nullcon Goa 2019
| title | author | length |
|---|---|---|
| Interview with Robert Baptiste aka Elliot Alderson [@fs0c131y] | Antriksh Shah | 25m |
A security researcher reports finding multiple exploitable flaws across Indian services including the Aadhaar app and several department sites, observes many… | ||
| Getting to $10,000 – the variables at play in determining bounty awards | Jarek Stanley | 20m |
Microsoft’s bug bounty program explains how impact, product priority and report completeness drive awards, not just vulnerability type. It uses the STRIDE… | ||
| A Hacker Walks Into A Co-Working Space | Rahul Binjve | 33m |
Talk Abstract:
Co-working spaces have become very popular in recent times as they provide valuable service to new entrepreneurs. But, as is the case in the… | ||
| Andromeda- GUI based Dynamic Instrumentation Toolkit powered by Frida | Shivang Desai | 21m |
Talk Abstract:
Andromeda is a GUI (Graphical User Interface) based on Frida and powered by Python under the hood. Andromeda guides researcher/pentester with… | ||
| Aftermovie #NullconDasham | 02m | |
Aftermovie for nullcon Goa 2019 compresses the conference into a music-driven montage that documents the 10th-anniversary edition held 26 Feb–2 Mar 2019 in Goa… | ||
| Shack On The Beach | Adam Laurie | 49m |
History of hacks that turn into tooling and disasters: builds CD Grab by flipping one bit in a DOS driver to read raw audio, proves burnable CDs fail after ~6… | ||
| The State Of Malware From The Eye Of The Tiger | Martijn Grooten | 49m |
Phone tech-support scams use remote desktop to extract ~£89; a Necrus/Makro-like botnet still persists with 1,000,000+ infections mostly on old unpatched… | ||
| PEW PEW PEW: Designing Secure Boot Securely | Niek Timmers, Albert Spruyt | 01h 07m |
Live fault injection on an STM32F4 using a Riscure Spider and a Python harness shows a single voltage glitch—found after ~2,000 trials—can hijack a memcopy… | ||
| Introducing the ASVS 4.0 | Andrew van der Stock | 39m |
OWASP ASVS 4.0 is published on GitHub, renumbers every control and raises the baseline to 167 level 1 controls that are pen-testable, makes secure SDLC and… | ||
| Another Place, Another Time: GPS Threats And Countermeasures | Stephan Gerling | 50m |
Claims that GNSS can be jammed or spoofed are demonstrated with concrete methods: cheap USB jammers (from about $79) and commercial kits up to hundreds of… | ||
| Unlocking iPhones On The Cheap | Joseph Cox | 39m |
Explains a criminal supply chain that turns stolen iPhones into resellable devices by using automated IMEI lookup bots, Telegram GSX/lookup services, and… | ||
| Everybody's Changing, And I Don't Feel The Same | Dhillon Andrew Kannabhiran | 39m |
Claims rapid expansion of the scene — more than 365 security conferences worldwide and a typical 12:1 submission-to-slot ratio for some events — and gives… | ||
| Hacking Elections For Fun & Profit | Eva Galperin, Hari, Anand Venkatanarayanan, Pukhraj Singh | 52m |
Claims Iran runs an attributable state-backed disinformation campaign targeting India, using scraped electoral rolls and beneficiary databases plus WhatsApp… | ||
| Best Of Google VRP 2018 | Daniel Stelter-Gliese | 29m |
Summary of Google VRP 2018: program has full-time triage engineers in Zurich and California and pays real money for impact — examples include up to $7.5K for… | ||
| How To Use Bug Bounty To Start A Career In Silicon Valley | Adam Ruddermann | 46m |
Background includes NSA work, early Synack triager and running Facebook’s bounty program; advice focuses on concrete steps: learn OWASP Top 10, follow a… | ||
| A Monitoring Platform for Kubernetes Cluster Security | Vincent Ruijter, Valentine Mairet | 30m |
A centralized audit-log pipeline collects Kubernetes API server JSON logs, parses them with Fluentd, indexes into Elasticsearch and visualizes in Kibana; a… | ||
| Cybersecurity & Privacy From The Global Lens | Eva Galperin | 56m |
EFF Threat Lab documents a campaign called Dark Caracal that uses phishing and sideloaded Android trojans masquerading as Signal WhatsApp Psiphon and fake Play… | ||
| Automating Security Testing with Functional Testing Test Cases | Lavakumar Kuppan | 46m |
Built a pipeline that integrates IronWASP with Selenium so functional test cases drive a blackbox scanner, which noticeably increases coverage but hits… | ||
| LTE And IMSI Catchers: Then And Now | Altaf Shaik | 44m |
Documents a concrete LTE attack set: builds low-cost IMSI-catchers with OpenLTE/srsLTE + USRP or LimeSDR, reproduces a TAU reject IMEI leak affecting multiple… | ||
| The Windows Sandbox Paradox | James Forshaw | 45m |
Windows 10 reshapes sandboxing: faster six‑month releases add features that both harden and widen attack surface. Concrete changes include app container… | ||
| CXO Panel: Clash Of The Titans; Who Will Survive? | Burgess Cooper, Shan Lee, Durga Dube, Jaya Baloo, Vasanthika Srinath, Manish Tiwari | 01h 00m |
Panel argues whether a CISO should also be DPO, citing GDPR’s prohibition in some places and real-world hybrids where CISOs temporarily hold DPO duties while… | ||
| CXO Panel: Breached? – Here Is How I Responded! | Muslim Koser, Vijay K. Verma, Mrudul Uchil, Sachin Burman, Venkata Satish Guttula | 46m |
Moderator: Muslim Koser
Panelists: Vijay K. Verma, Mrudul Uchil, Sachin Burman, Venkata Satish Guttula
#CISO #Security… | ||
| Automatic Automotive Hacking | Craig Smith | 37m |
Shows an automated toolkit that does UDS emulation to mimic a car and reverse‑fuzz dealership diagnostic tools, plus passive CAN fingerprinting that identifies… | ||
| Everything Is Quantum | Jaya Baloo | 57m |
Claims that China runs a 2,000 km trusted node quantum network and launched a quantum communications satellite, that fiber QKD tops out near 64 km while a… | ||
| Unlocking secrets of the Proxmark3 RDV4.0 | Kevin Barker, Christian Herrmann | 49m |
Firmware and hardware changes to the Proxmark3 RDV4.0 make it a quarter of the original size and add 2 Mbit flash for onboard dictionaries, a 7.816 contact… | ||
| How to build your own Infosec Company | Mario Heiderich | 48m |
Builds a boutique pen‑test firm (kept at ~20 people) that wins a large US browser vendor as first client, uses Google Drive and Slack for collaboration, keeps… | ||
| Attacking & Securing HealthCare Standards & Hospital Secured Systems | Ajay Pratap Singh | 53m |
Talk Abstract:
The Health Care Industry has evolved exponentially over the last decade. It's no secret that advancement in technology & it's adoption was the… | ||
| A Call To Arms | Desi Jugaad | Hari K. Prasad | 25m |
About Presenter:
Hari Krishna Prasad Vemuru is the first and only Indian to be awarded the Pioneer Award from Electronic Frontier Foundation.
#EVM #Security… | ||
| Fuzzing Embedded (Trusted) Operating Systems Using AFL | Martijn Bogaard | 58m |
Presents a fuzzing framework for OP-TEE that integrates AFL (unmodified) with compile-time coverage hooks inside the TEE kernel to fuzz kernel code, the… | ||
| Building Hardened IoT Implementations With LangSec | Prashant Anantharaman | 42m |
Language-theoretic approach separates recognition from processing and yields concrete results: a C/C++ hammer parser-combinator library (bindings for Ruby… | ||
| Security Alarm System: Feeling of Security or Cause for Alarm? | Kirils Solovjovs | 40m |
Builds a compact M5Stack prototype that taps the COMBUS via ground, clock and data wires, logs four-digit PINs and emulates a keypad to arm, disarm and cancel… | ||
| Introduction To STIX/TAXII 2 Standards | Allan Thomson | 01h 01m |
Overview of STIX/TAXII 2 specifics: STIX 2 moves from XML to JSON graph model with a pattern grammar for machine-readable TTPs, TAXII 2 uses REST API roots… | ||
| Early Detection Of Malicious Patterns In Event-Streaming Data | Hyrum Anderson | 50m |
An open-source Event Query Language parses JSON event streams into process-centered sequences and makes hunting rules runnable; a sequence GRU model embeds… | ||
| CXO Panel: Clear & Present Danger: Cyber Wars Will Target Critical Infrastructure | Sourabh Issar, Sachin Burman, Sudarshan Rajagopal, Somnath Kundu | 53m |
Moderator: Sourabh Issar
Panelists: Sachin Burman, Sudarshan Rajagopal, Somnath Kundu
#CXO #Security #CriticalInfrastructure… | ||
| CXO Panel: Cybersecurity: Is Machine Learning The Answer? | Sumeet Khokhani, Sitesh Behera, Rui Bastos | 49m |
Panel argues machine learning finds patterns but needs large, high‑quality datasets and years of training to cut false positives, with supervised models… | ||
| CXO Panel: Navigating Risk In The Changing Business & Technology Landscape | Manish Tiwari, Burgess Cooper, Mannan Godil | 45m |
Moderator: Rahul Mani
Panelists: Manish Tiwari, Burgess Cooper, Mannan Godil
#CXO #Security #Business… | ||
| CXO Panel: Actionable Intelligence And Cyber Security | M Sheshadri, Shrikant Shitole, Alan White, Rahul Sasi | 53m |
Moderator: Durga Dube
Panelists: M Sheshadri, Shrikant Shitole, Alan White, Rahul Sasi
#CXO #CyberSecurity… | ||
| CXO Panel: OT & IoT Risk Management Strategy For CISOs | Gaurav Shukla, Sudarshan Rajagopal, Gomeet Pant, Rakesh Viswanathan | 53m |
Panelists argue that OT and IoT risk management is urgent: they cite 3x IoT devices by 2020, routine discovery of legacy PLCs and protocols with no auth, and… | ||
| CXO Panel: The Myth Of Sisyphus Secure Product Development | Vaibhav Gupta, Neelu Tripathy, Minatee Mishra, Vishal Sahani | 58m |
Moderator: Bipin U
Panelists: Vaibhav Gupta, Neelu Tripathy, Minatee Mishra, Vishal Sahani
#CXO #Security #ProductDevelopment… | ||
| Legal & Policy Session | Raman Jit Singh Chima | 45m |
Talk Abstract:
The infosec community is getting a lot of attention in India, especially in relation to vulnerability disclosure and increasing public awareness… | ||
| nothing matches | ||