The insider’s guide to Black Hat 2025

Cut through 100+ talks to find what matters: AI vulnerabilities, cloud attacks, and where to grab drinks...

BRB, pausing for a "Sanctuary Moon" marathon

Welcome to this week's edition of the Threat Source newsletter. Yesterday, Cisco Talos debuted the first Humans of Talos episode, where I interviewed Hazel Burton, a face and voice you're probably familiar with. In our conversation, Hazel shared not just the story of how she found her way onto th...

Researcher Demonstrates 4 New Variants of HTTP Request Smuggling Attack

A new research has identified four new variants of HTTP request smuggling attacks that work against various commercial off-the-shelf web servers and HTTP proxy servers. Amit Klein, VP of Security Research at SafeBreach who presented the findings today at the Black Hat security conference, said th...

Spies Can Listen to Your Conversations by Watching a Light Bulb in the Room

You might not believe it, but it's possible to spy on secret conversations happening in a room from a nearby remote location just by observing a light bulb hanging in there—visible from a window—and measuring the amount of light it emits. A team of cybersecurity researchers has developed and...

Three Service Account Secrets Straight from Hackers and Security Pros

Barbara Hoffman, Product Marketing Manager, Thycotic Nearly 19,000 infosec experts travel from all over the world to attend the annual Black Hat Conference. They come to share, educate and disclose their security research on the latest vulnerabilities and cyberthreats. We here at Thycotic love to...

SNDBOX: AI-Powered Online Automated Malware Analysis Platform

Looking for an automated malware analysis software? Something like a 1-click solution that doesn't require any installation or configuration…a platform that can scale up your research time… technology that can provide data-driven explanations… well, your search is over! Israeli cybersecurity and...

On Cache Poisoning

In March 2017, Akamai released a post, "On Web Cache Deception Attacks". A presentation at the Black Hat conference by James Kettle from Port Swigger on web cache poisoning has recently raised awareness of cache poisoning. This is a class of vulnerability with a long history. Cache poisoning can ...

Finding the signal of community in all the noise at Black Hat

I dont know about you, but I find large conferences overwhelming. Dont get me wrong, nothing beats the innovative potential of bringing a diverse group of brilliant people together to hash through thorny issues and share insights. But there are so many speakers, booths, and people, it can be a...

Black Hat 2018: Update Mechanisms Allow Remote Attacks on UEFI Firmware

LAS VEGAS – Researchers said they found buffer overflow flaws in the firmware for ASRock and ASUS, potentially enabling bad actors to remotely launch man-in-the-middle MITM attacks. The findings, which will be presented Wednesday at Black Hat USA this week by researchers from Eclypsium, show that...

Microsoft’s Top 100 Security Researchers – Black Hat 2018 Edition

This morning we are excited to unveil the security researcher leaderboard at the Black Hat Security Conference. This list recognizes the top security researchers who have contributed research to the Microsoft products and services. If you are curious on how we build the list, check out our blog...

Microsoft’s Top 100 Security Researchers – Black Hat 2018 Edition

This morning we are excited to unveil the security researcher leaderboard at the Black Hat Security Conference. This list recognizes the top security researchers who have contributed research to the Microsoft products and services. If you are curious on how we build the list, check out our blog...

Office of the senior threat vulnerability in the wild use analysis-vulnerability warning-the black bar safety net

Office of the senior threat vulnerability background In the advanced threat attack, the hackers remote delivery invasion client the most like the vulnerability is office documents vulnerability in the just-concluded black hat conference, the best client security vulnerabilities award went to...

Black Hat 2017: training, cybersecurity trends and end-point protection

Every year, Black Hat is a highly anticipated event in the cybersecurity community--and Black Hat 2017 certainly did not disappoint! It was yet another year of record traffic, bustling with visitors from the security community that want to strengthen their security skills and postures...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of July 24, 2017

This week, I attended the Black Hat conference in Las Vegas, Nevada. 2017 marked the 20th anniversary of the Black Hat conference. A lot has certainly changed since I started attending back in 2002. I’m sure that many will have their opinions on the central themes that they saw at the conference...

Microsoft Windows 10 Virtualization-Based Security Bypass - us

Lenovo Security Advisory: LEN-8584 Potential Impact: Microsoft Virtualization-based security bypass by an attacker with administrative privileges Severity: Medium Scope of Impact: Industry-Wide Summary Description: A vulnerability affecting the virtualization-based security in Microsoft Windows 1...

HTTP2. 0 Protocol is aeration 4 high-risk vulnerabilities can cause server to crash-bug warning-the black bar safety net

! If you think that HTTP2. 0 Protocol than the standard HTTP Hypertext Transfer Protocol more secure, then you're wrong. Researchers spent 4 months in HTTP2. 0 Protocol found 4 vulnerabilities that! Last 2 month, Google put their SPDY project bundled into HTTP2. 0, intended to strengthen the page...

General Motors GM Vulnerability Disclosure Program

General Motors’ new vulnerability disclosure program puts it alongside Tesla as the only major automakers with a mechanism for security researchers to report flaws. Unlike Tesla’s program, however, GM’s does not offer a monetary reward. GM launched its program last week via the HackerOne platform...

Novel NTP Attacks Roll Back Time

Sharon Goldberg remembers the cold February day when her Boston University PhD candidate Aanchal Malhotra was studying routing security, in particular, attacks against the resource public key infrastructure RPKI—and kept hitting a dead end because of a cache-flushing issue. The resourceful Malhot...

Android devices frequently have pits: Certifi-gate vulnerability control-screen recording-vulnerability warning-the black bar safety net

! This month's black hat conference disclosure vulnerability Certifi-gate exposed android security repeatedly go wrong. The black bar safety net Encyclopedia: what is the Certifi-gate “Certifi-gate”is a vulnerability, this vulnerability exists in the Android phone remote support...

Manipulating Microsoft WSUS to Own Enterprises

LAS VEGAS – Windows Server Update Services WSUS is your friend, if you run an enterprise IT shop, because it facilitates the download and distribution of security patches, service pack installations and hardware driver updates among others. Two researchers this week at the Black Hat conference,...