Black Hat Asia 2026 | Advanced Glitching Leveraging Hidden CPU–eMMC Behavior

Secure Boot is a core security mechanism in embedded and automotive-grade SoCs, ensuring the integrity of the boot chain by verifying firmware signatures. However, in practical attacks, although fault injection techniques (such as EMFI and voltage glitching) are highly destructive, their success rate is fundamentally limited by the inability to precisely locate the moment when signature verification is performed. As a result, attackers are forced to blindly inject faults over hundreds of milliseconds of the boot process, leading to high noise, low success rates, and a significant risk of irreversible CPU damage. This presentation proposes a new high-precision fault attack localization method. In environments where the CPU provides no serial output, we jointly analyze the micro-level electromagnetic emission characteristics of the CPU core and the low-level timing behavior of the eMMC and DDR buses. By constructing a cross-domain hardware signal correlation model, we accurately calibrate the actual time point at which Secure Boot executes its verification logic. Through multi-level sampling and signal correlation, we compress the fault attack window from the second scale down to the millisecond or even nanosecond scale, transforming traditional "blind glitching" into a repeatable and precisely targeted attack. We demonstrate the complete process of successfully bypassing Secure Boot on real embedded devices using this method and reveal the physical leakage paths that exist between the CPU and peripheral storage during runtime. This research has significant implications for hardware security evaluation and fault injection attack studies. Jie Fu | Head of SkyHunter, China Telecom Cyber Security Technology Co., Ltd. Qiang Qin | Security Researcher, China Telecom Cyber Security Technology Co., Ltd. Shaohua Zhang | Security Researcher, China Telecom Cyber Security Technology Co., Ltd. Chunmei Zhang | Researcher, China Telecom Yang Chen | Senior Binary Researcher, China Telecom Cyber Security Technology Co., Ltd. YuJie Lu | Security Researcher, China Telecom Cyber Security Technology Co., Ltd. WeiChao Zhou | Director of Waterdrop Laboratory, China Telecom Cyber Security Technology Co., Ltd. https://ift.tt/j8vuWfr

source https://www.youtube.com/watch?v=VBF5ID-3Ve4

Black Hat Asia 2026 | Lost in Normalization: From URL Quirks to Poisoning the Azure Supply Chain

We transformed a single, isolated container in Azure Container Instances (ACI) for GPU into a full tenant-isolation breach and a critical supply chain attack. This talk details the multi-stage exploit chain that broke a seemingly secure, multi-layered design. It all started with a misconfiguration that exposed a container image for a highly sensitive internal Kubernetes component, effectively handing us its source code. We will demonstrate how we chained two novel vulnerabilities, discovered in this internal code, with advanced Kubernetes techniques to achieve critical service compromise. First, we achieved full cross-tenant credential theft, allowing us to steal secrets from other tenants' private container registries. More critically, we escalated this access to gain write permissions to a shared, production container registry used by ACI itself. This would have potentially allowed an attacker to poison trusted, official ACI images, creating a platform-wide supply chain attack. Shortly after, following the disclosure of these critical vulnerabilities, the service was retired. This Briefing serves as a case study in how a single flaw can undermine a robust security design. Attendees will get a rare look into the internal security architecture of a major cloud service and learn to identify and defend against similar platform-wide vulnerabilities. Nir Ohfeld | Head of Vulnerability Research, Wiz Ronen Shustin | Security Researcher, Wiz https://ift.tt/cUuI8hz

source https://www.youtube.com/watch?v=CdOw22fA6Xo

Black Hat Asia 2026 | the Source, Of the Source

Sure, you can double‑check package names, stick to trusted maintainers, and install only from reputable sources. But even if you play everything perfectly, what happens when the infrastructure itself is what gets pwned? This research goes past the packages themselves and straight into the machinery underneath: exploiting the registry services, CDNs and proxie that every build quietly depends on. Once we treated those systems as the real attack surface, things got interesting fast. This talk walks through how we uncovered critical vulnerabilities across package distribution infrastructure of JavaScript, Julia, Go, .NET, Lua, and more — bugs that enabled account takeover, package hijacks, server-side RCE, and other ecosystem‑level compromises quietly embedded in the infrastructure. Even when developers do everything right, the systems delivering their code can still be the weak link. The problem isn't always just your dependencies; it's sometimes the systems that ship them. This is our journey into breaking (and ultimately helping secure) the foundations of modern software distribution. Tsi-Lin Ng | Security Researcher, DEVCORE https://ift.tt/Z5EBAl2

source https://www.youtube.com/watch?v=TPpHyYv6SqU

Black Hat Asia 2026 | Cyber-Paleontology in the Age of AI

A sophisticated cyber-espionage toolkit can disappear for decades-and still outperform modern implants. In this Briefing, we will present the discovery and reconstruction of an undocumented nation-state framework believed to have gone extinct more than 20 years ago. Although buried in time, this "fossil" malware reveals engineering decisions that remain surprisingly competitive today, and it appears to have quietly influenced reconnaissance platforms that emerged long after it. But the story isn't only about the tool. Because this framework was never publicly documented, it creates a rare testbed for something security teams are increasingly relying on: AI-driven malware analysis and attribution. We use the case to measure how modern AI systems behave when they cannot rely on training data, prior writeups, or recognizable patterns-and compare their conclusions to careful, expert-led reverse engineering. The result is both a recovered chapter of cyber-espionage history and a grounded look at where AI helps, where it misleads, and what its failure modes look like in cyber-paleontology. Vitaly Kamluk | Founder, TitanHex+SentinelLABS https://ift.tt/ZzTCFgW

source https://www.youtube.com/watch?v=2F0mFtGqsl0

Black Hat Asia 2026 | Discovering React2Shell: JavaScript’s Long-Awaited Deserialization Flight-mare

Millions of exposed sites. Over a billion attack attempts in a week. When you hear "Insecure Deserialization", you usually think of legacy Java apps, PHP behemoths, or crusty .NET projects – not the most popular modern JavaScript framework. React2Shell (CVE-2025-55182) challenged this, proving that "this code is widely used and battle-tested, so I'm sure it's secure" doesn't mean we can't teach this new dog some old deserialization tricks. This Briefing will cover the novel attack surface of deserializing complex JavaScript objects and building sophisticated exploits that abuse quirks of the language, V8 engine, and Node.js runtime. As well as detailing how I discovered React2Shell, I'll also share the impact of AI hallucinations, the double-edged sword of day-zero defenses, and lessons learned across the industry. Lachlan Davidson | Security Innovation Lead, Carapace https://ift.tt/ZUhyfKX

source https://www.youtube.com/watch?v=JtYAuqS4fsg

Black Hat Asia 2026 | Post-Quantum Cryptography: A Realistic Guide to Manage the Transition

The quantum computing risk has become a boardroom issue, driven by the emergence of standards, government-issued guidelines, and companies attempting to build quantum computers. Despite lackluster progress, the risk must not be ignored, hence organizations must assess their exposure and ensure appropriate defenses, which mostly consist of post-quantum cryptography. This presentation offers a technical and strategic roadmap for PQC integration: We'll first characterize the risk, mostly via its impact for various systems such as VPNs, encryption-at-rest, and distributed ledgers. We'll discuss the various "harvest now, decrypt later" scenarios and why quantum computers won't steal your Bitcoin (but might affect blockchain systems in surprising ways.) Although the expected timeline is an elusive topic, I'll share my perspective. We'll then describe the technical options, reviewing the standards and recommendations in various regions—in the U.S. (NIST), as well as China (GM/T), Japan (CRYPTREC), and Korea (KISA). Drawing from my work as co-author of FIPS 205 (SLH-DSA), I'll describe the different algorithm types and their respective properties in terms of security assurance and performance, also discussing hybrid deployment modes. Finally, we'll share our experience in managing the risk as a CSO: creating an internal migration plan, performing risk assessments, adapting cryptographic software, and addressing clients' and regulators' concerns. Jean-Philippe Aumasson | Cofounder and CSO, Taurus https://ift.tt/CoKMhUy

source https://www.youtube.com/watch?v=_M0of-6aLpk

Black Hat Asia 2026 | Network Operations Center (NOC) Report

Back with another year of soul-crushing statistics, the Black Hat NOC team will be sharing all of the data that keeps us equally puzzled, and entertained, year after year. We'll let you know all the tools and techniques we're using to set up, stabilize, and secure the network, and what changes we've made over the past year to try and keep doing things better. Of course, we'll be sharing some of the more humorous network activity and what it helps us learn about the way security professionals conduct themselves on an open WiFi network. Bart Stump | Managing Principal, Coalfire Neil R. (a.k.a. Grifter) Wyler | Vice President of Defensive Services, Coalfire https://ift.tt/NrkTzZp

source https://www.youtube.com/watch?v=05w_6iUGFvE

Black Hat Asia 2026 | Hidden Telemetry: Uncovering TraceLogging ETW Providers You're Not Using (Yet)

Event Tracing for Windows (ETW) is a built-in Windows logging and tracing framework that collects system and application events, providing detailed visibility into what's happening on a machine. In security, ETW is widely leveraged as one of the key telemetry sources for modern Endpoint Detection and Response (EDR) products because of the wealth of data it provides. This trace data is generated by components known as providers. While four types exist—Managed Object Format (MOF), Windows software trace preprocessor (WPP), Manifest-based, and TraceLogging—Microsoft generally recommends using the two modern variants: Manifest-based and TraceLogging providers [1]. However, a significant knowledge gap exists. While Manifest-based providers are relatively well-understood [2], information regarding TraceLogging providers remains scarce. Consequently, it is questionable whether the security community is truly maximizing ETW's full potential. To bridge this gap and enable defenders to better leverage ETW, we will present our findings on TraceLogging providers in the latest Windows. We will cover how to work with them, highlight providers potentially useful for security (e.g., AttackSurfaceMonitor), and walk through practical use cases. Asuka Nakajima | Senior Security Research Engineer, Elastic https://ift.tt/PNbRd1M

source https://www.youtube.com/watch?v=ubFcs1M62P4

Black Hat Asia 2026 | Beyond the Golden Image: A Self-Healing Image Supply Chain

Cloud images are frequently stale on arrival. Traditional hardening depends on manual patch cycles and periodic rebuilds—an approach that breaks down in large enterprises running thousands of rapidly changing workloads. Reactive remediation creates persistent security debt, long exposure windows, and an image supply chain that cannot keep pace with modern Agile delivery. This Briefing presents a security-first framework for a self-healing image supply chain that continuously delivers deterministic, verifiable, and zero-CVE operating system images at enterprise scale. The approach replaces legacy package-manager–driven workflows with hermetic, declarative builds that remove non-determinism and guarantee 100% reproducibility. Every image is cryptographically signed, attested with SLSA-aligned provenance, and verified prior to promotion, preventing compromised or untrusted components from reaching production. Our platform implements this framework, with layered hardening and minimal-footprint custom builds that eliminate unnecessary utilities, reducing attack surface while preserving developer flexibility. Strict policy gates ensure that only images meeting integrity, compliance, and vulnerability criteria are deployable. To sustain security posture at scale, the system continuously tracks vulnerability intelligence feeds and upstream base-layer updates. When a patch or new CVE is released, images are automatically regenerated, validated, and published—guaranteeing updated images in less than 24 hours without manual intervention. In production use, the framework is actively consumed by 500+ SREs impacting 1000s of developers across 70+ engineering teams, has reduced organization-wide CVE backlog by approximately 40%, and scales to support thousands of workloads. Today it supports hardened Linux and Windows OS images across AWS and Azure, with a design extensible to data-center images and container pipelines. We will share the architecture framework, threat model and implementation techniques as a vendor-neutral blueprint so security and platform teams can transform image security from a reactive process into an autonomous, continuously verified supply chain. Neelu Tripathy | Senior Security Architect, Adobe Inc. Lovlesh Malik | Engineering Manager, Adobe Systems India Pvt. Ltd https://ift.tt/7OeFs2o

source https://www.youtube.com/watch?v=ueG0ynK0I7A

Black Hat Asia 2026 | Inside Cybercrime Inc: Lessons From Covering the Global Fraud Boom

Drawing on three years of on the ground reporting across South East Asia, this talk examines the rise of an industrial scale cybercrime economy, an ecosystem now generating an estimated $500bn a year, rivaling the global drug trade. I'll unpack how these syndicates operate as fully fledged multinational enterprises, and explore the human, political and economic forces that allow them to thrive. By tracing how online fraud has evolved, industrialised and globalised, I'll outline what this transformation reveals about the future of organised crime and why defenders, policymakers and investigators need to rethink the threat landscape ahead. Sue-Lin Wong | Asia Correspondent, The Economist https://ift.tt/xcOnhQI

source https://www.youtube.com/watch?v=ChQ-wvvgGNU

Black Hat Vault | Cyber Granny

Meet Cyber Granny! 🔐 Hear her thoughts on the Black Hat community, advice for newcomers, and the importance of staying cyber aware.

source https://www.youtube.com/shorts/vgyZ7AaAZCM