Talk/Event Schedule

Friday

Friday - 00:00 PDT

Friday - 01:00 PDT

Friday - 02:00 PDT

Friday - 03:00 PDT

Friday - 04:00 PDT

Friday - 05:00 PDT

Friday - 06:00 PDT

Friday - 07:00 PDT

Friday - 08:00 PDT

Friday - 09:00 PDT

Friday - 10:00 PDT

Friday - 11:00 PDT

Friday - 12:00 PDT

Friday - 13:00 PDT

Friday - 14:00 PDT

Friday - 15:00 PDT

Friday - 16:00 PDT

Friday - 17:00 PDT

Friday - 18:00 PDT

Friday - 19:00 PDT

Friday - 20:00 PDT

Friday - 21:00 PDT

Friday - 22:00 PDT

Friday - 23:00 PDT

Talk/Event Descriptions

HRV - Friday - 11:00-11:30 PDT

For more information, see https://hamvillage.org/dc29.html

Twitch: https://www.twitch.tv/hamradiovillage

#hrv-presentation-text: https://discord.com/channels/708208267699945503/736674835413073991

BHV - Friday - 13:00-13:30 PDT

Shannon has a background in data science, strategy, and mission integration. Prior to joining Booz Allen, she supported NASA’s science and human space flight mission directorates for close to a decade. After NASA, she took a 5-year academic hiatus to conduct research in consumer decision making using econometrics, predictive modeling, and experimental methods.

Shannon has three degrees from the University of Maryland, College Park, including a Ph.D. in business information systems from the Robert H. Smith School of Business; a master’s degree in information management from the College of Information Studies; and a bachelor’s degree in mathematics and philosophy.

YouTube: https://www.youtube.com/channel/UCm1Kas76P64rs2s1LUA6s2Q

AVV - Friday - 17:45-19:59 PDT

Q&A sessions will happen in DEF CON Official Discord server after each talk.

YouTube: https://www.youtube.com/channel/UCOhn9WALnpb5YAbW18R1Hzg

Twitch: https://twitch.tv/adversaryvillage

Discord: https://discord.gg/defcon

IOTV - Friday - 11:45-12:30 PDT

Twitch: https://www.twitch.tv/iotvillage

DC - Friday - 11:00-11:45 PDT

His experience involves research on Windows and embedded devices

His main interest is focused on Windows vulnerability research, reverse engineering and APT research.

His recent discoveries are vulnerabilities in the Windows Spooler mechansim and a research on the most persistent Iranian APT campaign. He is a contributor to Mitre Attack framework and a Speaker at BlackHat, Defcon and Sector conferences.

We decided to go back in time to 2016 to search for patterns and automatically classify all the public vulnerabilities since then. We believed that only by connecting the dots to a bigger picture, we will be able to come back 2021 with the success of achieving our goal.

We adopted a new approach, in terms of both the goal and how to get there. Until now, the main goal of patch-diff was focused on the root cause of the vulnerability and building a 1-day to exploit it Usually patch-diff was done manually on a single patch.

We reached higher for the holy grail. We understood that in order to find 0-days we needed to build an automated process that would gather all the insights from all the patches in a single, searchable db.

It worked! We discovered the root causes of multiple classes of vulnerabilities. We used these discoveries on a fully patched Windows 10 host in order to highlight opportunities for exploitation. As a consequence, we found and reported (1) 6 information disclosure vulnerabilities to Microsoft, (2) 2 post exploitation techniques allowing covert exfiltration of private user data, and (3) an additional surprise.

In this presentation, we'll describe our research process, demonstrate a live exploitation of the vulnerabilities we found, share the tools we developed, and explain how other researchers can use it to discover 0-days.

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=VxNi5pVDZU0

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Tomer%20Bar%20Eran%20Segal%20-%202021%20-%20Our%20Journey%20Back%20To%20The%20Future%20Of%20Windows%20Vulnerabilities%20and%20the%200-days%20we%20brought%20back%20with%20us.mp4

This talk has also been pre-recorded and will be broadcast on DCTV2, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_two

IOTV - Friday - 13:30-14:15 PDT

Twitch: https://www.twitch.tv/iotvillage

VMV - Friday - 11:00-11:30 PDT

Twitch: https://www.twitch.tv/votingvillagedc

YouTube: https://www.youtube.com/channel/UCnDevqsxt3sO8chqS5MGvwg

VMV - Friday - 12:00-12:10 PDT

He holds a master’s degree in journalism from the University of Missouri and degrees in history and mathematics from Fairfield University. He is on the advisory board of the University of Georgia journalism school’s Cox Institute for Media Innovation and is a mentor/editor at the Op-Ed Project.

Twitch: https://www.twitch.tv/votingvillagedc

YouTube: https://www.youtube.com/channel/UCnDevqsxt3sO8chqS5MGvwg

HHV - Friday - 13:30-14:30 PDT

#hhv-challenge-text https://discord.com/channels/708208267699945503/739567199647301702

Twitch: https://twitch.tv/dchhv

Twitch: https://www.twitch.tv/dchhv

BTV - Friday - 16:45-17:15 PDT

A SIEM is pivotal to a Threat Detection and Incident Response function. But, commercial SIEMs are expensive both in terms of cost of usage and maintenance, and risk a vendor lock-in. At Cloudflare, we build a SIEM to manage logs from 200+ data centers, 2000s endpoints and our corporate networks. The SIEM is built using a Serverless architecture in GCP that scales up and down based on usage, for a true pay-as-you-go model. It provides multiple data processing and analyzing paradigms that enable various D&R workflows. In this talk, we will discuss the motivation, constraints and the SIEM architecture. We’ll also dive into our logging pipeline, detection, automation and notification workflows using this SIEM.

--

Twitch: https://twitch.tv/blueteamvillage

ASV - Friday - 09:00-17:59 PDT

Day 1: Aug. 6th, 2021 9:00AM – 6:00PM PDT (UTC-7) Day 2: Aug. 7th, 2021 9:00AM – 6:00PM PDT (UTC-7)

Registration available at https://aisac.cyberskyline.com/defcon

Aviation ISAC is hosting a competition at DC29 Aerospace Village! This competition represents a simulated airport hosted on the Cyber Skyline platform and is developed by the Department of Cyber Intelligence and Security at Embry-Riddle Aeronautical University (Prescott) and Matthew E. Luallen, Chief Executive Inventor at CybatiWorks powered by IntelliGenesis. The ethical design of the competition is achieved through investigative themes that provides a focus in blue team while still offering red team aspects.

Storyline for CTF: On 8/6, an employee from ERAU Airline noticed a USB stick inside one of their kiosks. After further investigation, airport security suspects someone is carrying out an attack against the airport. You have been brought in to retrace the steps of the attackers, determine where security needs to be hardened, regain control of compromised systems, and prevent a successful attack at the airport. Identify the criminals by retracing their steps and utilizing OSINT to identify which suspects need to be arrested. Investigators have not ruled out insider threats which means you must remain undetected by airport staff while you attempt to regain control of the airport’s infrastructure. Good Luck and remember to register ahead of time!

CybatiWorks part of the CTF Stage 7: Runway Lighting System: The Runway Lighting System (RLS) was taken over by the attackers and the lights are operating erratically. Identify what the attackers have changed causing the RLS HMI systems to work improperly and regain access to the remote logic controller operating the runway lights. Update the logic on the HMI system, regain control of the remote logic controller and successfully operate the RLS.

Architecture Design: The competitors are provided with a CybatiWorks custom docker image that they use to gain access to the operator and maintenance HMI logic. The competitors will review and update the logic to match the documentation provided in stage 4. Once the local components are successfully completed the competitors will request access to the remote RLS logic controller (i.e. a Raspberry PI with a 3d printed/LED runway lighting system accessible via a VPN). The competitors will complete additional challenges to confirm the logic program and then remotely control the RLS. All remote RLS stations will be visible

SOC - Friday - 13:00-23:59 PDT

IOTV - Friday - 15:30-16:15 PDT

Twitch: https://www.twitch.tv/iotvillage

DC - Friday - 15:00-15:45 PDT

Over the years Rotem has gained experience in a diversity of industries from the financial services, to insurance, through high-tech & the automotive industry, along with other complex environments.

In the last couple of years Rotem has been working in concept design and development, pen testing and working with hardware in Cymotive, which is a company that focuses on end to end cyber security for the automotive industry, and after that he served as an application security expert at AppsFlyer.

Today Rotem is the Head of Marketplace Integrations at Cider Security, that is focusing on revolutionizing CI/CD security.

During his free time, Rotem plays with robotics, bug-bounty and and enjoys traveling with his family.

Scanning the code occurs on developers' machines and in CI/CD pipelines, which assumes the code is untrusted and unverified and based on this assumption scanners shouldn't have the ability to dynamically run code.

Our research focuses on the many static analyzers out there if this is really the case. Many of the scanners allow different ways of interaction - From requesting external resources, overriding the configuration and to remote code execution as part of the process.This talk will be technical and show examples of well-known scanning tools and how we created code that attacks them.

TLDR -
When integrating and using new tools in our CI systems and especially when running on unverified code, Which tools can we trust and how can we scan safe untrusted code in a secure way?

REFERENCES

https://github.com/jonase/kibit/issues/235 - Issue I raised in the past in one of the tools

Hiroki Suezawa in a thread in cloud security forum talked about exploiting terraform plan https://cloudsecurityforum.slack.com/archives/CNJKBFXMH/p1584035704035800

This reference was released after I've started my research but nevertheless a good resource and has interesting perspectives and I will reference it: https://alex.kaskaso.li/post/terraform-plan-rce

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=Jl-CU6G4Ofc

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Rotem%20Bar%20-%20Abusing%20SAST%20tools%20When%20scanners%20do%20more%20than%20just%20scanning.mp4

This talk has also been pre-recorded and will be broadcast on DCTV2, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_two

ASV - Friday - 10:00-15:59 PDT

BTV - Friday - 14:15-15:15 PDT

One of the major problems with our justice system is how the power dynamics work when one side of a legal dispute has resources and the other does not. This plays out in digital forensics too. Most of our work never ends up in court and is rarely challenged. While most of us are honest, there is far more work that needs to be done and not enough qualified people doing it. In short, not every analyst is qualified or experienced but their testimony is accepted unquestioned.

This talk will cover cases that were performed pro bono for clients who would not normally have access to an expert to challenge the government’s experts. Cautionary tales of bad analysis will be shown to emphasize the importance of sound forensic techniques and the risks of sloppy work.

The talk will end with a call to action for more professionals to contribute their time on similar pro bono efforts.

--

Twitch: https://twitch.tv/blueteamvillage

AVV - Friday - 12:15-12:59 PDT

Prior to creating TrustedSec, David was a Chief Security Officer (CSO) for Diebold Incorporated, a Fortune 1000 company. As a forward thinker in the security field, David has had the privilege of speaking at some of the nation’s largest conferences, including Microsoft’s BlueHat, DEF CON, Black Hat, and DerbyCon, which he co-created in 2011 and expanded into DerbyCon Communities.

Q&A sessions will happen in DEF CON Official Discord server after each talk.

YouTube: https://www.youtube.com/channel/UCOhn9WALnpb5YAbW18R1Hzg

Twitch: https://twitch.tv/adversaryvillage

Discord: https://discord.gg/defcon

AVV - Friday - 12:00-12:15 PDT

Q&A sessions will happen in DEF CON Official Discord server after each talk.

YouTube: https://www.youtube.com/channel/UCOhn9WALnpb5YAbW18R1Hzg

Twitch: https://twitch.tv/adversaryvillage

Discord: https://discord.gg/defcon

AIV - Friday - 14:30-14:59 PDT

Speakers will be made available on DEF CON's Discord, in #aiv-general-text.

Twitch: https://www.twitch.tv/aivillage

YouTube: https://www.youtube.com/c/aivillage

#aiv-general-text: https://discord.com/channels/708208267699945503/732733090568339536

ASV - Friday - 11:30-12:59 PDT

For more information, please see https://aerospacevillage.org/events/upcoming-events/def-con-29/aiaa-cubesat-hacking-workshop/

ASV - Friday - 14:00-15:59 PDT

For more information, please see https://aerospacevillage.org/events/upcoming-events/def-con-29/aiaa-cubesat-hacking-workshop/

ASV - Friday - 10:00-11:30 PDT

For more information, please see https://aerospacevillage.org/events/upcoming-events/def-con-29/aiaa-cubesat-hacking-workshop/

HTSV - Friday - 13:00-13:55 PDT

Twitch: https://www.twitch.tv/h4ckthesea

YouTube: https://www.youtube.com/channel/UC5htD_rPiP8N7v8VQKyJkOQ

HTSV - Friday - 10:00-11:50 PDT

Twitch: https://www.twitch.tv/h4ckthesea

YouTube: https://www.youtube.com/channel/UC5htD_rPiP8N7v8VQKyJkOQ

DL - Friday - 10:00-11:50 PDT

Short Abstract: AIS Tools is a suite of Perl-based scripts to create, capture, interpret, and play NMEA 0183 Automatic Identification System (AIS) messages.

Short Developer Bio: Gary Kessler, Ph.D., CISSP is a principal consultant at Fathom5, a retired professor of cybersecurity, and co-author of "Maritime Cybersecurity: A Guide for Leaders and Managers." He is a past speaker at DEFCON, where he has presented on AIS cybersecurity vulnerabilities and an encryption-based demonstration-of-capability method to mitigate some of those vulnerabilities. Gary's background is in mathematics and computer science, and he has spent several decades teaching about network protocols, data communications, digital forensics, and information security. He holds a leadership position in USCG Auxiliary cybersecurity efforts, is a Master SCUBA Diver Trainer, and holds a 50GT captain license.

URL to any additional information:
https://www.garykessler.net/library/ais_pi.html https://www.garykessler.net/software/AIS_README.TXT https://gpsd.gitlab.io/gpsd/AIVDM.html
https://github.com/trendmicro/ais/

Detailed Explanation of Tool:
AIS Tools is a suite of Perl scripts that allow a user to customize and parse National Marine Electronics Association (NMEA) 0183 standard AIS messages (seen in over-the-air broadcasts per ITU Recommendation M.1371). It is conceptually based upon the TrendMicro AIS Blacktoolkit, but is an extension intended for research and development purposes by incorporating more message types and standard default values.

The suite includes the following programs and functions: AIS_menu: Allows the user to create a custom NMEA 0183 AIS message by entering parameters specific to a requested message type. (At this time, the tools supports 22 of the 27 message types.) The output of the program is a properly formatted command line with all appropriate switches for the AIS_ping program. AIS_ping: AIS_ping allows a user to define an AIS message that will be properly formatted but could, in fact, contain invalid parameter values (a la hping3). The output is a binary string representing the AIS message. The binary string could be directed to a radio transmission (using Blacktoolkit software for GNU Radio) or formatted into one or more AIS sentences using AIS_NMEA. AIS_NMEA: This program accepts an AIS message binary string and produces a set of one or more AIS sentences. AIS_parser: Decodes an NMEA binary string or AIS sentence, displaying the contents field by field. parser2html: Produces HTML formatting of parsed messages. timestamp_data: Capture live AIS data from over-the-air transmissions and store the sentences in a file with a timestamp. play_ais: Replay timestamped AIS data from a file. This is code that was used for research and development purposes, gathering input from, and directing output to, OpenCPN. Data can also be received and broadcast via software-defined radio.

More detail can be found in https://www.garykessler.net/software/AIS_README.TXT

Supporting Files, Code, etc: https://www.garykessler.net/software/index.html#ais

Target Audience:
Defense, students, researchers, product developers (but, like any good tool, can be used for offense)

This tool is specifically directed at those interested in maritime cybersecurity, particularly with respect to navigation systems, but applies to anyone interested in a deep understanding of the AIS protocol as observed in over-the-air transmissions. It will aid researchers in capturing and analyzing AIS data, and designing scenarios with which to prepare exercises and test products.

#dl-video1-voice: https://discord.com/channels/708208267699945503/734027693250576505

AIV - Friday - 12:00-12:30 PDT

Speakers will be made available on DEF CON's Discord, in #aiv-general-text.

Twitch: https://www.twitch.tv/aivillage

YouTube: https://www.youtube.com/c/aivillage

#aiv-general-text: https://discord.com/channels/708208267699945503/732733090568339536

WS - Friday - 10:00-13:59 PDT

Registration Link: https://www.eventbrite.com/e/analysis-101-and-102-for-the-incident-responder-las-vegas-3-4-tickets-162216976343

Prerequisites

None

Materials needed:
Laptop with Wireshark installed

ASV - Friday - 10:00-15:59 PDT

ICSV - Friday - 15:00-15:30 PDT

YouTube: https://www.youtube.com/channel/UCI_GT2-OMrsqqglv0JijHhw

#ics-speaker-questions-and-answers-text: https://discord.com/channels/708208267699945503/735937961908109485

APV - Friday - 17:30-17:35 PDT

YouTube: https://www.youtube.com/c/appsecvillage

APV - Friday - 11:00-10:59 PDT

YouTube: https://www.youtube.com/c/appsecvillage

VMV - Friday - 12:30-12:59 PDT

Twitch: https://www.twitch.tv/votingvillagedc

YouTube: https://www.youtube.com/channel/UCnDevqsxt3sO8chqS5MGvwg

LPV - Friday - 13:00-13:20 PDT

Twitch: https://www.twitch.tv/toool_us?

YouTube: https://youtube.com/c/TOOOL-US

ASV - Friday - 10:00-15:59 PDT

BHV - Friday - 13:30-14:30 PDT

YouTube: https://www.youtube.com/channel/UCm1Kas76P64rs2s1LUA6s2Q

PYV - Friday - 10:00-10:59 PDT

--

Twitch: https://www.twitch.tv/paymentvillage

YouTube: https://www.youtube.com/c/PaymentVillage

BTV - Friday - 09:30-10:59 PDT

This talk will go over the introduction of red/purple teaming, along with how individuals can emulate adversary actions, as well as track those actions across their enterprise, evaluating their detection coverage.

We'll first go over how a tool like Prelude Operator can be used to emulate these adversary actions, then learn how Security Onion can be leveraged to detect these actions and track our coverage across the MITRE attack framework.

Throughout the discussion the following tools will be introduced:

Prelude Operator - autonomous red-teaming platform, creating adversaries to test detection Zeek - Policy-neutral NIDS
Suricata - Signature-based NIDS
Stenographer – Full Packet capture
Playbook - Detection development
ATT&CK Navigator - Track detection coverage Strelka - File analysis
Osquery - Host-based monitoring
Wazuh - HIDS

CLV - Friday - 12:05-12:50 PDT

In this talk, I will be sharing techniques and attack vectors to exploit and compromise Terraform environments in engagements, as well as patterns that I have seen that achieve successful infrastructure takeover against companies. I will be also covering prevention methods for the discussed attack vectors in my talk. This is part of my work-in-progress research in cloud security and attacking modern environments.

YouTube: https://www.youtube.com/cloudvillage_dc

PYV - Friday - 12:00-12:59 PDT

--

Twitch: https://www.twitch.tv/paymentvillage

YouTube: https://www.youtube.com/c/PaymentVillage

SOC - Friday - 14:00-15:59 PDT

BADASS is going to be from 2 PM PDT til 4 PM PDT on Discord in Fireside Lounge for a video discussion.

Fireside Lounge: https://discord.com/channels/708208267699945503/738141986476916826

BCV - Friday - 11:30-11:59 PDT

ICSV - Friday - 13:00-13:30 PDT

YouTube: https://www.youtube.com/channel/UCI_GT2-OMrsqqglv0JijHhw

#ics-speaker-questions-and-answers-text: https://discord.com/channels/708208267699945503/735937961908109485

CON - Friday - 10:00-13:59 PDT

BHV - Friday - 10:00-10:45 PDT

Lets talk about the strides we, as a village and a community, have made in one year.

YouTube: https://www.youtube.com/channel/UCm1Kas76P64rs2s1LUA6s2Q

IOTV - Friday - 10:00-18:30 PDT

CON - Friday - 12:00-17:59 PDT

BCV - Friday - 14:00-14:30 PDT

IOTV - Friday - 14:30-15:15 PDT

These devices frequently self-provision services which leak critical data or through insecure network design and installation practices which are easily mapped, attacked, and discovered via insecure vendor, software, and integrator practices (ex. PKI, Dynamic DNS, “Finder” service registrations, DNS leakage, Layer 2 Attacks / DHCP network attacks, DNS passive hijacking through domain purchases & active record injection)

Some concepts and new attacks may be obliquely referenced or held private by the researcher. Essential PoC is contained in this document and is easily reproduced using supplied narrative and screenshots.

The affected devices are easily discoverable either through insecure practices (ex. insecure Zones, algorithmic FQDN generation, lack of local network controls, public metadata leakage) or vendor provided interfaces and access methods. (DATTOWEB, DATTOLOCAL, SYNOLOGY.ME, DYNAMIC-M, GVDIP.COM, EGNYTE-APPLIANCE.COM)

Many issues develop due to these problems. For example, nearly all of these devices and appliances provide easily discoverable portals / content / metadata with which to craft extremely convincing social engineering campaigns, even in the absence of technical exploit vectors.

Host Header Attacks & 302 redirects used in concert with malicious DNS records / spoofed or squatted domains can be abused in this manner. An attacker can identify the MERAKI device a victim uses through registration, abuse the API to obtain sensitive metadata, and send the victim to a spoofed site or malicious content purported to be a Meraki Dashboard alert. An attacker can change the dynamic DNS record through a number of vectors (ex. Third party service attacks, local vectors) and effectively “hijack” the user or content being accessed.

Through our DNS harvesting and our undisclosed 0-days, we can establish a complex exploit network and botnet via poor vendor controls (ex. MIRAI) We can also hide exploit code in APIs, persist across multiple appliance types, and abuse multiple dynamic DNS networks.

The DNS zones we have provided are intentionally designed, demonstrably insecure, provide detailed information, and can be abused easily. Registrations can be abused for data exfiltration or beaconing over the vendor’s DNS network. These DYNAMIC DNS services allow for efficient, mass exploitation and recon. The poor controls and “spoofability” of these networks (will demonstrate at another time) allow an attacker to not only FIND vulnerable devices.. but automate mass exploitation via attacks such as those we provided or other common attacks.

The author wishes for this to be noted as responsible disclosure and ethical considerations for the attacks / exploits seriously impacted disclosure dates and continues to.

Some initial work can be found here:

https://cybir.com/2021/cyber-security/bluemonday-series-part-1-exploitation-mapping-of-vulnerable-devices-at-scale-through-self-registration-services/

Twitch: https://www.twitch.tv/iotvillage

CHV - Friday - 14:00-14:59 PDT

This talk will stream on YouTube.

YouTube: https://www.youtube.com/watch?v=5-JM1QRGUYc

DC - Friday - 16:00-16:45 PDT

In this presentation we’ll dig deep into the bowels of macOS to uncover the root cause of the bug: a subtle logic flaw in the complex and undocumented policy subsystem. Moreover, we’ll highlight the discovery of malware exploiting this bug as an 0day, reversing Apple’s patch, and discuss novel methods of both detection and prevention.

REFERENCES

“All Your Macs Are Belong To Us” https://objective-see.com/blog/blog_0x64.html “macOS Gatekeeper Bypass (2021 Edition)” https://cedowens.medium.com/macos-gatekeeper-bypass-2021-edition-5256a2955508 “Shlayer Malware Abusing Gatekeeper Bypass On Macos” https://www.jamf.com/blog/shlayer-malware-abusing-gatekeeper-bypass-on-macos/

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=raSTgFqYaoc

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Patrick%20Wardle%20-%20Bundles%20of%20Joy%20-%20Breaking%20macOS%20via%20Subverted%20Applications%20Bundles.mp4

This talk has also been pre-recorded and will be broadcast on DCTV2, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_two

CON - Friday - 10:00-23:55 PDT

BCV - Friday - 13:00-13:59 PDT

Nadir Akhtar is a Blockchain Security engineer at Coinbase, where he leads security reviews of assets under consideration for Coinbase listing. Previously at Quantstamp, he audited smart contracts and contributed to a book on smart contract security fundamentals. He graduated from UC Berkeley in 2019 with a degree in Computer Science. During his time in Blockchain at Berkeley, he was President and an instructor for the UC Berkeley-endorsed blockchain fundamentals edX course series, reaching over 225,000 enrolled students to date.

In this talk, you’ll learn about Polkadot’s reaping mechanism and its implications for exchanges and other organizations managing DOT at scale. We’ll dive into the “Existential Deposit,” understanding its motivation for existing in the network as well as the implications of pruning account data below a certain threshold, namely replay attacks.

We’ll discover how replay attacks can be performed, as well as their consequences through a demonstration along with some protocol-level mitigations. We’ll discuss how naively reaping accounts can still expose exchanges to attacks, investigate potential but infeasible mitigations, then finally reveal the solution which Coinbase discovered for protection against replay attacks.

Finally, we’ll examine some final edge cases which arose from the final solution, demonstrating that protecting against attacks may not be perfect but significantly improves our defenses.

DC - Friday - 11:00-11:59 PDT

In this talk, we will show you the advantage and beauty of the IPC logic bugs, how we rule all Apple platforms, Intel and Apple Silicon alike, even with all the latest hardware mitigations enabled, without changing one line of code. We would talk about the security features introduced by Apple M1, like Pointer Authentication Code (PAC), System Integrity, and Data Protection. How did they make exploiting much harder to provide better security and protect user's privacy. We will talk about different IPC mechanisms like Mach Message, XPC, and NSXPC. They are widely used on Apple platforms which could be abused to break the well designed security boundaries.

We will walk you through some incredibly fun logic bugs we have discovered, share the stories behind them and methods of finding them, and also talk about how to exploit these logic bugs to achieve privilege escalation.

REFERENCES

https://www.youtube.com/watch?v=Kh6sEcdGruU https://support.apple.com/en-us/HT211931 https://support.apple.com/en-us/HT211850 https://support.apple.com/en-us/HT212011 https://support.apple.com/en-us/HT212317 https://helpx.adobe.com/security/products/acrobat/apsb20-24.html https://helpx.adobe.com/security/products/acrobat/apsb20-48.html https://helpx.adobe.com/security/products/acrobat/apsb20-67.html

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=oAMZxKsZQp0

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Zhipeng%20Huo%20Yuebin%20Sun%20Chuanda%20Ding%20-%20Caught%20you%20-%20reveal%20and%20exploit%20IPC%20logic%20bugs%20inside%20Apple.mp4

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_three

DC - Friday - 09:00-20:59 PDT

There will be chill music playing:

09:00-12:00 DJ Pi & Darren
12:00-12:40 s1gns of l1fe
12:40-14:20 Mixmaster Morris
14:30-17:00 kampf
17:00-18:30 Merin MC
18:30-21:00 djdead

You can also watch the chill room stream on Twitch.

Twitch: https://www.twitch.tv/defcon_chill

CLV - Friday - 07:00-12:15 PDT

CLV - Friday - 11:00-12:15 PDT

CON - Friday - 10:00-15:59 PDT

CON - Friday - 00:00-23:59 PDT

ASV - Friday - 15:30-15:55 PDT

This talk will be streamed on YouTube: https://www.youtube.com/watch?v=6nxlqh-m3Jc

YouTube: https://www.youtube.com/c/AerospaceVillage

APV - Friday - 09:05-09:59 PDT

YouTube: https://www.youtube.com/c/appsecvillage

CHV - Friday - 12:00-12:59 PDT

This talk will stream on YouTube.

YouTube: https://www.youtube.com/watch?v=RzcpZODAJE0

DC - Friday - 10:00-10:59 PDT

For virtual access, register here: https://us02web.zoom.us/meeting/register/tZcvd-yqpzkqE9bzjZeppc0bGmvkYjHnwQZN

DC - Friday - 15:30-16:30 PDT

Register here: https://us02web.zoom.us/meeting/register/tZAqdO2tqT0tGdRR1k_xro6MUseFIxMUAuGf

DC - Friday - 11:30-12:30 PDT

For virtual access, register here: https://us02web.zoom.us/meeting/register/tZEqf-igrDIrG92o-NpocyyBPIMNfVEONXn7

DC - Friday - 16:00-16:59 PDT

For virtual access, register here: https://us02web.zoom.us/meeting/register/tZUvduytqTwsGN2k75CDTSCl23o0QDiqbkDn

DC - Friday - 11:30-12:30 PDT

Register here: https://us02web.zoom.us/meeting/register/tZYkcumtqzsqGtzGz8976GzrMPoM3e6FEi1j

DC - Friday - 14:30-15:30 PDT

For virtual access, register here: https://us02web.zoom.us/meeting/register/tZAtfuqsrDgiH9y3ifQhU0Pg3bewc--OFyJ3

ICSV - Friday - 14:00-14:59 PDT

YouTube: https://www.youtube.com/channel/UCI_GT2-OMrsqqglv0JijHhw

#ics-speaker-questions-and-answers-text: https://discord.com/channels/708208267699945503/735937961908109485

ASV - Friday - 14:30-14:55 PDT

We construct a realistic threat model for CPDLC and introduce attacks on the underlying protocol, taking advantage of automated components of the system to make attacks which are difficult for human operators to detect. We also propose a number of improvements to CPDLC to mitigate these threats.

This talk will be streamed on YouTube: https://www.youtube.com/watch?v=cl_56FUk8ps

YouTube: https://www.youtube.com/c/AerospaceVillage

APV - Friday - 12:00-12:45 PDT

YouTube: https://www.youtube.com/c/appsecvillage

CON - Friday - 09:00-15:59 PDT

DDV - Friday - 10:00-16:59 PDT

Pick your drives full of data anytime 14-24 hours after drop off.

Last chance pickup is Sunday from 10:00 to 11:00.

Yes, 6TB and larger drives are accepted.

Any drives not picked up by Sunday at 11:00am are considered donated to the DDV.

See https://dcddv.org/dc29-schedule for more information.

ASV - Friday - 10:00-15:59 PDT

CON - Friday - 10:00-19:59 PDT

CON - Friday - 06:00-11:59 PDT

DC - Friday - 08:00-16:59 PDT

1st you will pass through the vaccination check line, providing whatever original documentation your health care provider or vaccination center gave you. It will be checked against your State issued ID to make sure the names match, the dates are good, and that enough time has passed for you to be fully vaccinated, etc. We will not record your ID or records. If all is good you will get a WRISTBAND you must wear during the con.

2nd Next you head to the badge pickup desks. There you will show your wristband and your in-person badge bar code and get it scanned. If the scan passes you get your Human reg pack.

Where to register / pick up badges: Paris, near the InfoBooth. Please find "REGISTRATION" on the provided DC29 floorplan (available in HackerTracker and online).

Both registration and the vaccine check processing functions are planning to be available from 8am/08:00 to 5pm/17:00. If those times change, this schedule entry will be updated in HackerTracker and info.defcon.org as soon as possible.

DC - Friday - 20:00-21:59 PDT

CON - Friday - 10:00-11:59 PDT

Also see #ce-defcon-scavenger-hunt-text

#ce-defcon-scavenger-hunt-text: https://discord.com/channels/708208267699945503/711049278163779605/872883588461367366

DC - Friday - 16:00-16:59 PDT

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_one

IOTV - Friday - 17:30-18:15 PDT

Twitch: https://www.twitch.tv/iotvillage

AVV - Friday - 16:45-17:45 PDT

If you are interested in building your own C2 framework, contributing to existing frameworks, or even software development in general, there’s something in this talk for you.

Q&A sessions will happen in DEF CON Official Discord server after each talk.

YouTube: https://www.youtube.com/channel/UCOhn9WALnpb5YAbW18R1Hzg

Twitch: https://twitch.tv/adversaryvillage

Discord: https://discord.gg/defcon

CLV - Friday - 10:15-10:59 PDT

YouTube: https://www.youtube.com/cloudvillage_dc

ASV - Friday - 15:00-15:25 PDT

This talk will be streamed on YouTube: https://www.youtube.com/watch?v=WXuT-e-Zs80

YouTube: https://www.youtube.com/c/AerospaceVillage

APV - Friday - 16:00-16:59 PDT

YouTube: https://www.youtube.com/c/appsecvillage

DC - Friday - 12:00-12:59 PDT

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_one

HRV - Friday - 14:00-14:30 PDT

For more information, see https://hamvillage.org/dc29.html

Twitch: https://www.twitch.tv/hamradiovillage

#hrv-presentation-text: https://discord.com/channels/708208267699945503/736674835413073991

DC - Friday - 17:00-18:59 PDT

This talk has been released to the DEF CON Media server.

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Christian%20quaddi%20Dameff%20MD%20Jeff%20r3plicant%20Tully%20MD%20Jessica%20Wilkerson%20Josh%20Corman%20-%20Do%20No%20harm-%20Health%20Panel.mp4

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_one

ICSV - Friday - 12:30-12:59 PDT

YouTube: https://www.youtube.com/channel/UCI_GT2-OMrsqqglv0JijHhw

#ics-speaker-questions-and-answers-text: https://discord.com/channels/708208267699945503/735937961908109485

DC - Friday - 12:00-12:20 PDT

The easiest way to remotely reach a user's Kindle is through an e-book. A malicious book can be published and made available for free access in any virtual library, including the Kindle Store, or sent directly to the end-user device via Amazon services. While you might not be happy with the writing in a particular book, nobody expects to download one that is malicious. No such scenarios have been publicized. Antiviruses do not have signatures for e-books. But... we succeeded in making a malicious book for you. If you open this book on a Kindle device, it causes a hidden piece of code to be executed with root rights. From this moment on, you lost your e-reader, account and more.

Want to know the details?

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=1jM_r-pe8Ss

Media

(Main Talk) https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Slava%20Makkaveev%20-%20Do%20you%20like%20to%20read-%20I%20know%20how%20to%20take%20over%20your%20Kindle%20with%20an%20e-book.mp4

(Demo)
https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Slava%20Makkaveev%20-%20Do%20you%20like%20to%20read-%20I%20know%20how%20to%20take%20over%20your%20Kindle%20with%20an%20e-book%20-%20Demo.mp4

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_three

BCV - Friday - 16:30-17:30 PDT

ASV - Friday - 14:00-14:25 PDT

This talk will be streamed on YouTube: https://www.youtube.com/watch?v=eiO7F5isPE8

YouTube: https://www.youtube.com/c/AerospaceVillage

LPV - Friday - 15:00-15:30 PDT

Twitch: https://www.twitch.tv/toool_us?

YouTube: https://youtube.com/c/TOOOL-US

DC - Friday - 13:00-13:59 PDT

Over the past few years, many vendors have started using eBPF to speed up their services or introduce innovative features. Cilium, Calico, Cloudflare, Netflix and Facebook are leading the charge, showing off new complex networking use cases on a monthly basis. On the security side of things, Google recently contributed the Kernel Runtime Security Instrumentation which opens the door to writing Linux Security Modules with eBPF.

In other words, eBPF is the new kid in town and a growing number of companies are running services with eBPF access in production. This leads us to a simple question: how bad can things get if one of those services were to be compromised ? This talk will cover how we leveraged eBPF to implement a full blown rootkit with all the features you would expect: various obfuscation techniques, command and control with remote and persistent access, data theft and exfiltration techniques, Runtime Application Self-Protection evasion techniques, and finally two original container breakout techniques.

Simply put, our goal is to demonstrate that rogue kernel modules might have finally found a worthy opponent. We will also detail how to detect such attacks and protect your infrastructure from them, while safely enjoying the exciting capabilities that eBPF has to offer.

REFERENCES

Bibliography and documentation links cited in the submission:

1. Russian GRU 85th GTsSS deploys previously undisclosed drovorub malware, NSA / FBI, August 2020 https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF
2. Kprobe-based Event Tracing, https://www.kernel.org/doc/html/latest/trace/kprobetrace.html
3. Linux Kernel tracepoints, https://www.kernel.org/doc/html/latest/trace/tracepoints.html
4. “bpf_probe_write_user” bpf helper, https://elixir.bootlin.com/linux/v5.11.11/source/include/uapi/linux/bpf.h#L1472
5. Uprobe-based Event Tracing, https://www.kernel.org/doc/html/latest/trace/uprobetracer.html
6. Cilium’s XDP documentation, https://docs.cilium.io/en/latest/bpf/#xdp

Previous eBPF related talks & projects that helped us build the rootkit:

7. Evil eBPF In-Depth: Practical Abuses of an In-Kernel Bytecode Runtime, Jeff Dileo, DEF CON 27, https://www.defcon.org/html/defcon-27/dc-27-speakers.html#Dileo 8. Process level network security monitoring and enforcement with eBPF, Guillaume Fournier, https://www.sstic.org/2020/presentation/process_level_network_security_monitoring_and_enforcement_with_ebpf/

9. Runtime Security with eBPF, Sylvain Afchain, Sylvain Baubeau, Guillaume Fournier, https://www.sstic.org/2021/presentation/runtime_security_with_ebpf/ 10. Monitoring and protecting SSH sessions with eBPF, Guillaume Fournier, https://www.sstic.org/2021/presentation/monitoring_and_protecting_ssh_sessions_with_ebpf/

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=5zixNDolLrg

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Guillaume%20Fournier%20Sylvain%20Afchain%20Sylvain%20Baubeau%20-%20eBPF%2C%20I%20thought%20we%20were%20friends.mp4

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_three

CON - Friday - 17:00-19:59 PDT

This event will be streamed to Twitch with chat in Discord.

Twitch: https://www.twitch.tv/efflive

#ce-eff-tech-trivia-text: https://discord.com/channels/708208267699945503/711644552573747350/

DL - Friday - 14:00-15:50 PDT

Short Abstract (What is your tool, what does it do?): Empire is a Command and Control (C2) framework powered by Python 3 that supports Windows, Linux, and macOS exploitation. It leverages many widely used offensive security tools through PowerShell, Python 3, and C# agents. At the same time, it offers cryptologically-secure communications and flexible modular architecture that links Advanced Persistent Threats (APTs) Tactics, Techniques, and Procedures (TTPs) through the MITRE ATT&CK database.

Empire has evolved significantly since its introduction in 2015 and has become one of the most widely used open-source C2 platforms. Through this time, Empire has advanced from a single user experience to allowing multiple user operations through an API with Empire acting as a teamserver. Currently, 2 different applications are available to connect to the Empire teamserver: Empire Command Line Interface (CLI) and Starkiller.

The Empire CLI is built from the ground up as a replacement to the embedded legacy CLI and gives users a familiar feel of the legacy CLI, but is portable and connects through the Empire API. While Starkiller is a cross-platform UI available in Linux, Windows, and macOS powered by ElectronJS.

The framework's flexibility to easily incorporate new modules allows for a single solution for red team operations with the aim for Empire to provide an easy-to-use platform for emulating APTs. Customization is essential to any successful red team operation, which has driven the expansion of user plugins. These plugins allow any custom program to run side-by-side with the Empire teamserver. In addition, the commonality between other C2 platforms allows profiles and modules to be easily dropped in without the need for additional development. These features allow both red and blue teams to easily emulate and defend against the APT attack vectors.

Short Developer Bio:
Vincent "Vinnybod" Rose is the Lead Tool Developer for Empire and Starkiller. He is a software engineer with expertise in cloud service and has over a decade of software development and networking experience. Recently, his focus has been on building ad-serving technologies, web and ad-tracking applications. Vinnybod has presented at Black Hat has taught courses at DEF CON on Red Teaming and Offensive PowerShell. He currently maintains a cybersecurity blog focused on offensive security at https://www.bc-security.org/blog/.

Anthony "Cx01N" Rose, CISSP, is the Lead Security Researcher at BC Security, where he specializes in adversary tactic emulation planning, Red and Blue Team operations, and embedded systems security. He has presented at numerous security conferences, including Black Hat, DEF CON, and RSA conferences. Cx01N is the author of various offensive security tools, including Empire and Starkiller, which he actively develops and maintains. He is recognized for his work, revealing wide-spread vulnerabilities in Bluetooth devices and is the co-author of a cybersecurity blog at https://www.bc-security.org/blog/.

URL to any additional information:
Blogs about new Empire and Starkiller features: https://www.bc-security.org/post/emp...tarkiller-1-6/ https://www.bc-security.org/post/return-of-the-cli/ https://www.bc-security.org/post/emp...e-c2-profiles/ https://www.bc-security.org/post/an-...to-starkiller/ Video walk through of new features:
https://www.youtube.com/watch?v=v4nzXCHGzUA https://www.youtube.com/watch?v=CzZmzBIVJHA Detailed Explanation of Tool:
Empire has been a well-established versatile Command and Control (C2) framework for many years. Our work has allowed better adoption by red teams and shifts the focus of the platform to threat emulation. Threat emulation has been enhanced by leveraging a MITRE ATT&CK framework-based database. Every module is tagged with the MITRE ATT&CK techniques that most closely relate to the objectives of that tool and allows operators to search through the database to find and use tools that meet their specific threat emulation plan. This is combined with the new Empire server/client architecture, which has 2 different applications to connect through Starkiller and Empire Command Line Interface (CLI), allowing for multi-user distributed operations. Starkiller is a cross-platform UI available in Linux, Windows, and macOS for interacting with the Empire post-exploitation framework. This application allows red teams to share any instance of Empire and support remote, multi-operator engagements for instant collaboration and efficient event tracking. Each user is tracked in a database, which can be queried to evaluate team progression and generate post-engagement reports. Within a few minutes, a red-teamer can set up a listener (call back server) on Empire, get a target (agent) calling back to that server, and send payloads to it. Not only that, but multiple users can be working with those same agents, 3rd party modules, and listeners. There is no need to duplicate effort in establishing independent red team infrastructures when a common interface can now be used with the enhanced Empire API. When viewing an agent in the interface, we can get live updates of tasks queued to it, which users set that task, and the results.

The Empire CLI is built from the ground up as a replacement to the embedded legacy CLI that was packaged with Empire. This adaption allows users to continue to run an interface that gives the look and feel of the legacy CLI, but is portable and connects through the Empire API. While building this, we looked for areas to improve and constructed it using Python Prompt Toolkit, which gives users a streamlined look with drop-down menus, interactive shell, and multiple user support. While many of these new improvements are still in their early stages, we believe that the new construct for Empire will drive a significant change in how teams use the tool in the future.

Supporting Files, Code, etc:
https://github.com/BC-SECURITY/Empire
https://github.com/BC-SECURITY/Empire-Cli https://github.com/BC-SECURITY/Starkiller

Target Audience:
Offense

These updates bring Empire into parity with some of the top paid Offense tool kits allowing students to gain exposure to how advanced TTPs and teaming workflows are utilized in offensive engagements.

We picked up the project back in August 2019. We actually were teaching a workshop using Empire and were contacted by Kali if we would be interested in publishing our Python 3 copy around November that year. They were wanting to drop Python 2 support but didn’t want to lose older tools. And we have been pushing updates ever since.

What we have done so far?
We designed an API that supports multiple users at once and collaboration within the c2. Added over 30 new tools within the framework, including socks proxy, Rubeus, and seatbelt. Added a graphical user interface, Starkiller. Threat emulation is a big thing that we are pushing for, so we went through at tagged every tool with a MITRE ATT&CK technique which links back to the source material and descriptions of the attack. We also added a cross-compatibility ability that uses Cobalt Strikes malleable C2 profiles to create malleable listeners in Empire.

Where are we going?
Empire 4.0, which is our current version in development. This is nearly a complete rewrite of the project and almost a new C2. The project now uses a server/client architecture that aligns itself with modern C2s, such as Cobalt Strike, PoshC2, and Silent Trinity.

We added C implants with on-the-fly compilation using Roslyn Compiler. This ability is something that everyone has been asking about for a while since most advanced frameworks support some flavor of C implants. We wanted to implement this in a way that allows us to have cross-compatibility with Covenant’s tools but still maintain Empire’s agent capabilities and formatting. What we ended up with is the capability to run C implants that can compile their modules and use all the PowerShell tools as well. Another advantage of this is that PowerShell agents can compile c tools on the fly as well.

Visually, we completely redid the CLI to be streamlined and includes new features like dropdown menus, server chatrooms, and suggested values.

We redesigned the plugin functionality within Empire and significantly expanded its capabilities. Plugins are a lesser-known ability which allows user to specially craft tools that can enhance the framework's capabilities. This is similar to how cobalt strike uses aggressor scripts to expand its capabilities.

ASV - Friday - 12:30-12:55 PDT

This talk will be streamed on YouTube: https://www.youtube.com/watch?v=QtM47OmprfQ

YouTube: https://www.youtube.com/c/AerospaceVillage

AVV - Friday - 15:45-16:45 PDT

In the past, he worked for many government organisms such as Ministry of Security, Federal Revenue Administration, Ministry of Health, Ministry of Economy, Ministry of Production and both SecBSD & FreeBSD Projects.

Q&A sessions will happen in DEF CON Official Discord server after each talk.

YouTube: https://www.youtube.com/channel/UCOhn9WALnpb5YAbW18R1Hzg

Twitch: https://twitch.tv/adversaryvillage

Discord: https://discord.gg/defcon

AVV - Friday - 14:45-15:45 PDT

Q&A sessions will happen in DEF CON Official Discord server after each talk.

YouTube: https://www.youtube.com/channel/UCOhn9WALnpb5YAbW18R1Hzg

Twitch: https://twitch.tv/adversaryvillage

Discord: https://discord.gg/defcon

CLV - Friday - 11:45-12:05 PDT

YouTube: https://www.youtube.com/cloudvillage_dc

CAHV - Friday - 12:00-12:59 PDT

This talk will be available on YouTube: https://www.youtube.com/watch?v=F6I6O-3LCUc

YouTube: https://youtube.com/careerhackingvillage

RCV - Friday - 14:00-14:30 PDT

YouTube: https://www.youtube.com/c/ReconVillage

BTV - Friday - 13:30-13:59 PDT

Today we are embracing the benefits and advantages of having cloud storage in most environments especially now when everyone is working work from home and data transmits from one place to another by the use of cloud storage services such as one drive, box, dropbox & google drive. There are a couple of artifacts on the endpoint side that gives us the ability to see the bigger picture when these cloud services are being used to perform data exfiltration and any malicious actions. In short, cloud storage data can be more accessible on the local device and can contain files and metadata distinctly different than the current cloud repository. I'm going to show how to perform data acquisition on these cloud storage applications installed in endpoint and what are those metadata and evidence that we can extract from the forensics standpoint.

--

Twitch: https://twitch.tv/blueteamvillage

SOC - Friday - 12:00-12:59 PDT

SOC - Friday - 17:00-17:59 PDT

CHV - Friday - 13:00-13:59 PDT

This talk will stream on YouTube.

YouTube: https://www.youtube.com/watch?v=8LI19B5lmk8

AVV - Friday - 13:45-14:45 PDT

THE SESSION CONTAINS:

Getting Domain Admin through Azure AD Connect Getting Domain Admin through Azure AD Connect Cloud Sync (new offering) Bypass Azure AD authentication & MFA
Azure reconnaissance with AzureHound

Q&A sessions will happen in DEF CON Official Discord server after each talk.

YouTube: https://www.youtube.com/channel/UCOhn9WALnpb5YAbW18R1Hzg

Twitch: https://twitch.tv/adversaryvillage

Discord: https://discord.gg/defcon

CCV - Friday - 11:00-11:30 PDT

The Cryptocurrency Village is conveniently located in Paris Champagne Ballroom 1.

DC - Friday - 10:00-10:45 PDT

His blogs can be found here: https://medium.com/@cedowens His tools can be found here: https://github.com/cedowens

--

This talk has been released to the DEF CON Media server.

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Cedric%20Owens%20-%20Gone%20Apple%20Pickin%20-%20Red%20Teaming%20macOS%20Environments%20in%202021.mp4

This talk has also been pre-recorded and will be broadcast on DCTV2, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_two

SOC - Friday - 21:00-01:59 PDT

VMV - Friday - 13:00-13:30 PDT

Byrum has previously served on Michigan’s Election Security Commission, the Secretary of State’s team of advisors tasked with strengthening and better securing elections in the state. Byrum has been a consistent advocate for the voting rights of qualified registered voters, with a focus on voting rights of military and overseas voters. Byrum serves on the Overseas Voting Initiative, which is a joint effort by the Federal Voting Assistance Program and Council of State Governments. As a member of the Initiative, Byrum met with military service members in San Diego, California in March 2019, Puerto Rico in December of 2019 and continues to have military and overseas voters’ interests in mind, when advocating for increased access to the ballot.

Byrum graduated from Michigan State University with a Bachelor of Science degree in agribusiness management. She also holds a law degree from the MSU College of Law.

Byrum previously served three terms as a Michigan State Representative. During her time in the Legislature, Byrum served as the ranking Democrat on the House Committee on Redistricting and Elections.

We must fight back against disinformation and the misinformation relating to our elections and those that would seek to speak fear and lies. We must pledge to push back on those lies and that disinformation in the media and online at every opportunity. We must work together on our elections to make sure that they are safe and secure as they can possibly be. Together, we can hack the conspiracies and take back our democracy.

Twitch: https://www.twitch.tv/votingvillagedc

YouTube: https://www.youtube.com/channel/UCnDevqsxt3sO8chqS5MGvwg

ASV - Friday - 10:30-11:20 PDT

This talk will be streamed on YouTube: https://www.youtube.com/watch?v=G3YA5Sa5Wbs

YouTube: https://www.youtube.com/c/AerospaceVillage

ASV - Friday - 10:00-15:59 PDT

For virtual attendees, the Digital twin demonstration will also be accessible via VNC to an instance running inside Docker containers in Amazon AWS (remote viewers will need to have a VNC client on their own computer).

CON - Friday - 10:00-15:59 PDT

More info: https://hack3rrunway.github.io/

https://twitter.com/hack3rrunway

Also see #ce-hack3r-runway.

Register here: https://docs.google.com/forms/d/e/1FAIpQLSdua561gCbWEbGk7_ZuS7cg3w7_IFbtrahibeKsU0iR%20ENiIiw/viewform?usp=sf_link

#ce-hack3r-runway: https://discord.com/channels/708208267699945503/711644666239647824

CON - Friday - 20:00-21:59 PDT

This event will be held VIRTUALLY ONLY, on Twitch. Discussion will be held in #ce-hacker-jeopardy-text.

Twitch: https://www.twitch.tv/DFIUtv

Twitter: https://twitter.com/HackerJeopardy

#ce-hacker-jeopardy-text: https://discord.com/channels/708208267699945503/732439600391389184/

SOC - Friday - 18:00-23:59 PDT

DC - Friday - 14:00-14:45 PDT

REFERENCES

1. T. Karras, S. Laine, and T. Aila, “A Style-Based Generator Architecture for Generative Adversarial Networks,” arXiv:1812.04948 [cs.NE], 2019.
2. S. Gehrmann, H. Strobelt, and A. M. Rush, “GLTR: Statistical Detection and Visualization of Generated Text,” arXiv:1906.04043 [cs.CL], 2019.
3. G. Jawahar, M. Abdul-Mageed, and L. V. S. Lakshmanan, “Automatic Detection of Machine Generated Text: A Critical Survey,” arXiv:2011.01314 [cs.CL], 2020.
4. J. Seymour and P. Tully, “Weaponizing Data Science for Social Engineering: Automated E2E Spear Phishing on Twitter,” 2016.
5. P. Tully and F. Lee, “Repurposing Neural Networks to Generate Synthetic Media for Information Operations,” 2020.
6. OpenAI, “OpenAI Charter,” OpenAI, 09-Apr-2018. [Online]. Available: https://openai.com/charter/.
7. G. Brockman, M. Murati, and P. Welinder, “OpenAI API,” OpenAI, 11-Jun-2020. [Online]. Available: https://openai.com/blog/openai-api/.
8. A. Pilipiszyn, “GPT-3 Powers the Next Generation of Apps,” OpenAI, 25-Mar-2021. [Online]. Available: https://openai.com/blog/gpt-3-apps/.

Would like to thank contributing author Timothy Lee Timothy is a security researcher who likes to break things and tries to understand how the system works during the process. In the past year, he is researching with iOS security and is starting his journey on iOS vulnerability research. Additionally, he has contributed to red team social engineering operations and security tooling, with practical experience in vishing and in-person social engineering. https://www.linkedin.com/in/timothylee0/

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=tWWhRbzhkrg

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Eugene%20Lim%20Glenice%20Tan%20Tan%20Kee%20Hock%20-%20Hacking%20Humans%20with%20AI%20as%20a%20Service.mp4

This talk has also been pre-recorded and will be broadcast on DCTV2, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_two

VMV - Friday - 10:30-10:59 PDT

Eddie has a wealth of expertise in election systems design, implementation, security, usability, and standards. A veteran of the commercial election technology industry, he formerly served as director of product management for one of the three major voting systems vendors in the U.S. Now, Eddie utilizes his skills to drive open source voting technology design, as well as federal and state certification for open source technologies, and voter education initiatives.

Eddie is a regular contributor to media outlets from MSNBC news to Fox News, including The Washington Post, Associated Press, and POLITICO, to name a few. He is also an NBC News contributing elections analyst on topics of technology, practices, security, and public policy.

Eddie speaks to policy leaders on election technology and administration, and has given testimony to several agencies and government bodies including the U.S. Election Assistance Commission and The National Conference of State Legislatures.

Eddie is co-inventor of two U.S. patents in voting technology.

Edward is on Twitter at @eddieperezTX with contributions via @OSET and @TrustTheVote

Time to panic? No, it’s time to roll up our sleeves!

Where others might despair, we see a golden opportunity! At no other time in our history have so many Americans of all political stripes been so focused on election integrity. We want security-minded, tech-savvy people of all genders, races, creeds, and political stripes to step up. And if we’re going to lower the temperature and bolster public confidence in election integrity, it’s critical to understand how elections are actually run, and how election technology is used. Election administration is a complex profession limited by law, policy, and specific practices.

Whether you’re new to election security, or an experienced practitioner, this presentation is a snapshot of the operating environment for election technology. Our goal is to help you learn what to anticipate, and how best to apply your technology skills in defense of democracy. Together, we can enhance election integrity and help to ensure that accurate information gets widely shared, and misinformation does not.

Twitch: https://www.twitch.tv/votingvillagedc

YouTube: https://www.youtube.com/channel/UCnDevqsxt3sO8chqS5MGvwg

CAHV - Friday - 13:00-13:59 PDT

This talk will be available on YouTube: https://www.youtube.com/watch?v=T4r2ZpEUjJs

YouTube: https://youtube.com/careerhackingvillage

ASV - Friday - 10:00-15:59 PDT

HRV - Friday - 09:00-15:59 PDT

Register here: https://ham.study/sessions/60fa3250a6684b06a0c6f327/1

HHV - Friday - 10:00-10:30 PDT

We misuse the trust the operating system places on USB human-interaction devices to demonstrate once again the old adage that if you can physically access a computing device, there is no real security to be had. I will review hardware, its capabilities, how to breach OS security, and how attackers can enable it to perform a variety of tasks with its own tools. I will then show how to build and install additional software and customize the device with binary or scripted payloads.

We take the discussion to the next level by removing the need for a device and exploring attacks that can be delivered directly by a plain USB cable. We dissect easily-sourced, low-cost hardware implants embedded in standard, innocent-looking USB cables providing an attacker with further capabilities, including among them the ability to track its own geolocation.

#hhv-talk-qa-hw-hacking-101-text https://discord.com/channels/708208267699945503/709255105479704636

Twitch: https://twitch.tv/dchhv

Twitch: https://www.twitch.tv/dchhv

CCV - Friday - 14:00-14:59 PDT

The Cryptocurrency Village is conveniently located in Paris Champagne Ballroom 1.

BHV - Friday - 15:30-15:59 PDT

YouTube: https://www.youtube.com/channel/UCm1Kas76P64rs2s1LUA6s2Q

ASV - Friday - 16:00-16:25 PDT

This talk will be streamed on YouTube: https://www.youtube.com/watch?v=2FTSGCAG3EE

YouTube: https://www.youtube.com/c/AerospaceVillage

WS - Friday - 10:00-13:59 PDT

This workshop is for learning heap exploit development in GLibC Malloc. GLibC Malloc is the default allocator on most Linux distros. With this hands-on introduction into GLibC Malloc heap exploitation you will learn how the allocator functions, heap specific vulnerability classes and to pwn with a variety of techniques. Whether you're an avid CTFer or just trying to get into heap exploitation on your pwnables site, this course is good for adding another tool to the tools arsenal. After taking this course you will understand the GLibC Malloc allocator, be able to discover heap specific vulnerability classes and pwn the heap with a variety of techniques, with the capability to easily learn more.

Registration Link: https://www.eventbrite.com/e/house-of-heap-exploitation-las-vegas-5-6-tickets-162214679473

Prerequisites

Basic computer science background (x86_64 assembly, stack, programming skills in C & Python) Basic binary exploitation skills (buffer overflow exploitation, ROP, ASLR, etc.) Familiar with Linux developer tools such as the command line, Python scripting and GDB. Previous usage of pwntools is a plus

Materials needed:
Laptop with enough power for a moderately sized Linux VM Administrative access to the laptop 8GB RAM minimum 50GB harddrive space Virtualbox or another virtualization platform installed

CPV - Friday - 11:30-12:30 PDT

Twitch: https://www.twitch.tv/cryptovillage

YouTube: https://www.youtube.com/c/CryptoVillage

DC - Friday - 18:00-18:59 PDT

Now, we can control many important websites and affect millions of users. Let's make things more interesting. We found that this fastjson vulnerability affect a multi-billion-dollar blockchain. We designed multiple complex gadgets based on the features of the blockchain, and exquisitely achieved information leakage and pointer hijacking. Putting all these gadgets together, we achieved remote code execution on the blockchain nodes.

However, generally after remote code execution, we seem to have no better exploit method other than the 51% attack, which will lead to serious accounting confusion. After a detailed analysis of the architecture design of the public blockchain, we found a way from RCE to steal the public blockchain users' assets almost without any notification.

To the best of our knowledge, this is the first published attack case on the realization of covertly stealing user assets after RCE on the public blockchain nodes. We will propose a more covert post penetration exploit method for public blockchain nodes in this talk.

Blockchain is not bulletproof to security vulnerability. We will show you how to use classical web vulnerabilities attack the blockchain and how to steal real money from the decentralized cyber world.

REFERENCES

1. https://github.com/threedr3am/gadgetinspector 2. https://github.com/JackOfMostTrades/gadgetinspector 3. http://i.blackhat.com/us-18/Thu-August-9/us-18-Haken-Automated-Discovery-of-Deserialization-Gadget-Chains.pdf 4. http://i.blackhat.com/eu-19/Thursday/eu-19-Zhang-New-Exploit-Technique-In-Java-Deserialization-Attack.pdf 5. https://asm.ow2.io/asm4-guide.pdf

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=pUexrXOGCkE

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Hao%20Xing%20Zekai%20Wu%20-%20How%20I%20use%20a%20JSON%20Deserialization%200day%20to%20Steal%20Your%20Money%20On%20The%20Blockchain.mp4

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_three

DC - Friday - 10:00-10:59 PDT

I'll show you how these flaws enable HTTP/2-exclusive desync attacks, with case studies targeting high-profile websites powered by servers ranging from Amazon's Application Load Balancer to WAFs, CDNs, and bespoke stacks by big tech. I'll demonstrate critical impact by hijacking thick clients, poisoning caches, and stealing plaintext passwords to net multiple max-bounties.

After that, I'll unveil novel techniques and tooling to crack open a widespread but overlooked request smuggling variant affecting both HTTP/1 and HTTP/2 that is typically mistaken for a false positive.

Finally, I'll drop multiple exploit-primitives that resurrect a largely-forgotten class of vulnerability, and use HTTP/2 to expose fresh application-layer attack surface.

I'll leave you with an open-source scanner, a custom, open-source HTTP/2 stack, and free interactive labs so you can hone your new skills on live systems.

REFERENCES

The HTTP/2 RFC is essential reading: https://tools.ietf.org/html/rfc7540 This research is built on my previous work on this topic: https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn This presentation by defparam has good explanations of response queue poisoning and self-desync attacks: https://www.youtube.com/watch?v=3tpnuzFLU8g I had a partial research collision with Emil Lerner. His work provides an alternative perspective on certain techniques: https://github.com/neex/http2smugl

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=rHxVVeM9R-M

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20James%20Kettle%20-%20HTTP2%20-%20The%20Sequel%20is%20Always%20Worse.mp4

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_three

PHV - Friday - 12:00-13:59 PDT

CLV - Friday - 13:20-14:05 PDT

YouTube: https://www.youtube.com/cloudvillage_dc

AIV - Friday - 15:00-15:30 PDT

Speakers will be made available on DEF CON's Discord, in #aiv-general-text.

Twitch: https://www.twitch.tv/aivillage

YouTube: https://www.youtube.com/c/aivillage

#aiv-general-text: https://discord.com/channels/708208267699945503/732733090568339536

HTSV - Friday - 14:00-15:50 PDT

Twitch: https://www.twitch.tv/h4ckthesea

YouTube: https://www.youtube.com/channel/UC5htD_rPiP8N7v8VQKyJkOQ

WS - Friday - 10:00-13:59 PDT

Registration Link: https://www.eventbrite.com/e/inspecting-signals-from-satellites-to-shock-collars-tickets-162215666425

Prerequisites

Students are expected to have basic familiarity with the Linux command line.

Materials needed:
Students will need to bring a wifi-enabled laptop with a modern browser.

PHV - Friday - 10:00-10:59 PDT

YouTube: https://youtube.com/wallofsheep

Twitch: https://twitch.tv/wallofsheep

Facebook: https://www.facebook.com/wallofsheep/

Periscope: https://www.periscope.tv/wallofsheep

LPV - Friday - 10:00-10:30 PDT

Twitch: https://www.twitch.tv/toool_us?

YouTube: https://youtube.com/c/TOOOL-US

LPV - Friday - 12:00-12:30 PDT

Twitch: https://www.twitch.tv/toool_us?

YouTube: https://youtube.com/c/TOOOL-US

LPV - Friday - 14:15-14:45 PDT

Twitch: https://www.twitch.tv/toool_us?

YouTube: https://youtube.com/c/TOOOL-US

LPV - Friday - 16:15-16:45 PDT

Twitch: https://www.twitch.tv/toool_us?

YouTube: https://youtube.com/c/TOOOL-US

AIV - Friday - 09:30-10:59 PDT

Speakers will be made available on DEF CON's Discord, in #aiv-general-text.

Twitch: https://www.twitch.tv/aivillage

YouTube: https://www.youtube.com/c/aivillage

#aiv-general-text: https://discord.com/channels/708208267699945503/732733090568339536

IOTV - Friday - 16:30-17:15 PDT

Twitch: https://www.twitch.tv/iotvillage

IOTV - Friday - 10:00-18:30 PDT

Twitch: https://www.twitch.tv/iotvillage

IOTV - Friday - 10:00-18:30 PDT

Twitch: https://www.twitch.tv/iotvillage

ICSV - Friday - 15:30-15:59 PDT

Dennis has an extensive background in performing security assessments on a variety of industrial control systems. While Dennis was with the National Guard he created a two-week training program for cyber operators to receive special qualifications for missions involving cyber-physical systems. Dennis spent over 10 years performing assessments for the National Guard on critical systems that included building automation systems, electrical utilities, and voting systems. In 2016, Dennis’ work at the Guard contributed to US Secretary of Defense Ash Carter visiting his unit for a briefing on their capabilities and achievements.

YouTube: https://www.youtube.com/channel/UCI_GT2-OMrsqqglv0JijHhw

#ics-speaker-questions-and-answers-text: https://discord.com/channels/708208267699945503/735937961908109485

SEV - Friday - 12:30-13:30 PDT

She specializes in behavioral analysis and in intelligence collection and analysis through open source and human intelligence.

Christina has participated among other things in penetration tests, in trainings to companies and organizations, in vulnerability assessments, and in profiling and analysis of the modus operandi, and in the process of identifying personality traits, behavioral tendencies, and other variables of victims and offenders.

Christina is working with Cyber Risk GmbH as a social engineering specialist and an open source intelligence investigator for the vulnerability assessments conducted on corporations and high-value targets. She is the main developer of the social engineering training programs provided by Cyber Risk GmbH. Those programs are intertwining the lessons learned from real life cases and previous experiences with the fields of cybersecurity, psychology, and counterintelligence.

She is also an active Advisory Board Member at the OSINT Curious project.

The talk covers the topic of information gathering through social media intelligence (SOCMINT), and explains how even seemingly innocent information can be used to manipulate or influence targets. Case studies will be provided.

It will also discuss the art & science of profiling, along with its limitations for social engineering engagements. A two-part demonstration is included on how a profiler’s mind works when harvesting information on social media:

The first part includes real examples of posts that expose vulnerabilities, attract attackers and ultimately can be exploited and lead to security breaches. The second part dives deeper and demonstrates how the information found on a social media profile (from their pictures to the words used by the individual) are gathered, categorized into a profiling matrix and then analyzed, bringing into the surface a personality profile. The target’s profile can then provide actionable intelligence that increases the success of attacks, or attack simulations.

Twitch: https://www.twitch.tv/socialengineerllc

LPV - Friday - 11:00-11:50 PDT

Twitch: https://www.twitch.tv/toool_us?

YouTube: https://youtube.com/c/TOOOL-US

ICSV - Friday - 10:00-10:59 PDT

YouTube: https://www.youtube.com/channel/UCI_GT2-OMrsqqglv0JijHhw

#ics-speaker-questions-and-answers-text: https://discord.com/channels/708208267699945503/735937961908109485

VMV - Friday - 13:30-13:59 PDT

Harri Hursti is considered one of the world’s foremost experts on the topic of electronic voting security, having served in all aspects of the industry sector. He is considered an authority on uncovering critical problems in electronic voting systems worldwide.

As a consultant, he has conducted and co-authored many studies, both academic and commercial, on various election systems’ data security and vulnerability. These studies have come at the request of officials, legislators and policy makers in 5 countries; including the U.S. government, at both the state and federal level.

Twitch: https://www.twitch.tv/votingvillagedc

YouTube: https://www.youtube.com/channel/UCnDevqsxt3sO8chqS5MGvwg

CLV - Friday - 12:50-13:20 PDT

YouTube: https://www.youtube.com/cloudvillage_dc

CLV - Friday - 14:35-16:59 PDT