malware forensics

In an 11-minute TED talk, Ralph Langner explains how his team reverse-engineered the Stuxnet worm and worked out that it targeted industrial control systems, with a covert state origin. It is a compact look at cyber-forensics.

Linus Tech Tips warns against cheap Android TV boxes, many of which ship with preinstalled malware. It looks at several boxes and suggests safer alternatives such as Chromecast and Nvidia Shield.

Tom Scott explains Electrical Network Frequency analysis, where hum from the power grid in a recording is matched against grid logs to date and place it. He talks to a researcher and sets them a challenge.

Part 2 of a Q&A workshop with security researcher Jacob Appelbaum from April 2012, covering mobile phone security, cellphone forensics, state repression and surveillance. Topics include booting Tails from USB and surveillance self-defense resources.

Ang Cui and Jonathan Voris present firmware modification attacks on networked printers at 28c3, showing how HP printers can be compromised and used as footholds for malware inside sensitive networks.

Eric Parker connects a fresh Windows XP machine to the internet in 2024 to see how quickly it gets infected with malware. He documents the dangers of running an unpatched legacy OS online.

Bruce Dang of Microsoft gives a 27C3 talk on how the Stuxnet vulnerabilities were found and analyzed. He walks through the techniques used to triage them and the details of each zero-day exploit, down to the opcode level.

Kim Nilsson presents his investigation into how Mt. Gox was hacked and mismanaged, tracing the finances and the missing bitcoins. It was given at the 2017 Breaking Bitcoin meetup.

A Black Hat USA 2017 briefing by the prosecutors who caught Russian carder Roman Seleznev. It covers the electronic evidence collected, the international trail, and how he was located and arrested.

A short Princeton CITP video describing cold boot attacks, where encryption keys remain in DRAM after power loss and can be recovered. It covers the attack against disk encryption such as BitLocker, FileVault and TrueCrypt.

Christopher Domas's Black Hat 2015 talk on a long-unnoticed x86 design flaw that lets an attacker reach System Management Mode, a ring below the OS. It explains how the legacy architecture allows universal privilege escalation and persistent, hard-to-detect malware.

Karsten Nohl and Jakob Lell present BadUSB at Black Hat 2014, showing that USB controller firmware can be reprogrammed to impersonate other device types. They demonstrate system compromise and a self-replicating USB threat that current defenses cannot detect.

A John Oliver Last Week Tonight segment on how forensic science used in criminal trials is often unscientific. It looks at unreliable methods and lab malpractice, and ends with a joke about a TV procedural that might change public perception.

A WiebeTech marketing demo of HotPlug, a device that moves a running computer onto battery or another power source so it can be transported without shutting down.