Uploaded September 2026 | Updated September 2026, 2 weeks ago
I gave my first professional training at Black Hat, and then we were running our Hextree fault injection workshop at DEF CON. In this (long) vlog I take you along my trip to Las Vegas and share what it was actually like. From training preparation and conference events to meeting people at the booth and finally escaping and going home again.
LEARN ON HEXTREE (ad)
Learn hacking on Hextree: hextree.io
Learn more about hardware hacking on Hextree: app.hextree.io/map/hardware-hacking
Join the Hextree Discord: discord.gg/xgQpCQCpvy
Previous Vlogs:
- youtube.com/watch?v=bhQ6FF3fCdA
- youtube.com/watch?v=B8saYocsI-U
- youtube.com/watch?v=RXgp4cDbiq4
CHAPTERS
00:00 - Intro
00:29 - Flying to Las Vegas
03:01 - The Luxor and some Las Vegas impressions
06:55 - Jet lag and preparing for the training
14:05 - Giving our Black Hat fault injection training
23:16 - Moving hotels and preparing for DEF CON
29:55 - Craps and DEF CON parties
34:14 - Running the Hextree fault injection lab at DEF CON
41:14 - The final days at DEF CON
49:17 - One last day in Las Vegas
53:53 - Going home after two exhausting weeks
SUPPORT
Per video: patreon.com/join/liveoverflow
Per month: youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
Buy my handwriting font (ad): shop.liveoverflow.com
WATCH, FOLLOW & READ
Second channel: youtube.com/LiveUnderflow
Twitch: twitch.tv/LiveOverflow
Twitter: twitter.com/LiveOverflow
Instagram: instagram.com/LiveOverflow
TikTok: tiktok.com/@liveoverflow_
LiveOverflow blog: liveoverflow.com
Hextree blog (ad): hextree.io/blog
#BlackHat #DEFCON #LiveOverflow
(ad) LiveOverflow YouTube channel is supported by advertisement and product placement.
I gave my first professional training at Black Hat, and then we were running our Hextree fault injection workshop at DEF CON. In this (long) vlog I take you along my trip to Las Vegas and share what it was actually like. From training preparation and conference events to meeting people at the booth and finally escaping and going home again.
LEARN ON HEXTREE (ad)
Learn hacking on Hextree: hextree.io
Learn more about hardware hacking on Hextree: app.hextree.io/map/hardware-hacking
Join the Hextree Discord: discord.gg/xgQpCQCpvy
Previous Vlogs:
- youtube.com/watch?v=bhQ6FF3fCdA
- youtube.com/watch?v=B8saYocsI-U
- youtube.com/watch?v=RXgp4cDbiq4
CHAPTERS
00:00 - Intro
00:29 - Flying to Las Vegas
03:01 - The Luxor and some Las Vegas impressions
06:55 - Jet lag and preparing for the training
14:05 - Giving our Black Hat fault injection training
23:16 - Moving hotels and preparing for DEF CON
29:55 - Craps and DEF CON parties
34:14 - Running the Hextree fault injection lab at DEF CON
41:14 - The final days at DEF CON
49:17 - One last day in Las Vegas
53:53 - Going home after two exhausting weeks
SUPPORT
Per video: patreon.com/join/liveoverflow
Per month: youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
Buy my handwriting font (ad): shop.liveoverflow.com
WATCH, FOLLOW & READ
Second channel: youtube.com/LiveUnderflow
Twitch: twitch.tv/LiveOverflow
Twitter: twitter.com/LiveOverflow
Instagram: instagram.com/LiveOverflow
TikTok: tiktok.com/@liveoverflow_
LiveOverflow blog: liveoverflow.com
Hextree blog (ad): hextree.io/blog
#BlackHat #DEFCON #LiveOverflow
(ad) LiveOverflow YouTube channel is supported by advertisement and product placement.



![A Vulnerability to Hack The World - CVE-2023-4863
Citizenlab discovered BLASTPASS, a 0day being actively exploited in the image format WebP. Known as CVE-2023-4863 and CVE-2023-41064, an issue in webps build huffman table function can lead to a heap buffer overflow. This vulnerability is very interesting and Im excited to share with you what I learned.
LEARN ON HEXTREE (ad)
Learn hacking on Hextree: https://www.hextree.io/
Join the Hextree Discord: https://discord.gg/xgQpCQCpvy
WebP Fix Commit: https://chromium.googlesource.com/webm/libwebp/+/902bc9190331343b2017211debcec8d2ab87e17a
Citizenlab: https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/
Ben Hawkes: https://blog.isosceles.com/the-webp-0day/
Software Updates
Apple https://support.apple.com/en-gb/106361
Chrome https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html
Firefox https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/
Android https://source.android.com/docs/security/bulletin/2023-10-01
Whose CVE is it Anyway? https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/
References:
2014 bug introduction https://github.com/webmproject/libwebp/commit/f75dfbf23d1df1be52350b1a6fc5cfa6c2194499
https://www.youtube.com/watch?v=JsTptu56GM8
https://www.youtube.com/watch?v=B3y0RsVCyrw
https://www.youtube.com/watch?v=EFUYNoFRHQI
https://www.youtube.com/watch?v=iEm1NRyEe5c
https://stackoverflow.com/questions/13804629/huffman-code-with-lookup-table
https://web.archive.org/web/20230204211844/https://commandlinefanatic.com/cgi-bin/showarticle.cgi?article=art007
enough.c https://github.com/madler/zlib/blob/develop/examples/enough.c
Thanks to:
https://twitter.com/mistymntncop
https://twitter.com/benhawkes
CHAPTERS
00:00 - Intro to CVE-2023-4863
01:32 - Most Valuable Vulnerability?
03:02 - Heap Overflow Related to Huffman Trees
03:58 - Learning about Huffman Codes
06:24 - What are Huffman Tables?
10:24 - Hardcoded Table Sizes (enough.c)
12:21 - Code Walkthrough - BuildHuffmanTable()
13:04 - The code_lengths[] and count[] Arrays
15:14 - Difference Between Compression and Decompression!
17:04 - Outro
SUPPORT
Per video: https://www.patreon.com/join/liveoverflow
Per month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
Buy my handwriting font (ad): https://shop.liveoverflow.com/
WATCH, FOLLOW & READ
Second channel: https://www.youtube.com/LiveUnderflow
Twitch: https://twitch.tv/LiveOverflow/
Twitter: https://twitter.com/LiveOverflow/
Instagram: https://instagram.com/LiveOverflow/
TikTok: https://www.tiktok.com/@liveoverflow_
LiveOverflow blog: https://liveoverflow.com/
Hextree blog (ad): https://www.hextree.io/blog
#BufferOverflow #SecurityResearch #LiveOverflow
(ad) LiveOverflow YouTube channel is supported by advertisement and product placement. A Vulnerability to Hack The World - CVE-2023-4863](https://i.ytimg.com/vi/lAyhKaclsPM/mqdefault.jpg)




![Video Essay about the Security Creator Scene
I wrote an article about the state of the YouTube Hacker Scene for Phrack. I hope you enjoy this reading.
LEARN ON HEXTREE (ad)
Learn hacking on Hextree: https://www.hextree.io/
Join the Hextree Discord: https://discord.gg/xgQpCQCpvy
The article can be read here: http://phrack.org/issues/70/15.html#article
[ Missing parts:
1. Remember the hacking videos without audio using notepad to communicate? Thats definitely a part of the history that should have been included in this article.
[ References:
How SUDO on Linux was HACKED! // CVE-2021-3156
https://youtu.be/TLa2VqcGGEQ?list=PLhixgUqwRTjy0gMuT4C3bmjeZjuNQyqdx
XSS on Google Search - Sanitizing HTML in The Client?
https://www.youtube.com/watch?v=lG7U3fuNw3A
Identify Bootloader main() and find Button Press Handler
https://youtu.be/yJbnsMKkRUs?list=PLhixgUqwRTjyLgF4x-ZLVFL-CRTCrUo03
[0] Lenas Reversing for Newbies (2006) https://web.archive.org/web/20070524043123/http://www.tuts4you.com/download.php?list.17
[1] thebroken by Kevin Rose https://archive.org/details/thebroken_xvid
[2] Hak5 - Episode #1 https://www.youtube.com/watch?v=SUEXCCWMfXg
[3] Notacon 2007 Part 1 https://www.youtube.com/watch?v=HXSZ4PRLUDU
[4] CSAW CTF challenge 2.exe, 3.exe and 4.exe flag retrieval https://www.youtube.com/watch?v Ld1cD9d7tI
[5] Beginner Challenge #1... https://www.youtube.com/watch?v=tdqJ8NEcJUM
[6] Phrack issue #69 - International scenes
[7] https://reddit.com/r/WatchPeopleCode
[8] livectf REDEMPTION by geohot 7/27/2014 https://www.youtube.com/watch?v=td1KEUhlSuk
[9] Lets Hack Livestream - exploit-exercises.com (2015) https://www.youtube.com/watch?v=HBnPY77JtqY
[10] The Heap: dlmalloc unlink() exploit - bin 0x18 https://www.youtube.com/watch?v=HWhzH 89UQ
[11] Hacking Livestream #1: ReRe and EZPZP https://www.youtube.com/watch?v=XWozhb1ZOyM
[12] Life of an Exploit: Fuzzing PDFCrack with AFL for 0days https://www.youtube.com/watch?v=8VLNPIIgKbQ
[13] HackTheBox - Popcorn https://www.youtube.com/watch?v=NMGsnPSm8iw
[14] Live CTF v2: ... https://www.youtube.com/watch?v=D7uXE_lEzxI
[15] SMT in reverse engineering, for dummies https://youtu.be/b92CW-NZ3l0
[16] GoogleCTF - XSS Pasteurize https://youtu.be/voO6wu_58Ew
[17] Hacking into Googles Network for $133337 https://youtu.be/g-JgA1hvJzA
[18] https://support.google.com/youtube/answer/2801964?hl=en
[19] Data breaches, phishing, or malware? Understanding the risks of stolen credentials https://dl.acm.org/doi/abs/10.1145/3133956.3134067
[20] Zero to Hero Pentesting https://youtu.be/qlK174d_uu8?list=PLLKT MCUeiwBa7d7F_vN1GUwz_2TmVQj
[21] How the Apple AirTags were hacked https://youtu.be/_E0PWQvW-14
[22] FuzzOS: Day 1, starting the OS https://youtu.be/2YAgDJTs9So
[23] How We Hacked a TP-Link Router and Took Home $55,000 in Pwn2Own https://www.youtube.com/watch?v=zjafMP7EgEA
[24] https://www.tiktok.com/@malwaretech
[ Chapters:
CHAPTERS
00:00 - Intro
00:21 - 0. About the Author
00:50 - 1. Preamble
02:00 - 2. Before 2014
04:40 - 3. My Start in 2015
08:50 - 4. Todays Scene
15:50 - 5. Final Words
16:39 - Some Thoughts
20:06 - Outro
SUPPORT
Per video: https://www.patreon.com/join/liveoverflow
Per month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
Buy my handwriting font (ad): https://shop.liveoverflow.com/
WATCH, FOLLOW & READ
Second channel: https://www.youtube.com/LiveUnderflow
Twitch: https://twitch.tv/LiveOverflow/
Twitter: https://twitter.com/LiveOverflow/
Instagram: https://instagram.com/LiveOverflow/
TikTok: https://www.tiktok.com/@liveoverflow_
LiveOverflow blog: https://liveoverflow.com/
Hextree blog (ad): https://www.hextree.io/blog
#YouTube #Phrack #LiveOverflow
(ad) LiveOverflow YouTube channel is supported by advertisement and product placement. Video Essay about the Security Creator Scene](https://i.ytimg.com/vi/mDAwSrH4fqU/mqdefault.jpg)

