hack

The Mentor (Loyd Blankenship) reads his 1986 essay "The Conscience of a Hacker" at H2K2 in 2002 and adds his own insight about its backstory.

A HOPE X talk giving an in-depth explanation of how elevators work, from their history in hacker culture to using their control systems to bypass building security. It covers features and abilities of elevators that most people never see.

Joe Grand recounts being hired to hack a Trezor One hardware wallet and recover $2 million of cryptocurrency. He describes three months of experimentation, voltage glitching, failures and high-stakes attempts with only one chance to get it right.

John Sotos, a physician and former Intel chief medical officer, argues at DEF CON 25 that genetic diseases are exploitable vulnerabilities in the genome. He warns that CRISPR and related tools will make malicious genome hacks and targeted bioweapons feasible.

A 33c3 talk by marcan on reverse engineering the PS4 hardware to run Linux with 3D acceleration. It covers how the console differs from a PC and includes a story about tunneling PCIe over RS-232.

The fail0verflow team (bushing, marcan, sven) present console hacking at 27C3, covering Wii, Xbox 360 and PS3 exploits. They explain how the PS3 was cracked after Sony removed Other OS.

A DEF CON 23 talk by Marc Rogers and Kevin Mahaffey walking through the architecture of the Tesla Model S, what Tesla got right and wrong, and how the interconnected systems can be hacked. It also covers the data the car collects.

Theo de Raadt presents pledge, a new OpenBSD security mechanism that kills processes which exceed the system calls they declared they need. The talk was given late at night at Hackfest 2015.

Deviant Ollam's two-hour conference talk explains how elevators work, from the pit and buffers to the car top, controller logic and access-control features. It shows how this knowledge can be used for optimization and for bypassing building security.

Deviant Ollam and Howard Payne give an in-depth DEF CON 22 explanation of how elevators work, from the pit to the penthouse. It covers their control modes and how pen testers use elevators to bypass building security.

Craig Heffner's Black Hat 2013 talk on exploiting network surveillance cameras, covering how insecure their firmware is. It shows how easily such devices can be compromised.

A DEF CON 20 talk by RenderMan on the security weaknesses of ADS-B, the unencrypted, unauthenticated aircraft tracking broadcast. It shows how easily the data can be spoofed and what that means for security designed in too late.

Micah Lee's Circle of HOPE 2018 talk on Qubes OS, which isolates activities in separate virtual machines so one compromise, such as a bad PDF or USB stick, does not expose everything. He gives an overview timed around the Qubes 4.0 release.

Jessie Frazelle's DockerCon SF 2015 talk on running Docker containers for desktop applications, with fun container hacks and images. It shows how far containers can be pushed beyond servers.

Facebook engineers explain why they abandoned the traditional MVC paradigm for a more functional architecture, introducing Flux and React. They use the unread-message-count bug as a case study of the problems of bidirectional data flow at scale.

Jake Vanderplas's PyCon 2016 talk shows how sampling-based methods such as simulation, shuffling and bootstrapping make statistics intuitive. His pitch is that if you can write a for-loop, you can do statistics.

Erik Meijer gives a provocative talk presenting what he calls a rational alternative to Agile, arguing against Scrum-style practice. He also touches on the tenth-man concept.

The Grugq's Hack In The Box 2012 talk on operational security for hackers, drawing on hacker indictments and counter-intelligence research. It reviews OPSEC goals and methods for avoiding detection and arrest, with case studies of how hackers got caught.

George Hotz gives a SXSW 2019 talk on the idea that we live in a simulation and asks what actions would be available from inside it. He takes a hacker's view of whether it could be escaped.

Tom Murphy (suckerpinch) shows 'reverse emulation', using a Raspberry Pi in an NES cartridge to give an unmodified NES new abilities such as playing SNES games. The video starts in a strange way and gets stranger.

Tom7 explains how he built a SIGBOVIK 2017 paper made only of printable ASCII bytes that is also a valid DOS executable. He writes a C compiler targeting printable x86 without self-modifying code and solves the puzzles the constraint creates.

A 34C3 talk on the security architecture of the Nintendo Switch and the early progress breaking it. It introduces the Switch's custom OS and software stack, with the hackers' reverse-engineering and glitching work.

Charlie Miller and Chris Valasek present their DEF CON 23 talk on remotely compromising an unmodified Jeep, pivoting from the entertainment system to the vehicle's internal networks to send control messages. They aim to show the reality of car hacking.

Ken Shirriff walks through how to reverse engineer integrated circuits from die photos, using famous chips as examples, in a Hackaday SuperConference talk.

A reverse engineer walks through fixing a ten-year-old bug in Guitar Hero III without access to its source code, using a disassembler and decompiler. It is technical but explained step by step.

A DEF CON 24 talk on how a cyber mercenary group could forge identities and create the conditions for overthrowing a government. It is entertainingly outlandish and includes a drone-mounted saw for cutting power lines.

The fail0verflow 27C3 talk on breaking PS3 security, covering how Sony's implementation failed, including its ECDSA mistakes.

Omar Rizwan's short !!Con talk about writing a Breakout game in JavaScript that runs inside a PDF. It explores the surprisingly large PDF specification, including its scripting support.

Deviant Ollam, head of a physical penetration testing team, presents tactics for getting into buildings, from bypassing door levers with a wire to defeating bank doors. He argues that physical security is often surprisingly weak.

A DEF CON 21 talk by Adam Laurie and Zac Franken on decapping chips, covering how to remove chip packaging and image the die to read out contents such as ROM.

A DEF CON 21 talk by Karl Koscher and Eric Butler on how SIM cards work, including Java Card applets, the SIM toolkit and the OS running on the card. It shows how much control the network and the card have independent of the phone.

Matthew Cole's Black Hat 2013 talk on operational security failures by CIA operatives. It covers the Abu Omar case and how sloppy tradecraft with cell phones exposed officers through call records and metadata.

A HOPE09 talk on how modern computer chips are manufactured, from 22nm transistors to ultra-clean fabs and the tricks used to pattern tiny features with light. It frames chipmaking as hacking electrical engineering and physics.

Christopher Domas's Derbycon 2015 talk on the M/o/Vfuscator, a compiler that emits only x86 mov instructions, showing mov is Turing complete. It explains how a full machine is built from mov and why the output is a nightmare to reverse engineer.

A DEF CON 26 talk by investigative journalists and hackers on the fake science industry, with bogus conferences and predatory journals that give studies false credibility. It draws on a large investigation into the money behind them.

Christopher Domas presents research at DEF CON 26 showing a hidden alternate instruction set and undocumented hardware backdoor in some x86 processors, found on a third-party CPU. He uses it to ask how feasible wider hardware backdoors are.

A DEF CON 30 talk by Sam Bent, a former darknet vendor, on operational security when using Tor and the darknet. He applies the hacker mindset to staying anonymous and avoiding capture.

A PyCon 2012 talk by Kurt Grandis on building an automated water-squirting turret that uses Python and computer vision to detect and drive off squirrels from a bird feeder.

Apple security head Ivan Krstic gives a Black Hat 2016 talk on iOS security, covering HomeKit, Auto Unlock and iCloud Keychain. He explains key hierarchies and how data can stay safe even in adversarial clouds.

James Mickens's humorous USENIX Security keynote argues that improving security and trusting opaque technology like machine learning is far harder than the industry admits.