~/conference

BSidesSF 2025

Name: BSidesSF 2025
Start: 2025-04-26
End: 2025-04-27
Location: San Francisco

date:2025-04-26..2025-04-27

location:San Francisco, United States

website:https://bsidessf.org/a/2025/

series:BSidesSF · 7 editions

editions:[BSidesSF 2018, BSidesSF 2019, BSidesSF 2020, BSidesSF 2023, BSidesSF 2024, BSidesSF 2025, BSidesSF 2026]

tags:[security]

title	author	length
Understanding IRSF Fraud: Protecting Against...	Vien Van, Senthil Sivasubramanian	28m
Explains that SMS 2FA can fund International Revenue Share Fraud by routing huge SMS/voice volumes to premium numbers, with 8 million IPRNs created in a year… Talk on
Closing Remarks	Reed Loden	15m
Closing ceremonies recap lists concrete outcomes: 2,500 participants and the biggest BSidesSF ever, 363 CFP submissions reviewed by a 13‑person team leading to… Talk on
Your Intrusion Detection Still Sucks (And What to Do About It)	Jason Craig	34m
Argues that intrusion detection still fails at scale and gives concrete fixes: measure and reduce median dwell time (reported 10–15 day median dwell time with… Talk on
How to Train Your Detection Dragon	Geet Pradhan	37m
Built a detection and response pipeline from scratch for a mid‑size production stack, ingesting about 10–20 sources prioritized by compliance and business… Talk on
CISO Series Podcast - LIVE!	David Spark, Andy Ellis, Alexandra Landegger	46m
Live podcast records candid CISO debate with actionable specifics: a missed AAR shows accountability is everything, 15 people report 15 people reported courses… Talk on
Slaying the Dragons: A Security Professional’s Guide to...	Kirill Boychenko	44m
Open source dependencies supply 70–90% of an app and attackers exploit that scale with typosquatting, author impersonation, obfuscated multi‑stage payloads and… Talk on
Trust Engineering: Building Security Leadership at Early-Stage...	Mike Privette	31m
Trust Engineering is a five-step framework that claims the first security hire succeeds by aligning with sales and marketing, making security work visible… Talk on
The Four Tribes of Security Champions	Marisa Fagan	30m
Framework claims that security champion programs fall into four practical types — The Apprentices, The Learners, The Fan Club, The Sentinels — and recommends… Talk on
Blank Space: Filling the Gaps in Atomic and...	Merav Bar, Gili Tikochinski	30m
Claim: cloud-specific atomic and behavioral IoCs let defenders detect and link attacks that evade IP/hash/domain lists. Method: a honeypot that seeds leaked… Talk on
The Power of Persuasion: Better Security Through... Manipulation?	Nate Lee	30m
Argues that specific behavioral levers — reciprocity, social proof and commitment and consistency — produce measurable security gains: language tweaks raise… Talk on
Trawling for IOCs: Catching C2 in a Sea of Data	Moses Schwartz	30m
Data-driven detection engineering focuses on extracting concrete indicators and turning them into rules and feeds: pivoting a signer name in VirusTotal yields… Talk on
There and Back Again: Discovering OT Devices Across Protocol Gateways	Rob King	32m
Claims specific methods to enumerate OT gear across protocol gateways, demonstrating working parsers and live scans that find roughly 10,000 internet‑exposed… Talk on
Follow the Trace: How Traditional AppSec Tools Have Failed Us	Kennedy Toomey	31m
Runtime tracing shows actual attack paths by instrumenting a vulnerable Flask app with flame graphs, reproducing an SSRF that reaches an internal service, and… Talk on
Navigating the Unknowns: Fraud Mitigation for Netflix Live...	Aditi Gupta, Yue Wang	33m
Netflix adds live streaming in 2023 and scales in 2024, facing content piracy, account takeover and DDoS; a piracy scrape shows half a million viewers on a… Talk on
Sharing Vulnerabilities	Clint Gibler	48m
Reflective keynote arguing that emotional intelligence tangibly improves careers and relationships, illustrated with concrete examples: a supply chain… Talk on
Everyday AI: Leveraging LLMs for Simple...	Matthew Sullivan, Dominic Zanardi	19m
Instacart demonstrates practical LLM automation: 95% auto-approve of identity requests using short prompts, Python Lambdas or a workflow builder (Tines +… Talk on
Can Cyber Mercenaries and Human...	Bill Marczak, Cooper Quintin, Eva Galperin	46m
Companies like NSO, FinFisher and Paragon sell implants (mobile and desktop) and turnkey services that governments buy for million dollar contracts to target… Talk on
Light in the Labyrinth: Breach Path Analysis for Anyone	Parker Shelton	38m
Claims a usable “treasure map” of breach paths is buildable with mostly no‑ or low‑cost tooling and that Microsoft’s internal asset graph and breach‑path DB… Talk on
Centralizing Egress Access Controls Across a Hybrid Environment...	Ramesh Ramani	29m
Block centralizes egress policies across multi‑cloud and data‑center environments by mapping applications (via SPIFFE ID mapping) to domain groups stored in… Talk on
Radical Results: A Security Org's Version of Radical Candor	Evan Johnson	31m
Repurposes Radical Candor into a team-level quadrant with axes vibes vs effectiveness and a plotted-dot tool (ejcx.dev/radicalresults) to score projects… Talk on
Future-Proof Your...	Jay Sarwate, Alok Tongaonkar, Prutha Parikh, Ketan Nilangekar	44m
Panelists argue that generative AI already automates tasks like secure code reviews and scaling remediation scripts but still hallucinates bad fixes and… Talk on
Log In Through the Front Door: Automating Defense Against...	Barath Subramaniam	31m
Claims that stolen credentials drive a large share of breaches and shows an operational pipeline that actually blocks them: ingest public combo lists and… Talk on
Decentralized Communications: Deep-Dive into APRS...	Ankur Tyagi, Mayuresh Dani	44m
Comparison of two decentralized radio stacks with concrete tradeoffs: APRS runs AX.25 on ham bands (144.390 MHz in North America), requires an FCC call sign… Talk on
Trust Engineering: Building Security Leadership at Early-Stage...	Mike Privette	30m
Shows concrete measurements and an operational plan: CT log scans find 398 days average certificate lifetimes, 72% had certificate outage in the past year, and… Talk on
Enhancing Secret Detection in Cybersecurity...	Danny Lazarev, Erez Harush	31m
Fine-tuned a small LLM for secret detection using an LLM-agent labeling pipeline over 100,000 labeled files (cost ≈ $5,000) and LoRA adapters plus model… Talk on
State of (Absolute) AppSec	Seth Law, Ariel Shin, Lakshmi Sudheer, Ken Johnson	45m
Claims that secure by defaults cuts whole vulnerability classes (example: CSP to reduce XSS) but organizations still miss priorities—CI/CD and supply‑chain… Talk on
Shadow IT Battlefield: The CyberHaven Breach and...	Rohit Bansal, Zach Pritchard	31m
A vendor breach lets attackers upload a poisoned Chrome extension by abusing OAuth; that campaign hits ~30 other extensions but a preexisting allowlist for… Talk on
WHOIS Your Daddy: Tracking Iranian-backed Cyber Operations...	Austin Northcutt	21m
Investigation begins from four malicious IOCs and uses passive DNS and registration WHOIS pivots to link a unique name server hosterdaddy.net to 12 co‑hosted… Talk on
Into The Dragon’s Den	Jacob Salassi, Michele Freschi	44m
Explains concrete risks and concrete mitigations for launching a SaaS product in China: expect mandatory joint ventures/operating partners, government access… Talk on
One SOC, The Whole SOC, and Nothing But The SOC, So Help Me	Carson Zimmerman	41m
Argues the SOC must be atomic: keep triage/analysis/response, hunt/detection/intel, tools/architecture and situational awareness together or chaos follows… Talk on
The Growing Crisis in CVE Data Quality	Jerry Gamblin	30m
CVE records grow fast and many are low quality: 30% more CVEs year‑over‑year and 291,000 CVEs in NVD with roughly 24,000 lacking CVSS/CPE/CWE and about 20%… Talk on
How to Tame Your Dragon: Productionizing Agentic...	Thomas Vissers, Tim Van hamme	46m
Agentic email assistants are exploitable: a spear-phishing white-text prompt injection tricks rule selection and summarization to authorize an illicit payment… Talk on
Versus Killnet	Alex Holden	31m
Reveals that Killnet grows to 120,000 members and about 100,000 contributors, then collapses after a nine‑person team exploits a persistent backdoor, uses… Talk on
Opening Remarks	Reed Loen	14m
Day-two logistics, rules and on-site services: a code of conduct with zero tolerance and photo rules (official photographer will blur or delete on request)… Talk
The Art of Cybersecurity Mastery: From Entry-Level to Staff+	Florian Noeding	31m
Focuses on product security with concrete practices: adopting static code analyzers, SBOMs and software composition tools, and prioritizing memory safety in… Talk on
Data Splicing Attacks: Breaking Enterprise...	Vivek Ramachandran, Audrey Adeline	44m
Claims an exfiltration method that can bypass all major DLP vendors listed by Gartner, demonstrates five techniques (binary channels, sharding, client‑side… Talk on
How to Pull Off a Near Undetectable DDoS Attack...	Simon Wijckmans	25m
Claim: attackers buy cheap ad placements and push obfuscated JavaScript into real browsers to mount near‑undetectable layer‑7 DDoS that looks like normal… Talk on
Threat Modeling Meets Model Training: Web App Security Skills...	Breanne Boland	29m
Central claim: existing web app security techniques mostly cover LLM risks, so teams can threat model AI by applying sanitization, access controls, and… Talk on
Dragging Out Dragons: Slaying Hidden Threats in Residential...	Christo Roberts	33m
Residential and mobile proxies are the primary method bots use to appear legitimate, with mobile proxies giving the highest authenticity and evading IP rate… Talk on
Charting the SSH Multiverse	HD Moore	31m
SSH landscape has dozens of implementations with vendor forks, custom stacks and embedded libraries that leak precise OS and package versions from one packet… Talk on
Inside the Information Stealer Ecosystem: From Compromise...	Olivier Bilodeau	49m
Research shows information stealers routinely exfiltrate desktop screenshots, browser vaults, extensions and MFA secrets, sometimes uploading directly to… Talk on
15 Years of BSidesSF...	Reed Loden, Ricky, Steve, Tania McClain, Meghan Manfre	44m
Fifteen-year history condenses into concrete changes: growth from a single venue to a full buyout of 16 auditoriums, reinstated graphic recordings brought back… Talk on
The Product Security Imperative: Lessons from CISA	Jack Cable	31m
CISA’s secure by design pledge launches in 2023, reaches 300+ signatories with 68 initial commitments, but only ~30 public progress reports so far; major… Talk on
Adventures & Findings in ISP Hacking	Ian Foster	25m
Local ISP control plane is reachable from the customer WAN by adding addresses on 192.168/10/172.16 space and reveals routers, switches and services (SNMP… Talk on
Secure Designs, UX Dragons, Vuln Dungeons...	Mike Shema, Kalyani Pawar	44m
Live podcast digs into concrete tradeoffs: a secure-by-design white paper plus a public pledge that lands 300 companies pledged, the claim that memory-unsafe… Talk on
Plays Incident Response	Maya Kaczorowski, Whitney Merrill	25m
Interactive incident-response exercise that stages a KYC vendor bug leaking other users’ IDs to signups, affecting about 20,000 IDs leaked mostly in the US… Talk on
Mind vs Machine: The Role of Human Psychology...	Anubha Nagawat, Ashutosh Gupta	26m
Argues that human psychology and AI require different security designs and gives concrete evidence and mitigations: cites 45:1 non‑human identities growth… Talk on
Care and Feeding of HSMs: Key Management in Hard Mode	Nick Pelis	32m
Argues that HSMs solve key custody but introduce operational nightmares illustrated by real incidents: keys zeroized after misplaced units, batteries and… Talk on
Uncharted Minds: Exploring...	Peter Coroneos, Deidre Diamond, Kayla Williams	45m
Panel claims burnout is a neurological condition recognized by WHO, driven by chronic hypervigilance and manifesting as emotional exhaustion, cynicism, and… Talk on
Slaying Dragons Together...	Stanley Barr, Mary C Yang, Leslie Z Anderson	45m
Describes how multidisciplinary teams at MITRE convert decade-long deception research into reusable community resources: the ATT&CK knowledge base (originating… Talk on
Opening Remarks	Reed Loen	14m
Event logistics and policies condensed: the conference runs across 16 auditoriums on three floors with theater 14 hosting talks that were scheduled for 15… Talk
Decoding GraphQL: How to Map Hidden...	Antoine Carossio, Tristan Kalos	32m
Scans of the top 1M domains find ~200k GraphQL endpoints with ~60k exposing introspection; automated testing using a custom reinforcement learning algorithm… Talk on
Mind the Gap: Career...	Josh Liburdi, Elle McKenna, Sarai Rosenberg, Andrew Kline	47m
Four-panel discussion shares concrete career actions: become a T-shaped engineer (deep in 1–2 areas, broad elsewhere), force one consecutive week of PTO every… Talk on
The Silent Breach: Security Threats in Google Workspace	Rex Guo, Khang Nguyen	22m
Google Workspace audit logs miss key forensic signals so attackers can escalate and persist: a Chrome Web Store OAuth phishing chain yields refresh tokens to… Talk on
AppSec as Glue...	Mukund Sarma, Tad Whitaker, Sarah Liu, Ariel Shin, Jacob Salassi	41m
Teams describe building a platform for vulnerability management with centralized dashboards that engineers use to prioritize fixes, and a security platform… Talk on
Preparing for Dragons: Don’t Sharpen Swords. Set Traps, Gather...	Adrian Sanabria	31m
Argues that survival beats flashy “dragon‑slaying”: most breaches are simple misconfiguration and legacy tech, not exotic exploits, so prioritize asset… Talk on
Hack, Patch, Repeat: Insider Tales from Android’s...	Maria Uretsky, Camillus Cai	42m
Shows how the Android VRP turns research into fixes: a 2023 Cropalypse uncrop exploit leads to a CVE and patch; a kernel HID bug that leaks addresses via… Talk on
Scalably Securing Third-party Dependencies in...	Ziyad Edher, Chris Norman	31m
Anthropic builds Dependant, a network gateway that sits between the internet and internal artifact registries and enforces admission control on requested… Talk on
Lessons from Running a Product Security-Focused...	Aditya Saligrama, Joey Holtzman	29m
Stanford runs a product-security clinic that gives two-hour engagements combining threat modeling, data-security reviews, cloud config checks and live testing… Talk on
CyberCAN: A Roadmap for Municipal Support...	Sarah Powazek, Shannon Pierson	40m
UC Berkeley surveys 68 SF nonprofits (220 invited) and finds 85% suffered at least one cyber attack, 75% collect social security numbers, and 61% use MFA for… Talk on
When AI Goes Awry: Responding to AI Incidents	Eoin Wickens, Marta Janus	48m
Agentic systems with tool access and long‑term memory cause real incidents: a deployed agentic RAG setup claims 250% more efficient yet a 3am alert shows data… Talk on
One Search To Rule Them All: Threat Modelling AI Search	Kane Narraway	24m
Explains threat modeling for enterprise AI search with concrete findings: rollout at Canva uses Glean, connections to Slack, Confluence and other apps, and an… Talk on
Compliance Without the Chaos: Building It Right Into Your DevOps...	Varun Gurnaney	33m
Claim: bake compliance checks into CI/CD so audits stop derailing sprints. Practical recipe: GitHub + Jenkins build images, push to a designated registry… Talk on
Trace to Triage: How to Connect Product Vulnerabilities to Security Paths	Ben Stav	45m
Shows how eBPF-based instrumentation plus OpenTelemetry traces and continuous profiling turn runtime data into concrete triage answers: which service, what… Talk on
Not Every Groundbreaking Idea Needs to Become a ...	Ross Haleliuk	30m
Cybersecurity ends up with 5,000+ startups and a crowded vendor landscape, yet many problems are sub-venture scale and never attract VC fit. The claim: niche… Talk on
Resilience in the Uncharted AI Landscape	Ranita Bhattacharyya	31m
Claim: resilience requires hundreds of early, granular decisions and can be engineered into a genAI chat/search pipeline built with containerized agents on… Talk on
Let's Talk About the AI Apocalypse	Dylan Ayrey	35m
Argues that a single attacker can assemble a self‑contained, exponentially spreading worm by fine‑tuning a small LLM and bundling existing tooling: an Llama… Talk on
0.0.0.0 Day: Exploiting Localhost APIs From The Browser	Gal Elbaz	40m
Research shows 0.0.0.0 bypass lets browser requests reach localhost services despite Private Network Access, enabling port discovery and HTTP RCE. A WASM port… Talk on
GenAI Application Security: Not Just Prompt Injection	Ahmed Abugharbia	35m
Examines security across agents, vector databases and LLMs and shows concrete attack paths: vector database poisoning that corrupts RAG contexts, pickle… Talk on
Mapping the SaaS Attack Surface	Jaime Blasco	29m
Claims a reproducible SaaS attack surface procedure and releases an open‑source tool plus a tenant-to-vendor database. Techniques combine DNS/SSL artifacts… Talk on
Service Mesh Security: Shifting Focus to the Application Layer	Daniel Popescu	45m
Yelp abandons mesh‑level enforcement and implements app‑layer auth: services use JWTs for short‑lived identities, authorization via OPA running in ECS Fargate… Talk on
Something’s Phishy: See the Hook Before the Bait	Malachi Walker	32m
Claims a method to find DNS artifacts and adversary infrastructure as they are created to map intent before weaponization, using passive DNS and historical… Talk on
Tracking the World's Dumbest Cyber Mercenaries	Cooper Quintin, Eva Galperin	26m
Detailed forensic trail of Dark Caracal shows phishing-delivered Banduk RAT and Palace backdoored Android apps stealing photos, SMS, GPS and plaintext of… Talk on
Fireproof Your Castle with Risk-First GRC	Aakash Yadav, Lindsey Pilver	30m
Argues a shift to risk-first GRC that starts by listing business assets and failure scenarios, then uses qualitative triage plus Monte Carlo CRQ (FAIR logic)… Talk on
Don’t Sh*t-Left: How to Actually Shift-Left	Ahmad Sadeddin	37m
Shift-left often fails because tools and processes are wrong, not the idea: adding a SAST to CI yields noise and not fixes, legacy scanners show 50–80% false… Talk on
Cloud Security Podcast - LIVE!	Ashish Rajan, Jackie Bow, Kane Narraway	44m
Live podcast panel claims defenders can use LLMs to speed detection and triage: a prototype pipeline uses Claude and Claude Code to query cloud logs, build… Talk on
Third-party Risk Management: SOC 2s, Security Questionnaires...	Eleanor Mount	27m
Condemns checkbox vendor risk processes and argues TPRM must produce concrete outcomes: track vendor response time (commonly six weeks), treat SOC 2 reports… Talk on
Is Vulnerability Management Dead? A Security Architect’s...	Snir Ben Shimol	32m
Research shows 62% of incidents tie directly to vulnerabilities and misconfigurations and most cloud-forward enterprises sit on 100+ critical backlog items… Talk on
Effective Handling of Third-Party Supplier Incidents	Kasturi Puramwar	35m
Advocates a concrete process: inventory critical vendors, bind SLAs in contracts, and use tooling that combines contracts, questionnaires and risk scores to… Talk on
Using AI to Discover Silently Patched Vulnerabilities in Open...	Mackenzie Jackson	36m
Monitoring 5 million packages, the system scrapes change logs, uses one LLM to standardize changelogs and a second LLM to flag ambiguous security fixes… Talk on
Securing AI Agents...	Naveen Konrajankuppam Mahavishnu, Mohankumar Vengatachalam	42m
Claims threat modeling and demos, builds an intentionally vulnerable agent lab around a Notion-style orchestrator and subagents, and demonstrates bypassed… Talk on
AI's Bitter Lesson for SOCs: Let Machines Be Machines	Jackie Bow, Peter Sanford	45m
Anthropic experiments show that letting models "cook" rather than rigidly imitating analyst workflows finds novel strategies and scales: a prototype… Talk on
Confidential Computing: Protecting Customer Data in the Cloud	Jordan Mecom	45m
Confidential computing isolates in‑use data inside cryptographic trusted execution environments and produces signed attestation statements so verifiers can… Talk on
Netsec is Dead(?): Modern Network Fingerprinting for...	Vlad Iliushin	44m
Passive network fingerprinting roadmap from p0f to J4 and MonFP, showing real detections, tools, and limits: J3 MD5 hash instability (Chrome’s TLS extension… Talk on
Fire, Brimstone, and Bad Security Decisions	Wendy Nather	46m
Argues that resilience means planning to back out of long‑standing choices and gives concrete signs and fixes: obsolete policies like password rotation every… Talk on
Lex Sleuther - A Novel Approach to Script Language Detection	Aaron James	22m
Tool called Lex Sleuther lexes files with six lexers and turns token counts into token-count vectors, then learns a mapping to six language scores via simple… Talk on
Fake Hires, Real Threats: When Background Checks Aren’t Enough	Mabel Soe	29m
Fraudulent applicants create fake identities, pass interviews and background checks using stolen US identities (notably the July 2024 Noor case), then… Talk on
The Hidden Access Paths to Smaugs Cavern	Ben Arent	22m
History of misconfigurations includes exception trackers receiving production secrets, Redis deployed without TLS, and developers pushing prod keys into repos… Talk on
AI Won’t Help You Here	Ian Amit	33m
Generative models are often the wrong tool: a Slack-trained assistant parrots workplace habits ("I'll do it tomorrow"), Copilot wastes thousands on wrong… Talk on
Don't Trust, Verify! - How I Found a CSRF Bug Hiding...	Patrick O'Doherty	29m
Discovery: a long‑standing CSRF bug in gorilla/csrf allows an attacker to substitute a valid token by setting a path-specific cookie fixation on a shared… Talk on
A Deep Dive into the Triad Nexus Pig Butchering & Money Laundering...	Zach Edwards	30m
Research claims a Triad Nexus cluster uses a CDN brand called FUNNULL CDN and parent company ACB Group to host hundreds of investment scam and casino sites by… Talk on
Intro to Privacy-Enhancing Technologies (PETs)	Harshal Shah	29m
Covers practical PETs: Secure Multiparty Computation and Fully Homomorphic Encryption with concrete workflows — an 18‑voter election produces an encrypted sum… Talk on
Round and Around We Go: Interviews, What Do You Know?	Erin Barry	31m
Data from 30+ placements at 10+ US tech startups shows the average hire takes 48 days (~7 weeks), with a shortest 9 days (a 235K base) and a longest 138 days… Talk on
nothing matches

-- 93 of 93 talks indexed --