BSidesSF 2020
2020-02-23..2020-02-24
San Francisco, United States
BSidesSF ·
[BSidesSF 2018, BSidesSF 2019, BSidesSF 2020, BSidesSF 2023, BSidesSF 2024, BSidesSF 2025, BSidesSF 2026]
| title | author | length |
|---|---|---|
| Day One Opening Remarks | Reed Loden | 10m |
Opening notes list concrete logistics and community numbers: about 185 volunteers and ~30 year‑round staffers run a three‑floor event with multiple tracks… | ||
| Keynote: Dumping Traditional Security Teams | Fredrick "Flee" Lee | 38m |
Argues that centralized security teams shrink outcomes and instead shifts ownership to product and dev teams, scaling security from tiny staffs (<1% of… | ||
| Fantastic AWS Attacks and Where to Find Them | Georgios Kapoglis | 20m |
Demonstrates concrete AWS detections mapped to the ATT&CK Cloud matrix: hunts for STS assume-role from EC2 metadata abuse, anomalous create-user &… | ||
| Checking Your --privileged Container | Sam "Frenchie" Stewart, Maya Kaczorowski | 24m |
Shows that the --privileged flag effectively disables confines: containerd sets withAllCapabilities, mounts the host fs, rewrites read-only mounts, disables… | ||
| Graph Based Detection and Response with Grapl | Colin O'Brien | 46m |
Grapl is an open source graph analytics detection and response platform that ingests Sysmon or JSON logs, deduplicates entities into a master graph and claims… | ||
| How Software Transparency Can Help Save the World | Allan Friedman | 27m |
Claim: a machine-readable SBOM lets organizations answer “Am I affected?” by mapping actual components and versions, hashes and relationships. Work focuses on… | ||
| How to Kill an AWS Access Key | Benjamin Hering | 25m |
Shows how static AWS access keys get replaced by SAML + STS using AWS’s assume-role-with-saml API, Okta as the IdP, and a helper CLI (aws-okta or equivalents)… | ||
| Panel: Let's Get 360 w/Bug Bounty! | Maria M, Chloé M, Jeff B, Tanner E, Ben S | 50m |
Panelists compare hunter, triage and company workflows and say communication is the biggest bottleneck, not tools. Hunters report spending from a few hours a… | ||
| Peeling the Web Application Security Onion | Noam Lorberbaum, Keith Mashinter | 23m |
Redesign separates static and dynamic layers and hardens each with concrete components: React + nginx + S3 CDN for public assets with strict content security… | ||
| Hanging on the Telephone: Hacking VoIP | Sarah Young | 21m |
History of phone hacking traces from Captain Crunch whistles and blue boxes to modern SS7 exploits, but practical risks are current: IP phones register with a… | ||
| The Voight-Kampff Test for Discovering Vulnerabilities | Vanessa Sauter | 25m |
Builds a practical filter that separates vulnerabilities found by dynamic scanners from those that require human context. Uses Cobalt data from about 300… | ||
| MOSE: Using Configuration Management for Evil | Jayson Grace | 23m |
MOSE is an open-source Go binary that translates a single command or script into Puppet/Chef/Ansible/Salt payloads, automating discovery of where to place… | ||
| A Look at Jython-Enhanced Reverse Engineering with Ghidra | Byron Roosa | 47m |
Shows a concrete Ghidra workflow that automates resolving SpyEye’s hashed Windows API calls by using Ghidra’s Java/Python API and the built-in decompiler. It… | ||
| Mapping the Connections Inside Russia’s APT Ecosystem | Ari Eitan | 17m |
Research collects roughly 2,000 unique Russian-attributed samples, classifies them into 60 families and 200 modules, disassembles binaries into assembly… | ||
| Non-Political Security Learnings from the Mueller Report | Arkadiy Tetelman | 21m |
Timeline shows 90 spear phishing emails in mid-March 2016, John Podesta phished March 19, GRU gains DCCC access April 12 then pivots over a VPN to the DNC… | ||
| Secure by Design: Usable Security Tooling | Hon Kwok | 17m |
Rewrote the entire frontend for an internal scanning tool, adding deep linking, a conventional navigation bar, a dark theme, and denser tables that increase… | ||
| Purple is the New Black: Modern Approaches to Application Security | Tanya Janca | 24m |
Combines defence, offence, automation, empathy and continuous learning into a practical app-sec playbook: adopt zero trust and assume breach mindsets; secure… | ||
| Visualizing Security | Jay Jacobs | 40m |
Animated packet captures from AWS reveal a slow, massive scan that originates from Vietnam and runs for roughly 40 hours across TCP and UDP, created by… | ||
| Bootstrapping Security | Jared Casner, Rob Shaw | 24m |
Bootstrapped fintech describes concrete steps: make security part of every job description, require a one-page RFC time-boxed to under two hours, run continual… | ||
| Serverless Osquery Backend and Big Data Exploration | Geller Bedoya | 25m |
CloudFlare builds a serverless osquery backend called cenote on GCP using Cloud Functions, Pub/Sub, Redis, BigQuery, Stackdriver and memcache, decoupling… | ||
| Privacy Nightmares while Using ML/AI | Sameer Ahirrao, Yogesh Karpate | 25m |
Sameer Ahirrao, Yogesh Karpate - Privacy Nightmares while Using ML/AI in Your Applications
Everyone is excited with using ML And AI in applications but what… | ||
| Dispatch: Crisis Management Automation | Marc Vilanova, Forest Monsen | 26m |
Dispatch automates the full incident lifecycle: a simple intake form that creates JIRA tickets and Slack channels, assigns an incident commander, pages on-call… | ||
| Ask the EFF | Alexis Hancock, Kurt Opsahl, Hayley Tsukayama, Jamie Williams | 38m |
Updates on surveillance, encryption, compelled decryption, and privacy cover concrete wins and active fights: HTTPS Everywhere ships inside Tor and Brave… | ||
| Sharks in the Water: Open Source Component Risk and Mitigation | Aaron Brown | 24m |
Open source components explode in volume — roughly 22,000 new releases per day since 2018 and NPM alone supplies most app code — and risk follows: enterprises… | ||
| CISO Vendor Relationship Podcast | David Spark, Mike Johnson, Olivia Rose | 44m |
45-minute live podcast recording that mixes rapid-fire advice, listener Q&A and a game called "What's Worse?" and gives concrete vendor-CISO tactics: stop cold… | ||
| Break Crypto like a Pro! | Alexei Kojenov | 42m |
Shows concrete exploits and working demos: Github code reproduces an attack that decrypts a ciphertext via a padding oracle demo in seconds, an RC4 image XOR… | ||
| Adventures in Vendor Security and Continuous Review | Lokesh Pidawekar | 23m |
Builds a continuous vendor-review pipeline that scans public sources daily and cross-checks them with any available SOC 2 or pen‑test evidence, claiming work… | ||
| Managing the Assets of Your Security Career | Kyle Tobener, Chris John Riley | 25m |
Argues that treating stakeholders as trackable assets and managing them with simple tooling increases influence and promotion success: uses a Google… | ||
| Transform Your Presentation Skills | Anne Ricketts, Hilary Spreiter | 50m |
Workshop gives precise, repeatable changes: use feet hip-distance and a piece of tape on stage to ground movement, match gestures to words, hold eye contact… | ||
| Day Two Opening Remarks | Reed Loden | 09m |
Conference hits its 10th anniversary and runs with logistics: morning pancakes, lunch 12:00–1:30, sponsor raffle at 12:30, Career Center open 11:00–3:00 in the… | ||
| Keynote: What's New or Not in 2020: Are we Making Progress? | Larkin Ryder | 36m |
A decade review names concrete incidents and shifts: Stuxnet damaged about $20M of centrifuges and used USBs to bridge air gaps, WannaCry hits 150 countries… | ||
| Leveraging Osquery for DFIR at Scale | Sohini Mukherjee | 20m |
Claims that OSQuery can fast‑track DFIR by collecting live artifacts at scale: process execution, command lines, open sockets, loaded DLLs and file mtimes… | ||
| Chrome Extension Risks and You | Chris Barcellos, Abhi Kafle | 21m |
Lyft inventories ~8,000 Chrome extension IDs from a quick sample, scores them with CRXcavator, imports results into a cartography module, and builds an… | ||
| Lessons from DevSecOps Trenches | Clint G, Zane L, Astha S, Justine O, Doug D | 49m |
A frank account of what actually works: a homemade dynamic analyzer once DOSed PagerDuty so scripts need operational testing; year‑long SAST/DAST rollouts… | ||
| San-Serif Rules Everything Around Me | Travis Knapp-Prasek | 09m |
Mixed‑case sans‑serif makes lowercase l and uppercase I visually identical in Gmail, Apple iMessage, Facebook and Twitter so simple homograph phishing is… | ||
| The GCP Metadata API | Dylan Ayrey, Allison Donovan | 30m |
GCP’s metadata API returns instance credentials and can be abused despite extra protections; defaults attach powerful service accounts to cloud functions and… | ||
| k-rail: A Tool to Manage K8s Securely at Speed | Dustin Decker | 25m |
k-rail enforces pod-level rules via a validating/mutating webhook to block risky configs (no bind mounts, no privileged containers, no hostNetwork, image hash… | ||
| Security, Politics, Neutrality, and Protecting Users | Brendan O'Connor | 26m |
Tech neutrality causes concrete harms: companies volunteer to enforce foreign court orders like GitHub takedown of Tsunami Democratic, legal theories claim… | ||
| Securing Coinbase’s Edge Payments Infrastructure | Nishil Shah | 46m |
Coins move through brittle rails: concrete examples include ACH routing+account only auth that lets anyone with numbers initiate pulls, NACHA files that are… | ||
| Developing a Baseline Security Standard for Endpoint Devices | Claire Moynahan | 11m |
Project builds a measurable endpoint baseline for laptops and workstations and maps OS controls to a Boolean compliance score across Windows 10, macOS, and… | ||
| If You’re Not Using SSH Certificates You’re Doing SSH Wrong | Mike Malone | 11m |
Argues that simple public‑key SSH is the operational and security problem and that switching to certificate auth fixes it: OpenSSH added certificates in… | ||
| From Cockroaches to Marble Floors | Daniel Tobin, Paul Pereyda Karayan | 28m |
Argues that treating security flaws as ordinary defects cuts breach risk and raises product quality by aligning QA, DevOps and security around the same metrics… | ||
| Real Time Vulnerability Alerting | Amol Sarwate | 47m |
System ingests public feeds (NVD, Exploit-DB, vendor advisories, blogs, Twitter), stores records in RDS relational DB, and uses multiple AWS Lambda jobs plus a… | ||
| So You’re the First Security Hire | Bryan Zimmer | 19m |
Practical roadmap for the first security hire: inventory crown jewels, map legal and customer compliance needs, and rank threats with Mitre ATT&CK and CVSS to… | ||
| 2FA in 2020 and Beyond | Kelley Robinson | 24m |
Data show tradeoffs: SMS is easy to onboard but vulnerable to SS7 and SIM‑swap; Google finds SMS blocks 100% of automated bots, 96% of bulk phishing and 76% of… | ||
| Creating Threat Intelligence Signals in a “Zero Trust” Environment | Or Katz | 17m |
Argues that threat intel must shift from perimeter alerts to entity-focused, signal-based data→signals→actions that score user and device trust and apply… | ||
| Security Learns to Sprint: DevSecOps | Tanya Janca | 27m |
Argues that security stops being the bottleneck by matching DevOps cadence: break security work into sprints, make critical security bugs break the build, and… | ||
| How to 10X Your Company’s Security (Without a Series D) | Clint Gibler | 47m |
Summarizes a practical playbook pulled from 50+ talks and dozens of tools and shows concrete wins: continuous PR scanning with fast AST checks using sgrep AST… | ||
| When GDPR and CCPA strike | Rafae Bhatti | 25m |
GDPR and CCPA turn “works-as-designed” data use into legal risk: Equifax’s settlement hits about $700M, Cambridge Analytica affected ~87M profiles and would… | ||
| Phishy Little Liars - Pretexts That Kill | Alethe Denis | 22m |
Shows how to use OSINT to build fast, target-specific pretexts that actually work: comb Glassdoor, LinkedIn, corporate videos, geotagged Instagram and image… | ||
| Panel: Mental Health for Hackers | Chloé M, Ryan L, Susan P | 42m |
Panel outlines measurable claims and built interventions: community nonprofit Mental Health Hackers spins up a mental health village at conferences (yoga… | ||
| How To Write Like It's Your Job | Brianne Hughes | 22m |
Practical five-step system: admit writing is part of the job, dump a rough first draft, set aside explicit editing time, use concrete tools and checklists… | ||
| RIS-ky Business: Exploiting Medical Information Systems | Jacob Brackett | 22m |
Research shows radiology networks accept unauthenticated DICOM associations via guessable AE titles, allowing remote C‑FIND queries and C‑STORE uploads… | ||
| How The Coasts Approach Information Security Differently | Sourya Biswas | 20m |
Banks prioritize compliance and documented processes while Valley firms prioritize speed and engineering; consequence: financial firms often show deprecated… | ||
| An Effective Approach to Software Obfuscation | Yu-Jye Tung | 26m |
Argues that most obfuscation boosts potency and resilience but ignores stealth, making transforms easy to detect. Analyzes LLVM’s control-flow flattening… | ||
| Closing Ceremony | Reed Loden | 14m |
Record attendance of 2,342 participants and 1,678 badges distributed supports a volunteer-run conference with 185 volunteers filling 349 shifts for over 1,200… | ||
| Mistakes Made Integrating Security Scanning into CI/CD | Atul G, Moses S | 26m |
An expired SSL certificate causes 100+ Slack alerts and a seven to eight hour outage that breaks many Jenkins pipelines, so the team builds a Jenkins shared… | ||
| What Should and Shouldn’t Scare You: Kubernetes and Containers | Connor Gilbert | 19m |
Kubernetes standardizes images with content-addressable images (SHA-256 digests) and exposes a discoverable API that lets you audit running workloads; concrete… | ||
| nothing matches | ||