Talk/Event Schedule

Saturday

Saturday - 00:00 PDT

Saturday - 01:00 PDT

Saturday - 08:00 PDT

Saturday - 09:00 PDT

Saturday - 10:00 PDT

Saturday - 11:00 PDT

Saturday - 12:00 PDT

Saturday - 13:00 PDT

Saturday - 14:00 PDT

Saturday - 15:00 PDT

Saturday - 16:00 PDT

Saturday - 17:00 PDT

Saturday - 18:00 PDT

Saturday - 19:00 PDT

Saturday - 20:00 PDT

Saturday - 21:00 PDT

Saturday - 22:00 PDT

Saturday - 23:00 PDT

Talk/Event Descriptions

RCV - Saturday - 14:40-15:10 PDT

YouTube: https://www.youtube.com/c/ReconVillage

DC - Saturday - 19:00-19:30 PDT

Offensive testing in organizations has shown a tremendous value for simulating controlled attacks. While cyber extortion may be one of the main high ROI end goals for the attacker, surprisingly few tools exist to simulate ransomware operations.

Racketeer is one such tool. It is an offensive agent coupled with a C2 base, built to help teams to prototype and exercise a tightly controlled ransomware campaign.

We walk through the design considerations and implementation of a ransomware implant which emulates logical steps taken to manage connectivity and asset encryption and decryption capabilities. We showcase flexible and actionable ways to prototype components of fully remote ransomware operation including key and data management, as well as data communication that is used in ransomware campaigns.

Racketeer is equipped with practical safeguards for lights out operations, and can address the goals of keeping strict control of data and key management in its deployment, including target containment policy, safe credential management, and implementing operational security in simulated operations.

Racketeer can help gain better optics into IoCs, and is helpful in providing detailed logs that can be used to study the behavior and execution artifacts of a ransomware agent.

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=VJ8aqReB118

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Dimitry%20Op%20Nomad%20Snezhkov%20-%20Racketeer%20Toolkit.%20Prototyping%20Controlled%20Ransomware%20Operations.mp4

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_two

DC - Saturday - 19:00-19:59 PDT

The talk, "UFOs and Government: A Historical Inquiry" given at Def Con 21 has been viewed thousands of times. It was a serious well-documented exploration of the UFO subject based on Thieme's participation in research into the subject with colleagues. The book of that name is the gold standard for historical research into the subject and is in 100+ university libraries.

This update was necessitated by recent UFO incidents and the diverse conversations triggered by them. Contextual understanding is needed to evaluate current reports from pilots and naval personnel, statements from senators and Pentagon personnel, and indeed, all the input from journalists who are often unfamiliar with the field and the real history of documented UFOs over the past 70 years.

Thieme was privileged to participate with scholars and lifelong researchers into the massive trove of reports. We estimate that 95% can be explained by mundane phenomena but the remainder suggest prolonged interaction with our planetary society over a long period. Thieme also knows that when you know you don't know something, don't suggest that you do. Stay with the facts, stay with the data. Sensible conclusions, when we do that, are astonishing enough.

Reality, as Philip K. Dick said, will not go away just because we refuse to believe in it.

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=mExktWB0qz4

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Richard%20Thieme%20AKA%20neuralcowboy%20-%20UFOs%20-%20Misinformation%2C%20Disinformation%2C%20and%20the%20Basic%20Truth.mp4

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_one

AVV - Saturday - 19:45-20:30 PDT

PEASS is a compilation of a bash script for Linux/MacOS/*nix and a .Net project and a batch script for Windows that I have created some time ago which aims to check and highlight every possible privescpath so professionals don’t need to execute several different tools for this purpose and can very easily find vulnerabilities.

During this talk I would like to present PEASS-ng. The architecture of these scripts has evolved and improved so much that I would like to present how they work at the moment and how the difficulty to collaborate with the project has been reduced significantly. Moreover, I would also like to present the 2 new PEAS that haven't been present anywhere yet: BotPEAS and WebPEAS (the latest one will be released the day of the talk). During the talk I will also present my local privilege escalation resources (https://book.hacktricks.xyz/linux-unix/privilege-escalation , https://book.hacktricks.xyz/windows/windows-local-privilege-escalation) so the attended will be able to continue learning about the topic after the talk.

Q&A sessions will happen in DEF CON Official Discord server after each talk.

YouTube: https://www.youtube.com/channel/UCOhn9WALnpb5YAbW18R1Hzg

Twitch: https://twitch.tv/adversaryvillage

Discord: https://discord.gg/defcon

AVV - Saturday - 15:00-15:45 PDT

Q&A sessions will happen in DEF CON Official Discord server after each talk.

YouTube: https://www.youtube.com/channel/UCOhn9WALnpb5YAbW18R1Hzg

Twitch: https://twitch.tv/adversaryvillage

Discord: https://discord.gg/defcon

AVV - Saturday - 13:15-13:59 PDT

Q&A sessions will happen in DEF CON Official Discord server after each talk.

YouTube: https://www.youtube.com/channel/UCOhn9WALnpb5YAbW18R1Hzg

Twitch: https://twitch.tv/adversaryvillage

Discord: https://discord.gg/defcon

AVV - Saturday - 16:30-17:15 PDT

Q&A sessions will happen in DEF CON Official Discord server after each talk.

YouTube: https://www.youtube.com/channel/UCOhn9WALnpb5YAbW18R1Hzg

Twitch: https://twitch.tv/adversaryvillage

Discord: https://discord.gg/defcon

APV - Saturday - 12:00-14:30 PDT

YouTube: https://www.youtube.com/c/appsecvillage

AVV - Saturday - 11:00-13:15 PDT

Q&A sessions will happen in DEF CON Official Discord server after each talk.

YouTube: https://www.youtube.com/channel/UCOhn9WALnpb5YAbW18R1Hzg

Twitch: https://twitch.tv/adversaryvillage

Discord: https://discord.gg/defcon

PHV - Saturday - 10:00-10:59 PDT

YouTube: https://youtube.com/wallofsheep

Twitch: https://twitch.tv/wallofsheep

Facebook: https://www.facebook.com/wallofsheep/

Periscope: https://www.periscope.tv/wallofsheep

BICV - Saturday - 14:30-14:30 PDT

YouTube: https://www.youtube.com/c/BlacksInCybersecurity

BHV - Saturday - 16:45-16:59 PDT

YouTube: https://www.youtube.com/channel/UCm1Kas76P64rs2s1LUA6s2Q

APV - Saturday - 15:00-15:45 PDT

YouTube: https://www.youtube.com/c/appsecvillage

HHV - Saturday - 12:00-12:59 PDT

#hhv-challenge-text https://discord.com/channels/708208267699945503/739567199647301702

Twitch: https://twitch.tv/dchhv

Twitch: https://www.twitch.tv/dchhv

DC - Saturday - 12:30-12:50 PDT

REFERENCES

I. Microsoft Windows DNS Update algorithm explained - https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/configure-dns-dynamic-updates-windows-server-2003 II. An excellent blog post by Matthew Bryant on hijacking DNS Updates abusing a dangling domain issue on Guatemala State's Top Level Domain - https://thehackerblog.com/hacking-guatemalas-dns-spying-on-active-directory-users-by-exploiting-a-tld-misconfiguration/

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=72uzIZPyVjI

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Shir%20Tamari%20Ami%20Luttwak%20-%20A%20new%20class%20of%20DNS%20vulnerabilities%20affecting%20many%20DNS-as-Service%20platforms.mp4

This talk has also been pre-recorded and will be broadcast on DCTV2, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_two

ASV - Saturday - 09:00-17:59 PDT

Day 1: Aug. 6th, 2021 9:00AM – 6:00PM PDT (UTC-7) Day 2: Aug. 7th, 2021 9:00AM – 6:00PM PDT (UTC-7)

Registration available at https://aisac.cyberskyline.com/defcon

Aviation ISAC is hosting a competition at DC29 Aerospace Village! This competition represents a simulated airport hosted on the Cyber Skyline platform and is developed by the Department of Cyber Intelligence and Security at Embry-Riddle Aeronautical University (Prescott) and Matthew E. Luallen, Chief Executive Inventor at CybatiWorks powered by IntelliGenesis. The ethical design of the competition is achieved through investigative themes that provides a focus in blue team while still offering red team aspects.

Storyline for CTF: On 8/6, an employee from ERAU Airline noticed a USB stick inside one of their kiosks. After further investigation, airport security suspects someone is carrying out an attack against the airport. You have been brought in to retrace the steps of the attackers, determine where security needs to be hardened, regain control of compromised systems, and prevent a successful attack at the airport. Identify the criminals by retracing their steps and utilizing OSINT to identify which suspects need to be arrested. Investigators have not ruled out insider threats which means you must remain undetected by airport staff while you attempt to regain control of the airport’s infrastructure. Good Luck and remember to register ahead of time!

CybatiWorks part of the CTF Stage 7: Runway Lighting System: The Runway Lighting System (RLS) was taken over by the attackers and the lights are operating erratically. Identify what the attackers have changed causing the RLS HMI systems to work improperly and regain access to the remote logic controller operating the runway lights. Update the logic on the HMI system, regain control of the remote logic controller and successfully operate the RLS.

Architecture Design: The competitors are provided with a CybatiWorks custom docker image that they use to gain access to the operator and maintenance HMI logic. The competitors will review and update the logic to match the documentation provided in stage 4. Once the local components are successfully completed the competitors will request access to the remote RLS logic controller (i.e. a Raspberry PI with a 3d printed/LED runway lighting system accessible via a VPN). The competitors will complete additional challenges to confirm the logic program and then remotely control the RLS. All remote RLS stations will be visible

SOC - Saturday - 13:00-23:59 PDT

ASV - Saturday - 10:00-15:59 PDT

WS - Saturday - 15:00-18:59 PDT

Registration Link: https://www.eventbrite.com/e/advanced-wireless-attacks-against-enterprise-networks-las-vegas-5-6-tickets-162214769743

Prerequisites

A previous wireless security background is helpful but certainly not required.

Materials needed:
- Students will be required to provide their own laptops, which must meet the following requirements:

• must be capable of running virtualization software such as VMWare or VirtualBox
• must have at least 100gb of free disk space OR have a free USB port and supplementary external hard drive with at least 100gb of free disk space available
• must be provisioned with a 64-bit operating system

Corporate / managed laptops are not recommended due to software restrictions.

DC - Saturday - 16:00-16:59 PDT

REFERENCES

https://www.crowdstrike.com/blog/cve-2021-1678-printer-spooler-relay-security-advisory/ https://labs.f-secure.com/archive/practically-exploiting-ms15-014-and-ms15-011/ https://www.securityfocus.com/bid/1616/info

--

This talk has been released to the DEF CON Media server.

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Sagi%20Sheinfeld%20Eyal%20Karni%20Yaron%20Zinar%20-%20Using%20Machine-in-the-Middle%20to%20Attack%20Active%20Directory%20Authentication%20Schemes.mp4

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_three

RCV - Saturday - 10:00-10:30 PDT

YouTube: https://www.youtube.com/c/ReconVillage

ASV - Saturday - 11:30-12:59 PDT

For more information, please see https://aerospacevillage.org/events/upcoming-events/def-con-29/aiaa-cubesat-hacking-workshop/

ASV - Saturday - 14:00-15:59 PDT

For more information, please see https://aerospacevillage.org/events/upcoming-events/def-con-29/aiaa-cubesat-hacking-workshop/

HRV - Saturday - 13:30-14:30 PDT

For more information, see https://hamvillage.org/dc29.html

Twitch: https://www.twitch.tv/hamradiovillage

#hrv-presentation-text: https://discord.com/channels/708208267699945503/736674835413073991

HRV - Saturday - 11:00-11:59 PDT

For more information, see https://hamvillage.org/dc29.html

Twitch: https://www.twitch.tv/hamradiovillage

#hrv-presentation-text: https://discord.com/channels/708208267699945503/736674835413073991

WS - Saturday - 15:00-18:59 PDT

Registration Link: https://www.eventbrite.com/e/analysis-101-and-102-for-the-incident-responder-las-vegas-1-2-tickets-162220226063

Prerequisites

None

Materials needed:
Laptop with Wireshark installed

ASV - Saturday - 10:00-15:59 PDT

APV - Saturday - 17:45-17:50 PDT

YouTube: https://www.youtube.com/c/appsecvillage

PHV - Saturday - 09:00-10:59 PDT

ASV - Saturday - 10:00-15:59 PDT

CLV - Saturday - 11:30-12:15 PDT

YouTube: https://www.youtube.com/cloudvillage_dc

CLV - Saturday - 13:50-14:35 PDT

• Azure Ad Overview Roles, terminology
• Understand Active directory with azure
• Azure AD security features Attacking
• Azure Ad (Techniques)
  • Unauth Recon
  • Password Sniper
  • MsOnline Powershell Module
  • PHS
  • Backdoor Azure
  • SSO
  • Spn scanning
  • DcShadow Attack
  • Group Policy, etc.
• Defense Azure Ad Suggestions

YouTube: https://www.youtube.com/cloudvillage_dc

IOTV - Saturday - 10:00-18:30 PDT

BICV - Saturday - 10:30-10:30 PDT

In1982, CompTIA was started under another name, yet still CompTIA. In 1989, SANS/GIAC was started and in 1992, ISC2 released the CBK that would 2 years later become the CISSP. In 2001, the EC Council formed in response to the attacks on the World Trade Center. Before these so-called cybersecurity certifications, how did the founders and instructors get certified to even instruct or create these organizations? Materials such as the Rainbow Books Series were the mainstay in the Trust Computing Model environment that are still being implemented today, just rebranded. These institutions implemented disproportionate programs when they gained traction and Cyber specific programs became profitable without giving up their "non-profit" status.

YouTube: https://www.youtube.com/c/BlacksInCybersecurity

CPV - Saturday - 11:30-12:30 PDT

Twitch: https://www.twitch.tv/cryptovillage

YouTube: https://www.youtube.com/c/CryptoVillage

DC - Saturday - 15:00-15:59 PDT

In the first phase of this talk, we will discuss exploitation of the bootloaders in modern Android smartphones, demonstrating weaknesses which allow for bypassing bootloader unlocking restrictions, decryption of protected user data, and deployment of malicious software to devices using full disk encryption.

In the second phase, we will discuss bootloader weaknesses in the secondary hardware used by smartphones. Using an embedded RF chip as a target, we will demonstrate reverse engineering techniques which identified weaknesses in the signature verification mechanisms of the firmware update protocols used by the bootloader, allowing for deployment of custom firmware to the chip.

REFERENCES

Travis Goodspeed - Great Ideas in Reversing the Tytera MD380: https://nullcon.net/website/archives/ppt/goa-16/Great-Ideas-in-Reversing-the-Tytera-MD380-by-Travis-Goodspeed.pdf Roee Hay - fastboot oem vuln: Android Bootloader Vulnerabilities in Vendor Customizations: https://www.usenix.org/system/files/conference/woot17/woot17-paper-hay.pdf

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=z4gIxdFfJDg

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Christopher%20Wade%20-%20Breaking%20Secure%20Bootloaders.mp4

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_three

DC - Saturday - 12:00-12:59 PDT

REFERENCES

- Yarden Shafir and Alex Ionescu, PrintDemon: Print Spooler Privilege Escalation, Persistence & Stealth (CVE-2020-1048 & more) - https://windows-internals.com/printdemon-cve-2020-1048/ - voidsec, CVE-2020-1337 – PrintDemon is dead, long live PrintDemon! - https://voidsec.com/cve-2020-1337-printdemon-is-dead-long-live-printdemon/ - Zhipeng Huo and Chuanda Ding, Evil Printer: How to Hack Windows Machines with Printing Protocol - https://media.defcon.org/DEF CON 28/DEF CON Safe Mode presentations/DEF CON Safe Mode - Zhipeng-Huo and Chuanda-Ding - Evil Printer How to Hack Windows Machines with Printing Protocol.pdf - Pentagrid AG, Local Privilege Escalation in many Ricoh Printer Drivers for Windows (CVE-2019-19363) - https://www.pentagrid.ch/en/blog/local-privilege-escalation-in-ricoh-printer-drivers-for-windows-cve-2019-19363/ - space-r7, Add module for CVE-2019-19363 - https://github.com/rapid7/metasploit-framework/pull/12906 - Microsoft, Point and Print with Packages - https://docs.microsoft.com/en-us/windows-hardware/drivers/print/point-and-print-with-packages - Microsoft, Driver Store - https://docs.microsoft.com/en-us/windows-hardware/drivers/install/driver-store - Microsoft, Printer INF Files - https://docs.microsoft.com/en-us/windows-hardware/drivers/print/printer-inf-files - Microsoft, Use Group Policy settings to control printers in Active Directory - https://docs.microsoft.com/en-us/troubleshoot/windows-server/printing/use-group-policy-to-control-ad-printer

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=vdesswZYz-8

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Jacob%20Baines%20-%20Bring%20Your%20Own%20Print%20Driver%20Vulnerability.mp4

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_three

BTV - Saturday - 14:00-15:30 PDT

In this workshop we will walk through a quick forensic triage of the "compromised" BTV Capstone servers.

Capstone is a Blue Team Village initiative to build and attack servers (and workstations) in a controlled environment, using common attacker techniques and tools in a safe way. We then use common Blue Team defender tools to gather information and review those machines, in order to train defenders on detecting, handling, and understanding common attacks.

This is the forensics workshop, and it will cover forensic triage. It's goal is to quickly answer some basic questions like:

Did Something Happen?
If So, When Did it Happen?
What Artifacts Can Help Us?
What Forensic Tools Can Help Us?
What Should We Look at Next?

The Capstone Project will provide the Telemetry and Artifacts to the community so they can use their own tools to explore the data and share findings. We encourage everyone at every level to participate and share findings - so everyone can learn and collaborate.

BTV - Saturday - 11:00-12:30 PDT

Attendees will be exposed to a number of different tools including...

REMnux
DnSpy
oletools
CyberChef
xlmdeobfuscator
shell2exe
EXCELntDonut
Invoke-Obfuscation

Target audience

SOC analysts
Forensic investigators and junior malware analysts Red team/pen testers
Anyone interested in the topic

WS - Saturday - 10:00-13:59 PDT

What to know before
- Basic idea of bugs (and bounty hunting) - Basic Linux commands (sed, awk, grep) - Shell scripting basics
- Have some practice doing recon

What you will learn
- How bug bounty programs/platforms work - What tools hunters use and how do they work - How to hunt for bugs (hopefully for profit) - Automatization of your hunting process

How technical is the class
- 30% theory and concepts
- 70% Installing, configuring and using tools to find bugs. Send some reports if we are lucky.

What tools are we going to use
- Scanners/automated tools: nuclei, axiom, bbrf, dalfox, Burp. - Recon tools (subfinder, amass, assetfinder, waybackurls, httpx and more)

What to read/watch in advance
- Books

• The Web Application Hacker's Handbook, 2nd Edition
• Hands-On Bug Hunting for Penetration Testers (Joseph E. Marshall)
• Web Hacking 101 (Peter Yaworski) - Videos
• Live Recon and Distributed Recon Automation Using Axiom with @pry0cc (https://bit.ly/3gPsonz) The Bug Hunter's Methodology Full 2-hour Training by Jason Haddix (https://bit.ly/2PzHUsr)
• Finding Your First Bug: Choosing Your Target by InsiderPhD (https://bit.ly/3uiF3n7)
• HOW TO GET STARTED IN BUG BOUNTY (9x PRO TIPS) by STÖK (https://bit.ly/3u81U4m)

Registration Link: https://www.eventbrite.com/e/bug-bounty-hunting-workshop-tickets-162219297285

Prerequisites

Basic knowledge about Bug bounty programs Basic Linux Commands

Materials needed:
Laptop with Kali Linux (native or virtual machine).

CHV - Saturday - 14:00-14:59 PDT

This talk will stream on YouTube.

YouTube: https://www.youtube.com/watch?v=3elYcORppls

AVV - Saturday - 17:15-18:15 PDT

Unfortunately, open source tools for threat emulation currently have limited support for such advanced features, leaving redteams with easy to detect C2 communications. We present C2Centipede, a proxy tool that provides these features to HTTP reverse shell tools (like Metasploit or Empire) to be stealthier on the network by dynamically and transparently modifying the trojan’s C2 communication routing and beaconing strategies, with the aim of evading some of the blueteam’s detection strategies.

BEACONING EVASION

Detection of HTTP reverse shell beaconing activity is possible because most of the patterns on which malware sends the beacons through the network can be identified as they occur in static time intervals or are adjusted in specific increments, attributes which are possible to detect using statistical analysis.[1]

For instance, Metasploit’s reverse_http meterpreter sends a message to the C2 server every 100 milliseconds and increases the interval by this same measure each time the C2 server gives no new jobs to the trojan, up to a maximum of 10 seconds.[2]

It is easy then for tools like RITA to perform statistical analysis on the number, timing and size of connections between pairs of hosts (source, destination)[3]. This IP-pair evaluation works in the most typical approach of having only one IP per C2 server. We implement a beaconing detection evasion method that works by 1) Altering the trojan’s C2 communication message interval and 2) Splitting and routing the C2 communication among many C2 server addresses to hide beaconing and exfiltration.

JITTER MODIFICATION

The Achille’s heel of most RAT (Remote Access Trojan) and TES (Threat Emulation Software) tools network stealthiness is fixed beaconing intervals. The time interval between each message that goes to the C2 server is usually hardcoded and just too short, making manyrequests across the network, so we have incorporated in the tool, better control of the beaconing, with the possibility of modifying the jitter on the fly or having preset configurations, like allowing C2 communication just on certain time window.

Some RAT/TES tools will fail after a specific amount of unsuccessful C2 communication attempts, so the C2Centipede proxy client cannot just drop the HTTP calls that don’t fit the operator’s beaconing strategy, therefore fake C2 response messages are generated in order to keep the trojan alive.

FAUX FLUX

The concept of Fast Flux networks as a technique to improve a botnet’s C2 availability has been in use since 2007-2008.[4] Using this technique, an attacker can hide the real C2 server behind proxies (which are usually compromised edge servers in a botnet), and distributing said proxies IPs through DNS records with a very low TTL[5], allowing them to rapidly (and thus the name fast flux) change the resolved IP for a given domain name. This results in making the shutdown of each C2 IP so difficult as to be usually compared to a whack a mole game.[4] The weakness of this approach is the reliance on a domain name[5], which can be sinkholed by the domain name registrar, as in the case of the shutdown of the Conficker botnet.[4] Some of the common detection methods for Fast Flux networks is the low TTL (time to live) of the record and a high number of IPs resolved for that record.[3]

We have incorporated the C2 proxying technique without the DNS and botnet requirements by utilizing open reverse tcp/http tunnels found on the internet, which provide plenty of IP addresses on which we can spread our C2 comms and provide anonymity as the real C2 server is hidden behind the reverse proxy. In our most recent internet-wide survey we found more than 1.5K servers that could be abused for this purpose

MULTIFRONTING

Domain fronting (ATT&CK T1090.004) is a widely used technique for evading network detection. This technique hides the trojan’s HTTP requests to the C2 as if it was directed to another domain hosted on the same Content Delivery Network (CDN) as the attacker’s. Without TLS inspection, where a mismatch between TLS’s SNI and the HTTP header could be detected, it becomes very hard for the defenders to detect malicious traffic using this technique, having as a last resource the detection via statistical analysis like beaconing detection.

C2Centipede has the ability to utilize multiple domain fronting configurations, which are not necessarily on the same CDN, this provides additional resilience in case one of the CDN providers blocks the redteamer’s account.

DOMAIN GENERATION ALGORITHMS

We have incorporated Flubot’s algorithm for Domain Generation Algorithm (ATT&CK: T1568.002). The seed, and maximum number of domains generated are easily configurable.

DYNAMIC PROXY CONFIGURATION

C2Centipede’s configuration on the server and client can be modified on the fly by the operator. The original trojan’s and C2 messages are wrapped in the tool’s own HTTP messages along with the configuration changes of the routing, jitter and encryption settings for the c2centipede client and server. These are piggybacked on the original HTTP requests, requiring no additional “noise” in the network.

LIMITATIONS

The tool currently works with reverse HTTP shells that close the TCP connections (eg. Metasploit, Empire) and currently does not support those with long connections (eg. PoshC2, Koadic)

Q&A sessions will happen in DEF CON Official Discord server after each talk.

YouTube: https://www.youtube.com/channel/UCOhn9WALnpb5YAbW18R1Hzg

Twitch: https://twitch.tv/adversaryvillage

Discord: https://discord.gg/defcon

ASV - Saturday - 09:00-16:59 PDT

Starts August 7, 2021@ 9 AM PST,
Ends Aug 8, 2021 5 PM PST

Registration available at https://www.cognitoforms.com/CCI17/CaliforniaCyberInnovationChallengeAEROSPACEVILLAGEDEFCON2021

The CCIC promotes Gamification & Esports for Space and Cybersecurity Skills Development. This is an electronic game of clue that has characters and threat actors or the person(s) who committed the Space and Cyber crime. Find the person(s) of interest that you think committed the crime. You are Cybernauts and Cyber Sleuth Analysts. Remember, throughout the challenge, record and take notes of all information, findings, evidence, and clues regarding characters you encounter. Take note of technical skills you executed to create a digital forensics analysis report of who committed the crime and their motives.

About the Crime:

A multi-billion dollar company led by CEO, William Gecko, Moonshot Satellite’s constellation of 5000 CubeSat’s, located in Low Earth Orbit (LEO), provides a mesh-network of internet access to over 20 million commercial and governmental customers around the globe. Moonshot Satellite, a small cube satellite company whose constellation satellite infrastructure provides communication services that deliver Internet access to over 200 million individual commercial customers and real-time communications support for numerous government agencies.

RCV - Saturday - 11:20-11:50 PDT

YouTube: https://www.youtube.com/c/ReconVillage

APV - Saturday - 17:00-17:45 PDT

YouTube: https://www.youtube.com/c/appsecvillage

CAHV - Saturday - 14:00-14:59 PDT

This talk will be available on YouTube: https://www.youtube.com/watch?v=oozqj7axNYM

YouTube: https://youtube.com/careerhackingvillage

DC - Saturday - 15:00-15:45 PDT

The presentation will end with a summary of identified threats and weaknesses of a two-tier retail central bank digital currency prototype and how to handle them. The goal of the presentation is to give the attendees insight of the security implications, challenges depending on the design and where an attack can be carried out and everything that cannot be missed when designing a CBDC.

REFERENCES

https://www.ingwb.com/media/3024436/solutions-for-the-corda-security-and-privacy-trade-off_-whitepaper.pdf https://d3js.org/

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=-MK0bn3Ys_M

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Ian%20Vitek%20-%20Central%20bank%20digital%20currency%2C%20threats%20and%20vulnerabilities.mp4

This talk has also been pre-recorded and will be broadcast on DCTV2, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_two

BCV - Saturday - 13:00-13:30 PDT

https://soundcloud.com/abstrct/saturday-morning-quarantoons-ep46 https://imgur.com/m5Jcql2
https://twitter.com/Abstr_ct
https://www.twitch.tv/abstr_ct

DC - Saturday - 09:00-20:59 PDT

There will be chill music playing:

09:00-12:00 DJ Pie & Darren
12:00-13:30 kampf
13:30-15:00 Merin MC & Rusty
15:00-18:00 Brian Behlendorf
19:00-21:00 djdead

You can also watch the chill room stream on Twitch.

Twitch: https://www.twitch.tv/defcon_chill

BHV - Saturday - 11:00-11:59 PDT

YouTube: https://www.youtube.com/channel/UCm1Kas76P64rs2s1LUA6s2Q

BHV - Saturday - 12:30-13:30 PDT

YouTube: https://www.youtube.com/channel/UCm1Kas76P64rs2s1LUA6s2Q

CON - Saturday - 10:00-15:59 PDT

DC - Saturday - 11:30-12:30 PDT

Register here: https://us02web.zoom.us/meeting/register/tZAlc-2pqT8uHNARKeSvxvivpQHj3UYH3hwV

DC - Saturday - 16:00-16:59 PDT

For virtual access, register here: https://us02web.zoom.us/meeting/register/tZItdOCsqDouHd3-on_4mXNeaIsDQhq7HEz1

DC - Saturday - 13:00-14:59 PDT

Part 2:
If it's Tuesday, it must be another ransomware attack. So what is a law-abiding company to do? If they pay, it just encourages the attacks. If they don't, then their business may suffer, or worse. Meanwhile, breach-notification regulation may have started a ticking clock forcing their hand – potentially in ways that are counter-productive to other policy efforts to stem the tide of these attacks. In this session we'll confront the practical realities and policy dilemmas these attacks provoke.

For virtual access, register here: https://us02web.zoom.us/meeting/register/tZYvduuorzgtG9MAPy9QjVRAaaC4JKIu89aq

DC - Saturday - 10:00-10:59 PDT

For virtual access, register here: https://us02web.zoom.us/meeting/register/tZcud-Gprj8qE92RoBYuXTWhhHsakUjGvoLc

DC - Saturday - 16:00-16:59 PDT

Register here: https://us02web.zoom.us/meeting/register/tZUlfu6hqTMoGtxIQ8TXdKvAUL4gZLj9x_o8

DC - Saturday - 10:00-10:59 PDT

ICSV - Saturday - 14:00-14:30 PDT

YouTube: https://www.youtube.com/channel/UCI_GT2-OMrsqqglv0JijHhw

#ics-speaker-questions-and-answers-text: https://discord.com/channels/708208267699945503/735937961908109485

DC - Saturday - 10:00-10:45 PDT

Containers on a mainframe? For real. IBM zCX is a Docker environment running on a custom Linux hypervisor built atop z/OS - IBM’s mainframe operating system. Building this platform introduces mainframe environments to a new generation of cloud-native developers-and introduces new attack surfaces that weren’t there before.

In this crossover episode, we’re going to talk about how two people with two very particular sets of skills went about breaking zCX in both directions, escaping containers into the mainframe host and spilling the secrets of the container implementation from the mainframe side.

When two very different technologies get combined for the first time, the result is new shells nobody’s ever popped before.

REFERENCES: Getting started with z/OS Container Extensions and Docker: https://www.redbooks.ibm.com/abstracts/sg248457.html The Path Less Traveled: Abusing Kubernetes Defaults: https://www.youtube.com/watch?v=HmoVSmTIOxM Attacking and Defending Kubernetes Clusters: A Guided Tour: https://securekubernetes.com Evil Mainframe penetration testing course :https://www.evilmainframe.com/ z/OS Unix System Services (USS): https://www.ibm.com/docs/en/zos/2.1.0?topic=system-basics-zos-unix-file z/OS Concepts: https://www.ibm.com/docs/en/zos-basic-skills?topic=zc-zos-operating-system-providing-virtual-environments-since-1960s Docker overview: https://docs.docker.com/get-started/overview/

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=7DXF7YDBf-g

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Ian%20Coldwater%20Chad%20Rikansrud%20%28Bigendian%20Smalls%29%20-%20The%20Real-Life%20Story%20of%20the%20First%20Mainframe%20Container%20Breakout.mp4

This talk has also been pre-recorded and will be broadcast on DCTV2, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_two

CCV - Saturday - 16:30-16:59 PDT

The Cryptocurrency Village is conveniently located in Paris Champagne Ballroom 1.

APV - Saturday - 12:00-12:45 PDT

YouTube: https://www.youtube.com/c/appsecvillage

CLV - Saturday - 13:30-13:50 PDT

YouTube: https://www.youtube.com/cloudvillage_dc

ICSV - Saturday - 10:00-11:59 PDT

YouTube: https://www.youtube.com/channel/UCI_GT2-OMrsqqglv0JijHhw

#ics-speaker-questions-and-answers-text: https://discord.com/channels/708208267699945503/735937961908109485

HTSV - Saturday - 12:00-12:55 PDT

Twitch: https://www.twitch.tv/h4ckthesea

YouTube: https://www.youtube.com/channel/UC5htD_rPiP8N7v8VQKyJkOQ

HTSV - Saturday - 14:00-14:55 PDT

Twitch: https://www.twitch.tv/h4ckthesea

YouTube: https://www.youtube.com/channel/UC5htD_rPiP8N7v8VQKyJkOQ

HTSV - Saturday - 11:00-11:55 PDT

Twitch: https://www.twitch.tv/h4ckthesea

YouTube: https://www.youtube.com/channel/UC5htD_rPiP8N7v8VQKyJkOQ

CON - Saturday - 09:00-16:59 PDT

DDV - Saturday - 10:00-09:59 PDT

Pick your drives full of data anytime 14-24 hours after drop off.

Last chance pickup is Sunday from 10:00 to 11:00.

Yes, 6TB and larger drives are accepted.

Any drives not picked up by Sunday at 11:00am are considered donated to the DDV.

See https://dcddv.org/dc29-schedule for more information.

SOC - Saturday - 17:00-18:59 PDT

ASV - Saturday - 11:00-11:59 PDT

• You’ll need a laptop with internet connection for this workshop

ASV - Saturday - 10:00-15:59 PDT

CON - Saturday - 10:00-19:59 PDT

DC - Saturday - 09:00-16:59 PDT

1st you will pass through the vaccination check line, providing whatever original documentation your health care provider or vaccination center gave you. It will be checked against your State issued ID to make sure the names match, the dates are good, and that enough time has passed for you to be fully vaccinated, etc. We will not record your ID or records. If all is good you will get a WRISTBAND you must wear during the con.

2nd Next you head to the badge pickup desks. There you will show your wristband and your in-person badge bar code and get it scanned. If the scan passes you get your Human reg pack.

Where to register / pick up badges: Paris, near the InfoBooth. Please find "REGISTRATION" on the provided DC29 floorplan (available in HackerTracker and online).

Both registration and the vaccine check processing functions are planning to be available from 8am/08:00 to 5pm/17:00. If those times change, this schedule entry will be updated in HackerTracker and info.defcon.org as soon as possible.

DC - Saturday - 20:00-21:59 PDT

DC - Saturday - 13:00-13:45 PDT

https://www.youtube.com/channel/UCzZK3vjJL9rKNPXNoCPFO5g/videos

This talk focuses on the communication lines in physical intrusion detection systems: how they are secured, and what vulnerabilities exist. We’ll discuss the logic implemented in the controllers and protections on the communication lines including end of line resistors - and all the ways that this aspect of the system can be exploited.

In particular, we’ll release schematics for a tool we’ve developed that will enable measuring end-of-line resistor systems covertly, determining the necessary re-wiring to defeat the sensors, and deploy it without setting off the alarm.

After the talk, you can head over to the Lock Bypass Village to try these techniques out for yourself!

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=Liz9R_QxSgk

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Bill%20Graydon%20-%20Defeating%20Physical%20Intrusion%20Detection%20Alarm%20Wires.mp4

This talk has also been pre-recorded and will be broadcast on DCTV2, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_two

ASV - Saturday - 11:30-11:55 PDT

This talk will be streamed on YouTube: https://www.youtube.com/watch?v=XEN9LTOUFFQ

YouTube: https://www.youtube.com/c/AerospaceVillage

DL - Saturday - 10:00-11:50 PDT

Short Abstract:
In modern embedded systems that implement a “secure boot” flow, the boot loader plays a critical role in establishing the integrity and authenticity of software and data required to boot an operating system. Given the role and vantage point of boot loaders, they are a particularly interesting target for hardware hackers seeking to root a device and instrument it for further vulnerability hunting and reverse engineering. Although the vast majority of devices leveraging the ubiquitous and open source U-Boot boot loader leave it unprotected and trivially exploited, more product vendors are finally implementing secure boot and (attempting to) lock down their U-Boot builds. These less common specimen offer exciting opportunities to pursue creative bypasses and explore underappreciated U-Boot functionality.

The Depthcharge framework was developed to help hardware hackers methodically (ab)use some of that underappreciated U-Boot functionality in novel ways to circumvent boot-time protections, as well as expedite the identification and exploitation of “the usual suspects” within exposed U-Boot device consoles. The project includes a Python 3 library for interfacing with devices, reading and writing memory via available primitives, deploying executable payloads, and analyzing various data structures. A collection of scripts built atop of library make this functionality readily available via the command line, and “Depthcharge Companion” firmware allows the tooling to extend its vantage point by presenting itself as a peripheral device connected to the target. This Demo Lab will introduce the basics of Depthcharge and explore how attendees can leverage and expand upon it when seeking to circumvent boot-time protections or just to further explore a system from within the U-Boot environment. For those wishing to protect their (employer’s) products from fellow DEF CON attendees, we’ll also cover the configuration checker functionality that can be used to avoid common U-Boot pitfalls.

Developer Bio:
Jon Szymaniak is Principle Security Consultant in NCC Group’s Hardware & Embedded Systems Services team and a former embedded systems engineer. His areas of interest include U-Boot, Linux, Yocto, and firmware reverse engineering. Through both his day job and hobby hacking adventures, he’s enjoyed exploring and exploiting boot ROMs, automotive ECUs, Android-based platforms, and a myriad of Internet-connected things that shouldn't be.

URLs

GitHub: https://github.com/nccgroup/depthcharge Documentation: https://depthcharge.readthedocs.io

Blog Posts and Prior Presentations:
Blog: https://research.nccgroup.com/2020/07/22/depthcharge/ Hardwear.io Webinar: https://www.youtube.com/watch?v=fTKMi3Is5x8 Blog: https://research.nccgroup.com/2020/1...hcharge-v0-2-0 OSFC Presentation: https://vimeo.com/488134063 Detailed Explanation:
Additional detail can be found here in the project documentation: https://depthcharge.readthedocs.io/e...is-depthcharge

The Depthcharge project aims to allow hackers, security practitioners, and engineering teams a way to “work smarter” when attempting to root a device or evaluate its security posture. This not only includes gaining control of a target’s U-Boot execution, but also leveraging the bootloader as a vantage point to further explore the target system.

The Python 3 Depthcharge API can be leveraged to enumerate functionality exposed by a U-Boot console and identify memory read/write primitives. Memory access abstractions built atop of these primitives seek to make dumping device firmware quicker and more robust, and custom payload deployment easier. With its colorized serial monitor, Depthcharge provides a more pleasant environment for hacking around and scripting while within a device’s U-Boot console. The “Companion” firmware extends Depthcharge reach into a target platform, allowing it to act as a “malicious” peripheral device (e.g. on an I2C bus). While much of the project focuses on console exposure, it also include some data structure identification (e.g. stored environments) functionality aimed at situations where such functionality is not available. For engineers and those on the “blue team” — build configuration checker functionality can help raise red flags and detect U-Boot pitfalls much earlier in the product development lifecycle.

Target Audience:
Hardware / Embedded Systems - Both “offense” and “defense” within this audience

I believe the Depthcharge Demo Lab can show that there’s more interesting hackery to be had within the U-Boot boot loader, and that we can work much smarter when we encounter it. Given that I tend to see discussions of U-Boot limited to unprotected IoT junkware, I’ve always been bummed that folks don’t seem to get to appreciate the joy of circumventing secure boot mechanisms, or otherwise leveraging their U-Boot environment to start exploring a hardware platform and its SoC from a lower level vantage point.

Whether it be folks enjoying the abuse of a CRC32 feature as an arbitrary memory primitive, or just gaining an appreciation for how U-Boot exports functionality for use by “stand alone applications” — I hope to share some new tricks and get people excited about hacking deeper on their devices. Demos will be based upon my earlier work bypassing a (now patched) 2019 Sonos vulnerability, as well as some “previously seen on client work” vulnerabilities modeled on development kits to protect the (not so?) innocent.

Warranty voiding and custom firmware development shall be strongly encouraged.

APV - Saturday - 16:00-16:45 PDT

YouTube: https://www.youtube.com/c/appsecvillage

WS - Saturday - 10:00-13:59 PDT

Upon successful class completion, students will be able to:

Build analysis skills that leverage complex scenarios and improve comprehension. Demonstrate an understanding of forensic fundamentals used to analyze an email. Use open-source information to collect and analyze threat actor data; identify indicators of compromise, and demonstrate how to pivot on that information. Demonstrate how to analyze a malicious downloader; to include but not limited to debugging and deobfuscation. Participate in a hand to keyboard combat capstone. Students will be given a malicious file sample and demonstrate how to analyze it.

Registration Link: https://www.eventbrite.com/e/digital-forensics-and-ir-against-the-dark-arts-las-vegas-5-6-tickets-162218185961

Prerequisites

None

Materials needed:
Students will be required to download two virtual machines (OVA files). Students will be given a URL for download access. In regards to the downloaded virtual machines, these should be imported into your virtual machine software and ready before the start of class. If any additional technical support is needed, the instructors will make themselves available online.

Students must have a laptop that meets the following requirements:

• A 64 bit CPU running at 2GHz or more. The students will be running two virtual machines on their host laptop.
• Have the ability to update BIOS settings. Specifically, enable virtualization technology such as "Intel-VT."
• The student must be able to access their system's BIOS if it is password protected. This is in case of changes being necessary.
• 8 GB (Gigabytes) of RAM or higher
• At least one open and working USB Type-A port
• 50 Gigabytes of free hard drive space, allowing you the ability to host the VMs we distribute
• Students must have Local Administrator Access on their system.
• Wireless 802.11 Capability
• A host operating system that is running Windows 10, Linux, or macOS 10.4 or later.
• Virtualization software is required. The supplied VMs have been built for out of the box comparability with VMWare Workstation or Player. Students may use other software if they choose, but they may have to troubleshoot unpredictable issues.

At a minimum, the following VM features will be needed:

• NATted networking from VM to Internet
• Copy Paste of text and files between the Host machine and VM

DC - Saturday - 17:00-17:59 PDT

After the efforts of countless talented engineers in Microsoft, SharePoint has been deployed in the Microsoft cloud as part of their office 365 offering. This presentation will analyze the security architecture of SharePoint server and how it differs from other popular CMS products. From an offensive point of view, we will also reveal several attack surfaces and mitigations implemented and how those mitigations can be bypassed. Finally we will disclose several high impact vulnerabilities detailing the discovery and exploitation.

REFERENCES

1. http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/ 2. https://docs.microsoft.com/en-us/dotnet/api/system.web.ui.control 3. https://docs.microsoft.com/en-us/previous-versions/iis/6.0-sdk/ms524602(v=vs.90) 4. https://www.youtube.com/watch?v=Xfbu-pQ1tIc 5. https://www.blackhat.com/us-20/briefings/schedule/#room-for-escape-scribbling-outside-the-lines-of-template-security-20292 6. https://www.spguides.com/sharepoint-csom-tutorial/

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=mVXrl4W1jOU

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Yuhao%20Weng%20Steven%20Seeley%20Zhiniang%20Peng%20-%20don%27t%20Dare%20to%20Exploit%20-%20An%20Attack%20Surface%20Tour%20of%20SharePoint%20Server.mp4

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_three

ASV - Saturday - 15:00-15:50 PDT

This talk will be streamed on YouTube: https://www.youtube.com/watch?v=M0BDHT43Ucc

YouTube: https://www.youtube.com/c/AerospaceVillage

CON - Saturday - 20:00-21:59 PDT

Twitter: https://twitter.com/drunkhackerhist?lang=en

BCV - Saturday - 12:00-12:59 PDT

IOTV - Saturday - 15:45-16:15 PDT

Governance and policing of Internet of Things devices is growing to cover the upcoming trail of destruction by flailing technical solutions, but some intriguing key unanswered questions are starting to reveal themselves.

In this talk, we’ll dive into what the sociotechnical problem of ethics means at the edge in the context of machine learning/artificial intelligence and address these questions:

1. Individual vectors of ethics (“Sustainability is an ethical principle?” “Edge devices have their own definition of fairness and bias different from human concepts?”)
2. Evolving principles and governance for IoT devices, and the importance of accountable anonymity
3. Definitions of trusted entities (“When are users a threat?” “Should humans be out of the loop?”), and how key ethical principles, such as privacy and transparency, can be a double-edged sword in the context of IoT security.
4. Incorporating morality into machines is now a reality (“How do we define a calculus and value alignment for IoT ethics?”) - what are key unconventional ethical concerns for human-centered design?

Twitch: https://www.twitch.tv/iotvillage

WS - Saturday - 15:00-18:59 PDT

In this workshop, we will:

i. Understand the use and employment of obfuscation in red teaming. ii. Demonstrate the concept of least obfuscation. iii. Introduce Microsoft's Antimalware Scan Interface (AMSI) and explain its importance. iv. Demonstrate obfuscation methodology for .NET payloads.

Registration Link: https://www.eventbrite.com/e/evading-detection-a-beginners-guide-to-obfuscation-las-vegas-3-4-tickets-162219734593

Prerequisites

Basic level of PowerShell or C# experience.

Materials needed:
- Laptop
- VMWare or Virtual Box
- Windows Dev machine or other Windows VM - Kali Linux VM

BCV - Saturday - 15:00-15:59 PDT

How can regular users identify bad projects? What can a security company do to help DeFi users and investors? We can't stop scammers from deploying contracts on the blockchain and setting up fake websites, but we can warn users to stay away from them. CertiK set up a submission form on our website for community members to report risky projects, and we will investigate them. If we find the project is risky, we will publish an alert on our website and Twitter account.

We reviewed more than 50 submissions from community members and identified around 15 risky projects in the past. At the Defcon blockchain village, we want to share our work for the past couple of months. In this talk, we will do a case study to demonstrate different types of scams; we will also talk about how scammers earn trust from users and how we investigate user submitted projects.

CLV - Saturday - 10:00-10:45 PDT

YouTube: https://www.youtube.com/cloudvillage_dc

ASV - Saturday - 12:00-12:25 PDT

An avid aviation enthusiast, Larry holds commercial pilot and flight instructor certificates in both land and sea, and travels in his own aircraft whenever possible.

This talk will be streamed on YouTube: https://www.youtube.com/watch?v=jcyL0zPNEuA

YouTube: https://www.youtube.com/c/AerospaceVillage

ICSV - Saturday - 12:00-12:59 PDT

YouTube: https://www.youtube.com/channel/UCI_GT2-OMrsqqglv0JijHhw

#ics-speaker-questions-and-answers-text: https://discord.com/channels/708208267699945503/735937961908109485

ICSV - Saturday - 13:30-13:59 PDT

This talk will explain important elements of hardening as well as things to keep in mind when performing cybersecurity testing during FAT/SAT phases after performing said hardening.

YouTube: https://www.youtube.com/channel/UCI_GT2-OMrsqqglv0JijHhw

#ics-speaker-questions-and-answers-text: https://discord.com/channels/708208267699945503/735937961908109485

SOC - Saturday - 12:00-12:59 PDT

SOC - Saturday - 17:00-17:59 PDT

WS - Saturday - 10:00-13:59 PDT

Customers expect web applications to provide significant functionality and data access. Even beyond the importance of customer-facing web applications, internal web applications increasingly represent the most commonly used business tools within any organization. Unfortunately, there is no "patch Tuesday" for custom web applications, so major industry studies find that web application flaws play a major role in significant breaches and intrusions.

In this workshop we will teach you how to find vulnerabilities in web security according to the latest methods and techniques. We will demonstrate every vulnerability by giving an example from vulnerability we have found in major tech companies like: Facebook, WhatsApp, Amazon, AliExpress, Snapchat, LG and more!

Registration Link: https://www.eventbrite.com/e/from-zero-to-hero-in-web-security-research-jubilee-2-tickets-162214757707

Prerequisites

Basic Web Concepts, Basic Web Development Skills, Ability to Understand JavaScript.

Materials needed:
Personal Laptop

CHV - Saturday - 13:00-13:59 PDT

This talk will stream on YouTube.

YouTube: https://www.youtube.com/watch?v=L7RCalagQ&feature=youtu.be

ASV - Saturday - 16:00-16:25 PDT

This talk will be streamed on YouTube: https://www.youtube.com/watch?v=D5yiIlMy2Lg

YouTube: https://www.youtube.com/c/AerospaceVillage

AVV - Saturday - 18:45-19:45 PDT

Q&A sessions will happen in DEF CON Official Discord server after each talk.

YouTube: https://www.youtube.com/channel/UCOhn9WALnpb5YAbW18R1Hzg

Twitch: https://twitch.tv/adversaryvillage

Discord: https://discord.gg/defcon

HRV - Saturday - 16:00-16:30 PDT

For more information, see https://hamvillage.org/dc29.html

Twitch: https://www.twitch.tv/hamradiovillage

#hrv-presentation-text: https://discord.com/channels/708208267699945503/736674835413073991

DL - Saturday - 12:00-13:50 PDT

Short Abstract:
Git Wild Hunt is a tool designed to search and identify leaked credentials at public repositories such as Github. Git Wild Hunt searches for footprints and patterns of over 30 of the most used secrets/credentials on the internet, especially those used in Devops and IT Operations. This tool helps developers and security operation departments discover leaked credentials in public repositories. This tool is also a recon tool for red teamers and pentesters, as it also provides metadata from leaks such as usernames, company names, secret types and dates.

License: Apache-2.0 License

Short Developer Bio:
José Hernandez @d1vious
Principal Security Researcher at Splunk. He started his professional career at Prolexic Technologies (now Akamai), fighting DDOS attacks against Fortune 100 companies perpetrated by “anonymous” and “lulzsec.” As an engineering co-founder of Zenedge Inc. (acquired by Oracle Inc.), José helped build technologies to fight bots and web-application attacks. He has also built security operation centers and run a public threat-intelligence service.

Rod Soto @rodsoto
Principal Security Research Engineer at Splunk. Worked at Prolexic Technologies (now Akamai), and Caspida. Cofounder of Hackmiami and Pacific Hackers meetups and conferences. Creator of Kommand && KonTroll / NoQrtr-CTF.

URL to any additional information: https://github.com/d1vious/git-wild-hunt

Detailed Explanation of Tool:
This tool is very effective in finding leaked credentials here is a list of the credentials that are detected: AWS API Key
Amazon AWS Access Key ID
Amazon MWS Auth Token
Facebook Access Token
Facebook OAuth
Generic API Key
Generic Secret
GitHub
Google (GCP) Service-account
Google API Key
Google Cloud Platform API Key
Google Cloud Platform OAuth
Google Drive API Key
Google Drive OAuth
Google Gmail API Key
Google Gmail OAuth
Google OAuth Access Token
Google YouTube API Key
Google YouTube OAuth
Heroku API Key
MailChimp API Key
Mailgun API Key
PGP private key block
Password in URL
PayPal Braintree Access Token
Picatic API Key
RSA private key
SSH (DSA) private key
SSH (EC) private key
Slack Token
Slack Webhook
Square Access Token
Square OAuth Secret
Stripe API Key
Stripe Restricted API Key
Twilio API Key
Twitter Access Token
Twitter OAuth
Target Audience:
Offense, Vulnerability Assessment

This tool is very effective in bringing awareness of the danger of leaked credentials in public repositories.

CPV - Saturday - 15:30-16:30 PDT

goldbug.cryptovillage.org

Twitch: https://www.twitch.tv/cryptovillage

YouTube: https://www.youtube.com/c/CryptoVillage

SOC - Saturday - 20:00-01:59 PDT

DC - Saturday - 12:30-12:50 PDT

Another stage of his career was to get involved in security contests and participated in more than 100 such contests. He also reached important finals such as Codegate, Trend Micro and Defcon with the PwnThyBytes team. He also won several individual competitions, including the mini CTF from the first edition of Appsec village - Defcon village.

Now he is doing research in the field of web application security, being also a PhD student at University Polytechnic of Bucharest. Through his research he wants to innovate in the field and to bring a new layer of security to web applications. He has also been working as a Security Researcher @Future Networks 5G Lab for a few months now and hopes to make an important contribution to the 5G security area through research.

Various automated tools have been analyzed and it has been found that these tools operate in an unsafe way. Various exploit databases were analyzed and we learned that some of these are written in an insecure (predictable) way.

This presentation will showcase the results of the research, including examples of exploits that once executed can be harmful. The data we obtain after exploitation can be accessible to other entities without the need of decrypting the traffic. The SSL/TLS specs will not change. There is a clear reason for that and in this presentation I will argue this, but what will change for sure is the way hackers will write some of the exploits.

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=WNXEuFaRUkU

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Ionut%20Cernica%20-%20Hack%20the%20hackers-%20Leaking%20data%20over%20SSL-TLS.mp4

This talk has also been pre-recorded and will be broadcast on DCTV1, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_one

HTSV - Saturday - 12:00-14:59 PDT

Come visit our Cabana Saturday from 12:00-3:00pm PST pool-side at Bally’s!

Twitch: https://www.twitch.tv/h4ckthesea

YouTube: https://www.youtube.com/channel/UC5htD_rPiP8N7v8VQKyJkOQ

ASV - Saturday - 10:00-15:59 PDT

For virtual attendees, the Digital twin demonstration will also be accessible via VNC to an instance running inside Docker containers in Amazon AWS (remote viewers will need to have a VNC client on their own computer).

CON - Saturday - 10:00-15:59 PDT

More info: https://hack3rrunway.github.io/

https://twitter.com/hack3rrunway

Also see #ce-hack3r-runway.

Register here: https://docs.google.com/forms/d/e/1FAIpQLSdua561gCbWEbGk7_ZuS7cg3w7_IFbtrahibeKsU0iR%20ENiIiw/viewform?usp=sf_link

#ce-hack3r-runway: https://discord.com/channels/708208267699945503/711644666239647824

SOC - Saturday - 20:00-22:59 PDT

CON - Saturday - 20:00-21:59 PDT

For more information, see https://forum.defcon.org/node/236486

Twitch: https://www.twitch.tv/DFIUtv

Twitter: https://twitter.com/HackerJeopardy

#ce-hacker-jeopardy-text: https://discord.com/channels/708208267699945503/732439600391389184/

SOC - Saturday - 18:00-23:59 PDT

DC - Saturday - 18:00-18:59 PDT

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_one

DC - Saturday - 15:00-15:45 PDT

As a studious sorcerer, you’ll discover how to pierce even the most fortified G Suite enterprises. You’ll learn to conjure Apps Script payloads to bypass powerful protective enchantments such as U2F, OAuth app allowlisting, and locked-down enterprise Chromebooks.

Our incantations don’t stop at the perimeter, we will also discover novel spells to escalate our internal privileges and bring more G Suite accounts under our control. Once we’ve obtained the access we seek, we’ll learn various curses to persist ourselves whilst keeping a low profile so as to not risk an unwelcome exorcism.

You don’t need divination to see that this knowledge just might rival alchemy in value.

REFERENCES

No real academic references, this is all original research gleaned from real-world testing and reading documentation.

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=6AsVUS79gLw

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Matthew%20Bryant%20-%20Hacking%20G%20Suite%20-%20The%20Power%20of%20Dark%20Apps%20Script%20Magic.mp4

This talk has also been pre-recorded and will be broadcast on DCTV1, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_one

DC - Saturday - 17:00-17:45 PDT

Less than 10 days after the AirTag release, we bypassed firmware protections by glitching the nRF52 microcontroller. This opens the AirTags for firmware analysis and modification. In this talk, we will explain the initial nRF52 bypass as well as various hacks built on top of this. In particular, AirTags can now act as phishing device by providing malicious links via the NFC interface, be cloned and appear at a completely different location, used without privacy protections that should alert users as tracking protection, act as low-quality microphone by reutilizing the accelerometer, and send arbitrary data via the Find My network. Besides these malicious use cases, AirTags are now a research platform that even allows access to the new Ultrawide-band chip U1.

REFERENCES

LimitedResults nRF52 APPROTECT Bypass: https://limitedresults.com/2020/06/nrf52-debug-resurrection-approtect-bypass/

Positive Security’s Send My Research for sending arbitrary data via the find my network: https://positive.security/blog/send-my

Colin O’Flynn’s notes on the AirTag Hardware: https://github.com/colinoflynn/airtag-re

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=paxErRRsrTU

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Thomas%20Roth%20-%20Hacking%20the%20Apple%20AirTags.mp4

This talk has also been pre-recorded and will be broadcast on DCTV2, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_two

WS - Saturday - 10:00-13:59 PDT

Registration Link: https://www.eventbrite.com/e/hacking-the-metal-an-introduction-to-assembly-language-programming-lv-34-tickets-162218563089

Prerequisites

Some previous programming experience is helpful but not vital.

Materials needed:
Laptop

ASV - Saturday - 10:00-15:59 PDT

HRV - Saturday - 12:00-17:59 PDT

Register here: https://ham.study/sessions/60fa327596cc8a184ebc8f89/1

HHV - Saturday - 08:30-08:59 PDT

We misuse the trust the operating system places on USB human-interaction devices to demonstrate once again the old adage that if you can physically access a computing device, there is no real security to be had. I will review hardware, its capabilities, how to breach OS security, and how attackers can enable it to perform a variety of tasks with its own tools. I will then show how to build and install additional software and customize the device with binary or scripted payloads.

We take the discussion to the next level by removing the need for a device and exploring attacks that can be delivered directly by a plain USB cable. We dissect easily-sourced, low-cost hardware implants embedded in standard, innocent-looking USB cables providing an attacker with further capabilities, including among them the ability to track its own geolocation.

#hhv-talk-qa-hw-hacking-101-text https://discord.com/channels/708208267699945503/709255105479704636

Twitch: https://twitch.tv/dchhv

Twitch: https://www.twitch.tv/dchhv

VMV - Saturday - 11:30-11:59 PDT

In December of 2020, the High Turnout Wide Margins podcast launched to fill the void and give administrators an outlet for discussing the nuts and bolts of elections. Co-hosts Brianna Lennon, an elected county clerk in Boone County, Missouri and Eric Fey, an appointed director of elections in St. Louis County, Missouri, talk to subject-matter experts on topics like cybersecurity, disinformation, and elections integrity. In this presentation, Lennon and Fey share key takeaways from these discussions.

High Turnout Wide Margins is not a commercial podcast.

Twitch: https://www.twitch.tv/votingvillagedc

YouTube: https://www.youtube.com/channel/UCnDevqsxt3sO8chqS5MGvwg

DC - Saturday - 10:00-10:45 PDT

Our research has identified multiple vulnerabilities in Dell's BiosConnect feature used for remote update and recovery of the operating system. These vulnerabilities are easy to exploit by an adversary in the right position, and are not prevented by protective technologies such as Secured Core PCs, BitLocker, BootGuard, and BIOS Guard.

Join us and together we will explore the new attack surfaces introduced by these UEFI firmware update mechanisms -- including a full walk-through of multiple vulnerability findings and the methods we used to create fully working exploits that gain remote code execution within the laptop BIOS and their effects on the operating system.

--

This talk has been released to YouTube and the DEF CON Media server.

YouTube: https://www.youtube.com/watch?v=qxWfkSonK7M

Media: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/DEF%20CON%2029%20-%20Mickey%20Shkatov%20Jesse%20Michael%20-%20High-Stakes%20Updates%20-%20BIOS%20RCE%20OMG%20WTF%20BBQ.mp4

This talk has also been pre-recorded and will be broadcast on DCTV1, both in local hotels and on Twitch.

DCTV Channel Map: https://dctv.defcon.org/

Twitch: https://www.twitch.tv/defcon_dctv_one

BICV - Saturday - 16:30-16:30 PDT

YouTube: https://www.youtube.com/c/BlacksInCybersecurity

BTV - Saturday - 12:15-12:45 PDT

By now, every company should not only be aware of the cloud but actively using it to some degree—whether run by your IT department or, unofficially, by your engineering teams and sales organizations itching to invite a script kiddie to pluck your precious intellectual property—I mean, POC and strut their stuff that they can take their security and IT matters into their own hands.

Either way, you need a strategy or a clue. One is good. Both are better. Tying them together is best.

In this talk, I'll cover a number of random things. The generic reasons why many teams want to use cloud accounts. The common gotchas that may improve or disrupt your obviously super awesome demo for your customer, boss, team. Or just to actually do real work and expand your organization's compute demand en masse.

The focus will be addressing the technical gotchas in managing, monitoring, and assessing the security needs against the "business" needs for your organization: engineering, IT, and compliance. Operationally, you'll hit a breaking point. Too many users, too many accounts, too many workloads hammering your cloud interface. I'll focus primarily on AWS but also generically cover the other major Cloud Service Provider flavors, as, in the end, it's all the same: your org may have gotten wind that there are other cloud accounts and they just wanted to play with ALL OF THEM. How do you corral these little beasts? Tools. Technology. Processes.

I'll focus on open source tools like Prowler and ScoutSuite, touch some for closed source, but you'll still need to understand how to operationally point, aim, and fire to make it scale for you. In my experience, there's a certain level of "je ne sais quoi" element to getting to a comfortable level in overseeing the management of all these cloud accounts. I'll probably spend the balance of the time critiquing each tool in the end and present pros/cons and likely scenarios for you/your team/your org's maturity here to help you to drive your choice. Who knows, maybe I'll talk about my own open-source spin on things!

--

Twitch: https://twitch.tv/blueteamvillage

APV - Saturday - 14:00-14:45 PDT

YouTube: https://www.youtube.com/c/appsecvillage

LPV - Saturday - 13:00-13:59 PDT

Twitch: https://www.twitch.tv/toool_us?

YouTube: https://youtube.com/c/TOOOL-US

HRV - Saturday - 15:00-15:30 PDT

For more information, see https://hamvillage.org/dc29.html

Twitch: https://www.twitch.tv/hamradiovillage

#hrv-presentation-text: https://discord.com/channels/708208267699945503/736674835413073991

BHV - Saturday - 10:00-10:59 PDT

YouTube: https://www.youtube.com/channel/UCm1Kas76P64rs2s1LUA6s2Q

VMV - Saturday - 11:00-11:30 PDT

Twitch: https://www.twitch.tv/votingvillagedc

YouTube: https://www.youtube.com/channel/UCnDevqsxt3sO8chqS5MGvwg

RCV - Saturday - 14:00-14:30 PDT

YouTube: https://www.youtube.com/c/ReconVillage

LPV - Saturday - 11:00-11:30 PDT

Twitch: https://www.twitch.tv/toool_us?

YouTube: https://youtube.com/c/TOOOL-US

BTV - Saturday - 09:00-09:15 PDT

To follow his passion for identity and security, Igal decided to leave Microsoft and Co-found, Keytos a security company with the mission of eliminating passwords by creating easy to use PKI offerings. Earlier this year they launch their first product “EZSSH” which takes aim at stopping SSH Key theft by making it easy to use short lived SSH Certificates.

When comparing security reviews with red team findings, I always found that security reviews are based on what they think their system looks like and not how it actually is. Is the SSH port really closed? Or did I forget to close it the last time I was debugging something? Wait who added this identity as owner of the resources and when?!

Azure Security Center provides us with some great tools to check some of these errors. For example, from the two examples above it will alert on the SSH port being left open but it would not alert on some new person being added to your production subscription.

The Solution? SubWatcher our internal tool that it was too good to keep in-house and not share it with the world. SubWatches is an open-source tool that monitors your Azure Subscription ACLs and will alert you if they changed based on the baseline you have created.

--

Twitch: https://twitch.tv/blueteamvillage

IOTV - Saturday - 10:00-10:45 PDT

In this talk, I am going to tell you a story about my hacking journey that unexpectedly took me from device configuration settings to software reverse engineering, vulnerability discovery, and six new CVEs. Together, we’ll go step by step through reconnaissance, firmware analysis, decompiling, code review, and remote debugging. I’ll also share my experience with the responsible disclosure process. I hope this talk inspires you to apply your general hacking skills to new areas such as IoT, even if you’ve never done that before.

Twitch: https://www.twitch.tv/iotvillage

APV - Saturday - 10:00-10:45 PDT

YouTube: https://www.youtube.com/c/appsecvillage

ASV - Saturday - 12:00-15:59 PDT

LPV - Saturday - 10:00-10:30 PDT

Twitch: https://www.twitch.tv/toool_us?

YouTube: https://youtube.com/c/TOOOL-US

LPV - Saturday - 12:00-12:30 PDT

Twitch: https://www.twitch.tv/toool_us?

YouTube: https://youtube.com/c/TOOOL-US

LPV - Saturday - 14:15-14:45 PDT

Twitch: https://www.twitch.tv/toool_us?

YouTube: https://youtube.com/c/TOOOL-US

LPV - Saturday - 16:15-16:45 PDT

Twitch: https://www.twitch.tv/toool_us?

YouTube: https://youtube.com/c/TOOOL-US

AIV - Saturday - 09:30-10:59 PDT

Speakers will be made available on DEF CON's Discord, in #aiv-general-text.

Twitch: https://www.twitch.tv/aivillage

YouTube: https://www.youtube.com/c/aivillage

#aiv-general-text: https://discord.com/channels/708208267699945503/732733090568339536

IOTV - Saturday - 16:30-16:59 PDT

These examples are hardly isolated instances—there are thousands of other cases just like them. And they all speak to an important truth: IoT devices are increasingly being used by law enforcement for investigational purposes and, in some cases, even being made into star witnesses at trial. But law enforcement’s use of IoT devices raises two important questions. First, does allowing the government to use IoT data violate consumer expectations of privacy, particularly at a time when IoT products are being made and marketed with an eye toward information security? Second, are criminal suspects being provided with the same near-limitless access to IoT data for purposes of mounting their legal defense?

The answers to both of these questions are troubling, in large part because the law is inherently back-ward looking and is thus not equipped to grapple with the raw amount of information is now generated. Just as many consumers did not realize several years that their watch or car audio system would be used by law enforcement to track their location 24/7, so lawmakers and judges did not either. For example, the Federal Privacy Act of 1974 never contemplated that, rather than maintaining records, the government would simply buy access to private records—as ICE recently did by purchasing access to CLEAR—or create its own iOS app to ensnare criminals, as the FBI recently did. Likewise, although the Supreme Court noted the private nature of cell phone location data in Carpenter v. United States, this was a 5-4 decision (while RBG was still on the bench) that only applied the Fourth Amendment to historical cell phone GPS data, effectively leaving the law unsettled on many other types of IoT data. This has led courts, including a New York federal court in a case involving Apple, to express concerns that, even where warrants are involved, allowing the government to force companies to produce IoT device data could “result in a virtually limitless expansion of the government’s legal authority to surreptitiously intrude on personal privacy.”

These concerns are heightened by the fact that, although the Federal Rules of Criminal Procedure are supposed provide defendants with equal discovery rights, the Stored Communications Act often prevents defendants from accessing the IoT data of others, such as witnesses, accusers, or potential other defendants. In practice, this means that IoT data can effectively be used against criminal suspects but is not available for them to use in arguing their legal defense. This results in an incredible inequality in the criminal justice system. And it may also lead to erroneous outcomes: as with DNA evidence, IoT data may help exonerate criminals just as often as it implicates them. Indeed, in the Arkansas v. Bates murder case, the prosecution dismissed the charges against the defendant shortly after it obtained the Amazon Echo data, which apparently validated the defendant’s alibi. Similarly, allegations of cheating against low-income students at Dartmouth Medical School were dismissed after IoT data brought into question potentially erroneous remote test monitoring that may have been skewed by poor internet.

So what can we do to reform or limit government use of IoT data? This talk aims to talk through ways in which both the infosec and legal communities can increase their mutual understanding and help drive reform. In the short term, the infosec community can increase security by minimizing, encrypting, or de-identifying data. This can reduce the amount of information that IoT devices collect and, thus, are required to turn over to law enforcement. Over the long-term, the best solution may be to pass new laws or drive new judicial precedent that incorporates an understanding as to what IoT data is, how it is changing expectations of privacy, and how it is being used by law enforcement. Such laws could either limit access to IoT data—enshrining a greater degree of privacy—or set forth procedures delineating when authorities may use it and guaranteeing defendants equal access. Of course, there are other potential solutions and we hope this talk will help launch a broader discussion on how to help the law interact with IoT technology.

Twitch: https://www.twitch.tv/iotvillage

IOTV - Saturday - 10:00-18:30 PDT

Twitch: https://www.twitch.tv/iotvillage

IOTV - Saturday - 10:00-18:30 PDT

Twitch: https://www.twitch.tv/iotvillage

VMV - Saturday - 12:00-12:30 PDT

On the one hand, its public impact on every activity is wide enough to influence a far broader audience with multiple interests. On the other hand, this wider audience than private organizations allows salient cyberattacks such as influence operations with social media, conveyance of wrongful policy information, a breach in personal health information (PHI) and privacy, and so forth - protecting a local government is both protection of an organization and its residents.

This presentation suggests a method to revise existing ISP to make contributions for ISP staying up-to-date, align to the latest industry standards and regulations to be compliant, and narrowing down newly identified gaps from the local government perspective.

Twitch: https://www.twitch.tv/votingvillagedc

YouTube: https://www.youtube.com/channel/UCnDevqsxt3sO8chqS5MGvwg

BCV - Saturday - 10:15-11:30 PDT

DL - Saturday - 10:00-11:50 PDT

Short Abstract:
Kubernetes Goat is “vulnerable by design” Kubernetes Cluster environment to practice and learn about Kubernetes Security. It has step by step detailed guide and digital book on how to get started with Kubernetes Goat by exploring different vulnerabilities in Kubernetes Cluster and Containerized environments. Also, it has scenarios taken from the real-world vulnerabilities and maps the Kubernetes Goat scenarios. The complete documentation and instruction to practice Kubernetes Security for performing security assessments, pentesting, and in general Kubernetes Security. As a defender you will see how we can learn these attacks, misconfigurations to understand and improve your cloud native infrastructure security posture.

Short Developer Bio:
Madhu Akula is the creator of Kubernetes Goat, an intentionally vulnerable by design Kubernetes Cluster to learn and practice Kubernetes Security. Also published author and Cloud Native security architect with extensive experience. Also, he is an active member of the international security, DevOps, and Cloud Native communities (null, DevSecOps, AllDayDevOps, etc). Holds industry certifications like OSCP (Offensive Security Certified Professional), CKA (Certified Kubernetes Administrator), etc.

Madhu frequently speaks and runs training sessions at security events and conferences around the world including DEF CON (24, 26, 27, 28), Black Hat USA (2018, 19, 21), USENIX LISA (2018, 19, 21), O’Reilly Velocity EU 2019, GitHub Satellite 2020, Appsec EU (2018 & 19), All Day DevOps (2016, 17, 18, 19 & 20), DevSecCon (London, Singapore, Boston), DevOpsDays India, c0c0n(2017, 18, 20), Nullcon (2018, 19, 21), SACON 2019, Serverless Summit, null and multiple others.

His research has identified vulnerabilities in over 200+ companies and organizations including; Google, Microsoft, LinkedIn, eBay, AT&T, WordPress, NTOP and Adobe, etc, and credited with multiple CVE’s, Acknowledgements, and rewards. He is co-author of Security Automation with Ansible2 (ISBN-13: 978-1788394512), which is listed as a technical resource by Red Hat Ansible. Also, technical reviewer of Learn Kubernetes Security book published by Packt. Won 1st prize for building Infrastructure Security Monitoring solution at InMobi flagship hackathon among 100+ engineering teams

URL to any additional information:
https://github.com/madhuakula/kubernetes-goat https://madhuakula.com/kubernetes-goat
Detailed Explanation of Tool:
Kubernetes Goat is designed to be an intentionally vulnerable cluster environment to learn and practice Kubernetes security. Some of the high-level scenarios include, but not limited to below: Sensitive keys in code bases
DIND (docker-in-docker) exploitation
SSRF in K8S world
Container escape to access host system
Docker CIS Benchmarks analysis
Kubernetes CIS Benchmarks analysis
Attacking private registry
NodePort exposed services
Helm v2 tiller to PwN the cluster
Analysing crypto miner container
Kubernetes Namespaces bypass
Gaining environment information
DoS the memory/cpu resources
Hacker Container preview
Hidden in layers
Supporting Files, Code, etc:
https://github.com/madhuakula/kubernetes-goat https://madhuakula.com/kubernetes-goat/

Target Audience:
Offense, Defense

The adoption of Kubernetes use in production has increased to 83% from a survey by CNCF. Still, most of the security teams struggle to understand these modern technologies. So this project helps and brings a completely new area of research to share with the community to learn and practice from years of experience.

#dl-video1-voice: https://discord.com/channels/708208267699945503/734027693250576505

ASV - Saturday - 10:00-15:59 PDT

RCV - Saturday - 12:00-12:45 PDT

YouTube: https://www.youtube.com/c/ReconVillage

BTV - Saturday - 13:45-14:15 PDT

With the introduction of NGFWs came new operational risk in the form of application ID. After taking a path down to mitigate this risk by implementing passive NGFWs, it also become an opportunity to leverage them for threat hunting.

This talk will review research over the past 5 years of running such passive NGFWs. The pros/cons of the environment over exiting threat hunting tools, review of architecture, and a deep dive into the various functionality will be discussed.

Talk presented by - Shawn Wallis (Drimacus) - Cyber Security Research Strategiest

--

Twitch: https://twitch.tv/blueteamvillage

ICSV - Saturday - 14:30-14:59 PDT

YouTube: https://www.youtube.com/channel/UCI_GT2-OMrsqqglv0JijHhw

#ics-speaker-questions-and-answers-text: https://discord.com/channels/708208267699945503/735937961908109485

AVV - Saturday - 18:15-18:45 PDT

Q&A sessions will happen in DEF CON Official Discord server after each talk.

YouTube: https://www.youtube.com/channel/UCOhn9WALnpb5YAbW18R1Hzg

Twitch: https://twitch.tv/adversaryvillage

Discord: https://discord.gg/defcon

PHV - Saturday - 11:00-11:59 PDT

YouTube: https://youtube.com/wallofsheep

Twitch: https://twitch.tv/wallofsheep

Facebook: https://www.facebook.com/wallofsheep/

Periscope: https://www.periscope.tv/wallofsheep

ASV - Saturday - 12:30-13:20 PDT

This talk will be streamed on YouTube: https://www.youtube.com/watch?v=TEUgTF5zDHA

YouTube: https://www.youtube.com/c/AerospaceVillage

BTV - Saturday - 14:00-17:59 PDT

During the day Ben fights off cyber criminals as a DART engineer at Dropbox.com. At night Ben is the author of his blog HoldMyBeerSecurity.com where he discusses topics in security that interest him such as incident response, threat hunting, Osquery, and DevSecOps.

For each phase in the attack live cycle participants learn about one particular tactic, relevant macOS data sources, how to build a hunting plan, practice hunting, & how the red team emulated the tactic using open source intelligence.

This workshop is a resource on how to threat hunt, emulate, & use open source threat intelligence on a specific threat actor.

The Hunt for Red Apples workshop guides participants through emulation walkthroughs, hunting playbooks, and hunting exercises around an Ocean Lotus intrusion, an established threat actor targeting macOS. The workshop is broken into sections using both the attack lifecycle and Mitre ATT&CK knowledge base. For each phase in the attack live cycle participants learn about one particular tactic, relevant macOS data sources, how to build a hunting plan, practice hunting, and how the red team emulated the tactic using open source intelligence.

The objective of this workshop is to provide a balanced approach that showcases both hunting and adversary actions. This workshop is a resource on how to threat hunt, emulate, and use open source threat intelligence on a specific threat actor.

The Hunt for Red Apples workshop is broken into two four hour sessions over two days. As a bonus, we are releasing a second data set for a different scenario on day two for more advanced hunters with no playbooks or walkthroughs. Participants will get to test their macOS Threat Hunting skills! And it's all FREE!

SEV - Saturday - 14:30-15:30 PDT

Chris is also a well-known author, having written five books on social engineering. Chris’ new book, “Human Hacking: Win Friends, Influence People and Leave Them Better Off for Having Met You”, released January 5, 2021.

Learn more about the book: https://humanhackingbook.com/

Chris is an Adjunct Professor of Social Engineering for the University of Arizona’s NSA designated Center of Academic Excellence in Cyber Operations (CAE-CO). He also lectures and teaches about social engineering around the globe. Moreover, he’s been invited to speak at the Pentagon, as well as other high secure facilities. Additionally, as the creator of the world’s first Social Engineering Capture the Flag (SECTF), Chris leads the way in educating people on this serious threat.

Chris works with some of the world’s leaders in scientific research for the purpose of acquiring a deeper understanding of social engineering. Notably, Chris authored a book with Dr. Paul Ekman regarding the use of nonverbal communication by social engineers.

Twitch: https://www.twitch.tv/socialengineerllc