition and loads...
Black Hat USA 2025 | ECS-Cape – Hijacking IAM Privileges in Amazon ECS
The Black Hat talk unveiled a critical flaw dubbed “EC escape” that lets a single container running on an Amazon ECS‑EC2 instance hijack IAM credentials of every other container on the same host. By abusing the internal Agent Communication Service...
Black Hat USA 2025 | Shade BIOS: Unleashing the Full Stealth of UEFI Malware
At Black Hat USA 2025, Kazuk Kimatsu of FFR Security presented “Shade BIOS,” a method for extending UEFI firmware functionality into runtime to create fully stealthy BIOS‑level malware. He explained that today’s UEFI bootkits and SMM backdoors are limited by either...
Black Hat USA 2025 | Ransomware, Tracking, DoS, and Data Leaks on Xiaomi Electric Scooters
At Black Hat USA 2025, researchers from KTH, URIM and the ITROANS project presented a deep‑dive into the security flaws of Xiaomi’s flagship electric scooters, the M365 and Mi 3. The talk detailed how proprietary Bluetooth‑Low‑Energy protocols and over‑the‑air firmware updates...
Black Hat USA 2025 | No Hoodies Here: Organized Crime in AdTech
The Black Hat USA 2025 talk unveiled how the advertising ecosystem has become a lucrative conduit for organized crime. Speakers Dave Mitchell and Renee Burton detailed the rise of malicious ad‑tech networks—most notably VEX Trio—showing how they infiltrate legitimate ad...