POC2024 Archive

01

Talks

17 presentations

Cloudy with a Chance of Bugs: Attacking the Windows Cloud Files API		Alex BirnbergSecurity Researcher
Lights Out: Covertly turning off the ThinkPad webcam LED indicator		Andrey KonovalovPositive Technologies
Fuzzing for complex bugs across languages in JavaScript Engines		Carl SmithGoogle V8 Security Team
How I use a novel approach to exploit a limited OOB on Ubuntu at Pwn2Own Vancouver 2024		Chih-Yen ChangDEVCORE
Apple Disk-O Party		Csaba FitzlKandji
A journey into forgotten Null Session and MS-RPC interfaces		Haidar KabiboKaspersky
Breaking through the cage: Get Android Universal Root by B-PUAF		Hanqin Ling, Yutao LuPangu Team
AI-Based Generation of Adversarial Malicious ELF Samples		Heyi WuSecurity Researcher
Fake it till you make it: Bypassing V8 Sandbox by constructing a fake Isolate		Jaewon Min, Kaan EzderBinary Gecko
An insider perspective on the offensive industry		Luca TodescoDataflow Security
Pishi: Coverage-Guided Fuzzing of the XNU Kernel and Arbitrary KEXT		Meysam FirouziSecurity Researcher
A New Era of macOS Sandbox Escapes: Diving into an Overlooked Attack Surface and Uncovering 10+ New Vulnerabilities		Mickey JinSecurity Researcher
VMware Workstation: Escaping via a New Route - Virtual Bluetooth		Nguyễn Hoàng ThạchSTAR Labs
GPUAF : Two ways of rooting All Qualcomm based Android phones		Pan Zhenpeng & Jheng Bing JhongSTAR Labs
Uncovering Multitenancy Issues in AI-as-a-Service Providers		Sagi TzadikWiz
WebAssembly Is All You Need: Exploiting Chrome and the V8 Sandbox 10+ times with WASM		Seunghyun LeeCarnegie Mellon University
A Single Transaction to Rule Them All: Attacking Blockchain Validators		Zhaofeng ChenCertiK

02

Training

2 courses

Practical Fuzzing: A Hands-On Learning Experience for Uncovering Vulnerabilities on Linux and Windows Platforms		Hardik ShahVehere
Modern Malware Evasion Techniques: Red and Blue Team Perspectives		Silvio La Porta & Antonio VillaniRETooling

03

Sponsors

Diamond
Party Sponsor	Day 1 Day 2
Gold
Silver