I am super excited to speak at Black Hat USA this year with Rob King (lorddimwit is now @rk@well.com (npub1etd…8t0k)) Our work, "Secure Shells in Shambles", dives deep into the Secure Shell protocol, its popular implementations, what's changed, what hasn't, and how this leads to unexpected vulnerabilities and novel attacks. An open source tool, dubbed "sshamble", will be demonstrated, which reproduces these attacks and opens the door for further research.
#BHUSA #vulnerability #infosec
- https://www.blackhat.com/us-24/briefings/schedule/#secure-shells-in-shambles-40393
Some of the announced talks that I am looking forward to include:
* Super Hat Trick: Exploit Chrome and Firefox Four Times: Nan Wang, Zhenghang Xiao, & Xuehao Guo
* Securing Network Appliances: New Technologies and Old Challenges: Vladyslav Babkin
* Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server! Orange Tsai
* Listen to the Whispers: Web Timing Attacks that Actually Work: James Kettle
* Project Zero: Ten Years of 'Make 0-Day Hard': Natalie Silvanovich
* Nope, S7ill Not Secure: Stealing Private Keys From S7 PLCs: Nadav Adir, Alon Dankner, Eli Biham, Sara Bitan, Ron Freudenthal, Or Keret
* Listen Up: Sonos Over-The-Air Remote Kernel Exploitation and Covert Wiretap: Alex Plaskett, Robert Hererra
* Bugs of Yore: A Bug Hunting Journey on VMware's Hypervisor: Zisis Sialveras
* Crashing the Party: Vulnerabilities in RPKI Validation: Niklas Vogel, Donika Mirdita, Haya Schulmann, Michael Waidner
* OVPNX: 4 Zero-Days Leading to RCE, LPE and KCE (via BYOVD) Affecting Millions of OpenVPN Endpoints Across the Globe: Vladimir Tokarev
* Surveilling the Masses with Wi-Fi Positioning Systems: Erik Rye
* Terrapin Attack: Breaking SSH Channel Integrity by Sequence Number Manipulation: Fabian Bäumer
HD Moore /
npub18p…k787r
2024-05-29 03:26:57
Author Public Key
npub18pcs78pe5c63534qwvzf5c0gateeu9qk3g4grgj5n9gxn8wth8vsek787rPublished at
2024-05-29 03:26:57Event JSON
{
"id": "9b26b516d52d0adcdee9266960a9490cafeee2ec9473e4e68ac5d74a9a607d46",
"pubkey": "38710f1c39a6351a46a073049a61e8eaf39e14168a2a81a2549950699dcbb9d9",
"created_at": 1716953217,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@hdm/112522246034888101",
"web"
],
[
"t",
"vulnerability"
],
[
"p",
"cadb1cb31087aad9a6b36255e234b0665c3cff2ef8c84c0d6717a66bc0492c9f"
],
[
"t",
"infosec"
],
[
"t",
"bhusa"
],
[
"proxy",
"https://infosec.exchange/users/hdm/statuses/112522246034888101",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/hdm/statuses/112522246034888101",
"pink.momostr"
]
],
"content": "I am super excited to speak at Black Hat USA this year with Rob King (nostr:npub1etd3evcss74dnf4nvf27yd9svewrelewlryycrt8z7nxhszf9j0sgm8t0k) Our work, \"Secure Shells in Shambles\", dives deep into the Secure Shell protocol, its popular implementations, what's changed, what hasn't, and how this leads to unexpected vulnerabilities and novel attacks. An open source tool, dubbed \"sshamble\", will be demonstrated, which reproduces these attacks and opens the door for further research.\n\n#BHUSA #vulnerability #infosec \n\n- https://www.blackhat.com/us-24/briefings/schedule/#secure-shells-in-shambles-40393\n\nSome of the announced talks that I am looking forward to include:\n\n* Super Hat Trick: Exploit Chrome and Firefox Four Times: Nan Wang, Zhenghang Xiao, \u0026 Xuehao Guo\n\n* Securing Network Appliances: New Technologies and Old Challenges: Vladyslav Babkin\n\n* Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server! Orange Tsai\n\n* Listen to the Whispers: Web Timing Attacks that Actually Work: James Kettle\n\n* Project Zero: Ten Years of 'Make 0-Day Hard': Natalie Silvanovich\n\n* Nope, S7ill Not Secure: Stealing Private Keys From S7 PLCs: Nadav Adir, Alon Dankner, Eli Biham, Sara Bitan, Ron Freudenthal, Or Keret\n\n* Listen Up: Sonos Over-The-Air Remote Kernel Exploitation and Covert Wiretap: Alex Plaskett, Robert Hererra\n\n* Bugs of Yore: A Bug Hunting Journey on VMware's Hypervisor: Zisis Sialveras\n\n* Crashing the Party: Vulnerabilities in RPKI Validation: Niklas Vogel, Donika Mirdita, Haya Schulmann, Michael Waidner\n\n* OVPNX: 4 Zero-Days Leading to RCE, LPE and KCE (via BYOVD) Affecting Millions of OpenVPN Endpoints Across the Globe: Vladimir Tokarev\n\n* Surveilling the Masses with Wi-Fi Positioning Systems: Erik Rye\n\n* Terrapin Attack: Breaking SSH Channel Integrity by Sequence Number Manipulation: Fabian Bäumer",
"sig": "00d71ca7813662a2f4eaf6fe3266d66c8cb53eb5ea64bd2cd0f07bedbc2af0ae6f61e461efa2ae96671e405ac8dc3ebc2d7a73b65cca447fc1e819bb9587e7f8"
}