Talk/Event Schedule

Saturday

Saturday - 08:00 PDT

Saturday - 09:00 PDT

Saturday - 10:00 PDT

Saturday - 11:00 PDT

Saturday - 12:00 PDT

Saturday - 13:00 PDT

Saturday - 14:00 PDT

Saturday - 15:00 PDT

Saturday - 16:00 PDT

Saturday - 17:00 PDT

Saturday - 18:00 PDT

Saturday - 19:00 PDT

Saturday - 20:00 PDT

Saturday - 21:00 PDT

Saturday - 22:00 PDT

Saturday - 23:00 PDT

Talk/Event Descriptions

MIV - Saturday - 14:15-14:45 PDT

AIV - Saturday - 10:00-10:50 PDT

After this talk, you will get a taste of how AI Red Teams approach the problem, grasp what AI Red Teams do, how they interact with existing security paradigms like traditional red teaming as well as emerging areas like adversarial machine learning. You will be able to assess what it takes to be successful in this field, and how your can make an impact without a PhD in Adversarial Machine learning.

RCV - Saturday - 15:50-16:15 PDT

AIV - Saturday - 12:00-12:50 PDT

In our presentation, we describe this system in transparent detail, discussing the complexity of raw data, the limitations of current approaches, and how our system can integrate into existing infrastructure, even in the presence of unstructured data and a shifting landscape of security sensors. We’ll also show our system’s performance in the practical defense of a diverse population of organizations and go over in-the-trenches case studies illustrating our system’s strengths and weaknesses.

CLV - Saturday - 14:20-14:50 PDT

IAM is a complex system in which permission information is distributed among many sources and permission evaluation logic is complex. The tool can help both defensive and offensive security teams with this challenge.

For defenders. The need to facilitate access to teams annoyed or frustrated by access denied messages often breaks least-privilege and creates excessive permissions in the environment. AccessUndenied gives a minimal least-privilege policy suggestion and prevents this. Some users of the tool are even scaling their use by hooking AccessUndenied to a Lambda that automatically handles AccessDenied messages and sends them a slack notification with the tool's output.

For offensive teams. In AWS IAM, a Deny statement trumps any allow. Therefore even after privilege escalation to admin, certain actions can still be blocked. Offensive teams can use AccessUndenied to quickly and effectively track down these explicit deny statements to then circumvent or remove them.

Sometimes, the new and more detailed AccessDenied messages provided by AWS will be sufficient. However, this is not always the case.

Some AccessDenied messages do not provide details. Among the services with (many or exclusively) undetailed messages are: S3, SSO, EFS, EKS, GuardDuty, Batch, SQS, and many more.

When the reason for AccessDenied is an explicit deny, it can be difficult to track down and evaluate every relevant policy.

When the explicit deny is in a service control policy (SCP), one has to find every single policy in the organization that applies to the account.

When the problem is a missing allow statement, users still need to define a least-privilege policy.

Github: https://github.com/ermetic/access-undenied-aws

MIV - Saturday - 15:45-16:15 PDT

PLV - Saturday - 12:00-13:45 PDT

AVV - Saturday - 10:30-12:30 PDT

AVV - Saturday - 14:30-17:30 PDT

AVV - Saturday - 10:30-17:30 PDT

AIV - Saturday - 16:00-17:30 PDT

RTV - Saturday - 14:00-14:59 PDT

BHV - Saturday - 11:30-11:59 PDT

The use of implanted neuromodulation is increasing in both the medical and consumer space, yet the telemetric nature of these closed looped systems expose them to a range of vulnerabilities [2-4]. Unlike hacks on insulin pumps and pacemakers, there is currently no research on hacks of brain-computer interfaces [1, 5].

Interactions between hardware and neuroanatomy invoke a range of unexpected symptoms - for Isaac the DBS error induced intense emotions and motor disturbance. An understanding of these biotechnological syndromes requires expertise from computer scientists, engineers, biomedical experts and hackers who can expose system flaws. We bring this case to DEFCON to foster collaboration between the medical and hacking community, to improve the care of patients like Isaac, who present with medical emergencies resulting from technological failures.

*Psuedonym
"""

DC - Saturday - 12:00-12:45 PDT

He participated in Pwn2Own 2021 Vancouver & Austin and was a speaker at conferences HITCON.

In late 2021, Google increased the vulnerability reward program in kCTF infrastructure, which was built on top of Kubernetes and Google Container Optimized OS, with a minimum reward of $31,337 per submission.

In this talk, we will share about how we managed to have 4 successful submissions on kCTF VRP by exploiting four Linux kernel bugs to perform container escape on kCTF cluster, we will explain some interesting kernel exploit techniques and tricks that can be used to bypass the latest security mitigation in Linux kernel. We will also share what we did wrong that causes us to nearly lose 1 of the bounty.

As of writing, there are 14 successful entries to kCTF. In this presentation, we are willing to share our full, in-depth details on the research of kCTF.

To the best of our knowledge, this presentation will be the first to talk about a complete methodology to pwn kCTF (find and exploit bugs within 0-day and 1-day) in public.

DL - Saturday - 12:00-13:55 PDT

Audience: Researchers, reverse engineers, pentesters, bug bounty hunters

ASV - Saturday - 10:00-16:59 PDT

Required gear: Laptop and connection required to access the jam environment, set up DEF CON WiFi in advance!

DC - Saturday - 12:30-13:15 PDT

Jimmy has worked for various DoD contractors, leveraging a variety of skills against national level adversaries, including network analysis, dead disk and memory forensics, and software development for detection and analysis of malware. After leaving the DoD contracting world, he joined Focal Point Academy, where he developed and taught malware analysis courses to civilian and military professionals across the country. In his off-time, Jimmy enjoys learning about operating systems internals, playing pool, cheap beer, and good whiskey.

This presentation will summarize the malware, and detail the difficulties encountered during the reverse engineering and analysis of the malware to include acquiring equipment and setting up our lab. This talk will also release the latest results from Drago's lab including an assessment of the breadth of impact of PIPEDREAM's CODESYS modules on equipment beyond Schneider Electric's PLCs, testing Omron servo manipulation, as well as OPC-UA server manipulation. While a background in ICS is helpful to understand this talk, it is not required. The audience will learn about what challenges they can expect to encounter when testing ICS malware and how to overcome them.

RFV - Saturday - 13:00-13:59 PDT

SOC - Saturday - 21:00-23:59 PDT

This epic party is hosted by the Military Cyber Professionals Association (a tech ed charity) and friends.

More info: ArcadeParty.org (open to all DEF CON attendees)

AVV - Saturday - 15:15-17:15 PDT

We will supply individual labs using the VMware Learning Platform. The lab environment will include an attack system and a target Windows system. Please bring a laptop with internet access so that you can connect to the cloud-hosted VMware lab environment.

Attendees will be able to follow the self-paced guide to set up emulations, create payloads, and gain execution for assumed breach payloads. From there, various adversary behaviors will be walked through to meet adversary objectives. From the defensive side, the guide will walk the attendee through setting up data sources for detection using free tools and cover common detection types.

RCV - Saturday - 10:00-10:50 PDT

WS - Saturday - 14:00-17:59 PDT

In this workshop you will build your own programmable Windows debugger from scratch (using Python). Each component in the debugger will be built as a separate module with an accompanying lab used to explain the concepts and Windows internals that support the component. In the final lab you will have the chance to test your new debugger against various malware samples and attempt to automatically unpack them, and extract IOCs.

This workshop is aimed at malware analysts and reverse engineers who are interested in learning more about debuggers and how programmable debuggers can be used to automate some reverse engineering workflows. Students must be able to write basic Python scripts, and have a working knowledge of the Windows OS.

You will be provided with a VirtualMachine to use during the workshop. Please make sure to bring a laptop that meets the following requirements. - Your laptop must have VirtualBox or VMWare installed and working prior to the start of the course. - Your laptop must have at least 60GB of disk space free. - Your laptop must also be able to mount USB storage devices. (Make sure you have the appropriate dongle if you need one.)

Materials

Students will be provided with a VirtualMachine to use during the workshop. They will need to bring a laptop that meets the following requirements; - The laptop must have VirtualBox or VMWare installed and working prior to class. - The laptop must have at least 60GB of disk space free. - The laptop must be able to mount USB storage devices (ensure you have the appropriate dongle if you need one).

Prereq

Students must be able to write basic Python scripts and have a basic understanding of the Windows operating system. Familiarity with a Windows user space debugger like x64dbg would also be a benefit.

DC - Saturday - 15:30-15:50 PDT

He researches security issues in not only in-vehicle systems, but also V2G and V2X systems. Jonghyuk received his Ph.D. in Computer Science and Engineering at POSTECH, South Korea in 2015. He has worked in Samsung Research as an offensive security researcher, where his work included finding security issues in smartphones, smart home appliances and network routers.

He is mainly working on fuzzing test and issue analysis on the in-vehicle networks, such as CAN/CAN-FD, UDSonCAN and Automotive Ethernet.

Also, he has designed the requirements of automotive security test solutions.

This talk describes how to do fuzzing on the SOME/IP services step by step. First, we demonstrate how to buy an ECU, how to power and wire it. Second, we explain network configurations to communicate between ECU and PC. Third, we describe how to find out the information required to perform SOME/IP fuzzing and how to implement SOME/IP Fuzzer. We have conducted the fuzzing with the BMW ECUs purchased by official BMW sales channels, not used products.

We hope this talk will make more people to try car hacking and will not go through the trials and errors that we have experienced.

DCGVR - Saturday - 15:00-15:59 PDT

RFV - Saturday - 14:00-14:30 PDT

GHV - Saturday - 11:30-11:59 PDT

DC - Saturday - 17:30-18:15 PDT

This talk will discuss and demonstrate how even in the absence of information about a given card, there are a series of ways to enumerate the contents and capabilities of a card, find exposed information, fuzz for input handling flaws, and exploit poor authentication and access control.

SOC - Saturday - 19:30-00:59 PDT

ASV - Saturday - 10:00-15:59 PDT

In order to get participants familiar with ARINC 429 concepts, there will be a presentation introducing 429 and the challenge environment at 10:30 and 13:00 both days.

Event #1 – Airplane Challenge (“AC”): during this event the user is presented with a user interface to send their own crafted 429 messages. The participant will be assigned an airplane on a map with the objectives of navigating the airplane to a win condition.

Event #2 – Capture The Flag (CTF): The participants will connect into the CTF to take on challenges involving protocol and message manipulation. The participant will be able to validate each flag found in order to complete the event!

Required gear: for the AC, you will need a mobile phone and/or Laptop with ability to connect to WiFi. For the CTF you will need a laptop and ethernet cable

Signups: first come first serve!

PHV - Saturday - 10:00-17:59 PDT

DC - Saturday - 10:00-11:15 PDT

BHV - Saturday - 12:00-12:30 PDT

CLV - Saturday - 13:10-13:40 PDT

Because cloud and on-premise infrastructures are not alike, security analysts require a different skillset when assessing cloud infrastructure. There are multiple courses and exams that can be taken to learn how to work with and audit cloud environments. All these courses teach a global understanding of cloud security, but do not go in-depth due to all services having a different portal and setup. With this tool we will create security hacking training for the rapidly developing Azure space.

With this tool we will create security hacking training for the rapidly developing Azure space. We aim to breach the gap between theory and practice in a real secured Azure cloud environment. The software allows everyone that is trying to get into the field of cloud security to train their skills in the Azure space, with a Capture-the-Flag requiring multiple vulnerabilities that need to be exploited. All challenges are hosted online for free for anyone that wants to use the software. The challenges are beginner-friendly. The broken features are explained to give insight into why they exist and how they can be prevented. If the user is not able to figure out how to complete the challenge, additional hints (and eventually the answer) can be requested. The environment is built using the Infrastructure-As-Code language Terraform, which will all be open-source to allow other developers and security professionals to add new challenges and make the tool even better.

DCGVR - Saturday - 10:00-10:59 PDT

ASV - Saturday - 10:00-10:25 PDT

His team consecutively won first place at DEF CON 23, 24, and 25's Wireless CTF, snagging a black badge along the way. Forcibly retired from competing in the Wireless CTF, he now helps create challenges!

IOTV - Saturday - 10:00-13:59 PDT

PSV - Saturday - 10:30-10:59 PDT

PSV - Saturday - 11:00-11:30 PDT

BHV - Saturday - 16:00-16:30 PDT

CON - Saturday - 13:30-17:59 PDT

Last round kicks off at 16:00

CON - Saturday - 10:30-11:59 PDT

Last round for Friday kicks off at 16:00.

CPV - Saturday - 15:30-16:15 PDT

CON - Saturday - 10:00-17:30 PDT

DCGVR - Saturday - 12:30-12:59 PDT

Attendees of this talk need not have any prior knowledge of Google Colab but should have a basic understanding of getting shells. I will demonstrate backdooring a victim's Colab account and exfiltrating data using tools such as Ngrok. You will leave this talk with an understanding of a whole new attack vector and a desire to research more ways Colab might be abused.

AIV - Saturday - 13:00-13:50 PDT

BTV - Saturday - 15:00-15:59 PDT

Testing security controls is hard. Really hard. Every incident responder has lived with victims who are sure existing security controls should have prevented or detected the intrusion. While some organizations don’t do any security control validation, those that do understand the challenges. While red team operations allow for point-in-time validation, how are organizations dealing with control validations during product updates or configuration changes? By and large the answer is “they aren’t.” On this panel, we’ll discuss why control validation is difficult. Then we’ll discuss recommendations for scaling control validation operations in practically any organization.

SOC - Saturday - 09:00-17:59 PDT

All chillout lounges are planned to be open 09:00 - 18:00 for chillout purposes. Each may be open at other times for parties, meetups, etc.

Entertainment schedule:

09:00 to 12:00 - Pie & Darren
12:00 to 13:30 - Kampf
13:30 to 14:30 - s1gnsofl1fe
14:30 to 15:30 - Merin MC
15:30 to 16:30 - Rusty
16:30 to 18:00 - djdead

SOC - Saturday - 09:00-17:59 PDT

All chillout lounges are planned to be open 09:00 - 18:00 for chillout purposes. Each may be open at other times for parties, meetups, etc.

Entertainment schedule:

09:00 to 12:00 - Pie & Darren
12:00 to 13:30 - Kampf
13:30 to 14:30 - s1gnsofl1fe
14:30 to 15:30 - Merin MC
15:30 to 16:30 - Rusty
16:30 to 18:00 - djdead

SOC - Saturday - 09:00-17:59 PDT

All chillout lounges are planned to be open 09:00 - 18:00 for chillout purposes. Each may be open at other times for parties, meetups, etc.

Entertainment schedule:

09:00 to 12:00 - Pie & Darren
12:00 to 13:30 - Kampf
13:30 to 14:30 - s1gnsofl1fe
14:30 to 15:30 - Merin MC
15:30 to 16:30 - Rusty
16:30 to 18:00 - djdead

SOC - Saturday - 09:00-17:59 PDT

All chillout lounges are planned to be open 09:00 - 18:00 for chillout purposes. Each may be open at other times for parties, meetups, etc.

Entertainment schedule:

09:00 to 12:00 - Pie & Darren
12:00 to 13:30 - Kampf
13:30 to 14:30 - s1gnsofl1fe
14:30 to 15:30 - Merin MC
15:30 to 16:30 - Rusty
16:30 to 18:00 - djdead

DC - Saturday - 13:00-13:45 PDT

ICSV - Saturday - 10:00-17:59 PDT

** Swing by the ICS Village to reserve a time for your team. **

Escape Room Scenario: A disgruntled employee, Bob, has been plotting to bring down the company where he works. In retaliation for his perceived mistreatment, Bob has created an electromagnetic pulse device (EMP) to take out sensitive industrial control systems in the area. Thanks to a few diligent and observant company employees, Bob was taken into custody but not before the timer on the device could be activated! The EMP device has been armed and the clock is ticking. CISA needs your help in protecting our critical infrastructure by following the clues found in Bob’s office to help CISA to disarm the EMP device before it is too late.

MIV - Saturday - 12:30-13:15 PDT

SEV - Saturday - 12:00-12:59 PDT

PLV - Saturday - 14:00-15:45 PDT

The United States needs a new strategy that responds to what is now a fragmented and dangerous internet. The Council on Foreign Relations launched an independent task force to develop findings and recommendations for a new foreign policy for cyberspace. This session will seek input from the DEF CON community on specific foreign policy measures, to help guide Washington’s adaptation to today’s more complex, variegated, and dangerous cyber realm.

Come prepared to discuss topics, such as: Developing a digital privacy policy that is interoperable with Europe’s General Data Protection Regulation (GDPR); Building a coalition for open-source software; Developing coalition-wide practices for the Vulnerabilities Equities Process (VEP); Clean up U.S. cyberspace by offering incentives for internet service providers (ISPs) and cloud providers to reduce malicious activity within their infrastructure.

RTV - Saturday - 10:00-10:59 PDT

RTV - Saturday - 11:00-11:59 PDT

RTV - Saturday - 12:00-12:59 PDT

DL - Saturday - 14:00-15:55 PDT

Audience: Intelligence analysts, SOC/blue team/defenders, red team/adversary emulation, GRC analysts

AVV - Saturday - 12:00-12:30 PDT

CON - Saturday - 17:00-19:59 PDT

Teams are given programming challenges and have to solve them with code. If your code fails to compile? Take a drink. Segfault? Take a drink. Did your code fail to produce the correct answer when you ran it? Take a drink. We set you against the clock and the other teams. And because our ""Team Distraction"" think watching people simply code is boring, they have taken it upon themselves to be creative in hindering you from programming, much to the enjoyment of the audience. At the end of the night, one team will have proven their ability, and walk away with the coveted Crash and Compile trophy.

Crash and Compile is looking for the top programmers to test their skills in our contest. Can you complete our challenges? Can you do so with style that sets your team ahead of the others? To play our game you must first complete our qualifying round. Gather your team and see if you have the coding chops to secure your place as one of the top teams to move on to the main contest.

Qualifications for Crash and Compile will take place Friday from 10am to 3pm on-site and online at https://crashandcompile.org.

You may have up to two people per team. (Having two people on a team is highly suggested)

Of the qualifiers, nine teams will move on to compete head to head on the contest stage.

CON - Saturday - 16:00-16:59 PDT

What happens when you take an ACM style programming contest, smash it head long into a drinking game, throw in a mix of our most distracting helpers, then shove the resulting chaos incarnate onto a stage? You get the contest known as Crash and Compile.

Teams are given programming challenges and have to solve them with code. If your code fails to compile? Take a drink. Segfault? Take a drink. Did your code fail to produce the correct answer when you ran it? Take a drink. We set you against the clock and the other teams. And because our ""Team Distraction"" think watching people simply code is boring, they have taken it upon themselves to be creative in hindering you from programming, much to the enjoyment of the audience. At the end of the night, one team will have proven their ability, and walk away with the coveted Crash and Compile trophy.

Crash and Compile is looking for the top programmers to test their skills in our contest. Can you complete our challenges? Can you do so with style that sets your team ahead of the others? To play our game you must first complete our qualifying round. Gather your team and see if you have the coding chops to secure your place as one of the top teams to move on to the main contest.

Qualifications for Crash and Compile will take place Friday from 10am to 3pm on-site and online at https://crashandcompile.org.

You may have up to two people per team. (Having two people on a team is highly suggested)

Of the qualifiers, nine teams will move on to compete head to head on the contest stage.

CON - Saturday - 18:00-18:59 PDT

WS - Saturday - 14:00-17:59 PDT

In this workshop, you will get hands-on with containers and kubernetes, - starting with introductory content - learning how they work, where and how to hide or find things, how to identify indicators of compromise, indicators of attack, and how to apply analysis to gain a deeper understanding of container malware and what is going on inside containers.

This workshop will utilize the Google Cloud Platform alongside command line operands and a small amount of open source tooling to learn both offensive and defense techniques on containers. By the end, you’ll have a solid mental model of how containers work, how they are managed and deployed, and be equipped with the ability to analyze container images, identify problems, and identify familiar patterns. Ultimately, these skills will allow you to generate valuable insights for your organization’s defense or aid you in your next attack.

This is a fast-paced course designed to take you deep into the world of containers, making tooling like Kubernetes much more intuitive and easy to understand. Labs will be used to reinforce your learnings, and the course comes with very detailed notes and instructions for setup which you can repeat on your own time. This course will provide references to scripts that make certain tasks easier, but we will be challenging you to learn the process and reasoning behind them rather than relying on automation.

Attendees will be provided with all the lab material used in the course in digital format, including labs, guides and virtual machine setup.

Materials

A Google Cloud free tier account (basically a fresh gmail account), and an internet connected computer. We hope to send out instructions to attendees prior to the class, so they can be ready on the day.

Prereq

None, the class is well designed to allow those with little to no linux, kubernetes or cloud familiarity to follow along, but a basic familiarity with Linux and terminal will allow attendees to focus on the work.

DC - Saturday - 17:30-18:15 PDT

This talk will span python binary RE, header smuggling, configuration injection, docker networking and questionable RFC interpretation. We hope to show you a little bit of what worked and a lot a bit of what didn't work on our quest to exploit this heisenbug.

CPV - Saturday - 13:00-13:45 PDT

We’ve created an open source clone of Wordle called Cryptle, with the goal of demonstrating data encryption in use, where the processing of the data is done in a Trusted Execution Environment (TEE), and only accessible to the Cryptle application.

Cryptle is similar to Wordle but one important difference is that it is multi-party and the secret words are suggested by the players themselves. Each player proposes words that are most likely to match those sent by others. The words are sent to the Cryptle application deployed and running in an Enarx Keep (a specific TEE instance) and are only revealed to the players when there’s a match between the secret words.

The standard way to engage with the game is for players to guess the secret words by playing Cryptle from the client side. However, we will also be allowing an alternative: players may write an open source application which runs with root privileges on the host side and attempts to derive or otherwise guess the secret words. Since Cryptle makes use of Confidential Computing, players shouldn't be able to read what's in memory, even with root access.

We'll provide an overview of an exploit of Enarx and we'll explain how we were able to fix it. Attendees will be invited to find new vulnerabilities as part of the Cryptle Hack Challenge.

BICV - Saturday - 11:00-11:45 PDT

WS - Saturday - 09:00-12:59 PDT

This workshop will start with an overview of the CTF landscape, why we do them, and what value they have in the scope of the hacking community. This workshop will include various resources, a couple walkthroughs to show how to approach CTFs, and how it may differ from "real world" hacking challenges. Next, a short CTF will be hosted to give attendees hands-on experience solving challenges while being able to ask for help to successfully navigate the challenges. By the end of the workshop, the group will have worked through various types of CTF challenges, and have the confidence to participate in other CTFs hosted throughout the year.

Areas of focus will include:
* Common platforms and formats
* Overview of online resources
* Common tools used in CTFs and hacking challenges * Basics of web challenges
* Basics of binary exploitation and reversing challenges * Basics of cryptographic challenges
* Basics of forensic and network traffic challenges * Some ways of preparing for your next CTF / Hacking challenge

Materials

Laptop Debian-based Virtual Machine (e.g., Kali) is recommended, and USB install drives will be available Virtualized environment or Kali is not required but Kali will provide all the tools useful in solving the challenges and help standardize available tools. All challenge solutions will be possible using default Kali installations.

Prereq

Be curious about CTFs and have a very basic knowledge of or exposure to fundamental topics (e.g., Linux, websites, networking, data encoding and encryption) Exposure to the above concepts will help during the workshop defined CTF challenges but is not required for the workshop

ICSV - Saturday - 13:30-13:59 PDT

RTV - Saturday - 10:00-10:59 PDT

RTV - Saturday - 11:00-11:59 PDT

RTV - Saturday - 13:00-13:59 PDT

RTV - Saturday - 16:00-16:59 PDT

ASV - Saturday - 11:00-11:50 PDT

PLV - Saturday - 19:00-21:59 PDT

Let’s face it- the last couple of years have been doom and gloom, and while attacks on hospitals continue to increase at record pace, and the promise of new medical technologies is equally matched with some terrifying security implications (Neuralink, call us), we really do need to stand back and appreciate where we’ve come from, because only then can we put into perspective what we still need to do.

D0 No H4rm returns to DEF CON to once again give you the chance to interface directly with some of the biggest names in a domain that just keeps growing in importance. Moderated by physician hackers quaddi and r3plicant, this perennially packed event - with a heavily curated panel of policy badasses, elite hackers, and seasoned clinicians - always fills up fast. So if you want to protect patients, build a safer and more resilient healthcare system, and meet some incredible new friends, then join us. And welcome home.

DC - Saturday - 15:00-15:20 PDT

Having worked at NASA and the NSA, as well as presenting at countless security conferences, he is intimately familiar with aliens, spies, and talking nerdy.

Patrick is passionate about all things related to macOS security and thus spends his days finding Apple 0days, analyzing macOS malware, and writing free open-source security tools to protect Mac users.

In this talk, we discuss what appears to be a systemic issue impacting our cyber-security community: the theft and unauthorized use of algorithms by corporate entities. Entities who themselves may be part of the community.

First, we’ll present a variety of search techniques that can automatically point to unauthorized code in commercial products. Then we’ll show how reverse-engineering and binary comparison techniques can confirm such findings.

Next, we will apply these approaches in a real-world case study. Specifically, we’ll focus on a popular tool from a non-profit organization that was reverse-engineered by multiple entities such that its core algorithm could be recovered and used (unauthorized), in multiple commercial products.

The talk will end with actionable takeaways and recommendations, as who knows, this may happen to you too! For one, we'll present strategic approaches (and the challenges) of confronting culpable commercial entities (and their legal teams). Moreover, we’ll provide recommendations for corporations to ensure this doesn’t happen in the first place, thus ensuring that our community can remain cohesively focused on its mutual goals.

SKY - Saturday - 16:00-16:50 PDT

This talk will go over the hardware and software combination approach we used to combat a notorious DRM scheme and preserve a series of arcade games. The protection is employed in commercial and consumer environments and this trick has been used to preserve not only these, but many other digital games from extinction.

CON - Saturday - 10:00-19:59 PDT

CON - Saturday - 10:00-19:59 PDT

Friday: 10:00-20:00
Saturday: 10:00-20:00

DCGVR - Saturday - 09:00-09:59 PDT

ICSV - Saturday - 10:00-17:59 PDT

In this lab, you’ll learn the basics of microgrid design – from what they are, how they work, and how they regulate themselves. Then, you’ll be able to use this knowledge to then attempt to take over and shut down a mock microgrid by hacking its weather data system and sensor input network to generate chaos.

(first-come-first-seated kind of event, essentially when a seat is free you are allowed to join)

DDV - Saturday - 10:00-16:59 PDT

QTV - Saturday - 15:00-15:59 PDT

BICV - Saturday - 12:00-12:30 PDT

CON - Saturday - 15:00-15:30 PDT

Chess, computers, and hacking go way back. In the 18th century, the Mechanical Turk appeared to play a good game, but there was a human ghost hiding in the shell. Some of the first computer software was written to play chess. In 1997, world champion Garry Kasparov lost to the program Deep Blue, but after the match he accused IBM of cheating, alleging that only a rival grandmaster could have made certain moves.

At DEF CON 30, we propose to host a human chess tournament. The games will have a “blitz” time control of 5 minutes on each player’s clock, for a maximum total game time of 10 minutes. The tournament will have a Swiss-system format, with a fixed number of rounds. The match pairing for each round is done after the previous round has ended, and depends on its results. Each player is paired with another player who has a similar running score.

To determine the winner, the Swiss system is considered highly effective, even when there is a large number of competitors and a small number of rounds. Every player gets to play the full tournament, and the winner has the highest aggregate score when all rounds are over.

We’ll also have a top computer chess program on hand. There will be prizes for the winners of the tournament, as well as anyone who can beat the machine.

The tournament mechanics will be managed by the Las Vegas Chess Center (LVCC), which has over five years of experience in organizing royal game tournaments for all strength levels and ages. LVCC has professional coaches, and grandmasters are frequent visitors.

Does your contest or event plan to have a pre-qualifier?

To help crown the best chess player at DEF CON 30, we will register the highest-rated players first. We did this at DEF CON 26. In the end, everyone who wanted to play was able to play.

CON - Saturday - 15:30-17:30 PDT

At DEF CON 30, we propose to host a human chess tournament. The games will have a “blitz” time control of 5 minutes on each player’s clock, for a maximum total game time of 10 minutes. The tournament will have a Swiss-system format, with a fixed number of rounds. The match pairing for each round is done after the previous round has ended, and depends on its results. Each player is paired with another player who has a similar running score.

To determine the winner, the Swiss system is considered highly effective, even when there is a large number of competitors and a small number of rounds. Every player gets to play the full tournament, and the winner has the highest aggregate score when all rounds are over.

We’ll also have a top computer chess program on hand. There will be prizes for the winners of the tournament, as well as anyone who can beat the machine.

The tournament mechanics will be managed by the Las Vegas Chess Center (LVCC), which has over five years of experience in organizing royal game tournaments for all strength levels and ages. LVCC has professional coaches, and grandmasters are frequent visitors.

Does your contest or event plan to have a pre-qualifier?

To help crown the best chess player at DEF CON 30, we will register the highest-rated players first. We did this at DEF CON 26. In the end, everyone who wanted to play was able to play.

CON - Saturday - 10:00-17:59 PDT

As part of our challenge we will present contestants with the exact same design and compare the outputs they produce against a number of categories in order to identify a winner and crown DEF CON’s Next Top Threat Model(er).

RFV - Saturday - 10:00-17:59 PDT

DC - Saturday - 16:30-17:15 PDT

We have identified a major vulnerability in this technology, and have developed a number of techniques to unlock these locks using a key made from a solid piece of material, which defeats all of the benefits of an interactive key. I’ll demonstrate how it can be applied to Mul-T-Lock Interactive, Mul-T-Lock MT5+ and the Medeco M4, allowing keys to be duplicated by casting, 3D printing and more. I’ll also cover other techniques to defeat moving elements in a key, such as printing a compliant mechanism and printing a captive element directly. With this talk, we’re also releasing a web application for anyone to generate 3D printable files based on this exploit. Finally, I’ll also discuss the responsible disclosure process, and working with the lock manufacturers to patch the vulnerability and mitigate the risk.

PT - Tuesday - 09:00-16:59 PDT

Training description:

This training focuses on elevating your threat detection, investigations, and response knowledge into the cloud. This hands-on training simulates real-life attack scenarios on cloud infrastructure & applications. It then teaches you to build your own defensive tools against such attacks by using cloud native services on AWS. This makes it an ideal class for red & blue teams.

PT - Monday - 09:00-16:59 PDT

Training description:

This training focuses on elevating your threat detection, investigations, and response knowledge into the cloud. This hands-on training simulates real-life attack scenarios on cloud infrastructure & applications. It then teaches you to build your own defensive tools against such attacks by using cloud native services on AWS. This makes it an ideal class for red & blue teams.

DL - Saturday - 12:00-13:55 PDT

Audience: Target Audience: Network Defense and Attack, 5G, Software Defined Radio and Infrastructure-as-Code.

SOC - Saturday - 17:00-18:59 PDT

ICSV - Saturday - 11:00-11:30 PDT

WS - Saturday - 09:00-12:59 PDT

Reverse Network Tunneling, i.e. UDP Hole Punching, is a powerful technique that makes it possible for computers with internal IP addresses that are inaccessible on the Internet to be able to connect to each other directly, and therefore become accessible. As crazy as this sounds, it's real and works. This has multiple applications in the real world, such as allowing a pentester to directly connect to a victim that is hidden behind a router. Network tunneling also invalidates the need of centralized services provided by companies that log, surveil and profit from our traffic. Imagine how the future of secure communications would change if all of our online interactions were off-the-grid?

This workshop shows you how to punch holes through external routers to allow computers that were once hidden from the Internet to connect to each other P2P. If you've ever wanted to tunnel into private networks and access internal computers, then this workshop is for you. Create a botnet, backdoor, or even the next great privacy app - the sky's the limit! This is a beginner-level, technical workshop and requires that attendees have some prior experience in at least one programming language, such as Python, JavaScript or C++. Bring your laptop and a strong appetite for pwning network devices.

Materials

Laptop with Windows, Linux, or OSX. USB flash drive for copying program materials (optional).

Prereq

Previous experience in at least one programming language is required. Previous experience with Python or C/C++ is recommended, but not required.

DC - Saturday - 14:30-14:50 PDT

Mobile payment signatures are carried out in the Trusted Execution Environment (TEE) that remains secure on compromised devices. The attacker needs to hack the TEE in order to hack the payment. There is a lot of good research about mobile TEEs in the public domain, but no one pays attention to trusted apps written by device vendors like Xiaomi and not by chip makers, while the core of mobile payments is implemented there. In our research, we reviewed Xiaomi's TEE for security issues in order to find a way to scam WeChat Pay.

VMV - Saturday - 16:00-16:30 PDT

Dozens of machines were on display for DefCon participants to ‘hack’ and find vulnerabilities. As I had my digital forensic toolkit with me, I asked Harri if the Windows CE and Windows XP devices had been professionally imaged and analyzed. Within minutes, I was presented with a pristine Windows CE machine. I imaged the device with BlackBag’s MacQuisition and began triage analysis with BlackBag’s BlackLight system.

The system was used for local, state, and national elections, initially purchased by Fairfax County, Virginia and placed into service, October 2002. The machine was last used in November 2014. I met with Harri at DefCon 2018 and performed the same tasks for thirty seven additional voting machines. The systematic lack of security was found on every single device nationwide. The same pattern was repeated at DefCon 2019.

I will discuss the professional methods we use to image devices at the Voting Village prior to the general public accessing the machines and the two-person finding verification method in use as well as the best practice of multiple tools. (Imaged with write-blocking hardware, analyzed with BlackLight and Autopsy, with a deleted file recovery tool afterwards.) I will discuss the findings we have discovered in the voting village: The operating system had not been updated since purchase. Votes were compiled into cleartext (votes.txt) onto a removable media drive and in some instances, uploaded to a ftp server, unencrypted.

Hundreds of USB drives had been inserted into the machines since deployment. Voters access the machines as ‘administrator’ with all votes being cast on the admin account. Admin and security user names and passwords are found online due to the relevant state sunshine laws. I will present our findings as to what was absent from the machines:

No firewall or antivirus programs are present No audit trail for USB drives or voting record integrity was found No voter information was found
No evidence of tampering has been found.

DC - Saturday - 18:30-18:50 PDT

DC - Saturday - 13:30-14:15 PDT

Jacob has been active in the Security field for well over a decade. He’s held positions as a developer, reverse engineer, and vulnerability researcher. As a vulnerability researcher, Jacob has had the good fortune to publish and present his research which varies from embedded system exploitation, web application attacks, and Windows vulnerabilities.

In this talk, new vulnerabilities affecting the Cisco ASA will be presented. We’ll exploit the firewall, the system’s administrators, and the ASA-X FirePOWER module. The result of which should call into question the firewall’s trustworthiness.

The talk will focus on the practical exploitation of the ASA using these new vulnerabilities. To that end, new tooling and Metasploit modules will be presented. For IT protectors, mitigation and potential indicators of compromise will also be explored.

DC - Saturday - 14:30-15:15 PDT

Finding exploits on z/OS is no different than any other platform. This talk will walk through how you too can become a mainframe exploit researcher!

Remote code execution is extra tricky on a mainframe as almost all sockets read data with the ASCII character set and convert that to EBCDIC for the application. With this talk you will find out how to find and then remotely overflow a vulnerable mainframe C program and create a ASCII -> EBCDIC shellcode to escalate your privileges remotely, without auth. Previous mainframe talks focused on infrastructure based attacks. This talk builds on those but adds a class of vulnerabilities, opening up the mainframe hacking community.

VMV - Saturday - 10:00-10:30 PDT

AVV - Saturday - 14:45-15:15 PDT

LPV - Saturday - 12:00-13:59 PDT

AVV - Saturday - 10:00-10:45 PDT

IOTV - Saturday - 10:00-17:59 PDT

DL - Saturday - 10:00-11:55 PDT

Audience: Offense, Defense, Windows, EDR

VMV - Saturday - 14:00-14:59 PDT

PSV - Saturday - 15:30-15:59 PDT

DL - Saturday - 10:00-11:55 PDT

Audience: Offense

RHV - Saturday - 11:00-11:59 PDT

WS - Saturday - 14:00-17:59 PDT

In this workshop, we will:

i.            Understand the use and employment of obfuscation in red teaming.
ii.           Demonstrate the concept of least obfuscation.
iii.          Introduce Microsoft's Antimalware Scan Interface (AMSI) and explain its importance.
iv.          Demonstrate obfuscation methodology for .NET payloads.

Materials

Laptop VMWare or Virtual Box Windows Dev machine or other Windows VM Kali Linux VM

Prereq

Basic level of PowerShell or C# experience.

BTV - Saturday - 12:15-12:45 PDT

1. What is Threat Modelling?
2. Why is Threat Modeling necessary? 3.Common Threat Modelling Frameworks:

   All the mentioned frameworks will be explained in detail with actionable scenarios and how to measure violations and propose mitigations

   STRIDE PASTA VAST TRIKE

3. How to plan Threat Modelling?
4. What NOT to do when doing threat modelling?
5. How to handle the results of threat modelling to not make it overwhelming to different stakeholders?

For eg:
In STRIDE, I'll give an overview and then walkthrough real life scenarios how

1. Explanantion of the framwork
2. Example: 2.1. Spoofing Identity refers to violation of authentication

   Can be potrayed by misconfigured VPN configurations (in detail) 2.2 Tampering with data refers to Integrity

   Having mutable logs and super admin having toxic right to change them (in detail) 2.3 Non Repudiation

   Multiple users using same set of credentials causing non-repudiation and making logs useless because actions can't be backtracked to the user performing it (in details) etc

I will give examples from actual threat modellings I have done but remove all the organisation related information and make them generic, then what scenarios look like in organisations.

The talk will mainly focus on different frameworks of Threat Modelling and how threat modelling can be more efficient. Learning from the past experiences and common mistakes which organizations make while doing threat modelling.

MIV - Saturday - 13:15-14:15 PDT

Platforms have understandably been focused on COVID-19 misinformation. However, they continue to fall short on other types of health misinformation, particularly content that most negatively impacts people with marginalized gender identities.

Research shows that the vast majority of women, trans people, and nonbinary people seeking information about health turn to the internet. This makes sense given that these demographics are the most marginalized in our healthcare systems. Unfortunately, research also shows that a significant amount of the online content about the health of women, trans people, and nonbinary people is low quality and that most people are not likely to question the validity of posts. As a result, misinformation is dangerously impacting health outcomes.

Through a set of three case studies I delve into 1) the pervasiveness of gendered health misinformation online, 2) misinformation trends on each topic, and 3) what platforms should do to address this urgent problem.

RFV - Saturday - 15:30-15:59 PDT

DC - Saturday - 13:00-13:45 PDT

In this talk, we will walkthrough and demonstrate a 0-day RCE vulnerability which we discovered through our research of MS-RPC. When exploited, this vulnerability allows an attacker to execute code remotely and potentially take over the Domain Controller. We believe this vulnerability may belong to a somewhat novel bug-class which is unique to RPC server implementations, and would like to share this idea as a possible research direction with the audience.

To aid future research into the topic of MS-RPC, we will share a deep, technical overview of the RPC system in Windows, explain why we decided to target it, and point out several design flaws. We will also outline the methodology we developed around RPC as a research target along with some tools we built to facilitate the bug-hunting process.

GHV - Saturday - 12:00-12:30 PDT

Additionally, she is published in Victims & Offenders with several forthcoming articles in peer-reviewed journals. She volunteers for the Crisis Hotline and has served as a mentor in the Pipeline Mentorship Program at Georgia State University. She has received several awards, such as the University of Tennessee at Chattanooga Department of Social, Cultural, and Justice Studies Most Outstanding Graduate Student in 2018, the Andrew Young Dean's Fellowship Scholarship at Georgia State University from 2018 to 2021, and the Department of Criminal Justice and Criminology Graduate Teaching Award at Georgia State University in the spring of 2021. Currently, she is completing her dissertation exploring online fraudsters' decision-making processes which is constructed in the three-journal article format to be published upon her degree confirmation.

CPV - Saturday - 13:45-14:30 PDT

BHV - Saturday - 10:30-10:59 PDT

ICSV - Saturday - 10:00-17:59 PDT

This is a registration required based CTF https://www.sea-tf.com/registration First come first serve basis on time slots.

RCV - Saturday - 12:55-13:30 PDT

We wrote a command and control python tool for this research. This Tool is hosted on our private server on amazon. So what does this tool do? This tool constantly scans the most used temporary mail services (yopmail, tempr.email, dispostable, guerrila, maildrop) today and indexes the mails falling there according to the words we specify, and keeps us informed via telegram with the telegram API integrated into the tool. This tool has been running on our server for about 1 year and has stored and continues to store more than 1 million mails. In our research, we observed these e-mails, what kind of e-mails are sent in these services and what use these e-mails can be for a hacker. In our research, we were able to take over the accounts containing money from these mail services. In our ongoing research, we have identified information such as confidential personal information, account reset emails, hundreds of game accounts, bitcoin wallet information. We will show them in our presentation, some of which will be censored.

In addition, we will release the tool on github after the presentation. this tool contains a config. It constantly crawls and monitors the mails in the URLs given in this config file and can save it if you want. It makes the e-mails it will record according to the keywords in the config file that you can configure. Therefore, I can say that this tool is very effective.

For example, I installed this tool and entered words such as ebay, password reset, bitcoin, OTP into the related words. This tool saves or tells you when e-mails containing these words come to the relevant e-mail services instantly. In addition, this tool has telegram API integration. In this way, when the relevant e-mails are received instantly, you can receive information via telegram.

We have included all of these in our research. In addition, while presenting our project, we will perform a live proof of concept and see what valuable things we can gain during the presentation.

In the bonus part, we will show the redteam activities that we noticed while examining these mail services. This place can be very interesting 🙂

MIV - Saturday - 15:15-15:45 PDT

PLV - Saturday - 19:00-20:15 PDT

PLV - Saturday - 20:30-21:59 PDT

ROV - Saturday - 15:30-16:30 PDT

RCV - Saturday - 10:50-11:35 PDT

This presentation will explore the results of the analysis of these accounts, information leading to potential initial attribution for the creator(s) of the accounts, as well as potential analysis of other groups of accounts using similar methodologies. In this session, participants will learn how this group of accounts works, as well as learning the mistakes in tradecraft that led to the identification of this group of accounts as illegitimate. This knowledge will be useful in detection of fraudulent accounts (including some methods that can be used by less technical audiences), as well as for creation of more plausible sockpuppet accounts for OSINT purposes.

HRV - Saturday - 11:00-17:59 PDT

SOC - Saturday - 12:00-11:59 PDT

Please note: the Caesars Forum Unity Ballroom is at the "front" of Caesars Forum, beside Demo Labs, across from room 216 (the Contest-CTF area).

SOC - Saturday - 17:00-16:59 PDT

Please note: the Caesars Forum Unity Ballroom is at the "front" of Caesars Forum, beside Demo Labs, across from room 216 (the Contest-CTF area).

DCGVR - Saturday - 12:00-12:30 PDT

I am a self-proclaimed AAA-rated GRC Hacker - having presented similar talks at Defcon villages and the PCI Council events.

They are sometimes funny, sometimes weird but some of them are really good interesting information that I aim to follow up later (spoiler alert - I never do). This talk will walk you through the contents of my bookmarks folder - you should be entertained but you may actually learn something too.

AIV - Saturday - 15:00-15:50 PDT

SKY - Saturday - 09:30-10:20 PDT

HRV - Saturday - 13:00-13:30 PDT

SKY - Saturday - 17:05-17:55 PDT

Elevator pitch: The world is dangerous. I will tell you how to make or source guns and ammunition. Don't break the law.

SOC - Saturday - 20:30-23:59 PDT

DCGVR - Saturday - 16:00-16:59 PDT

In this talk, we’ll do a whirlwind tour of the techniques used to bypass tamper evident seals, with things you’d likely have in your home. I’ll wrap up by talking publicly for the first time how the Glitter nail polish seal was bypassed at the OzSecCon 2018 Tamper Evident Challenge