Talk/Event Schedule


Friday


This Schedule is tentative and may be changed at any time. Check at an Info Booth for the latest.

 

Friday - 00:00 PDT


Return to Index  -  Locations Legend
CON - Coindroids -
MUS - Music - DJ St3rling - DJ St3rling

 

Friday - 01:00 PDT


Return to Index  -  Locations Legend
CON - cont...(00:00-23:59 PDT) - Coindroids -
MUS - Music - Acid T - Acid T

 

Friday - 02:00 PDT


Return to Index  -  Locations Legend
CON - cont...(00:00-23:59 PDT) - Coindroids -

 

Friday - 03:00 PDT


Return to Index  -  Locations Legend
CON - cont...(00:00-23:59 PDT) - Coindroids -

 

Friday - 04:00 PDT


Return to Index  -  Locations Legend
CON - cont...(00:00-23:59 PDT) - Coindroids -

 

Friday - 05:00 PDT


Return to Index  -  Locations Legend
CON - cont...(00:00-23:59 PDT) - Coindroids -

 

Friday - 06:00 PDT


Return to Index  -  Locations Legend
CON - cont...(00:00-23:59 PDT) - Coindroids -
CON - DEF CON Bike Ride -

 

Friday - 07:00 PDT


Return to Index  -  Locations Legend
CLV - Cloud Village CTF - Registration -
CON - cont...(00:00-23:59 PDT) - Coindroids -
CON - cont...(06:00-11:59 PDT) - DEF CON Bike Ride -
ICSV - Tabletop Exercise - GRIMM

 

Friday - 08:00 PDT


Return to Index  -  Locations Legend
CLV - cont...(07:00-12:15 PDT) - Cloud Village CTF - Registration -
CON - cont...(00:00-23:59 PDT) - Coindroids -
CON - cont...(06:00-11:59 PDT) - DEF CON Bike Ride -
DC - DEF CON Human Registration (Badge Pickup) and Vaccine Check Processing Open -

 

Friday - 09:00 PDT


Return to Index  -  Locations Legend
AIV - Welcome. A Short Tour of Good and Bad AI in 2021 - AI Village Organizers
AIV - (09:30-10:59 PDT) - Intro to ML Workshop - Gavin Klondike
APV - AppSec Village Welcome and Introductions
APV - Colorful AppSec - Luis Gomes,Erez Yalon,Pedro Umbelino,Tanya Janca
ASV - Retired but not forgotten – A look at IFEs - Alex Lomas,Phil Eveleigh
ASV - A-ISAC CTF -- Pre-registration Required -
ASV - (09:30-10:20 PDT) - The Antenny Board Design and Fabrication Saga: Sweat and Tears Along the Supply Chain - Ang Cui
BTV - (09:30-10:30 PDT) - Yeet the leet with Osquery (Effective Threathunting Without Breaking Bank ) - Sebastiaan Provost
BTV - (09:30-10:59 PDT) - Attack and Detect with Prelude Operator and Security Onion - Wes Lambert
CLV - cont...(07:00-12:15 PDT) - Cloud Village CTF - Registration -
CON - cont...(00:00-23:59 PDT) - Coindroids -
CON - cont...(06:00-11:59 PDT) - DEF CON Bike Ride -
CON - Darknet-NG -
DC - cont...(08:00-16:59 PDT) - DEF CON Human Registration (Badge Pickup) and Vaccine Check Processing Open -
DC - Chillout Lounges - djdead,DJ Pie & Darren,kampf,Merin MC,s1gns of l1fe,Mixmaster Morris
DC - Welcome to Discord - Dark Tangent
DC - Making the DEF CON 29 Badge - Katie Whiteley,Michael Whiteley
HHV - (09:30-09:59 PDT) - Meetup: Some HHV challenges - rehr
HRV - Ham Radio Exams -
LBV - (09:30-10:30 PDT) - Bypass 101
PHV - Web App Penetration Testing Workshop - Sunny Wear
PHV - The War for Control of DNS Encryption - Paul Vixie

 

Friday - 10:00 PDT


Return to Index  -  Locations Legend
AIV - cont...(09:30-10:59 PDT) - Intro to ML Workshop - Gavin Klondike
APV - Summer of Fuzz: MacOS - Jeremy Brown
ASV - cont...(09:00-17:59 PDT) - A-ISAC CTF -- Pre-registration Required -
ASV - cont...(09:30-10:20 PDT) - The Antenny Board Design and Fabrication Saga: Sweat and Tears Along the Supply Chain - Ang Cui
ASV - AIAA CubeSat Hacking Workshop - World Premier of the videos -
ASV - ARINC 429 Lab -
ASV - Deep Space Networking -
ASV - Hack-A-Sat2 Satellite Platform -
ASV - Antenny -
ASV - HACMS Live Demo -
ASV - Lego Spike Hub -
ASV - ADSB Demo and Paper Airplanes -
ASV - (10:30-11:20 PDT) - Hack-A-Sat 2: The Good, The Bad and the Cyber-Secure - Bryce Kerley,Capt Aaron Bolen,Frank Pound,Steve Wood
BCV - Welcome Note
BCV - (10:15-11:30 PDT) - Key Note
BHV - Biohacking Village Welcome Keynote - Nina Alli
BHV - Biohacking Village CTF: Hospital Under Siege (Pre-registration required)
BICV - (10:30-10:30 PDT) - Why don’t we have IoT, daddy? - Jessica Hoffman
BTV - cont...(09:30-10:30 PDT) - Yeet the leet with Osquery (Effective Threathunting Without Breaking Bank ) - Sebastiaan Provost
BTV - cont...(09:30-10:59 PDT) - Attack and Detect with Prelude Operator and Security Onion - Wes Lambert
BTV - (10:45-11:45 PDT) - Velociraptor - Dig Deeper - Mike Cohen
BTV - (10:45-12:15 PDT) - Windows Forensics 101 (Beginner) - Surya Teja Masanam
CHV - Ready, fire aim: Hacking State and Federal Law Enforcement Vehicles - Alissa Knight
CLV - cont...(07:00-12:15 PDT) - Cloud Village CTF - Registration -
CLV - Cloud Village Opening Keynote
CLV - (10:15-10:59 PDT) - Detection Challenges in Cloud Connected Credential Abuse Attacks - Rod Soto
CON - cont...(00:00-23:59 PDT) - Coindroids -
CON - cont...(06:00-11:59 PDT) - DEF CON Bike Ride -
CON - cont...(09:00-15:59 PDT) - Darknet-NG -
CON - DEF CON 29 CTF by OOO -
CON - OpenSOC Blue Team CTF -
CON - Secure Coding Tournament CTF -
CON - Red Team Village CTF - Qualifiers Part 1 -
CON - Red Alert ICS CTF -
CON - Beverage Cooling Contraption Contest -
CON - Car Hacking CTF -
CON - CMD+CTRL -
CON - Hack3r Runw@y -
CPV - New Face, Who Dis? Protecting Privacy in an Era of Surveillance - Mike Kiser
DC - cont...(08:00-16:59 PDT) - DEF CON Human Registration (Badge Pickup) and Vaccine Check Processing Open -
DC - cont...(09:00-20:59 PDT) - Chillout Lounges - djdead,DJ Pie & Darren,kampf,Merin MC,s1gns of l1fe,Mixmaster Morris
DC - Welcome To DEF CON - Dark Tangent & Making the DEF CON 29 Badge - Dark Tangent,Katie Whiteley,Michael Whiteley
DC - Gone Apple Pickin': Red Teaming macOS Environments in 2021 - Cedric Owens
DC - HTTP/2: The Sequel is Always Worse - James Kettle
DC - DEF CON Vendor Area Open
DC - Community Roundtable - (De)Criminalizing Hacking Around the Globe -
DDV - Data Duplication Village - Open -
DL - AIS Tools - Gary Kessler
DL - Mooltipass - Mathieu Stephan
DL - WiFi Kraken Lite - Mike Spicer,Henry Hill
HHV - Hardware Hacking 101: Rogue Keyboards and Eavesdropping Cables - Federico Lucifredi
HRV - cont...(09:00-15:59 PDT) - Ham Radio Exams -
HRV - Ham Radio Village Opening Remarks
HTSV - AIS Tools Demo (DEF CON) - Gary Kessler
ICSV - Keynote - PW Singer - PW Singer
ICSV - (10:30-11:30 PDT) - Tabletop Exercise - GRIMM
IOTV - Pentesting 101 -
IOTV - When Penetration Testing Isn’t Penetration Testing At All - Ted Harrington
IOTV - UART to UBOOT to ROOT -
IOTV - IoT Village Capture the Flag (CTF) -
IOTV - IoT Village Labs -
IOTV - Black Box Challenges -
IOTV - (10:45-11:30 PDT) - Representation Matters - Camille Eddy,Chloe Messdaghi
LBV - cont...(09:30-10:30 PDT) - Bypass 101
LBV - (10:30-11:30 PDT) - Tools 101
LPV - Intro To Lockpicking - TOOOL
PHV - cont...(09:00-10:59 PDT) - Web App Penetration Testing Workshop - Sunny Wear
PHV - Internet Protocol (IP) - Roy Feng
PYV - ATM Transaction Reversal Frauds (And how to fight them) - Hector Cuevas Cruz
RCV - Recon Village Keynote - Ben S
RCV - (10:55-11:25 PDT) - Using Passive DNS for gathering Business Intelligence - Andy Dennis
RGV - Top 10 BOGUS Biometrics! - Vic Harkness
SEV - SECTF4Kids (Pre-Registration Required) - Ryan M,Colin H
VMV - Voting Village Logistical Information Broadcast (Discord, Youtube, Twitch) -
VMV - (10:30-10:59 PDT) - Hacking to Save Democracy: What Technologists Need to Know About Election Administration - Eddie Perez
WS - The Joy of Reverse Engineering: Learning With Ghidra and WinDbg - Wesley McGrew
WS - Inspecting Signals from Satellites to Shock Collars - Eric Escobar,Trenton Ivey
WS - Analysis 101 and 102 for the Incident Responder - Kristy Westphal
WS - House of Heap Exploitation - James Dolan,Maxwell Dulin,Nathan Kirkland,Zachary Minneker

 

Friday - 11:00 PDT


Return to Index  -  Locations Legend
AIV - The Coming AI Hackers - Bruce Schneier
APV - Vulnerability Inheritance - Attacking companies and scoring bounties through 3rd party integrations - Gal Nagli
APV - AppSec Village Capture the Flag Starts -
ASV - cont...(09:00-17:59 PDT) - A-ISAC CTF -- Pre-registration Required -
ASV - cont...(10:00-11:30 PDT) - AIAA CubeSat Hacking Workshop - World Premier of the videos -
ASV - cont...(10:00-15:59 PDT) - ARINC 429 Lab -
ASV - cont...(10:00-15:59 PDT) - Deep Space Networking -
ASV - cont...(10:00-15:59 PDT) - Hack-A-Sat2 Satellite Platform -
ASV - cont...(10:00-15:59 PDT) - Antenny -
ASV - cont...(10:00-15:59 PDT) - HACMS Live Demo -
ASV - cont...(10:00-15:59 PDT) - Lego Spike Hub -
ASV - cont...(10:00-15:59 PDT) - ADSB Demo and Paper Airplanes -
ASV - cont...(10:30-11:20 PDT) - Hack-A-Sat 2: The Good, The Bad and the Cyber-Secure - Bryce Kerley,Capt Aaron Bolen,Frank Pound,Steve Wood
ASV - (11:30-11:55 PDT) - Steal This Drone: High-Assurance Cyber Military Systems - Darren Cofer
ASV - (11:30-12:59 PDT) - AIAA CubeSat Hacking Workshop - Virtual Lab #1 -
BCV - cont...(10:15-11:30 PDT) - Key Note
BCV - (11:30-11:59 PDT) - BCOS Village Contest Overview - Reddcoin
BHV - cont...(10:00-17:59 PDT) - Biohacking Village CTF: Hospital Under Siege (Pre-registration required)
BHV - The Digital Physiome - How wearables can (and are) transforming healthcare - Jennifer Goldsack,Jessilyn Dunn
BTV - cont...(10:45-11:45 PDT) - Velociraptor - Dig Deeper - Mike Cohen
BTV - cont...(10:45-12:15 PDT) - Windows Forensics 101 (Beginner) - Surya Teja Masanam
CCV - Getting Started with Decentralized Object Storage - Storj Team
CHV - Remotely Rooting Charging Station for fun and maybe profit - Huajiang "Kevin2600" Chen,Wu Ming
CLV - cont...(07:00-12:15 PDT) - Cloud Village CTF - Registration -
CLV - Cloud Village CTF -
CLV - The Fault in Our Stars - Attack vectors for APIs using AWS API Gateway Lambda Authorizers - Alexandre Sieira,Leonardo Viveiros
CLV - (11:45-12:05 PDT) - Exploiting the O365 Duo 2FA Misconfiguration (Lightning Talk) - Cassandra Young
CON - cont...(00:00-23:59 PDT) - Coindroids -
CON - cont...(06:00-11:59 PDT) - DEF CON Bike Ride -
CON - cont...(09:00-15:59 PDT) - Darknet-NG -
CON - cont...(10:00-19:59 PDT) - DEF CON 29 CTF by OOO -
CON - cont...(10:00-17:30 PDT) - OpenSOC Blue Team CTF -
CON - cont...(10:00-14:59 PDT) - Secure Coding Tournament CTF -
CON - cont...(10:00-16:59 PDT) - Red Team Village CTF - Qualifiers Part 1 -
CON - cont...(10:00-17:59 PDT) - Red Alert ICS CTF -
CON - cont...(10:00-13:59 PDT) - Beverage Cooling Contraption Contest -
CON - cont...(10:00-23:55 PDT) - Car Hacking CTF -
CON - cont...(10:00-15:59 PDT) - CMD+CTRL -
CON - cont...(10:00-15:59 PDT) - Hack3r Runw@y -
CPV - Welcome to Gold Bug -
CPV - (11:30-12:30 PDT) - How expensive is quantum factoring, really? - Craig Gidney
DC - cont...(08:00-16:59 PDT) - DEF CON Human Registration (Badge Pickup) and Vaccine Check Processing Open -
DC - cont...(09:00-20:59 PDT) - Chillout Lounges - djdead,DJ Pie & Darren,kampf,Merin MC,s1gns of l1fe,Mixmaster Morris
DC - cont...(10:00-19:59 PDT) - DEF CON Vendor Area Open
DC - 2021 - Our Journey Back To The Future Of Windows Vulnerabilities and the 0-days we brought back with us - Eran Segal,Tomer Bar
DC - Caught you - reveal and exploit IPC logic bugs inside Apple - Chuanda Ding,Yuebin Sun,Zhipeng Huo
DC - (11:30-12:30 PDT) - Community Roundtable - We can build it. We have the technology. So why aren't we? -
DC - (11:30-12:30 PDT) - Community Roundtable - Toward a Global IoT Code of Practice -
DDV - cont...(10:00-16:59 PDT) - Data Duplication Village - Open -
DL - cont...(10:00-11:50 PDT) - AIS Tools - Gary Kessler
DL - cont...(10:00-11:50 PDT) - Mooltipass - Mathieu Stephan
DL - cont...(10:00-11:50 PDT) - WiFi Kraken Lite - Mike Spicer,Henry Hill
HHV - Use a PortaProg to flash, dump, and test ISP and UPDI chips - Bradán Lane,Sara Cladlow
HRV - cont...(09:00-15:59 PDT) - Ham Radio Exams -
HRV - "Ask a Ham" Q&A -
HTSV - cont...(10:00-11:50 PDT) - AIS Tools Demo (DEF CON) - Gary Kessler
ICSV - cont...(10:30-11:30 PDT) - Tabletop Exercise - GRIMM
ICSV - (11:30-12:30 PDT) - Your Infrastructure is Encrypted: Protecting Critical Infrastructure from Ransomware - David Etue,Ernie Bio,Jamil Jaffer,Jennifer DeTrani
IOTV - cont...(10:00-18:30 PDT) - Pentesting 101 -
IOTV - cont...(10:00-18:30 PDT) - UART to UBOOT to ROOT -
IOTV - cont...(10:00-18:30 PDT) - IoT Village Capture the Flag (CTF) -
IOTV - cont...(10:00-18:30 PDT) - IoT Village Labs -
IOTV - cont...(10:00-18:30 PDT) - Black Box Challenges -
IOTV - cont...(10:45-11:30 PDT) - Representation Matters - Camille Eddy,Chloe Messdaghi
IOTV - (11:45-12:30 PDT) - 1.21 Gigawatts! Vulnerabilities in Solar Panel Controllers - Waylon Grange
LBV - cont...(10:30-11:30 PDT) - Tools 101
LBV - (11:30-12:30 PDT) - Intro to RFID Hacking
LPV - Key Duplication - It's not just for the movies! - Tony Virelli
PHV - MITRE Engage: A Framework for Adversary Engagement Operations - Stan Bar,Gabby Raymond,Maretta Morovitz
PYV - Racing cryptoexchanges or how I manipulated the balances - Vahagan Vardanyan
RCV - cont...(10:55-11:25 PDT) - Using Passive DNS for gathering Business Intelligence - Andy Dennis
RCV - (11:35-12:05 PDT) - So You Want to OPSEC, Eh? - Ritu Gill
SEV - cont...(10:00-11:59 PDT) - SECTF4Kids (Pre-Registration Required) - Ryan M,Colin H
VMV - A Deep Dive on Vulnerability Disclosure for Election Systems - Tod Beardsley
VMV - (11:30-11:59 PDT) - Wireless Odyssey or why is the federal government permitting devices with wireless networking capability in federally certified voting machines? - Susan Greenhalgh
WS - cont...(10:00-13:59 PDT) - The Joy of Reverse Engineering: Learning With Ghidra and WinDbg - Wesley McGrew
WS - cont...(10:00-13:59 PDT) - Inspecting Signals from Satellites to Shock Collars - Eric Escobar,Trenton Ivey
WS - cont...(10:00-13:59 PDT) - Analysis 101 and 102 for the Incident Responder - Kristy Westphal
WS - cont...(10:00-13:59 PDT) - House of Heap Exploitation - James Dolan,Maxwell Dulin,Nathan Kirkland,Zachary Minneker

 

Friday - 12:00 PDT


Return to Index  -  Locations Legend
AIV - Algorithmic Ethics Bug Bounty Contest Announcement - Rumman Chowdhury
AIV - (12:30-12:59 PDT) - Microsoft ML Security Evasion Competition Details - Hyrum Anderson
APV - Cross-document messaging technology, how to hack it, and how to use it safely. - Chen Gour-Arie
ASV - cont...(09:00-17:59 PDT) - A-ISAC CTF -- Pre-registration Required -
ASV - cont...(10:00-15:59 PDT) - ARINC 429 Lab -
ASV - cont...(10:00-15:59 PDT) - Deep Space Networking -
ASV - cont...(10:00-15:59 PDT) - Hack-A-Sat2 Satellite Platform -
ASV - cont...(10:00-15:59 PDT) - Antenny -
ASV - cont...(10:00-15:59 PDT) - HACMS Live Demo -
ASV - cont...(10:00-15:59 PDT) - Lego Spike Hub -
ASV - cont...(10:00-15:59 PDT) - ADSB Demo and Paper Airplanes -
ASV - cont...(11:30-12:59 PDT) - AIAA CubeSat Hacking Workshop - Virtual Lab #1 -
ASV - Threat Modeling for Space Hitchhikers - James Pavur
ASV - (12:30-12:55 PDT) - Evaluating Wireless Attacks on Real-World Avionics Hardware - Leeloo Granger
AVV - Adversary Village Kick-off - Abhijith B R
AVV - (12:15-12:59 PDT) - Adversary Village Keynote - David Kennedy
BCV - Polyswarm Talk - Kevin Leffew
BHV - cont...(10:00-17:59 PDT) - Biohacking Village CTF: Hospital Under Siege (Pre-registration required)
BHV - The Next Critical Infrastructure: Understanding the Bioeconomy - Charles Fracchia,Nathan Case
BICV - (12:30-12:30 PDT) - The Action Plan for Cyber Diversity! - Keith Chapman
BTV - cont...(10:45-12:15 PDT) - Windows Forensics 101 (Beginner) - Surya Teja Masanam
BTV - This is what we thought would happen in 2021 - Gert-Jan Bruggink
CAHV - F**k You, Pay Me - Knowing your worth and getting paid - Alyssa Miller,Liana McCrea
CAHV - Resume Reviewing
CAHV - Career Coaching
CCV - (12:30-12:59 PDT) - Privacy on Public Blockchains with SGX - Secret Network Team
CHV - Commercial Transportation: Trucking Hacking - Ben Gardiner
CLV - cont...(07:00-12:15 PDT) - Cloud Village CTF - Registration -
CLV - cont...(11:00-12:15 PDT) - Cloud Village CTF -
CLV - cont...(11:45-12:05 PDT) - Exploiting the O365 Duo 2FA Misconfiguration (Lightning Talk) - Cassandra Young
CLV - Attacking Modern Environments Series: Attack Vectors on Terraform Environments - Mazin Ahmed
CLV - (12:50-13:20 PDT) - Kubernetes Goat - Kubernetes Security Learning (Tool Demo) - Madhu Akula
CON - cont...(00:00-23:59 PDT) - Coindroids -
CON - cont...(09:00-15:59 PDT) - Darknet-NG -
CON - cont...(10:00-19:59 PDT) - DEF CON 29 CTF by OOO -
CON - cont...(10:00-17:30 PDT) - OpenSOC Blue Team CTF -
CON - cont...(10:00-14:59 PDT) - Secure Coding Tournament CTF -
CON - cont...(10:00-16:59 PDT) - Red Team Village CTF - Qualifiers Part 1 -
CON - cont...(10:00-17:59 PDT) - Red Alert ICS CTF -
CON - cont...(10:00-13:59 PDT) - Beverage Cooling Contraption Contest -
CON - cont...(10:00-23:55 PDT) - Car Hacking CTF -
CON - cont...(10:00-15:59 PDT) - CMD+CTRL -
CON - cont...(10:00-15:59 PDT) - Hack3r Runw@y -
CON - Blacks in Cybersecurity CTF -
CPV - cont...(11:30-12:30 PDT) - How expensive is quantum factoring, really? - Craig Gidney
CPV - (12:30-13:10 PDT) - CPV Through the Looking-Glass: How to Backdoor Diffie-Hellman (DC 24)
DC - cont...(08:00-16:59 PDT) - DEF CON Human Registration (Badge Pickup) and Vaccine Check Processing Open -
DC - cont...(09:00-20:59 PDT) - Chillout Lounges - djdead,DJ Pie & Darren,kampf,Merin MC,s1gns of l1fe,Mixmaster Morris
DC - cont...(10:00-19:59 PDT) - DEF CON Vendor Area Open
DC - cont...(11:30-12:30 PDT) - Community Roundtable - We can build it. We have the technology. So why aren't we? -
DC - cont...(11:30-12:30 PDT) - Community Roundtable - Toward a Global IoT Code of Practice -
DC - DHS REBOOTING CRITICAL INFRASTRUCTURE PROTECTION Panel with DEF CON Policy Panel - Lily Newman,Alexander Klimburg,Faye Francy,Eric Goldstein,Amelie Koran,Danny McPherson
DC - Your House is My House: Use of Offensive Enclaves In Adversarial Operations - Dimitry "Op_Nomad" Snezhkov
DC - Do you like to read? I know how to take over your Kindle with an e-book - Slava Makkaveev
DC - (12:30-12:50 PDT) - The Mechanics of Compromising Low Entropy RSA Keys - Austin Allshouse
DC - (12:30-12:50 PDT) - Worming through IDEs - David Dworken
DDV - cont...(10:00-16:59 PDT) - Data Duplication Village - Open -
DL - Solitude - Dan Hastings
DL - Siembol - Marian Novotny
HHV - The Black Box and the Brain Box: When Electronics and Deception Collide - Gigs
HHV - (12:30-13:30 PDT) - Walkthrough of DC 28 HHV Challenges - rehr
HRV - cont...(09:00-15:59 PDT) - Ham Radio Exams -
HRV - (12:30-13:30 PDT) - Spectrum Coordination for Amateur Radio - Bryan Fields
HTSV - Intro to SeaTF, Salty Sensor, and Tin Foil Competitions
ICSV - cont...(11:30-12:30 PDT) - Your Infrastructure is Encrypted: Protecting Critical Infrastructure from Ransomware - David Etue,Ernie Bio,Jamil Jaffer,Jennifer DeTrani
ICSV - (12:30-12:59 PDT) - Do We Really Want to Live in the Cyberpunk World? - Mert Can Kilic
IOTV - cont...(10:00-18:30 PDT) - Pentesting 101 -
IOTV - cont...(10:00-18:30 PDT) - UART to UBOOT to ROOT -
IOTV - cont...(10:00-18:30 PDT) - IoT Village Capture the Flag (CTF) -
IOTV - cont...(10:00-18:30 PDT) - IoT Village Labs -
IOTV - cont...(10:00-18:30 PDT) - Black Box Challenges -
IOTV - cont...(11:45-12:30 PDT) - 1.21 Gigawatts! Vulnerabilities in Solar Panel Controllers - Waylon Grange
IOTV - (12:45-13:15 PDT) - LED Light Lunacy! - Victor Hanna
LBV - cont...(11:30-12:30 PDT) - Intro to RFID Hacking
LPV - Intro To Lockpicking - TOOOL
PHV - Hunting Evil with Wireshark - Michael Wylie
PHV - Seeing Through The Windows: Centralizing Windows Logs For Greater Visibility - Matthew Gracie
PYV - Automated Tear Machines - Meadow Ellis
RCV - cont...(11:35-12:05 PDT) - So You Want to OPSEC, Eh? - Ritu Gill
RCV - (12:15-12:59 PDT) - OSINT and the Hermit Kingdom. Leveraging online sources to learn more about the worlds most secret nation - Nick Roy
SEV - (12:30-13:30 PDT) - Judging by the Cover: Profiling & Targeting Through Social Media - Christina Lekati
SOC - Friends of Bill W. -
VMV - A Journalist’s Perspective on Fake News - Bob Sullivan
VMV - (12:30-12:59 PDT) - Are Barcodes on Ballots Bad?  - Kevin Skoglund
WS - cont...(10:00-13:59 PDT) - The Joy of Reverse Engineering: Learning With Ghidra and WinDbg - Wesley McGrew
WS - cont...(10:00-13:59 PDT) - Inspecting Signals from Satellites to Shock Collars - Eric Escobar,Trenton Ivey
WS - cont...(10:00-13:59 PDT) - Analysis 101 and 102 for the Incident Responder - Kristy Westphal
WS - cont...(10:00-13:59 PDT) - House of Heap Exploitation - James Dolan,Maxwell Dulin,Nathan Kirkland,Zachary Minneker

 

Friday - 13:00 PDT


Return to Index  -  Locations Legend
AIV - Shell Language Processing (SLP) - Dmitrijs Trizna
AIV - (13:30-14:30 PDT) - Trailblazing the AI for Cybersecurity Discipline: Overview of the Field and Promising Future Directions - Sagar Samtani
APV - Signed, Sealed, Delivered: Abusing Trust in Software Supply Chain Attacks - Cheryl Biswas
ASV - cont...(09:00-17:59 PDT) - A-ISAC CTF -- Pre-registration Required -
ASV - cont...(10:00-15:59 PDT) - ARINC 429 Lab -
ASV - cont...(10:00-15:59 PDT) - Deep Space Networking -
ASV - cont...(10:00-15:59 PDT) - Hack-A-Sat2 Satellite Platform -
ASV - cont...(10:00-15:59 PDT) - Antenny -
ASV - cont...(10:00-15:59 PDT) - HACMS Live Demo -
ASV - cont...(10:00-15:59 PDT) - Lego Spike Hub -
ASV - cont...(10:00-15:59 PDT) - ADSB Demo and Paper Airplanes -
ASV - Unboxing the Spacecraft Software BlackBox – Hunting for Vulnerabilities - Brandon Bailey
ASV - Understanding Space in the Cyber Domain -
AVV - Look at me, I'm the Adversary now: Introduction to Adversary Emulation and its place in Security Operations - Samuel Kimmons
AVV - (13:45-14:45 PDT) - From On-Prem to the Cloud - Hybrid AD attack path - Sergey Chubarov
BCV - Catching (and Fixing) an Unlimited Burn Vulnerability - Nadir Akhtar
BHV - cont...(10:00-17:59 PDT) - Biohacking Village CTF: Hospital Under Siege (Pre-registration required)
BHV - "Who Bears the Risk?" Why a Market Incentives Perspective is Critical to Protecting Patients from Cyber Threats - Matt McMahon,Shannon Lantzky
BHV - (13:30-14:30 PDT) - At least ten questions for “Bad HIPPA Takes” (@BadHIPPA), 2021’s best tweeter on privacy, pandemic, and snark. - Lucia Savage
BTV - (13:30-13:59 PDT) - Forensicating Endpoint Artifacts in the World of Cloud Storage Services - Renzon Cruz
CAHV - cont...(12:00-15:59 PDT) - Resume Reviewing
CAHV - cont...(12:00-15:59 PDT) - Career Coaching
CAHV - Hacking Your Career: The Options - Chris Sperry,Deb Herrity,Jennifer Haverman
CHV - From CTF to CVE - Bill Hatzer
CLV - cont...(12:50-13:20 PDT) - Kubernetes Goat - Kubernetes Security Learning (Tool Demo) - Madhu Akula
CLV - (13:20-14:05 PDT) - Hunting for AWS Exposed Resources - Felipe Pr0teus Espósito
CON - cont...(00:00-23:59 PDT) - Coindroids -
CON - cont...(09:00-15:59 PDT) - Darknet-NG -
CON - cont...(10:00-19:59 PDT) - DEF CON 29 CTF by OOO -
CON - cont...(10:00-17:30 PDT) - OpenSOC Blue Team CTF -
CON - cont...(10:00-14:59 PDT) - Secure Coding Tournament CTF -
CON - cont...(10:00-16:59 PDT) - Red Team Village CTF - Qualifiers Part 1 -
CON - cont...(10:00-17:59 PDT) - Red Alert ICS CTF -
CON - cont...(10:00-13:59 PDT) - Beverage Cooling Contraption Contest -
CON - cont...(10:00-23:55 PDT) - Car Hacking CTF -
CON - cont...(10:00-15:59 PDT) - CMD+CTRL -
CON - cont...(10:00-15:59 PDT) - Hack3r Runw@y -
CON - cont...(12:00-17:59 PDT) - Blacks in Cybersecurity CTF -
CPV - cont...(12:30-13:10 PDT) - CPV Through the Looking-Glass: How to Backdoor Diffie-Hellman (DC 24)
DC - cont...(08:00-16:59 PDT) - DEF CON Human Registration (Badge Pickup) and Vaccine Check Processing Open -
DC - cont...(09:00-20:59 PDT) - Chillout Lounges - djdead,DJ Pie & Darren,kampf,Merin MC,s1gns of l1fe,Mixmaster Morris
DC - cont...(10:00-19:59 PDT) - DEF CON Vendor Area Open
DC - Ransomeware’s Big Year – from nuisance to “scourge”? - DEF CON Policy Panel
DC - Sleight of ARM: Demystifying Intel Houdini - Brian Hong
DC - eBPF, I thought we were friends! - Guillaume Fournier,Sylvain Afchain,Sylvain Baubeau
DC - Policy Debrief - Myths and Legends of Section 230 -
DDV - cont...(10:00-16:59 PDT) - Data Duplication Village - Open -
DL - cont...(12:00-13:50 PDT) - Solitude - Dan Hastings
DL - cont...(12:00-13:50 PDT) - Siembol - Marian Novotny
HHV - cont...(12:30-13:30 PDT) - Walkthrough of DC 28 HHV Challenges - rehr
HHV - (13:30-14:30 PDT) - A Lazy r2 Solve of @mediumrehr Challenge 6 - Ben Gardiner
HRV - cont...(09:00-15:59 PDT) - Ham Radio Exams -
HRV - cont...(12:30-13:30 PDT) - Spectrum Coordination for Amateur Radio - Bryan Fields
HTSV - AIS Protocol Internals (Abridged) - Gary Kessler
ICSV - Tabletop Exercise - GRIMM
ICSV - Beetlejuice: The Lessons We Should Have Learned For ICS Cybersecurity - Tim Yardley
ICSV - (13:30-13:59 PDT) - Scripts and Tools to Help Your ICS InfoSec Journey - Don C. Weber
IOTV - cont...(10:00-18:30 PDT) - Pentesting 101 -
IOTV - cont...(10:00-18:30 PDT) - UART to UBOOT to ROOT -
IOTV - cont...(10:00-18:30 PDT) - IoT Village Capture the Flag (CTF) -
IOTV - cont...(10:00-18:30 PDT) - IoT Village Labs -
IOTV - cont...(10:00-18:30 PDT) - Black Box Challenges -
IOTV - cont...(12:45-13:15 PDT) - LED Light Lunacy! - Victor Hanna
IOTV - (13:30-14:15 PDT) - 5 years of IoT vulnerability research and countless 0days - A retrospective - Alex "Jay" Balan
LBV - (13:30-14:30 PDT) - Alarm Bypass
LPV - Are We Still Doing it? 10 Locksport Hobbies that go Beyond Lock Picking - Lock Noob
PHV - cont...(12:00-13:59 PDT) - Hunting Evil with Wireshark - Michael Wylie
PYV - What happens when businesses decide to enroll cryptocurrency cards - Timur Yunusov
SEV - cont...(12:30-13:30 PDT) - Judging by the Cover: Profiling & Targeting Through Social Media - Christina Lekati
SEV - (13:30-14:30 PDT) - SE Team vs. Red Team - Ryan MacDougall
SOC - A&E Pool Party! -
VMV - Hack the Conspiracies - Barb Byrum
VMV - (13:30-13:59 PDT) - Kickoff Remarks (recorded in-person in Las Vegas) - Harri Hursti
WS - cont...(10:00-13:59 PDT) - The Joy of Reverse Engineering: Learning With Ghidra and WinDbg - Wesley McGrew
WS - cont...(10:00-13:59 PDT) - Inspecting Signals from Satellites to Shock Collars - Eric Escobar,Trenton Ivey
WS - cont...(10:00-13:59 PDT) - Analysis 101 and 102 for the Incident Responder - Kristy Westphal
WS - cont...(10:00-13:59 PDT) - House of Heap Exploitation - James Dolan,Maxwell Dulin,Nathan Kirkland,Zachary Minneker

 

Friday - 14:00 PDT


Return to Index  -  Locations Legend
AIV - cont...(13:30-14:30 PDT) - Trailblazing the AI for Cybersecurity Discipline: Overview of the Field and Promising Future Directions - Sagar Samtani
AIV - (14:30-14:59 PDT) - AI Policy Talk: "An AI Security ISAC" and "An AI Playbook" - Sagar Samtani
APV - Poking bots for fun and profit in the age of asynchronous stuff - Emanuel Rodrigues
ASV - cont...(09:00-17:59 PDT) - A-ISAC CTF -- Pre-registration Required -
ASV - cont...(10:00-15:59 PDT) - ARINC 429 Lab -
ASV - cont...(10:00-15:59 PDT) - Deep Space Networking -
ASV - cont...(10:00-15:59 PDT) - Hack-A-Sat2 Satellite Platform -
ASV - cont...(10:00-15:59 PDT) - Antenny -
ASV - cont...(10:00-15:59 PDT) - HACMS Live Demo -
ASV - cont...(10:00-15:59 PDT) - Lego Spike Hub -
ASV - cont...(10:00-15:59 PDT) - ADSB Demo and Paper Airplanes -
ASV - cont...(13:00-15:59 PDT) - Understanding Space in the Cyber Domain -
ASV - AIAA CubeSat Hacking Workshop - Virtual Lab #2 -
ASV - Don’t fear the BUS, it won’t run you over. - Nicholas Childs
ASV - (14:30-14:55 PDT) - CPDLC: Man-in-the-middle attacks and how to defend against them - Joshua Smailes
AVV - cont...(13:45-14:45 PDT) - From On-Prem to the Cloud - Hybrid AD attack path - Sergey Chubarov
AVV - (14:45-15:45 PDT) - Exploiting Blue Team OPSEC failures with RedELK - Marc Smeets
BCV - Blockchain Security Tools - Mila Paul
BCV - (14:30-15:59 PDT) - Workshop - Decentralized Cloud
BHV - cont...(10:00-17:59 PDT) - Biohacking Village CTF: Hospital Under Siege (Pre-registration required)
BHV - cont...(13:30-14:30 PDT) - At least ten questions for “Bad HIPPA Takes” (@BadHIPPA), 2021’s best tweeter on privacy, pandemic, and snark. - Lucia Savage
BHV - (14:30-14:59 PDT) - Open-Source Vaccine Developer Kits (VDKs) with RaDVaC - Alex Hoekstra
BICV - (14:30-14:30 PDT) - The Big Cleanup: Tackling The Remnants of Systematic Discrimination in the Tech Industry - Maurice Turner
BTV - MacOs Workshop - Hunt for Red Apples: Ocean Lotus Edition Part1 - Cat Self,plug,Ben Bornholm,Tilottama Sanyal,Dan Borges
BTV - (14:15-15:15 PDT) - Adventures in Pro Bono Digital Forensics Work - John Bambenek
CAHV - cont...(12:00-15:59 PDT) - Resume Reviewing
CAHV - cont...(12:00-15:59 PDT) - Career Coaching
CAHV - Making the Leap - Changing Careers - Danyelle Davis
CCV - Hardware Wallet Show and Tell - Michael Schloh von Bennewitz
CHV - Bug Hunter's Guide to Bashing for a Car Hacking Bug Bash or Contest - Jay Turla
CLV - cont...(13:20-14:05 PDT) - Hunting for AWS Exposed Resources - Felipe Pr0teus Espósito
CLV - WhoC - Peeking under the hood of CaaS offerings - Yuval Avrahami
CLV - (14:35-16:59 PDT) - Kubernetes Security 101: Best Practices to Secure your Cluster (Workshop) - Magno Logan
CON - cont...(00:00-23:59 PDT) - Coindroids -
CON - cont...(09:00-15:59 PDT) - Darknet-NG -
CON - cont...(10:00-19:59 PDT) - DEF CON 29 CTF by OOO -
CON - cont...(10:00-17:30 PDT) - OpenSOC Blue Team CTF -
CON - cont...(10:00-14:59 PDT) - Secure Coding Tournament CTF -
CON - cont...(10:00-16:59 PDT) - Red Team Village CTF - Qualifiers Part 1 -
CON - cont...(10:00-17:59 PDT) - Red Alert ICS CTF -
CON - cont...(10:00-23:55 PDT) - Car Hacking CTF -
CON - cont...(10:00-15:59 PDT) - CMD+CTRL -
CON - cont...(10:00-15:59 PDT) - Hack3r Runw@y -
CON - cont...(12:00-17:59 PDT) - Blacks in Cybersecurity CTF -
CPV - Playing God: How ambiguities in state and federal breach notification laws give lawyers too much discretion in deciding whether or not to disclose potential data breaches - Anthony Hendricks,Jordan Sessler
CPV - (14:45-14:59 PDT) - Lightning Talk: Differential Privacy and Census Data - Wendy Edwards
DC - cont...(08:00-16:59 PDT) - DEF CON Human Registration (Badge Pickup) and Vaccine Check Processing Open -
DC - cont...(09:00-20:59 PDT) - Chillout Lounges - djdead,DJ Pie & Darren,kampf,Merin MC,s1gns of l1fe,Mixmaster Morris
DC - cont...(10:00-19:59 PDT) - DEF CON Vendor Area Open
DC - MAVSH> Attacking from Above - Sach
DC - Hacking Humans with AI as a Service - Eugene Lim,Glenice Tan,Tan Kee Hock
DC - Rotten code, aging standards, & pwning IPv4 parsing across nearly every mainstream programming language - Kelly Kaoudis,Sick Codes
DC - (14:30-15:30 PDT) - Community Roundtable - Zero Trust, Critical Software, and a Cyber Safety Review Board -
DC - (14:30-15:30 PDT) - Policy Debrief - Global Cyber Capacity Building - triple challenge or triple opportunity? -
DDV - cont...(10:00-16:59 PDT) - Data Duplication Village - Open -
DL - Kubestriker - Vasant Chinnipilli
DL - Zuthaka - Lucas Bonastre
DL - Open Bridge - Constantine Macris
DL - Empire - Anthony "Cx01N" Rose,Vincent "Vinnybod" Rose
HHV - cont...(13:30-14:30 PDT) - A Lazy r2 Solve of @mediumrehr Challenge 6 - Ben Gardiner
HHV - (14:30-14:59 PDT) - Meetup: PCB Proto and Rework - K
HRV - cont...(09:00-15:59 PDT) - Ham Radio Exams -
HRV - Discord Practice Net -
HTSV - In-person broadcast via demolabs - Constantine Macris
ICSV - Consider the (Data) Source - Dan Gunter
IOTV - cont...(10:00-18:30 PDT) - Pentesting 101 -
IOTV - cont...(10:00-18:30 PDT) - UART to UBOOT to ROOT -
IOTV - cont...(10:00-18:30 PDT) - IoT Village Capture the Flag (CTF) -
IOTV - cont...(10:00-18:30 PDT) - IoT Village Labs -
IOTV - cont...(10:00-18:30 PDT) - Black Box Challenges -
IOTV - cont...(13:30-14:15 PDT) - 5 years of IoT vulnerability research and countless 0days - A retrospective - Alex "Jay" Balan
IOTV - (14:30-15:15 PDT) - BLUEMONDAY Series – Exploitation & Mapping of vulnerable devices at scale through self-registration services (DATTO/ EGNYTE/ SYNOLOGY/ MERAKI/ GEOVISION) - Ken Pyle
LBV - cont...(13:30-14:30 PDT) - Alarm Bypass
LPV - (14:15-14:45 PDT) - Intro To Lockpicking - TOOOL
RCV - Finding Hidden Gems via URL Shortener Services - Utku Sen
RCV - (14:40-15:10 PDT) - Using OSINT to Aid in Human Trafficking and Smuggling Cases - Rae
RGV - The Neuroscience of Magic (Registration required) - Daniel Roy
SEV - cont...(13:30-14:30 PDT) - SE Team vs. Red Team - Ryan MacDougall
SOC - cont...(13:00-23:59 PDT) - A&E Pool Party! -
SOC - BADASS Meetup (Virtual) -

 

Friday - 15:00 PDT


Return to Index  -  Locations Legend
AIV - Identifying Excel 4.0 Macro strains using Anomaly Detection - Elad Ciuraru,Tal Leibovich
AIV - (15:30-16:30 PDT) - Workshop on Microsoft Counterfit - Will Pearce
APV - Scaling static analysis for free: add additional codebases with a single line of code and no money - Erin Browning,Tim Faraci 
ASV - cont...(09:00-17:59 PDT) - A-ISAC CTF -- Pre-registration Required -
ASV - cont...(10:00-15:59 PDT) - ARINC 429 Lab -
ASV - cont...(10:00-15:59 PDT) - Deep Space Networking -
ASV - cont...(10:00-15:59 PDT) - Hack-A-Sat2 Satellite Platform -
ASV - cont...(10:00-15:59 PDT) - Antenny -
ASV - cont...(10:00-15:59 PDT) - HACMS Live Demo -
ASV - cont...(10:00-15:59 PDT) - Lego Spike Hub -
ASV - cont...(10:00-15:59 PDT) - ADSB Demo and Paper Airplanes -
ASV - cont...(13:00-15:59 PDT) - Understanding Space in the Cyber Domain -
ASV - cont...(14:00-15:59 PDT) - AIAA CubeSat Hacking Workshop - Virtual Lab #2 -
ASV - Developing Aerospace Security Training 3D Models - Kevin Hood
ASV - (15:30-15:55 PDT) - Collecting CANs: a Bridge Less Traveled - Peace Barry
AVV - cont...(14:45-15:45 PDT) - Exploiting Blue Team OPSEC failures with RedELK - Marc Smeets
AVV - (15:45-16:45 PDT) - Everything is a C2 if you're brave enough - Luis Ángel Ramírez Mendoza,Mauro Cáseres Rozanowski
BCV - cont...(14:30-15:59 PDT) - Workshop - Decentralized Cloud
BHV - cont...(10:00-17:59 PDT) - Biohacking Village CTF: Hospital Under Siege (Pre-registration required)
BHV - Truth, Trust, and Biodefense - Eric Perakslis
BHV - (15:30-15:59 PDT) - Healthcare Innovation With People of All Abilities - Joel Isaac,Pia Zaragoza
BTV - cont...(14:00-17:59 PDT) - MacOs Workshop - Hunt for Red Apples: Ocean Lotus Edition Part1 - Cat Self,plug,Ben Bornholm,Tilottama Sanyal,Dan Borges
BTV - cont...(14:15-15:15 PDT) - Adventures in Pro Bono Digital Forensics Work - John Bambenek
BTV - (15:30-16:30 PDT) - Uncovering covert network behaviors within critical infrastructure environments - Michael Raggo,Chester Hosmer
CAHV - cont...(12:00-15:59 PDT) - Resume Reviewing
CAHV - cont...(12:00-15:59 PDT) - Career Coaching
CAHV - This Job Ad Sucks - Kirsten Renner
CHV - Remote Adversarial Phantom Attacks against Tesla and Mobileye - Ben Nassi
CLV - cont...(14:35-16:59 PDT) - Kubernetes Security 101: Best Practices to Secure your Cluster (Workshop) - Magno Logan
CON - cont...(00:00-23:59 PDT) - Coindroids -
CON - cont...(09:00-15:59 PDT) - Darknet-NG -
CON - cont...(10:00-19:59 PDT) - DEF CON 29 CTF by OOO -
CON - cont...(10:00-17:30 PDT) - OpenSOC Blue Team CTF -
CON - cont...(10:00-16:59 PDT) - Red Team Village CTF - Qualifiers Part 1 -
CON - cont...(10:00-17:59 PDT) - Red Alert ICS CTF -
CON - cont...(10:00-23:55 PDT) - Car Hacking CTF -
CON - cont...(10:00-15:59 PDT) - CMD+CTRL -
CON - cont...(10:00-15:59 PDT) - Hack3r Runw@y -
CON - cont...(12:00-17:59 PDT) - Blacks in Cybersecurity CTF -
CPV - So What? The CFAA after Van Buren - Kendra Albert
CPV - (15:30-16:30 PDT) - CPV Through the Looking-Glass: Adversarial Fashion (DC 27)
DC - cont...(08:00-16:59 PDT) - DEF CON Human Registration (Badge Pickup) and Vaccine Check Processing Open -
DC - cont...(09:00-20:59 PDT) - Chillout Lounges - djdead,DJ Pie & Darren,kampf,Merin MC,s1gns of l1fe,Mixmaster Morris
DC - cont...(10:00-19:59 PDT) - DEF CON Vendor Area Open
DC - cont...(14:30-15:30 PDT) - Community Roundtable - Zero Trust, Critical Software, and a Cyber Safety Review Board -
DC - cont...(14:30-15:30 PDT) - Policy Debrief - Global Cyber Capacity Building - triple challenge or triple opportunity? -
DC - UFOs: Misinformation, Disinformation, and the Basic Truth - Richard Thieme AKA neuralcowboy
DC - Abusing SAST tools! When scanners do more than just scanning - Rotem Bar
DC - ProxyLogon is Just the Tip of the Iceberg, A New Attack Surface on Microsoft Exchange Server! - Orange Tsai
DC - (15:30-16:30 PDT) - Community Roundtable - 10 years after SOPA: where are we now? -
DDV - cont...(10:00-16:59 PDT) - Data Duplication Village - Open -
DL - cont...(14:00-15:50 PDT) - Kubestriker - Vasant Chinnipilli
DL - cont...(14:00-15:50 PDT) - Zuthaka - Lucas Bonastre
DL - cont...(14:00-15:50 PDT) - Open Bridge - Constantine Macris
DL - cont...(14:00-15:50 PDT) - Empire - Anthony "Cx01N" Rose,Vincent "Vinnybod" Rose
HHV - Robo Sumo On site - ShortTie
HHV - (15:30-15:59 PDT) - Meetup: Legacy Hardware - K
HRV - cont...(09:00-15:59 PDT) - Ham Radio Exams -
HTSV - cont...(14:00-15:50 PDT) - In-person broadcast via demolabs - Constantine Macris
ICSV - Approaches to Attract, Develop, and Retain an Industrial Cybersecurity Workforce - John Ellis,Julia Atkinson
ICSV - (15:30-15:59 PDT) - It Takes a Village (and a generous grant): Students Performing ICS Security Assessments - Alexander Vigovskiy,Christopher Von Reybyton,Dennis Skarr
IOTV - cont...(10:00-18:30 PDT) - Pentesting 101 -
IOTV - cont...(10:00-18:30 PDT) - UART to UBOOT to ROOT -
IOTV - cont...(10:00-18:30 PDT) - IoT Village Capture the Flag (CTF) -
IOTV - cont...(10:00-18:30 PDT) - IoT Village Labs -
IOTV - cont...(10:00-18:30 PDT) - Black Box Challenges -
IOTV - cont...(14:30-15:15 PDT) - BLUEMONDAY Series – Exploitation & Mapping of vulnerable devices at scale through self-registration services (DATTO/ EGNYTE/ SYNOLOGY/ MERAKI/ GEOVISION) - Ken Pyle
IOTV - (15:30-16:15 PDT) - “Alexa, have you been compromised?” — Exploitation of Voice Assistants in Healthcare (and other business contexts) - Hutch (Justin Hutchens)
LPV - Doors, Cameras, and Mantraps OH MY! - Dylan The Magician
RCV - cont...(14:40-15:10 PDT) - Using OSINT to Aid in Human Trafficking and Smuggling Cases - Rae
RCV - (15:20-16:05 PDT) - Venator: Hunting & Smashing Trolls on Twitter - Mauro Cáseres Rozanowski
SOC - cont...(13:00-23:59 PDT) - A&E Pool Party! -
SOC - cont...(14:00-15:59 PDT) - BADASS Meetup (Virtual) -
WS - Windows Internals - Sam Bowne,Elizabeth Biddlecome,Irvin Lemus,Kaitlyn Handelman
WS - Secure messaging over unsecured transports - Ash
WS - Learning to Hack Bluetooth Low Energy with BLE CTF - Ryan Holeman
WS - Writing Golang Malware - Benjamin Kurtz

 

Friday - 16:00 PDT


Return to Index  -  Locations Legend
AIV - cont...(15:30-16:30 PDT) - Workshop on Microsoft Counterfit - Will Pearce
AIV - (16:30-16:59 PDT) - AI Discord Happy Hour - Open Discussion on AIV Discord about the State of AI Security
APV - DFDs Ain't That Bad - Izar Tarandach,Matthew Coles
ASV - cont...(09:00-17:59 PDT) - A-ISAC CTF -- Pre-registration Required -
ASV - Holistic View of a Flight with Crowd Sourced Data - Allan Tart
AVV - cont...(15:45-16:45 PDT) - Everything is a C2 if you're brave enough - Luis Ángel Ramírez Mendoza,Mauro Cáseres Rozanowski
AVV - (16:45-17:45 PDT) - Designing a C2 Framework - Daniel "Rasta" Duggan
BCV - Surviving 51% Attacks on Blockchains - Yaz Khoury
BCV - (16:30-17:30 PDT) - Do You Really Own Your NFTs? - Francesco Piccoli,Steven Yang
BHV - cont...(10:00-17:59 PDT) - Biohacking Village CTF: Hospital Under Siege (Pre-registration required)
BHV - No Aggregation Without Representation - Andrea Downing
BTV - cont...(14:00-17:59 PDT) - MacOs Workshop - Hunt for Red Apples: Ocean Lotus Edition Part1 - Cat Self,plug,Ben Bornholm,Tilottama Sanyal,Dan Borges
BTV - cont...(15:30-16:30 PDT) - Uncovering covert network behaviors within critical infrastructure environments - Michael Raggo,Chester Hosmer
BTV - (16:30-17:59 PDT) - Watch Out! And just skip the packer - Felipe Duarte
BTV - (16:45-17:15 PDT) - A SERVERLESS SIEM: DETECTING ALL BADDIES ON A BUDGET - Chen Cao
CCV - State of Cryptocurrency Ransomware AMA - Guillermo Christensen
CLV - cont...(14:35-16:59 PDT) - Kubernetes Security 101: Best Practices to Secure your Cluster (Workshop) - Magno Logan
CON - cont...(00:00-23:59 PDT) - Coindroids -
CON - cont...(10:00-19:59 PDT) - DEF CON 29 CTF by OOO -
CON - cont...(10:00-17:30 PDT) - OpenSOC Blue Team CTF -
CON - cont...(10:00-16:59 PDT) - Red Team Village CTF - Qualifiers Part 1 -
CON - cont...(10:00-17:59 PDT) - Red Alert ICS CTF -
CON - cont...(10:00-23:55 PDT) - Car Hacking CTF -
CON - cont...(12:00-17:59 PDT) - Blacks in Cybersecurity CTF -
CPV - cont...(15:30-16:30 PDT) - CPV Through the Looking-Glass: Adversarial Fashion (DC 27)
CPV - (16:30-17:30 PDT) - Piecing Together Your Personal Privacy Profile - Margaret Fero
DC - cont...(08:00-16:59 PDT) - DEF CON Human Registration (Badge Pickup) and Vaccine Check Processing Open -
DC - cont...(09:00-20:59 PDT) - Chillout Lounges - djdead,DJ Pie & Darren,kampf,Merin MC,s1gns of l1fe,Mixmaster Morris
DC - cont...(10:00-19:59 PDT) - DEF CON Vendor Area Open
DC - cont...(15:30-16:30 PDT) - Community Roundtable - 10 years after SOPA: where are we now? -
DC - Defending against nation-state (legal) attack: how to build a privacy-protecting service in the era of ubiquitous surveillance - Bill "Woody" Woodcock
DC - Bundles of Joy: Breaking macOS via Subverted Applications Bundles - Patrick Wardle
DC - The Unbelievable Insecurity of the Big Data Stack: An Offensive Approach to Analyzing Huge and Complex Big Data Infrastructures - Sheila A. Berta
DC - Community Roundtable - Volunteer Hacker Fire Department -
DDV - cont...(10:00-16:59 PDT) - Data Duplication Village - Open -
HRV - Remote Ham Radio Exams -
IOTV - cont...(10:00-18:30 PDT) - Black Box Challenges -
IOTV - cont...(10:00-18:30 PDT) - Pentesting 101 -
IOTV - cont...(10:00-18:30 PDT) - UART to UBOOT to ROOT -
IOTV - cont...(10:00-18:30 PDT) - IoT Village Capture the Flag (CTF) -
IOTV - cont...(10:00-18:30 PDT) - IoT Village Labs -
IOTV - cont...(15:30-16:15 PDT) - “Alexa, have you been compromised?” — Exploitation of Voice Assistants in Healthcare (and other business contexts) - Hutch (Justin Hutchens)
IOTV - (16:30-17:15 PDT) - IoT Testing Crash Course - Tim Jensen (EapolSniper)
LBV - Expoiting Retail Security with Tiktok's Hacker Community
LPV - (16:15-16:45 PDT) - Intro To Lockpicking - TOOOL
RCV - cont...(15:20-16:05 PDT) - Venator: Hunting & Smashing Trolls on Twitter - Mauro Cáseres Rozanowski
RCV - (16:15-16:45 PDT) - People Hunting: A Pentesters Perspective - Mishaal Khan
SOC - cont...(13:00-23:59 PDT) - A&E Pool Party! -
SOC - QueerCon Virtual Pool Party
SOC - QueerCon Party -
WS - cont...(15:00-18:59 PDT) - Windows Internals - Sam Bowne,Elizabeth Biddlecome,Irvin Lemus,Kaitlyn Handelman
WS - cont...(15:00-18:59 PDT) - Secure messaging over unsecured transports - Ash
WS - cont...(15:00-18:59 PDT) - Learning to Hack Bluetooth Low Energy with BLE CTF - Ryan Holeman
WS - cont...(15:00-18:59 PDT) - Writing Golang Malware - Benjamin Kurtz

 

Friday - 17:00 PDT


Return to Index  -  Locations Legend
APV - (17:30-17:35 PDT) - AppSec Quiz Time! - Eden Stroet
ASV - cont...(09:00-17:59 PDT) - A-ISAC CTF -- Pre-registration Required -
AVV - cont...(16:45-17:45 PDT) - Designing a C2 Framework - Daniel "Rasta" Duggan
AVV - (17:45-19:59 PDT) - (Workshop) Tradecraft Development in Adversary Simulations - Fatih Ozavci
BCV - cont...(16:30-17:30 PDT) - Do You Really Own Your NFTs? - Francesco Piccoli,Steven Yang
BHV - cont...(10:00-17:59 PDT) - Biohacking Village CTF: Hospital Under Siege (Pre-registration required)
BHV - Lets Get Real About The Future State of Healthcare - Christian Dameff,Jeff 'R3plicant' Tully
BTV - cont...(14:00-17:59 PDT) - MacOs Workshop - Hunt for Red Apples: Ocean Lotus Edition Part1 - Cat Self,plug,Ben Bornholm,Tilottama Sanyal,Dan Borges
BTV - cont...(16:30-17:59 PDT) - Watch Out! And just skip the packer - Felipe Duarte
BTV - cont...(16:45-17:15 PDT) - A SERVERLESS SIEM: DETECTING ALL BADDIES ON A BUDGET - Chen Cao
BTV - (17:30-17:59 PDT) - Scope X: Hunt in the Ocean! - Meisam Eslahi
CON - cont...(00:00-23:59 PDT) - Coindroids -
CON - cont...(10:00-19:59 PDT) - DEF CON 29 CTF by OOO -
CON - cont...(10:00-17:30 PDT) - OpenSOC Blue Team CTF -
CON - cont...(10:00-17:59 PDT) - Red Alert ICS CTF -
CON - cont...(10:00-23:55 PDT) - Car Hacking CTF -
CON - cont...(12:00-17:59 PDT) - Blacks in Cybersecurity CTF -
CON - EFF Tech Trivia -
CPV - cont...(16:30-17:30 PDT) - Piecing Together Your Personal Privacy Profile - Margaret Fero
DC - cont...(09:00-20:59 PDT) - Chillout Lounges - djdead,DJ Pie & Darren,kampf,Merin MC,s1gns of l1fe,Mixmaster Morris
DC - cont...(10:00-19:59 PDT) - DEF CON Vendor Area Open
DC - Do No harm; Health Panel : Live version - A DEF CON Policy Panel - DEF CON Policy Panel
DC - Phantom Attack: Evading System Call Monitoring - Junyuan Zeng,Rex Guo
DC - Warping Reality - creating and countering the next generation of Linux rootkits using eBPF - PatH
HHV - (17:30-17:59 PDT) - Meetup: Some HHV challenges - rehr
HRV - cont...(16:00-17:59 PDT) - Remote Ham Radio Exams -
IOTV - cont...(10:00-18:30 PDT) - Black Box Challenges -
IOTV - cont...(10:00-18:30 PDT) - Pentesting 101 -
IOTV - cont...(10:00-18:30 PDT) - UART to UBOOT to ROOT -
IOTV - cont...(10:00-18:30 PDT) - IoT Village Capture the Flag (CTF) -
IOTV - cont...(10:00-18:30 PDT) - IoT Village Labs -
IOTV - cont...(16:30-17:15 PDT) - IoT Testing Crash Course - Tim Jensen (EapolSniper)
IOTV - (17:30-18:15 PDT) - Defending IoT in the Future of High-Tech Warfare - Harshit Agrawal
LBV - cont...(16:00-17:59 PDT) - Expoiting Retail Security with Tiktok's Hacker Community
LPV - Law School for Lockpickers - Preston Thomas
SOC - cont...(13:00-23:59 PDT) - A&E Pool Party! -
SOC - cont...(16:00-17:59 PDT) - QueerCon Virtual Pool Party
SOC - cont...(16:00-17:59 PDT) - QueerCon Party -
SOC - Friends of Bill W. -
WS - cont...(15:00-18:59 PDT) - Windows Internals - Sam Bowne,Elizabeth Biddlecome,Irvin Lemus,Kaitlyn Handelman
WS - cont...(15:00-18:59 PDT) - Secure messaging over unsecured transports - Ash
WS - cont...(15:00-18:59 PDT) - Learning to Hack Bluetooth Low Energy with BLE CTF - Ryan Holeman
WS - cont...(15:00-18:59 PDT) - Writing Golang Malware - Benjamin Kurtz

 

Friday - 18:00 PDT


Return to Index  -  Locations Legend
AVV - cont...(17:45-19:59 PDT) - (Workshop) Tradecraft Development in Adversary Simulations - Fatih Ozavci
CON - cont...(00:00-23:59 PDT) - Coindroids -
CON - cont...(10:00-19:59 PDT) - DEF CON 29 CTF by OOO -
CON - cont...(10:00-23:55 PDT) - Car Hacking CTF -
CON - cont...(17:00-19:59 PDT) - EFF Tech Trivia -
DC - cont...(09:00-20:59 PDT) - Chillout Lounges - djdead,DJ Pie & Darren,kampf,Merin MC,s1gns of l1fe,Mixmaster Morris
DC - cont...(10:00-19:59 PDT) - DEF CON Vendor Area Open
DC - cont...(17:00-18:59 PDT) - Do No harm; Health Panel : Live version - A DEF CON Policy Panel - DEF CON Policy Panel
DC - Response Smuggling: Pwning HTTP/1.1 Connections - Martin Doyhenard
DC - How I use a JSON Deserialization 0day to Steal Your Money On The Blockchain - Hao Xing,Zekai Wu
IOTV - cont...(10:00-18:30 PDT) - Black Box Challenges -
IOTV - cont...(10:00-18:30 PDT) - Pentesting 101 -
IOTV - cont...(10:00-18:30 PDT) - UART to UBOOT to ROOT -
IOTV - cont...(10:00-18:30 PDT) - IoT Village Capture the Flag (CTF) -
IOTV - cont...(10:00-18:30 PDT) - IoT Village Labs -
IOTV - cont...(17:30-18:15 PDT) - Defending IoT in the Future of High-Tech Warfare - Harshit Agrawal
SOC - cont...(13:00-23:59 PDT) - A&E Pool Party! -
SOC - Lawyers Meet -
SOC - Hacker Karaoke (Virtual) -
WS - cont...(15:00-18:59 PDT) - Windows Internals - Sam Bowne,Elizabeth Biddlecome,Irvin Lemus,Kaitlyn Handelman
WS - cont...(15:00-18:59 PDT) - Secure messaging over unsecured transports - Ash
WS - cont...(15:00-18:59 PDT) - Learning to Hack Bluetooth Low Energy with BLE CTF - Ryan Holeman
WS - cont...(15:00-18:59 PDT) - Writing Golang Malware - Benjamin Kurtz

 

Friday - 19:00 PDT


Return to Index  -  Locations Legend
AVV - cont...(17:45-19:59 PDT) - (Workshop) Tradecraft Development in Adversary Simulations - Fatih Ozavci
CON - cont...(00:00-23:59 PDT) - Coindroids -
CON - cont...(10:00-19:59 PDT) - DEF CON 29 CTF by OOO -
CON - cont...(10:00-23:55 PDT) - Car Hacking CTF -
CON - cont...(17:00-19:59 PDT) - EFF Tech Trivia -
DC - cont...(09:00-20:59 PDT) - Chillout Lounges - djdead,DJ Pie & Darren,kampf,Merin MC,s1gns of l1fe,Mixmaster Morris
DC - cont...(10:00-19:59 PDT) - DEF CON Vendor Area Open
SOC - cont...(13:00-23:59 PDT) - A&E Pool Party! -
SOC - cont...(18:00-19:59 PDT) - Lawyers Meet -
SOC - cont...(18:00-23:59 PDT) - Hacker Karaoke (Virtual) -

 

Friday - 20:00 PDT


Return to Index  -  Locations Legend
AVV - Panel discussion: Adversary simulation, emulation or purple teaming - How would you define it? - Tomer Bar,Samuel Kimmons,Anant Shrivastava,Vincent Yiu,Martin Ingesen,Joe Vest
CON - cont...(00:00-23:59 PDT) - Coindroids -
CON - cont...(10:00-23:55 PDT) - Car Hacking CTF -
CON - Hacker Jeopardy -
DC - cont...(09:00-20:59 PDT) - Chillout Lounges - djdead,DJ Pie & Darren,kampf,Merin MC,s1gns of l1fe,Mixmaster Morris
DC - DEF CON Movie Night - Tron -
SOC - cont...(13:00-23:59 PDT) - A&E Pool Party! -
SOC - cont...(18:00-23:59 PDT) - Hacker Karaoke (Virtual) -
SOC - Vampire the Masquerade (Party) -
SOC - War Story Bunker -

 

Friday - 21:00 PDT


Return to Index  -  Locations Legend
CON - cont...(00:00-23:59 PDT) - Coindroids -
CON - cont...(10:00-23:55 PDT) - Car Hacking CTF -
CON - cont...(20:00-21:59 PDT) - Hacker Jeopardy -
DC - cont...(20:00-21:59 PDT) - DEF CON Movie Night - Tron -
MUS - Music - Thaad - Thaad
MUS - Music - Yesterday & Tomorrow - Yesterday & Tomorrow
SOC - cont...(13:00-23:59 PDT) - A&E Pool Party! -
SOC - cont...(18:00-23:59 PDT) - Hacker Karaoke (Virtual) -
SOC - cont...(20:00-21:59 PDT) - War Story Bunker -
SOC - Gothcon 2021 (Virtual) -

 

Friday - 22:00 PDT


Return to Index  -  Locations Legend
CON - cont...(00:00-23:59 PDT) - Coindroids -
CON - cont...(10:00-23:55 PDT) - Car Hacking CTF -
CON - Whose Slide Is It Anyway -
MUS - Music - FuzzyNop - FuzzyNop
MUS - Music - Terrestrial Access Network - Terrestrial Access Network
SOC - cont...(13:00-23:59 PDT) - A&E Pool Party! -
SOC - cont...(18:00-23:59 PDT) - Hacker Karaoke (Virtual) -

 

Friday - 23:00 PDT


Return to Index  -  Locations Legend
CON - cont...(00:00-23:59 PDT) - Coindroids -
CON - cont...(10:00-23:55 PDT) - Car Hacking CTF -
CON - cont...(22:00-23:59 PDT) - Whose Slide Is It Anyway -
MUS - Music - n0x08 - n0x08
MUS - Music - Z3NPI - Z3NPI
SOC - cont...(13:00-23:59 PDT) - A&E Pool Party! -
SOC - cont...(18:00-23:59 PDT) - Hacker Karaoke (Virtual) -

Talk/Event Descriptions


 

HRV - Friday - 11:00-11:30 PDT


Title: "Ask a Ham" Q&A
When: Friday, Aug 6, 11:00 - 11:30 PDT
Where: Ham Radio Village (Virtual Talks)

Description:
Got a question about anything ham radio? Come ask us in this open forum of all things ham radio!

All Ham Radio Village talks will be streamed to Twitch, with discussion in Discord.

For more information, see https://hamvillage.org/dc29.html


Twitch: https://www.twitch.tv/hamradiovillage

#hrv-presentation-text: https://discord.com/channels/708208267699945503/736674835413073991


Return to Index    -    Add to    -    ics Calendar file

 

BHV - Friday - 13:00-13:30 PDT


Title: "Who Bears the Risk?" Why a Market Incentives Perspective is Critical to Protecting Patients from Cyber Threats
When: Friday, Aug 6, 13:00 - 13:30 PDT
Where: Biohacking Village (Talk - Virtual)
Speakers:Matt McMahon,Shannon Lantzky

SpeakerBio:Matt McMahon , Senior Product Manager - Cybersecurity at Philips
Matt is currently a Program Manager for IoMT with Booz Allen, Grad Adj Professor, teaching coursework in Cyber and Healthcare at Salve Regina University and a Cyber & IOT SME with MIT

SpeakerBio:Shannon Lantzky , Chief Scientist, Secure Connected Health, Strategic Innovation Group at Booz Allen Hamilton
Dr. Shannon Lantzy is a leader in Booz Allen’s regulatory science practice, focused on efficient regulatory decisions to promote public health. Based out of our Bethesda, Maryland office, Shannon oversees innovation projects in the areas of secure connected health, medical device premarket review program assessment, digital health, simulation modeling, and decision science support services. Her team includes biologists, economists, operations researchers, engineers, chemists, epidemiologists, technologists, and data scientists.

Shannon has a background in data science, strategy, and mission integration. Prior to joining Booz Allen, she supported NASA’s science and human space flight mission directorates for close to a decade. After NASA, she took a 5-year academic hiatus to conduct research in consumer decision making using econometrics, predictive modeling, and experimental methods.

Shannon has three degrees from the University of Maryland, College Park, including a Ph.D. in business information systems from the Robert H. Smith School of Business; a master’s degree in information management from the College of Information Studies; and a bachelor’s degree in mathematics and philosophy.


Description:
Cyberattacks in healthcare abound. Sensitive health data is stolen, and patients’ lives are put at risk by the fleet of outdated, legacy medical devices in our hospitals that are vulnerable to attackers. As the market for internet of medical things (IoMT) rapidly expands, these trends will only increase. While we have the technology to fix this problem, traditional market incentives have not been able to induce a more secure healthcare environment. This talk will discuss those market failures from an economics perspective and suggest new strategies for properly incentivizing medical device manufacturers to make more cyber secure and resilient devices.

All Biohacking Village talks will be streamed to YouTube.

YouTube: https://www.youtube.com/channel/UCm1Kas76P64rs2s1LUA6s2Q


Return to Index    -    Add to    -    ics Calendar file

 

AVV - Friday - 17:45-19:59 PDT


Title: (Workshop) Tradecraft Development in Adversary Simulations
When: Friday, Aug 6, 17:45 - 19:59 PDT
Where: Adversary Village (Virtual)

SpeakerBio:Fatih Ozavci , Managing Security Consultant, The Missing Link (Australia)
Fatih Ozavci is a multidisciplinary security manager, engineer and researcher with two decades of experience on offensive and defensive security technologies. He has managed several international security assessment and research projects focused on various technologies including service provider networks, unified communications, application security and embedded systems. He shared his researches, tools, advisories and vulnerabilities in major security conferences such as Black Hat USA, DEF CON and HITB. Nowadays, he combines his skillsets to perform realistic adversary simulations and defence exercises for larger organisations. Fatih is also studying Master of Cyber Security (Advanced Tradecraft) at University of New South Wales at Australian Defence Force Academy.
https://au.linkedin.com/in/fozavci

Description:
Threat actors build their tradecraft for each campaign, they need to select the right tactics, techniques. Most of the time they use open source or commercial, but publicly available tools. They even re-purpose or pack existing malware acquired from other threat actors. The reason behind of this decision is tool development takes time, and if the known/current tools already work well, they don’t need upgrades either. However, the adversary simulation specialists need to operate in safer environments, therefore, they’re not allowed to use malicious tradecraft or unknown tools in general. Tradecraft development is an essential skills for an adversary simulation specialist as it needs custom C2 protocols, implants, safer but realistic Mitre Att&ck TTPs, and finally cutting-edge evasions for the modern security controls including EDRs and Cyber Analytics. In this workshop, we’ll walk through reasons and ways of Tradecraft development, talk about where to start, and to go, finding example source codes, walking through the source code of existing C2s, implants, and draft tools. We’ll also discuss about weaponization techniques such as offensive pipelines, modern evasions techniques and tool integrations. Duringthe exercises, we’ll prefer C# for programming, but you can replicate what you learn in various languages after this workshop (e.g. Python, Go, Rust). During the workshop, the participants will be able to develop their own implants, C2s, evasions and more using examples and active tools such as Petaq Purple Team C2 and Malware, TA505+ Adversary Simulation Pack and Tehsat Malware Traffic Generator

Adversary Village talks and workshops will be streamed on YouTube and Twitch.

Q&A sessions will happen in DEF CON Official Discord server after each talk.


YouTube: https://www.youtube.com/channel/UCOhn9WALnpb5YAbW18R1Hzg

Twitch: https://twitch.tv/adversaryvillage

Discord: https://discord.gg/defcon


Return to Index    -    Add to    -    ics Calendar file

 

IOTV - Friday - 11:45-12:30 PDT


Title: 1.21 Gigawatts! Vulnerabilities in Solar Panel Controllers
When: Friday, Aug 6, 11:45 - 12:30 PDT
Where: IoT Village (Talk - Virtual)

SpeakerBio:Waylon Grange
Waylon Grange is an experienced vulnerability researcher, reverse engineer, and developer. Prior to Stage 2, he worked for Symantec and the NSA. Waylon has been a speaker at Black Hat, DefCon, RSA, CanSecWest, and DerbyCon and is credited with a US patient, multiple CVEs, and exposing APT groups. His in-depth knowledge of embedded systems is utilized to evaluate the security of IoT systems and develop electronic badges for conferences.

Description:
Embedded device security has come a long way since the days of telnet and default passwords. Product vendors are now doing more to secure their devices but how effective are they? This presentation will outline many of the software and hardware-based attacks used to compromise embedded systems. It also discusses some of the mitigations used to prevent these attacks. Many previous IoT talks show the simplicity of hacking devices that have weak security or no hardening. In contrast, this presentation shows how even secured devices have attack surfaces that still need to be addressed. It demonstrates the need for embedded devices to incorporate a security lifecycle plan and hardware designs must be audited for security weakness before production. Topics to be covered include firmware image encryption, disabling UART console access, hardening JTAG development access, securing e.MMC storage, NOR Flash protection, processor glitching, update lifecycle attacks, avoiding custom crypto, dealing with reverse engineers, and initial device setup vs authentication. None of these topics will be a deep dive. The intent is to show how they are attacked or utilized to mitigate specific attacks. To illustrate these topics the presentation will use a recent security audit of a US solar equipment manufacturer as a case study. The vendor incorporated many best practices for securing embedded devices but made some architecture decisions in the guise of security that ended up weakening their security posture rather than helping it. Finally, we'll show the ramifications of an attack against solar systems and how it could be used for racketeering. Attacks in this talk are beneficial to system designers, hobbyists, and researchers.

IoT Village talks will be streamed to Twitch. Select speakers may be available in the IoT Village on-site to answer questions.

Twitch: https://www.twitch.tv/iotvillage


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 11:00-11:45 PDT


Title: 2021 - Our Journey Back To The Future Of Windows Vulnerabilities and the 0-days we brought back with us
When: Friday, Aug 6, 11:00 - 11:45 PDT
Where: Track 2 Live; DCTV/Twitch #2 Pre-Recorded
Speakers:Eran Segal,Tomer Bar

SpeakerBio:Eran Segal
Eran Segal is a security researcher, having 7+ years experience in cyber security research. He is working on security research projects in SafeBreach Labs in the last 2 years after serving in various sec positions at the IDF.

His experience involves research on Windows and embedded devices


SpeakerBio:Tomer Bar
Tomer Bar is hands-on security researcher and head of research manager with ~20 years of unique experience in the cyber security. In the Past, he ran research groups for the Israeli government and then lead the endpoint malware research for Palo Alto Networks. Currently, he leads the SafeBreach Labs research which is the research and development arm of SafeBreach.

His main interest is focused on Windows vulnerability research, reverse engineering and APT research.

His recent discoveries are vulnerabilities in the Windows Spooler mechansim and a research on the most persistent Iranian APT campaign. He is a contributor to Mitre Attack framework and a Speaker at BlackHat, Defcon and Sector conferences.


Description:
In 2020, security researchers reported a record number of Windows vulnerabilities. We were curious what superpowers will we get from researching this huge number of vulnerabilities? Can we leverage our findings to discover 0-days?

We decided to go back in time to 2016 to search for patterns and automatically classify all the public vulnerabilities since then. We believed that only by connecting the dots to a bigger picture, we will be able to come back 2021 with the success of achieving our goal.

We adopted a new approach, in terms of both the goal and how to get there. Until now, the main goal of patch-diff was focused on the root cause of the vulnerability and building a 1-day to exploit it Usually patch-diff was done manually on a single patch.

We reached higher for the holy grail. We understood that in order to find 0-days we needed to build an automated process that would gather all the insights from all the patches in a single, searchable db.

It worked! We discovered the root causes of multiple classes of vulnerabilities. We used these discoveries on a fully patched Windows 10 host in order to highlight opportunities for exploitation. As a consequence, we found and reported (1) 6 information disclosure vulnerabilities to Microsoft, (2) 2 post exploitation techniques allowing covert exfiltration of private user data, and (3) an additional surprise.

In this presentation, we'll describe our research process, demonstrate a live exploitation of the vulnerabilities we found, share the tools we developed, and explain how other researchers can use it to discover 0-days.

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=VxNi5pVDZU0

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Tomer%20Bar%20Eran%20Segal%20-%202021%20-%20Our%20Journey%20Back%20To%20The%20Future%20Of%20Windows%20Vulnerabilities%20and%20the%200-days%20we%20brought%20back%20with%20us.mp4


This talk will be given live in Track 2.

This talk has also been pre-recorded and will be broadcast on DCTV2, both in local hotels and on Twitch.


DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_two


Return to Index    -    Add to    -    ics Calendar file

 

IOTV - Friday - 13:30-14:15 PDT


Title: 5 years of IoT vulnerability research and countless 0days - A retrospective
When: Friday, Aug 6, 13:30 - 14:15 PDT
Where: IoT Village (Talk - Virtual)

SpeakerBio:Alex "Jay" Balan
Alex "Jay" Balan is the Security Research Director and Spokesperson for Bitdefender. His career is focused on Information Security and Innovation, fields in which he has so far accumulated over 20 years of experience. He is now furthering security and privacy research and has been actively involved in creating awareness by speaking at a number of conferences including DEFCON , Derbycon, RSA, BSides, ISC China, and many others

Description:
How many 0days can a research team discover in 4 years of vulnerability research in IoT? How many of them are relevant and can be used even today? How to get started (or advance further) with IoT vulnerability research? This talk will answer all these questions and show you some hands-on shell-popping and authentication bypasses as well as some new 0days published this year

IoT Village talks will be streamed to Twitch. Select speakers may be available in the IoT Village on-site to answer questions.

Twitch: https://www.twitch.tv/iotvillage


Return to Index    -    Add to    -    ics Calendar file

 

VMV - Friday - 11:00-11:30 PDT


Title: A Deep Dive on Vulnerability Disclosure for Election Systems
When: Friday, Aug 6, 11:00 - 11:30 PDT
Where: Voting Village (Talks - Virtual)

SpeakerBio:Tod Beardsley
Tod Beardsley is the Director of Research at Rapid7. He has over 30 years of hands-on security experience, stretching from in-band telephony switching to modern IoT implementations. He has held IT Ops and Security positions in large organizations such as 3Com, Dell, and Westinghouse, as both an offensive and defensive practitioner. Today, Tod directs the security research program at Rapid7, is a zealous advocate for coordinated vulnerability disclosure, is a CVE Board member, is a contributing author to a number of research papers produced by Rapid7, and is often a Travis County Election Judge in Texas. Because of this last qualifier, it is permissible to address him as “Your Honor.”

Description:
The norms and practices of vulnerability disclosure among voting machine manufacturers and election infrastructure providers have radically changed since the first Voting Machine Hacking Village of DEFCON 25. In just a few short years, private companies in the election services sector have matured from recalcitrant, close-lipped antagonists to active and willing participants in coordinated vulnerability disclosure (CVD) with published vulnerability disclosure programs (VDPs). And yet, truly unbelievable claims about voting security have risen to the fore, and as a result, the public imagination around how cybersecurity works and what are realistic threats to election integrity seems more fanciful than ever. In this short presentation, we will explore how CVD works for voting machines and other election systems, provide guidance on how well-meaning, virtuous hackers can best interface with this niche but crucial industry, and how we can all do our part to bring some reason and rigor to the practice of information security when it comes to one of our most important institutions.

Voting Village talks will be streamed to YouTube and Twitch.

Twitch: https://www.twitch.tv/votingvillagedc

YouTube: https://www.youtube.com/channel/UCnDevqsxt3sO8chqS5MGvwg


Return to Index    -    Add to    -    ics Calendar file

 

VMV - Friday - 12:00-12:10 PDT


Title: A Journalist’s Perspective on Fake News
When: Friday, Aug 6, 12:00 - 12:10 PDT
Where: Voting Village (Talks - Virtual)

SpeakerBio:Bob Sullivan
Bob Sullivan is a veteran journalist and the author of five books, including New York Times Best-Sellers, Gotcha Capitalism and Stop Getting Ripped Off! He has won the Society of Professional Journalists Public Service Award, a Peabody award, a Carnegie Mellon University CyLab Cybersecurity Journalism Award, and the Consumer Federation of America Betty Furness Consumer Media Service Award. He spent nearly two decades working at MSNBC.com and NBC News, and he still appears on TODAY, NBC Nightly News, and CNBC. He’s now a syndicated columnist and frequent TV guest. He is also host of AARP’s The Perfect Scam podcast, co-host of the podcast / audio documentary “Breach“, which examines history’s biggest hacking stories, and co-host of the podcast “So, Bob,” which tackles stories about the unintended consequences of technology. His latest podcast is called Debugger, exploring issues at the intersection of technology and democracy, produced in cooperation with Duke University’s Sanford School of Public Policy and the Kenan Institute for Ethics.

He holds a master’s degree in journalism from the University of Missouri and degrees in history and mathematics from Fairfield University. He is on the advisory board of the University of Georgia journalism school’s Cox Institute for Media Innovation and is a mentor/editor at the Op-Ed Project.


Description:
Why pseudo-events led to fake news.

Voting Village talks will be streamed to YouTube and Twitch.

Twitch: https://www.twitch.tv/votingvillagedc

YouTube: https://www.youtube.com/channel/UCnDevqsxt3sO8chqS5MGvwg


Return to Index    -    Add to    -    ics Calendar file

 

HHV - Friday - 13:30-14:30 PDT


Title: A Lazy r2 Solve of @mediumrehr Challenge 6
When: Friday, Aug 6, 13:30 - 14:30 PDT
Where: Hardware Hacking Village (Virtual Talk)

SpeakerBio:Ben Gardiner
Mr. Gardiner is an independent consultant at Yellow Flag Security, Inc. presently working to secure heavy vehicles at the NMFTA. With more than ten years of professional experience in embedded systems design and a lifetime of hacking experience, Gardiner has a deep knowledge of the low-level functions of operating systems and the hardware with which they interface. Prior YFS Inc. and joining the NMFTA team in 2019, Mr. Gardiner held security assurance and reversing roles at a global corporation, as well as worked in embedded software and systems engineering roles at several organizations. He holds a M.Sc. Eng. in Applied Math & Stats from Queen’s University. He is a DEF CON Hardware Hacking Village (DC HHV) and Car Hacking Village (CHV) volunteer.
Twitter: @BenLGardiner

Description:
Join Ben for an informal let’s play of @mediumrehr’s Hardware Hacking Village challenge 6. Some topics we will cover include: radare2 , AVR assembly, 7 segment displays, and sigrok. It should be fun and relaxed with plenty of time to stop and re-do some steps if something needs more deliberation. See you there.

#hhv-challenge-text https://discord.com/channels/708208267699945503/739567199647301702

Twitch: https://twitch.tv/dchhv


Hardware Hacking Village talks will be streamed to Twitch.

Twitch: https://www.twitch.tv/dchhv


Return to Index    -    Add to    -    ics Calendar file

 

BTV - Friday - 16:45-17:15 PDT


Title: A SERVERLESS SIEM: DETECTING ALL BADDIES ON A BUDGET
When: Friday, Aug 6, 16:45 - 17:15 PDT
Where: Blue Team Village - Main Track (Virtual)

SpeakerBio:Chen Cao
A security engineer at Cloudflare focuses on Detection and Response. Chen holds a Master of Science degree in Security Informatics from Johns Hopkins University and has been in the security industry for about 4 years now. He enjoys sharing & learning good practices in the industry and currently working on finding a reliable, scalable and cheap way for log collection and alerting.
Twitter: @chencao_cc

Description:
Commercial SIEMs are expensive, inflexible and risk a vendor lock-in. At Cloudflare, we built a SIEM using a Serverless architecture that provides scalability and flexibility to perform various Detection and Response functions. We will discuss this architecture and how it can be built upon to solve many Security problems, in a true pay-as-you-use model after 2 years of use handling Cloudflare’s data.

A SIEM is pivotal to a Threat Detection and Incident Response function. But, commercial SIEMs are expensive both in terms of cost of usage and maintenance, and risk a vendor lock-in. At Cloudflare, we build a SIEM to manage logs from 200+ data centers, 2000s endpoints and our corporate networks. The SIEM is built using a Serverless architecture in GCP that scales up and down based on usage, for a true pay-as-you-go model. It provides multiple data processing and analyzing paradigms that enable various D&R workflows. In this talk, we will discuss the motivation, constraints and the SIEM architecture. We’ll also dive into our logging pipeline, detection, automation and notification workflows using this SIEM.


Blue Team Village talks will be streamed to Twitch.

--

Twitch: https://twitch.tv/blueteamvillage


Return to Index    -    Add to    -    ics Calendar file

 

ASV - Friday - 09:00-17:59 PDT


Title: A-ISAC CTF -- Pre-registration Required
When: Friday, Aug 6, 09:00 - 17:59 PDT
Where: Aerospace Village (Virtual CTF)

Description:
A-ISAC, ERAU with support from IntelliGenesis (CybatiWorks)

Day 1: Aug. 6th, 2021 9:00AM – 6:00PM PDT (UTC-7) Day 2: Aug. 7th, 2021 9:00AM – 6:00PM PDT (UTC-7)

Registration available at https://aisac.cyberskyline.com/defcon

Aviation ISAC is hosting a competition at DC29 Aerospace Village! This competition represents a simulated airport hosted on the Cyber Skyline platform and is developed by the Department of Cyber Intelligence and Security at Embry-Riddle Aeronautical University (Prescott) and Matthew E. Luallen, Chief Executive Inventor at CybatiWorks powered by IntelliGenesis. The ethical design of the competition is achieved through investigative themes that provides a focus in blue team while still offering red team aspects.

Storyline for CTF: On 8/6, an employee from ERAU Airline noticed a USB stick inside one of their kiosks. After further investigation, airport security suspects someone is carrying out an attack against the airport. You have been brought in to retrace the steps of the attackers, determine where security needs to be hardened, regain control of compromised systems, and prevent a successful attack at the airport. Identify the criminals by retracing their steps and utilizing OSINT to identify which suspects need to be arrested. Investigators have not ruled out insider threats which means you must remain undetected by airport staff while you attempt to regain control of the airport’s infrastructure. Good Luck and remember to register ahead of time!

CybatiWorks part of the CTF Stage 7: Runway Lighting System: The Runway Lighting System (RLS) was taken over by the attackers and the lights are operating erratically. Identify what the attackers have changed causing the RLS HMI systems to work improperly and regain access to the remote logic controller operating the runway lights. Update the logic on the HMI system, regain control of the remote logic controller and successfully operate the RLS.

Architecture Design: The competitors are provided with a CybatiWorks custom docker image that they use to gain access to the operator and maintenance HMI logic. The competitors will review and update the logic to match the documentation provided in stage 4. Once the local components are successfully completed the competitors will request access to the remote RLS logic controller (i.e. a Raspberry PI with a 3d printed/LED runway lighting system accessible via a VPN). The competitors will complete additional challenges to confirm the logic program and then remotely control the RLS. All remote RLS stations will be visible


Return to Index    -    Add to    -    ics Calendar file

 

SOC - Friday - 13:00-23:59 PDT


Title: A&E Pool Party!
When: Friday, Aug 6, 13:00 - 23:59 PDT
Where: Bally's Pool

Description:
Pool Party Schedule is listed here: https://forum.defcon.org/node/238025

Return to Index    -    Add to    -    ics Calendar file

 

IOTV - Friday - 15:30-16:15 PDT


Title: “Alexa, have you been compromised?” — Exploitation of Voice Assistants in Healthcare (and other business contexts)
When: Friday, Aug 6, 15:30 - 16:15 PDT
Where: IoT Village (Talk - Virtual)

SpeakerBio:Hutch (Justin Hutchens)
Justin Hutchens (“Hutch”) is the Assessments Services Practice Lead at Set Solutions and manages TVM, IR, and GRC services. He is the co-host of the "Ready, Set, Secure" InfoSec podcast. He is also the creator of Sociosploit, a research blog which examines exploitation opportunities on the social web – a confluence of his interests in both hacking and social psychology. Hutch has spoken at multiple conferences to include HouSecCon, ToorCon, and DEF CON.

Description:
As voice assistant technologies (such as Amazon Alexa and Google Assistant) become increasingly sophisticated, we are beginning to see adoption of these technologies in the workplace. Whether supporting conference room communications, or even supporting interactions between an organization and its customers — these technologies are becoming increasingly integrated into the ways that we do business. While implementations of these solutions can streamline operations, they are not always without risk. During this talk, the speaker will discuss lessons learned during a recent penetration test of a large-scale “Alexa for Business” implementation in a hospital environment where voice assistants were implemented to assist with patient interactions during the peak of the COVID-19 pandemic. The speaker will provide a live demonstration of how a cyber-criminal could potentially use pre-staged AWS Lambda functions to compromise an “Alexa for Business” device with less than one-minute of physical access. Multiple attack scenarios will be discussed to include making Alexa verbally abuse her users (resulting in possible reputation damage), remote eavesdropping on user interactions, and even active “vishing” (voice phishing) attacks to obtain sensitive information. Finally, the talk will conclude with a discussion of best-practice hardening measures that can be taken to prevent your “Alexa for Business” devices from being transformed into foul-mouthed miscreants with malicious intent.

IoT Village talks will be streamed to Twitch. Select speakers may be available in the IoT Village on-site to answer questions.

Twitch: https://www.twitch.tv/iotvillage


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 15:00-15:45 PDT


Title: Abusing SAST tools! When scanners do more than just scanning
When: Friday, Aug 6, 15:00 - 15:45 PDT
Where: Track 2 Live; DCTV/Twitch #2 Pre-Recorded

SpeakerBio:Rotem Bar
Rotem Bar has over a decade of experience in the security field including penetration testing both application and network, design reviews, code reviews, architecture reviews, tech management, and of course development.

Over the years Rotem has gained experience in a diversity of industries from the financial services, to insurance, through high-tech & the automotive industry, along with other complex environments.

In the last couple of years Rotem has been working in concept design and development, pen testing and working with hardware in Cymotive, which is a company that focuses on end to end cyber security for the automotive industry, and after that he served as an application security expert at AppsFlyer.

Today Rotem is the Head of Marketplace Integrations at Cider Security, that is focusing on revolutionizing CI/CD security.

During his free time, Rotem plays with robotics, bug-bounty and and enjoys traveling with his family.

Twitter: @rotembar
www.rotem-bar.com

Description:
When we write code, we often run many scanners for different purposes on our code - from linters, to testing, security scanning, secret scanning, and more.

Scanning the code occurs on developers' machines and in CI/CD pipelines, which assumes the code is untrusted and unverified and based on this assumption scanners shouldn't have the ability to dynamically run code.

Our research focuses on the many static analyzers out there if this is really the case. Many of the scanners allow different ways of interaction - From requesting external resources, overriding the configuration and to remote code execution as part of the process.This talk will be technical and show examples of well-known scanning tools and how we created code that attacks them.

TLDR -
When integrating and using new tools in our CI systems and especially when running on unverified code, Which tools can we trust and how can we scan safe untrusted code in a secure way?

REFERENCES
https://github.com/jonase/kibit/issues/235 - Issue I raised in the past in one of the tools

Hiroki Suezawa in a thread in cloud security forum talked about exploiting terraform plan https://cloudsecurityforum.slack.com/archives/CNJKBFXMH/p1584035704035800

This reference was released after I've started my research but nevertheless a good resource and has interesting perspectives and I will reference it: https://alex.kaskaso.li/post/terraform-plan-rce

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=Jl-CU6G4Ofc

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Rotem%20Bar%20-%20Abusing%20SAST%20tools%20When%20scanners%20do%20more%20than%20just%20scanning.mp4


This talk will be given live in Track 2.

This talk has also been pre-recorded and will be broadcast on DCTV2, both in local hotels and on Twitch.


DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_two


Return to Index    -    Add to    -    ics Calendar file

 

ASV - Friday - 10:00-15:59 PDT


Title: ADSB Demo and Paper Airplanes
When: Friday, Aug 6, 10:00 - 15:59 PDT
Where: Aerospace Village (Workshop - Paris Rivoli B)

Description:
Interactive ADS-B demonstration and paper airplane activity. Educational and fun

Return to Index    -    Add to    -    ics Calendar file

 

BTV - Friday - 14:15-15:15 PDT


Title: Adventures in Pro Bono Digital Forensics Work
When: Friday, Aug 6, 14:15 - 15:15 PDT
Where: Blue Team Village - Main Track (Virtual)

SpeakerBio:John Bambenek
John Bambenek is President of Bambenek Labs, a threat intelligence firm, and a PhD student studying cyber security machine learning at the University of Illinois at Urbana-Champaign. He has 20 years experience investigating cyber crime and has participated in large investigations in ransomware, the 2016 election-related hacking, and extremist fundraising in cryptocurrency.
Twitter: @bambenek

Description:
Most of DFIR work never makes it to a courtroom and even when it does it is often unchallenged. This talk will cover cases of doing pro bono digital forensics for public defenders and journalists and the shoddy work that often passes for science.

One of the major problems with our justice system is how the power dynamics work when one side of a legal dispute has resources and the other does not. This plays out in digital forensics too. Most of our work never ends up in court and is rarely challenged. While most of us are honest, there is far more work that needs to be done and not enough qualified people doing it. In short, not every analyst is qualified or experienced but their testimony is accepted unquestioned.

This talk will cover cases that were performed pro bono for clients who would not normally have access to an expert to challenge the government’s experts. Cautionary tales of bad analysis will be shown to emphasize the importance of sound forensic techniques and the risks of sloppy work.

The talk will end with a call to action for more professionals to contribute their time on similar pro bono efforts.


Blue Team Village talks will be streamed to Twitch.

--

Twitch: https://twitch.tv/blueteamvillage


Return to Index    -    Add to    -    ics Calendar file

 

AVV - Friday - 12:15-12:59 PDT


Title: Adversary Village Keynote
When: Friday, Aug 6, 12:15 - 12:59 PDT
Where: Adversary Village (Virtual)

SpeakerBio:David Kennedy , CEO, TrustedSec
David is a cybersecurity authority whose mission is to drive the industry forward and make the world a more secure place. In addition to creating two large-scale cybersecurity firms, David has testified before Congress on issues of national security and has appeared as a subject matter expert on hundreds of national news and TV shows.

Prior to creating TrustedSec, David was a Chief Security Officer (CSO) for Diebold Incorporated, a Fortune 1000 company. As a forward thinker in the security field, David has had the privilege of speaking at some of the nation’s largest conferences, including Microsoft’s BlueHat, DEF CON, Black Hat, and DerbyCon, which he co-created in 2011 and expanded into DerbyCon Communities.

Twitter: @HackingDave
https://www.linkedin.com/in/davidkennedy4

Description:No Description available

Adversary Village talks and workshops will be streamed on YouTube and Twitch.

Q&A sessions will happen in DEF CON Official Discord server after each talk.


YouTube: https://www.youtube.com/channel/UCOhn9WALnpb5YAbW18R1Hzg

Twitch: https://twitch.tv/adversaryvillage

Discord: https://discord.gg/defcon


Return to Index    -    Add to    -    ics Calendar file

 

AVV - Friday - 12:00-12:15 PDT


Title: Adversary Village Kick-off
When: Friday, Aug 6, 12:00 - 12:15 PDT
Where: Adversary Village (Virtual)

SpeakerBio:Abhijith B R
No BIO available

Description:No Description available

Adversary Village talks and workshops will be streamed on YouTube and Twitch.

Q&A sessions will happen in DEF CON Official Discord server after each talk.


YouTube: https://www.youtube.com/channel/UCOhn9WALnpb5YAbW18R1Hzg

Twitch: https://twitch.tv/adversaryvillage

Discord: https://discord.gg/defcon


Return to Index    -    Add to    -    ics Calendar file

 

AIV - Friday - 14:30-14:59 PDT


Title: AI Policy Talk: "An AI Security ISAC" and "An AI Playbook"
When: Friday, Aug 6, 14:30 - 14:59 PDT
Where: AI Village (Virtual)

SpeakerBio:Sagar Samtani
No BIO available

Description:No Description available

AI Village events will be streamed to Twitch, and later be made available as videos on YouTube.

Speakers will be made available on DEF CON's Discord, in #aiv-general-text.


Twitch: https://www.twitch.tv/aivillage

YouTube: https://www.youtube.com/c/aivillage

#aiv-general-text: https://discord.com/channels/708208267699945503/732733090568339536


Return to Index    -    Add to    -    ics Calendar file

 

ASV - Friday - 11:30-12:59 PDT


Title: AIAA CubeSat Hacking Workshop - Virtual Lab #1
When: Friday, Aug 6, 11:30 - 12:59 PDT
Where: See Description

Description:
DEF CON participants will be able to interact with CubeSat hardware and ground equipment in cybersecurity sandbox environment.

For more information, please see https://aerospacevillage.org/events/upcoming-events/def-con-29/aiaa-cubesat-hacking-workshop/


Return to Index    -    Add to    -    ics Calendar file

 

ASV - Friday - 14:00-15:59 PDT


Title: AIAA CubeSat Hacking Workshop - Virtual Lab #2
When: Friday, Aug 6, 14:00 - 15:59 PDT
Where: See Description

Description:
DEF CON participants will be able to interact with CubeSat hardware and ground equipment in cybersecurity sandbox environment.

For more information, please see https://aerospacevillage.org/events/upcoming-events/def-con-29/aiaa-cubesat-hacking-workshop/


Return to Index    -    Add to    -    ics Calendar file

 

ASV - Friday - 10:00-11:30 PDT


Title: AIAA CubeSat Hacking Workshop - World Premier of the videos
When: Friday, Aug 6, 10:00 - 11:30 PDT
Where: See Description

Description:
DEF CON participants will be able to interact with CubeSat hardware and ground equipment in cybersecurity sandbox environment.

For more information, please see https://aerospacevillage.org/events/upcoming-events/def-con-29/aiaa-cubesat-hacking-workshop/


Return to Index    -    Add to    -    ics Calendar file

 

HTSV - Friday - 13:00-13:55 PDT


Title: AIS Protocol Internals (Abridged)
When: Friday, Aug 6, 13:00 - 13:55 PDT
Where: Hack the Sea (Virtual)

SpeakerBio:Gary Kessler
Gary Kessler, Ph.D., CISSP is a principal consultant at Fathom5, a retired professor of cybersecurity, and co-author of "Maritime Cybersecurity: A Guide for Leaders and Managers." He is a past speaker at DEFCON, where he has presented on AIS cybersecurity vulnerabilities and an encryption-based demonstration-of-capability method to mitigate some of those vulnerabilities. Gary's background is in mathematics and computer science, and he has spent several decades teaching about network protocols, data communications, digital forensics, and information security. He holds a leadership position in USCG Auxiliary cybersecurity efforts, is a Master SCUBA Diver Trainer, and holds a 50GT captain license.

Description:No Description available

Hack the Sea Village will stream their events to YouTube and Twitch.

Twitch: https://www.twitch.tv/h4ckthesea

YouTube: https://www.youtube.com/channel/UC5htD_rPiP8N7v8VQKyJkOQ


Return to Index    -    Add to    -    ics Calendar file

 

HTSV - Friday - 10:00-11:50 PDT


Title: AIS Tools Demo (DEF CON)
When: Friday, Aug 6, 10:00 - 11:50 PDT
Where: Hack the Sea (Virtual)

SpeakerBio:Gary Kessler
Gary Kessler, Ph.D., CISSP is a principal consultant at Fathom5, a retired professor of cybersecurity, and co-author of "Maritime Cybersecurity: A Guide for Leaders and Managers." He is a past speaker at DEFCON, where he has presented on AIS cybersecurity vulnerabilities and an encryption-based demonstration-of-capability method to mitigate some of those vulnerabilities. Gary's background is in mathematics and computer science, and he has spent several decades teaching about network protocols, data communications, digital forensics, and information security. He holds a leadership position in USCG Auxiliary cybersecurity efforts, is a Master SCUBA Diver Trainer, and holds a 50GT captain license.

Description:
This is a placeholder event.

Hack the Sea Village will stream their events to YouTube and Twitch.

Twitch: https://www.twitch.tv/h4ckthesea

YouTube: https://www.youtube.com/channel/UC5htD_rPiP8N7v8VQKyJkOQ


Return to Index    -    Add to    -    ics Calendar file

 

DL - Friday - 10:00-11:50 PDT


Title: AIS Tools
When: Friday, Aug 6, 10:00 - 11:50 PDT
Where: DemoLab Video Channel 1

SpeakerBio:Gary Kessler
Gary Kessler, Ph.D., CISSP is a principal consultant at Fathom5, a retired professor of cybersecurity, and co-author of "Maritime Cybersecurity: A Guide for Leaders and Managers." He is a past speaker at DEFCON, where he has presented on AIS cybersecurity vulnerabilities and an encryption-based demonstration-of-capability method to mitigate some of those vulnerabilities. Gary's background is in mathematics and computer science, and he has spent several decades teaching about network protocols, data communications, digital forensics, and information security. He holds a leadership position in USCG Auxiliary cybersecurity efforts, is a Master SCUBA Diver Trainer, and holds a 50GT captain license.

Description:
Tool or Project Name: AIS Tools

Short Abstract: AIS Tools is a suite of Perl-based scripts to create, capture, interpret, and play NMEA 0183 Automatic Identification System (AIS) messages.

Short Developer Bio: Gary Kessler, Ph.D., CISSP is a principal consultant at Fathom5, a retired professor of cybersecurity, and co-author of "Maritime Cybersecurity: A Guide for Leaders and Managers." He is a past speaker at DEFCON, where he has presented on AIS cybersecurity vulnerabilities and an encryption-based demonstration-of-capability method to mitigate some of those vulnerabilities. Gary's background is in mathematics and computer science, and he has spent several decades teaching about network protocols, data communications, digital forensics, and information security. He holds a leadership position in USCG Auxiliary cybersecurity efforts, is a Master SCUBA Diver Trainer, and holds a 50GT captain license.

URL to any additional information:
https://www.garykessler.net/library/ais_pi.html https://www.garykessler.net/software/AIS_README.TXT https://gpsd.gitlab.io/gpsd/AIVDM.html
https://github.com/trendmicro/ais/

Detailed Explanation of Tool:
AIS Tools is a suite of Perl scripts that allow a user to customize and parse National Marine Electronics Association (NMEA) 0183 standard AIS messages (seen in over-the-air broadcasts per ITU Recommendation M.1371). It is conceptually based upon the TrendMicro AIS Blacktoolkit, but is an extension intended for research and development purposes by incorporating more message types and standard default values.

The suite includes the following programs and functions: AIS_menu: Allows the user to create a custom NMEA 0183 AIS message by entering parameters specific to a requested message type. (At this time, the tools supports 22 of the 27 message types.) The output of the program is a properly formatted command line with all appropriate switches for the AIS_ping program. AIS_ping: AIS_ping allows a user to define an AIS message that will be properly formatted but could, in fact, contain invalid parameter values (a la hping3). The output is a binary string representing the AIS message. The binary string could be directed to a radio transmission (using Blacktoolkit software for GNU Radio) or formatted into one or more AIS sentences using AIS_NMEA. AIS_NMEA: This program accepts an AIS message binary string and produces a set of one or more AIS sentences. AIS_parser: Decodes an NMEA binary string or AIS sentence, displaying the contents field by field. parser2html: Produces HTML formatting of parsed messages. timestamp_data: Capture live AIS data from over-the-air transmissions and store the sentences in a file with a timestamp. play_ais: Replay timestamped AIS data from a file. This is code that was used for research and development purposes, gathering input from, and directing output to, OpenCPN. Data can also be received and broadcast via software-defined radio.

More detail can be found in https://www.garykessler.net/software/AIS_README.TXT

Supporting Files, Code, etc: https://www.garykessler.net/software/index.html#ais

Target Audience:
Defense, students, researchers, product developers (but, like any good tool, can be used for offense)

This tool is specifically directed at those interested in maritime cybersecurity, particularly with respect to navigation systems, but applies to anyone interested in a deep understanding of the AIS protocol as observed in over-the-air transmissions. It will aid researchers in capturing and analyzing AIS data, and designing scenarios with which to prepare exercises and test products.


This content will be presented on a Discord video channel.

#dl-video1-voice: https://discord.com/channels/708208267699945503/734027693250576505


Return to Index    -    Add to    -    ics Calendar file

 

AIV - Friday - 12:00-12:30 PDT


Title: Algorithmic Ethics Bug Bounty Contest Announcement
When: Friday, Aug 6, 12:00 - 12:30 PDT
Where: AI Village (Virtual)

SpeakerBio:Rumman Chowdhury
No BIO available

Description:No Description available

AI Village events will be streamed to Twitch, and later be made available as videos on YouTube.

Speakers will be made available on DEF CON's Discord, in #aiv-general-text.


Twitch: https://www.twitch.tv/aivillage

YouTube: https://www.youtube.com/c/aivillage

#aiv-general-text: https://discord.com/channels/708208267699945503/732733090568339536


Return to Index    -    Add to    -    ics Calendar file

 

WS - Friday - 10:00-13:59 PDT


Title: Analysis 101 and 102 for the Incident Responder
When: Friday, Aug 6, 10:00 - 13:59 PDT
Where: Workshops - Las Vegas 3+4 (Onsite Only)

SpeakerBio:Kristy Westphal , Vice President, Security Operations
Kristy Westphal is a versatile information technology professional with specific experience in providing advisory and management services in the area of information security and risk is currently employed as the Vice President, Security Operations at a financial services company. Specializing in leadership and program development, specific expertise in security areas includes: process analysis, risk assessments, security awareness programs, operating system security, network security, incident handling, vulnerability analysis and policy development.

Description:
You have a theory about something you have found while roaming the network or conducting your own hackfest, but how do you go about proving it? This workshop will be a hands-on journey deep into the world of analysis. While analysis is a bit of an art form, there are methods that can be applied to make it less of a gut feeling and more of a scientific approach to support your hypothesis. From network forensics to log analysis to endpoint forensics and cloud log analysis, we will review numerous quick methods to gain context over the data you have gathered and apply critical thinking in an attempt to find the answers. Sometimes, the answers weren’t meant to be found, but we’ll also discuss how to make the best of any conclusion that you reach.

Registration Link: https://www.eventbrite.com/e/analysis-101-and-102-for-the-incident-responder-las-vegas-3-4-tickets-162216976343

Prerequisites
None

Materials needed:
Laptop with Wireshark installed


Return to Index    -    Add to    -    ics Calendar file

 

ASV - Friday - 10:00-15:59 PDT


Title: Antenny
When: Friday, Aug 6, 10:00 - 15:59 PDT
Where: Aerospace Village (Virtual Workshop)

Description:
Come together to build on Antenny boards. Make things that can talk to the sky with very very very affordable hardware. What becomes possible when we have 1000 ground stations? I have a few ideas, I’m sure participants will have many others. Let’s build it and find out together!

Return to Index    -    Add to    -    ics Calendar file

 

ICSV - Friday - 15:00-15:30 PDT


Title: Approaches to Attract, Develop, and Retain an Industrial Cybersecurity Workforce
When: Friday, Aug 6, 15:00 - 15:30 PDT
Where: ICS Village (Virtual)
Speakers:John Ellis,Julia Atkinson

SpeakerBio:John Ellis , Siemens Energy
John Ellis has 10 years of experience in global customer-centric strategic and business roles with a focus on relationship building, commercial intelligence, strategic advisory, and transforming technological innovation into business success. In his current role as the Global Head of Industrial Cyber Alliances at Siemens Energy, he works to develop partnerships between industry, academia, and government to solve some of the most challenging critical infrastructure cybersecurity challenges. John holds a BS in Mechanical Engineering and an MS in Engineering Management from the University of Maryland Baltimore County, an MBA from Johns Hopkins Carey Business School, and an MPS in Cybersecurity and Information Assurance from Penn State.

SpeakerBio:Julia Atkinson , Siemens Energy
Julia Atkinson has 10 years of relationship building experience across multiple sectors including business, government, NGO, and journalism. As a Global Cyber Program Alliance Manager at Siemens Energy, Julia believes in the power of diverse partnerships in solving today’s cybersecurity challenges. Julia graduated with her Master’s Degree in International Economics and Strategic Studies from The Johns Hopkins School of Advanced International Studies and holds a Bachelor’s in Political Science from Yale University.

Description:
Gaps in the industrial cybersecurity workforce leave critical infrastructure assets vulnerable to attack. In a 2020 ICS2 report, 64% of companies reported a significant or slight shortage of cybersecurity professionals. At the same time, 56% of companies reported that their organization is extremely or moderately at risk due to the cyber workforce shortage. A National Initiative for Cybersecurity Education (NICE) report found that industry-wide there was only one qualified worker to fill every 10 cybersecurity jobs in 2020. To protect the cyber-physical systems that form the lifeblood of the economy, something needs to be done to develop the ICS/OT cybersecurity workforce pipeline. This session will present models to attract, develop, and retain talent in industrial cybersecurity.

ICS Village will be releasing their events to YouTube at each event's scheduled time. Discussion will be available on Discord in #ics-speaker-questions-and-answers-text.

YouTube: https://www.youtube.com/channel/UCI_GT2-OMrsqqglv0JijHhw

#ics-speaker-questions-and-answers-text: https://discord.com/channels/708208267699945503/735937961908109485


Return to Index    -    Add to    -    ics Calendar file

 

APV - Friday - 17:30-17:35 PDT


Title: AppSec Quiz Time!
When: Friday, Aug 6, 17:30 - 17:35 PDT
Where: AppSec Village (Virtual)

SpeakerBio:Eden Stroet
No BIO available

Description:No Description available

AppSec Village events will be streamed to YouTube.

YouTube: https://www.youtube.com/c/appsecvillage


Return to Index    -    Add to    -    ics Calendar file

 

APV - Friday - 11:00-10:59 PDT


Title: AppSec Village Capture the Flag Starts
When: Friday, Aug 6, 11:00 - 10:59 PDT
Where: AppSec Village (Virtual)

Description:
For more information, see https://www.appsecvillage.com/ctf

AppSec Village events will be streamed to YouTube.

YouTube: https://www.youtube.com/c/appsecvillage


Return to Index    -    Add to    -    ics Calendar file

 

VMV - Friday - 12:30-12:59 PDT


Title: Are Barcodes on Ballots Bad? 
When: Friday, Aug 6, 12:30 - 12:59 PDT
Where: Voting Village (Talks - Virtual)

SpeakerBio:Kevin Skoglund
Ke​​vin Skoglund is a digital security and election technology expert, and the President and Chief Technologist for Citizens for Better Elections, a non-profit, non-partisan group advocating for evidence-based elections. Kevin serves on the Board of Advisors for Verified Voting, participates in the NIST Voting System Cybersecurity Working Group which develops national guidelines for U.S. voting systems, and is a designated speaker on election security for the U.S. Department of State. His past work includes advising nonprofits, counties, cities, and members of the U.S. Congress on voting system technology and election legislation, researching security vulnerabilities, and identifying voting systems connected to the internet. Kevin is also a Judge of Election (chief poll worker) in Pennsylvania. Outside of his election work, Kevin has been a programmer, consultant, and teacher for over 20 years.

Description:
This presentation focuses on the use of barcodes on ballots, specifically barcodes on ballots that store vote selections. Skoglund teaches us how voting systems store votes and barcodes, explains how to decode them, and explores their attack surface from a security perspective. Through close examination of three examples (ES&S ExpressVote, Dominion ImageCast X, Unisyn Freedom Vote Tablet), the presentation explains potential attacks, and highlights detection and mitigation strategies.

Voting Village talks will be streamed to YouTube and Twitch.

Twitch: https://www.twitch.tv/votingvillagedc

YouTube: https://www.youtube.com/channel/UCnDevqsxt3sO8chqS5MGvwg


Return to Index    -    Add to    -    ics Calendar file

 

LPV - Friday - 13:00-13:20 PDT


Title: Are We Still Doing it? 10 Locksport Hobbies that go Beyond Lock Picking
When: Friday, Aug 6, 13:00 - 13:20 PDT
Where: Lock Pick Village (Virtual)

SpeakerBio:Lock Noob
No BIO available

Description:
There is so much more to locksport than just lock picking. In this presentation I look at 10 inspiring locksport hobbies that every lock picker should try! From key casting to tool making, from impressioning to making jewellery and many more, you will be surprised by the range and depth of the skills you can choose from.

Lock Pick Village will be streaming their activities to Twitch and YouTube.

Twitch: https://www.twitch.tv/toool_us?

YouTube: https://youtube.com/c/TOOOL-US


Return to Index    -    Add to    -    ics Calendar file

 

ASV - Friday - 10:00-15:59 PDT


Title: ARINC 429 Lab
When: Friday, Aug 6, 10:00 - 15:59 PDT
Where: Aerospace Village (Workshop - Virtual + Paris Rivoli B)

Description:
Sessions will be held for small audience 15-20 users to demonstrate the structure and use of avionic-specific communication protocol (ARINC 429). This is an opportunity for hands-on experience in a controlled setting.

Return to Index    -    Add to    -    ics Calendar file

 

BHV - Friday - 13:30-14:30 PDT


Title: At least ten questions for “Bad HIPPA Takes” (@BadHIPPA), 2021’s best tweeter on privacy, pandemic, and snark.
When: Friday, Aug 6, 13:30 - 14:30 PDT
Where: Biohacking Village (Talk - Virtual)

SpeakerBio:Lucia Savage , 21st Century health care strategic expert
Lucia is a nationally recognized expert on health information privacy. She was an architect of the foundational aspects of ONC's new interoperability rules. She believes in vaccine records.
Twitter: @savagelucia

Description:
From the start of the pandemic, through the election and the insurrection on the Capitol and on into the vaccine roll-out, the nationwide health privacy law, HIPAA, has gotten more famous and more misunderstood than ever. Out of this morass of politicization and polemic emerged “Bad HIPPA Takes” (@BadHIPPA), shining a light on the absurd, funny, sad and even accurate in a must-follow for anyone interested in privacy. In this session, we’ll ask Bad HIPPA Takes some questions, check out their views based on the past year, and even see if they have any inkling about the future of privacy law in the U. S.

All Biohacking Village talks will be streamed to YouTube.

YouTube: https://www.youtube.com/channel/UCm1Kas76P64rs2s1LUA6s2Q


Return to Index    -    Add to    -    ics Calendar file

 

PYV - Friday - 10:00-10:59 PDT


Title: ATM Transaction Reversal Frauds (And how to fight them)
When: Friday, Aug 6, 10:00 - 10:59 PDT
Where: Payment Village (Virtual)

SpeakerBio:Hector Cuevas Cruz
No BIO available

Description:
Transaction Reversal Frauds (TRF) are a type of attack that doesn't require a malware, complex physical attacks or even opening an ATM, instead they abuse some business and operational rules defined by the financial institutions to cash-out an ATM. This presentation describe what Transaction Reversal Frauds are, why this type of attacks are on rise and more important, how to detect them through an integral analysis of journaling and some other logs

Payment Village events will stream to Twitch and YouTube.

--

Twitch: https://www.twitch.tv/paymentvillage

YouTube: https://www.youtube.com/c/PaymentVillage


Return to Index    -    Add to    -    ics Calendar file

 

BTV - Friday - 09:30-10:59 PDT


Title: Attack and Detect with Prelude Operator and Security Onion
When: Friday, Aug 6, 09:30 - 10:59 PDT
Where: Blue Team Village - Workshop Track 1 (Virtual)

SpeakerBio:Wes Lambert
Wes Lambert is the Director of Support and Professional Services at Security Onion Solutions, where he helps customers to implement enterprise security monitoring solutions and understand their computer networks. A huge fan of OSS projects, Wes loves to solve problems and enhance security using completely free and easily deployable tools.
Twitter: @therealwlambert

Description:
In this workshop, we’ll leverage Prelude Operator, an easy-to-use desktop platform for autonomous red teaming. With Operator, we can generate adversary profiles, complete with TTPs and goals, then deploy an “adversary”, evaluating our detection coverage against the MITRE ATT&CK framework using Security Onion, a free and open platform for intrusion detection, enterprise security monitoring, and log management. By providing network, host, and other types of data, Security Onion can provide a leg up to defenders, allowing them to track down their adversaries and make them cry.

This talk will go over the introduction of red/purple teaming, along with how individuals can emulate adversary actions, as well as track those actions across their enterprise, evaluating their detection coverage.

We'll first go over how a tool like Prelude Operator can be used to emulate these adversary actions, then learn how Security Onion can be leveraged to detect these actions and track our coverage across the MITRE attack framework.

Throughout the discussion the following tools will be introduced:

Prelude Operator - autonomous red-teaming platform, creating adversaries to test detection Zeek - Policy-neutral NIDS
Suricata - Signature-based NIDS
Stenographer – Full Packet capture
Playbook - Detection development
ATT&CK Navigator - Track detection coverage Strelka - File analysis
Osquery - Host-based monitoring
Wazuh - HIDS


Return to Index    -    Add to    -    ics Calendar file

 

CLV - Friday - 12:05-12:50 PDT


Title: Attacking Modern Environments Series: Attack Vectors on Terraform Environments
When: Friday, Aug 6, 12:05 - 12:50 PDT
Where: Cloud Village (Virtual)

SpeakerBio:Mazin Ahmed
Mazin Ahmed is a security engineer that specializes in AppSec and offensive security. He is passionate about information security and has previously found vulnerabilities in Facebook, Twitter, Linkedin, and Oracle to name a few. Mazin is the developer of several popular open-source security tools that have been integrated into security testing frameworks and distributions. Mazin also built FullHunt.io, the next-generation continuous attack surface security platform. He is also passionate about cloud security where he has been running dozens of experiments in the cloud security world.
Twitter: @mazen160

Description:
Ever come across an environment in an engagement that uses Terraform for IAC (infrastructure-as-code) management? Almost every modern company does now.

In this talk, I will be sharing techniques and attack vectors to exploit and compromise Terraform environments in engagements, as well as patterns that I have seen that achieve successful infrastructure takeover against companies. I will be also covering prevention methods for the discussed attack vectors in my talk. This is part of my work-in-progress research in cloud security and attacking modern environments.


Cloud Village activities will be streamed to YouTube.

YouTube: https://www.youtube.com/cloudvillage_dc


Return to Index    -    Add to    -    ics Calendar file

 

PYV - Friday - 12:00-12:59 PDT


Title: Automated Tear Machines
When: Friday, Aug 6, 12:00 - 12:59 PDT
Where: Payment Village (Virtual)

SpeakerBio:Meadow Ellis
No BIO available

Description:
Short, yet packed with information talk about why ATMs are bad, why they are a literal magnet for criminals, what types of attacks do actually happen and why it is so bloody hard to do any kind of research on them, unless you are a criminal. I won't bore you with stuff you can read on Wikipedia but rather give you an overview of terms, parts and crazy things people do to either get the money out of you or out of an ATM itself. And, what can you do to try and protect yourself and what to do when you see something 'that doesn't look right'. Don't tear off the magstripe from your card, though.

Payment Village events will stream to Twitch and YouTube.

--

Twitch: https://www.twitch.tv/paymentvillage

YouTube: https://www.youtube.com/c/PaymentVillage


Return to Index    -    Add to    -    ics Calendar file

 

SOC - Friday - 14:00-15:59 PDT


Title: BADASS Meetup (Virtual)
When: Friday, Aug 6, 14:00 - 15:59 PDT
Where: See Description

Description:
We represent the BADASS army, an organization that empowers and assists victims of revenge-porn and non-consensual images through education in privacy, operational security, and evidence collection. This’d be an event where we discuss how we fight NCI/RP, how that battlespace has changed, what we’ve learned and more.

BADASS is going to be from 2 PM PDT til 4 PM PDT on Discord in Fireside Lounge for a video discussion.


Fireside Lounge: https://discord.com/channels/708208267699945503/738141986476916826


Return to Index    -    Add to    -    ics Calendar file

 

BCV - Friday - 11:30-11:59 PDT


Title: BCOS Village Contest Overview
When: Friday, Aug 6, 11:30 - 11:59 PDT
Where: Blockchain Village / Paris Vendome B

SpeakerBio:Reddcoin
No BIO available

Description:No Description available

This content will be presented live and in-person.

Return to Index    -    Add to    -    ics Calendar file

 

ICSV - Friday - 13:00-13:30 PDT


Title: Beetlejuice: The Lessons We Should Have Learned For ICS Cybersecurity
When: Friday, Aug 6, 13:00 - 13:30 PDT
Where: ICS Village (Virtual)

SpeakerBio:Tim Yardley , University of Illinois Urbana-Champaign
Tim Yardley is a Principal Research Scientist and Associate Director at the Information Trust Institute (ITI) in the University of Illinois Urbana-Champaign. He works on trustworthiness and resiliency in critical infrastructure. Much of his work has focused on experimentation frameworks, device analytics, assessments, verification and validation, intrusion detection and data fusion approaches. Enough of the boring bio’s though, let’s have some fun.
Twitter: @timyardley

Description:
In this talk I will present the top 15 quotes from redacted and how we can transform them to operational advice to improve ICS cyber security. Hold tight, this is going to be a wild ride.

ICS Village will be releasing their events to YouTube at each event's scheduled time. Discussion will be available on Discord in #ics-speaker-questions-and-answers-text.

YouTube: https://www.youtube.com/channel/UCI_GT2-OMrsqqglv0JijHhw

#ics-speaker-questions-and-answers-text: https://discord.com/channels/708208267699945503/735937961908109485


Return to Index    -    Add to    -    ics Calendar file

 

CON - Friday - 10:00-13:59 PDT


Title: Beverage Cooling Contraption Contest
When: Friday, Aug 6, 10:00 - 13:59 PDT
Where: See Description

Description:
For more information, see https://forum.defcon.org/node/236475

Return to Index    -    Add to    -    ics Calendar file

 

BHV - Friday - 10:00-10:45 PDT


Title: Biohacking Village Welcome Keynote
When: Friday, Aug 6, 10:00 - 10:45 PDT
Where: Biohacking Village (Talk - Virtual)

SpeakerBio:Nina Alli , Executive Director, Biohacking Village
No BIO available

Description:
Willkommen, Bienvenue, Bienvenido, Bem-vindo, Добро пожаловать, أهلا بك , ברוך הבא, kaabo.

Lets talk about the strides we, as a village and a community, have made in one year.


All Biohacking Village talks will be streamed to YouTube.

YouTube: https://www.youtube.com/channel/UCm1Kas76P64rs2s1LUA6s2Q


Return to Index    -    Add to    -    ics Calendar file

 

IOTV - Friday - 10:00-18:30 PDT


Title: Black Box Challenges
When: Friday, Aug 6, 10:00 - 18:30 PDT
Where: IoT Village (Onsite)

Description:
For more information, see https://www.iotvillage.org/defcon.html

Return to Index    -    Add to    -    ics Calendar file

 

CON - Friday - 12:00-17:59 PDT


Title: Blacks in Cybersecurity CTF
When: Friday, Aug 6, 12:00 - 17:59 PDT
Where: See Description

Description:
For more information, see https://forum.defcon.org/node/236493 or https://www.blacksincyberconf.com/ctf

Return to Index    -    Add to    -    ics Calendar file

 

BCV - Friday - 14:00-14:30 PDT


Title: Blockchain Security Tools
When: Friday, Aug 6, 14:00 - 14:30 PDT
Where: Blockchain Village / Paris Vendome B

SpeakerBio:Mila Paul , Blockchain Security Researcher
Mila Paul is a researcher in cybersecurity and blockchain startup technology. Her background includes systems, network and storage in a secure and virtual infrastructure. She recently earned a Ph.D in Cyber Operations and enjoys teaching.

Description:
Blockchain was originally created by cypherpunks to integrate privacy and integrity in cash transactions. Since the inception of Bitcoin and its blockhain back-end, research and development in blockchain has revealed its strength in providing security through cryptology. This lecture inspires an exploration into finding blockchain based solution for common cybersecurity issues.

This content will be presented live and in-person.

Return to Index    -    Add to    -    ics Calendar file

 

IOTV - Friday - 14:30-15:15 PDT


Title: BLUEMONDAY Series – Exploitation & Mapping of vulnerable devices at scale through self-registration services (DATTO/ EGNYTE/ SYNOLOGY/ MERAKI/ GEOVISION)
When: Friday, Aug 6, 14:30 - 15:15 PDT
Where: IoT Village (Talk - Virtual)

SpeakerBio:Ken Pyle
Ken Pyle is a partner of CYBIR, specializing in Information Security, exploit development, penetration testing and enterprise risk management. Ken is a graduate professor of CyberSecurity at Chestnut Hill College. He has published academic works on a wide range of topics and has presented at industry events such as ShmooCon, Secureworld, HTCIA International.

Description:
Vendors like DATTO, MERAKI, GEOVISION, SYNOLOGY, EGNYTE and others are which leverage or depend on these services are imperiling data, networks, and businesses through insecure design, intentional design decisions, and web application flaws.

These devices frequently self-provision services which leak critical data or through insecure network design and installation practices which are easily mapped, attacked, and discovered via insecure vendor, software, and integrator practices (ex. PKI, Dynamic DNS, “Finder” service registrations, DNS leakage, Layer 2 Attacks / DHCP network attacks, DNS passive hijacking through domain purchases & active record injection)

Some concepts and new attacks may be obliquely referenced or held private by the researcher. Essential PoC is contained in this document and is easily reproduced using supplied narrative and screenshots.

The affected devices are easily discoverable either through insecure practices (ex. insecure Zones, algorithmic FQDN generation, lack of local network controls, public metadata leakage) or vendor provided interfaces and access methods. (DATTOWEB, DATTOLOCAL, SYNOLOGY.ME, DYNAMIC-M, GVDIP.COM, EGNYTE-APPLIANCE.COM)

Many issues develop due to these problems. For example, nearly all of these devices and appliances provide easily discoverable portals / content / metadata with which to craft extremely convincing social engineering campaigns, even in the absence of technical exploit vectors.

Host Header Attacks & 302 redirects used in concert with malicious DNS records / spoofed or squatted domains can be abused in this manner. An attacker can identify the MERAKI device a victim uses through registration, abuse the API to obtain sensitive metadata, and send the victim to a spoofed site or malicious content purported to be a Meraki Dashboard alert. An attacker can change the dynamic DNS record through a number of vectors (ex. Third party service attacks, local vectors) and effectively “hijack” the user or content being accessed.

Through our DNS harvesting and our undisclosed 0-days, we can establish a complex exploit network and botnet via poor vendor controls (ex. MIRAI) We can also hide exploit code in APIs, persist across multiple appliance types, and abuse multiple dynamic DNS networks.

The DNS zones we have provided are intentionally designed, demonstrably insecure, provide detailed information, and can be abused easily. Registrations can be abused for data exfiltration or beaconing over the vendor’s DNS network. These DYNAMIC DNS services allow for efficient, mass exploitation and recon. The poor controls and “spoofability” of these networks (will demonstrate at another time) allow an attacker to not only FIND vulnerable devices.. but automate mass exploitation via attacks such as those we provided or other common attacks.

The author wishes for this to be noted as responsible disclosure and ethical considerations for the attacks / exploits seriously impacted disclosure dates and continues to.

Some initial work can be found here:

https://cybir.com/2021/cyber-security/bluemonday-series-part-1-exploitation-mapping-of-vulnerable-devices-at-scale-through-self-registration-services/


IoT Village talks will be streamed to Twitch. Select speakers may be available in the IoT Village on-site to answer questions.

Twitch: https://www.twitch.tv/iotvillage


Return to Index    -    Add to    -    ics Calendar file

 

CHV - Friday - 14:00-14:59 PDT


Title: Bug Hunter's Guide to Bashing for a Car Hacking Bug Bash or Contest
When: Friday, Aug 6, 14:00 - 14:59 PDT
Where: Car Hacking Village - Talks (Virtual)

SpeakerBio:Jay Turla , Manager, Security Operations at Bugcrowd
Jay Turla is a Manager, Security operations at Bugcrowd Inc., and one of the goons of ROOTCON. He has been acknowledged and rewarded by Facebook, Adobe, Yahoo, Microsoft, Mozilla, etc. for his responsible disclosures. He has also contributed auxiliary and exploit modules to the Metasploit Framework: Host Header Injection Detection, BisonWare BisonFTP Server Buffer Overflow, Zemra Botnet CnC Web Panel Remote Code Execution, Simple Backdoor Shell Remote Code Execution, w3tw0rk / Pitbul IRC Bot Remote Code Execution, etc. He used to work for HP Fortify where he performs Vulnerability Assessment, Remediation and Advance Testing.

Description:
Bug Bounty Programs and Bug Bashes geared towards vehicles or automobiles are getting attention now. A lot of our brethren have also been wining some of these competitions. What is their secret to their success? How do you prepare for one? This talk will summarize some techniques and methodologies the speaker observed during his stint as a triager for automotive security bugs and a common car hacker. This talk will also be an eye opener for other bug hunters who wants to dive into car hacking so that they may be able to participate car hacking bug bashes soon.

This talk will stream on YouTube.


YouTube: https://www.youtube.com/watch?v=5-JM1QRGUYc


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 16:00-16:45 PDT


Title: Bundles of Joy: Breaking macOS via Subverted Applications Bundles
When: Friday, Aug 6, 16:00 - 16:45 PDT
Where: Track 2 Live; DCTV/Twitch #2 Pre-Recorded

SpeakerBio:Patrick Wardle
Patrick Wardle is the founder of Objective-See. Having worked at NASA and the NSA, as well as presenting at countless security conferences, he is intimately familiar with aliens, spies, and talking nerdy. Patrick is passionate about all things related to macOS security and thus spends his days finding Apple 0days, analyzing macOS malware, and writing free open-source security tools to protect Mac users.
Twitter: @patrickwardle
https://objective-see.com/

Description:
A recent vulnerability, CVE-2021-30657, neatly bypassed a myriad of foundational macOS security features such as File Quarantine, Gatekeeper, and Notarization. Armed with this capability attackers could (and were!) hacking macOS systems with a simple user (double)-click. Yikes!

In this presentation we’ll dig deep into the bowels of macOS to uncover the root cause of the bug: a subtle logic flaw in the complex and undocumented policy subsystem. Moreover, we’ll highlight the discovery of malware exploiting this bug as an 0day, reversing Apple’s patch, and discuss novel methods of both detection and prevention.

REFERENCES
“All Your Macs Are Belong To Us” https://objective-see.com/blog/blog_0x64.html “macOS Gatekeeper Bypass (2021 Edition)” https://cedowens.medium.com/macos-gatekeeper-bypass-2021-edition-5256a2955508 “Shlayer Malware Abusing Gatekeeper Bypass On Macos” https://www.jamf.com/blog/shlayer-malware-abusing-gatekeeper-bypass-on-macos/

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=raSTgFqYaoc

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Patrick%20Wardle%20-%20Bundles%20of%20Joy%20-%20Breaking%20macOS%20via%20Subverted%20Applications%20Bundles.mp4


This talk will be given live in Track 2.

This talk has also been pre-recorded and will be broadcast on DCTV2, both in local hotels and on Twitch.


DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_two


Return to Index    -    Add to    -    ics Calendar file

 

CON - Friday - 10:00-23:55 PDT


Title: Car Hacking CTF
When: Friday, Aug 6, 10:00 - 23:55 PDT
Where: See Description

Description:
For more information, see https://forum.defcon.org/node/236495

Return to Index    -    Add to    -    ics Calendar file

 

BCV - Friday - 13:00-13:59 PDT


Title: Catching (and Fixing) an Unlimited Burn Vulnerability
When: Friday, Aug 6, 13:00 - 13:59 PDT
Where: Blockchain Village / Paris Vendome B

SpeakerBio:Nadir Akhtar , Blockchain Security Engineer, Coinbase
Blockchain security engineer @ Coinbase with deep expertise in digital asset security vulnerabilities https://blog.coinbase.com/securing-an-erc-20-token-for-launch-on-coinbase-68313652768f Former President, Blockchain @ Berkeley edX Blockchain Fundamentals curriculum developer and lecturer

Nadir Akhtar is a Blockchain Security engineer at Coinbase, where he leads security reviews of assets under consideration for Coinbase listing. Previously at Quantstamp, he audited smart contracts and contributed to a book on smart contract security fundamentals. He graduated from UC Berkeley in 2019 with a degree in Computer Science. During his time in Blockchain at Berkeley, he was President and an instructor for the UC Berkeley-endorsed blockchain fundamentals edX course series, reaching over 225,000 enrolled students to date.


Description:
Bitcoin, Ethereum, and more blockchains come with an infamous storage problem: taking up too much space on miners’ hard drives. In response, protocols are implementing novel methods for reducing the size of the blockchain, often deleting accounts beneath a certain balance. DOT provides a case study of the financial consequences to exchanges of pruning account data.

In this talk, you’ll learn about Polkadot’s reaping mechanism and its implications for exchanges and other organizations managing DOT at scale. We’ll dive into the “Existential Deposit,” understanding its motivation for existing in the network as well as the implications of pruning account data below a certain threshold, namely replay attacks.

We’ll discover how replay attacks can be performed, as well as their consequences through a demonstration along with some protocol-level mitigations. We’ll discuss how naively reaping accounts can still expose exchanges to attacks, investigate potential but infeasible mitigations, then finally reveal the solution which Coinbase discovered for protection against replay attacks.

Finally, we’ll examine some final edge cases which arose from the final solution, demonstrating that protecting against attacks may not be perfect but significantly improves our defenses.


This content will be presented live and in-person.

Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 11:00-11:59 PDT


Title: Caught you - reveal and exploit IPC logic bugs inside Apple
When: Friday, Aug 6, 11:00 - 11:59 PDT
Where: DCTV/Twitch #3 Pre-Recorded
Speakers:Chuanda Ding,Yuebin Sun,Zhipeng Huo

SpeakerBio:Chuanda Ding
Chuanda Ding is a senior security researcher on Windows platform security. He leads EcoSec team at Tencent Security Xuanwu Lab. He was a speaker at Black Hat Europe 2018, DEF CON China 2018, CanSecWest 2017, CanSecWest 2016, and QCon Beijing 2016.
Twitter: @FlowerCode_

SpeakerBio:Yuebin Sun
Yuebin Sun is a senior security researcher at Tencent Security Xuanwu Lab.
Twitter: @yuebinsun2020

SpeakerBio:Zhipeng Huo
Zhipeng Huo is a senior security researcher on macOS and Windows platform security at Tencent Security Xuanwu Lab. He was a speaker at Black Hat Europe 2018 and DEF CON 28.
Twitter: @R3dF09

Description:
Apple's iOS, macOS and other OS have existed for a long time. There are numerous interesting logic bugs hidden for many years. We demonstrated the world's first public 0day exploit running natively on Apple M1 on a MacBook Air (M1, 2020). Without any modification, we exploited an iPhone 12 Pro with the same bug.

In this talk, we will show you the advantage and beauty of the IPC logic bugs, how we rule all Apple platforms, Intel and Apple Silicon alike, even with all the latest hardware mitigations enabled, without changing one line of code. We would talk about the security features introduced by Apple M1, like Pointer Authentication Code (PAC), System Integrity, and Data Protection. How did they make exploiting much harder to provide better security and protect user's privacy. We will talk about different IPC mechanisms like Mach Message, XPC, and NSXPC. They are widely used on Apple platforms which could be abused to break the well designed security boundaries.

We will walk you through some incredibly fun logic bugs we have discovered, share the stories behind them and methods of finding them, and also talk about how to exploit these logic bugs to achieve privilege escalation.

REFERENCES
https://www.youtube.com/watch?v=Kh6sEcdGruU https://support.apple.com/en-us/HT211931 https://support.apple.com/en-us/HT211850 https://support.apple.com/en-us/HT212011 https://support.apple.com/en-us/HT212317 https://helpx.adobe.com/security/products/acrobat/apsb20-24.html https://helpx.adobe.com/security/products/acrobat/apsb20-48.html https://helpx.adobe.com/security/products/acrobat/apsb20-67.html

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=oAMZxKsZQp0

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Zhipeng%20Huo%20Yuebin%20Sun%20Chuanda%20Ding%20-%20Caught%20you%20-%20reveal%20and%20exploit%20IPC%20logic%20bugs%20inside%20Apple.mp4


This talk has been pre-recorded and will be released to the DEF CON Media Server, torrents, and YouTube. At the time of this event, it will also stream on DCTV3, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_three


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 09:00-20:59 PDT


Title: Chillout Lounges
When: Friday, Aug 6, 09:00 - 20:59 PDT
Where: See Description
Speakers:djdead,DJ Pie & Darren,kampf,Merin MC,s1gns of l1fe,Mixmaster Morris

SpeakerBio:djdead
No BIO available

SpeakerBio:DJ Pie & Darren
No BIO available

SpeakerBio:kampf
No BIO available

SpeakerBio:Merin MC
No BIO available

SpeakerBio:s1gns of l1fe
No BIO available

SpeakerBio:Mixmaster Morris
No BIO available

Description:
There are two onsite chillout lounges available: Bally's Silver Ballroom, and Paris Concorde A.

There will be chill music playing:

09:00-12:00 DJ Pi & Darren
12:00-12:40 s1gns of l1fe
12:40-14:20 Mixmaster Morris
14:30-17:00 kampf
17:00-18:30 Merin MC
18:30-21:00 djdead

You can also watch the chill room stream on Twitch.


Twitch: https://www.twitch.tv/defcon_chill


Return to Index    -    Add to    -    ics Calendar file

 

CLV - Friday - 07:00-12:15 PDT


Title: Cloud Village CTF - Registration
When: Friday, Aug 6, 07:00 - 12:15 PDT
Where: See Description

Description:
For more information, see https://cloud-village.org/

Return to Index    -    Add to    -    ics Calendar file

 

CLV - Friday - 11:00-12:15 PDT


Title: Cloud Village CTF
When: Friday, Aug 6, 11:00 - 12:15 PDT
Where: See Description

Description:
For more information, see https://cloud-village.org/

Return to Index    -    Add to    -    ics Calendar file

 

CON - Friday - 10:00-15:59 PDT


Title: CMD+CTRL
When: Friday, Aug 6, 10:00 - 15:59 PDT
Where: See Description

Description:
For more information, see https://forum.defcon.org/node/236481

Return to Index    -    Add to    -    ics Calendar file

 

CON - Friday - 00:00-23:59 PDT


Title: Coindroids
When: Friday, Aug 6, 00:00 - 23:59 PDT
Where: See Description

Description:
For more information, see https://forum.defcon.org/node/236482

Return to Index    -    Add to    -    ics Calendar file

 

ASV - Friday - 15:30-15:55 PDT


Title: Collecting CANs: a Bridge Less Traveled
When: Friday, Aug 6, 15:30 - 15:55 PDT
Where: Aerospace Village (Virtual Talk)

SpeakerBio:Peace Barry
Having worked as a Metasploit developer and later as a manager of Metasploit development at Rapid7, Pearce currently keeps busy doing security research at Rumble, Inc. and following advances in space technologies.

Description:
We’ll step back a few years to early 2017, when @zombieCraig released the Metasploit Hardware Bridge as a mechanism to allow Metasploit Framework to reach into networks beyond Ethernet. While the now-defunct HWBridge initially focused on automotive targets, some of that tech, including CAN buses and RF transceivers, has commonality in aviation targets. In this talk, we’ll cover basic design and use of the HWBridge, how one can use it with CAN and RF transceivers, and what it takes to set it up.

This talk will be streamed on YouTube: https://www.youtube.com/watch?v=6nxlqh-m3Jc


Aerospace Village talks will be streamed to YouTube.

YouTube: https://www.youtube.com/c/AerospaceVillage


Return to Index    -    Add to    -    ics Calendar file

 

APV - Friday - 09:05-09:59 PDT


Title: Colorful AppSec
When: Friday, Aug 6, 09:05 - 09:59 PDT
Where: AppSec Village (Virtual)
Speakers:Luis Gomes,Erez Yalon,Pedro Umbelino,Tanya Janca

SpeakerBio:Luis Gomes
No BIO available

SpeakerBio:Erez Yalon
No BIO available

SpeakerBio:Pedro Umbelino
No BIO available

SpeakerBio:Tanya Janca
No BIO available

Description:No Description available

AppSec Village events will be streamed to YouTube.

YouTube: https://www.youtube.com/c/appsecvillage


Return to Index    -    Add to    -    ics Calendar file

 

CHV - Friday - 12:00-12:59 PDT


Title: Commercial Transportation: Trucking Hacking
When: Friday, Aug 6, 12:00 - 12:59 PDT
Where: Car Hacking Village - Talks (Virtual)

SpeakerBio:Ben Gardiner
Mr. Gardiner is an independent consultant at Yellow Flag Security, Inc. presently working to secure heavy vehicles at the NMFTA. With more than ten years of professional experience in embedded systems design and a lifetime of hacking experience, Gardiner has a deep knowledge of the low-level functions of operating systems and the hardware with which they interface. Prior YFS Inc. and joining the NMFTA team in 2019, Mr. Gardiner held security assurance and reversing roles at a global corporation, as well as worked in embedded software and systems engineering roles at several organizations. He holds a M.Sc. Eng. in Applied Math & Stats from Queen’s University. He is a DEF CON Hardware Hacking Village (DC HHV) and Car Hacking Village (CHV) volunteer.
Twitter: @BenLGardiner

Description:
Join us for a technical review of the how-to of hacking big rig trucks. Included is an overview and introduction to commercial transportation, specifically trucking (tractors and trailers), and its technologies. It will cover the vehicle networks J1939, J1708/J1587 and J2497, how they operate and what they can be used for both intentionally and unintentionally. Several tools for truck hacking are presented and a survey of the public truck attacks are covered. Many tools are introduced and discussed, some are covered with examples. Attendees should leave with a good sense of what are the potentially fruitful areas of technical research into commercial transport cybersecurity and how they can equip themselves to successfully explore those areas. Some exposure to the CAN bus is assumed but no specific experience with commercial transport is needed.

This talk will stream on YouTube.


YouTube: https://www.youtube.com/watch?v=RzcpZODAJE0


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 10:00-10:59 PDT


Title: Community Roundtable - (De)Criminalizing Hacking Around the Globe
When: Friday, Aug 6, 10:00 - 10:59 PDT
Where: Policy (Virtual & SkyView 1)

Description:
In the last 12 months, the Supreme Court has weighed in on the Computer Fraud and Abuse Act, a groundswell of support has arisen in the UK to reform the Computer Misuse Act, and a proposed law in Mexico would have criminalized hacking. In all cases, members of the hacker community had a voice. And with several more upcoming in the next 12 months, our community needs to continue engaging with policymakers so they understand our value to the global security ecosystem.

For virtual access, register here: https://us02web.zoom.us/meeting/register/tZcvd-yqpzkqE9bzjZeppc0bGmvkYjHnwQZN


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 15:30-16:30 PDT


Title: Community Roundtable - 10 years after SOPA: where are we now?
When: Friday, Aug 6, 15:30 - 16:30 PDT
Where: Policy (Virtual)

Description:
Ten years ago the Internet nearly changed forever, with the passage of the SOPA/PIPA bills. Driven by copyright interests, it would have unleashed new powers for individuals and governments to censor speech online. Thanks to the public outrage by enough users, those bills didn't make it into law. But whether it comes cloaked in copyright, privacy, antitrust, or some other initiative, the appetite to control speech still continues to inform Internet policymaking discussions. Will they succeed this time in shaping new law? What happens to the Internet if they do? Come discuss these and other questions with Internet policy practitioners who interact with them daily.

Register here: https://us02web.zoom.us/meeting/register/tZAqdO2tqT0tGdRR1k_xro6MUseFIxMUAuGf


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 11:30-12:30 PDT


Title: Community Roundtable - Toward a Global IoT Code of Practice
When: Friday, Aug 6, 11:30 - 12:30 PDT
Where: Policy (Virtual & SkyView 1)

Description:
The UK’s Code of Practice for IoT Security, developed by the UK government, has become a European standard, and countries around the world are adopting it as defacto minimum threshold for devices. This session will elicit responses to proposed Parliamentary legislation which would apply the Code to consumer IoT sold and imported in the UK. Peter Stephens, who leads the initiative, will be on hand to frame the discussion, answer questions, and take feedback.

For virtual access, register here: https://us02web.zoom.us/meeting/register/tZEqf-igrDIrG92o-NpocyyBPIMNfVEONXn7


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 16:00-16:59 PDT


Title: Community Roundtable - Volunteer Hacker Fire Department
When: Friday, Aug 6, 16:00 - 16:59 PDT
Where: Policy (Virtual & SkyView 1)

Description:
The volunteer fire department model has saved countless lives and countless economic damage across the US and around the world. Several initiatives over the past several years - and continuing today - have given us a glimpse of what a volunteer-based hacker Fire Department might look like, addressing Internet-scale incidents. What are they and how do we scale them?

For virtual access, register here: https://us02web.zoom.us/meeting/register/tZUvduytqTwsGN2k75CDTSCl23o0QDiqbkDn


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 11:30-12:30 PDT


Title: Community Roundtable - We can build it. We have the technology. So why aren't we?
When: Friday, Aug 6, 11:30 - 12:30 PDT
Where: Policy (Virtual)

Description:
Clean energy. Vaccines. We are an incredible species with an incredible capacity to innovate solutions to our biggest problems. So why are we so terrible at implementing them? Have some thoughts on this? Then come share them!

Register here: https://us02web.zoom.us/meeting/register/tZYkcumtqzsqGtzGz8976GzrMPoM3e6FEi1j


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 14:30-15:30 PDT


Title: Community Roundtable - Zero Trust, Critical Software, and a Cyber Safety Review Board
When: Friday, Aug 6, 14:30 - 15:30 PDT
Where: Policy (Virtual & SkyView 1)

Description:
The recent cybersecurity Executive Order called for several new protections for US Federal networks and the nation's critical infrastructure, though some of these are undefined. While Zero Trust Architectures neatly fit into vendor buzzword bingo, what are they really? And how can you define critical software when any software on a critical system could cause harm? How would a Cyber Safety Review Board weigh in on issues where bits and bytes meet flesh and blood? Join this session to talk through some of the implications.

For virtual access, register here: https://us02web.zoom.us/meeting/register/tZAtfuqsrDgiH9y3ifQhU0Pg3bewc--OFyJ3


Return to Index    -    Add to    -    ics Calendar file

 

ICSV - Friday - 14:00-14:59 PDT


Title: Consider the (Data) Source
When: Friday, Aug 6, 14:00 - 14:59 PDT
Where: ICS Village (Virtual)

SpeakerBio:Dan Gunter , Founder and CEO of Insane Forensics
Dan Gunter is the Founder and CEO of Insane Forensics; a cybersecurity company focused on the scaled analysis of memory, disk, and network data in mission-critical networks. Before Insane Forensics, Dan was Director of R&D at Dragos and served in the US Air Force."
Twitter: @dan_gunter

Description:
Protecting industrial control systems involves a variety of challenges, from low tolerance of downtime to requiring a very deliberate combination of approaches and tools to ensure the integrity and availability of the environment. These environmental challenges can often stovepipe our thoughts around how we can respond to threats to control systems in making us think that one source of data is the only option. In this talk, we will consider the strengths and weaknesses of different data sources to include network and host sources. Using data from MITRE Engenuity's recent ICS ATT&CK evaluation, we will talk about known attacker TTPs, how to detect TTPs, and how to improve the chance of adversary detection by diversifying data sources. As collecting and processing more data is both a technical and staffing challenge, we will discuss how analysis can scale without requiring a significant resource increase.

ICS Village will be releasing their events to YouTube at each event's scheduled time. Discussion will be available on Discord in #ics-speaker-questions-and-answers-text.

YouTube: https://www.youtube.com/channel/UCI_GT2-OMrsqqglv0JijHhw

#ics-speaker-questions-and-answers-text: https://discord.com/channels/708208267699945503/735937961908109485


Return to Index    -    Add to    -    ics Calendar file

 

ASV - Friday - 14:30-14:55 PDT


Title: CPDLC: Man-in-the-middle attacks and how to defend against them
When: Friday, Aug 6, 14:30 - 14:55 PDT
Where: Aerospace Village (Virtual Talk)

SpeakerBio:Joshua Smailes
No BIO available

Description:
The Controller Pilot Data Link Communications (CPDLC) protocol replaces voice-based air traffic control with a text-based protocol. With no real security protections, this system is open to a wide range of message injection attacks. It has long been assumed that air traffic controllers and flight crew should be able to detect such attacks, but this is not always the case.

We construct a realistic threat model for CPDLC and introduce attacks on the underlying protocol, taking advantage of automated components of the system to make attacks which are difficult for human operators to detect. We also propose a number of improvements to CPDLC to mitigate these threats.

This talk will be streamed on YouTube: https://www.youtube.com/watch?v=cl_56FUk8ps


Aerospace Village talks will be streamed to YouTube.

YouTube: https://www.youtube.com/c/AerospaceVillage


Return to Index    -    Add to    -    ics Calendar file

 

APV - Friday - 12:00-12:45 PDT


Title: Cross-document messaging technology, how to hack it, and how to use it safely.
When: Friday, Aug 6, 12:00 - 12:45 PDT
Where: AppSec Village (Virtual)

SpeakerBio:Chen Gour-Arie
No BIO available

Description:No Description available

AppSec Village events will be streamed to YouTube.

YouTube: https://www.youtube.com/c/appsecvillage


Return to Index    -    Add to    -    ics Calendar file

 

CON - Friday - 09:00-15:59 PDT


Title: Darknet-NG
When: Friday, Aug 6, 09:00 - 15:59 PDT
Where: See Description

Description:
For more information, see https://forum.defcon.org/node/238249

Return to Index    -    Add to    -    ics Calendar file

 

DDV - Friday - 10:00-16:59 PDT


Title: Data Duplication Village - Open
When: Friday, Aug 6, 10:00 - 16:59 PDT
Where: Data Duplication Village

Description:
Space permitting, last drop off is Saturday at 3:00pm.

Pick your drives full of data anytime 14-24 hours after drop off.

Last chance pickup is Sunday from 10:00 to 11:00.

Yes, 6TB and larger drives are accepted.

Any drives not picked up by Sunday at 11:00am are considered donated to the DDV.

See https://dcddv.org/dc29-schedule for more information.


Return to Index    -    Add to    -    ics Calendar file

 

ASV - Friday - 10:00-15:59 PDT


Title: Deep Space Networking
When: Friday, Aug 6, 10:00 - 15:59 PDT
Where: Aerospace Village (Virtual Workshop)

Description:
Deep space communications utilize TCP/IP protocols with some added assistance from a TCP Convergence Layer and the Bundle Protocol. In this workshop, participants will contrast data transmission on the Earth terrestrial Internet to the Deep Space Network and then delve into the latest version of the Bundle protocol and the TCP Convergence Layer. We will examine key fields in the headers, locate the first packet of a bundle and the first and second legs of the relay process, as reassembled by Wireshark. Participants will learn to build a custom Wireshark profile to quickly identify key fields of the Bundle Protocol, including fields that define priority, destination type, endpoint IDs, and reporting of bundle delivery.

Return to Index    -    Add to    -    ics Calendar file

 

CON - Friday - 10:00-19:59 PDT


Title: DEF CON 29 CTF by OOO
When: Friday, Aug 6, 10:00 - 19:59 PDT
Where: See Description

Description:
For more information, see https://forum.defcon.org/node/236417

Return to Index    -    Add to    -    ics Calendar file

 

CON - Friday - 06:00-11:59 PDT


Title: DEF CON Bike Ride
When: Friday, Aug 6, 06:00 - 11:59 PDT
Where: See Description

Description:
For more information, see https://forum.defcon.org/node/236418

Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 08:00-16:59 PDT


Title: DEF CON Human Registration (Badge Pickup) and Vaccine Check Processing Open
When: Friday, Aug 6, 08:00 - 16:59 PDT
Where: Paris DEF CON Registration Desk

Description:
You can start the 2-step process. There is no need to rush, if you have purchased on-line your badge is reserved and there is no concern about them running out:

1st you will pass through the vaccination check line, providing whatever original documentation your health care provider or vaccination center gave you. It will be checked against your State issued ID to make sure the names match, the dates are good, and that enough time has passed for you to be fully vaccinated, etc. We will not record your ID or records. If all is good you will get a WRISTBAND you must wear during the con.

2nd Next you head to the badge pickup desks. There you will show your wristband and your in-person badge bar code and get it scanned. If the scan passes you get your Human reg pack.

Where to register / pick up badges: Paris, near the InfoBooth. Please find "REGISTRATION" on the provided DC29 floorplan (available in HackerTracker and online).

Both registration and the vaccine check processing functions are planning to be available from 8am/08:00 to 5pm/17:00. If those times change, this schedule entry will be updated in HackerTracker and info.defcon.org as soon as possible.


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 20:00-21:59 PDT


Title: DEF CON Movie Night - Tron
When: Friday, Aug 6, 20:00 - 21:59 PDT
Where: See Description

Description:
Tron will be shown in Track 2.

Return to Index    -    Add to    -    ics Calendar file

 

CON - Friday - 10:00-11:59 PDT


Title: DEF CON Scavenger Hunt
When: Friday, Aug 6, 10:00 - 11:59 PDT
Where: See Description

Description:
For more information, see https://forum.defcon.org/node/236484

Also see #ce-defcon-scavenger-hunt-text


#ce-defcon-scavenger-hunt-text: https://discord.com/channels/708208267699945503/711049278163779605/872883588461367366


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 16:00-16:59 PDT


Title: Defending against nation-state (legal) attack: how to build a privacy-protecting service in the era of ubiquitous surveillance
When: Friday, Aug 6, 16:00 - 16:59 PDT
Where: Track 1 Live; DCTV/Twitch #1 Live

SpeakerBio:Bill "Woody" Woodcock
No BIO available

Description:No Description available

This talk will be given live in Track 1, and will be streamed to DCTV1, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_one


Return to Index    -    Add to    -    ics Calendar file

 

IOTV - Friday - 17:30-18:15 PDT


Title: Defending IoT in the Future of High-Tech Warfare
When: Friday, Aug 6, 17:30 - 18:15 PDT
Where: IoT Village (Talk - Virtual)

SpeakerBio:Harshit Agrawal
Harshit Agrawal is currently working as a Radio Security Researcher. He is enthusiastic about Sigint, Drone Pentesting, and IoT Security. He presented his research at Security conferences like RSAC USA, HITB Cyberweek, HITB Amsterdam, etc. Previously, he was President at CSI Chapter and Vice President for Entrepreneurship cell at MIT, where he also headed the team of security enthusiasts, giving him a good insight into cybersecurity and increased his thirst to explore more in this field.

Description:
The increase of cyberattacks using IoT devices has exposed the vulnerabilities in the infrastructures that make up the IoT and have shown how small devices can affect networks and services functioning. This talk presents a review of the vulnerabilities that bear the IoT and assessing the experiences in implementing RF attacks targeting the Internet of Things and analyses various facets of the IoT centricity of future military operations based on the IoT concept, IoT-led future shaping of the things, challenges, and developmental trajectories of major powers.

IoT Village talks will be streamed to Twitch. Select speakers may be available in the IoT Village on-site to answer questions.

Twitch: https://www.twitch.tv/iotvillage


Return to Index    -    Add to    -    ics Calendar file

 

AVV - Friday - 16:45-17:45 PDT


Title: Designing a C2 Framework
When: Friday, Aug 6, 16:45 - 17:45 PDT
Where: Adversary Village (Virtual)

SpeakerBio:Daniel "Rasta" Duggan
Daniel Duggan, aka Rasta Mouse, is the Director of Zero-Point Security and creator of the Red Team Ops training course. Daniel has authored and contributed to multiple open source projects including TikiTorch, SharpC2, Covenant and SharpSploit.
Twitter: @_RastaMouse

Description:
Over recent years, there has been a huge boom in open-source C2 frameworks hitting the information security space. So much so they made a website and a logo - that’s how you know things are serious! Such a trend naturally drives more people towards taking on the gauntlet but all too often it becomes an insurmountable challenge and another dashed dream of the aspiring red teamer, or veteran alike. Believe me when I say - I’ve been there. I’ve felt the pain, the frustration, the imposter syndrome. Heck, I still do. However, I’ve (mostly) come out the other side with some hard learned lessons. Those lessons are the subject of this talk. The goal is not to write or provide code. We shall discuss how to approach initial design ideas; decide what is important and what is not; anticipate and deal with potential problem areas; consider different use cases and perspectives; and more.

If you are interested in building your own C2 framework, contributing to existing frameworks, or even software development in general, there’s something in this talk for you.


Adversary Village talks and workshops will be streamed on YouTube and Twitch.

Q&A sessions will happen in DEF CON Official Discord server after each talk.


YouTube: https://www.youtube.com/channel/UCOhn9WALnpb5YAbW18R1Hzg

Twitch: https://twitch.tv/adversaryvillage

Discord: https://discord.gg/defcon


Return to Index    -    Add to    -    ics Calendar file

 

CLV - Friday - 10:15-10:59 PDT


Title: Detection Challenges in Cloud Connected Credential Abuse Attacks
When: Friday, Aug 6, 10:15 - 10:59 PDT
Where: Cloud Village (Virtual)

SpeakerBio:Rod Soto
Over 15 years of experience in information technology and security. He has spoken at ISSA, ISC2, OWASP, DEFCON, RSA Conference,Hackmiami, DerbyCon, Splunk .CONF, Black Hat,BSides, Underground Economy and also been featured in Rolling Stone Magazine, Pentest Magazine, Univision, BBC, Forbes, VICE, Fox News and CNN. Co-founder of Hackmiami, Pacific Hackers Meetups and Conferences. Co-founder of Pacific Hackers Association.

Description:
With the widespread adoption of cloud technologies, many companies are now managing environments where the line between the perimeter and the internet is blurred. This presentation outlines the challenges defenders face in the light of the implementation of new technologies that enable users to operate seamlessly between the cloud and the perimeter. A “converged” perimeter brings new attacks such as Golden SAML, Pass The SAML, Oauth Token Hijacking which are some of the manifestations of current and future challenges in these types of environments. Presenters will propose a new approach based on current attack research and new defense posture, with specific detections developed to address these new threats.

Cloud Village activities will be streamed to YouTube.

YouTube: https://www.youtube.com/cloudvillage_dc


Return to Index    -    Add to    -    ics Calendar file

 

ASV - Friday - 15:00-15:25 PDT


Title: Developing Aerospace Security Training 3D Models
When: Friday, Aug 6, 15:00 - 15:25 PDT
Where: Aerospace Village (Virtual Talk)

SpeakerBio:Kevin Hood
Kevin Hood is a Software Security Engineering Intern at Collins Aerospace, Project Manager for the Aviation ISAC Cyber Competition, and student at Embry-Riddle Aeronautical university. Kevin has focused his career in aerospace cybersecurity and develops events to bring more people into the industry.

Description:
The challenge for students interested in aerospace cybersecurity is how to jump-start their learning and prepare themselves for this career path. Developing models and simulated aerospace infrastructure can enhance critical skills needed in aerospace cybersecurity. From a student’s perspective, learn how to get started in aerospace cybersecurity and the future developments of a hackable, large-scale model airport at the Aerospace Village.

This talk will be streamed on YouTube: https://www.youtube.com/watch?v=WXuT-e-Zs80


Aerospace Village talks will be streamed to YouTube.

YouTube: https://www.youtube.com/c/AerospaceVillage


Return to Index    -    Add to    -    ics Calendar file

 

APV - Friday - 16:00-16:59 PDT


Title: DFDs Ain't That Bad
When: Friday, Aug 6, 16:00 - 16:59 PDT
Where: AppSec Village (Virtual)
Speakers:Izar Tarandach,Matthew Coles

SpeakerBio:Izar Tarandach
No BIO available

SpeakerBio:Matthew Coles
No BIO available

Description:
Threat Modeling is, at its root, a combination of two separate disciplines: system modeling and threat elicitation (and then a bit of risk management, but that’s another talk). In the last few years the industry has focused mostly on the second part, threat elicitation, and rare was the analysis of the successes and failures of system modeling. Co-authors and members of the Threat Modeling Manifesto Group, Matt & Izar offer a view from the threat modeling pit of why sometimes developers won’t model for threats, what can be done differently, and a view of their pytm tool as a collaborative (remote) system modeler tool with a threat elicitation cherry on top.

AppSec Village events will be streamed to YouTube.

YouTube: https://www.youtube.com/c/appsecvillage


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 12:00-12:59 PDT


Title: DHS REBOOTING CRITICAL INFRASTRUCTURE PROTECTION Panel with DEF CON Policy Panel
When: Friday, Aug 6, 12:00 - 12:59 PDT
Where: Track 1 Live; DCTV/Twitch #1 Live
Speakers:Lily Newman,Alexander Klimburg,Faye Francy,Eric Goldstein,Amelie Koran,Danny McPherson

SpeakerBio:Lily Newman , WIRED magazine
No BIO available

SpeakerBio:Alexander Klimburg , Director, Global Commission on the Stability of Cyberspace
No BIO available

SpeakerBio:Faye Francy , Executive Director, Automotive Information Sharing and Analysis Center
No BIO available

SpeakerBio:Eric Goldstein , Executive Assistant Director, DHS CISA
No BIO available

SpeakerBio:Amelie Koran , Senior Technology Advocate, Splunk
No BIO available

SpeakerBio:Danny McPherson , Executive Vice President & Chief Security Officer, Verisign
No BIO available

Description:
In 1998 the US government issued the first major policy document on Critical Infrastructure Protection (CIP). Since then, CIP has become one of the most fundamental tasks for governments everywhere, and has given birth to a plethora of institutions and processes seeking to manage what is called a “Public Private Partnership” between government, industry, and civil society. But despite all the efforts put into information exchanges, incident management, but also supply chain protection and even national industrial policies, cyber-attacks have not decreased, both in the United States and elsewhere. What else needs to be done? What lessons learned are there from international experiences? And how can the community help best?

This talk will be given live in Track 1, and will be streamed to DCTV1, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_one


Return to Index    -    Add to    -    ics Calendar file

 

HRV - Friday - 14:00-14:30 PDT


Title: Discord Practice Net
When: Friday, Aug 6, 14:00 - 14:30 PDT
Where: Ham Radio Village (Virtual Talks)

Description:
In this "demo", we'll be hosting a practice "net" (ham-speak for on-air meeting) on the #hrv-get-on-the-air-voice channel in the village. All persons, even non-hams, are invited to join us in this practice so you can become familiar with expected etiquette.

All Ham Radio Village talks will be streamed to Twitch, with discussion in Discord.

For more information, see https://hamvillage.org/dc29.html


Twitch: https://www.twitch.tv/hamradiovillage

#hrv-presentation-text: https://discord.com/channels/708208267699945503/736674835413073991


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 17:00-18:59 PDT


Title: Do No harm; Health Panel : Live version - A DEF CON Policy Panel
When: Friday, Aug 6, 17:00 - 18:59 PDT
Where: Track 1 Live; DCTV/Twitch #1 Live

SpeakerBio:DEF CON Policy Panel
No BIO available

Description:
--

This talk has been released to the DEF CON Media server.

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Christian%20quaddi%20Dameff%20MD%20Jeff%20r3plicant%20Tully%20MD%20Jessica%20Wilkerson%20Josh%20Corman%20-%20Do%20No%20harm-%20Health%20Panel.mp4


This talk will be given live in Track 1, and will be streamed to DCTV1, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_one


Return to Index    -    Add to    -    ics Calendar file

 

ICSV - Friday - 12:30-12:59 PDT


Title: Do We Really Want to Live in the Cyberpunk World?
When: Friday, Aug 6, 12:30 - 12:59 PDT
Where: ICS Village (Virtual)

SpeakerBio:Mert Can Kilic , Barikat Cyber Security
MsC. Comp. Engineer, Tinker, Maker, Love Legos

Description:
What are the possible future threats when it comes to cyber physical systems? Human augmentations, insulin pumps, and brain computer interfaces are inevitable, but how will their security and possible incidents affect our world?

ICS Village will be releasing their events to YouTube at each event's scheduled time. Discussion will be available on Discord in #ics-speaker-questions-and-answers-text.

YouTube: https://www.youtube.com/channel/UCI_GT2-OMrsqqglv0JijHhw

#ics-speaker-questions-and-answers-text: https://discord.com/channels/708208267699945503/735937961908109485


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 12:00-12:20 PDT


Title: Do you like to read? I know how to take over your Kindle with an e-book
When: Friday, Aug 6, 12:00 - 12:20 PDT
Where: DCTV/Twitch #3 Pre-Recorded

SpeakerBio:Slava Makkaveev
Slava Makkaveev is a Security Researcher at Check Point Software Technologies Ltd. Holds a PhD in Computer Science. Slava has found himself in the security field more than ten years ago and since that gained vast experience in reverse engineering and vulnerability research. Recently Slava has taken a particularly strong interest in mobile platforms and firmware security.

Description:
Since 2007, Amazon has sold tens of millions of Kindles, which is impressive. But this also means that tens of millions of people can be hacked through a software bug in those same Kindles. Their devices can be turned into bots, their private local networks can be compromised, and perhaps even information in their billing accounts can be stolen.

The easiest way to remotely reach a user's Kindle is through an e-book. A malicious book can be published and made available for free access in any virtual library, including the Kindle Store, or sent directly to the end-user device via Amazon services. While you might not be happy with the writing in a particular book, nobody expects to download one that is malicious. No such scenarios have been publicized. Antiviruses do not have signatures for e-books. But... we succeeded in making a malicious book for you. If you open this book on a Kindle device, it causes a hidden piece of code to be executed with root rights. From this moment on, you lost your e-reader, account and more.

Want to know the details?

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=1jM_r-pe8Ss

Media
(Main Talk) https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Slava%20Makkaveev%20-%20Do%20you%20like%20to%20read-%20I%20know%20how%20to%20take%20over%20your%20Kindle%20with%20an%20e-book.mp4

(Demo)
https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Slava%20Makkaveev%20-%20Do%20you%20like%20to%20read-%20I%20know%20how%20to%20take%20over%20your%20Kindle%20with%20an%20e-book%20-%20Demo.mp4


This talk has been pre-recorded and will be released to the DEF CON Media Server, torrents, and YouTube. At the time of this event, it will also stream on DCTV3, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_three


Return to Index    -    Add to    -    ics Calendar file

 

BCV - Friday - 16:30-17:30 PDT


Title: Do You Really Own Your NFTs?
When: Friday, Aug 6, 16:30 - 17:30 PDT
Where: Blockchain Village / Paris Vendome B
Speakers:Francesco Piccoli,Steven Yang

SpeakerBio:Francesco Piccoli
No BIO available

SpeakerBio:Steven Yang , ANCHAIN
No BIO available

Description:No Description available

This content will be presented live and in-person.

Return to Index    -    Add to    -    ics Calendar file

 

ASV - Friday - 14:00-14:25 PDT


Title: Don’t fear the BUS, it won’t run you over.
When: Friday, Aug 6, 14:00 - 14:25 PDT
Where: Aerospace Village (Virtual Talk)

SpeakerBio:Nicholas Childs
Nicholas Childs Is a USAF aircraft maintainer with experience with mechanical, electronic, hydraulic, and avionics systems with both military and civilian aerospace platforms. He has worked on C-5, C-17, KC-135, B-1, 737, 747, and L10-11 platforms. With a focus on security he scrutinizes them.

Description:
This talk is a basic introduction to aircraft avionics comm/nav bus systems and the expansion of the network to more vulnerable areas than have seen before. It is more of a primer and 101 for stepping into a the larger world of aerospace networks.

This talk will be streamed on YouTube: https://www.youtube.com/watch?v=eiO7F5isPE8


Aerospace Village talks will be streamed to YouTube.

YouTube: https://www.youtube.com/c/AerospaceVillage


Return to Index    -    Add to    -    ics Calendar file

 

LPV - Friday - 15:00-15:30 PDT


Title: Doors, Cameras, and Mantraps OH MY!
When: Friday, Aug 6, 15:00 - 15:30 PDT
Where: Lock Pick Village (Virtual)

SpeakerBio:Dylan The Magician
No BIO available

Description:
Lockpicking, door bypassing, and physical security are among the more eye catching components of an on premises risk assessment. It always draws the most questions and gets the most staff popping over to see what's going on. I suppose it's because the physical space is personal, it isn't digital and hence it draws more focus. I do on premises risk assessment and I want to tell you a bit about how the process goes with my company and share my personal philosophies on how I do my engagements. What I hope to gain is a stronger focus on Physical Security, or PhysSec, in the Cybersecurity domain.

Lock Pick Village will be streaming their activities to Twitch and YouTube.

Twitch: https://www.twitch.tv/toool_us?

YouTube: https://youtube.com/c/TOOOL-US


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 13:00-13:59 PDT


Title: eBPF, I thought we were friends!
When: Friday, Aug 6, 13:00 - 13:59 PDT
Where: DCTV/Twitch #3 Pre-Recorded
Speakers:Guillaume Fournier,Sylvain Afchain,Sylvain Baubeau

SpeakerBio:Guillaume Fournier
Guillaume Fournier is a Security Engineer at Datadog where he focuses on developing a new generation of runtime security tools powered by eBPF. In his free time, he likes to build defensive and offensive security tools such as a chrome-like sandbox for VLC on Linux, or various projects to automate drones and wireless keyboards hacking.
Twitter: @gui774ume

SpeakerBio:Sylvain Afchain
Sylvain Afchain is a staff software engineer at Datadog. He's been working on linux for more than 15 years. He mostly worked on distributed systems, cloud infrastructure and SDN solutions. In his spare time, he enjoys cycling, playing tennis and badminton.

SpeakerBio:Sylvain Baubeau
Sylvain Baubeau is a staff software engineer, mostly working on Linux, cloud and infrastructure technologies. In his spare time, he likes to play drums, reverse engineer old games and build arcades.

Description:
Since its first appearance in Kernel 3.18, eBPF (Extended Berkley Packet Filter) has progressively become a key technology for observability in the Linux kernel. Initially dedicated to network monitoring, eBPF can now be used to monitor and trace any kind of kernel space activity.

Over the past few years, many vendors have started using eBPF to speed up their services or introduce innovative features. Cilium, Calico, Cloudflare, Netflix and Facebook are leading the charge, showing off new complex networking use cases on a monthly basis. On the security side of things, Google recently contributed the Kernel Runtime Security Instrumentation which opens the door to writing Linux Security Modules with eBPF.

In other words, eBPF is the new kid in town and a growing number of companies are running services with eBPF access in production. This leads us to a simple question: how bad can things get if one of those services were to be compromised ? This talk will cover how we leveraged eBPF to implement a full blown rootkit with all the features you would expect: various obfuscation techniques, command and control with remote and persistent access, data theft and exfiltration techniques, Runtime Application Self-Protection evasion techniques, and finally two original container breakout techniques.

Simply put, our goal is to demonstrate that rogue kernel modules might have finally found a worthy opponent. We will also detail how to detect such attacks and protect your infrastructure from them, while safely enjoying the exciting capabilities that eBPF has to offer.

REFERENCES
Bibliography and documentation links cited in the submission:
  1. Russian GRU 85th GTsSS deploys previously undisclosed drovorub malware, NSA / FBI, August 2020 https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF
  2. Kprobe-based Event Tracing, https://www.kernel.org/doc/html/latest/trace/kprobetrace.html
  3. Linux Kernel tracepoints, https://www.kernel.org/doc/html/latest/trace/tracepoints.html
  4. “bpf_probe_write_user” bpf helper, https://elixir.bootlin.com/linux/v5.11.11/source/include/uapi/linux/bpf.h#L1472
  5. Uprobe-based Event Tracing, https://www.kernel.org/doc/html/latest/trace/uprobetracer.html
  6. Cilium’s XDP documentation, https://docs.cilium.io/en/latest/bpf/#xdp

Previous eBPF related talks & projects that helped us build the rootkit:

7. Evil eBPF In-Depth: Practical Abuses of an In-Kernel Bytecode Runtime, Jeff Dileo, DEF CON 27, https://www.defcon.org/html/defcon-27/dc-27-speakers.html#Dileo 8. Process level network security monitoring and enforcement with eBPF, Guillaume Fournier, https://www.sstic.org/2020/presentation/process_level_network_security_monitoring_and_enforcement_with_ebpf/

9. Runtime Security with eBPF, Sylvain Afchain, Sylvain Baubeau, Guillaume Fournier, https://www.sstic.org/2021/presentation/runtime_security_with_ebpf/ 10. Monitoring and protecting SSH sessions with eBPF, Guillaume Fournier, https://www.sstic.org/2021/presentation/monitoring_and_protecting_ssh_sessions_with_ebpf/

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=5zixNDolLrg

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Guillaume%20Fournier%20Sylvain%20Afchain%20Sylvain%20Baubeau%20-%20eBPF%2C%20I%20thought%20we%20were%20friends.mp4


This talk has been pre-recorded and will be released to the DEF CON Media Server, torrents, and YouTube. At the time of this event, it will also stream on DCTV3, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_three


Return to Index    -    Add to    -    ics Calendar file

 

CON - Friday - 17:00-19:59 PDT


Title: EFF Tech Trivia
When: Friday, Aug 6, 17:00 - 19:59 PDT
Where: See Description

Description:
For more information, see https://forum.defcon.org/node/236425

This event will be streamed to Twitch with chat in Discord.


Twitch: https://www.twitch.tv/efflive

#ce-eff-tech-trivia-text: https://discord.com/channels/708208267699945503/711644552573747350/


Return to Index    -    Add to    -    ics Calendar file

 

DL - Friday - 14:00-15:50 PDT


Title: Empire
When: Friday, Aug 6, 14:00 - 15:50 PDT
Where: Palace 3+4+5
Speakers:Anthony "Cx01N" Rose,Vincent "Vinnybod" Rose

SpeakerBio:Anthony "Cx01N" Rose , Lead Security Researcher
Anthony "Cx01N" Rose, CISSP, is the Lead Security Researcher at BC Security, where he specializes in adversary tactic emulation planning, Red and Blue Team operations, and embedded systems security. He has presented at numerous security conferences, including Black Hat, DEF CON, and RSA conferences. Cx01N is the author of various offensive security tools, including Empire and Starkiller, which he actively develops and maintains. He is recognized for his work, revealing wide-spread vulnerabilities in Bluetooth devices and is the co-author of a cybersecurity blog at https://www.bc-security.org/blog/.

SpeakerBio:Vincent "Vinnybod" Rose , Lead Tool Developer
Vincent "Vinnybod" Rose is the Lead Tool Developer for Empire and Starkiller. He is a software engineer with expertise in cloud service and has over a decade of software development and networking experience. Recently, his focus has been on building ad-serving technologies, web and ad-tracking applications. Vinnybod has presented at Black Hat has taught courses at DEF CON on Red Teaming and Offensive PowerShell. He currently maintains a cybersecurity blog focused on offensive security at https://www.bc-security.org/blog/.

Description:
Tool or Project Name: Empire

Short Abstract (What is your tool, what does it do?): Empire is a Command and Control (C2) framework powered by Python 3 that supports Windows, Linux, and macOS exploitation. It leverages many widely used offensive security tools through PowerShell, Python 3, and C# agents. At the same time, it offers cryptologically-secure communications and flexible modular architecture that links Advanced Persistent Threats (APTs) Tactics, Techniques, and Procedures (TTPs) through the MITRE ATT&CK database.

Empire has evolved significantly since its introduction in 2015 and has become one of the most widely used open-source C2 platforms. Through this time, Empire has advanced from a single user experience to allowing multiple user operations through an API with Empire acting as a teamserver. Currently, 2 different applications are available to connect to the Empire teamserver: Empire Command Line Interface (CLI) and Starkiller.

The Empire CLI is built from the ground up as a replacement to the embedded legacy CLI and gives users a familiar feel of the legacy CLI, but is portable and connects through the Empire API. While Starkiller is a cross-platform UI available in Linux, Windows, and macOS powered by ElectronJS.

The framework's flexibility to easily incorporate new modules allows for a single solution for red team operations with the aim for Empire to provide an easy-to-use platform for emulating APTs. Customization is essential to any successful red team operation, which has driven the expansion of user plugins. These plugins allow any custom program to run side-by-side with the Empire teamserver. In addition, the commonality between other C2 platforms allows profiles and modules to be easily dropped in without the need for additional development. These features allow both red and blue teams to easily emulate and defend against the APT attack vectors.

Short Developer Bio:
Vincent "Vinnybod" Rose is the Lead Tool Developer for Empire and Starkiller. He is a software engineer with expertise in cloud service and has over a decade of software development and networking experience. Recently, his focus has been on building ad-serving technologies, web and ad-tracking applications. Vinnybod has presented at Black Hat has taught courses at DEF CON on Red Teaming and Offensive PowerShell. He currently maintains a cybersecurity blog focused on offensive security at https://www.bc-security.org/blog/.

Anthony "Cx01N" Rose, CISSP, is the Lead Security Researcher at BC Security, where he specializes in adversary tactic emulation planning, Red and Blue Team operations, and embedded systems security. He has presented at numerous security conferences, including Black Hat, DEF CON, and RSA conferences. Cx01N is the author of various offensive security tools, including Empire and Starkiller, which he actively develops and maintains. He is recognized for his work, revealing wide-spread vulnerabilities in Bluetooth devices and is the co-author of a cybersecurity blog at https://www.bc-security.org/blog/.

URL to any additional information:
Blogs about new Empire and Starkiller features: https://www.bc-security.org/post/emp...tarkiller-1-6/ https://www.bc-security.org/post/return-of-the-cli/ https://www.bc-security.org/post/emp...e-c2-profiles/ https://www.bc-security.org/post/an-...to-starkiller/ Video walk through of new features:
https://www.youtube.com/watch?v=v4nzXCHGzUA https://www.youtube.com/watch?v=CzZmzBIVJHA Detailed Explanation of Tool:
Empire has been a well-established versatile Command and Control (C2) framework for many years. Our work has allowed better adoption by red teams and shifts the focus of the platform to threat emulation. Threat emulation has been enhanced by leveraging a MITRE ATT&CK framework-based database. Every module is tagged with the MITRE ATT&CK techniques that most closely relate to the objectives of that tool and allows operators to search through the database to find and use tools that meet their specific threat emulation plan. This is combined with the new Empire server/client architecture, which has 2 different applications to connect through Starkiller and Empire Command Line Interface (CLI), allowing for multi-user distributed operations. Starkiller is a cross-platform UI available in Linux, Windows, and macOS for interacting with the Empire post-exploitation framework. This application allows red teams to share any instance of Empire and support remote, multi-operator engagements for instant collaboration and efficient event tracking. Each user is tracked in a database, which can be queried to evaluate team progression and generate post-engagement reports. Within a few minutes, a red-teamer can set up a listener (call back server) on Empire, get a target (agent) calling back to that server, and send payloads to it. Not only that, but multiple users can be working with those same agents, 3rd party modules, and listeners. There is no need to duplicate effort in establishing independent red team infrastructures when a common interface can now be used with the enhanced Empire API. When viewing an agent in the interface, we can get live updates of tasks queued to it, which users set that task, and the results.

The Empire CLI is built from the ground up as a replacement to the embedded legacy CLI that was packaged with Empire. This adaption allows users to continue to run an interface that gives the look and feel of the legacy CLI, but is portable and connects through the Empire API. While building this, we looked for areas to improve and constructed it using Python Prompt Toolkit, which gives users a streamlined look with drop-down menus, interactive shell, and multiple user support. While many of these new improvements are still in their early stages, we believe that the new construct for Empire will drive a significant change in how teams use the tool in the future.

Supporting Files, Code, etc:
https://github.com/BC-SECURITY/Empire
https://github.com/BC-SECURITY/Empire-Cli https://github.com/BC-SECURITY/Starkiller

Target Audience:
Offense

These updates bring Empire into parity with some of the top paid Offense tool kits allowing students to gain exposure to how advanced TTPs and teaming workflows are utilized in offensive engagements.

We picked up the project back in August 2019. We actually were teaching a workshop using Empire and were contacted by Kali if we would be interested in publishing our Python 3 copy around November that year. They were wanting to drop Python 2 support but didn’t want to lose older tools. And we have been pushing updates ever since.

What we have done so far?
We designed an API that supports multiple users at once and collaboration within the c2. Added over 30 new tools within the framework, including socks proxy, Rubeus, and seatbelt. Added a graphical user interface, Starkiller. Threat emulation is a big thing that we are pushing for, so we went through at tagged every tool with a MITRE ATT&CK technique which links back to the source material and descriptions of the attack. We also added a cross-compatibility ability that uses Cobalt Strikes malleable C2 profiles to create malleable listeners in Empire.

Where are we going?
Empire 4.0, which is our current version in development. This is nearly a complete rewrite of the project and almost a new C2. The project now uses a server/client architecture that aligns itself with modern C2s, such as Cobalt Strike, PoshC2, and Silent Trinity.

We added C implants with on-the-fly compilation using Roslyn Compiler. This ability is something that everyone has been asking about for a while since most advanced frameworks support some flavor of C implants. We wanted to implement this in a way that allows us to have cross-compatibility with Covenant’s tools but still maintain Empire’s agent capabilities and formatting. What we ended up with is the capability to run C implants that can compile their modules and use all the PowerShell tools as well. Another advantage of this is that PowerShell agents can compile c tools on the fly as well.

Visually, we completely redid the CLI to be streamlined and includes new features like dropdown menus, server chatrooms, and suggested values.

We redesigned the plugin functionality within Empire and significantly expanded its capabilities. Plugins are a lesser-known ability which allows user to specially craft tools that can enhance the framework's capabilities. This is similar to how cobalt strike uses aggressor scripts to expand its capabilities.


Return to Index    -    Add to    -    ics Calendar file

 

ASV - Friday - 12:30-12:55 PDT


Title: Evaluating Wireless Attacks on Real-World Avionics Hardware
When: Friday, Aug 6, 12:30 - 12:55 PDT
Where: Aerospace Village (Virtual Talk)

SpeakerBio:Leeloo Granger
Leeloo is a Swiss-French undergraduate student in Communication Systems at EPFL, currently in exchange at ETH Zürich. She is currently learning to become a private pilot and has an interest in avionics security avionics. Besides her studies, she is an athlete in archery currently training for the 2024 Olympics.

Description:
In a nutshell, in this project we prove the critical vulnerabilities of GPS and ADS-B technologies which only had been theoretically discussed in the literature. To do so, we investigated the feasibility and accessibility of GPS and Mode S spoofing on an avionics lab – the Garmin’s Navigator GTN750 – and using two types of transmitters: the USRP B210 and Raceologic’s LabSat Wideband 3. We successfully spoofed the GPS position of the GTN750, as well as intruders on the Traffic detection system. Unfortunately, we were not able to attack the TCAS II. Our work shows the vulnerabilities of communication technologies that have a major role in the safety of an aircraft, hence attacks are a severe threat and all the more so if they are conducted using as few resources as we did.

This talk will be streamed on YouTube: https://www.youtube.com/watch?v=QtM47OmprfQ


Aerospace Village talks will be streamed to YouTube.

YouTube: https://www.youtube.com/c/AerospaceVillage


Return to Index    -    Add to    -    ics Calendar file

 

AVV - Friday - 15:45-16:45 PDT


Title: Everything is a C2 if you're brave enough
When: Friday, Aug 6, 15:45 - 16:45 PDT
Where: Adversary Village (Virtual)
Speakers:Luis Ángel Ramírez Mendoza,Mauro Cáseres Rozanowski

SpeakerBio:Luis Ángel Ramírez Mendoza
No BIO available

SpeakerBio:Mauro Cáseres Rozanowski
Mauro Eldritch is an Argentine Hacker & Speaker, Founder of BCA and DC5411. He was a Speaker at DEF CON (six times!), ROADSEC (LATAM’s biggest security conference), DEVFEST Siberia, DragonJAR Colombia (biggest spanish-speaking conference in LATAM), P0SCON Iran, Texas Cyber Summit and EC-Council Hacker Halted among other conferences (25+).

In the past, he worked for many government organisms such as Ministry of Security, Federal Revenue Administration, Ministry of Health, Ministry of Economy, Ministry of Production and both SecBSD & FreeBSD Projects.

Twitter: @mauroeldritch

Description:
It is truly amazing how many and diverse methods an attacker has to "call home", exfiltrate information, or coordinate the next steps in his chain of attack. In this talk we will demonstrate (and automate) the most wacky, unexpected, and interesting methods for setting up a C2 server: Messaging apps? social media profiles? video games or gaming platforms? Yes, and there's more. The more sacred and innocent an app appears to be, the higher the score for us when weaponizing it. We will explain from scratch the function, the construction and even the automation with Ruby and Python of C2 servers based on a wide range of applications of common and daily use. For this we will use a fake toy ransomware, which will try to call home, exfiltrate information and coordinate an attack in the most crazy,bizarre and above all ... unexpected ways. Lots of short demos make this talk suitable to both newcomers and experienced people.

Adversary Village talks and workshops will be streamed on YouTube and Twitch.

Q&A sessions will happen in DEF CON Official Discord server after each talk.


YouTube: https://www.youtube.com/channel/UCOhn9WALnpb5YAbW18R1Hzg

Twitch: https://twitch.tv/adversaryvillage

Discord: https://discord.gg/defcon


Return to Index    -    Add to    -    ics Calendar file

 

AVV - Friday - 14:45-15:45 PDT


Title: Exploiting Blue Team OPSEC failures with RedELK
When: Friday, Aug 6, 14:45 - 15:45 PDT
Where: Adversary Village (Virtual)

SpeakerBio:Marc Smeets , Red Teamer, Outflank
Marc is from Infosec class 1999 (hobby) and 2006 (professionally). With a strong background in system and network engineering, he switched to pentesting in 2006. In 2016 he co-founded Outflank, a boutique red teaming and adversary simulation company in Amsterdam. He helps international customers on a daily base. Besides working for his clients, Marc spends his time making tools to optimise the red teamer's workflow, a.o. RedELK. Besides infosec, Marc is a great fan of fast cars and champagne.

Description:
Blue teams and CERTs are increasingly better equipped and better trained. At the same time offensive infrastructures are increasingly diverse in components and growing in size. This makes it a lot harder for red teams to keep oversight but also a lot easier for blue teams to react on the traces that red teams leave behind. However, do blue teams really know what traces they leave behind when doing their investigation and analyses? RedELK was created and open sourced to help red teams with these two goals: 1) make it easy to have operational oversight, 2) abuse blue team OPSEC failures. Come to this talk to learn about blue team detection and how RedELK can help you.

Adversary Village talks and workshops will be streamed on YouTube and Twitch.

Q&A sessions will happen in DEF CON Official Discord server after each talk.


YouTube: https://www.youtube.com/channel/UCOhn9WALnpb5YAbW18R1Hzg

Twitch: https://twitch.tv/adversaryvillage

Discord: https://discord.gg/defcon


Return to Index    -    Add to    -    ics Calendar file

 

CLV - Friday - 11:45-12:05 PDT


Title: Exploiting the O365 Duo 2FA Misconfiguration (Lightning Talk)
When: Friday, Aug 6, 11:45 - 12:05 PDT
Where: Cloud Village (Virtual)

SpeakerBio:Cassandra Young
Cassandra is a Senior Scientist at Security Risk Advisors, focusing on Cloud Security architecture and engineering. She is concurrently pursuing a Masters degree in Computer Science, with notable work including academic research on serverless/microservices security, cloud-based app development, and privacy & anonymity technologies. She is also one of the directors of Blue Team Village, a not-for-profit organization bringing free Blue Team talks, workshops and more to the broader InfoSec community.
Twitter: @muteki_rtw

Description:
A common methodology used by companies to implement Duo 2-factor authentication for O365 can, if not configured properly, result in a loophole that allows mobile clients to authenticate without being prompted. This short talk will provide background on the authentication types involved, show the incomplete configuration, and demonstrate how to exploit using mobile devices.

Cloud Village activities will be streamed to YouTube.

YouTube: https://www.youtube.com/cloudvillage_dc


Return to Index    -    Add to    -    ics Calendar file

 

CAHV - Friday - 12:00-12:59 PDT


Title: F**k You, Pay Me - Knowing your worth and getting paid
When: Friday, Aug 6, 12:00 - 12:59 PDT
Where: Career Hacking Village (Talk)
Speakers:Alyssa Miller,Liana McCrea

SpeakerBio:Alyssa Miller
No BIO available

SpeakerBio:Liana McCrea
No BIO available

Description:
In any job search, you’ll no doubt be asked some variation of the inevitable question, “What are your salary expectations?” For many this question induces anxiety. What should I get paid? What’s a fair salary? It can be a hard question of how to maximize earnings without pricing ourselves out of a potential role. Then the offer comes and it’s less than you asked for. Can you negotiate, should you negotiate, how should you negotiate for better compensation? What other things like bonuses, time off, benefits, etc. are on the table? Let’s talk about real-world strategies for knowing your worth in each job you apply for, how to position yourself for getting the pay you deserve, and considerations to account for in the negotiation process. You’ll hear about lessons learned that every job seeker should be aware of before submitting that first application or sending in a resume. The discussion will even cover how to know when what your prospective employer is saying is a legitimate constraint versus posturing for negotiating purposes. Ultimately, you’ll walk away ready to go into your next job search with the same bravado as Paulie from Goodfellas and be ready to tell them “F**k you, pay me”.

This talk will be available on YouTube: https://www.youtube.com/watch?v=F6I6O-3LCUc


Career Hacking Village content will be available on YouTube.

YouTube: https://youtube.com/careerhackingvillage


Return to Index    -    Add to    -    ics Calendar file

 

RCV - Friday - 14:00-14:30 PDT


Title: Finding Hidden Gems via URL Shortener Services
When: Friday, Aug 6, 14:00 - 14:30 PDT
Where: Recon Village (Virtual)

SpeakerBio:Utku Sen
No BIO available
Twitter: @utkusen

Description:No Description available

Recon Village talks will stream to YouTube.

YouTube: https://www.youtube.com/c/ReconVillage


Return to Index    -    Add to    -    ics Calendar file

 

BTV - Friday - 13:30-13:59 PDT


Title: Forensicating Endpoint Artifacts in the World of Cloud Storage Services
When: Friday, Aug 6, 13:30 - 13:59 PDT
Where: Blue Team Village - Main Track (Virtual)

SpeakerBio:Renzon Cruz
Renzon Cruz, a Filipino security professional living in Dubai who works as Digital Forensics & Incident Response in a company based in UK. He previously worked as Sr. Security Consultant as part of a National Cyber Security Agency in Qatar. He was also accepted to various international conferences as a speaker such as BSides Vancouver (2019), BSides London (2019), BSides Doha (2020), and ROOTCON Hacking Conference (2020). He is also co-founder and instructor of GuideM, a real-world cybersecurity training center based in the Philippines. He's mainly interested in defensive strategy, threat hunting, DFIR, malware analysis, & adversary simulation.
Twitter: @r3nzsec

Description:
In this presentation, I will discuss the key forensic artifacts that can be used whenever DFIR professionals encounter cloud storage services into the host such as OneDrive, GoogleDrive, Box and Dropbox. These are all essentials especially when the attacker or insider threat leverage these services to exfiltrate data. I will also show how to perform data acquisition to get these artifacts in forensically sound manner.

Today we are embracing the benefits and advantages of having cloud storage in most environments especially now when everyone is working work from home and data transmits from one place to another by the use of cloud storage services such as one drive, box, dropbox & google drive. There are a couple of artifacts on the endpoint side that gives us the ability to see the bigger picture when these cloud services are being used to perform data exfiltration and any malicious actions. In short, cloud storage data can be more accessible on the local device and can contain files and metadata distinctly different than the current cloud repository. I'm going to show how to perform data acquisition on these cloud storage applications installed in endpoint and what are those metadata and evidence that we can extract from the forensics standpoint.


Blue Team Village talks will be streamed to Twitch.

--

Twitch: https://twitch.tv/blueteamvillage


Return to Index    -    Add to    -    ics Calendar file

 

SOC - Friday - 12:00-12:59 PDT


Title: Friends of Bill W.
When: Friday, Aug 6, 12:00 - 12:59 PDT
Where: Bally's Pool Cabana

Description:
For all those Friends of Bill W. looking for a meeting or just a quiet moment to regroup, we have you covered with meetings throughout #DEFCON - Noon & 5pm Thurs-Sat, Noon Sun. The location is in a Bally's poolside cabana, look for the sign.

Return to Index    -    Add to    -    ics Calendar file

 

SOC - Friday - 17:00-17:59 PDT


Title: Friends of Bill W.
When: Friday, Aug 6, 17:00 - 17:59 PDT
Where: Bally's Pool Cabana

Description:
For all those Friends of Bill W. looking for a meeting or just a quiet moment to regroup, we have you covered with meetings throughout #DEFCON - Noon & 5pm Thurs-Sat, Noon Sun. The location is in a Bally's poolside cabana, look for the sign.

Return to Index    -    Add to    -    ics Calendar file

 

CHV - Friday - 13:00-13:59 PDT


Title: From CTF to CVE
When: Friday, Aug 6, 13:00 - 13:59 PDT
Where: Car Hacking Village - Talks (Virtual)

SpeakerBio:Bill Hatzer
No BIO available

Description:
A brief overview of my approach to hacking things and how preparing for a CTF discovered my first CVE on Hyundai Bluelink. I was practicing some burpsuite stuff and decided to tap and trap my Phone... and caught something strange.

This talk will stream on YouTube.


YouTube: https://www.youtube.com/watch?v=8LI19B5lmk8


Return to Index    -    Add to    -    ics Calendar file

 

AVV - Friday - 13:45-14:45 PDT


Title: From On-Prem to the Cloud - Hybrid AD attack path
When: Friday, Aug 6, 13:45 - 14:45 PDT
Where: Adversary Village (Virtual)

SpeakerBio:Sergey Chubarov
Sergey Chubarov is a Security and Cloud Expert, Instructor with 15+ years experience on Microsoft technologies. His day-to-day job is to help companies securely embrace cloud technologies. He has certifications and recognitions such as Microsoft MVP: Microsoft Azure, Offensive Security Certified Professional (OSCP), Offensive Security Experienced Penetration Tester (OSEP), Microsoft Certified Trainer, MCT Regional Lead, EC Council CEH, CPENT, CEI, CREST CPSA, CRT and more. Frequent speaker on local and international conferences. Prefers live demos and cyberattacks simulations.
https://ru.linkedin.com/in/schubarov

Description:
Most businesses today use hybrid cloud and many of us will retire before companies fully migrate to the cloud. Cloud identity service Azure AD provides protection from advanced cybersecurity attacks, but what additional challenges appear when integrating with on-prem AD? Let's check that out in advanced scenario-based session, Live demos only.

THE SESSION CONTAINS:

Getting Domain Admin through Azure AD Connect Getting Domain Admin through Azure AD Connect Cloud Sync (new offering) Bypass Azure AD authentication & MFA
Azure reconnaissance with AzureHound


Adversary Village talks and workshops will be streamed on YouTube and Twitch.

Q&A sessions will happen in DEF CON Official Discord server after each talk.


YouTube: https://www.youtube.com/channel/UCOhn9WALnpb5YAbW18R1Hzg

Twitch: https://twitch.tv/adversaryvillage

Discord: https://discord.gg/defcon


Return to Index    -    Add to    -    ics Calendar file

 

CCV - Friday - 11:00-11:30 PDT


Title: Getting Started with Decentralized Object Storage
When: Friday, Aug 6, 11:00 - 11:30 PDT
Where: Cryptocurrency Village (Onsite - Paris Champagne Ballroom 1)

SpeakerBio:Storj Team
No BIO available

Description:
Join Storj for this brief demo. The team will be available most other times in the village to answer questions.

The Cryptocurrency Village is built around conversations and events, not formal talks. Stop by any time to speak with knowledgeable individuals! This village focuses on the security and privacy side of cryptocurrencies, not the investment side.

The Cryptocurrency Village is conveniently located in Paris Champagne Ballroom 1.


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 10:00-10:45 PDT


Title: Gone Apple Pickin': Red Teaming macOS Environments in 2021
When: Friday, Aug 6, 10:00 - 10:45 PDT
Where: Track 2 Live; DCTV/Twitch #2 Pre-Recorded

SpeakerBio:Cedric Owens
Cedric is currently an offensive security engineer who came from a blue team background. His passion revolves around red teams and blue teams working closely together to improve each other's tradecraft. Cedric enjoys researching techniques and writing tools related to macOS post exploitation and infrastructure automation.

His blogs can be found here: https://medium.com/@cedowens His tools can be found here: https://github.com/cedowens

Twitter: @cedowens

Description:
Though the vast majority of US companies are enterprise Windows shops, there is a growing percentage of companies that are shifting away from this model. Most of these types of companies tend to be based in the SF Bay Area and are often tech companies. This talk will provide a glimpse into what common attack paths in these environments look like in the absence of typical enterprise Active Directory implementations. Examples include techniques for targeting macOS endpoints, cloud and IdaaS, CI/CD pipeline, and other fun approaches. I will begin by discussing common tech stacks and macOS deployments and then move into macOS initial access (including the Gatekeeper bypass I found) and post exploitation options in these modern tech environments as well as detection opportunities.

--

This talk has been released to the DEF CON Media server.

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Cedric%20Owens%20-%20Gone%20Apple%20Pickin%20-%20Red%20Teaming%20macOS%20Environments%20in%202021.mp4


This talk will be given live in Track 2.

This talk has also been pre-recorded and will be broadcast on DCTV2, both in local hotels and on Twitch.


DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_two


Return to Index    -    Add to    -    ics Calendar file

 

SOC - Friday - 21:00-01:59 PDT


Title: Gothcon 2021 (Virtual)
When: Friday, Aug 6, 21:00 - 01:59 PDT
Where: See Description

Description:
Join us, hybrid style, as we continue yet another year of #DCGOTHCON. Digital hangs will be found at https://www.twitch.tv/dcgothcon. Watch our twitter @dcgothcon for updates about some renegade IRL meet-ups. We will be streaming our fav goth DJ's Friday evening, 10p-2a Pacific. DM on twitter to join our discord.

Return to Index    -    Add to    -    ics Calendar file

 

VMV - Friday - 13:00-13:30 PDT


Title: Hack the Conspiracies
When: Friday, Aug 6, 13:00 - 13:30 PDT
Where: Voting Village (Talks - Virtual)

SpeakerBio:Barb Byrum
Barb Byrum is currently in her third term as Ingham County Clerk, serving as the county’s chief elections official. As Clerk of one of the most populous counties in the State of Michigan, Byrum has successfully conducted 27 elections, 4 union elections, and the 2016 Presidential Recount. Since 2016, Byrum has been credentialed as a Certified Elections/Registration Administrator by Election Center, the only national program of continuing professional education that specializes in elections administration and voter registration. In 2017, she served on Election Center’s Security Task Force.

Byrum has previously served on Michigan’s Election Security Commission, the Secretary of State’s team of advisors tasked with strengthening and better securing elections in the state. Byrum has been a consistent advocate for the voting rights of qualified registered voters, with a focus on voting rights of military and overseas voters. Byrum serves on the Overseas Voting Initiative, which is a joint effort by the Federal Voting Assistance Program and Council of State Governments. As a member of the Initiative, Byrum met with military service members in San Diego, California in March 2019, Puerto Rico in December of 2019 and continues to have military and overseas voters’ interests in mind, when advocating for increased access to the ballot.

Byrum graduated from Michigan State University with a Bachelor of Science degree in agribusiness management. She also holds a law degree from the MSU College of Law.

Byrum previously served three terms as a Michigan State Representative. During her time in the Legislature, Byrum served as the ranking Democrat on the House Committee on Redistricting and Elections.


Description:
The conspiracy theories surrounding the November 2020 General Election have had a profound and significant impact on the American people but the devastating damage done to the integrity of our elections will take years to repair. This has resulted in death threats, attacks, and shows of force against our election workers, armed protests that turned violent and legislation that would take states backward to a time when America more blatantly disenfranchised certain groups and demographics of voters. The result is that many qualified election administrators are leaving the profession for positions where their lives are not in danger.

We must fight back against disinformation and the misinformation relating to our elections and those that would seek to speak fear and lies. We must pledge to push back on those lies and that disinformation in the media and online at every opportunity. We must work together on our elections to make sure that they are safe and secure as they can possibly be. Together, we can hack the conspiracies and take back our democracy.


Voting Village talks will be streamed to YouTube and Twitch.

Twitch: https://www.twitch.tv/votingvillagedc

YouTube: https://www.youtube.com/channel/UCnDevqsxt3sO8chqS5MGvwg


Return to Index    -    Add to    -    ics Calendar file

 

ASV - Friday - 10:30-11:20 PDT


Title: Hack-A-Sat 2: The Good, The Bad and the Cyber-Secure
When: Friday, Aug 6, 10:30 - 11:20 PDT
Where: Aerospace Village (Virtual Talk)
Speakers:Bryce Kerley,Capt Aaron Bolen,Frank Pound,Steve Wood

SpeakerBio:Bryce Kerley
No BIO available

SpeakerBio:Capt Aaron Bolen
No BIO available

SpeakerBio:Frank Pound
No BIO available

SpeakerBio:Steve Wood
No BIO available

Description:
Take a deep dive into the last frontier of cybersecurity: Space. We take an inside look at the Hack-A-Sat prize competition, a joint effort of the Air Force and Space Force, in collaboration with the Aerospace Village, aimed at educating and inspiring a new generation of hackers to tackle this ever-important domain. In this talk, we will discuss: Satellite hacking 101, recap HAS1 insights, provide HAS2 Quals challenge explainers, and preview the HAS2 Finals…and beyond

This talk will be streamed on YouTube: https://www.youtube.com/watch?v=G3YA5Sa5Wbs


Aerospace Village talks will be streamed to YouTube.

YouTube: https://www.youtube.com/c/AerospaceVillage


Return to Index    -    Add to    -    ics Calendar file

 

ASV - Friday - 10:00-15:59 PDT


Title: Hack-A-Sat2 Satellite Platform
When: Friday, Aug 6, 10:00 - 15:59 PDT
Where: Aerospace Village (Workshop - Virtual + Paris Rivoli B)

Description:
Come and gets hands on with Hack-a-Sat 2 hardware and learn about the unique problems presented by cybersecurity in the space realm. The Air Force and Space Force will be presenting the HAS2 flatsat – the primary platform hosting the hacking challenges for HAS2, comprised of a variety of software and processor architectures commonly used in space vehicles. Visitors can command various settings changes in the flatsat and see the resulting changes in the telemetry from the device as well as visual attitude changes in the NASA 42 simulation. Visitors will also be introduced to the HAS2 Digital Twin, an emulated version of all the flight software running on the flatsat, and will have a chance to capture and analyze an exploit being thrown against the flight software. Lastly, the Aerospace Corporation will demonstrate cyber defense onboard a satellite by using machine learning and signatures to detect anomalous command sequences and onboard cyber events.

For virtual attendees, the Digital twin demonstration will also be accessible via VNC to an instance running inside Docker containers in Amazon AWS (remote viewers will need to have a VNC client on their own computer).


Return to Index    -    Add to    -    ics Calendar file

 

CON - Friday - 10:00-15:59 PDT


Title: Hack3r Runw@y
When: Friday, Aug 6, 10:00 - 15:59 PDT
Where: See Description

Description:
More info: https://forum.defcon.org/node/236429

More info: https://hack3rrunway.github.io/

https://twitter.com/hack3rrunway

Also see #ce-hack3r-runway.

Register here: https://docs.google.com/forms/d/e/1FAIpQLSdua561gCbWEbGk7_ZuS7cg3w7_IFbtrahibeKsU0iR%20ENiIiw/viewform?usp=sf_link


#ce-hack3r-runway: https://discord.com/channels/708208267699945503/711644666239647824


Return to Index    -    Add to    -    ics Calendar file

 

CON - Friday - 20:00-21:59 PDT


Title: Hacker Jeopardy
When: Friday, Aug 6, 20:00 - 21:59 PDT
Where: See Description

Description:
For more information, see https://forum.defcon.org/node/236486

This event will be held VIRTUALLY ONLY, on Twitch. Discussion will be held in #ce-hacker-jeopardy-text.


Twitch: https://www.twitch.tv/DFIUtv

Twitter: https://twitter.com/HackerJeopardy

#ce-hacker-jeopardy-text: https://discord.com/channels/708208267699945503/732439600391389184/


Return to Index    -    Add to    -    ics Calendar file

 

SOC - Friday - 18:00-23:59 PDT


Title: Hacker Karaoke (Virtual)
When: Friday, Aug 6, 18:00 - 23:59 PDT
Where: See Description

Description:
Even though we cannot be there in person to run the event, we will be event on the Discord Defcon Channel in the Hacker Karaoke room. We will be running from 6PM pacific to Midnight Pacific on Friday and Saturday night. Additional information on joining the event will be available online. Follow us at @hackerkaraoke for more information.

Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 14:00-14:45 PDT


Title: Hacking Humans with AI as a Service
When: Friday, Aug 6, 14:00 - 14:45 PDT
Where: Track 2 Live; DCTV/Twitch #2 Pre-Recorded
Speakers:Eugene Lim,Glenice Tan,Tan Kee Hock

SpeakerBio:Eugene Lim
Eugene Lim, also known as spaceraccoon, is a security researcher and white hat hacker. He regularly participates in live-hacking events and was awarded the Most Valuable Hacker title in the h1-213 Live-Hacking Event by Hackerone. Besides white hat hacking, he enjoys building security tools, including a malicious npm package scanner and an open-source intelligence social engineering honeypot that were presented at Black Hat Asia Arsenal 2019 and Black Hat USA Arsenal 2020. His writeups on https://spaceraccoon.dev are regularly cited by other white hat hackers.
Twitter: @spaceraccoonsec
https://www.linkedin.com/in/limzhiweieugene/

SpeakerBio:Glenice Tan
Glenice is a security researcher that enjoys exploring the quirks of different systems, applications, and processes. In the past year, she had the opportunity to conduct social engineering exercises, which includes phishing and vishing. Apart from applications and human hacking, she also experiments on ways to automate or improve red team operations.
https://www.linkedin.com/in/glenicetan/

SpeakerBio:Tan Kee Hock
Tan Kee Hock is a Cybersecurity Specialist who simply likes to 'hack' things. He loves to play CTFs and is always keen to explore more!
https://www.linkedin.com/in/tankeehock/

Description:
As the proliferation of Artificial Intelligence as a Service (AIaaS) products such as OpenAI's GPT-3 API places advanced synthetic media generation capabilities in the hands of a global audience at a fraction of the cost, what does the future hold for AI-assisted social engineering attacks? In our talk, we will present the nuts and bolts of an AIaaS phishing pipeline that was successfully deployed in multiple authorized phishing campaigns. Using both paid and free services, we emulated the techniques that even low-skilled, limited resource actors could adopt to execute effective AI-assisted phishing campaigns at scale. By repurposing easily-accessible personality analysis AIaaS products, we generated persuasive phishing emails that were automatically personalized based on a target's public social media information and created by state-of-the-art natural language generators. We will also discuss how an AI-assisted phishing workflow would impact traditional social engineering teams and operations. Finally, we look at how AIaaS suppliers can mitigate the misuse of their products.

REFERENCES

  1. T. Karras, S. Laine, and T. Aila, “A Style-Based Generator Architecture for Generative Adversarial Networks,” arXiv:1812.04948 [cs.NE], 2019.
  2. S. Gehrmann, H. Strobelt, and A. M. Rush, “GLTR: Statistical Detection and Visualization of Generated Text,” arXiv:1906.04043 [cs.CL], 2019.
  3. G. Jawahar, M. Abdul-Mageed, and L. V. S. Lakshmanan, “Automatic Detection of Machine Generated Text: A Critical Survey,” arXiv:2011.01314 [cs.CL], 2020.
  4. J. Seymour and P. Tully, “Weaponizing Data Science for Social Engineering: Automated E2E Spear Phishing on Twitter,” 2016.
  5. P. Tully and F. Lee, “Repurposing Neural Networks to Generate Synthetic Media for Information Operations,” 2020.
  6. OpenAI, “OpenAI Charter,” OpenAI, 09-Apr-2018. [Online]. Available: https://openai.com/charter/.
  7. G. Brockman, M. Murati, and P. Welinder, “OpenAI API,” OpenAI, 11-Jun-2020. [Online]. Available: https://openai.com/blog/openai-api/.
  8. A. Pilipiszyn, “GPT-3 Powers the Next Generation of Apps,” OpenAI, 25-Mar-2021. [Online]. Available: https://openai.com/blog/gpt-3-apps/.

Would like to thank contributing author Timothy Lee Timothy is a security researcher who likes to break things and tries to understand how the system works during the process. In the past year, he is researching with iOS security and is starting his journey on iOS vulnerability research. Additionally, he has contributed to red team social engineering operations and security tooling, with practical experience in vishing and in-person social engineering. https://www.linkedin.com/in/timothylee0/

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=tWWhRbzhkrg

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Eugene%20Lim%20Glenice%20Tan%20Tan%20Kee%20Hock%20-%20Hacking%20Humans%20with%20AI%20as%20a%20Service.mp4


This talk will be given live in Track 2.

This talk has also been pre-recorded and will be broadcast on DCTV2, both in local hotels and on Twitch.


DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_two


Return to Index    -    Add to    -    ics Calendar file

 

VMV - Friday - 10:30-10:59 PDT


Title: Hacking to Save Democracy: What Technologists Need to Know About Election Administration
When: Friday, Aug 6, 10:30 - 10:59 PDT
Where: Voting Village (Talks - Virtual)

SpeakerBio:Eddie Perez
Eddie Perez is the Global Director of Technology Development & Open Standards for the Open Source Election Technology Institute. He is a principal liaison to the TrustTheVote Project's election officials' stakeholder community.

Eddie has a wealth of expertise in election systems design, implementation, security, usability, and standards. A veteran of the commercial election technology industry, he formerly served as director of product management for one of the three major voting systems vendors in the U.S. Now, Eddie utilizes his skills to drive open source voting technology design, as well as federal and state certification for open source technologies, and voter education initiatives.

Eddie is a regular contributor to media outlets from MSNBC news to Fox News, including The Washington Post, Associated Press, and POLITICO, to name a few. He is also an NBC News contributing elections analyst on topics of technology, practices, security, and public policy.

Eddie speaks to policy leaders on election technology and administration, and has given testimony to several agencies and government bodies including the U.S. Election Assistance Commission and The National Conference of State Legislatures.

Eddie is co-inventor of two U.S. patents in voting technology.

Edward is on Twitter at @eddieperezTX with contributions via @OSET and @TrustTheVote

Twitter: @eddieperezTX

Description:
No technology is more consequential to democracy than election technology. When it's done well, election technology undergirds democracy and ensures that even the losers of elections respect the result. When it's done poorly, trust in democracy erodes and even the most powerful countries are shaken to their cores.

Time to panic? No, it’s time to roll up our sleeves!

Where others might despair, we see a golden opportunity! At no other time in our history have so many Americans of all political stripes been so focused on election integrity. We want security-minded, tech-savvy people of all genders, races, creeds, and political stripes to step up. And if we’re going to lower the temperature and bolster public confidence in election integrity, it’s critical to understand how elections are actually run, and how election technology is used. Election administration is a complex profession limited by law, policy, and specific practices.

Whether you’re new to election security, or an experienced practitioner, this presentation is a snapshot of the operating environment for election technology. Our goal is to help you learn what to anticipate, and how best to apply your technology skills in defense of democracy. Together, we can enhance election integrity and help to ensure that accurate information gets widely shared, and misinformation does not.


Voting Village talks will be streamed to YouTube and Twitch.

Twitch: https://www.twitch.tv/votingvillagedc

YouTube: https://www.youtube.com/channel/UCnDevqsxt3sO8chqS5MGvwg


Return to Index    -    Add to    -    ics Calendar file

 

CAHV - Friday - 13:00-13:59 PDT


Title: Hacking Your Career: The Options
When: Friday, Aug 6, 13:00 - 13:59 PDT
Where: Career Hacking Village (Talk)
Speakers:Chris Sperry,Deb Herrity,Jennifer Haverman

SpeakerBio:Chris Sperry
No BIO available

SpeakerBio:Deb Herrity
No BIO available

SpeakerBio:Jennifer Haverman
No BIO available

Description:
One common theme in the community: a lack of understanding over what jobs exist in the career field that encompasses Infosec, Information Assurance, Cyber Security, and related fields; and what it’s like to work and live in them. What’s right for you; what career path you create: there is no “right” answer or limits: knowing the options and leveraging your “why” will help guide your way. This presentation abstract proposes a small panel of sages, diverse on purpose, with those that have a combination of career experience in government, military, industry sharing their career path experiences; their “whys” of where they worked and why they are where they are now; but with the focus on giving attendees ideas and options they might not have considered before.

This talk will be available on YouTube: https://www.youtube.com/watch?v=T4r2ZpEUjJs


Career Hacking Village content will be available on YouTube.

YouTube: https://youtube.com/careerhackingvillage


Return to Index    -    Add to    -    ics Calendar file

 

ASV - Friday - 10:00-15:59 PDT


Title: HACMS Live Demo
When: Friday, Aug 6, 10:00 - 15:59 PDT
Where: Aerospace Village (Workshop - Paris Rivoli B)

Description:
As part of DARPA-s High-Assurance Cyber Military Systems program, Collins Aerospace led a team of researchers using formal methods tools to construct aircraft software that was provably secure against many classes of cyber attack. We will have an operational (but non-flying) version of our secure quadcopter present whose mission and telemetry software runs on the formally verified seL4 kernel. We will provide wifi access to an isolated virtual machine running on its mission computer. DEF CON participants will be challenged to break out of the VM environment to read or write the encryption keys used for vehicle telemetry.

Return to Index    -    Add to    -    ics Calendar file

 

HRV - Friday - 09:00-15:59 PDT


Title: Ham Radio Exams
When: Friday, Aug 6, 09:00 - 15:59 PDT
Where: Ham Radio Village (Onsite - Bally's Bronze 1-2)

Description:
Come stop by the Ham Radio Village to get your amateur radio license during our free license exams! More info on the DEF CON fourms

Register here: https://ham.study/sessions/60fa3250a6684b06a0c6f327/1


Return to Index    -    Add to    -    ics Calendar file

 

HHV - Friday - 10:00-10:30 PDT


Title: Hardware Hacking 101: Rogue Keyboards and Eavesdropping Cables
When: Friday, Aug 6, 10:00 - 10:30 PDT
Where: Hardware Hacking Village (Virtual Talk)

SpeakerBio:Federico Lucifredi
Federico Lucifredi is the Product Management Director for Ceph Storage at Red Hat and a co-author of O’Reilly’s ““Peccary Book”” on AWS System Administration. Previously, he was the Ubuntu Server product manager at Canonical, where he oversaw a broad portfolio and the rise of Ubuntu Server to the rank of most popular OS on Amazon AWS. A software engineer-turned-manager at the Novell corporation, he was part of the SUSE Linux team, overseeing the update lifecycle and delivery stack of a $150 million maintenance business. A CIO and a network software architect at advanced technology and embedded Linux startups, Federico was also a lecturer for over 200 students in Boston University’s graduate and undergraduate programs, and simultaneously a consultant for MIT implementing fluid-dynamics simulations in Java.
Twitter: @0xF2
f2.svbtle.com

Description:
This is a live tutorial of hacking with keystroke injection attacks. We take advantage of the inherent trust that computers place on what is believed to be a regular keyboard to unleash pre-programmed keystroke payloads at well over 1000 words a minute. We access the host system and bypass traditional security countermeasures for payloads that can include reverse shells, binary injection, brute force password attacks, and just about any attack that can be fully automated.

We misuse the trust the operating system places on USB human-interaction devices to demonstrate once again the old adage that if you can physically access a computing device, there is no real security to be had. I will review hardware, its capabilities, how to breach OS security, and how attackers can enable it to perform a variety of tasks with its own tools. I will then show how to build and install additional software and customize the device with binary or scripted payloads.

We take the discussion to the next level by removing the need for a device and exploring attacks that can be delivered directly by a plain USB cable. We dissect easily-sourced, low-cost hardware implants embedded in standard, innocent-looking USB cables providing an attacker with further capabilities, including among them the ability to track its own geolocation.


#hhv-talk-qa-hw-hacking-101-text https://discord.com/channels/708208267699945503/709255105479704636

Twitch: https://twitch.tv/dchhv


Hardware Hacking Village talks will be streamed to Twitch.

Twitch: https://www.twitch.tv/dchhv


Return to Index    -    Add to    -    ics Calendar file

 

CCV - Friday - 14:00-14:59 PDT


Title: Hardware Wallet Show and Tell
When: Friday, Aug 6, 14:00 - 14:59 PDT
Where: Cryptocurrency Village (Onsite - Paris Champagne Ballroom 1)

SpeakerBio:Michael Schloh von Bennewitz
No BIO available

Description:
Michael will show off a variety of village badges and hardware. Michael will also be available at other times in the village for various other hardware activities.

The Cryptocurrency Village is built around conversations and events, not formal talks. Stop by any time to speak with knowledgeable individuals! This village focuses on the security and privacy side of cryptocurrencies, not the investment side.

The Cryptocurrency Village is conveniently located in Paris Champagne Ballroom 1.


Return to Index    -    Add to    -    ics Calendar file

 

BHV - Friday - 15:30-15:59 PDT


Title: Healthcare Innovation With People of All Abilities
When: Friday, Aug 6, 15:30 - 15:59 PDT
Where: Biohacking Village (Talk - Virtual)
Speakers:Joel Isaac,Pia Zaragoza

SpeakerBio:Joel Isaac
No BIO available

SpeakerBio:Pia Zaragoza , Presidential Innovation Fellow, #uxdesign, #civictech, #uxresearch, #accessibility
No BIO available

Description:
The World Bank reported in their 2020 Disability Inclusion report that there are one billion people or 15% of the world’s population that experience some form of disability. During this presentation, Joel Isaac and Pia Zaragoza will go over key concepts around disability inclusion, universal design and accessibility to spark ideas around healthcare innovation amongst the disability, medical manufacturers, regulators, cyber research, citizen science, and biohacker communities.

All Biohacking Village talks will be streamed to YouTube.

YouTube: https://www.youtube.com/channel/UCm1Kas76P64rs2s1LUA6s2Q


Return to Index    -    Add to    -    ics Calendar file

 

ASV - Friday - 16:00-16:25 PDT


Title: Holistic View of a Flight with Crowd Sourced Data
When: Friday, Aug 6, 16:00 - 16:25 PDT
Where: Aerospace Village (Virtual Talk)

SpeakerBio:Allan Tart
Allan Tart has worked in the field of Air Traffic Management over a decade, where he has had several roles. His latest position in OpenSky Network, has included air-ground VHF communications to his list of interests, which previously mainly concentrated only on surveillance systems.

Description:
During the talk an overview will be given about how one can use crowd sourced data for creating a holistic view of flight. The data used for the purpose will include both ADS-B and VHF voice communications.

This talk will be streamed on YouTube: https://www.youtube.com/watch?v=2FTSGCAG3EE


Aerospace Village talks will be streamed to YouTube.

YouTube: https://www.youtube.com/c/AerospaceVillage


Return to Index    -    Add to    -    ics Calendar file

 

WS - Friday - 10:00-13:59 PDT


Title: House of Heap Exploitation
When: Friday, Aug 6, 10:00 - 13:59 PDT
Where: Workshops - Las Vegas 5+6 (Onsite Only)
Speakers:James Dolan,Maxwell Dulin,Nathan Kirkland,Zachary Minneker

SpeakerBio:James Dolan , Security Engineer
James Dolan works for Security Innovation as a Security Engineer focusing on engagements ranging from IoT hacking to kiosk exploitation. His current research interests include emerging threats against Mobile and IoT devices. He has a degree in Computer and Information Science from University of Oregon. In his free time, James enjoys composing music, playing video games or hiking in the greater Seattle area.

SpeakerBio:Maxwell Dulin , Security Consultant
Maxwell Dulin (Strikeout) is a security consultant at Security Innovation hacking all things under the sun, from robots to web applications. Additionally, he started the Spokane Mayors Cyber Cup and has written pwnables for SSD. Maxwell has published many articles for a plethora of heap exploitation techniques, assorted web application hacking exploits and IoT device vulnerability hunting. He has previously spoken at DEFCON 27 IoT Village. In his free time, he plays with RF toys, hikes to fire lookouts and catches everything at dodgeball.

SpeakerBio:Nathan Kirkland , Security Researcher & Engineer
Raised on a steady diet of video game modding, when Nathan found programming as a teenager, he fit right into it. Legend says he still keeps his coffee (and tear) stained 1980s edition of The C Programming Language by K&R stored in a box somewhere. A few borrowed Kevin Mitnick books later, he had a new interest, and began spending more and more time searching for buffer overflows and SQL injections. Many coffee fueled sleepless nights later, he had earned OSCP, and graduated highschool a few months later. After a few more years of working towards a math degree and trying fervently to teach himself cryptanalysis, he decided to head back to the types of fun hacking problems that were his real first love, and has worked at Security Innovation ever since.

SpeakerBio:Zachary Minneker , Security Researcher & Engineer
Zachary Minneker is a security researcher and security engineer at Security Innovation. His first computer was a PowerPC Macintosh, an ISA which he continues to defend to this day. At Security Innovation, he has performed security assessments on a variety of systems, including robots for kids, audio transcription codecs, and electronic medical systems. He has previous experience administrating electronic medical systems, and deep experience in fuzzing, reverse engineering, and protocol analysis. His research has focused on techniques for in-memory fuzzing, macOS sandbox security, and IPC methods.

Description:
Heap exploitation is an incredibly powerful tool for a hacker. As exploit mitigations have made exploitation more difficult, modern exploit development has moved to the heap. However, heap exploitation is a subject that has evaded many people for years for one reason: they focus on the techniques instead of the allocator. By learning with an allocator first style, the techniques are easily understood and practical to use.

This workshop is for learning heap exploit development in GLibC Malloc. GLibC Malloc is the default allocator on most Linux distros. With this hands-on introduction into GLibC Malloc heap exploitation you will learn how the allocator functions, heap specific vulnerability classes and to pwn with a variety of techniques. Whether you're an avid CTFer or just trying to get into heap exploitation on your pwnables site, this course is good for adding another tool to the tools arsenal. After taking this course you will understand the GLibC Malloc allocator, be able to discover heap specific vulnerability classes and pwn the heap with a variety of techniques, with the capability to easily learn more.

Registration Link: https://www.eventbrite.com/e/house-of-heap-exploitation-las-vegas-5-6-tickets-162214679473

Prerequisites
Basic computer science background (x86_64 assembly, stack, programming skills in C & Python) Basic binary exploitation skills (buffer overflow exploitation, ROP, ASLR, etc.) Familiar with Linux developer tools such as the command line, Python scripting and GDB. Previous usage of pwntools is a plus

Materials needed:
Laptop with enough power for a moderately sized Linux VM Administrative access to the laptop 8GB RAM minimum 50GB harddrive space Virtualbox or another virtualization platform installed


Return to Index    -    Add to    -    ics Calendar file

 

CPV - Friday - 11:30-12:30 PDT


Title: How expensive is quantum factoring, really?
When: Friday, Aug 6, 11:30 - 12:30 PDT
Where: Crypto & Privacy Village (Virtual)

SpeakerBio:Craig Gidney
Software engineer turned research scientist on Google's quantum team. Cut the cost of quantum factoring by 100x. Unofficial record holder for largest number not-actually-factored on a quantum computer.

Description:
Quantum computers are expected to eventually break RSA and ECC. But how big would the machine have to be, and how long would it need to run? This talk will discuss the hype, the reality, and the difficulties around quantum attacks on public key cryptography.

Crypto & Privacy Village will be streaming their events to YouTube and Twitch.

Twitch: https://www.twitch.tv/cryptovillage

YouTube: https://www.youtube.com/c/CryptoVillage


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 18:00-18:59 PDT


Title: How I use a JSON Deserialization 0day to Steal Your Money On The Blockchain
When: Friday, Aug 6, 18:00 - 18:59 PDT
Where: DCTV/Twitch #3 Pre-Recorded
Speakers:Hao Xing,Zekai Wu

SpeakerBio:Hao Xing
Hao Xing is a Security researcher from Tencent Security Xuanwu Lab. He made some presentations at Chaos Communication Congress and BlackHat Asia. His research foucs on Web security, Andoird security and Red Team. He reported lots of vulnerabilities for many internet giants such as Google, Microsoft, Alibaba etc.
Twitter: @RonnyX2017

SpeakerBio:Zekai Wu
No BIO available
Twitter: @hellowuzekai

Description:
Fastjson is a widely used open source JSON parser with 23'100 stars on GitHub. As a basic module of countless java web services, it serves hundreds of millions of users. We managed to find a way to bypass many security checks and mitigations by using the inheritance process of some basic classes, and achieve remote code execution successfully. We will disclose these high-risk and universal gadgets for the first time in this talk.

Now, we can control many important websites and affect millions of users. Let's make things more interesting. We found that this fastjson vulnerability affect a multi-billion-dollar blockchain. We designed multiple complex gadgets based on the features of the blockchain, and exquisitely achieved information leakage and pointer hijacking. Putting all these gadgets together, we achieved remote code execution on the blockchain nodes.

However, generally after remote code execution, we seem to have no better exploit method other than the 51% attack, which will lead to serious accounting confusion. After a detailed analysis of the architecture design of the public blockchain, we found a way from RCE to steal the public blockchain users' assets almost without any notification.

To the best of our knowledge, this is the first published attack case on the realization of covertly stealing user assets after RCE on the public blockchain nodes. We will propose a more covert post penetration exploit method for public blockchain nodes in this talk.

Blockchain is not bulletproof to security vulnerability. We will show you how to use classical web vulnerabilities attack the blockchain and how to steal real money from the decentralized cyber world.

REFERENCES
1. https://github.com/threedr3am/gadgetinspector 2. https://github.com/JackOfMostTrades/gadgetinspector 3. http://i.blackhat.com/us-18/Thu-August-9/us-18-Haken-Automated-Discovery-of-Deserialization-Gadget-Chains.pdf 4. http://i.blackhat.com/eu-19/Thursday/eu-19-Zhang-New-Exploit-Technique-In-Java-Deserialization-Attack.pdf 5. https://asm.ow2.io/asm4-guide.pdf

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=pUexrXOGCkE

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Hao%20Xing%20Zekai%20Wu%20-%20How%20I%20use%20a%20JSON%20Deserialization%200day%20to%20Steal%20Your%20Money%20On%20The%20Blockchain.mp4


This talk has been pre-recorded and will be released to the DEF CON Media Server, torrents, and YouTube. At the time of this event, it will also stream on DCTV3, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_three


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 10:00-10:59 PDT


Title: HTTP/2: The Sequel is Always Worse
When: Friday, Aug 6, 10:00 - 10:59 PDT
Where: DCTV/Twitch #3 Pre-Recorded

SpeakerBio:James Kettle
James Kettle is Director of Research at PortSwigger Web Security, where he cultivates novel web attack techniques. Recent work has focused on HTTP Request Smuggling, and using web cache poisoning to turn caches into exploit delivery systems. Past research includes server-side RCE via Template Injection, client-side RCE via malicious formulas in CSV exports, and abusing the HTTP Host header to poison password reset emails and server-side caches. He is also the author of multiple popular Burp Suite extensions including HTTP Request Smuggler, Param Miner and Turbo Intruder. He has spoken at numerous prestigious venues including DEF CON, both BlackHat USA and EU, and OWASP AppSec USA and EU.
Twitter: @albinowax
https://skeletonscribe.net/

Description:
HTTP/2 is easily mistaken for a transport-layer protocol that can be swapped in with zero security implications for the website behind it. Two years ago, I presented HTTP Desync Attacks and kicked off a wave of request smuggling, but HTTP/2 escaped serious analysis. In this presentation, I'll take you beyond the frontiers of existing HTTP/2 research, to unearth horrifying implementation flaws and subtle RFC oversights.

I'll show you how these flaws enable HTTP/2-exclusive desync attacks, with case studies targeting high-profile websites powered by servers ranging from Amazon's Application Load Balancer to WAFs, CDNs, and bespoke stacks by big tech. I'll demonstrate critical impact by hijacking thick clients, poisoning caches, and stealing plaintext passwords to net multiple max-bounties.

After that, I'll unveil novel techniques and tooling to crack open a widespread but overlooked request smuggling variant affecting both HTTP/1 and HTTP/2 that is typically mistaken for a false positive.

Finally, I'll drop multiple exploit-primitives that resurrect a largely-forgotten class of vulnerability, and use HTTP/2 to expose fresh application-layer attack surface.

I'll leave you with an open-source scanner, a custom, open-source HTTP/2 stack, and free interactive labs so you can hone your new skills on live systems.

REFERENCES
The HTTP/2 RFC is essential reading: https://tools.ietf.org/html/rfc7540 This research is built on my previous work on this topic: https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn This presentation by defparam has good explanations of response queue poisoning and self-desync attacks: https://www.youtube.com/watch?v=3tpnuzFLU8g I had a partial research collision with Emil Lerner. His work provides an alternative perspective on certain techniques: https://github.com/neex/http2smugl

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=rHxVVeM9R-M

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20James%20Kettle%20-%20HTTP2%20-%20The%20Sequel%20is%20Always%20Worse.mp4


This talk has been pre-recorded and will be released to the DEF CON Media Server, torrents, and YouTube. At the time of this event, it will also stream on DCTV3, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_three


Return to Index    -    Add to    -    ics Calendar file

 

PHV - Friday - 12:00-13:59 PDT


Title: Hunting Evil with Wireshark
When: Friday, Aug 6, 12:00 - 13:59 PDT
Where: Packet Hacking Village - Workshops (Virtual)

SpeakerBio:Michael Wylie
Michael Wylie, MBA, CISSP is the Sr. Manager of a 24/7/365 global managed threat hunting team. Prior to his current role, he was the Director of Cybersecurity at a top 100 CPA firm where he built out the offensive/defensive security service practice. Michael has developed and taught numerous courses for the U.S. Department of Defense, DEFCON, Colleges, and for clients around the world. Michael is the winner of numerous SANS challenge coin and holds the following credentials: CISSP, CCNA R&S, GPEN, GMON, GCFE, TPN, CEH, CEI, VCP-DCV, CHPA, PenTest+, CNVP, Microsoft Azure, and more.
Twitter: @themikewylie

Description:
This workshop will take attendees’ Wireshark skills to the next level with a heavy emphasis on incident response, threat hunting, and identifying anomalous network traffic. This workshop will begin with a brief introduction to Wireshark and other Network Security Monitoring (NSM) tools/concepts. Throughout the workshop, we’ll examine what different attacks and malware look like while using Wireshark. Attendees will then have hands-on time in the lab to search for Indicators of Compromise (IOCs) and TTPs utilizing staged packet capture files. Labs start out easy and quickly progress in difficulty. There will be plenty of take-home labs for additional practice.

Return to Index    -    Add to    -    ics Calendar file

 

CLV - Friday - 13:20-14:05 PDT


Title: Hunting for AWS Exposed Resources
When: Friday, Aug 6, 13:20 - 14:05 PDT
Where: Cloud Village (Virtual)

SpeakerBio:Felipe Pr0teus Espósito
Felipe Espósito graduated in Information Technology at UNICAMP and has a master's degree in Systems and Computing Engineering by COPPE-UFRJ, both among the top technology universities in Brazil. He has over ten years of experience in information security and IT, with an emphasis on security monitoring, networking, data visualization, and threat hunting. He is a founder of the HackerMakerSpace in Rio de Janeiro and presented at respected conferences such as Hackers 2 Hackers Conference, BHACK, BSides (Las Vegas and São Paulo), FISL, Latinoware, SecTor and SANS SIEM Summit.
Twitter: @pr0teusbr

Description:
Like all major public cloud providers, AWS allows users to expose managed resources like S3 buckets, SQS queues, RDS databases, and others publicly on the Internet. There are legitimate uses for making resources public, such as publishing non-sensitive data. However, we often find that this functionality is mistakenly used, often due to a lack of cloud security expertise, to erroneously expose sensitive data. News of exposed S3 buckets are sadly very frequent in the specialized media. It is important to note, however, that there are many other relevant kinds of AWS resources that can be equally dangerous when publicly exposed but that doesn't get nearly as much scrutiny as S3 buckets. In this talk we are going to describe some of the methods that researchers and attackers use to discover and exploit these publicly exposed resources, and how cloud providers and defenders can have taken action to monitor, prevent and respond to these activities.

Cloud Village activities will be streamed to YouTube.

YouTube: https://www.youtube.com/cloudvillage_dc


Return to Index    -    Add to    -    ics Calendar file

 

AIV - Friday - 15:00-15:30 PDT


Title: Identifying Excel 4.0 Macro strains using Anomaly Detection
When: Friday, Aug 6, 15:00 - 15:30 PDT
Where: AI Village (Virtual)
Speakers:Elad Ciuraru,Tal Leibovich

SpeakerBio:Elad Ciuraru
No BIO available

SpeakerBio:Tal Leibovich
No BIO available

Description:No Description available

AI Village events will be streamed to Twitch, and later be made available as videos on YouTube.

Speakers will be made available on DEF CON's Discord, in #aiv-general-text.


Twitch: https://www.twitch.tv/aivillage

YouTube: https://www.youtube.com/c/aivillage

#aiv-general-text: https://discord.com/channels/708208267699945503/732733090568339536


Return to Index    -    Add to    -    ics Calendar file

 

HTSV - Friday - 14:00-15:50 PDT


Title: In-person broadcast via demolabs
When: Friday, Aug 6, 14:00 - 15:50 PDT
Where: Hack the Sea (Virtual)

SpeakerBio:Constantine Macris
No BIO available

Description:
This is a placeholder event.

Hack the Sea Village will stream their events to YouTube and Twitch.

Twitch: https://www.twitch.tv/h4ckthesea

YouTube: https://www.youtube.com/channel/UC5htD_rPiP8N7v8VQKyJkOQ


Return to Index    -    Add to    -    ics Calendar file

 

WS - Friday - 10:00-13:59 PDT


Title: Inspecting Signals from Satellites to Shock Collars
When: Friday, Aug 6, 10:00 - 13:59 PDT
Where: Workshops - Las Vegas 1+2 (Onsite Only)
Speakers:Eric Escobar,Trenton Ivey

SpeakerBio:Eric Escobar , Principal Security Consultant
Eric is a seasoned pentester and a Principal Security Consultant at Secureworks. On a daily basis he attempts to compromise large enterprise networks to test their physical, human, network and wireless security. His team consecutively won first place at DEF CON 23, 24, and 25's Wireless CTF, snagging a black badge along the way. Forcibly retired from competing in the Wireless CTF, he’s now a member of the DEF CON Wireless Village team. Before entering the cyber security arena, Eric attained both a BS and MS in Civil Engineering along with his Professional Engineering license.

SpeakerBio:Trenton Ivey , Senior Security Researcher
Trenton is a Senior Security Researcher for Secureworks’ Counter Threat Unit and is a Technical Lead for Secureworks Adversary Group. He currently builds tools to assist with offensive testing, and helps defenders find creative ways to respond. Prior to joining Secureworks, Trenton helped build the network penetration team for a Fortune 500 company, performed web-application and device testing for a PA-QSA company, and provided IT support for one of the largest health systems in the US. Trenton received his Bachelors of Science in Biology and Chemistry and now regularly tries to find ways to apply lessons learned from the physical world to the digital one. Trenton has his Expert Class Amateur Radio license and is a lifelong member of AMSAT (Amateur Radio in Space).

Description:
Invisible signals control everything from satellites to shock collars. Wireless security can be intimidating, especially when research requires a low-level understanding of the many ways radio waves can carry data. The concept of using light to send messages is not hard to grasp, but the several abstraction layers between physical radio waves and decoded data packets obscure what is really happening when wireless devices communicate. By examining several topics that are rarely presented together, this workshop provides the introduction to wireless hacking that we both wish we had when starting out. If you want the ability to see and manipulate the unseen, this workshop is for you.

Registration Link: https://www.eventbrite.com/e/inspecting-signals-from-satellites-to-shock-collars-tickets-162215666425

Prerequisites
Students are expected to have basic familiarity with the Linux command line.

Materials needed:
Students will need to bring a wifi-enabled laptop with a modern browser.


Return to Index    -    Add to    -    ics Calendar file

 

PHV - Friday - 10:00-10:59 PDT


Title: Internet Protocol (IP)
When: Friday, Aug 6, 10:00 - 10:59 PDT
Where: Packet Hacking Village - Talks (Virtual)

SpeakerBio:Roy Feng
Roy Feng (Twitter: @LPF613) is a networking and cybersecurity enthusiast. He has six years of experience working as a network engineer and one year working in threat intelligence. His latest role is at a managed security service provider, where he leads a team of incident responders and threat hunters to help investigate and respond to incidents as well as hunt for threats in customer environments. In his spare time, Roy can be seen building and maintaining his home lab, and learning about and tinkering with the latest and greatest technologies.
Twitter: @LPF613

Description:
The Internet Protocol is one of the foundational protocols of the Internet, and is what keeps devices connected. This video talks about the fundamentals of the Internet Protocol.

All Packet Hacking Village talks will stream on YouTube, Twitch, Facebook, and Periscope.

YouTube: https://youtube.com/wallofsheep

Twitch: https://twitch.tv/wallofsheep

Facebook: https://www.facebook.com/wallofsheep/

Periscope: https://www.periscope.tv/wallofsheep


Return to Index    -    Add to    -    ics Calendar file

 

LPV - Friday - 10:00-10:30 PDT


Title: Intro To Lockpicking
When: Friday, Aug 6, 10:00 - 10:30 PDT
Where: Lock Pick Village (Virtual)

SpeakerBio:TOOOL
No BIO available

Description:
New to lock picking? Haven't picked in a year and need a refresher? Don't know a half-diamond from a turner? This talk is for you! Join one of our knowledgable village volunteers as we walk you through the very basics of lock picking, from how to hold your tools to the theory behind the technique that makes lock picking possible.

Lock Pick Village will be streaming their activities to Twitch and YouTube.

Twitch: https://www.twitch.tv/toool_us?

YouTube: https://youtube.com/c/TOOOL-US


Return to Index    -    Add to    -    ics Calendar file

 

LPV - Friday - 12:00-12:30 PDT


Title: Intro To Lockpicking
When: Friday, Aug 6, 12:00 - 12:30 PDT
Where: Lock Pick Village (Virtual)

SpeakerBio:TOOOL
No BIO available

Description:
New to lock picking? Haven't picked in a year and need a refresher? Don't know a half-diamond from a turner? This talk is for you! Join one of our knowledgable village volunteers as we walk you through the very basics of lock picking, from how to hold your tools to the theory behind the technique that makes lock picking possible.

Lock Pick Village will be streaming their activities to Twitch and YouTube.

Twitch: https://www.twitch.tv/toool_us?

YouTube: https://youtube.com/c/TOOOL-US


Return to Index    -    Add to    -    ics Calendar file

 

LPV - Friday - 14:15-14:45 PDT


Title: Intro To Lockpicking
When: Friday, Aug 6, 14:15 - 14:45 PDT
Where: Lock Pick Village (Virtual)

SpeakerBio:TOOOL
No BIO available

Description:
New to lock picking? Haven't picked in a year and need a refresher? Don't know a half-diamond from a turner? This talk is for you! Join one of our knowledgable village volunteers as we walk you through the very basics of lock picking, from how to hold your tools to the theory behind the technique that makes lock picking possible.

Lock Pick Village will be streaming their activities to Twitch and YouTube.

Twitch: https://www.twitch.tv/toool_us?

YouTube: https://youtube.com/c/TOOOL-US


Return to Index    -    Add to    -    ics Calendar file

 

LPV - Friday - 16:15-16:45 PDT


Title: Intro To Lockpicking
When: Friday, Aug 6, 16:15 - 16:45 PDT
Where: Lock Pick Village (Virtual)

SpeakerBio:TOOOL
No BIO available

Description:
New to lock picking? Haven't picked in a year and need a refresher? Don't know a half-diamond from a turner? This talk is for you! Join one of our knowledgable village volunteers as we walk you through the very basics of lock picking, from how to hold your tools to the theory behind the technique that makes lock picking possible.

Lock Pick Village will be streaming their activities to Twitch and YouTube.

Twitch: https://www.twitch.tv/toool_us?

YouTube: https://youtube.com/c/TOOOL-US


Return to Index    -    Add to    -    ics Calendar file

 

AIV - Friday - 09:30-10:59 PDT


Title: Intro to ML Workshop
When: Friday, Aug 6, 09:30 - 10:59 PDT
Where: AI Village (Virtual)

SpeakerBio:Gavin Klondike
No BIO available

Description:No Description available

AI Village events will be streamed to Twitch, and later be made available as videos on YouTube.

Speakers will be made available on DEF CON's Discord, in #aiv-general-text.


Twitch: https://www.twitch.tv/aivillage

YouTube: https://www.youtube.com/c/aivillage

#aiv-general-text: https://discord.com/channels/708208267699945503/732733090568339536


Return to Index    -    Add to    -    ics Calendar file

 

IOTV - Friday - 16:30-17:15 PDT


Title: IoT Testing Crash Course
When: Friday, Aug 6, 16:30 - 17:15 PDT
Where: IoT Village (Talk - Virtual)

SpeakerBio:Tim Jensen (EapolSniper)
Tim has 9 years of professional security experience, largely in network, IoT, and web application penetration testing. He ran a hack lab in Fargo, ND for 4 years where he taught hardware hacking and penetration testing on evenings and weekends. When not hacking, Tim enjoys cycling, walking, and live music.

Description:
In this IoT 101 level talk I provide practical instruction to security focused individuals who want to test IoT devices for critical vulnerabilities. Included will be basic network pentesting of the device, web app or other UI testing, extracting/downloading firmware, and using binwalk. This will also include reviewing binaries for potential backdoors, looking for hardcoded credentials, and whitebox code review of the UI interface to look for backdoors or other vulnerabilities. All testing will be done against publicly downloadable binaries.

IoT Village talks will be streamed to Twitch. Select speakers may be available in the IoT Village on-site to answer questions.

Twitch: https://www.twitch.tv/iotvillage


Return to Index    -    Add to    -    ics Calendar file

 

IOTV - Friday - 10:00-18:30 PDT


Title: IoT Village Capture the Flag (CTF)
When: Friday, Aug 6, 10:00 - 18:30 PDT
Where: IoT Village (Virtual + Paris Vendome A)

Description:
For more information, see https://www.iotvillage.org/defcon.html

IoT Village virtual events will be streamed to Twitch.

Twitch: https://www.twitch.tv/iotvillage


Return to Index    -    Add to    -    ics Calendar file

 

IOTV - Friday - 10:00-18:30 PDT


Title: IoT Village Labs
When: Friday, Aug 6, 10:00 - 18:30 PDT
Where: IoT Village (Virtual + Paris Vendome A)

Description:
For more information, see https://www.iotvillage.org/defcon.html

IoT Village virtual events will be streamed to Twitch.

Twitch: https://www.twitch.tv/iotvillage


Return to Index    -    Add to    -    ics Calendar file

 

ICSV - Friday - 15:30-15:59 PDT


Title: It Takes a Village (and a generous grant): Students Performing ICS Security Assessments
When: Friday, Aug 6, 15:30 - 15:59 PDT
Where: ICS Village (Virtual)
Speakers:Alexander Vigovskiy,Christopher Von Reybyton,Dennis Skarr

SpeakerBio:Alexander Vigovskiy
No BIO available

SpeakerBio:Christopher Von Reybyton
No BIO available

SpeakerBio:Dennis Skarr , Everett Community College
Dennis Skarr is tenured faculty at Everett Community College (EvCC) where he teaches Information Technology. His teaching endeavors resulted in receiving the 2019 Exceptional Faculty Award from EvCC. Dennis is currently building an Industrial Security Program for EvCC that includes classes, workshops, and Capture the Flag competitions.

Dennis has an extensive background in performing security assessments on a variety of industrial control systems. While Dennis was with the National Guard he created a two-week training program for cyber operators to receive special qualifications for missions involving cyber-physical systems. Dennis spent over 10 years performing assessments for the National Guard on critical systems that included building automation systems, electrical utilities, and voting systems. In 2016, Dennis’ work at the Guard contributed to US Secretary of Defense Ash Carter visiting his unit for a briefing on their capabilities and achievements.

Twitter: @DennisSkarr

Description:
Everett Community College (EvCC) recently launched a 5 credit class titled “Assessing and Securing Control Systems” utilizing custom-developed ICS trainers by GRIMM. Performing a mock assessment on the nation’s first 10 foot ICS wall at a community college, students completed their capstone exercise for the EvCC’s first class dedicated to ICS security. This presentation has multiple students sharing their experiences related to why they chose this class, what they gained, and their career goals after the competition.

ICS Village will be releasing their events to YouTube at each event's scheduled time. Discussion will be available on Discord in #ics-speaker-questions-and-answers-text.

YouTube: https://www.youtube.com/channel/UCI_GT2-OMrsqqglv0JijHhw

#ics-speaker-questions-and-answers-text: https://discord.com/channels/708208267699945503/735937961908109485


Return to Index    -    Add to    -    ics Calendar file

 

SEV - Friday - 12:30-13:30 PDT


Title: Judging by the Cover: Profiling & Targeting Through Social Media
When: Friday, Aug 6, 12:30 - 13:30 PDT
Where: Social Engineer Village (Virtual)

SpeakerBio:Christina Lekati
Christina Lekati is a psychologist, a social engineer and an open-source intelligence analyst.

She specializes in behavioral analysis and in intelligence collection and analysis through open source and human intelligence.

Christina has participated among other things in penetration tests, in trainings to companies and organizations, in vulnerability assessments, and in profiling and analysis of the modus operandi, and in the process of identifying personality traits, behavioral tendencies, and other variables of victims and offenders.

Christina is working with Cyber Risk GmbH as a social engineering specialist and an open source intelligence investigator for the vulnerability assessments conducted on corporations and high-value targets. She is the main developer of the social engineering training programs provided by Cyber Risk GmbH. Those programs are intertwining the lessons learned from real life cases and previous experiences with the fields of cybersecurity, psychology, and counterintelligence.

She is also an active Advisory Board Member at the OSINT Curious project.


Description:
While to the rest of the world social media are friendly platforms of communication and sharing, for the fellow social engineers and OSINT analysts, they are targeting and information harvesting platforms. Even though social media do not always demonstrate our true personalities, they do demonstrate the way we want to be viewed and treated by others – which can be a lot more useful for social engineers. They also “leak” behavioral tendencies and characteristics that provide significant intelligence for any type of operation targeting humans.

The talk covers the topic of information gathering through social media intelligence (SOCMINT), and explains how even seemingly innocent information can be used to manipulate or influence targets. Case studies will be provided.

It will also discuss the art & science of profiling, along with its limitations for social engineering engagements. A two-part demonstration is included on how a profiler’s mind works when harvesting information on social media:

The first part includes real examples of posts that expose vulnerabilities, attract attackers and ultimately can be exploited and lead to security breaches. The second part dives deeper and demonstrates how the information found on a social media profile (from their pictures to the words used by the individual) are gathered, categorized into a profiling matrix and then analyzed, bringing into the surface a personality profile. The target’s profile can then provide actionable intelligence that increases the success of attacks, or attack simulations.


Social Engineer Village will stream content to Twitch.

Twitch: https://www.twitch.tv/socialengineerllc


Return to Index    -    Add to    -    ics Calendar file

 

LPV - Friday - 11:00-11:50 PDT


Title: Key Duplication - It's not just for the movies!
When: Friday, Aug 6, 11:00 - 11:50 PDT
Where: Lock Pick Village (Virtual)

SpeakerBio:Tony Virelli
No BIO available

Description:
Have you ever seen someone just walking around with a key hanging on their belt? How about a wall of keys behind a security desk? Better yet, has anyone you know every posted a picture of the keys to the new home they just bought? Well, what if you could take a picture and easily duplicate that key with a 3D Printer? Sound like something from a James Bond film? Well it's not! Better yet, if you can just get a moment alone with a key, you can get an imprint of it in less than 2 minutes, return the key to the owner and then cast a duplicate of that key for later use.

Lock Pick Village will be streaming their activities to Twitch and YouTube.

Twitch: https://www.twitch.tv/toool_us?

YouTube: https://youtube.com/c/TOOOL-US


Return to Index    -    Add to    -    ics Calendar file

 

ICSV - Friday - 10:00-10:59 PDT


Title: Keynote - PW Singer
When: Friday, Aug 6, 10:00 - 10:59 PDT
Where: ICS Village (Virtual)

SpeakerBio:PW Singer
No BIO available

Description:No Description available

ICS Village will be releasing their events to YouTube at each event's scheduled time. Discussion will be available on Discord in #ics-speaker-questions-and-answers-text.

YouTube: https://www.youtube.com/channel/UCI_GT2-OMrsqqglv0JijHhw

#ics-speaker-questions-and-answers-text: https://discord.com/channels/708208267699945503/735937961908109485


Return to Index    -    Add to    -    ics Calendar file

 

VMV - Friday - 13:30-13:59 PDT


Title: Kickoff Remarks (recorded in-person in Las Vegas)
When: Friday, Aug 6, 13:30 - 13:59 PDT
Where: Voting Village (Talks - Virtual)

SpeakerBio:Harri Hursti
Co-Founder, DEF CON Voting Village; Founding Partner, Nordic Innovation Labs

Harri Hursti is considered one of the world’s foremost experts on the topic of electronic voting security, having served in all aspects of the industry sector. He is considered an authority on uncovering critical problems in electronic voting systems worldwide.

As a consultant, he has conducted and co-authored many studies, both academic and commercial, on various election systems’ data security and vulnerability. These studies have come at the request of officials, legislators and policy makers in 5 countries; including the U.S. government, at both the state and federal level.


Description:
Recorded live in Las Vegas this morning and rebroadcast.

Voting Village talks will be streamed to YouTube and Twitch.

Twitch: https://www.twitch.tv/votingvillagedc

YouTube: https://www.youtube.com/channel/UCnDevqsxt3sO8chqS5MGvwg


Return to Index    -    Add to    -    ics Calendar file

 

CLV - Friday - 12:50-13:20 PDT


Title: Kubernetes Goat - Kubernetes Security Learning (Tool Demo)
When: Friday, Aug 6, 12:50 - 13:20 PDT
Where: Cloud Village (Virtual)

SpeakerBio:Madhu Akula
Madhu Akula is the creator of Kubernetes Goat, an intentionally vulnerable by design Kubernetes Cluster to learn and practice Kubernetes Security. Also published author and Cloud Native security researcher with extensive experience. Also, he is an active member of the international security, DevOps, and Cloud Native communities (null, DevSecOps, AllDayDevOps, etc). Holds industry certifications like OSCP (Offensive Security Certified Professional), CKA (Certified Kubernetes Administrator), etc. Madhu frequently speaks and runs training sessions at security events and conferences around the world including DEFCON (24, 26 & 27), BlackHat USA (2018 & 19), USENIX LISA (2018 & 19), O'Reilly Velocity EU 2019, GitHub Satellite 2020, Appsec EU (2018 & 19), All Day DevOps (2016, 17, 18, 19 & 20), DevSecCon (London, Singapore, Boston), DevOpsDays India, c0c0n(2017, 18), Nullcon (2018, 19), SACON 2019, Serverless Summit, null and multiple others. His research has identified vulnerabilities in over 200+ companies and organizations including; Google, Microsoft, LinkedIn, eBay, AT&T, WordPress, NTOP and Adobe, etc, and credited with multiple CVE's, Acknowledgements, and rewards. He is co-author of Security Automation with Ansible2 (ISBN-13: 978-1788394512), which is listed as a technical resource by Red Hat Ansible. Also, technical reviewer of Learn Kubernetes Security book published by Packt. Also won 1st prize for building Infrastructure Security Monitoring solution at InMobi flagship hackathon among 100+ engineering teams.
Twitter: @madhuakula

Description:
Kubernetes Goat is "vulnerable by design" Kubernetes Cluster environment to practice and learn about Kubernetes Security. In this session, Madhu Akula will present how to get started with Kubernetes Goat by exploring different vulnerabilities in Kubernetes Cluster and Containerized environments. Also, he demonstrates the real-world vulnerabilities and maps the Kubernetes Goat scenarios with them. We will see the complete documentation and instruction to practice Kubernetes Security for performing security assessments. As a defender you will see how we can learn these attacks, misconfigurations to understand and improve your cloud native infrastructure security posture.

Cloud Village activities will be streamed to YouTube.

YouTube: https://www.youtube.com/cloudvillage_dc


Return to Index    -    Add to    -    ics Calendar file

 

CLV - Friday - 14:35-16:59 PDT


Title: Kubernetes Security 101: Best Practices to Secure your Cluster (Workshop)
When: Friday, Aug 6, 14:35 - 16:59 PDT
Where: Cloud Village (Virtual)

SpeakerBio:Magno Logan
Magno Logan works as an Information Security Specialist for Trend Micro. He specializes in Cloud, Container and Application Security Research, Threat Modelling and Red Teaming. He has been tapped as a resource speaker for numerous security conferences around the globe. He is the founder of the JampaSec Security Conference and the OWASP Paraiba Chapter and also an active member of the CNCF TAG-Security team.
Twitter: @magnologan

Description:
This workshop aims to give an overview about how Kubernetes works and provide some best practices to secure your cluster whenever you are deploying a new cluster on your own or via managed services such as GKE, EKS or AKS. We are going to cover everything from the Control Plane or the Master Node, starting with the API server, including etcd, RBAC and network policies. Then, we’ll cover the worker nodes, kubelet, audit logs and pods best practices. We'll talk about the CIS Benchmarks for Kubernetes and the default configurations you need to worry about when deploying a new cluster. We'll show how to use RBAC and assign roles and permissions to your cluster users. We'll demonstrate how to enable audit logs for better visibility and later we'll set up some network policies to avoid communication between pods and prevent any lateral movement from attackers. Are you starting to use Kubernetes for container orchestration? Do you need guidelines on how to start securing Kubernetes in your organization? Do you want to find a way to increase the protection of your Kubernetes clusters without increasing the complexity of the infrastructure? Do you need to use Kubernetes clusters in a safe, efficient and affordable way? Everything in a practical way with a focus on security best practices? Then this is the workshop for you! Outline:

Cloud Village activities will be streamed to YouTube.

YouTube: https://www.youtube.com/cloudvillage_dc


Return to Index    -    Add to    -    ics Calendar file

 

DL - Friday - 14:00-15:50 PDT


Title: Kubestriker
When: Friday, Aug 6, 14:00 - 15:50 PDT
Where: DemoLab Video Channel 1

SpeakerBio:Vasant Chinnipilli
Vasant is a security enthusiast and speaker, currently working as a Security Architect and DevSecOps Practitioner.

His technical abilities span a wide range of technologies across various domains of information security including cloud and container security and penetration testing. He is passionate about cloud and cloud native security, devsecops and security automation.


Description:
Tool Name: Kubestriker - a blazing fast security auditing tool for kubernetes

Short Abstract:
Kubestriker is a platform-agnostic tool designed to tackle Kuberenetes cluster security issues due to misconfigurations and will help strengthen the overall IT infrastructure of any organization.

It performs numerous in depth checks on a range of services and open ports on Kubernetes platform to identify any misconfigurations which make organisations an easy target for attackers. In addition, it helps safeguard against potential attacks on Kubernetes clusters by continuously scanning, monitoring and alerting of any anomalies.

Furthermore, it comprises the ability to see some components of kubernetes infrastructure and provides visualised attack paths of how hackers can advance their attacks.

Short Developer Bio:
Vasant is a security enthusiast and speaker, currently working as a Security Architect and DevSecOps Practitioner. His technical abilities span a wide range of technologies across various domains of information security including cloud and container security and penetration testing. He is passionate about cloud and cloud native security, devsecops and security automation.

URL to any additional information:
https://github.com/vchinnipilli/kubestriker

Detailed Explanation of Tool:
The tool is open source and platform-agnostic making it compatible with various platforms such as self-hosted kubernetes, Amazon EKS, Azure AKS and Google GKE.

Current capabilities include performing in-depth reconnaissance and automated enumeration for a range of services and open ports. It also scans for a wide range of IAM misconfigurations, misconfigured containers and misconfigured pod security and network policies. It can also assess the excessive privileges of subjects in the cluster and generate an elaborative report with detailed explanation of the findings.

It also incorporates security for containers running in the cluster by continuously discovering, tracking, scanning, and reporting them, along with the ability to see some of the components of kubernetes infrastructure and provide visualised attack paths of how hackers can advance their attacks by chaining different misconfigured components in the kubernetes cluster.

Target Audience:
Offensive and Defensive Security Professionals Security Auditors
Developers, Devops, Sysadmins, Devsecops and SRE professionals The aim of the presentation is to demonstrate the kind of attacks that are possible due to misconfigurations. In particular, through the use of Kubestriker, I will demonstrate how misconfigured cluster privileges can compromise the kubernetes platform and its underlying infrastructure, along with showing backdooring cloud environments, avoid detection by manipulating logging controls and access sensitive information and trade secrets due to IAM, pod security policy and webhook misconfigurations.


This content will be presented on a Discord video channel.

#dl-video1-voice: https://discord.com/channels/708208267699945503/734027693250576505


Return to Index    -    Add to    -    ics Calendar file

 

LPV - Friday - 17:00-17:45 PDT


Title: Law School for Lockpickers
When: Friday, Aug 6, 17:00 - 17:45 PDT
Where: Lock Pick Village (Virtual)

SpeakerBio:Preston Thomas
No BIO available

Description:
No, Virginia, lockpicks aren't "illegal". Like lockpicking itself, the law of lockpicking is esoteric, widely misunderstood, and occasionally a source of hilarity when interpreted by outsiders. Class is in session as practicing attorney and former TOOOL Board member Preston Thomas hosts a lighthearted law school for locksporters, laying out the legal logic, busting myths, and telling stories. Expect raucous Q&A, real talk, and absolutely zero legal advice.

Lock Pick Village will be streaming their activities to Twitch and YouTube.

Twitch: https://www.twitch.tv/toool_us?

YouTube: https://youtube.com/c/TOOOL-US


Return to Index    -    Add to    -    ics Calendar file

 

SOC - Friday - 18:00-19:59 PDT


Title: Lawyers Meet
When: Friday, Aug 6, 18:00 - 19:59 PDT
Where: Bally's Pool Cabana

Description:
If you're a lawyer (recently unfrozen or otherwise), a judge or a law student please make a note to join Jeff McNamara at 18:00 on Friday in a poolside cabana, look for the sign, for a friendly get-together, drinks, and conversation.

Return to Index    -    Add to    -    ics Calendar file

 

WS - Friday - 15:00-18:59 PDT


Title: Learning to Hack Bluetooth Low Energy with BLE CTF
When: Friday, Aug 6, 15:00 - 18:59 PDT
Where: Workshops - Las Vegas 3+4 (Onsite Only)

SpeakerBio:Ryan Holeman , Global Security Overlord
Ryan Holeman resides in Austin Texas where he works as the Global Security Overlord on Atlassian's Security team. He is also an advisor for the endpoint security software company Ziften Technologies. He received a Masters of Science in Software Engineering from Kent State University. His graduate research and masters thesis focused on C++ template metaprograming. He has spoken at many respected venues such as Black Hat, DEF CON, Lockdown, BSides, Ruxcon, Notacon, and Shmoocon. He has also published papers though venues such as ICSM and ICPC . You can keep up with his current activity, open source contributions and general news on his blog. His spare time is mostly spent digging into various network protocols, random hacking, creating art, and shredding local skateparks.

Description:
BLE CTF is a series of Bluetooth low energy challenges in a capture the flag format. It was created to teach the fundamentals of interacting with and hacking Bluetooth Low Energy services. Each exercise, or flag, aims to interactively teach a new concept to the user. For this workshop, we will step through a series of exercises to teach beginner students new concepts and allow more seasoned users to try new tools and techniques. After completing this workshop, you should have a good solid understanding of how to interact with and hack on BLE devices in the wild.

If you have done BLE CTF in the past, this class is still valuable. For advanced users we offer BLE CTF Infinity which is a sequel to BLE CTF. BLE CTF Infinity offers new exercises where each flag challenge is hosted in a completely separate GATT service. The new version allows for more advanced challenges which were not possible in the past.

To prepare for the workshop, please follow the setup documentation located at https://github.com/hackgnar/ble_ctf/blob/master/docs/workshop_setup.md

Registration Link: https://www.eventbrite.com/e/learning-to-hack-bluetooth-low-energy-with-ble-ctf-las-vegas-3-4-tickets-162217343441

Prerequisites
To prepare for the workshop, please follow the setup documentation located at https://github.com/hackgnar/ble_ctf/blob/master/docs/workshop_setup.md

Materials needed:
Preferably a Linux box with a bluetooth controller or a bluetooth usb dongle. An OSX or Windows machine with a Linux VM and usb passthough works as well but should be setup and tested before the workshop.


Return to Index    -    Add to    -    ics Calendar file

 

IOTV - Friday - 12:45-13:15 PDT


Title: LED Light Lunacy!
When: Friday, Aug 6, 12:45 - 13:15 PDT
Where: IoT Village (Talk - Virtual)

SpeakerBio:Victor Hanna
Security Researcher at SpiderLabs

Description:
All your LEDs are mine ... How a case of lockdown boredom turned into led lights for everyone !

IoT Village talks will be streamed to Twitch. Select speakers may be available in the IoT Village on-site to answer questions.

Twitch: https://www.twitch.tv/iotvillage


Return to Index    -    Add to    -    ics Calendar file

 

ASV - Friday - 10:00-15:59 PDT


Title: Lego Spike Hub
When: Friday, Aug 6, 10:00 - 15:59 PDT
Where: Aerospace Village (Workshop - Paris Rivoli B)

Description:
Participants will be given the opportunity to program a Lego Spike Hub to perform a space mission of transporting and sorting valuable minerals. The workshop is intended to be an introductory workshop to give participants an appreciation for the operation of autonomous space vehicles and an understanding of finite state machines and hardware limitations. There will be 4 prebuilt Lego robots, 2 will be for tracing a line while the other 2 will be for color sorting. The scenario presented to the participant is that they are on a foreign planet and need to transport minerals along a predefined path to safely arrive at the sorting facility and as such will program in Scratch code code for the transport shuttle to execute. Participants will also have a chance to program in Scratch the code to execute on the color sorting robot, thus demonstrating the ability to correctly sort the minerals in appropriate colors.

Return to Index    -    Add to    -    ics Calendar file

 

BHV - Friday - 17:00-17:30 PDT


Title: Lets Get Real About The Future State of Healthcare
When: Friday, Aug 6, 17:00 - 17:30 PDT
Where: Biohacking Village (Talk - Virtual)
Speakers:Christian Dameff,Jeff 'R3plicant' Tully

SpeakerBio:Christian Dameff , Medical Director of Cybersecurity at UCSD
No BIO available

SpeakerBio:Jeff 'R3plicant' Tully
No BIO available

Description:
Taking the lessons of COVID-19 and the healthcare response, how can we create an improved state of resilience in healthcare?

All Biohacking Village talks will be streamed to YouTube.

YouTube: https://www.youtube.com/channel/UCm1Kas76P64rs2s1LUA6s2Q


Return to Index    -    Add to    -    ics Calendar file

 

CPV - Friday - 14:45-14:59 PDT


Title: Lightning Talk: Differential Privacy and Census Data
When: Friday, Aug 6, 14:45 - 14:59 PDT
Where: Crypto & Privacy Village (Virtual)

SpeakerBio:Wendy Edwards
Wendy is a software developer interested in the intersection of cybersecurity and data science. She’s involved in the NASA Datanauts program and participated in the SANS Women’s Academy, earning GIAC GSEC, GCIH, and GCIA certifications. She has masters degrees in computer science and library and information science from the University of Illinois. She has spoken at Summercon, BSides Chicago, The Diana Initiative, Hackfest Canada, Circle City Con, and DEFCON Ethics Village. In her spare time, she enjoys Scrabble and swimming and has a lively flat-coated retriever named Ciaran.
Twitter: @wayward710

Description:
The U.S. Constitution requires that a Census be conducted every 10 years. In addition to counting populations, the Census also collects personal data that's legally required to be kept private. This presents a growing challenge: how can the Census provide accurate statistical data without revealing information that would allow others to piece together someone's data? For example, what if you had a very small census block with only one member of a particular ethnicity? Without any privacy measures, it might be possible to figure out who the person was. Big data also increases privacy risks. What if it was possible to deidentify Census data and then combine it with social media big data?

The Census Bureau has developed a Disclosure Avoidance System that uses differential privacy to introduce noise into results. Essentially, the goal of differential privacy is to give each person the same amount of privacy they would have if their data was removed. Differential privacy has a number of implications for redistricting; for example, it may make gerrymandering more difficult since fine-grained data is obscured.

This talk will discuss Census privacy challenges, and provide an overview of differential privacy.


Crypto & Privacy Village will be streaming their events to YouTube and Twitch.

Twitch: https://www.twitch.tv/cryptovillage

YouTube: https://www.youtube.com/c/CryptoVillage


Return to Index    -    Add to    -    ics Calendar file

 

AVV - Friday - 13:00-13:45 PDT


Title: Look at me, I'm the Adversary now: Introduction to Adversary Emulation and its place in Security Operations
When: Friday, Aug 6, 13:00 - 13:45 PDT
Where: Adversary Village (Virtual)

SpeakerBio:Samuel Kimmons
Samuel Kimmons is Red Teamer at Cognizant. He is responsible for researching, planning, and developing full scope Red Team engagements. Samuel got is start in Information Security during his time in the United States Air Force (USAF). While in the USAF he stood up the first interal red team at the United States Air Force Computer Emergency Response Team (AFCERT). His team's primary purpose was to emulate threat actors in order to increase the accuracy of detection capabilities.
https://www.linkedin.com/in/kimmons

Description:
Adversary Emulation is quickly becoming a hot topic in information security, and there is a good reason for it. Security analysts, threat hunters, and incident responders are constantly facing an onslaught of old and new threats. How can defenders properly prepare for the ever-changing threat landscape, improve their skill set, and improve the security posture of their organization? In this presentation I'll answer those questions by covering: The various forms of Adversary Emulation, where/how it fits into Security Operations, Threat Intelligence, the benefits of using it as a Blue Team training tool, and how to get started!

Adversary Village talks and workshops will be streamed on YouTube and Twitch.

Q&A sessions will happen in DEF CON Official Discord server after each talk.


YouTube: https://www.youtube.com/channel/UCOhn9WALnpb5YAbW18R1Hzg

Twitch: https://twitch.tv/adversaryvillage

Discord: https://discord.gg/defcon


Return to Index    -    Add to    -    ics Calendar file

 

BTV - Friday - 14:00-17:59 PDT


Title: MacOs Workshop - Hunt for Red Apples: Ocean Lotus Edition Part1
When: Friday, Aug 6, 14:00 - 17:59 PDT
Where: Blue Team Village - Workshop Track 1 (Virtual)
Speakers:Cat Self,plug,Ben Bornholm,Tilottama Sanyal,Dan Borges

SpeakerBio:Cat Self , Lead Cyber Adversarial Engineer – The MITRE Corporation
Cat Self is a Lead Cyber Adversarial Engineer working on MITRE ATT&CK® and ATT&CK Evaluations teams at MITRE. Cat previously worked at Target as a red team operator, threat hunter, and developer. Cat is an Army Military Intelligence veteran with a passion for mentorship, hiking in foreign lands, and finding opportunities to give back.

SpeakerBio:plug
Plug started his journey in computer security back in 1996 when he discovered a 2600 magazine that eventually lead him to his first LA2600 meeting in 1998. From that point forward, he has been involved in computer security. Plug currently leads the Threat Hunting Program for a Fortune 20 organization. In his free time he enjoys building Legos, playing with synthesizers, and when possible, he volunteers his time to computer security events.

SpeakerBio:Ben Bornholm
Ben (@CptOfEvilMinion) is not new to creating workshops as this is his second time creating a DEFCON workshop, yet he has never actually been to DEFCON in person! Ben crafted his whimsical presenting style from being President of RIT’s security club previously known as RC3.

During the day Ben fights off cyber criminals as a DART engineer at Dropbox.com. At night Ben is the author of his blog HoldMyBeerSecurity.com where he discusses topics in security that interest him such as incident response, threat hunting, Osquery, and DevSecOps.

Twitter: @CptOfEvilMinion

SpeakerBio:Tilottama Sanyal
Tilottama Sanyal (wildphish) has a degree in Information technology from India and has almost 8 years of combined experience across DevOps and Cybersecurity. She holds certifications like the GCIH and currently works as an Incident Response Team member at Verizon Media (Yahoo!). Her areas of expertise include risk assessments, vulnerability analysis, and incident response. Her current interests include threat hunting and this is her first-ever workshop.
Twitter: @wildphish

SpeakerBio:Dan Borges
A core member of the National CCDC red team and a director for the Global CPTC. Recently wrote a book on deception applied to infosec and attack-defense competitions: https://ahhh.github.io/Cybersecurity-Tradecraft/

Description:
The Hunt for Red Apples workshop guides participants through emulation walkthroughs, hunting playbooks, & hunting exercises around an Ocean Lotus intrusion, an established threat actor targeting macOS. The workshop is broken into sections using both the attack lifecycle & Mitre ATT&CK knowledge base.

For each phase in the attack live cycle participants learn about one particular tactic, relevant macOS data sources, how to build a hunting plan, practice hunting, & how the red team emulated the tactic using open source intelligence.

This workshop is a resource on how to threat hunt, emulate, & use open source threat intelligence on a specific threat actor.

The Hunt for Red Apples workshop guides participants through emulation walkthroughs, hunting playbooks, and hunting exercises around an Ocean Lotus intrusion, an established threat actor targeting macOS. The workshop is broken into sections using both the attack lifecycle and Mitre ATT&CK knowledge base. For each phase in the attack live cycle participants learn about one particular tactic, relevant macOS data sources, how to build a hunting plan, practice hunting, and how the red team emulated the tactic using open source intelligence.

The objective of this workshop is to provide a balanced approach that showcases both hunting and adversary actions. This workshop is a resource on how to threat hunt, emulate, and use open source threat intelligence on a specific threat actor.

The Hunt for Red Apples workshop is broken into two four hour sessions over two days. As a bonus, we are releasing a second data set for a different scenario on day two for more advanced hunters with no playbooks or walkthroughs. Participants will get to test their macOS Threat Hunting skills! And it's all FREE!


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 09:00-09:59 PDT


Title: Making the DEF CON 29 Badge
When: Friday, Aug 6, 09:00 - 09:59 PDT
Where: DCTV/Twitch #3 Pre-Recorded
Speakers:Katie Whiteley,Michael Whiteley

SpeakerBio:Katie Whiteley
Katie is a wife, mother, and graphic designer. She likes long walks on the beach because there's no internet connection.

Together with Michael, they are MK Factor, a husband/wife badgemaker team. They've created badges for many conferences and groups like OpenWest, Saintcon, DC801, Car Hacking Village, and many unofficial DEF CON badges. Together they earned a black badge for Car Hacking at DEF CON 24.

Twitter: @ktjgeekmom

SpeakerBio:Michael Whiteley
Michael is a husband, father, and electronics geek. He doesn't like long walks on the beach, but prefers to be indoors with a fast internet connection.

Together with Katie, they are MK Factor, a husband/wife badgemaker team. They've created badges for many conferences and groups like OpenWest, Saintcon, DC801, Car Hacking Village, and many unofficial DEF CON badges. Together they earned a black badge for Car Hacking at DEF CON 24.

Twitter: @compukidmike

Description:
Come meet the new badge makers and hear the story of how this year's badge was created amidst a global pandemic. We'll share tales of chip shortages, delayed parts, and late nights, as well as discuss how the badge works and what you can do with it. Maybe even some hints about the challenges within...

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=H3kdq40PY3s

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Michael%20Whiteley%20Katie%20Whiteley%20-%20Making%20the%20DEF%20CON%2029%20Badge.mp4


This talk has been pre-recorded and will be released to the DEF CON Media Server, torrents, and YouTube. At the time of this event, it will also stream on DCTV3, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_three


Return to Index    -    Add to    -    ics Calendar file

 

CAHV - Friday - 14:00-14:59 PDT


Title: Making the Leap - Changing Careers
When: Friday, Aug 6, 14:00 - 14:59 PDT
Where: Career Hacking Village (Talk)

SpeakerBio:Danyelle Davis
No BIO available

Description:
Cyber Security, Research, H4x0r, or that stuff in the place with the thing. Regardless of what you call it, many people end up here after starting down a different career path. I was one of those people. I found myself, a 26 year old, black, female, manual software tester with learning disabilities, in an automated world. I refused to be stuck in a dead end job for the rest of my life. I decided it was time for a switch. Like any transition - some things worked well and some needed improvement. My challenges in maintaining one career while transitioning to another can provide insights as you plan your own.

This talk will be available on YouTube: https://www.youtube.com/watch?v=0mFw0fXia58


Career Hacking Village content will be available on YouTube.

YouTube: https://youtube.com/careerhackingvillage


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 14:00-14:45 PDT


Title: MAVSH> Attacking from Above
When: Friday, Aug 6, 14:00 - 14:45 PDT
Where: Track 1 Live; DCTV/Twitch #1 Pre-Recorded

SpeakerBio:Sach
Sach is a self taught developer, an aspiring pentester, and a drone enthusiast. In his spare time he enjoys playing chess, reading Sci-Fi novels, learning about cryptocurrencies, and flying drones.
Twitter: @0xkayn

Description:
Over the course of 2020 and 2021, drone enthusiasts and the FAA have been locked in a series of legal battles over the future of unmanned aviation.

New regulations and restrictions, such as Remote Identification, aim to leave drone and model aviation hobbyists with a grim choice: incur countless financial costs, or lose the ability to fly freely.

Not only do these regulations impact hobbyists, they also restrict our ability to use drones as recon and payload delivery tools, but the FAA gave us a loophole.

In this talk, I'll share my knowledge of the MAVLink protocol and how it can be modified to take advantage of that loophole. I'll also show you how to build a drone capable of 20+ minute flights, potentially multiple miles of range, and hosting a Raspberry Pi 0 W onboard, enabling remote command execution without the use of onboard WiFi or cellular networks ALL while exploiting that loophole.

Come learn how and why the FAA "Can't Stop the Signal"!

REFERENCES

Ardupilot
https://ardupilot.org/ https://github.com/ArduPilot/ardupilot
MAVLink
https://mavlink.io/en/

Danger Drone and Defense Measures:
https://resources.bishopfox.com/files/slides/2017/DEF_CON_25_(2017)-Game_of_Drones-Brown_Latimer-29July2017.pdf https://resources.bishopfox.com/resources/tools/drones-penetration-testers/attack-tools/

Watch Dogs Drone:
https://hackaday.com/2018/05/27/watch-dogs-inspired-hacking-drone-takes-flight/

FAA vs RDQ:
https://www.racedayquads.com/pages/rdq-vs-faa https://www.gofundme.com/f/savefpv?utm_campaign=p_cp_url&utm_medium=os&utm_source=customer https://www.suasnews.com/2021/03/racedayquads-com-vs-faa-court-case-in-defense-of-all-drone-pilots-and-model-aviators/


This talk will be given live in Track 1.

This talk has also been pre-recorded and will be broadcast on DCTV1, both in local hotels and on Twitch.


DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_one


Return to Index    -    Add to    -    ics Calendar file

 

HHV - Friday - 15:30-15:59 PDT


Title: Meetup: Legacy Hardware
When: Friday, Aug 6, 15:30 - 15:59 PDT
Where: Hardware Hacking Village (Virtual Meetup)

SpeakerBio:K
No BIO available

Description:
A place to meet people with the same interests or challenges and discuss. The meetup is a nexus for finding and starting the conversation. Bring your expertise and your questions.

#hhv-meetups-A: https://discord.com/channels/708208267699945503/739567085004521533

#hhv-meetups-A-voice: https://discord.com/channels/708208267699945503/739571117756383333


Return to Index    -    Add to    -    ics Calendar file

 

HHV - Friday - 14:30-14:59 PDT


Title: Meetup: PCB Proto and Rework
When: Friday, Aug 6, 14:30 - 14:59 PDT
Where: Hardware Hacking Village (Virtual Meetup)

SpeakerBio:K
No BIO available

Description:
A place to meet people with the same interests or challenges and discuss. The meetup is a nexus for finding and starting the conversation. Bring your expertise and your questions.

#hhv-meetups-A: https://discord.com/channels/708208267699945503/739567085004521533

#hhv-meetups-A-voice: https://discord.com/channels/708208267699945503/739571117756383333


Return to Index    -    Add to    -    ics Calendar file

 

HHV - Friday - 17:30-17:59 PDT


Title: Meetup: Some HHV challenges
When: Friday, Aug 6, 17:30 - 17:59 PDT
Where: Hardware Hacking Village (Virtual Meetup)

SpeakerBio:rehr
Rehr is an electrical engineering, and long-time Hardware Hacking Village volunteer. He enjoys teaching and creating challenges that help grow and challenge the hardware hacking community.
Twitter: @mediumrehr

Description:
HHV members have created a few challenges for this year’s DEF CON. Come learn and chat about those challenges, or bring new challenges to share with the community. This time will start with an introduction to this year’s HHV challenges, but the remaining time will be open to community questions and conversations

#hhv-challenge: https://discord.com/channels/708208267699945503/739567199647301702

#hhv-meetups-A-voice: https://discord.com/channels/708208267699945503/739571117756383333


Return to Index    -    Add to    -    ics Calendar file

 

HHV - Friday - 09:30-09:59 PDT


Title: Meetup: Some HHV challenges
When: Friday, Aug 6, 09:30 - 09:59 PDT
Where: Hardware Hacking Village (Virtual Meetup)

SpeakerBio:rehr
Rehr is an electrical engineering, and long-time Hardware Hacking Village volunteer. He enjoys teaching and creating challenges that help grow and challenge the hardware hacking community.
Twitter: @mediumrehr

Description:
HHV members have created a few challenges for this year’s DEF CON. Come learn and chat about those challenges, or bring new challenges to share with the community. This time will start with an introduction to this year’s HHV challenges, but the remaining time will be open to community questions and conversations

#hhv-challenge: https://discord.com/channels/708208267699945503/739567199647301702

#hhv-meetups-A-voice: https://discord.com/channels/708208267699945503/739571117756383333


Return to Index    -    Add to    -    ics Calendar file

 

AIV - Friday - 12:30-12:59 PDT


Title: Microsoft ML Security Evasion Competition Details
When: Friday, Aug 6, 12:30 - 12:59 PDT
Where: AI Village (Virtual)

SpeakerBio:Hyrum Anderson
No BIO available

Description:No Description available

AI Village events will be streamed to Twitch, and later be made available as videos on YouTube.

Speakers will be made available on DEF CON's Discord, in #aiv-general-text.


Twitch: https://www.twitch.tv/aivillage

YouTube: https://www.youtube.com/c/aivillage

#aiv-general-text: https://discord.com/channels/708208267699945503/732733090568339536


Return to Index    -    Add to    -    ics Calendar file

 

PHV - Friday - 11:00-11:59 PDT


Title: MITRE Engage: A Framework for Adversary Engagement Operations
When: Friday, Aug 6, 11:00 - 11:59 PDT
Where: Packet Hacking Village - Talks (Virtual)
Speakers:Stan Bar,Gabby Raymond,Maretta Morovitz

SpeakerBio:Stan Bar
Dr. Stanley Barr is a three-time graduate of University of Massachusetts Lowell. He has a BS in Information Sciences, an MS in Mathematics, and a PhD in Computer Science. He has coauthored papers in malware analysis, barrier coverage problems, expert systems for network security, and robotic manufacturing. He has spoken at MILCOM and been a panelist for several conferences. Additionally, he has appeared on several podcasts on adversary engagement and presented at TEDx. Currently, he is a Principal Scientist at The MITRE Corporation. He currently is the Capability Area Leader for Cyber Denial, Deception, and Adversary Engagement. Stan lives with his wife, 5 rescue dogs, and 15 chickens.

SpeakerBio:Gabby Raymond , CO-CAPABILITY AREA LEAD, CYBER DENIAL, DECEPTION, AND ADVERSARY ENGAGEMENT, THE MITRE CORPORATION
Gabby Raymond is a two-time graduate from Tufts University. She holds a B.S. in Mathematics and Computer Science and a M.S. in Computer Science. Her research has spanned topics in intrusion detection, cyber-physical systems, and machine learning applications for security. Gabby recently co-authored a Choose Your Own Adventure style book called "The Toolbox of Innovation" with members of MITRE's Innovation Toolkit team. Outside of work, Gabby enjoys knitting and judging science fairs. Gabby is the Co-Capability Area Lead for Cyber Deception and Adversary Engagement at The MITRE Corporation.

SpeakerBio:Maretta Morovitz , SENIOR CYBER SECURITY ENGINEER, THE MITRE CORPORATION
Maretta Morovitz is a graduate of Tufts University School of Engineering, where she graduated with a degree in Computer Science. She is a Senior Cyber Security Engineer at the MITRE Corporation where she works in the areas of adversary engagement, malware analysis, and reverse engineering. She is a founding member of MITRE's Cyber Deterrence and Adversary Management (CDAM) team and has helped shape MITRE's adversary engagement work for the last two years. She was recently named as one fo the AFCEA 40 Under 40 Awardees for 2021. Outside of work you can find her nerding out about the latest Brandon Sanderson novel, still anxiously awaiting her letter from Hogwarts, or snuggling with her dog and hedgehog.

Description:
For 10+ years MITRE has been engaged in denial, deception, and adversary engagement operations for internal defense and research purposes. We have created MITRE Engage as a framework for planning and communicating about adversary engagement operations. In our talk we include:

All Packet Hacking Village talks will stream on YouTube, Twitch, Facebook, and Periscope.

YouTube: https://youtube.com/wallofsheep

Twitch: https://twitch.tv/wallofsheep

Facebook: https://www.facebook.com/wallofsheep/

Periscope: https://www.periscope.tv/wallofsheep


Return to Index    -    Add to    -    ics Calendar file

 

DL - Friday - 10:00-11:50 PDT


Title: Mooltipass
When: Friday, Aug 6, 10:00 - 11:50 PDT
Where: DemoLab Video Channel 2

SpeakerBio:Mathieu Stephan
Mathieu Stephan is an electronics engineer who is actively involved in the open source movement. He specializes in designing devices from the ground up and alternates between full-time positions in the security and communication industries and contracting jobs in other sectors – from quantum physics to Formula E cars. He has been a writer for Hackaday and has a personal website filled with electronics projects.

Description:
Tool or Project Name: Mooltipass

Short Abstract: The Mooltipass project is a completely open-source ecosystem aimed at providing hardware-based authentication solutions. Its latest family member, the Mooltipass Mini BLE, features a dual microcontroller architecture aimed at separating the communications and security domains, together with an OLED screen and dedicated flash memories for credentials and graphics storage. The Mooltipass project is an ongoing 7-year adventure with contributors from around the globe. It has produced 3 hardware devices, multiple browser extensions, a cross-platform user interface and software daemon, an SSH agent and a python library.

Short Developer Bio: Mathieu Stephan is an electronics engineer who is actively involved in the open source movement. He specializes in designing devices from the ground up and alternates between full-time positions in the security and communication industries and contracting jobs in other sectors – from quantum physics to Formula E cars. He has been a writer for Hackaday and has a personal website filled with electronics projects.

URL to any additional information: https://github.com/mooltipass/minible

Detailed Explanation of Tool: The Mooltipass project is an authentication ecosystem centered around several open source devices, the Mooltipass Standard, Mini and BLE.

Among its many features, it offers:
Files, notes and credentials storage
FIDO2 (WebAuthn), TOTP and SSH support
Native credentials recall into browser login fields On-device language and security parameter customization Standalone credential typing using the device's standard USB or Bluetooth Keyboard HID channels Cross-platform tools allowing device database management and synchronization Its latest family addition, the Mini BLE, includes the following hardware features: A dual microcontroller architecture: the 'auxiliary' ATSAMD21E18 takes care of USB (HID, FIDO2, custom HID) and Bluetooth Low Energy (HID and custom HID) communications while the 'main' ATSAMD21G18 takes care of the rest. A dedicate hardware line for the main MCU to hard-disable BLE communications A 256x64x4bpp 2.08" OLED screen
A clickable scroll wheel for fast user interaction A smartcard connector to interface with secure elements storing the encryption keys A dedicated flash memory for graphics, strings and signed firmware updates A dedicated flash memory for users' encrypted databases Purpose-built charging electronics for the NiMH battery The firmware running on the ATSAMD21E18 and on ATSAMD21G18 was built from scratch, except the crypto routines which are from the open source BearSSL library, and the BLE features which are from the Atmel-proprietary library. The firmware provides the following features: A fully-fledged graphical library that handles compressed bitmaps and font rendering, using an internal frame buffer as needed A custom-made database model allowing storage of credentials, files, notes and WebAuthn secrets while still allowing ease-of-use features such as favorites A read-only file system library allowing fetching of graphical data, user-selected language strings, firmware updates and keyboard HID lookup tables A dedicated abstraction layer allowing the device to send unicode text using simulated key presses through BLE & USB HID, with support for dozens of keyboard layouts Graphical and database storage support of the Unicode Basic Multilingual Plane Time based One Time Password (TOTP) and FIDO2 (WebAuthn) support On-device password generation and credential display To facilitate our development process and to allow device testing by everyone, we developed device emulators for Windows and Linux. These emulators also enable testing most of the Mooltipass ecosystem open-source software components:

  1. Moolticute, a Qt-based cross-platform software tool composed of a daemon & user interface allowing the user to: customize device behavior (more than 30 settings, requested by our beta testers and users of previous generations of the Mooltipass) manage, modify, import and export a user's database directly view and edit notes stored on the device upload and download files to and from the device manage FIDO2 credentials
  2. mc-agent, an SSH agent running on the OS side allowing password-less SSH authentication, written in Go
  3. mooltipy, a python library to recall credentials stored on the Mooltipass
  4. mc-cli, a command line tool written in Go to interact with the device

Supporting Files, Code, etc: https://github.com/mooltipass

Target Audience:
Hardware, Defense

How will you or your Demo Lab contribute a new perspective to the content at DEF CON? The Mooltipass project takes a fundamentally different approach from the commonly used software-based security solutions that require non-compromised systems to run on. We want to show that there are open source hardware solutions out there that do not sacrifice security for ease-of-use and while reducing the attack surface to a very strict minimum.


This content will be presented on a Discord video channel.

#dl-video2-voice: https://discord.com/channels/708208267699945503/734027778646867988


Return to Index    -    Add to    -    ics Calendar file

 

MUS - Friday - 01:00-01:59 PDT


Title: Music - Acid T
When: Friday, Aug 6, 01:00 - 01:59 PDT
Where: Bally's Silver Ballroom

SpeakerBio:Acid T
Prepare for some Post Pandemic Pandemonium!

https://www.facebook.com/dj.sm0ke
https://www.twitch.tv/studio_sm0ke
https://www.youtube.com/channel/UC55xsENb9PKz-IKB5zodYGA https://soundcloud.com/acid_t
https://twitter.com/DJ_Sm0ke
https://youtu.be/3lIhyGU4uB4
https://soundcloud.com/acid_t/liquid-feeling

Twitter: @DJ_Sm0ke

Description:No Description available

Return to Index    -    Add to    -    ics Calendar file

 

MUS - Friday - 00:00-00:59 PDT


Title: Music - DJ St3rling
When: Friday, Aug 6, 00:00 - 00:59 PDT
Where: Bally's Silver Ballroom

SpeakerBio:DJ St3rling
L33t Hacker by day, DJ by night- DJ St3rling brings those dirty ass bass wobbles and loads of remixed electronic house music. Together, let's Drink all the booze and Hack all the things! Let's Rock <3

https://www.facebook.com/photo?fbid=1277406085958716&set=a.116333305399339 https://www.youtube.com/c/DJSt3rling
https://www.facebook.com/OfficialDjSt3rling https://www.instagram.com/theycallmest3r https://soundcloud.com/theycallmest3r
https://www.twitch.tv/theycallmest3r


Description:No Description available

Return to Index    -    Add to    -    ics Calendar file

 

MUS - Friday - 22:00-22:59 PDT


Title: Music - FuzzyNop
When: Friday, Aug 6, 22:00 - 22:59 PDT
Where: Bally's Silver Ballroom

SpeakerBio:FuzzyNop
FuzzyNop is a computer, raised by computers that told him to computer, now he knows how to computer.

https://www.youtube.com/watch?v=dqtTPco4_v8 https://drive.google.com/drive/folders/1DJDbugX8FfhyeZ8AZhemEYrb86qbmGJ2?usp=sharing https://twitter.com/fuzzynop
https://www.vjdj.io


Description:No Description available

Return to Index    -    Add to    -    ics Calendar file

 

MUS - Friday - 23:00-23:59 PDT


Title: Music - n0x08
When: Friday, Aug 6, 23:00 - 23:59 PDT
Where: Bally's Silver Ballroom

SpeakerBio:n0x08
n0x08 has been obliterating eardrums with filthy drum&bass since he first played the Seattle club scene in the early 2000's. A staunch advocate against laptop DJ's and for getting TF off his lawn, the pandemic finally made him break down & switch to digital. He rides to Valhalla, shiny & chrome!

https://media.wired.com/photos/5f726156dc40abe2b60138b1/master/w_1600%2Cc_limit/backchannel_cti_seattle.jpg https://twitter.com/n0x08
https://soundcloud.com/n0x08


Description:No Description available

Return to Index    -    Add to    -    ics Calendar file

 

MUS - Friday - 22:00-22:59 PDT


Title: Music - Terrestrial Access Network
When: Friday, Aug 6, 22:00 - 22:59 PDT
Where: Bally's Pool

SpeakerBio:Terrestrial Access Network
If packets were to dance, they would surely dance to this.

https://soundcloud.com/collinsulliva...mix-07-06-2019 https://www.mediafire.com/view/g31mc...PRESS.png/file https://soundcloud.com/collinsullivan
https://www.instagram.com/terrestrialaccessnetwork/


Description:No Description available

Return to Index    -    Add to    -    ics Calendar file

 

MUS - Friday - 21:00-21:59 PDT


Title: Music - Thaad
When: Friday, Aug 6, 21:00 - 21:59 PDT
Where: Bally's Silver Ballroom

SpeakerBio:Thaad
Lead DJ and Promoter at Malevolent-Las Vegas. Founder of Anti-Klub.
Power Noise Movement Original.
Klub Terminal Resident DJ.

https://facebook.com/djTotalHarmonDistortion https://www.twitch.tv/djthaad
https://www.mixcloud.com/DJ_ThAAd
https://soundcloud.com/d-j-th-d


Description:No Description available

Return to Index    -    Add to    -    ics Calendar file

 

MUS - Friday - 21:00-21:59 PDT


Title: Music - Yesterday & Tomorrow
When: Friday, Aug 6, 21:00 - 21:59 PDT
Where: Bally's Pool

SpeakerBio:Yesterday & Tomorrow
Yesterday & Tomorrow believes in DJing as an art form, seeking to establish a deep connection with listeners through rhythm and sound.

Influenced heavily by legendary DJs such as John Digweed and Hernan Cattaneo, his musical selections showcase the latest in underground dance music from all corners of the globe, from Argentina to Berlin and beyond.

Y&T has performed at various DEF CON venues and events for several years running and showcases the latest releases weekly on select streaming platforms.

https://www.mixcloud.com/yesterdayan...-showcase-mix/ https://imgur.com/sHtxfyv
Mixcloud: https://www.mixcloud.com/yesterdayandtomorrow Twitch: https://twitch.tv/yesterdayandtomorrow Additional: https://linktr.ee/yesterdayandtomorrow


Description:No Description available

Return to Index    -    Add to    -    ics Calendar file

 

MUS - Friday - 23:00-23:59 PDT


Title: Music - Z3NPI
When: Friday, Aug 6, 23:00 - 23:59 PDT
Where: Bally's Pool

SpeakerBio:Z3NPI
Z3Npi is the culmination of over 2 decades of writing, recording, and performing electronic music from many genres. Originally known as dj:devoid, Chris Schmidt has spent over half his life creating music and is bringing to bear the experience he’s gained to a new project. With Z3Npi, the concept is clear:

“Music is the glue that holds us togethers, it can heal our hearts and minds in ways that nothing else can”.

Collaboration is an important aspect of the Z3Npi sound, so you can expect a wide variety of featured artists in his catalog. More than anything music is best when it’s combined with performances that accentuate the sounds – Z3Npi delivers not just a unique recorded sound but performances that take the music to the next level.

https://www.youtube.com/watch?v=NeDqEGUrRcg https://i0.wp.com/z3npi.com/wp-conte...74961283_n.jpg https://i0.wp.com/z3npi.com/wp-conte...1/02/image.png https://i2.wp.com/z3npi.com/wp-conte.../12/Church.jpg


Description:No Description available

Return to Index    -    Add to    -    ics Calendar file

 

CPV - Friday - 10:00-10:59 PDT


Title: New Face, Who Dis? Protecting Privacy in an Era of Surveillance
When: Friday, Aug 6, 10:00 - 10:59 PDT
Where: Crypto & Privacy Village (Virtual)

SpeakerBio:Mike Kiser
Mike Kiser is insecure. He has been this way since birth, despite holding a panoply of industry positions over the past 20 years—from the Office of the CTO to Security Strategist to Security Analyst to Security Architect—that might imply otherwise. In spite of this, he has designed, directed, and advised on large-scale security deployments for a global clientele. He is currently in a long-term relationship with fine haberdashery, is a chronic chronoptimist (look it up), and delights in needlessly convoluted verbiage. He speaks regularly at events such as the European Identity Conference and the RSA Conference, is a member of several standards groups, and has presented identity-related research at Black Hat and Def Con. He is currently a Senior Identity Strategist for SailPoint Technologies.

Description:
While it has its potential benefits, facial recognition is eroding privacy and other human rights. Over the past year, several organizations have acknowledged that they have “scraped” social media and similar sites for photos to build their biometric databases, and photos intended for personal use only have now been potentially weaponized.

Industry and government have ethical responsibilities to prevent this, but what if there were a way to enhance privacy for individuals without waiting for the cavalry? Adversarial technology can provide a way to protect this biometric, but it must be as easy to use as picking up their mobile device and taking a photo.

We’ll cover the last year in adversarial research, examining the pros and cons of each and working towards the introduction of a new open-source mobile app, “Ruse," that seeks to use adversarial strategies to make personal photos less useful for commercial facial recognition systems while retaining a (relatively) low impact on human usefulness.


Crypto & Privacy Village will be streaming their events to YouTube and Twitch.

Twitch: https://www.twitch.tv/cryptovillage

YouTube: https://www.youtube.com/c/CryptoVillage


Return to Index    -    Add to    -    ics Calendar file

 

BHV - Friday - 16:00-16:59 PDT


Title: No Aggregation Without Representation
When: Friday, Aug 6, 16:00 - 16:59 PDT
Where: Biohacking Village (Talk - Virtual)

SpeakerBio:Andrea Downing , Light Collective, Co-Founder
Andrea Downing is a BRCA Community Data Organizer and an ePatient security researcher. In 2018, Andrea discovered a security vulnerability (SICGRL) which affected the privacy and safety of all closed groups on Facebook and launched a congressional inquiry.
Twitter: @BraveBosom

Description:
As we emerge from a pandemic and a year where we all became at risk of developing COVID, many of us have become patients and caregivers navigating a healthcare system under siege. With the rise in ransomware attacks on hospitals, disinformation campaigns from state actors on social media, and new biosecurity threats there has never been a greater need to develop capacity for a new kind of immune response to emerging threats in digital health. Representation matters. During this talk, BRCA mutant turned Security Researcher share how patient communities - namely "the ePatient movement" - holds potential to bring a new type of representation to the field of cybersecurity. ePatients with disabilities have superpowers to co-design and co-production of new technologies with fresh eyes - and to help us protect the emerging technologies that have the power to cure or kill.

All Biohacking Village talks will be streamed to YouTube.

YouTube: https://www.youtube.com/channel/UCm1Kas76P64rs2s1LUA6s2Q


Return to Index    -    Add to    -    ics Calendar file

 

DL - Friday - 14:00-15:50 PDT


Title: Open Bridge
When: Friday, Aug 6, 14:00 - 15:50 PDT
Where: Palace 1+2

SpeakerBio:Constantine Macris
No BIO available

Description:
Tool or Project Name: Open Bridge Simulator

Short Abstract:
Open Bridge Simulator provides a platform to explore the NMEA 2000 protocol, maritime electronics and CAN interfaces in a cost effective (under $50) software/hardware suite.

Short Developer Bio:
Constantine is an instructor at the US Coast Guard Academy where he teaches Cyber Systems. On the side he breaks things...

URL to any additional information: https://github.com/thedini/openBridge

Detailed Explanation of Tool:
Over the years I have built various tools that pull data from and put data on the NMEA 2000 maritime electronics bus. From talking boats (Twitter @CES_bigAl) to a network of connected recreational vessels. It was always a struggle because of the somewhat obscure nature of the application (boats/yachts/ships) and the difficulty and cost in obtaining hardware and tools to learn about the systems. Open Bridge Simulator is an open source project (software and eventually hardware) that aims to make this process more cost effective and obtainable to individuals without $10,000 laying around to purchase expensive maritime electronics.

The demo lab will involve:
Reviewing the NMEA 2000 protocol
Seeing the simulator and estimated cost of the system produced by the US Coast Guard Academy Capstone team ( an example of an expensive solution) Reviewing the architecture of a standard NMEA 2000 network (with live devices) The traditional means of interacting with the NEMA 2000 network An introduction and demo of the Open Bridge Simulator software and hardware I also intend to cover some of the challenges we faced in developing this project as well as ways we can work together to make learning about NMEA 2000 more inclusive.

The general project will be using off the shelf hardware (Teensy 4.1, WCMCU-230 Can Transceiver) to interface with Docker containers that simulate different marine electronics so a user with less than $50 in hardware can simulate an entire bridge system on almost any computer. The project is designed to be a framework to allow individuals to share the devices they build and create a library of bridge systems that can be connected to simulate industry accurate systems.

This project can stand alone or interface with an existing system and can act as an educational tool, defense and simulation tool or prove out attacks.

The overall goal of Open Bridge Simulator is to make playing with NMEA 2000 easier!

Target Audience: Hardware, Education, Defense

The purpose of this project is to make learning and playing with NMEA2000 more reasonable and affordable for beginners and those without access to expensive hardware (like GPS head units). I think that reducing the cost and barrier to entry will bring more people into the space and shine a light onto a somewhat obscure and difficult area to get started.


Return to Index    -    Add to    -    ics Calendar file

 

BHV - Friday - 14:30-14:59 PDT


Title: Open-Source Vaccine Developer Kits (VDKs) with RaDVaC
When: Friday, Aug 6, 14:30 - 14:59 PDT
Where: Biohacking Village (Talk - Virtual)

SpeakerBio:Alex Hoekstra
No BIO available

Description:
Vaccine development has traditionally been an expensive and thus primarily proprietary endeavor. Tools to decrease costs, increase adaptability, speed of production, speed of testing, and expand access to could help increase participation, collaboration, innovation, infectious disease biosecurity, and equity in vaccine development and ultimately vaccine deployment globally. Open-Source VDKs could fill a vital and underserved niche in the ecosystem or vaccine development.

RaDVaC is building tools to increase participation in vaccine development. Key features of a useful vaccine developer kit (VDK) include technical specs for vaccine candidate design, production, testing, adaptation, and collaboration. The ecosystem of vaccine development is weaker for a lack of open-source toolkits (open-source infrastructure is an investment in anti-fragility).


All Biohacking Village talks will be streamed to YouTube.

YouTube: https://www.youtube.com/channel/UCm1Kas76P64rs2s1LUA6s2Q


Return to Index    -    Add to    -    ics Calendar file

 

CON - Friday - 10:00-17:30 PDT


Title: OpenSOC Blue Team CTF
When: Friday, Aug 6, 10:00 - 17:30 PDT
Where: See Description

Description:
For more information, see https://forum.defcon.org/node/238017

Return to Index    -    Add to    -    ics Calendar file

 

RCV - Friday - 12:15-12:59 PDT


Title: OSINT and the Hermit Kingdom. Leveraging online sources to learn more about the worlds most secret nation
When: Friday, Aug 6, 12:15 - 12:59 PDT
Where: Recon Village (Virtual)

SpeakerBio:Nick Roy
Nick Roy (Twitter: @superducktoes) currently works for a global security vendor creating training content and researching new attacker patterns and techniques. Previously he worked at an automation platform startup teaching people about the joys and benefits of automation. While not working he lives in Boston with his wife and two cats hunting out the best dive bars in Boston and solving math problems on college chalkboards overnight.
Twitter: @superducktoes

Description:No Description available

Recon Village talks will stream to YouTube.

YouTube: https://www.youtube.com/c/ReconVillage


Return to Index    -    Add to    -    ics Calendar file

 

AVV - Friday - 20:00-20:59 PDT


Title: Panel discussion: Adversary simulation, emulation or purple teaming - How would you define it?
When: Friday, Aug 6, 20:00 - 20:59 PDT
Where: Adversary Village (Virtual)
Speakers:Tomer Bar,Samuel Kimmons,Anant Shrivastava,Vincent Yiu,Martin Ingesen,Joe Vest

SpeakerBio:Tomer Bar
Tomer Bar is hands-on security researcher and head of research manager with ~20 years of unique experience in the cyber security. In the Past, he ran research groups for the Israeli government and then lead the endpoint malware research for Palo Alto Networks. Currently, he leads the SafeBreach Labs research which is the research and development arm of SafeBreach.

His main interest is focused on Windows vulnerability research, reverse engineering and APT research.

His recent discoveries are vulnerabilities in the Windows Spooler mechansim and a research on the most persistent Iranian APT campaign. He is a contributor to Mitre Attack framework and a Speaker at BlackHat, Defcon and Sector conferences.


SpeakerBio:Samuel Kimmons
Samuel Kimmons is Red Teamer at Cognizant. He is responsible for researching, planning, and developing full scope Red Team engagements. Samuel got is start in Information Security during his time in the United States Air Force (USAF). While in the USAF he stood up the first interal red team at the United States Air Force Computer Emergency Response Team (AFCERT). His team's primary purpose was to emulate threat actors in order to increase the accuracy of detection capabilities.
https://www.linkedin.com/in/kimmons

SpeakerBio:Anant Shrivastava
No BIO available

SpeakerBio:Vincent Yiu
No BIO available

SpeakerBio:Martin Ingesen
No BIO available

SpeakerBio:Joe Vest
No BIO available

Description:No Description available

Adversary Village talks and workshops will be streamed on YouTube and Twitch.

Q&A sessions will happen in DEF CON Official Discord server after each talk.


YouTube: https://www.youtube.com/channel/UCOhn9WALnpb5YAbW18R1Hzg

Twitch: https://twitch.tv/adversaryvillage

Discord: https://discord.gg/defcon


Return to Index    -    Add to    -    ics Calendar file

 

IOTV - Friday - 10:00-18:30 PDT


Title: Pentesting 101
When: Friday, Aug 6, 10:00 - 18:30 PDT
Where: IoT Village (Onsite)

Description:
For more information, see https://www.iotvillage.org/defcon.html

Return to Index    -    Add to    -    ics Calendar file

 

RCV - Friday - 16:15-16:45 PDT


Title: People Hunting: A Pentesters Perspective
When: Friday, Aug 6, 16:15 - 16:45 PDT
Where: Recon Village (Virtual)

SpeakerBio:Mishaal Khan
No BIO available
Twitter: @mish3alkhan

Description:No Description available

Recon Village talks will stream to YouTube.

YouTube: https://www.youtube.com/c/ReconVillage


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 17:00-17:45 PDT


Title: Phantom Attack: Evading System Call Monitoring
When: Friday, Aug 6, 17:00 - 17:45 PDT
Where: Track 2 Live; DCTV/Twitch #2 Pre-Recorded
Speakers:Junyuan Zeng,Rex Guo

SpeakerBio:Junyuan Zeng
Junyuan Zeng is Senior Software Engineer at Linkedin. Before Linkedin, he was Staff Security Architect at JD.com where he designed and architected container security monitoring solutions. Before that he was Staff Software Engineer for mobile payment security at Samsung and a security researcher at FireEye where he worked on mobile malware analysis. He has published in ACM CCS, USENIX ATC, and other top academic conferences. He obtained his PhD in Computer Science from The University of Texas at Dallas.
https://www.linkedin.com/in/junyuanzeng/

SpeakerBio:Rex Guo
Rex Guo works as Head of Research at Confluera where he leads the security research and development of the cloud XDR product which includes the real-time threat storyboarding capabilities (a.k.a. attack narrative). Before joining Confluera, he was an engineering manager at Cisco Tetration where his team bootstrapped the server EDR product deployed on millions of cloud endpoints. Before that, Rex worked at both Intel Security and Qualcomm. In these positions, he has worked on application security, infrastructure security, malware analysis, and mobile/ IoT platform security. He has presented at Blackhat multiple times. He has 30+ patents and publications. He received a PhD from New York University.
Twitter: @Xiaofei_REX
https://www.linkedin.com/in/xiaofeiguo/

Description:
Phantom attack is a collection of attacks that evade Linux system call monitoring. A user mode program does not need any special privileges or capabilities to reliably evade system call monitoring using Phantom attack by exploiting insecure tracing implementations.

After adversaries gain an initial foothold on a Linux system, they typically perform post-exploitation activities such as reconnaissance, execution, privilege escalation, persistence, etc. It is extremely difficult if not impossible to perform any non-trivial adversarial activities without using Linux system calls.

Security monitoring solutions on Linux endpoints typically offer system call monitoring to effectively detect attacks. Modern solutions often use either ebpf-based programs or kernel modules to monitor system calls through tracepoint and/or kprobe. Any adversary operations including abnormal and/or suspicious system calls reveal additional information to the defenders and can trigger detection alerts.

We will explain the generic nature of the vulnerabilities exploited by Phantom attack. We will demonstrate Phantom attack on two popular open source Linux system call monitoring solutions Falco (Sysdig) and Tracee (Aquasecurity). We will also explain the differences between Phantom v1 and v2 attacks. Finally, we will discuss mitigations for Phantom attack and secure tracing in the broader context beyond system call tracing.

REFERENCES
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33505 https://i.blackhat.com/USA-20/Thursday/us-20-Lee-Exploiting-Kernel-Races-Through-Taming-Thread-Interleaving.pdf https://www.youtube.com/watch?v=MIJL5wLUtKE https://dl.packetstormsecurity.net/1005-advisories/khobe-earthquake.pdf

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=yaAdM8pWKG8

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Rex%20Guo%20Junyuan%20Zeng%20-%20Phantom%20Attack%20-%20Evading%20System%20Call%20Monitoring.mp4


This talk will be given live in Track 2.

This talk has also been pre-recorded and will be broadcast on DCTV2, both in local hotels and on Twitch.


DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_two


Return to Index    -    Add to    -    ics Calendar file

 

CPV - Friday - 16:30-17:30 PDT


Title: Piecing Together Your Personal Privacy Profile
When: Friday, Aug 6, 16:30 - 17:30 PDT
Where: Crypto & Privacy Village (Virtual)

SpeakerBio:Margaret Fero
Margaret leads security at a small startup, and loves information security, learning and education, and interdisciplinary connections. Before transitioning to a career in security, Margaret was a Technical Writer and independent security researcher. Margaret has spoken at conferences including ToorCon, Write The Docs Day: Australia, the O'Reilly Open Source Convention (OSCON), and Abstractions II.

Description:
In finance, analysts combine seemingly-insignificant information to constitute useful information that a company didn’t intend to reveal. This is called mosaic theory. This talk applies the concepts of mosaic theory to a personal privacy audit.

Many details, like those you might post to social media or include on a public resume, can be combined to deduce significant aspects of your private data. Small divergences from your usual patterns can, when combined together, also reveal information that you may not intend to disclose. Often, this information includes your physical location, vacation dates, or current employer.

After this talk, you should be able to apply the concepts of mosaic theory to evaluate the data that is publicly available about you, including combinations of small details that you may have considered insignificant on their own.


Crypto & Privacy Village will be streaming their events to YouTube and Twitch.

Twitch: https://www.twitch.tv/cryptovillage

YouTube: https://www.youtube.com/c/CryptoVillage


Return to Index    -    Add to    -    ics Calendar file

 

CPV - Friday - 14:00-14:45 PDT


Title: Playing God: How ambiguities in state and federal breach notification laws give lawyers too much discretion in deciding whether or not to disclose potential data breaches
When: Friday, Aug 6, 14:00 - 14:45 PDT
Where: Crypto & Privacy Village (Virtual)
Speakers:Anthony Hendricks,Jordan Sessler

SpeakerBio:Anthony Hendricks
Anthony Hendricks is an attorney who advises clients as the chair of Crowe & Dunlevy’s Cybersecurity & Data Privacy Practice Group. In that role, he frequently analyzes and litigates legal issues related to IoT devices. Prior to beginning his practice, he studied as Howard University's first Marshall Scholar and later graduated from Harvard Law School. He now teaches cybersecurity law as an adjunct professor at Oklahoma City University School of Law.

SpeakerBio:Jordan Sessler
Jordan Sessler is an attorney who advises clients on data security as a member of Crowe & Dunlevy’s Cybersecurity & Data Privacy Practice Group. In that role, he regularly engages with legal issues related to IoT devices and has represented companies in disputes with law enforcement regarding the discoverability of user- and device-generated data. Prior to beginning his practice, he graduated from Harvard Law School and clerked for U.S. District Court Judge D.P. Marshall Jr.

Description:
There is often ambiguity as to whether a security incident qualifies as a data breach and, thus, needs to be reported to authorities or disclosed to affected individuals. This means that, despite efforts to pass breach notification laws in all fifty states, there is little consistency in what actually gets reported and disclosed. Some companies disclose data breaches where there is no evidence of data access, while others decline to do so even when there is a substantial possibility of access. Under current law, both courses of action are generally acceptable given latent ambiguity in what triggers a “reasonable belief” that data has been accessed or acquired by an unauthorized party. However, this legal grey area often leaves individual lawyers to make a massive ethical decision: does our client need to tell you that your data may have been stolen, even when the law does not necessarily require that they do so?

Crypto & Privacy Village will be streaming their events to YouTube and Twitch.

Twitch: https://www.twitch.tv/cryptovillage

YouTube: https://www.youtube.com/c/CryptoVillage


Return to Index    -    Add to    -    ics Calendar file

 

APV - Friday - 14:00-14:30 PDT


Title: Poking bots for fun and profit in the age of asynchronous stuff
When: Friday, Aug 6, 14:00 - 14:30 PDT
Where: AppSec Village (Virtual)

SpeakerBio:Emanuel Rodrigues
No BIO available

Description:
What Slack, Telegram, Discord, and a ton of other messaging platforms have in common ? Messaging of course ! : ) ... but also Bots/apps which are used to enrich the experience of messaging and collaboration environments. Bots are extremely popular now and are very easy to create. The App markets are full of Bots/Apps both free and paid. Let's take a look at these technologies, how it works and how to approach them from a security testing perspective.

AppSec Village events will be streamed to YouTube.

YouTube: https://www.youtube.com/c/appsecvillage


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 14:30-15:30 PDT


Title: Policy Debrief - Global Cyber Capacity Building - triple challenge or triple opportunity?
When: Friday, Aug 6, 14:30 - 15:30 PDT
Where: Policy (Onsite - SkyView 5/6)

Description:
One thing government worldwide agree upon is that raising defenses helps us all, but also that poorer countries need a lot of help to do so. In recent years the term “cyber capacity building” (CCB) has been used to describe large-scale development assistance programs that help build CERTs, train infosec professionals, but also educate on global cybersecurity issues. Often hackers from DEF CON can find themselves offered lucrative engagements in e.g. the Balkans or Sub-Saharan Africa towards this end. But are programs really global, or more a new type of big power competition? How much can they really deliver both for those societies, but also the rest of the world? And what is the best way to get involved?

Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 13:00-13:59 PDT


Title: Policy Debrief - Myths and Legends of Section 230
When: Friday, Aug 6, 13:00 - 13:59 PDT
Where: See Description

Description:
LOCATION TBD

It seems like everyone's talking about Section 230 these days, and keen to change it, without really knowing what it says and does. Don't let this happen to you! Come to this crash course in Section 230 given by Cathy Gellis, a lawyer who regularly litigates (and pontificates) about the statute to learn the truth about this crucial law that enables our online world. We'll talk about why we have Section 230, what it does, why it works, its relationship with the First Amendment, and some of the common misperceptions about it, including why getting rid of it might not make the Internet any better (and will probably make it worse).


Return to Index    -    Add to    -    ics Calendar file

 

BCV - Friday - 12:00-12:30 PDT


Title: Polyswarm Talk
When: Friday, Aug 6, 12:00 - 12:30 PDT
Where: Blockchain Village / Paris Vendome B

SpeakerBio:Kevin Leffew
No BIO available

Description:No Description available

This content will be presented live and in-person.

Return to Index    -    Add to    -    ics Calendar file

 

CCV - Friday - 12:30-12:59 PDT


Title: Privacy on Public Blockchains with SGX
When: Friday, Aug 6, 12:30 - 12:59 PDT
Where: Cryptocurrency Village (Onsite - Paris Champagne Ballroom 1)

SpeakerBio:Secret Network Team
No BIO available

Description:
Bringing privacy to smart contracts by leveraging intel SGX to compute over data without node operators seeing the underlying information.

The Cryptocurrency Village is built around conversations and events, not formal talks. Stop by any time to speak with knowledgeable individuals! This village focuses on the security and privacy side of cryptocurrencies, not the investment side.

The Cryptocurrency Village is conveniently located in Paris Champagne Ballroom 1.


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 15:00-15:59 PDT


Title: ProxyLogon is Just the Tip of the Iceberg, A New Attack Surface on Microsoft Exchange Server!
When: Friday, Aug 6, 15:00 - 15:59 PDT
Where: DCTV/Twitch #3 Pre-Recorded

SpeakerBio:Orange Tsai
Cheng-Da Tsai, aka Orange Tsai, is the principal security researcher of DEVCORE, CHROOT security group member, and captain of HITCON CTF team in Taiwan. He is the Pwn2Own 2021 "Master of Pwn" champion and also as the speaker in conferences such as Black Hat USA/ASIA, DEF CON, HITCON, HITB GSEC/AMS, CODE BLUE, and WooYun!

Orange participates in numerous CTF and won second place in DEF CON CTF 22/25/27 as team HITCON. Currently, Orange is a 0day researcher focusing on web/application security, his research is not only the Pwnie Awards 2019 winner for “Best Server-Side Bug” but also the first place in "Top 10 Web Hacking Techniques" of 2017/2018. Orange also enjoys bug bounties in his free time. He is enthusiastic about the RCE bugs and uncovered RCEs in numerous vendors such as Twitter, Facebook, Uber, Apple, GitHub, Amazon, and so on.

Twitter: @orange_8361
https://blog.orange.tw/

Description:
Microsoft Exchange Server is an email solution widely deployed within government and enterprises, and it is an integral part of both their daily operations and security. Needless to say, vulnerabilities in Exchange have long been the Holy Grail for attackers, hence our security research on Exchange. Surprisingly, we’ve found not only critical vulnerabilities such as ProxyLogon, but a whole new attack surface of Exchange.

This new attack surface is based on a significant change in Exchange Server 2013, where the fundamental protocol handler, Client Access Service (CAS), splits into frontend and backend. In this fundamental change of architecture, quite an amount of design debt was incurred, and, even worse, it introduced inconsistencies between contexts, leading us to discover this new attack surface.

To unveil the beauty of this attack surface and our novel exploitation, we’ll start by analyzing this architecture, followed by 7 vulnerabilities that consist of server-side bugs, client-side bugs, and crypto bugs found via this attack surface. In the end, these vulnerabilities are chained into 3 attack vectors that shine in different attack scenarios: ProxyLogon, ProxyShell, and ProxyOracle. These attack vectors enable any unauthenticated attacker to uncover plaintext passwords and even execute arbitrary code on Microsoft Exchange Servers through port 443, which is exposed to the Internet by ~400K Exchange Servers.

This attack surface has its unparalleled impact for a reason: security researchers tend to find vulnerabilities from a certain perspective, such as digging for memory bugs, injections, or logic flaws, but we took a different approach by looking at Exchange from a high-level architectural view and captured this architecture-level attack surface, which yielded multiple vulnerabilities. We hope this brings a new paradigm to vulnerability research and inspires more security researchers to look into Exchange Server. Last but not least, we’ll provide hardening actions to mitigate such types of 0days in Exchange.

# REFERENCES:

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=5mqid-7zp8k

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Orange%20Tsai%20-%20ProxyLogon%20is%20Just%20the%20Tip%20of%20the%20Iceberg%2C%20A%20New%20Attack%20Surface%20on%20Microsoft%20Exchange%20Server.mp4


This talk has been pre-recorded and will be released to the DEF CON Media Server, torrents, and YouTube. At the time of this event, it will also stream on DCTV3, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_three


Return to Index    -    Add to    -    ics Calendar file

 

SOC - Friday - 16:00-17:59 PDT


Title: QueerCon Party
When: Friday, Aug 6, 16:00 - 17:59 PDT
Where: Bally's Pool

Description:
Come hang out with the queer hacker community

Return to Index    -    Add to    -    ics Calendar file

 

PYV - Friday - 11:00-11:59 PDT


Title: Racing cryptoexchanges or how I manipulated the balances
When: Friday, Aug 6, 11:00 - 11:59 PDT
Where: Payment Village (Virtual)

SpeakerBio:Vahagan Vardanyan
No BIO available

Description:
A talk on race condition vulnerabilities detected on large cryptocurrency exchanges and made it possible to manipulate the balance.

Payment Village events will stream to Twitch and YouTube.

--

Twitch: https://www.twitch.tv/paymentvillage

YouTube: https://www.youtube.com/c/PaymentVillage


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 13:00-13:59 PDT


Title: Ransomeware’s Big Year – from nuisance to “scourge”?
When: Friday, Aug 6, 13:00 - 13:59 PDT
Where: Track 1 Live; DCTV/Twitch #1 Live

SpeakerBio:DEF CON Policy Panel
No BIO available

Description:No Description available

This talk will be given live in Track 1, and will be streamed to DCTV1, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_one


Return to Index    -    Add to    -    ics Calendar file

 

CHV - Friday - 10:00-10:59 PDT


Title: Ready, fire aim: Hacking State and Federal Law Enforcement Vehicles
When: Friday, Aug 6, 10:00 - 10:59 PDT
Where: Car Hacking Village - Talks (Virtual)

SpeakerBio:Alissa Knight , Content Creator | Hacker
Alissa Knight is a recovering hacker of 20 years, blending hacking with a unique style of written and visual content creation for challenger brands and market leaders in cybersecurity. Alissa is a cybersecurity influencer, content creator, and community manager as a partner at Knight Ink (http://www.knightinkmedia.com/) that provides vendors go-to market and content strategy for telling brand stories at scale in cybersecurity. Alissa is also the principal analyst in cybersecurity at Alissa Knight & Associates.

Alissa is a published author through her publisher at Wiley, having published the first book on hacking connected cars (https://www.amazon.com/Hacking-Connected-Cars-Techniques-Procedures/dp/1119491800/ref=sr_1_1?crid=X8OQ88MUEP4T&dchild=1&keywords=hacking+connected+cars&qid=1592558581&sprefix=hacking+connected+cars%2Caps%2C300&sr=8-1) and recently received two new book contracts to publish her autobiography and a new book on hacking APIs.

As a serial entrepreneur, Alissa has started and sold two cybersecurity companies to public companies in international markets and also sits as the group CEO of Brier & Thorn, a managed security service provider (MSSP).

https://www.alissaknight.com/

https://www.alissaknight.com/

Description:
This talk will stream on YouTube.

YouTube: https://www.youtube.com/watch?v=X0ZNEyzloY8


Return to Index    -    Add to    -    ics Calendar file

 

RCV - Friday - 10:00-10:45 PDT


Title: Recon Village Keynote
When: Friday, Aug 6, 10:00 - 10:45 PDT
Where: Recon Village (Virtual)

SpeakerBio:Ben S
No BIO available
Twitter: @nahamsec

Description:No Description available

Recon Village talks will stream to YouTube.

YouTube: https://www.youtube.com/c/ReconVillage


Return to Index    -    Add to    -    ics Calendar file

 

CON - Friday - 10:00-17:59 PDT


Title: Red Alert ICS CTF
When: Friday, Aug 6, 10:00 - 17:59 PDT
Where: See Description

Description:
For more information, see https://forum.defcon.org/node/236432

Return to Index    -    Add to    -    ics Calendar file

 

CON - Friday - 10:00-16:59 PDT


Title: Red Team Village CTF - Qualifiers Part 1
When: Friday, Aug 6, 10:00 - 16:59 PDT
Where: See Description

Description:
For more information, see https://forum.defcon.org/node/236421

Return to Index    -    Add to    -    ics Calendar file

 

CHV - Friday - 15:00-15:59 PDT


Title: Remote Adversarial Phantom Attacks against Tesla and Mobileye
When: Friday, Aug 6, 15:00 - 15:59 PDT
Where: Car Hacking Village - Talks (Virtual)

SpeakerBio:Ben Nassi
Ben Nassi (Twitter: @ben_nassi) is a security researcher. He specializes in security of autonomous vehicles and IoT devices.
Twitter: @ben_nassi

Description:
In this talk, we present "split-second phantom attacks," a scientific gap that causes two commercial advanced driver-assistance systems (ADASs), Telsa Model X (HW 2.5 and HW 3) and Mobileye 630, to treat a depthless object that appears for a few milliseconds as a real obstacle/object.

We discuss the challenge that split-second phantom attacks create for ADASs. We demonstrate how attackers can apply split-second phantom attacks remotely by embedding phantom road signs into an advertisement presented on a digital billboard which causes Tesla’s autopilot to suddenly stop the car in the middle of a road and Mobileye 630 to issue false notifications. We also demonstrate how attackers can use a projector in order to cause Tesla’s autopilot to apply the brakes in response to a phantom of a pedestrian that was projected on the road and Mobileye 630 to issue false notifications in response to a projected road sign. This talk will stream on YouTube.


YouTube: https://www.youtube.com/watch?v=6aYPhi16FjA


Return to Index    -    Add to    -    ics Calendar file

 

HRV - Friday - 16:00-17:59 PDT


Title: Remote Ham Radio Exams
When: Friday, Aug 6, 16:00 - 17:59 PDT
Where: Ham Radio Village (Virtual Exams)

Description:
For those participating in DEF CON remotely, the HRV is offering remote ham radio exams as well as in-person exams! Register, as well as study for the exam online though ham.study. Registration can be completed at https://ham.study/sessions/610602949f7bd0fb99cbdf95/1

Return to Index    -    Add to    -    ics Calendar file

 

CHV - Friday - 11:00-11:59 PDT


Title: Remotely Rooting Charging Station for fun and maybe profit
When: Friday, Aug 6, 11:00 - 11:59 PDT
Where: Car Hacking Village - Talks (Virtual)
Speakers:Huajiang "Kevin2600" Chen,Wu Ming

SpeakerBio:Huajiang "Kevin2600" Chen
Huajiang "Kevin2600" Chen (Twitter: @kevin2600) is a senior security researcher. He mainly focuses on vulnerability research in wireless and embedded systems. Kevin2600 has spoken at various conferences including KCON; DEFCON and CANSECWEST.
Twitter: @kevin2600

SpeakerBio:Wu Ming
Wu Ming (Twitter: @rapiddns) is a senior security engineer. He specializes in Web Security and a Bug Bounty Hunter.
Twitter: @rapiddns

Description:
In recent years the emergence of a new security threat to the electric vehicle charging ecosystem. How safely and easily charge electric vehicles, is deeply impacting the way people travel. Therefore we conducted an in-depth security analysis for the EV charging stations from Schneider Electric.

In this talk, we'll present 3 vulnerabilities (CVE-2021-22706; CVE-2021-22707, and CVE-2021-22708) which we found in Schneider Electric's EVLink Charging System. We'll start by explaining the architecture; components, and protocols involved in such a system. Then we'll walk through step by step how do we found an RCE Vulnerability from it.

We will be diving into the journey of reverse engineering EVLink Charging station. Start from firmware acquisition, and the various challenges of exploiting EVLink. We'll explain the details of how do we overcome these limits, and show how our payloads manipulate the system in order to get a reverse shell with Root privilege. Finally, we'll present a video demo of exploiting the vulnerability.

This talk will stream on YouTube.


YouTube: https://www.youtube.com/watch?v=PW60NXN0qZE


Return to Index    -    Add to    -    ics Calendar file

 

IOTV - Friday - 10:45-11:30 PDT


Title: Representation Matters
When: Friday, Aug 6, 10:45 - 11:30 PDT
Where: IoT Village (Talk - Virtual)
Speakers:Camille Eddy,Chloe Messdaghi

SpeakerBio:Camille Eddy
No BIO available

SpeakerBio:Chloe Messdaghi
Chloé Messdaghi is a tech changemaker who is innovating tech and information security sectors to meet today’s and future’s demands by accelerating startups and providing solutions that empower. She is an international keynote speaker at major information security and tech conferences and events, and serves as a trusted source to reporters and editors, such as Forbes and Business Insider. Additionally, she is one of the Business Insider’s 50 Power Players. Camille Eddy is a Product Engineer and International Public Speaker. She earned her Bachelor of Science degree in Mechanical Engineering from the University of Idaho. Camille has given her talk “Recognizing Cultural Bias in AI” across the world, including San Francisco, Washington DC and Budapest; Helping Technical and Non-Technical Project Managers, Founders and Engineering Leads build better products. Finally, she coaches women building online platforms, helping them make a profitable business working on their passion.

Description:
We often hear about the importance of Diversity, Equity, and Inclusion (DEI) and how companies are striving to do better. However, there are plenty of examples where DEI that is being promoted is not actually happening behind scenes. Stories of those who are marginalized in tech showcasing we still have a large problem with companies practicing lip service and no actual actions to show for it. One way to see if a company is trying to be better on DEI is reflected on the board and C-suite. Yet, still to this day less than 20% of company boards represent marginalized identities. It's time to increase representation of marginalized identities from less than 20% to 50%+ for all levels in tech. When we shift to incorporating DEI practices by making sure representation is present on the leadership team, board and c-suite, it recognizes the voices of marginalized identities: ethnicities, genders, generations, sexuality, and abilities. Research has repeatedly shown that when we have diverse boards and c-level positions held by marginalized persons, it produces a trickle down effect. Where the company takes actions and voices are finally heard because there’s representation, and it's reflected in the vision, company policies, and hiring practices. This talk discusses why we need representation on the leadership team, and how to get involved to actually bring a change to an industry that has run out of time to become more inclusive.

IoT Village talks will be streamed to Twitch. Select speakers may be available in the IoT Village on-site to answer questions.

Twitch: https://www.twitch.tv/iotvillage


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 18:00-18:45 PDT


Title: Response Smuggling: Pwning HTTP/1.1 Connections
When: Friday, Aug 6, 18:00 - 18:45 PDT
Where: Track 2 Live; DCTV/Twitch #2 Pre-Recorded

SpeakerBio:Martin Doyhenard
Martin is a security researcher at the Onapsis Research Labs. His work includes performing security assessment on SAP and Oracle products and detecting vulnerabilities in ERP systems. His research is focused on Web stack security, reverse engineering and binary analisis, and he is also an active CTF player. Martin has spoken at different conferences including RSA, Troopers, Hack In The Box and EkoParty and presented multiple critical vulnerabilities.
Twitter: @tincho_508

Description:
Over the past few years, we have seen some novel presentations re-introducing the concept of HTTP request smuggling, to reliably exploit complex landscapes and systems. With advanced techniques, researchers were able to bypass restrictions and breach the security of critical web applications.

This presentation will take a new approach, focusing on the response pipeline desynchronization, a rather unexplored attack vector in HTTP Smuggling.

First, I will introduce a Desync variant, using connection-tokens to hide arbitrary headers from the backend. This technique does not abuse discrepancy between HTTP parsers, but instead relies on a vulnerability in the protocol itself!

The issue was found and reported under Google’s Vulnerability Reward Program for a nice bounty!

Next, I will show how it is possible to inject multiple messages at the backend server, mixing the pipeline’s connection order, and hijack users sessions from login requests.

Finally, using a novel technique known as Response Scripting, I will demonstrate how to create malicious outbound messages using static responses as the building blocks. This will be leveraged to write custom responses and take control of one of the most popular protocols in history!

REFERENCES
RFC 2616: Hypertext Transfer Protocol -- HTTP/1.1 https://tools.ietf.org/html/rfc2616

RFC 7231: Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content https://tools.ietf.org/html/rfc7231

CHAIM LINHART, AMIT KLEIN, RONEN HELED, STEVE ORRIN: HTTP Request Smuggling
https://www.cgisecurity.com/lib/HTTP-Request-Smuggling.pdf

James Kettle:
HTTP Desync Attacks: Request Smuggling Reborn https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn https://portswigger.net/research/http-desync-attacks-what-happened-next

Emile Fugulin
HTTP Desync Attacks with Python and AWS https://medium.com/@emilefugulin/http-desync-attacks-with-python-and-aws-1ba07d2c860f

Amit Klein
HTTP Request Smuggling in 2020
https://i.blackhat.com/USA-20/Wednesday/us-20-Klein-HTTP-Request-Smuggling-In-2020-New-Variants-New-Defenses-And-New-Challenges.pdf

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=suxDcYViwao

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Martin%20Doyhenard%20-%20Response%20Smuggling-%20Pwning%20HTTP-1.1%20Connections.mp4


This talk will be given live in Track 2.

This talk has also been pre-recorded and will be broadcast on DCTV2, both in local hotels and on Twitch.


DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_two


Return to Index    -    Add to    -    ics Calendar file

 

ASV - Friday - 09:00-09:25 PDT


Title: Retired but not forgotten – A look at IFEs
When: Friday, Aug 6, 09:00 - 09:25 PDT
Where: Aerospace Village (Virtual Talk)
Speakers:Alex Lomas,Phil Eveleigh

SpeakerBio:Alex Lomas
Alex is Pen Test Partner’s aerospace specialist. Alex undertakes penetration testing of traditional IT, such as networks, web applications, and APIs, as well as more aviation-specific areas including airport operational technology and avionics embedded systems such as inflight entertainment and e-enabled aircraft.

SpeakerBio:Phil Eveleigh
Phil has undertaken testing of all kinds of embedded systems with Pen Test Partners’ Hardware Team, from consumer routers through to operational technology and household electronic devices. He has now brought his skills to the aviation sector. This is Phil’s first talk at DEFCON!

Description:
Alex Lomas and Phil Eveleigh from Pen Test Partners reminisce about research on two interesting in flight entertainment systems from the past 12 months, including great interactions with vendors, attempts remembering how to pwn NT4, and a reminder that just because an aircraft is going to scrap, it still means that disclosures have to be handled sensitively.

This talk will be streamed on YouTube: https://www.youtube.com/watch?v=p0A03vVHXnw


Aerospace Village talks will be streamed to YouTube.

YouTube: https://www.youtube.com/c/AerospaceVillage


Return to Index    -    Add to    -    ics Calendar file

 

HHV - Friday - 15:00-15:30 PDT


Title: Robo Sumo On site
When: Friday, Aug 6, 15:00 - 15:30 PDT
Where: Hardware Hacking Village (Onsite - Bally's Bronze 4)

SpeakerBio:ShortTie
No BIO available

Description:
Come out for Robo Sumo meetup at the HHV IRL

Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 14:00-14:59 PDT


Title: Rotten code, aging standards, & pwning IPv4 parsing across nearly every mainstream programming language
When: Friday, Aug 6, 14:00 - 14:59 PDT
Where: DCTV/Twitch #3 Pre-Recorded
Speakers:Kelly Kaoudis,Sick Codes

SpeakerBio:Kelly Kaoudis
Kelly Kaoudis is a senior software engineer working in application security in Colorado. Following working with the group to validate and test the node-netmask bypass Viale discovered, Kaoudis wrote many of the proofs-of-concept which demonstrate the critical impact of this cascade of unique vulnerabilities.
Twitter: @kaoudis
https://github.com/kaoudis

SpeakerBio:Sick Codes
Sick Codes maintains popular open source projects, publishes high-profile security vulnerabilities in good faith, and administers his namesake https://sick.codes, a security research and tutorial resource for developers. Sick Codes' work coordinating communication across many companies, foundations, and other open source organisations was invaluable in getting these vulnerabilities patched and responsibly disclosed.

Sick Codes: I am a Hacker, an Independent Security Researcher, an Australian, and an Open Source maintainer. I regularly publish nasty vulnerabilities in everyone's favorite products, from all the best vendors. I've published CVEs in Smart TV's, Browsers, missile design software, and entire programming languages. Freelance automation specialist by day and hacker by trade. I publish weaponized code on GitHub, namely Docker-OSX, which was my first big "thing," which now has 15k stars, and my biggest project, Docker-OSX has over 100,000 downloads on DockerHub.

@sickcodes
https://github.com/sickcodes
https://www.linkedin.com/in/sickcodes/
https://sick.codes

Twitter: @sickcodes
https://sick.codes

Description:
Openness to responsibly disclosed external vulnerability research is crucial for modern software maintainers and security teams. Changes in upstream dependency code may have pulled the safety rug out from underneath widely trusted core libraries, leaving millions of services vulnerable to unsophisticated attacks. The impact of even a single reasonably well-distributed supply-chain security vulnerability will be felt by engineering teams across many applications, companies, and industries.

We'd like to discuss an IP address parsing vulnerability first discovered in private-ip, a small and infrequently maintained yet critically important NodeJS package for determining if an IP address should be considered part of a private range or not. We'll talk about not only the implications of this CVE but taking the main idea and applying it across multiple programming languages in uniquely disturbing ways.

Sometimes, the effects of code rot are even more far-reaching than we could possibly expect, and if you pull on a thread, it just keeps going. Sometimes, you get lucky when you know exactly what you're looking for. Sometimes, it's hard to convince other technically-minded folks that a seemingly trivial implementation flaw is dangerous in capable hands.

This talk is beginner as well as advanced-friendly; we'll show you the basics a hacker or a programmer needs to know about IP address parsing and how to tell your octal from your decimal along the way.

REFERENCES

Researchers involved in this work:
- Victor Viale: https://github.com/koroeskohr, koroeskohr - Sick Codes: https://github.com/sickcodes, sickcodes - Kelly Kaoudis: https://github.com/kaoudis, kaoudis - John Jackson: https://www.johnjhacking - Nick Sahler: https://github.com/nicksahler, tensor_bodega - Cheng Xu: https://github.com/xu-cheng

Selected press coverage (as of May '21) - https://www.bleepingcomputer.com/news/security/critical-netmask-networking-bug-impacts-thousands-of-applications/ - https://www.theregister.com/2021/03/29/netmask_cve/ - https://www.bleepingcomputer.com/news/security/python-also-impacted-by-critical-ip-address-validation-vulnerability/

Currently released advisories related to this work (as of May '21) - https://sick.codes/sick-2021-011/
- https://vuln.ryotak.me/advisories/6
- https://sick.codes/sick-2021-018/
- https://sick.codes/sick-2020-022/

Additional
- https://sick.codes/universal-netmask-npm-package-used-by-270000-projects-vulnerable-to-octal-input-data-server-side-request-forgery-remote-file-inclusion-local-file-inclusion-and-more-cve-2021-28918/ - https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/ - https://blog.dave.tf/post/ip-addr-parsing/ - https://security-tracker.debian.org/tracker/CVE-2021-29424 - https://security-tracker.debian.org/tracker/CVE-2021-29662 - https://www.npmjs.com/package/netmask - https://github.com/rs/node-netmask
- https://bugs.python.org/issue36384#msg392423 - https://github.com/rust-lang/rust/pull/83652 - https://github.com/rust-lang/rust/issues/83648

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=_o1RPJAe4kU

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Kelly%20Kaoudis%20Sick%20Codes%20-%20Rotten%20code%2C%20aging%20standards%2C%20%26%20pwning%20IPv4%20parsing%20across%20nearly%20every%20mainstream%20programming%20language.mp4


This talk has been pre-recorded and will be released to the DEF CON Media Server, torrents, and YouTube. At the time of this event, it will also stream on DCTV3, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_three


Return to Index    -    Add to    -    ics Calendar file

 

APV - Friday - 15:00-15:45 PDT


Title: Scaling static analysis for free: add additional codebases with a single line of code and no money
When: Friday, Aug 6, 15:00 - 15:45 PDT
Where: AppSec Village (Virtual)
Speakers:Erin Browning,Tim Faraci 

SpeakerBio:Erin Browning
No BIO available

SpeakerBio:Tim Faraci 
No BIO available

Description:
Scaling static analysis across languages and multiple codebases is a difficult process at best. Here we walk through our setup, which we've architectured to be easy to maintain, provide few false positives, and trivial to add additional codebases. Plus, the primary tool we use is free, as in beer.

AppSec Village events will be streamed to YouTube.

YouTube: https://www.youtube.com/c/appsecvillage


Return to Index    -    Add to    -    ics Calendar file

 

BTV - Friday - 17:30-17:59 PDT


Title: Scope X: Hunt in the Ocean!
When: Friday, Aug 6, 17:30 - 17:59 PDT
Where: Blue Team Village - Main Track (Virtual)

SpeakerBio:Meisam Eslahi
Meisam is a technical cybersecurity practitioner with solid expertise in providing strategies and technical directions, building new service/business lines, diverse teams, and capabilities. He has over 19 years of experience in information technology, with 15 years dedicated to cybersecurity in leadership and technical roles leading, managing, and delivering a wide range of cybersecurity services to multi-national clients - mainly in the banking, financial, healthcare, and telecom sectors.
Twitter: @drmeisam_

Description:
Almost every cybersecurity services begin with defining a scope to be assessed. There is nothing wrong with scoping unless it is all about what we know. Attackers walk into our network from the entry points that we may not even know about them. This is not an "out of the scope" concept as these entry points are entirely unknown; Let's call it "Scope X." One of the mysterious examples of Scope X is subdomains; this presentation will not talk about techniques to enumerate them as uncle Google provides tons of tutorials. Instead, we discuss threat hunting on discovered subdomains.

This talk defines scope x and its importance in threat hunting by using subdomains as a perfect example. Exploring subdomains may help red teamers look for more sensitive information, forgotten vulnerabilities, and obsolete technologies that could provide additional attack surfaces.

On the other hand, the blue teamers should proactively discover the subdomains, identify the different types of risks and address them. Assume we retrieved a large number of subdomains; what would be the next step?

• Data Validation: When we have a bulk number of subdomains in hands, the first step is to determine which one is really UP to reduce false findings.

• Data classification and reduction: We may face tons of subdomains containing sensitive information, precisely like hunting fishes in an ocean! Before we jump into the analysis phase, we could separate and organize collected data into different groups based on desired parameters or filter out unwanted data to narrow down the hunting scope.

• Say cheese and Take a Picture! Without a doubt navigating the subdomains one by one is not an option! One of the common practices is taking the screenshots in bulk, checking and shortlisting them if we found something interesting. But how do that?

• Keyword Style! Each subdomain page source may contain information that helps us to look for a different type of risk. How fast can we search for specific data in a large volume of subdomains? By the way, what to look for?

• Threats lucky draw: There may be different types of technical and business security risks. How to analyze our data, identify risks, and categorize them?


Blue Team Village talks will be streamed to Twitch.

--

Twitch: https://twitch.tv/blueteamvillage


Return to Index    -    Add to    -    ics Calendar file

 

ICSV - Friday - 13:30-13:59 PDT


Title: Scripts and Tools to Help Your ICS InfoSec Journey
When: Friday, Aug 6, 13:30 - 13:59 PDT
Where: ICS Village (Virtual)

SpeakerBio:Don C. Weber , Founder, Cutaway Security
Don C. Weber is a Principal Consultant at and Founder of Cutaway Security, LLC and a Certified SANS Instructor. He specializes in providing information security consulting services to organizations with control environments. In his free time he assists with the ICS Village and provides mentoring and teaching for other information security professionals."
Twitter: @cutaway

Description:
Conducting security assessments and gathering information from control environments are obviously different than doing the same tasks in a corporate environment. But, where do you start? Don will outline some of the tools to conduct research, perform assessments, and gather information. He will review some of the scripts the Cutaway Security team has developed to make this easier for administrators, information security professionals, and operational technology teams teams.

ICS Village will be releasing their events to YouTube at each event's scheduled time. Discussion will be available on Discord in #ics-speaker-questions-and-answers-text.

YouTube: https://www.youtube.com/channel/UCI_GT2-OMrsqqglv0JijHhw

#ics-speaker-questions-and-answers-text: https://discord.com/channels/708208267699945503/735937961908109485


Return to Index    -    Add to    -    ics Calendar file

 

SEV - Friday - 13:30-14:30 PDT


Title: SE Team vs. Red Team
When: Friday, Aug 6, 13:30 - 14:30 PDT
Where: Social Engineer Village (Virtual)

SpeakerBio:Ryan MacDougall
Ryan MacDougall is presently the Chief Operating Officer and Open Source Intelligence trainer for Social-Engineer, LLC. In addition, he runs operations during penetration tests and exercises with clients, as well as managing client relationships. Additionally, Ryan is also a multiyear Black Hat conference trainer and DEFCON SEVillage speaker, regarding social engineering as well as, open source intelligence gathering.

Description:
What is the difference? Is there a difference? Find out by riding along during a real story of a true SE Team.

Social Engineer Village will stream content to Twitch.

Twitch: https://www.twitch.tv/socialengineerllc


Return to Index    -    Add to    -    ics Calendar file

 

SEV - Friday - 10:00-11:59 PDT


Title: SECTF4Kids (Pre-Registration Required)
When: Friday, Aug 6, 10:00 - 11:59 PDT
Where: Social Engineer Village (Virtual)
Speakers:Ryan M,Colin H

SpeakerBio:Ryan M
No BIO available

SpeakerBio:Colin H
No BIO available

Description:
For more information, please see https://www.social-engineer.org/events/sevillage-def-con/the-sectf4kids/

Social Engineer Village will stream content to Twitch.

Twitch: https://www.twitch.tv/socialengineerllc


Return to Index    -    Add to    -    ics Calendar file

 

CON - Friday - 10:00-14:59 PDT


Title: Secure Coding Tournament CTF
When: Friday, Aug 6, 10:00 - 14:59 PDT
Where: See Description

Description:
For more information, see https://forum.defcon.org/node/236774

Return to Index    -    Add to    -    ics Calendar file

 

WS - Friday - 15:00-18:59 PDT


Title: Secure messaging over unsecured transports
When: Friday, Aug 6, 15:00 - 18:59 PDT
Where: Workshops - Las Vegas 1+2 (Onsite Only)

SpeakerBio:Ash , Hacker
Ash is just some dude. In the past he's been a network engineer, created a variety of security tools, and is currently working in R&D and protocol development in spaces adjacent to email security. He has spoken at DEFCON, Black Hat, and Bsides San Diego. He has recently developed a weird fascination with hacking vintage electromechanical tech.

Description:
You need to send a message, avoiding traditional channels like email and SMS, to someone who's on a different network, somewhere else in the world. The tools at your disposal are Python, DNS, and an unauthenticated MQTT broker. This message must be end-to-end encrypted, and the recipient must be able to confirm that it was undeniably you who sent it. Now add another constraint: you can't communicate directly with this other party to perform a public key exchange before signing, encrypting, and transmitting the message. This can be a difficult problem to solve, and many specialized secure messaging apps have sprung up to address the challenge of end-to-end secured messaging. We will build our own. While our application won't be as sophisticated as Signal, you'll leave the workshop with an understanding of how DNS can be used to enable end-to-end authenticated and encrypted communication across nearly any public system that can be made to support the publisher/subscriber communication pattern.

Registration Link: https://www.eventbrite.com/e/secure-messaging-over-unsecured-transports-las-vegas-1-2-tickets-162214713575

Prerequisites
Students should have a good understanding of DNS, Docker, and the Python programming language. An understanding of how to configure DNSSEC with their DNS server/provider of choice is necessary, and a basic understanding of how PKI works (roots of trust and the use of public keys to secure the conveyance of public keys) will be beneficial.

Materials needed:


Return to Index    -    Add to    -    ics Calendar file

 

PHV - Friday - 12:00-12:59 PDT


Title: Seeing Through The Windows: Centralizing Windows Logs For Greater Visibility
When: Friday, Aug 6, 12:00 - 12:59 PDT
Where: Packet Hacking Village - Talks (Virtual)

SpeakerBio:Matthew Gracie , SENIOR ENGINEER AT SECURITY ONION SOLUTIONS
Matthew Gracie (Twitter: @InfosecGoon) has over a decade of experience in information security, working to defend networks in higher education, manufacturing, and financial services. He is currently a Senior Engineer at Security Onion Solutions and the founder of the Infosec 716 monthly meetup. Matt enjoys good beer, mountain bikes, Debian-based Linux distributions, and college hockey.
Twitter: @InfosecGoon

Description:
This talk is a brief summary of how to collect and centralize Windows Event Logs for analysis and free tools that can be used to do so. There is also a demonstration of how to use Elastic Stack to investigate an incident using these collected logs.

All Packet Hacking Village talks will stream on YouTube, Twitch, Facebook, and Periscope.

YouTube: https://youtube.com/wallofsheep

Twitch: https://twitch.tv/wallofsheep

Facebook: https://www.facebook.com/wallofsheep/

Periscope: https://www.periscope.tv/wallofsheep


Return to Index    -    Add to    -    ics Calendar file

 

AIV - Friday - 13:00-13:30 PDT


Title: Shell Language Processing (SLP)
When: Friday, Aug 6, 13:00 - 13:30 PDT
Where: AI Village (Virtual)

SpeakerBio:Dmitrijs Trizna
No BIO available

Description:No Description available

AI Village events will be streamed to Twitch, and later be made available as videos on YouTube.

Speakers will be made available on DEF CON's Discord, in #aiv-general-text.


Twitch: https://www.twitch.tv/aivillage

YouTube: https://www.youtube.com/c/aivillage

#aiv-general-text: https://discord.com/channels/708208267699945503/732733090568339536


Return to Index    -    Add to    -    ics Calendar file

 

DL - Friday - 12:00-13:50 PDT


Title: Siembol
When: Friday, Aug 6, 12:00 - 13:50 PDT
Where: DemoLab Video Channel 2

SpeakerBio:Marian Novotny
Marian Novotny received his PhD in Computer Science from the Faculty of Sciences at Pavol Jozef Safarik University in Kosice, Slovakia. In his PhD thesis he focused on the design and analysis of security protocols. He is currently working as a software engineer at G-Research, where he is responsible for the design, analysis and implementation of security data processing applications used for security monitoring and intrusion detection. In the past he worked as a specialized software engineer at ESET, where he designed and implemented network intrusion detection systems which were integrated into various ESET products.

Description:
Tool or Project Name: Siembol

Short Abstract:
Siembol is Anti-Malware for the Cloud: an open-source real-time SIEM (Security Information & Event Management) tool based on big data technologies.

Short Developer Bio:
Marian Novotny received his PhD in Computer Science from the Faculty of Sciences at Pavol Jozef Safarik University in Kosice, Slovakia. In his PhD thesis he focused on the design and analysis of security protocols. He is currently working as a software engineer at G-Research, where he is responsible for the design, analysis and implementation of security data processing applications used for security monitoring and intrusion detection. In the past he worked as a specialized software engineer at ESET, where he designed and implemented network intrusion detection systems which were integrated into various ESET products.

URL to any additional information:
https://siembol.io

Detailed Explanation of Tool:
Siembol is an in-house developed security data processing application, forming the core of an internal Security Data Platform. Following the experience of using Splunk, and as early adopters of Apache Metron, the team needed a highly efficient, real-time event processing engine with fewer limitations and more enhanced features. With Metron now retired, Siembol hopes to give the community an evolved alternative. Siembol improvements over Metron:
Components for real-time alert escalation: CSIRT teams can easily create a rule-based alert from a single data source, or they can create advanced correlation rules that combine various data sources. Pending: tool for translating a Sigma rule specification into siembol Ability to integrate with other systems using dedicated components and plugin architecture for easy integration with incident response tools Advanced parsing framework for building fault tolerant parsers Enhanced enrichment component allowing for defining rules and joining enrichment tables Configurations and rules are defined by a modern Angular web application, with a git-based approval process Supports OAUTH2/OIDC for authentication and authorization in the siembol UI Easy installation for use with prepared docker images and helm charts Siembol Use Cases:
SIEM log collection using open-source technologies Detection tool for discovery of leaks and attacks on infrastructure

Supporting Files, Code, etc:
https://github.com/G-Research/siembol

Target Audience:
Defense

Siembol is trying to provide SIEM functionality using open-source technologies, and is enthusiastic about building community around the project. We believe that this approach can help build a better open-source anti-malware cloud product.


This content will be presented on a Discord video channel.

#dl-video2-voice: https://discord.com/channels/708208267699945503/734027778646867988


Return to Index    -    Add to    -    ics Calendar file

 

APV - Friday - 13:00-13:45 PDT


Title: Signed, Sealed, Delivered: Abusing Trust in Software Supply Chain Attacks
When: Friday, Aug 6, 13:00 - 13:45 PDT
Where: AppSec Village (Virtual)

SpeakerBio:Cheryl Biswas , Threat Intel Specialist, TD
Cheryl Biswas is a Threat Intelligence Specialist with TD Bank in Toronto, Canada, where she produces and delivers annual cyber threat forecasts, and has experience in security audits and assessments, privacy, disaster recovery and change management. She holds an ITIL certification and a specialized honours degree in Political Science. Cheryl is actively engaged in the security community as a conference speaker and volunteer, mentors those entering the field, and champions women and diversity in cyber security as a founding member of “The Diana Initiative”.
Twitter: @3ncr1pt3d

Description:
Our technology-driven world increasingly relies on software dependencies: third party code, open source libraries and shared repositories. A history of software supply chain attacks shows how easy it is to create confusion and send malicious code undetected through automated channels to trusting recipients. SolarWinds delivered a hard truth to defenders: everyone is vulnerable when trust can be abused. Are we ready for what will be sent down the pipeline next?

AppSec Village events will be streamed to YouTube.

YouTube: https://www.youtube.com/c/appsecvillage


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 13:00-13:45 PDT


Title: Sleight of ARM: Demystifying Intel Houdini
When: Friday, Aug 6, 13:00 - 13:45 PDT
Where: Track 2 Live; DCTV/Twitch #2 Pre-Recorded

SpeakerBio:Brian Hong
Brian Hong is a security consultant at NCC Group, a global information assurance specialist providing organizations with expert security consulting services. He specializes in hardware penetration testing, reverse engineering, and has performed security research related to embedded systems, firmware analysis, web application penetration testing, and Android security and malware analysis. Brian has a B. Eng. in Electrical Engineering and Computer Science from The Cooper Union.

Description:
In the recent years, we have seen some of the major players in the industry switch from x86-based processors to ARM processors. However, you might be surprised to know that Intel has long supported ARM to x86 transition with their binary translator, Houdini, which runs ARM binaries on x86.

In this talk, we will discuss Intel's proprietary Houdini translator, which is primarily used by Android on x86 platforms, such as higher-end Chromebooks and desktop Android emulators. We will start with a high-level discussion of how Houdini works and is loaded into processes. We will then dive into the low-level internals of the Houdini engine and memory model, including several security weaknesses it introduces into processes using it. Lastly, we will discuss methods to escape the Houdini environment, execute arbitrary ARM and x86, and write Houdini-targeted malware that bypasses existing platform analysis.

REFERENCES
* Ye, Roger. Android System Programming: Porting, Customizing, and Debugging Android HAL. Packt Publishing, 2017. * JNI Functions, Oracle, 12 Nov. 2002, https://docs.oracle.com/javase/7/docs/technotes/guides/jni/spec/functions.html * Chromium OS Docs. Linux System Call Table, https://chromium.googlesource.com/chromiumos/docs/+/master/constants/syscalls.md * The Development Environment : Android Developers. Android Developers, https://developer.android.com/topic/arc/development-environment * Nachoparker. Own Your Bits, 14 June 2018, https://ownyourbits.com/2018/06/13/transparently-running-binaries-from-any-architecture-in-linux-with-qemu-and-binfmt_misc/ * Git at Google. Android container in Chrome OS, archived at https://web.archive.org/web/20200128052853/https://chromium.googlesource.com/chromiumos/platform2/+/master/arc/container-bundle/ * Oberheide, J. & Miller, C. 2012, June. Dissecting the Android Bouncer [Presentation] @ SummerCON, Brooklyn, New York

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=9oQ5XjA1aq0

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Brian%20Hong%20-%20Sleight%20of%20ARM%20-%20Demystifying%20Intel%20Houdini.mp4


This talk will be given live in Track 2.

This talk has also been pre-recorded and will be broadcast on DCTV2, both in local hotels and on Twitch.


DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_two


Return to Index    -    Add to    -    ics Calendar file

 

CPV - Friday - 15:00-15:30 PDT


Title: So What? The CFAA after Van Buren
When: Friday, Aug 6, 15:00 - 15:30 PDT
Where: Crypto & Privacy Village (Virtual)

SpeakerBio:Kendra Albert
Kendra Albert is a public interest technology lawyer with a special interest in computer security law and in protecting marginalized speakers and users. They serve as a clinical instructor at the Cyberlaw Clinic at Harvard Law School, where they teach students to practice law by working with pro bono clients. Kendra is also the founder and director of the Initiative for a Representative First Amendment. Before they joined the Clinic, Kendra worked with Marcia Hofmann at Zeitgeist Law. They serve on the board of the ACLU of Massachusetts and the Tor Project, and provide support as a legal advisor for Hacking // Hustling.

Description:
On June 3, 2021, the Supreme Court of the United States decided Van Buren v. United States, its first case that meaningfully took up the scope of the Computer Fraud and Abuse Act, the federal anti-hacking statute. Originally passed in the aftermath of Wargames (no, really), the CFAA's broad language has been used to criminalize all kinds of activities that might not be traditionally considered hacking, from employees accessing databases for non-job purposes to companies that aimed to aggregate social network data. Post Van Buren, it's clear that the Computer Fraud and Abuse Act is narrower - but what is covered and what isn't is still up in the air. This talk will provide a brief overview of the CFAA, particularly focused on computer security work and research, and then discuss what the consequences of Van Buren might be, including competing theories about the infamous (for lawyers at least) footnote that suggests that non-technical restrictions on access may create CFAA liability.

Crypto & Privacy Village will be streaming their events to YouTube and Twitch.

Twitch: https://www.twitch.tv/cryptovillage

YouTube: https://www.youtube.com/c/CryptoVillage


Return to Index    -    Add to    -    ics Calendar file

 

RCV - Friday - 11:35-12:05 PDT


Title: So You Want to OPSEC, Eh?
When: Friday, Aug 6, 11:35 - 12:05 PDT
Where: Recon Village (Virtual)

SpeakerBio:Ritu Gill
No BIO available
Twitter: @OSINTtechniques

Description:No Description available

Recon Village talks will stream to YouTube.

YouTube: https://www.youtube.com/c/ReconVillage


Return to Index    -    Add to    -    ics Calendar file

 

DL - Friday - 12:00-13:50 PDT


Title: Solitude
When: Friday, Aug 6, 12:00 - 13:50 PDT
Where: DemoLab Video Channel 1

SpeakerBio:Dan Hastings
Dan Hastings is a senior security consultant at NCC Group. He spends his time performing mobile and web application penetration tests for fortune 500 companies. Dan has spoken at the Defcon Crypto and Privacy village on his research on discrepancies in iOS Robocall blocking apps privacy policies and their actual data collection practices.

Description:
Tool or Project Name: Solitude: A privacy analysis tool

Short Abstract:
Solitude is an open-source privacy analysis tool that aims to help people inspect where their private data goes once it leaves their favorite mobile or web applications. Whether a curious novice or a more advanced researcher, Solitude makes the process of evaluating an app’s privacy accessible for everyone without the need for time-consuming app instrumentation and analysis, which we’ve abstracted away from the user.

Privacy policies are often difficult to understand when trying to identify how your private data is being shared and with whom it's being shared. My previous research1 has even shown that privacy policies don't always tell the truth of what an app’s actual data collection practices actually are. What’s more, prior to Solitude, tooling to find this out efficiently didn’t exist for security researchers, let alone nontechnical users. Solitude was built to help give users more transparency to understand where their private data goes by the process of proxying HTTP traffic and inspecting HTTP traffic more straightforward, and can be configured to look for arbitrary datatypes captured by a mobile or web application. In its early release, this tool has already been used by journalists to help investigate privacy abuses by mobile app vendors.

Short Developer Bio:
Dan Hastings is a senior security consultant at NCC Group. He spends his time performing mobile and web application penetration tests for fortune 500 companies. Dan has spoken at the Defcon Crypto and Privacy village on his research on discrepancies in iOS Robocall blocking apps privacy policies and their actual data collection practices.

URL to any additional information:
https://github.com/nccgroup/Solitude

Detailed Explanation of Tool:
Solitude can be run in two different ways; either as a stand-alone web application/HTTP intercept proxy, or in a more mobile-friendly docker container that runs an Open VPN server along with the Solitude web application and intercepting HTTP proxy.

Users of Solitude can configure what data they want Solitude to search for in the Solitude web application. Solitude automatically searches through all websockets and HTTP requests using yara rules based upon what users have configured to search for. Solitude recursively decodes base64 and URL encoded data, searches for sha1,sha256 and md5 hashes of all configured data and supports protobuf and gzip. Several built-in searches are pre-configured to search for GPS coordinates and internal IP addresses. Once a configured piece of data is found the data and domain that the data is being sent to is displayed in the Solitude web application.

Supporting Files, Code, etc:
https://github.com/nccgroup/Solitude

Target Audience:
Mobile, Offense, Privacy enthusiasts.

Solitude makes the process of gaining transparency into where your private data goes when you use your favorite apps easier than reading and trusting a privacy policy. App users deserve more insight the data collection practices of the apps they use. Solitude is unique in that it aims to make an otherwise technical process easy and empower people to make informed decisions about the applications they choose to use.


This content will be presented on a Discord video channel.

#dl-video1-voice: https://discord.com/channels/708208267699945503/734027693250576505


Return to Index    -    Add to    -    ics Calendar file

 

HRV - Friday - 12:30-13:30 PDT


Title: Spectrum Coordination for Amateur Radio
When: Friday, Aug 6, 12:30 - 13:30 PDT
Where: Ham Radio Village (Virtual Talks)

SpeakerBio:Bryan Fields
Bryan Fields, W9CR, is one of the founding members of the Florida Amateur Spectrum Management Association ("FASMA") and operates a number of wide coverage repeaters in the Tampa Bay region. Bryan holds several FCC licenses, he was first licensed in 1995 at age 10, and holds a GROL+RADAR license as well. He's served as a technical committee member to ARDC, the holder of 44/8 ("AMPRNET"), and is a founding member of AllStarLink. Professionally Bryan has worked in the carrier networking space, focusing on IP/MPLS networks and wireless communications. Currently he is a senior consulting engineer with a major router vendor.

Description:
In this presentation we'll cover the basis for coordination of repeater and other other stations in the amateur radio service. The theory will focus on the practices used in Florida, but generally are applicable to other coordination bodies.

All Ham Radio Village talks will be streamed to Twitch, with discussion in Discord.

For more information, see https://hamvillage.org/dc29.html


Twitch: https://www.twitch.tv/hamradiovillage

#hrv-presentation-text: https://discord.com/channels/708208267699945503/736674835413073991


Return to Index    -    Add to    -    ics Calendar file

 

CCV - Friday - 16:00-16:30 PDT


Title: State of Cryptocurrency Ransomware AMA
When: Friday, Aug 6, 16:00 - 16:30 PDT
Where: Cryptocurrency Village (Onsite - Paris Champagne Ballroom 1)

SpeakerBio:Guillermo Christensen
No BIO available

Description:
Guillermo will give an overview of the state of cryptocurrencies and ransomware, focusing on what he hears in the national security/law Enforcment sector plus incident response and then work on what options are there for addressing the proliferation of ransomware tied to cryptocurrencies but avoiding some of the global solutions like banning.

The Cryptocurrency Village is built around conversations and events, not formal talks. Stop by any time to speak with knowledgeable individuals! This village focuses on the security and privacy side of cryptocurrencies, not the investment side.

The Cryptocurrency Village is conveniently located in Paris Champagne Ballroom 1.


Return to Index    -    Add to    -    ics Calendar file

 

ASV - Friday - 11:30-11:55 PDT


Title: Steal This Drone: High-Assurance Cyber Military Systems
When: Friday, Aug 6, 11:30 - 11:55 PDT
Where: Aerospace Village (Virtual Talk)

SpeakerBio:Darren Cofer
Darren Cofer is a Fellow at Collins Aerospace. He earned his PhD in Electrical and Computer Engineering from The University of Texas at Austin. He has worked in the aerospace industry for 26 years, applying formal methods for verification and certification of high-integrity systems.

Description:
As part of DARPA’s High Assurance Cyber Military Systems program, Collins Aerospace led a team of researchers developing new tools for building aircraft software that is provably secure against many classes of cyber attack. We developed system architecture models, software components, and operating system software which have been mathematically analyzed to ensure key security properties. This talk describes the research results and demonstration in-flight on a military helicopter.

This talk will be streamed on YouTube: https://www.youtube.com/watch?v=gjYNu-2IEnc


Aerospace Village talks will be streamed to YouTube.

YouTube: https://www.youtube.com/c/AerospaceVillage


Return to Index    -    Add to    -    ics Calendar file

 

APV - Friday - 10:00-10:45 PDT


Title: Summer of Fuzz: MacOS
When: Friday, Aug 6, 10:00 - 10:45 PDT
Where: AppSec Village (Virtual)

SpeakerBio:Jeremy Brown
Jeremy is a security professional largely focused on offensive and application security along with vulnerability research and automation. He has gained extensive software security experience working at software and service companies, large and small, for over a decade as well as publishing research in the security community. He has taken the opportunity to gain expertise in many different areas including bug hunting, app/prod/infra security, fuzzing, as well as breaking cloud and web services and enjoys all things interesting in the realm of computer security.

Description:
Thinking of fuzzing applications on OS X can quickly lead to a passing conversation of "ooh exotic Mac stuff", "lets fuzz the kernel" or it can otherwise not be thought of as an exciting target, at least for looking for crashes in stuff other than Safari or the iPhone. While there are some intricacies and nuance involved, workaround for security protections to enable debugging and finding tools that work and work well, this research will detail how it can be done in a reliable way and make the topic more tangible and easier to digest, kind of like how people think about using AFL on Linux: it "just works". We'll explore some of the overlooked attack surfaces of file parsers and some network services on Mac, how to fuzz userland binaries and introduce a new fuzzer that makes setup and crash triage straightforward while poking at some Apple core apps and clients. Have you ever thought "This thing has got to have some bugs" but think twice because it's only available on Mac and not worth the effort? If so, you may now find yourself both more motivated and better equipped to do some bug hunting on the sleek and eventually accommodating Mac OS.

AppSec Village events will be streamed to YouTube.

YouTube: https://www.youtube.com/c/appsecvillage


Return to Index    -    Add to    -    ics Calendar file

 

BCV - Friday - 16:00-16:30 PDT


Title: Surviving 51% Attacks on Blockchains
When: Friday, Aug 6, 16:00 - 16:30 PDT
Where: Blockchain Village / Paris Vendome B

SpeakerBio:Yaz Khoury , Developer Realtions Engineer at Celo
Yaz Khoury is currently a developer relations engineer at Celo, mobile-first smart contract blockchain. Previously he was the Director of Developer Relations at Ethereum Classic. He has worked on many new toolings to help the blockchain ecosystem in infrastructure and security, including building Ethercluster, an open-source alternative to Infura with infra-as-code design specifications for cloud blockchain deployments. He has also built ForkWatch, a simple anomaly detection tool for NiceHash rentable-mining market to track if it's being used for 51% attacks. He has done lots of volunteer work in the blockchain space as a judge and mentor at hackathons like ETHDenver and ETHBerlin and Celo Camp, a speaker at Consensus and TABConf and EDCON. He also has done Ethereum webinars and education for Hyperledger Foundation and was the co-chair of the Testnet Working Group of the Enterprise Ethereum Alliance. His favorite industry topics are on-chain attacks and Miner-Extractable Value (MEV).

Description:
The talk highlights the speakers experience managing four 51% attacks on the Ethereum Classic network and how the attacks were each different and unfolded. Yaz goes over each event and how it impacted the network, how to minimize such events, and he goes over ways to monitor and respond to such attacks using existing and new tools in the space.

This content will be presented live and in-person.

Return to Index    -    Add to    -    ics Calendar file

 

BICV - Friday - 12:30-12:30 PDT


Title: The Action Plan for Cyber Diversity!
When: Friday, Aug 6, 12:30 - 12:30 PDT
Where: Blacks in Cyber

SpeakerBio:Keith Chapman
Keith Chapman is an information security professional, cyber education chair and conference presenter. His background includes incident response, threat intelligence and governance, risk and compliance. He also invests in the information security community by attending and speaking at and conferences. Keith serves as the Cincinnati, OH ambassador for Blacks in Cyber. He is committed to increasing diversity, equity, and inclusion in our field and mentors students in the Ohio Public School System, specifically the Cyber Academy.
Twitter: @S1lv3rL10n

Description:
What does it take to increase diversity, equity, and inclusion in information security? An inside perspective with actionable steps. These actions will build a stronger defense and future for us all.

Blacks in Cyber talks will be streamed on YouTube.

YouTube: https://www.youtube.com/c/BlacksInCybersecurity


Return to Index    -    Add to    -    ics Calendar file

 

ASV - Friday - 09:30-10:20 PDT


Title: The Antenny Board Design and Fabrication Saga: Sweat and Tears Along the Supply Chain
When: Friday, Aug 6, 09:30 - 10:20 PDT
Where: Aerospace Village (Virtual Talk)

SpeakerBio:Ang Cui
Dr. Ang Cui is the Founder and Chief Scientist of Red Balloon Security. Dr. Cui received his PhD from Columbia University in 2015. Ang has focused on developing technologies to defend embedded systems. He has also uncovered vulnerabilities within embedded devices like Cisco routers and HP printers.

Description:
Over the past few months, Red Balloon Security has been developing and manufacturing the Antenny v5 board, and like anyone else who is putting together hardware, we ran headlong into the famous chip shortage. Listen to our story of how we overcame the shortage, found the most treasured of surprises in the most unlikely of places, and distilled all the drama into the little purple boards over in the Aerospace Village area.

This talk will be streamed on YouTube: https://www.youtube.com/watch?v=5trlb5hEXAw


Aerospace Village talks will be streamed to YouTube.

YouTube: https://www.youtube.com/c/AerospaceVillage


Return to Index    -    Add to    -    ics Calendar file

 

BICV - Friday - 14:30-14:30 PDT


Title: The Big Cleanup: Tackling The Remnants of Systematic Discrimination in the Tech Industry
When: Friday, Aug 6, 14:30 - 14:30 PDT
Where: Blacks in Cyber

SpeakerBio:Maurice Turner
Maurice Turner is the Cybersecurity Fellow at the Alliance for Securing Democracy at the German Marshall Fund of the United States. He is a recognized public interest technologist and cybersecurity expert focused on developing strategies to secure critical infrastructure and deter cyber operation escalation. He has also provided testimony before the United States Congress, shared his insights with the European Union, and spoken at numerous security conferences. He most recently served as Senior Advisor to the Executive Director at the United States Election Assistance Commission, where he provided subject matter expertise in support of local, state, and federal partners to administer elections fairly and securely. Prior to that he was Deputy Director of the Internet Architecture project at the Center for Democracy & Technology, where he led the Election Security and Privacy Project, identifying and updating election cybersecurity practices and infrastructure through multi-sector partnerships. He also served as a TechCongress Congressional Innovation Fellow assigned to the U.S. Senate Homeland Security and Governmental Affairs Committee, where he shaped policy and oversaw the preparation of memos, briefings, and hearings on federal Information Technology systems, cybersecurity threats, and cybersecurity regulations. He holds an MA in Public Administration from the University of Southern California, an BA in Political Science from California State University Fullerton, and a Certificate in Cybersecurity Strategy from Georgetown University.
Twitter: @TypeMRT

Description:
It’s easy to just accept the status quo even when it’s harmful because that’s just how it’s always been done. Discrimination in the tech industry is no different. The reuse and amplification of discriminatory language can have damaging effects on those within the industry, as well as in other physical spaces. It adds to the barriers that prevent folks from even trying to participate because they think that they don’t belong. ​
Using technology to challenge how concepts are labeled can help break down those barriers and drive inclusivity. Changing how practitioners label concepts like Whitelist/Blacklist and Master/Slave makes the tech industry more inclusive internally. We can also use technology to uncover remnants of discrimination in the analog world. Thousands of geographic places across the country have official names that are racist like Negro Run and Squaw Creek. They are now easy to find using services like Google Maps. When those names are changed, everyone can see the update immediately. ​
Old baggage has a way of sticking around when new systems are built using legacy data. Regardless of my role in organizations, I look for ways to turn that around and cleanup some of those remnants of systematic discrimination. I will highlight two of those experiences where I have been able to make small changes with big impact by ensuring inclusive language in voting securing standards and changing the racist name of a river using a mapping service. I hope you see that you too can make small changes that make a difference at scale.

Blacks in Cyber talks will be streamed on YouTube.

YouTube: https://www.youtube.com/c/BlacksInCybersecurity


Return to Index    -    Add to    -    ics Calendar file

 

HHV - Friday - 12:00-12:30 PDT


Title: The Black Box and the Brain Box: When Electronics and Deception Collide
When: Friday, Aug 6, 12:00 - 12:30 PDT
Where: Hardware Hacking Village (Virtual Talk)

SpeakerBio:Gigs
Gigs is the founder of ##electronics on Freenode (may it rest in peace), and a long time electronics enthusiast and DEF CON HHV volunteer. He, working with see_ess, did the PCB and hardware design for this year’s TorBadge, a mini-polygraph device.
Twitter: @gigstaggart
gigsatdc.org

Description:
Electricity has, from the earliest history of man, been seen as an almost mystical force. From Thor’s lightning onward, various individuals and groups have used electricity and electrical devices to baffle, mystify, mislead, and control people. In the modern day, this practice continues in the form of polygraph, questionable uses of fMRI and EEG, and other high-tech props intended to dazzle the victim or lend a technological veneer of credibility to the user. This talk will focus on the history and current applications of deception by and with electrical and electronic devices.

#hhv-talk-qa-blackbox-brainbox-text https://discord.com/channels/708208267699945503/709254868329693214

Twitch: https://twitch.tv/dchhv


Hardware Hacking Village talks will be streamed to Twitch.

Twitch: https://www.twitch.tv/dchhv


Return to Index    -    Add to    -    ics Calendar file

 

AIV - Friday - 11:00-11:59 PDT


Title: The Coming AI Hackers
When: Friday, Aug 6, 11:00 - 11:59 PDT
Where: AI Village (Virtual)

SpeakerBio:Bruce Schneier
No BIO available

Description:No Description available

AI Village events will be streamed to Twitch, and later be made available as videos on YouTube.

Speakers will be made available on DEF CON's Discord, in #aiv-general-text.


Twitch: https://www.twitch.tv/aivillage

YouTube: https://www.youtube.com/c/aivillage

#aiv-general-text: https://discord.com/channels/708208267699945503/732733090568339536


Return to Index    -    Add to    -    ics Calendar file

 

BHV - Friday - 11:00-11:45 PDT


Title: The Digital Physiome - How wearables can (and are) transforming healthcare
When: Friday, Aug 6, 11:00 - 11:45 PDT
Where: Biohacking Village (Talk - Virtual)
Speakers:Jennifer Goldsack,Jessilyn Dunn

SpeakerBio:Jennifer Goldsack , CEO at the Digital Medicine Society (DiMe)
No BIO available

SpeakerBio:Jessilyn Dunn , ​Assistant Professor of Biomedical Engineering, Duke University
No BIO available

Description:
Only in the recent past have accurate and scalable methods for biometric monitoring and edge computing become possible, providing a unique opportunity to collect and analyze continuous physiologic measurements and enabling a new mechanistic understanding of acute and chronic diseases. We are focused on using digital health tools such as wearables and smart phones to uncover physiologic signatures of disease, which we refer to as digital biomarkers and that can serve as sentinels of disease onset. Overall, we aim to develop tools and infrastructure using digital health data for disease detection, monitoring, and intervention.

All Biohacking Village talks will be streamed to YouTube.

YouTube: https://www.youtube.com/channel/UCm1Kas76P64rs2s1LUA6s2Q


Return to Index    -    Add to    -    ics Calendar file

 

CLV - Friday - 11:00-11:45 PDT


Title: The Fault in Our Stars - Attack vectors for APIs using AWS API Gateway Lambda Authorizers
When: Friday, Aug 6, 11:00 - 11:45 PDT
Where: Cloud Village (Virtual)
Speakers:Alexandre Sieira,Leonardo Viveiros

SpeakerBio:Alexandre Sieira
Alexandre Sieira is a successful information security entrepreneur with a global footprint since 2003. He began his security career as a Co-Founder and CTO of CIPHER, an international security consulting and MSSP from Brazil acquired in 2018 by Prosegur. In 2015, became Co-Founder and CTO of Niddel, a bootstrapped security analytics SaaS startup running entirely on the cloud, which won a Gartner Cool Vendor award in 2016. After the acquisition of Niddel by Verizon in January 2018, he became the Senior manager and global leader of the Managed Security Services - analytics products management team in the Detect & Respond portfolio tower at Verizon. In late 2019 founded Tenchi Security, a company that focuses on cloud security solutions and services. Experienced speaker featured at Black Hat, DEF CON Cloud Village, BSides San Francisco, FIRST Conference and others.
Twitter: @AlexandreSieira

SpeakerBio:Leonardo Viveiros
A Software Engineer at heart, Leonardo has been working in tech in different roles, from interacting with clients to building robust, scalable solutions. Experienced in building Cloud Native solutions as well as Front-end applications. Led the product roadmap of a smart mobility startup from Rio de Janeiro. Current DevSecOps Specialist at Tenchi Security enabling our clients to achieve a safer software development life cycle.
Twitter: @LeonardoViveiro

Description:
Serverless applications are a really interesting new trend that promises benefits such as increased scalability and reduced cost. Frameworks like Serverless Application Model (SAM) and Serverless Framework are increasingly used to build them. APIs are a natural part of serverless applications, and in AWS that typically is implemented using the AWS API Gateway backed by Lambdas that implement the actual API endpoint logic. Our research focused on API Gateway Lambda Authorizers. This is a feature that allows developers to use a custom authentication and authorization scheme that uses a bearer token authentication strategy (like JWTs, OAuth or SAML), or that uses request parameters to determine the caller's identity and enforce which API endpoints they are allowed to access. We will present (AFAIK novel) techniques to attack the authentication and authorization of APIs that use Lambda Authorizers. We show how IAM policy injection is possible in theory but highly unlikely in practice due to some good decisions by AWS. We also show a class of problems based on incorrect security assumptions baked into AWS' own documentation and Lambda Authorizer open source code templates. Sample source code will be provided to demonstrate all techniques.

Cloud Village activities will be streamed to YouTube.

YouTube: https://www.youtube.com/cloudvillage_dc


Return to Index    -    Add to    -    ics Calendar file

 

WS - Friday - 10:00-13:59 PDT


Title: The Joy of Reverse Engineering: Learning With Ghidra and WinDbg
When: Friday, Aug 6, 10:00 - 13:59 PDT
Where: Workshops - Jubilee 2 (Onsite Only)

SpeakerBio:Wesley McGrew , Senior Cybersecurity Fellow
Dr. Wesley McGrew directs research, development, and offensive cyber operations as Senior Cybersecurity Fellow for MartinFederal. He has presented on topics of penetration testing and and malware analysis at DEF CON and Black Hat USA and taught a self-designed course on reverse engineering to students at Mississippi State University, using real-world, high-profile malware samples. Wesley has a Ph.D. in Computer Science from Mississippi State University for his research in vulnerability analysis of SCADA HMI systems.

Description:
While it can be intimidating to "get into" software reverse engineering (RE), it can be very rewarding. Reverse engineering skills will serve you well in malicious software analysis, vulnerability discovery, exploit development, bypassing host-based protection, and in approaching many other interesting and useful problems in hacking. Being able to study how software works, without source code or documentation, will give you the confidence that there is nothing about a computer system you can't understand, if you simply apply enough time and effort. Beyond all of this: it's fun. Every malicious program becomes a new and interesting puzzle to "solve".

The purpose of this workshop is to introduce software reverse engineering to the attendees, using static and dynamic techniques with the Ghidra disassembler and WinDbg debugger. No prior experience in reverse engineering is necessary. There will be few slides--concepts and techniques will be illustrated within the Ghidra and WinDbg environments, and attendees can follow along with their own laptops and virtual environments. We will cover the following topics:

Software Reverse Engineering concepts and terminology Setting up WinDbg and Ghidra (and building the latter from source) The execution environment (CPU, Virtual Memory, Linking and Loading) C constructs, as seen in disassembled code Combining static and dynamic analysis to understand and document compiled binary code Methodology and approaches for reverse engineering large programs Hands-on malware analysis
How to approach a "new-to-you" architecture

Registration Link: https://www.eventbrite.com/e/the-joy-of-reverse-engineering-learning-with-ghidra-and-windbg-jubilee-2-tickets-162215935229

Prerequisites
No previous reverse engineering experience required. Basic familiarity with programming in a high-level language is necessary (C preferred).

Materials needed:

We will be working with live malware samples. Depending on your comfort level with this, bring a "burner" laptop, use a clean drive, or plan on doing a clean install before and after the workshop.


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 12:30-12:50 PDT


Title: The Mechanics of Compromising Low Entropy RSA Keys
When: Friday, Aug 6, 12:30 - 12:50 PDT
Where: Track 2 Live; DCTV/Twitch #2 Pre-Recorded

SpeakerBio:Austin Allshouse
Austin Allshouse is a Research Scientist at BitSight where he applies information security, statistical modeling, and distributed computing concepts to develop quantitative methods of assessing security risk. He has a decade of experience researching the technologies and methodologies underpinning digital network surveillance systems.
Twitter: @AustinAllshouse

Description:
Over the past decade, there have been a number of research efforts (and DEFCON talks!) investigating the phenomenon of RSA keys on the Internet that share prime factors with other keys. This can occur when devices have poorly initialized sources of “randomness” when generating keys; making it trivial to factor the RSA modulus and recover the private key because, unlike large integer factorization, calculating the greatest common divisor (GCD) of two moduli can be fast and efficient. When describing their research, past hackers and researchers have attested that they “built a custom distributed implementation of Batch-GCD;” which seems like one hell of a detail to gloss over, right? This talk will detail a hacker's journey from understanding and implementing distributed batch GCD to analyzing findings from compromising RSA keys from network devices en masse.
REFERENCES
Amiet, Nils and Romailler, Yolan. “Reaping and breaking keys at scale: when crypto meets big data.” DEF CON 26, 2018.

Heninger, Nadia, et al. "Mining your Ps and Qs: Detection of widespread weak keys in network devices." 21st {USENIX} Security Symposium ({USENIX} Security 12). 2012.

Hastings, Marcella, Joshua Fried, and Nadia Heninger. "Weak keys remain widespread in network devices." Proceedings of the 2016 Internet Measurement Conference. 2016.

Kilgallin, JD. “Securing RSA Keys & Certificates for IoT Devices.” https://info.keyfactor.com/factoring-rsa-keys-in-the-iot-era. 2019

Daniel J. Bernstein. Fast multiplication and its applications, 2008.

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=BRsXsUEIU70

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Austin%20Allshouse%20-%20The%20Mechanics%20of%20Compromising%20Low%20Entropy%20RSA%20Keys.mp4


This talk will be given live in Track 2.

This talk has also been pre-recorded and will be broadcast on DCTV2, both in local hotels and on Twitch.


DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_two


Return to Index    -    Add to    -    ics Calendar file

 

RGV - Friday - 14:00-14:30 PDT


Title: The Neuroscience of Magic (Registration required)
When: Friday, Aug 6, 14:00 - 14:30 PDT
Where: Rogues Village (Virtual)

SpeakerBio:Daniel Roy
Born and raised in San Francisco, Daniel was firmly bitten by the magic bug at the age of 10. Since then, he has appeared at the world-famous Hollywood Magic Castle and the prestigious Chicago Magic Lounge. His audiences have included Fortune 500 Companies, Hollywood actors, and members of the U.S. Congress. In 2019, he became one of the youngest magicians ever to receive the Milbourne Christopher award for Close-Up Magician of the Year.

Description:
Presented via Zoom. Space is limited so please register here:

https://docs.google.com/forms/d/e/1FAIpQLSf06PkmQ1s_pAJ_L971Vm2nPXFtPUr1nut09GFZl3IuWxsfXQ/viewform


Return to Index    -    Add to    -    ics Calendar file

 

BHV - Friday - 12:00-12:59 PDT


Title: The Next Critical Infrastructure: Understanding the Bioeconomy
When: Friday, Aug 6, 12:00 - 12:59 PDT
Where: Biohacking Village (Talk - Virtual)
Speakers:Charles Fracchia,Nathan Case

SpeakerBio:Charles Fracchia , Biomedical researcher for the digital age
No BIO available

SpeakerBio:Nathan Case
No BIO available

Description:
We will use a fictional -but highly realistic- biomanufacturing scenario and company to share with the audience how cybersecurity has become a critical component of biosecurity and public health. We will review the importance of biomanufacturing to the world's public health posture, in particular in light of the COVID19 pandemic and share how vulnerable digital technologies have become exploited vectors for global geopolitical moves.

All Biohacking Village talks will be streamed to YouTube.

YouTube: https://www.youtube.com/channel/UCm1Kas76P64rs2s1LUA6s2Q


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 16:00-16:59 PDT


Title: The Unbelievable Insecurity of the Big Data Stack: An Offensive Approach to Analyzing Huge and Complex Big Data Infrastructures
When: Friday, Aug 6, 16:00 - 16:59 PDT
Where: DCTV/Twitch #3 Pre-Recorded

SpeakerBio:Sheila A. Berta
Sheila A. Berta is an offensive security specialist who started at 12 years-old by learning on her own. At the age of 15, she wrote her first book about Web Hacking, published in several countries. Over the years, Sheila has discovered vulnerabilities in popular web applications and software, as well as given courses at universities and private institutes in Argentina. She specializes in offensive techniques, reverse engineering, and exploit writing and is also a developer in ASM (MCU and MPU x86/x64), C/C++, Python and Go. The last years she focused on Cloud Native and Big Data security. As an international speaker, she has spoken at important security conferences such as Black Hat Briefings, DEF CON, HITB, Ekoparty, IEEE ArgenCon and others. Sheila currently works as Head of Research at Dreamlab Technologies.
Twitter: @UnaPibaGeek

Description:
Honoring the term, the variety of technologies in the Big Data stack is hugely BIG. Many complex components in charge of transport, storing, and processing millions of records make up Big Data infrastructures. The speed at which data needs to be processed and how quickly the implemented technologies need to communicate with each other make security lag behind. Once again, complexity is the worst enemy of security.

Today, when conducting a security assessment on Big Data infrastructures, there is currently no methodology for it and there are hardly any technical resources to analyze the attack vectors. On top of that, many things that are considered vulnerabilities in conventional infrastructures, or even in the Cloud, are not vulnerabilities in this stack. What is a security problem and what is not a security problem in Big Data infrastructures? That is one of the many questions that this research answers. Security professionals need to count on a methodology and acquire the necessary skills to competently analyze the security of such infrastructures.

This talk presents a methodology, and new and impactful attack vectors in the four layers of the Big Data stack: Data Ingestion, Data Storage, Data Processing and Data Access. Some of the techniques that will be exposed are the remote attack of the centralized cluster configuration managed by ZooKeeper; packet crafting for remote communication with the Hadoop RPC/IPC to compromise the HDFS; development of a malicious YARN application to achieve RCE; interfering data ingestion channels as well as abusing the drivers of HDFS-based storage technologies like Hive/HBase, and platforms to query multiple data lakes as Presto. In addition, security recommendations will be provided to prevent the attacks explained.

REFERENCES
I plan to release a white paper at the conference, in the white paper there will be all the references. Anyway, as the attacks are novel, the references are related to infrastructure stuff mostly, not so much about security.

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=vl9hk4fQdos

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Sheila%20A.%20Berta%20-%20The%20Unbelievable%20Insecurity%20of%20the%20Big%20Data%20Stack.mp4


This talk has been pre-recorded and will be released to the DEF CON Media Server, torrents, and YouTube. At the time of this event, it will also stream on DCTV3, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_three


Return to Index    -    Add to    -    ics Calendar file

 

PHV - Friday - 09:00-09:59 PDT


Title: The War for Control of DNS Encryption
When: Friday, Aug 6, 09:00 - 09:59 PDT
Where: Packet Hacking Village - Talks (Virtual)

SpeakerBio:Paul Vixie , CHAIRMAN AND CEO AND COFOUNDER OF FARSIGHT SECURITY, INC
Dr. Paul Vixie (Twitter: @PaulVixie) is an Internet pioneer. Currently, he is the Chairman, Chief Executive Officer and Cofounder of Farsight Security, Inc. He was inducted into the Internet Hall of Fame in 2014 for work related to DNS and DNSSEC. Dr. Vixie is a prolific author of open-source Internet software including BIND, and of many Internet standards documents concerning DNS and DNSSEC. In addition, he founded the first anti-spam company (MAPS, 1996), the first non-profit Internet infrastructure software company (ISC, 1994), and the first neutral and commercial Internet exchange (PAIX, 1991). He earned his Ph.D. from Keio University.
Twitter: @PaulVixie

Description:
Pervasive monitoring of the Internet by both government, corporate, and criminal actors has triggered an encryption wavefront as wide as the Internet itself. DNS, as the map of the Internet's territory, is seen as especially sensitive and there are now several competing encryption standards waiting to be deployed. In this short talk, Dr. Vixie will explain the original problem, describe the protocol-level solutions, and then show how vendors like Google, Mozilla Corporation, Microsoft, and Apple are deploying these technologies across their product lines. Opinions may also be offered.

All Packet Hacking Village talks will stream on YouTube, Twitch, Facebook, and Periscope.

YouTube: https://youtube.com/wallofsheep

Twitch: https://twitch.tv/wallofsheep

Facebook: https://www.facebook.com/wallofsheep/

Periscope: https://www.periscope.tv/wallofsheep


Return to Index    -    Add to    -    ics Calendar file

 

BTV - Friday - 12:00-12:30 PDT


Title: This is what we thought would happen in 2021
When: Friday, Aug 6, 12:00 - 12:30 PDT
Where: Blue Team Village - Main Track (Virtual)

SpeakerBio:Gert-Jan Bruggink
Gert-Jan (GJ) Bruggink is a cyber threat intelligence leader, specialized in understanding adversary tradecraft and thereby helping leaders make more informed decisions. GJ has extensive experience at the crossing of offense, defence & strategic risk management and spend the last 10+ years specializing on providing leaders actionable threat intelligence products and building secure organizations. GJ previously co-founded and delivered defensive services at FalconForce, led the Dutch cyber threat intelligence team at a Big Four accounting firm and delived security services at a security integrator.
Twitter: @gertjanbruggink

Description:
At the beginning of each year, companies share lessons learned and forecasts on what (cyber) threats are expected in the next 12 months. The reality is that a lot of teams and companies publish about this and you probably did not read all these articles or reports.

This talk explores the results of a meta-analysis on threat forecasting, based on open-source reports and articles. As a defender you constantly balance between pushing Jira tickets and looking ahead. By giving you a TLDR, defenders have context into what needs to be prioritised next to the daily operations.

This talk explores the concept of forecasting to help your cyber security program. Following concepts introduced in the book ‘Superforecasting: the art and science of prediction’ (Tetlock, Gardner), the average of multiple forecasts is usually the most accurate.

In preparation to this talk, all publicly available research released in Jan-April 2021 from companies on their expectations for 2021’ threat landscape has been analysed. This exercise resulted into a prioritised list of topics expected for 2021. This list is also actively tracked, to monitor if events already occurred and topics are more/less relevant. By giving you the TLDR, defenders have more context into what needs to be prioritised - next to the daily operations.

As a defender, there is always the constant balance where to focus your precious time. There is great value in looking ahead, yet this is hard when constantly pivoting between Jira tickets. Forecasting is just one way to look ahead and prepare yourself and your teams.

The objective of this talk is to provide defenders access to a larger narrative around cyber threats to support both business and senior stakeholder’s decision making. Providing more situational awareness. As a defender you constantly balance between pushing Jira tickets and looking ahead. This session supports keeping that balance.


Blue Team Village talks will be streamed to Twitch.

--

Twitch: https://twitch.tv/blueteamvillage


Return to Index    -    Add to    -    ics Calendar file

 

CAHV - Friday - 15:00-15:59 PDT


Title: This Job Ad Sucks
When: Friday, Aug 6, 15:00 - 15:59 PDT
Where: Career Hacking Village (Talk)

SpeakerBio:Kirsten Renner
No BIO available

Description:
I'm mostly kidding, but not really. I have taught managers for years how to write better descriptions and candidates how to write better resumes, and I will continue to do that. I even spoke at multiple conferences over the last few years for that purpose. But the key is to have a way of getting around and through bad descriptions (and other road blocks), because I don't think we can ever really fix that problem completely. In other words, even though those obstacles exist and likely always will, there are ways to get through it, and that is what I will be presenting. In the same way that a poorly written resume is not a fair depiction of the potential a candidate has to offer, it just take a bit of coaching and, well, hacking, to get around road blocks in the system to make good matches between the opportunities and talent. This presentation isn’t going to offer a solution to making employers do a better job advertising for and determining the best fits for their openings - there's plenty of content out there for them to do that. It will however tell [the candidates] how to make it through bad descriptions, as well as less than effective interviewers and maybe it will even help them see the light! Looking for a job is an engineering problem. Gather the requirements, do some QA, launch (get out there) and keep updating!

This talk will be available on YouTube: https://www.youtube.com/watch?v=6GvuhfzvQGE


Career Hacking Village content will be available on YouTube.

YouTube: https://youtube.com/careerhackingvillage


Return to Index    -    Add to    -    ics Calendar file

 

ASV - Friday - 12:00-12:25 PDT


Title: Threat Modeling for Space Hitchhikers
When: Friday, Aug 6, 12:00 - 12:25 PDT
Where: Aerospace Village (Virtual Talk)

SpeakerBio:James Pavur
James Pavur is a Rhodes Scholar and DPhil Student at Oxford University where he researches satellite cyber-security in the Department of Computer Science’s System Security Lab.

Description:
When you strap someone else’s satellite to your rocket, how much should you trust them? In this talk, we’ll explore threats relating to launch integration and the role of secondary payloads, such as CubeSats, in modern missions. The briefing combines strategic and policy perspectives with dynamic simulations exploring space-to-space radio attacks from compromise or malicious payloads. While it includes technical components, it assumes no prior experience with radio communications or aerospace.

This talk will be streamed on YouTube: https://www.youtube.com/watch?v=W91uGzCWHXI


Aerospace Village talks will be streamed to YouTube.

YouTube: https://www.youtube.com/c/AerospaceVillage


Return to Index    -    Add to    -    ics Calendar file

 

RGV - Friday - 10:00-10:59 PDT


Title: Top 10 BOGUS Biometrics!
When: Friday, Aug 6, 10:00 - 10:59 PDT
Where: Rogues Village (Virtual)

SpeakerBio:Vic Harkness
Vic is a Security Consultant at F-Secure Consulting who can commonly be found talking about something weird. She has previously spoken at conferences about defeating facial recognition systems, ATM malware, and future attacks on connected/autonomous vehicles. She holds a Bachelor's degree in Robotics & Artificial Intelligence and a Master's degree in Cyber Security, which she believes qualifies her to talk about a range of completely unrelated topics.
Twitter: @VicHarkness
https://vicharkness.co.uk/

Description:
Every now and then, you come across an article. Top 10 WILDEST biometrics! Number 5 will SHOCK YOU. I’ve seen them too. But, these articles never go beyond the surface. They’ll tell you that buttholes are a viable biometric modality, but rarely provide a source to these claims. This talk describes the results of me delving into the dark hole of weird biometrics. Come learn about how legit clickbait modalities actually are, or where the disinformation may have come from. Or maybe you'll learn about the hot new biometrics that you'll be seeing in the future- You'll have to watch to find out!

This talk will go live on Twitch: https://www.twitch.tv/roguesvillage


Return to Index    -    Add to    -    ics Calendar file

 

AIV - Friday - 13:30-14:30 PDT


Title: Trailblazing the AI for Cybersecurity Discipline: Overview of the Field and Promising Future Directions
When: Friday, Aug 6, 13:30 - 14:30 PDT
Where: AI Village (Virtual)

SpeakerBio:Sagar Samtani
No BIO available

Description:No Description available

AI Village events will be streamed to Twitch, and later be made available as videos on YouTube.

Speakers will be made available on DEF CON's Discord, in #aiv-general-text.


Twitch: https://www.twitch.tv/aivillage

YouTube: https://www.youtube.com/c/aivillage

#aiv-general-text: https://discord.com/channels/708208267699945503/732733090568339536


Return to Index    -    Add to    -    ics Calendar file

 

BHV - Friday - 15:00-15:30 PDT


Title: Truth, Trust, and Biodefense
When: Friday, Aug 6, 15:00 - 15:30 PDT
Where: Biohacking Village (Talk - Virtual)

SpeakerBio:Eric Perakslis , Chief Science and Digital Officer, Duke Clinical Research Institute
Eric Perakslis, PhD is the Chief Science and Digital Officer at the Duke Clinical Research Institute. He leads the strategic vision of digital research initiatives and technology affairs of the DCRI, provides oversight for the DCRI’s Technology and Data Solutions, and serves as faculty lead for the DCRI’s Health Services Research group. Dr. Perakslis transitioned to the DCRI from his role as a Rubenstein Fellow at Duke University, where his work focused on collaborative efforts in data science that spanned medicine, policy, engineering, computer science, information technology, and security. Immediately prior to his arrival at Duke, Dr. Perakslis served as Chief Scientific Advisor at Datavant, Lecturer in the Department of Biomedical Informatics at Harvard Medical School, and Strategic Innovation Advisor to Médecins Sans Frontières. Previously, Dr. Perakslis had senior leadership roles, including Senior Vice President and Head of the Takeda R&D Data Science Institute, Chief Information Officer and Chief Scientist (Informatics) at the U.S. Food and Drug Administration, and Senior Vice President of Research & Development Information Technology at Johnson & Johnson Pharmaceuticals. Throughout these roles, Dr. Perakslis created and led major transformations, bringing data, science, and technology together to advance the strategies of each of these organizations.

Description:
We all hope for a truly “post-COVID” world sooner rather than later, but that can only happen if we learn from the past and apply those lessons to our future. Our institutions and our people were unprepared for the harsh realities of the medical, scientific, economic and social demands that an emergency such as the COVID pandemic entails. Our national biodefense program had been steadily diminished while at the same time its focus was increasingly dedicated to human/terrorist threats over two decades. Our decentralized “public health” infrastructure was quickly shown to be simultaneously redundant and ineffective, and our national response was critically hampered by political agendas and rampant propaganda at the greatest scale ever witnessed in US history. Despite the tragic loss of more than 600,000 lives in the United States and millions worldwide, infectious disease experts know that it could have been much worse—and would have been, if the pathogen had been even slightly more deadly than the SARS-CoV-2 virus proved to be. Can we imagine the outcome if the COVID mortality rate was far greater than the 1.8% seen in the United States? What if coronavirus infections carried the same mortality rate as infectious encephalitis (100%), Ebola Zaire (25%-90%), or even smallpox in unvaccinated populations (>65%)? In this talk, we will discuss the history and future of biodefense with a specific focus on data, technology, communications, and the rapidly deteriorating concept of “truth.” Radicalization, misinformation, technology, the surveillance economy, information security, and personal privacy will all be discussed with an eye toward building back better, smarter, and more engaged institutions that are driven by better-prepared humans.

All Biohacking Village talks will be streamed to YouTube.

YouTube: https://www.youtube.com/channel/UCm1Kas76P64rs2s1LUA6s2Q


Return to Index    -    Add to    -    ics Calendar file

 

IOTV - Friday - 10:00-18:30 PDT


Title: UART to UBOOT to ROOT
When: Friday, Aug 6, 10:00 - 18:30 PDT
Where: IoT Village (Onsite)

Description:
For more information, see https://www.iotvillage.org/defcon.html

Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 15:00-15:59 PDT


Title: UFOs: Misinformation, Disinformation, and the Basic Truth
When: Friday, Aug 6, 15:00 - 15:59 PDT
Where: Track 1 CLOSED; DCTV/Twitch #1 Pre-Recorded

SpeakerBio:Richard Thieme AKA neuralcowboy
Richard Thieme, https://thiemeworks.com has addressed security and intelligence issues for 28 years. He has keynoted security conferences in 15 countries and given presentations for the NSA, FBI, Secret Service, Pentagon Security Forum, U.S. Department of the Treasury, and Los Alamos National Laboratory. He has been speaking at Def Con since Def Con 4. His sixth book, a novel, Mobius: A Memoir, about an intelligence professional looking back on his career and how it led down unexpected paths, is receiving rave reviews. He has explored UFO phenomena seriously for 43 years.
Twitter: @neuralcowboy

Description:
The talk, "UFOs and Government: A Historical Inquiry" given at Def Con 21 has been viewed thousands of times. It was a serious well-documented exploration of the UFO subject based on Thieme's participation in research into the subject with colleagues. The book of that name is the gold standard for historical research into the subject and is in 100+ university libraries.

This update was necessitated by recent UFO incidents and the diverse conversations triggered by them. Contextual understanding is needed to evaluate current reports from pilots and naval personnel, statements from senators and Pentagon personnel, and indeed, all the input from journalists who are often unfamiliar with the field and the real history of documented UFOs over the past 70 years.

Thieme was privileged to participate with scholars and lifelong researchers into the massive trove of reports. We estimate that 95% can be explained by mundane phenomena but the remainder suggest prolonged interaction with our planetary society over a long period. Thieme also knows that when you know you don't know something, don't suggest that you do. Stay with the facts, stay with the data. Sensible conclusions, when we do that, are astonishing enough.

Reality, as Philip K. Dick said, will not go away just because we refuse to believe in it.

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=mExktWB0qz4

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Richard%20Thieme%20AKA%20neuralcowboy%20-%20UFOs%20-%20Misinformation%2C%20Disinformation%2C%20and%20the%20Basic%20Truth.mp4


This talk has been pre-recorded and will be released to the DEF CON Media Server, torrents, and YouTube. At the time of this event, it will only be broadcast to DCTV1, in local hotels and on Twitch. This talk is not being presented in Track 1.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_one


Return to Index    -    Add to    -    ics Calendar file

 

ASV - Friday - 13:00-13:50 PDT


Title: Unboxing the Spacecraft Software BlackBox – Hunting for Vulnerabilities
When: Friday, Aug 6, 13:00 - 13:50 PDT
Where: Aerospace Village (Virtual Talk)

SpeakerBio:Brandon Bailey
Brandon Bailey has more than 15 years of experience supporting intelligence and civil space customers. Brandon’s specialties include vulnerability assessments and penetration testing for space systems. Brandon was awarded NASA’s Exceptional Service Medal for his landmark cybersecurity work in 2019.

Description:
As the commercialization of space increases or access to source code is not feasible, it is getting more common that spacecraft/embedded binaries are a black box. There needs to be a way automate code inspection in a cost effective, fast, repeatable manner which can be constantly enhanced to have the latest capability to build secure spacecraft SW. Synthetic vulnerabilities were created and analyzed with varying results.

This talk will be streamed on YouTube: https://www.youtube.com/watch?v=WvKtdXSRvhM


Aerospace Village talks will be streamed to YouTube.

YouTube: https://www.youtube.com/c/AerospaceVillage


Return to Index    -    Add to    -    ics Calendar file

 

BTV - Friday - 15:30-16:30 PDT


Title: Uncovering covert network behaviors within critical infrastructure environments
When: Friday, Aug 6, 15:30 - 16:30 PDT
Where: Blue Team Village - Main Track (Virtual)
Speakers:Michael Raggo,Chester Hosmer

SpeakerBio:Michael Raggo
Michael Raggo has over 20 years of security research experience. His current research focuses on Cloud security. His research has been highlighted on television’s CNN Tech, and numerous media publications including TIME, Forbes, Bloomberg, Dark Reading, TechCrunch, TechTarget, The Register, and countless others. Michael is the author of “Mobile Data Loss: Threats & Countermeasures” and “Data Hiding” for Syngress Books, and is a contributing author for “Information Security the Complete Reference 2nd Edition”. His Data Hiding book is also included at the NSA’s National Cryptologic Museum at Ft. Meade. A former security trainer, Michael has briefed international defense agencies including the FBI and Pentagon; and is a former participating member of the PCI Council. He is also a frequent presenter at security conferences, including Black Hat, DEF CON, RSA, OWASP, HackCon, and SANS. He was also awarded the Pentagon’s Certificate of Appreciation.
Twitter: @datahiding

SpeakerBio:Chester Hosmer
No BIO available

Description:
We’ll explore vulnerabilities we’ve discovered in our IoT, IIoT, and ICS research to reveal the systemic problems that exist as a result of the fragmented supply chain, inconsistent configurations, and overall poor security standards found across the critical networks and devices. We'll then show how we have applied discoveries of these aberrant behaviors to ML algorithms to uncover the risky and potentially very damaging covert channels communicating with the outside world and the types of data being harvested along with the new attack surfaces that they offer.

Through the evolution of IoT, IIoT, and ICS networks we’ve been uncovering new risks and vulnerabilities. Most of these risks and vulnerabilities are so unpredictable when considering the fragmented supply chain of hardware, operating systems, and software; making signature-based and operating system-centric security solutions inadequate.

Leveraging the Active Cyber Defense framework and combining that with our homegrown ML, we’ve created our own approach to detecting aberrant network behavior through passive network monitoring to discover covert communications, rogue devices, emerging threats, and more. The analysis of protocols, device behavior, and network activity within these environments is critical and can aid investigators when responding to incidents that have national impacts. (For example, the recent Colonial Pipeline Ransomware Attack, and the Oldsmar Florida water poisoning attempt).

We’ll explore many vulnerabilities we’ve discovered in our IoT, IIoT, and ICS research to reveal the systemic problems that exist as a result of the fragmented supply chain, inconsistent configurations, and overall poor security standards found across the critical networks and devices. We will build upon our previous real-world examples and current threat research within this presentation and show how we have applied the discoveries of these aberrant behaviors to machine learning algorithms to uncover the risky and potentially very damaging covert channels communicating with the outside world and the types of data that is being harvested along with the new attack surfaces that they offer.

The combined lecture and demonstration will take a deep dive into the early identification of network activities that map to each stage of the cyber kill chain. We’ll also demo our open source and free Modbus TCP pcap analysis tool to identify malicious behaviors within ICS environments.


Blue Team Village talks will be streamed to Twitch.

--

Twitch: https://twitch.tv/blueteamvillage


Return to Index    -    Add to    -    ics Calendar file

 

ASV - Friday - 13:00-15:59 PDT


Title: Understanding Space in the Cyber Domain
When: Friday, Aug 6, 13:00 - 15:59 PDT
Where: Aerospace Village (Virtual Workshop)

Description:
This half-day course examines the practical issues of developing and sustaining a secure cyber environment through all phases of the space mission lifecycle. The course is organized around the SPAce Domain Cybersecurity (SpaDoCs) Framework. The SpaDoCs Framework provides a comprehensive and systematic model for understanding and tackling all critical issues of cybersecurity in the space domain. An examination of the Key objectives— confidentiality, integrity, availability—provides the foundation for the course. From there, the space domain is examined layer by layer starting from the enterprise layer, then drilling down through mission, system and DevSecOps layers. Threats and vulnerabilities at each layer are highlighted. Finally, first principles of cybersecurity are discussed (domain separation, process isolation, etc.) as well as key enablers (vision, strategy, etc.) to help frame plans for action to address the cybersecurity issues exposed by this course. Course exercises center around practical application of the material to real-world space mission scenarios.

Return to Index    -    Add to    -    ics Calendar file

 

HHV - Friday - 11:00-11:59 PDT


Title: Use a PortaProg to flash, dump, and test ISP and UPDI chips
When: Friday, Aug 6, 11:00 - 11:59 PDT
Where: Hardware Hacking Village (Virtual Talk)
Speakers:Bradán Lane,Sara Cladlow

SpeakerBio:Bradán Lane
Bradán Lane is a UX Design and User Researcher who had his own ““Alice’s Adventures in Wonderland”” experience when he discovered badge making. While he has made a number of fun blinky beepy ornaments and badges, his found his passion with the 2020 eChallengeCoin - an interactive and text story challenge puzzle. To help with his development, he created the PortableISP. The 2021 eChallengeCoin required a new chip which precipitated the creation of the PortaProg which serves as both his development tool an his production and test device.

Website: https://aosc.cc
https://gitlab.com/bradanlane
https://aosc.cc/blinks

Twitter: @bradanlane

SpeakerBio:Sara Cladlow
No BIO available

Description:
What is a PortaProg and why would I use it? You can use the PortaProg for flashing firmware to a wide range of Atmel chips using the ISP or UPDI interfaces. It can also read/write FUSES, and access EEPROM. It can flash a chip interactively during development or from its on-board SPIFFS storage at the bench or in the field. The talk will demonstrate it being used for rapid programming of ATTiny badges, performing an update to an ATMega device in the field, and dumping the firmware from an Ardiuno based device without a computer. You will also see how the PortProg has spawned a 3D printed plug-and-play test jig design …. or just attend to see if the demos crash and burn.

#hhv-talk-qa-use-a-portaprog-text https://discord.com/channels/708208267699945503/739571364821729310

Twitch: https://twitch.tv/dchhv


Hardware Hacking Village talks will be streamed to Twitch.

Twitch: https://www.twitch.tv/dchhv


Return to Index    -    Add to    -    ics Calendar file

 

RCV - Friday - 14:40-15:10 PDT


Title: Using OSINT to Aid in Human Trafficking and Smuggling Cases
When: Friday, Aug 6, 14:40 - 15:10 PDT
Where: Recon Village (Virtual)

SpeakerBio:Rae
No BIO available
Twitter: @wondersmith_rae

Description:No Description available

Recon Village talks will stream to YouTube.

YouTube: https://www.youtube.com/c/ReconVillage


Return to Index    -    Add to    -    ics Calendar file

 

RCV - Friday - 10:55-11:25 PDT


Title: Using Passive DNS for gathering Business Intelligence
When: Friday, Aug 6, 10:55 - 11:25 PDT
Where: Recon Village (Virtual)

SpeakerBio:Andy Dennis
No BIO available

Description:No Description available

Recon Village talks will stream to YouTube.

YouTube: https://www.youtube.com/c/ReconVillage


Return to Index    -    Add to    -    ics Calendar file

 

SOC - Friday - 20:00-01:59 PDT


Title: Vampire the Masquerade (Party)
When: Friday, Aug 6, 20:00 - 01:59 PDT
Where: Bally's Skyview 2

Description:
Its... Vampire the masquerade for the Las vegas setting, in las vegas... Because I heard people like Vegas and it might be fun to do.

Return to Index    -    Add to    -    ics Calendar file

 

BTV - Friday - 10:45-11:45 PDT


Title: Velociraptor - Dig Deeper
When: Friday, Aug 6, 10:45 - 11:45 PDT
Where: Blue Team Village - Main Track (Virtual)

SpeakerBio:Mike Cohen
Dr. Mike Cohen has over 20 years of experience in applying and developing novel incident response and digital forensics tools and techniques. He has previously worked in the Australian Department of Defence as an information security specialist, at the Australian Federal Police specialising in digital forensics, network and memory forensics, and spent 8 years in Google developing tools such as GRR and Rekall. In 2018, Mike founded the Velociraptor project, an advanced open source DFIR framework. Mike has recently joined Rapid7 to promote and further develop Velociraptor into a fully featured enterprise DFIR toolkit.
Twitter: @velocidex

Description:
The recent increase in network compromises and sophistication of attackers has underscored the need to rapidly identify and remediate attacks at a large scale across the enterprise. Having the ability to rapidly collect, detect and remediate across a network is a game changer for any Digital Forensics and Incident Response (DFIR) team. It provides unprecedented visibility into the state of the endpoint and the ability to tailor responses as the investigation evolves. Having this capability in an open-source tool that allows for truly surgical collection – at speed, at scale and free – is a triple bonus.

Velociraptor is fast becoming the standard DFIR tool for hunting at scale. Featuring a powerful query language called VQL, allowing for rapidly adapting to fluid DFIR introsions, Velociraptor places unprecedented reach, flexibility and power in the hands of responders.

Unlike more traditional remote forensic tools which collect large amounts of raw data for offline processing, VQL allows defenders to perform analysis directly on the endpoint. This new approach allows defenders to collect only high value, tactical information to affect their response, and leverage current state of the art digital forensic analysis techniques into detection.

This talk will provide some examples of Velociraptor's use in typical DFIR scenarios, such as compromise assessment, wide spread remediation and rapid response. Specifically, we examine the process of going from a detection idea, writing the VQL to detect it and then hunting a large network (10k+ hosts) to identify the compromised hosts in minutes. Finally we illustrate how these custom detections can be elevated to real time monitoring rules (also implemented by VQL) to allow the endpoint to autonomously detect future compromises even while being offline!

Velociraptor is the open source DFIR tool the industry has been crying out for - making large scale DFIR fast, efficient and surgical!

Presentation outline

Problem statement
Have you ever tried to hunt a large network to quickly identify and remediate an ongoing attack on your network? You probably found that traditional DFIR techniques, such as parsing the ntfs filesystem for evidence of deleted files, parsing prefetch files for evidence of past program execution or yara scanning large numbers of files simply do not scale to many thousands of endpoints.

Introducing Velociraptor - deployment architecture and overview This talk introduces the new standard in opensource DFIR investigations - Velociraptor. This tool simplifies and streamlines many of the common tasks in traditional DFIR investigation - dealing efficiently with scale.

Example of simple - pre packaged detections - 1 -2 slides Would you like to hunt executions of lolbins (living off the land binaries) within a certain time window and in short succession? No problem - Velociraptor can query all your endpoints and will answer within minutes.

What makes this work? VQL introduction
Velociraptor is driven by a unique query language called VQL. This language underpins all Velociraptor's features and allows users to customize their investigations by applying VQL to both control Velociraptor and to adapt to detecting new adversary tools and techniques.

The real game changer with Velociraptor is enabling defenders to go from a blog post, or some research about a new vulnerability or attack technique to a high quality detection, and then proceed to hunt across a vast network in minutes.

Case studies walk through (each case about 10 min) This talk will walk though some of these examples (specific examples may change/revise before the talk):

Scan the NTFS USN journal for webshell install activity within the past days Build a dynamic file parser in VQL for a new file format just presented by a blog post (e.g. powershell readline history file https://0xdf.gitlab.io/2018/11/08/powershell-history-file.html or a similar example)

The talk will go through the process of building a query from scratch - reading public information about a detection technique, writing some VQL to identify the IOC on a compromised system, then running a hunt on 10k+ machines to identify the compromised hosts. All this will be done using open source tools and freely available resources!

Post hunt analysis - post processing with VQL We then tour the Velociraptor GUI and see how to quickly examine the compromised endpoints for further triage and remediation. We can interactively collect files, registry keys and raw NTFS artifacts directly through a familiar GUI.

VQL event monitoring - unique on host detection (2-3 slides) Finally we discuss VQL's unique real time monitoring capabilities. Unlike other query languages in endpoint tools, the VQL query does not need to have a finite run time. Instead it is possible to write a query which monitors for new events permanently. These "Event Monitoring Queries" can be used to build real time detections for future events.

This novel approach really changes the current state of the art in detection and response. Currently, EDR tools forward events from the endpoint to a central SIEM with backend automated detections raising escalations for operators to manually go back and try to collect additional information from the endpoint or remediate it. This leads to long OODA loop times and increases the time between compromise and response.

VQL event monitoring queries are powerful queries that bring the response to the end point. Once installed, the query codes a "response plan" whereby the endpoint already knows what to do if a certain condition is met, even if the endpoint is offline! We term this an autonomous response plan.

Follow through to implement the above examples as monitoring queries (2 slides per example) In the talk, we will follow through some of these examples into the next logical step, which is to deploy event monitoring queries on all endpoints to prevent future compromise. That is, we go from a detection query that tells us when run if the EP is compromised to an event query that will automatically respond in the future when the EP becomes compromised with the same vector! This is unprecedented!

Conclusion and call to action
Velociraptor is an open source DFIR tool bursting on the scene in 2019 (we initially presented it at the SANS 2019 DFIR summit) but since then, there have been many features added and the tool is now quickly becoming the standard DFIR tool to use for triage, detection and remediation.


Blue Team Village talks will be streamed to Twitch.

--

Twitch: https://twitch.tv/blueteamvillage


Return to Index    -    Add to    -    ics Calendar file

 

RCV - Friday - 15:20-16:05 PDT


Title: Venator: Hunting & Smashing Trolls on Twitter
When: Friday, Aug 6, 15:20 - 16:05 PDT
Where: Recon Village (Virtual)

SpeakerBio:Mauro Cáseres Rozanowski
Mauro Eldritch is an Argentine Hacker & Speaker, Founder of BCA and DC5411. He was a Speaker at DEF CON (six times!), ROADSEC (LATAM’s biggest security conference), DEVFEST Siberia, DragonJAR Colombia (biggest spanish-speaking conference in LATAM), P0SCON Iran, Texas Cyber Summit and EC-Council Hacker Halted among other conferences (25+).

In the past, he worked for many government organisms such as Ministry of Security, Federal Revenue Administration, Ministry of Health, Ministry of Economy, Ministry of Production and both SecBSD & FreeBSD Projects.

Twitter: @mauroeldritch

Description:No Description available

Recon Village talks will stream to YouTube.

YouTube: https://www.youtube.com/c/ReconVillage


Return to Index    -    Add to    -    ics Calendar file

 

VMV - Friday - 10:00-10:30 PDT


Title: Voting Village Logistical Information Broadcast (Discord, Youtube, Twitch)
When: Friday, Aug 6, 10:00 - 10:30 PDT
Where: Voting Village (Talks - Virtual)

Description:
Information on how to follow the live conversation on our discord channel

Voting Village talks will be streamed to YouTube and Twitch.

Twitch: https://www.twitch.tv/votingvillagedc

YouTube: https://www.youtube.com/channel/UCnDevqsxt3sO8chqS5MGvwg


Return to Index    -    Add to    -    ics Calendar file

 

APV - Friday - 11:00-11:45 PDT


Title: Vulnerability Inheritance - Attacking companies and scoring bounties through 3rd party integrations
When: Friday, Aug 6, 11:00 - 11:45 PDT
Where: AppSec Village (Virtual)

SpeakerBio:Gal Nagli
Gal Nagli is an Application Security researcher at enso.security and a B.Sc computer science student. Most of his time is spent doing Bug bounties on Hackerone, Synack and BugCrowd - where he recently won "Best Collaboration" award during Okta 2021 Bug Bash. He is mainly focused on automation and enjoys the community by publishing writeups on his blogs, helpful tips in twitter and running a Slack community where bounty hunters collab and hang out.

Description:
Time to Sharpen your Bug Bounty Game! In this session the attendees will learn about vulnerabilities around 3rd party integrations, how to improve their reconnaissance flow and how to scan the entire internet for specific vulnerabilities utilizing Nuclei, by observing Proof of Concepts from the presenter journey and practical examples.

AppSec Village events will be streamed to YouTube.

YouTube: https://www.youtube.com/c/appsecvillage


Return to Index    -    Add to    -    ics Calendar file

 

HHV - Friday - 12:30-13:30 PDT


Title: Walkthrough of DC 28 HHV Challenges
When: Friday, Aug 6, 12:30 - 13:30 PDT
Where: Hardware Hacking Village (Virtual Talk)

SpeakerBio:rehr
Rehr is an electrical engineering, and long-time Hardware Hacking Village volunteer. He enjoys teaching and creating challenges that help grow and challenge the hardware hacking community.
Twitter: @mediumrehr

Description:
Last year we (the HHV) released a series of hardware hacking challenges for DEF CON attendees to solve during the conference (and after). Many attempted the challenges, but only a few (3) solved all 5! Join us as we will walk through how to solve all 5 of the DC 28 HHV challenges, and attempt to demystify the world of hardware hacking. We may even drop a hint or two for this years’ challenges.

#hhv-challenge-text https://discord.com/channels/708208267699945503/739567199647301702

Twitch: https://twitch.tv/dchhv


Hardware Hacking Village talks will be streamed to Twitch.

Twitch: https://www.twitch.tv/dchhv


Return to Index    -    Add to    -    ics Calendar file

 

SOC - Friday - 20:00-21:59 PDT


Title: War Story Bunker
When: Friday, Aug 6, 20:00 - 21:59 PDT
Where: Bally's Skyview 3

Description:
One of our favorite parts of DEF CON every year is hearing about what other hackers have been up to with harrowing tales of red team exercises gone wrong, or so very right. We’ve also heard of valiant efforts of defense, from our blue team folks while waiting in Linecon. Do you have a cool “war story” to share? Would you like to listen to some fun stories from your fellow hackers? This is the place to be. Join the DEF CON CFP Review Board, Goons, and fellow hackers as we hunker in the (War Story) bunker.

Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 17:00-17:59 PDT


Title: Warping Reality - creating and countering the next generation of Linux rootkits using eBPF
When: Friday, Aug 6, 17:00 - 17:59 PDT
Where: DCTV/Twitch #3 Pre-Recorded

SpeakerBio:PatH
Pat is a loving partner, a comedian to his daughter, and a dedicated ball retriever to his dog.

When he's not spending time being those things, he's a senior security researcher at a public cybersecurity company. Having previously worked as a low-level software dev, he now helps threat hunters uncover and stop advanced actors across the globe.

Twitter: @pathtofile
https://path.tofile.dev/

Description:
With complete access to a system, Linux kernel rootkits are perfectly placed to hide malicious access and activity. However, running code in the kernel comes with the massive risk that any change to a kernel version or configuration can mean the difference between running successfully and crashing the entire system. This talk will cover how to use extended Berkley Packet Filters (eBPF) to create kernel rootkits that are safe, stable, stealthy, and portable.

eBPF is one of the newest additions to the Linux kernel, designed to easily load safe, constrained, and portable programs into the kernel to observe and make decisions about network traffic, syscalls, and more. But that’s not it’s only use: by creating eBPF programs that target specific processes we can warp reality, presenting a version of a file to one program and a different version to another, all without altering the real file on disk. This enables techniques such as presenting a backdoor user to ssh while hiding from sysadmins, or smuggling data inside connections from legitimate programs. This talk will also cover how to use these same techniques in malware analysis to fool anti-sanbox checks.

These ideas and more are explored in this talk alongside practical methods to detect and prevent this next generation of Linux rootkits.

REFERENCES
- DEFCON 27 - Evil eBPF Practical Abuses of In-kernel Bytecode Runtime - A talk about abusing eBPF for exploitation and privilege escalation

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=g6SKWT7sROQ

Media
(Main Talk) https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20PatH%20-%20Warping%20Reality%20-%20creating%20and%20countering%20the%20next%20generation%20of%20Linux%20rootkits%20using%20eBPF.mp4

(Demo)
https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20PatH%20-%20Warping%20Reality%20-%20creating%20and%20countering%20the%20next%20generation%20of%20Linux%20rootkits%20using%20eBPF%20-%20Demo.mp4


This talk has been pre-recorded and will be released to the DEF CON Media Server, torrents, and YouTube. At the time of this event, it will also stream on DCTV3, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_three


Return to Index    -    Add to    -    ics Calendar file

 

BTV - Friday - 16:30-17:59 PDT


Title: Watch Out! And just skip the packer
When: Friday, Aug 6, 16:30 - 17:59 PDT
Where: Blue Team Village - Workshop Track 2 (Virtual)

SpeakerBio:Felipe Duarte
Malware researcher, CEH, GREM, electronics geek, IoT enthusiast, programmer, drone lover and machine learning fan. Just hunting malware for fun!
Twitter: @dark0pcodes

Description:
Analyzing malware is not an easy task. It is a slow process that becomes even more challenging with all the different protections added by threat actors to hide their secrets.

Several techniques could be used to obscure malicious code, however one of the first and most commonly used are the packers. Nowadays, almost every malicious piece of code uses a packer; so, if you really want to understand its inner workings you must first defeat its packer. But do you know how to get rid of this defense without losing your mind? Well, join me and we will find out.

Malware remains as one of the most effective tools used by cyber criminals to commit fraud. Far from now are the days in which viruses were just jokes. And, it is not me being dramatic, just look at the news and you will see that this situation is getting worse every day.

There are several reasons that make these threats successful, including but not limited to:

Launching a malware attack is NOT rocket science, you can find open source or leaked code on Github and even tutorials on Youtube. They come in different flavors according to your needs, from very simple keyloggers to highly modular botnets that can be updated on the fly. If you don’t want to deal with technical stuff, you can even buy malware-as-a-service (and you could get 24/7 support). For us as defenders, understanding the technical details of these type of threats is not an easy task, it requires specialized tools and skills and even with those, be aware that bad guys will always try to obscure their creations to slow down the analysis. This sounds scary, and especially intimidating if it is your first time dealing with these "creatures"; but it is not the end of the world, we just need to adapt and overcome these challenges.

Join me in this workshop if you want to learn several techniques that will help you to get rid of the first and most common type of defense implemented by malware to hide its secrets (packers/crypters). Let's remove their armors and see what is hidden behind!


Return to Index    -    Add to    -    ics Calendar file

 

PHV - Friday - 09:00-10:59 PDT


Title: Web App Penetration Testing Workshop
When: Friday, Aug 6, 09:00 - 10:59 PDT
Where: Packet Hacking Village - Workshops (Virtual)

SpeakerBio:Sunny Wear , WEB SECURITY ARCHITECT AND PENETRATION TESTER
Dr. Sunny Wear (Twitter: @SunnyWear) is a Web Security Architect and Penetration Tester. She provides secure coding classes, creates software, and performs penetration testing against web/API and mobile applications. Sunny has more than 25 years of hands-on software programming, architecture and security experience and holds a Doctor of Science in Cybersecurity. She is a published author, "Burp Suite Cookbook", a developer of mobile apps, such as the “Burp Tool Buddy,” and is a Pluralsight content creator, "Burp Suite for Beginners/Advanced/Writing Plugins". She regularly speaks and holds classes at security conferences such as Defcon, Hackfest, and BSides.
Twitter: @SunnyWear

Description:
Gain hands-on experience learning how to perform web application penetration testing in this two-hour workshop with the author of the Burp Suite Cookbook, Dr. Sunny Wear. Students will learn Injections attacks such as Cross-site Scripting and SQL Injection attacks, brute-forcing tactics, and optimization techniques for Burp Suite including configurations and macros.

Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 10:00-10:59 PDT


Title: Welcome To DEF CON - Dark Tangent & Making the DEF CON 29 Badge
When: Friday, Aug 6, 10:00 - 10:59 PDT
Where: Track 1 Live; DCTV/Twitch #1 Live
Speakers:Dark Tangent,Katie Whiteley,Michael Whiteley

SpeakerBio:Dark Tangent
No BIO available

SpeakerBio:Katie Whiteley
Katie is a wife, mother, and graphic designer. She likes long walks on the beach because there's no internet connection.

Together with Michael, they are MK Factor, a husband/wife badgemaker team. They've created badges for many conferences and groups like OpenWest, Saintcon, DC801, Car Hacking Village, and many unofficial DEF CON badges. Together they earned a black badge for Car Hacking at DEF CON 24.

Twitter: @ktjgeekmom

SpeakerBio:Michael Whiteley
Michael is a husband, father, and electronics geek. He doesn't like long walks on the beach, but prefers to be indoors with a fast internet connection.

Together with Katie, they are MK Factor, a husband/wife badgemaker team. They've created badges for many conferences and groups like OpenWest, Saintcon, DC801, Car Hacking Village, and many unofficial DEF CON badges. Together they earned a black badge for Car Hacking at DEF CON 24.

Twitter: @compukidmike

Description:No Description available

This talk will be given live in Track 1, and will be streamed to DCTV1, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_one


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 09:00-09:59 PDT


Title: Welcome to Discord
When: Friday, Aug 6, 09:00 - 09:59 PDT
Where: DCTV/Twitch #3 Pre-Recorded

SpeakerBio:Dark Tangent
No BIO available

Description:No Description available

This talk has been pre-recorded and will be released to the DEF CON Media Server, torrents, and YouTube. At the time of this event, it will also stream on DCTV3, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_three


Return to Index    -    Add to    -    ics Calendar file

 

CPV - Friday - 11:00-11:30 PDT


Title: Welcome to Gold Bug
When: Friday, Aug 6, 11:00 - 11:30 PDT
Where: Crypto & Privacy Village (Virtual)

Description:
Description:Join puzzlemasters Maya & Kevin to kick off this year's Gold Bug puzzle challenge!

Crypto & Privacy Village will be streaming their events to YouTube and Twitch.

Twitch: https://www.twitch.tv/cryptovillage

YouTube: https://www.youtube.com/c/CryptoVillage


Return to Index    -    Add to    -    ics Calendar file

 

AIV - Friday - 09:00-09:30 PDT


Title: Welcome. A Short Tour of Good and Bad AI in 2021
When: Friday, Aug 6, 09:00 - 09:30 PDT
Where: AI Village (Virtual)

SpeakerBio:AI Village Organizers
No BIO available

Description:No Description available

AI Village events will be streamed to Twitch, and later be made available as videos on YouTube.

Speakers will be made available on DEF CON's Discord, in #aiv-general-text.


Twitch: https://www.twitch.tv/aivillage

YouTube: https://www.youtube.com/c/aivillage

#aiv-general-text: https://discord.com/channels/708208267699945503/732733090568339536


Return to Index    -    Add to    -    ics Calendar file

 

PYV - Friday - 13:00-13:59 PDT


Title: What happens when businesses decide to enroll cryptocurrency cards
When: Friday, Aug 6, 13:00 - 13:59 PDT
Where: Payment Village (Virtual)

SpeakerBio:Timur Yunusov
No BIO available

Description:
Cryptocurrencies are the new black. They are everywhere, and even your grandparents may now be gossiping about them. In this talk we will make an overview of risks that your brand new cryptocurrency card may carry with it.

Payment Village events will stream to Twitch and YouTube.

--

Twitch: https://www.twitch.tv/paymentvillage

YouTube: https://www.youtube.com/c/PaymentVillage


Return to Index    -    Add to    -    ics Calendar file

 

IOTV - Friday - 10:00-10:30 PDT


Title: When Penetration Testing Isn’t Penetration Testing At All
When: Friday, Aug 6, 10:00 - 10:30 PDT
Where: IoT Village (Talk - Virtual)

SpeakerBio:Ted Harrington
Ted Harrington is the #1 best selling author of HACKABLE: How to Do Application Security Right, and the Executive Partner at Independent Security Evaluators (ISE), the company of ethical hackers famous for hacking cars, medical devices, web applications, and password managers. He’s helped hundreds of companies fix tens of thousands of security vulnerabilities, including Google, Amazon, and Netflix. Ted has been featured in more than 100 media outlets, including The Wall Street Journal, Financial Times, and Forbes. His team founded and organizes IoT Village, an event whose hacking contest is a three-time DEF CON Black Badge winner. He hosts the Tech Done Different podcast.

Description:
When companies want to build secure IoT systems, they know they need to test their system for security flaws, which typically leads them to seek out “penetration testing.” However, this term has become so misused across the security community that it’s hard to decipher what is really happening.

So where does that leave you? What is your security testing program actually doing (and not doing)?

In this keynote, you’ll learn the often widely misunderstood difference about what penetration testing is (and is not). Drawing insights from the #1 bestselling book Hackable, you’ll learn why the distinction matters, and you’ll get an insight into the more advanced tactics used by ethical hackers, such as functionality abuse and exploit chaining. By design, this keynote is more strategic rather than technical, and will equip you with insights to think differently about your security testing program. As a result, you’ll leave with new ideas about how to build better, more secure systems.


IoT Village talks will be streamed to Twitch. Select speakers may be available in the IoT Village on-site to answer questions.

Twitch: https://www.twitch.tv/iotvillage


Return to Index    -    Add to    -    ics Calendar file

 

CLV - Friday - 14:05-14:35 PDT


Title: WhoC - Peeking under the hood of CaaS offerings
When: Friday, Aug 6, 14:05 - 14:35 PDT
Where: Cloud Village (Virtual)

SpeakerBio:Yuval Avrahami
Yuval Avrahami is a Principal Security Researcher at Palo Alto Networks, dealing with hacking and securing anything related to containers and cloud. Yuval is a veteran of the Israeli Air Force, where he served in the role of a researcher.
Twitter: @yuval_avrahami

Description:
Running your business-critical applications on the public cloud involves trust. You trust your cloud provider to separate your workloads from other customers' workloads. You trust your cloud provider to patch and update their software and hardware stack. For those of us with trust issues, blindly running our applications in the public cloud can be tough. Fortunately, trust can be earned through visibility, and that's where WhoC can help. WhoC provides a bit of visibility into how Container-as-a-Service (CaaS) offerings run our containers. WhoC (Who Contains) is a container image that upon execution extracts the underlying container runtime. It doesn't try to identify the underlying runtime based on the container's cgroup configuration, the existence of a '.dockerenv' file or any other known trick. WhoC exfiltrates the actual container runtime binary from the underlying host. In this talk Yuval will walk you through how WhoC works and show a demo running WhoC in a popular CaaS offering. You'll learn a surprising truth: Linux containers can actually access one host file - the container runtime.

Cloud Village activities will be streamed to YouTube.

YouTube: https://www.youtube.com/cloudvillage_dc


Return to Index    -    Add to    -    ics Calendar file

 

CON - Friday - 22:00-23:59 PDT


Title: Whose Slide Is It Anyway
When: Friday, Aug 6, 22:00 - 23:59 PDT
Where: See Description

Description:
For more information, see https://forum.defcon.org/node/237295 or https://twitter.com/whoseslide

This event will be held in Track 1, Bally's


Return to Index    -    Add to    -    ics Calendar file

 

BICV - Friday - 10:30-10:30 PDT


Title: Why don’t we have IoT, daddy?
When: Friday, Aug 6, 10:30 - 10:30 PDT
Where: Blacks in Cyber

SpeakerBio:Jessica Hoffman
Jessica Hoffman is an IT Audit manger and partner of her Black owned audit and compliance firm. She provides Readiness assessments and audits mainly to the federal healthcare sector but also service various public/private sector fields. She has been in Cybersecurity for 10 years and IT for over 15 years. Prior to starting her small business, she was a federal and state employee; Public service and giving back to the community are two areas that she is dedicated to and she excels in as a dedicated volunteer, mentor, professor and advocate.
Twitter: @JHoBootyFat

Description:No Description available

Blacks in Cyber talks will be streamed on YouTube.

YouTube: https://www.youtube.com/c/BlacksInCybersecurity


Return to Index    -    Add to    -    ics Calendar file

 

DL - Friday - 10:00-11:50 PDT


Title: WiFi Kraken Lite
When: Friday, Aug 6, 10:00 - 11:50 PDT
Where: Palace 3+4+5
Speakers:Mike Spicer,Henry Hill

SpeakerBio:Mike Spicer
Mike Spicer (d4rkm4tter) is a mad scientist hacker who likes to meddle with hardware and software. He is particularly obsessed with wireless. He has a degree in computer science which he has put to use building and breaking a wide array of systems. These include web application pentesting, wireless monitoring and tracking as well as reverse engineering. He is the creator of the #WiFiCactus and has been seen presenting and demoing at a number of conferences including DEF CON. He is a Kismet cultist and active in the wireless and wardriving communities.

SpeakerBio:Henry Hill
Henry Hill is an expert with computer hardware and is able to design and build the most bleeding edge systems that are the fastest in the world. His internal knowledge of architecture and system bottlenecks help him build systems capable of extreme processing and even faster storage. Henry is also an expert with mechanical engineering and fabrication. When his modifications aren’t appearing in d4rkm4tter’s projects, they can be seen in his race car at the track.

Description:
Tool or Project Name: The WiFi Kraken Lite

Short Abstract:
D4rkm4tter and Henry have been obsessed with monitoring wireless networks and have built hardware to meet the challenges of scanning and testing in the most busy and client dense environments. The WiFi-Kraken Lite contends with these issues in a smaller package without sacrificing any monitoring performance. This project is the results of years of research into the most effective way to scan and audit wireless in a single box that can be easily deployed or used as a hardened terminal in the most rugged conditions.

The WiFi-Kraken Lite consists of a single-board computer which connects 12 wireless radios that enables scanning and auditing WiFi, Bluetooth, LoRaWAN and other commonly used wireless protocols. The number of wireless devices is growing as well as the way those devices are being connected. Having an all-in-one wireless monitoring solution will give you the ability to track this data across these bands and give you the best picture of what’s happening in the air around you.

This demonstration will provide you the information so that you can build your own all-in-one monitoring device. You will also gain an overview of capture technologies including Kismet that will help you perform this type of analysis in your own environments. Finally once the data is capture, you will get an understanding of efficient data processing using tools like Wireshark and d4rkm4tter’s own PCAPinator tool.

Short Developer Bio:
Mike Spicer (d4rkm4tter) is a mad scientist hacker who likes to meddle with hardware and software. He is particularly obsessed with wireless. He has a degree in computer science which he has put to use building and breaking a wide array of systems. These include web application pentesting, wireless monitoring and tracking as well as reverse engineering. He is the creator of the #WiFiCactus and has been seen presenting and demoing at a number of conferences including DEF CON. He is a Kismet cultist and active in the wireless and wardriving communities.

Henry Hill is an expert with computer hardware and is able to design and build the most bleeding edge systems that are the fastest in the world. His internal knowledge of architecture and system bottlenecks help him build systems capable of extreme processing and even faster storage. Henry is also an expert with mechanical engineering and fabrication. When his modifications aren’t appearing in d4rkm4tter’s projects, they can be seen in his race car at the track.

URL to any additional information:
Palshack.org/wifi-kraken-lite (Site will be online for DEF CON)

Detailed Explanation of Tool:
The WiFi-Kraken Lite is a wireless monitoring system that is a rugged box with a single board computer and 12 wireless devices that are capable of simultaneously monitoring a large number of frequencies and protocols while storing that data in real time. The primary motivation for this project was to be able to gain visibility into as much of the wireless spectrum as possible in very congested networks in a small rugged form factor. Networks with a large number of clients that have a large number of access points can be difficult to perform analysis on. These networks typically have clients who switch between networks and can switch frequencies lending to more confusion when tracking with only a single radio. By increasing the number of radios as well as adding support for other protocols beyond just WiFi, a more complete understanding of the wireless environment can be documented. This information can then be used for defenders or penetration testers to identify vulnerable networks, vulnerable clients, or verify security that can be easily documented and audited.

The hardware is set up so that it minimizes the number of bottlenecks between the actual frames in the air and when it writes the data to disk. It does this by taking advantage of the high-bandwidth PCI-express bus to connect wireless devices. From there the data transfers to a high-speed NVMe storage device. The operating system is Linux which allows us to take advantage of a number of open source tools and projects that help us capture the data. These projects include Kismet, BlueZ, btscanner, and Feather TFT LoRa Sniffer. Custom scripts help us manage and easily configure The WiFi-Kraken Lite for the desired mode.

The buildout of the project uses a hardened Pelican like case which provides the ruggedness and physical security so that the system can be left in harsh environments. Inside the case is a mounted LCD screen that gives the user easy access to make changes in the field if necessary. The electronic components including the single board computer wireless cards are all mounted inside to protect them. The project also features battery packs so that it can run for up to 24 hours or longer depending on the monitoring task.

Data captured with the system can be stored on disk or be analyzed in real time thanks to the internally mounted LCD. Data can also be analyzed remotely by using one of the radios to connect to a nearby laptop. This can be useful in scenarios where the WiFi-Kraken Lite needs to be concealed. The form factor was chosen for not only its strength but also for being inconspicuous especially at conferences where lots of large polycarbonate cases can be seen.

Further data analysis can be performed in real time thanks to Kismet’s fully featured web dashboard. Additionally post monitoring analysis can be performed using Wireshark or d4rkm4tter’s PCAPinator tool which is a multithreaded wrapper around tshark to optimize queries on large datasets. The wireless data captured in this type of analysis can help to determine vulnerabilities which then you can use The WiFi-Kraken Lite to attack what you found.

This tool can be used entirely passively as a silent listener to validate bring your own device (BYOD) policies, monitor if wireless attacks are happening against your infrastructure, see if there are strange behaviors happening in your wireless network due to misconfiguration or maliciousness, or track devices as they moved throughout the networks so that you can have a better understanding of client flow. It can be used to perform a number of active attacks including impersonation, evil twin and other common wireless attacks.

It has never been more important to perform wireless assessments and continual monitoring of your infrastructure considering the number of wireless enabled devices increases daily. Rolling out new wireless infrastructure is costly and implementing the most secure system is daunting for even the most seasoned network integrators. This leads to misconfiguration and sub optimal security settings which are still connected to important infrastructure. For the defender this project brings clarity to the risks and also provides information into the most important mitigations that should be implemented. For the attacker this tool provides valuable recon that will allow them to focus solely on the vulnerable target making as little noise as possible all from it a single box.

Target Audience:
Offense, Defense and Hardware

By bringing equipment that can monitor the latest in wireless technologies, including WiFi 6, this project will shed light on a new and up and coming standard of technology that is slowly being rolled out across the world. With new technology, new tools are required so that research can be conducted to find flaws and validate the real world applications. The WiFi Kraken Lite will bring an enhanced perspective to the wireless monitoring in a box with new tools, new wireless bands captured, and new data processing.


Return to Index    -    Add to    -    ics Calendar file

 

BTV - Friday - 10:45-12:15 PDT


Title: Windows Forensics 101 (Beginner)
When: Friday, Aug 6, 10:45 - 12:15 PDT
Where: Blue Team Village - Workshop Track 2 (Virtual)

SpeakerBio:Surya Teja Masanam
Surya found his passion for cybersecurity during his college days where out of curiosity he figured out how a malware was spreading actively in the college computers and found a remediation technique. From then onwards his cybersecurity journey started. Digital Forensics and Malware Analysis are his all-time favorites. Surya is a Security Engineer with 5+ years of experience in performing both offensive and defensive activities. Engaging, understanding, and knowledgeable technical trainer, having expertise in training small and large groups across diverse industries. LinkedIn: https://www.linkedin.com/in/suryatejam/
Twitter: @surya4n6
https://www.linkedin.com/in/suryatejam/

Description:
Are you fascinated with Sherlock Holmes stories?

In your lifetime, have you ever come across the word Forensics? Most of us might have seen in the movies like, After a crime, Police visits the crime scene and says “Call the Forensics Team”

Did you ever feel CURIOUS about that?

Technology is evolving, so are the attacks and investigation techniques.

If you are interested in Digital Forensics and have questions like:

How to start?
What skills are required?
What tools to use?
Then this workshop is the right place for you.

This intro-level workshop covers topics present in Digital Forensics LifeCycle like Evidence Collection and Investigation on a Windows machine, of a Windows machine. Attendees will be provided with the necessary lab instructions and evidence files to perform forensic analysis practically and be confident and clear on how to apply the knowledge gained here to investigate some real-world scenarios.

Attendees will learn:

Skills required for a Forensic Examiner Build their own forensics toolkit with free and open-source tools Evidence Collection --> On Live and Dead Machines, Do’s and Dont’s Investigation --> Windows Artifact analysis, Internet History & Application Analysis, Data Carving, Memory Analysis Opportunities and challenges in this field Attendees will be provided with:

Evidence Files
Lab instructions to perform forensic analysis Access to the Windows Forensics Artifact Library of the Speaker Useful resources for further practice and exploration after this workshop Lab Requirements:

OS: Windows 7 and above [Win10 recommended] If you are on Linux or Mac, Install Windows using VirtualBox RAM: Min. 4GB [8GB recommended]
Disk Space: 50 GB
Note: Download links for the labs will be shared before the workshop

Pre-requisites
- Familiarity with Windows Operating System. - Curiosity, Willingness, and of course, the Lab requirements too ;-)


Return to Index    -    Add to    -    ics Calendar file

 

WS - Friday - 15:00-18:59 PDT


Title: Windows Internals
When: Friday, Aug 6, 15:00 - 18:59 PDT
Where: Workshops - Jubilee 1 (Onsite Only)
Speakers:Sam Bowne,Elizabeth Biddlecome,Irvin Lemus,Kaitlyn Handelman

SpeakerBio:Sam Bowne , Proprietor, Bowne Consulting
Sam Bowne has been teaching computer networking and security classes at CCSF since 2000. He has given talks and hands-on trainings at DEF CON, DEF CON China, HOPE, BSidesSF, BSidesLV, RSA, and many conferences and colleges.

SpeakerBio:Elizabeth Biddlecome , Consultant and Part-Time Instructor
Elizabeth Biddlecome is a consultant and a part-time instructor at City College San Francisco, delivering technical training and mentorship to students and professionals. She leverages her enthusiasm for architecture, security, and code to design and implement comprehensive information security solutions for business needs. Elizabeth enjoys wielding everything from soldering irons to scripting languages in cybersecurity competitions, hackathons, and CTFs.

SpeakerBio:Irvin Lemus , Cybersecurity Professor
Irvin Lemus has been in the industry for 10+ years as an MSP technician, consultant, instructor and coordinator. He is currently the cybersecurity professor at Cabrillo College in Santa Cruz, CA. He also is the Bay Area Cyber Competitions Regional Coordinator as well as the contest creator for SkillsUSA CA and FL. Irvin has spoken at various cybersecurity and educational conferences. Irvin holds a CISSP and a Bachelor's Degree in Information Security.

Irvin Lemus is an instructor at Cabrillo College, teaching cyber security courses for 3 years. Irvin runs the cybersecurity competition program for the Bay Area Community Colleges. He also creates the SkillsUSA Cybersecurity contests for California and Florida. He has Security+, CySA+, WCNA, CISSP.


SpeakerBio:Kaitlyn Handelman , Hacker
I like to hack stuff, and I’m like really good at computers.

Description:
Explore the structure of Windows executable files and the operating system itself, to better understand programs, services, malware, and defenses. Projects include: cheating at games, building malicious DLL libraries, stealing passwords from the API, building a keylogger, and debugging a driver. Tools used include FLARE-VM, pestudio, API Monitor, Visual Studio, OllyDbg, IDA Pro, Ghidra, and WinDbg. No previous experience with programming is required.

To prepare for this workshop, please prepare a FLARE-VM in advance, as explained here: https://samsclass.info/126/proj/PMA40.htm

Registration Link: https://www.eventbrite.com/e/windows-internals-jubilee-1-tickets-162217227093

Prerequisites
Previous experience troubleshooting Windows is helpful but not required

Materials needed:
A computer that can run virtual machines locally, or a few dollars to rent cloud servers


Return to Index    -    Add to    -    ics Calendar file

 

VMV - Friday - 11:30-11:59 PDT


Title: Wireless Odyssey or why is the federal government permitting devices with wireless networking capability in federally certified voting machines?
When: Friday, Aug 6, 11:30 - 11:59 PDT
Where: Voting Village (Talks - Virtual)

SpeakerBio:Susan Greenhalgh
Susan Greenhalgh is the Senior Advisor on Election Security for Free Speech For People. Ms. Greenhalgh has previously served as vice president of programs at Verified Voting and at the National Election Defense Coalition, advocating for secure election protocols, paper ballot voting systems and post-election audits. Recognized as an expert on election security, she has been invited to testify before the U.S. Commission on Civil Rights and has been an invited speaker at meetings of the MITRE Corporation, the National Conference of State Legislatures, the Mid-West Election Officials Conference, the International Association of Government Officials, the Election Verification Network and the E-Vote-ID conference in Bregenz, Austria. She is a frequent source for reporters from The New York Times, The Washington Post, The Wall Street Journal, Politico, USA Today, Associated Press, National Public Radio and other leading news outlets. She has appeared on CNN and MSNBC’s The Rachel Maddow Show, and various other television news shows. She has a BA in Chemistry from the University of Vermont.

Description:
In February, the U.S. Election Assistance Commission (EAC) passed new voting system standards, the federal voluntary voting system guidelines or VVSG 2.0. The new guidelines that were presented to the EAC, voted on, and adopted, had a significant change in them from the guidelines that had gone through the federally mandated public hearing and comment period. The new standards, that had not been vetted publicly, suddenly allowed the inclusion of wireless networking devices like modems, chips or radios.

This presentation aims to tell the story of how the computer security community successfully advocated for the federal voting system standards to ban all wireless networking capability in federally certified voting systems, only to have the EAC change the publicly vetted version of the standards, in secret, behind closed doors, at the eleventh hour, at the request of the voting system vendors, to allow wireless devices.


Voting Village talks will be streamed to YouTube and Twitch.

Twitch: https://www.twitch.tv/votingvillagedc

YouTube: https://www.youtube.com/channel/UCnDevqsxt3sO8chqS5MGvwg


Return to Index    -    Add to    -    ics Calendar file

 

AIV - Friday - 15:30-16:30 PDT


Title: Workshop on Microsoft Counterfit
When: Friday, Aug 6, 15:30 - 16:30 PDT
Where: AI Village (Virtual)

SpeakerBio:Will Pearce
No BIO available

Description:No Description available

AI Village events will be streamed to Twitch, and later be made available as videos on YouTube.

Speakers will be made available on DEF CON's Discord, in #aiv-general-text.


Twitch: https://www.twitch.tv/aivillage

YouTube: https://www.youtube.com/c/aivillage

#aiv-general-text: https://discord.com/channels/708208267699945503/732733090568339536


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 12:30-12:50 PDT


Title: Worming through IDEs
When: Friday, Aug 6, 12:30 - 12:50 PDT
Where: DCTV/Twitch #3 Pre-Recorded

SpeakerBio:David Dworken
David is a bug bounty hunter turned software engineer turned security engineer. He started in security in high school hacking on bug bounties and then spent four years learning how to be an effective software engineer. He's worked on five different product security teams ranging from startups to large corporations. He previously published a research paper on tracking malicious proxies in ACSAC. Currently, he works as a security engineer at Google working on deploying an alphabet soup of security headers across hundreds of services.
Twitter: @ddworken
daviddworken.com

Description:
You might think that as long as you never hit run, opening up that interesting new POC in your IDE and checking out the code is safe. But it isn't. IDEs and developer tools are complex pieces of software that have vulnerabilities, just like everything else.

We'll start by discussing what a reasonable threat model is for IDEs. How do companies threat model their IDEs? What do users expect of their IDEs? Is viewing a file equivalent to executing it?

Then we'll dive into the reality of it. Nearly every IDE examined was trivially vulnerable. But there were also a variety of subtle bugs lying underneath. We'll look at bugs in both local IDEs (like VSCode and IntelliJ) and cloud-based IDEs (like AWS Cloud9 and Github Codespaces).

Finally, we'll show how an attacker could make a worm that would spread through attacking IDEs. View a malicious project? Let's automatically backdoor every project on a computer and keep spreading.

REFERENCES
https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md https://nvd.nist.gov/vuln/detail/CVE-2012-3479 http://blog.saynotolinux.com/blog/2016/08/15/jetbrains-ide-remote-code-execution-and-local-file-disclosure-vulnerability-analysis/ https://www.cvedetails.com/vulnerability-list/vendor_id-15146/product_id-49160/year-2019/Jetbrains-Intellij-Idea.html

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=pzqu_qaoNuY

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20David%20Dworken%20-%20Worming%20through%20IDEs.mp4


This talk has been pre-recorded and will be released to the DEF CON Media Server, torrents, and YouTube. At the time of this event, it will also stream on DCTV3, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_three


Return to Index    -    Add to    -    ics Calendar file

 

WS - Friday - 15:00-18:59 PDT


Title: Writing Golang Malware
When: Friday, Aug 6, 15:00 - 18:59 PDT
Where: Workshops - Las Vegas 5+6 (Onsite Only)

SpeakerBio:Benjamin Kurtz , Hacker
Ben Kurtz is a hacker, a hardware enthusiast, and the host of the Hack the Planet podcast (https://symbolcrash.com/podcast). After his first talk, at DefCon 13, he ditched development and started a long career in security. He has been a pentester for IOActive, head of security for an MMO company, and on the internal pentest team for the Xbox One at Microsoft. Along the way, he volunteered on anti-censorship projects, which resulted in his conversion to Golang and the development of the ratnet project (https://github.com/awgh/ratnet). A few years ago, he co-founded the Binject group to develop core offensive components for Golang-based malware, and Symbol Crash, which focuses on sharing hacker knowledge through trainings for red teams, a free monthly Hardware Hacking workshop in Seattle, and podcasts. He is currently developing a ratnet-based handheld device for mobile encrypted mesh messenging, planned for release next year.
Twitter: @symbolcrash1
symbolcrash.com

Description:
Participants will learn how to design and build their own multi-platform Golang-based implants and c2 frameworks by building on samples provided.

Topics will include:

Registration Link: https://www.eventbrite.com/e/writing-golang-malware-las-vegas-5-6-tickets-162217403621

Prerequisites
Programming experience required, some experience with Golang would be helpful.

Materials needed:
Laptop (any operating system)


Return to Index    -    Add to    -    ics Calendar file

 

BTV - Friday - 09:30-10:30 PDT


Title: Yeet the leet with Osquery (Effective Threathunting Without Breaking Bank )
When: Friday, Aug 6, 09:30 - 10:30 PDT
Where: Blue Team Village - Main Track (Virtual)

SpeakerBio:Sebastiaan Provost
Sebastiaan is the Lead Security Engineer at Beacon and has worked in information security for across both offensive and defensive domains. He specializes in protecting business critical assets by applying technology in creative ways and is particularly interested in Threat Hunting in Zero Trust Environments. In his free time, he enjoys the gym, he tries to hone his infosec knives, and tries to visit as many countries as possible. He has previously given talks at SHA2017 and BsidesNCL 2019.
Twitter: @Stekkz

Description:
EDR/MDR/XDR is touted as the panacea, a one-stop-shop of security. However, there is no certainty on how well those solutions protect us. Companies throw money at them because they get promised complete protection. EDR solutions, no matter how expensive, still miss common techniques and payloads. This talk will show the audience how they can use the power of OSQuery to add additional monitoring to their systems in addition to keeping their EDR solutions honest. The talk will focus on detections of common command & control (C2) frameworks using OSQuery in addition to EDR.

What will be learned throughout the talk: - What is Osquery
- How to detect potential IOCs with Osquery - How to detect C2 payloads with Osquery - How to detect reverse shells with Osquery - How to combine this with a good alerting setup for the chance of a quick intervention - Potential automation past the alerting

Description/Flow
1. Intro
I will introduce myself, talk about my background, what I do and what my motivation is for this talk. I will also explain what can be expected and give a quick overview of the journey that we will follow. 2. Osquery & Why it was chosen
Osquery has been around for a few years now. It is a piece of software that allows you to describe anything related to a device with simple SQL commands that leverage a relational data-model. A short intro will be given about what it actually does, what its capabilities are, who is behind it, and what it can be used for. This will be followed up by a list of examples to show the power of osquery, to give the audience an initial view on how far you can go with it. Lastly, I will use a few examples that will show how you can use the power of osquery to detect potential IOCs.

Payloads and Reverse Shells
C2 Payloads
In this part I will take the audience on a journey of hunting for C2 payloads & processes. I will go over a few off-the-shelf C2 frameworks that can be found on Github, what kind of payloads they provide and how easy/difficult it is to set them up. From there I will show the audience how we can catch the payloads/processes of these C2 frameworks with a few SQL queries in Osquery. Reverse Shells
In this part I will guide the audience through a series of examples on how reverse shells can be launched and how their connections can be detected. From there I will show the audience how we can catch those connections and reverse shells with a few simple SQL queries. Alerting
After I’ve shown the audience what the capabilities are of Osquery, how you can use it to hunt for C2 payloads/processes and for reverse shells, I will guide them on how this can be combined with alerting so analysts can react quickly if something has been found by Osquery. I will use both Splunk and Elasticsearch as an example on how this alerting can look like and will speak a little bit on how we can automate this even more with SOAR platforms. Sitrep
During the sitrep, I will talk briefly about the technologies we’ve encountered. I will also give a brief overview of the things we’ve learned looking back and how this can be extended even more looking forward. The end
This is the part where I would like to thank everyone for listening in and I will happily answer any question that comes my way!


Blue Team Village talks will be streamed to Twitch.

--

Twitch: https://twitch.tv/blueteamvillage


Return to Index    -    Add to    -    ics Calendar file

 

DC - Friday - 12:00-12:20 PDT


Title: Your House is My House: Use of Offensive Enclaves In Adversarial Operations
When: Friday, Aug 6, 12:00 - 12:20 PDT
Where: Track 2 Live; DCTV/Twitch #2 Pre-Recorded

SpeakerBio:Dimitry "Op_Nomad" Snezhkov
Dimitry Snezhkov is an Associate Director at Protiviti. In this role he hacks code, tools, networks, apps and sometimes subverts human behavior too. Dimitry has spoken at DEF CON, BlackHat, THOTCON conferences, and presented tools at BlackHat Arsenal.
Twitter: @Op_Nomad

Description:
As developers start to rely more on hardware-based memory encryption controls that isolate specific application code and data in memory - secure enclaves, adversaries can use enclaves to successfully coexist on the host and enjoy similar protections.

In this talk we venture into a practical implementation of such an offensive enclave, with the help of Intel SGX enclave technology, supported on a wide variety of processors present in enterprise data-centers and in the cloud.

We discuss how malware can avoid detection in defensively instrumented environments and protect their operational components from processes running at high privilege levels, including the Operating System. We dive deeper into using enclaves in implants and stagers, and discuss the design and implementation of an enclave that is capable of facilitating secure communication and storage of sensitive data in offensive operations. We cover how the enclaves can be built to help secure external communication while resisting system and network inspection efforts and to achieve deployment with minimal dependencies where possible.

Finally, we release the enclave code and a library of offensive enclave primitives as a useful reference for teams that leverage Intel SGX technology or have the hardware platform capable to support such adversarial efforts.

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=WWGkaGBtn2Q

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Dimitry%20Op%20Nomad%20Snezhkov%20-%20Your%20House%20is%20My%20House%20-%20Use%20of%20Offensive%20Enclaves%20In%20Adversarial%20Operations.mp4


This talk will be given live in Track 2.

This talk has also been pre-recorded and will be broadcast on DCTV2, both in local hotels and on Twitch.


DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_two


Return to Index    -    Add to    -    ics Calendar file

 

ICSV - Friday - 11:30-12:30 PDT


Title: Your Infrastructure is Encrypted: Protecting Critical Infrastructure from Ransomware
When: Friday, Aug 6, 11:30 - 12:30 PDT
Where: ICS Village (Virtual)
Speakers:David Etue,Ernie Bio,Jamil Jaffer,Jennifer DeTrani

SpeakerBio:David Etue
No BIO available

SpeakerBio:Ernie Bio
No BIO available

SpeakerBio:Jamil Jaffer , National Security Institute
Jamil currently serves as Founder and Executive Director of the National Security Institute and as an Assistant Professor of Law and Director of the National Security Law & Policy Program at the Antonin Scalia Law School at George Mason University. He also currently serves as Vice President for Strategy, Partnerships & Corporate Development at IronNet Cybersecurity, a startup technology firm founded by former NSA Director Gen. (ret.) Keith B. Alexander. Jamil also serves on the Board of Directors for the Greater Washington Board of Trade, is a member of the Board’s Smart Region Movement Strategic Advisory Counsel, and is a co-chair of the SRM’s Cyber, Data Management, and Privacy Solution Group. Jamil is also an advisor to Beacon Global Strategies, a strategic advisory firm specializing in international policy, defense, cyber, intelligence, and homeland security; 4iQ, a technology startup focused on deep and dark web intelligence and identity theft protection; Duco, a technology platform startup that connects corporations with geopolitical and international business experts; and Amber, a digital authentication and verification startup.
Twitter: @Jamil_n_jaffer

SpeakerBio:Jennifer DeTrani
No BIO available

Description:
The recent attacks against Colonial Pipeline, JBS, and others have made it clear just how vulnerable U.S. Critical Infrastructure is to ransomware. While these attacks have been grabbing headlines, the path forward has not. A variety of tools and approaches will need to be tested by both the government and private sector to push back against the threat of ransomware and protect critical infrastructure from future attacks.

This panel brings together a variety of perspectives from the government, technology, and venture capital sectors to chart the path forward and detail what steps government and the private sector can take individually and together to protect critical infrastructure across the country.


ICS Village will be releasing their events to YouTube at each event's scheduled time. Discussion will be available on Discord in #ics-speaker-questions-and-answers-text.

YouTube: https://www.youtube.com/channel/UCI_GT2-OMrsqqglv0JijHhw

#ics-speaker-questions-and-answers-text: https://discord.com/channels/708208267699945503/735937961908109485


Return to Index    -    Add to    -    ics Calendar file

 

DL - Friday - 14:00-15:50 PDT


Title: Zuthaka
When: Friday, Aug 6, 14:00 - 15:50 PDT
Where: DemoLab Video Channel 2

SpeakerBio:Lucas Bonastre
Lucas started his career studying Mathematics at the University of Buenos Aires, however when his uncle gave him a C++ book, he realized his true passion for programming and his outstanding ability for problem-solving. He worked across cybersecurity and technology firms and is a vetted developer in many languages such as C/C++, Python, Java, and PHP. Now he is a full time developer and security researcher at Pucara Information Security. In his spare time, he is an expert chess player and he is studying AI to analyze foosball strategies.

Description:
Tool or Project Name: Zuthaka

Short Abstract:
A collaborative free open-source Command & Control development framework that allows developers to concentrate on the core function and goal of their C2. Zuthaka presents a simplified API for fast and clear integration of C2s and provides a centralized management for multiple C2 instances through a unified interface for Red Team operations.

Short Developer Bio:
Lucas started his career studying Mathematics at the University of Buenos Aires, however when his uncle gave him a C++ book, he realized his true passion for programming and his outstanding ability for problem-solving. He worked across cybersecurity and technology firms and is a vetted developer in many languages such as C/C++, Python, Java, and PHP. Now he is a full time developer and security researcher at Pucara Information Security. In his spare time, he is an expert chess player and he is studying AI to analyze foosball strategies.

URL to any additional information:
https://docs.zuthaka.com/-MYVExFNbaf2ARSR5z2e/

Detailed Explanation of Tool:

Problem Statement: The current C2s ecosystem has rapidly grown in order to adapt to modern red team operations and diverse needs (further information on C2 selection can be found here). This comes with a lot of overhead work for Offensive Security professionals everywhere. Creating a C2 is already a demanding task, and most C2s available lack an intuitive and easy to use web interface. Most Red Teams must independently administer and understand each C2 in their infrastructure.

Solution: With the belief that community efforts surpass that of any individual, Zuthaka presents a simplified API for fast and clear integration of C2s and provides a centralized management for multiple C2 instances through a unified interface for Red Team operations.

‌Zuthaka is more than just a collection of C2s, it is also a solid foundation that can be built upon and easily customized to meet the needs of the exercise that needs to be accomplish. This integration and development framework for C2 allows developers to concentrate on a unique target environment and not have to reinvent the wheel.

Please reefer to the supporting files for more detailed information about Zuthaka.

Supporting Files, Code, etc:
Docs : https://docs.zuthaka.com/-MYVExFNbaf2ARSR5z2e/ Github : https://github.com/pucarasec/zuthaka Demo Video: https://youtu.be/pcW9Hj5Jzu0 Target Audience:
Offensive developers, Red Teamers Operators, C2 Developers

Problem Statement:
The current C2s ecosystem has rapidly grown in order to adapt to modern red team operations and diverse needs (further information on C2 selection can be found here). This comes with a lot of overhead work for Offensive Security professionals everywhere. Creating a C2 is already a demanding task, and most C2s available lack an intuitive and easy to use web interface. Most Red Teams must independently administer and understand each C2 in their infrastructure.

Solutions: With the belief that community efforts surpass that of any individual, Zuthaka presents a simplified API for fast and clear integration of C2s and provides a centralized management for multiple C2 instances through a unified interface for Red Team operations.

‌Zuthaka is more than just a collection of C2s, it is also a solid foundation that can be built upon and easily customized to meet the needs of the exercise that needs to be accomplish. This integration and development framework for C2 allows developers to concentrate on a unique target environment and not have to reinvent the wheel.

Additional information:
The github repository is private ,until the release of the tool, but we can provide an early access to the repository for the reviewers. All the information is available on: https://docs.zuthaka.com/-MYVExFNbaf2ARSR5z2e/


This content will be presented on a Discord video channel.

#dl-video2-voice: https://discord.com/channels/708208267699945503/734027778646867988


Return to Index    -    Add to    -    ics Calendar file