BSidesSF 2018
2018-04-15
San Francisco, United States
BSidesSF ·
[BSidesSF 2018, BSidesSF 2019, BSidesSF 2020, BSidesSF 2023, BSidesSF 2024, BSidesSF 2025, BSidesSF 2026]
| title | author | length |
|---|---|---|
| The IoT Hacker's Toolkit | David Tomaschik | 28m |
Overview of practical techniques for breaking and inspecting real IoT hardware and firmware, with concrete takeaways: many devices expose UART serial at 3.3V… | ||
| No More XSS: Deploying CSP with nonces and strict-dynamic | Devin Lundberg | 29m |
Deploys a strict CSP using 128-bit base64 nonces plus hashes for cached pages, adds nonce-generation middleware, and rolls policy in report-only before turning… | ||
| Six Degrees of Infiltration | Sacha Faust | 31m |
Graph-backed inventory and risk analysis uses a Neo4j graph fed by periodic cron jobs that rebuild state from AWS, GitHub, JIRA, PagerDuty and host agents… | ||
| Fighting Secrets In Source Code With TruffleHog | Dylan Ayrey | 31m |
Tool hunts secrets in git history using entropy scanning and curated regexes, packaged as truffleHog and extended to npm/PyPI as SantaHog. Scans flagged… | ||
| Hacking the Law: Are Bug Bounties a True Safe Harbor? | Amit Elazari | 33m |
A survey of bug bounty contracts examines 177 HackerOne policies and finds only 17 had partial safe harbor, revealing platforms often shift civil and criminal… | ||
| An Open Source Malware Classifier and Dataset | Phil Roth | 28m |
Provides an open dataset of 1.1M PE hashes (no binaries) with 900k chronological training records split evenly between benign malicious and unlabeled, seven… | ||
| Blue Team Fundamentals | Benjamin Hering | 28m |
Shows concrete defender wins and failures: blocks 34,000+ fuzzing requests from one IP (peaked ~93 req/s), fingerprints and blocks Apache Struts CVE-2017-5638… | ||
| Tales of Red Teaming | Aladdin Mubaied, Rahul Nair | 30m |
Shows how attackers use domain fronting via CloudFront to hide C2, patching and using evilOSX with a PR script that auto-creates CNAMEs, LetsEncrypt and… | ||
| Pensieve: Finding Malicious Artifacts in Container Environments | Yathi Naik | 23m |
Claims that per-container memory and resource artifacts can be captured without dumping host RAM using CRIU checkpointing, demonstrated by checkpointing a… | ||
| Building a Predictive Pipeline to Rapidly Detect Phishing Domains | Wes Connell | 30m |
A Python pipeline ingests real-time Certificate Transparency logs and extracts features (Levenshtein distance to brands, TLD, dash/period counts, entropy) from… | ||
| Data Driven Bug Bounty | Arkadiy Tetelman | 31m |
Collects JIRA-tagged metrics, feeds them into SuperSet dashboards, and ties HackerOne/Bugcrowd and NCC Group triage data to prioritization. Shows concrete… | ||
| Rise of Coinminers | Omri Segev Moyal | 21m |
Coinminers surge is real: traffic detection jumps 8500% increase in 2017 and Monero dominates because it’s CPU‑friendly. Common tooling includes Coinhive and… | ||
| Managing Secrets in Your Cloud Environment | Evan Johnson, Maya Kaczorowski | 29m |
Central recommendation: stop putting credentials in code and centralize. Hands-on solutions compared: HashiCorp Vault (dynamic creds, but operationally heavy… | ||
| What We Can Learn from Google’s Fight with Phishing | Neal Mueller | 32m |
Google measures 12.4 million potential phishing victims and 1.9 billion exposed credentials and estimates 7–25% of stolen passwords let attackers access Google… | ||
| A Case Study of MacOS Supply Chain Compromise | Jason Craig, Michael George | 32m |
Uses osquery for cross‑host state and timelining, Santa for execution events plus binary hashes and signer info, and OpenBSM/audit for file and network… | ||
| Logging, Monitoring, and Alerting in AWS (The TL;DR) | Jonathon Poling | 25m |
Core recommendations: consolidate audit logs by enabling apply trail to all regions and disable duplicate global logging; enable object-level S3 data events… | ||
| Moving Security from Cost Center to Revenue Generator | Arianna Willett | 25m |
Argues security can be measured as dollars by linking vendor questionnaires and sales interactions in Salesforce or a CRM, tracking contributions in Google… | ||
| Honeypots 2.0: A New ‘Twist’ on Defending Enterprise Networks | Lane Thames | 23m |
Describes a practical honeypot system built in Python using Twisted that spins up full HTTP and Modbus servers, serves a response header then tears them down… | ||
| Fuzzing Ruby and C Extensions | Claudio Contin | 33m |
Fuzzing Ruby C extensions with AFL and dockerized builds finds real bugs fast: a double-free in a CSV C parser that crashes in ~20s, null-pointer and a stack… | ||
| Deconstructing APT28's XAgent for OSX | Tiberius Axinte | 19m |
APT28's macOS implant is a full-featured backdoor (xAgent v3) delivered by a 3-stage spearphish PDF→downloader→payload chain and calls home to hard-coded… | ||
| Keep it Like a Secret: When Android Apps Contain Private Keys | Will Dormann | 32m |
Crawled and analyzed 1.8 million apps using GPlayCLI, AndroGuard, apktool, JEB, SQLite and OpenSSL, and finds thousands of embedded private keys (including… | ||
| Introduction to Windows Kernel Mode Debugging | Yamin Tian | 32m |
Practical, hands‑on primer that shows how to reproduce bugs, collect artifacts and find root causes: uses WinDbg connected via a VMware pipe to capture kernel… | ||
| The Bucket List: Experiences Operating S3 Honeypots | Cameron Ero | 30m |
Built a fleet of 100 honeypots (public S3 buckets) with access logging feeding a private bucket and Kinesis/Lambda postprocessing, and the experiment works —… | ||
| Crimeware Chaos: Empirical Analysis of HTTP-Based Botnet C&C Panels | Aditya K Sood | 35m |
Empirical analysis of thousands of real C&C URLs shows HTTP-based panels often use domain names while a significant minority use direct IPs, many panels run… | ||
| Privacy for Safety - OPSEC When the Threat is in the Home | Stella | 22m |
Argues that common threat models assume outsiders while real danger comes from someone in the home who knows passwords, answers security questions, or installs… | ||
| How to Find if Your Developers are Leaking Secrets? | Ian Lee | 24m |
Lawrence Livermore penetration exercises show developers leak credentials through commits, shell profiles and histories, yielding discoverable AWS keys (about… | ||
| Prospecting Ransomware Tech | Vlad Craciun | 32m |
2017 spawns about 150 ransomware families (roughly 12 new families per month) with only about 10% recoverable using current decrypters; delivery mixes include… | ||
| Starting a Security Program: Thrills and Spills | Poornaprajna Udupi | 34m |
First security hire at Lyra Health builds a usable program that hits HITRUST in 1 year, enforces MDM and disk encryption, turns on find-sec-bugs and CI build… | ||
| Caught My WebApp Cheating on Me! | Pedro Fortuna | 38m |
Web applications are routinely altered in the browser: examples include the 2015 Dridex man‑in‑the‑browser theft of at least $50M and a supply‑chain jQuery… | ||
| Supply Chain Attack Through CCleaner | Itai Tevet | 27m |
Avast’s CCleaner update carries a backdoor in the main executable v5.33.6162 modified executable that infects millions of users but the attacker delivers a… | ||
| KubeScope for the Extraordinary World of Containers | Tongbo Luo, Zhaoyan Xu | 20m |
KubeScope is a containerized API server proxy that inspects every HTTP REST request to Kubernetes, extracts URL parameters, headers and JSON payloads, and… | ||
| Securing DNSSEC with Ritual and Ceremony | Smiljana Antonijevic | 19m |
Anthropological study of Packet Clearing House and ICANN ceremonies shows concrete practices that produce trust: layered physical security (facility, safe… | ||
| Building Intelligent Automatons with Semantic Reasoning | Anton Goncharov | 32m |
Claims that graph-based ontologies (stored in a triple store) and a stack of RDF/RDFS/OWL let security teams consolidate alerts, asset, and vuln data into a… | ||
| So You Think You Can Patch | J Banghart, A Friedman, K Landfield, W Nather | 28m |
Panel documents concrete failure modes and mitigations: 4,687 NVD entries in three months, auto‑updates that brick a laptop, organizations that skip patches… | ||
| From Bounties to Bureaucracy | Brian Gorenc | 36m |
Zero Day Initiative describes a vendor-agnostic bug-buying operation that purchases high-value flaws for intelligence and protection, claiming $15 million paid… | ||
| Unraveling the Threat of Chrome Based Malware | Spencer Walden, Justin Warner | 29m |
Spencer Walden • Justin Warner - Unraveling the Threat of Chrome Based Malware
Most leading web browsers, including Google Chrome, offer users the ability to… | ||
| Netrepser – A JavaScript Targeted Attack | Cristina Vatamanu | 25m |
Netrepser is a JavaScript-based targeted framework that infects via malicious Word macros, drops an obfuscated JS payload that registers to C2 and returns an… | ||
| Navigating the Vast Ocean of Browser Fingerprints | Russell Thomas | 34m |
A practical method combines browser fingerprints with feature engineering to build sparse distributed representations that encode similarity directly, using… | ||
| Overcoming Obstacles in Operationalizing Security | Rafae Bhatti | 36m |
Creates a 30/60/90 roadmap and immediately hits a negative slope: resources don’t arrive fast enough and capability lags. Builds crude automation with JIRA… | ||
| Rapid-Fire Stories of Creative Solutions to InfoSec Problems | Katie Ledoux | 33m |
Team replaced reactive chaos with documented triage workflows and an in-house security awareness video, built an open-source phone checklist for activists… | ||
| Simple. Open. Mobile: A Look at the Future of Strong Authentication | Jerrod Chong | 33m |
FIDO U2F and FIDO2 (WebAuthn) replace phishable passwords with public‑key challenge‑response: the browser signs the challenge plus origin is signed so… | ||
| Machine Learning: Too Smart for its Own Good | Thomas Phillips | 25m |
A physical steampunk classifier is built from an aquarium air pump, gang valves and a Lego comparator that fuses 4-bit inputs into one output. It reliably… | ||
| The Memory of a Meltdown | Shane Cota, Chris Magistrado | 25m |
Demonstrates working proof-of-concept exploit of Meltdown/Spectre that uses flush+reload cache timing to leak privileged memory, including kernel pages and… | ||
| Using Math to Speed Up Security Assessments of Windows Executables | Cole Thompson | 31m |
Claims a triage tool that extracts ~20 static metadata fields from PE files, applies Euclidean distance on logged metadata to find nearest-peer binaries, and… | ||
| Listen to your Engine | Robby Cochran | 32m |
Demonstrates that system call streams yield high‑fidelity indicators of compromise: running a vulnerable Apache Struts in Docker, attaching strace/ptrace, and… | ||
| The SecDevOpronomicon | Clint Gibler | 29m |
Security teams are often outnumbered 100 to 1, so the talk argues for two concrete levers: ship secure-by-default libraries (examples: ban raw md5 by exposing… | ||
| PostgreSQL Threats and Attacks in the Wild | AJ Bahnken, Forrest Fleming | 22m |
Two honeypots are built and deployed: pghoney (low‑interaction, Go) and Sticky Elephant (medium‑interaction, Ruby), integrated with MHN & HPFeeds. Deployments… | ||
| The Memory of a Meltdown | Shane Cota, Chris Magistrado | 24m |
Live PoC demonstrates that speculative execution and cache-timing side channels let user code read memory outside permissions: PoC pulls kernel data via cache… | ||
| Lessons Learned Implementing Meaningful Access Controls... | Patrick O'Doherty | 27m |
Intercom spends nine months reducing internal access to customer data, cutting over 70% reduction in who can see critical data by baselining SSH certs… | ||
| Practical Steps for Reducing Exposure and Detecting Compromise | Jim Nitterauer | 34m |
Shows concrete exploits (DNS exfiltration, DNS tunnels for botnet C2, DGAs, EDNS0 abuse, cache poisoning, rebinding, MITM, TLD takeover, amplification and… | ||
| Closing Ceremony | Reed Loden | 14m |
Closing ceremony lists concrete totals and outcomes: almost 1,500 tickets sold with about 1,200 check‑ins (84%), conference Wi‑Fi peaks near 300 Mbps and… | ||
| Ask the EFF | N Cardozo, A Crocker, G Gebhart, S Lacambra, S. Li, K Opsahl | 36m |
Panel answers whether GDPR will reach US companies noting May 25 GDPR enforcement and explains Facebook said it would apply protections worldwide; describes… | ||
| Opening Remarks - Monday | Reed Loden | 05m |
Welcome back to day two of BSidesSF 2018 with logistical and community notes: there are 180 volunteers filling 250 slots, leading sponsors listed as… | ||
| Opening Remarks - Sunday | Reed Loden | 06m |
Opening remarks list concrete logistics and policy: the event runs entirely on 180 volunteers plus 13 year‑round staff, top sponsors are CloudPassage Google… | ||
| nothing matches | ||