malware forensics

In an 11-minute TED talk, Ralph Langner explains how his team reverse-engineered the Stuxnet worm and worked out that it targeted industrial control systems, with a covert state origin. It is a compact look at cyber-forensics.

Ang Cui and Jonathan Voris present firmware modification attacks on networked printers at 28c3, showing how HP printers can be compromised and used as footholds for malware inside sensitive networks.

Bruce Dang of Microsoft gives a 27C3 talk on how the Stuxnet vulnerabilities were found and analyzed. He walks through the techniques used to triage them and the details of each zero-day exploit, down to the opcode level.

Kim Nilsson presents his investigation into how Mt. Gox was hacked and mismanaged, tracing the finances and the missing bitcoins. It was given at the 2017 Breaking Bitcoin meetup.

A Black Hat USA 2017 briefing by the prosecutors who caught Russian carder Roman Seleznev. It covers the electronic evidence collected, the international trail, and how he was located and arrested.

Christopher Domas's Black Hat 2015 talk on a long-unnoticed x86 design flaw that lets an attacker reach System Management Mode, a ring below the OS. It explains how the legacy architecture allows universal privilege escalation and persistent, hard-to-detect malware.

Karsten Nohl and Jakob Lell present BadUSB at Black Hat 2014, showing that USB controller firmware can be reprogrammed to impersonate other device types. They demonstrate system compromise and a self-replicating USB threat that current defenses cannot detect.