SquareX to unveil browser, passkey flaws at Black Hat, DEF CON
During Black Hat USA and DEF CON 33, SquareX will reveal a number of architectural vulnerabilities impacting passkey authentication systems, enterprise data loss prevention solutions, and browser extensions. The company's researchers plan to deliver multiple talks that aim to detail new techniques attackers may use to circumvent existing security measures.
Browser-first world
At Black Hat USA, the presentation titled "Browser-Native Security in a Browser First World" will be delivered by Vivek Ramachandran, Founder of SquareX. This talk is expected to cover the growing dependency enterprises have on web browsers and the resulting security challenges.
With staff reportedly spending up to 80% of their device usage time within browsers, defending against browser-based threats has become a critical concern. Ramachandran's talk will highlight current tactics, techniques, and procedures (TTPs) that enable attackers to bypass technologies such as Secure Access Service Edge (SASE), endpoint detection and response (EDR), and endpoint data loss prevention (DLP) tools.
Passkey vulnerabilities
DEF CON 33 will feature Shourya Pratap Singh, Jonathan Lin and Daniel Seetoh presenting research under the session title "Passkeys Pwned: Turning WebAuthn Against Itself." This discussion will focus on a new technique designed to subvert passkey authentication.
Passkeys, which have seen significant uptake among major technology providers such as Apple, Google, and Microsoft, are promoted as a more secure alternative to traditional passwords. Despite this positioning, SquareX's research asserts that vulnerabilities still exist. "Over the past year, we have been releasing bleeding edge research on architectural browser vulnerabilities as part of the Year of Browser Bugs project. We believe that deeply understanding the attacker mindset is the only way to defend against the newest threat vectors, and we believe that it is critical to share these findings at industry leading conferences like Black Hat and DEF CON. This year's research demonstrates critical gaps that traditional security solutions simply cannot address - everything from passkey to browser extension vulnerabilities. We will also be sharing multiple open source browser-native security tools that enterprises need to plug the browser security gap," said Vivek Ramachandran, Founder of SquareX.
Browser extension threats
In addition to the mainstage talks, Nishant Sharma and Shourya Pratap Singh will present "Plug and Prey: Scanning and Scoring Browser Extensions" at Recon Village. Their session introduces ExtHuntr, an open-source tool developed to scan for installed browser extensions, analyse their permissions and behaviour, and generate risk scores. ExtHuntr aims to provide security teams with greater visibility into potential risks posed by browser extensions.
SquareX will also run a demonstration called "Copycat: Identity Stealer Extension" and a session titled "Angry Magpie: DLP Bypass Simulator" at DEF CON 33 Demo Labs, underscoring the firm's focus on practical, real-world attack simulation tools related to browser security.
Cloud security workshop
Nishant Sharma, Head of Security Research at SquareX, is scheduled to conduct a workshop at Cloud Village, titled "Serverless but Not Defenceless: A Security Deep Dive into Cloud Run." The workshop will provide attendees with detailed guidance on how to deploy and manage services on Google Cloud Run securely, using principles drawn from DevSecOps and related practices.
Security field manual
Audrey Adeline, a SquareX researcher, will participate in "The Trailblazer's Guide to Cybersecurity" discussion at Black Hat USA. Topics will include the experiences of professionals who are first-generation entrants to the cybersecurity sector. Adeline will also share information about the release of The Browser Security Field Manual, a book written in collaboration with chief information security officers (CISOs) from Fortune 500 companies and major technology firms. The manual addresses contemporary attacks targeting employees via browsers and provides guidance on defensive techniques.
Event schedule
In addition to the headline talks, SquareX researchers will lead several demonstration sessions and workshops at both Black Hat USA and DEF CON 33. These include practical labs showing browser-based identity theft and DLP bypass scenarios, as well as further engagements focusing on serverless security and browser-native security tools.
The presentations are designed to highlight what SquareX claims are critical gaps in existing security technology, particularly where traditional solutions may not adequately address emerging attack vectors related to browsers, passkeys, and extensions.
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
RNZ News
an hour ago
- RNZ News
Tech Tuesday with Tim Batt: YouTube using AI to check users age
technology media 35 minutes ago Tech giant Google is taking action to verify how old YouTube users are. It says it will use AI to estimate the age of users and then show them age appropriate content. The move comes after Australia confirmed it would ban children under 16 from using YouTube. Tim shares details with Emile.
Otago Daily Times
10 hours ago
- Otago Daily Times
Counting the costs of tariffs
What an arbitrary and unfair world. While New Zealand might not be stung as badly as many others, it is still being penalised by capricious and unjust tariffs. This nation has virtually no tariffs (about 0.8%) on goods from the United States, while US-owned giants like Meta, Microsoft and Google extract billions of dollars through tax avoidance. New Zealand, long a close friend internationally, has been forced to tread carefully around US President Donald Trump. It recently welcomed an FBI office in Wellington and has held back on pledging recognition of Palestinian statehood. Nonetheless, the baseline 10% tariff imposed by the US earlier this year rises to 15%. Why? New Zealand recorded a trade surplus with the United States last year. If food prices had not been high, or if New Zealand had imported a few US aircraft, the balance might have been reversed — and the 10% might have stayed, as it has for Singapore and Australia. However, the US might still have made dismantling Pharmac a condition of a better deal. It is, of course, futile to appease bullies. There are effectively no real negotiations. Mr Trump issues decrees, and only afterwards might there be limited room to move. The might of China may have muscle, especially because of the US debt it holds. Puny New Zealand is simply too small. If there were just a little fairness, New Zealand could also apply 15% to US imports. Nobody, however, is seriously proposing that. New Zealand has staked its reputation and its interests as a trading nation on free trade. It also dares not provoke the Trump tactic of responding with another ratchet of the rack. It says much about the state of play that wily Foreign Minister Winston Peters and others advocated keeping this country's head down. Mr Trump has so many big fish to fry — discussions are continuing with China and the European Union on the trade front alone — this seemed the wisest course. In a flurry of action, New Zealand's head trade official is now off the Washington, and Trade Minister Todd McLay will follow. Unsurprisingly, there is scepticism that this will do much good. Previously, such efforts failed to reduce steel and aluminium tariffs, and tiny New Zealand will struggle to receive much air or ear time at the highest levels. Politically, however, it makes the government look as though it is doing something. Despite Labour's criticism of poor tactics, it is doubtful whether proactive and public lobbying in Washington would have made any difference. The resulting 15% tariff matches that applied to US allies Japan and South Korea and is slightly lower than much of Southeast Asia. However, it is higher than the rate for fellow beef exporters Argentina and Uruguay. The US is also New Zealand's largest wine export market. Wine receipts are expected to suffer, and F&P Healthcare, one of New Zealand's largest companies with manufacturing in Auckland and Mexico, will be disadvantaged as it competes with a major US rival. Exporters were reconciling themselves to 10%, and 15% might not sound excessive. But it represents a 50% increase on the earlier amount and is far harder to absorb. The result will be lower returns for exporters and higher costs for consumers, while the US collects tariff revenue. Trade Minister Todd McLay estimates the tariff cost to exporters at an additional $500 million. Fortunately, this coincides with strong global food demand and prices. Unfortunately, it comes at a time when the New Zealand economy is struggling to recover from prolonged doldrums. Although not catastrophic, it dents confidence and removes another brick as the government tries to rebuild economic growth and salvage its electoral prospects. The US has overtaken Australia as New Zealand's second-largest export market, worth $9 billion last year, though still well behind China. New Zealand will bear the costs of President Trump's disruptive trade policies, both directly through tariffs and indirectly through their dampening effect on US and global growth.
1News
13 hours ago
- 1News
Phones are covered in germs. A tech expert explains how to clean them
We wash our hands, sanitise shopping trolleys and wipe down cafe tables. But what about our phones? We touch these devices dozens of times a day, and take them everywhere from the kitchen to the dining table, and even the bathroom, writes Australian academic and technology expert Meena Jha. Phones can be contaminated with many kinds of potential germs. When was the last time you wiped down yours – and with what? If you use the wrong cleaning agents or tools, you could strip your phone's protective coatings, degrade waterproof seals, or even affect its touch sensitivity. Do phones really need cleaning? Touchscreens get covered in fingerprints and smudges, so there are aesthetic and functional reasons to wipe down your screen. ADVERTISEMENT Another reason comes down to potential health concerns. Whenever mobile phones are swabbed for microorganisms, scientists inevitably find hundreds of species of bacteria and viruses. While not all of these cause sickness, the potential for transmission is there. We use phones while in the bathroom and then put them near our mouths, touch them while eating, and pass them between people in meetings, cafes, parties and classrooms. Unlike hands, which can be washed many times a day, phones are rarely cleaned properly – if at all. If you do want to sanitise your phone, it's also important to not damage it in the process. Some cleaning products will damage your phone (Source: Getty) You might think a quick swipe with a household cleaner or hand sanitiser is a clever shortcut to keeping your phone clean. However, many of these products can actually degrade your device's surface and internal components over time. ADVERTISEMENT For example, both Apple and Samsung advise against using bleach, hydrogen peroxide, vinegar, aerosol sprays, window cleaners or high-concentration alcohol wipes (above 70%) on their devices. Most smartphones are coated with an oleophobic layer – a thin film that helps resist fingerprints and smudges. Harsh chemicals such as alcohols, acetone or ammonia-based cleaners can strip this coating, making your screen more vulnerable to smudging, and diminished touch responsiveness. Vinegar, a common DIY disinfectant, can corrode aluminium or plastic edges due to its high acidity. Bleach and hydrogen peroxide, though highly effective as disinfectants, are also too aggressive for the delicate materials used in consumer electronics. High-alcohol content wipes may dry out plastics and make them brittle with repeated use. In short: if the cleaner is tough enough to disinfect your kitchen bench, it is probably too harsh for your phone. How should I clean my phone then? (Source: Getty) ADVERTISEMENT The good news is that cleaning your phone properly is simple and inexpensive. You just need to follow the guidelines backed by major manufacturers. You should also unplug and remove any protective cases or accessories when cleaning your phone. Most tech companies recommend using 70% isopropyl alcohol wipes (not higher), soft microfibre cloths, and anti-static soft-bristled brushes made of nylon, horsehair or goat hair to clean delicate areas like speaker grills and charging ports. During the Covid pandemic, Apple revised its cleaning guidelines to permit the use of Clorox disinfecting wipes and 70% isopropyl alcohol on iPhones, provided they are used gently to avoid damaging screen coatings or allowing moisture to seep into the device. Samsung offers similar advice, recommending users wipe down their phones with a microfibre cloth lightly dampened with a 70% alcohol solution, while steering clear of direct application to ports and openings. Prevent accidental damage when using these tips (Source: Getty) Never spray liquid directly onto the phone, as moisture can seep into ports and internal components, leading to short circuits or corrosion. ADVERTISEMENT Submerging your phone in any cleaning solution is also risky, even for water-resistant models: the seals that prevent water from getting in, such as rubber gaskets, adhesives, nano-coatings and silicone layers, can degrade over time. Avoid using paper towels, tissues, or rough cloths which may leave scratches on the screen or shed lint that clogs openings. Finally, be cautious about over-cleaning. Excessive wiping or scrubbing can wear down protective coatings, making your phone more susceptible to fingerprints, smudges, and long-term surface damage. How often should I clean my phone? (Source: Getty) While there is no strict rule for how often you should clean your phone, giving it a proper wipe-down at least once a week under normal use would make sense. If you regularly take your phone into high-risk environments such as public transport, hospitals, gyms, or bathrooms it is wise to clean it more frequently. ADVERTISEMENT If you're serious about hygiene, cleaning not just your hands but one of the things you touch most every single day makes sense. Doing it wrong can slowly damage your device. But doing it right is simple, affordable, and doesn't take much time. Meena Jha is the head technology and pedagogy cluster CML-NET at Australia's CQUniversity. This article is republished from The Conversation under a Creative Commons license.
