Black Hat Asia 2026 | Revealing User Activity on macOS for Apple Silicon

Apple's M-series now powers a huge portion of executive, enterprise, and developer laptops. One blind spot has stayed largely off the radar: interrupt-based side channels where signals raised by normal device activities such as networking, input, and display can be sensed by an unprivileged attacker. We show that a determined attacker can turn those signals into high-fidelity surveillance of user activities on macOS for Apple Silicon. In this talk, we will present TIDE, which works like a stethoscope for the OS: every time macOS returns from the kernel to user space, it produces a tiny, deterministic "heartbeat we can feel from user space". By listening for that heartbeat, TIDE pinpoints exactly when an interrupt occurs without any timers. With TIDE as our sensor, we reverse-engineer Apple's publicly undocumented interrupt delivery and reveal that shared peripheral interrupts are uniformly distributed across all active cores. This quirk means an unprivileged attacker no longer has to "chase the right core" to spy on user activities within the same OS. To demonstrate the effectiveness of TIDE, we will present two live, end-to-end attacks on real Apple Silicon hardware. One is website fingerprinting on Safari with about 94% Top-1 accuracy in closed-world and about 91% in open-world to reveal the websites users have visited. The other is Video fingerprinting with roughly 80% to identifying streaming content from its interrupt patterns. We conclude with potential software-only mitigations Apple can deploy, plus longer-term OS/SoC directions. We call for more parties to join in this effort to enhance the security of macOS. Xin Zhang | Ph.D. Student, Peking University Zhi Zhang | Senior Lecturer, The University of Western Australia Chang Liu | Ph.D. Student, Tsinghua University Qingni Shen | Full Professor, Peking University Trevor E. Carlson | Associate Professor, National University of Singapore https://ift.tt/tNBT93X

source https://www.youtube.com/watch?v=PuQIMyz0BeQ

Black Hat Asia 2026 | Model Files → Memory Corruption → RCE: The Triple-Stage AI Attack Chain

Amidst the rapid advancement of artificial intelligence technologies, an increasing number of enterprises and individuals are adopting AI solutions. As the core vessel of AI systems, model files encapsulate substantial training outcomes and intellectual achievements from researchers. With the proliferation of large language models and the maturation of open-source communities, leading organizations are actively promoting model open-sourcing and sharing, making cutting-edge models accessible to developers worldwide. However, in practical applications, the model loading process has emerged as a critical security vulnerability hotspot. Existing research reveals significant security risks in the model loading mechanisms of mainstream deep learning frameworks. For instance, PyTorch's historical use of pickle for model serialization introduces inherent deserialization vulnerabilities, while TensorFlow is susceptible to remote code execution (RCE) through maliciously crafted Lambda Layers. More alarmingly, as these frameworks predominantly employ C/C++ implementations for high-performance computing, they remain exposed to conventional memory safety threats such as buffer overflows. This raises a crucial question: Can these memory vulnerabilities be weaponized into complete and reliable RCE attack chains? In this Briefing, to the best of our knowledge, we will present the first publicly disclosed study that systematically exploits memory corruption vulnerabilities in AI model files to achieve reliable remote code execution. By analyzing the memory management mechanisms of mainstream deep learning frameworks, we construct a complete, end-to-end three-stage attack chain — from malicious model files to arbitrary code execution — through carefully designed heap layouts and control-flow hijacking techniques. We further validate the practical exploitability of this attack chain across real-world AI inference systems. Ji'an Zhou | Security Researcher Lei Lu | Security Researcher Li'shuo Song | Security Researcher https://ift.tt/o07khlr

source https://www.youtube.com/watch?v=nQml4Ng9iVc

Black Hat Asia 2026 | Payload Compromised: Full Key Recovery in Rocket.Chat E2EE

Rocket.Chat is used in more than 150 countries, where many organizations rely on its end-to-end encryption (E2EE) for security-critical communication. This talk presents the first comprehensive analysis of Rocket.Chat's E2EE as deployed in real systems. By combining automated symbolic analysis with in-depth manual inspection of the implementation, we identify practical attacks that break both confidentiality and integrity. Our most severe finding is a practical key-recovery attack. An attacker with access to encrypted user backups can recover private keys and all derived group keys in twelve days under realistic assumptions. We validate this attack with practical proof-of-concept exploits. This results from weak offline-attack resistance combined with a biased, low-entropy password generator used to encrypt key backups. At the time of reporting, any server operating under a malicious-server threat model could execute the attack. We also uncover structural failures in the platform's key-rotation workflow. Although E2EE passwords and a master key were rotated, the group keys protecting message content were never replaced. Clients continued to accept and redistribute compromised group keys, which were then reused to encrypt new messages and decrypt past ones. A single key recovery therefore enabled expanding and persistent compromise across group communication. Manual analysis further revealed integrity failures, including ciphertext forgery made possible by unauthenticated AES-CBC encryption. Beyond the technical flaws, we also reconstruct how this fragile design emerged by examining public development discussions and historical commits. This OSINT analysis explains why several fundamental E2EE principles were never integrated and how long-term structural risks accumulated. The most severe vulnerabilities, including key recovery and broken key rotation, were fixed within six months of disclosure, and remaining integrity issues were patched after extended coordination. Attendees will learn how to analyze real-world E2EE systems, detect specification-implementation gaps, and replace password-based architectures with modern best practices. Hayato Kimura | Researcher, National Institute of Information and Communications Technology & The University of Osaka Ryoma Ito | Senior Researcher, National Institute of Information and Communications Technology Kazuhiko Minematsu | Research Fellow, NEC Corporation Takanori Isobe | Professor, The University of Osaka https://ift.tt/5f7G03M

source https://www.youtube.com/watch?v=35kun8wzFRU

Black Hat Asia 2026 | Exploiting BLE Re-Pairing with the BLERP Attacks

Bluetooth Low Energy (BLE) security relies on a Long-Term Key (LTK) that serves as a root of trust. Users implicitly trust their paired devices, such as laptops, mice, and keyboards, assuming that once paired, they are secure. We show that this trust is fragile. In this talk, we introduce the BLE Re-Pairing Attacks (BLERP), a new class of protocol-level attacks that weaponize the standard re-pairing mechanism to overwrite trusted LTKs with attacker-controlled keys, compromising the BLE security model. We reveal six critical design flaws affecting re-pairing in the latest Bluetooth standard (v6.1), and we show how these flaws enable device impersonation and Man-in-the-Middle (MitM) attacks, even against the most secure BLE configurations. The BLERP attacks are stealthy and practical: they are "0-click" on headless devices, such as keyboards, and require a single unauthenticated interaction on smartphones. We describe the BLERP Toolkit, an open-source framework built on low-cost nRF52 hardware that enables over-the-air testing of BLE pairing and allows attendees to audit their own devices. The talk includes a live demonstration of a re-pairing Peripheral Impersonation attack against a smartphone and concludes with immediate, actionable mitigations to protect against the BLERP attacks. Attendees will learn about BLE security, how BLERP attacks undermine it, and how to defend against these newly identified threats. Tommaso Sacchetti | PhD Candidate, EURECOM Daniele Antonioli | Assistant Professor, EURECOM https://ift.tt/2lL4dVj

source https://www.youtube.com/watch?v=_08bb55Q33o

Black Hat Asia 2026 | Bad Vibes - Pwning Coding Agents 70 Times With The Same Bugs

It seems like everyone with access to a keyboard is vibe-coding these days, with an increasingly significant amount of code being written through the use of AI Coding Agents. These tools, whether specialized IDEs, IDE extensions, or CLI utilities, come with varying features, interfaces and architectures. However, they all suffer from the same fundamental, severe vulnerabilities and flawed design choices, which we will expose. Our research has uncovered 70+ serious vulnerabilities across a broad array of major platforms, including GitHub Copilot, Google Gemini CLI and Antigravity, OpenAI Codex, Claude Code, Amazon Q and Kiro, Cursor, and more. These vulnerabilities demonstrate that the industry is collectively making similar, fundamental mistakes in securing these agentic applications, which means that not only coding agents may suffer from similar problems. In this session, we will first map out what an attacker needs to achieve in order to truly compromise an AI agent. We will present a variety of issues which lead to severe consequences, making coding agents perform actions significantly more devious than just writing terrible code. Come vibe with us as we demonstrate these attacks across multiple products, showing how to turn a successful prompt injection into a devastating machine compromise using various command-line tricks, creative path manipulation techniques, and turning sandbox features against themselves to bypass established defenses. By detailing the common, critical mistakes shared across these vendors, we aim to provide developers and architects with actionable takeaways to avoid these deep-seated vulnerabilities and better secure the future of AI development tools. Philip Tsukerman | Vulnerability Research Team Lead, Cyberark Nil Ashkenazi | Cyber Security Researcher, Cyberark Alon Zahavi | Senior Security Researcher, Cyberark https://ift.tt/wUQOSoD

source https://www.youtube.com/watch?v=7UCpHzFYF40

Black Hat Asia 2026 | Large-Scale macOS PID-Domain Vulnerability Discovery with LLM Reasoning

For years, macOS researchers have focused on high-privilege system and user domain services—yet a vast class of background daemons has quietly operated beneath the radar: PID-domain services. These processes, often reachable even from sandboxed apps, expose privileged functionality and sensitive system controls. Despite their enormous attack surface, they've remained largely unexplored and unprotected—until now. In this Briefing, we will unveil the first large-scale automated framework for discovering logic vulnerabilities in PID-domain services, powered by LLM-assisted static analysis. We will start by dissecting historical flaws and Apple's patching patterns to formalize a repeatable attack model. Building on that foundation, our framework automatically enumerates connectable PID-domain daemons, decompiles their exported APIs, and leverages LLM semantic reasoning to classify sensitive operations across five categories—from file and privacy access to interprocess privilege crossing. We then map entitlements to these operations and apply taint analysis to trace attacker-controlled data into privileged sinks—surfacing hidden logic flaws that manual auditing would almost certainly miss. Our evaluation uncovered 12 previously unknown vulnerabilities, including multiple sandbox escapes and TCC privacy bypasses—six of which have already been assigned CVEs by Apple. This research exposes a massive, underestimated attack surface within macOS's userspace and demonstrates how LLMs can be weaponized for scalable vulnerability discovery in closed-source ecosystems. Attendees will gain new insights into Apple's userspace attack surface, automated bug-hunting methodologies, and the next frontier of human–AI collaboration in exploit development. l_m_h l_m_h | Independent Security Researcher Yinyi Wu | Security Researcher, Dawn Security Lab, JD.com Yingqi Shi | Security Researcher, DBAPPSecurity Yuchong Xie | Security Researcher, The Hong Kong University of Science and Technology Cheng Li | Security Researcher Yizhuo Wang | Security Researcher https://ift.tt/vSPIcka

source https://www.youtube.com/watch?v=uFgB_aMw5-g

Black Hat Asia 2026 | LLM-Empowered Differential Testing for the Ethereum Infrastructure

Securing over $380 billion in digital assets, the Ethereum ecosystem relies entirely on clients to bridge users and the blockchain network. However, this infrastructure remains perilously fragile: the infamous CVE-2020-26241, a single memory corruption bug in the dominant Geth client, triggered an unintended Ethereum mainnet chain fork, causing a catastrophic 7-hour outage for major infrastructures like Infura and MetaMask. While the community now champions "client diversity" to mitigate such single points of failure, this heterogeneity introduces a new, insidious threat: subtle implementation inconsistencies across different languages and architectures that traditional testing methods fail to detect. To fortify this multi-billion dollar foundation, we propose a novel, specification-driven differential testing framework that synergizes classical software engineering with modern AI. Unlike traditional fuzzers, our approach leverages Large Language Models (LLMs) to bridge the gap between abstract specifications and complex reality. We utilize LLMs not only to generate diverse, semantically valid test inputs (covering both EVM opcodes and Client APIs) but also to act as intelligent filters that distinguish genuine bugs from harmless semantic variations. This "dual-engine" approach allows us to identify deep logic flaws with high precision while minimizing false positives. Our comprehensive evaluation across 11 distinct clients uncovered 98 previously unknown bugs, even including critical errors within the official Ethereum specifications themselves. The impact of our work is immediate and far-reaching: developers confirmed our findings with a greater than 90% acceptance rate, 4 vulnerabilities were assigned CNVD IDs, and our methodology has received official endorsement from the Ethereum Foundation, with specific findings escalated to core protocol management meetings. We provide not just a bug-finding approach, but a crucial safeguard for the stability of the decentralized economy. Jie Ma | Eng.D Candidate, Beihang University; Zhongguancun Laboratory Ningyu He | Research Assistant Professor, The Hong Kong Polytechnic University; Amber Group Chiachih Wu | Partner & Head of Web3 Security, Amber Group Haoyu Wang | Professor, Huazhong University of Science and Technology Ying Gao | Associate Professor, Beihang University; Zhongguancun Laboratory Yinliang Yue | Professor, Zhongguancun Laboratory https://ift.tt/0v4BPuI

source https://www.youtube.com/watch?v=btaJkpmFs4s

Black Hat Asia 2026 | Overkill: Hijacking a Wi-Fi 7 Chip for SYSTEM Privileges

"A RISC-V CPU in your modern Windows PC? It is more likely than you think!" Research on Windows privilege escalation often concentrates on uncovering vulnerabilities within the kernel itself. However, this is only one part of the broader security picture. Leveraging firmware on Windows for exploits, unlike on Android, remains largely overlooked. It deserves far more attention. In this Briefing, we will take a deep dive into the driver and firmware powering MediaTek's latest client Wi-Fi 7 chip, the Filogic 360 codenamed MT7925. We will present our point of entry and describe how we leveraged both Linux and Windows drivers to get more insights into the kernel-firmware communication. Then, we will explain and showcase how we got code execution on the MT7925 device and how it enabled us to analyze the entire firmware. At the end, we will demonstrate a complete exploit chain, starting with a leak, then the takeover of the communication processor of the MT7925 from userspace, followed by the exploitation of a bug in the firmware-kernel interface to escalate privileges on the latest Windows 11 25H2 release. Nicola Stauffer | Graduate Student, Zürich University of Applied Sciences ZHAW Gürkan Gür | Senior Lecturer, Zürich University of Applied Sciences ZHAW https://ift.tt/W3MCoyY

source https://www.youtube.com/watch?v=Hr5Wla1__0k

Black Hat Asia 2026 | Mass Scale Hijacking of Shared Mobility and EV-Charging Fleets

Rentable IoT infrastructures—such as e-scooters, EV chargers, shared bicycles, laundry machines, and public tools—are now deployed at city scale and controlled through cellular IoT backends. However, our research reveals that these systems systematically rely on weak resource identifiers, inconsistent authentication models, and insecure backend APIs, enabling attackers to remotely manipulate thousands of devices without physical access. In this talk, we will present the first large-scale, cross-vendor security study of the rentable IoT ecosystem, covering 17 hardware devices and 92 mobile/mini-program apps. By reverse-engineering firmware, extracting cellular traffic from insecure modem debug channels, re-implementing binary protocols as "phantom clients," and performing black-box API testing, we uncovered 57 previously unknown vulnerabilities across 28 products. These issues enable attackers to: • Force all rentable devices offline (city-wide DoS) • Remotely lock, unlock, or disable mobility devices • Obtain free charging, free rides, or unrestricted device usage • Hijack user accounts and leak sensitive personal data • Spoof device states to mislead operators and trigger operational failures To scale these attacks, we introduce IDScope, an automated enumeration engine capable of inferring all valid device serial numbers or user IDs within minutes, bypassing rate limits and enabling exploitation of every device in a vendor's fleet. We will demonstrate end-to-end attacks on real devices—turning thousands of EV chargers into free power stations, remotely stopping active e-bikes, unlocking shared devices, and impersonating entire device fleets. The talk will conclude with practical mitigations for both vendors and cities seeking to protect smart-mobility infrastructure. Hetian Shi | Hardware and IoT Security Researcher, Tsinghua Univeristy https://ift.tt/zACt3sW

source https://www.youtube.com/watch?v=1ntsyqs5yy0

Black Hat Asia 2026 | Graph-Aware LLM for Windows Logon with a Closed-Loop Guarded Detection Agent

Because Windows Event Logs were never originally designed for detecting unauthorized logons, traces of attacks are easily buried in a massive amount of noise. It is also inherently difficult to create reliable signatures for suspicious log entries in Windows Event Logs, and research on analysis methods has been ongoing for many years. In recent years, the use of LLMs for log analysis has advanced; however, in real-world investigations, log sizes often exceed hundreds of gigabytes. In such cases, prompts quickly become too large, making it impractical to apply LLMs directly. In addition, hallucinated explanations and lack of reproducibility remain key challenges when using LLMs in security operations. In this Briefing, we will present a practical, production-ready framework that combines graph analytics with LLM agents to accurately detect suspicious logons. Concretely, we compress logs into graph information by constructing an authentication graph of users and hosts from Windows Event Logs. This makes it possible to reduce the data to a realistic size that can actually be fed to an LLM. On top of that, a closed-loop detection agent autonomously iterates the cycle of generating search queries to a database → executing the queries → evaluating the results → exploring further. Through this loop, it detects signs such as concentrations of service tickets, cross-host logons by privileged accounts, remote service access, and suspicious chains of logons. The outcome of the analysis is presented as an incident severity level, an evidence timeline, and an attack scenario summary, automatically providing information that can be directly used in real incident investigations. Our approach aggregates millions of events down to a few dozen suspicious logons within minutes, and elevates LLM usage in DFIR into a form that is auditable, reproducible, and operationally viable. We will release an open-source tool that implements this method so that analysts can apply it to real-world incident analysis. Shusei Tomonaga | CTO, JPCERT/CC https://ift.tt/B2jZ1tL

source https://www.youtube.com/watch?v=7QVcpQA_j_I

Black Hat Asia 2026 | Social Media Manipulation Wargaming for Cyberliteracy and Research

LLM-powered bots are influencing social media around the world, amplifying the effects of misinformation and disinformation. Detecting if content is being promoted or manipulated by such bots is difficult, both for casual observers of social media platforms as well as for platform operators faced with continuous "cat and mouse" development by malicious adversaries. To address both challenges, we produced "Capture the Narrative", the world's first CTF-style massively-multiplayer wargame for social media manipulation. Over four weeks in 2025, 288 students formed 70+ teams from Australian universities and competed in a multiplayer competition to manipulate an in-house social media platform we called "Legit Social". They were aiming to swing a simulated election in a fictional country, a task which they ultimately completed by moving the electorate by 1.8 percentage points. In this Briefing, I will introduce the competition, as well as discuss its outputs, which include the associated awareness campaign as well as a collaboratively developed dataset made up of survey data, developed bot software, and recorded bot activity for the thousands of bots producing millions of artificial posts to amplify in-game misinformation. Hammond Pearce | Senior Lecturer, UNSW (University of New South Wales) https://ift.tt/A7mkBlS

source https://www.youtube.com/watch?v=zihOGGeoaTU