Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Black Hat Asia
May 10-13, 2022
Hybrid/Marina Bay Sands, Singapore
Black Hat USA
August 6-11, 2022
Las Vegas, NV, USA
Black Hat Europe
December 5-8, 2022
London
End of Bibblio RCM includes -->
1/22/2015
11:00 AM
Black Hat Staff
Black Hat Staff
Event Updates

Black Hat Asia 2015: Android Assault

Black Hat Asia 2015 is just over two months away, so it's high time to start exploring the numerous exciting Black Hat Briefings that'll be on offer. Black Hat's signature Briefings offer an oft-imitated, seldom equaled combo of hardcore technical insights presented by world-class experts, but you probably knew that. Today's inaugural trio of Briefings all touch on Google's incredibly popular mobile operating system …

The new Android Runtime (ART) brings some nice improvements, but it's new technology, so there's bound to be some, I dunno, ways to create user-mode rootkits? Indeed, that's exactly what you'll hear about in Hiding Behind Android Runtime (ART), in which Paul Sabanal will demonstrate a way to achieve persistence on devices despite recent advances that make modifying the system partition increasingly difficult. Expect a deep dive into ART internals that will cover the file formats and mechanisms relevant to achieving this root, as well as discussion of the method's limitations and a live demo.

Switching gears, the once-stodgy consumer payment industry has seen a flurry of change lately, with the growing adoption of contactless "smart" cards being just one development. Come to Relaying EMV Contactless Transactions Using Off-the-Shelf Android Devices to hear about another: the first discovered vulnerabilities in the EMV (Europay, MasterCard, Visa) Contactless platform. With this attack, a victim can have his or her contactless card used for an illicit purchase just by standing nearby. Presenter Jordi Van den Breekel will also discuss vulnerabilities found in other contactless platforms, including out-of-spec, non-unique codes used in Visa cards, a denial-of-service attack, and much more. You might want to leave your wallet at the hotel, just to be safe.

Finally, tools like APKProtect, DexGuard, BangCle, Ijiami, and LIAPP give Android developers some semblance of code protection. They employ varied anti-analysis techniques such as anti-debugging, anti-jdwp, self-debugging, and straight-up obfuscation. So, no more easy cracking of compiled APKs, right? Well, you ought to have a word with Yeonung Park, whose Briefing We Can Still Crack You! General Unpacking Method for Android Packer (no root) will propose and demonstrate a novel, general unpacking method that circumvents the anti-analysis measures and doesn't even need root. (What a showoff.)

Black Hat Asia 2015 takes place March 24 to 27 at the Marina Bay Sands in Singapore, and this is the last week for super-low early-bird rates. Get registered already!

Comment  | 
Print  | 
More Insights
//Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Improving Enterprise Cybersecurity With XDR
Enterprises are looking at eXtended Detection and Response technologies to improve their abilities to detect, and respond to, threats. While endpoint detection and response is not new to enterprise security, organizations have to improve network visibility, expand data collection and expand threat hunting capabilites if they want their XDR deployments to succeed. This issue of Tech Insights also includes: a market overview for XDR from Omdia, questions to ask before deploying XDR, and an XDR primer.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-5683
PUBLISHED: 2022-06-30
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none.
CVE-2013-6390
PUBLISHED: 2022-06-30
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none.
CVE-2013-6423
PUBLISHED: 2022-06-30
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none.
CVE-2013-6464
PUBLISHED: 2022-06-30
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none.
CVE-2013-6471
PUBLISHED: 2022-06-30
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none.