Blackhat.2015

Researchers presented data showing that while email phishing detection had improved (thanks to DMARC and user training), voice phishing (vishing) was back. Using automated voice synthesis and publicly available LinkedIn data, hackers could spoof a CEO’s voice to the CFO and wire money instantly.

If you want to understand the cyber threats of today , study the research of . The seeds planted there have finally grown into the forest fire we are fighting now. Keywords: blackhat.2015, Zero-day, Stagefright, Jeep Hack, IoT Security, PowerShell attack, RSA 512-bit, cybersecurity history. blackhat.2015

This article dissects the critical themes, catastrophic zero-days, and legacy of the Black Hat 2015 conference. If there was a single image that defined blackhat.2015 , it was a Jeep Cherokee driving off a cliff—remotely. Charlie Miller and Chris Valasek delivered their long-anticipated sequel to 2014’s "Adventures in Automotive Networks." The Jeep Hack In 2015, the duo demonstrated a remote exploit that required no physical access to the vehicle. Using a cellular connection (Sprint’s network), they exploited the Uconnect system to send CAN bus commands directly to the engine, brakes, and steering wheel. Researchers presented data showing that while email phishing

For the attendees of , the message was clear: Encryption is only as strong as the oldest protocol you support. The Rise of the "Broken Box" (Hacking Hardware) While software grabbed headlines, the Hardware Hacking Village at Black Hat 2015 was standing room only. The Internet of Things (IoT) was exploding, and devices had zero security. The Dropcam Decimation A researcher known as "Birdman" dissected the Dropcam Pro. He found that the device’s "secure" firmware updates were signed with a 512-bit RSA key that was easily factorable. He extracted the private key and demonstrated how to push custom firmware to any Dropcam on the planet. Routerpocalypse Juniper Networks and Cisco took heavy fire. Researchers revealed backdoors and hard-coded credentials in numerous SOHO (Small Office/Home Office) routers. If you thought your edge device was safe because it was "enterprise grade," blackhat.2015 was the bucket of ice water proving otherwise. The Infamous Zero-Days: Stagefright and OLE Two vulnerability sets overshadowed the rest, altering the patch cycles for Google and Microsoft for years. 1. Stagefright (Android) Zimperium researchers dropped a bomb: A vulnerability in Android’s media library (Stagefright) allowed an attacker to compromise an Android phone via a single MMS message. The victim didn't need to click a link or download a file. They just needed to receive a text. The seeds planted there have finally grown into

It moved the threat model from "data theft" to "physical safety." Suddenly, a buffer overflow didn't just leak credit cards; it killed the brakes. The Erosion of the Perimeter By 2015, the cloud was digesting the enterprise. Black Hat that year hammered home one painful truth: The firewall is dead. PowerShell Without Powers One of the most chilling talks came from Matt Graeber, who demonstrated "PowerShell for Offense." He showed that PowerShell could be used to load malware directly into memory without ever touching the disk. Traditional AV was blind to it. This technique—living off the land—became the standard for every APT group post-2015. The SSL/TLS Funeral Several talks targeted the encryption that held the web together. With the discovery of Logjam and the continued exploitation of FREAK (Factoring Attack on RSA-EXPORT Keys), researchers showed that a nation-state could downgrade a "secure" HTTPS connection to 512-bit export-grade crypto in minutes.

The impact was staggering: 950 million devices vulnerable. It forced Google to abandon its "OEM-led" patch model and implement the monthly "Android Security Bulletin" we know today. A talk titled "Windows 10: The Kernel is Calling" demonstrated that Microsoft’s new baby, Windows 10, was shipping with a driver model that allowed attackers to disable anti-malware software if they could get ring-0 access. It was a sobering reminder that even a brand new OS carries the ghost of legacy code. The Social Engineering Evolution Black Hat 2015 wasn't just about bits and bytes. The "Human Factor" track highlighted the rise of "Vishing 2.0."

The term "Whaling" (targeting C-suite executives) entered the common vernacular at this show. In previous years, bug bounties were seen as cheap stunts by startups. In 2015, the scales tipped. Microsoft and Google hosted massive "hack the pentagon" style side events. The atmosphere shifted from "hackers vs. vendors" to "researchers subsidized by vendors."