NDC Security 2025
2025-01-20..2025-01-23
Oslo, Norway
[NDC Security 2022, NDC Security 2023, NDC Security 2024, NDC Security 2025, NDC Security 2026]
| title | author | length |
|---|---|---|
| Floki: Defining Agentic Workflows for Security | Roberto Rodriguez | 01h 09m |
Floki is an open source Python framework built on Dapr sidecar that defines agentic workflows as code, turning LLM-driven steps into microservices with… | ||
| TPMs and the Linux Kernel: unlocking a better path to hardware security | Ignat Korchagin | 54m |
A Python request_key plugin demonstrates reproducible, per‑application keys derived from the TPM seed and application metadata, removing the need to store… | ||
| AI and the SOC Engineer: The Evolving Human Element in Security | Victoria Almazova | 01h 01m |
Claims that Microsoft Security Copilot embeds a guided response architecture with three pipelines: weekly training, 15-minute inference for action… | ||
| Inside Google's Discovery and Remediation of a Critical CPU Vulnerability | Yousif Hussin | 45m |
A critical Intel CPU bug called Reptar causes machine‑check exceptions that can crash hosts and thus cloud tenants; exploit reproducer uses the icebreak test… | ||
| Optimistic Security | Niall Merrigan | 53m |
Explains why optimism and shortcut thinking cause security and engineering failures, citing about 186 cognitive biases, a study of 10 programmers (range: 1… | ||
| Improve your threat modelling through the science of simplicity | Dave Soldera | 01h 01m |
Presents a four‑property simplicity framework (cheap, value, predictable/reliable, composable) and applies it to threat modelling, claiming the result reduces… | ||
| Building a lightning fast Firewall with Java & eBPF | Johannes Bechberger | 47m |
Claims a working Java-based eBPF firewall using the hello-ebpf library to load eBPF programs and BPF maps from Java, attaches at XDP for kernel‑level packet… | ||
| Hack the Planet! What Movies can Teach Us about InfoSec | Simon Painter | 56m |
Cinematic examples map to concrete failures: a 1965 fraud scheme creates fake companies and dodges auditing because a single blue security light is trusted… | ||
| Linux containers in (less than) 100 lines of shell | Michael Kerrisk | 01h 15m |
Claims a usable Docker‑like container can be built with less than 100 lines of shell using only standard tools. Shows exact commands: unshare… | ||
| Keynote: Maturing Your Application Security Program | Tanya Janca | 57m |
After consulting with almost 400 teams and finding industry maturity scores averaging 1.1/3 on SAM, the talk lays out three concrete AppSec program states and… | ||
| Content Security Policy: From newbie to advanced | Halvor Sakshaug | 01h 00m |
Explains how to build a working CSP by overriding header in Chromium to iteratively break and fix the NDC Security tickets page, adding specific host entries… | ||
| Plants vs thieves: Automated Tests in the World of Web Security | Ramona Schwering | 55m |
Demonstrates using Cypress end-to-end tests against a Dockerized OWASP Juice Shop to catch OWASP Top 3 issues: a crafted SQL injection via login yields… | ||
| Spoofing Commands - Can You Trust Process Creation Logs? | Tristan Bennett | 55m |
Attacks overwrite the process environment block to replace the logged command line after a process is created suspended, so Windows, Sysmon and Defender XDR… | ||
| Tales of OAuth2/OIDC in the wild | Anders Abel | 41m |
Shows concrete failures and fixes: Microsoft ENT ID expands nested groups into ID tokens and limits group entries to about 200 to avoid header overflow, so ID… | ||
| Challenges and Opportunities from Quantum-Safe Cryptography | Tjerand Silde | 01h 05m |
Lattice-based schemes replace RSA/ECC: Kyber (~800 B public keys and ciphertexts) and Dilithium signatures (larger, with ~10 rejection-sampling trials… | ||
| From DevSecOops to Security Success: The Bug Bounty Effect at FINN.no | Emil Vaagland | 37m |
Since 2019 FINN.no runs a private bug bounty that outfinds static and dynamic scanners: CodeQL finds some issues but the bounty yields far more exploitable… | ||
| Cybersecurity in the Era of AI and Quantum Computing | Tudor Damian | 01h 04m |
AI already runs automated threat detection and realtime anomaly blocking (MFA triggers, account lockdowns), while adversaries use AI for localized phishing and… | ||
| Building antifragile systems using Secure by Design | Anders Kofoed, Eivind Jahr Kirkeby | 58m |
Claim: making code antifragile by baking security into design reduces surprise failures. Demonstrated fixes include domain primitives (username, 0356 postal… | ||
| Hacking History: The first computer worm | Håvard Opheim | 40m |
The talk reconstructs the 1988 Morris Worm: ~3,200 lines of C that uses gets buffer overflow against finger, a sendmail debug exploit to ask targets to execute… | ||
| Secure System Integrations | Tobias Ahnoff | 49m |
Recommends a concrete baseline: enforce network segmentation, use TLS 1.3 only (or a hardened 1.2) and verify with SSL Labs scanning, and move client auth from… | ||
| RCE via legacy dependency in Python | Andrea Brambilla | 29m |
A small Flask app running in a Python 3.4 container uses PyYAML 3.13 and calls yaml.load on user-provided configs, which allows Python execution and leads to… | ||
| Security Champion Worst Practices | Tanya Janca | 01h 01m |
Security champion programs sound promising but over half of programs fail because goals, support and scope are vague. Practical fixes: set one or two concrete… | ||
| GitHub Actions: A Cloudy Day for Security | Sofia Lindqvist | 57m |
Covers concrete failures and fixes for GitHub Actions plus cloud federation: shows script injection via workflow contexts and the safe fix using env… | ||
| Breaking and securing OAuth 2.0 in frontends at NDC Security | Philippe De Ryck | 01h 00m |
Demo web app and attacker server show malicious script steals tokens (exfiltrates access + refresh tokens to attacker domain) and a second demo uses a silent… | ||
| Crypto Heist: The Aftermath of a Government Website Cryptojacking Attack | Scott Helme | 01h 02m |
A large cryptojacking campaign is traced to a compromised third‑party text‑to‑speech plugin that silently injects Coinhive to mine Monero to a single wallet… | ||
| Flipping Bits: Your Credentials Are Certainly Mine | Stök, Joohoi | 55m |
Registers cheap bitflip domains, runs a custom stack called Certainly that combines Wildcard DNS matching with an ACME-driven on-the-fly SSL workflow, logs… | ||
| Using developer-centric data to predict, prioritize, and improve App Security Outcomes | Laura Bell | 57m |
Uses developer tool metadata (GitHub APIs, build and PR logs) to profile projects by build frequency, PR size and reviewer diversity, lines of code, tech… | ||
| Using GenAI on your code, what could possibly go wrong? | Niels Tanis | |
Academic benchmarks find roughly 40% of generated snippets contain vulnerabilities (2021–2023 studies) and code velocity rises as developers accept LLM output… | ||
| I don't need privacy, I got confidentiality! | Kim Wuyts | 53m |
Claim: privacy differs from confidentiality and must be engineered into the SDLC using concrete techniques. Uses threat modeling (LINDDUN-style categories) to… | ||
| Practical cryptography with Tink | Neil Madden | 43m |
Google's Tink is a high‑level crypto library that replaces error‑prone APIs with concrete primitives: AEAD for one‑liner authenticated encryption (avoids… | ||
| Securing React: Prompt Engineering for Robust and Secure Code Generation | Jim Manico | 01h 00m |
Shows how verbose security rules become reusable prompts, stores them in source control, and applies them before and after generation; demonstrates a live fix… | ||
| LIVE DEMO: Supply Chain Attacks in the Terraform Registry | Kyle Kotowick | 47m |
Live demo shows a malicious Terraform Registry module being swapped to a backdoored branch while keeping the same version, exploiting CloudFront caching and… | ||
| SEVEN things about API security | Philippe De Ryck | 01h 00m |
Covers concrete failures and fixes: shows SSRF via parser ambiguity where URL parsers and libcurl disagree and internal services become reachable; reproduces a… | ||
| Privilege Escalation in Microsoft Azure | Christian August Holm Hansen | 58m |
Demonstrates a practical escalation from Reader to full control by abusing legacy ARM API versions, using two discovery tricks: diffing operations APIs to find… | ||
| Navigating the Security and Privacy Landscape of Modern AI | Vera Rimmer | 01h 05m |
Modern AI breaks three ML assumptions—future equals past, training data is representative, and data generation is independent of the model—causing predictable… | ||
| Homoglyph-Based Attacks: Circumventing LLM Detectors | Aldan Creo | 56m |
Homoglyph substitution (e.g., 5% character substitution) reliably flips state‑of‑the‑art detectors — classifiers shift embeddings, perplexity drops, and… | ||
| Chrome Browser Exploitation: from zero to heap sandbox escape | Matteo Malvica | 49m |
Three V8 type‑confusions (2018, 2023, 2024) turn into working Windows exploits that bypass the V8 Heap sandbox and achieve remote code execution; demos use d8… | ||
| RAG Against the Machine | Brennan Lodge | 59m |
Practical RAG blueprint that builds a self‑hosted pipeline using a sentence embedding model, Chroma vector DB, LangChain orchestration and an open‑source LLM… | ||
| Incoherent Code: How Code Quality Impacts Security | Tav Herzlich | 58m |
Claim: low code quality raises measurable security risk by hiding missing input sanitization, tangled SQL and absent schemas that break audits. Evidence… | ||
| (Ab)user Experience: The Dark side of Product and Security | L. Potter, J. Watkins | 57m |
Practical steps to design security into products: turn giant, abstract security NFR lists into small, testable abuser stories that developers will pick up; run… | ||
| You Gotta Fight For Your Right To Third Party | Mathew Caplan | 53m |
This talk was recorded at NDC Security in Oslo, Norway. #ndcsecurity #ndcconferences #security #developer #softwaredeveloper
Attend the next NDC… | ||
| nothing matches | ||