Dates
Conferences
Tags
Sort by:
Most recent
Conference: Defcon 31
Authors: Alexander Dalsgaard Krog Vulnerability Researcher at Vectorize, Alexander Skovsende Grad Student at Technical University of Denmark
2023-08-01
In this work, we present the novel results of our research on Intel CPU microcode. Building upon prior research on Intel Goldmont CPUs, we have reverse-engineered the implementations of complex x86 instructions, leading to the discovery of hidden microcode which serves to prevent the persistence of any changes made. Using this knowledge, we were able to patch those discovered sections, allowing us to make persistent microcode changes from userspace on Linux. We have developed and improved microcode tracing tools, giving us deeper insight into Intel Atom microcode than was previously possible, by allowing more dynamic analysis of the ROM.
Along with this presentation, we provide a C library for making microcode changes and documentation on the reverse-engineered microcode.
We show that vendor updates to the microcode, which cannot be verified by the user, impose a security risk by demonstrating how a Linux system can be compromised through a backdoor within a CPU core's microcode.
Conference: Defcon 31
Authors: NiNi Chen Security Researcher at DEVCORE
2023-08-01
MikroTik, as a supplier of network infrastructures, its products and RouterOS are adopted widely. Currently, at least 3 million+ devices are running RouterOS online. Being the target research by attackers actively, the exploits leaked from the CIA in 2018 and the massive exploits that followed are samples of the havoc that can be caused when such devices are maliciously exploited again. Therefore, RouterOS also attracts many researchers to hunt bugs in it. However, there are rarely high-impact vulnerabilities reported over a long period. Can the OS become perfect overnight? Of course not. Some details have been missed.
Researches on RouterOS were mainly against jailbreak, Nova Message in IPC, and analysis of exploits in the wild. Especially researches against Nova Message have reported tons of post-auth vulnerabilities. However, the architecture design and the lower-layer objects, which are closely related to the functionality of Nova Binary, were being neglected due to their complexity, causing some details to be overlooked for a long time. Starting by introducing the mechanisms of the socket callback and the remote object, we will disclose more about the overlooked attack surface and implementations in RouterOS. Moreover, we will discuss how we, at the end of rarely visited trails, found the pre-auth RCE that existed for nine years and can exploit all active versions and the race condition in the remote object. We will also share our methodology and vulnerability patterns.
Delving into the design of the RouterOS, attendees will have a greater understanding of the overlooked attack surface and implementation of it and be able to review the system more reliably. Additionally, we will also share our open-source tools and methodology to facilitate researchers researching RouterOS, making it less obscure.
Conference: KubeCon + CloudNativeCon Europe 2023
Authors: Carolina Lindqvist, Daniel Fernández
2023-04-19
tldr - powered by Generative AI
The presentation discusses the process of bringing Kubernetes into an organization and the benefits it provides for daily operations and automation.
- Start prototyping as soon as possible to identify potential problems and collaborate with users and operations teams to understand use cases and evaluate decisions
- Use standard alternatives unless there is a specific reason not to
- Write easy-to-follow how-to guides for users
- Implement a GitOps approach with Flux for automation and Helm charts for deployment
- Configure and test applications in a Dev environment before scaling to other environments
Conference: Global AppSec Dublin 2023
Authors: Gil Cohen, Omri Inbar
2023-02-16
Two vulnerable websites which were found to be vulnerable to CRLF injection, caused Google Chrome to behave differently. This trigged an exciting research journey ending in finding weaknesses in reverse proxies, Chrome and other browsers as well as a new hacking technique named Frontend server hijacking or Frontjacking in short. Frontjacking combines CRLF injection, poorly configured servers and shared hosting, enables attackers to execute any reflected XSS and phishing related payloads while bypassing any defensive mechanisms including CSP (Content Security Policy), HttpOnly cookie attributes, WAFs (Web Application Firewalls), CORS (Cross Origin Resource Sharing) and HTTPS certificate validation.
Conference: KubeCon + CloudNativeCon North America 2022
Authors: Huamin Chen, Chen Wang
2022-10-27
tldr - powered by Generative AI
The presentation discusses the use of cloud-native patterns to improve cloud efficiency in sustainable architecture, with a focus on Project Kepler and its integration with Kubernetes ecosystems.
- Cloud-native sustainability infrastructure can improve cloud efficiency in sustainable architecture
- Project Kepler uses eBPF programs and system libraries to measure energy, performance, and resource usage
- Kepler enables energy-relevant observability and sustainable management on clusters
- Kepler can be used for research topics like energy-efficient workload scheduling and energy-aware autoscaling
- The presentation includes a case study of a Kepler integration for building an advanced vertical autoscaler to improve energy performance objectives of Kubernetes applications
Conference: Transform X 2022
Authors: Anima Anandkumar
2022-10-19
As the Director of AI Research at NVIDIA, Dr. Anandkumar shares some of the highest-impact topics her team is researching—from better weather modeling to tackle climate change, to modeling CO2 carbon capture and storage, to coronavirus aerosol simulation and drug discovery. Previously, Anandkumar helped launch Amazon SageMaker, Comprehend, and Rekognition at AWS (Amazon Web Services). She is also the Bren Professor at Caltech’s CMS (Computing + Mathematical Sciences) Department and serves as part of the expert network of the World Economic Forum.Building on her seminal paper that covers the initial development of tensor algorithms, Dr. Anandkumar presents her research on Fourier Neural Operators (FNOs), which in some cases can replace computationally costly Navier-Stokes equations that underpin many fluid dynamics simulations such as weather forecasting models and drug discovery processes. She advocates the use of the Fourier transform in neural networks to make them discretization- (or even quantization-) invariant. By replacing brute-force computational approaches with FNOs running on GPUs, Dr. Anandkumar is able to reduce the complexity of the simulation of weather modeling (a 45,000x speed-up) and carbon capture and sequestration (a more than 10,000x speed-up).Join Dr. Anandkumar as she will inspire attendees to apply FNOs, smarter model architectures, and parallel computation to solve the public health and climate crises of our time.
Conference: Transform X 2022
Authors: Dr. Lynne Parker, Michael Kratsios
2022-10-19
tldr - powered by Generative AI
The use of AI in the federal government can streamline processes, reform regulations, and improve citizen services. However, there is a talent challenge and a need for guidance on AI procurement.
- AI can be used to process paperwork and summarize important information for agencies to address citizen problems
- AI can be used for regulatory reform to detect contradictory regulations and flag them for correction
- 13 federal agencies have made public their use cases of AI
- There is a talent challenge in federal agencies to implement AI
- There is a need for guidance on AI procurement to accelerate the use of AI in the federal government
Conference: Transform X 2022
Authors: Dragomir Anguelov, Marco Pavone, Alex Kendall, Kate Park
2022-10-19
tldr - powered by Generative AI
Experts discuss the challenges in incorporating machine learning into autonomous vehicles safely and effectively.
- Autonomous vehicles use multiple sensors to identify their surroundings, but face difficulties in identifying pedestrians, other vehicles, obstacles, and environmental conditions.
- Integrating complicated sensor suites, software, data management, and machine learning with engineering is a challenge.
- Collecting and labeling large amounts of data, integrating ML models with the rest of the self-driving stack, and improving the driver continuously are also challenges.
- Simulation plays a critical role in development.
- Different OEMs use unique approaches to leverage machine learning in their self-driving stack, with some using end-to-end learning and others preferring modular learning.
- Scaling to new environments quickly is a difficult challenge.
Conference: KubeCon + CloudNativeCon North America 2021
Authors: Micah Hausler, Robert Clark
2021-10-15
tldr - powered by Generative AI
The presentation discusses the importance of staying up-to-date with Kubernetes vulnerabilities and the need to consider environmental scoring when assessing their severity.
- Canonical sources for vulnerability information may not always be up-to-date
- Staying on an up-to-date version of Kubernetes is crucial for security
- Environmental scoring can change the severity of a vulnerability based on how it's deployed
- Rescoring vulnerabilities is important to understand which ones to escalate
- The number of unique CVEs has consistently decreased over the last few years
Conference: KubeCon + CloudNativeCon North America 2021
Authors: Tasha Drew, Gaby Moreno Cesar, Josephene Pynadath, Carl J Pearson
2021-10-13
Have you ever taken a step back and wondered, what is up with this whole Kubernetes thing? Why are people using it all over the place? Is it becase of Phippy and Captain Kube? The Docker whale being so cute and retro? Or is there something else going on? The team at SIG Usability had these questions too, and we have embarked on a two year user research study to find out what exactly is going on. Our goal is to make sure the upstream Kubernetes' community deeply understands the needs and goals of the users of Kubernetes, and how they are met and not met today. Join this talk for a deep dive into our study and data, and what we're learning about our users. Spoiler: getting started with Kubernetes is real hard, and we should fix our on-ramp. Learn more at our talk!