exploits

A live performance at AGDQ 2014 in which Super Mario World is made to execute arbitrary injected code, running other games like Pong and Snake on the cartridge. It is done through a TASBot feeding precise controller inputs.

Cosmo's 22:38 Ocarina of Time speedrun, performed live at AGDQ 2013. The runner uses a complex exploit to skip much of the game.

A 37C3 talk by Kaspersky researchers on Operation Triangulation, a zero-click iPhone attack that targeted their own colleagues. They describe capturing every stage of the chain, four zero-days and a previously unknown spyware active for years.

Christopher Domas's Black Hat 2015 talk on a long-unnoticed x86 design flaw that lets an attacker reach System Management Mode, a ring below the OS. It explains how the legacy architecture allows universal privilege escalation and persistent, hard-to-detect malware.

A tool-assisted speedrun of Super Mario World that achieves arbitrary code execution through frame-precise controller inputs, finishing in 2:25. It was also performed live on real hardware at AGDQ 2014.

A recording of the TASBot block at Awesome Games Done Quick 2017, where a robot plays games via tool-assisted speedruns, including Super Mario 64 and Portal on an SNES via arbitrary code execution, and ending with a Twitch Plays segment. It showcases console exploits and creative hardware hacking.

In the finale of Double Fine's Devs Play, speedrunner SMK demonstrates glitches and exploits that skip entire sections of Psychonauts while Tim Schafer and the dev team watch. The developers react to and discuss the bugs as they appear.

A five-hour documentary history of the Super Mario 64 A button challenge, which aims to beat the game with as few A presses as possible. It covers the bugs and exploits discovered over the years.

The fail0verflow team (bushing, marcan, sven) present console hacking at 27C3, covering Wii, Xbox 360 and PS3 exploits. They explain how the PS3 was cracked after Sony removed Other OS.

A tool-assisted speedrun of Pokemon Yellow on Game Boy Color that uses glitches and frame-precise inputs to make the game execute an arbitrary program. It was later obsoleted by an improved run.

Pannenkoek2012's commentated tool-assisted Super Mario 64 run collecting the Watch for Rolling Rocks star with half an A press, using parallel universes and QPU movement. The video is marked outdated in favor of a newer version.

Tom Murphy (suckerpinch) shows 'reverse emulation', using a Raspberry Pi in an NES cartridge to give an unmodified NES new abilities such as playing SNES games. The video starts in a strange way and gets stranger.

Apple security head Ivan Krstic gives a Black Hat 2016 talk on iOS security, covering HomeKit, Auto Unlock and iCloud Keychain. He explains key hierarchies and how data can stay safe even in adversarial clouds.

Tom Scott explains why electronic voting is a bad idea. Elections must be trusted by everyone and attacks on software scale in ways attacks on paper do not, so open source or blockchain fixes do not solve it.

James Mickens's humorous USENIX Security keynote argues that improving security and trusting opaque technology like machine learning is far harder than the industry admits.

Moxie Marlinspike's DEF CON 18 talk on changing threats to privacy argues that surveillance arrived through convenient services and network effects, so opting out is not a real solution. It also includes his framing of getting social democracy rather than the fascism people feared.

SethBling shows MarI/O, a program using neural networks and the NEAT genetic algorithm to learn to play Super Mario World. The description links the source code, the paper and background reading.

Meredith Patterson and Sergey Bratus argue that networked software stays insecure because protocols and inputs are too complex to recognize safely. They propose using formal language theory and grammars to build secure, verifiable input handling.

SethBling uses Super Mario World glitches to inject and run Flappy Bird code on an unmodified SNES, entering it purely with controller inputs. It was the first time a human completed this kind of exploit by hand.

John Sotos, a physician and former Intel chief medical officer, argues at DEF CON 25 that genetic diseases are exploitable vulnerabilities in the genome. He warns that CRISPR and related tools will make malicious genome hacks and targeted bioweapons feasible.

Deviant Ollam's two-hour conference talk explains how elevators work, from the pit and buffers to the car top, controller logic and access-control features. It shows how this knowledge can be used for optimization and for bypassing building security.

Tom7 explains how he built a SIGBOVIK 2017 paper made only of printable ASCII bytes that is also a valid DOS executable. He writes a C compiler targeting printable x86 without self-modifying code and solves the puzzles the constraint creates.

Christopher Domas's Derbycon 2015 talk on the M/o/Vfuscator, a compiler that emits only x86 mov instructions, showing mov is Turing complete. It explains how a full machine is built from mov and why the output is a nightmare to reverse engineer.

Moxie Marlinspike's BlackHat 2011 talk examines weaknesses of SSL and the certificate authority system and proposes Convergence, a decentralized notary approach with trust agility.

Bruce Dang of Microsoft gives a 27C3 talk on how the Stuxnet vulnerabilities were found and analyzed. He walks through the techniques used to triage them and the details of each zero-day exploit, down to the opcode level.

Frank Abagnale, the real subject of Catch Me If You Can, speaks at Google about his life as a con man turned FBI fraud and cybersecurity expert, including advice on fraud, breaches and credit cards.

The Grugq's Hack In The Box 2012 talk on operational security for hackers, drawing on hacker indictments and counter-intelligence research. It reviews OPSEC goals and methods for avoiding detection and arrest, with case studies of how hackers got caught.

Christopher Domas presents at Black Hat 2017 how page fault analysis and processor fuzzing can exhaustively search the x86 instruction set. The talk uncovers undocumented instructions and hardware bugs and shows limits of disassemblers.

Microsoft's Tony Chen explains how the Xbox One was designed to resist physical attacks, including secure boot, encrypted memory, a security processor and a hypervisor. The goal was to make any hardware attack cost more than the price of many games.

Kaze Emanuar explains how he rewrote and optimized the Super Mario 64 source code so it runs far faster on real N64 hardware. He covers performance bottlenecks and fixes in detail for his ROM hacks.

Dan Geer's Black Hat 2014 keynote argues that cybersecurity is a matter of power and policy rather than wishful thinking. He covers surveillance, the vulnerability market, software liability and privacy as the capacity to misrepresent yourself.

A DEF CON 26 talk by investigative journalists and hackers on the fake science industry, with bogus conferences and predatory journals that give studies false credibility. It draws on a large investigation into the money behind them.

A Google Tech Talk by Steve Weis that introduces modern cryptography and its use in practice and at Google. It covers proofs of security and security definitions and a special topic. HN commenters treat it as a talk on verifiable electronic voting.

Okta developer advocate Nate Barbettini explains OAuth 2.0 and OpenID Connect in a roughly hour-long talk. It starts from the problems the protocols solve and walks through the flows. The description notes the implicit flow material is now out of date.

Tom Scott explains for Computerphile why electronic voting is a bad idea, arguing that paper ballots are transparent, auditable and hard to tamper with at scale. He covers why moving voting to phones, tablets or computers undermines trust and verifiability.

Zoz's DEF CON 22 talk on operational security in the age of pervasive surveillance. He shows how hard it is to avoid mistakes even for people who should know better.

Bryan Cantrill's Papers We Love talk on FreeBSD Jails and Solaris Zones, tracing how OS-level virtualization grew out of chroot and the limits of the traditional UNIX security model.

Deviant Ollam and Howard Payne give an in-depth DEF CON 22 explanation of how elevators work, from the pit to the penthouse. It covers their control modes and how pen testers use elevators to bypass building security.

A HOPE X talk giving an in-depth explanation of how elevators work, from their history in hacker culture to using their control systems to bypass building security. It covers features and abilities of elevators that most people never see.

Andrew "bunnie" Huang examines how realistic hardware supply chain attacks are, from rogue insiders to nation states, in the wake of the Bloomberg Businessweek report. He explains how undocumented components could be hidden on boards and how hard they are to spot.