BEGIN:VCALENDAR
VERSION:2.0
PRODID:Data::ICal 0.24
BEGIN:VEVENT
DESCRIPTION:   'Title: Perimeter Breached! Hacking an Access Control System
 \n   When: Saturday\, Aug 13\, 15:30 - 16:15 PDT\n   Where: Caesars Forum 
 - Alliance 301-309\, 321 (Track 4) - [1]Map\n   Speakers:Steve Povolny\,Sa
 m Quinn\n\n   SpeakerBio:Steve Povolny \, Principal Engineer & Head of Adv
 anced\n   Threat Research\n   Steve Povolny\, @spovolny\, is the Head of A
 dvanced Threat Research for\n   Trellix\, which delivers groundbreaking vu
 lnerability research spanning\n   nearly every industry. With more than a 
 decade of experience in\n   network security\, Steve is a recognized autho
 rity on hardware and\n   software vulnerabilities\, and regularly collabor
 ates with influencers\n   in academia\, government\, law enforcement\, con
 sumers and enterprise\n   businesses of all sizes. Steve is a sought after
  public speaker and\n   media commentator who often blogs on key topics. H
 e brings his passion\n   for threat research and a unique vision to harnes
 s the power of\n   collaboration between the research community and produc
 t vendors\,\n   through responsible disclosure\, for the benefit of all.\n
    Twitter: [2]@spovolny\n\n   SpeakerBio:Sam Quinn \, Senior Security Res
 earcher\n   Sam Quinn\, @eAyeP\, is a Senior Security Researcher on the Ad
 vanced\n   Threat Research team\, focused on finding new vulnerabilities i
 n both\n   software and hardware. Sam has a focus on embedded devices with
 \n   knowledge in the fields of reverse engineering and exploitation. He\n
    has had numerous vulnerability findings and published CVEs in the\n   a
 reas of IOT and enterprise software.\n   Twitter: [3]@eAyeP\n\n   Descript
 ion:\n   The first critical component to any attack is an entry point. As 
 we\n   lock down firewalls and routers\, it can be easy to overlook the\n 
   network-connected physical access control systems. A study done by IBM\n
    in 2021 showed that the average cost of a physical security compromise\
 n   is $3.54 million and takes an average of 223 days to identify a\n   br
 each.\n\n   HID Mercury is a global distributor of access control systems 
 with\n   more than 20 OEM partners\, deployed across multiple industries a
 nd\n   certified for use in federal and state government facilities.\n\n  
  Trellix's Advanced Threat Research team uncovered 4 unique 0-day\n   vuln
 erabilities and 4 additional undisclosed vulnerabilities leading\n   to re
 mote\, unauthenticated code execution on multiple HID Mercury\n   access c
 ontrol panels. These findings lead to full system control\n   including th
 e ability for an attacker to remotely manipulate door\n   locks. During th
 is presentation\, we will briefly cover the hardware\n   debugging process
 \, leading to a root shell on the target. We will\n   explore in greater d
 epth the vulnerability discovery techniques\,\n   including emulation\, fu
 zzing\, static and dynamic reverse engineering\,\n   and a detailed walkth
 rough of several of the most critical\n   vulnerabilities. We’ll address
  our approach to exploitation using\n   simplistic malware we designed to 
 control system functionality and\n   culminate the talk with a live demo f
 eaturing full system control\,\n   unlocking doors remotely without trigge
 ring any software notification\n\n   '\n\n   1. https://defcon.outel.org/c
 onsolidated_page.html#CaesarsAllianceBR\n   2. https://twitter.com/spovoln
 y\n   3. https://twitter.com/eAyeP\n\n\n
DTEND:20220813T231500Z
DTSTART:20220813T223000Z
LOCATION:DC - Caesars Forum - Alliance 301-309\, 321 (Track 4)
SUMMARY:Perimeter Breached! Hacking an Access Control System
END:VEVENT
END:VCALENDAR