Black Hat USA 2025 | Racing for Privilege

Racing for Privilege: Leaking Privileged Memory From Any Intel System Using a Microarchitectural Race Condition Enhanced Indirect Branch Restricted Speculation (eIBRS) is Intel's primary defense against Branch Target Injection-style (BTI) Spectre attacks. eIBRS prevents misuse of untrusted branch target predictions in higher privilege domains (i.e., kernel/hypervisor mode) by restricting predictions from other privilege domains other than the one they were created for. Since its inception in late 2018, eIBRS remains the best-suited BTI defense that all major operating systems and hypervisors rely on, and it has so far successfully prevented attackers from injecting arbitrary branch target predictions across privilege boundaries. However, our research finds that microarchitectural mitigations like eIBRS, much like software, are vulnerable to race conditions. Consequently, we will demonstrate an exploitation technique that allows attackers to inject branch target predictions not only into higher privilege domains, but also across prediction barriers (i.e., IBPB) meant to invalidate all such predictions. Tracing back the bug to its origin, we find that it has been present ever since the eIBRS was first introduced, meaning systems have been vulnerable for over 7 years! We will demonstrate that this issue is easy to exploit by building an arbitrary privileged memory read primitive, evaluated (5.6 kB/s) on an up-to-date Ubuntu 24.04 system with all default mitigations enabled. This attack shows how easily hardware mitigations can fall apart when integrated into a complex CPU design, and it gives us a reminder of how much trust the computer industry faithfully puts into hardware vendors' security claims. By: Sandro Rüegge | Security Researcher, ETH Zürich Johannes Wikner | CPU Therapist, PhD, ETH Zurich Presentation Materials Available at: https://ift.tt/0UQ7idh

source https://www.youtube.com/watch?v=ULXuhxj-WgA

Black Hat USA 2025 | Hackers Dropping Mid-Heist Selfies

Hackers Dropping Mid-Heist Selfies: LLM Identifies Information Stealer Infection Vector and Extracts IoCs Information stealer malware has become one of the most prolific and damaging threats in today's cybercrime landscape, siphoning off everything from browser-stored credentials to session tokens and other system secrets. In 2024 alone, we witnessed more than 30 million stealer logs traded on underground markets. Yet buried within these logs is an underexplored goldmine: screenshots captured at the precise moment of infection. Think of it as a thief taking a selfie mid-heist, unexpected but convenient for us, right? Surprisingly, these crime scene snapshots have been largely overlooked until now. Leveraging infostealer infection screenshots and Large Language Models (LLMs), we propose a new approach to identify infection vectors, extract indicators of compromise (IoCs) and track infostealer campaigns at scale. Our approach found several hundred potential IoCs in the form of URLs leading to the download of the malware-laden payload. By applying this method to "fresh" stealer logs, we can detect and mitigate infection vectors almost instantaneously, reducing further infections. Our analysis uncovered distribution strategies, lure themes and social engineering techniques used by threat actors in successful infection campaigns. We will break down three distinct campaigns to illustrate the tactics they use to deliver malware and deceive victims: cracked versions of popular software, ads pointing to popular software and free AI image generators. This presentation, with its live demonstration, shows how LLMs can be harnessed to extract IoCs at scale while addressing the challenges and costs of implementation. Attendees will walk away with a deeper understanding of the modern infostealer ecosystem and will want to apply LLM to other illicit artifacts to extract actionable intelligence. By: Estelle Ruellan | Threat Intelligence Researcher, Flare Olivier Bilodeau | Principal Security Researcher, Flare Presentation Materials Available at: https://ift.tt/1GYAekO

source https://www.youtube.com/watch?v=WQFIfORignI

Black Hat USA 2025 | Unix Underworld: Tales from the Dark Side of z/OS

You may have heard tales of mainframe pentesting and exploitation before - mostly from us! Those stories often focused on the MVS/ISPF side of the IBM z/OS. But did you know that all those same tricks (and more!) can be pulled off in z/OS Unix System Services (OMVS) as well? I bet you didn't even know z/OS had a UNIX side! Over the years, we've discovered multiple unique attack paths when it comes to Unix on the mainframe. In this talk, we'll present live demos of real-world scenarios we've encountered during mainframe penetration tests. These examples will showcase what can happen with poor file hygiene leading to database compromises, inadequate file permissions enabling privilege escalation, a lack of ESM resource understanding allowing for privileged command execution, and how dataset protection won't save you from these attacks. We'll also be demonstrating what can happen when we overflow the buffer in an APF authorized dataset. Attendees will learn how to test these controls themselves using freely available open-source tools and how to (partially) detect these attacks. While privesc in UNIX isn't game over for your mainframe, it's pretty close. By the end, it will be clear that simply granting superuser access to Unix can be just as dangerous, if not more so, than giving access to TSO on the mainframe. By: Philip Young | Director Mainframe Penetration Testing Services, NetSPI Chad Rikansrud | Software Security Researcher, Broadcom Presentation Materials Available at: https://ift.tt/DOXYWFE

source https://www.youtube.com/watch?v=3wQHhGxVTuo

Black Hat USA 2025 | Booting into Breaches: Hunting Windows SecureBoot's Remote Attack Surfaces

SecureBoot, designed to protect against firmware-level tampering, has long been dismissed as a "local-only" attack surface. This research shatters that assumption, exposing systemic flaws that enable remote exploitation of SecureBoot—culminating in Pre-Auth RCE on fully patched systems. With 31 CVEs discovered and fixed in Microsoft's SecureBoot implementation, we reveal how attackers can weaponize bootloader components (network stacks, BCD registries, filesystems) to bypass critical security guarantees. We dissect novel attack surfaces in Windows' UEFI environment, including an overlooked network protocol parser and a single 100-line BCD registry function harboring 6 vulnerabilities. Our custom debugging and fuzzing frameworks can assist vulnerability hunting in the UEFI environment efficiently. Beyond the bootloader, we demonstrate how kernel and userland components inherit these weaknesses, including a RCE demo on a SecureBoot-enforced Hyper-V host. By chaining logical flaws in SecureBoot's trust model, we illustrate how attackers can pivot from firmware to OS-level control without physical access. We conclude with actionable mitigations and a critical call to re-evaluate firmware security paradigms in an era where remote exploitation nullifies the "local access" defense. By: Jietao Yang | Security Researcher, Cyber Kunlun Lab Presentation Materials Available at: https://ift.tt/z6oEmWw

source https://www.youtube.com/watch?v=p4EXzE0dvWE

Black Hat USA 2025 | I'm in Your Logs Now, Deceiving Your Analysts and Blinding Your EDR

What if you could leverage Event Tracing for Windows (ETW) to manipulate telemetry data, challenging the trust placed in endpoint detection and response (EDR) tools? ETW is a critical component to the operating system for Event Log generation as well as EDR telemetry collection. By injecting custom events into the ETW stream, I've found a safe way for blue teams to replicate attack telemetry without executing these risky processes on production systems. Additionally, red teams can exploit this same technique to mislead incident analysts or, worse, trigger capping mechanisms in EDRs, effectively rendering them partially blind to malicious activities. Current Windows protection mechanisms mostly allow these techniques to be executed from any un-elevated process, in user mode. I will demonstrate the injection of telemetry events and the exploitation of event capping—illustrating how an overflow in event generation can cause the Defender for Endpoint to disregard subsequent logs, including those from genuine threats. I will showcase how automated risk assessment can lead to the revocation of tenant access for that device. By: Olaf Hartong | Security Researcher, FalconForce Presentation Materials Available at: https://ift.tt/uRoVyUj

source https://www.youtube.com/watch?v=G3Ft0gtmm4I

Black Hat USA 2025 | Analyzing Smart Farming Automation Systems for Fun and Profit

The digital transformation of agriculture has led to a change in technology. This includes modernized farming equipment with smart capabilities and the development and widespread adoption of retrofit automation systems for legacy farming equipment to extend the lifespan and use existing legacy resources, similar to security efforts for legacy systems in OT. This research presents a security analysis of the FJ Dynamics Steering Kit, a leading aftermarket solution for autonomous tractor capabilities, which is sold under different labels in Asia, Europe and the United States. Our investigation revealed critical vulnerabilities enabling unauthorized global tracking of tractors, system manipulation, and potential safety compromises, highlighting significant risks to agricultural operations and public safety. By: Tracking the Tractors: Analyzing Smart Farming Automation Systems for Fun and Profit Presentation Materials Available at: https://ift.tt/Km1QEL5

source https://www.youtube.com/watch?v=OxnY_25suS8

Black Hat USA 2025 | BitUnlocker: Leveraging Windows Recovery to Extract BitLocker Secrets

In Windows, the cornerstone of data protection is BitLocker, a Full Volume Encryption technology designed to secure sensitive data on disk. This ensures that even if an adversary gains physical access to the device, the data remains secure and inaccessible. One of the most critical aspects of any data protection feature is its ability to support recovery operations in case of failure. To enable BitLocker recovery, significant design changes were implemented in the Windows Recovery Environment (WinRE). This led us to a pivotal question: did these changes introduce any new attack surfaces impacting BitLocker? In this talk, we will share our journey of researching a fascinating and mysterious component: WinRE. Our exploration begins with an overview of the WinRE architecture, followed by a retrospective analysis of the attack surfaces exposed with the introduction of BitLocker. We will then discuss our methodology for effectively researching and exploiting these exposed attack surfaces. Our presentation will reveal how we identified multiple 0-day vulnerabilities and developed fully functional exploits, enabling us to bypass BitLocker and extract all protected data in several different ways. Notably, the findings described reside entirely in the software stack, not requiring intrusive hardware attacks to be exploited. After identifying these vulnerabilities as attackers, we then took on the role of defenders. We will share the insights Microsoft gained from this research and explain our approach to hardening and further securing WinRE, which in turn strengthens BitLocker. By: Alon Leviev | Security Researcher, Microsoft Netanel Ben Simon | Senior Security Researcher, Microsoft Yair Netzer | Principal Security Research Manager, Microsoft Amit Dori | Senior Security Research Manager, MORSE Team, Microsoft Full Presentation Materials Available at: https://ift.tt/5qkCOdG

source https://www.youtube.com/watch?v=2CJl6mTtgws

Black Hat USA 2025 | ECS-cape – Hijacking IAM Privileges in Amazon ECS

Amazon Elastic Container Service (ECS) is a popular container orchestration service that relies on IAM roles for fine-grained access control. Our research uncovered a critical privilege escalation vulnerability that allows a low-privileged task running on an ECS instance to hijack the IAM privileges of higher-privileged containers on the same EC2 machine. This talk will unveil the details of this previously undisclosed vulnerability, dubbed ECS-cape, which exploits an undocumented ECS protocol to escalate privileges. By taking advantage of shared infrastructure in containerized environments, attackers can use this technique to gain unauthorized access to cloud resources. We will demonstrate ECS-cape live, showcasing how an attacker can leverage this flaw to escalate privileges. The session will also cover practical defense strategies, detailing why co-locating high-privilege and low-privilege workloads on the same ECS instance is risky and how organizations can architect their cloud environments to mitigate this attack vector. Attendees will leave with a clear understanding of how to detect, mitigate, and prevent similar privilege escalation risks in their cloud infrastructure. By: Naor Haziz | Senior Software Developer, Sweet Security Presentation Materials Available at: https://ift.tt/KiPDspS

source https://www.youtube.com/watch?v=UV-hS-DTeik

Black Hat USA 2025 | Shade BIOS: Unleashing the Full Stealth of UEFI Malware

UEFI security has been gaining significant attention, especially in the context of national security and cloud security, due to its high stealth capabilities and strong privileges. However, existing UEFI malware has only scratched the surface of what BIOS can do. They all eventually perform malbehaviors in userland or kernel and are dependent on OS-level security after all. There is some research on SMM backdoors that are purely BIOS implemented, but these implementations tend to be device dependent, resulting in low-versatility backdoors that only work on a specific PC. Moreover, with the current trends of SMM deprivileging, they won't be able to function anymore. We propose the concept "pure-BIOS malware", which operates completely independent from OS-level security and performs malbehaviors without device dependence at runtime. Then, we will introduce Shade BIOS, which made this possible. Shade BIOS operates like an attacker-exclusive OS by running BIOS environment, which would normally lose its functionality after OS boot, in the shadow of OS at runtime. In this talk, we dive into the technical details of Shade BIOS. Moreover, considering the latest trends in BIOS security, such as SMM deprivileging, we will take a broad perspective on BIOS and examine the optimal entity for pure-BIOS malware. As a starting point for detecting pure-BIOS malware, we will also demonstrate a practical method for detecting Shade BIOS. By: Kazuki Matsuo | Security Researcher, FFRI Security, Inc. Presentation Materials Available at: https://ift.tt/nQ9qDMb

source https://www.youtube.com/watch?v=t17YEHymwE4

Black Hat USA 2025 | Ransomware, Tracking, DoS, and Data Leaks on Xiaomi Electric Scooters

We present a broad security and privacy assessment of the internals of two popular Xiaomi e-scooters: the M365 (2016) and Mi3 (2023). The internals include a battery management system (BMS), an electric motor controller (DRV), and a Bluetooth Low Energy subsystem (BTS). We also analyze Mi Home, the official Xiaomi e-scooter companion app for Android and iOS. We uncovered four critical vulnerabilities through extensive static and dynamic reverse engineering, including a remote code execution flaw in the BMS. We exploit the vulnerabilities to conduct four novel attacks we call E-Trojans. The attacks can be executed remotely via a malicious mobile application installed on the victim's phone or in wireless proximity using a Bluetooth Low Energy (BLE) device. The attacks affect the e-scooter safety, security, availability, and privacy. For example, we present a new ransomware attack infecting the BMS and asking for a ransom while permanently damaging the e-scooter battery by silently undervolting its cells. We present the E-Trojans toolkit, an open-source and modular toolkit for reproducing our attacks and experimenting with Xiaomi e-scooters. The toolkit contains an automated patching module that creates modified BMS firmware with malicious capabilities, such as disabling firmware updates and overriding the battery safety thresholds. The toolkit also includes the Android app and Django/MongoDB backend required by our ransomware. Empirical tests confirm our attacks' effectiveness and practicality. For instance, our undervoltage ransomware can permanently reduce the autonomy of an M365 battery by 50% in three hours while asking for a ransom. We propose four countermeasures to enhance the security and privacy of the Xiaomi e-scooter ecosystem. By: Marco Casagrande | Security Researcher, KTH Daniele Antonioli | Professor, EURECOM Presentation Materials Available at: https://ift.tt/oFnvRdh

source https://www.youtube.com/watch?v=k-UsaSfndQQ

Black Hat USA 2025 | No Hoodies Here: Organized Crime in AdTech

For nearly a decade, traffic distribution systems (TDSs) have enabled cybercriminals to hide the true nature of their operations. A TDS serves not only to 'cloak' their activity but also to ensure that victims are 'delivered' to the malicious bait they are most likely to take. These systems are so complex that they are often disregarded with off-hand references to 'a bunch of redirects,' but TDSs are critical enablers to a wide range of crime, from scams to information stealers. In this talk, we will unveil the true identity and nature of one of the most pervasive TDS operators in the landscape, which serves as a cautionary tale of how organized crime actors have created an adtech sector unnoticed by the security community. VexTrio operates the oldest documented (dating back to 2015), most prolific criminal TDS. For years, it was assumed that VexTrio was a gang of 'hackers in hoodies' operating in the dark web as part of the underground economy. In reality, VexTrio operates in the corporate world and their activities go far beyond traffic distribution. They run a vast enterprise that includes dozens of companies across adjacent industries (not just adtech) on multiple continents. We'll share how we unraveled their operations and how they responded to coordinated exposure, cementing our confidence in the conclusions. Unmasking VexTrio has been a watershed moment in understanding the role of organized crime within the adtech industry. Numerous other syndicates were discovered as a result, as well as their affiliations with one another. With this new perspective, attendees working in threat intelligence will see TDS in a different light, allowing them to help advance the industry's knowledge and capabilities to fight against malicious adtech. While at the same time, attendees working in defender positions will understand events in their own network better. By: Renée Burton | VP of Threat Intel, Infoblox Dave Mitchell | Senior Director, Threat Intel, Infoblox Christopher Kim | Senior Staff Threat Researcher, Infoblox Full Session Details Available at: https://ift.tt/jlT5tbJ

source https://www.youtube.com/watch?v=o7jlWJ8_Xuc