BEGIN:VCALENDAR
VERSION:2.0
PRODID:Data::ICal 0.24
BEGIN:VEVENT
DESCRIPTION:   'Title: Your OTP Never Arrived: Attacking the Trust Boundary
  Where SMS\n   Meets the Internet\n   Tags: DEF CON Official Talk | Demo ð
 Ÿ’» | Exploit 🪲\n   When: Saturday\, Aug 8\, 11:30 - 12:30 PDT\n   Wher
 e: LVCCW Level 1 Hall 3 904 (Main Track 4) and DCTV-4 - [1]Map\n\n   Descr
 iption:\n\n   Kannel is the most widely deployed open-source SMS and WAP g
 ateway in\n   the world. With over 1000+ internet-facing instances across 
 65\n   countries\, powering two-factor authentication\, mobile banking\,\n
    emergency alerts\, and carrier-grade messaging\, it forms a silent but\
 n   critical pillar of global telecommunications infrastructure. Despite\n
    handling billions of messages\, Kannel has received only a single CVE\n
    in its entire history. We present the results of a comprehensive\n   se
 curity audit of Kannel SMS Gateway spanning versions 1.4.4\, 1.4.5\,\n   a
 nd 1.5.0. Our research uncovered multiple previously unknown\n   vulnerabi
 lities. Most critically\, we introduce telecom-specific attack\n   primiti
 ves that exploit the inherent trust model between gateway\n   components\,
  enabling silent message censorship\, billing fraud through\n   forged del
 ivery receipts\, and audit evasion through metadata\n   manipulation. Thes
 e go beyond traditional memory corruption to expose\n   fundamental design
  weaknesses in how SMS infrastructure routes\,\n   delivers\, and accounts
  for messages. This talk fundamentally\n   challenges the assumption that 
 legacy telecom software is secure\n   through obscurity.\n\n   https://www
 .kannel.org/ https://github.com/kannel\n   https://en.wikipedia.org/wiki/S
 hort_Message_Peer-to-Peer\n   https://www.kannel.org/doc.shtml\n   https:/
 /gatewayapi.com/docs/apis/kannel/\n   https://docs.smsportal.com/docs/kann
 el\n   https://github.com/playsms/book-playsms/blob/master/book-contents/e
 n/Installation/Gateway-Installation/Kannel/Example-Kannel-configuration-wi
 th-SMPP.md\n   https://en.wikipedia.org/wiki/SMS_gateway\n   https://www.d
 rupal.org/project/kannel https://smpp.org/\n   https://smpp.org/smpp-v5.ht
 ml\n   https://www.infobip.com/docs/essentials/api-essentials/smpp-specifi
 cation\n\n   Speakers:Kyprianos "kavasilo" Vasilopoulos\,Nikos "nickvourd"
  Vourdas\n\n   SpeakerBio:  Kyprianos "kavasilo" Vasilopoulos\, Apifon\n\n
    Kyprianos Vasilopoulos is a cybersecurity executive with 20+ years of\n
    experience in red teaming\, incident response\, penetration testing\, a
 nd\n   malware research. He is the CISO at Apifon and Co-Founder of\n   Of
 fensiveX. He has led cyber operations for major events like the\n   Olympi
 c Games and contributed to zero-day research at Trustwave\n   SpiderLabs. 
 Holding certifications such as OSCP and OSCE\, he combines\n   deep techni
 cal expertise with strategic leadership. His focus includes\n   offensive 
 security automation\, red teaming\, and threat-led penetration\n   testing
 \, and he has appeared on BBC News while being recognized in the\n   Zyxel
  CVE Hall of Fame.\n\n   SpeakerBio:  Nikos "nickvourd" Vourdas\, EY\n\n  
  Nikos Vourdas\, also known as nickvourd or NCV\, is a Senior Offensive\n 
   Security Consultant based in the US. With over five years of\n   profess
 ional experience\, he has actively participated in various\n   global Tibe
 r-EU and iCAST Red Teaming engagements. Nikos has conducted\n   full Red T
 eaming operations to major clients across retail\, banking\,\n   shipping\
 , construction industries. He holds OSCE3\, OSCP\, OSWP\, CRTL\,\n   CRTO 
 and OASP certifications. Also\, he has previously presented at DEF\n   CON
 \, DevSecCon\, and various BSides events around the world. Nikos\n   loves
  contributing to open-source projects and always starts his day\n   at 05:
 00 AM with a refreshing jog while listening to French rap music.\n\n   '\n
 \n   1. #LVCCW_Level1_Hall3\n\n\n
DTEND:20260808T193000Z
DTSTART:20260808T183000Z
LOCATION:DEF CON Talks - LVCCW Level 1 Hall 3 904 (Main Track 4) and DCTV-4
SUMMARY:Your OTP Never Arrived: Attacking the Trust Boundary Where SMS Meet
 s the Internet
END:VEVENT
END:VCALENDAR