BSidesSF 2019
2019-03-03..2019-03-04
San Francisco, United States
BSidesSF ·
[BSidesSF 2018, BSidesSF 2019, BSidesSF 2020, BSidesSF 2023, BSidesSF 2024, BSidesSF 2025, BSidesSF 2026]
| title | author | length |
|---|---|---|
| How to Orchestrate a Cyber Security Incident Tabletop Exercise | Melanie Masterson | 32m |
Walks through concrete tabletop scenarios: a SQL injection that stays 10 months undetected because logs aren’t centralized, an Active Directory script that… | ||
| Lyft Cartography: Automating Security Visibility and Democratization | Sacha Faust | 30m |
Lyft Security Intelligence builds and open-sources Cartography open-source platform, a Python CLI that syncs modular intelligence collectors into a Neo4j graph… | ||
| Navigating Passwordless Authentication with FIDO2 & WebAuthn | Jerrod Chong | 33m |
Explains how FIDO2/WebAuthn replaces passwords with per-site public‑key credentials and hardware or built‑in authenticators (USB/NFC/BLE/platform), already… | ||
| Offensive Javascript Techniques for Red Teamers | Dylan Ayrey, Christian Frichot | 33m |
Walks through concrete offensive JavaScript workflows: using BeEF, fetch/WebRTC and prebuilt recon (Certificate Transparency, VirusTotal, PassiveTotal) to… | ||
| Automating Web Application Bug Hunting | Jerry Gamblin, Jonathan Cran | 32m |
Tool demo of an automation platform that discovers and enriches an organization’s web assets, creates entity graphs and runs recursive scans to enumerate… | ||
| Friend or Replicant: How Attackers Automate and Disguise Themselves | Anna Westelius | 32m |
Claim: attackers assemble plug‑and‑play armies using AI-generated faces, cheap residential IP rentals (examples: peer‑to‑peer VPNs), and headless browsers to… | ||
| Abusing WCF Endpoint for RCE and Privilege Escalation | Christopher Anastasio | 29m |
WCF endpoints in .NET apps expose powerful operations that lead to real RCE and local privilege escalation: static analysis with dnSpy and Process/sys queries… | ||
| The Path to Infosec is Not Always Linear | Rachel Tobac | 28m |
A nonlinear route from neuroscience and rat‑lab experiments through improv lands in live social‑engineering contests and commercial services, with measurable… | ||
| Implementing a Kick-Butt Training Program: BLUE TEAM GO! | Ryan Chapman | 29m |
A practical five-week framework that trains analysts to do, not just memorize, with each week mapped to concrete skills: week 1 onboarding and SIEM setup with… | ||
| Journey to Command Injection: Hacking the Lenovo ix4-300d | Rick Ramgattie | 26m |
Lenovo ix4-300d firmware contains a chainable remote exploit: a command injection in share and personal-cloud fields plus a reflected XSS on the security page… | ||
| How to Lose a Container in 10 Minutes | Sarah Young | 34m |
Claims common cloud/container mistakes: default Kubernetes configs expose APIs and dashboards, secrets sit in etcd base64 and aren’t encrypted, and public… | ||
| DevSecOps State of the Union | Clint Gibler | 30m |
Summarizes ~40 recent DevSecOps talks and distills concrete wins: automated least‑privilege via repo‑kid that prunes AWS permissions until failure, an… | ||
| Back to the SOCless Future | Ubani Balogun | 32m |
Twilio Security Operations describes a serverless SOCless stack that automates response playbooks using AWS Step Functions to orchestrate short, modular Lambda… | ||
| All Your Containers Are Belong to Us | James Condon | 25m |
Scans using Census and Shodan find concrete exposures: about 21,000 Kubernetes API endpoints (mostly on AWS), roughly 500 web Kubernetes Dashboard instances… | ||
| A Deep Dive into Go Malware: Using Metadata to Empower the Analyst | Joakim Kennedy | 27m |
Stripped Go binaries still contain a recoverable PC-to-line table and rich type metadata, so function names, source file paths, and exact line numbers often… | ||
| Bye-Bye False Positives: Using AI to Improve Detection | Ivan Novikov | 23m |
Claims a practical system that reduces WAF/IPS false positives by treating SQLi payloads as tokenized lexeme time-series, preprocessing with a heuristic… | ||
| Self Care for Security Professionals | Caroline Wong | 35m |
Starts from lived crises—divorce, alcoholism, a child born the week a parent dies—and lays out specific coping tools that actually work: CBT techniques, nine… | ||
| How to Build an Application Security Program | Jerry Gamblin | 26m |
Argues there is no perfect appsec product and successful programs pair static + dynamic tools (static often ~$5k, dynamic $10,000–$20,000), rely on people more… | ||
| Don't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting Activity | John Stoner | 31m |
Argues that MITRE ATT&CK should drive focused hunts so teams stop "boiling the ocean," and demonstrates a Splunk-built adversary emulation (blue‑team CTF) that… | ||
| Anti-Privacy Anti-Patterns | Sarah Harvey | 29m |
Defines privacy as user control over both tangible PII and derived behavioral data, and argues web search and personalization plus cheaper servers lead… | ||
| Beyond AV: Detection-Oriented File Analysis | Josh Liburdi | 28m |
Argues for adding detection-oriented file analysis into detection stacks by showing a working system: Strelka, a Python + 0mq + protobuf pipeline that produces… | ||
| Hacking with a Heads Up Display | David Scrobonia | 27m |
A browser-integrated front end for OWASP ZAP overlays the app and runs site tree, spider, passive + active scanners and an intercept/break tool so scanning… | ||
| BADPDF: Stealing Windows Credentials via PDF Files | Ido Solomon, Adi Ikan | 23m |
Microsoft NTLM is an authentication protocol used on networks that includes systems running the Windows operating system and stand-alone systems. Despite… | ||
| Cats? In My Certificate Transparency Logs? | Scott Behrens, Ian Haken | 33m |
Certificate Transparency logs are a public, append-only store that must include any issued certificate and Chrome enforces this via SCTs. The authors scrape CT… | ||
| Two-Faces of WASM Security | Pranjal Jumde, Kaizhe Huang | 21m |
Shows concrete exploits against WASM modules compiled with Emscripten toolchain: buffer overflows and format-string-style overwrites of linear memory that… | ||
| Ethical Hacking: DIY Mobile Security Workstation (For Cheap) | Dale Meredith | 31m |
Reverse-engineers a $749 EC-Council kit and shows a working alternative built from Amazon parts for about $250 in parts: a Raspberry Pi 3 B+, 7" touchscreen… | ||
| Security Automation Simplified | Moses Schwartz | 23m |
Shows a concrete pipeline: a Splunk alert posts JSON to a lightweight Flask API on a DigitalOcean droplet which calls the Atlassian Python SDK to create a JIRA… | ||
| HTTP Security Headers: A Technology History Through Scar Tissue | Benjamin Hering | 31m |
History of browser-driven fixes that prevent real attacks and breakage: concrete headers and how to set them. Use X-Content-Type-Options: nosniff to stop MIME… | ||
| Treat the Problems, Not the Symptoms | Igal Gofman, Yaron Shani | 22m |
Shows how a failed remediation after a pen test leads to real breach — Singapore healthcare exposes 1.5M records — and demonstrates concrete AD attacks… | ||
| Goldilocks and the Three ATM Attacks | David M. N. Bryan | 28m |
Three ATM case studies show concrete failures: a hardened machine yields a stolen SAM and a custom management binary that accepts a two-packet 1,400-byte RCE… | ||
| Vendor Security: Where Our Data Goes We Follow | Justin Calmus, Rachel Black, Vivienne Pustell, Niru Ragupathy, Kyle Tobener, Wendy Zenone | 29m |
Panelists give concrete practices: use vendor questionnaires plus third‑party or in‑house pen tests (about 90% of high‑risk vendors get tested), triage by data… | ||
| Concrete Steps to Create a Security Culture | Arkadiy Tetelman | 24m |
At a 70-person startup a security program uses repeatable tactics: a Google Group security champions list, detailed "fireside bug bounty" emails with… | ||
| Fuzzing Malware for Fun & Profit | Maksim Shudrak | 28m |
Coverage-guided fuzzing against malware binaries proves practical: a patched WinAFL built on DynamoRIO (netAFL on WinAFL + DynamoRIO) feeds forged C2 responses… | ||
| Deploying Two-Factor Authentication to Millions of Users | Emanuele Cesena | 30m |
Built 2FA for Pinterest and ships it globally to millions, focusing first on login then on enable flows; implementation uses TOTP, push, and adds FIDO U2F… | ||
| Ferris Bueller's Guide to Abuse Domain Permutations | Rob Ragan, Kelly Albrink | 28m |
Research generates 3,457 subdomains across 16 major brands, finds Amazon controls 59% of its permutations while others hover near 10%, and uncovers live… | ||
| Slack App Security: Securing Your Workspaces From a Bot Uprising | Kelly Ann | 28m |
Slack checks that requested OAuth scopes are actually used and runs apps in test workspaces, but it lacks source code visibility and most apps sit atop larger… | ||
| Operation PZCHAO | Ivona-Alexandra Chili | 19m |
Malware campaign active since July 2017 targets Asia and infects a telemetry-observed 10,000 institutions across government, telecom, education and tech using… | ||
| High Performance VM Introspection | Cristinel-Ionel Anichitei, Raul Tosa | 25m |
Claims a concrete reduction in hypervisor exits by moving page-table filtering into the guest: a tiny, dynamically injected kernel stub uses the #VE… | ||
| You Might Still Need Patches for Denim | Maya Kaczorowski, Dan Lorenc | 30m |
Argues that patching shifts from in-place fixes to rebuilding images, using Kubernetes, container registries and content-addressable container registry digests… | ||
| Conquer the Enterprise from Inside | Simon Roses Femerling | 31m |
Advocates show that small on-site pentest dropboxes lower cost and simulate assume breach internal attacks using common hardware (Raspberry Pi, Pineapple… | ||
| RadRAT: An all-in-one toolkit for complex espionage ops | Ivona-Alexandra Chili | 17m |
Malware named RadRAT is active since at least 2015 and combines 92 commands with two main service DLLs that run as Windows services and switch behavior by… | ||
| The Secure Metamorphosis: Streaming Logs with Kafka and TLS | Tyler Paxton | 30m |
Kafka handles 5 billion messages/day into topics and partitions while TLS is added for transport; builders implement mutual TLS plus SASL… | ||
| Building Identity for an Open Perimeter | Tejas Dharamshi | 28m |
Netflix shifts from a network perimeter to identity-first zero trust by building a federation platform called Meechum that issues SAML/OIDC/OAuth tokens, uses… | ||
| Containers: Your Ally in Improving Security | Connor Gilbert, Connor Gorman | 26m |
Runtime monitoring collects which paths are written, which kernel capabilities a process requests (via a BPF probe), and which TCP connects happen, then uses… | ||
| WHOIS Calling the 80s to Get Their Finger Back | Joakim Kennedy | 23m |
Demonstrates a working RAT proof-of-concept that never opens sockets itself but abuses OS TCP utilities to get a reverse shell and exfiltrate data: whois over… | ||
| Guarding Against Protocol Subversion at Coinbase | Mark Nesbitt | 30m |
Coinbase describes concrete defenses: real-time blockchain parsers that detect hash changes and reorgs, alerting when depths exceed confirmation policies… | ||
| Career Mutation: A Panel on the Evolution to Management in Security | Zach Powers, Rachel Black, Chris Dorros, Daed Latrope, Kyle Tobener, Xiaoran Wang | 30m |
Panelists describe concrete tactics for moving from engineer to manager: take management classes (Crucial Conversations, coaching), start practicing leadership… | ||
| Collect All the Data; Protect All the Things | Aaron Rosenmund | 27m |
Argues that reducing mean discovery from ~146 days requires collecting network, host, application and telemetry data and correlating it, showing concrete tools… | ||
| Shall We Play a Game? | J. Wolfgang Goerlich | 30m |
Practical recipe for turning intelligence into practiced action: pick a breach story, map the attack steps to MITRE ATT&CK, break tactics into line-by-line… | ||
| Owning the Smart Home with Logitech Harmony Hub | Joseph Bingham | 18m |
Reverse engineering the Logitech Harmony Hub finds two vulnerabilities that chain to remote root without authentication or MITM, discovered by extracting… | ||
| How to Fix the Diversity Gap in Cybersecurity | Chloe Messdaghi | 25m |
Security workforce has 11 percent women and under 12 percent minorities, and the field faces an estimated 1.5 million shortage in 2019. Concrete examples show… | ||
| Attacking Deep Learning-Based NLP Systems | Toshiro Nishimura | 31m |
Demonstrates that by poisoning word embeddings — via injected Wikipedia or Twitter sentences, tampered corpora, or distributed pre-trained embeddings — an… | ||
| Making Sense of Unstructured Threat Data | Zainab Danish, Nicolas Kseib | 21m |
Trains Word2Vec/Doc2Vec on open-source reports from EU-CERT and US-CERT plus CVE text from NVD, then clusters document vectors to link vulnerability… | ||
| Arcades and Audits: What Gaming Can Do for Your Security Posture | Miranda Fullerton | 27m |
Gamifying business continuity and disaster recovery drills yields measurable gains: interactive arcade-style exercises reduce cognitive bias ~17% short-term… | ||
| Opening Remarks | Reed Loden | 09m |
Opening announcements cover schedule changes and logistics: sessions moved to 14 and 15 with overflow in 10 and 11, villages and CTF run until 5:00, chill-out… | ||
| Securing Online Identities with Simple, Secure, Open Standards | Stina Ehrensvard | 32m |
Company builds a USB/NFC device that emulates a keyboard to inject cryptographic responses and coauthors the U2F/FIDO2 standard now exposed as WebAuthn in… | ||
| Profiling "VIP Accounts" Access Patterns in User-Centric Data Streams | Rod Soto, Joseph Zadeh, Xiodan Li | 27m |
Real-time pipeline ingests Active Directory and Kerberos events via Kafka Streams and builds per-account graphs scored with PageRank + SVD; anomaly detection… | ||
| Do You Even Tech Anymore: Management & Leadership in Security? | Mark Hillick | 31m |
Riot built a self-service and feedback-driven security program across a hybrid infrastructure and deliberately delayed a POODLE TLS change because millions of… | ||
| Surfing the Motivation Wave to Create Security Behavior Change | Masha Sedova | 30m |
Argues that training alone fails and behavior needs motivation ability trigger (Fogg model); shows concrete fixes: install a password manager to raise ability… | ||
| Do Androids Dream of Electric Fences? | Brandon Weeks | 23m |
Practical steps to manage Android devices: require SafetyNet Attestation and recent security patches (Pixels get updates immediately; allow two major versions… | ||
| Strangeways, Here We Come | Victor Clark | 30m |
A natural language engine gets migrated from on‑prem into AWS as a cluster of Fargate containers behind API Gateway -> VPC Link -> NLB -> Fargate -> RDS, with… | ||
| Closing Ceremony | Reed Loden | 07m |
Record attendance hits about 2,200 people with 1.6k tickets, ~83% checked in and 101 sessions plus workshops; network runs on a 1 Gbps uplink from Webpass with… | ||
| Contact Center Authenticaion | Kelley Robinson | 35m |
Research calls to about 45 contact centers reveal most systems use phone, email or DOB to identify customers but rarely authenticate them; several ask for… | ||
| Opening Remarks | Reed Loden | 08m |
Opening remarks list logistics and rules: the event runs with 20 core staff and over 200 volunteers, lunch is 12:00–1:30, CTF and villages run until 5:00 with… | ||
| Ask the EFF | Andrew C, Kurt O, Cooper Q, Sydney L, India M, Alexis H, Alex M | 32m |
Updates on litigation, tools and campaigns: ongoing Jewel litigation dates to 2008 and a recent Ninth Circuit ruling lets judges review secret evidence; a… | ||
| nothing matches | ||