BSides Canberra 2021
| title | author | length |
|---|---|---|
| Theme Introduction | 01m | |
A short theatrical intro sequences a mythic origin story over licensed music, narrating a post‑cyberpocalypse rebirth: heaven, earth, sun and moon act on an… | ||
| "BSidesCbr 2021 Announcement" | Kylie McDevitt, Silvio Cesare | 08m |
Already 1715 tickets sold and about 50% delegates from interstate or overseas; the convention centre is booked for the 9th and 10th next year and plans require… | ||
| "Return to Sender: Bypassing Email Spam & Malware Filters" | Sebastian Salla | 20m |
Explains three concrete exploits against cloud email: the bounce attack, the direct mail attack and the direct mail bounce attack, with measured exposure —… | ||
| "The Security of Emojis" | Adrian Justice | 25m |
Tests show Windows Terminal renders emojis while conhost shows replacement boxes and Windows Terminal renders emojis. Hostnames and domain names accept emoji… | ||
| "Electronic Hardware Design" | Josh Johnson | 25m |
Step-by-step account of building a conference badge that looks like a bow tie with LEDs and a microphone, from part selection to finished board: uses KiCad for… | ||
| "Finding Tony Abbott's Passport Number and entering the Do Not Get Arrested Challenge 2020" | Alex | 57m |
A photo of a boarding pass yields a six‑character booking reference, used on the airline’s “manage booking” page; right‑clicking and using inspect element… | ||
| "Easy LPEs and Common Software Vulnerabilities" | Christopher Vella | 56m |
Shows concrete, fast-to-find privilege escalations: uses Process Hacker, Procmon and Project Zero symbolic tools to map IPC and filesystem access, finds a Zoom… | ||
| "Attacking the TCache in GLibc 2.32" | Jayden Rivers | 48m |
Demonstrates a practical bypass of glibc 2.32’s safe‑linking by corrupting in‑heap tcache metadata to make malloc return allocator-controlled addresses. Uses… | ||
| "Context Aware Content Discovery: The Natural Evolution" | Michael Gianarakis, Shubham Shah, Sean Yeoh, Patrick Mortensen | 50m |
Collects and normalizes public OpenAPI/Swagger specs (BigQuery, apis.guru, SwaggerHub, internet scan) into a 67.5k-spec corpus and ~1M unique routes, then… | ||
| "Cold Case - Catch a Killer in 16 Bytes" | Iggy | 27m |
A Kodak C513 compact camera has 16 megabytes of internal NAND organized as a FAT12 filesystem that can hold up to 41 images; commercial tools (Photorec… | ||
| "The Defender's New Clothes" | Eldar Marcussen | 42m |
Argues defenders overtrust appliances that run with high privilege and rely on brittle string matching, demonstrates concrete bypasses: Cloudflare and WAFs… | ||
| "Oh my Pod: Lessons from building one of Australia's biggest CTFs" | Sam | 29m |
Built a statewide two-day CTF that runs on Kubernetes with per-team namespaces, OpenVPN pods and shell boxes, handling 3600 containers across 190 namespaces… | ||
| Keynote | Mike Burgess | 36m |
Asserts that espionage and foreign interference will supplant terrorism as Australia’s principal security concern over the next five years, cites two domestic… | ||
| "Understanding the Reality of Fraud Victimisation" | Cassandra Cross | 33m |
Fraud causes far more than money loss: Australia reports $634M in 2019 and the US $3.5B, yet reporting is often low (under one third reported). Offenders work… | ||
| nothing matches | ||