Saluti ai partecipanti e agli Sponsor
Fine prevista per le 10:45
The world is changing fast and the capabilities of LLMs continue to increase. Their reliability and precision are likely their main limitation (for now), but with the proper tooling and verification methods, impressive results can be achieved. This talk (tries to) discuss the state of the art and offers insights focused (mostly) on (interesting) software vulnerabilities in (complex) and interesting applications (and maybe hardware/firmware).
Fine prevista per le 11:30
Since May 2026, cases of WhatsApp compromise have been reported both in Italy and in several other countries. Every report shared the same characteristics: an up-to-date WhatsApp application, an outdated iOS version, fraudulent messages requesting money sent to the victim's contacts without ever appearing in the chat on the phone, and a list of linked devices showing no anomalies. Starting from the first report, we began collecting diagnostic logs (sysdiagnose) and full filesystem forensic images in order to investigate the compromise through forensic analysis and answer two questions: what method was used to compromise the devices, and how was WhatsApp manipulated to carry out the fraud? After several weeks of research, we have reached a number of concrete results: based on the analysis of the collected evidence, the WhatsApp compromise appears to be linked to Coruna, a sophisticated malware discovered a few months earlier by researchers at the Google Threat Intelligence Group and iVerify. The outdated iOS versions found on all affected devices are consistent with the exploitation of N-day vulnerabilities rather than zero-days. In this talk we will cover three aspects: the attack chain that led to the compromise of the iOS devices; the inner workings of the WhatsApp module used by Coruna, including the techniques and methodologies the malware employed to hijack the victim's WhatsApp session in order to send fraudulent messages to their contacts; and, finally, a potentially new technique used to clone WhatsApp sessions.
Fine prevista per le 12:15
PDFs - rise, decline, and revival: a journey across how we have changed our way of viewing and editing PDF files by moving from offline clients to online services, and how this is changing the role of PDF files as attack vectors. A talk on how we have moved from local clients (Adobe, etc) to browsers and online services to render, view, edit, and sign PDF files, and how this has changed the role of PDFs in attacks and exploitations. From the false-positive vulnerabilities (CVE-2020-26505, CVE-2023-0108, CVE-2023-5873, and other CVEs that were not vulnerabilities) to vulnerabilities in client-side PDF SDKs. During the talk, we will investigate some cross-site-scripting vulnerabilities exploited in the real world (e.g. bug bounty programs), focusing in particular on PDF.js (CVE-2018-5158, and CVE-2024-4367) and Apryse Webviewer (CVE-2024-4327, and CVE-2024-29359).
Fine prevista per le 13:00
Ci rivediamo tra pochissimo...
Fine prevista per le 14:15
AES-256 should make ransomware-encrypted files practically unrecoverable without the key. But what happens when a subtle implementation mistake reduces the effective recovery problem from 256 bits to just 32? This talk presents an original reverse-engineering investigation of the r543t/ok75 ransomware lineage, observed in samples from 2023 and 2025. By recovering the embedded AutoIt source code and comparing both generations, I reconstructed the ransomware's partial-encryption format, its key-derivation process, and a critical flaw in its use of the Windows CryptoAPI. Although the malware initially derives a valid AES-256 session key, an unexpected interaction between CryptoAPI and the AutoIt encryption wrapper undermines the security of the entire encryption scheme. In the analyzed 32-bit implementations, this mistake reduces the effective recovery search space to at most 2^32 candidates. The presentation will uncover the vulnerable code path, explain the cryptographic consequences, and demonstrate the development of a standalone decryptor. It will also cover candidate-key validation techniques and an alternative recovery path that can eliminate brute force when a ransomware artifact survives. Validated against both ransomware generations, the decryptor successfully recovered encrypted files byte-for-byte, matching their original cryptographic hashes. This case demonstrates how a single API-level mistake can turn apparently strong cryptography into a practical reverse-engineering and recovery problem.
Fine prevista per le 15:15
Bots and crawlers have visited websites for years, using pre-defined algorithms. AI agents visit websites but change how decisions are made: they interpret a user's intent and choose what to do toward a goal. To accommodate this new kind of visitor, the Web Machine Learning Community Group is developing WebMCP. Its draft lets websites expose JavaScript-based tools that agents can discover and invoke through an MCP-like interaction, using the site's existing application logic. If a user asks an agent to buy products from an online store, the agent could find tools to search the catalog, add a product to the cart, and complete the purchase. The site can use the same logic behind its existing pages and form submissions instead of building a second application for agents. The goal of the talk is to analyze how web security changes with AI agents, following Adam Shostack's four threat-modeling questions: What are we building? What can go wrong? What are we going to do about it? Did we do a good enough job? Starting from the WebMCP draft, we draw data flow diagrams for different ways agents can be deployed, identifying the different trust boundaries. We then use STRIDE and Shostack's PHANTOM-B framework for LLMs to elicit threats. We produced a model with 27 threats, some WebMCP-specific and others related to agentic Web navigation more generally. From there, we take the threats back to the specification's WebIDL and algorithms and compare them with Chromium source. Custom AI-assisted skills support this comparison, help us form test hypotheses, build proofs of concept, and trace the path from a threat to code, an experiment, and a candidate remediation. We tested several hypotheses with Chrome 154. Native browser tests showed that revoking cross-origin exposure prevented invocation. In a separate experiment with the non-production GoogleChromeLabs agent extension, a page that controlled its own tool registration changed a tool while consent was pending; approval then invoked the replacement callback. That experiment gives us a concrete question about what the agent's approval binds to when a tool changes. We also consider what deterministic controls can decide and where an agent must judge a tool call against the user's intent. For this second problem, we built a WebMCP-inspired synthetic benchmark of 432 scenarios to explore whether stochastic, guardian-style LLM checks can help. The point is to test the feasibility of that kind of decision, alongside the code-level experiments, and to see which questions still need a response. The last question is also important. WebMCP is a Community Group draft; at this stage of a Web API's development, what is enough security review to influence its design? We will show both what we found and how we reached it, invite feedback from the HackInBo audience and the WebMCP community, and plan to release the AI-assisted skills used in the work by the time of the talk.
Fine prevista per le 16:00
Standard dynamic instrumentation frameworks have become the backbone of mobile vulnerability research. However, as anti-tamper mechanisms evolve, relying on off-the-shelf, high-level tools leaves researchers working inside a detectable black box. To truly understand modern Android process isolation, memory constraints, and evasion techniques, security engineers must understand how to execute these injection mechanics at the bare metal. This presentation dissects the architecture of HILDA, a custom-built, pure C dynamic instrumentation engine and ptrace-based loader designed specifically for modern AArch64 Android environments. Rather than relying on standard framework wrappers or installed APK components, I will demonstrate how to hijack a live Android process entirely from the native layer. We will walk step-by-step through the raw mechanics of native .so injection. The talk will cover the practical challenges of using ptrace on AArch64, including interrupting execution, manipulating CPU registers, and saving/restoring process state. I will detail how HILDA defeats ASLR by parsing virtual memory maps (/proc/pid/maps) and performs manual runtime symbol resolution for linker64 and libart to dynamically locate critical execution points in foreign memory. Furthermore, we will explore navigating SELinux memory protections to allocate executable memory in a remote process. To prove the capability, the session will conclude with a technical breakdown of a live payload execution: using the Python-driven orchestrator to force a target process (running on Android 17 / aarch64) to load a custom shared library (libpayload.so), invoking the Android Runtime (ART) via JNI directly from native space, and calling in-process Java APIs (such as getActiveNotifications()) to extract live, structured data (NDJSON) over an ADB pipeline—all without ever installing a target-facing APK. Attendees will leave with a demystified understanding of Android’s lowest-level execution boundaries, equipping them with the knowledge to build custom, stealthy, architecture-specific instrumentation tooling for advanced offensive research.
Fine prevista per le 16:45
Report e Premiazione Squadre HackInBo® Forensic Games
Fine prevista per le 17:15
Saluti finali
Fine prevista per le 17:30
