Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Black Hat USA
August 1-6, 2020
Las Vegas, NV, USA
Black Hat Asia
September 29 - October 2, 2020
Singapore
Black Hat Europe
November 9-12, 2020
London UK
6/17/2019
09:00 AM
Black Hat Staff
Black Hat Staff
Event Updates
100%
0%

Find Your Next Favorite Cybersecurity Tool at the Black Hat USA Arsenal

Learn new enterprise-grade techniques for identifying vulnerabilities, improving Active Directory security, and building trust with customers at Black Hat USA this summer.

On the hunt for new cybersecurity tools? Check out the Arsenal at Black Hat USA in Las Vegas this August, where all Black Hat passholders are invited to see live demonstrations of the latest open-source security tools.

For example, you could swing by the Arsenal (located in the Business Hall) and catch a demonstration of Smalien, a security tool for information flow analysis and information leakage detection on Android devices.

Once you give an application to Smalien, it understands the application thoroughly by executing static information flow analysis of Dalvik bytecode files extracted from the application. Smalien performs not only static analysis but also dynamic analysis, implicit information flow detection, and privacy policy enforcement at runtime by parasitizing the application.

You may also want to see a demo of Objection: Runtime Mobile Exploration, a runtime mobile exploration toolkit built with the aim of helping assess mobile applications and their security posture without the need for a jailbroken or rooted mobile device.

Objection allows for many common pentesting tasks to be performed such as disabling SSL inspection, interacting with the applicable platforms keystore/keychain as well as the ability to upload/download files from a device. Additionally, more advanced usages such as code path tracing and live Java object inspection is also possible.

Black Hat USA will also host a smorgasbord of complementary Briefings featuring expert speakers sharing tools and techniques that can help you put these tools to good use. Securing the System: A Deep Dive into Reversing Android Pre-Installed Apps is a good example. This 50-minute Briefing from Google will detail the differences in reversing and analyzing pre-installed Android applications compared to the user-space applications on which most security research focuses.

This will include detecting signals that the pre-installed app may be colluding with other components and be only one piece of the puzzle, and how bad behaviors can change when they are run in the more privileged context of a pre-installed application. You’ll also dive into case-studies of Android pre-installed security issues Google discovered in 2018 and 2019: malware, security misconfigurations, and remote code execution backdoors!

In New Vulnerabilities in 5G Networks you’ll get an in-depth look at the security features of 5G radio networks and new vulnerabilities affecting both the operator infrastructure and end-devices (including mobiles, NB-IoTand laptops). Plus, you’ll see how these new vulnerabilities in the 5G/4G security standards can be exploited using low-cost hardware and software platforms.

For more information about these Briefings and many more check out the Black Hat USA Briefings page, which is regularly updated with new content as we get closer to the event!

Black Hat USA returns to the Mandalay Bay in Las Vegas August 3-8, 2019. For more information on what’s happening at the event and how to register, check out the Black Hat website.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9498
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
CVE-2020-3282
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
CVE-2020-5909
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
CVE-2020-5910
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
CVE-2020-5911
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.