Nullcon Goa 2025
| title | author | length |
|---|---|---|
| Securing the chains: Building defensive layers for software supply chains | Akhil Mahendra, Hritik Vijay, Yadhu Krishna M | 38m |
Builds an open source pipeline called Supply Shield that scans Docker images (SIFT, ScanCode) to generate SBOMs and capture exact runtime versions, then uses… | ||
| Large-Scale Exposure Of Orphaned Commits On Major Git Platforms | Kumar Ashwin | 27m |
Large-scale scan across GitHub GitLab and Bitbucket uses the GitHub event API plus a five-year historical dataset to map commits; engineering runs commit and… | ||
| Panel: Modernizing Security Architecture: Platforms or Best-of-Breed, What Works? | Rahul Neel Mani, Srihari Kotni, Satyavathi Divadari, Prajal Kulkarni | 45m |
Panelists report enterprises run ~40–50 security products while major vendors bundle 85–90 modular capabilities into platforms; teams split use by use… | ||
| Panel | Cyber Fusion Center: The Command Center For Integrated Cyber Defense | Avkash Kathiriya, Mathan Baby Kasilingam, Yogi Kapur, Komal Vora | 42m |
Panel argues for concrete fusion: running a central “mother” SOC plus specialized identity sock and infra/information socks, integrating SIM, UBA, DLP and OT… | ||
| Unlocking India’s cyber potential through policy, innovation, and partnerships | Atul Kumar, Sanjay Bahl, Savita Utreja, Anand Panda | 42m |
India now counts about 400 product companies with roughly 50% revenue from outside, and the government backs commercialization through a National Center of… | ||
| Panel: Tackling Automotive Hardware Vulnerabilities | Aseem Jakhar, Dennis Giese, Sachin Jain | 41m |
Cars resemble IoT stacks: outdated infotainment exposes infotainment Android exploits, firmware extraction tools routinely pull ECU images, and closed supplier… | ||
| Panel: From Code to Defense: Why Developers Are the New Security Leaders | Vaibhav Gupta, Vikas Goyal, Hilal Lone, Gene Golovinsky | 49m |
A claim that insecure code costs about $4.5M per breach drives a concrete shift left: teams build dedicated DevSecOps squads and a new product line, embed… | ||
| Satellite Communications: Analyzing & Protecting Space-Based Assets | Drishti Jain | 31m |
Covers concrete SatCom attack vectors—signal jamming, spoofing, interception and a 1999 UK military satellite hijack example—and matches each to concrete… | ||
| Breaking Boundaries & Demystifying Kernel SU 4 Root Access In Azure Cloud Shell | Vamsi Krishna, Kandi Abhishek Reddy | 27m |
Finds a Use-After-Free in nftables and an Open vSwitch integer manipulation bug in kernels Azure Cloud Shell used (5.10.102.2-microsoft-standard and older 6.9… | ||
| Draining Your Credentials From Popular MacOS Password Managers | Wojciech Reguła | 44m |
Five popular macOS password managers are tested and all yield credentials: native MacPass accepts plugins via disabled library validation so a malicious plugin… | ||
| Trapped By The CLI | William Robinet | 38m |
A custom Perl ASN1-template tool converts OpenSSL asn1parse output into editable templates and reconstructs binary ASN.1 via the asn1parse -> template -> gen… | ||
| Predator Malware: Trust Broken At The Core | Matthias Frielingsdorf | 41m |
Static analysis of the 2023 Predator loader uses strings, otool, codesign, IDA/Ghidra and reveals a configured multi-stage loader that spawns Watcher and… | ||
| MacOS Lockdown Mode: A Forensic Deep Dive | Bhargav Rathod | 39m |
Research shows macOS Lockdown Mode (introduced 2022 and now on four Apple OSes) changes behavior and leaves disk and log artefacts while blocking common… | ||
| State Of IOS Jailbreaking In 2025 | Lars Fröder | 36m |
Explains a practical jailbreak chain that reaches full system control on iOS 15–16.5 by combining a TrollStore code‑signing bypass (multi‑signer/CARTrust flaw… | ||
| Windows Keylogger Detection: Targeting Past & Present Keylogging Techniques | Asuka | 37m |
EDR feature monitors manifest ETW provider Microsoft‑Windows‑Win32k and reliably captures three API events used by keyloggers: GetAsyncKeyState… | ||
| Aftermovie | 02m | |
Short aftermovie that captures crowd energy, networking and on-site training rather than technical content. Clips show dozens of attendees clustering for… | ||
| How To Teach Threading To A Dolphin | Andras Tevesz | 49m |
Modified an NRF USB dongle into a Flipper Zero Thread radio extension board by soldering power and UART lines to a Nordic radio, running OpenThread via a small… | ||
| Project Dusseldorf: Finding Out-Of-Band Vulnerabilities At Cloud Scale | Michael | 39m |
Project Dusseldorf is an open‑source out‑of‑band appsec platform that catches DNS/HTTP/HTTPS callbacks at cloud scale, used internally by ~130 Microsoft red… | ||
| Practical Software Countermeasures 4 Hardware Glitch Attacks | Arshid, Chinmay | 44m |
Uses a ChipWhisperer with an STM32F3 target and an Arduino testboard (decoupling caps removed) to run voltage glitch campaigns that hit the password check… | ||
| MLOps Under Attack: Threat Modeling Modern AI Systems | Sandeep Singh | 42m |
MLOps pipelines use Jupyter, Hugging Face, MLflow, Kubeflow, KServe, Seldon and cloud stacks (SageMaker, Vertex) and the talk shows concrete failures: public… | ||
| Pwning Smart Weighing Machines wt API & Hardware Hacking | Eugene Lim | 34m |
Analysis shows two distinct failures: the Chinese OEM uses MAC addresses as authentication secrets and an SQLi on the API lets an attacker enumerate >200,000… | ||
| What The PHUZZ?! Finding 0-Days In PHP Apps wt Coverage-guided Fuzzing | Sebastian | 38m |
Open-source PHUZZ brings coverage-guided fuzzing to PHP apps by running a Python fuzzer, collecting endpoints from a browser HAR, and instrumenting targets via… | ||
| Google Give Me Vulnz | Cameron Vincent | 30m |
Manual Burp Suite tests and simple ID-swapping expose concrete failures: 175 valid Google VRP submissions (160 were IDORs) show it’s possible to gain access to… | ||
| Reversing Large Deep Learning AI Models | Yashodhan Vivek Mandke | 44m |
Reversing extracts full layer graphs and numeric tensors from ONNX, HDF5 and PyTorch files so an attacker can download weights as numpy and read layer shapes… | ||
| Your Identity Is Mine: Techniques & Insights From OS Identity Providers Research | Maor Abutbul | 33m |
Research demonstrates two concrete exploit chains: on Keycloak a single-packet attack over HTTP/2 using Burp Repeater and TLS secret extraction defeats API… | ||
| The Hidden ART Of Rolling Shellcode Decryption | Tijme Gommers | 30m |
Kong Loader implements rolling decryption: a vectored-exception, hardware-breakpoint loader that decrypts, executes, and re-encrypts one instruction at a time… | ||
| How Ecovacs Robots Got Hacked And What We Can Learn From It | Dennis Giese | 39m |
Research shows Ecovacs devices have 18 CVEs across 30+ models including a live PIN bypass via client-side auth and a Bluetooth LE remote code execution that… | ||
| The Future Is Trustless: How ZkVMS And ZkTLS Transform Bug | Anto Joseph | 41m |
Proof-of-concept system demonstrates cryptographic proofs for vulnerabilities: Rust programs run inside a zkVMS to generate SNARK proofs of a secret preimage… | ||
| Fueling The Future: Building Robust Engines | Daniel Cuthbert | 30m |
Argues that software must be treated as safety‑critical engineering, not just bug hunting, and backs that with history (Triangle Shirtwaist 140 deaths, 19 11?… | ||
| Nullcon Goa 2025 | 01m | |
Transcript contains only repeated greetings and the uploader offers a generic event recap, so there is no technical content and no demos or numbers to… | ||
| nothing matches | ||