Hacking the Cloud with SAMLFelix Wilhelm

[Slides] [Video]

Announcing GUAC, a great pairing with SLSA (and SBOM)!Brandon Lum, Mihai Maruseac, Isaac Hepworth, Google Open Source Security Team

[Blog] [Code] [Presentation]

We sign code nowWilliam Woodruff

[Blog] [Code] [Video]

Knockout Win Against TCC - 20+ NEW Ways to Bypass Your MacOS Privacy MechanismsCsaba Fitzl and Wojciech Regula

[Slides] 

Farming The Apple Orchards: Living Off The Land TechniquesCedric Owens and Chris Ross

[Slides] [Video]

LOLBINed — Using Kaspersky Endpoint Security “KES” Installer to Execute Arbitrary CommandsNasreddine Bencherchali

[Blog] 

POPKORN: Popping Windows Kernel Drivers At ScaleRajat Gupta, Lukas Patrick Dresel, Noah Spahn, Giovanni Vigna, Christopher Kruegel, and Taesoo Kim

[Paper] [Code]

RC4 Is Still Considered HarmfulJames Forshaw

[Blog]

Kerberos’ RC4-HMAC broken in practice: spoofing PACs with MD5 collisionsTom Tervoort

[Paper] [Slides]

Exploring Ancient Ruins to Find Modern Bugs: Discovering a 0-Day in MS-RPC serviceOphir Harpaz and Stiv Kupchik

[Slides] [Video]

Decentralized Identity Attack SurfaceShaked Reiner

[Blog part 1] [Blog part 2]

Drone Authentication via Acoustic FingerprintYufeng Diao, Yichi Zhang, Guodong Zhao, and Mohamed Khamis

[Slides] [Paper]

On the Implications of Spoofing and Jamming Aviation Datalink ApplicationsHarshad Sathaye, Guevara Noubir, and Aanjhan Ranganathan

[Slides] [Paper]

{JS-ON: Security-OFF}: Abusing JSON-Based SQL QueriesNoam Moshe

[Slides] [SQLMap patch] [Blog]

Are There Wireless Hidden Cameras Spying on Me?Jeongyoon Heo, Sangwon Gil, Youngman Jung, Jinmok Kim, Donguk Kim,

Woojin Park, Yongdae Kim, Kang G. Shin, and Choong-Hoon Lee

[Slides] [Paper]