Black Hat USA
August 4-9, 2018
Las Vegas, NV, USA
Black Hat Trainings
October 22-23, 2018
Chicago, IL USA
Black Hat Europe
December 3-6, 2018
London UK
6/18/2018
11:00 AM
Black Hat Staff
Black Hat Staff
Event Updates
0%
100%

Black Hat USA 2018:
Comandeering Voice Enabled Devices

Researchers Amichai Shulman, Ron Marcovich, Tal Be'ery and Yuval Ron will detail a vulnerability of Microsoft's Cortana in their Black Hat USA Briefing "Open Sesame: Picking Locks with Cortana."

From Apple’s Siri to Amazon’s Alexa, Google’s Assistant and Microsoft’s Cortana, voice enabled activated devices have grown substantially. Researchers Amichai Shulman, Ron Marcovich, Tal Be'ery and Yuval Ron will detail a vulnerability of Microsoft’s Cortana in their Black Hat USA Briefing “Open Sesame: Picking Locks with Cortana.”

 

Cortana vulnerability (cve-2018-8140) enables attackers to compromise locked machines and escalate privileges to access private information without detection. This attack can be conducted without deploying external code, mitigating the usefulness of anti-virus and anti-malware softwares. Hear the findings, learn defense mechanisms, detection tools and more at Black Hat USA 2018. This year’s Briefings span 18 Tracks including malware, network defense, and exploit development. Check out the Briefings Lineup and register by July 13 to save on your pass.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
New Cold Boot Attack Gives Hackers the Keys to PCs, Macs
Kelly Sheridan, Staff Editor, Dark Reading,  9/13/2018
Yahoo Class-Action Suits Set for Settlement
Dark Reading Staff 9/17/2018
RDP Ports Prove Hot Commodities on the Dark Web
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17182
PUBLISHED: 2018-09-19
An issue was discovered in the Linux kernel through 4.18.8. The vmacache_flush_all function in mm/vmacache.c mishandles sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations...
CVE-2018-17144
PUBLISHED: 2018-09-19
Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16.x before 0.16.3 allow a remote denial of service (application crash) exploitable by miners via duplicate input. An attacker can make bitcoind or Bitcoin-Qt crash.
CVE-2017-3912
PUBLISHED: 2018-09-18
Bypassing password security vulnerability in McAfee Application and Change Control (MACC) 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility.
CVE-2018-6690
PUBLISHED: 2018-09-18
Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 and earlier allows authenticated users to execute arbitrary code via file transfer from external system.
CVE-2018-6693
PUBLISHED: 2018-09-18
An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of check to time of use (TOCTOU) race condition during a specific scanning sequence, the unprivileged user is able to perform a privilege escal...