BSidesSF 2023
2023-04-22..2023-04-23
San Francisco, United States
BSidesSF ·
[BSidesSF 2018, BSidesSF 2019, BSidesSF 2020, BSidesSF 2023, BSidesSF 2024, BSidesSF 2025, BSidesSF 2026]
| title | author | length |
|---|---|---|
| Opening Remarks - Day 1 | Reed Loden | 11m |
Conference opens framing the theme as security, putting the Cyber in space tied to the James Webb telescope and runs on 100 volunteers with ~19 leads and… | ||
| Keynote: The Expanding Universe of Cyber Threats | Dr. Xena Olsen | 42m |
Overview of concrete findings and tactics: cyber threat teams use MITRE ATT&CK, VirusTotal/VTI and simple tooling (strings, sandboxing) to triage exploit… | ||
| No Adversaries: Getting Users on Your Side for Tough... | Breanne Boland, Amy Martin | 21m |
Moves about 80 websites off Drupal 7 to a unified sf.gov platform and a company-wide anti-phishing rollout each expose the same lesson: technical fixes fail… | ||
| Building Production-Grade End to End Encrypted App... | Ehsan Asdar, Nishil Shah | 50m |
Skiff describes a working E2EE production stack: client-side keys derived via Argon2id + HMAC KDF, SRP/OPAQUE for phishing-resistant auth, per-user signing and… | ||
| Level Up Your Career | Rami McCarthy, Lea Snyder, Hasnain Lakhani, Kurt Boberg | 50m |
Panelists argue Staff+ means delivering cross‑org outcomes not just deeper code: examples include built fuzzing platform that finds native memory‑corruption… | ||
| Making of the BSides SF Astronaut Badge | Abhinav SP | 22m |
Full-color astronaut badge built as a single-sided PCB with components on the back, UV-printed artwork and lacquer gloss, powered by a coin cell and micro USB… | ||
| Stop Committing Your Secrets - Git Hooks To The Rescue! | Dwayne McDaniel | 14m |
Claim: stop secrets before they reach remote repos by running scanners in Git hooks. Evidence: a report finds 10 million secrets in GitHub public repos last… | ||
| Community Cyber Defense: How to be a Local Cyber Hero | Sarah Powazek | 12m |
Volunteer programs train people to do real work: university cyber clinics train 730 students who perform assessments and have helped 120 community… | ||
| Gamify security best practices to scalably improve engineering culture | David Trejo | 17m |
Internal Rails app Monocle aggregates GitHub, CircleCI, Jira and vulnerability data nightly, shows repositories graded A–F, and surfaces pull request checks… | ||
| Growing Your Skillset with Capture the Flag | David Tomaschik | 23m |
Organizer-run CTFs split into Jeopardy and attack‑defense formats and aim for realistic vulnerabilities, mostly web and crypto, with published challenge repos… | ||
| Catching the Phisherman | Nick Ascoli, Aidan Raney | 27m |
Investigation maps an active, automated Facebook Messenger phishing operation that uses an Android-emulator macro to harvest creds, then fans links across… | ||
| Cross Site Scripting 101 | Niru Ragupathy | 18m |
Basic XSS concepts are demonstrated with an actual beginner CTF challenge and a working exploit that reads a server-only flag via client-side JavaScript and… | ||
| What Does it Mean to Build a Proactive Security... | Mukund Sarma, Arkadiy Tetelman | 25m |
Argues that culture scales security more than headcount, cites a 1:150 security to engineer ratio, and gives concrete practices: embed security engineers, run… | ||
| Hunting Supply Chain Threats Using Anomaly Detection | Craig Chamberlain | 50m |
Case study shows anomaly detection on CloudTrail APIs (SQL-based analytics, MaxMind geo enrichment, planned Airflow pipeline) catching a supply‑chain… | ||
| Lessons Learned While Building a Privacy Operations Center at... | Shobhit Mehta | 40m |
Built a Privacy Operations Center at Headspace Health to cover 150+ countries and HIPAA GDPR CCPA requirements, organized into four pillars: governance… | ||
| Tracking Meaningful Security Product Metrics | Leif Dreizler | 25m |
Built an internal access workflow called Access Service that cuts approval time from hours or days to about 3–4 minutes, off-boards 60x employees in the first… | ||
| HSMs in Plain Envelopes: A Code Signing Story | Alexis Hancock | 23m |
Project needs immediate Windows trust for a public open source release so code signing certificate choice and hardware tokens matter. Certificate arrives on a… | ||
| Defining a Data Masking Framework at Scale | Sohini Mukherjee, Tim Lam | 26m |
Example company RealCorp evolves from blanket encryption to hashing, then to format-preserving encryption and finally to tokenization to enable analytics while… | ||
| New Apps, Good Snacks: Effective Threat Modeling for New Territory | Breanne Boland | 28m |
Threat modeling for a shared store tablet called Snack Adder evaluates concrete choices: authentication options compared are a 6–8 digit PIN, device… | ||
| New Face, Who Dis? Recent Adversarial Approaches to Facial Recognition | Mike Kiser | 26m |
Survey of recent adversarial methods compares concrete tools and measured results: pixel-level perturbations (early, fragile), GAN avatars, the Camera… | ||
| Certificate Transparency Logs: Roadmaps to Riches or Ruin? | Nolan Reisbeck | 51m |
Certificate Transparency logs prove and record every issued certificate by publishing pre-certificates to public, append-only Merkle trees, letting defenders… | ||
| Career Village - tales from a hiring manager | Sacha Faust | 26m |
Practical hiring advice about what to prepare and how to prove it: map three case studies (most impactful, biggest failure, coolest bug) with clear timelines… | ||
| Life of a Bug (an insight on the GitHub bounty... | Jeffrey Guerra, Caitlin Buckshaw | 26m |
Shows how GitHub routes a HackerOne report through HackerOne intake into an automated Slack-driven workflow that creates a lead, runs slash-command… | ||
| NLP for security log analysis : Learning to crawl before you run | Arjun Chakraborty | 26m |
Uses a fine-tuned DistilBERT to convert kubernetes audit logs into vector representations, training on ~7,500 samples to predict verb types and extract… | ||
| The History of Ransomware: From Floppies to Droppers, and Beyond | Eliad Kimhy | 24m |
History shows ransomware starting in 1989 as the AIDS Trojan distributed on 10–15k floppy disks, encrypting files with simple symmetric methods and demanding… | ||
| Hackers Don't Care About Scope | Ben Sadeghipour | 22m |
Claim that tight scopes hide bugs and attackers ignore scope; real findings come from testing DNS zones, dev APIs, exposed Jenkins, third‑party JavaScript and… | ||
| Overwatch: A serverless approach to orchestrating your... | Sanchay Jaipuriyar | 28m |
A serverless orchestration platform written in Go uses a GitHub App to ingest org‑wide events into a Go orchestrator that decides whether to invoke isolated… | ||
| FAIR STRIDE - Building Business Relevant Threat Models | Arthur Loris | 51m |
Combines STRIDE threat lists with FAIR risk math and Monte Carlo simulations to turn findings into dollars, 90% confidence intervals and log‑normal loss… | ||
| You lost data, unfortunately… Who will knock on your door and why | Gopi Ramamoorthy | 47m |
Claim: every organization faces inevitable data loss and must map data types, location and access because regulators and plaintiffs act fast. Evidence: 16… | ||
| Detection as Code: The Engineering-Focused Future... | Julie Agnes Sparks, Jackie Bow, Jessica Rozhin, Louis Barrett | 47m |
Teams move detections into version control with CI/CD to get detection as code and run adversary-as-code tests so a new rule is validated against simulated… | ||
| Hiring and Interviewing as Security Engineers | Arpita Biswas | 20m |
Distills hiring into three concrete interview tracks — product engineering, proactive infra/security engineering, and reactive/secops — and maps exact skills… | ||
| When is a vulnerability not a vulnerability? Overcoming the... | Adam Berman | 22m |
Claims that a pragmatic SCA program can ignore over 90% of alerts by using reachability analysis to surface only code paths that call vulnerable functions… | ||
| Container vuln management with (hopefully) minimal... | Alex Chantavy | 29m |
Lyft scans 1000+ service images, builds an image-lineage graph with cartography, and uses trivy feeds to convert findings into exact fix versions; an MVP… | ||
| Sleeping With One AI Open: An Introduction to Attacks Against... | Marta Janus, Eoin Wickens | 52m |
A taxonomy of practical ML attacks with live demos and tool names: model theft via query-based distillation (Knockoff Nets reproduced a model for ~$30)… | ||
| To Normalized Logs, and Beyond - Building a Threat Detection... | David Levitsky, Brian Maloney | 50m |
Built a replaceable, serverless AWS pipeline using Lambda, EventBridge, SQS, Kinesis Firehose and S3 to centralize heterogeneous logs, normalize with a… | ||
| Scalable security: how to win friends and not burn... | Eric Chiang, Brandon Weeks | 23m |
Describes running security at Google scale: building controls in audit mode to measure breakage, rolling out to 1%, 2%, 10% to limit tickets, and flipping… | ||
| Opening Remarks - Day 2 | Reed Loden | 12m |
Escalator out earlier leads to two stairwells opened plus elevators and a one-way escalator rule, and an extra food line to cut queues; 100% volunteer-run with… | ||
| Keynote: Hacking Policy and Policy Hacking - A Hacker Guide to... | Dr. Amit Elazari | 42m |
Describes how targeted actions — a GitHub repo of bug‑bounty contracts, a public “hall of fame” for safer terms and the disclose.io playbook — move companies… | ||
| HALT AND CATCH FIRE: Social Engineering CTFs for fun to a job as a... | Alethe Denis | 24m |
Transition from capture‑the‑flag contests to billable red team work shows concrete gaps: won Defcon social engineering CTF (2019) and Trace Labs black badge… | ||
| Protecting Pinner Passwords | Aalaa Kamal Satti, Yuru Shao | 25m |
Pinterest detects reused breached passwords with PinRipper (matching Pinterest DB dumps to third‑party breach records) and a reCAPTCHA password check against… | ||
| You don’t have to patch! | Pedro Fortuna, Jasvir Nagra | 25m |
Patching often takes weeks: testing, vendor coordination and rollouts delay fixes and patches sometimes fail to remove the vulnerability. Concrete mitigations… | ||
| What I learned about security working minimum wage at Hollywood... | Ben Schmerler | 21m |
Retail operations at a Hollywood Video store suffer chronic shrinkage because understaffing (4 people covering 9am–1am), a slow POS, and lax management create… | ||
| Take The Helm: Guidance For... | Kyle Tobener, Arianna Willett, Katie Ledoux, Emre Sağlam, Divya Dwarakanath | 53m |
Panelists describe concrete first‑time CISO work: choosing a time to join scaleups, running SOC2/ISO and pushing FedRAMP Moderate across every engineering… | ||
| Designing consumer account recovery in a 2FA world | Kelley Robinson | 26m |
Explains concrete recovery paths for WebAuthn and passkeys including passkeys syncing and cloud fallback to iCloud+SMS, shows that backup codes are actually… | ||
| Security Compliance as Code | Rahat Sethi | 24m |
Built a Common Controls Framework that funnels 2,500 to 350 controls into a baseline of about 100–140 controls so teams add only 10–50 extra controls for PCI… | ||
| Windows 11 At Your Service | Michael Bargury | 25m |
Claim: Windows 11’s built‑in Power Automate RPA can be turned into a persistent C2 and exfiltration channel. It uses Power Automate agents plus an outbound… | ||
| Cameras, CACs & Clocks: A Story of Millions of Interrogated and... | John Vecchi | 23m |
Claims that XIoT numbers top 60–70 billion devices and are growing ~18–20% yearly, with specific scans finding ~5 million cameras and 3.5M Hikvision devices… | ||
| Scraping after HiQ Labs v. LinkedIn | Hannah Zhao | 26m |
Ninth Circuit and Supreme Court decisions narrow CFAA risk: public pages are treated as accessible under a gates up/gates down framework from Van Buren, so… | ||
| Securing the Pipeline: Protecting Self-Hosted GitHub Runners | Adnan Khan | 51m |
Compromise of a single developer personal access token lets an attacker push a malicious workflow to repos that run on self-hosted runners, spin a detached… | ||
| Sure, Let Business Users Build Their Own. What Could Go Wrong? | Michael Bargury | 51m |
Scans of over 100,000 local low‑code apps reveal enterprises with 65,000 applications created in a few years and Microsoft reporting about 7–8 million low‑code… | ||
| The State of Blockchain Security - 2023 Edition | Peter Kacherginsky | 46m |
Annual numbers show about $3.7B stolen in 2022 with per-incident losses often ~$12M; major incidents include a $586M Binance Smart Chain node exploit, $325M… | ||
| Hacking the Hiring Process: Insider Tips for your InfoSec Job Search | Zach Strong | 21m |
Market is tighter so stop spam-applying and take a targeted, measurable approach: control your online footprint, update LinkedIn and resume, and tap referrals… | ||
| The Big “P” Problem in Cybersecurity | Stacey Champagne | 25m |
Claims that the field loses people because of the Peter Principle, backed by a 2018 study of ~50,000 sales reps showing promoted top performers cause a 7.5%… | ||
| How Segment proactively protects customer’s API keys | Sal Olivares | 26m |
Segment changes token format to an SGP prefix so secret scanners can match reliably, enrolls in GitHub/GitLab secret‑scanning partner programs, and runs a… | ||
| Security Hiring Trends | Erin Barry | 21m |
Claims a 35% employment growth 2023–2031 and ~3.5 million open security jobs by 2031, but hiring actually rewards builders who code and ship, not just… | ||
| Advanced Attack Vectors in Azure Environments | Zur Ulianitzky, Bill Ben Haim | 51m |
Shows concrete escalations: using az CLI and Microsoft Graph REST calls to find an app owner, reset its secret, and authenticate as the app; creating a… | ||
| Space and Cyberspace at the White House | Tanya Simms, Lauryn Williams | 50m |
Office of the National Cyber Director maps space system cyber risks to the Biden‑Harris National Cybersecurity Strategy, says SPD‑5 is useful but SPD-5 lacks… | ||
| The Best Defense is a Great Offense: Leveraging Automated... | Sam Manzer, Mike Parowski | 35m |
Claim: treat network telemetry as the primary detection source and validate detectors by generating real attacker traffic. Built an automated, ephemeral cloud… | ||
| Backup Plans for Your Backup Plans for Your Backup Plans | Margaret Fero | 22m |
Argues that a single BCP enactment can amplify other risks and shows concrete tools and failures: defines BCDR, BIA, RPO/RTO and covers scenarios like fire… | ||
| Go Far Together: Building Your Squad | Terry O'Daniel | 27m |
Concrete steps to build a peer squad: identify shared goals, recruit beyond your comfort circle, set short time‑boxed missions, and run regular… | ||
| Lost In Space: How to navigate Corporate Security as an Engineer | Maria Mora | 22m |
Corporate security here means securing business functions through stakeholder-driven risk management, not just code. Advice: map stakeholders, track… | ||
| Using machine learning to detect sensitive documents on SharePoint | Wilson Tang | 23m |
Project applies Random Forest one‑vs‑all classifiers to bag‑of‑words vectors plus regex for secrets to flag sensitive SharePoint files and API keys, deployed… | ||
| Placeholder for Dayzzz | Rojan Rijal | 40m |
Finds placeholder injection flaws in support portals that let attackers extract other users’ data by sending crafted tickets to Zendesk-backed APIs. Tests use… | ||
| First Security Hire: Building a sec... | Reed Loden, Coleen Coolidge, Tom Alcock, Kevin Hanaford, Mike McBryde | 51m |
Advice: wait until product market fit or Series A/B then hire a cloud security generalist who codes and pairs appsec with infra work, use CSO‑as‑a‑service… | ||
| Building an Endpoint Security program from scratch | Nishith Shah | 23m |
Builds an endpoint program by first defining scope and assembling an asset inventory via agent, network or browser telemetry, then mapping threats and… | ||
| Launch Control - Automating a Security Baseline... | David Levitsky, Olivia Hillman | 22m |
Describes a concrete system that deploys a declarative, self‑healing security baseline across many AWS accounts using Terraform and a hybrid workspace model… | ||
| How to CTF Infra - Beyond the challenges and flags | Max G, Jayesh Singh Chauhan | 21m |
Deployment uses ctfd on AWS with ECS + RDS + Redis and Terraform-managed infra; initial 2020 outage traces to Gunicorn default one worker throttling… | ||
| Disrupting Malicious Traffic with Egress Proxies | Dean Liu | 26m |
Lyft builds an Envoy-based egress gateway that forces outbound traffic through a client-aware CONNECT proxy with a transparent iptables sidecar to trap leaky… | ||
| Secret Hunting | Tanya Janca | 26m |
Secrets are easy to find with free scanners like truffle hog and Chekov using regex and entropy checks, and juniors or interns routinely unearth multiple live… | ||
| Using an mTLS Identity Provider to achieve Password-less auth... | Armen Tashjian | 20m |
Pinterest builds a custom IdP that replaces Okta SSO by validating device-bound client certificates at the Edge (Envoy does TLS termination and cert checks)… | ||
| MTV Reboot — my Super Sweet 16-bit malware... | Nika Korchok Wakulich | 50m |
Deep reverse engineering of MS-DOS malware shows actual techniques: hooking the IVT to install TSR payloads, infecting COM files (max ~63 KB), and… | ||
| How do you trust your open source software? | Naveen Srinivasan, Brian Russell | 25m |
Automated OpenSSF Scorecard runs 1.2 million weekly GitHub scans and reduces each heuristic to a score 0–10 per check, exposing concrete issues like… | ||
| Sandboxes all the way down - A hitchhiker's guide to platform... | Tom DNetto | 22m |
Survey of containment techniques claims kernel isolation is easy to deploy but routinely leaks via kernel bugs, so combine it with purpose-built mediators like… | ||
| WebAuthn, Yubikeys, and You: What we wish we knew before... | Alex Toombs | 27m |
Discord rolls out FIDO2/WebAuthn across 400+ internal users using Okta and Yubico hardware, requiring two authenticators per user (platform Touch ID/Windows… | ||
| Closing Ceremony | Reed Loden | 15m |
Almost 2,000 total participants with about 1,400 attendees, 113 presenters, 200 volunteers and 78 presentations and workshops. Capture the Flag logs show 54… | ||
| nothing matches | ||