Conference recordings are now online!

Conference recordings are now online!

We've highlighted a few talks worth checking out:

• Resilient, They Said: Breaking the Windows ReFS Driver, One Mount at a Time. The talk examines vulnerabilities in the Windows ReFS file system driver. It shows how a specially crafted disk image can trigger kernel memory corruption during routine file operations.

• Using AI to Audit Embedded Devices. A researcher uses AI agents to compromise home routers. Examples involving Netgear devices include JWT forgery, installation of modified firmware, and code execution in the U-Boot bootloader.

• Dude Where Is My .git? Secrets and Commits Left Behind in Docker Images. The author shows how to extract valid access tokens for private repositories and cloud resources from public Docker images.

• AI Security at Scale: Memory Safety Across the ML Inference Stack. The research examines memory safety issues in GPTQModel and llama.cpp, software for running ML models. Demonstrations cover data disclosure from GPU memory and arbitrary command execution.

• When AI Starts to Take Actions: GUI-Agent Smartphone Hacking. In the demonstration, a smartphone AI assistant checking SMS messages opens a webpage containing a prompt injection. The injection tricks it into sending the attacker a one-time code from another SMS, allowing access to the victim’s bank account.