Black Hat 2021: 10 Cybersecurity Sessions to Watch
Summary
A curated Black Hat 2021 lineup highlights sessions on Wi-Fi and cloud vulnerabilities, HTTP/2 attacks, DNS data leakage, SIEM design, IPv6 geolocation, blockchain exploitation, timing attacks, and brand-impersonation detection.
Key points
- The FragAttacks session covers Wi-Fi design and implementation flaws that may enable packet injection or frame exfiltration across protected networks.
- A session on AWS describes cross-account vulnerabilities in AWS Config, CloudTrail, and Serverless Repository that could allow actions on other customers’ resources, and discusses IAM remediation gaps.
- DNSaaS research describes Windows DNS updates leaking corporate network information; the researchers report finding three vulnerable providers among six examined and updates from nearly one million endpoints.
- HTTP/2 sessions will discuss desynchronization and request-smuggling attacks, including cache poisoning and credential theft, alongside an open-source scanner and interactive labs.
- IPvSeeYou uses EUI-64 IPv6 addresses and related Wi-Fi MAC addresses to geolocate residential routers; its authors say they mapped millions of routers.
- A Fastjson presentation describes remote-code-execution techniques and a claimed method for covertly stealing assets from blockchain users after compromising nodes.
- Other sessions cover building a cloud-native SIEM, remote timing attacks designed to resist network jitter, and a Siamese neural network for detecting brand impersonation.
Article Details
- Event Type
- Black Hat 2021 conference session preview
- Impact
- The featured sessions describe potential security impacts from Wi-Fi design and implementation flaws, cross-account AWS IAM vulnerabilities, DNSaaS information leakage, HTTP/2 request-smuggling attacks, and vulnerabilities affecting Fastjson and blockchain nodes. The article presents these as research topics and potential risks, not as a report of a single confirmed incident.
Vendors
Products
AWS Configto access clients' resources. The vulnerabilities have been proven on three major AWS services (AWS Config, Cloudtrail, and Serverless Repository) and have allowed a potential attacker to write and read certainAWS Route 53vulnerabilities have been proven and successfully exploited on three major cloud providers including AWS Route 53 and may affect many others. Successful exploitation of the vulnerabilities may allow exfiltration ofAWS Serverless Repository ServiceThe vulnerabilities have been proven on three major AWS services (AWS Config, Cloudtrail, and Serverless Repository) and have allowed a potential attacker to write and read certain objects from private S3 buckets.CloudTrailclients' resources. The vulnerabilities have been proven on three major AWS services (AWS Config, Cloudtrail, and Serverless Repository) and have allowed a potential attacker to write and read certain objectsIAMthat may affect many other services in AWS because the tenant scope is implicitly defined in AWS IAM policies, causing services that allow multi-tenant access to perform unintended actions.Microsoft WindowsNAT so the adversary can connect to and exploit internal devices in the network (e.g. BlueKeep against Windows 7).S3Serverless Repository) and have allowed a potential attacker to write and read certain objects from private S3 buckets.