HEXACON2024 – Caught in the wild, past, present and future by Clem1

Summary: The video discusses the importance of understanding exploits and zero days in the context of Google’s security efforts, highlighting the past experiences from 2010 to present. It shares insights from an exploit hunter at Google’s Threat Analysis Group (TAG), revealing techniques for discovering and analyzing exploits, the ethics involved, and future trends in exploit behavior and technology.

Keypoints:

• Introduction to the speaker’s role in Google’s Threat Analysis Group (TAG) and the focus on exploits.
• Google’s heightened sensitivity towards exploits due to incidents like the 2010 attack by Chinese hackers.
• Insights into how exploits are discovered, including monitoring watering holes and suspicious websites.
• Use of Google’s internal data to identify exploits, such as scanning websites for changes that may indicate a compromise.
• Discussion on finding exploits in public repositories and the significance of monitoring man-in-the-middle attacks.
• Details on exploit delivery mechanisms, including one-time links and client-side fingerprinting techniques.
• Trends in exploit chains, including challenges in finding actual exploits among millions of crashes.
• Real-world examples of detected exploits, particularly those affecting browsers and applications.
• Future outlook on exploits indicating a shift towards partial exploit chains and greater targeting of messaging apps.
• Emphasis on the evolving landscape of security threats and the need for continuous monitoring and adaptation.