Join us as we announce the winners of the Contest!

DEF CON Training - Tuesday - 08:30-17:30 PDT

DEF CON Training - Monday - 08:30-17:30 PDT

Contests - Sunday - 10:00-11:59 PDT

Participate in CHV's CTF to learn and play with automotive technology. This year's contest features problems on smart chargers, automotive ECU harnesses, our own badge, and more! Don't worry about bringing your own automotive specific gear, we've got you covered. Stop by the village to register, get started, and get hacking.

Car Hacking Village - Sunday - 10:00-13:59 PDT

Welcome to the Car Hacking Village - a place where you can learn all about the cool technology that powers modern connected transportation. The CHV at DEF CON 34 will feature a whole race track of activities including Creator Stage presentations, a competitive CTF (with awesome prizes!), an amazing badge for sale that doubles as a fully functional car hacking tool, a scavenger hunt, and more!

IoT Village - Sunday - 10:00-13:59 PDT

What happens when your cat’s litter box joins the Internet of Things? Join Suzu Labs as we dissect, analyze, and hack smart litter robots to uncover security risks.

DEF CON Talks - Sunday - 13:00-13:59 PDT

Modern Windows exploit mitigations have made memory corruption significantly harder, but reliable privilege escalation still emerges from a quieter class of bugs: logical flaws in privileged components. This talk shows how low impact Windows bugs become practical SYSTEM exploits when treated as reusable primitives over privileged resources.

We will walk through two distinct LPE chains to illustrate this concept. First, we demonstrate a novel LPE approach achieved by chaining service-level process termination with arbitrary file deletion. Second, we explore another powerful LPE path that leverages kernel- and task-driven registry creation and deletion primitives, ultimately turning attacker-controlled registry state into code execution via Performance DLL hijacking.

• ZDI-24-1098: https://www.zerodayinitiative.com/advisories/ZDI-24-1098/
• ZDI-24-451 / CVE-2024-30033: https://www.zerodayinitiative.com/advisories/ZDI-24-451/
• CVE-2025-60705: Windows Client-Side Caching Elevation of Privilege Vulnerability
• CVE-2025-59512: Windows Arbitrary Registry Deletion Elevation of Privilege Vulnerability
• Public Microsoft / MSRC security update references for patched issues
• itm4n, "Windows RpcEptMapper Service Insecure Registry Permissions EoP": https://itm4n.github.io/windows-registry-rpceptmapper-eop/
• itm4n, "An Unconventional Exploit for the RpcEptMapper Registry Key Vulnerability": https://itm4n.github.io/windows-registry-rpceptmapper-exploit/

Bocheng Xiang (@crispr_x) is a PhD candidate at Fudan University. He is listed on the MSRC MVR 2024/2025 and ranked Top #20 on the MSRC 2024 Q3 Windows Leaderboard. He has published papers at USENIX Security 2025, and his works have been accepted by PoC2025, re//verse2026 and BlackHat USA/Europe.

HeeChan Kim is a security researcher and a student at Soongsil University, specializing in Windows OS internals and Local Privilege Escalation (LPE). As a winner of the DEF CON 33 CTF with team MMM and a member of TeamH4C, he actively hunts for zero-days and persistent logical flaws within complex OS architectures. He has previously presented his Windows LPE research at POC and RE//verse.

DEF CON Talks - Sunday - 12:30-13:30 PDT

System Guard Runtime Monitor was meant to be an OS integrity anchor on Windows. A kernel driver, gated behind Protected Process Light (PPL), and a runtime attestation engine running in a secure enclave. In this talk, we revisit a classic code injection technique and adapt it into what we call "Bring Your Own Vulnerable WerFaultSecure". Instead of loading a third-party vulnerable driver, we bring our own vulnerable copy of a PPL-enabled Microsoft binary and its dependencies to get code execution as a protected process. From there, we pivot into the Microsoft System Guard kernel driver, a component that was built to support the integrity attestation of kernel objects, specifically processes, but which can be abused to tamper with those exact objects instead. We will close by sharing Indicators of Compromise (IOCs), along with prevention and detection ideas for defenders, and by discussing the innovation this exploit chain brings to the offensive security landscape.

https://infocon.org/mirrors/vx%20underground%20-%202025%20June/Papers/Windows/Internals%20and%20Analysis/2022-08-02%20-%20Inside%20Windows%20Defender%20System%20Guard%20Runtime%20Monitor.pdf https://www.microsoft.com/en-us/security/blog/2018/04/19/introducing-windows-defender-system-guard-runtime-attestation/ https://googleprojectzero.blogspot.com/2018/10/injecting-code-into-windows-protected.html https://googleprojectzero.blogspot.com/2018/11/injecting-code-into-windows-protected.html https://x.com/GabrielLandau/status/1683854578767343619 https://blog.scrt.ch/2023/03/17/bypassing-ppl-in-userland-again/ https://iamelli0t.github.io/2021/04/10/RPC-Bypass-CFG.html
https://github.com/Slowerzs/PPLSystem https://github.com/mdsecactivebreach/com_inject/ https://helgeklein.com/blog/anatomy-of-werfault-exe-application-crash-error-reporting/

Angelo is a security researcher specialized in Windows Internals. He currently works at SentinelOne, where he conducts research on advanced exploits and tampering techniques targeting the Windows ecosystem. Angelo’s background also includes web application penetration testing and red teaming, particularly assume-breach adversary simulations.

Angelo is eCXD, eCPPT, eJPT and OSCP certified. He enjoys reverse engineering and programming, mostly in C/C++. His GitHub profile (https://github/lem0nSec) features his main contributions to the cybersecurity community.

Angelo has a master’s degree in International Security Studies from University of Leicester, where he graduated in 2021 with the ‘Best Campus-Based Masters Dissertation Prize’ and the ‘Best Campus-Based Masters Student Performance Prize’.

AppSec Village - Sunday - 11:00-12:59 PDT

Clash of Prompts is the world's first live, head-to-head AI prompt battle royale. Two developers tackle the same coding challenge, one prompt each, on the clock, while the AI generates the code live on screen. Every prompt is scored in real time on vulnerabilities, security best practices, and prompt efficiency.

Research shows 87-94% of AI-generated code ships with security flaws, even when developers try to prompt securely. This Pod is a hands-on way to see that play out: attendees write and test real prompts and watch them get scored instantly.

With over 20 years of experience in cybersecurity and 15 years as a CxO, Jérôme has a proven track record in driving successful outcomes. He has been instrumental in five successful exits, including Lexsi (acquired by Orange in 2016) and Alsid (acquired by Tenable in 2021). Starting his career in deep-tech, mathematics, and engineering, Jérôme transitioned seamlessly into business leadership, leveraging his technical roots to guide strategic decisions and foster innovation in the cybersecurity landscape.

Cloud Village - Sunday - 13:10-13:30 PDT

DCNextGen - Sunday - 10:00-10:59 PDT

Welcome to Apex Park, where cloud-security mistakes are causing trouble throughout the park! Participants will investigate three beginner-friendly Azure challenges involving an exposed gift shop, an overpowered day pass, and an unlocked control room. They will inspect websites, investigate cloud-storage permissions, follow clues, and recover hidden flags. No access to a real Azure account or the challenge infrastructure is required. Participants interact only with intentionally vulnerable CTF resources created for learning.

Contests - Sunday - 10:00-12:59 PDT

CMD+CTRL is back for our 10th year and bringing something new to show. Drop by our cyber range for hands-on web application security challenges designed for all skill levels. Come to learn, come to compete, come to break things. All are welcome, whether it's your 1st CTF or your 101st.

There is no pre-qualification, and the only participant prerequisite is "Computer with internet access."

Contests - Sunday - 10:00-13:59 PDT

Code Cadaver: Break Every System. Save Your Friend.

Your best friend entered St. Dismas Hospital with flu-like symptoms.

He never came back.

Now his hotel room has been torn apart, his phone is still beaconing somewhere in the wreckage, and every clue points toward a hospital that seems less interested in healing people than hiding what happens to them.

Code Cadaver is Biohacking Village’s immersive healthcare cybersecurity CTF—a dark, story-driven challenge that pulls players through the connected systems of a compromised hospital and the criminal network surrounding it.

Follow wireless signals. Pivot from guest networks into production systems. Hunt through patient intake records, webcams, HL7 traffic, payment systems, RFID credentials, pager networks, infusion devices, DICOM archives, and secured medical cabinets. Every system holds another piece of the truth. Every solved challenge brings you closer to Ethan—and deeper into St. Dismas.

This is more than a collection of puzzles. It is a full-chain medical cyber-thriller built around the technologies, mistakes, dependencies, and trust relationships that keep modern healthcare running.

You will need technical skill, persistence, curiosity, and a willingness to question everything.

The hospital is closing in.

The machines are still working.

Ethan is running out of time.

Break every system. Save your friend before St. Dismas finishes what it started.

Social Engineering Community Village - Sunday - 11:30-12:30 PDT

Ready for the hot seat? Step into the soundproof booth, grab a mystery target and three escalating objectives, and we'll place the call. Run by rekdt, Arty Boy, and Shadow Fox. First come, first served, so get your name on the Cold Call list!

Misc - Sunday - 10:00-10:59 PDT

Kick off your DEF CON morning with a creative reset. Color with WISP! Choose from different coloring pages and bring them to life with markers, crayons, and your own flair. Whether you're decompressing or collaborating on a shared poster, it's the perfect low-pressure space to connect, reflect, and color outside the lines.

Red Team Village - Sunday - 11:00-11:59 PDT

GitHub is where identity, automation, and production changes all meet, which makes it a great target. Once an attacker gets in, the distance between read access and shipping malicious code to production is often a lot shorter than teams expect.

This talk covers realistic attack paths into GitHub organizations. We start with initial access: device-code phishing and abuse of trusted GitHub Apps like the GitHub CLI. Then we follow the credentials, from long-lived Personal Access Tokens sitting on developer machines to short-lived secrets like GITHUB_TOKEN that leak through logs and artifacts, and show how both enable lateral movement and privilege escalation.

Then we get into a technique we call secret stomping. Anyone with write access to a repo can overwrite an Actions secret, including protected environment secrets reviewers assume are safe. Leak the real value first, then overwrite the secret with a payload that keeps the original value intact, and the pipeline stays green while your code runs on the runner. Using the org, repo, and environment scope hierarchy, you can shadow a secret in one repo without touching others, then delete it and leave nothing behind at the org level.

We close on the defensive side with detection strategies and response playbooks built around the signals that matter, plus how to get coverage into the places GitHub is hardest to watch. Blue teams leave with a checklist for locking down identities, tokens, integrations, and workflows. Red teams leave with a map of where GitHub controls break in practice.

After the talk we're running a hands-on workshop in a private GitHub org built for this, focused on secret stomping. You'll leak a secret, stomp it with a payload that keeps the pipeline green, and use scope shadowing to exploit your way onto a sensitive runner without tripping the obvious alarms. Bring a laptop.

Andrew Buchanan is a Senior Red Team Operator with over six years of offensive security experience spanning adversary simulation, penetration testing, and real-world attack execution.

Andrew has spent years conducting advanced red team engagements and security assessments across highly complex enterprise environments at one of Canada's largest financial institutions.

Andrew specializes in initial access and social engineering, having designed and delivered numerous campaigns that closely mirror real-world threat actor tradecraft. His work spans offensive operations across on-premises, cloud, and hybrid environments, with a particular focus on cloud attack surfaces, execution chains, and targeted phishing and pretexting campaigns.

Max leads offensive security at Figment and brings over a decade of experience spanning national security, security research, and blockchain security. He has published multiple CVEs and conducts research focused on CI/CD pipeline security, threat modeling, secure key management, and practical security controls for high-risk systems.

Contests - Sunday - 10:00-10:30 PDT

See who won in our village! During this time we'll present the SECVC and BOTB winners, as well as the much-coveted Dundies!

DEF CON Talks - Sunday - 13:30-14:59 PDT

Crypto & Privacy Village - Sunday - 11:00-11:30 PDT

Confidential computing systems involve computation over private inputs held by mutually distrusting parties while producing public, cryptographically verifiable evidence of what was computed. Trusted execution environments (TEEs) are a practical building block for these systems, enabling code to run inside hardware-encrypted enclaves that emit attestations binding a measurement of the loaded code to genuine hardware. We present Cove, a framework that composes attested computations into multi-stage, multi-party workflows structured as directed acyclic graphs. Each node runs in its own enclave, decrypts private inputs only under attestation-gated key release, and emits a certificate that downstream nodes can require as a cryptographic precondition before consuming upstream artifacts; anyone holding the workflow bytes and the TEE vendor's attestation roots can verify the whole chain non-interactively. We show that a small set of reusable primitives - confidential artifact provisioning, encrypted dynamic outputs, attested ephemeral-key channels (RA-TLS), and certificate-gated preconditions - compose into systems that lift attestation from verified code identity to verified runtime properties, and use this to express practical applications in secure AI systems including confidential AI inference, attested AI benchmarks, and training-code verification. We give an open-source reference implementation on Intel TDX via Phala Cloud's dstack and demonstrate end-to-end feasibility with an attested benchmark workflow.

Stephanie is a research engineer working on AI security and safety. Her research interests include adversarial robustness, agent security and verifiable AI deployments. Previously, she was at Meta, where she worked on AI safety and security evaluations (CyberSecEval) and guardrails (PromptGuard, LlamaFirewall), and prior to that she worked on application security for web and mobile.

Robin is a Member of Technical Staff at Inferact (maintainer of vLLM), working towards the best inference stack of the future. Previously he worked as a software engineer at Near Protocol, Meta, Google, and Twitter. His interests include application security, model red-teaming, distributed systems, and GPU performance optimization.

Erika Lee is a 3rd-year Math–Computer Science undergraduate student at UC San Diego and a MATS 9.1 AI Security Fellow. Her research interests are in verifiable and privacy-preserving AI, and building secure and trustworthy AI systems. She previously interned with the US Department of Defense's AI/ML portfolio and the U.S. Army, working on deploying AI/ML systems in classified environments.

Bing-Jyue Chen is a 3rd-year PhD candidate in Computer Science at UIUC. His current research focuses on zero knowledge machine learning (zkml). He is also interested in verifiable AI, privacy-preserving machine learning, and advanced cryptography.

Daniel Kang is an assistant professor at UIUC in the computer science department. His research focuses on making analytics with machine learning easy for scientists and analysts to use, and has been supported by Google, the Open Philanthropy project, Emergent Ventures, and others. He has consulted at OpenAI, Google, Microsoft, hedge funds, and other companies to support their ML deployments, and advised a number of startups.

Contests - Sunday - 10:00-11:59 PDT

Time is of the essence! You will have 48 hours to crack as many hashes and files as possible.

Pamama, a US-based data broker had a massive data breach. Profiles on over a billion people, containing all the information amassed about them. It is alleged that the company siphoned records from different government agencies around the world, as well. The dump was encrypted, and regulators are downplaying the breach claiming no damage was done. A bill has been fast-tracked in Congress to exempt Pamama from any investigations, including illegally shield them from GDPR violations. This led to accusations that Pamama has bought or blackmailed members of congress.

Crack the staff's accounts and encrypted files to demonstrate the extent of the exposure and the need for individuals to get restitution and compensation, and to find smoking gun evidence of collusion so that the corruption can be fully exposed before the legislation goes forward.

Participant Prerequisites

Open to all, but pre-registration is recommended. Compete in the Street class for individuals or small teams, or in Pro if you do not want to sleep all weekend. Check out past years' contests at https://contest.korelogic.com/ , or the Password Village site for an introduction to password cracking and links to other resources: https://passwordvillage.org/

Pre-Qualifications

None.

Contests - Sunday - 10:00-11:59 PDT

Welcome to Crack the Core–a true test of lockpicking skills. Competitors will work through a variety of locks ranging in different difficulties, technologies, and configurations. From standard off-the-shelf locks to evil creations from the community. Locks will be presented in a variety of ways, ranging from your traditional deadbolt to much, much more. Just wait until you see what we have in store for you…

Challenges will not only test traditional lockpicking skills but force competitors to interact with different “environments,” work through various challenges, and adapt to what's presented. Collect the most points, you go home the winner–it’s that simple…

Bring your tools. Bring your focus. The locks will be waiting.

Participant Prerequisites

Basic tools will be available for use but it is highly recommended to bring your own tools. This may include lockpicks, bypass tools, vices, etc. Destructive entry is not allowed and associated tools will not be needed.

Contests - Sunday - 10:00-11:59 PDT

Something is already watching you.

The Cryptid Hunt is a task-oriented challenge that moves agents across the conference floor toward a truth most attendees will never find. This is not a passive experience — each clue demands action, and the path forward is never obvious.

Look carefully at what surrounds you. The next layer of any good mystery is always hiding beneath the surface. Patterns emerge for those paying attention. Signals exist for those who know how to listen.

Is this a puzzle? A test? A hunt? At its core, this is a community experience that rewards curiosity, persistence, and the willingness to go further than most people will.

The conference is your map. Maritime exploration, ancient communication, and the village of knowledge surrounding you are all part of the journey. Nothing here is coincidental.

Finishers are recognized. What awaits those who complete the hunt will not be found anywhere else at this conference. Supplies are finite. So is your time.

Your first clue is already in your hands.

— The Cryptid Hunt Team

Bureau of Unverified Phenomena · DC34

Participant Prerequisites

• Smart Phone
• Desire to Learn
• Patience

Cryptocurrency Village - Sunday - 11:00-11:59 PDT

Closing the Cryptocurrency areas at DEFCON, we introduce everyone at work and their achievements during the event. We review our four major activities including the hackathon, contests, workshops, and capture the flag competition. A summary of teams, winners, and statistics indicates the degree of participation in this event. We describe what prizes were awarded and which contestants won big. A list of workshop topics follows, with instructors giving their impressions of how modern finance technology benefits from interactive learning. Finally, we give a sneak preview of what's to come in the Cryptocurrency areas (Village, Contest, Vendor, Party, Training) at DEFCON in Bahrain and how we intend to fulfill the mandate of fostering cryptocurrency exploration and hacking there.

Chelsea is a lawyer specializing in consumer finance, data and technology. She advises clients on updates in the law and defends them in litigation. She is a cryptocurrency advocate, with multiple professional publications.

Param is an Electrical Engineering Student from Georgia Tech with a strong passion for and interest in crypto. Although he primarily got interested in cryptography and hardware security through a class at Georgia Tech, he is also working at a software company on crypto adoption and ease of use. With a unique blend of HW and SW skills, Param is truly enthusiastic about all aspects of crypto.

Arjun Suresh is pursuing postgraduate studies in Cybersecurity at the University of Wollongong in Dubai, specializing in blockchain security, penetration testing, and applied cryptography. His interest in crypto security was shaped by analyzing major exchange breaches, including the Mt. Gox and Ronin Network hacks, where he studied the gap between attacker tradecraft and real-world defenses.

Noob Community - Sunday - 10:30-11:30 PDT

DEF CON Talks - Sunday - 12:30-13:30 PDT

CUDA've done better - Hacking Nvidia GPUs for container-escape and privilege escalation. We found and exploited a UAF in the NVIDIA Linux kernel module that allows us to escape NVIDIA containers and gain root access on the host. We'll show novel exploitation techniques: bypass kernel heap mitigations, deterministically win races by abusing rw_semaphore, and execute code on the kernel without ever jumping anywhere (by writing directly to physical memory).

I used to be a vulnerability researcher for the army, but now that I'm a full time physics grad student researching superconducting quantum computers at the Weizmann Institute (very unrelated to hacking).

I just love hacking so much that I still do it in my spare time, while not doing physics. I like using hacking as an excuse to learn and deeply understand stuff. NVIDIA is a good example. I wanted to learn more about GPUs because of all the latest advancements in AI, so instead of seeing a tutorial/lecture about it, I just opened the code and started researching it. Another good example is when I hacked Merkle trees to learn more about zero-knowledge proofs.

Noam is a low-level systems, GPU, and vulnerability researcher at Atom, where he works on GPU infrastructure for AI. He previously served in an IDF cyber unit and later worked as a vulnerability researcher at a private cybersecurity company. Noam holds a B.Sc. in Computer Science and Mathematics from the Hebrew University of Jerusalem and is currently pursuing a master’s degree in Mathematics at the Hebrew University.

Contests - Sunday - 10:00-11:59 PDT

The cyber deck contest at DEF CON 34 encourages makers of all types to create their own cyber deck. Winners will be judged on form, function, creativity, does it work, general, awesomeness, and complexity.

Stop by Makers' Village for more info!

Judging Criteria

• Design Description
• Purpose
• Functionality
• Fancy-Do-Dads
• Processing Power
• Housing/Case utility
• Housing/Case Aesthetic Appeal
• Complexity
• Bonus categories revealed at con

Rules

1. Must be present to enter.
2. Winners are determined by points awarded by the judges.
3. Rules are subject to change.

AI Village - Sunday - 10:00-13:59 PDT

Go deepfake yourself! This hands-on demo shows how threat actors leverage open-source deepfake video and voice cloning frameworks to impersonate anyone in realtime, conducting social engineering and compromising organizations using nothing more than a consumer-grade gaming laptop. No specialized hardware, no budget, no nation-state resources required. Come learn the tradecraft firsthand and find out just how convincing you can become.

Brandon Kovacs (CRT, OSCP) is a Senior Security Consultant at offensive cybersecurity firm Bishop Fox, where he specializes in red teaming, network penetration testing, and physical penetration testing. As a red team operator, he is adept at identifying critical attack chains that an external attacker could use to fully compromise organizations and reach high-value targets. Brandon is also recognized as a deepfake expert, conducting speaking sessions and live demonstrations at several global security and technology conferences. His research focuses on the intersection of offensive cybersecurity and artificial intelligence.

Contests - Sunday - 10:00-11:59 PDT

Darknet-NG is an Alternate Reality Game (ARG), where the players take on the Persona of an Agent who is sent on Quests to learn real skills and gain in-game points. If this is your first time at DEF CON, this is a great place to start, because we assume no prior knowledge. Building from basic concepts, we teach agents about a range of topics from Lock-picking, to using and decoding ciphers, to Electronics 101, just to name a few, all while also helping to connect them to the larger DEF CON Community. The "Learning Quests" help the agent gather knowledge from all across the other villages at the conference, while the "Challenge Quests" help hone their skills! Sunday Morning there is a BOSS FIGHT where the Agents must use their combined skills as a community and take on that year's final challenge! There is a whole skill tree of personal knowledge to obtain, community to connect with and memories to make! To get started, check out our site https://darknet-ng.network and join our growing Community!

Participant Prerequisites

Prerequisites for competing in the contest would require a device with access to a web browser like a Phone, Tablet, Laptop.

Contests - Sunday - 10:00-11:59 PDT

Threat Modeling is arguably the single most important activity in an application security program and if performed early can identify a wide range of potential flaws before a single line of code has been written. While being so critically important there is no single correct way to perform Threat Modeling, many techniques, methodologies and/or tools exist.

As part of our challenge we will present contestants with the exact same design and compare the outputs they produce against a number of categories in order to identify a winner and crown DEF CON’s Next Top Threat Model(er).

Participant Prerequisites

A laptop is recommended, a smartphone could be used but will be less than idea. Internet access to retrieve the design materials and to submit findings and access to the email used during registration.

Aerospace Village - Sunday - 10:00-13:59 PDT

Step right up to our interactive LEGO aircraft. Can you investigate the aircraft's control system, identify any vulnerabilities, and “hack” beyond its intended functions?

This exercise uses real-world I2C protocols to simulate potential vulnerabilities in an aircraft control system.

No specialized hardware required - all target devices, materials, and interfaces are provided!

No prior aviation or security experience required - a walkthrough guide is provided for beginners, and volunteers are on hand to help at every step. This activity is accessible to all skill levels.

Aerospace Village - Sunday - 10:00-13:59 PDT

RIC-1, tail number N3VR-G0N, has gone down! You need to use radio direction-finding (RDF) techniques to locate Emergency Locator Transmitter (ELT), report its position, and help rescue our missing pilot!

Participants will use the provided handheld DF equipment provided by the Village, or bring your own, to triangulate the hidden transmitter location within the village area. Your handheld radio must be capable of receiving on the designated frequency with a directional antenna or attenuator. Once you've located RIC-1, listen closely... you may recognize the beacon's "distress tone." It appears to be broadcasting an audio payload that responders have described as "oddly catchy" and "impossible to stop once you start listening." Bring your comfortable shoes and strong will to ensure you never give up until you find our missing pilot!

No prior RDF experience required - volunteers can walk you through basic triangulation techniques before you start this 15-30 minute event.

Aerospace Village - Sunday - 10:00-13:59 PDT

The MOUSE-1 satellite is currently in Safe Mode, and its attitude and heading systems are behaving unexpectedly. Ground control needs answers NOW!

You are a newly assigned Mission Specialist, and it's your job to figure out what's going on. Work through five sequential challenge missions aboard a simulated HUD - complete with live orbital tracking, optical camera feeds, and attitude telemetry - to triage MOUSE-1, uncover what happened, and make it operational again.

Participants will learn how satellites operate, how they stay secure in orbit, and what happens when they don't - using a fully browser-based, gamified interface developed by California Polytechnic State University students.

Just grab a seat in front of the provided station, no prior cybersecurity or aerospace experience required! Each mission is self-guided with built-in instructions, and volunteers are available to assist. Both beginner and experienced participants will find this 30-minute event challenging and fun.

DCNextGen - Sunday - 13:30-14:30 PDT

And just like that, it's a wrap! While we're sad to see the fun end, we want to give everyone one last big thank you.

Join us to say goodbye to new friends and hear about all the cool plans we have for next year. We'll also be handing out prizes for our DCNextGen Badge CTF — you must be present to win!

Social Gatherings/Events - Sunday - 22:30-01:59 PDT

Close out DEF CON at LIV Fontainebleau. Bring your DEF CON badge for free admission and a free drink.

DEF CON Talks - Sunday - 15:00-17:30 PDT

Mr. Moss is an internet security expert and is the founder of both the Black Hat Briefings and DEF CON Hacking conferences.

Contests - Sunday - 10:00-11:59 PDT

We are the Benevolent Bureau of Birds (BBB), formulated from previous victors of past DEF CON CTF contests. We are dedicated to the ethos at the core of CTF: community, skill-building, and showing off insane new hacking talent.

Participant Prerequisites

Players will have to be qualified by an online qualifer to take place in May. Chosen players are then required to have a laptop to participate in the in-person contest, to interact with the scoreboard and challenges hosted on network.

Pre-Qualification

Yes - online pre-qualifier in May 22-24, 2026.

DEF CON Groups - Sunday - 10:00-13:59 PDT

DEF CON Groups are the year round, local communities that bring the DEF CON spirit home. Run by volunteers around the world, DCGs create spaces where hackers meet, learn, collaborate, and build community outside of conference season.

The DEF CON Groups community space brings together Points of Contact, members, and prospective members to collaborate, share ideas, and learn from one another. Through informal workshops and hands on interaction, participants exchange practical lessons on building, sustaining, and evolving local hacker communities.

The space also serves as a social anchor. A relaxed place to reconnect with old friends, meet new ones, and participate in light interactive activities that reflect the collaborative nature of hacking culture.

DEF CON has always been the island of misfit toys we all return to once a year. DEF CON Groups are how that ethos survives the other fifty one weeks.

Contests - Sunday - 10:00-11:59 PDT

Whether you're a seasoned DEF CON veteran or a curious newcomer, the DEF CON Scavenger Hunt promises to challenge your skills, tickle your wits, and ignite your hacker spirit. Our list is a portal to mystery, mischief, and mayhem. Assemble your team of up to 5 members, interpret the items, and submit your efforts at the booth to our esteemed judges. Go beyond the basics for bonus points. Legends are born here.

The DEF CON Scavenger Hunt is open to everyone, regardless of skill level or experience, no pre-qualifying necessary. We strive to maintain the balance of a low barrier to entry while providing a challenge that many are eager to take on. Casual players should not be overwhelmed by the list, find a handful of items and have fun. If you are looking to win however, you will need to fully immerse yourself in the DEF CON Scavenger Hunt. Let's make some memories together.

Remember that it's not just about fame, glory, or boxes of swag; the true allure is the camaraderie of fellow hackers, the knowledge that you've etched your mark on DEF CON history, and the ultimate badge of honor: bragging rights. Nothing says "I'm a hacker" quite like being triumphant at the DEF CON Scavenger Hunt.

Participant Prerequisites

No, we work very hard to maintain a very low barrier to entry. If anything is required for an item, they should be able to find a fellow hacker with it that would be willing to assist them with their item.

Social Gatherings/Events - Sunday - 06:00-07:59 PDT

Defcon.run, formerly the DEF CON 4x5K, is a community-driven tradition where hackers gather for morning runs and rucks across Las Vegas. Participants can choose from various routes, from 5Ks to longer distances.

For DEF CON 34, meet at "The Spot" near the North Entrance of the Las Vegas Convention Center West Hall. Activities start at 06:00, Thursday through Sunday; arrive early for safety briefings and community hype.

Whether you are an experienced runner or a newcomer, visit defcon.run to sign up and connect with the community.

Blacks In Cyber Village - Sunday - 13:00-13:59 PDT

Dive into the future of cybersecurity with a session that challenges conventional thinking. This talk explores the concept of 'DeNISTifying Technology,' guiding attendees through paradigm shifts towards quantum encryption, advanced post-cryptography methods, and the evolving landscape of digital forensics. Discover innovative approaches and critical insights into securing our digital world beyond current standards. All experience levels are welcome to explore these cutting-edge topics.

Aisha Berry is a cybersecurity professional, PhD candidate, and experienced nurse with over 15 years in healthcare. They hold a Bachelor's in Cybersecurity and Computer Networking with a focus on digital forensics, and a Master's of Science in Digital Forensics and Cyber Investigations. Currently pursuing a doctoral program with a focus on healthcare, Aisha delves into the psychological component of technology, emphasizing the mindset of attackers in cybersecurity strategy.

Red Team Village - Sunday - 14:00-14:59 PDT

DFMI is a cross-platform, open-source offensive toolkit that hijacks & abuses the Windows Installer's own execution engine to detonate arbitrary payloads during software installation, with zero files written to disk and zero evidence left behind. And this can be achieved without even corrupting the Authenticode of the binary.

The attack surface is the CustomAction table embedded in every MSI database — a small structure that Windows Installer processes unconditionally at install time. DFMI injects a deferred CustomAction (property-based EXE invocation) — firing right before the modification in system files; the payload executes before a single legitimate byte touches the filesystem.

Right now, DFMI provides 3 different methods for abusing MSI files: - Inject: Simply injects a CustomAction (CA) into an existing MSI package. - Rogue MST: Generates an MSI Transform File (.mst) and injects into legitimate ".msi" file without corrupting it's Authenticode. - Stub: Creates a malicious MSI file from scratch.

What makes DFMI particularly difficult to eradicate is that it exploits no vulnerability; it's a feature. The CustomAction mechanism is a 25-year-old Windows feature, documented by Microsoft, used by virtually every enterprise software package and trusted implicitly by the OS.

DFMI simply turns that trust sideways — using the Installer engine as its own payload executor.

https://github.com/ccelikanil/DFMI

Computer Engineer & been working as a Red Teamer for the past ~7 years. Previously did presentations at DEFCON 33 Demo Labs, DEFCON 33 Red Team Village & Black Hat USA Arsenal 2025. Currently holding 6 CVEs, OSCP & OSWP. Interests: Windows Internals & AD Security

Red Team Village - Sunday - 10:00-10:59 PDT

Command and control beacons currently reach out to the operating system to request socket resources, triggering auditing and being restricted by local firewall rules. However, it is possible to develop malware that can evade the standard process. Sparse is a tool that weaponizes this concept to evade such auditing and defensive configurations.

I started learning to program in middle school and found a software engineering project to work on throughout highschool. I attended Liberty University to study Software Engineering and Cybersecurity at the undergraduate level, learning to develop software that works in adversarial contexts. I have recently finished my master's degree in Cybersecurity, where I was able to further practice developing software in adversarial contexts and develop version 2 of Sparse

OSINT For Good Community - Sunday - 11:30-12:45 PDT

OSINT, social media, drones, AI, and more… in this session, we’ll learn how these innovations are applied to make life-saving decisions before, during, and after a disaster

Matt Green is your friendly neighborhood emergency manager, professor, and host of the state of disaster podcast. His passion is ensuring equitable, high-quality, whole community emergency management across sectors and borders.

OSINT For Good Community - Sunday - 11:30-11:59 PDT

OSINT, social media, drones, AI, and more… in this session, we’ll learn how these innovations are applied to make life-saving decisions before, during, and after a disaster

Matt Green is your friendly neighborhood emergency manager, professor, and host of the state of disaster podcast. His passion is ensuring equitable, high-quality, whole community emergency management across sectors and borders.

IoT Village - Sunday - 10:00-13:59 PDT

Join us for a self-guided interactive look at GE Appliances and get hands on with some of our most popular home appliances!

Red Team Village - Sunday - 12:00-13:59 PDT

"Identity is the new perimeter" gets thrown around a lot in security discussions, fo a good reason. With the right privileges, cloud resources can be managed through APIs. Each provider has their own way of handling API access on resources. If your identity has the right permissions for a specific API call, you can execute that action.

The thing is, it's hard to remember every single API call you need to get specific information or access certain resources. AWS recognized this problem and created the AWS CloudControl API, a unified API that groups different resources together so you can create, update, delete, or retrieve them in bulk. This makes managing resources much simpler since you don't need to know which specific service, API call, or parameters to use.

But here's the catch: when something is easy for legitimate users, it's usually easy for attackers too. There are already tools available to use the AWS CloudControl API to pull resource information, and the technique is gaining attention.

But is it actually a good way to do stealthy enumeration? In this article, we examine what the CloudControl API is, how it simplifies resource management, how attackers can weaponize it, its limitations, and detection methods.

Bleon is an Info-sec passionate about Infrastructure Penetration Testing and Security, including Active Directory, Cloud (AWS, Azure, GCP, Digital Ocean), Hybrid Infrastructures, as well as Defense, Detection and Thread Hunting. He has presented topics related to Cloud Penetration Testing and Security in conferences like BlackHat USA, Europe and Sector, DEF CON, SANS Pentest Hackfest Hollywood and Amsterdam, as well as several BSides on USA and Europe.

His research include Nebula, a Cloud Penetration Testing Framework (https://github.com/gl4ssesbo1/Nebula) and other blogs, which you can also find on his blog (blog.pepperclipp.com). He is also the author of YetiHunter, DetentionDodger and Ransomwhen (https://github.com/Permiso-io-tools/[DetentionDodger | YetiHunter | Ransomwhen]).

He is also the author of the upcoming book "Deep Dive into Clouded Waters: An overview in Digital Ocean's Pentest and Security" (https://leanpub.com/deep-dive-into-clouded-waters-an-overview-in-digitaloceans-pentest-and-security)

Aerospace Village - Sunday - 10:00-13:59 PDT

Dive into our interactive choose-your-own-adventure web interface and learn how to hack a drone in a fun, storyboard-based game. This graphical user interface simulates the process we use when hacking drones for the Air Force, allowing participants to make decisions and see the outcomes.

It's a beginner-friendly, 15-30 minute activity offering insights into the steps involved in drone penetration testing.

Participants can access it from their own computers or mobile phones.

Aerospace Village - Sunday - 10:00-13:59 PDT

Join our Drone Hacking Workshop for hands-on experience hacking drone components. This three-step in-depth activity is designed to teach you about the vulnerabilities and security of autonomous systems. Using sample drones, participants will learn techniques used in government pen tests.

This 2-3 hour workshop suits all skill levels, from beginners to advanced hackers. Come and test your skills in a real-world scenario and understand the intricacies of drone security.

Participants need to bring a laptop capable of running a Linux distribution.

Embedded Systems Village - Sunday - 10:00-13:59 PDT

We have a lab platform that brings everyone from every skill level to the same playing field with step by step instructions that aim to teach individuals specific techniques and skills in a hands-on manner on embedded hacking techniques.

Biohacking Village - Sunday - 10:00-13:59 PDT

This course offers a deep dive into practical techniques for dissecting and manipulating embedded systems. Get hands-on with these core activities:

• Visually inspect and document a device to map components, debug interfaces, and attack surfaces
• Decode board communication protocols with logic analyzers
• Exfiltrate live data over SPI, JTAG, and SWD — and use chip-off / deadbugging to reach embedded storage
• Reverse-engineer bare-metal firmware in Ghidra with advanced plugins
• Probe embedded defenses — encryption, disabled debug interfaces, glitching, and fault injection
• Chain hardware-level access into higher-level exploits — from physical interfaces all the way up to network-exposed services

Embedded Systems Village - Sunday - 10:00-13:59 PDT

Get hands-on with devices you won't find anywhere else — rare, hard-to-source embedded devices staged for live exploitation. Hunt real zero-days, and yes, bring your AI: LLM-assisted tooling is fully allowed, so use it to go as deep as you can.

Come break something that's never been broken.

New to embedded? Just wrapped our 101 Labs? Beginner challenges are available as well to apply your new found knowledge!

Contests - Sunday - 10:00-11:59 PDT

Customer service channels are increasingly saturated with conversational text and voice AI agents. Can you convince, trick, or break enough of them to earn your shot at a live human operator in a real-world call center?

Escalation Desk is Call Center Village's capture-the-flag challenge. Start with low-pressure AI agents and learn how to spot, avoid, and exploit common pitfalls and patterns in system prompts — eventually unlocking live human operators at our partner call centers. A real-time leaderboard tracks solo and team progress, with our not-so-famous Golden Telephone Booth trophy awarded to the top participant.

Hit our minimum point threshold and earn a special Call Center Village 100 Trying black flight tag. The top individual and their team also take home the rare Call Center Village 200 OK gold flight tags. Bring your tags to Party Line, Call Center Village's after-hours telephony-themed party, and enjoy free refreshments for your spoils.

Escalation Desk is beginner (and introvert) friendly — if you can dial a phone number or use a keyboard, you can participate. Bring your own laptop and headset, or use one of our village stations. Active Noise-canceling headphones with a microphone are highly recommended.

The CTF will run during village hours, pausing when the village closes each night, and ends on Sunday at 12:00.

DEF CON Talks - Sunday - 10:00-10:59 PDT

Privacy should be accessible to all. Historically, counter-surveillance tools have been expensive, complex, and inaccessible to most individuals, often limited to well-funded researchers and costly hardware configurations. The ESP32 offers a transformative alternative. This presentation will demonstrate how an affordable microcontroller has become the foundation for a growing suite of open-source, user-friendly anti-surveillance tools. We will discuss the technical features that make the ESP32 a compelling choice for these applications, including passive 802.11 and Bluetooth monitoring, OUI-based device fingerprinting, and robust cryptographic capabilities. Applications include detecting police body cameras in operational environments, mapping Flock Safety automatic license plate recognition (ALPR) infrastructure, identifying unauthorized drones, detecting radio frequency jamming across 2.4GHz, 5GHz, and cellular bands, and tracking autonomous robots operating with known-vulnerable firmware. These tools are cost-effective and freely available. We will also consider future developments in accessible counter-surveillance hardware, such as the ESP32-S5 with 5GHz support, GPS, displays, haptics, etc. Advancing anti-surveillance culture requires designing devices that individuals are motivated to use and carry.

Cooper Quintin is a security researcher and senior public interest technologist with the EFF Threat Lab. research fellow with Citizen Lab, adviser to CoRD Research and Design, and board member of Open Archive. He has worked on projects including Rayhunter, Privacy Badger, Canary Watch, and analysis of state sponsored malware campaigns such as Dark Caracal. Cooper has given talks about security research at prestigious security conferences including Black Hat, DEFCON, Enigma Conference, and ReCon about issues ranging from IMSI Catcher detection to fem tech privacy issues to newly discovered APTs. He has also been published or quoted in publications including: The New York Times, Reuters, NPR, CNN, and Al Jazeera. Cooper has given security trainings for activists, non profit workers, and vulnerable populations around the world. He previously worked building websites for nonprofits, including Greenpeace, Adbusters, and the Chelsea Manning Support Network. Cooper was also an editor and contributor to the hacktivist journal, "Hack this Zine." In his spare time he enjoys making music, visualizing a solar-punk communitarian future, and playing with his kids.

Malware researcher by day, IoT rapid prototyper by night. Creator of Mesh-Detect and Oui-Spy. I love making things and bringing my ideas to a completed prototype rapidly. I’m Interested in privacy, digital rights, and detecting all the things.

Product Manager working on building pentesting platforms by day, hacker and electronics prototyper by night (and occasional weekend). Creator of VoidMantisOS for the hacker pager and SpectraMesh mesh networking protocol. Interested in security, privacy, RF, electronics and fighting digital surveillance. Listed under: just handle

Red Team Village - Sunday - 10:00-11:59 PDT

Modern endpoint defenses increasingly fingerprint .NET tools not only by strings and imports, but by structure: control flow, call graphs, and overall execution “workflows.” Traditional IL obfuscation can hide obvious indicators, yet often produces highly regular flattened patterns that are easy to flag on their own.

This talk presents a Roslyn-based, source-to-source obfuscator for C# that rewrites an entire project before compilation. Using the official compiler APIs, it transforms the code’s syntax and semantic structure, reshapes control/data flow, and then recompiles the result - while keeping the program’s observable behavior intact. The output tends to look complex but “natural,” diverging both from the original tool and from the telltale patterns created by many IL-level obfuscators.

I will walk through the pipeline, show how surprisingly little code is needed to build these transformations on Roslyn, and discuss what this means for EDR, sandboxing, and ML detections that rely on graph and workflow analysis of .NET binaries.

So, anyway, on moment of submitting original Seatbelt tool (obfuscated by source) have 10/73 security vendors flagged this file as malicious (can be better) https://www.virustotal.com/gui/file/ec2dcecb927874d41b051633135c8a594abb40d03f6836a548b40963bf330c86/detection/f-ec2dcecb927874d41b051633135c8a594abb40d03f6836a548b40963bf330c86-1764839678

My project https://github.com/gam4er/Loaders differs from more well known https://github.com/sadreck/Codecepticon by implementing semantic structure obfuscation.

My point of view (sa a SOC analyst, blue teamer) on "how to hide mytool from AV" problem is: if you have a code - OBFUSCATE YOUR CODE. Stop modifying binaries

Rodchenko Alexander is a Senior SOC Analyst at the SOC Security Research Group at Kaspersky. He began his career at OJSC Rosneft, focusing on industrial safety, troubleshooting, and audits. Currently, he investigates industry events and trends with the primary goal of integrating these insights into monitoring and threat hunting practices. Leveraging his extensive expertise, Alexander advises customers and threat detection/hunting teams on the optimal response to emerging threats and trends. In addition to speaking at Positive Hack Days (twice) and BSides Zurich 2023, he has also been a speaker at CodeBlue 2024 and BlackHat MEA 2024.

I currently work as an Incident Response Specialist on Kaspersky's Global Emergency Response Team (GERT). I live in Mexico and have over seven years of experience in Incident Response, Digital Forensics, Malware Analysis, and Reverse Engineering. Before joining DFIR, I worked for two years as a Penetration Tester.

I have collaborated on various Threat Hunting and Threat Intelligence projects.

Additionally, I have been a speaker at international events such as DEFCON (La Villa Hacker), BSides, Ekoparty, 8.8, HackGDL, BugCON, Pwnterrey, and others. I currently teach the Digital Forensics, Malware Analysis, and Incident Response modules in an information security diploma program at UNAM (Universidad Nacional Autónoma de México).

Certifications: GREM, GCFA, GCFR, eCTHP, CHFI.

--

Actualmente me desempeño como Incident Response Specialist en el Global Emergency Response Team (GERT) de Kaspersky, cuento con +6 años de experiencia realizando Respuesta a Incidentes, Análisis Forense Digital, Análisis de Malware y Reversing; previo a dedicarme a DFIR laboré 2 años como Penetration Tester.

He colaborado en distintos proyectos de Threat Hunting y Threat Intelligence.

Adicionalmente, he sido ponente en eventos internacionales como DEFCON (La Villa Hacker), BSides, Ekoparty, 8.8, BugCON, etc.

Actualmente soy profesor de los módulos de Análisis Forense, Análisis de Malware y Respuesta a Incidentes en un diplomado de seguridad de la información de la UNAM.

Certificaciones: GREM, GCFA, eCTHP, CHFI.

Eduardo Chavarro Ovalle, DFIR Group Manager for Americas, member of Kaspersky GERT Team. Student of DBA in ML and AI and MSc in Cybersecurity with more than 20 years of experience in cybersecurity, DFIR, eDiscovery, and threat analysis. GCIH | GRID | GCFA | CISM | CHFI | CPTE | SFCP | ITIL.

Embedded Systems Village - Sunday - 10:00-13:59 PDT

Discover how easy it is to fingerprint and control nearby BLE devices with a tap on your phone - yes, including iPhone that gets BLE superpowers with with an external ESP32. Scan remotely, clone and simulate BLE devices, test a popular headset for known vulnerabilities (or perhaps uncover a new one?) and take control of a robotic dog. Already know some BLE? Crack open our smart safe and claim the BLESPloit hardware reward inside!

Seasoned trainer, speaker and IT security consultant with over two decades of expertise. Developed secure embedded systems certified to use by national agencies, participated in dozens assessments of systems, applications, firmware and hardware security for leading financial companies, largest manufacturers and innovative startups. Currently focuses on security research of new technologies (especially Bluetooth Low Energy and NFC/RFID) and provides training in regards to security of devices - based among others on contemporary electronic access control systems and smart locks. Beyond consulting on secure design for various software and hardware projects, impulsively acquires more and more BLE and NFC devices and enjoys reversing and breaking them. Loves sharing his knowledge via trainings, workshops, talks and open source hackme's (https://www.smartlockpicking.com/) – at OrangeCon, BlackHat, HackInTheBox, Hardwear.io, HackInParis, Deepsec, Appsec EU, BruCon, Confidence, and many others, including private on-demand sessions.

IoT Village - Sunday - 10:00-13:59 PDT

Join the Ludlow Institute Surveillance Mission. Dump firmware, capture packets, probe APIs, or tear devices apart however you like. Prizes up for grabs.

AppSec Village - Sunday - 11:10-11:40 PDT

Shared threat frameworks have enabled consistent communication and coordination across vulnerability researchers, PSIRTs, vendors, and defenders. However, as attackers increasingly operate at the application layer (abusing software supply chains, runtime behavior, and trusted cloud workflows) defenders face challenges applying existing models consistently. This session presents lessons from the Application Attack Matrix, a community-driven research effort involving contributors from Mandiant (Google Cloud), Microsoft, AWS, Meta, Oligo Security, and others, and uses the ByBit / Safe{Wallet} incident to illustrate why application-layer technique modeling is increasingly important.

J. Fridley is a Senior Solutions Engineer at Oligo Security, helping teams secure modern cloud environments with deep runtime visibility. He previously led and supported Solutions Engineering teams at Snyk and has a background as a software engineer and technical project lead. J also brings nearly two decades of military service with the U.S. Navy and Army National Guard.

OSINT For Good Community - Sunday - 10:00-13:59 PDT

The OSINT Educational Series is a 3-level series that introduces Open-Source Intelligence (OSINT). It covers data collection, social media analysis, and investigative techniques, showing how publicly available information is used in cybersecurity and intelligence. Volunteers will be on hand to help you get started and answer questions if you get stuck! Complete all 3 levels and earn a digital badge!

AppSec Village - Sunday - 11:50-12:20 PDT

AI made finding and exploiting bugs almost free. In one month, Anthropic's Project Glasswing surfaced over 10,000 high and critical bugs and patched fewer than 100. The maintainers on the receiving end are asking Anthropic to slow down, because they can't fix the bugs fast enough.

If one model can bury the world's best-funded security teams, what happens to the 1-to-5 person team with little security budget and a backlog now growing at machine speed?

This talk shows you how to build SPAR (Scan, Prioritize, Auto-fix, Rewrite): a remediation pipeline that chains call-graph reachability, EPSS percentiles, and SSVC decision logic into triage a small team can run, then routes the ones that matter through AI patch generation behind a regression-aware verification harness.

Mohan is a security leader with over a decade of experience in security architecture, engineering, and operations. He has a strong interest in developing robust security programs and a proven track record of creating proactive security roadmaps and strategies aligned with business objectives. He constantly seeks ways to elevate security processes and culture to the next level.

Naveen is a Security Researcher with over 9 years of expertise specializing in AI, application, and cloud security. He invented 5 patents in Agentic Security space.

He possesses extensive knowledge in all aspects of product security, including threat modeling, DevSecOps, API security, and penetration testing. He is passionate about integrating security into the SDLC from design to deployment, ensuring the early detection and mitigation of vulnerabilities.

ICS Village - Sunday - 10:00-10:30 PDT

What does the global attack surface of operational technology actually look like at internet scale? We built IRONMAP, a purpose-built OT/ICS intelligence platform, to find out — and the answer is both larger and more disturbing than we expected.

Over the course of this ongoing research project, IRONMAP has catalogued over 5.5 million ICS/OT-facing assets across the public internet, with more than 2.25 million flagged as high-risk. Using deep protocol fingerprinting across all major industrial protocols — EtherNet/IP (CIP), Modbus TCP, Siemens S7, DNP3, IEC 60870-5-104, OPC-UA, BACnet/IP, Omron FINS, GE SRTP, Tridium Fox, and more — IRONMAP goes well beyond port scanning to perform authenticated protocol enumeration, live register reads, and tag harvesting using PLCDISCO, our multi-protocol OT scanner.

This talk presents a ground-level statistical portrait of the exposed OT internet: which protocols dominate, which sectors are most exposed, how vendor market share looks through the lens of deep insight and where in the world the highest concentrations of exposed critical infrastructure live (spoiler: it is not all China). We will walk through what over 242,000 EtherNet/IP devices look like when you enumerate their CIP identity objects, what ~500,000 Modbus devices expose in their holding registers, and what the live tag names of real PLCs tell you about what processes they are running.

We then turn to a specific and underappreciated issue: Automatic Tank Gauges (ATGs). IRONMAP found 149 confirmed ATG systems directly exposed to the internet, the majority of them Veeder Root TLS-350 and TLS-450 units — the dominant ATG platform at commercial fueling facilities across North America. These systems, reachable via the Guardian ASP protocol on TCP/10001, require no authentication on older firmware and respond to a simple serial-style command set with:

• Current fuel volume per tank, in gallons
• Product type (Unleaded, Premium, Diesel, Jet-A, Heating Oil)
• Live alarm states (high water, leak detection, low fuel, overfill)
• Delivery event history and timestamps
• Up to 8 tank probes per unit

The implications are significant. Exposed ATGs reveal not just that a facility has fuel storage, but how much, what kind, and when deliveries occur — operational patterns that are directly relevant to physical security and supply chain intelligence. IRONMAP discovered ATGs at locations that include commercial truck stops, bulk fuel terminals, and sites with product profiles consistent with aviation or military use. We will demonstrate a live walk-through of what an unauthenticated session reveals, discuss the responsible disclosure posture we have taken, and present mitigation guidance for asset owners.

Attendees will leave with a realistic, data-grounded view of the exposed OT landscape — not a cherry-picked set of scary screenshots, but statistically representative findings from a 5.5-million-asset dataset — plus actionable context on the ATG exposure class and how to find and fix it.

Matt Caldwell is the founder of Tophat Security, cyber security firm specializing in innovative OT/ICS software and tools, red team operations, and critical infrastructure research. With over a decade of experience in industrial control system security, Matt has assessed environments spanning oil and gas, electric utilities, water treatment, manufacturing, and federal government. He built IRONMAP as a research platform to continuously map the internet-exposed OT attack surface at scale, applying it to build threat intelligence, support disclosure efforts, and develop data-driven visibility into the global ICS exposure problem. Matt holds relevant certifications in cyber security and penetration testing and has presented research at global OT/ICS security conferences. He is based in Athens, Georgia, and speaks regularly with asset owners, government stakeholders, and research organizations on OT exposure topics.

Aerospace Village - Sunday - 10:00-13:59 PDT

Experience the effects of tampered engine performance data as you take the controls on a departing flight. Feel for yourself how vulnerabilities in electronic flight bags can have a physical impact inside the cockpit.

Cloud Village - Sunday - 11:50-12:30 PDT

Malware loaders used to advertise themselves with throwaway domains, fragile hosting, and obvious command-and-control infrastructure. Foxveil is a hard reset in loader tradecraft. Less attacker-owned infrastructure, less disk-heavy execution, fewer static clues, and more abuse of platforms defenders see every day. This newly documented loader stages payloads from our most trusted and favorite cloud-native tool chains: Cloudflare Pages, Netlify, and Discord attachments, executes shellcode largely in memory, establishes persistence through masqueraded Windows artifacts, and actively rewrites analysis-significant strings at runtime to make reverse engineering and static detection harder. Across two observed variants, Foxveil combines several pieces of modern tradecraft into one compact initial-stage loader. One variant spawns a fake svchost.exe and performs Early Bird APC injection into the target process before it fully resumes. Another pulls shellcode from Discord attachments and executes it through self-injection. Both stage follow-on payloads from trusted platforms, drop files into SysWOW64 under names designed to blend into normal Windows noise, and use runtime string mutation to corrupt keywords such as beacon, meterpreter, shellcode, and even fox itself. This talk walks through the full Foxveil infection chain, from staging and shellcode delivery to persistence and follow-on deployment, and examines what makes this loader part of a broader shift in attacker and malware tradecraft by comparing both variants. The real story is not just cloud-hosted staging. It is the emergence of a loader model that borrows trust instead of building infrastructure. Foxveil examines what modern initial-stage malware looks like when it is designed for rotation, ambiguity, and survival.

Shani Kurtzberg is an XDR Team Lead at Cato Networks and member of Cato CTRL. She leads the Threat Intelligence and XDR Detection Engineering initiatives. Prior to Cato, Shani served in the Israeli Air Force (IAF) as a Security Analyst, leading SOC operations to protect critical systems. Shani holds a Master of Business Administration (M.B.A.) from Peres Academic Center, specializing in Marketing and Product Management.

Zohar Buber is a security analyst in Cato Research Labs at Cato Networks. He focuses on network protocol analysis and malicious traffic detection, specializing in threat identification using network-based methods. He previously worked at Radware, where he examined threats in the DDoS industry. Zohar holds B.A focused in Business Administration, Information System Analysis // Zohar Buber, zohar@devtalks.me

Social Gatherings/Events - Sunday - 11:00-12:59 PDT

Free ham radio exams return to DEF CON 34! Partake in this hacker “rite of passage” by getting your license at DEF CON, presented by the Ham Radio Village.

While anyone is able to listen in to amateur/ham radio transmissions, only those who have an amateur radio license are able to fully partake in the “oldest hacker hobby”. With your license, you’ll be authorized by the FCC to transmit up to 1,500W on designated frequencies, build/modify radios & antennas, and even administer your own exams! Additionally, having your ham radio license can improve your resume as it is a well-recognized proof of technical and regulatory knowledge when it comes to all things radio.

About The Exam

In the US there are 3 current levels of amateur radio license - Technician, General, and Amateur Extra. You can progress through the levels by taking a series of multiple-choice exams showing increasing breadth of knowledge. Most folks at DEF CON looking to become a ham take just the technician exam.

The technician exam is a 35 question, multiple choice exam. Questions come from from a public question pool of 400 questions. Because of that, the most popular way folks at DEF CON prepare is by reading through all 400 questions before the exam, and learning hands on once you get licensed. Many study resources exist - most people recommend ham.study.

Signing Up

Who may register for this testing session:

• Anyone with an interest in obtaining a new Amateur Radio license or upgrading their existing licenses.
• You may take multiple elements in a single appointment; we just ask that you have studied and are ready to pass.

Fees

• All license examinations administered by the Laurel VEC are free to all
• After passing, Laurel VEC will submit your application to the FCC. On acceptance you will receive an email from the FCC directly with instructions to pay the $35 application fee.

Questions

If you have any questions leading up to DEF CON, come visit us on the Ham Radio Village Discord server (discord.gg/hrv) and let us know what questions you have. During the conference, come visit the Ham Radio Village to learn all things ham radio, including the studying, testing, and licensing process.

Social Gatherings/Events - Sunday - 12:00-12:59 PDT

We know DEF CON and Vegas can be a lot. If you're a friend of Bill W who's looking for a meeting or just a place to collect yourself, DEF CON 34 has you covered. Join us throughout the conference in room W301. Meetings will be Thursday, Friday, Saturday, and Sunday.

Misc - Sunday - 12:00-12:59 PDT

Create a custom bracelet to wear or trade, each featuring a special bead with a hidden message or symbol of empowerment. This tactile, low-key activity is perfect for starting conversations and forming connections across the community. No crafting experience needed, just good vibes and open hands. Join us during this hour for a WISP bead to add to your bracelet (while supplies last)!

Red Team Village - Sunday - 12:00-13:59 PDT

This presentation takes a practical, demo-driven approach to exploitation, demonstrating how a buffer overflow vulnerability can still serve as an entry point to compromise modern industrial infrastructures. The session is approximately 90% hands-on and 10% theoretical. The talk walks through the full attack chain, starting from initial exploitation and progressing to the development and execution of multistage shellcode. This shellcode establishes communication with a remote Command and Control (C2) server, retrieves an additional payload, and executes it directly in memory, bypassing traditional detection mechanisms. Once the environment is compromised, the session demonstrates how an attacker can gain full remote control, enabling command execution, lateral movement, and exfiltration of sensitive data, including critical assets such as licenses and proprietary industrial information. The talk also includes interaction with real-world devices such as RTUs (Remote Terminal Units), showing how malicious actions can directly impact industrial operations. In critical scenarios, this can lead to disruptions in essential services, including failures in energy systems and potential blackouts. The content is based on real-world pentesting experience conducted in an energy sector company in Brazil, providing a practical and applied perspective on risks in ICS/SCADA environments. The goal is to demonstrate how modern attacks combine vulnerabilities with advanced techniques, reinforcing the need for robust security strategies to protect critical infrastructure.

Cybersecurity researcher focused on Pentesting and AppSec, also serving as a Practical / Hands-on Speaker. He also dedicates part of his research to critical infrastructure security (ICS/SCADA), exploring the intersection between classic vulnerabilities and industrial environments. He has over 18 years of experience in offensive security and practical application exploitation.

He has participated in research and development projects focused on vulnerability exploitation and offensive security.

Specialized in 0day discovery and exploit development, he has over 135 published CVEs and is ranked in the Top 10 contributors on VulDB https://vuldb.com/users.top.

Additionally, he has published multiple exploits and technical papers publicly available https://www.exploit-db.com/?author=12136 and https://packetstorm.news/files/author/8470/1.

His work focuses on real-world vulnerability exploitation, including advanced scenarios such as memory corruption, buffer overflows, and complex environments.

He is the creator of https://yrprey.com, an educational framework that brings together more than 20 vulnerable applications based on the OWASP Top 10, used for practical training in Application Security and Offensive Security https://owasp.org/www-project-vulnerable-web-application-directory.

He is also the driving force behind https://speakfy.io, a project focused on promoting Information Security events globally.

Furthermore, he develops application security-oriented tools, such as https://leapfix.co (static code analysis) and https://fitoxs.com, a dynamic application analysis platform powered by artificial intelligence.

Thiago Cunha is an offensive security specialist, or as he likes to put it: “professionally paid to break into systems before someone less friendly does.”

He currently works as a Red Team and Threat Intelligence Consultant at Banco Carrefour and as an instructor at the Kryfal, teaching future ethical hackers not to click on suspicious links.

Noob Community - Sunday - 11:00-12:59 PDT

Led by a seasoned security speaker with over 600 presentations under their belt and training from world-class Toastmasters, this interactive session completely bypasses the fluff to focus entirely on real-world delivery. This workshop is your chance to turn stage fright into stage might, equipping you with the tools to present with poise, project authority, and own the room.

AppSec Village - Sunday - 10:30-10:59 PDT

Most vulnerabilities aren't found because teams lack tools they persist because the cost of fixing them is too high. A finding without a concrete, context-aware fix is just noise developers learn to ignore. This talk walks through three real-world attack scenarios a secret leaked into git history, a compromised dependency in a supply chain attack, and an injection vulnerability introduced in a PR and shows how each is detected, mapped to OWASP Top 10:2025, and automatically remediated using AI running entirely on local infrastructure. No source code leaves the machine. The AI receives the vulnerable code block, CWE identifier, CVSS score, and OWASP category and returns a fix that is specific, correct, and ready to apply. Attendees leave with a working open-source tool and a new mental model for what AppSec remediation can look like.

I’ve been working as Head of Technical Advocacy at SCYTHE, Founder & Investor at CROSS-INTEL, Advisor & Investor at Sherlockeye, BSides Porto Organizer, Red Team Village Director (DEF CON), Senior Advisor Raices Cyber Academy, Founder of Red Team Community (Brazil and LATAM), AWS Community Builder, Snyk Ambassador, Application Security Specialist and Hacking is NOT a crime Advocate. International Speaker at Security and New technologies events in many countries such as US (Black Hat & Defcon), Canada, France, Spain, Germany, Poland, Black Hat MEA - Middle-East - and others, I’ve served as University Professor in Master Degree in Portugal, Graduation and MBA courses at Brazilian colleges, in addition, I'm Creator and Instructor of the Course - Malware Attack Types with Kill Chain Methodology (PentestMagazine), PowerShell and Windows for Red Teamers(PentestMagazine) and Malware Analysis - Fundamentals (HackerSec).

Black Hat US 2025 - https://blackhat.com/us-25/arsenal/schedule/presenters.html#filipi-pires-46329 Black Hat US 2024 - https://blackhat.com/us-24/arsenal/schedule/presenters.html#filipi-pires-46329 Black Hat MEA 2025 - https://blackhatmea.com/speaker/filipi-pires-0 Black Hat MEA 2024 - https://blackhatmea.com/speaker/filipi-pires DEF CON 33 / 32 - https://sessionize.com/filipi-pires/ DEF CON - Adversary Village - https://adversaryvillage.org/adversary-events/DEFCON-33/Filipi-Pires/

DEF CON Talks - Sunday - 11:30-12:30 PDT

1. OSS-Fuzz Issue #483856591 — Original crash report filed under php-fuzz-function-jit target
2. PHP Source: Zend/zend_operators.c, concat_function() — https://github.com/php/php-src/blob/master/Zend/zend_operators.c
3. php/php-src#16726 — Array-element UAF (second-chain vulnerability used to bypass mod-16 alignment barrier)
4. Zend MM Internals: https://www.phpinternalsbook.com/php7/memory_management/zend_memory_manager.html
5. CVE-2022-29072 — Prior 7-Zip zero-day by the same researcher (Kağan Çapar), demonstrating track record in vulnerability research
6. CVE-2026-5201 — gdk-pixbuf heap buffer overflow discovered by the same researcher, acknowledged by Red Hat (CVSS 7.5)
7. W3Techs PHP Usage Statistics — https://w3techs.com/technologies/details/pl-php
8. V8 Sandbox Design (2024) — Referenced in comparative interpreter memory model analysis

Can Oztas is a security researcher with applied R&D experience across several key sectors, including defense, finance, and telecommunications. His background encompasses AppSec, vulnerability research, and offensive security engineering. He is currently a PhD student focusing on the intersection of Artificial Intelligence and cybersecurity.

Kağan Çapar is a Vulnerability Researcher with over 15 years of experience. His research focuses on binary exploitation, fuzzing, and zero-day discovery across widely deployed software.

Blacks In Cyber Village - Sunday - 10:00-10:59 PDT

Most cybersecurity workshops teach you how to do the work. This one teaches you how to own it. Tyrone E. Wilson Army veteran, CISO, and founder of Cover6 Solutions breaks down what it actually takes to transition from practitioner to principal: building a service-based firm, pricing your expertise, navigating GovCon as an SDVOSB, and sustaining a business that doesn't depend on your last client check.

Tyrone E. Wilson is a U.S. Army veteran, cybersecurity executive, and founder of Cover6 Solutions a Service-Disabled Veteran-Owned Small Business delivering vCISO and compliance services to organizations across the public and private sectors. With over two decades of experience in security leadership, they built Cover6 from the ground up while simultaneously growing a 9,000+ member cybersecurity community for career changers and professionals of color. They are the creator of the Breaking Into Cyber framework and host of the Cover6 Community a free resource for anyone navigating the industry without a built-in network. Tyrone has delivered training for Blacks In Cybersecurity and speaks regularly on the intersection of entrepreneurship, community, and cybersecurity career development.

Middle Easterns & Africans in Cyber Security (MEACS) - Sunday - 10:00-10:59 PDT

If yesterday was where we came from, today is where we are going. The same regions that gave the world algebra and the first codebreakers are now home to some of the fastest-growing security communities on the planet, from Lagos to Cairo to Riyadh, alongside a diaspora shaping the field from inside every major company and conference. This talk picks up where the kickoff left off and moves from history to right now: the researchers, founders, defenders, and organizers carrying the work forward, the obstacles that still stand in the way, and what it takes to build a career and a community when the industry has not always made room for you. We will talk honestly about representation, mentorship, and momentum, and about the role a space like MEACS plays in turning a shared heritage into a shared future. Come for the story, stay to find your people.

Ezz Tahoun is an award-winning cybersecurity data scientist recognized globally for his innovations in applying AI to security operations.

He has keynoted, trained & presented at BlackHat US, Sector, MEA, Asia & EU, DEFCON, SANS Summits, all the top Bsides, Securityweek ICS Conference and GISEC among many others.

His groundbreaking work earned him a gold edison award and accolades from Yale, Princeton, Northwestern, NATO, Microsoft, and Canada's CSE.

At 19, Ezz began his PhD in Computer Sci at the Univ of Waterloo, quickly gaining recognition through over 20 influential papers and open-source tools.

His experience includes leading advanced AI security ops projects for Orange CyberDefense, Forescout, RBC, and Huawei US.

He holds certifications such as GIAC Advisory Board, aCCISO, CISM, CRISC, GCIH, CEH, PMP and GCP-Cloud Architect, and served as an adjunct professor in cyber defense and warfare.

Bug Bounty Village - Sunday - 11:00-11:30 PDT

Every year the BBV badge gets one new thing we don't know how to do yet. Last year: epoxy. This year: a real 0.96" OLED behind the acrylic, giving a whole new vibe to the hacker laptop screen. Plus RGB for whichever team you're on, and a fun CTF.

Abhinav's artistry comes from the times he used to sneakily paint drawings made by his sister. His hacking career began as a toddler, disassembling his toys but never putting them back together. His entrepreneurial roots come from selling snacks at a school fair and making a loss of ten bucks, his entire pocket money. Having learned how not to make money, he launched Hackerware.io - a boutique badgelife lab with in-house manufacturing - which has grown over the past ten years into a global presence across 20+ countries. He's often spotted at conferences around the world - hosting hardware villages or pulling off the kind of random shenanigans that earned him the Sin CON Person of the Year 2025 award.

DEF CON Training - Sunday - 08:30-17:30 PDT

Contests - Sunday - 10:00-10:30 PDT

Winners of the Game Hacking Village CTF will be awarded their prizes.

Contests - Sunday - 10:00-11:59 PDT

A presentation by the challenge creators about how the Game Hacking Village CTF along with an open QnA about challenges.

CodeBloom - Sunday - 12:00-12:59 PDT

Input, output, and variables are the building blocks behind every single program you've ever used, and once you understand them, you're well on your way to writing your own code! In this session, we'll play some fun games together to show how these ideas already show up in your everyday life, then practice matching them to real Python code. All are welcome, no coding experience required. If you've ever wanted to get involved in our community or teach our classes, this would be a great time to stop by and learn more!

CodeBloom - Sunday - 10:00-10:59 PDT

Have you ever had to do the same thing over and over and thought, there has to be an easier way? Good news, there is, and it's called a loop! Come play some classic schoolyard games with us and discover that you've been using loops in real life all along. Then we'll show you how programmers use for loops and while loops to make computers repeat tasks automatically, whether that's counting to 100 or spawning enemies in your favorite video game. No experience needed, just come ready to play! If you've ever wanted to get involved in our community or teach our classes, this would be a great time to stop by and learn more!

Recon Village - Sunday - 10:00-10:45 PDT

People are getting hired and trusted every day. Some of them do not exist at all, yet they still pass interviews, collect paychecks, and gain access to sensitive systems. Campaigns attributed to the DPRK have shown that this threat is very real. So how do you catch a ghost with a resume? Attendees will learn practical OSINT techniques for spotting fake personas and receive a checklist for thorough background checks. They will see these methods applied through two cases based on a true story, illustrating how these personas succeeded, how one could have been prevented, and where OSINT reaches its limits. These techniques not only help attendees detect fake personas but also provide practical ways to protect their own privacy and control what personal information is visible online.

Michael is a Product Security Specialist at SAP, working with the SAP Cloud Infrastructure security team. His focus areas include vulnerability management, secrets management, and building secure internal services.

He obtained multiple industry certifications such as OSCP, GCPN, and CISSP.

A healthy dose of paranoia led him to explore OSINT and the surprising power of publicly available information.

Beyond his day-to-day work, Michael is an active member of the cybersecurity community and helps organize BSides Luxembourg.

Rishi is a London-based security researcher with over five years of hands-on experience in IT. He currently specializes in vulnerability research, threat intelligence, and enterprise risk analysis. His current focus lies in identifying and analyzing zero-day vulnerabilities and emerging CVEs, often working to reverse engineer exploit mechanics and build detection logic before public weaponization. Rishi’s work spans both offensive and defensive domains—developing threat models based on real-world TTPs, crafting custom detection rules, and automating reconnaissance pipelines to uncover exploitable misconfigurations and exposed assets. He is particularly active in attack surface management (ASM) and OSINT, where he leverages DNS enumeration, passive data correlation, and large-scale infrastructure scanning to surface unknown entry points and map adversary-accessible exposure. Outside of research, Rishi integrates findings into operational tooling and supports data-driven prioritization strategies to bridge technical risk and business impact. His work reflects a deep commitment to adversary-informed defense and proactive discovery across modern hybrid environments.

Red Team Village - Sunday - 14:00-14:59 PDT

Critical infrastructure protocols designed in the late 70s were never built to handle a modern adversary. In this hands-on Tactic, we move beyond theoretical slides to execute a high-fidelity, nation-state-style operation against a municipal water treatment facility. Using a portable Software-in-the-Loop (SiL) environment, participants will experience the raw tradecraft of industrial sabotage without the need for a six-figure hardware rack.

This session focuses on "Living-off-the-Ladder" (LotL)—the art of using legitimate industrial function codes to perform unauthorized actions. You will not be dropping malware; you will be programmatically manipulating the physics of the plant using the same TTPs seen in recent geopolitical conflicts.

The Mission (30–60 Minute Sprint):

Industrial Interrogation: Use unauthenticated DNP3 and S7comm discovery to fingerprint PLCs and map the process logic—capturing vendor data and firmware versions silently.

The Memory Heist: Execute a "Credential Harvest" (T0861) by programmatically reading PLC holding registers to recover plaintext maintenance keys.

Coordinated Sabotage: Trigger a "Slow-and-Low" chemical setpoint override (Modbus FC16) across multiple facilities simultaneously, observing real-time physical feedback from the simulated plant sensors. • Phase 1: Automated multi-protocol fingerprinting and asset discovery. • Phase 2: Executing a "Memory Heist" to extract plaintext maintenance credentials directly from PLC registers. • Phase 3: A coordinated "Slow-and-Low" chemical setpoint override, providing real-time visual feedback of the physical process failure.

Attendee Takeaway: Participants will build the muscle memory required to navigate OT environments and will leave with a deployable, containerized SiL framework to continue their own ICS research and detection validation at home. Attendees will leave with a deployable SiL framework and the "Living-off-the-Ladder" playbook to continue their own ICS research without the need for expensive hardware.

Blessen Thomas is an Independent Security Researcher.He has more than 13+ years of experience in Red Teaming, Appsec (Web, Thick, API & Mobile Apps), Smart Watch Wearable Application Penetration Testing, Mobile Penetration Test (iOS,Android,Windows platform), IoT,OT ,mainframes,SAP,SWIFT,RPA,Cloud,ATM,KIOSK,Vulnerability Assessment and Network Penetration Test,Physical Covert Entry,Wireless assessments,Telecom(2G,3G,USSD) etc. for several enterprise companies and financial institutions all across the globe. He is a B.Tech in Information Technology from Anna University and holds industry certifications such as SANS GPEN,CRTO,OPST,CREST CRT(PEN),CREST CPSA,OSCP,CRTP,OSWP,C)PTE,CEH,CHFI. He has been listed and acknowledged in various “HALL OF FAMES” for various companies such as Oracle,Sony, Kayako, Appcelerator, Hotgloo, Meldium, Splunk and many more for responsible disclosure. He has been a bug bounty hunter and contributor for the OWASP Mobile Testing Guide Project(MSTG),Tamer OS, Seclists, OWASP top 10 API, OSSTMM, Awesome Mainframe Hacking,RvR,WAVSEP Benchmark sectool projects. His research training/talks has been accepted into various security conferences like Hack in the Box-Dubai,Hacktivity -Hungary, CanSecWest -Canada,OWASP Appsec EU- London -UK,OWASP Appsec Europe-Italy, RootCon-Philippines ,OWASP PH,OWASP New Zealand Day, Infosec SouthWest,Austin,Texas, FSec-Croatia, Hackbeach, Hackfest, Shakacon,ITWeb-South Africa, Jordan Cyber Security Summit, HITCON-Taiwan, OWASP AppSec-Bucharest, OWASP Appsec Africa-Morocco,CircleCityCon,OWASP Botswana,CactusCon,Bsides-London,Prishtina,Aarhus,Vilnius,Elbsides,Kristiansand,Athens and many more. He has been invited as Speaker for Radio Talk Shows for All India Radio. He spends his leisure time playing drumkit and percussion.

Javier is a Red Team Operator and Malware Developer specializing in offensive engineering, adversary emulation, and custom tooling development. Holding certifications such as OSEP and CRTO, he has delivered high‑impact security engagements across both consulting environments and in‑house security teams. His work focuses on crafting stealthy implants, evasion techniques, and automation‑driven offensive capabilities. Passionate about applied research, he explores the intersection of malware development and AI‑augmented offensive security to help organizations strengthen their resilience against modern threats

Wojciech Poparda is a cybersecurity consultant. He helps organizations proactively defend their digital infrastructure by thinking like an adversary. Leveraging a deep foundation in Offensive Security, he specializes in designing resilient Security Architectures that bridge the gap between complex attack vectors and enterprise defense, with a sharp focus on Cloud Security and Identity & Access Management (IAM).

His approach is backed by rigorous technical validation, holding industry-leading certifications including OSCP, CRTE, CRTP, CRTO, CPTS, CWES, AWS Certified Solutions Architect - Associate and AWS Certified Security - Specialty. He is also an Associate of ISC2, having successfully passed the CISSP exam.

Beyond the terminal, he channels the discipline, focus, and resilience required for cybersecurity into his life as a triathlete. As an IRONMAN European and World Championships finisher, he brings the same endurance and dedication to solving complex security challenges as he does to the race course.

DEF CON Talks - Sunday - 10:00-10:30 PDT

What if your keystroke injection implant could be triggered from kilometers away, through walls, without WiFi, cellular, or line-of-sight? What if the entire Meshtastic network relayed your commands for you? M.I.A. (Mesh Injection Apparatus) is a new open-source offensive tool that combines USB HID injection with LoRa mesh networking. Plant a device during brief physical access, then trigger payloads remotely- across a building, a campus, or a city, using Meshtastic's encrypted mesh protocol. No internet required. No WiFi range limitations. Just long-range, low-power radio that blends into the growing ecosystem of LoRa devices. This talk covers the complete build: understanding USB HID at the protocol level, reverse-engineering Meshtastic's packet structure and AES-CTR encryption, implementing a DuckyScript parser from scratch in C++, and designing custom PCB hardware. I'll demonstrate remote-triggered injection over the mesh network, discuss operational considerations for red teams, and release all firmware, schematics, and tooling as open source. MIA represents a new class of implant, one that stays connected when traditional C2 channels fail.

https://www.blackhillsinfosec.com/introducing-lora-long-range-wireless-technology-part-1/

(I would like to cite Venky Raju's talk, but I could not find it online. I will try to reach out to him.)

Benito Sauceda is a 19-year-old university student who saw a talk at a small regional conference, got inspired, and spent the next few months procrastinating homework to build his own version from scratch. It escalated quickly.

His proudest accomplishments stem mostly from growing cybersecurity communities, a curious side effect of talking about hacking with everyone around him. He founded cybersecurity clubs at both his high school and local community college, taught cybersecurity to 8–12th grade students through the Bay Area Cyber League, and helped develop regional cybersecurity competitions for 16 Bay Area community colleges.

This is his first DEF CON talk.

DEF CON Talks - Sunday - 11:00-11:59 PDT

In 2025, Amnesty International, in collaboration with Google TAG, released a write-up of an in-the-wild chain of USB Linux kernel vulnerabilities which was used to compromise mobile devices.

Whilst the vulnerabilities themselves were disclosed, no details on how these vulnerabilities could be exploited were provided. This led us to deep dive into these issues to determine how they could be leveraged for arbitrary code execution.

This is the story of exploiting one of these vulnerabilities (CVE-2024-53104), an out of bounds write in USB Video which offered a brilliant exploit primitive leading to highly reliable code execution when chained together with an information leakage vulnerability.

In this talk we will first discuss the in-the-wild vulnerabilities, moving on to providing background of USB specifics for several device classes and coverage guided fuzzing for finding new issues.

We will then move onto a more recent information disclosure vulnerability CVE-2025-38494 which could be leveraged to bypass KASLR.

An extensive deep dive into CVE-2024-53104 vulnerability will be performed (the OOB write) and we will discuss our novel technique used for exploitation of this issue and expose the power of the UVC_QUIRK_RESTRICT_FRAME_RATE quirk!

Finally, we will wrap up our talk with several demonstrations.

Alex Plaskett (@alexjplaskett) is an Associate Director within the Exploit Development Group (EDG) at NCC Group. Alex is a five-time Pwn2Own winner (desktop, mobile, embedded, and automotive) and has over 16+ years of experience in vulnerability research and exploitation. Alex has exploited vulnerabilities in a large range of high-profile products across many different areas of security. Alex is a frequent speaker at security conferences (e.g. BlackHat, OffensiveCon, Hexacon, HITB, BlueHat, POC, Troopers etc). Alex was previously leading security teams in Fintech, Mobile Security and Security Research) and just generally causing vendors to patch things on a regular basis!

Robert Herrera (@robert.herrera_) is a Lead Security Researcher within the Exploit Development Group (EDG) at NCC Group. Robert has extensive experience performing high-impact security audits and reverse-engineering for a diverse set of technologies ranging from automotive, modems, secure boot platforms, and wireless technologies. Robert has 9+ years of experience and has worn many hats over the years ranging from iOS Developer, Software Engineer, to Reverse Engineer.

DEF CON Talks - Sunday - 10:30-11:30 PDT

Browser-in-the-Middle (BitM) phishing is no longer just a research curiosity. Since its 2021 formalization, BitM has been cataloged by MITRE as an official attack pattern, recognized as a severe threat to MFA-protected web applications. Because the victim authenticates directly through the attacker's browser rather than their own, the technique effectively bypasses most traditional forms of MFA.

This talk presents two years of research on weaponizing BitM for advanced offensive operations. We investigated what novel attack techniques become possible when an attacker fully controls the browser the victim interacts with. This includes real-time keystroke logging, in-transit file interception and silent modification, session persistence that keeps operator access alive long after the victim logs out, and microphone/webcam capture achieved through social-engineered browser flows.

The practical validation of this research is P-BitM, the first open-source framework for Persistent Browser-in-the-Middle spear-phishing, which will be released at DEF CON 34. The "Persistent" in P-BitM carries its full offensive meaning: a single phishing click becomes a persistent beachhead. We will break down our core research, demonstrate these new attack vectors via demo videos, and showcase the capabilities of the tool.

https://link.springer.com/article/10.1007/s10207-021-00548-5 https://github.com/JoelGMSec/EvilnoVNC https://github.com/b3rito/peeko

Giacomo Lenzini is an Offensive Security Specialist and Red Teamer at EY Italy, and an independent security researcher. His work focuses on adversary simulation, red team operations, and penetration testing. He has received recognition from organizations such as NASA and has identified several vulnerabilities with associated CVEs.

Contests - Sunday - 10:00-11:59 PDT

Rogue Signal builds bespoke, technically driven interactive experiences rooted in hacker culture, game design, and immersive storytelling. Drawing from backgrounds in immersive theater, live events production, community building, and deep game design practice, Rogue Signal creates systems that transform participation into exploration.

Rather than relying on superficial gamification, Rogue Signal focuses on meaningful challenge design. Their experiences reward curiosity, experimentation, collaboration, and strategic thinking. From scavenger hunts to technical skill challenges to digital easter eggs, each activation is designed around the specific audience and environment it lives in.

At DEF CON, Rogue Signal brings that philosophy to Hac-Man. A Pac-Man–themed security challenge platform that blends retro inspiration with layered technical depth. Participants will engage directly with structured challenges that test logic, pattern recognition, foundational security and hacker knowledge, and progressively more advanced technical skills.

Hac-Man reflects the hacker mindset: iterate, experiment, fail, refine, break assumptions, and try again. It encourages collaboration where helpful, competition where motivating, and discovery at every level.

Attendees can expect: - Hands-on security challenges - Multiple subject-matter tracks - Layered difficulty levels - Scavenger style discovery elements - Competitive scoring and mission style progression - A welcoming but technically rich environment

Whether you’re new to security or already deep in the field, Rogue Signal’s space offers a place to test your thinking, sharpen your skills, and experience hacking concepts through play.

Participant Prerequisites

Participants will need access to a smartphone, tablet, or laptop in order to access gameplay content and view leaderboards. The experience is web-accessible and designed to function on standard modern devices.

No specialized hardware (e.g., Flipper Zero, SDR, etc.) is required. Foundational familiarity with basic computer use and logical problem-solving will be helpful, but no advanced security knowledge is required to begin. The game features layered difficulty tracks to accommodate both beginners and more advanced participants.

Noob Community - Sunday - 10:00-13:59 PDT

Contests - Sunday - 10:00-11:59 PDT

The Hacker Games is a series of hacker skills tests meant to challenge the hacker's knowledge of computer systems such as Binary -> Hex -> X conversion, Adapter -> Adapter knowledge, Keyboard Layout, and many more arbitrarily useless skills. Hackers will go head-to-head in a series of several skill-based games. BinHexAscii, Chopstick Challenge (a.k.a. Will it Flow), Keyboard Layout, Adapt or Die, ToS, and more! Can you hack it?

Participant Prerequisites

A box of computer-style adapters of no particular order would be very helpful.

Contests - Sunday - 10:00-11:59 PDT

HackFortress is back! Returning to DEF CON with a twist on our standard format. Two teams of players, 6 gamers and 4 hackers each, compete in a mashup of a jeopardy style CTF and a first person shooter. New this year, we're replacing our previous FPS of Team Fortress 2 with a web based version of the 2000's classic Quake 3!

While gamers are rocket jumping and sniping each other in Quake, hackers will be solving challenges in a variety of areas: web security, network security, cryptography, lock picking, social engineering, and more! Challenges range from beginner to advanced, from serious to absurd. During the competition, as both sides of the team star scoring points, the teams also earn points in the HackFortess HackConomy Store, in the store hackers can buy in game effects, both offensive and defensive, and much like the challenges, these effects range from serious to absurd.

With all of the contest being web based, both hacking and Quake, players MUST bring their own laptop (or whatever device they want to use) and a wired network adapter.

Grab your friends!

Ask that random stranger standing next to you in Linecon if they want to join your team!

Come play HACKFORTRESS!

Participant Prerequisites

All players will need to bring a laptop and wired network adapter. Since we are now using web based version of Quake 3 (which can run on players phones), we are no longer providing any gaming laptops.

Gamers: bring any gaming accessory of your choice, its your hardware, go for it

Hackers: bring lockpicks

Contests - Sunday - 10:00-11:59 PDT

Hacking CMMC is a hands-on cybersecurity competition designed to immerse participants in the practical aspects of the Cybersecurity Maturity Model Certification (CMMC). Through realistic, challenge-based scenarios, players explore common compliance gaps, security controls, and threats faced by defense contractors.

The CTF blends technical problem-solving with compliance-driven thinking, helping participants understand how security requirements translate into real-world incidents. It offers an engaging way to learn, test skills, and strengthen readiness for CMMC-aligned environments.

The CTF will be a Jeopardy-style CTF where every player will have a list of challenges in different categories. For every challenge solved, the player will get a certain number of points depending on the difficulty of the challenge.

Prerequisites

• Laptop with Internet Access

DEF CON Talks - Sunday - 14:00-14:30 PDT

One day, I woke up to a simple message from a friend: "What do you know about CAN bus?" Expecting him to have car trouble, I called him and asked, "What do you need?"

Turns out the car trouble was actually jetski trouble: he bought a Sea-Doo jetski for very cheap - but it came without a key. A quick research on his side showed that the jetski does not (like others from the time) use a simple magnet key: No, the jetski has a full, digital immobilizer system, and just the tools to diagnose and program in a new key cost more than the jetski. And zero public information is available on how this all works.

And so we dove in: from reverse-engineering the CAN bus diagnostics protocol and the electronic key protocol to designing our own freely programmable key and a Flipper Zero jetski diagnostic app, this talk goes into the weeds of hacking something that I didn't even know needed to be hacked: Jetskis!

Thomas Roth aka stacksmashing is a security researcher mostly focused on hardware and firmware. His work includes hardware attacks on processors & microcontrollers, building cheap JTAG tooling for the iPhone, and attacking a wide variety of embedded devices. He also runs a YouTube channel called stacksmashing about security, reverse engineering and hardware hacking.

Red Team Village - Sunday - 13:00-13:59 PDT

AI defenses are only as good as the analysts training them. This session exposes how attackers manipulate SOC analyst behavior to silently degrade AI baselines over time, no exploit required. We cover the mechanics of false positive injection, alert fatigue as a weapon, and misdirection. Then attendees step into the analyst's seat in a live browser-based simulation and experience how their own decisions poison the model.

4.5 years in the SOC. Junior Analyst to Team Lead. CPTS, CRTO, CRTE, OSCP and enough certs to wallpaper a small room with some left over. Zombie has spent the better part of half a decade watching how defenders think, how they triage, how they get tired, and how attackers can weaponize all three. By day he leads a SOC team. By night he's learning everything he can about breaking the things he built. Still technically blue team. Emphasis on technically.

Lee McWhorter, Owner & Chief Geek at McWhorter Technologies, has been involved in IT since his early days and has over 30 years of experience. He is a highly sought after professional who first learned about identifying weaknesses in computer networks, systems, and software when Internet access was achieved using a modem. Lee holds an MBA and more than 20 industry certifications in such areas as System Admin, Networking, Programming, Linux, IoT, and Cybersecurity. His roles have ranged from the server room to the board room, and he has taught for numerous universities, commercial trainers, and nonprofits. Lee is the SWAG Master and a Core Staff member for the Red Team Village at DEFCON; and works closely with the Pacific Hackers Association, Dark Arts Village at RSAC, Texas Cyber Summit, CompTIA, and the CompTIA Instructor Network as a Speaker, SME, and Instructor.

IoT Village - Sunday - 10:00-13:59 PDT

Using tools like OpenOCD and Segger J-Link Mini, we’ll guide you through modifying the boot 'init=' process in memory via JTAG, forcing the device into a single user mode shell via UART.

Bug Bounty Village - Sunday - 11:30-11:59 PDT

Take a look behind the scenes at five years of custom DEF CON challenge coins from DEF CON 30 through DEF CON 34. This session walks through the entire lifecycle of these unique hardware puzzles, exploring the inspiration behind their designs, step-by-step solutions, and how the rise of AI is shifting the future of cryptographic challenges.

Ariel Garcia (arl_rose) is a security researcher with over a decade of experience in pentesting, bug bounty, and cybersecurity community building. Blending hands-on offensive security with deep community ties, his work is a driving force within the hacker ecosystem. He has organized multiple Live Hacking Events, co-founded the global Ambassador World Cup, and led community initiatives spanning content creation, Discord management, and security instruction. A DEF CON attendee since 2014, Ariel is the co-founder of the Bug Bounty Village, providing a dedicated space to support the researchers and organizations shaping the field.

OSINT For Good Community - Sunday - 10:30-10:59 PDT

How long do you think it takes to find sensitive information on the executives of a major company? It is sometimes wrongly believed that VIPs have better digital hygiene than us regular humans, that their information is not present on any people search site, and that their dubious online past has been wiped from the internet. This is false. Throughout this talk I will show you how I approach a vulnerability assessment on the c-suite of a multinational corporation. From the boring stuff like note taking and report writing, to the really exciting stuff like wacky sources and fun findings.

Sarah Muriel is an Intelligence Analyst from Mexico with more than 6 years of experience in open source investigations, currently working with the Attack Surfaces of companies all over the world. In her spare time she likes participating in various international OSINT related CTFs and developing retro-style websites. She’s also fairly active in the cybersecurity community, being part of the organization team for one of Mexico’s top conferences.

Bug Bounty Village - Sunday - 12:00-12:59 PDT

In this talk, the CTF.ae team goes behind the scenes of Xenoptic: how they built this year's BBV CTF lab, the new challenges they hit along the way, and a walkthrough of some of the most interesting vulnerabilities they planted in it.

Adham is an offensive security consultant by day, but when the sun sets he returns to what he enjoys most: CTFs. This year he led the team building Xenoptic, working across application security, UI/UX and game balance.

Contests - Sunday - 10:00-11:59 PDT

"Your prompt becomes a character, a machine, or an attack—and every word can change what happens next.

HSPACE: AI Battlegrounds is a collection of three hands-on games that turn natural-language and visual prompts into playable systems:

Wizard of Prompts — Write a short prompt to generate a pixel-art hero with unique stats and skills, then guide that hero through a five-boss, card-based battle campaign. Experiment with wording, build a stronger character, and see how the game's AI responds to prompt-injection attempts.

Prompt Prix — Describe your ideal race car and watch the AI convert your prompt into a validated vehicle build. Race across changing track conditions, study the result, and tune your prompt to improve the car's speed, grip, stability, and final ranking.

Vision Breaker — Face a vision-language-model security guard that decides who may enter. Use signs, screens, clothing, props, and visual prompt-injection techniques to influence its observations, bypass its checks, and progress through three escalating stages—from changing a decision to hijacking a command.

No joystick, coding experience, or prior security knowledge is required. Come experiment, iterate, and discover how small changes in language and visual context can reshape an AI agent's behavior.

Participant Prerequisites

Anyone who has used AI at least once is welcome. A camera-enabled smartphone or laptop with a modern web browser is recommended for Vision Breaker; camera permission is required for live play. Game stations and physical props are provided at the booth.

Participants can also play on their own smartphones or personal laptops. The competitive portion of AI Battlegrounds will be conducted online."

Social Gatherings/Events - Sunday - 09:00-11:59 PDT

Our human registration process this year will be very similar to previous years. Please be patient. All of the times listed here are approximate.

Basics

Who needs a badge?

A badge is required for each human age 8 and older.

Human?

You are a human if you do not know otherwise. People that are not humans include goons, official speaker, village/community/contest/creator staff, press, black badge holders, or similar. If you are not a human, you need to register separately. If you don't know how, see an NFO goon (NFO Node, formerly known as an infobooth, is where you can get help). The remainder of this message applies only to humans.

Lines? Linecon?

Linecon is your optional opportunity to stand (or sit) in line for human registration to open. Doors will open for linecon on Wednesday at approximately 17:00. When human registration opens on Thursday at approximately 08:00, they start working the linecon queue, and the line will start moving quickly. (Please understand that we will begin processing the line on Thursday morning as soon as the cashiers and materials are in place; we will strive for Thursday 08:00, but actual start may be slightly earlier or later.)

Online badge purchase (aka pre-registration) has no impact on linecon. You can join the line on Wednesday (if you wish) regardless of whether you purchased a badge online or intend to pay with cash. There is only one linecon for both types of badge sales.

Please help us make this a great experience for everyone by following directions given by goons. After human registration opens, there may be one line for all of registration, or there may be two lines (one for online sales (pre-registration) and one for cash sales). This may also change over time, based on available staffing and necessary crowd control. We will strive to make it easily understandable in-person as to which line you should join.

Ways to buy a badge

• $560-600 online purchase until August 1, 2026. Tickets are transferable. Please read the details on the linked page.
• $520 cash purchase on-site.
• As part of a BlackHat registration.

Online Purchase

You will be emailed a QR code to the email address provided when you bought your badge. Please guard that QR code as though it is cash -- it can only be redeemed once, and anyone can redeem it if they have it (including a photo of it). Badges are picked-up on-site -- they will not be mailed or shipped.

We can scan the QR code either from your phone's display or from a printed copy. You must have the QR code with you in order to obtain your badge. As you approach the front of the line, if you are going to show your QR code on an electronic device, please ensure that your display is set to maximum brightness.

If you pre-registered, but ultimately are unable to attend DEF CON and want to cancel your purchase, the only way to get a refund is from the original online source. We are unable to provide any refunds on-site at DEF CON. There is a fee to have your badge canceled: $34 before July 18, and $84 on and after July 18.

Online purchases are provided a receipt via email when the purchase is made.

Online purchase -- often referred to as pre-registration -- does not allow you to skip any line/queue to pick up your badge. Once you arrive on-site, you will need to join the existing line for human registration. There may or may not be a dedicated line for pre-registration badge pickup, depending on when you arrive, how long the line is, available staff, etc.

Cash Purchase

Badges will be available for purchase on-site at DEF CON. All badge sales are cash only. No checks, money orders, credit cards, etc., will be accepted. In order to keep the registration line moving as quickly as possible, please have exact change ready as you near the front of the line.

There are no refunds given for cash sales. If you have any doubt about your desire to buy a badge, please refrain from doing so.

We are unable to provide printed receipts at the time of the sale. A generic receipt for the cash sale of a badge will be made available on media.defcon.org after the conference. You are welcome to print your own copy of the receipt on plain paper.

Via BlackHat

If you've purchased a DEF CON badge as part of your Black Hat registration, you're in luck - you will be able to pick up your DEF CON badge at Black Hat on Thursday. Please bring your Black Hat badge and watch for emails from Black Hat about where exactly the badge pickup will be.

Please note that DEF CON is not able to access or verify Black Hat registration or attendee info. DEF CON's preregistration list is not the same as Black Hat's. For help, ask at Black Hat registration or the concierge area.

Misc

Want to buy multiple badges? No problem! We're happy to sell you however many badges you want to pay for.

If you lose your badge, there is unfortunately no way for us to replace it. You'll have to buy a replacement at full price. Please don't lose your badge. :(

If you are being accompanied by a full-time caretaker (such as someone who will push your wheelchair, and will accompany you at all times), please ask to speak to a Registration Goon. Your caretaker will receive a paper badge that will permit them to accompany you everywhere you go.

Still need help?

If you have questions about anything regarding human registration that are not addressed here, please ask to speak to a Registration Goon.

Policy @ DEF CON - Sunday - 12:00-12:30 PDT

As grids decentralize and cyber-attacks accelerate, Critical Infrastructure must keep up. "Inference in the Infrastructure" offers a path to machine-speed defense, but it is only as safe as the guardrails we build together. This is a call to action to help shape the new NIST AI Risk Management Framework Profile for Trustworthy AI in Critical Infrastructure. We need the hacker community to ensure these systems are worthy of our trust before they are fully deployed. Trustworthy AI in critical systems requires more than high-level policy. The hacker mindset is vital for identifying the emergent failures, hidden interdependencies, and non-obvious edge cases. We will dive into resources designed to bridge the gap between governance and field-ready implementation, translating trustworthiness characteristics into actionable "bridge language" and technical practices that facilitate governance controls that align with both data science and operational realities. We are inviting the community to look under the hood, stress-test, and shape the draft guidance before it informs the rules for the next generation of infrastructure. Whether you are an AI researcher, an ICS defender, or a policy architect, your "ground-truth" input is needed to ensure we automate our world on a foundation that is both resilient and intelligent.

Dr. Raymond Sheh is an AI, cybersecurity, robotics, and standards expert with over two decades of published international research experience across academia, industry, government, and defense. He is an Associate Research Scientist at Johns Hopkins University in Maryland and leads the development of the NIST AI Risk Management Framework (AI RMF) Profile for Trustworthy AI in Critical Infrastructure at the U.S. National Institute of Standards and Technology (NIST) Information Technology Laboratory (ITL). He was previously the Uncrewed Aircraft Systems (UAS) Research Lead for the NIST Public Safety Communications Research Division (PSCR), a Research Professor at Georgetown University in Washington DC, and a Senior Lecturer in Computer Science at Curtin University in Western Australia. Dr. Sheh holds a Ph.D. in AI and robotics from the University of New South Wales in Sydney, Australia.

Martin Stanley, AI and Cybersecurity Researcher, leads the NIST AI Risk Management Framework (AI RMF) efforts at the U.S. National Institute of Standards and Technology (NIST), Information Technology Laboratory. Martin previously led the Emerging Technology and R&D Program at CISA and the Enterprise Cybersecurity Program at the U.S. Food and Drug Administration. Prior to his federal service Martin held executive leadership positions at Vonage and UUNET Technologies. Martin co-authored “Digital Health”, an Oxford University Press Publication, and led the 2024 development of NIST AI 600-1 “NIST AI RMF: Generative Artificial Intelligence Profile” and NIST SP 800-218A “Secure Software Development Practices for Generative AI and Dual-Use Foundation Models: An SSDF Community Profile.”

DEF CON Training - Sunday - 08:30-17:30 PDT

Lockpick Village - Sunday - 13:00-13:30 PDT

New to lock picking? Haven't picked in a year and need a refresher? Don't know a half-diamond from a turner? This talk is for you! Join one of our knowledgeable village volunteers as we walk you through the very basics of lock picking, from how to hold your tools to the theory behind the technique that makes lock picking possible.

Lockpick Village - Sunday - 10:15-10:45 PDT

New to lock picking? Haven't picked in a year and need a refresher? Don't know a half-diamond from a turner? This talk is for you! Join one of our knowledgeable village volunteers as we walk you through the very basics of lock picking, from how to hold your tools to the theory behind the technique that makes lock picking possible.

AppSec Village - Sunday - 10:15-12:59 PDT

This workshop introduces the practical world of threat modeling, combining hands-on exercises and real-world scenarios. In particular, we will focus on how AI can enhance your threat modeling work plus introduce the basics of securing AI systems.

We will review some of the latest threat intelligence and attack methods projected for 2026/2027, including vulnerabilities in LLMs and Agentic AI. Participants will engage in practical exercises inspired by real industry projects, such as integrating threat modeling into security-by-design and DevOps/MLOps workflows. Key features include threat-informed defense using MITRE frameworks such as ATLAS for real-world analysis, leveraging threat intelligence libraries to deepen threat understanding, and addressing modern challenges.

By the end of this workshop, you will walk away not just with knowledge but also the ability to start practicing threat modeling effectively in your organization.

Robert brings over 30 years of experience in secure coding, software architecture. Robert started and led the threat modeling program at Bank of America, filled in a similar role at Aquia and was a trainer and coach at Toreon. He is passionate about helping teams identify, communicate, and understand threats and mitigations and enhance workload security through threat modeling.

Robert is a Microsoft MVP for Developer Security and an ISC2 Certified Secure Software Lifecycle Professional (CSSLP). He holds a Master of Science in Cyber Security from Southern New Hampshire University and is a Ph.D. candidate in Space Cybersecurity at Capitol Technology University.

Robert is co-author of the Threat Modeling Manifesto (https://www.threatmodelingmanifesto.org/), Threat Modeling Capabilities Model (https://www.threatmodelingmanifesto.org/capabilities), and co-host of the Application Security Podcast (https://appsec.buzzsprout.com/).

ICS Village - Sunday - 11:00-11:30 PDT

Much of modern life depends on cooling systems, from keeping food fresh in grocery stores to storing life-saving medicine. At their core, refrigeration controllers manage the entire process, coordinating field controllers directly connected to the refrigeration components like compressors, fans etc. With tens-of-thousands of devices exposed online, used by the largest retail stores around the world, attacking these controllers could cause huge financial loss and disrupt food and medicine supply chains around the globe.

During the last year we looked at refrigeration controllers from leading vendors in the industry, disclosing more than 30 vulnerabilities. We discovered buffer-overflows, authentication bypasses and remote code execution issues. Furthermore, we discovered ways to exfiltrate sensitive information from devices, allowing attackers to leak ownership and location information and pinpoint attack specific targets.

In our talk, we will deep dive into the refrigeration ecosystem. Including hardware firmware extraction and analyzing it, emulating firmware binaries and showcasing the vulnerability chains we uncovered affecting these systems. Lastly, we will present a real-life video demo presenting an attacker hacking a controller covertly, disrupting normal operations and affecting refrigerators’ contents.

Vulnerability researcher at Claroty Team82

Mobile Hacking Community - Sunday - 11:30-11:59 PDT

Mobile devices have become the primary targets for highly sophisticated, targeted spyware and state-sponsored surveillance, yet validating a suspected compromise remains an adversarial challenge across all sectors. Whether in a corporate enterprise, an investigative newsroom, or a human rights organization, tracking mobile malware forces an impossible binary choice: accept the existential risk of data exfiltration, or initiate traditional forensics. For individual users, journalists, and corporate Incident Response (IR) teams alike, standard forensic methods are deeply destructive, and breaks critical software access. Because specialized forensic workstations are complex and cost-prohibitive, high-risk individuals and organizations often remain completely blind to ongoing breaches.

This talk introduces IsMyPhonePwned, an open-source, non-destructive mobile forensic framework designed to democratize device auditing. It allows anyone to scan for Indicators of Compromise (IoCs) and malware infections directly from a standard web browser over a USB connection. By leveraging WebAssembly and a high-performance stack written entirely in Rust, our framework enables client-side extraction, log parsing, and industry-standard Sigma rule evaluation without rooting, zero software installation, and zero device downtime. We will demonstrate how organizations and individual citizens can bypass complex, destructive investigative bottlenecks and perform rapid, privacy-preserving mobile triage at scale.

I spent my last decade at Google in the Android Security Team, to fight against Android malware ! I'm now working at CERT-EDF, to keep the light on ;)

IoT Village - Sunday - 10:00-13:59 PDT

2 Mini-Workshops, Only 15 Minutes Each: QEMU: Emulate Your 'Things' – Hack a Drug Lord’s Smart Toilet; Encryption! What Encryption? – Decrypt TLS Traffic with mitmproxy. No Schedule.

Noob Community - Sunday - 10:00-13:59 PDT

Kryptsec started as a Discord server for people who wanted to learn cybersecurity together and has grown into a company focused on making security training engaging rather than monotonous, including hands-on, AI-assisted CTF labs and OASIS, its open-source tool for benchmarking AI agent vulnerabilities. Stop by the Kryptsec Labs table during village hours to work through their hands-on challenges.

Scambait Village - Sunday - 10:00-15:59 PDT

Prerecorded scambait calls running in Discord voice throughout the day. Bring earbuds and tune in from your phone while you walk the village or the rest of the con. Listen to real interactions, hear how experienced baiters handle different situations, and pick up new techniques and banter styles. Ambient and educational, drop in for a few minutes or stay for a whole set.

Contests - Sunday - 10:00-11:59 PDT

Want to learn more about Kubernetes hacking or compete against other people in a Capture the Flag contest? Sign up on-line and come see us in person/on Discord at the Kubernetes Capture the Flag (CTF) contest .

We have two events - you can play in both if you like.

From Friday to Sunday, we have a non-competitive Learning CTF, where you can go through last year's Kubernetes CTF scenario, referring to a cheat sheet whenever you want. This runs from Friday 12:00 to Sunday 12:00. We'll be in the contest area to support you during:

Friday: 12:00-17:00 Saturday: 10:00-17:00 Sunday: 10:00-12:00

On Saturday only, you can play in the competitive Kubernetes CTF challenge, where teams (of one or more) can build and test their skills. Each team is given access to a single Kubernetes cluster that contains a set of challenges. This runs from 10:30am to 5:30pm on Saturday.

Find out more and sign up at: https://containersecurityctf.com/

La Villa Community - Sunday - 11:30-11:59 PDT

Tres insólitos incidentes de ciberseguridad fueron resueltos por dos investigadores en Incidentes de Ciberseguridad con ayuda de múltiples técnicas de "sniper-forensics" y una "Rosa Blanca" les confirmó sus sospechas iniciales y los llevó a encontrar la verdad.

Se abordará el análisis detallado de las diferentes fuentes de información (bitácoras, artefactos y contexto).

Victor Gomez is a cybersecurity professional coming from the sysadmin-architecture world. He has focused his career on digital forensics, incident response, and Intel, responding to all kinds of attacks on multiple and different sizes of organizations & industries and leading multiple Cyber* teams. In his spare time, he likes to mentor and organize a local meetup in Mexico City.

Ph.D. in Computer Sciences (cybersecurity & AI) from Instituto Politécnico Nacional (National Polytechnic Institute, IPN in 2024. For the past few years, I have been working as an Incident Responder, taking on multiple roles in cybersecurity. My professional interests include incident response, Artificial Intelligence (AI) applied to Cybersecurity, primarily in Android malware analysis and Computer Forensics.

La Villa Community - Sunday - 13:00-13:30 PDT

Data Duplication Village - Sunday - 10:00-10:59 PDT

This is your last chance to pickup your drives whether they're finished or not. Get here between 10:00am and 11:00am on Sunday as any drives left behind are considered donations.

DEF CON Talks - Sunday - 11:00-11:59 PDT

As AI and agentic desktop apps rapidly adopt custom URI schemes for one-click onboarding—MCP install, plugin install, configuration import, prompt-driven actions—a browser click becomes a gateway into privileged local logic. Prior Electron research assumes the attacker is already inside the app; the browser-triggered, end-to-end exploitation model has remained unexplored.

We present LaunchBreak: a class of vulnerabilities where a crafted browser link launches a desktop app and injects attacker-controlled input into a multi-stage, multi-process exploit chain. We systematize the attack surface across three dimensions: payload sources (URI, attacker server, local file), cross-process flows (main/utility/renderer), and sinks (command exec, dynamic eval, module loading).

Our findings include 18 zero-days, 17 of them full RCEs, with 11 CVEs and a bug bounty. The affected apps include AFFiNE (60k stars, CVE-2026-21853), Hyper (Vercel's terminal, bounty awarded), Cherry Studio (CVE-2025-54063), Pinokio (CVE-2025-44109), deepchat (CVE-2025-55733), Paperlib (CVE-2025-64743), and more, spanning AI assistants, music players, and dev tools. We'll demo live exploits against apps, walk through the chains, and release Proton, the agent-guided segmented fuzzing framework we built to find them, plus PoCs for every vulnerability.

The related CCS paper if that submission is accepted (the result comes out in June.), if not, then none.

Jiacheng (Gavin) Zhong is a security researcher, focusing on AI system security, program analysis, and identity security. He recently completed his M.S. in Security Informatics at Johns Hopkins University, where his work was accepted to IEEE S&P 2026. Gavin has reported over 30 CVEs in widely used open-source projects. He is also an active CTF player with r3kapig, an international team ranked top 3 worldwide.

Zhengyu Liu is a third-year PhD student in Computer Science at Johns Hopkins University. His research focuses on web and software security via program analysis. His work received Distinguished Paper (S&P ’25), Honorable Mention (USENIX ’25), and Best Student Paper (ICICS ’22). He is a DEF CON speaker and is a member of CTF team TheHackersCrew.

Jianjia Yu is a PhD student at Johns Hopkins University, advised by Prof. Yinzhi Cao. Her research focuses on security and privacy in web and mobile ecosystems using program analysis techniques. Her work has received Distinguished Paper Awards at CCS '23 and S&P '25, and an Honorable Mention at USENIX Security '25. She has discovered over 40 zero-day vulnerabilities and uncovered privacy leaks affecting millions of users across browser extensions and mobile applications.

DEF CON Groups - Sunday - 10:00-10:30 PDT

Building a new DEF CON Group comes with a lot of trial, error, and unexpected lessons. DC724 will share real-world experience from the early stages of growing a newer group, including finding space, building relationships, coordinating with other communities, avoiding common mistakes, and creating momentum. This session is especially useful for newer POCs, prospective organizers, and anyone trying to get a local hacker community off the ground.

Cliff Friedel (GritsnGravy) is one of the co-founders of DC 724 and has been working with computers and technology since 1979. Working in various IT disciplines from the 1980s until today, Grits has got his hands into everything from BBSes to ISPs to storage acceleration networks. Now semi-retired, he focuses on retro computers, making nerdy T-shirts, RF technologies and amateur radio, and occasionally trying to throw a god roll at the craps tables.

Joe Buhagiar (jbohack) is a Security Engineer at NaviSec, specializing in incident response and penetration testing. He is also the Co-Founder and Lead Developer of Nyan Devices, the creators of the nyanBOX, a wireless security toolkit covering Wi-Fi, Bluetooth, and RF, with a focus on device visibility and counter-surveillance research. He is a Co-Founder of DC724.

OWASP Foundation - Sunday - 12:00-12:59 PDT

Think threat modeling can't be fun? Think again! Join us for an interactive OWASP Cornucopia 3.0 game session where you'll team up to uncover security risks, challenge assumptions, and sharpen your secure design skills through friendly competition. Whether you're a developer, security professional, or just curious about application security, come play, collaborate, and experience one of the most engaging ways to learn threat modeling.

AI Village - Sunday - 12:30-12:59 PDT

The rapid adoption of Large Language Models (LLMs) is transforming how organizations interpret and enforce policy, regulatory, and compliance requirements. In the context of the Internet of Medical Things (IoMT), where sensitive health data flows across distributed and resource-constrained devices, LLMs offer promising capabilities such as automated policy analysis, compliance monitoring, and intelligent decision support. However, their integration also introduces significant security, privacy, and trust challenges, including data leakage, model hallucinations, regulatory misinterpretation, and adversarial manipulation. This talk explores the dual role of LLMs as both enablers and potential risk amplifiers in IoMT ecosystems. It will examine how LLMs can assist in translating complex regulations (e.g., HIPAA-like frameworks), detecting compliance violations, and enabling adaptive policy enforcement across heterogeneous medical devices. At the same time, the session will highlight critical vulnerabilities, including privacy breaches, lack of explainability, and risks associated with using external or cloud-hosted models in healthcare environments. The workshop will conclude with practical design guidelines and architectural considerations for securely integrating LLMs into IoMT systems, emphasizing privacy-preserving techniques, federated approaches, and human-in-the-loop validation to ensure trustworthy and compliant deployment.

Dr. Deepti Gupta is a tenure-track Assistant Professor at Texas A&M University-Central Texas. She was a Cloud Security Architect at Goldman Sachs. She received her Ph.D. in Computer Science from the University of Texas at San Antonio (UTSA). She received B.S. and M.S. degrees in Mathematics from India, the M.Tech. degree in Computer Engineering from India and an M.S. degree in Computer Science from UTSA. Dr. Gupta’s research interests lie in the areas of security and privacy in Agentic AI, LLMs, Internet of Things (IoT) leveraging cloud and edge computing. Her research interests also include the application of AI and Machine Learning to secure IoT and CPS infrastructures in various application domains, such as smart healthcare, wearable IoT and smart home. Dr. Gupta has received National Science Foundation (NSF) award and Department of Defense (DoD) award. She is an active team member of IEEE ComSoc Young Professionals, AnitaB.org, WiCyS, and also co-chair of the N2Women fellowship.

Sai Sitharaman is the Founder and Chief Technology Officer (CTO) of Zetafence Inc., a cloud security startup based in Dublin, California, focused on enabling enterprises to detect and mitigate cloud attack vulnerabilities. He received the B.E. degree in Computer Science from the National Institute of Technology, India, and the M.S. degree in Computer Science from Texas A&M University, College Station, specializing in security and network control algorithms. Prior to founding Zetafence, he contributed to the design and development of cloud networking and security products at Cisco, Juniper Networks, and Aruba (Hewlett Packard Enterprise), where he worked on distributed systems, network control algorithms, and cloud security infrastructure. His research interests include cloud security, artificial intelligence for cybersecurity, attack graph analysis, and risk quantification for cloud-native environments. He is an active contributor to the cybersecurity community through collaborations with organizations such as NIST, CNCF, and CISA, and is a frequent speaker at major cybersecurity conferences.

Recon Village - Sunday - 10:45-11:30 PDT

LLM-powered tooling is becoming a force multiplier for attackers, from reconnaissance automation to post-exploitation enumeration. Using their own API keys creates attribution and cost, so they look for alternatives.

Thousands of inference endpoints sit exposed on the internet: misconfigured Ollama instances, open vLLM deployments, leaked API keys in directory listings, and expired OAuth tokens from AI coding assistants that can be silently refreshed. Attackers can discover these resources and use them as free compute for their operations, without spending a dollar or registering an account.

Attendees will learn how to:

•⁠ ⁠Discover exposed inference endpoints and leaked API keys using Infreerence •⁠ ⁠Validate that discovered resources provide usable inference access •⁠ ⁠Operate Echidna, powered entirely by discovered inference •⁠ ⁠Chain LLM skill agents together to execute a guided campaign against a target network

Current LLMs are effective force multipliers when directed, and significantly more so when the compute bill goes to someone else. This is resource hijacking applied to the AI era: living off someone else's inference. Understanding this threat is essential for any organization deploying or exposing AI infrastructure.

Two tools will be released as open source during the session:

•⁠ ⁠Infreerence: A multi-phase scanner and dashboard that discovers exposed inference endpoints and leaked API keys through Shodan and Censys, validates them against live provider APIs, and catalogs usable inference resources across 10+ providers. •⁠ ⁠Echidna: A Mythic C2 agent type that consumes discovered inference endpoints and turns them into operator-directed skill agents for reconnaissance, exploitation planning, post-exploitation, and lateral movement.

Redon Gashi is a Managing Security Consultant and offensive team lead at Sentry, where he has spent close to a decade leading and executing penetration tests and red team operations for Fortune 500 clients across banking, telecom, insurance, and fintech. He holds the OSEP, CRTL, and CRTO certifications, and has personally performed over 200 engagements spanning web applications, internal infrastructure, and mobile platforms, while leading many more across his team. A former lecturer at Cyber Academy, speaker at multiple BSides conferences, and multiple-time CTF champion, Redon combines deep hands-on technical expertise with a proven ability to build and scale offensive security teams.

Armend Gashi is Managing Security Consultant at Sentry. With over 5 years in the industry, he specializes in application security and AWS cloud assessments. Armend has conducted AI red teaming engagements, developed multi-agent systems to perform security-focused tasks such as code auditing and exploit development, and was part of Anthropic’s external AI red team capability through HackerOne.

Armend has led security research initiatives resulting in the discovery of multiple vulnerabilities, including:

CVE-2023-26482 - Critical-risk vulnerability enabling remote code execution CVE-2023-48239 - High-risk vulnerability allowing arbitrary user storage updates CVE-2023-35928 - High-risk vulnerability enabling user account hijacking CVE-2023-45660 - Medium-risk application-level denial of service vulnerability CVE-2023-48301 - Medium-risk arbitrary browser code injection vulnerability CVE-2023-48307 - Low-risk server-side request forgery vulnerability

Red Team Village - Sunday - 12:00-13:59 PDT