Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Black Hat USA
July 31 - August 5, 2021
Las Vegas, NV, USA
SecTor
November 4 - October 30, 2021
Toronto, ON, Canada
Black Hat Europe
November 8-11, 2021
Virtual Event
6/17/2019
09:00 AM
Black Hat Staff
Black Hat Staff
Event Updates
100%
0%

Find Your Next Favorite Cybersecurity Tool at the Black Hat USA Arsenal

Learn new enterprise-grade techniques for identifying vulnerabilities, improving Active Directory security, and building trust with customers at Black Hat USA this summer.

On the hunt for new cybersecurity tools? Check out the Arsenal at Black Hat USA in Las Vegas this August, where all Black Hat passholders are invited to see live demonstrations of the latest open-source security tools.

For example, you could swing by the Arsenal (located in the Business Hall) and catch a demonstration of Smalien, a security tool for information flow analysis and information leakage detection on Android devices.

Once you give an application to Smalien, it understands the application thoroughly by executing static information flow analysis of Dalvik bytecode files extracted from the application. Smalien performs not only static analysis but also dynamic analysis, implicit information flow detection, and privacy policy enforcement at runtime by parasitizing the application.

You may also want to see a demo of Objection: Runtime Mobile Exploration, a runtime mobile exploration toolkit built with the aim of helping assess mobile applications and their security posture without the need for a jailbroken or rooted mobile device.

Objection allows for many common pentesting tasks to be performed such as disabling SSL inspection, interacting with the applicable platforms keystore/keychain as well as the ability to upload/download files from a device. Additionally, more advanced usages such as code path tracing and live Java object inspection is also possible.

Black Hat USA will also host a smorgasbord of complementary Briefings featuring expert speakers sharing tools and techniques that can help you put these tools to good use. Securing the System: A Deep Dive into Reversing Android Pre-Installed Apps is a good example. This 50-minute Briefing from Google will detail the differences in reversing and analyzing pre-installed Android applications compared to the user-space applications on which most security research focuses.

This will include detecting signals that the pre-installed app may be colluding with other components and be only one piece of the puzzle, and how bad behaviors can change when they are run in the more privileged context of a pre-installed application. You’ll also dive into case-studies of Android pre-installed security issues Google discovered in 2018 and 2019: malware, security misconfigurations, and remote code execution backdoors!

In New Vulnerabilities in 5G Networks you’ll get an in-depth look at the security features of 5G radio networks and new vulnerabilities affecting both the operator infrastructure and end-devices (including mobiles, NB-IoTand laptops). Plus, you’ll see how these new vulnerabilities in the 5G/4G security standards can be exploited using low-cost hardware and software platforms.

For more information about these Briefings and many more check out the Black Hat USA Briefings page, which is regularly updated with new content as we get closer to the event!

Black Hat USA returns to the Mandalay Bay in Las Vegas August 3-8, 2019. For more information on what’s happening at the event and how to register, check out the Black Hat website.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Enterprise Cybersecurity Plans in a Post-Pandemic World
Download the Enterprise Cybersecurity Plans in a Post-Pandemic World report to understand how security leaders are maintaining pace with pandemic-related challenges, and where there is room for improvement.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-38300
PUBLISHED: 2021-09-20
arch/mips/net/bpf_jit.c in the Linux kernel through 5.14.6 can generate undesirable machine code when transforming unprivileged cBPF programs, allowing execution of arbitrary code within the kernel context. This occurs because conditional branches can exceed the 128 KB limit of the MIPS architecture...
CVE-2021-40690
PUBLISHED: 2021-09-19
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract...
CVE-2021-41073
PUBLISHED: 2021-09-19
loop_rw_iter in fs/io_uring.c in the Linux kernel through 5.14.6 allows local users to gain privileges by using IORING_OP_PROVIDE_BUFFERS to trigger a free of a kernel buffer, as demonstrated by using /proc/<pid>/maps for exploitation.
CVE-2021-23441
PUBLISHED: 2021-09-19
All versions of package com.jsoniter:jsoniter are vulnerable to Deserialization of Untrusted Data via malicious JSON strings. This may lead to a Denial of Service, and in certain cases, code execution.
CVE-2021-41393
PUBLISHED: 2021-09-18
Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows forgery of SSH host certificates in some situations.