Dan Walters

Dan Walters

Your cable modem is secure Right? Oh!

Most people think their devices are “secure” well its time to talk about things most cable company don’t want you to be aware of…. ignorance is bliss right?


Dustin Heywood (evil_mog)

Dustin Heywood (evil_mog)

Silver Tickets Through the Printer Bug: How NTLMv1 Brings Down the Kingdom

Have you ever wanted to know how the MS-RPRN Print Spooler service can lead to local admin? This talk will go through the NTLMv1 hash format, reverse it to an NTLM hash, and show how to use that information to generate Silver Tickets. It will also cover defenses for this devastating attack.


Trenton Ivey

Trenton Ivey

KEYNOTE: Make(){Break()};Break(){Make()};

By definition, hackers make things work in unexpected and unintended ways. To many outside this community, hacking seems like a destructive process. However, anyone that has ever created or utilized an exploit in an imaginative way knows that, at its heart, hacking is all about making something new. This talk, full of technical examples taken from opposing disciplines in information security, shows how healthy competition between makers and breakers drives progress.


Josh Bressers

Josh Bressers

Next Generation Enterprise Security

The single best way Humans transfer knowledge is through stories. We are a social species and there are no better stories than Star Trek episodes. Nearly every episode of Star Trek involves some sort of security incident. Everything from someone stealing data (or Data), insider threats, APT, malware, and more. There is a lot of content we can use as examples to help teach and learn.
What would the Star Trek lessons look like if we break them down into their core components? Even though the stories are fictitious, we can use them to help tell a story as a way to teach others about security and why it matters. We can start to ask questions like who is the biggest insider threat the ship faces: Data or Wesley? Why is security so terrible, does Worf ever do his job? Have these people ever heard of two factor authentication? Maybe the holodeck should be sandboxed? No the Romulans aren’t telling the truth this time.
Our industry is one of very serious questions and discussions, but sometimes you can be too serious. It can be a challenge to explore security topics even inside of the industry, sometimes we need a new way to think about a problem. Rather than focus on serious security lessons, let’s have some fun made up security stories. There are a lot of lessons to be learned in Star Trek TNG episodes.
In this session we are going to break down the security themes in Star Trek. Who are threat actors. Who are defenders. What are some mitigations that could be applied. What are some proactive ideas that should have been put in place. There are even some examples of recurring incidents because nobody fixed the problem the first time.
You will walk away from this one not just having a lot of fun because Star Trek is awesome, but learning some new ways to look at common problems. Sometimes a little perspective can really get the creative juices flowing.

Daniel Creed

Daniel Creed

Stop, think about the psychology of the hack and hacker FIRST!

We are by nature technologist, and far to often when we see something suspicious on the network, we immediately jump to a technological solution without stopping to think about the psychology of what we are seeing, and what that can mean in the form of an attack/breach.


Robert Lerner

Robert Lerner

418 I’m a Teapot – And other headers

What happens when you overshare HTTP headers and how to check if your’s are “up to code”


Eric Escobar

Eric Escobar Matt Orme

Matt Orme

Your Corporate Networks are Showing

Sysadmins, CISO’s and compliance officers run pentests on their internal and external infrastructure, and commonly ignore their wireless footprint. However, access to a corporate wireless network is seldom monitored and provides covert access to an attacker. Think a long random passphrase or individual user authentication will protect your perimeter? Think again. Current wireless attacks take advantage configuration oversights, deceiving end users, and circumventing what had been thought to be reasonable network segmentation. Such compromise can have disastrous implications resulting in the “attacker from the parking lot” scenario. Curious to see how a compromise from a “secure” wireless network happens? Eric & Matt will discuss their evolving wireless pentest methodology and answer audience questions.


Kat Traxler

Kat Traxler

The Cloud Attack Surface – Laughing at the OSI Model

Security Professionals are comfortable reasoning about the security posture of systems within the framework of the OSI model. We classify attacks as network based or application based each with their own set of understood preconditions or rules.
Enter ‘The Cloud’ or as I like to think about it “Other Peoples Datacenters”. The Cloud Platforms and their associated APIs are harnessed by a new bread of operations teams to define network or application systems in code. It’s on the Cloud API Platforms that a new attack surface has opened and it plays by none of the old rules.

J. Wolfgang Goerlich

J. Wolfgang Goerlich

Zero Trust for Zero Days

Zero Trust has evolved from hype to security concept, and is evolving into a security standard. Zero Trust has gone from being network-centric to applying to people, applications, and data. And yet? The value of any defensive security control can only be determined within the context of the offensive tactics. The value gets further obscured when unexpected vulnerabilities rip holes in our defenses. In this presentation, threat models and attack scenarios will highlight the strengths and weakness of Zero Trust. This session provides an adversarial view of limiting trust in our environments.


Alyssa Miller

Alyssa Miller

KEYNOTE: Stealing Reality – Deepfakes Ushering in a New Paradigm of Attacks

As a result of continuing advancements in neural networks, deep fake media has become increasingly convincing and easy to produce. Experts have warned of the impact this could have on elections and personal security. Additionally, deepfakes also pose very real threats to businesses and global markets, although these threats receive far less attention. Hacker and Security evangelist Alyssa Miller will analyze the technology behind creating deep fake media, showing how Generative Adversarial Networks (GAN) create convincing fake videos and audio from very limited samples. She will examine research into both low-tech and AI/ML based detection methods and counter measures, including leveraging the same neural network approaches being used to create deep fakes to help detect them. She’ll continue by discussing the theory and research behind
countermeasures such as Adversarial Perturbations and show how they can defeat facial recognition algorithms that deepfake generation relies on. Finally, Alyssa will present methods being developed to help certify the authenticity of real media.

As she concludes, Alyssa will offer up a hopeful viewpoint of the good that can be accomplished through the use of deepfake technology. From its use in entertainment, to improved analysis of medical imaging and even how GANs are being leveraged in malware identification.