BEGIN:VCALENDAR
VERSION:2.0
PRODID:Data::ICal 0.24
BEGIN:VEVENT
DESCRIPTION:   'Title: Goose Processing Unit (GPU): VRAM as an Unmonitored 
 Attack\n   Surface\n   Tags: DEF CON Demo Labs | Intermediate | Defense/Bl
 ue Team |\n   Hardware/IoT | Malware | Offense/Red Team | DEF CON Demo Lab
 s\n   When: Saturday\, Aug 8\, 10:00 - 10:45 PDT\n   Where: LVCCW Level 1 
 Hall 3 1003 (Demo Labs Track 3) - [1]Map\n\n   Description:\n\n   Modern G
 PUs have become foundational to computing infrastructure for\n   gaming\, 
 machine learning\, and AI workloads at scale\, yet GPU memory\n   remains 
 a largely unmonitored attack surface. No mainstream antivirus\n   or endpo
 int-detection solution currently inspects it\, creating a\n   significant 
 blind spot that sophisticated adversaries can exploit.\n   This Demo Lab p
 resents a novel technique that uses NVIDIA RTX 5090\n   CUDA APIs to stage
  payload data\, such as DLLs\, directly in GPU memory\,\n   entirely outsi
 de the visibility of host-based security tools\,\n   including Windows Def
 ender. A benign executable\, with no malicious\n   code of its own\, uses 
 CUDA's native memory transfer capabilities to\n   move binary payload data
  onto the GPU immediately upon execution. No\n   CUDA Toolkit installation
  is required on the target host. When\n   triggered\, the same executable 
 retrieves the payload from GPU memory\,\n   manually maps it into process 
 space\, and executes it. A working proof\n   of concept has been validated
  as an Empire C2 module\, confirming\n   practical operational viability. 
 The technique is particularly\n   impactful for high-uptime environments s
 uch as AI inference servers\,\n   rendering farms\, and enterprise GPU clu
 sters\, where small executables\n   interacting with the GPU blend natural
 ly into background workloads.\n\n   Speakers:Gannon "Dorf" Gebauer\,Anthon
 y "Coin" Rose\,Hana Christensen\n\n   SpeakerBio:  Gannon "Dorf" Gebauer\n
 \n   Gannon "Dorf" Gebauer is a second lieutenant in the United States Air
 \n   Force pursuing a master's in computer science at the Air Force\n   In
 stitute of Technology. He earned a Bachelor of Science in Computer\n   Sci
 ence from Arizona State University. His expertise spans red team\n   opera
 tions\, reverse engineering\, and offensive tool development\, and\n   his
  current research focuses on novel persistence techniques that\n   abuse G
 PU memory as an unmonitored attack surface.\n\n   SpeakerBio:  Anthony "Co
 in" Rose\n\n   Dr. Anthony "Coin" Rose is an officer in the United States 
 Air Force\,\n   an Assistant Professor\, and the Director of the Center fo
 r Cyberspace\n   Research at the Air Force Institute of Technology. He hol
 ds a\n   doctorate in Electrical Engineering and has expertise in machine\
 n   learning\, with a focus on its application to cybersecurity and malwar
 e\n   detection. He is also the founder of SIMAPTIC and the Director of\n 
   Security Research at BC Security\, where he specializes in adversary\n  
  tactics and emulation planning\, Red and Blue Team operations\, and\n   e
 mbedded systems security. Dr. Rose is credited with 16 CVEs and has\n   pr
 esented at numerous security conferences\, including Black Hat\, DEF\n   C
 ON\, HackSpaceCon\, HackMiami\, and RSA Conference.\n\n   SpeakerBio:  Han
 a Christensen\n\n   Hana Christensen is a second lieutenant and developmen
 tal engineer\n   (electrical) in the United States Air Force. She is curre
 ntly pursuing\n   a master's in electrical engineering\, with a focus on s
 ignal\n   processing and machine learning. Her research investigates secur
 ity\n   vulnerabilities in AI hardware\, examining whether side-channel\n 
   analysis can be used to extract information about machine learning\n   a
 lgorithms. She holds a B.S. in Electrical and Computer Engineering\n   fro
 m the United States Air Force Academy (class of 2025).\n\n   '\n\n   1. #L
 VCCW_Level1_Hall3\n\n\n
DTEND:20260808T174500Z
DTSTART:20260808T170000Z
LOCATION:Demo Labs - LVCCW Level 1 Hall 3 1003 (Demo Labs Track 3)
SUMMARY:Goose Processing Unit (GPU): VRAM as an Unmonitored Attack Surface
END:VEVENT
END:VCALENDAR