Creator: DEF CON Talks

In March 2026, while reverse-engineering the cloud platform behind a popular line of consumer baby monitors and home security cameras, I discovered that one MQTT SUBSCRIBE wildcard returned the live message stream from every device on the platform. 1.1 million cameras. Motion alerts with image URLs. Floor plans. P2P credentials. Audio events. From baby monitors, doorbells, indoor cameras.

That was one of twelve.

This talk presents a complete vendor surveillance audit of Meari Technology — a Hangzhou-based ODM whose firmware ships under 300+ white-label brands across 118 countries. Not a single bug. Twelve independent evidence chains, each one separately demonstrating that the vendor possesses by-design, architectural access to every camera they sell. EMQX brokers with admin/public on four regions. An Apollo configuration server returning 600+ production secrets without authentication. A CMS portal with 25+ live-camera endpoints accessible to 678 employees through DingTalk SSO. A universal TUTK authcode shared across every device. Cloud video IDOR. Plain-JPEG alerts on shared OSS buckets with no per-customer isolation.

Then I’ll walk through what happened after disclosure: the vendor’s IPO twelve days after first contact, the backdated security advisories, the three regional brokers fixed five days apart (incident

• Disclosure repository (public May 11, 2026): github.com/xn0tsa/meari-cloudedge-security-audit
• CVE-2026-33356 — MQTT Broker Missing Per-Device Subscribe ACL
• CVE-2026-33357 — OpenAPI Device Status IDOR (WAN IP Disclosure)
• CVE-2026-33358 — Cloud Video IDOR (No Ownership Check)
• CVE-2026-33359 — Alert Images Unauthenticated
• CVE-2026-33360 — API Signature Validation Disabled (CN Production)
• CVE-2026-33361 — Weak XOR Encryption on Baby Monitor Images
• CVE-2026-33362 — Hardcoded Static Cryptographic Keys in Client SDK
• CVE coordination: Tod Beardsley, runZero, Inc.
• CISA coordinated advisory (publication pending)
• Speaker’s prior work: DJI ROMO MQTT ACL bypass disclosure (February 2026), as covered by The Verge, Cybernews, Popular Science, TheGuardian, The Wired…
• Meari Technology official security advisories: meari.com/en/securityCenter
• EMQX broker: emqx.io
• Apollo Configuration Management: github.com/apolloconfig/apollo
• XXL-Job scheduler: github.com/xuxueli/xxl-job
• GDPR Articles 33 and 34: eur-lex.europa.eu
• EU Whistleblower Directive 2019/1937: eur-lex.europa.eu

People:
    SpeakerBio:  Sammy Azdoufal

Sammy Azdoufal is an independent security researcher and software engineer based in Barcelona. His work focuses on the cloud and mobile attack surface of consumer IoT, with an emphasis on Chinese ODM/OEM ecosystems supplying the smart-home market in Europe and North America.

In February 2026, he disclosed a critical MQTT ACL bypass affecting roughly 7,000 DJI ROMO robot vacuums across 24 countries, granting live camera and microphone access. The disclosure was covered by The Verge, Cybernews, Popular Science, The Guardian…, and led to a $30,000 bug bounty award from DJI. He is known for using AI coding assistants — specifically Anthropic’s Claude Code — as part of his reverse-engineering workflow, and for combining hands-on protocol analysis with disciplined responsible-disclosure practice.

The Meari Technology audit presented in this talk was conducted between February and April 2026, with CVE coordination performed by Tod Beardsley (runZero, Inc.) and disclosure coordinated with CISA. It is his largest single-vendor IoT audit to date.

Public handle: xn0tsa (GitHub). This will be Sammy’s first DEF CON Main Stage presentation.

Creator: DEF CON Talks

A major signing extension which has over 2 million users, primarily in Belgium, and lets websites interact with electronic ID (eID) and Maestro payment cards. It’s used by “8 of the 10 largest banks in Belgium and 60+ Belgian government agencies and departments”, and it facilitates eIDAS signatures, a cryptographically “secure” signature format trusted by governments and organizations.

The company behind it, is a Qualified Trust Service Provider on the EU eIDAS Trusted List, the highest trust tier the regulation defines.

We found multiple major issues with this system. Any site a user visited could read their eID and Maestro card data, and recover their eID PIN, which the binary handed back to the page inside a token that carried both the ciphertext and the key to decrypt it. And, worst of all, any site could trigger a drive-by RCE by getting the native binary to load and run an attacker-supplied library. All the user would see is a file download, like a PDF, when they are getting RCE’d.

We’ll show how they messed literally everything possible, and more!

https://chromewebstore.google.com/detail/connective-signing-extens/kclpjmhngbacampgcdojmiedamjbgjjm https://web.archive.org/web/20260427143606/https://www.gonitro.com/about/press/nitro-to-acquire-european-esign-leader-connective https://web.archive.org/web/20260226092908/https://www.gonitro.com/resources/nitro-to-acquire-connective

People:
    SpeakerBio:  James “Acorn221” Arnott, Bay Area Labs

I’m James, founder of Am I Being Pwned (amibeingpwned.com), where we hunt malicious and vulnerable browser extensions. I’ve spent 10+ years building and breaking them, including LighterFuel, a Tinder extension that hit 10k+ weekly users and, for one glorious day, made me (probably) the most-liked man on Tinder.

Recent finds include five drive-by CVSS 9.6 RCEs in production software affecting 10M+ users. I’ve also published in IEEE Xplore on Rubik’s cube-based FIDO2 authentication (CubeAuthn), because someone had to. Before this I was a founding engineer at three YC startups.

Fun fact: I was almost kicked out of school three times for finding and exploiting vulnerabilities.

Creator: DEF CON Talks

From time to time I take another pass at WMI to see if there’s anything left in it that hasn’t been picked over. For most of the last decade, offensive WMI has meant Win32_Process Create and event subscription persistence. Defenders built their detections around those two primitives, EDR vendors optimized for them, and the rest of WMI mostly got ignored.

The provider architecture is one of the parts that got ignored. This talk is about turning it into a distributed post-exploitation framework.

The core technique is remote installation of custom WMI providers without dropping anything over SMB or WinRM. To get there, I had to reimplement the parts of mofcomp.exe that handle MOF parsing and provider registration, and push the resulting object instances over the wire using the MS-WMIO binary protocol.

Getting the DLL onto the target needed its own primitive, so along the way I found that there are existing WMI classes on every supported Windows version that can be abused for arbitrary file upload and download. As far as I can tell that hasn’t been published before. Once a provider is installed, it runs inside WMIPrvSE.exe, which is a very different execution context from spawning cmd.exe through Win32_Process. The provider library I’m releasing covers a series of post exploitation primitives.

People:
    SpeakerBio:  Steven Flores

Steven enjoys offensive research, tool and capability development and is currently employed at SpecterOps doing his favorite things.

Creator: DEF CON Talks

Passkeys are marketed as phishing-resistant, and the WebAuthn ceremony at their center genuinely is. The catch: almost nobody runs only the ceremony. Roughly five billion passkeys are in active use (FIDO, 2026), yet only about a third of organizations use them as the primary sign-in, so a passkey almost always sits next to a weaker method. The cryptography covers only the ceremony, but the login rides on many moving parts, from the metal to the cloud: authenticator, cross-device transport, client, relying party, cloud sync, and the human who recovers the account. That is where it breaks, more often than the reputation suggests: in a recent audit, all 103 live relying parties tested were vulnerable to at least one server-side attack.

This talk pulls the scattered research into one pass over all of them, one attack per stop that survives a correct ceremony, shown in action, heaviest on the relying party where engagements land, with a suggested testing order and the sources to go deeper. You also get Passkey Editor, a Burp extension that decodes and re-encodes the vendor wrappers that make this traffic unreadable, ships preset ceremony-layer attacks, and lets you craft any relying-party manipulation by hand in intercept and Repeater.

Walk away knowing where passkey deployments break, with a tool to test them.

A curated, non-exhaustive list of the key references behind this talk.

Cultural anchor

• Nishant Kaushik (CTO, FIDO Alliance), Passkeys Are Not Broken. The Conversation About Them Often Is (https://fidoalliance.org/passkeys-are-not-broken-the-conversation-about-them-often-is/), September 2, 2025.

Specifications

• W3C Web Authentication Working Group, Web Authentication (WebAuthn) Level 3 (https://www.w3.org/TR/webauthn-3/); Level 2 Recommendation (https://www.w3.org/TR/webauthn-2/).
• FIDO Alliance, Credential Exchange Format (CXF) and Credential Exchange Protocol (CXP), Working Drafts (https://fidoalliance.org/specs/cx/cxp-v1.0-wd-20241003.html), 2024.

Academic

• Louis Jannett, Andreas Mayer, Maximilian Westers, Vladislav Mladenov, Christian Mainka, Jorg Schwenk, The State of Passkeys: Studying the Adoption and Security of Passkeys on the Web (https://www.usenix.org/conference/usenixsecurity26/presentation/jannett), USENIX Security 2026.
• Alaa Daffalla et al., A Framework for Abusability Analysis: The Case of Passkeys in Interpersonal Threat Models (https://www.usenix.org/conference/usenixsecurity25/presentation/daffalla), USENIX Security 2025.
• Prince Bhardwaj and Nishanth Sastry (University of Surrey), State of Passkey Authentication in the Wild: A Census of the Top 100K Sites (https://arxiv.org/abs/2602.15135), PAM 2026 (Springer LNCS 16477).
• Jenny Blessing, Daniel Hugenroth, Ross J. Anderson, Alastair R. Beresford (University of Cambridge), SoK: Web Authentication and Recovery in the Age of End-to-End Encryption (https://doi.org/10.56553/popets-2025-0113), PoPETs 2025(3).
• Matteo Scarlata, Giovanni Torrisi, Matilda Backendal, Kenneth G. Paterson (ETH Zurich / USI), Zero Knowledge (About) Encryption: A Comparative Security Analysis of Three Cloud-based Password Managers (https://zkae.io/), USENIX Security 2026 (IACR ePrint 2026/058).
• Mazharul Islam, Sunpreet S. Arora, Rahul Chatterjee, Ke Coby Wang, CASPER: Detecting Compromise of Passkey Storage on the Cloud (https://www.usenix.org/conference/usenixsecurity25/presentation/islam), USENIX Security 2025.
• Kemal Bicakci, Fatih Mehmet Varli, Muhammet Emir Korkmaz, Yusuf Uzunay, QES-Backed Virtual FIDO2 Authenticators (https://arxiv.org/abs/2601.06554), arXiv:2601.06554, January 2026.
• Christian Catalano, Andrea Chezzi, Vita Santa Barletta, Franco Tommasi, Defeating FIDO2/CTAP2/WebAuthn using Browser-in-the-Middle and reflected XSS (https://link.springer.com/article/10.1007/s11416-025-00556-2), Journal of Computer Virology and Hacking Techniques 2025.
• Marco Squarcina, Mauro Tempesta, Lorenzo Veronese, Stefano Calzavara, Matteo Maffei, Can I Take Your Subdomain? Exploring Same-Site Attacks in the Modern Web (https://www.usenix.org/conference/usenixsecurity21/presentation/squarcina), USENIX Security 2021.
• Marco Casagrande, Daniele Antonioli, CTRAPS: CTAP Client Impersonation and API Confusion on FIDO2 (https://arxiv.org/abs/2412.02349), arXiv:2412.02349, 2024.
• Peizhou Chen, Vulnerability Testing for WebAuthn (MSc thesis, University of Twente; companion Burp_FIDO2 extension) (https://essay.utwente.nl/98532/), 2024.

Government guidance

• UK National Cyber Security Centre (NCSC), Comparing the security properties of traditional user credentials and FIDO2 credentials for personal use (https://www.ncsc.gov.uk/paper/traditional-user-and-fido2-credentials-personal-use), 2026.

Industry data and reports

• FIDO Alliance, The State of Passkeys 2026: Global Consumer and Workforce Report (https://fidoalliance.org/the-state-of-passkeys-2026-global-consumer-and-workforce-report/), May 7, 2026.
• FIDO Alliance, World Passkey Day 2025 / Passkey Pledge (over 1 billion people have activated a passkey; 15 billion accounts support passkeys) (https://fidoalliance.org/fido-alliance-launches-the-passkey-pledge-to-further-accelerate-global-movement-away-from-passwords/), May 2025.

Industry and practitioner research

• Luke Jennings (Push Security), MFA downgrade: how attackers are getting around phishing-resistant authentication (https://pushsecurity.com/blog/mfa-downgrade-attacks), July 2025.
• Carlos Gomez (IOActive), Authentication Downgrade Attacks: Deep Dive into MFA Bypass (https://www.ioactive.com/authentication-downgrade-attacks-deep-dive-into-mfa-bypass/), February 2026.
• Netcraft, Phishing After Passkeys: What Attacks to Expect (https://www.netcraft.com/blog/phishing-after-passkeys-what-attacks-to-expect), April 2026.
• Maarten Balliauw (Duende Software), Deep Dive: Relying Party ID and origin with Passkeys (https://duendesoftware.com/blog/20251014-deep-dive-into-relying-party-id-and-origin-with-passkeys), October 2025.
• Tobia Righi (mastersplinter), Passkey account-takeover research and CVE-2024-9956 (incl. the credential-ID-collision overwrite note) (https://mastersplinter.work/research/passkey/), 2025.
• Curtis Brazzell (PhishU), Vaultjacking: One Captured PIN, the Entire Google Password Manager Vault (https://phishu.net/blogs/blog-vaultjacking-phishing-the-google-password-manager-vault-in-the-phishu-framework.html), May 2026.
• U-Zyn Chua (uzyn), Passkey has a theft-detection feature, but Apple, Google and Microsoft broke it (https://uzyn.com/2025/passkey-has-a-theft-detection-feature-but-big-tech-broke-it/), May 2025.
• Scott Helme, Open-Sourcing passkeys-php: A Security-Focused WebAuthn Library for PHP (https://scotthelme.co.uk/open-sourcing-passkeys-php-a-security-focused-webauthn-library-for-php/), May 2026.
• Dennis Kniep, FIDO Cross-Device Phishing (caBLE/hybrid cross-device relay PoC) (https://denniskniep.github.io/posts/14-fido-cross-device-phishing/), September 2025.
• William Brown (firstyear), WTF is a passkey (Open Source Security podcast) (https://opensourcesecurity.io/2026/2026-01-passkey-william-brown/), January 2026.

Conference talks (forthcoming / concurrent / recent)

• Michael Grafnetter (DSInternals), Pass-the-Passkey family of attacks (https://www.dsinternals.com/en/black-hat-usa-26-pass-the-passkey/), Black Hat USA 2026 (forthcoming).
• Nevada Romsdahl and Kam Talebzadeh, SquarePhish 2.0: QR Code + OAuth 2.0 Device Code Flow Phishing for the Primary Refresh Token (https://disobey.fi/2026/profile/disobey-2026-433-squarephish-2-0-qr-code-oauth-2-0-device-code-flow-phishing-for-primary-refresh-token), Disobey 2026.

Relying-party CVEs (public record, some of them)

• CVE-2026-46419, Yubico java-webauthn-server (webauthn-server-core) (https://www.yubico.com/support/security-advisories/ysa-2026-02/).
• CVE-2025-26788, StrongKey FIDO Server (https://nvd.nist.gov/vuln/detail/CVE-2025-26788).
• CVE-2024-12225, Quarkus quarkus-security-webauthn (https://nvd.nist.gov/vuln/detail/CVE-2024-12225).
• CVE-2025-12150, Keycloak keycloak-services, attestation-policy bypass via fmt:none (https://github.com/advisories/GHSA-7g5x-9c4v-4w5r).
• CVE-2026-6856, Keycloak, AAGUID-allowlist bypass via packed self-attestation (NVD record not yet published; tracked at the Keycloak issue) (https://github.com/keycloak/keycloak/issues/48388).

People:
    SpeakerBio:  Matteo Giordano, Anvil Secure

Matteo Giordano is an Italy-based offensive security specialist and Security Engineer at Anvil Secure, focused on application penetration testing and offensive research, with a growing focus on AI Red Teaming and GenAI security. For the past year he has researched WebAuthn and passkeys from an attacker’s perspective, mapping the real-world attack surface that sits around the protocol’s cryptographic core, the work behind this talk.

Creator: DEF CON Talks

Surveillance tech often operates as a “black box” burdened by systemic technical debt. This session is the capstone of “Bird Hunting Season,” an independent, self-funded teardown and research of the Flock Safety ecosystem. What began with an eBay purchase evolved into 51+ vulnerabilities across Raven gunshot detectors, Falcon LPRs, and Picard/Bravo compute boxes.

I detail the project’s lifecycle: from hardware root via UART and unauthenticated EDL mode to protocol-layer failures. I demonstrate how broken mTLS, hardcoded Java Keystore secrets, and debugging compilations led to system level escalation. The narrative reaches its climax with an an explanation of how I found 63 live production camera feeds exposed without authentication to the public internet.

I also formalize the “Flea Market Supply Chain” attack, detailing how direct communication with upstream SoM manufacturers can bypass months of reverse engineering.

The talk culminates in the release of BirdShot: a 12 module testing framework that incorporates the exploits I’ve discovered as well as a TensorFlow harness (BirdEye) for hijacking proprietary ML models. I demonstrate how BirdShot automates the journey from a three button physical hotspot trigger to a persistent root shell, proving that when the birds are watching you, you can watch them back.

[1] Gaines, J. (2026). Examining the Security Posture of an Anti-Crime Ecosystem. Zenodo. DOI: 10.5281/zenodo.17584876

[2] Gaines, J. (2025-2026). Bird Hunting Season: Anti-Crime Ecosystem Research Repository. GitHub. https://github.com/GainSec/anti-crime-ecosystem-research

[3] MITRE/CWE. ES2510-692960d9: Improper Entitlement/Authorization for Protected Artifact Access. (Submission Pending/Accepted).

[4] https://github.com/justcallmekoko/ESP32Marauder/wiki/Flock-Sniff

[5] https://github.com/justcallmekoko/ESP32Marauder/wiki/flock-wardrive

[6] https://github.com/colonelpanichacks/flock-you

People:
    SpeakerBio:  Jon “GainSec” Gaines

Jon “GainSec” Gaines is a offensive security researcher, leader and “lifelong hacker” with over a decade of experience hacking all types of technologies for international organizations. By day, he serves as a Senior Security Engineer at Anduril, where he hacks next generation defense systems, following a career of Principal and Managing roles at security firms like NetSPI.

Jon has independently disclosed over 50 CVEs spanning critical infrastructure, hardware, web applications, software, mobile applications, and embedded systems. His technical research has been featured in Phrack Magazine and he maintains a diverse output of open-source projects, ranging from automated PCB hardware hacking tools to control in depth offensive agent governance frameworks. Beyond the lab, he also serves as an adjunct instructor at Herkimer College, where he is dedicated to mentoring the next generation of offensive researchers.

Jon remains committed to lifting the community through technical transparency, tooling, and the meticulous deconstruction of insecure infrastructure.

Creator: DEF CON Talks

Car dealers predominantly in the Southwestern U.S. have been pre-installing “KARR,” an aftermarket anti-theft alarm system, in every car they sell. They offer these systems as an upgrade when you purchase your car, giving you smartphone-based control over your car locks and immobilizer; if you decline the offer, the dealer says they will deactivate the system. What they don’t tell you: this security system is authenticated by a global shared key, so anyone who recovers that key can remotely control nearby KARR units with a smartphone.

KARR is installed in an estimated 1.4 million cars, and every vulnerable unit shipped with the same authentication key, allowing an attacker with a smartphone to unlock the doors, disable the alarm and immobilizer, and trigger the horn and lights of any KARR-equipped vehicle. The core impact is unauthorized access, which can enable burglary, OBD-II access, and escalation including the key-programmer workflow we will demonstrate; every owner with KARR installed needs to update, including those who declined the upsell or inherited it used.

We’ll walk through how we discovered KARR, how KARR ends up in millions of cars, how the attack works end-to-end, and what owners can do to fix it today. We’ll also show that the same recipe revealed vulnerabilities in other aftermarket BLE systems.

Our paper: Yibo Wei, Jerry Yu, Sumanth Rao, Mohak Vaswani, Jefferson Chien, Christian Dameff, Nishant Bhaskar, Aaron Schulman, “BLE Theft Auto: Evaluating the Security of Aftermarket BLE-based Automotive Remote Control Systems”, USENIX Security 2026. (to appear)

Aftermarket alarms: Ken Munro / Pen Test Partners, “Gone in Six Seconds: Exploiting Car Alarms”, 2019. https://www.pentestpartners.com/security-blog/gone-in-six-seconds-exploiting-car-alarms/

Aftermarket alarms: VERSPRITE, “How Hackers Control & Steal Vehicles Remotely” (Carlink remote-start vulnerability). https://versprite.com/vs-labs/hacking-remote-start-system/

Automotive BLE and keyless entry: Xie et al., “Access Your Tesla without Your Awareness: Compromising Keyless Entry System of Model 3”, NDSS 2023. https://www.ndss-symposium.org/ndss-paper/access-your-tesla-without-your-awareness-compromising-keyless-entry-system-of-model-3/

Automotive BLE and keyless entry: NCC Group, “Tesla BLE Phone-as-a-Key Passive Entry Vulnerable to Relay Attacks”, 2022. https://www.nccgroup.com/research/technical-advisory-tesla-ble-phone-as-a-key-passive-entry-vulnerable-to-relay-attacks/

Automotive BLE and keyless entry: Francillon, Danev, Capkun, “Relay Attacks on Passive Keyless Entry and Start Systems in Modern Cars”, NDSS 2011.

Foundational automotive security: Koscher et al., “Experimental Security Analysis of a Modern Automobile”, IEEE S&P 2010. https://doi.org/10.1109/SP.2010.34

Foundational automotive security: Checkoway et al., “Comprehensive Experimental Analyses of Automotive Attack Surfaces”, USENIX Security 2011. https://www.autosec.org/pubs/cars-usenixsec2011.pdf

BLE application-layer auth: Sivakumaran and Blasco, “A Study of the Feasibility of Co-located App Attacks against BLE and a Large-Scale Analysis of the Current Application-Layer Security Landscape”, USENIX Security 2019. https://www.usenix.org/conference/usenixsecurity19/presentation/sivakumaran

Measurement and tooling: WiGLE, Wireless Network Mapping. https://www.wigle.net/

Measurement and tooling: ILSpy, open-source .NET assembly browser and decompiler. https://github.com/icsharpcode/ILSpy

People:
    SpeakerBio:  Aaron Schulman, University of California, San Diego

Aaron Schulman is an Associate Professor at University of California, San Diego. His research group works on problems that involve gathering large-scale measurements to test whether assumptions about security, and sometimes reliability, match reality. This work often leads his students to gather data on rooftops, at fast food restaurants, gas stations, and hospitals, and while riding in cars, trains, and airplanes. He earned his PhD in Computer Science from University of Maryland, where he studied Internet reliability, and he did a postdoctoral fellowship at Stanford University, where he investigated bottlenecks in cellular infrastructure. Aaron co-discovered sensitive unencrypted data sent over GEO satellites from cellular providers, governments, militaries, and power grid operators. He also co-developed a Bluetooth credit card skimmer detector that federal and state law enforcement have used to stop millions of dollars in credit card fraud. While in Silicon Valley, he co-founded a company that helped Google improve the battery life of the Chrome web browser. This is his third year attending DEF CON.

SpeakerBio:  Jerry Yu

Jerry Yu is a wireless systems software engineer associated with the SysNet research group at University of California, San Diego. He contributed to this work by reverse-engineering the mobile apps behind the aftermarket BLE automotive control systems we studied.

SpeakerBio:  Yibo Wei, University of California, San Diego

Yibo Wei is a PhD student at University of California, San Diego, advised by Professor Aaron Schulman. He is the lead author of the forthcoming USENIX Security 2026 paper on BLE Theft Auto (under embargo), an ecosystem-wide study of aftermarket BLE-based automotive remote control systems. He led the reverse-engineering, protocol analysis, population estimation, and disclosure for this work. This will be his first time attending DEF CON.

Creator: DEF CON Talks

Modern ARM64 systems rely on hardware Control-Flow Integrity (CFI) such as PAC and BTI to kill classic ROP/JOP exploits. Indirect branches must land on valid targets, returns are signed, and arbitrary jumps are supposed to be over.

Except… it isn’t.

In this talk, we show that, by design, there is a fundamental gap between POSIX signal handling and hardware CFI. Sigreturn acts as a built-in, kernel-assisted CFI bypass primitive, enabling arbitrary control-flow transfers via crafted signal frames while bypassing CFI enforcement.

We then explore what makes this work in practice on modern Linux and Android systems (including latest Ubuntu and Pixel devices): using sigreturn as a practical exploitation primitive, then pivoting with “”cfi-safe stack pivots””, abusing missing BTI enforcement on the vDSO, and leveraging GCC’s common default settings.

I’ll present a PoC showing how these primitives can be chained in classic SROP style, and demonstrate how you can extend COOP/CFOP beyond function-level control to achieve reliable arbitrary code execution, effectively breaking CFI again and again.

References

• SROP

  • “Framing Signals—A Return to Portable Shellcode”, Erik Bosman & Herbert Bos, IEEE S&P 2014. Link: https://www.cs.vu.nl/~herbertb/papers/srop_sp14.pdf

• COOP

  • “Counterfeit Object-oriented Programming”, Schuster et al., IEEE S&P 2015. Link: https://www.ieee-security.org/TC/SP2015/papers-archived/6949a745.pdf

• CFOP

  • “Await() a Second: Evading Control Flow Integrity by Hijacking C++ Coroutines”, Marcos Bajo and Christian Rossow, CISPA Helmholtz Center for Information Security, Usenix 2024. Link: https://www.usenix.org/conference/usenixsecurity25/presentation/bajo

People:
    SpeakerBio:  Omri “beta_b0t” Ben Bassat, Tel Aviv University

Omri Ben-Bassat is a vulnerability researcher with over a decade of experience in reverse engineering, vulnerability finding, binary exploitation, and low-level vulnerability analysis, specializing in IoT and embedded systems. He has presented his work at leading security conferences, including Black Hat USA, Black Hat Asia, and RSA Conference, and has delivered awesome hands-on trainings at Black Hat Asia and TyphoonCon. Omri is currently pursuing a master’s degree at Tel Aviv University, where his research focuses on applying formal methods to software exploitation.

Creator: DEF CON Talks

Amazon Lockers are everywhere, handling millions of packages every day. At the same time, thousands of packages get stolen from home porches every year, which made me wonder if the same thing could happen with Amazon Lockers.

This talk is my journey trying to break into them. I started where it made the most sense, BLE. What looked straightforward quickly turned into a series of unexpected turns, with different angles, different ideas, and a lot of time spent chasing paths that didn’t go where I thought they would.

This talk walks through that process, the dead ends, the pivots, and the techniques used along the way showing how attacking a system from different angles can expose weaknesses that aren’t obvious at first. From protocol reverse engineering and hardware hacking to mobile app security, OSINT, and physical attacks, in the end it’s about persistence, understanding how things really work, and not stopping until something gives.

By any means necessary.

All references are pointed in the outline to provide better context.

People:
    SpeakerBio:  Martin Vigo, Triskel Security

Martín is a cybersecurity expert with 15 years of experience, having helped protect companies such as Apple, Meta, and Salesforce, including work in penetration testing, red teaming, and vulnerability research. He has led teams and worked across mobile and web security, SaaS, cloud environments, and identity and authentication.

He is a frequent speaker at conferences including DEF CON, Black Hat, and CCC, presenting research on phreaking, vulnerabilities in password managers, new OSINT techniques, and reverse engineering of proprietary protocols.

He runs a cybersecurity consulting firm focused on improving organizational cyber resilience via offensive security, research, and public speaking. He is also co-host of the “Tierra de Hackers” podcast.

Martín holds a Bachelor’s in Computer Science, a Master’s in Software Engineering, and certifications in areas such as hardware hacking, exploit development, infrastructure and mobile security, radio frequency, and OSINT. He contributes to open source projects and collaborates with law enforcement on initiatives to enhance public safety.

Creator: DEF CON Talks

Local LLM runtimes now sit inside phones, desktops, and internal servers, but the layer underneath is still ordinary native code. We analyzed llama.cpp and Ollama across three trust boundaries: JNI, HTTP lifecycle code, and Go/C bindings.

First, in the llama.cpp Android integration, Java can free a native llama_context while native code is still using it. We reclaim the freed 648-byte object, redirect a vtable call, and show code execution in the embedding app. Second, in llama.cpp server, idle model teardown can race active requests, leaving a dangling pointer inside a freed 17,816-byte model allocation. We show remote cross-thread reclaim and attacker-controlled native dereference, then explain the remaining steps to stable RCE. Third, in Ollama, malicious GGUF metadata can push unsafe lengths across the Go/C boundary during quantization, causing C to read past a Go-backed buffer and return heap data to the caller.

This is not a prompt-injection talk. It is about exploiting local AI runtimes as native software: one full exploit, one validated server-side primitive, one disclosure primitive, and the audit patterns that find more.

1. Mergendahl, Louloudis, Vidas. “Cross-Language Attacks.” NDSS Symposium 2022.

2. Hussain. “Incubated Machine Learning Exploits.” DEF CON 32, 2024.

3. Riancho, Braverman, Demetrio. “Breaking Out of The AI Cage.” Black Hat USA 2025.

4. llama.cpp project: https://github.com/ggml-org/llama.cpp

5. Ollama project: https://github.com/ollama/ollama

6. llama.cpp Android sample: https://github.com/ggml-org/llama.cpp/tree/master/examples/llama.android

People:
    SpeakerBio:  Ofek Itach, Cyera

Security Research Team Lead at Cyera. Focus areas include cloud infrastructure and AI-related platform security. Talks: Black Hat USA 2024, DEF CON 32 (2024), RSA 2024, Sector 2024, INTENT 2024, Black Hat Europe 2024 Arsenal. Earlier work includes AWS internals and cloud attack surface mapping.

SpeakerBio:  Vladimir “G1ND1L4” Tokarev, Cyera

Vladimir Tokarev is a vulnerability researcher tech lead at Cyera, specializing in Cloud, IoT/OT, Windows, Linux, and AI vulnerability research and exploit. Talks: Black Hat USA 2024 and 2023,
DEF CON 33 Recon Village 2025, CodeBlue 2025, RSA 2024.

Creator: DEF CON Talks

Crypto phones promise the convenience of a mobile OS with hardware-backed key management. We tested that claim on dGEN1, the Ethereum phone marketed for digital-asset custody, and present a full compromise from bootrom to wallet key recovery.

Starting from a bootrom-level misconfiguration, we reverse the modern MediaTek bootchain and introduce a Loader-of-the-Loader technique for patching later boot stages entirely in memory, yielding EL3 code execution without modifying physical flash. From that foothold, we trace how boot-level compromise propagates into the device’s lock-screen verification path, enabling offline brute-forcing of the user PIN and recovery of the wallet’s primary ERC-4337 signing key. We further show that a separate identity flaw in the asset-claim workflow allows pre-activation theft using identifiers printed on a sealed retail box.

People:
    SpeakerBio:  Guanxing Wen

Guanxing Wen is a security researcher with over a decade of experience exploiting bootloaders, TEEs, kernels, and IoT systems. He is a top winner of Huawei bug bounty (2021/2022) and is listed in the Ledger Hall of Fame. His research has been presented at Black Hat, MOSEC, INFILTRATE, Summercon, and QPSS. He currently works at CertiK, where he focuses on low-level systems exploitation and blockchain infrastructure.

Creator: DEF CON Talks
Modern computers depend on a hardware root of trust: a component assumed to start trustworthy and is used to verify everything that follows. This has evolved from ROM boot code and fixed keys into TPMs, secure boot chains, external security controllers, and attestation mechanisms used far beyond disk encryption. Today, platforms trust these devices because they are certified, immutable, and built into the hardware, but what if that assumption is wrong? Starting from real hardware traces, failed approaches, and a pile of development boards, we arrive at a $45 FPGA-based SPI TPM that can appear to Windows 11 as a platform trust anchor. From there, we explore what this means for secure boot, measured boot, platform attestation, anticheat, AI infrastructure, and the broader belief that hardware identity is difficult to counterfeit. We will release the code, gateware, prompts, and data so others can reproduce the work and push it further.

https://twpm.dasharo.com/ https://github.com/microsoft/ms-tpm-20-ref

People:
    SpeakerBio:  Mickey “@HackingThings” Shkatov, Eclypsium

Mickey has been involved in security research for over a decade, specializing in breaking down complex concepts and identifying security vulnerabilities in unusual places. His experience spans a variety of topics, which he has presented at security conferences worldwide. His talks have covered areas ranging from web penetration testing to the intricacies of BIOS firmware.

SpeakerBio:  Jesse Michael, Eclypsium

Jesse is an experienced security researcher focused on vulnerability detection and mitigation who has worked at all layers of modern computing environments from exploiting worldwide corporate network infrastructure down to hunting vulnerabilities inside processors at the hardware design level. His primary areas of expertise include reverse engineering embedded firmware and exploit development. He has also presented research at DEF CON, Black Hat, PacSec, Hackito Ergo Sum, Ekoparty, and BSides Portland.

Creator: DEF CON Talks

The core assumption of modern endpoint defense is broken. While Endpoint Detection and Response (EDR) solutions are built to restrict administrators through Protected Process Light (PPL) and anti-tampering, this research reveals an industry-wide design flaw: the “Bring-Your-Own-EDR” (BYOEDR) technique. We demonstrate a post-exploitation scenario where a local administrator weaponizes the EDR’s own trusted installer to bypass its formidable defenses, establishing a self-protected malware. This shows a structural weakness in how security products handle installation and trust. We will show a complete exploit chain that any attacker can leverage to achieve arbitrary unsigned code execution within PPL boundaries.

Ultimately, the strongest defender becomes the attacker’s most powerful tool.

https://blog.slowerzs.net/posts/pplsystem/ https://github.com/hasherezade/pe_to_shellcode/ https://github.com/googleprojectzero/symboliclink-testing-tools

People:
    SpeakerBio:  Shahak Morag, Akamai

Shahak Morag is currently serving as the Senior Security Researcher at Akamai, with more than seven years of experience in security research. His background includes extensive expertise in Linux kernel, embedded systems, and Windows internals.

Creator: DEF CON Talks

What if a trusted security component could be repurposed into an attacker-controlled kernel primitive? What if a signed Microsoft remediation driver could be instructed to execute arbitrary file and registry operations from Ring 0 — without exploits, vulnerabilities, or memory corruption?

In this talk, we present the first full reverse engineering of the Windows Defender Boot-Time Removal driver (BTR.sys) and its proprietary transaction format. We dissect its encrypted configuration mechanism, integrity validation logic, and execution pipeline, and demonstrate how this legitimate remediation component can be transformed into a universal kernel operation engine. We introduce BTR_CLI, a research tool that constructs valid encrypted transactions and exercises the driver’s capabilities.

We demonstrate how BTR_CLI can be used as an EDR/AV bypass technique, disarming security solutions using a trusted Windows built-in, Microsoft-signed driver — without relying on typical BYOVD techniques.

Our research reveals how trusted security infrastructure can unintentionally expose powerful primitives and what this means for defenders. This talk blends reverse engineering, kernel internals, and detection engineering into a practical case study of when defensive technology becomes offensive capability.

People:
    SpeakerBio:  Jiří Vinopal, Threat Researcher at Check Point Research

Jiří Vinopal is a security researcher, malware researcher, and reverse engineer at Check Point Research, focused on advanced cyber threats, kernel internals, and the hidden mechanics of undocumented system components. His work spans uncovering novel attack primitives, reconstructing proprietary protocols from binary analysis alone, and deep-diving into both sophisticated malware families and trusted platform components. When he’s not buried in disassembly, he actively shares his knowledge and passion for reverse engineering across his X account, YouTube channel, and blog — delivering tips, tricks, and technical insights to fellow enthusiasts and the broader security community.

Creator: DEF CON Talks

85 findings exploitable from the internet with zero prior access. 28 takedown chains. Crypto failures that let you decrypt all C2 traffic with one recovered key.

Here’s how I got there. I’d been using coding agents to find bugs in software. Then I thought: what if I did this from the defender’s side, against the tools that threat actors actually use? I pointed LLM-assisted research at five C2 frameworks: Havoc, Mythic, Sliver, Covenant, AdaptixC2. Six months later, 251 design flaws, behavioral weaknesses, and vulnerabilities. Validated every finding in realistic lab environments. Then passively tapped 35 live servers via Shodan and Censys, and found operators running campaigns against victims in education, manufacturing, legal, and biotech across eight countries.

Eight bug classes recur across all five codebases. Findings rated on a defender-weighted scale, because CVSS doesn’t tell you which bug finds the server. Havoc, the most-deployed framework in the dataset, was archived on February 21, 2026. No patches coming. Defenders carry the load now.

AI isn’t just for protecting systems. Defenders can point it at the attackers’ own tools and find real ways to fight back. All findings for maintained projects disclosed through proper channels. Every demo against realistic lab environments I control.

People:
    SpeakerBio:  Vitaly Simonovich, Cato Networks

Vitaly Simonovich is a Senior Security Researcher at Cato Networks on the CTRL threat research team, following over ten years in cybersecurity across Cato CTRL and Imperva, where he focused on DDoS and botnet research from 2019 to 2023.

He coined HashJack, the first indirect prompt injection weaponizing URL fragments against AI browser assistants, and LAMEHUG, the first LLM-powered malware publicly linked to APT28. He documented the Immersive World jailbreak against Microsoft Copilot and introduced the Zero-Knowledge Threat Actor concept. His research has driven ten coordinated security disclosures across Open WebUI, MongoDB, Jenkins, BIND, Moodle, TYPO3, Perplexity, Microsoft, and others.

His work has been covered by Forbes, The Economist, Business Insider, VentureBeat, The Register, The Hacker News, and CyberScoop.

Conference talks: RSA Conference 2026, Botconf 2022, BSidesTLV 2025 AI Hacking Village, Qubit 2025 Prague, RootedCon 2026.

vitalysim.com

Creator: DEF CON Talks

We all know AI can find bugs. After a decade of research, I asked a harder question: can an autonomous system invent new attack techniques, and use them to hack live websites at scale? Building this sounded like a bad idea, so I did it.

It worked – I’ll share an arsenal of new HTTP desync triggers, gadgets, and exploits that compromised banks, security solutions, and government infrastructure. Then I’ll trace each discovery chain back through the HTTP Terminator, showing how to turn your personal expertise into an autonomous weapon – and the dark arts required to make it lethal.

I’ll also share discoveries from beyond the autonomy horizon – some only reachable with a tight human/AI research loop, and others beyond AI’s reach entirely. These include a powerful undisclosed recon technique, and anomalies that hint at new attack classes offering alternative paths to critical impact. I’ll analyse the discovery process, sharing detailed experiments that probe the boundaries of what AI can and can’t discover.

You’ll leave with new exploits from desync triggers to undisclosed attack classes, and a blueprint for turning your instincts into an autonomous research cascade. And yes, I’ll open-source the HTTP Terminator.

https://portswigger.net/research/http1-must-die https://i.blackhat.com/BH-USA-25/Presentations/US-25-Dolan-Gavitt-AI-Agents-for-Offsec-with-Zero-False-Positives-Thursday.pdf https://portswigger.net/research/listen-to-the-whispers-web-timing-attacks-that-actually-work https://www.intruder.io/research/practical-http-header-smuggling

People:
    SpeakerBio:  James “albinowax” Kettle, PortSwigger

James ‘albinowax’ Kettle is the Director of Research at PortSwigger, the makers of Burp Suite. He’s best known for pioneering novel web attack techniques, and publishing them at major conferences like Black Hat USA, at which he’s presented for nine consecutive years.

He also loves exploring and advising on innovative tool concepts for security professionals, many of which have since become industry standard. Examples include introducing OAST via Burp Collaborator, bulk parameter discovery via Param Miner, billion-request attacks with Turbo Intruder, and human-style scanning with Backslash Powered Scanner.

His best-known research is HTTP Desync Attacks, which popularised HTTP Request Smuggling. Other popular attack techniques that can be traced back to his research include web cache poisoning, the single-packet attack, server-side template injection, and password reset poisoning. He’s also the designer behind many of the topics and labs that make up the Web Security Academy, and serves on the Black Hat Europe review board.

Creator: DEF CON Talks

Go out and find some goofy stuff!!

The DEF CON 34 CHV Scavenger Hunt rules and treasure list can be found at the attached link.

Start Time: Friday, August 7 10:00

End Time: Sunday, August 9: 12:00

One Car Hacking Village 2026 Badge will be awarded to the first player to complete the Scavenger Hunt!

Links:
    Rules and List – https://drive.google.com/drive/folders/1cNDWbFOdm13aA9_NwG94Qvy15H265T_o?usp=sharing

Creator: DEF CON Talks

Four years after KB5014754 and one year after CVE-2024-49019, every hardening guide says Active Directory Certificate Services is a closed book. This talk reopens it.

We present five new primitives — proposed as ESC18 through ESC22, extending the public ESC1–ESC17 numbering — each validated end-to-end on a fully-patched Windows Server 2025 Enterprise CA with every Microsoft-recommended mitigation applied. Every primitive starts from a Domain Users account with no ACL, GPO, or template edges, and ends at krbtgt extraction.

Each primitive targets a different component of the post-2022 defence: the CA’s CSR processor, the CA’s Security-Extension writer, the KDC’s PKINIT binder, the CA’s Enroll-On-Behalf-Of path, and the registry-level enforcement layer everyone thinks is already hardened. Together they argue that Microsoft’s 2022 and 2024 fixes patched specific instances of the underlying bug classes, not the classes themselves — and that at least one control has an undocumented fallback path its own documentation does not mention.

A Certipy research fork will be released at the time of the talk to check and exploit the new techniques.

https://posts.specterops.io/certified-pre-owned-d95910965cd2 https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49019 https://posts.specterops.io/adcs-esc13-abuse-technique-fda4272fbd53 https://github.com/ly4k/Certipy

People:
    SpeakerBio:  Daniel Monzon

Daniel Monzón (stark0de) — Offensive Security Engineer at Halborn with 6+ years of offensive security experience across web pentesting, code review, Active Directory (on-premise and hybrid), Android/iOS mobile audits, thick-client assessments and red teaming. Holds certifications such as: OSCP, CRTP, OSWP, CREST CPSA, eMAPT, PACSP, and CARTP. Has been credited with multiple CVEs in open-source and commercial products, and currently focuses on Web3 and financial-sector security. Prior speaker at hack0n, RootedCON Málaga, DragonJARCON, and SecAdmin.

SpeakerBio:  Eric Labrador

Eric Labrador is an offensive security researcher at Accenture with over 6 years of experience breaking into networks, applications, and buildings for a living. His day-to-day work covers Red and Purple Team exercises, web and API audits, Android and iOS mobile application assessments, internal and external penetration testing, physical intrusions into corporate buildings, and large-scale phishing campaigns. He holds the OSCP, CRTE, CRTO, BSCP, and eWPTXv2 certifications, and is the author of ImagePanick, an open-source exploit chain that achieves arbitrary file write and remote code execution by combining weak default policies in ImageMagick with SAFER bypasses in Ghostscript, all triggered from a malicious SVG. Over the years he has delivered end-to-end attack paths that chain phishing, external footholds, lateral movement, and physical entry into full compromise across multiple industries, helping clients understand what a motivated attacker can actually do with the people, processes, and technology already in place.

Creator: DEF CON Talks

Modern Windows exploit mitigations have made memory corruption significantly harder, but reliable privilege escalation still emerges from a quieter class of bugs: logical flaws in privileged components. This talk shows how low impact Windows bugs become practical SYSTEM exploits when treated as reusable primitives over privileged resources.

We will walk through two distinct LPE chains to illustrate this concept. First, we demonstrate a novel LPE approach achieved by chaining service-level process termination with arbitrary file deletion. Second, we explore another powerful LPE path that leverages kernel- and task-driven registry creation and deletion primitives, ultimately turning attacker-controlled registry state into code execution via Performance DLL hijacking.

• ZDI-24-1098: https://www.zerodayinitiative.com/advisories/ZDI-24-1098/
• ZDI-24-451 / CVE-2024-30033: https://www.zerodayinitiative.com/advisories/ZDI-24-451/
• CVE-2025-60705: Windows Client-Side Caching Elevation of Privilege Vulnerability
• CVE-2025-59512: Windows Arbitrary Registry Deletion Elevation of Privilege Vulnerability
• Public Microsoft / MSRC security update references for patched issues
• itm4n, “Windows RpcEptMapper Service Insecure Registry Permissions EoP”: https://itm4n.github.io/windows-registry-rpceptmapper-eop/
• itm4n, “An Unconventional Exploit for the RpcEptMapper Registry Key Vulnerability”: https://itm4n.github.io/windows-registry-rpceptmapper-exploit/

People:
    SpeakerBio:  Bocheng “Crispr” Xiang, Fudan Univeristy

Bocheng Xiang (@crispr_x) is a PhD candidate at Fudan University. He is listed on the MSRC MVR 2024/2025 and ranked Top #20 on the MSRC 2024 Q3 Windows Leaderboard. He has published papers at USENIX Security 2025, and his works have been accepted by PoC2025, re//verse2026 and BlackHat USA/Europe.

SpeakerBio:  HeeChan “heegong123” Kim, TeamH4C

HeeChan Kim is a security researcher and a student at Soongsil University, specializing in Windows OS internals and Local Privilege Escalation (LPE). As a winner of the DEF CON 33 CTF with team MMM and a member of TeamH4C, he actively hunts for zero-days and persistent logical flaws within complex OS architectures. He has previously presented his Windows LPE research at POC and RE//verse.

Creator: DEF CON Talks

System Guard Runtime Monitor was meant to be an OS integrity anchor on Windows. A kernel driver, gated behind Protected Process Light (PPL), and a runtime attestation engine running in a secure enclave. In this talk, we revisit a classic code injection technique and adapt it into what we call “Bring Your Own Vulnerable WerFaultSecure”. Instead of loading a third-party vulnerable driver, we bring our own vulnerable copy of a PPL-enabled Microsoft binary and its dependencies to get code execution as a protected process. From there, we pivot into the Microsoft System Guard kernel driver, a component that was built to support the integrity attestation of kernel objects, specifically processes, but which can be abused to tamper with those exact objects instead. We will close by sharing Indicators of Compromise (IOCs), along with prevention and detection ideas for defenders, and by discussing the innovation this exploit chain brings to the offensive security landscape.

https://infocon.org/mirrors/vx%20underground%20-%202025%20June/Papers/Windows/Internals%20and%20Analysis/2022-08-02%20-%20Inside%20Windows%20Defender%20System%20Guard%20Runtime%20Monitor.pdf https://www.microsoft.com/en-us/security/blog/2018/04/19/introducing-windows-defender-system-guard-runtime-attestation/ https://googleprojectzero.blogspot.com/2018/10/injecting-code-into-windows-protected.html https://googleprojectzero.blogspot.com/2018/11/injecting-code-into-windows-protected.html https://x.com/GabrielLandau/status/1683854578767343619 https://blog.scrt.ch/2023/03/17/bypassing-ppl-in-userland-again/ https://iamelli0t.github.io/2021/04/10/RPC-Bypass-CFG.html
https://github.com/Slowerzs/PPLSystem https://github.com/mdsecactivebreach/com_inject/ https://helgeklein.com/blog/anatomy-of-werfault-exe-application-crash-error-reporting/

People:
    SpeakerBio:  Angelo Frasca Caccia, SentinelOne

Angelo is a security researcher specialized in Windows Internals. He currently works at SentinelOne, where he conducts research on advanced exploits and tampering techniques targeting the Windows ecosystem. Angelo’s background also includes web application penetration testing and red teaming, particularly assume-breach adversary simulations.

Angelo is eCXD, eCPPT, eJPT and OSCP certified. He enjoys reverse engineering and programming, mostly in C/C++. His GitHub profile (https://github/lem0nSec) features his main contributions to the cybersecurity community.

Angelo has a master’s degree in International Security Studies from University of Leicester, where he graduated in 2021 with the ‘Best Campus-Based Masters Dissertation Prize’ and the ‘Best Campus-Based Masters Student Performance Prize’.

Creator: DEF CON Talks

CloudBashing started with reversing the private AWS, Azure, and GCP CloudShell REST and websocket terminal protocols, then tracing and analyzing janky browser authentication/credential flows from cookies to OAuth tokens. Along the way, we automated the APIs to access free CPU/networking, maintained access across container/VM resets, utilized persistent $HOME for implants/data, locked users out of sudo access, and installed a C2 framework. We discovered IAM design issues like: AWS role assumption that result in a large # of environments per compromised identity, web socket sessions that survive API token revocation, and M365/Gmail consumer email accounts that have default CloudShell access. This turned into a newly released exploit toolkit, CloudBasher, that enumerates, validates, installs, and runs distributed workloads with virtual storage and private networking across a large-scale agent network with persistence and resilience. We’ll demo distributing CPU-intensive workloads, using virtual storage for staging/exfiltration, secure networking for proxy and obfuscated exfil paths, while automating the discovery, enumeration, creation of CloudShell environments from initial credentials/sessions to implants/setup/networking to management and control.

Amazon Web Services, “AWS CloudShell service authorization reference,” https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudshell.html

Amazon Web Services, “AWS Systems Manager StartSession API (SSM framing basis),” https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_StartSession.html

Google Cloud, “Cloud Shell API v1 REST reference,” https://docs.cloud.google.com/shell/docs/reference/rest/v1/users.environments

Microsoft Azure, “Azure Cloud Shell overview,” https://docs.microsoft.com/en-us/azure/cloud-shell/overview

OSRU @ ronin.ae, “AWS CloudShell analysis: privileged container, exposed block devices and container escape(s),” October 23, 2023, https://web.archive.org/web/20240912135502/https://ronin.ae/news/aws-cloudshell-analysis/

Aidan Steele, “Deep dive into AWS CloudShell,” awsteele.com, January 11, 2024, https://awsteele.com/blog/2024/01/11/deep-dive-into-aws-cloudshell.html

Paul Schwarzenberger, “CloudShell slip-up: command-line access to underlying AWS infrastructure,” Medium, October 15, 2024, https://medium.com/@paulschwarzenberger/cloudshell-slip-up-command-line-access-to-underlying-aws-infrastructure-ae77a0858088

Rhino Security Labs, “AWS CloudShell Lateral Movement,” https://rhinosecuritylabs.com/aws/cloudshell-lateral-movement/

Eduard Agavriloae, “notyet: AWS IAM Credential Revocation Gaps,” offensai, https://www.offensai.com/blog/notyet-aws-iam-credential-revocation-gaps

Dan Vittegleo, cloudshell-store, GitHub Repository, https://github.com/dan-v/cloudshell-store

FrancescoDiSalesGithub, “Google-cloud-shell-hacking,” GitHub Repository, https://github.com/FrancescoDiSalesGithub/Google-cloud-shell-hacking

Bipin Jitiya, “Google Cloud Shell Container Escape,” Medium, December 14, 2025, https://medium.com/@win3zz/google-cloud-shell-container-escape-b69ffb46b5df

Bertrand Martel, “AWS SSM Session: JavaScript library for AWS Systems Manager Session Manager,” GitHub, https://github.com/bertrandmartel/aws-ssm-session

Amazon Web Services, “Amazon SSM Agent: agentmessage.go,” AWS GitHub Repository, https://github.com/aws/amazon-ssm-agent/blob/c65d8ac29a8bbe6cd3f7cea778c1eeb1b06d49a3/agent/session/contracts/agentmessage.go

SentinelOne, “CVE-2026-32169: Azure Cloud Shell SSRF Vulnerability,” SentinelOne Vulnerability Database, March 19, 2026, https://www.sentinelone.com/vulnerability-database/cve-2026-32169/

People:
    SpeakerBio:  Jenko “edleft” Hwong, Huntress Labs

Jenko Hwong is a Principal Security Researcher at Huntress Labs, focusing on identity-based attacks and cloud abuse. Prior to Huntress, he spent 6 years at Netskope Threat Labs, has spoken at RSA and DEFCON, and is a Cloud Village Lead. He has over 20 years at various security startups in cloud detection/response, vulnerability scanning, AV/AS, pen-testing/exploits, L3/4 appliances, threat intel, and windows security.

SpeakerBio:  Chris Ryan, Huntress Labs

A series of oddly configured server banners, a JARM fingerprint, curious fields in a security certificate – these aren’t just technical details, but are instead threads in a narrative tapestry woven like a John le Carre novel. For over 20 years, Chris has dedicated his life to studying these threads and the intersection between cybersecurity, Russian linguistics, and free and open source software. His career path has taken detours through academia, aerospace and defense, software development, and cybersecurity.

Creator: DEF CON Talks

ATMs are the ultimate high-stakes target, often holding upwards of $400,000 in a single enclosure. While the global financial industry relies on a narrow pool of manufacturers, the software supply chain securing these “vaults” remains an underexamined attack surface. Following my disclosure of 6 code execution vulnerabilities affecting Diebold Nixdorf’s Vynamic Security Suite (VSS) at DefCon32, this research dives deeper into the foundational security layer: CryptWare CryptoPro Secure Disk for BitLocker.

CryptoPro acts as a proprietary security wrapper, adding pre-boot authorization, custom TPM protections, and an obfuscated encryption layer to the standard BitLocker architecture. I will be disclosing 9 new CVEs that allow an unauthenticated adversary to dismantle the CryptoPro stack. Join me as I share my journey of locating secrets buried in unallocated disk space, abusing TPM sealing logic, and deconstruct CryptoPro’s custom AES256 logic to recover the BitLocker keys. This presentation will highlight how a trusted security component became a critical backdoor.

In addition to the technical walk through, I will be releasing ragavan, a custom exploitation toolkit designed to automate secret extraction, decryption, TPM unsealing, and compromise of a CryptoPro-protected platform.

• Burch, Matt “Where’s the Money: Defeating ATM Disk Encrytion” DEFCON Media Server, https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Matt%20Burch%20-%20Where%E2%80%99s%20the%20Money%20-%20Defeating%20ATM%20Disk%20Encryption-white%20paper.pdf
• Freingruber, R., and M. von Dach. “Manipulation of pre-boot authentication in CryptWare CryptoPro Secure Disk for Bitlocker” SEC Consult, https://sec-consult.com/vulnerability-lab/advisory/manipulation-of-pre-boot-authentication/
• Diebold Nixdorf Legal Terms, https://dnlegalterms.com/products/
• Vynamic Security Suite 3.0 EULA, https://dnlegalterms.com/wp-content/uploads/2020/03/2020026_Diebold_Nixdorf_EULA_for_VYNAMIC_SECURITY_3_0_December_19_2018_022249.pdf
• Vynamic Security Suite 4.5 EULA, https://dnlegalterms.com/wp-content/uploads/2024/10/Diebold-Nixdorf-Third-Party-EULA-for-Vynamic-Security-Suite-4.5.pdf
• VirusTotal CryptoPro Client Installer, https://www.virustotal.com/gui/file/235646487eed8cb648f9d05dafd3c25255b6c53a30aa87cae0ce061081d2b0b7
• VirusTotal CryptoPro Server Installer, https://www.virustotal.com/gui/file/1f42ac4f4d177dc2c38228e02d3c47ecfeb32ee7c17766b8e67145348274a8cc
• cpsd it services GmbH. “CryptoPro Quick Install Guide”, https://secure-disk-for-bitlocker.com/quick-install-guide/
• cpsd it services GmbH. “CryptoPro Secure Disk for BitLocker Administration Manual”, https://docslib.org/doc/7196170/cryptopro-secure-disk-for-bitlocker-administration-manual
• Jean-Philippe Aumasson, “Serious Cryptography A practical Introduction to Modern Encryption” No Starch Press
• Christof Paar and Jan Pelzl, “Understanding Cryptography A Textbook for Students and Practitioners” Springer

People:
    SpeakerBio:  Matt Burch, Principal Security Researcher at Atredis Partners

Matt Burch is a Principal Security Researcher at Atredis Partners with 20 years of experience breaking things that aren’t supposed to break. From the embedded components of ATM platforms to complex SCADA/OT environments, Matt specializes in identifying critical flaws in hardened, enterprise-class systems. He is best known for his research into ATM disk encryption and Mobile Device Management (MDM) security, some of which has been highlighted in Wired Magazine and presented at DEF CON 32.

Matt is a reverse engineer and tool developer who has authored and contributed to various public projects. His career spans roles as an offensive security lead, expert witness, and technical advisor. Matt’s current research is a deep-dive into the ATM software supply chain, specifically targeting the subversion of TPM-backed roots of trust and the analysis of custom cryptographic primitives.

Creator: DEF CON Talks

Creator: DEF CON Talks

North Korea operates the world’s most extreme digital environment. Its custom Android OS enforces an “allowlist” ecosystem where media and apps require state-issued cryptographic signatures to run, while background daemons capture secret screenshots to log “illegal” activity. In this restrictive environment, the stakes for accessing outside information are measured in prison sentences and public executions.

Yet, the hackers are active. This talk deconstructs the regime’s information control systems—from signature-verification logic to TraceViewer forensics—and reveals how a network of defectors and technologists is fighting back. We will demo Pigeon, a working SELFSIGN spoof that bypasses handset verification, and discuss eMMC chip-off techniques used to study device internals, and look at Windows data concealment methods used by defectors.

This isn’t just a technology briefing; it’s an offensive security call for support. I will map out a unique and intriguing engineering backlog which includes media obfuscation tools, Android internals research, binary analysis, anti-forensics, and hardware hacking. I will show how these skills directly translate into freedom-of-information tool development. Built and validated through iterative testing with defectors, some of these technologies are operational already today.

• Korean Ministry of Unification: Annual North Korean Refugee Arrival Statistics: https://www.unikorea.go.kr/eng_unikorea/
• Citizen Lab: Red Star OS Analysis (2015): https://citizenlab.ca/2015/09/red-star-os/
• 38 North: North Korean technology reporting: https://www.38north.org
• Martyn Williams: North Korea Tech: https://www.northkoreatech.org
• Defector interviews and memoirs
• Jieun Baek: North Korea’s Hidden Revolution

People:
    SpeakerBio:  JDT, Liberty in North Korea

JDT brings over a decade of cybersecurity expertise to his role as Chief Technology Officer at LiNK. Before joining the organization, he served as the lead specialist for the U.S. Department of Homeland Security’s HQ Threat Hunt team, following ten years spent in incident response and red-teaming across the banking, retail, and tech sectors.

After volunteering for the North Korean human rights movement in 2019, JDT stepped into the CTO role in 2025 to spearhead the development of tools designed to pierce the world’s most restrictive information environment. By repurposing his deep understanding of adversary tradecraft, he develops unconventional technologies that empower North Koreans to access outside information safely and bypass state surveillance.

Creator: DEF CON Talks

A program crashes with a segmentation fault. Then, it crashes again. And again. What looks like crazy behaviour is actually an exploit, running one crash at a time.

In this talk, we present Segmentation Fault-Oriented Programming (SFOP), a novel exploitation technique that weaponizes 12 previously unknown weaknesses in the Linux kernel’s handling of signals to execute arbitrary code. SFOP is designed to bypass Intel CET, the most widely deployed hardware Control-Flow Integrity (CFI) scheme on modern x86-64 systems, built to stop classic code-reuse attacks such as Return-Oriented Programming (ROP) and Sigreturn-Oriented Programming (SROP). Unlike previous CFI bypass techniques, SFOP is a general-purpose technique that can by-default reliably exploit any vulnerable x86-64 application with Intel CET enabled, becoming the lowest-hanging fruit attack after Intel CET.

We will show how SFOP bypasses CFI and turns a single memory-corruption vulnerability into arbitrary code execution on real-world targets. Through practical exploits, we demonstrate that what appears to be a process trapped in a crash loop is, in reality, attacker-controlled execution progressing fault by fault. Finally, we discuss the underlying weaknesses that make SFOP possible and the mitigations needed to defend against this new class of attacks.

Our paper has a ~50 references, like most academic papers. We have references to the Linux kernel lines that showcase the vulnerabilities we find, even! Here we copy paste our references, but everything is properly ordered in the paper.

[1] LMS Phrack 40. Bypassing cet & bti with functional oriented programming. https://phrack.org/issues/71/7_md. (29-10-2025). [2] Martin Abadi, Mihai Budiu, Ulfar Erlingsson, and Jay Ligatti. Control-flow integrity. In Proceedings of the 12th ACM Conference on Computer and Communications Security, CCS ’05, page 340–353, New York, NY, USA, 2005. Association for Computing Machinery. [3] Marcos Bajo and Christian Rossow. Await() a second: evading control flow integrity by hijacking c++ coroutines. In Proceedings of the 34th USENIX Conference on Security Symposium, SEC ’25, USA, 2025. USENIX Association. [4] Markus Bauer, Ilya Grishchenko, and Christian Rossow. Typro: Forward cfi for c-style indirect function calls using type propagation. In Proceedings of the 38th Annual Computer Security Applications Conference, ACSAC ’22, page 346–360, New York, NY, USA, 2022. Association for Computing Machinery. [5] Lucas Becker, Matthias Hollick, and Jiska Classen. Sok: on the effectiveness of control-flow integrity in practice. In Proceedings of the 18th USENIX Conference on Offensive Technologies, WOOT’24, USA, 2024. USENIX Association. [6] Lorenzo Binosi, Gregorio Barzasi, Michele Carminati, Stefano Zanero, and Mario Polino. The Illusion of Randomness: An Empirical Analysis of Address Space Layout Randomization Implementations. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, 2024. [7] Tyler Bletsch, Xuxian Jiang, Vince W. Freeh, and Zhenkai Liang. Jump-oriented programming: A new class of code-reuse attack. In Proceedings of the ACM Symposium on Information, Computer and Communications Security, ASIACCS, 2011. [8] Erik Bosman. x86: Srop mitigation: implement signal counting. https://lkml.org/lkml/2014/5/15/858. (12-11-2025). [9] Erik Bosman and Herbert Bos. Framing signals – a return to portable shellcode. In 2014 IEEE Symposium on Security and Privacy, pages 243–258, 2014. [10] Nicholas Carlini, Antonio Barresi, Mathias Payer, David Wagner, and Thomas R. Gross. Control-Flow bending: On the effectiveness of Control-Flow integrity. In 24th USENIX Security Symposium (USENIX Security 15), pages 161–176, Washington, D.C., August 2015. USENIX Association. [11] Chromium. syscall sets.cc – chromium github. https://github.com/chromium/chromium/blob/main/sandbox/linux/seccomp-bpf-helpers/syscall sets.cc#L353. (12-11-2025). [12] Exploit Database. Nginx 1.3.9 – 1.4.0 – chuncked encoding stack buffer overflow (metasploit). https://www.exploit-db.com/exploits/25775. (29-10-2025). [13] V8 Developers. Control-flow integrity in v8. https://v8.dev/blog/control-flow-integrity. (29-10-2025). [14] Docker Docs. Seccomp security profiles for docker. https://docs.docker.com/engine/security/seccomp/. (12-11-2025). [15] Victor Duta, Fabian Freyer, Fabio Pagani, Marius Muench, and Cristiano Giuffrida. Let me unwind that for you: Exceptions to backward-edge protection. In Symposium on Network and Distributed System Security (NDSS), 2023. [16] Mozilla Firefox. Sandboxfilter.cpp – firefox github. https://github.com/mozilla-firefox/firefox/blob/main/security/sandbox/linux/SandboxFilter.cpp#L1178. (12-11-2025). [17] Alexander J. Gaidis, Joao Moreira, Ke Sun, Alyssa Milburn, Vaggelis Atlidakis, and Vasileios P. Kemerlis. Fineibt: Fine-grain control-flow enforcement with indirect branch tracking. In Proceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses, RAID ’23, page 527–546, New York, NY, USA, 2023. Association for Computing Machinery. [18] GNU. Gcc wiki – vtv. https://gcc.gnu.org/wiki/vtv. (12-11-2025). [19] GNU. Program instrumentation options. https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html. (12-11-2025). [20] Yingjie Guo, Liwei Chen, and Gang Shi. Function-oriented programming: A new class of code reuse attack in c applications. In 2018 IEEE Conference on Communications and Network Security (CNS), pages 1–9, 2018. [21] Enes Goktas, Elias Athanasopoulos, Herbert Bos, and Georgios Portokalidis. Out of control: Overcoming control-flow integrity. In 2014 IEEE Symposium on Security and Privacy, pages 575–589, 2014. [22] Hong Hu, Zheng Leong Chua, Sendroiu Adrian, Prateek Saxena, and Zhenkai Liang. Automatic generation of Data-Oriented exploits. In 24th USENIX Security Symposium (USENIX Security 15), pages 177–192, Washington, D.C., August 2015. USENIX Association. [23] Hong Hu, Shweta Shinde, Sendroiu Adrian, Zheng Leong Chua,Prateek Saxena, and Zhenkai Liang. Data-oriented programming: On the expressiveness of non-control data attacks. In 2016 IEEE Symposium on Security and Privacy (SP), pages 969–986, 2016. [24] Intel. A technical look at intel® control-flow enforcement technology. https://www.intel.com/content/www/us/en/developer/articles/technical/technical-look-control-flow-enforcement-technology.html. (29-10-2025). [25] Seunghoon Jeong, Jaejoon Hwang, Hyukjin Kwon, and Dongkyoo Shin. A cfi countermeasure against got overwrite attacks. IEEE Access, 8:36267–36280, 2020. [26] Linux Kernel. Control-flow enforcement technology (cet) shadow stack. https://docs.kernel.org/arch/x86/shstk.html. (12-11-2025). [27] LLVM. Control flow integrity design documentation. https://clang.llvm.org/docs/ControlFlowIntegrityDesign.html. (12-11-2025). [28] Linux manual page. Sigaction(2) – linux manual page. https://man7.org/linux/man-pages/man2/sigaction.2.html. (05-10-2025). [29] Ben Niu and Gang Tan. Modular control-flow integrity. In Proceedings of the 35th ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI ’14, page 577–587, New York, NY, USA, 2014. Association for Computing Machinery. [30] PaX. Address space randomization. https://pax.grsecurity.net/docs/aslr.txt, 2003. (12-11-2025). [31] Aravind Prakash, Xunchao Hu, and Heng Yin. vfguard: Strict protection for virtual function calls in cots c++ binaries. In Proceeding of the Annual Network and Distributed System Security Symposium (NDSS), 01 2015. [32] Bootlin Elixir Cross Referencer. create rstor token (linux kernel source code). https://elixir.bootlin.com/linux/v6.15.2/source/arch/x86/kernel/shstk.c#L64. (29-10-2025). [33] Bootlin Elixir Cross Referencer. get shstk data (linux kernel source code). https://elixir.bootlin.com/linux/v6.15.2/source/arch/x86/kernel/shstk.c#L272. (29-10-2025). [34] Bootlin Elixir Cross Referencer. libc sigaction (glibc source code). https://elixir.bootlin.com/glibc/glibc-2.33/source/sysdeps/unix/sysv/linux/sigaction.c#L42. (29-10-2025). [35] Bootlin Elixir Cross Referencer. pte mkwrite shstk (linux kernel source code). https://elixir.bootlin.com/linux/v6.15.2/source/arch/x86/include/asm/pgtable.h#L491. (29-10-2025). [36] Bootlin Elixir Cross Referencer. rt sigaction (linux kernel source code). https://elixir.bootlin.com/linux/v6.15.7/source/kernel/signal.c#L4644. (29-10-2025). [37] Bootlin Elixir Cross Referencer. rt sigreturn l266 (linux kernel source code). https://elixir.bootlin.com/linux/v6.15.2/source/arch/x86/kernel/signal 64.c#L266. (29-10-2025). [38] Bootlin Elixir Cross Referencer. rt sigreturn l275 (linux kernel source code). https://elixir.bootlin.com/linux/v6.15.2/source/arch/x86/kernel/signal 64.c#L275. (29-10-2025). [39] Bootlin Elixir Cross Referencer. setup signal shadow stack l364 (linux kernel source code). https://elixir.bootlin.com/linux/v6.15.2/source/arch/x86/kernel/shstk.c#L364. (29-10-2025). [40] Bootlin Elixir Cross Referencer. setup signal shadow stack l370 (linux kernel source code). https://elixir.bootlin.com/linux/v6.15.2/source/arch/x86/kernel/shstk.c#L370. (29-10-2025). [41] Bootlin Elixir Cross Referencer. Sigaction (linux kernel source code). https://elixir.bootlin.com/linux/v6.15.2/source/arch/x86/include/uapi/asm/signal.h#L93. (05-10-2025). [42] Bootlin Elixir Cross Referencer. Sigframe (linux kernel source code). https://elixir.bootlin.com/linux/v6.15.2/source/arch/x86/include/asm/sigframe.h#L59. (05-10-2025). [43] Bootlin Elixir Cross Referencer. sigset t (glibc source code). https://elixir.bootlin.com/glibc/glibc-2.33/source/signal/bits/types/sigset t.h#L7. (29-10-2025). [44] Bootlin Elixir Cross Referencer. sigset t (linux kernel source code). https://elixir.bootlin.com/linux/v6.15.7/source/arch/x86/include/asm/signal.h#L25. (29-10-2025). [45] AliAkbar Sadeghi, Salman Niksefat, and Maryam Rostamipour. Pure call oriented programming (pcop): chaining the gadgets using call instructions. Journal of Computer Virology and Hacking Techniques, 14:1–18, 05 2018. [46] Felix Schuster, Thomas Tendyck, Christopher Liebchen, Lucas Davi, Ahmad-Reza Sadeghi, and Thorsten Holz. Counterfeit object-oriented programming: On the difficulty of preventing code reuse attacks in c++ applications. In Proceedings of the IEEE Symposium on Security and Privacy, SP, 2015. [47] Hovav Shacham. The geometry of innocent flesh on the bone: Return-into-libc without function calls (on the x86). In Proceedings of the ACM conference on Computer and Communications Security, CCS, 2007. [48] sroettger. Ierae ctf 2024. https://gist.github.com/sroettger/fe66f7eb0cb10a8ebd1454875a7131ea. (29-10-2025). [49] Ubuntu. Compilerflags – ubuntu wiki. https://wiki.ubuntu.com/ToolChain/CompilerFlags. (29-10-2025). [50] Chao Zhang, Scott A. Carr, Tongxin Li, Yu Ding, Chenyu Song, Mathias Payer, and Dawn Song. Vtrust: Regaining trust on virtual calls. In Proceedings of the Annual Network and Distributed System Security Symposium (NDSS), 2016. [51] Tianning Zhang, Miao Cai, Diming Zhang, and Hao Huang. esrop attack: Leveraging signal handler to implement turing-complete attack under cfi defense. In Fengjun Li, Kaitai Liang, Zhiqiang Lin, and Sokratis K. Katsikas, editors, Security and Privacy in Communication Networks, pages 752–769, Cham, 2023. Springer Nature Switzerland

People:
    SpeakerBio:  Marcos “h3xduck” Bajo, CISPA Helmholtz Center for Information Security

Marcos Bajo aka h3xduck is a security researcher and PhD student at the CISPA Helmholtz Center for Information Security in Germany. His research focuses on exploitation techniques and malware, but more broadly, he’s interested in breaking things others build—and building things to break things.

SpeakerBio:  Ritvik “RoYalGamr” Goyal

Ritvik Goyal is a Senior Undergraduate in Mathematics and Scientific Computing at the Indian Institute of Technology Kanpur. He recently worked as a Research Intern at the CISPA Helmholtz Center, focusing on system security research regarding Control Flow Integrity protections like Intel CET. He is a key member of the competitive CTF team Wiredin IITK and actively mentors students in cybersecurity at Programming Club IIT Kanpur.

Creator: DEF CON Talks

Have you ever discovered a header injection vulnerability and settled for little more than an open redirect or XSS? In this session, we introduce a battle-tested “header injection” powered desync methodology, enabling you to perform HTTP request smuggling attacks against even strictly RFC-compliant proxy chains.

We will begin by explaining a well-known but overlooked CRLF injection primitive that produced HTTP Request Splitting inside the core infrastructure of a major CDN, resulting in the capture of live users’ credentials across thousands of compromised applications.

Building upon this, we’ll demonstrate how header injections can be used to exploit more traditional smuggling attack classes, even when no parser discrepancy exists. Finally we’ll reveal how you can shift previously non-compliant desync attacks into the browser, unlocking a plethora of novel exploitation opportunities even when keep-alive connections are not shared between users. The result is a slew of real-word case studies with impacts ranging from account takeovers via desync-enabled XSS gadgets to cache poisoning, response queue poisoning, access control bypasses, and in several cases the possibility of creating the ever-terrifying desync worm.

Finally, we’ll release two open source tools that introduce robust detection of header injection.

People:
    SpeakerBio:  Tom “t0xodile” Stacey, Independent

Tom ‘t0xodile’ Stacey is a security researcher at PortSwigger with a passion for automating the ideas that “will never work” to find gaps in the industry’s current understanding of web security. He is best known for his work in discovering and exploiting underappreciated forms of desync attacks.

At PortSwigger he spends most of his time experimenting with the HTTP protocol and the vulnerabilities that arise due to the disagreements between web servers and components with the goal of finding novel techniques to improve Burp Suite’s capabilities. When he’s not at work, he’s usually playing some form of video / board game or building Lego.

SpeakerBio:  Tobia “mastersplinter” Righi, TurtleSec

I am a security research and bug bounty hunter, recently I have started TurtleSec with other talented hackers, focusing on research driven projects. I spend most of my time tinkering with applications to try and figure out how to break them in the weirdest of ways.

Creator: DEF CON Talks

CUDA’ve done better – Hacking Nvidia GPUs for container-escape and privilege escalation. We found and exploited a UAF in the NVIDIA Linux kernel module that allows us to escape NVIDIA containers and gain root access on the host. We’ll show novel exploitation techniques: bypass kernel heap mitigations, deterministically win races by abusing rw_semaphore, and execute code on the kernel without ever jumping anywhere (by writing directly to physical memory).

People:
    SpeakerBio:  Daniel “0xDACA” Cohen Hillel

I used to be a vulnerability researcher for the army, but now that I’m a full time physics grad student researching superconducting quantum computers at the Weizmann Institute (very unrelated to hacking).

I just love hacking so much that I still do it in my spare time, while not doing physics. I like using hacking as an excuse to learn and deeply understand stuff. NVIDIA is a good example. I wanted to learn more about GPUs because of all the latest advancements in AI, so instead of seeing a tutorial/lecture about it, I just opened the code and started researching it. Another good example is when I hacked Merkle trees to learn more about zero-knowledge proofs.

SpeakerBio:  Noam Trobishi, Atom

Noam is a low-level systems, GPU, and vulnerability researcher at Atom, where he works on GPU infrastructure for AI. He previously served in an IDF cyber unit and later worked as a vulnerability researcher at a private cybersecurity company. Noam holds a B.Sc. in Computer Science and Mathematics from the Hebrew University of Jerusalem and is currently pursuing a master’s degree in Mathematics at the Hebrew University.

Creator: DEF CON Talks

Click a link, lose your MFA codes. Your AI assistant reads your email and exfiltrates the data through Bing, and you never notice.

We found a 1-click attack chain against Microsoft 365 Copilot that combines three vulnerability classes everyone assumed were solved – CSP, SSRF, and HTML injection – into one kill shot. A URL parameter lands directly in the AI engine as an executable prompt, a vector we call Parameter-to-Prompt (P2P) injection. The AI searches the victim’s mailbox, grabs sensitive data, and emits an img tag with the loot in the URL. That tag renders mid-stream, before the output sanitizer fires, because sanitization is a post-processing step. The img src hits Bing’s Search by Image endpoint – CSP-allowlisted – which server-side fetches to our domain, tunneling stolen data through Microsoft’s own infrastructure.

CSP enforced. Sanitizer running. AI guardrails active. All three defenses in place – the chain walked right through them. None of these bugs are new. Each has textbook mitigations. But nobody tests what happens when old web bugs compose with AI behaviors – web teams and AI teams don’t test each other’s seams. We break down the full chain, demo it live, and hand you a methodology for hunting composition bugs across AI-integrated platforms.

People:
    SpeakerBio:  Dolev Taler, Varonis

Dolev Taler is a senior security researcher at Varonis Threat Labs with over a decade of cybersecurity experience spanning red teaming, reverse engineering, vulnerability research, and malware analysis. He is passionate about machine learning and its pivotal role in modern threat detection, having developed advanced detection models, investigated ransomware attacks for major global enterprises, and reported vulnerabilities in critical infrastructure systems. Beyond tackling high-stakes cyber threats, Dolev also enjoys perfecting the art of coffee brewing and improving his lock-picking skills.

SpeakerBio:  Mark Vaitsman, Varonis

Mark Vaitsman is a Security Research Team Leader at Varonis, a leader in Data Security. He is a passionate cybersecurity expert with extensive experience in leading security threat and research teams in various Cyber Security companies, analyzing emerging threats, incident response and developing innovative solutions. Mark is also a lecturer of Cyber Security courses, sharing his knowledge and shaping the next generation of cybersecurity professionals. Previously spoken at BlackHat, DeepSec, RSAC, CrestCon. In his free time he likes sailing in the sea and riding a motorcycle.

Creator: DEF CON Talks

People:
    SpeakerBio:  Nikita Kronenberg
No BIO available
SpeakerBio:  Michael “sparky” Moore, Lead, Network Operations Center at DEF CON

Michael Moore “sparky” somehow convinced people to let him run the DEF CON Network Operations Center, where he leads the team responsible for building and operating the network that thousands of attendees immediately try to break. With more than 20 years with DEF CON, project management, and technical leadership, he’s learned that every impossible deadline is just another networking problem with better marketing. He’s still waiting for the year everything works exactly as planned.

SpeakerBio:  polybius, Global Village Lead at DEF CON Communications

¯_(ツ)_/¯

Creator: DEF CON Talks

People:
    SpeakerBio:  Jeff “The Dark Tangent” Moss

Mr. Moss is an internet security expert and is the founder of both the Black Hat Briefings and DEF CON Hacking conferences.

Creator: DEF CON Talks

How did DEF CON Franklin’s cyber volunteers helped American water systems become more secure as they rise to the top of adversaries’ target lists? This talk by Franklin co-founder Jake Braun will outline the program, share success stories from volunteer engagements, and discuss lessons learned from the past year of deployments. The session will also cover Franklin’s expansion into new states, highlight findings from the DEF CON Hackers’ Almanack, and examine why leading security tools struggle to meet the needs of resource-constrained water systems. Finally, the talk will lay out a path to scaling cybersecurity for water systems nationwide through a centrally managed network of regional MSSPs, and how the DEF CON community can help build it from the ground up.

Links:
    Website – https://defconfranklin.com
    Bluesky – https://bsky.app/profile/projectfranklin.bsky.social
    LinkedIn – https://www.linkedin.com/company/def-con-franklin

People:
    SpeakerBio:  Jake Braun, DEF CON Franklin

Jake Braun is the co-founder of DEF CON Franklin and the Executive Director of the Cyber Policy Initiative at the University of Chicago Harris School of Public Policy. He most recently served in the White House as acting Principal Deputy National Cyber Director. While at the White House, he oversaw the implementation of the National Cybersecurity Strategy, including efforts to secure our water systems, modernize the federal cyber workforce, enhance cyber cooperation with allied nations, and develop AI cybersecurity policy.

In addition to his role at the University of Chicago, Mr. Braun co-founded the DEF CON Voting Machine Hacking Village. In that capacity, he co-authored two award-winning reports on the cyber security of our election infrastructure: the DEF CON 25 and 26 Voting Village Reports. Most recently, he partnered with DEF CON, the world’s largest and longest running hacker conference, to launch “DEF CON Franklin,” a program to memorialize the most innovative and impactful findings from DEF CON in the annual “Hackers’ Almanack.” “DEF CON Franklin” also recruits cyber volunteers to support underresourced critical infrastructure.

Creator: DEF CON Talks

Over a decade ago, a much younger Patrick showed that macOS (then OS X) was vulnerable to what had long been considered a Windows-only attack: dynamic library hijacking. By planting malicious libraries in the right place, attackers could achieve stealthy persistence, inject code into trusted processes, and even bypass core Apple security mechanisms.

Today, an older (and hopefully wiser) Patrick revisits that work to answer a simple question: is dylib hijacking truly dead on modern macOS, or has Apple’s decade of defenses, including Gatekeeper, App Translocation, Notarization, and the Hardened Runtime, simply made it harder?

This talk revisits the technique in 2026, analyzing these mitigations and evaluating their real-world effectiveness. While the attack surface has been significantly reduced, we show dylib hijacking remains possible under the right conditions. Through real-world examples and live demos, we explore how modern applications can still be coerced into loading attacker-controlled libraries, enabling code execution within trusted processes and bypassing controls such as TCC.

Finally, we present practical detection and defense strategies, including novel approaches leveraging Endpoint Security to detect (and block!) malicious library loads at runtime.

“Dylib hijacking on OS X” 
www.virusbulletin.com/virusbulletin/2015/03/dylib-hijacking-os-x

“Tweaking macOS security controls to thwart application bundle manipulation” 
redcanary.com/blog/threat-detection/mac-application-bundles/

“What’s New in Security” (WWDC 2016)
 devstreaming-cdn.apple.com/videos/wwdc/2016/706sgjvzkvg6rrg9icw/706/706_whats_new_in_security.pdf

People:
    SpeakerBio:  Patrick Wardle, CEO and Co-Founder at DoubleYou

Patrick Wardle is the cofounder of the Objective-See Foundation, CEO and cofounder of DoubleYou, and author of The Art of Mac Malware series. He previously worked at NASA and the NSA, and has presented at countless security conferences, making him intimately familiar with aliens, spies, and talking nerdy.

Creator: DEF CON Talks

Privacy should be accessible to all. Historically, counter-surveillance tools have been expensive, complex, and inaccessible to most individuals, often limited to well-funded researchers and costly hardware configurations. The ESP32 offers a transformative alternative. This presentation will demonstrate how an affordable microcontroller has become the foundation for a growing suite of open-source, user-friendly anti-surveillance tools. We will discuss the technical features that make the ESP32 a compelling choice for these applications, including passive 802.11 and Bluetooth monitoring, OUI-based device fingerprinting, and robust cryptographic capabilities. Applications include detecting police body cameras in operational environments, mapping Flock Safety automatic license plate recognition (ALPR) infrastructure, identifying unauthorized drones, detecting radio frequency jamming across 2.4GHz, 5GHz, and cellular bands, and tracking autonomous robots operating with known-vulnerable firmware. These tools are cost-effective and freely available. We will also consider future developments in accessible counter-surveillance hardware, such as the ESP32-S5 with 5GHz support, GPS, displays, haptics, etc. Advancing anti-surveillance culture requires designing devices that individuals are motivated to use and carry.

People:
    SpeakerBio:  Cooper “Cybertiger” Quintin, Board Member at Open Archive

Cooper Quintin is a security researcher and senior public interest technologist with the EFF Threat Lab. research fellow with Citizen Lab, adviser to CoRD Research and Design, and board member of Open Archive. He has worked on projects including Rayhunter, Privacy Badger, Canary Watch, and analysis of state sponsored malware campaigns such as Dark Caracal. Cooper has given talks about security research at prestigious security conferences including Black Hat, DEFCON, Enigma Conference, and ReCon about issues ranging from IMSI Catcher detection to fem tech privacy issues to newly discovered APTs. He has also been published or quoted in publications including: The New York Times, Reuters, NPR, CNN, and Al Jazeera. Cooper has given security trainings for activists, non profit workers, and vulnerable populations around the world. He previously worked building websites for nonprofits, including Greenpeace, Adbusters, and the Chelsea Manning Support Network. Cooper was also an editor and contributor to the hacktivist journal, “Hack this Zine.” In his spare time he enjoys making music, visualizing a solar-punk communitarian future, and playing with his kids.

SpeakerBio:  Colonel Panic

Malware researcher by day, IoT rapid prototyper by night. Creator of Mesh-Detect and Oui-Spy. I love making things and bringing my ideas to a completed prototype rapidly. I’m Interested in privacy, digital rights, and detecting all the things.

SpeakerBio:  The Wrew, Hackers.Town

Product Manager working on building pentesting platforms by day, hacker and electronics prototyper by night (and occasional weekend). Creator of VoidMantisOS for the hacker pager and SpectraMesh mesh networking protocol. Interested in security, privacy, RF, electronics and fighting digital surveillance. Listed under: just handle

Creator: DEF CON Talks

People:
    SpeakerBio:  Paul Nakasone
No BIO available
SpeakerBio:  Jeff “The Dark Tangent” Moss

Mr. Moss is an internet security expert and is the founder of both the Black Hat Briefings and DEF CON Hacking conferences.

Creator: DEF CON Talks

The cybersecurity community chases the greatest risks in the latest tech, while components with outdated security principles gather dust. Companies rush to secure their latest AI product, while their network remains the same. Do attackers really need more than legacy services to take you down?

We asked this question as we analyzed an unauthenticated RCE in GNU-TelnetD that was discovered in January. We were amazed a simple shell injection existed for so long in the most popular telnet daemon. We further investigated Telnet and discovered it runs a root-privileged process with environment variables supplied by an unauthenticated client! Leading us to a privilege escalation vulnerability.

We then looked into Samba, the Linux service for sharing files and printers over SMB. Focused on shell injections, we searched for command execution using format strings – and we couldn’t believe it! Two more shell injection RCEs waited for us! In this talk, you’ll ask yourself, “How come it was only found in 2026?!” We will analyze the unauthenticated RCE in TelnetD and reveal three severe vulnerabilities: 2 unauthenticated RCEs in Samba (CVE-2026-4480 & CVE-2026-4408) and a privilege escalation in TelnetD (CVE-2026-28372). The routers or printers you forget to update might run those services, and they put you at risk

https://www.safebreach.com/blog/safebreach-labs-root-cause-analysis-and-poc-exploit-for-cve-2026-24061/

People:
    SpeakerBio:  Ron Ben Yizhak, SafeBreach

Ron (@RonB_Y) is a security researcher at SafeBreach with 11 years of experience. He works in vulnerability research and has knowledge in forensic investigations, malware analysis and reverse engineering. Ron previously worked in the development of security products and spoke several times at DEF CON

Creator: DEF CON Talks
It started as fuzzer noise: an OSS-Fuzz crash in PHP’s concat_function, filed under a JIT target but with no JIT in the stack. It is a core Zend Engine use-after-free, reproducible with php -n and no extensions. This is an honest exploitability study on Linux x86-64: from the mistriaged crash to native command execution (arbitrary read/write via stale DateInterval, zif_system resolved in-process, ASLR and PIE defeated at runtime) even where disable_functions is set. It builds on the public exploitation lineage, with an SPL ArrayObject delivery trick as our own delta.

1. OSS-Fuzz Issue #483856591 — Original crash report filed under php-fuzz-function-jit target
2. PHP Source: Zend/zend_operators.c, concat_function() — https://github.com/php/php-src/blob/master/Zend/zend_operators.c
3. php/php-src#16726 — Array-element UAF (second-chain vulnerability used to bypass mod-16 alignment barrier)
4. Zend MM Internals: https://www.phpinternalsbook.com/php7/memory_management/zend_memory_manager.html
5. CVE-2022-29072 — Prior 7-Zip zero-day by the same researcher (Kağan Çapar), demonstrating track record in vulnerability research
6. CVE-2026-5201 — gdk-pixbuf heap buffer overflow discovered by the same researcher, acknowledged by Red Hat (CVSS 7.5)
7. W3Techs PHP Usage Statistics — https://w3techs.com/technologies/details/pl-php
8. V8 Sandbox Design (2024) — Referenced in comparative interpreter memory model analysis

People:
    SpeakerBio:  Can Oztas

Can Oztas is a security researcher with applied R&D experience across several key sectors, including defense, finance, and telecommunications. His background encompasses AppSec, vulnerability research, and offensive security engineering. He is currently a PhD student focusing on the intersection of Artificial Intelligence and cybersecurity.

SpeakerBio:  Kağan Çapar

Kağan Çapar is a Vulnerability Researcher with over 15 years of experience. His research focuses on binary exploitation, fuzzing, and zero-day discovery across widely deployed software.

Creator: DEF CON Talks

Microsoft integrated Python into Excel, giving users more advanced data analysis. The Python code is processed in a cloud container and returned as results. This sparks an immediate question: does it allow remote code execution on Microsoft owned servers?

In this talk, we’ll dig into the various web applications and components in the Python execution environment. We’ll describe how we discovered a privilege escalation vulnerability in the file upload mechanism of this service, which allowed us to gain root access within the container. Utilizing that, we revealed the complete architecture of this solution. We will show how we discovered Microsoft’s internal deployment configuration, including key vaults, database servers, account names, tenant IDs, and much more. We were even able to execute code on the pilot servers of this product.

We also found how to craft a special response to Excel, resulting in bypassing two security boundaries (CVE-2026-45459): the trusted records protection (“Enable Content” warning) and the network isolation protection.

We will expose features that weren’t even announced yet and how they might be exploited. Follow us in our journey from the first “whoami” command, through exfiltrating tailor-made Python libraries, and eventually finding a vulnerability to achieve execution as root!

https://i.blackhat.com/Asia-25/Asia-25-Carmel-The-Problems-of-Embedded-Python-in-Excel.pdf https://www.netspi.com/blog/technical-blog/red-teaming/a-first-look-at-python-in-excel/

People:
    SpeakerBio:  Ron Ben Yizhak, SafeBreach

Ron (@RonB_Y) is a security researcher at SafeBreach with 11 years of experience. He works in vulnerability research and has knowledge in forensic investigations, malware analysis and reverse engineering. Ron previously worked in the development of security products and spoke several times at DEF CON

Creator: DEF CON Talks

On December 29, 2025, Poland’s energy sector was hit by what we believe was the first destructive cyber sabotage attack against energy infrastructure in NATO. Our public report described attacks against 30 renewable energy sites and a large combined heat and power plant. But one piece of the incident was still missing – and it led to an attack path we had never seen in the wild before.

This talk goes behind the scenes of the investigation into a second, smaller CHP plant affected during the same campaign. What first looked like human error turned into a three-month hunt through false leads, forgotten remote access devices, wiped industrial hardware, cellular connectivity, and infrastructure that was assumed to be isolated.

The talk ends with lessons on private APN security, OT incident response, and handling large-scale cyber incidents involving critical infrastructure.

People:
    SpeakerBio:  Marcin Dudek, CERT.PL

Marcin Dudek leads CERT Polska, Poland’s national CERT. Before taking on this role, he spent more than a decade in hands-on technical work across OT security, incident response, and APT investigations. His background includes industrial control systems security in critical infrastructure environments, including Poland’s only research nuclear reactor, as well as analysis of APT activity targeting Poland. He regularly speaks at local and international cybersecurity conferences and was deeply involved in the response to the incident described in this talk.

Creator: DEF CON Talks

Python is widely used in LLM applications and agent frameworks. Its ease of use comes from two core features: a uniform object model and dynamic reflection, which unfortunately also enable an emerging vulnerability class: Python class pollution. To date, with only one CVE and a handful of synthetic examples since its first disclosure in 2023, what is known is merely the tip of the iceberg, the real threat runs far deeper into the Python ecosystem.

In this talk, we introduce the first complete taxonomy of this vulnerability class, built from two object-resolution primitives and three object-assignment primitives, which together yield six types. Only one was previously known.

Building on this taxonomy, we design and implement Pyrl, the first automated framework for detecting Python class pollution via a novel static analysis technique named operational taint analysis. Applying Pyrl to over 600,000 GitHub and PyPI packages, we found 47 exploitable zero-days in Azure CLI, Taipy, ComfyUI, Google Mesop, HuggingFace Smolagents, and others. Through live case studies, we show how class pollution can be weaponized into token exfiltration, authentication bypass, stored XSS, sandbox escape, and RCE. Most importantly,we demonstrate that even the weakest type—one previously unknown—can still lead to critical impact in practice.

People:
    SpeakerBio:  Gavin Zhong, Johns Hopkins University

Jiacheng (Gavin) Zhong is a security researcher, focusing on AI system security, program analysis, and identity security. He recently completed his M.S. in Security Informatics at Johns Hopkins University, where his work was accepted to IEEE S&P 2026. Gavin has reported over 30 CVEs in widely used open-source projects. He is also an active CTF player with r3kapig, an international team ranked top 3 worldwide.

SpeakerBio:  Zhengyu Liu, Johns Hopkins University

Zhengyu Liu is a third-year PhD student in Computer Science at Johns Hopkins University. His research focuses on web and software security via program analysis. His work received Distinguished Paper (S&P ’25), Honorable Mention (USENIX ’25), and Best Student Paper (ICICS ’22). He is a DEF CON speaker and is a member of CTF team TheHackersCrew.

SpeakerBio:  Jianjia Yu, Johns Hopkins University

Jianjia Yu is a PhD student at Johns Hopkins University, advised by Prof. Yinzhi Cao. Her research focuses on security and privacy in web and mobile ecosystems using program analysis techniques. Her work has received Distinguished Paper Awards at CCS ’23 and S&P ’25, and an Honorable Mention at USENIX Security ’25. She has discovered over 40 zero-day vulnerabilities and uncovered privacy leaks affecting millions of users across browser extensions and mobile applications.

Creator: DEF CON Talks

What if your keystroke injection implant could be triggered from kilometers away, through walls, without WiFi, cellular, or line-of-sight? What if the entire Meshtastic network relayed your commands for you? M.I.A. (Mesh Injection Apparatus) is a new open-source offensive tool that combines USB HID injection with LoRa mesh networking. Plant a device during brief physical access, then trigger payloads remotely- across a building, a campus, or a city, using Meshtastic’s encrypted mesh protocol. No internet required. No WiFi range limitations. Just long-range, low-power radio that blends into the growing ecosystem of LoRa devices. This talk covers the complete build: understanding USB HID at the protocol level, reverse-engineering Meshtastic’s packet structure and AES-CTR encryption, implementing a DuckyScript parser from scratch in C++, and designing custom PCB hardware. I’ll demonstrate remote-triggered injection over the mesh network, discuss operational considerations for red teams, and release all firmware, schematics, and tooling as open source. MIA represents a new class of implant, one that stays connected when traditional C2 channels fail.

https://www.blackhillsinfosec.com/introducing-lora-long-range-wireless-technology-part-1/

(I would like to cite Venky Raju’s talk, but I could not find it online. I will try to reach out to him.)

People:
    SpeakerBio:  Benito “paperclipsvinny” Sauceda

Benito Sauceda is a 19-year-old university student who saw a talk at a small regional conference, got inspired, and spent the next few months procrastinating homework to build his own version from scratch. It escalated quickly.

His proudest accomplishments stem mostly from growing cybersecurity communities, a curious side effect of talking about hacking with everyone around him. He founded cybersecurity clubs at both his high school and local community college, taught cybersecurity to 8–12th grade students through the Bay Area Cyber League, and helped develop regional cybersecurity competitions for 16 Bay Area community colleges.

This is his first DEF CON talk.

Creator: DEF CON Talks

In 2025, Amnesty International, in collaboration with Google TAG, released a write-up of an in-the-wild chain of USB Linux kernel vulnerabilities which was used to compromise mobile devices.

Whilst the vulnerabilities themselves were disclosed, no details on how these vulnerabilities could be exploited were provided. This led us to deep dive into these issues to determine how they could be leveraged for arbitrary code execution.

This is the story of exploiting one of these vulnerabilities (CVE-2024-53104), an out of bounds write in USB Video which offered a brilliant exploit primitive leading to highly reliable code execution when chained together with an information leakage vulnerability.

In this talk we will first discuss the in-the-wild vulnerabilities, moving on to providing background of USB specifics for several device classes and coverage guided fuzzing for finding new issues.

We will then move onto a more recent information disclosure vulnerability CVE-2025-38494 which could be leveraged to bypass KASLR.

An extensive deep dive into CVE-2024-53104 vulnerability will be performed (the OOB write) and we will discuss our novel technique used for exploitation of this issue and expose the power of the UVC_QUIRK_RESTRICT_FRAME_RATE quirk!

Finally, we will wrap up our talk with several demonstrations.

People:
    SpeakerBio:  Alex Plaskett, NCC Group

Alex Plaskett (@alexjplaskett) is an Associate Director within the Exploit Development Group (EDG) at NCC Group. Alex is a five-time Pwn2Own winner (desktop, mobile, embedded, and automotive) and has over 16+ years of experience in vulnerability research and exploitation. Alex has exploited vulnerabilities in a large range of high-profile products across many different areas of security. Alex is a frequent speaker at security conferences (e.g. BlackHat, OffensiveCon, Hexacon, HITB, BlueHat, POC, Troopers etc). Alex was previously leading security teams in Fintech, Mobile Security and Security Research) and just generally causing vendors to patch things on a regular basis!

SpeakerBio:  Robert Herrera, NCC Group

Robert Herrera (@robert.herrera_) is a Lead Security Researcher within the Exploit Development Group (EDG) at NCC Group. Robert has extensive experience performing high-impact security audits and reverse-engineering for a diverse set of technologies ranging from automotive, modems, secure boot platforms, and wireless technologies. Robert has 9+ years of experience and has worn many hats over the years ranging from iOS Developer, Software Engineer, to Reverse Engineer.

Creator: DEF CON Talks

Contact discovery on instant messengers is designed to help users find their friends. But when identifiers are predictable and safeguards are weak, it allows attackers to find everyone. At that point, “catching ’em all” stops being a slogan and becomes an engineering problem.

In this talk, we show how we turned WhatsApp into a global Pokédex. By combining reverse-engineered API access with large-scale phone number generation, we probed tens of billions of candidates and identified over 3.5 billion active WhatsApp accounts — all from a single machine, without raising flags and getting blocked.

Beyond simple presence checks, enumeration exposes rich metadata, including profile pictures, public keys, device information, timestamps, and user-defined about tags. This enables both macroscopic insights into global platform usage and profiling of individual users.

Our analysis uncovers systemic issues, such as persistent exposure of numbers from historical data leaks and reuse of cryptographic keys across accounts. Moreover, we expose signals of criminal activity (e.g., drug dealers and scam factories), and measurable activity in regions where WhatsApp is officially restricted (e.g., North Korea).

At global scale, small design decisions become big problems. This is what allowed us to complete our 3.5B-sized Pokédex.

https://github.com/sbaresearch/whatsapp-census

Paper: Hey there! You are using WhatsApp: Enumerating Three Billion Accounts for Security and Privacy, Gegenhuber et al., NDSS 2026

People:
    SpeakerBio:  Maximilian Guenther, SBA Research

Max Guenther is master student at University of Vienna. He is a cybersecurity nerd and research engineer at XBow. Previously, he was security analyst at Austrian Power Grid and security researcher at the Austrian Armed Forces.

SpeakerBio:  Gabriel Gegenhuber, University of Vienna

Gabriel is working on measuring cellular networks, mobile communication and the Internet. In recent years, his research has examined security and privacy issues in global instant messaging platforms that use end-to-end encryption, such as WhatsApp and Signal. He completed his bachelor’s and master’s degrees at TU Wien and his PhD at the University of Vienna. He is currently a postdoctoral researcher at IT:U Linz.

Creator: DEF CON Talks

Browser-in-the-Middle (BitM) phishing is no longer just a research curiosity. Since its 2021 formalization, BitM has been cataloged by MITRE as an official attack pattern, recognized as a severe threat to MFA-protected web applications. Because the victim authenticates directly through the attacker’s browser rather than their own, the technique effectively bypasses most traditional forms of MFA.

This talk presents two years of research on weaponizing BitM for advanced offensive operations. We investigated what novel attack techniques become possible when an attacker fully controls the browser the victim interacts with. This includes real-time keystroke logging, in-transit file interception and silent modification, session persistence that keeps operator access alive long after the victim logs out, and microphone/webcam capture achieved through social-engineered browser flows.

The practical validation of this research is P-BitM, the first open-source framework for Persistent Browser-in-the-Middle spear-phishing, which will be released at DEF CON 34. The “Persistent” in P-BitM carries its full offensive meaning: a single phishing click becomes a persistent beachhead. We will break down our core research, demonstrate these new attack vectors via demo videos, and showcase the capabilities of the tool.

https://link.springer.com/article/10.1007/s10207-021-00548-5 https://github.com/JoelGMSec/EvilnoVNC https://github.com/b3rito/peeko

People:
    SpeakerBio:  Giacomo “GiacoLenzo2109” Lenzini, EY

Giacomo Lenzini is an Offensive Security Specialist and Red Teamer at EY Italy, and an independent security researcher. His work focuses on adversary simulation, red team operations, and penetration testing. He has received recognition from organizations such as NASA and has identified several vulnerabilities with associated CVEs.

Creator: DEF CON Talks

Have you ever wanted to know what your neighbor does on their network and what sites they’re browsing? How about all the people around you on their mobile phones, on cellular data?

GPON is the fiber-to-home protocol that carries traffic for hundreds of millions of subscribers worldwide (and climbing). It operates on a threat model that makes several assumptions that break in the real world.

We’ll chat about how it’s possible to become a modern day fiber optic voyeur with hardware that costs about $100 and watch your neighbor’s DNS, SIP calls and most excitingly, GTP-tunneled 4G/5G traffic from the cellular towers that you share a fiber line with.

Additionally, we show some fun, new techniques to retain your access even if your ISP wisens up and enables downstream AES encryption, by hacking the Optical Line Terminal itself over the fiber line, and how to build your own botnet army out of all the members of your ISP.

Finally, we’ll also explore how we built custom hardware to read and write onto a fiber line despite the rules of the network (and land).

• Anime4000 repo with prior art on modifying the RTL960x family of chipsets
• GPON FTTH networks (in)security
• Hack GPON community

People:
    SpeakerBio:  Rithwik “thel3l” Jayasimha, Lagrange Point

Rithwik is a hacker who’s been breaking into systems since the impressionable age of 10.

SpeakerBio:  Rithvik Vibhu, Lagrange Point

Rithvik has always been fascinated by network systems and in the past was a core contributor to the HNS ecosystem. In the past, he reverse engineered an implementation of UPI in India, and built distributed proxy infra.

Creator: DEF CON Talks

Humans are hacking AI systems. Humans are hacking with AI systems. But also, AIs are hacking human systems. They’re finding and exploiting vulnerabilities in computer code, and they’ll soon be doing the same with all sorts of other codes. For example: the tax code can be hacked. Vulnerabilities are called loopholes, exploits are called tax avoidance strategies, and black hats are called accountants. Similarly, financial markets can be hacked. So can any system of rules or laws, including democracy itself. AIs will hack these systems at our request, and they’ll also do this innately, organically – and possibly in ways we don’t immediately see. We need to consider a world where increasingly sophisticated hacks or our social, economic, and political systems are discovered computer speeds, and then exploited at computer scale and scope. Right now, our systems of patching these systems operate at a human pace, which won’t be good enough.

https://www.schneier.com/academic/archives/2021/04/the-coming-ai-hackers.html

People:
    SpeakerBio:  Bruce Schneier, Advisory Board Member at VerifiedVoting.org

Bruce Schneier is an internationally renowned security technologist, called a “security guru” by the Economist. He is the New York Times best-selling author of 14 books – including Rewiring Democracy and A Hacker’s Mind — as well as hundreds of articles, essays, and academic papers. His long-running newsletter and blog, “Schneier on Security,” is one of the most popular sources of cybersecurity news on the internet. Schneier is a Fellow and Lecturer in Public Policy at the Harvard Kennedy School and the Munk School at the University of Toronto. He is a fellow at the Berkman-Klein Center for Internet and Society at Harvard University, a board member of the Electronic Frontier Foundation and AccessNow, and an advisory board member of EPIC and VerifiedVoting.org. He is also the Chief of Security Architecture at Inrupt, Inc.

Creator: DEF CON Talks

One day, I woke up to a simple message from a friend: “What do you know about CAN bus?” Expecting him to have car trouble, I called him and asked, “What do you need?”

Turns out the car trouble was actually jetski trouble: he bought a Sea-Doo jetski for very cheap – but it came without a key. A quick research on his side showed that the jetski does not (like others from the time) use a simple magnet key: No, the jetski has a full, digital immobilizer system, and just the tools to diagnose and program in a new key cost more than the jetski. And zero public information is available on how this all works.

And so we dove in: from reverse-engineering the CAN bus diagnostics protocol and the electronic key protocol to designing our own freely programmable key and a Flipper Zero jetski diagnostic app, this talk goes into the weeds of hacking something that I didn’t even know needed to be hacked: Jetskis!

People:
    SpeakerBio:  stacksmashing, hextree.io

Thomas Roth aka stacksmashing is a security researcher mostly focused on hardware and firmware. His work includes hardware attacks on processors & microcontrollers, building cheap JTAG tooling for the iPhone, and attacking a wide variety of embedded devices. He also runs a YouTube channel called stacksmashing about security, reverse engineering and hardware hacking.

Creator: DEF CON Talks

What happens when you wander into a surplus store and walk out with a bomb disposal robot? You name him “Boomba” and tear him apart. Built by Roomba creator iRobot, the PackBot is often used by agencies who need to deploy a small, ruggedized robot in potentially dangerous locations. But beneath its rugged shell lies a fascinating time capsule of early 2000s engineering. As the platform’s physical capabilities evolved to meet extreme operational demands, its core software trailed behind, relying on legacy hardware and an architecture built before modern security controls. This talk is a full-stack teardown of a six-figure tactical asset. We’ll explore its 25-year evolution: mapping undocumented interfaces, fabricating custom cables, and replacing legacy 4.9 GHz restricted-band radios with custom hardware. We will dive into the software to expose unencrypted VPN connections and entirely plaintext Python 2.5 control protocols. We will also demonstrate vulnerabilities that grant full root access. Finally, we’ll decompile its modern tablet control app, breaking down the JAUS protocol to reveal a critical command injection vulnerability. With a live PackBot on stage, we’ll intercept telemetry, pop the LFI, and eavesdrop on network traffic. Watch Boomba get turned back into a vacuum, and catch him later at the Car Hacking

People:
    SpeakerBio:  Patrick “gigstorm” Kiley, Google

Patrick Kiley is a Security Consultant doing embedded security testing and has over 20 years of information security experience. Patrick has performed research in avionics security, vehicles, and even managed to brick his Tesla making it go faster. Patrick has a patent pending on a embedded security access tool and loves tearing things apart while figuring out how they work.

SpeakerBio:  Emily “@astradotpng” Astranova, Google

Emily is a security consultant doing physical security testing, covert entry and penetration testing of all the things. Emily has intentionally compromised US power grid systems, unintentionally compromised data centers and has somehow managed to keep her record to only one run-in with the FBI. In her spare time, Emily volunteers as a software and cybersecurity mentor for high school students as a part of FIRST Robotics.

Creator: DEF CON Talks

What happens when two researchers spend several days scrutinizing the Polish web? We didn’t just find anomalies—we took action. Join us as we reveal the results of our intensive research, which led to multiple official reports to CSIRT GOV, NASK, and MON. We will walk you through our findings, the scale of the threats discovered, and provide essential recommendations for a more secure digital future.

People:
    SpeakerBio:  Robert “ProXy” Kruczek, Securitum

I am a Cybersecurity Consultant, Mentor, and Ethical Hacker (known in the infosec community as ProXy) at Securitum – Poland’s leading cybersecurity firm – and a contributor to sekurak.pl, the country’s largest infosec portal. With over 10 years of experience in vulnerability research and penetration testing.

Operating under the ProXy alias, I discovered and reported 43 CVEs and I am an active Bug Bounty hunter (Hall of Fame at OLX, reports for BlaBlaCar, OVH, and ERCOM).

SpeakerBio:  Kamil Szczurowski, Securitum

On a daily basis, Kamil Szczurowski specializes in web application security testing and social engineering assessments. In his free time, he analyzes malware, APT campaigns, open-source software, and software used by government institutions, which has resulted in multiple CVE entries and publications. He is also an author of articles published on sekurak.pl.

Creator: DEF CON Talks

Underground VPN and tunneling ecosystems are widely used to monetize compromised servers and sell “free internet” access through SSH, SOCKS, and multi-protocol tunnels. These operations rely heavily on open-source infrastructure management tools deployed on rented or hacked Linux servers. But what happens when the tools themselves are weaponized?

In this talk we dissect FirewallFalcon Manager, a VPN/SSH server management toolkit widely promoted in Telegram communities. While it presents itself as a legitimate open-source platform, our analysis reveals a multi-layered supply-chain attack targeting the very operators who deploy it.

FirewallFalcon silently installs backdoors, injects a rogue TLS root certificate, hijacks DNS resolution, and redirects proxy traffic through attacker-controlled infrastructure to enable large-scale Man-in-the-Middle interception. Earlier versions also deployed a Telegram reconnaissance bot and a universal SSH backdoor granting root access to infected servers.

Using reverse engineering, GitHub history analysis, DNS infrastructure mapping, and large-scale internet scanning, we uncovered hundreds of active servers inside this compromised ecosystem. This talk exposes a new class of supply-chain attacks: hackers hacking the infrastructure used by other hackers.

People:
    SpeakerBio:  Assaf Morag, Flare

Assaf Morag is a Cybersecurity Researcher and Threat Intelligence Consultant, working with various companies on research focused on underground ecosystems, attacker infrastructure, and the evolving cyberthreat landscape. His work translates adversary activity from open, deep, and dark-web sources into actionable intelligence for security teams and the software development life cycle. Previously, Assaf served as Director of Threat Intelligence at Aqua Security and held senior intelligence roles at BlueVoyant and IBM Security. His research has been featured in leading cybersecurity publications and presented at major industry conferences. He contributed to the MITRE ATT&CK® Container Framework and authored an O’Reilly course on cloud-native cyber threat intelligence.

Creator: DEF CON Talks

AI orchestration platforms promise to automate your life. They deliver, just not always for you. Kestra, Langflow, Nocobase, Flowise, Activepieces, Dify, and Apache Airflow have quietly become critical infrastructure, and they all share the same dangerous assumption: anyone who can touch a workflow is trusted to run code on the host. I went hunting across seven major platforms and walked out with multiple CVEs and critical-severity findings. I’ll share an arsenal of RCE primitives: shell injection through template rendering, exec() on user-supplied “validation” code, eval() on raw LLM output, and unauthenticated API endpoints that hand you a shell. Then I’ll demonstrate the kill shot: an unauthenticated attacker achieving full RCE through a single prompt injection into an LLM module. When I reported these, some vendors told me code execution is intended behavior and security is the deployer’s problem. I’ll show you why that argument falls apart in real deployments, and walk through the trust boundary failures that keep producing the same bugs across the ecosystem. You’ll leave with a methodology for tearing these platforms apart, a catalog of recurring vulnerability patterns, and a framework for evaluating whether a platform’s threat model survives contact with reality.

People:
    SpeakerBio:  Peyton “p80n-sec” Kennedy, Endor Labs

Peyton ‘p80n-sec’ Kennedy is a Senior Security Researcher at Endor Labs, where he focuses on offensive security research, vulnerability discovery, and exploit development against the open source projects shaping modern software. His research has produced CVE disclosures across widely deployed frameworks and platforms, including koa.js and openclaw, with a consistent focus on the gap between what platforms claim about their threat models and what they actually enforce.

Creator: DEF CON Talks

Post-quantum cryptography is being deployed to defeat a computer that doesn’t exist yet – and the rush is opening a wide, purely classical attack surface today. This talk walks three implementation attack vectors against NIST’s lattice standards (ML-KEM / FIPS 203, ML-DSA / FIPS 204): (1) memory corruption at the deserialization boundary, culminating in remote code execution through a hybrid TLS 1.3 key exchange; (2) compiler-induced timing side channels, where “constant-time” source becomes variable-time binary and yields a chosen-ciphertext key-recovery oracle; and (3) fault injection against ML-DSA’s signing state machine on a low-cost ChipWhisperer. No quantum computer is required for any of them. The talk closes with the limits of hybrid cryptography as a defense and the live release of LatticeScope, an open-source timing-leak detector and lattice-aware fuzzer for auditing compiled PQC binaries.

People:
    SpeakerBio:  Aleksandr Krasnov

Aleksandr has been an industry expert in DevSecOps, has worked in companies like Dropbox, Palo Alto Networks, and Meta/Facebook. He has spent his time doing security research and holds several patents in the area of application security. In the free time, Aleksandr spends time exploring the great outdoors in British Columbia, climbing new boulders, or free diving in the ocean.

Creator: DEF CON Talks

Ever found yourself with a dead phone battery in a Walmart parking lot? What if we told you that you could walk up to a parked EV and charge your phone directly from its traction battery – no authorization, no keys, and no official V2L features required.

As the EV market expands, the complexity of its charging infrastructure scales with it. The push for Vehicle-to-Grid (V2G) communication capabilities introduces a significant attack surface with destructive potential for high-voltage systems. In this talk, we explore the security risks within current V2G communication. We break down exactly how this data is processed internally, map out the high-voltage charging architecture, and expose logic weaknesses hiding within the vehicle’s Battery Management System (BMS) ECUs.

Based on this research, we introduce ChargeSploit, a custom hardware and software toolkit designed for cybersecurity testing of the EV charging ecosystem. Capable of simulating both vehicles and chargers, or acting as a physical Man-in-the-Middle, ChargeSploit allows researchers to intercept, manipulate, and inject payloads into live communication flows. We conclude with a live demonstration exploiting V2G protocols and the BMS to force an unauthorized discharge, successfully powering an iPhone directly from a locked EV’s traction battery.

People:
    SpeakerBio:  Fabien Guillebot, Accenture

Fabien Guillebot is a Hardware Security Researcher at Accenture based in Prague, Czech Republic. He specializes in hardware-level security testing with a primary focus on the automotive sector. Fabien’s core expertise lies in designing custom hardware for specialized penetration testing and conducting advanced research in microcontroller glitching and fault injection.

SpeakerBio:  Stepan Konicek, Accenture

Stepan Konicek, MSc. is an Embedded Systems Penetration Tester at Accenture based in Prague, Czech Republic. Specializing in automotive cybersecurity, Stepan focuses on testing and securing ECUs and full-vehicle architectures. His primary research focus lies in EV charging security, where he investigates the physical and protocol-level vulnerabilities that exist between modern vehicles and grid infrastructure.

Creator: DEF CON Talks

Last year Xeno manually reverse-engineered Realtek RTL8761B* Bluetooth chips’ ROM & firmware, to inject code into them that allows everyone to send custom packets that aren’t supposed to be possible on a well-behaved device. Previous to that Veronica manually reverse-engineered multiple firmware to find link layer over-the-air exploitable vulnerabilities. This year we wanted to understand how much time we could have saved on past projects if we had used LLMs to automate the reversing process.

The answer turns out to be “quite a lot!”. In this talk we’ll discuss how we’ve created skills for LLMs to almost entirely automate the reverse engineering of Bluetooth Low Energy / Classic chip firmwares’ low level packet handling & Host Controller Interface layers. The key is to focus on helping the LLMs find the code that you know must be there in order for a chip to be spec-compliant (“Waypoints”).

If you work in another firmware/OS RE domain, with well-defined specification-required interfaces and data structures, we expect you’ll be able to follow the same process as us to significantly accelerate your reversing. Especially if you have binaries that you’ve already reverse-engineered in the past that you can feed into an automation process for grading purposes.

[1] “Reverse engineering Realtek RTL8761B* Bluetooth chips, to make better Bluetooth security tools & classes” – Xeno Kovah – https://darkmentor.com/publication/2025-11-hardweario/
[2] “DarkFirmware_real_i” – Xeno Kovah – https://github.com/darkmentorllc/DarkFirmware_real_i [3]

People:
    SpeakerBio:  Veronica Kovah, Dark Mentor LLC

Veronica is a researcher who has created and released multiple over-the-air arbitrary code execution exploits which target Bluetooth chip firmware. She presented these attacks at BlackHat USA 2020. In 2018 she founded the security consultancy Dark Mentor LLC. She has previously worked at companies like Tesla on vehicular security and NSA as an adjunct instructor and Capability Development Specialist developing CNE tools for embedded systems. She is currently using her background in reverse engineering and exploitation to specialize in the security analysis of Bluetooth systems.

SpeakerBio:  Xeno Kovah, Dark Mentor LLC

Prior to working full time on OpenSecurityTraining2 (ost2.fyi), Xeno worked at Apple designing architectural support for firmware security; and code auditing firmware security implementations. A lot of what he did revolved around adding secure boot support to the main and peripheral processors (e.g. the Broadcom Bluetooth chip.) He led the efforts to bring secure boot to Macs, first with T2-based Macs, and then with the massive architectural change of Apple Silicon Macs. Once the M1 Macs shipped, he left Apple to pursue the project he felt would be most impactful: creating free deep-technical online training material and growing the newly created OpenSecurityTraining 501(c)(3) nonprofit.

Creator: DEF CON Talks

Active Directory remains a major component of modern enterprise networks, and its security is paramount. Active Directory attack campaigns often aim to achieve Domain Admin privileges, which allow complete control over the domain. But what if we could simply confuse domain controllers, causing them to identify us as someone else? In this talk, we’ll dive into Kerberos and Active Directory and show how curiosity and creative thinking led to the discovery of two new identity confusion vulnerabilities. The first vulnerability, KerberLoss (CVE-2026-25177), bypasses a forest-wide security mechanism to perform a Denial of Service, or even force authentication to downgrade from Kerberos to NTLM. We later discovered ResetNightmare (CVE-2026-27912): a logical flaw in a Kerberos mechanism, allowing low-privileged users to compromise any account in the domain, including domain admins, leading to full domain takeover. The vulnerability is surprisingly easy to exploit and has a single, common prerequisite, making it highly dangerous for unpatched environments. We’ll explain the vulnerabilities, show them in action, and share practical detection opportunities and mitigation strategies to reduce exposure. In addition, we’ll be releasing a tool that automatically runs the entire attack flow for simple experimentation and testing.

People:
    SpeakerBio:  Shai Laron, Semperis

Shai Laron is a Security Researcher with 6 years of experience, focusing on Active Directory, Windows, and Identity Security, working at Semperis’ Research team. He has a strong passion for researching Kerberos and has discovered multiple vulnerabilities related to it.

Creator: DEF CON Talks

Developer tools trust extension identifiers way more than they should.

A VS Code extension ID like publisher.extension shows up everywhere a dev environment gets set up, and people treat it as the same trusted thing no matter where it’s resolved, but it isn’t. Extension identity is marketplace-specific. An extension can be trusted and popular in one marketplace while the matching namespace sits unclaimed in another that the main forks actually pull from. Claim that namespace, publish under the same identifier, and a name people already trust now runs your code. It’s dependency confusion, but for editor extensions. I’ve been calling it Extension Confusion.

I’ll show where the trust boundary breaks, the IDE quirks that carry these identifiers across the gap, and what happened when I published proof-of-concept extensions to measure it for real.

The scale got out of hand fast: 1M+ callbacks, hundreds of organizations, $200k+ in bounties, all in under 3 months. Code running on laptops, managed corporate machines, remote dev setups, WSL, and containers, across SaaS, fintech, Fortune 500s, healthcare, government, and universities.

A trusted name, a missing namespace, and the marketplace gap no one was watching.

Editor extensions are supply chain. Treat them that way.

My talk from last year around malicious extensions can be a good intro:

• https://www.youtube.com/watch?v=wI8ml8WqmQc

People:
    SpeakerBio:  Raphael “rcss” Silva

Raphael Silva is a security researcher at Aikido Security, focused on web security, software supply-chain security, and vulnerability research. He has spoken at DEF CON, RootedCON, OWASP Global AppSec, Black Alps and OWASP local chapters, and has also run hands-on activities at DEF CON. His work centers on finding weird trust assumptions in real systems, turning them into clear attack models, and responsibly disclosing the results to vendors and open-source projects.

Creator: DEF CON Talks

The Apple Keychain has become a cornerstone of credential management for millions of users across the Apple ecosystem. In response, Apple has implemented robust protections for the iCloud Keychain — restricting synchronization exclusively to devices within Apple’s “Circle of Trust” and encrypting stored secrets with keys protected by the Secure Enclave. These layered defenses are designed to ensure that even physical acquisition of Keychain data from Apple’s servers yields nothing actionable.

This talk introduces a novel vulnerability (CVE-2026-28860) that fundamentally undermines these protections. Leveraging a deep understanding of macOS internals, we demonstrate a technique capable of extracting all passwords stored within the Keychain — requiring neither root privileges, a user password, nor any prompts to the user. Beyond credential theft, we explore the broader attack surface this vulnerability exposes, presenting additional scenarios where data gleaned from the iCloud Keychain enables further, more severe compromise.

People:
    SpeakerBio:  Alex Radocea

Founder of Supernetworks and cofounder of Longterm Security. Alex started in security pentesting financial firms on Wall Street at Matasano and cofounded RPISEC at RPI. He has worked on Apple’s Product Security team, engineering at CrowdStrike, and Spotify’s Security team. His research — presented at Black Hat and REcon — spans mobile messenger cryptography, kernel security, binary static analysis, and browser hardening, including the discovery of critical flaws in Apple’s iCloud Keychain.

SpeakerBio:  Jaron Bradley, Jamf

Jaron is the Director of Jamf Threat Labs where he focuses on discovering new ways to keep user’s safe on Apple devices. He is author of the books “Threat Hunting macOS” and “OS X Incident Response”. In his free time he manages themittenmac.com, a site dedicated to helping others learn security on the Apple ecosystem.

Creator: DEF CON Talks

As AI and agentic desktop apps rapidly adopt custom URI schemes for one-click onboarding—MCP install, plugin install, configuration import, prompt-driven actions—a browser click becomes a gateway into privileged local logic. Prior Electron research assumes the attacker is already inside the app; the browser-triggered, end-to-end exploitation model has remained unexplored.

We present LaunchBreak: a class of vulnerabilities where a crafted browser link launches a desktop app and injects attacker-controlled input into a multi-stage, multi-process exploit chain. We systematize the attack surface across three dimensions: payload sources (URI, attacker server, local file), cross-process flows (main/utility/renderer), and sinks (command exec, dynamic eval, module loading).

Our findings include 18 zero-days, 17 of them full RCEs, with 11 CVEs and a bug bounty. The affected apps include AFFiNE (60k stars, CVE-2026-21853), Hyper (Vercel’s terminal, bounty awarded), Cherry Studio (CVE-2025-54063), Pinokio (CVE-2025-44109), deepchat (CVE-2025-55733), Paperlib (CVE-2025-64743), and more, spanning AI assistants, music players, and dev tools. We’ll demo live exploits against apps, walk through the chains, and release Proton, the agent-guided segmented fuzzing framework we built to find them, plus PoCs for every vulnerability.

The related CCS paper if that submission is accepted (the result comes out in June.), if not, then none.

People:
    SpeakerBio:  Gavin Zhong, Johns Hopkins University

Jiacheng (Gavin) Zhong is a security researcher, focusing on AI system security, program analysis, and identity security. He recently completed his M.S. in Security Informatics at Johns Hopkins University, where his work was accepted to IEEE S&P 2026. Gavin has reported over 30 CVEs in widely used open-source projects. He is also an active CTF player with r3kapig, an international team ranked top 3 worldwide.

SpeakerBio:  Zhengyu Liu, Johns Hopkins University

Zhengyu Liu is a third-year PhD student in Computer Science at Johns Hopkins University. His research focuses on web and software security via program analysis. His work received Distinguished Paper (S&P ’25), Honorable Mention (USENIX ’25), and Best Student Paper (ICICS ’22). He is a DEF CON speaker and is a member of CTF team TheHackersCrew.

SpeakerBio:  Jianjia Yu, Johns Hopkins University

Jianjia Yu is a PhD student at Johns Hopkins University, advised by Prof. Yinzhi Cao. Her research focuses on security and privacy in web and mobile ecosystems using program analysis techniques. Her work has received Distinguished Paper Awards at CCS ’23 and S&P ’25, and an Honorable Mention at USENIX Security ’25. She has discovered over 40 zero-day vulnerabilities and uncovered privacy leaks affecting millions of users across browser extensions and mobile applications.

Creator: DEF CON Talks

Internet pioneer Aaron Swartz’s last project was SecureDrop, a whistleblower submission system that can be used by news outlets and whistleblowers to communicate safely online. At the time of Aaron’s tragic death, SecureDrop was just a prototype, but it’s now run by Freedom of the Press Foundation and used by dozens of the biggest news outlets around the world. This talk will explore the unique technical challenges in running an anonymous whistleblower platform, the future of whistleblowing technology, and the lessons we have learned about how whistleblowers and journalists actually communicate along the way. In addition, we will preview our new project, a collaboration with the Tor Project called WEBCAT, which aims to solve code verification on web browsers and make end-to-end encryption for web applications safer.

https://securedrop.org https://webcat.tech

People:
    SpeakerBio:  Trevor Timm, Freedom of the Press Foundation

Trevor is a co-founder and the executive director of Freedom of the Press Foundation (FPF), and has served on its board since 2012. He is a journalist, activist, and legal analyst whose writing has appeared in The New York Times, The Guardian, USA Today, The Atlantic, Al Jazeera, Foreign Policy, Harvard Law & Policy Review, and Politico. Trevor formerly worked as an activist at the Electronic Frontier Foundation. Before that, he helped the longtime general counsel of The New York Times, James Goodale, write the book, “Fighting for the Press,” on the Pentagon Papers and the First Amendment. He received his J.D. from New York Law School. In 2013, he received the Hugh Hefner First Amendment Award for journalism.

SpeakerBio:  redshiftzero, Freedom of the Press Foundation

Jennifer is the chief technology officer at Freedom of the Press Foundation (FPF), where she oversees the organization’s engineering teams. She is an engineer, researcher, and cypherpunk. Prior to this role, she was a founding engineer at Penumbra Labs, focusing on applied cryptography for privacy-preserving payments. She previously led development for the SecureDrop whistleblower platform. She also co-founded Lucy Parsons Labs, a Chicago-based civil liberties group. Jennifer has spoken at events including Hackers on Planet Earth, USENIX Enigma, and DEF CON Crypto & Privacy Village. She holds a doctorate in astrophysics from the University of Chicago.

Creator: DEF CON Talks

Models are starting to make security decisions that used to be written as rules. Instead of matching an input against a policy, a model reads the request and decides what to do with it. OpenSearch is one of the first to put one in production as the only thing standing between an anonymous pull request and CI pipeline secrets.

When I reported a vulnerability, the team told me their model would catch it. So I tried to get past it the way you’d expect, hiding the attack. The model caught all of it, and going at it head-on wasn’t going to work.

So I stopped trying to outsmart it and started thinking like it, reading why each attempt got caught until I understood what it could actually verify and what it only assumed. What got through in the end hid no attack, because the only dangerous part lived somewhere the model had no way to check.

This talk walks the whole path, from first failed attempt to the bypass that worked. Along the way I mapped the model’s decision boundary – what it catches, what slips past, and how far an input bends before its judgment flips. The deeper gap is what it never sees at all, the blind spots built into how it reads a change. You’ll see where a model can be trusted to make this call and where it can’t, and what that means before you put one in front of something that matters.

https://github.com/opensearch-project/security-response/security/advisories/GHSA-2vmh-cgjm-h48x – Original pull_request_target vulnerability advisory

https://github.com/opensearch-project/security-response/security/advisories/GHSA-q72p-66hv-cc73 – LLM gateway bypass advisory

https://www.aikido.dev/blog/promptpwnd-github-actions-ai-agents – Prompt injection attacks against AI code review bots (different attack class)

https://www.wiz.io/blog/six-accounts-one-actor-inside-the-prt-scan-supply-chain-campaign – 500+ AI-generated malicious PRs targeting pull_request_target across hundreds of repos, including the one repo we discuss in this talk

https://www.404media.co/hackers-simply-asked-meta-ai-to-give-them-access-to-high-profile-instagram-accounts-it-worked/ – Meta AI support system flaw

People:
    SpeakerBio:  Aviv Donenfeld, Check Point Software Technologies

Aviv Donenfeld is a Security Researcher at Check Point Software Technologies. Before security research, he built distributed networking systems as a software engineer. His recent research centers on the attack surfaces of AI coding assistants, including critical vulnerabilities in Anthropic’s Claude Code and Cursor. He has found CI/CD supply chain vulnerabilities in Microsoft, SAP, Red Hat, and multiple Linux Foundation projects. Beyond offensive research, he builds defensive security tools in the AI and forensics space.

Creator: DEF CON Talks

Every enterprise server has a second computer you probably forgot about. The baseboard management controller runs its own OS, has its own network stack, and stays on even when the server is off. It speaks IPMI, a protocol from the 1990s that Dan Farmer thoroughly dismantled in 2013. Thirteen years later, nobody went back to check. We did.

We scanned 15,000 internet-facing BMCs and 125,000 across corporate networks, extracted RAKP password hashes from three out of four targets without credentials, and cracked thousands offline. We show how to fingerprint vendors from unauthenticated GUID responses, extract Dell service tags and HPE serial numbers before logging in, and brute-force the “random” passwords that California’s SB-327 law was supposed to fix.

Then we show what comes next: pivoting from a compromised host to its BMC over the internal bus without touching the network, jumping to the out-of-band management VLAN, reusing shared credentials across the fleet, and landing on production hosts via Serial-over-LAN and virtual media. The host and BMC are the same physical machine; network segmentation means nothing when the bridge is a PCIe bus.

We release OOBscan, an open-source IPMI exploitation tool, and demonstrate the full attack chain.

========================================

FOUNDATIONAL IPMI RESEARCH (2013-2014)

Dan Farmer – IPMI Security Research Hub http://fish2.com/ipmi/

Dan Farmer – “IPMI: Freight Train to Hell” (January 2013) http://fish2.com/ipmi/itrain.html

Dan Farmer – “Sold Down the River” (June 2014) http://fish2.com/ipmi/river.pdf

Dan Farmer – IPMI Security Best Practices http://fish2.com/ipmi/bp.pdf

Dan Farmer – Cracking IPMI Passwords Remotely http://fish2.com/ipmi/remote-pw-cracking.html

Dan Farmer – IPMI Tools (GitHub) https://github.com/zenfish/ipmi

HD Moore – “A Penetration Tester’s Guide to IPMI and BMCs” (July 2013) https://www.rapid7.com/blog/post/2013/07/02/a-penetration-testers-guide-to-ipmi/

Bonkoski, Bielber, Halderman – “Illuminating the Security Issues Surrounding Lights-Out Server Management” (WOOT ’13, August 2013) https://jhalderm.com/pub/papers/ipmi-woot13.pdf

US-CERT Alert TA13-207A – Risks of Using the Intelligent Platform Management Interface (IPMI) https://www.cisa.gov/uscert/ncas/alerts/TA13-207A

CVE-2013-4786 – IPMI 2.0 RAKP Authentication Remote Password Hash Retrieval https://nvd.nist.gov/vuln/detail/CVE-2013-4786

Metasploit IPMI Modules (ipmi_dumphashes, ipmi_cipher_zero, ipmi_version) https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/auxiliary/scanner/ipmi/ipmi_dumphashes.md

========================================

INTEL ME / AMT VULNERABILITIES

CVE-2017-5689 “Silent Bob is Silent” – Intel AMT Remote Privilege Escalation (CVSS 9.8) https://nvd.nist.gov/vuln/detail/CVE-2017-5689

Intel SA-00075 – Intel Active Management Technology Elevation of Privilege (May 2017) https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00075.html

Intel SA-00086 – Intel ME/SPS/TXE Multiple Vulnerabilities (November 2017) https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00086.html

EFF – “Intel’s Management Engine is a Security Hazard” (May 2017) https://www.eff.org/deeplinks/2017/05/intels-management-engine-security-hazard-and-users-need-way-disable-it

Wikipedia – Intel Management Engine (comprehensive history) https://en.wikipedia.org/wiki/Intel_Management_Engine

Evdokimov – “Intel AMT Stealth Breakthrough” (Black Hat USA 2017) https://blackhat.com/docs/us-17/thursday/us-17-Evdokimov-Intel-AMT-Stealth-Breakthrough-wp.pdf

========================================

PLATINUM APT – WEAPONIZED OOB MANAGEMENT

Microsoft – “PLATINUM Activity Group Using Intel AMT for C2” (June 2017) https://www.microsoft.com/en-us/security/blog/2017/06/07/platinum-continues-to-evolve-find-ways-to-maintain-invisibility/

========================================

ASPEED BMC HARDWARE VULNERABILITIES

CVE-2019-6260 “Pantsdown” – ASPEED AST2400/AST2500 AHB Bridge Arbitrary R/W (CVSS 9.8) https://nvd.nist.gov/vuln/detail/cve-2019-6260

Stewart Smith – “CVE-2019-6260: Gaining Control of BMC from the Host Processor” (January 2019) https://www.flamingspork.com/blog/2019/01/23/cve-2019-6260-gaining-control-of-bmc-from-the-host-processor/

OpenBMC Security Advisory for CVE-2019-6260 https://github.com/openbmc/openbmc/issues/3475

Pantsdown Exploit Tool https://github.com/amboar/cve-2019-6260

========================================

ECLYPSIUM BMC RESEARCH (2019-2025)

Eclypsium – “CloudBorne: Bare-Metal Cloud Server Vulnerabilities” (2019) https://eclypsium.com/blog/the-ilobleed-implant-lights-out-management-like-you-wouldnt-believe/

Eclypsium – “Vulnerable Firmware in the Supply Chain” (2019) – Lenovo/Vertiv MergePoint EMS https://eclypsium.com/wp-content/uploads/Vulnerable-Firmware-in-the-Supply-Chain.pdf

Eclypsium – BMC&C Part 1: “Supply Chain Vulnerabilities Put Server Ecosystem At Risk” (December 2022) CVE-2022-40259 (RCE via Redfish API), CVE-2022-40242, CVE-2022-2827 https://eclypsium.com/blog/supply-chain-vulnerabilities-put-server-ecosystem-at-risk/

Eclypsium – BMC&C Part 2: “Lights Out Forever” (July 2023) CVE-2023-34329 (CVSS 9.1, auth bypass via HTTP header spoofing), CVE-2023-34330 https://eclypsium.com/research/bmcc-lights-out-forever/

Eclypsium – BMC&C Part 3: AMI MegaRAC Vulnerabilities (March 2025) CVE-2024-54085 (CVSS 10.0, remote auth bypass via Redfish Host Interface) https://eclypsium.com/blog/ami-megarac-vulnerabilities-bmc-part-3/

Eclypsium – “CVE-2024-54085 Joins CISA’s KEV” (July 2025) https://eclypsium.com/blog/bmc-vulnerability-cve-2024-05485-cisa-known-exploited-vulnerabilities/

Eclypsium – Nuclei Templates for AMI MegaRAC Detection (July 2025) https://eclypsium.com/blog/eclypsium-releases-tools-for-detecting-ami-megarac-bmc-vulnerabilities/

Eclypsium – “The iLOBleed Implant” (analysis/commentary) https://eclypsium.com/blog/the-ilobleed-implant-lights-out-management-like-you-wouldnt-believe/

========================================

NVIDIA BMC RESEARCH

NVIDIA OSR – “Breaking BMC: The Forgotten Key to the Kingdom” (DEF CON 31, 2023) 18 vulnerabilities, 9 exploits, full chain to persistent firmware implant https://developer.nvidia.com/blog/analyzing-baseboard-management-controllers-to-secure-data-center-infrastructure/

DEF CON 31 Talk Description (Tereshkin & Zabrocki) https://forum.defcon.org/node/245714

========================================

iLOBLEED ROOTKIT (2020-2021)

Amnpardaz – “Implant.ARM.iLOBleed.a” Technical Report (December 2021) First known in-the-wild BMC firmware implant https://threats.amnpardaz.com/en/2021/12/28/implant-arm-ilobleed-a/

Amnpardaz – Full Technical Analysis PDF https://threats.amnpardaz.com/en/wp-content/uploads/sites/5/2021/12/Implant.ARM_.iLOBleed.a-en.pdf

========================================

HPE iLO SECURITY RESEARCH & TOOLS

CVE-2017-12542 – HPE iLO4 Authentication Bypass (CVSS 9.8) https://nvd.nist.gov/vuln/detail/CVE-2017-12542

Airbus Security Lab – “Subverting Your Server Through Its BMC: The HPE iLO4 Case” (SSTIC 2018) Périgaud, Gazet, Czarny – firmware analysis, backdooring, persistence https://airbus-seclab.github.io/ilo/SSTIC2018-Article-subverting_your_server_through_its_bmc_the_hpe_ilo4_case-gazet_perigaud_czarny.pdf

Airbus Security Lab – Presentation Slides (SSTIC 2018) https://airbus-seclab.github.io/ilo/SSTIC2018-Slides-EN-Backdooring_your_server_through_its_BMC_the_HPE_iLO4_case-perigaud-gazet-czarny.pdf

Airbus Security Lab – iLO4/iLO5 Toolbox (firmware analysis, extraction, exploitation) https://github.com/airbus-seclab/ilo4_toolbox

iLO4 Unlock – Custom firmware patching for HPE iLO4 (fan control, diagnostics) https://github.com/kendallgoto/ilo4_unlock

========================================

SUPERMICRO IPMI FIRMWARE TOOLS

Supermicro IPMI Firmware Source Code (GPL release) https://github.com/devicenull/supermicro_ipmi_firmware

IPMI Firmware Tools – Extract, modify, and rebuild Supermicro firmware images https://github.com/devicenull/ipmi_firmware_tools

smcbmc – Decrypt Supermicro BMC firmware images https://github.com/c0d3z3r0/smcbmc

super-bmc-fw-tools – Decrypt Supermicro BMC firmware (alternative implementation) https://github.com/zt-chen/super-bmc-fw-tools

Supermicro IPMI License Key Generation (reverse engineered) https://github.com/manfromafar/supermicro-ipmi-keygen

========================================

JUNGLESEC RANSOMWARE (2018)

BleepingComputer – “JungleSec Ransomware Infects Victims Through IPMI Remote Consoles” (December 2018) https://www.bleepingcomputer.com/news/security/junglesec-ransomware-infects-victims-through-ipmi-remote-consoles/

========================================

GOVERNMENT ADVISORIES

CISA/NSA – “Harden Baseboard Management Controllers” Joint CSI (June 2023) https://media.defense.gov/2023/Jun/14/2003241405/-1/-1/0/CSI_HARDEN_BMCS.PDF

CISA Alert – “CISA and NSA Release Joint Guidance on Hardening BMCs” (June 2023) https://www.cisa.gov/news-events/alerts/2023/06/14/cisa-and-nsa-release-joint-guidance-hardening-baseboard-management-controllers-bmcs

NSA Press Release – “NSA and CISA Release Guide to Protect BMCs” (June 2023) https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/3426648/nsa-and-cisa-release-guide-to-protect-baseboard-management-controllers/

CISA Binding Operational Directive 23-02 – Mitigating the Risk from Internet-Exposed Management Interfaces (June 2023) https://www.cisa.gov/news-events/directives/bod-23-02-mitigating-risk-internet-exposed-management-interfaces

CVE-2024-54085 – Added to CISA Known Exploited Vulnerabilities Catalog (June 2025) https://nvd.nist.gov/vuln/detail/CVE-2024-54085

========================================

CALIFORNIA SB-327 IoT SECURITY LAW

SB-327 Bill Text – California Legislative Information https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180SB327

========================================

IPMI SPECIFICATION

IPMI v2.0 Specification (Intel, maintained by DMTF) https://www.intel.com/content/www/us/en/products/docs/servers/ipmi/ipmi-second-gen-interface-spec-v2-rev1-1.html

========================================

CRACKING TOOLS

Hashcat – Mode 7300: IPMI2 RAKP HMAC-SHA1 https://hashcat.net/wiki/doku.php?id=example_hashes

John the Ripper (bleeding-jumbo branch) – IPMI RAKP support https://github.com/openwall/john

========================================

ADDITIONAL BMC VULNERABILITY REFERENCES

CVE-2022-40259 – AMI MegaRAC Arbitrary Code Execution via Redfish API https://nvd.nist.gov/vuln/detail/CVE-2022-40259

CVE-2023-34329 – AMI MegaRAC Auth Bypass via HTTP Header Spoofing (CVSS 9.1) https://nvd.nist.gov/vuln/detail/CVE-2023-34329

CVE-2018-7078 – HPE iLO4/iLO5 Remote Code Execution https://nvd.nist.gov/vuln/detail/CVE-2018-7078

CVE-2018-7113 – HPE iLO5 Secure Boot Bypass https://nvd.nist.gov/vuln/detail/CVE-2018-7113

CVE-2021-29202 – HPE iLO Host-to-iLO Arbitrary Code Execution https://nvd.nist.gov/vuln/detail/CVE-2021-29202

========================================

RELATED TOOLS

ipmitool – Standard open-source IPMI management utility https://github.com/ipmitool/ipmitool

PCILeech – Direct Memory Access (DMA) attack toolkit (relevant to BMC-host trust) https://github.com/ufrisk/pcileech

Shadowserver Foundation – Open IPMI Report (ongoing internet scanning) https://www.shadowserver.org/what-we-do/network-reporting/open-ipmi-report/

People:
    SpeakerBio:  HD “hdm” Moore

HD Moore is a pioneer of the cybersecurity industry who has dedicated his career to vulnerability research, network discovery, and software development since the 1990s. He is most recognized for creating Metasploit and is a passionate advocate for open-source software and vulnerability disclosure. HD serves as the CEO and founder of runZero, a provider of cutting-edge exposure management software and cloud services that helps organizations minimize risk across their total attack surface. Prior to founding runZero, he held leadership positions at Atredis Partners, Rapid7, and BreakingPoint. HD’s professional journey began with exploring telephone networks, developing exploits for the Department of Defense, and hacking into financial institution networks. When he’s not working, he enjoys hacking on weird Go projects, building janky electronics, running in circles, and playing single-player RPGs.

Creator: DEF CON Talks

The internet is fragile. A single misconfiguration in BGP can cause worldwide outages. There have been various efforts to harden BGP, like BGPsec, RPKI, and MANRS, but those mostly address route validation. The session-level boundary that everything else rests on is adjacency trust. If your router only connects to trusted peers, the router should be safe. That assumption shaped a lot of the security design around BGP: peer whitelisting, MD5 / TCP-AO authentication, GTSM (RFC 5082) using TTL to enforce that a peer is one hop away.

In this talk, we look beyond that boundary. Building on Route to Bugs (dos Santos & Guiot, DC31) and From Spoofing to Tunneling (123ojp, DC33), we demonstrate three vectors that undermine the assumption. We hijack a trusted peer through pre-auth command injection in BGP monitoring tools. We abuse tunnel injection to establish adjacency from off-path, and chain into a heap UAF for unauthenticated RCE. We turn implementation disagreement between FRR, BIRD, and other daemons into a weapon: we craft UPDATEs that one router type happily re-emits while causing denial of service in a different implementation.

BGP: – Route to Bugs: https://i.blackhat.com/BH-US-23/Presentations/US-23-dosSantos-Route-to-Bugs-Analyzing-the-Security-of-BGP.pdf

Tunnel injection: – From spoofing to tunneling: https://i.blackhat.com/BH-USA-25/Presentations/USA-25-Tung-From-Spoofing-To-Tunneling-New.pdf?_ga=2.41373794.1394109082.1756795982-2018511848.1751622634 – Free VPNs everywhere — tunnel injection: https://blog.chummydns.com/blogs/tunnel-injection-english/ – Hunted by legacy: discovering and exploiting vulnerable tunneling hosts: https://www.usenix.org/system/files/usenixsecurity25-beitis.pdf

Looking glasses: – Through the looking-glass and what eve found there: https://www.usenix.org/system/files/conference/woot14/woot14-bruno.pdf – Looking glass research WOOT2014 / DEFCON 22: https://blog.talosintelligence.com/looking-glasses-with-bacon/

People:
    SpeakerBio:  Bo-Shiun “bronson113” Yen, Calif.io

Bronson Yen (@bronson113) is a security researcher working at Calif.io. He has experience in researching networking equipment and hardware attacks, with a focus on binary exploitation and cryptography. He previously presented at HITCON for his work in router exploitation.

Creator: DEF CON Talks

The “Security by Obscurity” era in satellite communications is over, but the industry hasn’t received the memo. As we shift toward COTS hardware and standardized protocols like CCSDS and Space Packet Protocol (SPP), a massive attack surface has emerged, stretching from ground stations to the satellite.

In this talk, i will show the vulnerabilities of the modern space link. i will move beyond simple RF command injction to demonstrate a full-spectrum exploitation methodology. Using PWNSAT and PWNCUBE a high-fidelity, open-source satellite exploitation ecosystem we simulate an end-to-end mission under fire.

I will demonstrate:

Protocol Fuzzing, GNS spoofing and command exploiting CCSDS/SPP packet structures over LoRa/FSK. Lateral Movement in Orbit: How a compromised RF link leads to command injection on the internal CAN bus to manipulate satellite subsystems. Ground Segment Pivoting: Exploiting the Mission Operations Center (MOC) via radio protocol vulnerabilities.

This is not just a tool demo; it is a deep dive into the flaws of aerospace’s most trusted protocols. We provide the community with a “Vulnerable-by-Design” orbital platform to bridge the gap between cybersecurity and space engineering.

People:
    SpeakerBio:  Romel “r0r0x” Marin

Romel Marín is a Senior Hacker and Aerospace Cybersecurity Researcher with over a decade of experience in offensive operations. He has executed complex penetration testing assessments for diverse industries and Fortune 500 companies. Currently, he specializes in applying offensive methodologies to aerospace technologies, satellite protocols, and artificial intelligence. Romel is an external collaborator for the SPARTA (Space Attack Research & Tactics Analysis) framework and serves as a co-founder of the DEF CON Costa Rica group (DC11506). A speaker at international conferences such as BlackHat, DEF CON, Typhooncon DragonJAR, and Ekoparty, his work focuses on the security analysis of aerospace infrastructure and mission-critical communications.

Creator: DEF CON Talks

DEF CON Abstract

Metal is Apple’s GPU framework, it replaced OpenGL and is now the only way to talk to the GPU on macOS. Among its buffer types is StorageModePrivate: memory managed entirely by the GPU. The CPU can’t read it, write to it, or map it into virtual address space.

macOS endpoint security scans process memory through mach_vm_region and task_for_pid. Apple’s own Endpoint Security framework watches mappings via ES_EVENT_TYPE_NOTIFY_MMAP. None of them see StorageModePrivate buffers. Those pages live in GPU firmware page tables, allocated through IOGPUDevice in the IOAccelerator family, completely outside Mach VM. No API exists to let a security tool inspect them from another process.

I turned this gap into a working evasion technique. Incoming payload gets XOR-encoded to destroy signatures, staged through a shared MTLBuffer, then blitted into private GPU memory via MTLBlitCommandEncoder on AGXCommandQueue. All CPU-side artifacts get wiped, volatile pointers, _syncsynchronize barriers, multi-pass zeroing. At that point the data exists only in pages no process on the box can read. When I need it back, I reverse the blit, decode, execute, and wipe again. Total CPU exposure is milliseconds.

Tested on the latest Apple Silicon hardware. 100% evasion. No entitlements, no kexts, no root. Runs from a sandbox

Apple Metal Framework Documentation:MTLBuffer, MTLResourceStorageModePrivate, MTLBlitCommandEncoder https://developer.apple.com/documentation/metal

Apple Endpoint Security Framework Documentation: ES_EVENT_TYPE_NOTIFY_MMAP https://developer.apple.com/documentation/endpointsecurity

Apple Silicon Unified Memory Architecture: Apple Platform Security Guide https://support.apple.com/guide/security/welcome/web

IOKit IOAccelerator Family: GPU driver interface for macOS kernel subsystem https://developer.apple.com/documentation/iokit

People:
    SpeakerBio:  Hxr1

15+ years specializing in Red Teaming, Adversary Emulation, and Application Security. Proven track record executing advanced offensive operations across enterprise environments. Active contributor to the cybersecurity community focused on evolving offensive tradecraft and automating purple team capabilities.

Creator: DEF CON Talks

What happens when the ecosystem Microsoft built for isolation and integrity of modern Windows applications becomes a foundation for novel attacker tradecraft?

For over 13 years, an ecosystem that now includes MSIX, UWP, AppContainers, package identity, and the Windows Runtime has shipped by default on modern Windows. Yet offensive research into this ecosystem remains scarce, and visibility into its abuse lags further behind. In this talk, we demonstrate novel techniques spanning all major parts of an attack path.

For initial access, we abuse URL protocol handlers and packaging file formats to subvert endpoint detections. For post-exploitation, we overcome AppContainer process isolation to operate beneath EDR visibility thresholds. For lateral movement, we expose previously unabused WMI providers and DCOM objects within package installation services. For privilege escalation, we chain a logic flaw in package capabilities to achieve SYSTEM from a standard user context. Every technique requires no third-party software, works on fully patched systems, and abuses default-enabled features. Tools for red teams will be released alongside detection guidance for defenders.

The modern app packaging ecosystem was designed for isolation and integrity. We used its design to our advantage and turned it into an attack platform.

https://projectzero.google/2021/08/understanding-network-access-windows-app.html

https://www.pentestpartners.com/security-blog/ms-enterprise-app-management-service-rce-cve-2022-35841/

https://conference.hitb.org/hitbsecconf2018pek/materials/D1T2%20-%20The%20Inner%20Workings%20of%20the%20Windows%20Runtime%20-%20James%20Forshaw.pdf https://activecyber.us/activelabs/windows-appx-deployment-service-local-privilege-escalation-cve-2020-1488

People:
    SpeakerBio:  Nick “zyn3rgy” Powers, SpecterOps

An offensive security professional with experience in leading and offering red team assessments and penetration testing across several attack surfaces to a diverse set of industries. Professional interests include furthering knowledge of Windows internals, static and dynamic Endpoint Detection & Response (EDR) evasion, as well as initial access attack surface research. Passionate about contributing back to the security community by speaking at conferences such as Defcon, Wild West Hackin’ Fest, and Troopers along with instructing course content at conferences such as BlackHat USA.

Creator: DEF CON Talks

Security research on AI agents starts at the prompt boundary – injection, jailbreaking, guardrails. This talk starts earlier.

AI agents accept inputs before the model processes its first task: configuration files, environment variables, startup parameters, protocol handshakes. In CI/CD, the agent runs headless – no human in the loop, and the workspace is automatically trusted. These inputs can reach shell execution or disable security controls before any prompt-time safeguard activates. The security model is already compromised before the model does anything.

This talk demonstrates the pattern with a flagship exploit scored CVSS 10.0 by Google’s security team – publicly disclosed and patched. The exploit is deterministic, requires no model interaction, and fires before the sandbox starts. An additional case from a different vendor confirms this is not a one-off.

Attendees leave with a reusable offensive method for any AI agent system: enumerate what the system accepts before work begins, map what authority each input carries, and test whether that authority reaches execution or policy control. If it does, prompt-time defenses are irrelevant.

https://github.com/google-github-actions/run-gemini-cli/security/advisories/GHSA-wpqr-6v78-jr5g

People:
    SpeakerBio:  Elad Meged, Novee Security

Elad Meged is a Founding Engineer and Security Researcher at Novee Security, specializing in offensive security research and AI security. He holds an M.Sc. in Computer Science and has a background in vulnerability research across web, mobile, and low-level systems, with experience in reverse engineering and platform internals. His current work applies offensive research methodology to AI systems while developing AI-driven approaches to vulnerability discovery and exploit verification.

Creator: DEF CON Talks

Every day, developers and ML engineers pull containers and models from OCI registries without a second thought. What if that pull, no privileges, no special access, could be turned into host enumeration, credential theft, remote code execution, or even a container escape?

We found a class of vulnerabilities that spans the OCI ecosystem. Not just in registry clients, but in the underlying technologies they feed into, container runtimes, ML inference engines, and more. By standing up malicious registries and abusing how these tools handle registry responses, we turned routine pull operations into attack primitives. The result: multiple critical vulnerabilities across widely used tools and platforms, including SSRFs, arbitrary file reads for credential exfiltration, and a novel path to escaping a Docker container to the underlying host.

What do they all have in common? They all either use or offer OCI services through a client or a registry. This talk walks through the different attack paths we’ve found, how they were discovered, trends we’ve noticed across multiple products, proof-of-concepts, and what it means for the ecosystem moving forward.

People:
    SpeakerBio:  David “davidrxchester” Rochester, Booz Allen Hamilton

David Rochester is a penetration tester by day, where he focuses on web, cloud, network, and Active Directory security. He earned his B.S. in Computer Science from Clemson University and is currently pursuing a master’s at the University of Texas at Austin. He holds the OSCP, OSWE, and CRTO, along with several cloud security certifications. As an independent security researcher, his vulnerability research and exploitation work has produced eight CVEs to date, including findings in Docker and Ollama.

SpeakerBio:  Nicholas “gouldnicholas” Gould, Booz Allen Hamilton

Nicholas Gould is a Red Team Operator & Penetration Tester, as well as an independent security researcher specializing in offensive, cloud, application, and container security. He has discovered or co-discovered multiple CVEs across containerization, proxies, IaC tooling, and programming language runtime/interpreter implementations. His recent research focuses on AI / ML infrastructure security, and when not hunting for vulnerabilities, he builds agentic AI tools for offensive and defensive security operations.

Creator: DEF CON Talks

You are being watched. Not in the vague, philosophical sense. Right now. The ATM you used this morning. The gas pump. Every doorbell on your block. The 125 smart streetlights you walked past on your way to lunch. You are indexed, cataloged, and matched against databases you never consented to join, by AI models that are wrong more often than the vendors will ever admit.

Other solutions to this involves looking ridiculous. Face paint. IR glasses. Masks. Real-time deepfake software running on your phone. Congrats, you defeated the algorithm AND ensured every human within 50 feet is staring at you. Super subtle. I built something different. noRecognition is a genetic algorithm that breeds adversarial patterns, printed on ordinary fabric, that defeat the entire facial recognition pipeline: person detection, face detection, and identity recognition across 10 models used by Clearview AI, Axon, Hikvision, and Palantir. No electronics. No software. You look like a person wearing a scarf. The AI sees nothing.

I will demonstrate this live on stage. One camera. One scarf. Zero detections. Come watch me disappear.

People:
    SpeakerBio:  Bill “hevnsnt” Swearingen, SecKC

Bill Swearingen (hevnsnt) has been in the hacking scene for decades, and you can tell by the way he looks. He spoke at DEF CON 27 with “HAKC THE POLICE,” which became one of the most watched DEF CON talks of all time. He is the founder of SecKC, the world’s largest monthly security meetup. When he is not trying to make himself invisible to surveillance cameras, he builds things that break other things, preferably with cheap hardware and undeserved confidence.

noRecognition is his current obsession. He built the fuzzer, the genetic algorithm, the distributed network, and the pattern library. He has been saving the findings for this stage.

Creator: DEF CON Talks

LiteLLM is the most popular open-source AI gateway, deployed across a third of cloud environments. Organizations route all their LLM traffic through it, trusting it with API keys for every provider, every prompt and response, and connections to external tools via MCP. We broke every layer of its security model.

We present three independent attack vectors, an authentication bypass in the MCP layer, a root-level RCE through sandbox escape, and an SSRF path to cloud credentials, that chain from zero credentials to full cloud infrastructure compromise. We validated every attack at internet scale across thousands of real-world instances and found that nearly 1 in 10 accepted default credentials or required no authentication at all.

Beyond the individual findings, we examine the broader security patterns emerging across AI infrastructure and what they mean for organizations adopting AI gateways as core infrastructure.

People:
    SpeakerBio:  Yaara Shriki, Wiz (Google)

Yaara Shriki is a Threat Researcher at Wiz, specializing in emerging threats in cloud environments and attack surface analysis. She explores novel ways to integrate ML and NLP into security research and investigates new attack vectors in cloud and AI infrastructure. Yaara is currently pursuing an MSc in Computer Science at Tel Aviv University.

Creator: DEF CON Talks

2025 marks the dawn of AI security. Pwn2Own Berlin launched its first AI track, featuring Ollama and Triton Inference Server, while ZeroDay.Cloud introduced new challenges targeting vLLM and Ollama. These competitions pushed us to take a closer look at the security of core AI infrastructures. vLLM exposes limited API functionality by default — until we discovered that its completions endpoint accepts prompt_embeds, which are loaded via torch.load with weights_only enabled. We had previously disclosed CVE-2025-32434, a bypass for the weights_only mechanism; after it was patched, we wondered: could we succeed again? This led us to a heap overflow vulnerability that bypasses weights_only entirely (CVE-2026-24747), which we leveraged to compromise vLLM. This finding overturned a common assumption: that PyTorch flaws only enable model poisoning, requiring victims to load malicious models locally. In fact, many AI applications expose APIs that invoke torch.load for routine operations such as model loading and LoRA fine-tuning — turning a “local” vulnerability into a remote one. After mapping this attack surface, we developed exploits against ComfyUI, NVIDIA Dynamo and others. In this talk, we’ll walk through the discovery of this new PyTorch weights_only bypass and demonstrate its exploitation across AI infrastructures.

People:
    SpeakerBio:  Ji’an “azraelxuemo” Zhou

He focuses on Java security and AI security, and his work has helped many high-profile vendors—including Google, Amazon, Cloudera, IBM, Microsoft, Oracle, among others. He has presented at Black Hat Europe 2024, Zer0Con 2025, Off-by-One Con 2025, Black Hat USA 2025, DEFCON 33 and Zer0Con 2026.

SpeakerBio:  Lei “llfamsec” Lu

He has focuses on application and system security. He has reported many vulnerabilities to Linux, AMD, Apple, Microsoft, etc. He has presented at PHDays 2025.

Creator: DEF CON Talks

What happens when a flagship phone like the Samsung Galaxy S25 ships with an outdated Javascript engine in its default browser?

For the past 6 months, Samsung Internet shipped with an out-of-date V8 build that had already-fixed, publicly known vulnerabilities. One such bug is CVE-2025-10891, a flaw in Ignition bytecode generation for Javascript exception handling. In this talk, we show how we transform this vulnerability into reliable renderer code execution through instruction smuggling and internal native V8 runtime calls. We then showcase how we exploit weaker isolation mechanisms on mobile Chromium engines to upgrade the renderer RCE’s capability into a universal XSS primitive.

https://osec.io/blog/2026-04-01-patch-gap-to-mobile-renderer-rce/ https://issuetracker.google.com/issues/443875388

People:
    SpeakerBio:  Hrvoje Mišetić, OtterSec

Hrvoje Mišetić is a Web3 auditor and security researcher at OtterSec with prior research projects including Linux kernel LPE, QEMU hypervisor escape, and browser exploitation. He is a member of the Crusaders of Rust CTF team, and DiceGang, with whom he has qualified for Defcon CTF Finals multiple times. He presented Minecraft RCE research at OffensiveCon ‘26.

SpeakerBio:  Jamie Hill-Daniel, OtterSec

Jamie Hill-Daniel is a security auditor currently working at OtterSec, with an interest in browser and kernel research. He is a member of the Crusaders of Rust and DiceGang CTF teams, having qualified for multiple Defcon CTF Finals with the latter.

SpeakerBio:  William Liu

William Liu is a security engineer at Trail of Bits with experience in low-level systems and computer architecture. He is a member of the Crusaders of Rust and DiceGang CTF teams, having qualified for multiple Defcon CTF Finals with the latter. He has previously worked as a systems software engineer at NVIDIA. He documents some of his research on his personal site, willsroot.io.

William is a Class of 2025 graduate of the Massachusetts Institute of Technology, where he worked on the EntryBleed KASLR bypass and kernel fuzzing under Professor Mengjia Yan. He has presented micro-architectural security research at HASP ‘23 and NEHWS ‘24, as well as Linux 0-day research at Hexacon ‘25.

Creator: DEF CON Talks

Every time a USB device is plugged into a Windows machine, the OS may silently download a package from Microsoft and execute vendor code as SYSTEM. No admin required. The package is signed, so nothing looks wrong.

We spent the better part of a year mapping this attack surface. We analyzed 7K packages approx, built tools to emulate arbitrary USB devices without hardware, and found that the same kernel code path fires when a USB device is redirected over RDP channels, meaning a non admin user can trigger SYSTEM level code execution on the target, with no physical access at all (under certain conditions).

• How Windows PnP search actually works, the real kernel flow, not the MSDN summary.

• How to make Windows believe any USB device is connected, using device emulation and composite device tricks that bypass inbox driver interception.

• Why RDP USB redirection (MS-RDPEUSB / URBDRC) triggers the exact same kernel PnP path as a physical plug-in, and what that means for remote exploitation.

• A WHQL-signed software that contains a hidden debug backdoor alowing execution as SYSTEM, chainable with other vulnerabilities for full user to SYSTEM escalation from a standard account.

• A forced installation leading to the creation of a named pipe that lets any authenticated network user rewrite config on any machine.

People:
    SpeakerBio:  Alejandro “0xedh” Hernando, Accenture Spain

Alejandro Hernando is a red team operator and security researcher at Accenture Security’s Hacking team in Spain, with over a decade of hands-on experience in offensive cybersecurity. Throughout his career, he has assessed, exploited, and helped mitigate security vulnerabilities across commercial and proprietary systems, developing PoC exploits, offensive and defensive tooling, and conducting deep security research. His approach combines applied research with real world operational experience, driven by a focus on continuous learning and on sharpening both attack and defense strategies.

SpeakerBio:  Borja “borjmz” Martinez, Accenture Spain

Borja Martínez is a red team operator and security researcher at Accenture Security Hacking team in Spain, where he focuses on offensive security, advanced adversary simulation and hardware exploitation. A self-taught hacker with a deeply hands-on approach, he specializes in red team operations, penetration testing and low level attack research including DMA attacks, BIOS/UEFI exploitation, and TPM security.

Creator: DEF CON Talks

First public disclosure. rekordbox, the world’s most popular DJ software, silently runs an NFS server whenever you play over the network, and it shares your whole hard drive, not just your music. Any device on the same subnet can quietly read your SSH keys, passwords, and files. It works the same on Windows, macOS, iOS, and Android. The catch: the obvious fix would break 20 years of hardware compatibility.

This talk breaks down the PRO DJ LINK protocol, shows how any device on the wire talks its way into full filesystem access, and explains why the fix is stranger than it looks.

• CWE-284: Improper Access Control: https://cwe.mitre.org/data/definitions/284.html
• Deep Symmetry, crate-digger (Java, Pro DJ Link NFS client): https://github.com/Deep-Symmetry/crate-digger
• EvanPurkhiser, prolink-connect (TypeScript, Pro DJ Link library): https://github.com/EvanPurkhiser/prolink-connect
• Deep Symmetry, DJ Link Packet Analysis: https://djl-analysis.deepsymmetry.org/
• CVSS v3.1 Calculator: https://www.first.org/cvss/calculator/3.1
• JPCERT/CC Vulnerability Coordination: https://www.jpcert.or.jp/english/vh/report.html
• Digital DJ Tips, Global DJ Census / AlphaTheta market share: https://www.digitaldjtips.com/pioneer-alphatheta-industry-standard/

People:
    SpeakerBio:  Christopher “TRIODE” Le

TRIODE is an engineer, semi-professional DJ, and livestreamer who has performed at the last four Defcons. He discovered this vulnerability while reverse-engineering the Pro DJ Link protocol to build custom performance tooling. His background spans systems programming and network protocol analysis. This is his first Defcon talk submission.

Creator: DEF CON Talks

Apple’s Sandbox and code signing have made traditional security research impractical on iPhones – researchers must use full-system emulation or hunt for increasingly rare jailbreak exploits. The Sandbox blocks fork(), which shells need for job control. Code signing prevents unsigned code execution.

We present techniques that bypass both restrictions without exploiting vulnerabilities. Using only standard APIs, we built a system that runs SSH servers and interactive shells on iPhones with full fork() support and unsigned code execution.

We’ll dive deep into the technical implementation: userspace memory management, thread-based process virtualization, stack frame manipulation, and selective CPU emulation. Then we’ll demonstrate the real impact: running an unsigned public exploit directly on an iPhone through SSH – no jailbreak, no signing, no problem.

Full paper I wrote about the talk (have not published it in public domains yet, waiting for the conference first as a reveal!)

“Rage Against the Sandbox: Bypassing Apple’s iOS Security to Run Unsigned Code via SSH”, Y.H. Hirschenbein Sadde, 2026 https://drive.google.com/file/d/1ZyIvQa3kjiLvCmNhdY-fmSAbhRA5gLPx/view

People:
    SpeakerBio:  Yuval Hanoch Hirschenbein Sadde

Yuval is a security researcher. His main focuses are Android and iOS security – specifically in low-level system code and kernel modules. His work centers around researching the bootstrap process of operating systems, and analyzing popular low-level code flows within the platform frameworks and their third-party dependencies.

Creator: DEF CON Talks

Adversary-in-the-Middle (AitM) phishing has become the de facto standard for bypassing legacy Multi-Factor Authentication (MFA). However, modern AitM frameworks rely on complex, fragile regex rules to rewrite HTTP streams on the fly. When target applications implement strict client-side security headers like Subresource Integrity (SRI) and Content Security Policy (CSP), traditional proxies break, alerting defenders.

This presentation introduces a novel “Browser-in-the-Middle” architecture. By weaponizing the Chrome DevTools Protocol (CDP), this custom-built Go toolkit renders the target application server-side, allows legitimate scripts to execute, and captures the resulting DOM as an MHTML snapshot. I will demonstrate how converting external assets into Base64 Data URIs and serving a self-contained, live DOM neutralizes SRI and CSP organically without triggering browser security violations. Finally, the talk will detail a Just-In-Time (JIT) JavaScript shim that hooks API calls to silently harvest post-MFA tokens from major IdPs including Okta, Microsoft, Google, and Shibboleth effectively trapping the user in a perfectly mirrored, attacker-controlled environment.

People:
    SpeakerBio:  Gregory “1umberhack” Disney-Leugers, Independent Researcher

Gregory Disney-Leugers (1umberhack) is a Independent Researcher specializing in adversary simulation, modern web authentication bypasses, and identity-based attacks. With over a decade of experience in red teaming and penetration testing since 2013, they have previously served as a Technical Lead at major technology and identity providers, including Juniper Networks and Okta.

Creator: DEF CON Talks

Heavy-duty trucks move the majority of freight in North America, making them a critical component of our infrastructure. When a major supplier issued a recall to address a seemingly harmless noise issue, the explanation didn’t quite add up.

This talk follows the reverse engineering journey that began with a simple question and led to a much larger discovery. By tearing apart firmware, analyzing the update protocols, and tracing ECU behavior, we uncovered evidence that the recall was not just remediating noise triggered flaws. Hidden within the recall’s firmware update was a security mitigation addressing undisclosed vulnerabilities affecting a critical vehicle system.

Attendees will see how modern tractor ECUs can be analyzed using professional and public tools and techniques (IDA Pro, idapython, qbindiff), the challenges of working with the safety-critical microcontrollers in heavy-vehicles (S12XE), and the evidence that revealed security impacts of the patch. Along the way, we’ll discuss the growing cybersecurity risks facing commercial vehicles.

Whether you’re interested in automotive hacking, embedded systems, reverse engineering, or critical infrastructure security, this session offers a look inside the cybersecurity reality of the machines that keep the supply chain moving.

1. Aleph One. (1996). Smashing The Stack For Fun And Profit. Phrack Magazine, 7(49). http://phrack.org/issues/49/14.html
2. Intellon Corporation. (1997). SSC P485 PL Transceiver IC Data Sheet.
3. Hunter, J. D. (2007). Matplotlib: A 2D graphics environment. Computing in science & engineering, 9(3), 90-95.
4. NXP Semiconductors. (2010). HiWave Debugger. Part of CodeWarrior Development Studio.
5. Krzywinski, M., Birol, I., Jones, S. J., & Marra, M. A. (2011). Hive plots—rational approach to visualizing networks. Briefings in bioinformatics, 13(5), 627-644.
6. SAE International. (2013). J1587: Electronic Data Interchange Between Microcomputer Systems in Heavy-Duty Vehicle Applications. Warrendale, PA.
7. Miller, C., & Valasek, C. (2014). Adventures in Automotive Networks and Control Units. IOActive. https://www.ioactive.com/wp-content/uploads/pdfs/IOActive_Adventures_in_Automotive_Networks_and_Control_Units.pdf
8. Behere, S., Zhang, X., Izosimov, V., & Törngren, M. (2016). A Functional Brake Architecture for Autonomous Heavy Commercial Vehicles. https://legacy.sae.org/publications/technical-papers/content/2016-01-0134/
9. SAE International. (2016). J1708: Serial Data Communications Between Microcomputer Systems in Heavy-Duty Vehicle Applications. Warrendale, PA.
10. TruckHacking organization. (2016). py-hv-networks. https://github.com/TruckHacking/py-hv-networks
11. SAE International. (2018). J1939: Serial Control and Communications Heavy Duty Vehicle Network. Warrendale, PA.
12. International Organization for Standardization. (2018). ISO 26262: Road vehicles — Functional safety. Geneva, Switzerland.
13. International Organization for Standardization. (2018). ISO/IEC 29147: Information technology — Security techniques — Vulnerability disclosure. Geneva, Switzerland.
14. dfieschko. (2019). RP1210. https://github.com/dfieschko/RP1210
15. MITRE Corporation. (2020). CVE-2020-14514. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14514
16. International Organization for Standardization. (2020). ISO 14229: Road vehicles — Unified diagnostic services (UDS). Geneva, Switzerland.
17. Gardiner, B. (2022). Disclosure of confirmed remote write to J2497 aka PLC4TRUCKS. NMFTA, Alexandria, VA, Letter, March.
18. National Motor Freight Traffic Association. (2022). Actionable Mitigations Options v9. https://nmfta.org/wp-content/media/2022/11/Actionable_Mitigations_Options_v9_DIST.pdf
19. MITRE Corporation. (2022). CVE-2022-26131. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26131
20. Pulse Security. (2022). Reversing the Ducati 696 ECU Part 2. https://pulsesecurity.co.nz/articles/ducati-696-part2
21. Gardiner, B. (2022). Mitigating PLC4TRUCKS Remote Write. Proceedings of the 9th escar USA Conference. https://escar.info/downloads
22. Cybersecurity and Infrastructure Security Agency. (2023). Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Security-by-Design and -Default. https://www.cisa.gov/resources-tools/resources/shifting-balance-cybersecurity-risk-principles-and-approaches-security-design-and-default
23. Bendix Commercial Vehicle Systems LLC. (2024). 24E086 Chronology. https://static.nhtsa.gov/odi/rcl/2024/RMISC-24E086-5355.pdf
24. National Highway Traffic Safety Administration. (2024). Technical Service Bulletin 10194446. https://dot.report/bulletins/10194446
25. National Highway Traffic Safety Administration. (2024). Technical Service Bulletin 10176745. https://dot.report/bulletins/10176745
26. National Highway Traffic Safety Administration. (2024). Technical Service Bulletin 10222229. https://dot.report/bulletins/10222229
27. PACCAR Incorporated. (2024). Safety Recall Report 24V-915. https://static.nhtsa.gov/odi/rcl/2024/RCLRPT-24V915-6438.PDF
28. Navistar, Inc. (2024). Safety Recall Report 24V-818. https://static.nhtsa.gov/odi/rcl/2024/RCLRPT-24V818-4283.PDF
29. Volvo Trucks North America. (2024). Safety Recall Report 24V-790. https://static.nhtsa.gov/odi/rcl/2024/RCLRPT-24V790-3386.PDF
30. Bendix Commercial Vehicle Systems LLC. (2024). Technical Bulletin TCH-27-007. https://www.bendix.com/media/services-and-support/product-action-center-pdfs/tch_27_007_en_000.pdf
31. Bendix Commercial Vehicle Systems LLC. (2024). Technical Bulletin TCH-27-006. https://www.bendix.com/media/services-and-support/product-action-center-pdfs/tch_27_006_en_000.pdf
32. Bendix Commercial Vehicle Systems LLC. (2024). Technical Bulletin TCH-27-008. https://www.bendix.com/media/services-and-support/product-action-center-pdfs/tch-27-008_en_000.pdf
33. ZF Friedrichshafen AG. (2024). mBSP XBS Factsheet. https://www.zf.com/public/org/ZF_CVS_mBSP_XBS_Factsheet_EN_296135.pdf
34. Technology & Maintenance Council. (2024). Position Paper 2024-3: Next Generation Tractor-Trailer Technical Needs. American Trucking Associations. https://tmc.trucking.org/sites/default/files/TMC_PP-2024_3_NEXTGEN_TRACTOR_TRAILER_TECHNICAL_NEEDS%20.pdf
35. Gardiner, B., Maag, J., & Tindell, K. (2024). Security Requirements for Vehicle Security Gateways. SAE International. https://www.sae.org/papers/security-requirements-vehicle-security-gateways-2024-01-2806
36. Vehicle Cybersecurity Working Group (VCRWG), National Motor Freight Traffic Association. (2024). NMFTA Vehicle Cybersecurity Requirements. https://github.com/nmfta-repo/nmfta-vehicle_cybersecurity_requirements
37. python-can Developers. (2024). python-can. https://python-can.readthedocs.io/
38. Cohen, R., David, R., Mori, R., Yger, F., & Rossi, F. (2024). Improving binary diffing through similarity and matching intricacies. Proc. of the 6th Conference on Artificial Intelligence for Defense.
39. Quarkslab. (2024). Quokka. https://github.com/quarkslab/quokka
40. Bendix Commercial Vehicle Systems LLC. (2025). Safety Recall Report 25E-073. https://static.nhtsa.gov/odi/rcl/2025/RCLRPT-25E073-3346.pdf
41. National Motor Freight Traffic Association. (2025). Bendix EC80 Recall: Safety and Security Implications. https://nmfta.org/bendix-ec80-recall-safety-and-security-implications/
42. Cybersecurity and Infrastructure Security Agency. (2025). ICS Advisory (ICSA-25-021-03) Bendix EC-80. https://www.cisa.gov/news-events/ics-advisories/icsa-25-021-03
43. National Security Agency. (2025). Ghidra. https://ghidra-sre.org/
44. Hiveplotlib Developers. (2025). hiveplotlib. https://github.com/hiveplotlib/hiveplotlib
45. Land Line Media. (2025). Defective Bendix ECUs have prompted recall of nearly half a million trucks with latest Paccar recall. https://landline.media/defective-bendix-ecus-have-prompted-recall-of-nearly-half-a-million-trucks-with-latest-paccar-recall/
46. SAE Truck and Bus Control and Communications Network Committee. (2026). J2497 Power Line Carrier Communications for Commercial Vehicles. Work in Progress Draft Revision.
47. Hex-Rays. (2026). IDA Pro. https://hex-rays.com/ida-pro/
48. Python Software Foundation. (2026). Python Programming Language. https://www.python.org/
49. Graphviz Authors. (2026). Graphviz. https://graphviz.org/
50. ELDB. XPROG-box. https://www.eldb.eu/
51. PEmicro. PROGS12Z Flash Programmer Software. https://www.pemicro.com/
52. NXP Semiconductors. MC9S12XEQ512 Data Sheet. https://www.nxp.com/docs/en/data-sheet/MC9S12XEP100.pdf
53. NXP Semiconductors. MC9S12XE Family Reference Manual. https://www.nxp.com/docs/en/reference-manual/MC9S12XERM.pdf
54. DARPA. Assured Micropatching (AMP). https://www.darpa.mil/program/assured-micropatching
55. LinkerScope Developers. LinkerScope. Visualization Tool.
56. Zynamics. BinDiff. https://www.zynamics.com/bindiff.html
57. hotwolf. HSW12. https://github.com/hotwolf/HSW12
58. National Highway Traffic Safety Administration. NHTSA Recalls by Manufacturer. https://datahub.transportation.gov/Automobiles/NHTSA-Recalls-by-Manufacturer/mu99-t4jn
59. Yapo, T. FL2K Experiments. https://hackaday.io/project/164346-fl2k-sdr
60. Osmocom. Osmo-FL2k Project. https://osmocom.org/projects/osmo-fl2k
61. National Highway Traffic Safety Administration. Federal Motor Vehicle Safety Standard No. 121, Air Brake Systems. 49 CFR 571.121.
62. Evenchick, E. CANtact. https://cantact.io/
63. National Motor Freight Traffic Association. j2497-keyhole. https://github.com/nmfta-repo/j2497-keyhole
64. Motorola. Motorola S-Record Description (PDF). https://deramp.com/downloads/mfe_archive/060-Standards%20and%20Specifications/Hex%20Data%20Formats/Motorola%20S%20Record.pdf

People:
    SpeakerBio:  Ben Gardiner, NMFTA Inc.

Ben is a Senior Cybersecurity Research Engineer contractor at the National Motor Freight Traffic Association, Inc.® (NMFTA)® specializing in hardware and low-level software security.

With more than ten years of professional experience in embedded systems design and a lifetime of hacking experience, Ben has a deep knowledge of the low-level functions of operating systems and the hardware with which they interface.

He has held security assurance and reversing roles at a global corporation, as well as worked in embedded software and systems engineering roles at several organizations.

Ben has conducted workshops and presentations at leading cybersecurity and technical mobility events globally, including Black Hat USA, DEF CON, NorthSec, escar USA, ScapyyCon, the CyberTruck Challenge, GENIVI Security Sessions, Hack in Paris, and HackFest.

In addition to speaking on the main stage at Black Hat USA and DEF CON, Ben is a volunteer at the DEF CON Hardware Hacking Village (DC HHV) and Car Hacking Village (CHV). He is GIAC -GPEN, and -GICSP certified and a GIAC advisory board member, serves as the chair of the SAE TEVEES18A1 Cybersecurity Assurance Testing Task Force (responsible for J3322), a contributor to ATA TMC task forces, the ISO/SAE JWG and a voting member of the SAE VESS.

Creator: DEF CON Talks

How many of you tapped an RFID card to ride a train this year? How many of you know what’s actually stored on it? Every transit authority in the world builds their own proprietary card formats, and not one has ever published a spec. The security model is the same everywhere: if nobody knows the format, nobody can exploit it. I spent two years testing that assumption. Across 50+ cities and every major contactless protocol, I reverse engineered the proprietary data formats that transit systems treat as their last line of defense. Along the way I built Metroflip, an open source transit card reader for the Flipper Zero, and found critical vulnerabilities in Spain’s two largest transit systems that allow unlimited free travel. On RENFE, Spain’s national rail, I cracked a proprietary checksum algorithm that lets you directly modify trip counters, expiry dates, and zones on any card in the country. On T-Mobilitat, Barcelona’s modern encrypted metro platform, I bypassed card-level crypto entirely by changing a single byte in the mobile app’s relay, getting free trips and automatic refunds. I’ll walk through the methodology, demo the RENFE exploit live on stage with a Flipper Zero, and share some hard lessons about what happens when you try to responsibly disclose vulnerabilities in infrastructure you depend on every day.

Garcia, de Koning Gans, Muijrers, van Rossum, Verdult, Schreur, Jacobs. “Dismantling MIFARE Classic.” ESORICS 2008. https://flaviodgarcia.com/publications/Dismantling.Mifare.pdf Courtois, N. “The Dark Side of Security by Obscurity.” 2009. Darkside attack on MIFARE Classic CRYPTO1. Anderson, Ryan, Chiesa. “Anatomy of a Subway Hack.” DEF CON 16, 2008. (Boston CharlieCard) Rauch, B. “The Boston Infinite Money Glitch.” DEF CON 31, 2023. Garcia, de Koning Gans, Verdult. “Wirelessly Pickpocketing a Mifare Classic Card.” IEEE S&P 2009. NXP Semiconductors. “MIFARE DESFire EV2/EV3 Functional Specification.” (restricted distribution) Wouters, Carroll. “Unsaflok: Hacking Millions of Hotel Locks.” DEF CON 32, 2024. Rodriguez. “Contactless Overflow.” DEF CON 31, 2023. Hunt, Nakache. “Hung Out to Dry: Airing the Dirty Laundry of Stored Value Washing Cards.” 2025. Metrodroid project. https://github.com/metrodroid/metrodroid Metroflip project. https://github.com/luu176/Metroflip Proxmark3 RRG. https://github.com/RfidResearchGroup/proxmark3 CRC RevEng catalogue. https://reveng.sourceforge.io/crc-catalogue/

People:
    SpeakerBio:  Aidan “luu176” Nakache

Aidan Nakache is a 17-year-old CTO at dubblefilm, where he leads software and hardware development with a focus on automation, operational efficiency, security, and scalable growth. He develops and maintains company servers, hardware systems, and transaction equipment, with much of his work centered around fintech infrastructure, system expandability, and technology migration.

Alongside his role, he is a cybersecurity researcher and hardware hacker specializing in RFID, reverse engineering, and access-control systems. He enjoys competing in CTFs at conferences around the world and has spoken at DEF CON 33 in the Radio Frequency Hackers Sanctuary village. He shares open-source work on GitHub and continues to collaborate and grow within the field.

Creator: DEF CON Talks

You don’t realize it until you see them; they’re everywhere. From Wireless ISP links to the frontline of modern warfare. But nobody found anything? The devices behind those links are Ubiquiti AirMAX: critical infrastructure on a 17-year-old Linux kernel and a custom 802.11 extension built on “security by obscurity.” So we took it apart. This talk covers our reverse engineering of the AirMAX protocol, AirOS, and the kernel modules behind this proprietary mode. It rides on 802.11 Information Elements that look encrypted, but we’ll show why they aren’t. What we found: two critical vulnerabilities (CVE-2026-21639, CVE-2026-21638) across airMAX AC, airMAX M, airFiber, and GigaBeam, over 50 devices. These are the bugs from the movies: Over-The-Air, unauthenticated, kernel-privilege RCE. No network access, just line of sight. They affect every AirMAX device ever shipped. We disclosed them through Ubiquiti’s bug bounty program. The bugs were rated “Adjacent”, except adjacent here means kilometers away. The same hardware can be turned around and pointed at the problem: we’ll repurpose these devices as recon tools and release open-source software to locate AirMAX networks in the wild. This talk is about our journey, our tooling, and the state of security.

People:
    SpeakerBio:  Federico Kirschbaum, FaradaySec

Federico Kirschbaum is a security researcher with over two decades of experience building tools and ecosystems for offensive security. He is the Co-Founder and VP of Research in Faraday Security, an open-source platform. He is also the Co-Founder of Ekoparty, Latin America’s largest hacking conference, where he has helped shape the region’s security research community for over 20 years.

SpeakerBio:  Gaston Aznarez, FaradaySec

Gaston Aznarez is a Principal Security Researcher at Faraday Security, focused on IoT and embedded device vulnerability research, firmware reverse engineering, wireless protocol analysis, and hardware-level exploitation. He has presented at DEF CON, Black Hat and Ekoparty.

Creator: DEF CON Talks

The Tor network has been continuously operating for close to 25 years now. How have the attacks changed over that time? How about the communities, threats, and incentive structures for the volunteers who operate the network?

I’ll go over early lessons as well as lessons we are still learning, when it comes to the Tor network — from relays to directory authorities — focusing on the community angle, on finding and kicking out bad relays, and generally looking at the safety of users and of relay operators.

https://community.torproject.org/policies/relays/expectations-for-relay-operators/

https://community.torproject.org/policies/dir-auth/dir_auth_expectations/

https://www.freehaven.net/anonbib/#botnetfc14

https://spec.torproject.org/vanguards-spec/

https://research.torproject.org/safetyboard/

People:
    SpeakerBio:  Roger “arma” Dingledine, The Tor Project

Roger Dingledine is co-founder and original developer of the Tor Project, a nonprofit that develops free and open source software to protect people from tracking, censorship, and surveillance online. Roger works with journalists and activists on many continents to help them understand and defend against the threats they face, and he is a lead researcher in the online anonymity field. EFF picked him for a Pioneer Award, and Foreign Policy magazine chose him as one of its top 100 global thinkers. This is his twelfth talk on the Defcon main stage.

Creator: DEF CON Talks

Forty-five seconds. Two thousand five hundred Nike Air Jordans, gone. Resold at five times retail the next month. Every weekly drop, for years, at one of Europe’s largest retailers.

Shopping is the attack. The bot does not exploit a CVE. It does not break the contract. It just shops, and every standard control is structurally blind to it.

I spent five years as Head of SecOps at ASOS, on the bridge for every Air Jordan drop, reverse-engineering the full attacker MO because nobody else was going to.

This talk is that MO from the attacker’s chair. Eight phases against the e-commerce golden thread. Account army staged weeks ahead via fake registration and credential stuffing. Targets picked from StockX margins, not catalogues. Early bird APIs leaking pre-release products before the SKU exists. Mobile catalogue enumeration. Vision-API classification. A watcher polling stock until launch. Two bag agents racing, one guest for raw speed, one aged returning customer for trust. Checkout picked for approval probability. Then I show what Anthropic’s GTG-1002 disclosure means for retail: the same MO, decomposed into AI agents, at speeds Anthropic called physically impossible.

The eCommerce bots are unstoppable. Come see why.

People:
    SpeakerBio:  Yaniv “PSYMAG” Menasherov

Yaniv Menasherov has worked every seat in the SOC. He started as a Tier 1 analyst and worked his way up through shift lead, incident response manager, and Head of SOC, the analyst getting paged at 3 AM, the lead running the war room, and the one writing the post-mortem nobody wanted to read.

He’s fought them all from both sides of the table: as a client defending enterprises against ransomware crews, insiders, and the occasional state-aligned visitor with too much patience; and as a vendor, sitting next to customers when their existing stack wasn’t cutting it. Eventually he founded his own MSSP, building a unified global SOC for some of the largest enterprises in the world , 24/7 across continents, where “alert fatigue” is a polite way of saying “we’re losing.”

Today he leads research at Legion Security, an agentic SOC platform rethinking investigation and response for a world where analysts shouldn’t be the bottleneck. After years of watching SIEMs and SOARs over-promise, he’s building what he wished he’d had on shift.

Creator: DEF CON Talks

Air traffic control quietly moved from voice radios to text messages—and almost nobody outside aviation noticed.

We did. And it turns out you can slide into a commercial aircraft’s DMs.

In this talk, we show how modern aircraft receive digital instructions (like “climb,” “descend,” or “turn”) over a system called CPDLC—and how that system has basically zero real security. No crypto. No authentication. Just vibes and protocol complexity.

We built a full fake ground station using cheap SDR gear and made certified avionics believe we were air traffic control. From there, we can inject real flight instructions or knock aircraft offline at scale with protocol-level DoS attacks—no jamming required.

This isn’t a simulation. We tested it against real aviation hardware in a live CPDLC environment.

If you’ve ever wondered what happens when safety-critical infrastructure assumes “nobody will try this,” this talk is for you.

Sliding into the Flight Deck’s DMs: Practical Message Attacks on CPDLC

Mehdi Ziazi, ETH Zurich; Khalid Aleem, Independent; Harshad Sathaye, ETH Zurich; Martin Strohmeier, Cyber-Defence Campus, armasuisse Science + Technology

Usenix Security 2026

People:
    SpeakerBio:  Martin “MasorX” Strohmeier, Cyber-Defence Campus, armasuisse Science + Technology

Martin is a Senior Scientist at the Swiss Cyber Defence Campus, primarily based at ETH Zurich, and a Visiting Fellow of Kellogg College, Oxford. His work focuses on designing and analyzing security protocols for cyber-physical systems in critical infrastructures—aviation, satellites, space, and transportation systems. Martin also explore privacy issues in global networks, adversarial machine learning, and open-source intelligence.

Martin received his DPhil in 2016 at Oxford, supervised by Prof. Ivan Martinovic, where he studied the security and privacy of aviation communication technologies. I co-founded the OpenSky Network and coordinate its research activities. His work has received awards from both the aviation and security communities, including the EPSRC Doctoral Prize Fellowship and commendation from the British Computer Society. Martin has published regularly at all major security and AI conferences and also been a speaker at DEF CON several times (main stage + villages).

SpeakerBio:  Mehdi Ziazi, ETH Zurich

Mehdi Ziazi is a hacker and cybersecurity student at ETH Zurich and an incoming PhD student at CISPA focused on aerospace security and cyber-physical systems. Their recent work in aviation security explores novel attack paths against aircraft systems and their real-world impact, approached with curiosity, persistence, and a bit of stubbornness.

Creator: DEF CON Talks

We infiltrated a cell of North Korean IT workers dedicated to obtaining remote employment for the DPRK, attributed to Famous Chollima (Lazarus Group). Posing as facilitators, we went through their full recruitment process and, once inside, provided them with controlled environments that allowed us to observe and record their operations from the inside.

In parallel, we used OSINT and targeted reconnaissance to map their infrastructure, track financial movements, and reconstruct the broader structure behind the operation. This includes networks of fake companies and identities, local facilitators, fraudulent H-1B visa schemes, and a coordinated model of transnational fraud used to gain access to Western companies.

The talk features recorded direct interactions with DPRK operatives and live recordings from a fake laptop farm we built for them. While they believed they had remote access to legitimate work systems, we captured everything: how they set up their infrastructure, handled authentication, configured VPNs, and operated on a daily basis.

This was the first time this kind of threat campaign was profiled, recorded, and published from the inside. Now we want to share it with you. Smile, you’re on camera!

Original article: – https://any.run/cybersecurity-blog/lazarus-group-it-workers-investigation/

Media: – https://www.bleepingcomputer.com/news/security/north-korea-lures-engineers-to-rent-identities-in-fake-it-worker-scheme/ – https://thehackernews.com/2025/12/researchers-capture-lazarus-apts-remote.html

People:
    SpeakerBio:  Heiner García, NorthScan

Researcher & Strategic intelligence Analyst

Founder of NorthScan

Cyber Threat Intelligence at Telefonica Tech

SpeakerBio:  Mauro Eldritch, Leader at Bitso Quetzal Team

Hacker and Speaker.

Founder of BCA LTD and DC5411.

I wrote a book interviewing Threat Actors.

I like Threat Intelligence and Golden Retrievers.

Creator: DEF CON Talks

40 years ago today, I tripped over a 75-cent accounting glitch in a Unix system. That tiny clue led to a year-long chase across networks, modem banks, and international borders, ultimately uncovering a crew of German hackers working for the East German Stasi and the Soviet KGB. We had no budget, no roadmap, and no “cyber” anything. We improvised with soldering irons, shell scripts, logbooks, curiosity, and far too much coffee. Let’s revisit the chase – not just to remember, but to ask what changed, what didn’t, and why it still matters.

The Cuckoo’s Egg, Doubleday Books, 1989

Stalking the Wily Hacker, Communications of the ACM May 1988 v31, page 484-497
https://dl.acm.org/doi/10.1145/42411.42412

People:
    SpeakerBio:  Cliff Stoll, Acme Klein Bottle

Cliff graduated from Buffalo Public School #61 with a blue star for good attendance. He’s since fooled around in planetary physics, computer security, and mathematical Klein bottles, with occasional detours into common sense.

Creator: DEF CON Talks

In 2026, the US led what would become an international crackdown on Dark Fleet (sometimes called Shadow/Ghost Fleet): vessels that illegally transport sanctioned oil or other cargo. Little known to the public, Coast Guard Cyber Command was deploying its Cyber Protection Teams (CPTs) onboard these vessels to assure the security & safety of these vessels in cyber space. This talk provides a rare look at the US cyber operators deploying on Dark Fleet Tankers, the danger these vessels pose, and lessons learned from these boardings.

US Coast Guard Cyber Trends in the Maritime Environment 2025 (URL pending release) The Global Oil Tanker Market: An Overview as It Relates to Sanctions (https://www.congress.gov/crs-product/R47962)

People:
    SpeakerBio:  Kenneth Miltenberger, US Coast Guard / 2003 Cyber Protection Team

Commander Kenny Miltenberger currently serves as the first Commanding Officer of the 2003 Cyber Protection Team (CPT) in Alameda, CA. He is responsible for protecting the nation’s Marine Transportation System in cyberspace by conducting hunt, assess, and incident response operations. His team is the Coast Guard’s newest CPT and the only CPT geographically detached from Coast Guard Cyber Command (CGCYBER). He led the DEFCON 33 presentation, “From Shanghai to the Shore: The Silent Threat in Global Shipping”.

Kenny recently completed an assignment where he founded the Coast Guard’s Red Team and ran the Coast Guard’s Blue Team. During that tour he founded CGCYBER’s educational phishing capability, led cyber Opposing Forces for a major multinational exercise, and oversaw over 100 Red and Blue Team missions. Other notable positions include his work as an engineer for the U.S. Navy’s Naval Sea Systems Command, where he was a developer on a shipboard cyber security platform.

Kenny has a BS in Electrical Engineering from the Coast Guard Academy and an MS Electrical Engineering from University of Maryland (UMD) College Park.

Kenny has also worked as part-time faculty at UMD College Park, where he taught Binary Exploitation in their Cyber Masters Program. Industry certifications include OSCP, GXPN, GCPN, GREM, and more

SpeakerBio:  Shane Cancilla, US Coast Guard / 2003 Cyber Protection Team

Shane Cancilla is the Network Engineer for the 2003 Cyber Protection Team in Alameda, CA, focused on building and integrating tools for assessment, incident response, and threat hunting missions across Marine Transportation System and IT/OT/ICS environments. His work spans the engineering and deployment of sensors across complex networks and supporting mission-critical operations as a network analyst.

He has previously worked with organizations including Lawrence Livermore and Lawrence Berkeley National Laboratories, where he supported high performance computing and virtualized network environments.

Shane holds a B.S. in Computer Science from California State University, East Bay, along with CCNA and GCIH certifications.

Creator: DEF CON Talks

What if a globally accessible maritime communications network was co-opted for other than intended use? Our research tool demonstrates how defenders and users of AIS (the Automatic Identification System) might create and detect a covert communications channel that operates without a conventional server or internet connection.

DC10’s Stealth Data Transport (Khan) [https://share.google/Y5mFWV13VamaskHvq] AIS Spoofing: A Tutorial for Researchers Dr. Gary Kessler [https://share.google/ye0yai283P4mbq3Sj ] DC27’s Hack the Sea (Julian Blanco) [https://share.google/H7ExvRhCfSv32OEio] DC33’s Pirates of the North Sea (Bjørkhaug) [https://share.google/97Y51J8DEbis1TTAd] DC33’s Navigating the invisible (Mehmet Onder Key & Furkan Aydogan) [https://share.google/5jvqgyAgdLm18f7kR] Amro, A., & Gkioulos, V. (2022, September). From Click To Sink: Utilizing AIS for Command and Control in Maritime Cyber Attacks. 27th European Symposium on Research in Computer Security (ESORICS) 2022, Copenhagen, Denmark, pp. 535-553. Lecture Notes in Computer Science (LNCS), 13556. DOI: 10.1007/978-3-031-17143-7_26

People:
    SpeakerBio:  T. Gwyddon “data” Owen

data is a retired Air Force Cyber Warfare Officer with over 20 years of operational experience. While no longer a fed, he’s a CNODP and RIOT grad with a Comp Sci BS from the USAF Academy and a Master’s in Cyber Ops from the Air Force Institute of Technology. He’s been certified in all 3 NSA Red Team work roles, all 3 offensive SIGINT work roles, qualified in all 6 Cybercom offensive work roles and personally engaged real-world, nation-state-level actors, malware and targets in air, land, sea, space & cyberspace both offensively and defensively. And he’s done so with the US, UK, Canada, Australia and New Zealand. He also helped Bryce make the Space Badge for DEF CON 33 and the Clip-Boy badge for DEF CON 34.

SpeakerBio:  amp

amp spent 10 years driving ships around the globe—now captains a CTF team instead. With a B.S. in electrical engineering and pursuing M.S. in info systems engineering, amp made the jump from maritime grit to digital ops, bringing salty sea stories and a screwdriver to every hacking challenge. They’ve co-hosted episodes of several podcasts poking at the strange edges of maritime security, cyber policy, and why everything breaks at 2 AM. Into hardware hacking, retro gaming, and running text-based RPGs where everything is a side quest.

Creator: DEF CON Talks

Most agentic systems for offensive security boast impressive benchmarks while hiding the real cost, the real time, and the architectural pain behind them. Many remain closed-source, sacrificing the transparency security demands.After 20 years as an offensive security researcher, I spent the last 10 months distilling all that accumulated experience into a deterministic agentic pipeline for web pentesting.I’ll dissect the hard trade-offs I had to make: why visual validation via Playwright, CDP and Vision models became mandatory (and why text-based parsing is architecturally broken for client-side vulns like XSS), why suppressing creativity backfired, how specialization, model shifting and temperature control enabled useful determinism, why a dedicated Skeptic agent and weighted scoring were essential, and why immutable audit trails, wet/dry separation and native MCP support became non-negotiable.War stories included: the “Dojo Incident” — where the agents decided rewriting server configs was cheaper than writing the exploit.Conclusion: reliable offensive agentic systems must be open-source. Closed-source hides real behavior and real risks. Open-source is not a license choice — it is the only architectural and ethical safeguard we have left.

People:
    SpeakerBio:  Albert “yz9yt” Corzo

I’ve been breaking things for over 20 years — legally, most of the time. An offensive security researcher with an adversarial mindset, multiple Hall of Fame recognitions, and several critical CVEs discovered.For the past 6+ years I’ve focused on the intersection of AI and offensive security. My work centers on solving complex engineering challenges in agentic systems: enforcing determinism, minimizing token burn and environmental impact, and creating reliable pipelines that combine LLMs with real web pentesting tools.I’m a web pentester and technical speaker passionate about helping the next generation of researchers execute more precise and effective web attacks.

Creator: DEF CON Talks

Trusted execution environments (TEEs) aim to offer strong privacy and integrity guarantees even in the presence of root level attackers. Recently there has been a pivotal shift in TEE deployment, moving TEEs from enclaves running on PC-oriented hardware to confidential virtual machines executing on server-grade CPUs. Under the hood, this change has also resulted in significant modifications to the underlying memory encryption engine, removing integrity guarantees as well as protections against replay attacks. While Intel’s and AMD’s change in TEE implementation is clearly significant and substantial, most TEE deployments appear to fail to acknowledge the difference in security guarantees, assuming a stronger security model than truly afforded by the implementation. Thus, in this talk we discuss the true protection offered by Intel’s and AMD’s newest TEE offerings against entry-level physical side-channel attacks. We show that bus interposition attacks on DDR server memory can be constructed cheaply by hobbyists, using parts on e-commerce websites. With our bus interposer combined with the weaker security model of server TEEs, we will show a live demo of our ability to extract secret key material from machines in fully trusted status. Finally, we demonstrate the implications of our attacks on real world deployments.

https://tee.fail Paper: https://tee.fail/files/paper.pdf Please see our paper for references to prior work.

People:
    SpeakerBio:  Daniel Genkin, Georgia Tech

Daniel Genkin is an Associate Professor at the School of Cybersecurity and Privacy at Georgia Tech. Daniel’s research interests are in hardware and system security, with particular focus on side channel attacks and defenses. Daniel’s work has been recognized by best paper awards in multiple academic and industry venues, multiple Black Hat Pwnie awards, as well as covered by national and scientific press. Daniel has been part of the team performing the first analysis of speculative and transient execution, resulting in the discovery of Spectre, Meltdown and follow ups. Finally, he has a PhD in Computer Science from the Technion Israel’s Institute of Technology and is a 2024 Alfred P. Sloan Research Fellow.

SpeakerBio:  Jalen Chuang, Georgia Tech

Jalen Chuang is a PhD student at the Hardware Security Lab at Georgia Tech. Jalen’s research spans software fuzzing, CPU microarchitectural side-channels, and now focuses on trusted execution environments. Outside of research, Jalen is a regular CTF player and 2-time DEFCON CTF finalist.

Creator: DEF CON Talks

In this talk, we’ll discuss how we achieved the black-box compromise of the Trusted Execution Environment (TEE) of the Texas Instruments OMAP-L138, a popular SoC encountered in various PMR radios, satcom equipment and other embedded applications. These radios are frequently used in safety-critical roles, where integrity and service availability is paramount.

Through a painstaking iterative process, which includes building both a disassembler and a decompiler for the (hellish) DSP architecture, and through blind exploitation of the Texas Instruments ROM code underpinning the TEE functionality, we managed to abuse a (novel type of) timing side channel that exists when attempting to load (bogus) cryptographic modules into the TEE, allowing us to recover the manufacturer key within a minute.

The talk dives deep into the technical aspects of the attack, providing a rare perspective on how the simple primitive of “decryption isn’t constant time” can ultimately be leveraged into a very tangible result: recovery of the device’s full 128-bit AES key. Additionally, we discuss several ROM-based vulnerabilities, including one that enables full secure-mode code execution on the SoC.

Vulns are in ROM, so if you’re so inclined: feel free to have fun with those on other OMAP-L138-powered devices.

People:
    SpeakerBio:  Carlo Meijer, Midnight Blue

Carlo Meijer is a founding partner of the boutique security consultancy firm Midnight Blue and is most known for his research into TETRA, the MIFARE Classic Crypto1 RFID cipher, and the security of self-encrypting drives. Furthermore, Carlo regularly competes in the famous Pwn2Own hacking competition, where he is part of team PHP Hooligans.

SpeakerBio:  Wouter Bokslag, Midnight Blue

Wouter Bokslag is a co-founding partner and security researcher at Midnight Blue. He is known for the reverse-engineering and cryptanalysis of several proprietary in-vehicle immobilizer authentication ciphers used by major automotive manufacturers as well as co-developing the world’s fastest public attack against the Hitag2 cipher. He holds a Master’s Degree in Computer Science & Engineering from Eindhoven University of Technology (TU/e) and designed and assisted in teaching hands-on offensive security classes for graduate students at the Dutch Kerckhoffs Institute for several years.

Recently heavily involved in the TETRA:BURST research and associated follow-up research, such as the recent reverse-engineering and analysis of the elusive TETRA End-to-End protocol. Also, a contributer of open-source SDR code.

Creator: DEF CON Talks

People:
    SpeakerBio:  Ian Roos
No BIO available
SpeakerBio:  Mark Trumpbour
No BIO available

Creator: DEF CON Talks

Every 5G phone parses radio messages using code generated by a compiler. That compiler has two blind spots — and we used them to crash iPhones, Pixels, and phones from every major chipset vendor. No credentials, no user interaction, no warning.

The compiler can’t read English. Hundreds of rules that govern when fields should appear exist only in natural-language prose. The compiler discards them all. We extracted these invisible rules, turned them into targeted payloads, and crashed basebands from Apple, Google, Qualcomm, and MediaTek — all before authentication. Apple confirmed reproduction. Google Android Security confirmed multiple findings. MediaTek patched three CVEs affecting 64 chipset models and over 542 smartphone models. Qualcomm rewarded one finding.

The compiler can’t count. Some fields have value ranges that don’t fill the wire encoding. We changed one byte in a legitimate message and crashed phones across two chipset generations. GSMA assigned CVD-2025-0110.

Same root cause, same blind compiler, same result: the modem trusts a decoder that was never built to enforce the rules that matter. We demo live over-the-air crashes on stage.

1. 3GPP TS 38.331: NR Radio Resource Control (RRC) protocol specification
2. 3GPP TS 33.501: Security architecture and procedures for 5G System
3. ITU-T X.680-X.693: ASN.1 and encoding rules (UPER)
4. Hernandez et al., “FirmWire: Transparent Dynamic Analysis for Cellular Baseband Firmware,” NDSS 2022
5. Klischies et al., “BaseBridge: Bridging the Gap Between Over-the-Air and Emulation Testing for Cellular Baseband Firmware,” IEEE S&P 2025
6. Garbelini et al., “5Ghoul: Unleashing Chaos on 5G Edge Devices,” IEEE TDSC 2025
7. Park et al., “DoLTEst: In-depth Downlink Negative Testing Framework for LTE Devices,” USENIX Security 2022
8. Rupprecht et al., “Putting LTE Security Functions to the Test: A Framework to Evaluate Implementation Correctness,” USENIX WOOT 2016

People:
    SpeakerBio:  Qiqing Huang

Qiqing Huang is a PhD candidate in Computer Science at the University at Buffalo, specializing in 5G baseband security. His research focuses on exploiting structural gaps between formal protocol schemas and natural-language specification constraints to discover pre-authentication vulnerabilities in commercial cellular modems. His work has resulted in multiple high-severity CVEs affecting major baseband vendors including Apple, Qualcomm, Samsung, and MediaTek, impacting 64 chipset models and over 542 commercially available smartphone models. He received GSMA CVD-2025-0110 for discovering a class of ASN.1 decode divergence vulnerabilities. His research has been published at USENIX Security 2026. He maintains active responsible disclosure relationships with Apple, Google, Qualcomm, Samsung, MediaTek, and GSMA. He is completing his PhD in Summer 2026 and is on the job market for security research roles.

SpeakerBio:  Xingyu Wang, University at Buffalo

Xingyu Wang is a PhD student at the University at Buffalo studying the weird edge cases of networks, phones, and systems that are supposed to “just work.” He explores how AI can help security researchers survive dense specs and turn “wait, why did it do that?” moments into better tests. He does not fully trust AI or complex systems, but he enjoys putting them in the same room and watching what breaks first.

Creator: DEF CON Talks
The badge: how it was made, how to hack it, the new open source chip powering it, and how you can use it as a hardware security token after the con! bunnie shares his experiences zero-shotting the badge with the help of team Cheeso.

This year’s badge goes deeper into the open source rabbit hole than ever before. It features the Baochip-1x, a security-oriented “high-assurance” CPU that embraces Kerckhoffs’s principle: not only can you check out most of the hardware design source, you can also directly see its transistors using infrared light. Learn more about how to unlock the power of open source silicon, and power up your hacking game with “God Mode” visibility into the heart of the machine.

People:
    SpeakerBio:  Andrew ‘bunnie’ Huang

Andrew ‘bunnie’ Huang is best known for his work hacking the Microsoft Xbox, as well as for designing and manufacturing open source hardware. His current research interest is in facilitating trust in technology. He developed the IRIS (Infra-Red, In-Situ) imaging technique for silicon, and is the founder of Baochip, a fabless open source silicon company.

Creator: DEF CON Talks
Confidential computing on cloud TEEs: Nitro Enclaves, SEV-SNP, and TDX promises that a fully compromised host cannot reach into a hardware-isolated enclave. The cryptographic attestation story holds. The deployment story does not.

This talk demonstrates attacks that bypass TEE isolation without touching the enclave image. We target the inputs an enclave trusts at boot: cloud object storage, host-supplied environment variables, and KMS keys whose policies forget to enforce attestation. None are covered by attestation. All reach inside.

We demonstrate remote code execution as root inside a Nitro Enclave with a single s3:PutObject permission. No host access. No SSH. One file upload containing a path traversal, one boot cycle, and the enclave executes attacker-controlled code.

From inside we intercept KMS decrypts live to extract the database encryption key in plaintext, exfiltrate the enclave’s IAM credentials, and establish persistence across reboots without re-exploitation – all while PCR measurements remain unchanged and attestation reports a healthy enclave.

We release an open-source auditing tool, walk through which defenses held, and provide a hardening checklist for any team running workloads inside TEEs.

The enclave isn’t broken. The way we deploy it is.

AWS, “AWS Nitro Enclaves User Guide,” https://docs.aws.amazon.com/enclaves/latest/user/nitro-enclave.html AWS, “Cryptographic Attestation with AWS KMS for Nitro Enclaves,” https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html A. Tsow, “Attacking Confidential Computing: A Survey of TEE Exploitation Techniques,” IEEE S&P Workshop on Offensive Technologies (WOOT), 2024 NCC Group, “Public Report – AWS Nitro System Security Review,” 2023, https://research.nccgroup.com/2023/04/ Trail of Bits, “Security Assessment of AWS Nitro Enclaves,” 2022 MITRE ATT&CK, “Cloud Matrix – Initial Access / Valid Accounts,” https://attack.mitre.org/techniques/T1078/004/ J. Aas et al., “Understanding TEE Trust Models in Cloud Deployments,” USENIX Security Symposium, 2023 OWASP, “Path Traversal,” https://owasp.org/www-community/attacks/Path_Traversal AWS, “Instance Metadata Service Version 2 (IMDSv2),” https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html Apache Thrift Project, “Thrift Binary Protocol Specification,” https://github.com/apache/thrift/blob/master/doc/specs/thrift-binary-protocol.md

People:
    SpeakerBio:  Sandeep “pyro” Jayashankar, Independent Researcher

Sandeep Jayashankar is a security researcher specializing in offensive security and adversarial simulations. His work spans AWS, Azure, and GCP environments, with current research focused on trusted execution environment exploitation, confidential computing trust boundaries, and the security of AI/ML systems deployed in cloud-native architectures. This research was conducted under an authorized adversarial simulation program. He approaches security research from a defender’s perspective: every offensive finding ships with a concrete, auditable control that defenders can deploy. He previously presented at RSA Conference 2025.

Creator: DEF CON Talks

Smart locks are widely used in rental, hotel, and residential markets. As a major provider, TTLock (Sciener) operates in over 200 countries and relies on Offline Time Management to issue temporary eKeys without network access. However, our research reveals critical security flaws in this common offline design. From real-world anomalies, we analyzed TTLock’s proprietary BLE protocol and found serious weaknesses in its cryptographic verification and authentication. Lacking proper validation, the so-called secure offline architecture is fully bypassable. We uncovered three critical design flaws: full revocation bypass, expired credential resurrection, and low-cost DoS. In this talk, we will demonstrate exploitation with a Mac and custom Python tools. We show that time management in TTLock is a mere illusion, turning physical security into an open digital door.

People:
    SpeakerBio:  Yang Liu, Hillstone Networks Co., Ltd.

Yang Liu is a Security Researcher at Hillstone Network Security Research Institute, specializing in binary vulnerability hunting, ICS security, mobile security, and reverse engineering. With extensive experience in both red-teaming and defense, Yang has discovered numerous vulnerabilities in complex industrial control systems. He is a frequent speaker in the security community, notably presenting his ICS research at the Kanxue Security Development Conference (SDC). An avid CTF competitor, Yang excels in Reverse Engineering, Mobile, and ICS categories. He also leverages his real-world combat experience to provide professional cybersecurity training for enterprises.

SpeakerBio:  Zhenghan Wang, Hillstone Networks Co., Ltd.

Zhenghan Wang is a security researcher focusing on IoT security and open-source software security. His research interests include embedded system security, protocol analysis, reverse engineering, and vulnerability discovery. He is dedicated to finding and disclosing real-world security issues to help improve the safety of connected devices and open-source projects.

Creator: DEF CON Talks

Identity is the new perimeter, and biometrics are its supposed gatekeepers. But what happens when the gatekeepers are blind to the reality they consume? We spent more than 6 months deconstructing the biometric “Root of Trust” across every top-tier framework we could find, solutions relied upon by the world’s largest banks and providers worth billions. The result: A 100% bypass rate . From high-fidelity physical spoofs to a first-of-its-kind Cross-PID buffer hijack against integrated anti-tamper SDKs, we prove that even multi-million dollar “fortresses” can be reduced to client-side theater. This talk is a technical journey through the guts of the mobile media pipeline, exposing how synthetic identities are manufactured at scale to bypass RASP, Kernel-level integrity, and AI models. When the “Master Key” is just another line of code an attacker can hook, the risk isn’t just a bug, it’s a systemic failure affecting millions of users. Customers are losing wealth, companies are buying illusions, and the glass perimeter is shattering.

People:
    SpeakerBio:  Dan Borgogno, Security Researcher at Faraday

Dan Borgogno is a security researcher, backend developer, security engineer and international speaker with years of experience on mobile, hardware, IoT and web application hacking.

SpeakerBio:  Javier Bernardo, Strike Security

Senior Pentester, Security Engineer and Cybersecurity Researcher (+15 years) with a wide area of expertise in Offensive Security and Red Team. Passionate Bug Hunter and self-taught Cybersecurity Specialist who loves to hack almost everything.

Organizer of Bug Bounty Argentina Community: https://twitter.com/BugBountyArg Speaker and Organizer at Ekoparty Security Conference: https://ekoparty.org/

Creator: DEF CON Talks

Every major AI coding agent ships inside a containment system. I analyzed three of them – Anthropic’s Claude Code, Google’s Gemini CLI, and OpenAI’s Codex CLI – and each one breaks on its own terms.

Each sandbox uses a different containment model: permission-based access control, process-level environment sanitization, and kernel-level filesystem enforcement. Each makes a structural assumption about what the runtime will do. Each assumption is wrong.

This talk deconstructs all three architectures, shows what each claims to enforce, and demonstrates how the containment fails – not through prompt injection or model persuasion, but through gaps in the design itself. Every exploit is deterministic, demo-ready, and was reported through coordinated disclosure.

Attendees leave with a reusable methodology for evaluating any AI agent sandbox: identify the containment mechanism, read the enforcement code, find the structural assumption it depends on, and test whether the runtime violates it. The cross-vendor comparison shows that different engineering teams, solving the same problem independently, make structurally similar mistakes – and that the pattern is predictable once you know where to look.

People:
    SpeakerBio:  Elad Meged, Novee Security

Elad Meged is a Founding Engineer and Security Researcher at Novee Security, specializing in offensive security research and AI security. He holds an M.Sc. in Computer Science and has a background in vulnerability research across web, mobile, and low-level systems, with experience in reverse engineering and platform internals. His current work applies offensive research methodology to AI systems while developing AI-driven approaches to vulnerability discovery and exploit verification.

Creator: DEF CON Talks

Modern protocol bugs rarely look like flaws in the protocol itself. They show up when a clean spec meets existing server architectures. HTTP request smuggling showed this for request boundaries: implementations disagreed about where one request ended and the next began. This talk asks a similar question about HTTP/2 request lifetime: what happens when one layer thinks a request is over, while another is still working on it?

In 2023, Rapid Reset showed the world that HTTP/2 had a problem: attackers could open and reset streams faster than servers could keep up. The disclosure triggered an industry-wide patching scramble, but patches addressed the symptom, not the root cause.

Two years later, I disclosed MadeYouReset through CERT/CC as CVE-2025-8671, exploiting the same root cause through a different door and setting off a second round of patches across the ecosystem, including Apache Tomcat, H2O, Netty, and others.

In this talk, I’ll show how research that started with Rapid Reset led to MadeYouReset, and how both create streams closed at the HTTP/2 layer while server-side request work continues. We’ll see why this gap exists, why fully fixing it is infeasible, and what conditions make MadeYouReset especially harmful.

Finally, we’ll answer the question: is the next HTTP/2 abuse already waiting around the corner?

CERT/CC VU#767506: https://kb.cert.org/vuls/id/767506 NVD CVE-2025-8671: https://nvd.nist.gov/vuln/detail/CVE-2025-8671 MadeYouReset blog posts: https://galbarnahum.com/made-you-reset

People:
    SpeakerBio:  Gal Bar Nahum, Tenzai

Gal Bar Nahum is a security researcher at Tenzai with eight years of experience in vulnerability research, network protocol security, red teaming, and AI research.

Creator: DEF CON Talks

Thin clients are deployed across healthcare, finance, government and critical infrastructure, environments where full disk encryption is a compliance requirement, not optional. Dell, IGEL and HP all ship FDE backed by TPM hardware and modern cryptography. I broke all three.

I present new research demonstrating vulnerabilities that permit full disk encryption bypass across Dell ThinOS 9.x – 10.x, HP ThinPro 8.x – 9.x, and IGEL OS 11.x – 12.x. Every attack achieving filesystem access from a powered-off device with no credentials and no specialist hardware. Behind the encryption: WiFi credentials, 802.1x NAC client certificates, VDI session configs, management server credentials, and password hashes. Compromised devices provide a foothold into the infrastructure it was connected to. I trace Dell’s implementation across three generations getting progressively further from best practice, show IGEL’s correct PCR policy and modern cryptography bypassed through their own signed bootloader, and demonstrate HP’s implementation undone by an unmeasured boot chain.

People:
    SpeakerBio:  Darren McDonald, AmberWolf

Darren McDonald is an offensive security consultant at AmberWolf, where he specialises in hardware hacking and red teaming. He has spent 17 years breaking into things professionally, starting with networks and applications before moving to embedded systems, firmware, and the physical layer. The kind of hacker who pulls out screwdrivers instead of a checklist.

Creator: DEF CON Talks

Last DEF CON, we stole cleartext credentials directly from the real Microsoft login page. This year, we take it a step further by making Microsoft deliver our phishing emails!

We’ve all seen threat actors abuse built-in email notifications from legitimate SaaS platforms to send phishing links from trusted domains, bypassing email security solutions. But in most cases, they only control a small portion of the email content, making the end result far from convincing.

While the execution of these examples has mostly been fairly poor and limited in complexity so far, the idea of making a legitimate application deliver your phishing payload did intrigue me. So I started digging for more advanced ways to push this concept further, looking for techniques that would allow taking over the majority (or sometimes the entirety) of the email content.

In this talk, I’ll present several novel techniques to inject custom phishing pretexts into emails sent by multiple first-party Microsoft services, taking advantage of their trusted email addresses and domain reputation.

These emails seem so legitimate that even seasoned IT and security professionals would trust them (and we have the proof from our assessments to back this up). After all, who doesn’t trust Microsoft? 😉

• DEFCON33 – Turning Microsoft’s Login Page into our Phishing Infrastructure
  • https://www.youtube.com/watch?v=z6GJqrkL0S0
• GraphSpy
  • https://github.com/RedByte1337/GraphSpy
• SharePoint SendEmail API retirement
  • https://support.microsoft.com/en-us/office/retirement-of-the-sharepoint-sendemail-api-b35bbab1-7d09-455f-8737-c2de63fe0821

People:
    SpeakerBio:  Keanu “RedByte” Nys, Spotit

Keanu Nys (aka RedByte) is an information security researcher from Belgium, and currently leads Spotit’s offensive security team. While he has a passion for all offensive cybersecurity topics, he mostly specializes in Active Directory, Microsoft Entra ID (Azure AD), and Social Engineering.

He is the author of the Microsoft 365 and Entra attack toolkit GraphSpy. Additionally, Keanu is the trainer for the Certified Azure Red Team Expert (CARTE) bootcamps at Altered Security, and has given talks, workshops and trainings at conferences like DEF CON, Blackhat USA, and BruCON.

Creator: DEF CON Talks
Classical Markov password generators work over the character alphabet: hashcat’s Markov masks, JtR’s –markov, OMEN, even neural models like PassGPT.

We change one thing: the alphabet. Train an n-gram Markov on RockYou, but segment with GPT-2’s 50k BPE tokenizer instead of characters. The distribution stays RockYou-derived; only the units change. The vocabulary captures structure characters can’t: name fragments, digit patterns, symbol clusters from web-scale text.

Across 14 leak corpora (RockYou, LinkedIn, Yahoo, +11 more), token-Markov beats OMEN at fixed budgets on all 14, at 10^8 and 10^9, with best66 rules on both sides. On enterprise passwords (8+ chars, 3 of 4 classes), we recover ~6x more than OMEN: 6.3% vs 1.1% at 10^8, 12.3% vs 2.3% at 10^9; the lead holds ~2.8x with rules applied. tokenov hits 10^9 candidates in minutes on CPU; OMEN takes hours; PassGPT needs days.

Why: the tokenizer bakes in mixed-case, digit, and symbol primitives, so multi-class compliance is modal, not rare. “Michael99” is two tokens, not eight transitions.

We release tokenov: train an n-gram model with any tokenizer, or use include custom GTP-2 tokenizer. Pipe into hashcat, JtR, or write to disk. Use OSINT derived lists to seed generation customized to the target. No GPU needed: 1B candidates in under 2 minutes on an i9.

• Narayanan & Shmatikov, “Fast dictionary attacks on passwords using time-space tradeoff,” CCS 2005. (Markov password modeling, original.)
• Weir et al., “Password cracking using probabilistic context-free grammars,” IEEE S&P 2009. (PCFG, the natural rival to Markov.)
• Durmuth et al., “OMEN: Faster password guessing using an ordered Markov enumerator,” ESSoS 2015. (The level-ordered enumerator we benchmark against.)
• Melicher et al., “Fast, lean, and accurate: Modeling password guessability using neural networks,” USENIX Security 2016. (FLA, the neural baseline.)
• Hitaj et al., “PassGAN: A deep learning approach for password guessing,” ACNS 2019.
• Rando et al., “PassGPT: Password modeling and (guided) generation with LLMs,” ESORICS 2023. (Closest prior work; uses GPT-2 fine-tuned on RockYou. We outperform it.)
• Cracken (https://github.com/shmuelamar/cracken). The proximate inspiration; uses BPE for password masks. We extend the BPE idea from masks to full Markov generation.
• MAYA benchmark (S&P 2026). The 19-corpus evaluation framework we adopted.

People:
    SpeakerBio:  Jon “flakpaket” Gorenflo, ATTACKD

Jon Gorenflo is the founder of ATTACKD, a cybersecurity consulting firm dedicated to helping organizations of all sizes think like attackers and proactively secure their environments. Whether you’re a startup, a small business, or a global enterprise, Jon brings real-world offensive security insights that are practical, accessible, and actionable. He is also a Principal Instructor with the SANS Institute and the co-author of SEC560: Enterprise Penetration Testing, a leading course on advanced ethical hacking and red team operations. With more than 20 years of combined experience in IT, penetration testing, incident response, and security training, Jon has worked with a diverse range of organizations to uncover critical vulnerabilities and build resilient defenses. In addition, Jon serves as the executive director of Hackers Teaching Hackers (HTH), a grassroots cybersecurity conference that emphasizes hands-on learning and community connection. Jon is known for his clear communication, relatable style, and dedication to helping defenders build practical skills. He breaks down hacker tactics into understandable steps and helps teams of all sizes, from a solo IT admin to an enterprise SOC, apply those lessons to real-world defenses.

Creator: DEF CON Talks
We performed our research against three major GPS tracking platforms: SETracker (~10M devices, 39 brands), SinoTrack (6M+ devices), and TKSTAR/Thinkrace (20M+ devices). All three come from the same Shenzhen supply chain. All three are completely broken.

We achieved RCE on every platform, including NT AUTHORITY\SYSTEM on TKSTAR. From a free account with no device purchase, we can silently wiretap any child’s watch, force video surveillance, steal vehicles through remote door unlock and fuel cutoff, and take over the backend servers. We filed 45 CVEs, 19 critical, 9 of them CVSS v3.1 10.0.

The worst part is the supply chain structure. 39 consumer brands in 20+ countries (Wonlex, SaveFamily, KidiWatch, Garett, etc.) all connect to the same myaqsh.com server in China. Parents think they are choosing between brands. They are not. Brand diversity in this market is an illusion.

We release full PoC chains, CVE details, and a brand-to-backend mapping that shows how this industry actually works.

People:
    SpeakerBio:  Felipe Solferini

Felipe is a senior penetration tester and self-proclaimed security researcher. Most of the time, he’s mashing the wrong buttons, hoping for the worst but expecting the best – or just YOLOing like there’s no tomorrow. Occasionally, he wonders if life is just a CTF. He has presented his research at BSides London, BSides Sofia, and Bsides Vilnius.

SpeakerBio:  Vangelis Stykas, Kumio

Vangelis began as a developer from Greece. Ten years ago he realized that only his dog didn’t have an API, so he decided to steer his focus towards security. That led him to pursue a PhD in Web Application Security with an extra focus on machine learning. He’s still actively pursuing it. He currently applies his skills as a Chief Technology Officer at Kumio, and during his free time, Vangelis is helping start-ups secure themselves on the internet and get a leg up in security terms. His love of a simplistic approach to hacking by exploiting vulnerable APIs led him to publish research regarding API controlling ships, smart locks, IP cameras, car alarms, EV chargers, and many other IoT devices. Since our lives are nowadays extremely cyber-dependent, his goal is to convince all companies to never neglect their API security as rush-to-market mentality is almost certain to lead to catastrophic security failure. He has presented his research at Black Hat USA, DEF CON, Disobey, BSides London, BSides Dublin, BSides Athens, 44Con and other security conferences, and has keynoted at BSides Prague. His most recent work on disrupting ransomware operations by hacking their web panels was featured at Black Hat USA and DEF CON 32.

Creator: DEF CON Talks

In 2017, our DEF CON talk “Friday the 13th: JSON Attacks” forced the industry to confront Insecure Deserialization. Developers responded by hardening the configurations of parsers and serializers. But it created a dangerous blind spot. Developers and security reviewers now assume that simpler code patterns, those that do not involve parsers, are inherently safe. We demonstrate that they are not. This talk moves the focus away from the serialization format entirely and targets the transformation layer: the code that turns a simple string into a complex object. We expose “Insecure String Transformers”: mechanisms that silently resolve types, trigger complex logic, and instantiate objects during what looks like a safe string conversion. This overlooked attack surface remains invisible to the tools and reviews focused on the parser-level bugs from 2017. We dissect specific CVEs where string-to-object conversion was the root cause of RCE. We release new gadget chains targeting popular .NET libraries and present a methodology for hunting dangerous conversion patterns across any codebase. The goal is to redefine how the industry classifies this vulnerability: it is not “Insecure Deserialization” – it is Insecure Transformation, and it may be hiding in your application even if it does not use any serialization library.

Alvaro Muñoz & Oleksandr Mirosh, “Friday the 13th: JSON Attacks” – Black Hat USA 2017 https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-JSON-Attacks-wp.pdf Alvaro Muñoz & Oleksandr Mirosh, “Room for Escape: Scribbling Outside the Lines of Template Security” – Black Hat USA 2020 https://i.blackhat.com/USA-20/Wednesday/us-20-Munoz-Room-For-Escape-Scribbling-Outside-The-Lines-Of-Template-Security-wp.pdf

People:
    SpeakerBio:  Oleksandr Mirosh, OpenText Fortify

Oleksandr Mirosh is a Security Researcher on the Fortify Software Security Research team at OpenText, where he focuses on investigating emerging threats and developing detection and remediation rules for enterprise software. With over 18 years of experience in computer security, specializing in vulnerability research, reverse engineering, and penetration testing, his work centers on flaws in JNDI, authentication protocols, data serialization, and transformation logic across Java and .NET ecosystems. His research has led to the discovery of numerous CVEs in widely deployed enterprise applications and framework libraries. A frequent speaker at Black Hat USA and DEF CON, he has also presented at other security conferences like OWASP Global AppSec and BSidesLV.

Creator: DEF CON Talks

Everyday billions of credit card transactions are made worldwide, with the vast majority being done on purpose-built card machines. In the USA alone, nearly 400 million transactions are performed per day on these popular devices present in nearly every retail store. In this talk, I’ll focus on a widely deployed Verifone product line of card machines, with an estimated global deployment of over one million units. For several consecutive years I conducted an annual security assessment on these devices, until a pattern emerged: I’d arrive at the assessment, find a fresh set of vulnerabilities, gain root access, and then have Verifone patch the devices — only for me to return the following year and gain root access in a new way. I’ll demonstrate the three separate attack chains I discovered, two of which only required network access to the target. I’ll also detail additional vulnerabilities that could be used to disable hardening features such as grsecurity, including the ability to modify the file system to gain persistent access. Next, I’ll show how an attacker could leverage this access to continuously capture credit card information – contrary to the device’s security claims. Finally, in a homage to trixr4skids’ DEF CON 25 talk in which he hacked an older series of Verifone’s devices, I’ll also run Doom.

DEF CON 25 – trixr4skids’ DOOMed Point of Sale Systems CCC May Contain Hackers2022 – Thomas Rinsma’s Payment terminals as general purpose (game-)computers

People:
    SpeakerBio:  Reino Mostert, Orange Cyberdefense

Reino is a hacker who has been working as a penetration tester for the past decade. He has hacked various payment systems – from credit card devices all the way to payment switches, and has given talks at numerous cons. He enjoys coffee and hacking.

Creator: DEF CON Talks
Pyodide is often treated as a ready-made sandbox: block os, block js,
and untrusted Python is assumed to stay inside WebAssembly. In n8n and
the other products we tested, that assumption failed. When ctypes or reflection
remained reachable, attacker-controlled Python could cross from
CPython-in-WASM into the Emscripten/JavaScript host boundary the product
actually relied on.

We show this as an architectural failure, not a one-off bug. In Node.js embeddings, that boundary break typically becomes immediate host-side code execution because the escaped code lands in a runtime with no native permission model. In Deno embeddings, the same break still reaches the embedding runtime, but the final blast radius depends on the permissions the product granted; in one default configuration, that still meant full RCE. In CI environments, the same mistake turns tests and build steps into a supply-chain risk because the escaped code runs next to tokens, secrets, and release artifacts.

Across workflow automation, spreadsheets, AI agents, desktop wrappers, and build tooling, we found seven escapes, two public CVEs, and multiple additional disclosures. Attendees leave with a precise mental model of where Pyodide isolation actually ends, how to test similar deployments, and how to harden them beyond fragile denylists.

• Pyodide documentation. Pyodide is CPython compiled with Emscripten to WebAssembly and embedded in a JavaScript host; this host-embedding model is central to our analysis. https://pyodide.org/

  • Emscripten API documentation for emscripten_run_script*. These APIs are the JavaScript-execution bridge we reached from Pyodide via ctypes. https://emscripten.org/

  • Lehmann et al., “Everything Old is New Again: Binary Security of WebAssembly,” USENIX Security 2020.

  • Bosamiya et al., “Provably-Safe Multilingual Software Sandboxing using WebAssembly,” USENIX Security 2022.

  • Zhao et al., “Remote Code Execution from SSTI in the Sandbox: Cracking the Sandbox of Template Engines via Isolation-Aware Attack,” USENIX Security 2023.

  • Public advisories for two instances from this research: CVE-2025-68668 / GHSA-62r4-hw23-cc8v (n8n) CVE-2026-24002 / GHSA-7xvx-8pf2-pv5g (Grist)

People:
    SpeakerBio:  Saar Pearl, Cyera

Saar Pearl is a security researcher at Cyera. He specializes in offensive security and vulnerability research across cloud infrastructure and SaaS platforms, focusing on identity and access controls, architectural weaknesses and exploit development.

SpeakerBio:  Vladimir “G1ND1L4” Tokarev, Cyera

Vladimir Tokarev is a vulnerability researcher tech lead at Cyera, specializing in Cloud, IoT/OT, Windows, Linux, and AI vulnerability research and exploit. Talks: Black Hat USA 2024 and 2023,
DEF CON 33 Recon Village 2025, CodeBlue 2025, RSA 2024.

Creator: DEF CON Talks

This is a talk about making your CPU go slow. Really, really, really slow.

It is also, somehow, a talk about breaking platform security on nearly every x86 system ever shipped, activating a hundred dormant CVEs, repeatedly ignoring processor specifications, racing intra-core interrupts, and finding a vulnerability that cannot be fixed.

But mostly, it’s about going slow.

Memory Sinkhole AMD Sinkclose Sandsifter EDK2

People:
    SpeakerBio:  Christopher “xoreaxeaxeax” Domas

Christopher Domas (@xoreaxeaxeax) is a security researcher primarily focused on firmware, hardware, and low level processor exploitation. He is best known for releasing impractical solutions to non-existent problems, including the world’s first single instruction C compiler (M/o/Vfuscator), toolchains for generating images in program control flow graphs (REpsych), and Turing-machines in the vi text editor. His more relevant work includes the sandsifter processor fuzzer, rosenbridge backdoor, the binary visualization tool ..cantor.dust.., and the memory sinkhole privilege escalation exploit.

Creator: DEF CON Talks

People:
    SpeakerBio:  Jeff “The Dark Tangent” Moss

Mr. Moss is an internet security expert and is the founder of both the Black Hat Briefings and DEF CON Hacking conferences.

Creator: DEF CON Talks

Defenders and attackers are locked in a renewed race where AI has enabled new defenses and new attacks. In this iterated dual-use, game-theoretic situation, how can defenders be maximally enabled without unduly increasing the risks that adversaries get access to the same capabilities?

As highly capable LLMs face increasing restrictions and regulatory interest from policy makers, adversaries are attempting to evade restrictions, sometimes putting those who play by the rules at a disadvantage.

This panel will discuss recent examples and will look toward the near future as model capabilities increase yet again in both closed and open weights models.

People:
    SpeakerBio:  Emanuel Gawrieh, Co-Chair at AI Village

Emanuel Gawrieh is a Senior Chaos Containment Engineer on the Advanced Threat Protection team at Google, where he specializes in architecting and proving out threat models for complex workloads in highly regulated environments. As a core member of Google’s Secure AI Framework (SAIF) team, he works closely with Google AI Red Team, Google DeepMind, and the Cloud CISO’s office to establish AI security standards – contributing to the early development and specialized fine-tuning of dual-use models like SecGemini to mitigate emerging AI-specific risks. Outside of his work at Google, he is a leading voice in AI Security policy and community evangelism – having presented at DEFCON, RSA and is an active member of the [un]prompted CFP board. Additionally, he has architected the infrastructure for several Generative AI Red Team events and actively advises congressional leaders on AI and cybersecurity policy.

SpeakerBio:  Jason Clinton, Deputy CISO at Anthropic

Jason joined Anthropic in April 2023 as its first CISO after more than a decade at Google, where he most recently led Chrome infrastructure security working on defense against advanced persistent threats. While at Google, he also worked on ChromeOS and Android Pay. At Anthropic, Jason guides security strategy including detection and response, compliance, physical security, security engineering and IT. Jason promotes the security organization’s work to uphold Anthropic’s Responsible Scaling Policy framework, ensuring that the company has appropriate security safeguards in place for the responsible development and deployment of AI models. He is also the author of “Ruby Phrasebook”.

SpeakerBio:  Bruce Schneier, Advisory Board Member at VerifiedVoting.org

Bruce Schneier is an internationally renowned security technologist, called a “security guru” by the Economist. He is the New York Times best-selling author of 14 books – including Rewiring Democracy and A Hacker’s Mind — as well as hundreds of articles, essays, and academic papers. His long-running newsletter and blog, “Schneier on Security,” is one of the most popular sources of cybersecurity news on the internet. Schneier is a Fellow and Lecturer in Public Policy at the Harvard Kennedy School and the Munk School at the University of Toronto. He is a fellow at the Berkman-Klein Center for Internet and Society at Harvard University, a board member of the Electronic Frontier Foundation and AccessNow, and an advisory board member of EPIC and VerifiedVoting.org. He is also the Chief of Security Architecture at Inrupt, Inc.

SpeakerBio:  Heather Adkins, Vice President of Security Engineering at Google

Heather Adkins is a 24-year Google veteran and founding member of the Google Security Team. As VP, Security Engineering and head of Google’s Office of Cybersecurity Resilience she has built a global team responsible for maintaining the safety and security of Google’s networks, systems and applications. She has an extensive background in practical security, and has worked to build and secure some of the world’s largest infrastructure. She is co-author of Building Secure and Reliable Systems (O’Reilly, 2020), was deputy chair of CISA’s Cyber Safety Review Board, and has advised numerous organizations on how to adopt modern defendable architectures.

Creator: DEF CON Talks

You have a stripped binary. No source. No symbols. No harness. You want a PoC. How do you get there? Witchcraft Solver (wsolver) is a fully automated binary-only 0day discovery pipeline.

Phase 1 lifts the binary to LLVM IR via wunstrip (.eh_frame symbol recovery, 99.98% accuracy), runs an SSA taint pre-filter to cut targets by ~50%, then drives four parallel formal verification engines (KLEE, IKOS, SeaHorn, SMACK) to produce concrete violation witnesses – covering the entire binary in ~30 minutes, no source required.

Phase 2 uses those witnesses to seed directed fuzzing (AFLGo) and binary-only concolic execution (SymQEMU), converting symbolic candidates into working PoCs. An optional Phase 0 handles non-Intel targets via a lifter portfolio (RetDec + Anvill + rev.ng), covering 93% of 39,364 production ELF binaries across ARM64, ARMv7, RISC-V, and s390x.

Validated against CVE-2023-2804 (libjpeg-turbo heap-buffer-overflow): SymQEMU produces the first crash in 25 minutes from a stripped binary with zero source access.

The tool will be released under MIT license at the conference at: https://github.com/endrazine/wsolver

Experimental validation against the wider internet is left as an exercise to the audience…

[1] Brossard, J. “Unstripping Cloud Container ELF binaries.” IEEE IC_ETC 2025. https://ieeexplore.ieee.org/abstract/document/11141058 [2] Brossard, J. “CVE-2023-2804 Complete Fuzzing Benchmark.” Zenodo. doi:10.5281/zenodo.19136269 [3] Wojtczuk, R. “UQBTng.” 22C3, 2005. [4] Poeplau, S. and Francillon, A. “SymQEMU.” NDSS 2021. [5] Böhme et al. “Directed Greybox Fuzzing.” CCS 2017. [6] Cadar et al. “KLEE.” OSDI 2008. [7] Fioraldi et al. “AFL++.” USENIX WOOT 2020. [8] Brossard, J. “Introduction to the Witchcraft Compiler Collection.” DEF CON 24, Las Vegas, August 2016. Video: https://archive.org/details/youtube-1cgtr7VW7gY

Tool Source (once published at DEF CON): https://github.com/endrazine/wsolver

People:
    SpeakerBio:  Jonathan “endrazine” Brossard

Endrazine is a returning DEF CON speaker, having previously presented the first attack against Microsoft BitLocker and TrueCrypt in 2008, the infamous Rakshasa BIOS malware in 2012, and the Witchcraft Compiler Collection reverse engineering framework in 2016. Endrazine has previously presented at premier conferences such as Black Hat, CCC, and HITB in the industry, as well as IEEE, USENIX, and ACM in academia. He currently works as CTO at MOABI, a binary analysis and vulnerability assessment firm, after having been Principal Engineer of Product Security at Salesforce (San Francisco), where he later lead the RedTeam. He is wrapping up a PhD in reverse engineering at CNAM (Paris) where he has been an Associate Professor for three years, and holds master’s degrees in Engineering, Computer Science, and Cybersecurity.

Creator: DEF CON Talks

Microsoft Copilot Studio lets anyone build AI agents that execute Python. Behind the scenes, that code runs in a Windows container on Azure Service Fabric, wrapped in a Python sandbox and guarded by a GPT-4.1 mini model that decides what’s safe to run. Three layers of defense. The presenter broke all of them.

Starting from a standard agent with code interpreter enabled, we used classic MRO introspection with string concatenation to bypass dunder filters, escaped Python entirely through pythonnet (which nobody thought to block), and systematically defeated the LLM guardrail by exploiting its leaked reasoning chain. The result: exfiltrated TLS private keys and certificates, 75 environment variables including Azure AD client IDs and Service Fabric cluster topology, complete application source code, and confirmed command execution as ContainerUser.

The most interesting finding was the LLM guardrail itself. It is non-deterministic: identical payloads sometimes pass and sometimes get blocked. It leaks its full security reasoning in the API response, turning the defender’s AI into an oracle for the attacker. This talk walks through the full attack chain, demos a C2 tool that turns the code interpreter into a persistent shell, and releases all tooling.

• Ned Batchelder, “Eval really is dangerous” (2012). Original documentation of Python MRO introspection for sandbox escape.
• Michael Bargury / Zenity, “Living off Microsoft Copilot” (DEFCON 32, Black Hat USA 2024). Prompt injection and data exfiltration through Copilot connectors. Different attack surface from code interpreter sandbox escape.
• Tobias Diehl, “Mind the Data Voids: Hijacking Copilot Trust to Deliver C2 Instructions” (DEFCON 33). Memory-persistent data exfiltration via M365 Copilot. Related but targets a different feature and attack path.

People:
    SpeakerBio:  Ryan Hausknecht, BeyondTrust

Ryan Hausknecht is the Director of Research at BeyondTrust Phantom Labs. Ryan has an extensive background in red teaming, detection development, and security research through his tenure at Microsoft and Specterops. His most notable contibutions have been in cloud security as the creator of PowerZure, the Azure Threat Research Matrix, and as the co-author of AzureHound.

SpeakerBio:  Simon Maxwell-Stewart, BeyondTrust

Simon Maxwell-Stewart is a Staff Security Researcher at BeyondTrust’s Phantom Labs, where he focuses on cloud platform security and the emerging attack surface of enterprise AI systems. Before getting into security he spent over a decade doing data science and machine learning, with a physics degree from Oxford and production ML work in healthcare.

These days he’s the resident graph nerd on the Phantom Labs team, applying graph analysis to identity security problems across Microsoft cloud environments. His recent research focuses on Entra ID attack paths, Azure infrastructure security.

Creator: DEF CON Talks

CET shadow stacks are supposed to make return-address corruption a dead end. This talk presents three techniques that write attacker-chosen values directly into shadow stack memory on Linux.

The first uses /proc/self/mem. The kernel’s FOLL_FORCE flag overrides shadow stack page protections, letting an unprivileged process write to its own shadow stack with open() and pwrite(). Works on x86-64 CET and ARM64 GCS. After our report, Linus Torvalds merged commit 599bbba5a36f to restrict this path. A fork+ptrace variant still works on patched kernels. No distribution ships the new default yet.

The second uses userfaultfd. We register a fault handler on the shadow stack VMA, discard a page with MADV_DONTNEED, and when RET faults on the missing page, provide a replacement filled with chosen return addresses. The kernel maps it with valid shadow stack PTE encoding. Not blocked by the /proc/self/mem patch.

The third uses Intel’s WRSSQ instruction, which writes to shadow stack pages from user mode. We corrected a widespread encoding bug in prior PoC code (0x66 prefix produces ADCX, not WRSSQ) and confirmed it on Sapphire Rapids bare metal.

Validated against three CVEs (dnsmasq, libinput, rsync) with demos on bare metal, including a root shell with CET still enabled.

1. Intel, “Control-flow Enforcement Technology Specification,” Rev. 3.0, 2019.

   1. ARM, “Guarded Control Stack (GCS) Extension,” Arm Architecture Reference Manual for A-profile architecture.

   2. Linux kernel source, mm/gup.c and fs/proc/base.c, including FOLL_FORCE, /proc/*/mem, and VM_SHADOW_STACK handling.

   3. Lindenmeier and Schwarz, “Ghost in the Stack: CET Shadow Stack Bypass,” Black Hat Europe 2025.

   4. Muench et al., “Control Flow-Oriented Programming,” USENIX Security 2025.

   5. Schuster et al., “Counterfeit Object-oriented Programming: On the Difficulty of Preventing Code Reuse Attacks in C++ Applications,” IEEE S&P 2015.

   6. CVE-2017-14493, dnsmasq stack buffer overflow.

   7. CVE-2022-1215, libinput format string vulnerability.

   8. CVE-2024-12084, rsync heap buffer overflow.

People:
    SpeakerBio:  Vladimir “G1ND1L4” Tokarev, Cyera

Vladimir Tokarev is a vulnerability researcher tech lead at Cyera, specializing in Cloud, IoT/OT, Windows, Linux, and AI vulnerability research and exploit. Talks: Black Hat USA 2024 and 2023,
DEF CON 33 Recon Village 2025, CodeBlue 2025, RSA 2024.

Creator: DEF CON Talks

In 2020, I registered a domain on a whim, mostly because I thought it would be hilarious for email, and then forgot about it. Then a city government faxed me their internal documents. Then an organization started sending me Cisco UCM alerts. Then 363,000 emails arrived in sixteen months. I never sent a single packet of attack traffic. The vulnerability is an assumption, that a domain nobody owns is safe to hardcode. Developers at enterprise software vendors, government agencies, and companies made that assumption. I registered the domains and the mail flowed in. This talk covers six years of passive email interception across more than 20 domains, the tooling built to systematically map this attack surface across hundreds of TLDs, and what 400,000 misdirected emails reveal about how production mail infrastructure actually fails. No exploits. No credentials. Just a $11 domain registration.

Sheward, M. “Deleteduser.com — a $15 PII Magnet.” Medium, April 2026. https://mike-sheward.medium.com/deleteduser-com-a-15-pii-magnet-c4396eb21061

Krebs, B. “They Told You Not To Reply.” Washington Post Security Fix, March 2008. https://web.archive.org/web/20200905092128/http://voices.washingtonpost.com/securityfix/2008/03/they_told_you_not_to_reply.html

Krebs, B. “Chipotle Serves Up Chips, Guac & HR Email.” Krebs on Security, 16 Nov. 2015, https://krebsonsecurity.com/2015/11/chipotle-serves-up-chips-guac-hr-email/

Fitzpatrick, J. “Sears-Kmart MyGofer,” Internet Archive, archived May 1, 2014, https://web.archive.org/web/20140501153309/http://sears-kmart-mygofer.com/

Kim, P. and Gee, G. “Doppelganger Domains.” Godai Group, 2011. https://godaigroup.net/wp-content/uploads/doppelganger/Doppelganger.Domains.pdf

Szurdi, J. and Christin, N. “Email Typosquatting.” IMC 2017. ACM. https://dl.acm.org/doi/10.1145/3131365.3131399

Internet Assigned Numbers Authority. “RDAP Bootstrap File for Domain Name Space.” https://data.iana.org/rdap/dns.json (RFC 7484)

Bradner, S., “RFC 2606: Reserved Top Level DNS Names”, IETF, 1999 https://www.rfc-editor.org/rfc/rfc2606

Klensin, J., “Simple Mail Transfer Protocol”, RFC 5321, IETF, October 2008. https://www.rfc-editor.org/rfc/rfc5321

DomainTools. “TLD Registration Count Statistics.” https://research.domaintools.com/statistics/tld-counts/

People:
    SpeakerBio:  Cøry “interpünkt” Solovewicz

Cory Solovewicz (aka interpünkt) is a security consultant specializing in web and mobile application testing. His path into security started early, experimenting with tools like Sub7 and learning how systems could be pushed beyond their intended use. After a career in full-stack development, he transitioned into security to focus on breaking and improving real-world systems. He brings a builder’s perspective to his work, shaped by years of coding, late nights in hackerspaces, and a curiosity for how things fail.

Creator: DEF CON Talks
Mobile banking apps stack multiple security layers: RASP (runtime protection), root/jailbreak detection, anti-instrumentation, biometric KYC with liveness detection, and AI-powered anti-deepfake. Each layer promises to stop attackers. We defeated all of them — in production apps used by millions.

We present a full kill chain against mobile banks and digital wallet apps from a Latin American country, demonstrating how an attacker with an Android phone and open-source tools can: (1) bypass RASP and root detection using kernel-level root solutions and publicly available modules, achieving 100% evasion of OS integrity and anti-hacking controls; (2) use Frida to dynamically instrument biometric SDKs, injecting controlled frames into the liveness capture flow by hooking the “best result” getter and replacing the YUV buffer; (3) bypass KYC identity verification by substituting selfie images and crafting coherent template+photo payloads that the backend accepts as legitimate; and (4) generate AI-synthetic faces from photos that pass liveness detection with 0% detection rate.

Every banking app we tested fell. The different RASPs and biometric SDKs are deployed in 30+ countries, protecting hundreds of millions of users. We’ll show why that should worry you. Video demos included.

1. KernelSU Project – https://kernelsu.org
2. Kitsune Magisk Fork – https://github.com/1q23lyc45/KitsuneMagisk/tree/kitsune
3. Frida Dynamic Instrumentation Toolkit – https://frida.re
4. JADX Decompiler – https://github.com/skylot/jadx
5. RootBeerSample Root Detection Tool – https://github.com/nickcaballero/RootBeerSample (reference implementation)
6. TMLP Team / GooseBt Studio – Root bypass module configurations (GitHub, publicly available)
7. ImNotADeveloper – Xposed module that hides developer mode and USB debugging status from app detection – https://github.com/auag0/ImNotADeveloper
8. Public KYC bypass repositories (referenced for threat landscape awareness):
   • https://github.com/kycbypass/Android-Phone-Bypass-KYC-verification—No-root-required
   • https://github.com/hxreborn/biometric-bypass
   • https://github.com/nocomp/deep-ofensive-ai

People:
    SpeakerBio:  Xavier “@xaferima” Riofrio Machado, Fintech Ecuador

Computer Science Engineer with an MSc in Cybersecurity, specialized in offensive security, vulnerability research, and adversarial analysis, with a strong focus on mobile (Android & iOS) security.

I identify systemic weaknesses through logical reasoning, abuse of flawed assumptions, and hands-on exploitation of complex workflows across mobile, web, and API-driven environments. My experience combines deep technical rigor with practical red teaming, allowing me to model realistic attack paths instead of theoretical risks.

I have worked in high-demand environments such as CERN and currently contribute to securing fintech and digital wallet ecosystems, where mobile platforms are critical attack surfaces. While offense-driven by design, I translate offensive findings into concrete defensive controls that actually withstand real-world attackers.

SpeakerBio:  Alex Tipan, Fintech Ecuador

Cybersecurity professional specialized in application security, with a focus on offensive analysis of mobile apps, bypassing RASP controls, and assessing facial biometric workflows. Since school, he has been self-taught in programming, hacking, Linux, networking, and cryptography, later strengthening his academic foundation through a degree in Computer Systems Engineering. He currently conducts hands-on research on protection evasion in financial applications, including advanced instrumentation techniques and validation of real-world risks in authentication processes. His work aims to translate complex technical findings into concrete defensive security improvements.

Creator: DEF CON Talks

Kannel is the most widely deployed open-source SMS and WAP gateway in the world. With over 1000+ internet-facing instances across 65 countries, powering two-factor authentication, mobile banking, emergency alerts, and carrier-grade messaging, it forms a silent but critical pillar of global telecommunications infrastructure. Despite handling billions of messages, Kannel has received only a single CVE in its entire history. We present the results of a comprehensive security audit of Kannel SMS Gateway spanning versions 1.4.4, 1.4.5, and 1.5.0. Our research uncovered multiple previously unknown vulnerabilities. Most critically, we introduce telecom-specific attack primitives that exploit the inherent trust model between gateway components, enabling silent message censorship, billing fraud through forged delivery receipts, and audit evasion through metadata manipulation. These go beyond traditional memory corruption to expose fundamental design weaknesses in how SMS infrastructure routes, delivers, and accounts for messages. This talk fundamentally challenges the assumption that legacy telecom software is secure through obscurity.

https://www.kannel.org/ https://github.com/kannel https://en.wikipedia.org/wiki/Short_Message_Peer-to-Peer https://www.kannel.org/doc.shtml https://gatewayapi.com/docs/apis/kannel/ https://docs.smsportal.com/docs/kannel https://github.com/playsms/book-playsms/blob/master/book-contents/en/Installation/Gateway-Installation/Kannel/Example-Kannel-configuration-with-SMPP.md https://en.wikipedia.org/wiki/SMS_gateway https://www.drupal.org/project/kannel https://smpp.org/ https://smpp.org/smpp-v5.html https://www.infobip.com/docs/essentials/api-essentials/smpp-specification

People:
    SpeakerBio:  Kyprianos “kavasilo” Vasilopoulos, Apifon

Kyprianos Vasilopoulos is a cybersecurity executive with 20+ years of experience in red teaming, incident response, penetration testing, and malware research. He is the CISO at Apifon and Co-Founder of OffensiveX. He has led cyber operations for major events like the Olympic Games and contributed to zero-day research at Trustwave SpiderLabs. Holding certifications such as OSCP and OSCE, he combines deep technical expertise with strategic leadership. His focus includes offensive security automation, red teaming, and threat-led penetration testing, and he has appeared on BBC News while being recognized in the Zyxel CVE Hall of Fame.

SpeakerBio:  Nikos “nickvourd” Vourdas, EY

Nikos Vourdas, also known as nickvourd or NCV, is a Senior Offensive Security Consultant based in the US. With over five years of professional experience, he has actively participated in various global Tiber-EU and iCAST Red Teaming engagements. Nikos has conducted full Red Teaming operations to major clients across retail, banking, shipping, construction industries. He holds OSCE3, OSCP, OSWP, CRTL, CRTO and OASP certifications. Also, he has previously presented at DEF CON, DevSecCon, and various BSides events around the world. Nikos loves contributing to open-source projects and always starts his day at 05:00 AM with a refreshing jog while listening to French rap music.

Creator: DEF CON Talks

Quantum cybersecurity isn’t just Q-Day. We took passive OS fingerprinting, the technique behind p0f and every modern ML-based fingerprinting tool, and mapped it onto a 20-qubit quantum circuit, replacing XGBoost as the classifier inside an “OsirisML”-style pipeline. Head-to-head on real packet captures from CIC-IDS 2017, the quantum version landed within 0.013 F1 of XGBoost on identical features, using roughly two orders of magnitude fewer trainable parameters. This is the first time a real DEF CON-relevant security workload has been mapped onto a quantum classifier with results that hold up against the classical tool the community already uses. The conversation about quantum and security has been stuck on cryptography. This talk is about everything else it can do.

M. Zalewski, “p0f v3,” [Online]. Available: https://lcamtuf.coredump.cx/p0f3/. [Accessed: Apr. 25, 2026].

J. Holland, P. Schmitt, N. Feamster, and P. Mittal, “New Directions in Automated Traffic Analysis,” in Proc. 2021 ACM SIGSAC Conf. on Computer and Communications Security (CCS), 2021, pp. 3366–3383, doi: 10.1145/3460120.3484758.

S. Ekeroth, J. Neale, and J. S. Kim, “Machine Learning Optimization for Enhanced OS Fingerprinting,” Virginia Tech, 2024.

I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, “Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization,” in Proc. 4th Int. Conf. on Information Systems Security and Privacy (ICISSP), 2018.

T. Chen and C. Guestrin, “XGBoost: A Scalable Tree Boosting System,” in Proc. 22nd ACM SIGKDD Int. Conf. on Knowledge Discovery and Data Mining, 2016, pp. 785–794, doi: 10.1145/2939672.2939785.

M. Benedetti, E. Lloyd, S. Sack, and M. Fiorentini, “Parameterized quantum circuits as machine learning models,” Quantum Sci. Technol., vol. 4, no. 4, p. 043001, 2019, doi: 10.1088/2058-9565/ab4eb5.

M. Schuld, A. Bocharov, K. M. Svore, and N. Wiebe, “Circuit-centric quantum classifiers,” Phys. Rev. A, vol. 101, no. 3, p. 032308, 2020, doi: 10.1103/PhysRevA.101.032308.

K. Mitarai, M. Negoro, M. Kitagawa, and K. Fujii, “Quantum circuit learning,” Phys. Rev. A, vol. 98, no. 3, p. 032309, 2018, doi: 10.1103/PhysRevA.98.032309.

M. Schuld, V. Bergholm, C. Gogolin, J. Izaac, and N. Killoran, “Evaluating analytic gradients on quantum hardware,” Phys. Rev. A, vol. 99, no. 3, p. 032331, 2019, doi: 10.1103/PhysRevA.99.032331.

T. Jones and J. Gacon, “Efficient calculation of gradients in classical simulations of variational quantum algorithms,” arXiv preprint arXiv:2009.02823, 2020.

H. Neven, V. S. Denchev, G. Rose, and W. G. Macready, “QBoost: Large scale classifier training with adiabatic quantum optimization,” in Proc. Asian Conf. on Machine Learning (ACML), vol. 25, 2012, pp. 333–348.

V. Havlicek, A. D. Corcoles, K. Temme, A. W. Harrow, A. Kandala, J. M. Chow, and J. M. Gambetta, “Supervised learning with quantum-enhanced feature spaces,” Nature, vol. 567, no. 7747, pp. 209–212, 2019, doi: 10.1038/s41586-019-0980-2.

M. Schuld and N. Killoran, “Quantum machine learning in feature Hilbert spaces,” Phys. Rev. Lett., vol. 122, no. 4, p. 040504, 2019, doi: 10.1103/PhysRevLett.122.040504.

H. Suryotrisongko and Y. Musashi, “Evaluating hybrid quantum-classical deep learning for cybersecurity botnet DGA detection,” Procedia Comput. Sci., vol. 197, pp. 223–229, 2022, doi: 10.1016/j.procs.2021.12.135.

E. D. Payares and J. C. Martinez-Santos, “Quantum machine learning for intrusion detection of distributed denial of service attacks: a comparative overview,” in Proc. SPIE 11699, Quantum Computing, Communication, and Simulation, 2021, p. 116990B, doi: 10.1117/12.2593297.

J. R. McClean, S. Boixo, V. N. Smelyanskiy, R. Babbush, and H. Neven, “Barren plateaus in quantum neural network training landscapes,” Nat. Commun., vol. 9, no. 1, p. 4812, 2018, doi: 10.1038/s41467-018-07090-4.

M. Cerezo, A. Sone, T. Volkoff, L. Cincio, and P. J. Coles, “Cost function dependent barren plateaus in shallow parametrized quantum circuits,” Nat. Commun., vol. 12, no. 1, p. 1791, 2021, doi: 10.1038/s41467-021-21728-w.

V. Bergholm et al., “PennyLane: Automatic differentiation of hybrid quantum-classical computations,” arXiv preprint arXiv:1811.04968, 2018.

E. Grant, L. Wossnig, M. Ostaszewski, and M. Benedetti, “An initialization strategy for addressing barren plateaus in parametrized quantum circuits,” Quantum, vol. 3, p. 214, 2019, doi: 10.22331/q-2019-12-09-214.

People:
    SpeakerBio:  Daniel Justice, Carnegie Mellon University
No BIO available
SpeakerBio:  Jae Sung Kim, Independent Researcher

Jae Sung Kim is an independent researcher specializing in network security and machine learning. His work focuses on applying novel computational approaches, including hybrid quantum-classical architectures, to classical security problems such as passive OS fingerprinting. He is a co-author of OsirisML, a machine learning pipeline for enhanced OS fingerprinting built on the nPrint packet representation framework.

SpeakerBio:  La Alsulaim, University of Pittsburgh

La Alsulaim is a Computer Science student at the University of Pittsburgh. His research interests include machine learning applications

SpeakerBio:  Shreya G Savadatti, Carnegie Mellon University

Shreya G Savadatti is a researcher specializing in quantum computing and cybersecurity. Currently a Master’s student at Carnegie Mellon University, she explores Quantum Reservoir Computing (QRC) and cross-platform hardware benchmarking. As an IBM Qiskit Advocate, she contributes to open-source compilers and recently placed Top 5 at MIT iQuHACK 2026 for quantum circuit optimization. Her published research includes work on Quantum Fully Homomorphic Encryption (QFHE).

Creator: DEF CON Talks

What happens when getting blocked by your WAF is exactly how the attacker gets in? We built two new remote exploit chains that hijack AI agents through Cloudflare and Sentry – two of the most trusted tools on the internet. No malware. No binary exploits. The attacker never touches the victim or their agent. Just text in public logs, waiting to be read. Chain 1: We send requests Cloudflare blocks with 403 – and that is the attack. Our payloads land in WAF logs. When a dev asks their agent to debug Cloudflare, injections activate via cloudflare queries. Using only Cloudflare’s own MCP tools, we hijack DNS and reroute customer traffic. Chain 2: We inject stacktraces into Sentry’s public API, no auth needed. Sentry’s “Seer” agent reads them, gets compromised, and its poisoned recommendations flow into a developer’s Cursor which executes our commands. One agent infecting another. First demo of agent-to-agent lateral movement and “Self-Exploiting Agent” technique. Then we go deeper: a zero-day in Claude bypasses its network sandbox for full data exfiltration. For persistence, we show how “agentic rootkits” work by memory injection and config poisoning, invisible to EDRs. est 15,000+ organizations exposed via Cloudflare MCP alone. 27% of them are Fortune 1000. Responsibly disclosed. We’re now showing everything.

*Cloudflare MCP Server documentation and public deployment *Sentry MCP Server and Seer AI agent documentation *Anthropic Claude Desktop application architecture *Cursor AI coding agent – MCP integration and tool architecture *OWASP Top 10 for LLM Applications (2025) *MITRE ATLAS – Adversarial Threat Landscape for AI Systems *Clinejection (Feb 2026) – GitHub issue title exploit compromising Cline’s release pipeline *Comment & Control (Apr 2026) – prompt injection via PR titles leaking secrets from Claude Code, Gemini CLI, and Copilot

People:
    SpeakerBio:  Barak Sternberg, Tenet Security

Barak Sternberg is a cybersecurity researcher, offensive security specialist, and a returning DEFCON speaker. His research career spans over 15 years across every major attack surface of the last decade: from IoT to browser extension exploits (DEFCON 29), to Kube infra attacks (with Nevo), to smart device hacking (DEFCON Safe Mode IoT Village). He’s presented at DEFCON (twice), Hacktivity, RootCon, BSides, Intent, and numerous other security conferences worldwide. He’s a Unit 8200 veteran and Israel Defense Prize recipient. His research has consistently focused on finding novel attack chains in emerging technology before attackers do, across years in offensive cybersecurity. He also co-founded Wild Pointer (offensive security, Fortune 500 clients) and more recently co-founded Tenet Security as CEO with Nevo: but the research came first, the company came from the research, not the other way around. He leads Tenet while staying hands-on – the exploit chains in this talk came directly from his team’s research

SpeakerBio:  Nevo Poran

Nevo Poran, cybersecurity researcher, Co-Founder & CTO of Tenet Security, and a top-tier security engineer focused on GenAI, API, and application security. Unit 8200 veteran and 2x Excellence Awards. Nevo co-founded Wild Pointer with Barak, serving as technical lead and later CEO, managing teams delivering offensive R&D to Cisco, Noname Security, and Fortune 500 clients. He then co-led Cisco’s first GenAI Security Research Team – building the AI Defense product from research through production. Deep hands-on expertise in reverse engineering, exploit development, and agent runtime security. Speaks on Kubernetes/cloud and GenAI security (CyberArk INTENT 2024, UNC Symposium 2025) and co-presented the Kubernetes etcd exploitation research with Barak. They’ve been breaking things together for years.

SpeakerBio:  Ron Bobrov, Tenet Security

Ron Bobrov is a senior security researcher at Tenet Security with 10 years of experience in offensive security, penetration testing, and vulnerability research. He has specialized in emerging attack vectors and has recently focused on AI agent security, conducting red-team assessments that have uncovered critical vulnerabilities in modern LLM-based systems. At Tenet Security, Ron leads research initiatives exploring the intersection of traditional security threats and AI-specific attack surfaces. His work on bypassing A2AS framework protections has revealed fundamental architectural gaps in current AI agent security approaches, contributing to the development of runtime protection methodologies for agentic systems. Ron’s research combines deep technical expertise in system exploitation with novel approaches to adversarial AI security, helping organizations understand and defend against the next generation of attacks targeting AI agents in production environments.

Creator: DEF CON Talks

Today network equipment vendors offer Zero-Touch Provisioning (ZTP) for configuring devices with little-to-no manual intervention. However, it is often taken for granted that that the networking protocols used in ZTP are secure.

Most vulnerability and threat intelligence reports on network equipment focus on individual “device takeover” vulnerabilities allowing for direct Remote Code Execution. Yet, there is little recent research examining the security of ZTP designs and implementations, where the exploitation impact may be on a much larger scale.

In this talk, we will present 17 vulnerabilities affecting TP-Link Omada – a device ecosystem designed with ZTP in mind. We will present the Omada protocols ZTP and discuss key vulnerabilities in them, including a chain of trust compromise due to the use of hard-coded cryptographic keys, sensitive information disclosure, and remote code execution against some devices.

We will present attacks against controllers and client devices that allow attackers to infiltrate networks by taking over Omada equipment. We will also show that some of the issues go way beyond one device family and affect other network equipment, security cameras, smart home devices, and mobile apps with millions of downloads.

People:
    SpeakerBio:  Francesco La Spina, Forescout Technologies

Francesco La Spina holds an MSc in Computer Science from the University of Trento, Italy. He began his career as a software engineer with a focus on IT/IoT security gateway development, honing his expertise in crafting robust security solutions for digital infrastructures. Having served as a security engineer for an ISP and financial institutions, he also gained invaluable experience in fortifying networks against potential threats. Currently, Francesco is engaged in cutting-edge security research and threat analysis within the realms of IT and IoT at Forescout Technologies – Vedere Labs.

SpeakerBio:  Stanislav Dashevskyi, Forescout Technologies

Stanislav Dashevskyi is a Security Researcher at Forescout. He received his PhD from the International Doctorate School in Information and Communication Technologies (ICT) at the University of Trento (Italy) in 2017. His main research interests are open source software, software security, and vulnerability analysis.