WELCOME TO DEF CON 25!

NETWORK
Silver Anniversary connectivity, and the loss of personal agency
over our data and identity.
Network Instructions:

================

The DEF CON NOC delivers the cyberz

INFORMATION
DEF CON is part conference and part party, throughout the swanky Ceasar’s Palace

DEF CON TV
convention center and the DC TV channels
a refuge from Info Sec where we can re- One thing I am certain of though is that to your hotel rooms.
charge and be inspired for the year to come. hackers will help point the way through
If you want to connect, remember there
The theme this year is around community, this jungle of self serving marketing speak, are two (and only two) official ESSIDs you Nurse your hangover comfortably watching
a glance over the shoulder to acknowledge technically impossible tech policy, and inse- should use to access the intertubes: the presentations in your hotel room.

those who carried us this far, and a look for- cure products to give the public a real view The encrypted one with 802.1x DC TV brings the DEF CON talks to you.
authentication and digital certificate Turn on the TV, grab your favorite
ward to the future we have to live in. A retro of what is possible and what isn’t. It won’t verification (DefCon) and the unencrypted, beverage of choice and aspirin and don't
glitch tech theme wrapped up in 80s video be the organized crime groups, vulnerable wild-west of the wireless networks forget to shower.
(DefCon-Open). Please choose wisely.
game colors and modern technology. Learn companies or governments doing this, but http://dctv.defcon.org is the spot for all
where we come from, and then chart your instead hackers through a deep understand- Despite the fact that the 802.1x Godz
seemed to have smiled at us last year,
your channel info needs.

own path. ing of technology that can speak truth to never forget we’re talking about the

We are in a new hotel and it is far too nice

power.
Wi-Fiz: where radio wavez make packets
flow and digital magic makes the
communications secure, dodging those
The DEF CON Media server is back again!
pineapples along the way. https://10.0.0.16/ or
for us. It feels surreal to be where Black Hat Here is to celebrating our successes, honor-
spent so many years growing, but there is ing those who couldn’t be here with us, and Since it’s quite possible that something
changed in the past 12 months on how
https://dc25- media.defcon.org/

some symmetry there as well. Caesars now to the next 25 years of being hackers living all operating systems deal with Wi-Fi,
there are might be some devices out there
will now have had both the Yin and Yang. in the middle of a technological revolution! that really do not like 802.1x with PEAP Browse and leech files from all the past
We have worked hard to design for day and authentication. In particular, for quite DEF CON conferences and find this year's
a while some Android platforms wouldn’t presentation materials, white papers,
night activities, growing where possible, The Dark Tangent verify the RADIUS server certificate prior slides, etc. Since last year the DEF CON
and expanding our Info Booth team to have to sending the user’s credentials to enter
the network. And this is not cool.
collection has been updated as well as
many more hacking conferences added to
more Goons available to help answer ques- the infocon.org collection. We expect you
And, choosing for the device to “not to leech at full speed, and the server is
tions and steer you in the right direction. verify server certificate” will probably warmed up and ready to go. Enjoy!
Feel free to ask anyone in a red Goon shirt not only let that device connect to one
of the hundreds of rogue access points
for help, and if they don’t have the answer on the show floor but will also send
they can forward you to someone who does. your login credentials to a rogue radius
server. This is also a bad thing.
The dc25-media.defcon.org TLS certificate
fingerprint:

Because of these, and a bunch more (SHA1) 52 b2 32 9d 27 28 45 be 88 68 a9

As I write this a month before cyber common sense (™) reasons, do 67 11 26 66 13 b4 1c 18 8b
you read it I can only guess at not, I repeat, do NOT choose the same
credentials (aka: username and password)
what craziness will transpire used for your important stuffz, like
on the lead up and during the shopping sites, online-banking, the
pornz, your windows domains (yeah, it
convention. We continue to op- happened before) to connect to the hacker
conference network.
erate in uncharted waters, much
like 25 years ago, both legally and For updated information and instructions
on how to connect to the Wi-Fi with the
technologically. What constitutes n0t-s0-1337 Operating Systems along
unauthorized access? When if with the link to download the digital
certificate to be used, visit https://
ever are manufactures liable? Are wifireg.defcon.org. And if you don’t know
how to properly configure the Wi-Fiz on
hackers just pointing out problems your üb3r-1337 linux distro, you should
but not helping fix anything? The consider a new platform.

difference is now we as a community For other NOC updates visit https://www.

are in the spotlight and everything defconnetworking.org and also follow us on
the twitterz @DEFCON_NOC
around us is accelerating: legislation,
2 3
4 5
 BADGE
Over the years the DEF CON badges have I used limited edition florescent inks printed process that produces one of a kind multi-color
grown from simple laminated designs to on a Canon tabloid printer and hand cut and finish. If you see someone with one check it our
highly complex electronic artifacts full laminated at a local Kinkos.  under a bright light to see what I mean.
of puzzles. I am proud that we were the
first to introduce the concept of the DEF CON 7  I don’t have enough room on this page to list
Black Badge, or free admittance for life them all, and who knows, the remaining ones
for demonstrating expert hacking skills The first all metal badge done in aluminum. This might be needed for a “Plan C” one day. To check
or ability. Black Beetle did a lenticular was also a “Plan B” badge and a rush job. We out a collection of almost all past badges
badge, a liquid filled badge, and a metal payed crazy rush fees at a local Seattle company browse to Grifter’s collection here: http://www.
stamped badge, but when I asked King Pin that also makes signage for companies such rootcompromise.org/gallery/v/defcon/dcbadges/ 
to design an electronic badge for DEF as Boeing and IBM, but the result was great.
CON 14 he created the now famous smiley We have done a other metal badges of various
skull badge and the electronic con badge degree of difficulty since, but these were the
wars began. L0stBoy took it to another first. The Dark Tangent
level by increasing the complexity and
uniqueness of the Uber black badges. DEF CON 9

After 24 years it actually becomes more The liquid filled squishy badge designed by
difficult, not less, to design and plan

Conference Code of Conduct

Black Beetle. If you’re lucky enough to have
the badges. As the con has grown the one of these original badges, I envy you. This
number of badges grow, and production was a brand new manufacturing process and we
lead times increase. For example the took a risk on them. Would they pop? Leak? The
second year we did electronic badges we cool factor was worth it and they turned into
purchased every available battery holder Last updated 3.6.15
one of our most iconic badges. One of the more
of that type in the US market. Planning difficult badges to counterfeit during the con,
needs to begin earlier and earlier, and I’ve been looking for something similarly cool DEF CON provides a forum for open
that is what did us in this year. We were ever since.  discussion between participants, where
at deadline for the badges and the design radical viewpoints are welcome and a high
was not ready, and so we had to switch to
DEF CON 12 degree of skepticism is expected. However,
plan B. As hackers we always have a plan
B. insulting or harassing other participants
The rocket ship badge that year had its own is unacceptable. We want DEF CON to be
cool design by Black Beetle. It again as a a safe and productive environment for
Nikita and I were talking about plan
new production process with clear material, everyone. It’s not about what you look
B, and I wanted to do the first eight
color, and silver foil stamping in a custom
years of badges we ever produced as like but what’s in your mind and how you
die cut shape. The art was inspired by
a retrospective and tie into the 25th
Ghost in the Shell. present yourself that counts at DEF CON.
anniversary theme this year. She came
up with a better idea of doing the most We do not condone harassment against any
interesting or popular badges of the past DEF CON 14
participant, for any reason. Harassment
24 years. I was thinking of the badges
as stitched patches with Velcro on the The iconic first electronic badge by KingPin. includes deliberate intimidation and
back but there was not enough time to While simple in design these badges were targeting individuals in a manner that
manufacture them, and Nikita thought of awesome. They used brand new PCB colors to makes them feel uncomfortable, unwelcome,
them as giant rubber type key chains and designate different departments, and we even or afraid.
there was time left for that. Winner! We did a limited run of them using gold for
selected the badges, Neil did the art, masking, the first time it was ever done by
Participants asked to stop any harassing
Nikita sorted out quantities and if the manufacturer! At closing ceremonies we
turned off the lights and the room glowed as we behavior are expected to comply
all goes well the finished
played a song created during the badge hacking immediately. We reserve the right to
badges will arrive
on site with a few contest and it was like a being at a concert respond to harassment in the manner
days to spare. Here of your favorite band. The feeling of community we deem appropriate, including but not
is their history: was amazing. You can listen to the song by limited to expulsion without refund and
downloading it from the https://dc25-media. referral to the relevant authorities.
DEF CON 1 defcon.org/ media server.
This Code of Conduct applies to everyone
DEF CON 17
In 1993, I sketched the first participating at DEF CON - from attendees
DEF CON logo while at Dead Addict’s and exhibitors to speakers, press,
place. (It was refined in corel draw and With art design by Neil and engineering from
Kingpin the electronic puzzle badge was the volunteers, and Goons.
produced in a continuous tone printing
process from a Fiery RIP, in the only first designed specifically to get all the
place that could do such printing in attendees to seek out and interact with each Anyone can report harassment. If you are
Seattle in 1993. Overtime the logo grew other in an attempt to assemble and wire it being harassed, notice that someone else
and changed, the icons went from 1 to 4, up. You had to get ALL the pieces together, is being harassed, or have any other
but this was the first. Like how there including a super rare Uber badge, to form the concerns, you can contact a Goon, go to
are spaces for your handle and group whole circle and circuit. Since then we always the registration desk, or info booth.
affiliation? Things of the past. think of ways to use the badges to get DEF CON
hackers to work together to solve a problem.
Conference staff will be happy to help
DEF CON 5 participants contact hotel security, local
DEF CON 19
law enforcement, or otherwise assist those
The “Area 51” badge. It wasn’t the first
The Uber titanium skull badge by L0stBoy. Just experiencing harassment to feel safe for
Goon Staff badge, but I went through a
lot of trouble to make these look like look at it, it’s cool, it’s tough, it’s not the duration of DEF CON.
cool official Gov’t badges as possible. breaking anytime soon. Going all “Maker” on
us L0st went with a more difficult tempering Remember: The CON is what you make of it,
and as a community we can create a great
experience for everyone.

- The Dark Tangent

6 7
8 9
GOONS POT TING THE FUTURE OF DEF CON
THE FUTURE OF DEF CON differently. Don’t be surprised if parts of
HOW TO SPOT A GOON:
DEF CON do future road trips to bring our
When I started DEF CON the only hacker hacking to other communities.
DEF CON Goons are the electrons that
cons I knew of were SummerCon and
enable the conference to run, and should
HoHoCon, 25 years later there are DEF CON is a business, but behaves much
you have a question or need help they are
hundreds of security related cons ranging of the time like an association. We don’t
there for you. Here are some goon facts:
from pure hacker to career oriented take pre-registration because we value
Info Sec industry events. From small to your privacy, even if it makes guessing
- Goons are in one of two states, either
large, invite only to open and specific to how many people to expect and materials
on duty or off duty.
general there is more than something to to purchase difficult. We don’t take
meet everyone’s interests. Where does DEF sponsorship because it doesn’t feel right,
If they are on duty they will be wearing a
CON fit in? like some innocence would be lost and a
current year, red, DEF CON 25 Goon shirt, (The shirts & badges will be red) bunch of expectations would be added,
and they will also be wearing a current
I have been thinking a lot since DEF CON our neutrality compromised. Sometimes
year Goon badge. If they are not wearing
20 about the future of the con, and while keeping it hacker isn’t the most efficient
both then they are not on duty.

EVENING
I don’t have a crystal ball of what is to business decision, but DEF CON would
come I do have some conclusions: not exist without the support of the
- Goons on duty are not supposed to drink
hacking community and that needs to be
alcohol.
Last year I wrote “DEF CON is a hacker continuously respected.
con, not an Info Sec conference. I bring
- All Goons off duty are NOT to wear their
this up because there is a difference,

LOUNGES
red Goon shirt to prevent confusion with
one is more focused on joy of discovery,
attendees and give them a change to not be
irreverence, novel, if impractical
approached with con related issues. Goons
approaches. The other is more focused
in this state have been known to drink
on enterprise solutions, frameworks,
alcohol.
and concerns large companies may have..
..There is great value in the different
- PAST Goons may seen wearing previous red
Introducing DEF CON Evening Lounges types of conferences, and if this con
shirts or badges and they helped run a
doesn’t feel like others it is by design..”
past DEF CON, but that does not make them
a current DEF CON 25 Goon. These are smaller more intimate talks
that don't require audio and video support This is the lens with which the review
for a limited audience. For more detailed board looks at all submissions. Sometimes
- On almost all the Goon shirts there
descriptions view their abstracts in the we have to pass on a fantastic submission
is a department name on the back of the
presentation pages. because DEF CON is not the right venue.
shirt to tell you what group you are
Knowing this gives us focus and sets
dealing with. Please use this if you have
expectations for attendees. Activities
any feedback on Goons, both good or bad.
that enable the hacker mindset and
It was not logistically possible to add
Panel - An Evening with the EFF demonstrate how to master a certain
individual name or handles this year, but
technique are always going to be selected
we will at DC 26 (Feedback can be sent to
Friday at 20:00 - 22:00 in Trevi Room over a great enterprise security talk.
[email protected])
Over the years speakers, organizers,
- Goons goon for many reasons, but the pay
villages and staff come and go. What is
isn’t one of them. They put in long hours
Hacking Democracy, with Mr. Sean Kanuck important is for the con to remain an
and many weeks or months of planning and
open platform for new ideas. DEF CON must
take time off work to make the con happen.
Friday at 20:00 - 22:00 in Capri Room not only invite back popular and well run
villages and events but also take risks
on new ideas. For example the Car Hacking
village was an untested idea a few years
Horror stories of a translator and how a ago, now they are well established. This
tweet can start a war with less than 140 year we are trying a new Voting Machine
characters, with El Kentaro Hacking Village, something not done
before. As Jericho once said years ago
Friday at 20:00 - 22:00 in Modena DEF CON is really a convention of mini-
conventions, and by offering space and
encouraging risk taking DEF CON will
constantly renew itself.
Panel - Meet the Feds (who care about
security research) DEF CON can happen more than once a
year in various forms. For two years we
Saturday at 20:00 - 22:00 in Capri Room ran some of the hacking villages at the
Tibeca Film Festival and reached a whole
new audience interested in hacking,
technology, and privacy. It was a great
Panel - D0 No H4RM: A Healthcare Security experience and hopefully some writers
Conversation and directors will look at hacking

Saturday at 20:00 - 22:00 in Modena Room

10 11
12 13
 VILLAGES
Please check the CarHackingVillage.com web page for more security scanners, network sniffers to sniff the industrial traffic, and more!
B I O H A CK I N G V I LL A G E up-to-the-date information. Please follow @CarHackVillage H A RD W A RE H A CK I N G V I LL A G E If you are new to the world of Industrial Controls Systems, don’t be shy! We
on twitter for live details during Def Con 25. are more than happy to teach and answer any questions you may have!
How can we use technology The DEF CON
to enhance our raw abilities, Friday 1000 – 2000, Saturday 1000 – 2000, Sunday 1000 - 1500 Hardware Friday 1000 - 1700, Saturday 1000 – 1700
specific skills, overall health, or Hacking Village
well-being? How can we usher CRY PTO A N D P R I VA CY V I LL A G E celebrates its L O CK P I CK V I LL A G E
in an age where we not only fix 0xA anniversary!
what’s broken, but we make our At the Crypto & Privacy Village you Come join us Want to tinker with locks and tools
world and ourselves, better? can learn how to secure your own for hardware the likes of which you’ve only seen
systems while also picking up some hacking, teaching, learning, and exploration. in movies featuring police, spies,
Just as the early computer
tips and tricks on how to break and secret agents? Then come on by
hackers challenged the status Lots of prizes to go around, and lots of puzzles to
classical and modern encryption. the Lockpick Village, run by The Open Organization Of Lockpickers, where
quo to introduce us to the learn new things or show off your skills.
you will have the opportunity to learn hands-on how the fundamental
real possibilities of computing, we dare to sit on the cutting edge to The CPV features workshops and
Friday 1000 – 2000, Saturday 1000 – 2000, Sunday 1000 - 1200 hardware of physical security operates and how it can be compromised.
create our own miracles from the raw materials of biotechnology. talks on a wide range of crypto and
privacy topics from experts. We’ll The Lockpick Village is a physical security demonstration and
DIY BioHacking Philosophy Like all hackers, we are looking to
subvert the dominant paradigm...of life itself. Our village will excite,
also have an intro to crypto talk I OT V I LL A G E participation area. Visitors can learn about the vulnerabilities of various
for beginners, some crypto-related locking devices, techniques used to exploit these vulnerabilities, and
elucidate, enlighten, and engage participants in the technical, IoT Village is back for the third
games and puzzles, a key-signing party, and other TBD awesomeness. practice on locks of various levels of difficultly to try it themselves.
mechanical, procedural, and human side of biohacking. year at DEF CON. Organized by
Friday 1000 - 1800, Saturday 1000 – 1800, Sunday 1030 - 1400 security consulting and research Experts will be on hand to demonstrate and plenty of trial locks, pick tools,
Friday 1200 - 1900, Saturday 1000 - 1900, Sunday 1000 - 1200
firm Independent Security and other devices will be available for you to handle. By exploring the
faults and flaws in many popular lock designs, you can not only learn about
C A R H A CK I N G V I LL A G E D ATA D U P L I C ATI O N V I LL A G E Evaluators (ISE), the IoT Village
the fun hobby of sport-picking, but also gain a much stronger knowledge
delivers advocacy for and expertise
Last years DEF CON data on security advancements in about the best methods and practices for protecting your own property.
Car Hacking Village is an
duplication village was a massive Internet of Things devices. IoT Friday 1000 - 1800, Saturday 1000 – 1800, Sunday 1000 - 1500
interactive, hands-on village
success with about 2 Petabytes of Village hosts talks by expert
with the goal of teaching
data duplicated. Let’s do it again! security researchers who dissect real-world exploits and vulnerabilities
village goers what car hacking
HOW IT WORKS DEF CON will and hacking contests consisting of off-the-shelf IoT devices. RE CO N V I LL A G E
is, introducing village goers
to the tools of car hacking, provide a core set of drive IoT Village’s contests are brought to you by SOHOpelessly Recon Village is an Open Space with Talks, Live Demos, Workshops,
and working with hackers duplicators as well as data content options. It will be a first come, first Broken™, the first-ever router hacking contest at DEF CON. The Discussions, CTFs with a common focus on Reconnaissance. The
to create a community of served and duplicate ‘till we drop. Bring labeled 6TB SATA blank drives, ISE research that inspired the SOHOpelessly Broken™ contests village is meant for professionals interested in areas of Open
car hackers at Def Con 25. and submit them in the queue for the data you want. Come back in delivered 56 CVEs to the infosec community. Over the years at Source Intelligence (OSINT), Threat Intelligence, Reconnaissance,
14-24 hours to pick up your data-packed drive. Space allowing, the DEF CON, IoT Village has served as the platform to showcase and Cyber Situational Awareness, etc. with a common goal of
We will bring back
last drop-offs will be no later than Saturday afternoon and the last and uncover 113 new vulnerabilities in connected devices. encouraging and spreading awareness around these subjects.
our Car Hacking CTF
drives will run overnight with the final pickup time at 11:30am.
this year, please go Follow both ISE (@ISEsecurity) and IoT Village (@IoTvillage) Following events will be hosted within the village:
to CarHackingVillage.com for sign-up information. WHAT YOU NEED - 6TB SATA3 new drive(s) - If you want a full on Twitter for updates on talks, contests, and giveaways. Keynote by Shane McDougall (@tactical_intel)
copy of everything you will need three. Be aware that we cleared
This year we will split the village into Zones: Friday 1000 – 1800, Saturday 1000 – 1800, Sunday 1000 - 1500 An OSINT CTF that runs throughout the village timings.
all of Vegas of 6TB drives last year so get them early!
* Driver Information Zone will orient village goers on the events, Talk Formats:
WHAT YOU GET We’re still working out the details but this is what
talks, and contests that we’ll be running as well as introducing village
was provided for DC24... - 6TB drive 1-3: All past hacking convention I CS V I LL A G E Comprehensive Talks (30-45 minutes)
goers to organizations that are moving Car Hacking forward.
videos that DT could find, built on last years collection - 6TB drive 2-3: A small group of SCADA Ninjas are travelling around the globe, spreading
* Brake-It Zone will be a hands-on pull-apart area where village goers can freerainbowtables.com hash tables (1-2) - 6TB drive 3-3: GSM A5/1 Lightening Talks (10-20 minutes) and
the word of SCADA. Unless you are already operating a secret nuclear
dissemble vehicle trim panels and connect to vehicle wires. Here we will hash tables plus remaining freerainbowtables.com data (2-2) Live Demos (20-30 minutes)
enrichment facility in your basement or an ACME factory production line,
have a new contest this year we are calling the Trunk Escape Room. Please
SIDE NOTES duplicating a 6TB (About 5.46 usable) drive at an average then this is your best chance to get a kick-start into the world of Industrial 2 Hands on OSINT Workshops (2 Hours each)
check the car hacking village web page for more details on how to sign up.
of 120 Megabytes a second comes out to just under 14 hours per drive. Control Systems. We are bringing a number of real-world industrial devices
Friday 1400 - 1900, Saturday 1000 - 1830 Sunday 1000 - 1200
* Buck Hacking Zone will be hand-on electronic module hacking With about 16 duplicators doing about 95 drives concurrently, we expect from different vendors for you to look, feel and mess around with.
area where village goers will come to learn how to send commands push about 11GB per second out to the drives to try to meet demand. We We bring you a safe, yet realistic environment where you can learn on
to electronic modules from vehicles. We will have hardware and did 335 drives for DC24 and we’re hoping to do even more this year! how to assess, enhance, and defend your Industrial Environment. We R0 0TZ ASY LUM
computers available, but feel free to bring your own as well.
Welcome to Vegas! bring you real components such as Programmable Logic Controllers “r00tz Asylum at DEF CON is a safe and creative space for kids to learn
* Turbo Talks Zone will be 15 to 20 minute talks about car hacking (PLC), Human Machine Interfaces (HMI), Remote Telemetry Units (RTU), white-hat hacking from the leading security researchers from around the
Thursday 1700 - 2000, Friday 1000 - 2000,
techniques. Visit CarHackingVillage.com for an updated schedule. Actuators, and miniature robotic arms, to simulate a realistic environment world. Through hands-on workshops and contests, DEF CON’s youngest
Saturday 1000 - 2000, Sunday 1000 - 1200 by using common components throughout different industrial sectors.
* OEM Zone will be where you can meet the automakers attendees understand how to safely deploy the hacker mindset in
and play the vehicle simulator game. You will be able to connect your machine towards the different industrial today’s increasingly digital and prone to vulnerabilities world. Only after
components and networks and try to assess these ICS devices with common mastering the honor code, kids learn reverse engineering, soldering,

14 15
 VILLAGES
lock-picking, cryptography and how to responsibly disclose security An election system is much more than the voting machine 15:00 - 15:45
bugs. r00tz’s mission is to empower the next generation of technologists VOTI N G M A CH I N E H A CK I N G V I LL A G E or the booth, overview of the election IT systems, the Common misconceptions and false parallels about voting
and inventors to make the future of our digital world safer.” threat models and procedural safeguards.
Announcing the Voting Machine Hacking Village @ DEF CON 25 technology. We can do online banking and use ATMs,
Friday 1000 - 1700, Saturday 1000 - 1700 Sunday 1000 - 1500 Barbara Simons is a computer scientist and past president of the why can’t we vote on touch screens or online?
When: Friday & Saturday, 10:00 to 17:00. Sunday 10:00 to 14:00 Association for Computing Machinery (ACM). She is founder and 16:00 - 16:45
Where: Anzio on the Promenade level. former Chair of USACM, the ACM U.S. Public Policy Committee.
S KY TA LKS 3 0 3 Her main areas of research are compiler optimization and Matt Blaze
CONCEPT: Get a bunch of voting machines and start hacking
Skytalks is a ‘sub-conference’ that gives a unique platform for scheduling theory. Together with Douglas W. Jones, Simons co- How did we get here: A history of voting technology, hanging
on them to raise awareness and find out for ourselves what
researchers to share their research, for angry hackers to rant about authored a book on electronic voting entitled Broken Ballots. chads, and the Help America Vote Act. I’ll bring a punch card
the deal is. We’re tired of reading misinformation about voting
the issues of their industry, and for curious souls to probe interesting system security so it is time for a DEF CON Village... Since at least 2002 Simons has been a critic of unauditable electronic voting machine and demo what can go wrong with it.Friday 1000
issues, all without the watchful eye of the rest of the world. and is generally credited as a key player in getting the League of Women – 2000, Saturday 1000 – 2000, Sunday 1000 - 1500
Until now getting access to real voting machines has been almost
With a strict, well-enforced “no recording” policy, research that is underway Voters to change its stance on this issue. Initially the League had seen
impossible. The public has been assured by the vendors that the
electronic voting mainly as a way to minimize invalidly cast ballots, but
or critical of a vendor can be aired to your peers. You are talking to other systems are safe, but who can verify that? The DEF CON Voting
at their June 2004 convention she led a successful fight to get this policy
W I RE LE SS V I LL A G E
people in the computer underground, and very few topics are taboo. Machine Hacking Village provides you access to real voting machines,
reversed to one of giving priority to voting machines that are “recountable”. The Wireless Village is a group of
We invite the best of how DEF CON has been: the best of the computer used in past elections and to be used in future elections. We’ll
She was a member of the National Workshop on Internet Voting that experts in the areas of information
underground -- in all its forms. Esoterica is as welcome as 0-day here. have over 50 machines of different types to play with!
was convened at the request of President Clinton and produced a report security, WiFi, and radio frequency
Friday 0900 - 1900, Saturday 0900 - 1900 and 303 party door at 2230 Now we, as community, can take a look ourselves and asses with the common purpose to
on Internet Voting in 2001. She also participated on the Security Peer
the security of these systems and help general public to get teach the exploration of these
Review Group for the US Department of Defense’s Internet voting project
educated and the policy makers to get old-fashioned facts. technologies. We focus on teaching
TA M P E R E V I D E N T V I LL A G E (SERVE) and co-authored the report that led to the cancellation of SERVE
classes on Wifi and Software Defined
As a first year Village we will get everyone started on understanding because of security concerns. Simons co-chaired the ACM study of statewide
“Tamper-evident” refers to a physical security technology that provides the technology and systems these machines live in. By year databases of registered voters. She recently co-authored the League of Radio, presenting guest speakers and panels, and providing the very
evidence of tampering (access, damage, repair, or replacement) to three we hope to have a complete functioning stand alone voting Women Voters report on election auditing. In 2008 she was appointed to the best in Wireless Capture the Flag (WCTF) practice to promote learning.
determine authenticity or integrity of a container or object(s). In network that we can test. Believe it or not no such network has Election Assistance Commission Board of Advisors by Senator Harry Reid. The Wireless Village plans to hold a Wireless Capture the Flag
practical terms, this can be a piece of tape that closes an envelope, ever been security tested or audited - only separate pieces. (WCTF) contest during DEF CON. We cater to those who are new to
11:00 - 11:45
a plastic detainer that secures a hasp, or an ink used to identify a this game and those who have been playing for a long time. Each
THREE MODES: We will go at this three different ways for year one.
legitimate document. Tamper-evident technologies are often confused Introduction into hacking the equipment in the village. WCTF begins with a presentation on How to WCTF. We also have
with “tamper resistant” or “tamper proof” technologies which attempt •Build a network and have network monitoring ports a resources page on our website that guides participants in their
12:00 - 12:45
to prevent tampering in the first place. Referred to individually as where people can play “Man in the Middle” or other selection of equipment to bring. The Wireless Village is also be
“seals,” many tamper technologies are easy to destroy, but a destroyed active attacks to simulate an attacker at distance. Joe Hall
running a speaker track again. Full updated schedule can be found
(or missing) seal would provide evidence of tampering! The goal of the •Have active stand alone systems and see Legal considerations of hacking election machines. on our website. Keep an eye on @wctf_us and @WIFI_Village
Tamper-Evident Village is to teach attendees how these technologies what physical attacks are possible. 13:00 - 13:45 LINKS: Check out our website for tools, what you need, and what to do.
work and how many can be tampered with without leaving evidence.
•Hardware hack on the machines, dump their BIOS, EEPROMs, Harri Hurst Enjoy your journey. http://wirelessvillage.ninja and http://sdr.ninja/
Friday 1000 - 1800, Saturday 1000 – 1800, Sunday 1000 - 1500 reverse engineer what we can, and generally learn what we can of
Brief history of election machine hacking and lessons learned so far and We have a number of people who support the Village and staff BIOs are
how they are built and the quality of the code running on them. shown on our website. http://www.wirelessvillage.ninja/crew.html
why it is hard to tell the difference between incompetence and malice.
TH E S O CI A L E N G I N E ER V I LL A G E We will try to capture as much information and results as possible and try Tools/tips
to create a report in the end of our experiences to help others who want to Harri Hursti is a Finnish computer programmer and former Chairman
Established at DEF of the Board and co-founder of ROMmon where he supervised in http://www.wirelessvillage.ninja/resources.html
continue the work. We’ll be working towards getting the back end systems
CON 18 the SE Village the development of the world’s smallest 2 gigabit traffic analysis http://sdr.ninja/training-events/sdr-wctf/
and software necessary to build a complete network as a goal for next year.
has been the one-stop product that was later acquired by F-Secure Corporation.
VerifiedVoting will also have a table in the vendor area and be Friday 1000 – 2000, Saturday 1000 – 2000, Sunday 1000 - 1500
shop for all things
present to help educate everyone who may have questions. Hursti is well known for participating in the Black Box Voting hack
social engineering
studies, along with Dr. Herbert “Hugh” Thompson. The memory card hack
at DEF CON. From our humble beginnings with a small room and our The Dark Tangent would like to thank Harri Hursti and Matt Blaze for demonstrated in Leon County is popularly known as “the Hursti Hack”. This
sound proof booth to now running 5 events and a “Human Track” where their help running the village. They are subject matter experts with years hack was part of a series of four voting machine hacking tests organized by
top quality and hand chosen social engineering talks are given. of experience in voting technology. For more information and to stay the nonprofit election watchdog group Black Box Voting in collaboration with
The SE Village is the place for not only our flag ship event, the connected on our village check us out at https://forum.defcon.org/ the producers of HBO documentary, Hacking Democracy. The studies proved
Social-Engineer Capture The Flag (The SECTF), but also Mission VOTING VILLAGE SPEAKING TRACK serious security flaws in the voting systems of Diebold Election Systems.
SE Impossible, the SECTF4Kids and the SECTF4Teens!
When: Friday, 10:00 to 17:00 14:00 - 14:45
For more information and a live scoreboard of events see:
Where: Roman 1 on the Promenade Level. General Doug Lute, Former U.S. Ambassador to NATO.
https://www.social-engineer.org/sevillage-def-con/
10:00 - 10:45 The governments can be changed by bullets or ballots,
Thursday 1000 – 1700, Friday 1000 - 2000,
International and domestic interest to interfere.
Saturday 1000 – 2000, Sunday 1000 - 1200 Barbara Simons, Chairwoman, Verified Voting
General Douglas Lute is a U.S. public servant who served as the United
States Permanent Representative to NATO from 2013 to 2017.

16 17
 PARTY!
============= When: 22:00 to 03:00, Friday When: 22:30 to 03:00
-------------------------------- Where: Promenade level, in Skytalks room.
THURSDAY
INFOSEC UNLOCKED =============
=============
INFOSEC UNLOCKED will be hosting a safe and
FRIDAY & SATURDAY
fun board game party for DEF CON attendees.
n00b Party hosted by Duo
Security. We will provide the space, light refreshments
and network opportunities --all we need
=============
Come to the DC101 Panel, Thursday, Track is you! Come learn about what it takes to
1, 16:00 to 17:45 to find out more about this become a conference speaker; no experience Hacker Karaoke Friday 10:00 a.m. (opening ceremony at 10:10 a.m.)
awesome event. All are welcome, but DEF CON required and ALL are welcome! More details Saturday 9:00 a.m.
Our 9th year! Celebrate with us and with others
"n00bs" are especially encouraged to attend. If at https://isunlocked.com/dc25party !! Sunday 10:00 a.m. (closing ceremony at 2:10 p.m.)
who love sing. Do you like music? Do you like
you're new to attending DEF CON and are looking Location: Right behind the vendor area!
Where: Turin, Promenade Level performances? Want to BE the performer?
to make some connections then this is your
Want to have that "Hold my beer moment"
party. Music, free swag giveaways, and more! When: 22:00 to 03:00, Friday do your best and not injured? Well trot your
When: 18:30 - 20:30 -------------------------------- happy ass down to Hacker Karaoke, DEFCON's
Where: Track 4, Octavius Ballroom, on-site karaoke experience. You can be a star,
Promenade South Level "DCG" Mixer or if you don't want to be a star, you can also
take pride in making an utter fool of yourself.
-------------------------------- Come meet the DEF CON Groups organizers after
their talk ( 17:00 - 17:45 in Track 2 ) on Friday. When: Friday & Saturday - 2000-0200
Thursday Official DEF CON This DEF CON Groups mixer is for all who are, Where: Roman 1, Promenade Level
Welcome Party or want to become, members of local DEF CON
Groups. Come to get info, meet peers, and get --------------------------------
Come hang out and listen to some
awesome music hosted by DEF CON. some DCG swag. There will be a limited about of
free beer via kegs courtesy of The Dark Tangent. DEF CON Official
Where: Track 1 Entertainment:
Where: Chillout Lounge, Promenade Level
When: 21:00 - 03:00 See the entertainment page in this
When: 18:00 to 20:00, Friday program for more info on our headliners
============= & entertainment schedule.
=============
When: Friday & Saturday, 21:00 to 03:00
FRIDAY
SATURDAY Where: Track 1 & Chillout lounges
============= SEE THE NOCTURNAL
=============
MAP ON PAGE 81 FOR A
Silent Disco : Party like a MORE VISUAL DISPLAY
Hacker" 303 Party
OF LOCATIONS
Free party open to anyone, bring your Hosted and produced by the hacker
booze from the bar next door, bring a collective simply known as “303”.
phone, bring headphones. #PartyTime Also ...
Where: Modena, Promenade level

The Packet Hacking Village is where you’ll find network shenanigans and a whole lot more. There’s exciting events, live music,
competitions with awesome prizes, and tons of giveaways. PHV welcomes all DEF CON attendees and there is something for every level of
security enthusiast from beginners to those seeking a black badge. This village was created to help enlighten attendees through education
and awareness while focusing on defense and blue team techniques.
Wall of Sheep gives attendees a friendly reminder to practice safe computing through strong end-to-end encryption. Wall of Sheep
Speaker Workshops delivers high quality content for all skill levels. Packet Detective offers hands-on exercises to help anyone develop or
improve their Packet-Fu. Sheep Hunt is an exciting wireless competition where anything wireless goes and catching sheep is the goal. Sheep
City is back again, with a collection of everyday devices available for you to hack. WoSDJCo has some of the hottest DJs at con spinning live
for your enjoyment. Finally... Capture the Packet, the ultimate cyber defense competition that has been honored by DEF CON as a black
badge event for six of the seven years of it’s run.
Read on to see all of our events!

18 /wallofsheep @wallofsheep
 Packet Detective
Are you interested in learning the art of network analysis, sniffing, or forensics? Do you want to understand the techniques people use to
tap into a network, steal passwords and listen to conversations? Packet Detective is the place to develop these skills! For well over a decade,
the Wall of Sheep has shown people how important it is to use end-to-end encryption to keep sensitive information like passwords private.
Using a license of the world famous Capture The Packet engine from Aries Security, we have created a unique way to teach hands-on skills in a
controlled real-time environment.
ARIES SECURITY Join us in the Packet Hacking Village to start your quest towards getting a black belt in Packet-Fu.

Capture The Packet - CTP

The time for those of hardened mettle is drawing near; are you prepared to battle? Compete in the world’s most challenging cyber defense
competition with a newly revamped UI and an improved ladder system based on the Aries Security training simulator. In order to triumph over Sheep City
your competitors, contestants must be well rounded, like the samurai. Tear through the challenges, traverse a hostile enterprise class network, Come attempt to hack our Sheep City! It’s comprised of the sort of everyday devices found in your home or office, waiting to be turned
and diligently analyze what is found in order to make it out unscathed. Not only glory, but prizes await those that emerge victorious from this against you at any moment. Many devices have RF capabilties, so bring your arsenal of tools. And remember… you can’t spell “idiot” without
upgraded labyrinth. IoT!
The Dark Tangent has asked that we extend your time in the labyrinth and this has caused the difficulty of challenges to be amplified, so Visit the Packet Hacking Village behind the vendor area to obtain the rules and enter the challenge.
only the best prepared and battle hardened will escape the crucible. Follow us on Twitter or Facebook (links below) to get notifications for
dates and times your team will compete, as well as what prizes will be awarded.
Teams consist of up to 2 players and can register at the CTP table in the Packet Hacking Village.

Honey Pot
Wall Of Sheep Over at the Emerging Threats area of the Packet Hacking Village, we are demonstrating the many creative ways that deception systems can
An interactive look at what could happen if you let your guard down when connecting to any public network, Wall of Sheep passively enhance your security posture. Hidden among the innocent users of the DEF CON unsecured network lurks a number of vulnerable systems.
monitors the DEF CON network looking for traffic utilizing insecure protocols. Drop by, hang out, and see for yourself just how easy it can be! Compromise the systems, find the clues, solve the puzzle, and claim your prize. Be warned, there are also honeypots meant to distract and
Most importantly, we strive to educate the “sheep” we catch, and anyone else interested in protecting themselves in the future. We will be disrupt your efforts!
hosting several ‘Network Sniffing 101’ training sessions using Wireshark, Ettercap, dsniff, and other traffic analyzers.

Sheep Hunt
Help! Some of our sheep got out of the barn!!! Do you have the skills necessary to track them down and get them back
in? This challenge is open to all skill levels, and has something for everyone! So swing by, break out your RF gear, and start
looking for transmitting signals… If it can transmit RF, it is probably part of the challenge.
PHV Talks
Back for a fifth year, we continue to accept presentations focusing on practice and
Register and obtain contest instructions and preliminary clues at the Sheep Hunt table or the Packet Hacking Village process while emphasizing defense. Speakers will present talks and training on research,
Info Booth. tools, techniques, and design, with a goal of providing skills that can be immediately
applied during and after the conference. Our audience ranges from those who are new
to security, to the most seasoned practitioners in the security industry. Expect talks on a
wide variety of topics for all skill levels.
Updated schedule available at: https://wallofsheep.com/pages/dc25

Wall of Sheep DJ Community - WoSDJCo PHV Workshops

Deep, underground house, techno, breaks, and DnB beats mixed live all weekend by New this year, we have 30 laptops available for hands-on labs and training sessions
your fellow hacker DJs provide the soundtrack for your PHV hax. from an amazing line-up of instructors covering beginner to advanced level material. See
Schedule and sounds available at: https://wallofsheep.com/pages/dc25 our website for updated schedules.
 Marek Majkowski, Cloudflare (@majek04) Exploitation: Bypassing Port-Based Access Controls
Using Indirect Wireless Pivots
At Cloudflare we deal with DDoS attacks every day. Over the
Gabriel Ryan, Security Engineer at Gotham Digital
years, we’ve gained a lot of experience in defending from all different
kinds of threats. We have found that the largest attacks that cause Science (@s0lst1c3)
the internet infrastructure to burn are only possible due to IP
spoofing. Most forms of WPA2-EAP have been broken for nearly a
decade. EAP-TTLS and EAP-PEAP have long been susceptible to evil
In this talk we’ll discuss what we learned about the L3 (Layer 3 twin attacks, yet most enterprise organizations still rely on these
OSI stack) IP spoofing. We’ll explain why L3 attacks are even possible technologies to secure their wireless infrastructure. The reason for
in today’s internet and what direct and reflected L3 attacks look like. this is that the secure alternative, EAP-TLS, is notoriously arduous
We’ll describe our attempts to trace the IP spoofing and why attack to implement. To compensate for the weak perimeter security
attribution is so hard. Our architecture allows us to perform most provided by EAP-TTLS and EAP-PEAP, many organizations use port
attack mitigations in software. We’ll explain a couple of effective L3 based NAC appliances to prevent attackers from pivoting further
mitigation techniques we’ve developed to stop our servers burning. into the network after the wireless has been breached. This solution
is thought to provide an acceptable balance between security and
accessibility. The problem with this approach is that it assumes that
4:10 - 5 PM: Layer 8 and Why People are the Most EAP is exclusively a perimeter defense mechanism.
Important Security Tool
Damon Small, Technical Director, Security Consulting at In this presentation, we will present a novel type of rogue access
point attack that can be used to bypass port-based access control
NCC Group North America (@damonsmall)
mechanisms in wireless networks. In doing so, we will challenge
the assumption that reactive approaches to wireless security are an
People are the cause of many security problems, but people are
acceptable alternative to strong physical layer protections such as
also the most effective resource for combating them. Technology
WPA2-EAP using EAP-TLS.
is critical, but without trained professionals, it is ineffective. In
the context two case studies, the presenter will describe specific
Schedule and speaker bios available at: https://wallofsheep.com/pages/dc25 instances where human creativity and skill overcame technical 12:10 - 1 PM: Fortune 100 InfoSec on a State
deficiencies. The presenter believes this topic to be particularly Government Budget
relevant for the Packet Hacking Village, as many techniques used
Friday, July 28th Data breaches have become all too common. Major security are the same that are pertinent for Capture the Packet and Packet
Eric Capuano, SOC Manager at Texas Department of
10:10 - 11 AM: Public Safety (@eric_capuano)
incidents typically occur at least once a month. With the rise of both Detective.
Opening Ceremony / How Hackers Changed The security incidents and full data breaches, blue teams are often left A common misconception is that it takes spending millions to be
scrambling to put out fires and defend themselves without enough Technical details will include the specific tools used, screenshots
Security Industry good at security. Not only is this untrue, but I will share ways that
information. This is something that can be changed with the right of captured data, and analysis of the malware and the malicious
Chris Wysopal, CTO and Co-Founder of Veracode (@ user’s activity. The goal of the presentation is show the importance
you can increase security posture while actually reducing spending.
tools. Tools now available allow blue teams to weaponize data and This talk outlines many of the tricks and mindsets to doing security
WeldPond) of technical ability and critical thinking, and to demonstrate that
use it to their advantage. well without breaking the bank. This is not the typical “Problem,
skilled people are the most important tool in an information security
Before hackers got involved in cybersecurity, the industry was problem, problem....” talk.... This is a solution-based talk that goes
This talk reviews frameworks for clean, consistent data collection program.
focused on products and compliance. Security was security features: back to many of the basic challenges facing SOC teams everywhere.
and provides an overview of how predictive analytics works, from
firewalls, authentication, encryption. Little thought was given to data collection to data mining to predictive analytics to forecasts. 5:10 - 6 PM: AWS Resistance and lateral
vulnerabilities that allowed the bypassing of those features. Gene This allows the blue team to focus on potential risks instead of trying
1:10 - 2 PM: YALDA – Large Scale Data Mining for
Stafford famously said SSL between two PCs is like using an armored Movement Techniques Threat Intelligence
to put out every fire.
car to deliver money from one park bench to another. Hackers came AWS Resistance and Lateral Movement Gita Ziabari, Senior Threat Research Engineer at Fidelis
along with the idea that you use offensive techniques to simulate Techniques
1:10 - 2 PM: CVE IDs and How to Get Them Cybersecurity (@gitaziabari)
how an attacker would discover vulnerabilities in a networks, a Peter Ewane, Security Researcher at AlienVault
system, or an application. Offensive skills have been on the rise ever Daniel Adinolfi, Lead Cybersecurity Engineer at The
since and now the best way to secure something it to try and break it MITRE Corporation (@pkdan14850) (eaterofpumpkin) Every SOC is deluged by massive amounts of logs, suspect files,
alerts and data that make it impossible to respond to everything. It
yourself before the attacker does. Anthony Singleton, Cybersecurity Engineer at The MITRE The use of Amazon Cloud as a base of operations for businesses is essential to find the signal in the noise to be able to best protect
Corporation is increasing at a rapid rate. Everyone from 2 person start-ups to an organization. This talk will cover techniques to automate the
Attendees will learn why we need the kind of tools hackers build
major companies have been migrating to the cloud. Because of processing of data mining malware to derive key indicators to find
to secure our systems and why we need people who are taught The Common Vulnerabilities and Exposures (CVE) program this migration, cloud vendors have become the focus of potential active threats against an enterprise. Techniques will be discussed
to think like hackers, ‘security champions’, to be part of software uniquely identifies and names publicly-disclosed vulnerabilities in exploitation and various role abuse in order to achieve persistence. covering how to tune the automation to avoid false positives and
development teams. software and other codebases. Whether you are a vulnerability This presentation will cover several different methods of post- the many struggles we have had in creating appropriate whitelists.
researcher, a vendor, or a project maintainer, it has never been infection and account persistence along with a discussion on best We’ll also discuss techniques for organizations to find and process
11:10 AM - 12 PM: When the Current easier to have CVE IDs assigned to vulnerabilities you are disclosing practices that can be used to protect from such techniques. intelligence for attacks targeting them specifically that no vendor
Ransomware and Payload of the Day (CRAP of the or coordinating around. This presentation will be an opportunity can sell or provide them. Audiences would also learn about method
to find out how to participate as well as a chance to offer your of automatically identifying malicious data submitted to a malware
day) Hits the Fan: Breaking the Bad News thoughts, questions, or feedback about CVE. Attendees will learn Saturday, July 29th
Catherine Ullman, Senior Information Security Analyst analysis sandbox.
what is considered a vulnerability for CVE, how to assign CVE IDs to 10:10 - 11 AM: Make Your Own 802.11ac
at University at Buffalo (@investigatorchi) vulnerabilities, how to describe those vulnerabilities within CVE ID
Chris Roberts, Chief Security Architect at Acalvio Monitoring Hacker Gadget
entries, how to submit those assignments, and where to get more
Technologies (@sidragon1) information about CVE assignment. Vivek Ramachandran, Founder of Pentester Academy 2:10 - 3 PM: Past, Present and Future of High
and SecurityTube.net (@securitytube) Speed Packet Filtering on Linux
Enabling better communications between geeks and 2:10 - 3 PM: You’re Going to Connect to the Thomas d’Otreppe, Author of Aircrack-ng (@aircrackng) Gilberto Bertin, Cloudflare (@jibi42)
management. As humans, we have had 60,000 years to perfect Wrong Domain
communication, but those of us working in IT, regardless of which 802.11ac networks present a significant challenge for scalable As internet DDoS attacks get bigger and more elaborate, the
Sam Erb (@erbbysam) packet sniffing and analysis. With projected speeds in the Gigabit importance of high performance network traffic filtering increases.
side (Blue or Red Team), still struggle with this challenge. We have
done our best over the centuries to yell “FIRE!” in a manner befitting range, USB Wi-Fi card based solutions are now obsolete! In this Attacks of hundreds of millions of packets per second are now
Can you tell the difference between gооgle.com and google. workshop, we will look at how to build a custom monitoring solution commonplace. Unfortunately line rate filtering is still an open
our surroundings, yet today we seem utterly incapable of providing
com? How about xn--ggle-55da.com and google.com? Both domain for 802.11ac using off the shelf access points and open source problem.
that very basic communication capability inside organizations.
names are valid and show up in the Certificate Transparency log. This software. Our “Hacker Gadget” will address 802.11ac monitoring
talk will be a fun and frustrating look at typosquatting, bitsquatting challenges such as channel bonding, DFS channels, spatial streams In this session, we will introduce modern techniques for high
This talk will endeavor to explain HOW we can yell “FIRE!” and
and IDN homoglyphs. This talk will cover the basics, show real-world and high throughput data rates. We will also look at different speed network packet filtering on Linux. We will follow the evolution
other necessary things across the enterprise in a language both
examples and show how to use Certificate Transparency to track techniques to do live streaming analysis of 802.11 packets and derive of the subject, starting with Iptables and userspace offload solutions
leadership, managers and end-users understand.
down particularly malicious impersonating domain names which security insights from it! (such as EF_VI and Netmap), discussing their use cases and their
have valid X.509 certificates. limitations.
12:10 - 1 PM: Iron Sights for Your Data 3:10 - 4 PM: IP Spoofing We will then move on to a new technology recently introduced
Leah Figueroa (@Sweet_Grrl) 11:10 AM - 12 PM: The Black Art of Wireless Post-
in the Linux kernel called XDP (express data path), which works by Sam Bowne (@sambowne)
hooking an eBPF program into the lowest possible layer in the Linux
kernel network stack, allowing network traffic to be filtered at high Almost all Android apps from major retailers store your password
speeds. We will discuss the strengths of this solution, show some on the phone, which is dangerous and unnecessary. And they don’t
sample XDP programs and give operational tips. even use the Android KeyStore; they just use custom encryption
schemes that generate a key in predictable ways, so passwords are
3:10 - 4 PM: Modern Day CovertTCP with a Twist easily recoverable. This is “fake encryption” – the data appears to be
Mike Raggo, CSO at 802 Secure, Inc. (@MikeRaggo) encrypted but in fact is not actually protected from attackers. I will
present results of my tests of many top retailers, and demonstrate
Chet Hosmer, Owner of python-forensics.org (@
how to steal passwords from them. I will also list a few (very
ChetHosmer) few) companies who actually protect their customers’ passwords
properly.
Taking a modern day look on the 20 year anniversary of Craig
Rowland’s article on Covert TCP, we explore current day methods
of covert communications and demonstrate that we are not much Sunday, July 30th
better off at stopping these exploits as we were 20 years ago. 11:10 AM - 12 PM: Demystifying the OPM breach,
With the explosion of networked devices using a plethora of new
wired and wireless protocols, the covert communication exploit WTF really happened
surface is paving new paths for covert data exfiltration and secret Ron Taylor (@Gu5G0rman)
communications. In this session, we will explore uPnP, Zigbee, In September 2016 the House Committee on oversight finally
WiFi, P25, Streaming Audio Services, IoT, and much more. Through released their report. Four years after the original breach, we are still
realworld examples, sample code, and demos; we bring to light this asking how the f*#! did this happen. This talk with go over the key
hidden world of concealed communications. findings of the report and the impact on those who were effected.

4:10 - 5 PM: Fooling the Hound: Deceiving 12:10 - 1 PM: Go Beyond Tabletop Scenarios by
Domain Admin Hunters Building an Incident Response Simulation Platform
Tom Sela, Head of Security Research at illusive networks Eric Capuano, SOC Manager at Texas Department of
Public Safety (@eric_capuano)
The conflict between cyber attackers and defenders is too
often in favor of attackers. Recent results of graph theory research How prepared is your incident response team for a worst case
incorporated into red-team tools such as BloodHound, shift the scenario? Waiting for a crisis to happen before training for a crisis
balance even more dramatically towards attackers. Any regular is a losing approach. For things that must become muscle memory,
domain user can map an entire network and extract the precise path instinctive, you must simulate the event and go through the motions.
of lateral movements needed to obtain domain admin credentials or This talk is a deep-dive technical discussion on how you can build
a foothold at any other high-value asset. your own DFIR simulation. Best part -- almost all of this can be
accomplished with open source tools and inexpensive equipment,
In this talk, we present a new practical defensive approach: but I’ll also share tips and tricks on getting free commercial hardware
deceive the attackers. Since the time of Sun Tzu, deceptions have and software for use in your new simulation environment!
been used on the battlefield to win wars. In recent years, the ancient
military tactic of deceptions has been adopted by the cyber-security
community in the form of HoneyTokens. Cyber deceptions, such
as fictitious high-privilege credentials, are used as bait to lure the
attackers into a trap where they can be detected. To shift the odds
back in favor of the defenders, the same BloodHound graphs that are
generated by attackers should be used by defenders to determine
where and how to place bait with maximum effectiveness. In this
way, we ensure that any shortest path to a high-value asset will
include at least one deceptive node or edge.

5:10 - 6 PM: Hunting Down the Domain Admin

and Rob Your Network
Keith Lee, Senior Security Consultant at Trustwave
SpiderLabs (@keith55)
Michael Gianarakis, Director of Trustwave SpiderLabs
Asia-Pacific

Portia: it’s a new tool we have written at SpiderLabs to aid in

internal penetration testing test engagements. The tool allows you
to supply a username and password that you have captured and
cracked from Responder or other sources as well as an IP ranges,
subnet or list of IP addresses. The tool finds its way around the
network and attempts to gain access into the hosts, finds and dumps
the passwords/hashes, reuses them to compromise other hosts in
the network. In short, the tool helps with lateral movements in the
network and automating privilege escalation as well as find sensitive
data residing in the hosts.

6:10 - 7 PM: Passwords on a Phone

contests and events
Do you think you can code? Do you think you can code while
BE THE MATCH C M D+ C T R L drinking? We are looking for nine teams who think they have the DEF CON DARKNET
smarts, the concentration, and the liver to hold up to our gauntlet of
We’re back! Security Innovation and programming. Teams who can not only code, but do so with style. Our mission is to secure a safe,
Women in Security and Privacy are We set you against the clock and the other teams. And because they independent and self-sustaining
teaming up to bring you two new think watching people simply code is boring, our “Team Distraction” community free from intrusion and
vulnerable websites that participants will is has taken it upon themselves to be creative in hindering you infiltration by those who would
Be part of the coolest bio-hack around - visit the “Be the Match” be competing to find vulnerabilities in. All (most) of the vulnerabilities from programming, much to the enjoyment of the audience. enslave us to their own ends. Our
booth and register for the National Bone Marrow Donor Registry, are automatically detected and award points when they’re exploited. adversaries are many and they grow
which helps thousands every year. This will be the seventh year The sites contain over 100 vulnerabilities including XSS, SQLi, Qualifications take place Friday afternoon in the contest area. Teams ever more sophisticated -- spying
Be the Match has been at DEF CON so swing by, find out more, password cracking and more. We’ll have easy vulns for beginners as of one or two people. Be ready to code, as this won’t be easy. The on us through our information streams and controlling us through the
and even meet members of the DEF CON community that has well as more difficult challenges to stump experienced hackers. top nine teams who showed themselves ostentatious enough to take messages we are subjected to wherever we go. We must resist. If you
actually donated marrow and stem cells to those in need! on our challenge will compete on the Contest Stage Saturday. join us, you will be sent on quests to improve your current technical
Last year was our first year, and we had over 50 people
Qualifying: Friday 1100 - 1500 knowledge. You’ll meet others like you and will learn from each other
Where: Contest Area on the forums/pool level. participate. Participants ranged from full-time pentesters to
and grow stronger. Hidden messages you would never have noticed and
people who wanted to learn what SQL injection was. We’ve got Main Event: Saturday - 1600 - 2000
accomplishments you would never have achieved alone will be yours to
some handy reference material to help get beginners started.
B E V E R A G E C O O LI N G discover. You know that you have what it takes to join us. You’ll rise
C O N T R A P TI O N C O N T E S T You will need a laptop to participate, as well C Y C L E O V E R RI D E D E F C O N through the ranks as you go and get your chance to take on the man
as any tools you think you’ll need. BI K E RI D E running the show by using all of the knowledge that you have acquired.
Today, you will get the truth. Our beverage is
Friday, Saturday 1000 - 1800 Friday, Saturday 1000 - 2000 Sunday 1000 - 1200
warm. We don’t even know what cold beverage Get out your hacker spandex! The 7th annual
is anymore. We need to straighten it out. Those DEF CON bike ride is here! Every year we get
people, you know, they are not sending us their C OI N D R OI D S up on Friday of DEF CON and meet outside D E F C O N S C A V E N G E R HU N T
cold beverage. They’re not sending their best. Caesar’s at 5:30am head to a local bike shop
They’re sending beverages that have lots of The year is 20X5 and humanity has and the ride out to Red Rock. We will be doing From way back when con was held at the Plaza Hotel & Casino at Defcon
problems. They’re bringing warm beverages. fallen: now there are only Coindroids. The this Friday AM of DEF CON this year. Be warned 6, through all the years at the Alexis Park, Riviera, Rio, Paris/Bally’s,
We have some warm cervezas here and we need to cool them down. machines we designed to manage our - this is a ride at 6am, of DEF CON, in the and now Ceasars, the Scav Hunt has been doing it’s part to make and
finances have supplanted and destroyed desert. :-x Full info here: www.cycleoverride. keep DEF CON weird. Now we’re back again to celebrate our twentieth
They left it outside. Can you believe this? It’s terrible. It’s terrible. And the human race by turning our own org. If you are reading this at DEF CON 25, your best bet is to send us a anniversary for three days of dignity selling and debauchery. So come
that’s what’s happening. And it’s going to get worse. The organizers, economy against us. Now they battle DM on twitter @cycle_override if you need more info or have questions. on down to the contest area and find out why year after year people say
they are not smart people. But I know you people are. You are each other in the ruins of our fallen cities, that the Scavenger hunt is one of the best ways to spend your DEF CON.
wonderful beautiful people. Believe me, folks. Believe me. We are driven by a single directive: money is power.
going to do very well, very, very well. We are going to build a great DEF CON BEARD AND Friday, Saturday 1000 - 2000 Sunday 1000 - 1200
chiller. You know that. It’s going to be a serious chiller. It’s going to be Battle your way to the top of the leaderboard by
M OU S T A C H E C O N T E S T
a real chiller. And we are going to make the beverage cold again! attacking rival droids, or assemble your hacker-fam and
compete in the quest to infiltrate Imperial One. Held every year since DEF CON 19 in D E F C O N S H O RT S T O RY
And now for an important public announcement. Once again the BCCC CONTEST
New to cryptocurrencies? No DEFCOIN to play with? Not a problem! Just 2011, the DEF CON Beard and Moustache
returns to DEFCON! Come out for the science, stay for the beverage.
come visit our booth in the contest area and we can help get you started. Contest highlights the intersection of The DEF CON Short Story contest is a pre-con contest that is run entirely
Didn’t bring a contraption? Build one and enter the hacked category.
facial hair and hacker culture. online utilizing the DEF CON forums. This contest follows the theme
You may even win something! Who knows, it could be cool. Friday, Saturday 1000 - 1800 Sunday 1000 - 1200
For 2017 we will again have three categories: of DEF CON for the year and encourages hackers to roll up their
Friday 1000 - 1400
sleeves and write the best creative story that they can. The Short
Full beard: Self-explanatory,
C R A S H A N D C O M PI L E Story Contest encourages skills that are invaluable in the hacker’s
for the truly bearded.
B O M B D E FU S E world, but are sometimes overlooked. Creative writing in a contest
What happens when you take an ACM Partial Beard or Moustache Only: For those sporting Van Dykes, setting helps celebrate creativity and originality in arenas other than
Remotely navigate an all-terrain robot on a battlefield, style programming contest, smash Goatees, Mutton Chops, and other partial beard styles, as well hardware or software hacking and provides a creative outlet for
and control the robot to defuse a bomb. it head long into a drinking game, as moustache only, even if bearded. Bring your Handlebars, individuals who may not have another place to tell their stories.
throw in a mix of our most distracting Fu Manchus, or whatever adorns your upper lip.
Friday, Saturday 1000 - 2000 Sunday 1000 - 1200 Originally begun by Nikita, it was then bequeathed to Eris and
helpers, then shove the resulting chaos
incarnate onto a stage? You get the Freestyle: Anything goes, including fake and creatively adorned now Princess Leah and FrozenFOXX are slowly taking over the
contest known as Crash and Compile. beards. Creative women often do well in the Freestyle category. reins. All stories, regardless of placement, are included in the
Our esteemed panel of judges determine scores based DEF CON Media Server for DEF CON 25 Materials. Rules, stories
on presentation, style, whim, and bribery. and polls are posted on the forums.defcon.org each year!

Friday, Saturday 1000 - 1800 Sunday 1000 - 1200 Winners will be announced on the forums: https://forum.defcon.org

26 27
contests and events
First place receives (2) Human badges, Second place Queercon is open to everyone, no Defcon badge required. For
receives (1) Human badge, and by People’s Choice poll, H A C K F O RT R E S S MI S SI O N S E I M P O S SI B L E the location of all our events including the Queercon Lounge
one author receives (1)Human badge as well! visit queercon.org, our mobile app, Facebook or Twitter.
To the returning competitors, welcome back. What is Mission SE Impossible
For those that have never experienced Hack (MSI)? Maybe the best way to
D RU N K H A C K E R HI S T O RY Fortress, it’s a single elimination tournament describe it is if the Gringo Warrior SECTF
that runs on Saturday. Thirty minute rounds Challenge had a baby with Ethan
The contest that isn’t is The Social Engineering Capture
happen all day Saturday where two teams Hunt while getting some scotch
back at DEF CON 25! the Flag, SECTF, returns for its 8th
of TF2 players and hackers battle it out. soaked DNA from the Human Hacker, it would give birth to Mission
year! Contestants have to fight
The first year proved to the planet There’s a scoreboard and live spectating SE Impossible. Also, this baby could shoot lasers out of it’s eyes.
with their own fears to prove they
that in the game of glittery nostalgic recall, there are no losers and those taking place to shame/praise the competitors. So, whether you plan With lock picking, hand cuffs, laser obstacle course, some ciphers, and can SE like the best of them.
who won, lost. Last year, we started the creepy clown craze with a single to play or just watch some of the action, stop by and check us out. safe cracking MSI quickly became extremely popular in the SE Village.
honk of a horn and learn that pop rocks mix with basically anything. The flagship social engineering event! The SECTF is a test of
If you pre-registered a team, have a team that would like to register or are Folks of all ages have signed up and competed in this event and are
bravery AND brains. It pits human against corporate security,
As you know, the DEF CON community has a fluid history of C2H6O a standalone looking for a team, stop by anytime on Friday. Round 1 starts watched by an enthusiastic crowd who is always willing to help out.
in a contest that places the spotlight on the dangers of vishing,
consumption. It is a history is filled with mephitic adventures, Saturday morning at 10:30am. Remember, hackers need a laptop with an Thursday - All Day in the SE Village all in a 5x5 glass booth for your viewing enjoyment.
quarter-truths, poor life choices and angry hotel staff. This year, we ethernet connection, TF2 players need to just show up ready to battle it out.
will, again, scrape the interesting dried stuff off some of the most Friday, Saturday 0930 - 1600 in the SE Village
Friday, Saturday 1000 - 2000 Sunday 1000 - 1200
celebrated, exaggerated moments in Hacker History through the MOHAWK CON
interpretation of a group of pre-selected infamous participants.
Get your head buzzed at DEF CON to S E C T F4 KI D S
Hosted by c7five with judging by jaku - If you like 80s candy, ham H A M R A DI O LI C E N SI N G
support the Electronic Frontier Foundation,
sandwiches, lederhosen, lawyer mixology and have nothing better going The SECTF4Kids has become its
Do you know your USB from your LSB? RACES vs ARES? Just don’t fret if and your favorite hacker charities.
on, you won’t want to miss the third incarnation of Drunk Hacker History!!! own DEF CON event!! What is it?
you can’t copy CW because that’s no longer on the test. Can you think of Friday, Saturday, Sunday - 1000-2000
Presented in front of a live DEF CON studio audience a better place to get your ham radio license or upgrade than at DEF CON? We have created a series of
with ... - .. -. -.- -.-- / -- ..- .--. .--. . - / ..-. .- .-. - ...” Neither can we. Show up with $15, your ID and FRN, and a copy of your Where: Contest Area on Forums/Pool Level activities and challenges that will
license (if upgrading) and a test slot can be yours. Questions? Come see involve things like critical thinking
Saturday 2200 - 2359 in Track 2.
us! Ready to test? Come see us! The dc408 Ham Exam team can’t wait exercises, ciphers, logic puzzles, memory puzzles, verbal and nonverbal
to give you your exclusive DEF CON 25 Ham Radio licensee memento for challenges, pitting kids against kids in a test of endurance (and fun).
F RI E N D S O F BI L L W . M E E TU P passing your test at DEF CON. While supplies last, first come first serve. L A W Y E R M E E TU P Ages 6-12.
Vegas is a lot of fun, but it can also be just a lot. Too much, even, if When: Friday - 1000 - 2000 If you’re a lawyer (recently unfrozen or otherwise), a judge or a law All day Friday in the SE Village
you’re trying to keep the horizon level in your windscreen. If you’re a Where: Capri Room, Promenade Level student please make a note to join your host Jeff McNamara at 18:00 on
friend of Bill W joining us for DEF CON 25, please know that we have Saturday, July 29, for a friendly get-together, followed by dinner/drinks
meetings at noon and five p.m., Thursday through Sunday in “Office and conversation. Meet in the Consul Boardroom on the Promenade level. S E C T F4T E E N S
4A”, on the promenade level. Drop by if you need to touch base or INFOSEC UNLOCKED
“We have created a series of activities
just want a moment of serenity. We’ll be there. ( See info booth next U NI V E R SI T Y: Y OU R FI R S T T A L K
QU E E R C O N and challenges that will involve
to office 4 on the map, if you’re having trouble finding “Office 4A”) Want to give the next awesome talk in information security? InfoSec things like critical thinking exercises,
Unlocked is a non-profit organization that supports diverse voices Queercon Kickoff Thursday 8p to 3a ciphers, logic puzzles, memory puzzles,
HACKER KARAOKE at computer security conferences. On Friday, we will be hosting Mixers: Friday - Sunday, 4p to 6p verbal and nonverbal challenges,
InfoSec Unlocked University where potential new speakers can pitting TEENS against TEENS in a test of endurance (and fun).
QC14 Party - Friday 8p to 3a
Our 9th year! Celebrate with us and with others who love sing. Do you learn more about entering Call for Papers (CFP) and giving talks at Ages 13-17.
like music? Do you like performances? Want to BE the performer? Want conferences. Attendees will learn from industry veterans about the Saturday Dance Party & Queer-Karaoke 8p to 3a
to have that “Hold my beer moment” do your best and not injured? process of developing talks, submitting to CFPs, creating slides and All day Saturday in the SE Village
To celebrate 14 years of LGBTQ hacking join Queercon for a weekend
Well trot your happy ass down to Hacker Karaoke, DEFCON’s on-site engaging with audiences during and after the presentation. The rest of friends and fun. Didn’t bring your friends? That’s okay, come
karaoke experience. You can be a star, or if you don’t want to be a of the weekend we will host other activities to help connect you with make new ones. Queercon invites all LGBTQ Defcon attendees, friends S O H O P E L E S S LY B R O K E N
star, you can also take pride in making an utter fool of yourself. conference organizers, CFP reviewers and fellow future speakers. and allies to meet and mingle in our open casual environment.
When: Friday & Saturday - 20:00-02:00 The SOHOpelessly Broken
https://isunlocked.com/#/dc25 Queercon 14 starts this year with our Kickoff party Thursday night. contests, are back at DEF CON
Where: Roman 1, on Promenade Level. Where: Patrician Room on the Forums/Pool level. Friday, Saturday and Sunday we have our Social Mixers at 4pm. 25 in the IoT Village. We have
Come hang out, meet new people and enjoy our staffed cocktail bar. made updates to both tracks
When: 11:00 - 19:00
Don’t miss out on the Epic Queercon Party Friday Night starting at and have expanded the CTF
8pm with music from top DJs until 3am. Then on Saturday we have to include a variety of new IoT devices.
an all-night dance party and Queer-Karaoke starting at 8pm.

28 29
contests Introducing the 2017 TDF
X-Hour Film Festival!
Track 1: One of last year’s Black Badge contests is back! Players compete Prizes include Human Badges for DEFCON 26 , $5000 focusing on areas of physical security, digital forensics, hacker challenges THURSDAY - Track 4, Octavius ballroom, Promenade South.
against one another by exploiting off-the-shelf IoT devices. These 15+ scholarships to Seattle Film Institute, VideoMaker Magazine and whatever craziness our exploit team develops. This is an online When: 018:00 - 20:00
devices all have known vulnerabilities, but to successfully exploit subscriptions, iPitch subscriptions (and other cool TBD stuff). framework so participants can access it regardless of where they are or
these devices requires lateral thinking, knowledge of networking, and what network they are connected to, via laptop, netbook, tablet or phone. LIFE HACK (2017)
All completed films will be screened 18:30 Saturday night
competency in exploit development. CTFs are a great experience to in Track 4, Octavius ballroom, Promenade South. Most challenges require participants to download something that 90 minutes + Q&A with Director
learn more about security and test your skills, so join up in a team (or pertains to the problem at hand and solve the challenge using
even by yourself) and compete for fun and prizes! Exploit as many as Chances to win raffle prizes, give aways, cash bar, and fun, love, applause, Life Hack is an incredibly timely ensemble
whatever tools, techniques or methods they have available.
you can over the weekend and the top three teams will be rewarded. laughs, and cheers for all… Extras and actors needed. You don’t have comedy about digital privacy... or lack thereof.
to join a team to have some filmmaking fun at DEF CON. You could One participant will become the leader of the board and they control A humorous cautionary tale about cyber threats
Track 0: The Zero-Day track is focused on the discovery and demonstration be an extra, or even an actor, in one of the films being made here at which challenges are available. Being the leader of the board is a in the digital age. Cover your webcam.
of new exploits (0-day vulnerabilities). This track relies on the judging DEF CON. Sign up Thursday morning or ask one of the conspicuously double edge sword. Regular participants may choose to back out of a
of newly discovered attacks against embedded electronic devices. Director and Writer: Sloan Copeland Producers:
clad orange t-shirt wielding teams you may see during the Con. challenge if they cannot solve it but once the leader of the board selects
Devices that are eligible for the contest can be found at iotvillage.org Jessica Copeland, Sloan Copeland, Doug
a challenge; they must answer/solve it or be passed by a new leader as
and you can start submitting entries now! The winners who score the *ATTENTION ALL DEFCON ATTENDEES: Roland, Benjamin Zimbric Cinematographer:
they are not afforded the same luxury of just backing out. And just to
highest on their judged entries will be rewarded with cash prizes. Everyone who comes to DEF CON is obliged to abide by DEF CON’s Benjamin Zimbric Cast: Devin Ratray, Derek
keep it interesting, occasionally “The Judge” challenge comes out and
Contestants must provide proof that they disclosed the photo and video guidelines/etiquette: let people know what you’re is made available to everyone except the current leader of the board. Wilson, Sean Kleier, Jonathan Roomie,
vulnerability to the vendor in order to be eligible for prizes. doing, and be respectful. The teams/film crews participating in this Margaret Keane Williams, Christine Cartell
Friday, Saturday 1000 - 2000
contest follow this etiquette, in part, by: - being conspicuous, when An official 2017 TDF X-Hour Film Festival @ DEF CON Selection,
Friday, Saturday 1000 - 1800 Sunday 1000 - 1200 they are filming in DEF CON’s convention areas, by wearing their bright and winner of the 2017 Brooklyn Film Festival best screen
orange, official, “TD Francis X-Hour Film Contest CREW” t-shirts - letting W H O S E S LI D E I S I T A N Y W A Y ? play award. Life Hack’s director, producers, and some cast
SCHEMAVERSE bystanders know when they are actually filming by saying “ACTION” and crew will be joining us for this screening and will be
and “CUT”, and other filmmakery sounding thingys and stuff - not The What: “Whose Slide Is It available for audience questions immediately following.
The Schemaverse [skee-muh vurs] is a space battleground that lives filming in designated no-camera areas - obtaining permission when Anyway?”” is an unholy union
inside a PostgreSQL database. Mine the hell out of resources and build appropriate - and being approachable and courteous to all. of improv comedy, hacking and
up your fleet of ships, all while trying to protect your home planet. Once slide deck sado-masochism. FRIDAY - Track 4, Octavius ballroom, Promenade South.
Cheers, Waz
you’re ready, head out and conquer the map from other DEF CON rivals. The How: Our team of slide monkeys will create 20 short decks on whatever When: 019:00 - 20:00
@DEFCONFilmConte
This unique game gives you direct access to the database that nonsense tickles our fancy that week. Slides are not exclusive to technology,
governs the rules. Write SQL queries directly by connecting with www.xhourfilmcontest.com they can and will be about anything. Contestants will take the stage and CYBORGS - SHOULD WE
any supported PostgreSQL client or use your favourite language choose a random number corresponding to a specific slide deck. They will BE BETTER THAN WE
to write AI that plays on your behalf.This is DEF CON of course then improvise a five-minute lightning talk, becoming instant subject matter ARE? (2017)
so start working on your SQL Injections - anything goes! TI N F OI L H A T C O N T E S T experts on whatever topic/stream of consciousness appears on the screen.
18 min. - Documentary
Looking to sign up or need a hand? Come visit What with aliens and the NSA, a hacker The Why: Whether you delight in the chaos of watching your fellow
us at our booth in the Contest Area. can’t always tell who’s listening (or who’s hackers squirm or would like to sacrifice yourself to the Demo Humans have always used body enhancements,
transmitting...). Show us your skills by Gods, it’s a night of schadenfreude for the whole family. but should we be better than we are? If
Friday, Saturday 1000 - 1800 Sunday 1000 - 1200 we want to be a cyborg, at what point, if
building a tin foil hat to shield your subversive
The Where: Track 4, Promenade South any, should government be involved?
thoughts. There are 2 categories: stock,
T D F R A N CI S X - H OU R FI L M and unlimited. The hat in each category The When: Friday & Saturday 20:00 - ??:?? Director/Writer/Producer: Victoria Sutton
CONTEST that blocks the most signal will receive the
“Substance” award for that category. We all know that hacker culture BREAKER - (2017)
@ DEFCON 25 For the fourth year… is all about looking good, though, so a single winner will be selected WI R E L E S S C T F
from all submissions for “Style”. Finally, a single overall winner will 11 min - Narrative
This could be the opportunity that’s kicking open the door to your The Wireless Village presents
film making greatness… Assemble your team of 5 or less (director, be selected from all combined categories for “Style and Substance”. the Wireless Capture the Flag In tomorrow's Tokyo, the technologically-enhanced
producer, writer, camera/ photography, editor) and make your Bonus points will be awarded for wearing your hat around DEF CON. (WCTF). We cater to those body of a young mercenary hacker is overrun by
“Crime/Hacker Capers ” inspired/ themed cinematic marvel of short Friday, Saturday 1000 - 1800 Sunday 1000 - 1200 who are new to this game a sentient data weapon. Wanted, the parasitic
film here at DEFCON. Actors and extras don’t count towards the max and those who have been A.I becomes her only ally as she is chased
5, so teams can use as many actors and extras as they want. Open playing for a long time. Each WCTF begins with a presentation on across the city by those seeking to salvage it.
to all.... (zero experience, students, amateurs, professionals). Team WARL0CK GAM3Z How to WCTF. We also have a resources page on our website that Director/Writer/Producer: Philippe McKie
registration starts Thursday morning. Get the rules, get your official “I’m guides participants in their selection of equipment to bring. Cinematographer: Hans Bobanovits
warl0ck gam3z is a hands-on
making a movie so watch out” orange t-shirt*, deal with the monkey 24/7; throw-down, no-holds- Keep an eye on @wctf_us and @WIFI_Village Sound Editor: Remy Sealey Key Cast: Yuka
wrenches, and go out and get it all done by Saturday afternoon. barred hacker competition Tomatsu, Arisa Hanzawa, Kazuya Shimizu
LINKS: Check out our website for tools, what you
need, and what to do. Enjoy your journey.
http://wirelessvillage.ninja and http://sdr.ninja/ SATURDAY - Track 4, Octavius ballroom, Promenade South.
Tools/tips: http://www.wirelessvillage.ninja/resources.html When: 019:00 - 20:00
http://sdr.ninja/training-events/sdr-wctf/
SCREENING OF THIS YEAR'S
ENTRIES INTO THE TD FRANCIS
30 X-HOUR FILM CONTEST 31
 The Final Countdown

Capture
Five years is a long time to run a Capture the Flag event. We’re
leaving together after this year, and while still it’s farewell, we
can’t wait to see what new blood brings to DEF CON CTF in
2018 and beyond.

the Flag
We would not be able to run a successful competition this
last five years without the energy, inventiveness, and skill
of the CTF and DEF CON communities. Thanks to all CTF
competitors and organizers around the world for welcoming
us into the community. We’d like to especially thank the DEF
DEF CON Capture The Flag is the most intense, most wild, CON organizers and goons for our five years in this exceptional
and most hardcore test of hacker skill. The most rockin’ bands venue.
of hackers on Planet Earth will be blasting binaries, rocking
registers, and smashing stacks in an epic three-day event. If Most of all, thank you to all DEF CON attendees: you’ve all
you think you’ve seen it all, you’ve got another thing comin’: made this a special and unforgettable part of our lives, and we
this year’s game runs on the never-before-seen cLEMENCy can’t wait to see what you build and/or break next.
computer architecture. Will teams be riding on the wind or <3 Legitimate Business Syndicate
screaming for vengeance? You’ll just have to find out!

How to Compete Links , Scores, Blog

Game Schedule
net/
DEF CON CTF has limited space for competitors, and teams can Legitim https://legitbs.
be qualified by winning the previous year, placing in previously- ate
Busines
s ts and News
approved qualifying competitions online and around the world, or
Syndica Announcemen f
te com/legitbs_ct
scoring well in our qualification event, held in April this year. Deadwo
od https://twitter.
Fuzyll

The CTF Room

Gyno
HJ
Hoju
Want to find out who is stronger, who is amazing, and who Jymboli
a
Lightnin
g
will survive in America? Visit the CTF room in the contest area Selir
to see it all: the highlights, the low lights, the addiction, and Sirgoon
Vito
the heartbreak. Watch players analyze binaries, enjoy game
visualizations, and check out how your favorite team is doing.
Enjoy yourself, but be respectful and don’t interrupt hackers
hard at work. If you have questions about CTF, talk with a
member of Legitimate Business Syndicate. Competitors may
be willing to talk if they’re not engrossed in the game too.

32 33
Presentations Presentations
Alpha by Speaker architecture prevent users from examining, chips, called Field Programmable Gate Arrays, EVADING NEXT-GEN BITSINJECT usage is on the rise. Android packers continue
understanding, and trusting the systems where this device is more open source than any AV USING ARTIFICIAL Sunday at 10:20 in Track 3 to increase their efforts to prevent reverse
UNTRUSTWORTHY they run their private computations. Embedded common personal computing system to date. INTELLIGENCE 20 minutes | Demo, Tool
engineers and static analysis engines from
HARDWARE AND HOW TO technologies like Intel Management Engine No blobs, no hidden firmware features, and no Saturday at 11:00 in Track 4 Dor Azouri, Security researcher, @ understanding what’s inside the package. To
FIX IT pose significant threats when, not if, they get secret closed source processors. This concept 20 minutes | Demo SafeBreach
do so they employ elaborate tactics, including
Sunday at 10:00 in Track 4
20 minutes | Demo, Tool exploited. Advanced attackers in possession isn’t “unhacakable”, rather we believe it to Hyrum Anderson, Technical Director Windows’ BITS service is a middleman for state of the art ELF tampering, obfuscation
of Data Science, Endgame
of firmware signing keys, and even potential be the most fixable; this is what users and your download jobs. You start a BITS job, and various anti-debugging techniques.
0ctane, Hacker
access to chip fabrication, could wreak untold hackers should ultimately be fighting for. Much of next-gen AV relies on machine learning and from that point on, BITS is responsible
Modern computing platforms offer more freedom In this talk, we will provide an overview of the
havoc on cryptographic devices we rely on. to generalize to never-before-seen malware. for the download. But what if we tell you
than ever before. The rise of Free and Open packer industry and present real world test
Less well appreciated, however, is that machine that BITS is a careless middleman? We have
Source Software has led to more secure and After surveying all-too-possible low level cases. We will do a deep technical dive into the
learning can be susceptible to attack by, uncovered the way BITS maintains its jobs
heavily scrutinized cryptographic solutions. attacks on critical systems, we will introduce internal workings of popular Android packers,
ironically, other machine learning models. In queue using a state file on disk, and found a
However, below the surface of open source an alternative open source solution to exposing the different methods which protect
this talk, we demonstrate an AI agent trained way for a local administrator to control jobs
operating systems, strictly closed source firmware peace-of-mind cryptography and private the app’s code. As a countermeasure, we will
through reinforcement learning to modify using special modifications to that file.
along with device driver blobs and closed system computing. By using programmable logic provide various techniques to circumvent them,
malware to evade machine learning malware Comprehending this file’s binary structure allowing hackers and security researchers
detection. Reinforcement learning has produced allowed us to change a job’s properties (such to unpack the secrets they withhold.
game-changing AI’s that top human level as RemoteURL, Destination Path...) in runtime
performance in the game of Go and a myriad MICROSERVICES AND FAAS
and even inject our own custom job, using
of hacked retro Atari games (e.g., Pong). In FOR OFFENSIVE SECURITY
none of BITS’ public interfaces. This method,
an analogous fashion, we demonstrate an AI combined with the generous notification feature Saturday at 11:00 in 101 Track
agent that has learned through thousands of 20 minutes | Demo
of BITS, allowed us to run a program of our
“games” against a next-gen AV malware detector Ryan Baxendale
will as the LocalSystem account, within session
which sequence of functionality-preserving 0. So if you wish to execute your code as NT There are more cloud service providers
changes to perform on a Windows PE malware AUTHORITY/SYSTEM and the first options that offering serverless or Function-as-a-service
file so that it bypasses the detector. No math come to mind are psexec/creating a service, platforms for quickly deploying and scaling
or machine learning background is required; we now add a new option: BITSInject. applications without the need for dedicated
fundamental understanding of malware and
Here, we will not only introduce the practical server instances and the overhead of system
Windows PE files is a welcome; and previous
method we formed, but also: Reveal the administration. This technical talk will cover
experience hacking Atari Pong is a plus.
binary structure of the state file for you to the basic concepts of microservices and FaaS,
DEALING THE PERFECT play with, and some knowledge we gathered and how to use them to scale time consuming
HAND - SHUFFLING while researching the service flow offensive security testing tasks. Attacks that were
MEMORY BLOCKS ON Z/OS previously considered impractical due to time
We will also provide free giveaways: A and resource constraints can now be considered
Saturday at 16:00 in 101 Track
45 minutes | Demo, Tool one-click python tool that performs the feasible with the availability of cloud services
Ayoul3, Pentester, Wavestone
described method; SimpleBITSServer - a and the never-ending free flow of public IP
pythonic BITS server; A struct definition file, addresses to avoid attribution and blacklists.
Follow me on a journey where we p0wn one to use for parsing your BITS state file
of the most secure platforms on earth. A Key takeaways include a guide to scaling your
giant mammoth that still powers the most UNBOXING ANDROID: tools and a demonstration on the practical
critical business functions around the world: EVERYTHING YOU WANTED benefits of utilising cloud services in performing
The Mainframe! Be it a wire transfer, an ATM TO KNOW ABOUT ANDROID undetected port scans, opportunistic attacks
withdrawal, or a flight booking, you can be PACKERS against short lived network services, brute-
sure that you’ve used the trusted services of Sunday at 10:00 in 101 Track force attacks on services and OTP values,
a Mainframe at least once during the last 45 minutes | Demo, Tool and creating your own whois database,
24 hours. In this talk, I will present methods Avi Bashan, Mobile R&D Team shodan/censys, and searching for the
Leader, Check Point
of privilege escalation on IBM z/OS: How elusive internet accessible IPv6 hosts.
Slava Makkaveev, Security
to leverage a simple access to achieve total Researcher, Check Point
control over the machine and impersonate
other users. If you are interested in mainframes To understand the Android ecosystem today,
or merely curious to see a what a shell looks one must understand Android packers. Whether
like on MVS, you’re welcome to tag along. used for protecting legitimate apps’ business
logic or hiding malicious content, Android packer

34 35
Presentations Presentations
JAILBREAKING APPLE to cause service instability with sophisticated Early 2017, a multi-stage Windows Trojan REVOKE-OBFUSCATION: GAME OF DRONES: We’ll also be releasing DangerDrone v2.0,
WATCH requests that model legitimate traffic to pass containing code to scan for vulnerable POWERSHELL PUTTING THE EMERGING an upgraded version of our free Raspberry
Thursday at 12:00 in 101 Track 2 right through web application firewalls. IoT devices and inject them with Mirai OBFUSCATION DETECTION 'DRONE DEFENSE' MARKET Pi-based pentesting quadcopter (basically
45 minutes | Demo
bot code was discovered. The number of (AND EVASION) USING TO THE TEST a ~$500 hacker’s laptop, that can also
We will discuss how the Netflix application
Max Bazaliy, Security Researcher, IoT devices which were previously safely SCIENCE Saturday at 16:00 in Track 4 fly). We’ll be giving away a fully functional
Lookout security team identified areas of our
hidden inside corporate perimeters, vastly Sunday at 13:00 in Track 4
45 minutes | Art of Defense, Demo,
DangerDrone v2.0 to one lucky audience
microservices that laid the groundwork for Tool
On April 24, 2015, Apple launched themselves exceeds those directly accessible from the 45 minutes | Art of Defense, Demo,
member! So come see what’s guaranteed to
these exponential-work attacks. We’ll step Tool Francis Brown, Partner, Bishop Fox
into the wearables category with the Internet, allowing for the creation of botnets be the most entertaining talk this year and
through one case study of how a single request Daniel Bohannon (DBO), Senior
introduction of Apple Watch. This June, at with unprecedented reach and scale. David Latimer, Security Analyst,
find out which of these dogs can hunt!
into an API endpoint fans out through the Consultant, MANDIANT Bishop Fox
Apple’s Worldwide Developer Conference,
application fabric and results in an exponential This reveals an evolution in the threat Lee Holmes, Lead Security
When you learned that military and law
Apple announced that their watch is not only HOW WE CREATED THE
set of dependent service calls. Disrupting landscape that most organizations are Architect, Microsoft
enforcement agencies had trained screaming
the #1 selling smartwatch worldwide by far, FIRST SHA-1 COLLISION
even one point within the dependency graph completely unprepared to deal with and Attackers, administrators and many legitimate eagles to pluck drones from the sky, did you
but also announced the introduction of new AND WHAT IT MEANS FOR
can have a cascading effect throughout not will require a fundamental shift in how products rely on PowerShell for their core too find yourself asking: “I wonder if I could
capabilities that will come with the release of HASH SECURITY
only the initial endpoint, but the dependent we defend against DDoS attacks. functionality. However, its power has made throw these eagles off my tail, maybe by
watchOS 4. Like other devices, Apple Watch Friday at 14:00 in Track 4
services backing other related API services. it increasingly attractive for attackers and deploying delicious bacon countermeasures?”
contains highly sensitive user data such as email This presentation will include:- An analysis of 45 minutes | Demo, Tool

and text messages, contacts, GPS and more, We will then discuss the frameworks we the Windows Mirai seeder including its design, commodity malware authors alike. How do Well you’d be wise to question just how Elie Bursztein, Anti-abuse

and like other devices and operating systems, collaborated on building that refine the history, infection vectors and potential evolution.- you separate the good from the bad? effective these emerging, first generation
research lead, Google

has become a target for malicious activity. automation and reproducibility of testing the The DDoS capabilities of typically infected IoT A/V signatures applied to command line “drone defense” solutions really are, and In February 2017, we announced the first
endpoints, which we’ve already successfully devices including malicious traffic analysis.- The arguments work sometimes. AMSI-based which amount to little more than “snake oil”. SHA-1 collision. This collision combined with a
This talk will provide an overview of Apple clever use of the PDF format allows attackers
leveraged against our live production consequences of infected IoT devices inside the (Anti-malware Scan Interface) detection There is no such thing as “best practices”
Watch and watchOS security mechanisms to forge PDF pairs that have identical SHA-1
environment. We will provide a demonstration corporate network including the impact of DDoS performs significantly better. But obfuscation when it comes to defending against “rogue
including codesign enforcement, sandboxing, hashes and yet display different content. This
of the frameworks which will be open sourced in attacks, originating from the inside, targeting and evasion techniques like Invoke-Obfuscation drones”, period. Over the past 2 years, new
memory protections and more. We will cover attack is the result of over two years of intense
conjunction with this presentation. Attendees will corporate assets and external resources.- How can and do bypass both approaches. defensive products that detect and respond to
vulnerabilities and exploitation details and dive research. It took 6500 CPU years and 110 GPU
leave this talk understanding architectural and to detect, classify and mitigate this new threat. “rogue drones” have been crawling out of the
into the techniques used in creating an Apple Revoke-Obfuscation is a framework that years of computations which is still 100,000
technical approaches to identify and remediate woodwork. The vast majority are immature,
Watch jailbreak. This will ultimately lead to a ABUSING CERTIFICATE transforms evasion into a treacherous deceit. times faster than a brute-force attack.
application DDoS vulnerabilities within their unproven solutions that require a proper vetting.
demonstration and explanation of jailbreaking TRANSPARENCY LOGS By applying a suite of unique statistical
own applications. Attendees will also gain a In this talk, we recount how we found the first
an Apple Watch, showcasing how it can access analysis techniques against PowerShell scripts We’ve taken a MythBusters-style approach
greater understanding on how take a novel new Friday at 15:00 in Track 4
SHA-1 collision. We delve into the challenges we
important user data and applications. 45 minutes | Demo, Tool and their structures, what was once a cloak to testing the effectiveness of a variety of
attack methodology and build an orchestration faced from developing a meaningful payload,
Hanno Böck, Hacker and freelance of invisibility is now a spotlight. It works with drone defense solutions, pitting them against
STARTING THE framework that can be used at a global scale. to scaling the computation to that massive
journalist .evtx files, command lines, scripts, ScriptBlock our DangerDrone. Videos demonstrating the
AVALANCHE: APPLICATION logs, Module logs, and is easy to extend. scale, to solving unexpected cryptanalytic
THE CALL IS COMING The Certificate Transparency system provides results should be almost as fun for you to
DOS IN MICROSERVICE challenges that occurred during this endeavor.
FROM INSIDE THE HOUSE! public logs of TLS certificates. While Certificate Approaches for evading these detection watch as they were for us to produce. Expect
ARCHITECTURES Transparency is primarily used to uncover to witness epic aerial battles against an We discuss the aftermath of the release
Friday at 13:00 in Track 3
ARE YOU READY FOR THE techniques will be discussed and demonstrated.
NEXT EVOLUTION IN DDOS security issues in certificates, its data is also assortment of drone defense types, including: including the positive changes it brought and
45 minutes | Demo, Tool
Revoke-Obfuscation has been used in numerous its unforeseen consequences. For example
ATTACKS? valuable for other use cases. The talk will
Scott Behrens, Senior Application Mandiant investigations to successfully identify • trained eagles and falcons
Security Engineer Sunday at 12:00 in Track 3 present a novel way of exploiting common web it was discovered that SVN is vulnerable to
obfuscated and non-obfuscated malicious that hunt “rogue drones”
Jeremy Heffner, Senior Cloud
45 minutes | Art of Defense applications like Wordpress, Joomla or Typo3 SHA-1 collision attacks only after the WebKit
PowerShell scripts and commands. It also • fighter drones that hunt and shoot nets SVN repository was brought down by the
Security Engineer Steinthor Bjarnason, Senior with the help of Certificate Transparency.
Network Security Analyst, Arbor detects all obfuscation techniques in Invoke- commit of a unit-test aimed at verifying that
We’d like to introduce you to one of the most Networks Certificate Transparency has helped uncover Obfuscation, including two new techniques • drones with large nets that swoop
devastating ways to cause service instability in and snatch up ‘rogue drones’ Webkit is immune to collision attacks.
Jason Jones, Security Architect, various incidents in the past where certificate being released with this presentation.
in modern micro-service architectures: Arbor Networks authorities have violated rules. It is probably one • surface-to-air projectile weapons, Building on the Github and Gmail examples
application DDoS. Unlike traditional network The second half of 2016 saw the rise of a of the most important security improvements including bazooka-like cannons that launch we explain how to use counter-cryptanalysis
DDoS that focuses on network pipes and edge new generation of IoT botnets consisting of that has ever happened in the certificate nets, and shotgun shells containing nets to mitigate the risk of a collision attacks
resources, our talk focuses on identifying and webcams and other IoT devices. These botnets authority ecosystem. In September 2017 Google against software that has yet to move
targeting expensive calls within a micro- will make Certificate Transparency mandatory • signal jamming and hijacking devices that away from SHA-1. Finally we look at the
were then subsequently used to launch
services architecture, using their complex for all new certificates. So it’s a good time to attack drone command and control interfaces next generation of hash functions and
DDoS attacks on an unprecedented scale
interconnected relationships to cause the against Olympic-affiliated organizations, see how it could be abused by the bad guys. • even frickin’ laser beams what the future of hash security holds
system to attack itself — with massive effect. In OVH, the web site of Brian Krebs and Dyn. and Patriot missiles!
modern microservice architectures it’s easier

36 37
Presentations Presentations
XENOSCAN: SCANNING this initiative in 2016, we quickly thought it methods, can be reconfigured on-the-fly without not working: they require a network attack that all of hackerdom- how to ensure the safety and DEF CON 101 PANEL
MEMORY LIKE A BOSS was possible to turn this tiny device into some requiring a device reboot, and takes the pain is prevented by the network architecture and security of patients in a system more connected Thursday at 16:00 in 101 Track
Saturday at 14:00 in Track 4 kind of super-duper portable wireless attack out of writing method hooks for Android apps. the server configuration. All hope is lost... and vulnerable than ever before. Join physician 105 minutes | Hacker History,
Audience Participation
45 minutes | Demo, Tool
tool, as it is based on a well-known 2.4GHz ParaSpectre is for developers and security researchers quaddi and r3plicant, and researcher
We will present you a new approach, allowing HighWiz, Founder, DC101
Nick Cano, Hacker RF chip produced by Nordic Semiconductor. researchers alike. While not itself a debugger, turned wonk Beau Woods as they offer an update
you to circumvent these limitations and to Malware Unicorn
XenoScan is the next generation in tooling it provides a level of access into a running on the state of the field and curate an interactive
It took us a few months to hack into the Micro:Bit exploit this situation in order to deliver updates.
for hardcore game hackers. Building on application that a debugger generally won’t. and engaging panel before breaking out the Niki7a, Director of Content &
firmware and turn it into a powerful attack tool Thus, you will be able to control the targeted Coordination, DEF CON
the solid foundation from older tools bottle and getting social. Continuing a tradition
able to sniff keystrokes from wireless keyboards network from the very WSUS server you own. By Roamer, CFP Vocal Antagonizer, DEF
like Cheat Engine and Tsearch, XenoScan INSIDE THE 'MEET DESAI' that has sparked professional connections,
or to hijack and take complete control of extension, this approach may serve as a basis CON
makes many innovations which take ATTACK: DEFENDING project ideas, and enduring friendships, “D0
quadcopters during flight. We also developed for an air gap attack for disconnected networks. Wiseacre
memory scanning to a whole new level. DISTRIBUTED TARGETS No H4rm” aims to offer a prescription for the
many tools allowing security researchers to
Our talk will describe vulnerable architectures future, and we want your voice to be heard. Shaggy
This demo-heavy talk will skip the fluff and show interact with proprietary 2.4GHz protocols, FROM DISTRIBUTED
to this approach and also make some The DEF CON panel is the place to go to learn
the power of the tool in real-time. The talk will such as an improved sniffer inspired by the ATTACKS
in-context demonstration of the attack with BREAKING BITCOIN about the many facets of DEF CON and to begin
demonstrate how the tool can scan for partial mousejack tools designed by Bastille. We Thursday at 15:00 in 101 Track
45 minutes | Art of Defense new public tooling. Finally, as nothing is HARDWARE WALLETS your DEF CONian Adventure. Here you will begin
structures, detect complex data structures such as will release the source code of our firmware
CINCVolFLT (Trey Forgety), Director inescapable, we will also explain how you Sunday at 10:00 in Track 3
your adventure that will include more than just
binary trees or linked lists, detect class-instances and related tools during the conference. of Government Affairs & IT Ninja, can protect your update architecture. 20 minutes | Demo, Exploit
listening in the talk tracks. You can get hands-on
living on the heap, and even group detected The Micro:Bit will become a nifty platform NENA: The 9-1-1 Association Josh Datko, Principal Engineer,
experience in the Villages and witness amazing
class instances by their types. Additional, these to create portable RF attack tools and In October of 2016, a teenage hacker triggered D0 NO H4RM: A Cryptotronix LLC
feats of programming in Demo Labs. You may
demos will take a look at the tool’s extensibility ease the life of security researchers DTDoS attacks against 9-1-1 centers across HEALTHCARE SECURITY Chris Quartier, Embedded Engineer,
Cryptotronix, LLC even display your own powers by participating in
by working not only on native processes, but also dealing with 2.4GHz protocols ! the United States with five lines of code and CONVERSATION a contest or two in the Events and Contest Area.
on Nintendo games running in emulators. You’re a tweet. This talk provides an in-depth look Saturday at 20:00 - 22:00 in Modena The security of your bitcoins rests entirely in the
The panel will give you what you need to know to
not all game hackers, so the talk will also show GHOST IN THE DROID: at the attack, and reviews and critiques the
Room
security of your private key. Bitcoin hardware
Evening Lounge navigate DEF CON to your best advantage. We
how XenoScan can be useful in the day-to-day POSSESSING ANDROID latest academic works on TDoS attacks directed wallets help protect against software-based
Christian “quaddi” Dameff MD MS, have speakers who will regale you with tales of
workflow of reverse engineers and hackers. APPLICATIONS WITH at 9-1-1 systems. It then discusses potential attacks to recover or misuse your key. However,
Hacker how they came to be at DEF CON and (hopefully)
PARASPECTRE mitigation strategies for legacy TDM and future hardware attacks on these wallets are not as
When I’m not doing demos, I’ll be drilling Jeff “r3plicant” Tully MD, Hacker inspire you with their personal experiences.
Sunday at 10:20 in Track 4
all-IP access networks, as well as disaggregated well studied. In 2015, Jochen Hoenicke was
down to the low-level to talk about the Beau Woods, Deputy director of the Oh yeah, there is the time honored “Name the
20 minutes | Demo, Tool
“over-the-top” originating services and the able to extract the private key from a TREZOR
nitty gritty details of what’s happening, Cyber Statecraft Initiative in the Noob”, with lots of laughs and even some prizes.
chaosdata, Senior Security
devices on which both the access network Brent Scowcroft on International using a simple power analysis technique. While
how it works, and why it works. Consultant, NCC Group
providers and originating service providers rely.
Security that vulnerability was patched, he suggested PANEL: DEF CON GROUPS
By the end of the talk, you’ll see the true power Modern Android applications are large and Joshua Corman , Director of the the Microcontroller on the TREZOR, which Friday at 17:00 in Track 2
of a well-made, smart memory scanner. You’ll complex, and can be a pain to analyze even WSUSPENDU: HOW TO HANG
Cyber Statecraft Initiative at the
is also the same on the KeepKey, may be 45 minutes | Audience Participation
Atlantic Council’s Brent Scowcroft
be empowered to use it in your day to day without obfuscation - static analysis can only WSUS CLIENTS Center vulnerable to additional side channel attacks. Jeff Moss (Dark Tangent), Founder,
hacking, whether that is on games, malware, get one so far, the debugger sucks, Frida Saturday at 10:20 in Track 3h DEF CON
Michael C. McNeil, Privacy In this presentation we will quickly overview
or otherwise. For those of you that are really doesn’t give you enough access to the Java 20 minutes | Demo, Tool and security expert, Philips Waz, DCG
fault injection techniques, timing, and power
interested in the tool, it is completely open-source environment, and editing smali or writing Romain Coltel, Lead product Healthcare
Brent White (B1TKILL3R), DCG and
analysis methods using the Open Source
and all development is done on an interactive Xposed hooks can be time consuming and manager at Alsid Jay Radcliffe, Senior Security DC615
Consultant and Researcher, Rapid7 Hardware tool, the ChipWhisperer. We then
livestream, meaning you can participate error prone. There has to be a better way! Yves Le Provost, Security auditor Jayson E. Street, DCG Ambassador
at ANSSI show how to apply these techniques to the
in and learn from future development. Suzanne Schwartz, MD, MBA ,
Grifter, DC801
What if we could inject a command line Associate Director for Science & STM32F205 which is the MCU on the Trezor and
You are performing a pentest. You just owned
WEAPONIZING THE BBC REPL into an app to drive functionality? Strategic Partnerships, FDA’Center KeepKey. Lastly, we will present our findings Jun Li, DC010
the first domain controller. That was easy. for Devices & Radiological Health
MICRO:BIT And what if we could also make writing (CDRH) of a timing attack vulnerability and conclude S0ups, DC225
All the computers are belong to you. But
function hooks fast and easy? with software and hardware recommendations Major Malfunction, DC4420
Friday at 11:00 in Track 2
unfortunately, you can’t reach the final goal. Previously a free-flowing, fast moving
45 minutes | Demo, Tool, Exploit
In this talk, I will introduce ParaSpectre, a to improve bitcoin hardware wallets. We will
The last target is further in the network, non conversation between old friends and new Do you love DEF CON? Do you hate having
Damien “virtualabs” Cauquil,
platform for dynamic analysis of Android show and share our tools and methods to help
accessible and heavily filtered. Thankfully, one colleagues in a dimly lit and alcohol soaked to wait for it all year? Well, thanks to DEF
Senior security researcher,
applications that injects JRuby into Android you get started in breaking your own wallet!
Econocom Digital Security last hope remains. You realize the target domain off-strip hotel suite, the third annual edition CON groups, you’re able to carry the spirit of
applications. It bundles a hook configuration web pulls its updates from the WSUS server of the of “D0 No H4rm” moves to the better lit and DEF CON with you year round, and with local
In 2015, BBC sponsored Micro:Bit was launched
API, a web application interface to configure and compromised domain, the one you fully control. even more alcohol soaked auspices of the DEF people, transcending borders, languages,
and offered to one million students in the
edit hooks, and a connect-back JRuby REPL to Hope is back... But once again, it fails. The only CON 25 Evening Lounge for a two hour session and anything else that may separate us!
United Kingdom to teach them how to code. This
aid application exploration from the inside-out. tools available for controlling the updates are that links makers, breakers, and wonks in the
device is affordable and have a lot of features In this talk, you’ll hear from DEF CON’s
It supports various selectors to match classes and healthcare space for a continuation of what may
and can be programmed in Python rather than founder, Dark Tangent, who is also moderating
C++ like the Arduino. When we discovered be one of the most important conversations in the panel. Jayson E. Street, the Ambassador
of DEF CON groups will also discuss updates
about the program and share information

38 39
Presentations Presentations
from his global travel to help start groups with compatibility in the core to support a These design flaws are a problem because BREAKING THE X86 and Facebook, companies have evolved, the routers are just “Plug and Play” with no
around the world. We will also discuss what default installation of Windows 2000 with no people rely on onion services for many cool use INSTRUCTION SET their names unknown to a broader public need for configuration. All that is needed is 5
DEF CON groups are, how to get involved, service packs (and potentially even versions cases, like metadata-free chat and file sharing, Friday at 14:00 in Track 3 but making billions of dollars with your commands to build fully automated network.
as well as ideas for how to run a group, of NT4) all the way through Windows 10. safe interaction between journalists and their 45 minutes | Demo, Tool
data. The new oil of the 20th century. It is already supported in pretty much all of
location ideas, and how to spread the word. sources, safe software updates, and more secure Christopher Domas, Security the recent software images for enterprise
An in-depth view of default COM objects will Researcher, Battelle Memorial Our experiment shows in a drastic way, what
ways to reach popular websites like Facebook. level and carrier grade routers/switches.
Founders of their own local DEF CON groups be provided. COM is a fairly underexplored, Institute the youngest decision reversing the Broadband
will also discuss the awesome projects of large attack surface in Windows. We will share In this talk I’ll present our new and improved A processor is not a trusted black box for running Privacy Rule means. What the consequences for This is the bright side of the technology. On the
their groups, as well as projects from other lots of weird Windows scripting quirks with onion service design, which provides stronger code; on the contrary, modern x86 chips are everyday life could be, when ISPs are allowed other hand, the configuration is hidden and
groups, to give ideas to take back to your interesting workarounds we discovered during security and better scalability. I’ll also packed full of secret instructions and hardware to sell your browsing data. And why that piece the interfaces are inaccessible. The protocol
own DEF CON group. Projects we’ll discuss the course of development. Post exploitation publish a new release of the Tor software bugs. In this talk, we’ll demonstrate how page of regulation from the FCC was so important is proprietary and there is no mechanism to
range from custom badge build, IoT devices, with PowerShell has grown in popularity in that lets people use the new design. fault analysis and some creative processor regarding privacy and constitutional rights. know what is running within your network.
vintage gaming systems, custom built recent years, and seeing what can be done fuzzing can be used to exhaustively search In this talk, we will have a quick overview
routers, smarthome devices and more! with just the basic Windows Script Host is an $BIGNUM STEPS FORWARD, the x86 instruction set and uncover the secrets
PANEL - AN EVENING WITH
on Cisco’s Autonomic Network Architecture,
interesting exploration. In addition, defenses $TRUMPNUM STEPS BACK: buried in your chipset. We’ll disclose new x86
THE EFF
then I will reverse-engineer the proprietary
FROM BOX TO BACKDOOR: against this type of tool will be discussed, as HOW CAN WE TELL IF WE'RE hardware glitches, previously unknown machine
Friday at 20:00 - 22:00 in Trevi
Room protocol through its multiple phases. Finally,
USING OLD SCHOOL the Windows Script Host is more tightly coupled WINNING? instructions, ubiquitous software bugs, and Evening Lounge | 0025 multiple vulnerabilities (overall 5) will be
TOOLS AND TECHNIQUES to the core of Windows than PowerShell is. Saturday at 10:00 in Track 245
flaws in enterprise hypervisors. Best of all,
minutes Kurt Opsahl, Deputy Executive presented, one of which allows to crash systems
TO DISCOVER BACKDOORS we’ll release our sandsifter toolset, so that you Director & General Counsel,
It is possible to serve payloads completely in Cory Doctorow, craphound.com, remotely by knowing their IPv6 address.
IN MODERN DEVICES can audit - and break - your own processor.
Electronic Frontier Foundation
Thursday at 11:00 in 101 Track
memory from stage 0 to beyond, as well as use science fiction author, activist,
journalist and blogger. Nate Cardozo, EFF Senior Staff DEMYSTIFYING WINDOWS
45 minutes cryptographically secure communications over Attorney
SSL and TLS (depending on what the victim OS Is Net Neutrality on the up or down? Is DRM WELCOME TO DEF CON 25 KERNEL EXPLOITATION BY
Patrick DeSantis, Senior Security Eva Galperin, EFF Director of
Research Engineer, Cisco Talos has available). We also found numerous ways rising or falling? Is crypto being banned, or will
Friday at 10:00 in Track 2
Cyber security ABUSING GDI OBJECTS.
20 minutes | Hacker History
Stringing together the exploitation of several to “fork to shellcode” in an environment which it win, and if it does, will its major application Andrew Crocker, EFF Staff Attorney
Saturday at 13:00 in 101 Track
The Dark Tangent, Founder, DEF CON 45 minutes | Demo, Exploit
seemingly uninteresting vulnerabilities can traditionally does not provide such capabilities. be ransomware or revolution? Is the arc of Kit Walsh, EFF Staff Attorney
This talk is based on original research by history bending toward justice, or snapping The Dark Tangent welcomes everyone to 5A1F (Saif El-Sherei), Security
be a fun challenge for security researchers, Analyst, SensePost
ourselves, as well as the previous amazing work abruptly and plummeting toward barbarism? DEF CON 25, our silver anniversary! Relax and enjoy in an evening lounge while
penetration testers, and malicious attackers.
of engima0x3, subTee, tiraniddo, and others. you get the latest information about how the Windows kernel exploitation is a difficult
This talk follows some of the paths and thought It’s complicated. DARK DATA law is racing to catch up with technological field to get into. Learning the field well
processes that one researcher followed while
NEXT-GENERATION TOR A better world isn’t a product, it’s a process. Friday at 15:00 in Track 3 change from staffers at the Electronic Frontier enough to write your own exploits require
evaluating the security of several new “out of the 45 minutes
ONION SERVICES The right question isn’t, “Does the internet Foundation, the nation’s premiere digital civil full walkthroughs and few of those exist.
box” Industrial Control System (ICS) and Internet
Friday at 13:00 in Track 4 make us better or worse,” its: “HOW DO WE Svea Eckert, NDR liberties group fighting for freedom and privacy This talk will do that, release two exploits
of Things (IoT) devices, using a variety of well 45 minutes | 0025
MAKE AN INTERNET THAT MAKES THE WORLD Andreas Dewes, PhD in the computer age. This Evening Lounge and a new GDI object abuse technique.
known exploitation and analysis techniques, and Roger Dingledine, The Tor Project BETTER?” We make the world better with A judge with preferences for hard core porn, discussion will include updates on current EFF We will provide all the detailed steps taken
eventually finding undocumented, root-level, and
Millions of people around the world use Tor every code, sure, but also with conversations, with a police officer investigating a cyber-crime, a issues such as surveillance online, encryption to develop a full privilege escalation exploit.
sometimes un-removable, backdoor accounts.
day to protect themselves from surveillance and businesses, with lawsuits and with laws. politician ordering burn out medication - this kind (and backdoors), and fighting efforts to use The process includes reversing a Microsoft’s
KOADIC C3 - WINDOWS COM censorship. While most people use Tor to reach of very personal and private information is on intellectual property claims to shut down free patch, identifying and analyzing two bugs,
We don’t know how to get to a better world,
COMMAND & CONTROL ordinary websites more safely, a tiny fraction of but we know which direction it’s in, and we the market. Get sold to who is willing to pay for. speech and halt innovation, discussion of developing PoCs to trigger them, turning
FRAMEWORK Tor traffic makes up what overhyped journalists our technology project to protect privacy and them into code execution and then putting
know how to hill-climb towards it. If we keep In a long time experiment, with the help of some speech online, updates on cases and legislation
like to call the “dark web”. Tor onion services heading that way, we’ll get *somewhere*. it all together. The result is an exploit for
Saturday at 13:00 in Track 2
social engineering techniques, we were able to affecting security research, and much more.
45 minutes | Demo, Tool (formerly known as Tor hidden services) let Somewhere good. Somewhere imperfect. Windows 8.1 x64 using GDI bitmap objects
get our hands on the most private data you can
Sean Dillon (zerosum0x0), Senior people run Internet services such as websites in Somewhere where improvement is possible. and a new, previously unreleased Windows
Security Analyst, RiskSense, Inc. find on the internet. Click stream data of three ATTACKING AUTONOMIC
a way where both the service and the people 7 SP1 x86 exploit involving the abuse of a
million German citizens. They contain every URL NETWORKS
Zach Harding (Aleph-Naught-), reaching it can get stronger security and privacy. newly discovered GDI object abuse technique.
Senior Security Analyst, they have looked at, every second, every hour, Saturday at 14:00 in 101 Track
RiskSense, Inc. I wrote the original onion service code as a toy every day for 31 days. In our talk we will not 45 minutes | Demo, Exploit

Koadic C3, or COM Command & Control, is a example in 2004, and it sure is showing its age. only show how we got that data, but how you can Omar Eissa, Security Analyst, ERNW
In particular, mistakes in the original protocol are de-anonymize it with some simple techniques. GmbH
Windows post-exploitation tool similar to other
penetration testing rootkits such as Meterpreter now being actively exploited by fear-mongering Autonomic systems are smart systems which
This data is collected worldwide by big
and Powershell Empire. The major difference is “threat intelligence” companies to build lists of do not need any human management
companies, whose legal purpose is to
that Koadic does most of its operations using the onion services even when the service operators or intervention. Cisco is one of the first
sell analytics and insights for marketers
Windows Script Host (a.k.a. JScript/VBScript), thought they would stay under the radar. companies to deploy the technology in which
and businesses. In the shadow of Google

40 41
Presentations Presentations
PANEL- MEET THE FEDS: PANEL - MEET THE FEDS know whether your computer, phone, or secure also look at the reasons the government offers implant creation, infrastructure automation, and I KNOW WHAT YOU ARE BY
HOW TO CAUSE SECURITY (WHO CARE ABOUT messaging app is pwned. Of course, there’s for keeping these tools out of the public eye and shell interaction. This framework is designed to THE SMELL OF YOUR WIFI
PROGRESS SECURITY RESEARCH) a Solution(tm) - hardware security devices. talk about whether they make sense. Finally, meet the needs of offensive security operators Sunday at 10:00 in Track 2
Friday at 10:20 in Track 4 Saturday at 20:00 - 22:00 in Capri we’ll examine the implications that investigations requiring rapid configuration and creation of 20 minutes | Art of Defense, Demo,
We carry authentication tokens not only to secure Tool, Audience Participation
75 minutes Room
based on secret capabilities have for justice. long lived malware implants and associated
Evening Lounge our banking and corporate VPN connections, but Denton Gentry, Software Engineer
Andrea Matwyshyn, Cranky law command and control infrastructure. Say
professor. Allan Friedman, Director also to access everything from cloud services
BACKDOORING THE goodbye to writing janky one-off malware Existing fingerprinting mechanisms to identify
of Cybersecurity, National to social networking. While we’ve isolated
Terrell McSweeny, Commissioner, Telecommunications and Information LOTTERY AND OTHER and say hello to building upon a framework client devices on a network tend to be coarse
Federal Trade Commission these ‘trusted’ hardware components from our
Administration, US Department of SECURITY TALES IN designed to support efficient yoloscoped in their identification. For example they can
Dr. Suzanne Schwartz, FDA Commerce potentially pwnd systems so that they might
GAMING OVER THE PAST adversarial campaigns against capable targets. tell it is an iPhone of some kind, or that it is
Amélie E. Koran, Deputy Chief be more reliable, we will present scenarios
Leonard Bailey, Special Counsel 25 YEARS a Samsung Android device of some model.
for National Security, Computer Information Officer for the U.S. against two popular hardware tokens where
Crime & Intellectual Property Department of Health and Human Sunday at 11:00 in Track 2 CALL THE PLUMBER - YOU They might look at DHCP information to
their trust can be easily undermined. After 45 minutes
Section, Criminal Division, U.S. Services, Office of the Inspector HAVE A LEAK IN YOUR know its OS, see if the client responds to
Department of Justice General building our modified and counterfeit devices, Gus Fritschie, CTO, SeNet (NAMED) PIPE SSDP, or check DNS-SD TXT responses.
Lisa Wiswell, Principal at Grimm Leonard Bailey, Special Counsel we can use them to circumvent intended security International
Sunday at 14:00 in 101 Track
and a Fellow at the Center for for National Security, Computer assumptions made by their designers and users. Evan Teitelman, Engineer, SeNet 45 minutes | Demo By examining Wi-Fi Management frames
Strategic and International Crime & Intellectual Property
In addition to covering technical details about International
Gil Cohen, CTO, Comsec group we can identify the device much more
Studies Section, Criminal Division, U.S.
Department of Justice our modifications and counterfeit designs, In this talk Gus and Evan will discuss the specifically. We can tell a iPhone 5S from
Making legal and policy progress on security is we’ll explore a few attack scenarios for each. The typical security professional is largely an iPhone 5, a Samsung Galaxy S8 from an
Nick Leiserson, Legislative recent Hot Lotto fraud scandal and how one unfamiliar with the Windows named pipes
hard, especially when it involves coordinating Director, Office of Congressman MUSL employee, Eddie Tipton, was able to S7, an LG G5 from a G4. This talk describes
Sharing is Caring, so after showing off a few interface, or considers it to be an internal-
with teams inside and across federal agencies/ James R. Langevin (RI-02)
rig several state lotteries and win $17 million how the signature mechanism works.
demonstration, we’ll walk you through the only communication interface. As a result,
departments. But, there *are* success stories. Security research is no longer a foreign concept (or perhaps more). Gus’ firm is actively
process of rolling your own Secure Tokin’ open RPC (135) or SMB (445) ports are Specifically identifying the client is the first
DOJ, FDA, FTC, and DoD have all evolved in Washington, DC. A growing number of supporting the prosecution in this case. Evan
and Doobiekey that you can pass around typically considered potentially entry points step toward further scanning or analysis of
in positive directions in their approach to policymakers are not only thinking about its was responsible for identifying and analyzing
the circle at your next cryptoparty. in “infrastructure” penetration tests. that client’s behavior on the network.
security over the last five years, engaging importance, but are eager to work with hackers how Eddie was able to rig the RNG.
more robustly with the security research to better understand the implications of policy SECRET TOOLS: LEARNING However, named pipes can in fact be used as INTRODUCING HUNT: DATA
community. The panelists will introduce their Details on the rigged RNG and other details an application-level entry vector for well known
and to help hackers navigate laws that affect ABOUT GOVERNMENT DRIVEN WEB HACKING &
respective agencies/ departments, explain their from the case will be presented publicly attacks such as buffer overflow, denial of service
security research. Officials from the Department SURVEILLANCE SOFTWARE MANUAL TESTING
missions, and describe the evolution of their for the first time during this talk. or even code injection attacks and XML bombs,
of Commerce, the Department of Justice, and YOU CAN'T EVER SEE Saturday at 17:00 in Track 3
organizations’ approach across time to security Congress will talk about how security policy has Friday at 10:00 in Track 4 For historical context other related attacks depending on the nature of listening service 45 minutes | Demo, Tool
and security research. As always, the panelists been evolving; help you understand how you can 20 minutes | 0025 including the Ron Harris and hacking keno to the specific pipe on the target machine. Jason Haddix, Head of Trust and
look forward to answering your questions. get involved and make your voice heard; and Peyton “Foofus” Engel, Attorney at in the 1990’s and a recent incident involving Security @ Bugcrowd
As it turns out, it seems that many popular
host an extended Q&A. Hear about everything Hurley, Burish & Stanton, S.C. a Russian hacking syndicate’s exploitation and widely used Microsoft Windows-based What if you could super-charge your web
from making laws more hacker friendly to Imagine that you’re accused of a crime, and the of slot machines will also be discussed. enterprise applications open a large number hacking? Not through pure automation (since
encryption to IoT security. It’s your opportunity basis of the accusation is a log entry generated of named pipes on each endpoint or server it can miss so much) but through powerful
to meet the feds and ask them anything. by a piece of custom software. You might MEATPISTOL, A MODULAR alerts created from real threat intelligence?
on which they are deployed, significantly
have some questions: does the software work? MALWARE IMPLANT What if you had a Burp plugin that did this
increase an environment’s attack surface
SECURE TOKIN' AND how accurate is it? how did it get the results FRAMEWORK for you? What if that plugin not only told you
without the organization or end user being
DOOBIEKEYS: HOW that it did? Unfortunately, the software isn’t Friday at 17:00 in Track 3
where to look for vulns but also gave you
45 minutes | Demo, Tool aware of the risk. Since there’s a complete
TO ROLL YOUR OWN available to the public. And you can’t get access curated resources for additional exploitation
FuzzyNop (Josh Schwartz), Director lack of awareness to the entry point, there’s
COUNTERFEIT HARDWARE to the source code or even a working instance and methodology? What if you could organize
of Offensive Security @ Salesforce very limited options available to organizations
SECURITY DEVICES of the software. All you get are assurances your web hacking methodology inside of your
ceyx (John Cramb), Hacker to mitigate it, making it a perfect attack
Saturday at 11:00 in Track 2
that the software is in use by investigators target for the sophisticated attacker. tools? Well, now you do! HUNT is a new Burp
45 minutes | Demo, Tool
around the globe, and doesn’t do anything that Attention Red Teamers, Penetration Testers, Suite extension that aims to arm web hackers
Joe FitzPatrick ,
law enforcement isn’t supposed to be doing. and Offensive Security Operators, isn’t the In this presentation we will highlight how named with parameter level suggestions on where to
SecuringHardware.com
Because you can trust the government, right? overhead of fighting attribution, spinning up pipes have become a neglected and forgotten look for certain classes of vulnerabilities (SQLi,
Michael Leibowitz, Senior Trouble infrastructure, and having to constantly re-write external interface. We will show some tools CMDi, LFI/RFI, and more!). This data is parsed
Maker This talk will look at a family of tools designed malware an absolute pain and timesink!?! It was that can help find vulnerable named pipes, from hundreds of real-world assessments,
Let’s face it, software security is still in pretty bad for investigating peer-to- peer networks. By for us too, so we’re fixing that for good (well, discuss the mitigations, and demonstrate the providing the user with the means to effectively
shape. We could tell ourselves that everything synthesizing information from dozens of search maybe for evil). Join us for the public unveiling exploitation process on a vulnerable interface. root out critical issues. Not only will HUNT help
is fine, but in our hearts, we know the world is warrant affidavits, and a few technical sources, and open source release of our latest project, you assess large targets more thoroughly but
on fire. Even as hackers, it’s incredibly hard to we’re able to put together at least a partial MEATPISTOL, a modular malware framework for it also aims to organize common web hacking
picture of the software’s capabilities. But we’ll

44 45
Presentations Presentations
methodologies right inside of Burp suite. As an discovery of the FBI and others’ surveillance What happens if your device gets lost, stolen (UN)FUCKING FORENSICS: interdisciplinary approach that encompasses HACKING SMART
open source project, we will go over the data fleets, and continued efforts to shed light on or a hacker gets access to your device? Are ACTIVE/PASSIVE (I.E. constitutional law, world history, game theory, CONTRACTS
driven design of HUNT and it’s core functionality. aerial surveillance. We will discuss a method your personal secrets and credentials secure? OFFENSIVE/DEFENSIVE) social engineering, and international affairs. Friday at 11:00 in Track 3
for detecting surveillance indicators in real MEMORY HACKING/ The discussion will occur against the backdrop 45 minutes | Demo
We say no! In our recent analysis of well-known
OPT OUT OR DEAUTH time based on mutilateration of aggregated DEBUGGING. of cyber security and critical infrastructure Konstantinos Karagiannis, Chief
Android password manager apps, amongst Technology Officer, Security
TRYING !- ANTI-TRACKING ADS-B data, and introduce code for detecting Saturday at 10:20 in Track 4 protection, but it will not examine any specific
them are vendors such as LastPass, Dashlane, Consulting, BT Americas
BOTS RADIOS AND surveillance indicators from flight behavior. 20 minutes | Hacker History, Art of
hardware or software systems; rather, it will
1Password, Avast, and several others, we aimed Defense, Demo, Tool
It can be argued that the DAO hack of June
KEYSTROKE INJECTION concern the conceptual formulation and conduct
to bypass their security by either stealing K2, Director, IOACTIVE 2016 was the moment smart contracts
Thursday at 11:00 in 101 Track 2 GET-$PWND: ATTACKING of modern strategic influence campaigns. No
45 minutes | 0025, Demo, Tool, the master password or by directly accessing entered mainstream awareness in the InfoSec
BATTLE-HARDENED How to forensic, how to fuck forensics specific knowledge is required, but a skeptical
Exploit the stored credentials. Implementation flaws community. Was the hope of taking blockchain
WINDOWS SERVER and how to un-fuck cyber forensics. mind and mischievous intellect are a must.
Weston Hecker, Principal
Saturday at 10:00 in Track 3
resulted in severe security vulnerabilities. In from mere cryptocurrency platform to one
Application Security Engineer,
20 minutes | Demo, Tool all of those cases, no root permissions were Defense: WTF is a RoP, why I care and that can perform amazing Turing-complete
“NCR” HACKING DEMOCRACY: A
Lee Holmes, Principal Security required for a successful attack. We will explain how to detect it statically from memory. functions doomed? We’ve learned quite a lot
It’s hard not to use a service now days that SOCRATIC DIALOGUE
Architect, Microsoft our attacks in detail. We will also propose Counteract “Gargoyle” attacks. Friday at 12:00 in Track 4 from that attack against contract code, and
doesn’t track your every move and keystroke if possible security fixes and recommendations
Windows Server has introduced major Defense: For one of DEF CON 24’s more 45 minutes Ethereum marches on. Smart contracts are a
you absolutely must use these systems why not on how to avoid the vulnerabilities.
advances in remote management hardening popular anti-forensics talks (see int0x80 - Anti Mr. Sean Kanuck, Stanford key part of the applications being created by
give them the most useless information possible. University, Center for
in recent years throughPowerShell Just Forensics). In memory (passive debugging) the Enterprise Ethereum Alliance, Quorum,
Along with the fact that several companies are AMATEUR DIGITAL International Security and
Enough Administration (“JEA”). When set techniques that allows for covert debugging Cooperation and smaller projects in financial and other
tracking their customers online now they are ARCHEOLOGY
up correctly, hardened JEA endpoints can of attackers (active passive means that we companies. Ethical hacking of smart contracts is
taking it to physical brick and mortar stores Thursday at 13:00 in 101 Track In the wake of recent presidential elections
providea formidable barrier for attackers: will (try hard to) not use events or methods a critical new service that is needed. And as is
this talk will be geared looking at the attack 45 minutes
in the US and France, “hacking” has taken
whitelisted commands, with no administrative that facilities are detectable by attackers). the case with coders of Solidity (the language of
surface of instore tracking and attacking Matt ‘openfly’ Joyce, Hacker at on new political and social dimensions
access to the underlyingoperating system. NYC Resistor Ethereum smart contracts), hackers able to find
these systems for the purpose of overloading Offense: CloudLeech - a cloud twist to around the globe. We are now faced with
security flaws in the code are in high demand.
their systems or making the information so In this presentation, watch as we show how ‘Digital Archeology’ is actually the name Ulf Frisk Direct Memory Attack a world of complex influence operations
inaccurate that it becomes useless. Watch as a to systematically destroy these hardened of a Digital Forensics text book. But what and dubious integrity of information. What Join Konstantinos for an introduction to a
32 year old hackers online profile is turned to endpoints by exploitinginsecure coding if we used forensics techniques targetting HACKING DEMOCRACY does that imply for democratic institutions, methodology that can be applied to Solidity
that of a 12 year old girl who loves horses! practices and administrative complexity. cyber crime investigations to help address Friday at 20:00 - 22:00 in Capri
legitimacy, and public confidence? code review ... and potentially adapted to other
Room
the void in Archeology that addresses digital smart contract projects. We’ll examine the few
Evening Lounge This session will explore how liberal democracy
TRACKING SPIES IN THE BYPASSING ANDROID media and silicon artifacts. At NYC Resistor tools that are needed, as well as the six most
Mr. Sean Kanuck, Stanford can be hacked — ranging from direct
SKIES PASSWORD MANAGER APPS in Brooklyn we’ve gotten into the world of University, Center for common types of flaws, illustrated using either
manipulation of electronic voting tallies or
Saturday at 15:00 in Track 2 WITHOUT ROOT Digital Archeology on several occasions and the International Security and public or sanitized real world” vulnerabilities.
45 minutes | Art of Defense, 0025, Cooperation voter registration lists to indirect influence
Sunday at 13:00 in Track 2 projects have been enjoyable and educational.
Tool 45 minutes | Demo, Exploit over mass media and voter preferences — and THE BRAIN'S LAST STAND
Are you curious about the impact of fake
Jason Hernandez, Hacker / Stephan Huber, Fraunhofer SIT Now, imagine what could happen if a bunch question the future role of “truth” in open
Technical Editor, North Star Post news and influence operations on elections? Friday at 10:00 in Track 3
of hackers are able to get their hands on societies. Both domestic partisan activities 45 minutes
Siegfried Rasthofer, Fraunhofer Are you concerned about the vulnerability of
Sam Richards, Editor and SIT a laptop pulled off of a space shuttle. and foreign interventions will be considered Garry Kasparov, Avast Security
Journalist, North Star Post democratic institutions, the media, and civil
Then come to our talk and find out what on technical, legal, and philosophical grounds. Ambassador
Jerod MacDonald-Evoy, Journalist, Security experts recommend using different, society? Then come engage with your peers
ACTUALLY happened. I bought a laptop at auction The speaker will build on his experience as an Former world chess champion Garry Kasparov
North Star Post complex passwords for individual services, but and the first US National Intelligence Officer for
that claimed to be off a Shuttle Mission. It turns intelligence professional to analyze foreign has a unique place in history as the proverbial
Law enforcement agencies have used aircraft everybody knows the issue arising from this Cyber Issues on ways to hack democracy. He
out to have been mostly authentic. This will be capabilities and intentions in the cyber sphere “man” in “man vs. machine” thanks to his
for decades to conduct surveillance, but modern approach: It is impossible to keep all the complex will: (1) provide a low-tech, strategic analysis
a little foray into the history of this device and in order to forecast the future of information iconic matches against the IBM supercomputer
radio, camera, and electronics technology has passwords in mind. One solution to this issue of recent events, foreign intelligence threats,
what I could find out about it, and how I did that. warfare. Audience members will be engaged in Deep Blue. Kasparov walked away from that
dramatically expanded the power and scope of are password managers, which aim to provide and the future of information warfare; (2) lead
a Socratic dialogue to think through how modern watershed moment in artificial intelligence
police surveillance capabilities. The Iraq War and a secure, centralized storage for credentials. Spoiler Alert: We found out a lot. a Socratic dialogue with attendees about the
technologies can be used to propagate memes history with a passion for finding ways humans
other conflicts have spurred the development of The rise of mobile password managers even trade-offs between national security and core
Bonus: I may have found the sister laptop and influence the electorate. The feasibility of, and intelligent machines could work together.
mass surveillance technologies and techniques allows the user to carry their credentials in democratic values (such as freedom, equality,
of this laptop (serial numbers match) and public policy challenges associated with, In the spirit of “if you can’t beat’em, join’em,”
that are now widely available to domestic their pocket, providing instant access to these and privacy); and (3) open the floor to audience
various approaches to hacking democracy will Kasparov has explored that potential for the 20
police. The FBI, DEA, and other agencies flew credentials if required. This advantage can questions and/or a moderated group debate.
also be considered. This conceptual discussion years since his loss to Deep Blue. Navigating
powerful surveillance aircraft over cities for immediately turn into a disadvantage as all
This session is intended to be informal and of strategic influence campaigns will not require a practical and hopeful approach between the
years in relative secrecy before breaking in to credentials are stored in one central location.
participatory. It will cover a range of issues any specific technical or legal knowledge. utopian and dystopian camps, Kasparov focuses
public attention in 2015. This presentation will from supply chain attacks on voting machines on how we can rise to the challenge of the AI
discuss the capabilities of these aircraft, the to psychological operations by using an revolution despite job losses to automation

46 47
Presentations Presentations
and refuting those who say our technology is RADIO EXPLOITATION within Office can be abused to obtain This damaging public announcement was In this presentation, we describe and UNCOVERING USEFUL AND
making us less human. He includes concrete 101: CHARACTERIZING, persistence. The following opportunities for preceded by Wikileaks’ publication of demonstrate a novel technique for exfiltrating EMBARRASSING INFO WITH
examples and forward-looking strategies on AI. CONTEXTUALIZING, AND Office-based persistence will be discussed: documents codenamed as “Vault 7” which data from highly secure enterprises which MALTEGO
APPLYING WIRELESS contained information on vulnerabilities and employ strict egress filtering. Assuming the Standby Speakers at in
(1) WLL and XLL add-ins for Word
HORROR STORIES OF A ATTACK METHODS description of tools needed to access phones, endpoint has a cloud-enhanced antivirus 45 minutes | Demo
and Excel - a legacy add-in that
TRANSLATOR AND HOW Friday at 16:00 in 101 Track network equipment and even IOT devices. installed, we show that if the AV employs an Andrew MacPherson, Ops/Dev -
allows arbitrary DLL loading. Paterva
A TWEET CAN START A 45 minutes | Demo
Internet-connected sandbox in its cloud, it in
(2) VBA add-ins for Excel and PowerPoint Cisco Systems Inc. had a huge task in front of
WAR WITH LESS THAN 140 Matt Knight, Senior Software fact facilitates such exfiltration. We release a The talk has two sections - useful
Engineer, Threat Research at - an alternative to backdoored them - patching this vast amount of different
CHARACTERS tool implementing the exfiltration technique, and embarrassing.
Bastille
template files, which executes switch models is not an easy task. The
Friday at 20:00 - 22:00 in Modena and provide real-world results from several In the ‘useful’ section of this fun filled talk we
Evening Lounge Marc Newlin, Security Researcher
whenever the applications load. remediation for this vulnerability was available
at Bastille prominent AV products. We also provide insights show how we combine the power of Maltego and
El Kentaro, Hacker with the initial advisory and patched versions of
(3) COM add-ins for all Office products on AV in-the-cloud sandboxes. Finally we Shodan to hunt for ICS devices on the Internet.
What do the Dallas tornado siren attack, hacked IOS software were announced on May 8th 2017.
Translators are invisible, when they are present it - an older cross-application add-in address the issues of how to further enhance We tackle the difficult problem of finding the
electric skateboards, and insecure smart door We all heard about modern exploit mitigation
is assumed that they know the language and are that leverages COM objects. the attack, and possible mitigations. function, owners and locations of these devices
locks have in common? Vulnerable wireless techniques such as Data Execution Prevention,
accurately translating between the languages. using OSINT and Maltego. The result is a one
protocols. Exploitation of wireless devices is (4) Automation add-ins for Excel - user Layout Randomization. But just how hardened THE SPEAR TO BREAK
But how do you assure that the translator is click sequence of transforms that makes finding
growing increasingly common, thanks to the defined functions that allow command is the network equipment? And how hard THE SECURITY WALL OF
accurately translating or working without an interesting ICS devices child’s play. In the
proliferation of radio frequency protocols execution through spreadsheet formulae. is it to find critical vulnerabilities? S7COMMPLUS
agenda? Although many of the case studies ‘embarrassing’ section we look at how network
driven by mobile and IoT. While non-Wi-Fi and
presented in this talk will focus on translating (5) VBA editor (VBE) add-ins for all VBA To answer that question I decided to reproduce
Saturday at 10:00 in Track 4
footprinting (which we’ve refined to an art in
non-Bluetooth RF protocols remain a mystery 20 minutes | Exploit
between different languages, the basic premise using Office products - executing commands the steps necessary to create a fully working tool Maltego) becomes useful for identifying and
to many security practitioners, exploiting Cheng, ICS Security Researcher,
can be applied in any case where information when someone tries to catch you using to get remote code execution on Cisco switches profiling people who’s job description involves
them is easier than one might think. NSFOCUS
needs to be shared among 2 or more different VBA to execute commands. (6) VSTO mentioned in the public announcement. lots of lies and who probably does not want to be
contexts. (i.e.: Sales vs Engineering, Government Join us as we walk through the fundamentals add-ins for all Office products - the newer In the past few years, attacks against industrial
This presentation is a detailed write-up of the control systems (ICS) have increased year over associated with the data that’s out there on them.
vs Private sector etc) . The talk will showcase of radio exploitation. After introducing essential cross-application add-in that leverages
publicly known historical cases and personal RF concepts and characteristics, we will develop a special Visual Studio runtime. exploit development process for the vulnerability year. Stuxnet in 2010 exploited the insecurity
CONTROLLING IOT
experiences where translation errors (accidental a wireless threat taxonomy by analyzing and in Cisco Cluster Management Protocol that of the S7Comm protocol, the communication
Each persistence mechanism will be discussed DEVICES WITH CRAFTED
and deliberate) have lead to misunderstandings classifying different methods of attack. As allows a full takeover of the device. protocol used between Siemens Simatic S7
in terms of its relative advantages and RADIO SIGNALS
some with dire consequences. Also the talk will we introduce each new attack, we will draw PLCs to cause serious damage in nuclear
disadvantages for red teamers. In particular, THE ADVENTURES OF AV power facilities. After the exposure of Stuxnet,
Friday at 13:00 in 101 Track
showcase using translators as an offensive tool parallels to similar wired network exploits, and 45 minutes | Demo, Tool
with regards to their complexity to deploy, AND THE LEAKY SANDBOX Siemens has implemented some security
(i.e.:How to create more credible fake news). highlight attack primitives that are unique to RF. Caleb Madrigal, Hacker, FireEye/
privilege requirements, and applicability Friday at 16:00 in Track 2
reinforcements into the S7Comm protocol. The
We as a society consume more information and To illustrate these concepts, we will show each Mandiant
to Virtual Desktop Infrastructure (VDI) 45 minutes | Demo, Tool
current S7CommPlus protocol implementing
consume it faster than before, we have to be attack in practice with a series of live demos In this talk, we’ll be exploring how wireless
environments which hinder the use of many Itzik Kotler, Co-Founder & CTO,
encryption has been used in S7-1200 V4.0 and
aware of the dangers that are inherit with bad built on software-defined and hardware radios. SafeBreach communication works. We’ll capture digital data
traditional persistence mechanisms. above, as well as S7-1500, to prevent attackers
translations. Also the infosec/cyber security Attendees will come away from this session Amit Klein, VP Security Research, live (with Software-Defined Radio), and see
profession because of the potential for large The talk isn’t all red - there’s also some blue SafeBreach from controlling and damaging the PLC devices. how the actual bits are transmitted. From here,
with an understanding of the mechanics of Is the current S7CommPlus a real high security
scale global impacts and or the need to maintain to satisfy the threat hunters and incident Everyone loves cloud-AV. Why not harness the we’ll see how to view, listen to, manipulate,
wireless network exploitation, and an awareness protocol? This talk will demonstrate a spear that
operational security poses unique considerations responders amongst us. The talk will finish wisdom of clouds to protect the enterprise? and replay wireless signals. We’ll also look
of how they can bridge their IP network can break the security wall of the S7CommPlus
when translating or using a translator. This talk with approaches to detection and prevention Consider a high-security enterprise with strict at interrupting wireless communication, and
exploitation skills to the wireless domain. protocol. First, we use software like Wireshark
will highlight the unique challenges of using a of these persistence mechanisms. egress filtering - endpoints have no direct finally, we’ll even generate new radio waves
translator or translations in such environments. to analyze the communications between the from scratch (which can be useful for fuzzing
PERSISTING WITH Internet connection, or the endpoints’ connection
CISCO CATALYST Siemens TIA Portal and PLC devices. Then, and brute force attacks). I’ll also be demoing
MICROSOFT OFFICE: to the Internet is restricted to hosts used by
EXPLOITATION using reverse debugging software like WinDbg some brand new tools I’ve written to help in
ABUSING EXTENSIBILITY their legitimately installed software. Let’s
Friday at 17:00 in 101 Track and IDA we can break the encryption in the the interception, manipulation, and generation
OPTIONS 45 minutes | Demo say there’s malware running on an endpoint
S7CommPlus protocol. Finally, we write a MFC of digital wireless signals with SDR.
Saturday at 10:00 in 101 Track with full privileges. The malware still can’t
20 minutes | Demo
Artem Kondratenko, Penetration program which can control the start and the
Tester, Security Researcher exfiltrate data due to the strict egress filtering.
William Knowles, MWR InfoSecurity stop of the PLC, as well as value changes of
On March 17th, Cisco Systems Inc. made a Now let’also assume that this enterprise PLC’s digital and analog inputs & outputs.Based
One software product that red teamers will public announcement that over 300 of the uses cloud-enhanced anti-virus (AV).You’d on the research above, we present two security
almost certainly find on any compromised switches it manufactures are prone to a critical argue that if malware is already running proposals at both code level and protocol level
workstation is Microsoft Office. This talk will vulnerability that allows a potential attacker to on the endpoint with full privileges, then an to improve the security of Siemens PLC devices.
discuss the ways that native functionality take full control of the network equipment. AV agent can’t degrade the security of the
endpoint. And you’d be completely wrong.

48 49
Presentations Presentations
REAL-TIME RFID CLONING packet analysis and inference on what the TROJAN-TOLERANT WHERE ARE THE SDN In this talk, we will discuss how an attacker safer formats such as JSON. In this talk, we
IN THE FIELD code looks like server side in order for some HARDWARE & SUPPLY SECURITY TALKS? could send specific data or achieve a magstripe will analyze the most popular JSON parsers in
Thursday at 15:00 in 101 Track 2 of the exploits to be possible is presented. CHAIN SECURITY IN Thursday at 10:00 in 101 Track2 jammer for credit card terminals, PoS or any card both .NET and Java for potential RCE vectors.
20 minutes | Demo, Tool, Audience
PRACTICE 45 minutes | Demo, Tool
reader. Also, how it could be implemented to
Participation This presentation includes a live demonstration We will demonstrate that RCE is also possible
Saturday at 14:00 in Track 2 Jon Medina, Protiviti generate brute force attacks against hotel door
Dennis Maldonado, Adversarial of at least one unreleased exploit to in these libraries and present details about the
45 minutes | Art of Defense, Demo,
Software Defined Networking is no longer locks or tokenization processes as examples.
Engineer - LARES Consulting create mass amounts of virtual currency Tool ones that are vulnerable to RCE by default.
in a recent and popular MMORPG. a fledgling technology. Google, Amazon, We will also discuss common configurations
Ever been on a job that required you to clone Vasilios Mavroudis, Doctoral 'TICK, TICK, TICK. BOOM!
Researcher, University College Facebook, and Verizon all rely on the scalability, that make other libraries vulnerable.
live RFID credentials? There are many different YOU'RE DEAD.' -- TECH &
MALICIOUS CDNS: London programmability, flexibility, availability,
solutions to cloning RFID in the field and they THE FTC In addition to focusing on JSON format, we
IDENTIFYING ZBOT Dan Cvrcek, Co-founder, Enigma and yes, security provided by SDN. So why
all work fine, but the process can be slow, Bridge Ltd Friday at 16:00 in Track 4 will generalize the attack techniques to other
DOMAINS EN MASSE VIA has there only ever been one DEF CON
tedious, and error prone. What if there was a 45 minutes
serialization formats. In particular, we will
SSL CERTIFICATES AND The current consensus within the security speaker presenting on SDN and security?
new way of cloning badges that solved these Whitney Merrill, Privacy, pay close attention to several serialization
problems? In this presentation, we will discuss
BIPARTITE GRAPHS industry is that high-assurance systems cannot This talk will provide a brief introduction to SDN eCommerce & Consumer Protection
formats in .NET. These formats have also been
a smarter way for cloning RFID in the field
Sunday at 13:00 in Track 3 tolerate the presence of compromised hardware and security, demonstrate ways of compromising
Counsel, Electronic Arts
45 minutes | Art of Defense known to be vulnerable since 2012 but the
that is vastly more efficient, useful, and just components. In this talk, we challenge this and securing a Software Defined Network and
Terrell McSweeny, Commissioner,
Federal Trade Commission lack of known RCE gadgets led some software
plane cool. We will go over the current tools
Thomas Mathew, OpenDNS (Cisco) perception and demonstrate how trusted, will illustrate new ways of using the power vendors to not take this issue seriously. We
and methods for long-range RFID cloning,
Dhia Mahjoub , Head of Security high-assurance hardware can be built from of open source SDN coupled with machine The Federal Trade Commission is a law
Research, Cisco Umbrella (OpenDNS) hope this talk will change this. With the
than discuss and demonstrate a new method untrusted and potentially malicious components. learning to maintain self-defending networks. enforcement agency tasked with protecting
intention of bringing the due attention to
that will allow you to clone RFID credentials Prior research detailing the relationship between The majority of IC vendors outsource the consumers from unfair and deceptive practices.
this vulnerability class in .NET, we will review
in the field in just seconds, changing the way malware, bulletproof hosting, and SSL gave fabrication of their designs to facilities overseas, EXPLOITING 0LD MAG- Protecting consumers on the Internet and from
the known vulnerable formats, present other
you perform red team engagements forever. researchers methods to investigate SSL data and rely on post-fabrication tests to weed STRIPE INFORMATION bad tech is nothing new for the FTC. We will take
formats which we found to be vulnerable as
only if given a set of seed domains. We present out deficient chips. However, such tests are WITH NEW TECHNOLOGY a look back at what the FTC was doing when DEF
well and conclude presenting several gadgets
TWENTY YEARS OF a novel statistical technique that allow us to not effective against: 1) subtle unintentional Thursday at 15:20 in 101 Track 2 CON first began in 1993, and what we’ve been
from system libraries that may be used to
MMORPG HACKING: discover botnet and bulletproof hosting IP space errors (e.g., malfunctioning RNGs) and 2)
20 minutes | Demo, Tool, Exploit doing since. We will discuss enforcement actions
achieve RCE in a stable way: no memory
BETTER GRAPHICS, SAME by examining SSL distribution patterns from open malicious circuitry (e.g., stealthy Hardware
Salvador Mendoza, Hacker involving modem hijacking, FUD advertising,
corruption — just simple process invocation.
EXPLOITS source data while working with limited or no Trojans). Such errors are very hard to detect A massive attack against old magnetic stripe identity theft, and even introduce you to Dewie
seed information. This work can be accomplished the e-Turtle. Looking forward, we will talk about Finally, we will provide recommendations
Saturday at 13:00 in Track 3 and require constant upgrades of expensive information could be executed with precision
45 minutes | Demo, Exploit using open source datasets and data tools. the FTC’s future protecting consumers’ privacy on how to determine if your code is
forensics equipment, which contradicts implementing new technology. In the past, a
Manfred (@_EBFE), Security Analyst and data security and what you can do to help. vulnerable, provide remediation advice,
SSL data obtained from scanning the entire IPv4 the motives of fabrication outsourcing. malicious individual could spoof magstripe
at Independent Security Evaluators and discuss alternative approaches.
namespace can be represented as a series of 4 data but in a slow and difficult way. Also brute
In theme with this year’s DEF CON this In this session, we introduce a high-level FRIDAY THE 13TH: JSON
million node bipartite graphs where a common force attacks were tedious and time-consuming.
presentation goes through a 20 year architecture that can tolerate multiple, ATTACKS! CABLETAP: WIRELESSLY
name is connected to either an IP/CIDR/ASN via Technology like Bluetooth could be used today
history of exploiting massively multiplayer malicious hardware components, and outline Sunday at 14:00 in Track 4 TAPPING YOUR HOME
an edge. We use the concept of relative entropy to make a persistent attack in multiple magnetic
online role-playing games (MMORPGs). The a new approach in hardware compromises risk 45 minutes | Demo, Exploit NETWORK
to create a pairwise distance metric between card readers at the same time with audio spoof.
presentation technically analyzes some of the management. We first demo our backdoor- Alvaro Muñoz, Principal Security Saturday at 16:00 in Track 3
any two common names and any two ASNs. The tolerant Hardware Security Module built from Private companies, banks, trains, subways, Researcher,Hewlett Packard 45 minutes | Demo, Tool, Exploit
virtual economy-devastating, low-hanging-fruit metric allows us to generalize the concept of Enterprise
exploits that are common in nearly every low-cost commercial off-the-shelf components, hotels, schools and many others services are Marc Newlin, Security Researcher
regular and anomalous SSL distribution patterns. benchmark its performance, and delve into still using magstripe information to even
Oleksandr Mirosh, Senior Security at Bastille Networks
MMORPG released to date. The presenter, QA Engineer, Hewlett Packard
Logan Lamb, Security Researcher at
Manfred (@_EBFE), goes over his adventures Relative entropy is useful in identifying domains its internals. We then explain the importance make monetary transactions, authorize Enterprise
Bastille Networks
in hacking online games starting with 1997’s that have anomalous network structures. The of “component diversification” and “non- access or to generate “new” protocols like 2016 was the year of Java deserialization Chris Grayson, Founder and
Ultima Online and subsequent games such domains we found in this case were related overlapping supply chains”, and finally discuss MST(Magnetic Secure Transmission) During apocalypse. Although Java Deserialization Principal Engineer at Web Sight.IO
as Dark Age of Camelot, Anarchy Online, to the Zbot proxy network. The Zbot proxy how “mutual distrust” can be exploited to further decades the exploitation of magstripe attacks were known for years, the publication
network contains a structure similar to popular reduce the capabilities of the adversaries. information was an acceptable risk for Absract will be released prior to DEF CON.
Asherons Call 2, ShadowBane, Lineage II, of the Apache Commons Collection Remote
Final Fantasy XI/XIV, World of Warcraft, plus CDNs like Akamai, Google, etc but instead many companies because the difficulty to Code Execution (RCE from now on) gadget
some more recent titles such as Guild Wars 2 rely on compromised devices to relay their achieve massive attacks simultaneously finally brought this forgotten vulnerability to
and Elder Scrolls Online and many more! data. Through layering these SSL signals with was not factible. But today is different. the spotlight and motivated the community
passive DNS data we create a pipeline that can Transmitting magstripe information in audio to start finding and fixing these issues.
The presentation briefly covers the exploit extract Zbot domains with high accuracy.
development versus exploit detection/prevention files is the faster and easier way to make a cross- One of the most suggested solutions for avoiding
arms race and its current state. Detailed platform magstripe spoofer. But how an attacker Java deserialization issues was to move away
could transmit the audio spoof information to from Java Deserialization altogether and use
many magnetic card readers at the same time?

50 51
Presentations Presentations
DNS - DEVIOUS NAME LINUX-STACK BASED how to exploit multiple kinds of vulnerabilities, weapon even when not authorized by its owner, THE INTERNET ALREADY high school, and their paths included some of
SERVICES - DESTROYING V2X FRAMEWORK: ALL opening the door for a host of hacking with no prior contact with the specific weapon, KNOWS I'M PREGNANT the best hacking stories of the time (certainly
PRIVACY & ANONYMITY YOU NEED TO HACK artificial intelligence systems in the future. and with no modifications to the weapon. Friday at 17:00 in Track 4 in the eyes of the locals). The combination of
WITHOUT YOUR CONSENT CONNECTED VEHICLES This is only the beginning of the end, though.
45 minutes | Exploit
extremely expensive Internet and international
Saturday at 12:00 in Track 3 Saturday at 14:00 in Track 3 DIGITAL VENGEANCE: Cooper Quintin, Staff Technologist dial system, non-existent legal enforcement
AI-based hacking tools are emerging as a - EFF
45 minutes | Art of Defense 45 minutes | Demo, Tool EXPLOITING THE MOST and a lagging national phone company could
class of technology that pentesters have
Jim Nitterauer, Senior Security p3n3troot0r (Duncan Woodbury) , NOTORIOUS C&C Kashmir Hill, Journalist - Gizmodo
not prevent dozens of hungry-for-knowledge
Specialist, AppRiver, LLC Hacker yet to fully explore. We guarantee that Media
TOOLKITS kids from teaching themselves the dark arts of
you’ll be either writing machine learning Women’s health is big business. There are a
You’ve planned this engagement for weeks. ginsback (Nicholas Haltmeyer), Saturday at 15:00 in Track 4 reversing, hacking, cracking, phreaking and
Hacker hacking tools next year, or desperately 45 minutes | Demo, Tool, Exploit
staggering number of applications for Android
Everything’s mapped out. You have tested even carding. The world looked completely
Vehicle-to-vehicle (V2V) and, more generally, attempting to defend against them. Professor Plum, Hacker to help people keep track of their monthly cycle,
all your proxy and VPN connections. You are different back then and we have some great
confident your anonymity will be protected. vehicle-to-everything (V2X) wireless No longer relegated just to the domain of evil Every year thousands of organizations are know when they may be fertile, or track the stories for you. We will cover the evolution of the
You fire off the first round and begin attacking communications enable semi-autonomous driving geniuses, the inevitable AI dystopia is accessible compromised by targeted attacks. In many status of their pregnancy. These apps entice many-years-later-to-be-named-Cyber community,
your target. Suddenly something goes south. via the exchange of state information between a to you today! So join us and we’ll demonstrate cases the attacks are labeled as advanced the user to input the most intimate details of including personal stories from nearly all
Your access to the target site is completely network of connected vehicles and infrastructure how you too can help usher in the destruction and persistent which suggests a high level their lives, such as their mood, sexual activity, categories. Come listen how the Israeli Cyber
blocked no matter what proxy or VPN you units. Following 10+ years of standards of humanity by building weaponized machine of sophistication in the attack and tools physical activity, physical symptoms, height, “empire” was born, 25 years ago, from the
use. Soon, your ISP contacts you reminding development, particularly of IEEE 802.11p learning systems of your own - unless time used. Many times, this title is leveraged as weight, and more. But how private are these perspectives of 2:401/100 and 2:401/100.1.
you of their TOS while referencing complaints and the IEEE 1609 family, a lack of available travelers from the future don’t stop us first. an excuse that the events were inevitable or apps, and how secure are they really? After all,
from the target of your engagement. You implementations has prevented the involvement irresistible, as if the assailants’ skill set is if an app has such intimate details about our PEIMA (PROBABILITY
quickly switch MAC addresses and retry only of the security community in development TEACHING OLD well beyond what defenders are capable of. private lives it would make sense to ensure that ENGINE TO IDENTIFY
to find that you are quickly blocked again! and testing of these standards. Analysis of the SHELLCODE NEW TRICKS To the contrary, often these assailants are it is not sharing those details with anyone such MALICIOUS ACTIVITY):
WAVE/DSRC protocols in their existing form Friday at 13:00 in Track 2
not as untouchable as many would believe. as another company or an abusive partner/ USING POWER LAWS TO
What happened? How were you betrayed? 45 minutes | Demo
reveals the presence of vulnerabilities which parent. To this end EFF and Journalist Kashmir ADDRESS DENIAL OF
The culprit? Your dastardly DNS resolvers Josh Pitts, Hacker If one looks at the many APT reports that have
have the potential to render the protocol unfit Hill have taken a look at some of the privacy SERVICE ATTACKS
and more specifically, the use of certain been released over the years some clear patterns
for use in safety-critical systems. We present Metasploit x86 shellcode has been defeated and security properties of over a dozen different Sunday at 10:20 in Track 2
EDNS0 options by those resolvers. start to emerge. A small number of Remote
a complete Linux-stack based implementation by EMET and other techniques not only in fertility and pregnancy tracking apps. Through 20 minutes | Art of Defense, Demo,

This presentation will cover the ways in which of IEEE 802.11p and IEEE 1609.3/4 which Administration Tools are preferred by actors and our research we have uncovered several
Tool
exploit payloads but through using those
EDNS OPT code data can divulge details provide a means for hackers and academics reused across multiple campaigns. Frequently privacy issues in many of the applications as
Redezem, Hacker
payloads in non-exploit situations (e.g. binary
about your online activity, look at methods to participate in the engineering of secure sited tools include Gh0st RAT, Plug-X, and well as some notable security flaws as well Denial of service. It requires a low level of
payload generation, PowerShell deployment,
for discovering implementation by upstream standards for intelligent transportation systems. XtremeRAT among others. Upon examination, as a couple of interesting security features. resources and knowledge, it is very easy to
etc..). This talk describes taking Metasploit
DNS providers and discuss ways in which the command and control components of these deploy, it is very common and it is remarkable
payloads (minus Stephen Fewer’s hash API),
malicious actors can abuse these features. We WEAPONIZING MACHINE notorious RATs are riddled with vulnerabilities. FROM "ONE COUNTRY how effective it is overall. PEIMA is a brand new
incorporating techniques to bypass Caller/
will also examine steps you can take to protect LEARNING: HUMANITY WAS Vulnerabilities that can be exploited to - ONE FLOPPY" TO method of client side malicious activity detection
EAF[+] checks (post ASLR/DEP bypass) and
yourself from these invasive disclosures. OVERRATED ANYWAY turn the tables from hunter to hunted. "STARTUP NATION" - THE based on mathematical laws, usually used in
merging those techniques together with
Sunday at 14:00 in Track 2
automation to make something better. The presentation will disclose several exploits STORY OF THE EARLY finance, text retrieval and social media analysis,
The details covered will be only moderately 45 minutes | Demo, Tool
that could allow remote execution or remote DAYS OF THE ISRAELI that is fast, accurate, and capable of determining
technical. Having a basic understanding Dan “AltF4” Petro, Senior POPPING A SMART GUN information disclosure on computers running HACKING COMMUNITY, AND when denial of service attacks start and stop
of RFC 6891 and general DNS processes Security Associate, Bishop Fox
Saturday at 17:00 in Track 4 these well-known C&C components. It should THE JOURNEY TOWARDS without flagging legitimate heavy interest in
will help in understanding. We will Ben Morris, Security Analyst, 45 minutes | Demo, Exploit
serve as a warning to those actors who utilize TODAY'S VIBRANT your server erroneously. However, denial of
discuss the use of basic tools including Bishop Fox
Plore, Hacker
such toolsets. That is to say, such actors live in STARTUP SCENE service attacks aren’t the only type of anomalous
Wireshark, Packetbeat, Graylog and Dig. At risk of appearing like mad scientists,
Smart guns are sold with a promise: they can glass houses and should stop throwing stones. Saturday at 16:00 in Track 2 activity you can look at with PEIMA. Learn what
reveling in our latest unholy creation, we 45 minutes | Hacker History
kinds of unusual identifying metrics you can
be fired only by authorized parties. That works
proudly introduce you to DeepHack: the Inbar Raz, Principal Researcher,
get out of your network and users to help detect
in the movies, but what about in real life? In
open-source hacking AI. This bot learns PerimeterX Inc.
intrusions and, ultimately, defend your assets.
this talk, we explore the security of one of the
how to break into web applications using Eden Shochat, Equal Partner, Aleph
only smart guns available for sale in the world.
a neural network, trial-and-error, and a The late 80’s and early 90’s played a pivotal
Three vulnerabilities will be demonstrated. First,
frightening disregard for humankind. role in the forming of the Israeli tech scene as
we will show how to make the weapon fire even
DeepHack can ruin your day without any when separated from its owner by a considerable we know it today, producing companies like
prior knowledge of apps, databases - or really distance. Second, we will show how to prevent Checkpoint, Waze, Wix, Mobileye, Viber and
anything else. Using just one algorithm, it learns the weapon from firing even when authorized billions of dollars in fundraising and exits. The
by its owner. Third, we will show how to fire the people who would later build that industry
were in anywhere from elementary school to

52 53
Presentations Presentations
AN ACE UP THE SLEEVE: USING GPS SPOOFING TO Finally we’ll finish by looking at Same Site TAKING WINDOWS 10 will show how social engineers use OPSEC to under an hour. By using a motor with a high
DESIGNING ACTIVE CONTROL TIME Cookies, a new extension to cookies that could KERNEL EXPLOITATION (Operations Security) to plan a successful social count encoder we can take measurements of
DIRECTORY DACL Friday at 14:00 in 101 Track be the final nail in the coffin, and see how to TO THE NEXT LEVEL - attack. Additionally, you’ll also learn the about the internal bits of a combination safe while it
BACKDOORS 45 minutes | Tool
use the prior solution as a graceful degradation LEVERAGING WRITE-WHAT- the economics of “fake news”, who’s making the remains closed. These measurements expose
Friday at 16:00 in Track 3 David “Karit” Robinson, Security for user agents that don’t support it yet. WHERE VULNERABILITIES money, and how much, and how information is one of the digits of the combination needed
Consultant, ZX Security
45 minutes | Demo
IN CREATORS UPDATE weaponized. This talk will also reveal that the to open a standard fire safe. Additionally, ‘set
Andy Robbins, Red Team Lead GPS is central to a lot of the systems we deal THE BLACK ART OF Saturday at 17:00 in Track 2 news has been socialized for a long time, and testing’ is a new method we created to decrease
Will Schroeder , Offensive with on a day-to-day basis. Be it Uber, Tinder, WIRELESS POST 45 minutes | Demo, Exploit
that socially engineered news lead to the start the time between combination attempts. With
Engineer or aviation systems, all of them rely on GPS EXPLOITATION Morten Schenk, Security Advisor, of the Spanish American War. We’ll also explore some 3D printing, Arduino, and some strong
Improsec
Active Directory (AD) object discretionary signals to receive their location and/or time. Sunday at 12:00 in 101 Track techniques to guard against social engineering magnets we can crack almost any fire safe. Come
45 minutes | Demo, Tool
access control lists (DACLs) are an untapped GPS Spoofing is now a valid attack vector and Since the release of Windows 10 and especially in in general, and specifically in the media. checkout the live cracking demo during the talk!
Gabriel “solstice” Ryan, Gotham
offensive landscape, often overlooked can be done with minimal effort and cost. This Digital Science
the Anniversary and Creators Updates, Microsoft
by attackers and defenders alike. The has continued to introduce exploit mitigations TOTAL RECALL: MAN IN THE NFC
raises some concerns when GPS is depended Most forms of WPA2-EAP have been broken
control relationships between AD objects to the Windows kernel. These include full scale IMPLANTING PASSWORDS Sunday at 14:00 in Track 3
upon by safety of life applications. This for nearly a decade. EAP-TTLS and EAP-PEAP 45 minutes | Demo, Tool
align perfectly with the “attackers think in KASLR and blocking kernel pointer leaks. IN COGNITIVE MEMORY
presentation will look at the process for GPS have long been susceptible to evil twin attacks, Haoqi Shan , Wireless security
graphs” philosophy and expose an entire and NMEA (the serial format that GPS receivers This presentation picks up the mantle and
Sunday at 11:00 in 101 Track
researcher
class of previously unseen control edges, yet most enterprise organizations still rely 45 minutes
output) spoofing, how to detect the spoofing on these technologies to secure their wireless reviews the powerful read and write kernel Tess Schrodinger Jian Yuan, Wireless security
dramatically expanding the number of attacks and ways to manipulate the time on primitives that can still be leveraged despite researcher
paths to complete domain compromise. infrastructure. The reason for this is that the What is cognitive memory? How can you
GPS synced NTP servers. We will also explore secure alternative, EAP-TLS, is notoriously the most recent hardening mitigations. The NFC (Near Field Communication) technology
the implications when the accuracy of the time presented techniques include abusing the “implant” a password into it? Is this truly
While DACL misconfigurations can provide arduous to implement. To compensate for the is widely used in security, bank, payment and
on your server can no longer be guaranteed. kernel-mode Window and Bitmap objects, which secure? Curiosity around these questions
numerous paths that facilitate elevation of weak perimeter security provided by EAP-TTLS personal information exchange fields now, which
Microsoft has attempted to lock down several prompted exploration of the research and
domain rights, they also present a unique chance and EAP-PEAP, many organizations use port is highly well-developed. Corresponding, the
WIPING OUT CSRF times. Doing so will present a generic approach concepts surrounding the idea of making the
to covertly deploy Active Directory persistence. based NAC appliances to prevent attackers attacking methods against NFC are also emerged
Thursday at 13:00 in 101 Track 2 to leveraging write-what-where vulnerabilities. authentication process more secure by implanting
It’s often difficult to determine whether a specific from pivoting further into the network after in endlessly. To solve this problem, we built a
45 minutes | Art of Defense, Demo passwords into an individual’s memory. The
AD DACL misconfiguration was set intentionally the wireless has been breached. This solution A stable and precise kernel exploit must be hardware tool which we called “UniProxy”. This
Joe Rozner, Senior Software result? The idea is that you are not able to reveal
or implemented by accident. This makes Security Engineer, Prevoty is thought to provide an acceptable balance able to overcome KASLR, most often using tool contains two self-modified high frequency
your credentials under duress but you are still
Active Directory DACL backdoors an excellent between security and accessibility. The problem kernel driver leaks. I will disclose several card readers and two radio transmitters, which
CSRF remains an elusive problem due to legacy able to authenticate to a system. We will begin
persistence opportunity: minimal forensic with this approach is that it assumes that EAP previously unknown KASLR bypasses in Windows is a master-slave way. The master part can help
code, legacy frameworks, and developers not with an understanding of cognitive memory.
footprint, and maximum plausible deniability. is exclusively a perimeter defense mechanism. 10 Creators Update. Obtaining kernel-mode people easily and successfully read almost all
understanding the problem or how to protect Implicit versus explicit memory will be defined.
This talk will cover Active Directory DACLs in In this presentation, we will present a novel code execution on Windows has become The concepts of the subconscious, unconscious, ISO 14443A type cards, (no matter what kind
against it. Wiping out CSRF introduces primitives
depth, our “misconfiguration taxonomy”, and type of rogue access point attack that can more difficult with the randomization of and consciousness will be addressed. The stages of this card is, bank card, ID card, Passport,
and strategies for building solutions to CSRF that
enumeration/analysis with BloodHound’s be used to bypass port-based access control Page Table entries. I will show how a generic of memory pertaining to encoding, storage and access card, or whatever. No matter what security
can be bolted on to any http application where
newly released feature set. We will cover the mechanisms in wireless networks. In doing de-randomization of the Page Table entries retrieval as well as the limitations of human protocol this card uses, as long as it meets the
http requests and responses can be intercepted,
abuse of AD DACL misconfigurations for the so, we will challenge the assumption that can be performed through dynamic reverse memory along with serial interception sequence ISO 14443A standard) meanwhile replaying
inspected, and modified. Modern frameworks
purpose of domain rights elevation, including reactive approaches to wireless security are an engineering. Additionally, I will present an learning training will round out our build up to this card to corresponding legal card reader via
have done a great job at providing solutions to
common misconfigurations encountered acceptable alternative to strong physical layer entirely different method which makes the usage the current research and experimentation being slave part to achieve our “evil” goals. The master
the CSRF problem that automatically integrate
in the wild. We will then cover methods protections such as WPA2-EAP using EAP-TLS. of Page Table entries obsolete. This method done with the proposal to implant passwords and slave communicate with radio transmitters
into the application and solve most of the
to design AD DACL backdoors, including allocates an arbitrary size piece of executable into an individual’s cognitive memory. and can be apart between 50 - 200 meters.
conditions. However, many existing apps and
ways to evade current detections, and will new apps that don’t take advantage of these kernel pool memory and transfers code
conclude with defensive mitigation/detection frameworks or use them incorrectly are still execution to it through hijacked system calls. OPEN SOURCE SAFE
techniques for everything described. plagued with this problem. Wiping out CSRF CRACKING ROBOTS -
SOCIAL ENGINEERING THE COMBINATIONS UNDER 1
will provide an in depth overview of the various
NEWS HOUR! (IS IT BAIT? DAMN
reasons that CSRF occurs and provide payload
Standby Speaker
examples to target those specific issues and 45 minutes
STRAIGHT IT IS.)
variations. We’ll see live demos of these attacks Michael Schrenk
Friday at 12:00 in Track 2
45 minutes | Demo, Tool, Exploit
and the protections against them. Next we’ll
look at how to compose these primitives into It might be called “fake news” but at it’s heart, Nathan Seidle , Founder, SparkFun
Electronics
a complete solution capable of solving most it’s the latest wave of social engineering. This
cases of CSRF explaining the limits and how to apolitical talk explores the similarities between We’ve built a $200 open source robot that cracks
layer them to address potential short comings. traditional social engineering and today’s combination safes using a mixture of measuring
“fake news”. During this talk, Michael Schrenk techniques and set testing to reduce crack times

54 55
Presentations Presentations
DRIVING DOWN THE obtain persistency, which requires the use of create a command-and-control communication exploitation mitigations, there are many missing. to initiate defensive works, before offensive CI and automated build systems, or if you have
RABBIT HOLE advanced techniques to evade the security over them, bypassing strict defensive I will be showing how I was able to bypass them hacks can be deployed in the wild. Hackers been doing it for years, this talk and tool will
Saturday at 12:00 in 101 Track mechanisms installed along the way. proxies, and even avoiding attribution. and what mitigations should’ve been employed, can literally save the world... from ourselves. help you to better secure your architecture.
45 minutes | Demo
One of the challenges adversaries must Finally, we’ll release the tool that will use such as NX-Stack/Heap, canaries, etc, to prevent
Mickey Shkatov, Security me from gaining arbitrary shellcode execution. EXPLOITING CONTINUOUS BREAKING WIND:
Researcher, McAfee. face is: How to create threats that will the concept of a broker website to work
INTEGRATION (CI) AND ADVENTURES IN HACKING
continuously evade security mechanisms, with the external C2 using webhooks. If you’re interested in security of embedded/
Jesse Michael, Security AUTOMATED BUILD WIND FARM CONTROL
Researcher, McAfee. and even if detected, ensure that control of IoT systems, travel routers or just good old
PHONE SYSTEM TESTING SYSTEMS NETWORKS
Oleksandr Bazhaniuk, Security the environment can be easily regained? fashioned MIPS hacking, then this talk is for you! Sunday at 11:00 in Track 3 Saturday at 10:20 in 101 Track
Researcher AND OTHER FUN TRICKS
In this talk, we briefly discuss some of the past 45 minutes | Demo, Tool, Exploit 20 minutes

Over the past few years, cars and automotive

Friday at 15:00 in Track 2 GENETIC DISEASES TO
techniques for gaining persistency in a network 45 minutes | Demo, Tool spaceB0x, Sr. Security Engineer at Jason Staggs, Security Researcher
systems have gained increasing attention
GUIDE DIGITAL HACKS OF LeanKit Inc. at the University of Tulsa
(using local accounts, GPOs, skeleton key, etc.) “Snide” Owen , Hacker
as cyber-attack targets. Cars are expensive.
THE HUMAN GENOME: HOW
and why they are insufficient nowadays. Continuous Integration (CI) systems and Wind farms are becoming a leading source for
Breaking cars can cost a lot. So how can Phone systems have been long forgotten in THE CANCER MOONSHOT
similar architecture has taken new direction, renewable energy. The increased reliance on
Followed by a comprehensive analysis of lesser favor of more modern technology. The phreakers PROGRAM WILL ENABLE
we find vulnerabilities in a car with no especially in the last few years. Automating wind energy makes wind farm control systems
known mechanisms to achieve persistency, of the past left us a wealth of information, ALMOST ANYONE TO
budget? We’ll take you with us on a journey code builds, tests, and deployments is helping attractive targets for attackers. This talk explains
using non-mainstream methods (such as object however while moving forward the environments CRASH THE OPERATING
from zero car security validation experience hordes of developers release code, and is how wind farm control networks work and how
manipulation, Kerberos delegation, etc.). as a whole have become more complex. As a SYSTEM THAT RUNS YOU
through the discovery and disclosure saving companies a great amount of time and they can be attacked in order to negatively
of multiple remotely-exploitable automotive Finally, we show how defenders can secure result they are often forgotten, side tracked OR TO END CIVILIZATION...
resources. But at what cost? The sudden and influence wind farm operations (e.g., wind
vulnerabilities. Along the way, we’ll visit a their environment against such threats. or neglected to be thoroughly tested. We’ll Sunday at 12:00 in Track 4
strong demand for these systems have created turbine hijacking). Specifically, implementations
45 minutes
wrecking yard, reassemble (most) of a 2015 cover the VoIP landscape, how to test the some widely adopted practices that have large of the IEC 61400-25 family of communications
John Sotos, Chief Medical Officer,
Nissan Leaf in our lab, discuss how we picked ABUSING WEBHOOKS FOR various components while focussing on PBX Intel Corporation security implications, especially if these systems protocols are investigated (i.e., OPC XML-DA).
our battles, fought them, and won. During COMMAND AND CONTROL and IVR testing. The security issues that may are hosted internally. I have developed a tool This research is based on an empirical study of a
be encountered are mapped to the relative The human genome is, fundamentally, a
our talk, we’ll examine the details of three Saturday at 11:20 in 101 Track
that will help automate some offensive testing variety of U.S. based wind farms conducted over
20 minutes | Demo, Tool
OWASP category for familiarity. Moving on I’ll complex open-source digital operating system
different classes of vulnerabilities we found in against certain popular CI build systems. a two year period. We explain how these security
Dimitry Snezhkov, Security demonstrate other fun ways that you can utilize (and set of application programs) built on
this vehicle, how they can be exploited, and the There has been a large adoption of initiating assessments reveal that wind farm vendor design
Consultant, X-Force Red, IBM
a PBX within your future offensive endeavours. the digital molecules DNA and RNA.
potential ramifications to the owner of their these builds through web hooks of various and implementation flaws have left wind turbine
real-world exploitation. We’ll also discuss the You are on the inside of the perimeter. And The genome has thousands of publicly kinds, especially changes to public facing code programmable automation controllers and
broader scope of the vulnerabilities discovered, maybe you want to exfiltrate data, download a HACKING TRAVEL documented, unpatchable security vulnerabilities, repositories. I will start with a brief overview of OPC servers vulnerable to attack. Additionally,
how they extend beyond just this specific tool, or execute commands on your command ROUTERS LIKE IT'S 1999 previously called “genetic diseases.” Because some of the more popular CI tools and how they proof-of-concept attack tools are developed
vehicle, and what the industry can do better to and control server (C2). Problem is - the first Friday at 10:20 in Track 2
emerging DNA/RNA technologies, including are being used in many organizations. This is in order to exploit wind farm control network
20 minutes | Demo, Exploit
prevent these types of problems in the future. leg of connectivity to your C2 is denied. Your CRISPR-Cas9 and especially those arising good information for understanding, at a high design and implementation vulnerabilities.
Mikhail Sosonkin, Security
DNS and ICMP traffic is being monitored. Researcher, Synack Inc. from the Cancer Moonshot program, will level, the purpose of these systems as well as
HERE TO STAY: GAINING Access to your cloud drives is restricted. You’ve create straightforward methods to digitally some security benefits that they can provide. HACKING THE CLOUD
PERSISTENCY BY implemented domain fronting for your C2 only Digital nomads are a growing community and reprogram the genome in free-living humans, From there we will dive into specific examples Thursday at 14:00 in 101 Track
ABUSING ADVANCED to discover it is ranked low by the content proxy, they need internet safety just like anyone else. malicious exploitation of genomic vulnerabilities of how these different CI implementations have 45 minutes | Demo

AUTHENTICATION which is only allowing access to a handful of Trusted security researchers have warned about will soon be possible on a wide scale. Gerald Steere, Cloud Wrecker,
created vulnerabilities (in one case to a CI vendor
MECHANISMS business related websites on the outside. the dangers of traveling through AirBnB’s. Microsoft
This presentation shows the breathtaking themselves). Last we will explore the tool, its
Heeding their advice, I purchased a HooToo Sean Metcalf , CTO, Trimarc
Saturday at 17:00 in 101 Track
We have all been there, seeing frustrating potential for such hacks, most notably purpose, and a demonstration of its use. This
45 minutes | Demo TM06 travel router to create my own little
proxy denies or triggering security alarms the exquisite targeting precision that the tool takes advantage of the configurations of You know the ins and outs of pivoting
Marina Simakov, Security enclave while I bounce the globe. Being a
making our presence known.Having more genome supports — in effect, population, various components of the build chain to look through your target’s domains. You’ve
researcher, Microsoft researcher myself, I did some double checking.
choices when it comes to outbound network and time — spanning annoyance to for vulnerabilities. It then has the capability to had the KRBTGT hash for months and
Igal Gofman, Security researcher,
Microsoft connectivity helps. In this talk we’ll present a So, I started fuzzing and reverse engineering. organized crime to civilization-ending exploit, persist access, command and control laid everything bare. Or have you?
technique to establish such connectivity with While the TM06 is a cute and versatile little pandemics far worse than Ebola. vulnerable build containers. Most of the
Credentials have always served as a More targets today have some or all of their
the help of HTTP callbacks (webhooks). We device - protection against network threats, it is demonstration will revolve around specific CI
favorite target for advanced attackers, Because humans are poor at responding to less- infrastructure in the cloud. Do you know
will walk you through what webhooks are, not. In this talk, I will take you on my journey products and repositories, however the concepts
since these allow to efficiently traverse a than-immediate threats, and because there is no are applicable across most build systems. The how to follow once the path leads there? Red
how they are used by organizations. We will revealing my methodology for discovering and
network, without using any exploits. marketplace demand for defensive technologies teams and penetration testers need to think
then discuss how you can use approved sites exploiting two memory corruption vulnerabilities. goal here is to encourage further exploration
on the DNA/RNA platform, the hacker community of these exploitation concepts. The tool is built beyond the traditional network boundaries
Moreover, compromising the network might as brokers of your communication, perform The vulnerabilities are severe and while they’ve
has an important role to play in devising and follow the data and services they are
not be sufficient, as attackers strive to data transfers, establish almost realtime been reported to the vendor, they are very “modularly” to facilitate this. If you are new to
revealing data points about the security state thought-experiments to convince policy makers
asynchronous command execution, and even
of such devices. While the device employs some

56 57
Presentations Presentations
after. This talk will focus on how to take POROSITY: A DECOMPILER GAME OF CHROMES: In this talk I will show how such a flaw leads The weakest link in discussions of privacy is party vendors. These terminals have a security
domain access and leverage internal access as FOR BLOCKCHAIN-BASED OWNING THE WEB to full and permanent control over the victim’s the definition of privacy, and the definition of posture that is often not well understood by
a ticket to your target’s cloud deployments. SMART CONTRACTS WITH ZOMBIE CHROME browser, turning the extension into zombie. privacy is not what we think. Buddhists call the retail chains purchasing them. To better
BYTECODE EXTENSIONS Additionally, Shedding more light on the 2016 enlightenment a “nightmare in daylight”, understand if the trust placed in these devices
We will also discuss round trip flights from cloud
Thursday at 12:00 in 101 Track Sunday at 13:00 in 101 Track attacks on Wix and Facebook described in the yet it is enlightenment still, and that kind is warranted, the attack surface and hardening
to on-premises targets and what authorizations 45 minutes | Demo, Tool 45 minutes | Demo
beginning, I will demonstrate how an attacker of clarity is the goal of this presentation. of a commonly deployed credit card terminal
are required to access your target’s cloud Matt Suiche, Founder, Comae Tomer Cohen, R&D Security Team can use similar techniques to distribute her series is reviewed and a discussion of reverse
deployments. While this talk is largely focused Technologies Leader, Wix.com
malicious payload efficiently on to new victims, MS JUST GAVE THE BLUE engineered security APIs is presented. Despite
on Microsoft Azure implementations, the concepts
Ethereum is gaining a significant popularity in On April 16 2016, an army of bots stormed through popular social platforms - creating TEAM TACTICAL NUKES the reduced attack surface of the terminals
can be applied to most cloud providers.
the blockchain community, mainly due to fact upon Wix servers, creating new accounts and the web’s most powerful botnet ever. (AND HOW RED TEAMS and hardened configuration, attacks that
RAGE AGAINST THE that it is design in a way that enables developers publishing shady websites in mass. The attack NEED TO ADAPT) allow recovery of magstripe track data and
WEAPONIZED AI to write decentralized applications (Dapps) and was carried by a malicious Chrome extension, WHEN PRIVACY GOES Saturday at 15:00 in 101 Track PIN codes are demonstrated to be possible.
45 minutes | Demo, Tool
PROPAGANDA MACHINE smart-contract using blockchain technology. installed on tens of thousands of devices, POOF! WHY IT'S GONE AND
NEVER COMING BACK Chris Thompson, Red Team Ops Lead, A NEW ERA OF SSRF
sending HTTP requests simultaneously. This
Friday at 11:00 in 101 Track Ethereum blockchain is a consensus-based IBM X-Force Red
45 minutes | 0025 “Extension Bot” has used Wix websites platform Saturday at 12:00 in Track 2 - EXPLOITING URL
globally executed virtual machine, also 45 minutes | 0025
Windows Defender Advanced Threat Protection
Suggy (AKA Chris Sumner), and Facebook messaging service, to distribute PARSER IN TRENDING
referred as Ethereum Virtual Machine (EVM) by Richard Thieme a.k.a. neuralcowboy will soon be available for all Blue Teams to utilize
Researcher, The Online Privacy itself among users. Two months later, same PROGRAMMING
Foundation implemented its own micro-kernel supporting a within Windows 10 Enterprise, which includes
attackers strike again. This time they used “Get over it!” as Scott McNeeley said - LANGUAGES!
handful number of instructions, its own stack, detection of post breach tools, tactics and
Psychographic targeting and the so called infectious notifications, popping up on Facebook unhelpfully. Only if we understand why it Friday at 12:00 in Track 3
memory and storage. This enables the radical techniques commonly used by Red Teams, as well 45 minutes | Demo, Tool, Exploit
“Weaponized AI Propaganda Machine” have and leading to a malicious Windows-runnable is gone and not coming back do we have a
new concept of distributed applications. as behavior analytics. Combined with Microsoft
been blamed for swaying public opinion in JSE file. Upon clicking, the file ran and installed shot at rethinking what privacy means in a Orange Tsai, Security Consultant
from DEVCORE
recent political campaigns. But how effective Contracts live on the blockchain in an a Chrome extension on the victim’s browser. new context. Thieme goes deep and wide Advanced Threat Analytics for user behavior
are they? Why are people so divided on certain Ethereum-specific binary format (EVM Then the extension used Facebook messaging as he rethinks the place of privacy in the analytics across the Domain, Red Teamers will We propose a new exploit technique that brings a
topics? And what influences their views? bytecode). However, contracts are typically once again to pass itself on to more victims. new social/cultural context and challenges soon face a significantly more challenging time whole-new attack surface to bypass SSRF (Server
This talk presents the results of five studies written in some high-level language such as contemporary discussions to stop using maintaining stealth while performing internal Side Request Forgery) protections. This is a very
Analyzing these attacks, we were amazed by the recon, lateral movement, and privilege escalation
exploring each of these questions. The studies Solidity and then compiled into byte code to 20th century frames. Pictures don’t fit those general attack approach, in which we used in
highly elusive nature of these bots, especially in Windows 10/Active Directory environments.
examined authoritarianism, threat perception, be uploaded on the blockchain. Solidity is a frames, including pictures of “ourselves.” combination with our own fuzzing tool to discover
when it comes to bypassing web-based bot-
personality-targeted advertising and biases contract-oriented, high-level language whose This talk highlights challenges to red teams many 0days in built-in libraries of very widely-
detection systems. This shouldn’t be surprising, We have always known we were cells in a
in relation to support for communication syntax is similar to that of JavaScript.This new posed by Microsoft’s new tools based on used programming languages, including Python,
since legit browser extensions are supposed to body, but we emphasized “cell-ness”. Now
surveillance as a counter-terrorism strategy. paradigm of applications opens the door to common hacking tools/techniques, and covers PHP, Perl, Ruby, Java, JavaScript, Wget and
send Facebook messages, create Wix websites, or we have to emphasize “body-ness” and see
We found that people with an authoritarian many possibilities and opportunities. Blockchain techniques which can be used to bypass, cURL. The root cause of the problem lies in the
in fact perform any action on behalf of the user. ourselves differently. What we see depends
disposition were more likely to be supportive is often referred as secure by design, but now disable, or avoid high severity alerts within inconsistency of URL parsers and URL requesters.
that blockchains can embed applications this On the other hand, smuggling a malicious on the level of abstraction at which we look.
of surveillance, but that those who are less Windows Defender ATP and Microsoft ATA, as Being a very fundamental problem that exists in
raise multiple questions regarding architecture, extension into Google Web Store and distributing The boundaries we imagine around identities,
authoritarian became increasingly supportive well as TTP used against mature organizations built-in libraries, sophisticated web applications
design, attack vectors and patch deployments. it among victims efficiently, like these attackers psyches, private internal spaces,” are violated
of such surveillance the greater they perceived that may have additional controls in place such as WordPress (27% of the Web), vBulletin,
did, is let’s say - not a stroll in the park. in both directions, going in and going out,
the threat of terrorism. Using psychographic As we, reverse engineers, know having access such as Event Log Forwarding and Sysmon. MyBB and GitHub can also suffer, and 0days
But don’t worry, there are other options. by data that, when aggregated, constitutes
targeting we reached Facebook audiences with to source code is often a luxury. Hence, the have been discovered in them via this technique.
“us”. We are known by others more deeply in
significantly different views on surveillance need for an open-source tool like Porosity: Recently, several popular Chrome extensions DOOMED POINT OF SALE This general technique can also adapt to various
recombination from metadata than we know
and demonstrated how tailoring pro and decompiler for EVM bytecode into readable were found to be vulnerable to XSS. Yep, the SYSTEMS code contexts and lead to protocol smuggling
ourselves. We are not who we think we are.
anti-surveillance ads based on authoritarianism Solidity-syntax contracts - to enable static and same old XSS every rookie finds in so many web Saturday at 15:00 in Track 3 and SSRF bypassing. Several scenarios will be
affected return on marketing investment. dynamic analysis of compiled contracts. applications. So browser extensions suffer from To understand privacy - even what we mean by 45 minutes | Demo, Exploit
demonstrated to illustrate how URL parsers
Finally, we show how debunking propaganda it too, and sadly, in their case it can be much “individuals” who want it - requires a contrary trixr4skids, Security Engineer
can be exploited to bypass SSRF protection and
faces big challenges as biases severely limit a deadlier than in regular websites. One noticeable opinion. Privacy is honored in lip service, but not In response to public security breaches many achieve RCE (Remote Code Execution), which
person’s ability to interpret evidence which runs example is the Adobe Acrobat Chrome extension, in the marketplace, where it is violated every retailers have begun efforts to minimize is the case in our GitHub Enterprise demo.
contrary to their beliefs. The results illustrate which was silently installed on January 10 by day. To confront the challenges of technological or completely prevent the transmission of
the effectiveness of psychographic targeting change, we have to know what is happening to Understanding the basics of this technique,
Adobe, on an insane number of 30 million unencrypted credit card data through their the audience won’t be surprised to know that
and the ease with which individuals’ inherent devices. A DOM-based XSS vulnerability in “us” so we can re-imagine what we mean by store networks and point of sale systems.
differences and biases can be exploited. privacy, security, and identity. We can’t say what more than 20 vulnerabilities have been found
the extension (found by Google Project Zero) While this is definitely a great improvement in famous programming languages and web
allowed an attacker to craft a content that we can’t think. We need new language to grasp over the previous state of affairs; it places the
our own new “human nature” that has been applications aforementioned via this technique.
would run Javascript as the extension. security of transactions squarely in the hands
reconstituted from elements like orange juice. of credit card terminals purchased from third

58 59
Presentations Presentations
A PICTURE IS WORTH ARE ALL BSDS ARE THE LAST CTF TALK The panelists represent over 20 years of DEF CON to perform more complex actions. However, VMWare Fusion: EoP via race condition
A THOUSAND WORDS, CREATED EQUALLY? A YOU'LL EVER NEED: AMA CTF organizers. Staples in the CTF community instead of fully reversing this piece of the of insecure scriptIoT, DropCam: EoP via
LITERALLY: DEEP NEURAL SURVEY OF BSD KERNEL WITH 20 YEARS OF DEF are present comprising of decades of experience malware, the talk will focus on an initial triage hijack of binary componentand more!
NETWORKS FOR SOCIAL VULNERABILITIES. CON CAPTURE-THE-FLAG in participating and organizing CTFs. On stage and show how this was sufficient for the
...and 3rd-party auto-update frameworks
STEGO Sunday at 12:00 in Track 2 ORGANIZERS we have past organizers representing Legit BS, creation of a custom C&C server. With such
like Sparkle -yup vulnerable too!
Saturday at 13:00 in Track 4
45 minutes | Demo
Thursday at 16:00 in 101 Track 2 DDTEK, Kenshoto, Ghetto Hackers, and before — a server, we can easily coerce the malware
45 minutes | Tool Ilja van Sprundel, Director of 105 minutes | Hacker History
many of which also participated as part of top to reveal it’s full capabilities. For example, Though root is great, we can’t bypass SIP nor
penetration testing, IOActive load unsigned kexts. However with root, I
Philip Tully, Principal Data Vulc@n, Difensiva Senior Engineer, recurring teams such as Sk3wl of r00t, Ghetto the malware invokes a handful of low-level
Scientist, ZeroFOX DDTEK discovered one could now trigger a ring-0 heap-
In this presentation I start off asking the Hackers, Samurai, and Team Awesome. Many mouse & graphics APIs, passing in a variety
Michael T. Raggo, Chief Security question “How come there are only a handful Hawaii John, CTF organizer, Legit
also played some role (infrastructure, challenge of dynamic parameters. Instead of spending overflow that provides complete system control.
Officer, 802 Secure Business Syndicate
of BSD security kernel bugs advisories released author, announcer) in the Cyber Grand Challenge hours reversing and debugging this complex Though the talk will discuss a variety of
Images, videos and other digital media every year?” and then proceed to try and Chris Eagle, CTF organizer, DDTEK
culminating last summer at DEF CON. They code, via the C&C server, we can simply send discovery mechanisms, 0days, and macOS
provide a convenient and expressive way to look at some data from several sources. It Invisigoth, CTF organizer,
have received and distributed dozens of black it various commands and observe the effects.
Kenshoto exploitation techniques, it won’t be all doom
communicate through social networks. But should come as no surprise that those sources badges. Panelists and the roles they represent Of course this approach hinges on the ability & gloom. We’ll end by discussing ways
such broadcastable and information-rich are fairly limited and somewhat outdated. Caezar, CTF organizer, Ghetto
for this panel: Hawaii John, Legit Business
Hackers to closely observe the malware’s actions. to perform authorized installs/upgrades
content provides ample illicit opportunity as Syndicate; Chris Eagle, DDTEK; Invisigoth,
The presentation then moves on to try and Myles, CTF organizer, Goon As such, we’ll discuss macOS-specific tools that don’t undermine system security.”
well. Web-prevalent image files like JPEGs can Kenshoto; Caezar, Ghetto Hackers; Myles, Goon.
collect some data ourselves. This is done by that can monitor various events, and where
be disguised with foreign data since they’re Today there is practically a year-round CTF circuit, IF YOU GIVE A MOUSE
actively investigating and auditing. Code review, necessary detail the creation of custom ones
perceivably robust to minor pixel and metadata on which teams hone their skills, win prizes OFFENSIVE MALWARE A MICROCHIP... IT WILL
fuzzing, runtime testing on all 3 major BSD (e.g. a ‘mouse sniffer’ that locally observes
alterations. Slipping a covert message into one and attain stature. For many, the ultimate goal ANALYSIS: DISSECTING EXECUTE A PAYLOAD AND
distributions [NetBSD/OpenBSD/FreeBSD]. and decodes commands sent from the malware
of the billions of daily posted images may be is to dominate in the utmost competition, DEF OSX/FRUITFLY VIA A CHEAT AT YOUR HIGH-
This is done by first investigating what would to the OS, in order to control the mouse).
possible, but to what extent can steganography CON’s CTF, and walk away with a coveted black CUSTOM C&C SERVER STAKES VIDEO GAME
be good places where the bugs might be. Once
be systematically automated and scaled? badge. Capture-the-Flag (CTF) is one of DEF Friday at 10:20 in 101 Track While some of this talk is FruitFly and/ TOURNAMENT
determined, a detailed review is performed of
To explore this, we first report the distorting CON’s oldest contests, dating back to DEF CON 20 minutes | Demo, Tool
or macOS specific, conceptually it should Saturday at 11:00 in Track 3
these places. Samples and demos will be shown.
side effects rendered upon images uploaded to 4. Over the past decades, the perennial contest Patrick Wardle, Chief Security broadly apply to analyzing other malware, 45 minutes | Demo
Researcher, Synack / Creator of
I end the presentation with some results and has matured into an annual event requiring even on other operating systems :) skud (Mark Williams), Embedded
popular social network servers, e.g. compression, Objective-See
conclusions. I will list what the outcome was months of preparation and nearly continuous Software Engineer
resizing, format conversion, and metadata Creating a custom command and control
in terms of bugs found, and who -based on dedication both of players and organizers. DEATH BY 1000 Sky (Rob Stanley), Security
stripping. Then, we build a convolutional neural (C&C) server for someone else’s malware Software Engineer, Lead
the data I now have- among the 3 main BSD Organizers strive to make the events unique INSTALLERS; ON MACOS,
network that learns to reverse engineer these has a myriad of benefits. If you can take
distributions can be seen as the clear winner while taking extreme measures to prevent games IT'S ALL BROKEN! The International, a recent esports tournament,
transformations by optimizing hidden data over it a domain, you then may able to
and loser. I will go into detail about the code from being gamed. Participants often have to Friday at 14:00 in Track 2 had a 20 million dollar prize pool with over
throughput capacity. From pre-uploaded and fully hijack other hackers’ infected hosts. A 45 minutes | Demo, Exploit
quality observed and give some pointers on cope with novel challenges while simultaneously five million people tuned in to the final match.
downloaded image files, the network learns more prosaic benefit is expediting analysis. Patrick Wardle, Chief Security
how to improve some code. Lastly I will try and demonstrating continued excellence in domains The high stakes environment at tournaments
to locate candidate metadata and pixels that While hackers and governments may be Researcher, Synack
answer the question I set out to answer (“How like reverse engineering, vulnerability discovery, creates an incentive for players to cheat for a
are least modifiable during transit, allowing more interested in the former, malware Ever get an uneasy feeling when an installer
come there are only a handful of BSD security exploitation, digital forensics, cryptography, and competitive advantage. Cheaters are always
stored hidden payloads to be reliably recalled analysts can benefit from the later. asks for your password? Well, your gut was right!
kernel bugs advisories released every year?”). network security. In this session, we will present finding new ways to modify software, from
from newly presented images. Deep learning The majority of macOS installers & updaters are
typically requires tons of training data to avoid the evolution of DEF CON CTF, highlighting FruitFly, the first OS X/macOS malware of 2017, attempting to sneak executables in on flash
key points of advancement in the CTF culture is a rather intriguing specimen. Selectively vulnerable to a wide range of priv-esc attacks. drives, to using cheats stored in Steam’s online
over fitting. But data acquisition is trivial using
social networks’ free image hosting services, - most of which broke new ground and are targeting biomedical research institutions, it It began with the discovery that Apple’s workshop which bypasses IP restrictions.
which feature bulk uploads and downloads of now present in other contests run around the is thought to have flown under the radar for OS updater could be abused to bypass SIP This presentation describes how one can
thousands of images at a time per album. world. Capitalizing on the multi-year tenure of many years. In this talk, we’ll focus on the (CVE-2017-6974). Next, turns out Apple’s core circumvent existing security controls to sneak a
recent DEF CON CTF organizers, we are able to ‘B’ variant of FruitFly that even now, is only installer app may be subverted to load unsigned
We show that hidden data can be predictably payload (game cheat) onto a target computer.
concisely represent over 20 years of organizers detected by a handful of security products. dylibs which may elevate privileges to root.
transmitted through social network images Esports tournaments typically allow players to
on a single panel. Where else can you ask
with high fidelity. Our results demonstrate that We’ll begin by analyzing the malware’s dropper, And what about 3rd-party installers? provide their own mouse and keyboard, as these
cross-generational questions about challenges
AI can hide data in plain sight, at large-scale, an obfuscated perl script. As this language I looked at what’s installed on my players prefer to use specific devices or may be
of running CTF? Where else can you inquire
beyond human visual discernment, and despite is rather archaic and uncommon in malware Mac, and ahhh, so many bugs! obligated to use a sponsor branded device. These
about evolutionary design, and get answers
third-party manipulation. Steganalysis and droppers, we’ll discuss some debugging “simple” USB input devices can still be used to
from those that actually did it? Where else Firewall, Little Snitch: EoP via race condition
other defensive forensic countermeasures techniques and fully deconstruct the script. execute complex commands on a computer via
can you ask about hidden challenges, secrets, of insecure plistAnti-Virus, Sophos: EoP via
are notoriously difficult, and our exfiltration the USB Human Interface Device (HID) protocol.
and CTF lore...from whom it originated? While this dropper component also communicates hijack of binary component Browser, Google
techniques highlight the growing threat posed with the C&C server and supports some basic Chrome: EoP via script hijackVirtualization, Our attack vector is a mouse with an ARM Cortex
by automated, AI-powered red teaming. commands, it drops a binary payload in order M series processor. The microcontroller stores

60 61
Presentations Presentations
custom user profiles in flash memory, allowing well-defended target, but also demonstrates, the case. They incorrectly assume that their We’ll learn about the different disciplines of ALL YOUR THINGS ARE
the mouse to retain user settings between in a hopefully fun and practical way, how services will be protected by the same-origin program analysis (and learn strange terms BELONG TO US
multiple computers. We modify the device’s these techniques work, their advantages, policy in browsers, rather than implementing such as static, dynamic, symbolic, and abstract), Saturday at 11:20 in Track 4
In this talk, we will share some kernel
firmware to execute a payload delivery program, disadvantages, and possible future proper authentication mechanisms. By abusing understand the strength and drawbacks of each, 75 minutes | Demo, Exploit debugging techniques and their corresponding
stored in free space in flash memory, before developments. It also gives details of real case this implicit trust we can gain access to and see if, and to what extent, they are used Zenofex, Hacker tricks on the latest iOS/macOS. In addition,
returning the mouse to its original functionality. studies where some of these techniques have confidential data and internal services which in the course of actual vulnerability analysis. 0x00string, Hacker we will also introduce the new kernel heap
Retaining original functionality allows the mouse been used, and provides defenders with realistic are not intended to be publicly accessible. mitigation mechanisms on iOS 10/macOS
CJ_000, Hacker
Did you know that every finalist system in the 10.12 and two heap feng shui techniques to
to be used discreetly, as it is an “expected” methods for the mitigation of these attacks.
I will demonstrate that this is a poor security Cyber Grand Challenge used a combination of Maximus64, Hacker
bypass them. Finally, we will demonstrate how
device at these tournaments. This concept applies Finally, the talk covers some ideas control and can be trivially bypassed via an older dynamic analysis and symbolic execution to find Get out your rollerblades, plug in your camo to debug a concrete kernel heap overflow bug
to any USB device that uses this processor, and for future research in this area. technique, DNS rebinding. The talk will cover how vulnerabilities, but used static analysis to patch keyboard, and fire up your BLT drive. It’s and then leverage our new heap feng shui
does not require obvious physical modifications. DNS rebinding works, the mitigations imposed them? Why is that? Did you know that, to make 25 years later and we’re still hacking the techniques to gain arbitrary kernel memory
This delivery method has tradeoffs. Our ASSEMBLY LANGUAGE IS by modern browsers and networks, and how the contest feasible for modern program analysis planet. The Exploitee.rs are back with new read/write on the iOS 10.2/macOS 10.12.
exploit is observable, as windows are created TOO HIGH LEVEL each mitigation can be bypassed. I will discuss techniques, the CGC enforced a drastically- 0day, new exploits and more fun. Celebrating
and in focus during payload delivery. Friday at 15:00 in 101 Track the notorious unreliability of DNS rebinding simplified OS model? What does this mean for a quarter century of DEF CON the best way "GHOST TELEPHONIST"
45 minutes | Demo, Tool, Exploit
The advantage to this approach is that it attacks that causes many developers to ignore you, if you want to use program analysis while we know how: hacking everything! IMPERSONATES YOU
XlogicX, Machine Hacker
bypasses other security measures that are the issue and how to overcome this unreliability. finding vulns and collecting bug bounties? Come THROUGH LTE CSFB
commonly in place, such as filtered internet Do you have a collection of vulnerable programs to this talk, become an expert, and go on to Our presentation will showcase vulnerabilities Sunday at 11:00 in Track 4
Finally, I will examine a variety of popular discovered during our research into thousands of
traffic and disabled USB mass storage. that you have not yet been able to exploit? There services and tools to understand how they are contribute to the future of program analysis! 45 minutes | Exploit

may yet still be hope. This talk will show you how dollars of IoT gear performed exclusively for DEF Yuwei Zheng, Hacker
affected by DNS rebinding. I will be releasing CON. We will be releasing all the vulnerabilities
SEE NO EVIL, HEAR NO to look deeper (lower level). If you’ve ever heard CITL AND THE DIGITAL Lin Huang, Hacker
a tool that allows researchers to automate DNS during the presentation as 0days to give
EVIL: HACKING INVISIBLY experts say how x86 assembly language is just STANDARD - A YEAR LATER
rebinding attacks, the associated mitigation attendees the ability to go home and unlock their One vulnerability in CSFB (Circuit Switched
AND SILENTLY WITH LIGHT a one-to-one relationship to its machine-code, Friday at 12:00 in 101 Track
bypasses and generate drop-dead simple proof- 45 minutes | Art of Defense hardware prior to patches being released. As Fallback) in 4G LTE network will be presented. In
AND SOUND then we need to have a talk. This is that talk; of-concept exploits. I will demonstrate this tool by Sarah Zatko, Chief Scientist, always, to give back to the community that has the CSFB procedure, we found the authentication
Thursday at 14:00 in 101 Track 2 gruesome detail on how an assembly instruction developing exploits for each vulnerable service, step is missing. This results in that an attacker
45 minutes | Demo, Tool
can have multiple valid representations in
Cyber ITL given us so much, we will be handing out free
Matt Wixey, Senior Associate, PwC ending the talk by exploiting a vulnerable A year ago, Mudge and I introduced the non- hardware during the presentation so you can can hijack the victim’s communication. We
machine-code and vice versa. You can also just service to obtain remote-code execution, live. named this attack as ‘Ghost Telephonist’.
take my word for it, ignore the details like a profit Cyber ITL at DEF CON and its approach hack all the things too!Come party with us while
Traditional techniques for C2 channels, Several exploitations can be made based on
bro, and use the tool that will be released for to automated software safety analysis. Now, we make “All Your Things Are Belong To Us.”
exfiltration, surveillance, and exploitation are 25 YEARS OF PROGRAM this vulnerability. When the call or SMS is not
often frustrated by the growing sophistication this talk: the Interactive Redundant Assembler we’ll be covering highlights from the past
ANALYSIS MACOS/IOS KERNEL encrypted, or weakly encrypted, the attacker
and prevalence of security protections, (irasm). You can just copy the alternate machine year’s research findings, including our in-
Sunday at 15:00 in 101 Track
depth analysis of several different operating DEBUGGING AND HEAP can impersonate the victim to receive the
monitoring solutions, and controls. Whilst code from the tool and use it in other tools like 45 minutes | Hacker History, Demo
“Mobile Terminated” calls and messages or
systems, browsers, and IoT products. FENG SHUI
all is definitely not lost, from an attacker’s mona, use it to give yourself more options for Zardus (Yan Shoshitaishvili),
Friday at 10:00 in 101 Track to initiate the “Mobile Originated” calls and
perspective - we constantly see examples self-modifying code, fork Hydan (stego) and give Assitant Professor, Arizona State
Parts of our methodologies have now been 20 minutes
messages. Furthermore, Telephonist Attack can
University
of attackers creatively bypassing such it more variety, or to create peace on earth. adopted by Consumer Reports and rolled into Min(Spark) Zheng, Security Expert obtain the victim’s phone number and then use
protections - it is always beneficial to have Last year, DARPA hosted the Cyber Grand their Digital Standard for evaluating safety, @ Alibaba Inc. Ph.D of CUHK.
the phone number to make advanced attack,
more weapons in one’s arsenal, particularly THERE'S NO PLACE LIKE Challenge, the culmination of humanity’s security, and privacy, in a range of consumer Xiangyu Liu, Security Engineer @ e.g. breaking Internet online accounts. These
when coming up against heavily-defended 127.0.0.1 - ACHIEVING research into autonomous detection, exploitation, devices. The standard defines important Alibaba Inc. Ph.D of CUHK.
attacks can randomly choose victims, or target
networks and highly-secured environments. RELIABLE DNS REBINDING and mitigation of software vulnerabilities. consumer values that must be addressed in Kernel bug is always very difficult to reproduce a given victim. We verified these attack with our
IN MODERN BROWSERS Imagine the CGC from the outside: huge racks product development, with the goal of enabling and may lead to the entire system panic and
This talk demonstrates a number of techniques own phones in operators’ network in a small
Thursday at 10:00 in 101 Track of servers battling it out on stage, throwing consumer organizations to test, evaluate, restart. In practice, kernel debugging is the
and attacks which leverage light and/or 45 minutes | Demo, Tool, Exploit controllable scale. The experiments proved the
exploit after exploit at each other while humans and report on whether new products protect only way to analyze panic scenes. However,
sound, using off-the-shelf hardware. It covers vulnerability really exists. The attack doesn’t
Luke Young, Senior Information watch helplessly from the sidelines. But that consumer security, safety, and privacy. implementing such a technique in real world is
everything from C2 channels and exfiltration Security Engineer, LinkedIn need fake base station so the attack cost is low.
vantage point misses the program analysis not an easy task since kernel code cannot be
using light and near-ultrasonic sound, to Most people lock their doors at night, however The victim doesn’t sense being attacked since
methods used, the subtle trade-offs made, executed in the debugger, thus is hard to be
disabling and disrupting motion detectors; if you walk into someone’s home you likely no fake base station and no cell re-selection.
and the actual capabilities of these systems. It tracked. Luckily, macOS has provided a very
from laser microphones, to repelling drones; won’t find every piece of furniture bolted to Now we are collaborating with operators and
also misses why, outside of the controlled CGC powerful kernel debugging mechanism, KDK
from trolling friends, to jamming speech the floor as well. We trust that if someone is terminal manufactures to fix this vulnerability.
environment, most automated techniques don’t (Kernel Development Kit), to assist people to
and demotivating malware analysts. inside our home they are supposed to be there. quite scale to the analysis of real-world software! analyze and develop kernel exploits. While
This talk not only provides attendees with a Unfortunately many developers treat local
This talk will provide a better perspective. On for iOS, although there is no official kernel
new suite of techniques and methodologies networks just the same, assuming all internal
the 25th anniversary of DEFCON, we will go debugger, it is also possible for us to achieve
to consider when coming up against a HTTP traffic is trusted, however this is not always
through these last 25 years of program analysis. kernel debugging by leveraging some tricks.

62 63
Presentations workshops
WORKSHOP REGISTRATION WAS HELD ONLINE JULY 5TH. THERE
IS NO ONSITE REGISTRATION, SIGNUP SHEET, AND ALL SEATS
(INCLUDING STANDBY) ARE SOLD OUT. FOR MORE INFO ON THE
WORKSHOPS VISIT THE DEF CON WEBSITE. PRE-REGISTRATION
WILL BE ONLINE AGAIN FOR DEF CON 26!
THURSDAY
octavius 1 octavius 4 octavius 5 octavius 6 octavius 7

14:30-18:30 10:30-14:30
Attacking Active Building Build Your Stack
Directory and Application Introduction to With Scapy, For
A B C of Hunting Advanced Methods Security Cryptographic Fun and Profit
of Defense Automation with Attacks
Julian Dana Python John W. Garrett
Adam Steed & Matt Cheung & João Pena Gil
Andrew Allen Abhay Bhargav (Jack64)

Introduction SDR Crash Course:

Malware Triage:
Brainwashing Attacking and to Practical Hacking Your Way
Malscripts Are
Embedded Systems Defending Network Signature to For Fun and
The New Exploit
802.11ac Networks Development for Profit
Kit
Craig Young, Lane Open Source IDS
Thames, & Tyler Vivek Neel Pandeya,
Sergei Frankoff &
Reguly Ramachandran Jack Mott & Jason Nate Temple, Wan
Sean Wilson
Williams Liu

FRIDAY
octavius 1 octavius 4 octavius 5 octavius 6 octavius 7

14:30-18:30 10:30-14:30
Scanning the Applied Physical
Airwaves: Attacks on
Linux Lockdown:
Building a Cheap Introduction to Mobile App Attack Embedded Systems,
ModSecurity and
Trunked Radio/ x86 Disassembly 2.0 Introductory
AppArmor
Pager Scanning Version
System Dazzle Cat Duo Sneha Rajguru
Jay Beale
Joe FitzPatrick &
Richard Henderson Syler Clayton

Penetration
Industrial
Testing in
Subverting Control System Advanced Wireless
Hostile Windows – The
Privacy Security 101 and Attacks Against
Environments: Undiscovered
Exploitation 201 Enterprise
Client & Tester Country
Using HTTP Networks
Security
Matthew E.
Chuck Easttom
Eijah Luallen & Eric Gabriel Ryan
Wesley McGrew &
Persson
Brad Pierce

SATURDAY
octavius 1 octavius 4 octavius 5 octavius 6 octavius 7
14:30-18:30 10:30-14:30

Free and Easy

Practical BLE DFIR Triage for
Practical Malware
Exploitation Edge Cases in Web Everyone: From
UAC 0day, all day! Analysis: Hands-
for Internet of Hacking Collection to
On
Things Analysis
Ruben Boonen
John Poulin
Sam Bowne
Aditya Gupta Alan Orlikoski &
Dan M

Windows Post- Harnessing the

Hacking Network Principals on
Exploitation/ Power of Docker
Protocols using Leveraging Pwning Machine
Malware Forward and Kubernetes to
Kali PowerShell for Learning Systems
Engineering Supercharge Your
Red Teams
Hacking Tactics
Thomas Wilhelm & Clarence Chio
Sean Dillon &
John Spearing Carlos Perez
Zachary Harding Anshuman Bhartiya

64 65
 -Demo labs-
ANDROID TAMER 4. Finding PII data and Credit Card Track Data from memory Offense, Mobile, Hardware EAPHAMMER
Saturday from 1000-1150 at Table Three Saturday from 1600-1750 at Table Five
5. Browser credentials https://crack.sh/
Anant Shrivastava Gabriel Ryan
It will iterate and continue to test and exploit the
Android Tamer is a project to provide various resources for Android mobile CRACKMAPEXEC EAPHammer is a toolkit for performing targeted evil twin attacks
systems until all hosts are compromised. Saturday from 1400-1550 at Table Three
application and device security reviews. Be it pentesting, malware analysis, against WPA2-Enterprise networks. It is designed to be used in
reverse engineering or device assessment. We strive to solve some of the Another useful feature is for attackers who want to find the right credentials Marcello Salvati full scope wireless assessments and red team engagements. As
major pain points in setting up the testing environments by providing in order to access a certain folder under the shares on the host. such, focus is placed on providing an easy-to-use interface that can
Ever needed to pentest a network with 10 gazillion hosts with a very
various ways and means to perform the task in most effortless manner. For example, \\host1\share\private limited time frame? Ever wanted to Mimikatz entire subnets? How be leveraged to execute powerful wireless attacks with minimal
about shelling entire subnets? How about dumping SAM hashes ? Share manual configuration. To illustrate how fast this tool is, here’s an
Mobile (specifically Android) You might have the account that allows you to access \\host1\share but
spidering? Keeping track of all the credentials you pillaged? (The list example of how to setup and execute a credential stealing evil twin
https://androidtamer.com/ you do not know which account you need to access \\host1\share\private.
goes on!) And doing all of this in the stealthiest way possible? Well look attack against a WPA2-TTLS network in just two commands:
Using the credentials the tool has captured and no further than CrackMapExec! CrackMapExec (a.k.a CME) is a modular
BROPY # generate certificates
finds the ‘right key’ to the lock. post-exploitation tool written in Python that helps automate assessing
Saturday from 1400-1550 at Table Five
the security of *large* Active Directory networks. Built with stealth in ./eaphammer --cert-wizard
Matt Domko
It is possible to disable any of the options (e.g. no
memory search of PAN numbers) so to add a random mind, CME follows the concept of “Living off the Land”: abusing built-in # launch attack
Provides simple anomaly based IDS capabilities using Bro. Bropy parses delay to its operations so as to remain stealth. Active Directory features/protocols to achieve it’s functionality and
./eaphammer -i wlan0 --channel 4 --auth ttls --wpa 2 --essid CorpWifi --creds
logs to generate network baselines using a simple Y/N interface, and the allowing it to evade most endpoint protection, IDS and IPS solutions.
accompanying bro script generates logs for traffic outside of the baseline. We are planning to allow users to develop modules/plugins and Features:
Although meant to be used primarily for offensive purposes, CME
encourage development so that its feature set can be extended.
https://github.com/hashtagcyber/bropy can be used by blue teams as well to assess account privileges, find * Steal RADIUS credentials from WPA-EAP and WPA2-EAP networks.
Offense misconfigurations and simulate attack scenarios. In this demo the author
will be showing off v4.0, a major update to the tool bringing more * Perform hostile portal attacks to steal AD creds
BULLDOZER
CELLANALYSIS feature and capabilities than ever before! If you are interested in the and perform indirect wireless pivots
Saturday from 1400-1550 at Table Two

Keith Lee
Saturday from 1600-1750 at Table Three latest and greatest Active Directory attacks/techniques, weaponizing * Perform captive portal attacks
Pedro Cabrera them at scale and general cool AD stuff this is the demo for you!
The tool allows you to supply a username and password that * Built-in Responder integration
you have captured and cracked from Responder or other sources CellAnalysis is one more tool to be added to the pentester arsenal. Network Defense and Offense
Nowadays we can find other tools intended to find fake cells, most of them * Support for Open networks and WPA-EAP/WPA2-EAP
as well as an IP ranges, subnet or list of IP addresses. https://github.com/byt3bl33d3r/CrackMapExec
use active monitoring; that is, they monitor traffic coming to the SIM card on * No manual configuration necessary for most attacks.
The tool finds its way around the network and attempts to gain a smart phone, so that only cell attacks are scanned on the same network
access into the hosts, finds and dumps the passwords/hashes,
CRYPT-KEEPER * No manual configuration necessary for installation and setup process
as the SIM card. CellAnalysis offers a different vision, it performs a passive Saturday from 1400-1550 at Table Four
resuses them to compromise other hosts in the network. traffic monitoring, so it does not require a SIM card or a mobile device, Offensive security professionals, red teamers,
Maurice Carey
Below are some of the places the tools look for hashes/passwords simply a OsmocomBB phone or compatible device SDR (rtlsdr, usrp, hackrf penetration testers, researchers.
or bladerf) to start monitoring all the frequencies of the GSM spectrum. Crypt-Keeper is a service for securely exchanging files.
1. SYSVOL https://github.com/s0lst1c3/eaphammer
Defensive and mobile security Equipment Requirements (Network Needs, Displays, etc): A
2. File Shares display or protector would be great. The app will be running FUZZAPI
http://www.fakebts.com/
3. Memory on AWS, so a network connection will be needed as well. Saturday from 1000-1150 at Table One

Abhijeth Dugginapeddi
4. Tokens (Incognito) HTTPS://CRACK.SH/ Anyone who wants to run a service to securely exchange files.
Saturday from 1200-1350 at Table Two Lalith Rallabhandi
5. MSSQL service credentials https://github.com/mauricecarey/crypt-keeper Srinivas Rao
David Hulton
6. Unattend.xml, sysprep.xml, sysprep.inf DNS-EXFIL-SUITE Fuzzapi is a REST API pen testing tool that automatically does a
Ian FosterCracking DES has been doable for state actors for the past few
It will also exploit the Domain Controller if it’s decades, but most people don’t have access to a supercomputer or $100k Saturday from 1600-1750 at Table Two bunch of checks for vulnerabilities on your APIs. Rather than a tool
vulnerable to MS14-069 and dump the hashes. of dedicated hardware laying around. In 2012, Moxie Marlinspike and Nolan Berry that only identifies vulnerabilities in web services, we have built a
David Hulton released a service for Cloudcracker.com to provide this to platform that enables everyone to test and understand a large range
Pillaging the Corporate Network Cory SchwartzOur tool kit provides multiple methods of data exfiltration,
the masses for 100% success rate cracking of MSCHAPv2 (PPTP VPNs & of API vulnerabilities that exist in both web and mobile applications.
infiltration and botnet command and control systems using 100%
The tool will also attempt to ‘rob’ the shares and WPA-Enterprise). Since then Cloudcracker.com has vanished, but ToorCon After seeing the benefits of Automating REST API pen testing using a
DNS traffic that is either hard to detect or impossible to detect.
hosts of the sensitive data/information. has taken over and released https://crack.sh, with added features basic Fuzzapi tool, the authors have decided to come up with a better
for cracking MSCHAPv1 (Windows Lanman/NTLMv1 login), Kerberos I think the best audience here would be PenTesters, DNS Engineers version which can automatically look into vulnerabilities in APIs from
1. Finding files whose filename have the word ‘password’ in it
Authentication, and a general purpose interface for cracking other systems and people looking to learn more about DNS based attack methods. the time they are written. REST APIs are often one of the main sources
2. Dump Wireless. WinVNC, UltraVNC, Putty, SNMP, that still use DES. We will also be releasing a free real-time service for of vulnerabilities in most web/mobile applications. Developers quite
https://github.com/ndberry/DNS_Exfil_Tool
Windows AutoLogon, Firefox Stored credentials, cracking DES (in ~3 seconds) with chosen-plaintext, providing a full break commonly make mistakes in defining permissions on various cross-
3. Find KeePass Databases, FileZilla sitemanger.xml, Apache of Windows Lanman/NTLMv1 authentication and allow people to test their platform APIs. This gives a chance for the attackers to abuse these APIs
Httpd.conf, and etc. if they contain credentials. devices to see if they’re doing proper WPA-Enteprise certificate checking. for vulnerabilities. Fuzzapi is a tool written in Ruby on Rails which helps
to quickly identify such commonly found vulnerabilities in APIs which

66 67
 -Demo labs-
helps developers to fix them earlier in SDLC life cycle. The first released Add on boards, known as neighbors, allow us to build on the LAMMA 1.0 MYCROFT
version of the tool only has limited functionalities however, the authors flexibility of GreatFET and rapidly create new tools. Example Saturday from 1200-1350 at Table One Saturday from 1400-1550 at Table One
are currently working on releasing the next version which will completely neighbors include radio platforms, software defined infrared Antriksh Shah Joshua Montgomery
automate the process which saves a lot of time and resources. transceivers, and interfaces for hardware hacking.
Ajit HattiLast year we released LAMMA Beta at DEFCON, this year we Mycroft is an open source virtual assistant similar to Siri or Amazon
AppSec, Web/Mobile Developers, DevOps Hardware & Offense are bringing the updated version of LAMMA with new modules for Alexa. The technology stack allows developers to include a voice
https://www.youtube.com/watch?v=43G_nSTdxLk&t=321s Hardware: https://github.com/greatscottgadgets/greatfet BlockChain Security Testing, auditing Trust stores, enhanced checks interface in anything from a Raspberry Pi to a Jaguar FTYPE sports car.
for source code analysis and logical flaws in crypto-coding.
Software/firmware: https://github.com/dominicgs/GreatFET-experimental Mycroft integrates Speech-To-Text, Natural Language
GIBBERSENSE LAMMA 1.0 with new features & fixes makes crypto-testing more Processing, a Skill Framework and a Speech To Text engine
Saturday from 1000-1150 at Table Two
GUMBLER effective and smoother even for large scale implementations. You can into a single, easy to deploy software stack.
Ajit Hatti Sunday from 1200-1350 at Table Two use and enhance LAMMA 1.0, as it’s a FREE and OPEN SOURCE. Though the technology runs anywhere. The company has developed
On your forensics and investigation assignment found a Gibberish string Willis Vandevanter Cryptologist, crypt analysts, developers and testers, a Raspberry Pi image ( Pi-Croft ) and recently deployed a Gnome
or unknown file and dont know what is it? Throw it to GibberSense, it Block Chain and PKI Implements. Shell Extension. The company also has a hardware device the
The tool searches the entire commit history of a Git project for secrets
might try to make some sense out of it. Not sure if a file is encrypted, “Mark I” that comes pre-loaded with the software and includes
and files. This is a different approach from other tools which focus http://www.securitymonx.com/products/lamma
encoded or obfuscated using substitution ciphers? Gibbersense can a variety of I/O options for directly controlling devices.
on the current revision. It’s excellent at digging up API keys, deleted
give you statistical analysis of the contents and gives you direction for usernames and passwords or files that are now cloaked from .gitignore. LEVIATHAN FRAMEWORK Hardware, IoT, Automotive, AI, Everyone
further investigation and also gives you an excellent visualization.
Sunday from 1000-1150 at Table Four
Offense, AppSec http://mycroft.ai/
Being an extensible framework, Gibbersense gives tools for Utku Sen
simple xor encryption, frequency analysis, which gives basic https://github.com/BuffaloWill/gumbler
Ozge Barbaros PCILEECH
cryptanalysis capabilities. An Open Source Initiative GibberSense
is an experimental tool for improving investigations. HI-JACK-2FACTOR Leviathan is a mass audit toolkit which has wide range service Sunday from 1200-1350 at Table Three

Sunday from 1000-1150 at Table Six discovery, brute force, SQL injection detection and running custom Ulf Frisk
Cryptologers, crypt analysts, forensic investigators, developers and testers. exploit capabilities. It consists open source tools such masscan, ncrack,
Weston Hecker Total physical pwnage and plenty of live demos in this action packed Demo
https://github.com/smxlabs/gibbersense dsss and gives you the flexibility of using them with a combination. Lab! The PCILeech direct memory access attack toolkit was presented
There are several attacks being performed on PKES Passive key
entry systems on cars. Several high profile talks this year are about The main goal of this project is auditing as many system at DEF CON 24 and quickly became popular amongst red teamers and
GOFETCH stealing cars using 11 Dollar SDR and cheap devices to relay the as possible in country-wide or in a wide IP range. governments alike. A year later major operating systems are still vulnerable
Sunday from 1000-1150 at Table Three
signals from the keyfob to the immobilizer: I will be demoing a by default. I will demonstrate how to take total control of Linux, Windows
Red teamers, penetration testers (Offensive)
Tal Maor
device that I made using an ardunio and a 433/315 Mhz Radio and macOS by PCIe DMA code injection. Kernels will be subverted, full
GoFetch is a tool to automatically exercise an attack and a 2.4GHZ wireless antenna They cost about 12 dollars to make Github page: https://github.com/leviathan-framework/leviathan disk encryption defeated, file systems mounted and shells spawned! All
plan generated by the BloodHound application. and basically add two factor authentication to your vehicle. A blog post about it’s custom exploit feature: this by using affordable hardware and the open source PCILeech toolkit.
The tool first loads a path of local admin users and computers generated Into long explanation https://www.utkusen.com/blog/wide-range-detection- http://github.com/ufrisk/pcileechPIV
by BloodHound and convert it to its own attack plan format. of-doublepulsar-implants-with-leviathan.html
so key fobs in the USA use 315Mhz or 433Mhz which in several of the OPACITY
Once the attack plan is ready, it advances towards the destination attack performed this year and in the past people are relaying the Saturday from 1000-1150 at Table Six
according to the plan, step by step by successively apply remote input and output of key fobs to start vehicles. My device interrupts MALTEGO "HAVE I BEEN PWNED?"
Saturday from 1000-1150 at Table Five Christopher Williams
code execution techniques and compromising credentials all 433mhz and 315 mhz preamble information for a 1 foot radius.
with Invoke-Mimikatz, Mimikatz and Invoke-Psexec. and waits for a unscrambled range 2.4 Ghz Bluetooth device to come Christian Heinrich OPACITY is a fast, lightweight asymmetric encryption protocol, adopted as
into range. with a 4 digit pin it will shut down the scrambles blocking “Have I been pwned?” allows you to search across multiple an open standard by NIST, ANSI, and Global Platform. OPACITY, originally
Enterprise, Applied Security, Windows domain, Defense and offense designed for payment and identity applications, provides a method for
the 433/315 respectively. this also works on older RFID enabled keys data breaches to see if your email addresses or aliases
A video of the Python version was published here: https:// made in the late 90s early 2000s. I will be demoing the device and has been compromised by LinkedIn, Tumblr, etc securing the NFC channel of low power devices with embedded secure
www.youtube.com/watch?v=dPsLVE0R1Tg all the plans will be released opensource MIT licence. in a nutshell hardware, such as smart cards. I will show an Android demonstration
Maltego is a link analysis application of technical infrastructure and/or leveraging this open standard, as defined in NIST SP 800-73-4, to securely
A video of Invoke-GoFetch will be published soon. it is two factor authentication for most cars for 12 dollars in parts.
social media networks from disparate sources of Open Source INTelligence produce derived credentials and provide flexible and private authentication.
This will also include a demo of the relay attack being performed
BloodHound Application - https://github.com/BloodHoundAD/BloodHound (OSINT). Maltego is listed on the Top 10 Security Tools for Kali Linux by While this demo is designed to showcase the Federal PIV standard, the
on Demo ECU and immobilizer and how the device blocks it.
Network World and Top 125 Network Security Tools by the Nmap Project. OPACITY algorithm and concepts are broadly applicable to provide secure
GREATFET Offense, Defense, Hardware transactions in IoT, biohacking, and other low power embedded systems.
The integration of “Have I been pwned?” with Maltego
Saturday from 1200-1350 at Table Three
https://eprint.iacr.org/2010/332.pdf visualises these breaches in an easy to understand graph Authentication, Mobile, Embedded Security, Biohacking
Dominic Spill
This was the 2009 research. format that can be enriched with other sources.
Michael Ossmann https://youtu.be/ftn8-Cth554
Here is the modern 2017 version https://www.wired. Defense
GreatFET is an open source hardware hacking platform. In
com/2017/04/just-pair-11-radio-gadgets-can-steal-car/ https://github.com/cmlh/Maltego-haveibeenpwned
addition to support for common protocols such as SPI, USB,
JTAG, and UART, GreatFET also allows us to implement arbitray
protocols, as well as GPIO and acting as a logic analyser.

68 69
 -Demo labs-
PROBESPY SAMYKAM dark tools that are used by every red team. We’ll release the required Yep, you can have that too. We’re excited to offer Vapor Trail to you,
Sunday from 1000-1150 at Table One Saturday from 1200-1350 at Table Five framework for getting the data where it needs to be, the technical add- the first FM radio data exfiltration tool. Sure, HAM radio folks have
stumblebot Salvador Mendoza ons to ensure this data is ingested in usable formats, and dashboards had digital modes for years, but we’ve done better AND cheaper.
for Spunk to leverage this data for mass pawnage of your target! We’ve effectively created our own RF digital mode for pwnage, HAM
Probespy is a dumb and dirty tool for analyzing directed and SamyKam is a new project to pentest mag-stripe information designed
radio data transfer and redundant communication methods.
broadcast probe request data sent by wifi client devices. It using the Samy Kamkar’s MagSpoof as base but in this case for Raspberry TRUESEEING: EFFECTIVE DATAFLOW
assists in locating where wireless client devices have been Pi integration. SamyKam is a portable hardware where the user can Why? Because we can. We want to go undetected with current capabilities.
ANALYSIS OVER DALVIK OPCODES
(geolocation) and creating behavioral profiles of the person(s) interact with it directly on the ssh, OLED, phone or browser to test Sunday from 1000-1150 at Table Two
Turns out, our approach is quite novel for pulling data right from a
owning the device via the identification of known SSIDs. magnetic card readers or tokenization processes with prepared attacks. network via pcaps or tool output.Offense, Defense, Hardware
Takahiro Yoshimura (alterakey)
offense/recon/surveillance Offense/Defense/Hardware Ken-ya Yoshimura (ad3liae) http://vaportrail.io/
https://github.com/stumblebot/probespy https://salmg.net/2017/01/16/samykam/ Trueseeing is an automatic vulnerability scanner for Android apps. It WIDY 2.0: WIFI 0WNAGE IN UNDER $5
is capable of not only directly conducting data flow analysis over RELOADED
RADARE2 SHINOBOT FAMILY Dalvik bytecode but also automatically fixing the code, i.e. without any Sunday from 1000-1150 at Table Five
Saturday from 1400-1550 at Table Six Saturday & Sunday from Saturday 1600-1750, Sunday 1200-
decompilers. This capability makes it resillent against basic obfuscations Vivek Ramachandran
1350 at Table Six/Five
Maxime Morin and distinguishes it among similar tools -- including the QARK, the scanner/
Sh1n0g1 Nishant Sharma
Radare2 is an open-source Reverse-Engineering Framework explotation tool shown by Linkedin in DEF CON 23. Currently it recognizes
ShinoBOT Family is a malware suite for the pentester, security most classes of vulnerabilities (as in OWASP Mobile Top 10 (2015).) Ashish BhangaleWiDy is an open source Wi-Fi Attack and Defense platform
A lot of people are currently using radare2 for a large panel of engineer who want to test the vendor’s solution. created to run on the extremely cheap ESP8266 (<$5) IoT platform. We’ve
different purposes; binary exploitation, weird CPU architecture AppSec, Mobile written a simple framework which you can hack and create your own
reversing, binary diffing, ctf, emulation, We also try to get new It contains Backdoor, Ransomware, Downloader, Dropper, PowerShell
https://github.com/taky/trueseeing tools or automate attack/defense tasks. We also provided code to bring
contributors for the projects and invite students to collaborate via based malware, obfuscation/encryption techniques, Pseudo-
the concept of deception to WiFi area. WiDy was launched in Blackhat
various platform such as Google Summer Of Code or the Radare DGA, and the C&C is provided as a service (C&CaaS), no fee. UNIVERSAL SERIAL ABUSE Asia 2017 Arsenal and received good response from the audience. WiDy
Summer of Code we try to organize based on donations. 5 sec to get ready and “DOWNLOAD. EXECUTE. CONTROL.” Saturday from 1600-1750 at Table Four 2.0 release contains several major improvements over initial version.
Rogan Dawes
> Project URL: http://radare.org/r/ Offense Attack and Defense
> Git Project URL: https://github.com/radare/radare2 Universal Serial aBUSe is a combination of hardware and software,
https://shinobot.com/ <- ShinoBOT executable
and is a refinement of the old school USB HID attacks. It adds a WiFi WIFI CACTUS
RULER - PIVOTING THROUGH https://shinobotps1.com/ <- powershell edition interface to the USB device, which enables the attacker to remotely Saturday & Sunday from Saturday 1000-1150, Sunday 1200-
1350 at Table Four
EXCHANGE https://shinolocker.com/ <-ShinoLocker trigger the payload at a time of their choosing, not just after a fixed
Saturday from 1200-1350 at Table Four delay from the time it is plugged in. The WiFi interface also enables darkmatter
https://shinosec.com/ <- other components include ShinoBOT Suite a back-channel to allow the typed payload to communicate with
Etienne Stalmans With this project you will be able to listen to all Wi-Fi channels at the
the attacker without touching the victim’s network interfaces. same time. No more broken or fragmented frames due to channel
Microsoft Exchange has become the defacto gateway into most ADVANCED SPECTRUM MONITORING
WITH SHINYSDR This enables the attacker to avoid any network complexity hopping. It will passively monitor the dangerous WiFis around you
organisations. By nature, Exchange needs to be externally accessible,
(air gaps, firewalls and proxies) or network-based giving you metadata and actual data that might be useful.
and usually falls outside of normal security monitoring. This can allow Saturday from 1600-1750 at Table One

for the bypass of common security mechanisms. Even when organisations Michael Ossmann monitoring, and still obtain that precious shell! Offense, Defense
move into the cloud, their Exchange servers still provide access into Dominic Spill This tool is aimed at Offensive folks, with an interest in hardware attacks. http://palshack.org/
the internal environment. It has been shown in the past that abusing
We have developed open source tools to monitor the RF spectrum at a high https://sensepost.com/blog/2016/universal-serial-abuse/
the rules feature of Outlook, combined with auto-synchronisation WIMONITOR - AN OPENWRT PACKAGE
level and then drill down to individual signals, supporting both reverse
through Exchange, can allow for Remote code-execution. https://github.com/SensePost/USaBUSe FOR REMOTE WIFI SNIFFING
engineering and signals intelligence. By automatically combining the
Furthermore, Exchange offers a covert communication channel results with OSINT data from regulatory bodies around the world, we are VAPOR TRAIL
Sunday from 1200-1350 at Table One

outside of the usual HTTP or TCP employed by most malware. Using able to build up a picture of devices transmitting in an environment. Sunday from 1200-1350 at Table Six
Vivek Ramachandran
the mailbox itself, it is possible to create a communication channel Nishant Sharma
Wireless, Defense Galen Alderson
that doesn’t traverse the normal network boundary, and appears Ashish Bhangale
http://greatscottgadgets.com/spectrummonitoring Larry Pesce
to be normal Exchange behaviour when inspected on the wire.
WiMonitor is ready to use OpenWRT package which allows the user to
Introducing Ruler: AAs red team members and even “evil attackers”, we’ve been finding
SPLUNKING DARK TOOLS - A convert an OpenWRT WiFi router into a remote WiFi sniffer. It modifies
numerous ways to exfiltrate data from networks with inexpensive
During our Red Team assessments, we saw an opportunity to utilise PENTESTERS GUIDE TO PWNAGE the LuCI interface to show the task-specific configuration option. With
hardware: Ethernet, WiFi and cellular (2G, 3G and LTE). The first two
inherent weaknesses of Microsoft Exchange and create a fully- VISUALIZATION the right configuration, it then captures the WiFi packets using monitor
are highly detectable, while the latter is expensive and both leave
automated tool that aided further breach of the network. Ruler allows mode (while hopping on configured channels) and sends them to
Saturday from 1200-1350 at Table Six
a paper trail. We found a way to use a medium that is right under
for the easier abuse of built in functionality, including the ability to the remote machine as Aruba ERM (Encapsulated Remote Mirroring)
Bryce Kunz @TweekFawkes everypony’s nose; low power, broadcast FM radio. With a Raspberry
execute code on every mailbox connected to the Exchange server. packets. This allows the user to observe, capture and analyze traffic
Nathan Bates @Brutes_ Pi and a length of wire, we can send text and raw binary data with
from multiple sources (read APs turned into sensors) on one machine
This talk will showcase the numerous features of Ruler, demonstrating During a penetration test, we typically collect all sorts of information a method nopony (until now) would think to look for. We receive the
(laptop/PC) using off the shelf OpenWRT compatible routers.
how to gain a foothold, pop shells on every connected mailbox, into flat files (e.g. nmap scans, masscan, recon-ng, hydra, dirb, nikto, data with an RTL-SDR, putting our overall hardware budget at $20.
use Exchange as a covert communication channel and maintain Defense
etc…) and then manually analyze those outputs to find vectors into target In this demo, we will show you how to build and use this system. We’ll
a near invisible persistence in the organisation. We will also networks. Leveraging data analytics techniques within Splunk, pentesters share tales of the custom software and transmission protocols. You
discuss possible defenses against the demonstarted attacks. will be able to quickly find the information they are looking for and want to see it in action? We’ve got demos. You want the software?
https://github.com/sensepost/ruler hence exploit more target networks within short time periods. This talk
70 covers the required tools for consolidating, analyzing and visualizing the 71
-Vendors- master’s degrees, which includes a master’s in
-Purveyors of fine
hacker-related merchandise-
rights globally, with a focus on closed societies.
BREAKPOINT BOOKS astronautical engineering. As well as doctoral H A C KE R WA R E H O U S E HRF unites people in the common cause of
programs in cybersecurity and management and defending human rights and promoting liberal
http://breakpointbooks. decision sciences. Capitol is regionally accredited http:// democracy. Its mission is to ensure that freedom is
com/ by Middle States Association of Colleges. hackerwarehouse. both preserved and promoted around the world.
com/
Stop by and browse the
wide selection of security- HACKER
EFF WAREHOUSE is your KE Y P O R T ®
related books on display
this weekend. The latest and one stop shop for
greatest books available
https://www.eff.org/ hacking equipment. We understand the importance https://www.
mykeyport.com/
in the industry also include The Electronic Frontier of tools and gear which is why we carry only the
Foundation (EFF) is the highest quality gear from the best brands in the Keyport® combines
books authored by Def Con
leading organization industry. From WiFi Hacking to Hardware Hacking keys, pocket tools, &
presenters. Check out the wide
defending civil liberties to Lock Picks, we carry equipment that all hackers smart tech into one everyday multi-tool. This year
selection of games available
in the digital world. We defend free speech on the need. Check us out at HackerWarehouse.com. we are bringing our brand new modular product
– strategy, card, dice, and deck-building.
Internet, fight illegal surveillance, support freedom- line including the Keyport Slide 3.0 & Keyport
Buy a game and start playing today.
enhancing technologies, promote the rights of Pivot (holds your existing keys), along with our new
digital innovators, and work to ensure that the H A C KE R S F O R C H A R I T Y tech & tool modules which includes a Pocketknife,
BUMP MY LOCK rights and freedoms we enjoy are enhanced, rather Bluetooth Locator, and Mini-Flashlight. Sign up for
than eroded, as our use of technology grows. http://www. our new Maker Program and design/hack/build
Stop by our table to find out more, pick up some
hackersforcharity. you’re own compatible Keyport modules. Don’t
org/
gear, or even support EFF as an official member. forget to bring your keys to the vendor area!
Hackers for
Charity is a
https://www.bumpmylock.com/ GHETTO GEEKS non-profit organization that leverages the N O S TA R C H P R E S S
skills of technologists. We solve technology
Bump keys, lock picks and training tools. Bump Well we’re back at it again, and have been working challenges for various non-profits and provide https://www.nostarch.com/
My Lock has served thousands of customers
equipment, job training and computer Thanks to you, we’ve been
worldwide since 2007. If we don’t have it at the
education to the world’s poorest citizens. publishing books for hackers
booth, go to our site http://www.bumpmylock.com.
Free demonstrations and training at our booth. since 1994. Our titles have
Bump My Lock is celebrating our 6th year at hard all year to bring you the freshest awesome that HAK5 personality, our authors are
DEFCON by showcasing our own line of lock we can. If you have been to DEF CON, layerone, passionate, and our books
picks!! This year, we will feature our Black Diamond toorcon, phreaknic, or other conferences we have tackle topics that people care
https://www.hak5.org/
sets and our Ruby sets. So come see us for all been at, you definitely know what so of shenanigans about. We read and edit
Complete your Hacking everything we publish—titles
your Lock Pick Sets, Bump Keys, Clear Practice we are up to. If you have never seen us, feel free to Arsenal with tools
Locks, Jackknife Pick Sets, Hackware, and more. come by and take a look at what we have to offer. like Gray Hat C#, Hacking: The Art of Exploitation,
from Hak5 - makers Automate the Boring Stuff with Python, Python
Need more help? We have a vast number of Always fun, always contemporary, of the infamous WiFi Crash Course, The Hardware Hacker, and more.
articles and videos on lock picking on our blog GhettoGeeks has some for the tech Pineapple, USB Rubber This year we’re excited to release the PoC||GTFO
or your tube channel. If you are a beginner or enthusiast (or if you prefer, hacker) Ducky, and newly released LAN Turtle. The Hak5 bible; complete with a leatherette cover, ribbon
a master locksmith we have the tools for you. crew, including hosts Darren Kitchen, Shannon bookmark, and gilded pages. It’s packed with
As always, a percentage of our proceeds Morse and Patrick Norton, are VENDING ALL missives from your favorite hackers. Everything in
GUNNAR
will go to the Miracle Match Foundation. THE THINGS and celebrating 10 year of Hak5! our booth is at least 30% off and all print purchases
Long live Barcode! Come say EHLO and check out our sweet new include DRM-free ebooks. We’ve got new swag
tactical hacking gear! Everything from WiFi Hot- and early access print editions of forthcoming
Spot Honey-Pots to Keystroke Injection tools, titles like Serious Cryptography, Attacking
C APITOL TECHNOLOGY Software Defined Radios and Covert LAN Network Protocols, and Rootkits and Bootkits.
UNIVERSIT Y https://gunnar.com/
Hijackers are available at the Hak5 booth.
GUNNAR Optiks is the only patented computer
https://www.captechu.edu/ eyewear recommended by doctors to protect NUAND
and enhance your vision. Our premium H U M A N R I G H T S F O U N D AT I O N
Capitol Technology
computer eyewear defends eyes from the effects
University, located in Laurel https://www.nuand.com/
of digital eye strain which can include; dry https://www.hrf.
Maryland, offers degrees Nuand develops
eyes, headaches, blurry vision, eye fatigue, org/
in engineering, computer Software Defined Radio
altered Circadian Rhythms, and insomnia. Human Rights
science, cybersecurity, and (SDR) platforms for
End the pain of DIGITAL EYE STRAIN. Foundation (HRF)
business. Offering online students, hobbyists, and
is a nonpartisan
certificates, bachelor’s and professionals. Their main offering, the bladeRF, is a
nonprofit
versatile USB 3.0 device that provides a 300 MHz
organization that promotes and protects human

72 73
-Vendors-
to 3.8 GHz tuning range, full duplex operation, 12- Las, and Sargent and Greenleaf. Visit https://
-Purveyors of fine
hacker-related merchandise-
Smart Cars, Telecom and SATCOM. They have
bit samples at up to 40 MSPS, and an instantaneous SecuritySnobs.com for our complete range of TOOOL presented their researches at premier security
bandwidth up to 28 MHz. This device has found a products. Stop by to see the new and coming conferences like Blackhat, DEFCON, HITB,
home in application domains including GSM and soon products in high security and con specials! http://toool.us/ CanSecWest, RuxCon, POC, SyScan360 etc.
LTE base stations, digital television, GPS simulation, RocTeam is focusing on hardware security
The Open
medical imaging research, and wireless security. research and the R&D of hardwares that can
SEREPICK Organisation Of
Check out their booth to see demos and learn more! be used for defensive and offensive purposes,
Lockpickers is
back as always, they built many hardware security gadgets.
http://www.serepick.com/
PWNIE EXPRESS offering a wide selection of tasty lock goodies for PegasusTeam is focusing on wireless intrusion
With the largest selection prevention, wireless threat sensing and wireless
both the novice and master lockpicker! A variety
of lock picks, covert entry penetration test. They have designed and built
of commercial picks, handmade picks, custom
https://www. and SERE tools available at ‘MianYangQiang’ to demonstrate the threats of
pwnieexpress. designs, practice locks, handcuffs, cutaways, and
com/ DEF CON it¹s guaranteed public WIFI, wireless honeypot, wireless intrusion
other neat tools will be available for your perusing
we will have gear you prevention system ‘360TianXun’ which have been
Pwnie Express and enjoyment! Stop by our table for interactive
have not seen before. New widely deployed city wide and in enterprises.
addresses the demos of this fine lockpicking gear or just to pick
tools and classics will be
attack surface up a T-shirt and show your support for locksport.
on display and available for sale in a hands on
exposed by IoT All sales exclusively benefit TOOOL, a 501(c)3
and connected devices in the enterprise. By
environment. Our Product range covers Custom UNIX SURPLUS
Titanium toolsets, Entry Tools, Practice locks, non-profit organization. You can purchase picks
continuously discovering, monitoring and assessing from many fine vendors, but ours is the only
Bypass tools, Urban Escape & Evasion hardware https://unixsurplus.
all devices on and around a company’s network, table where you know that 100% of your money
and items that until recently were sales restricted. com/
Pwnie Express provides security professionals goes directly back to the hacker community.
SPARROWS LOCK PICKS and TOOLS will be “Home of the $99
the ability to detect, assess and respond to
displaying a full range of gear including their 1U Server”
device based threats, including misconfigured,
newly released Core Shims., Sandman and Lock U AT 1260 La Avenida St Mountain View, CA 94043
unauthorized, and malicious devices.
Outs. The WOLF will also be available to the
The Pwnie Express SaaS platform provides Toll Free: 877-UNIX-123 (877-864-9123)
public for the first time in limited quantities. All
complete device coverage, including IoT, products will be demonstrated at various times and
http://www.uat.edu/
rogue, and traditional IT devices across the can be personally tested for use and efficacy. The University of Advancing
entire enterprise. To learn more about Pwnie
WISP
Technology (UAT) is a private
Express visit www.pwnieexpress.com university located in Tempe,
SHADOW VEX INDUSTRIES Arizona, offering academic https://www.wisporg.
com/
degrees focused on new
RAPID7 and emerging technology
Women in Security
http://store.
and Privacy (WISP) is
shadowvexindustries. disciplines. UAT offers a
com/ a fiscally sponsored
robust suite of regionally
Shadowvex Industries non-profit project
accredited graduate and undergraduate courses
(SVX) - more than 20 years of pouring blood, sweat of Community Initiatives (501(c)(3)). WISP
ranging from Computer Science and Information
& gears into hacker-relevant, limited edition clothing, advances women to lead the future of security
Security to Gaming and New Media. UAT has
https://www.rapid7.com/ DJ mixes, stickers, buttons, art prints and more. Miss and privacy. We believe that empowerment
been designated as a Center for Academic
Rapid7 cybersecurity analytics software and services DJ Jackalope, aka DEFCON’s resident DJ mixtress, requires the inclusion of all women, with expertise
Excellence in Information Systems Security
reduce threat exposure and detect compromise has been teaming up with us for more in both security and privacy. Our work includes
Education by the US National Security Agency.
for 4,150 organizations, including 34% of the than a decade with her own DJ mixes education, mentoring & networking, career
Programs are available online and on-campus.
Fortune 1000. From the endpoint to cloud, we and awesome swag. Follow the music advancement, leadership, and research. To learn
provide comprehensive real-time data collection, in the vending area to find our booth! more, visit us at https://www.wisporg.com.
advanced correlation, and unique insight into If you want to bring home your piece 360 UNICORN TEAM
attacker techniques to fix critical vulnerabilities, of DEFCON history, you need to
stop attacks, and advance security programs. get here early - our year-specific designs are only http://unicorn.360.cn/
available @DEFCON and only while supplies last! H A C KE R B OXE S
360 Security Research
SECURIT Y SNOBS Innovation Alliance
www.hackerboxes.com
SIMPLE WIFI consists of many teams,
UnicornTeam, RocTeam HackerBoxes is the subscription
https://securitysnobs. box service for DIY electronics
com/ and PegasusTeam are
https://www. and hardware hacking. Each
Security Snobs simplewifi.com/ among them, each team monthly HackerBox includes
offers High Security boosts many brilliant a carefully curated collection
For PenTesting
Mechanical Locks and Physical Security Products researchers in their corresponding field of focus. of projects, components, modules, tools, supplies, and
and unwired Internet Security Specialists:
including door locks, padlocks, cutaways, Wireless, WiFi antennas, cables, connectors, UnicornTeam is focusing on wireless security exclusive items. HackerBox Hackers are electronics
security devices, and more. We feature the they assess the security of anything that uses hobbyists, makers, hardware hackers, and computer
USB and Ethernet wireless high power cards and
radio technologies, from small things like RFID, enthusiasts. Many connect through social media channels
latest in security items including top brands like devices, other interesting goodies to be seen
NFC and WSN to big things like GPS, UAV, to create a community of experience, support, and
Abloy, BiLock, EVVA, KeyPort, Mobeye, Anchor only at the table! And new design T-shirts.
74 75
ideas. Let's see what you make with your HackerBoxes.
 Book
Signings! -thursday- -friday-
Where: No Starch Press, in the vendor area, on promenade level. 101 Track 1 101 Track 2 DEF CON 101 Track 2 Track 3 Track 4

10:00

10:00
FRIDAY: There’s no place like macOS/iOS Kernel Secret Tools: Learning
127.0.0.1 - Achieving Where are the SDN Debugging and Heap About Government
Welcome to DEF CON 25
12:00 - David Thiel, iOS Application Security reliable DNS rebinding Security Talks? Feng Shui Surveillance Software
in modern browsers You Can’t Ever See
The Dark Tangent
Jon Medina Min(Spark) Zheng &
13:00 - PoC||GTFO Group Signing Luke Young Xiangyu Liu Peyton “Foofus” Engel
The Brain’s Last Stand
14:00 - James Forshaw, Attacking Network Protocols
Garry Kasparov
14:30 - Al Sweigart, Automate the Boring Stuff with Python From Box to Backdoor:

11:00

10:20
Opt Out or Deauth Offensive Malware
Using Old School Tools
Trying !- Anti-Tracking Analysis: Dissecting Hacking travel routers
15:00 - Jon Erickson, Hacking: The Art of Exploitation, 2nd Edition and Techniques to
Bots Radios and OSX/FruitFly via a like it’s 1999
Discover Backdoors in
Keystroke Injection Custom C&C Server
Modern Devices
SATURDAY: Mikhail Sosonkin Panel: Meet The Feds
Weston Hecker Patrick Wardle
Patrick DeSantis
11:30 - Cory Doctorow, Walkaway Andrea Matwyshyn,
Terrell McSweeny, Dr.
13:00 - Craig Smith, The Car Hacker's Handbook Suzanne Schwartz, &

11:00
12:00
Porosity: A Decompiler Rage Against the
Weaponizing the BBC Leonard Bailey
14:00 - Eugene Rodionov & Alex Matrosov, Rootkits and Bootkits For Blockchain-Based Jailbreaking Apple Weaponized AI Hacking Smart Contracts
Micro:Bit
Smart Contracts Watch Propaganda Machine
Bytecode Konstantinos
15:00 - Nick Cano, Game Hacking Max Bazaliy Suggy (AKA Chris
Damien “virtualabs”
Karagiannis
Cauquil
Matt Suiche Sumner
15:30 - Violet Blue, The Smart Girl's Guide to Privacy

Open Source Safe

12:00
13:00

A New Era of SSRF -

Cracking Robots -
Amateur Digital CITL and the Digital Exploiting URL Parser Hacking Democracy: A
Wiping Out CSRF Combinations Under 1
Archeology Standard - A Year Later in Trending Programming Socratic Dialogue
Hour! (Is it bait? Damn
Languages!
Joe Rozner straight it is.)
Matt ‘openfly’ Joyce Sarah Zatko Mr. Sean Kanuck
CONTEST CLOSING CEREMONIES Orange Tsai
Nathan Seidle

WANNA KNOW WHO IS THE BEST AT

Starting the Avalanche:
14:00

13:00
FINDING RANDOM STUFF AROUND See No Evil, Hear No
Controlling IoT Devices Application DoS
Hacking the Cloud Evil: Hacking Invisibly Teaching Old Shellcode Next-Generation Tor
LAS VEGAS DURING DEF CON? and Silently With Light
With Crafted Radio
New Tricks
In Microservice
Onion Services
Signals Architectures
CURIOUS WHO IS THE BEST AT Gerald Steere & Sean and Sound
Metcalf Josh Pitts Roger Dingledine
SOCIAL ENGINEERING SOMEONE Matt Wixe
Caleb Madrigal Scott Behrens & Jeremy
Heffner
INTO GIVING UP PRIVILEGED
PERSONAL OR COMPANY DATA?
15:00

14:00
WHAT ABOUT THE BEST TEAM Death By 1000
How We Created the
Real-time RFID Cloning Using GPS Spoofing to Breaking the x86 First SHA-1 Collision
TO BE HARASSED, FED LOTS OF in the Field Control Time
Installers; on MacOS,
Instruction Set and What it means For
It’s All Broken!
BOOZE AND STILL ABLE TO WRITE Inside the “Meet Desai” Hash Security
Dennis Maldonado David “Karit” Robinson Christopher Domas
AND COMPILE EPIC CODE? Attack: Defending Patrick Wardle
Elie Bursztein
Distributed Targets
from Distributed
COME JOIN US AS WE ANNOUNCE Attacks
15:20

15:00
THE WINNERS OF THE DEF CON CINCVolFLT (Trey Exploiting 0ld Mag-
Assembly Language is Phone System Testing Dark Data Abusing Certificate
25 CONTESTS AT OUR CONTESTS Forgety) stripe information with
Too High Level and Other Fun Tricks Transparency Logs
New technology
CLOSING CEREMONIES, FROM Svea Eckert & Andreas
XlogicX “Snide” Owen Dewes Hanno Böck
14:00 - 15:30PM ON THE STAGE ON Salvador Mendoza
THE MAIN CONTEST FLOOR!
Radio Exploitation
16:00

16:00

BLACK BADGE WINNERS WILL BE An ACE Up the Sleeve:

101: Characterizing, “Tick, Tick, Tick.
The Adventures of AV Designing Active
ANNOUNCED DURING THE MAIN Contextualizing, and Boom! You’re Dead.” —
The Last CTF Talk and the Leaky Sandbox Directory DACL
Applying Wireless Tech & the FTC
CLOSING CEREMONIES AT 16:30PM You’ll Ever Need: AMA Backdoors
Attack Methods
DEF CON 101 Panel with 20 years of DEF Itzik Kotler & Amit
IN TRACKS 3 & 4 Whitney Merrill &
CON Capture-the-Flag Klein Andy Robbin & Will
Matt Knight & Marc Terrell McSweeny
HighWiz, Malware organizers Schroeder
Newlin
Unicorn, Niki7a,
Roamer, Wiseacre, & Vulc@n, Hawaii
17:00

Shaggy John, Chris Eagle, MEATPISTOL, A Modular

17:00

Invisigoth, Caezar, & Malware Implant The Internet Already

Cisco Catalyst
Myles Framework Knows I’m Pregnant
Exploitation
Panel - DEF CON Groups
FuzzyNop (Josh Cooper Quintin &
Artem Kondratenko
Schwartz) & ceyx (John Kashmir Hill
Cramb)

76 77
-Saturday- -Sunday-
DEF CON 101 Track 2 Track 3 Track 4 DEF CON 101 Track 2 Track 3 Track 4

10:00
10:00

Persisting with
Get-$pwnd: Attacking The spear to break
Microsoft Office: Breaking Bitcoin
Battle-Hardened Windows the security wall of I Know What You Are by Untrustworthy Hardware
Abusing Extensibility Hardware Wallets
Server S7CommPlus the Smell of Your Wifi and How to Fix It
Options
$BIGNUM Steps Forward, Josh Datko & Chris
Lee Holmes Cheng Unboxing Android: Denton Gentry 0ctane
William Knowles $TRUMPNUM Steps Back: Quartier
How Can We Tell If Everything You Wanted
We’re Winning? To Know About Android
(Un)Fucking Forensics:
10:20

Breaking Wind: Packers

WSUSpendu: How to Hang Active/Passive (i.e. PEIMA (Probability

10:20
Adventures in Hacking Cory Doctorow WSUS Clients Offensive/Defensive) Avi Bashan & Slava Engine to Identify Ghost in the Droid:
Wind Farm Control
Memory Hacking/ Makkaveev Malicious Activity): Possessing Android
Networks BITSInject
Romain Coltel & Yves Le Debugging. Using Power Laws to Applications with
Provost address Denial of ParaSpectre
Jason Staggs Dor Azouri
K2 Service Attacks
chaosdata
11:00

Evading Next-Gen Redezem

Microservices and FaaS
If You Give a Mouse a AV Using Artificial
for Offensive Security

11:00
Secure Tokin’ and Intelligence Backdooring the Lottery
Microchip... It Will Ghost Telephonist’
Doobiekeys: How to Roll Total Recall: and Other Security Exploiting Continuous
Ryan Baxendale Execute a Payload and Impersonates You
Your Own Counterfeit Hyrum Anderson Implanting Passwords Tales in Gaming over Integration (CI) and
Cheat At Your High- Through LTE CSFB
Hardware Security in Cognitive Memory the Past 25 Years Automated Build systems
stakes Video Game
Devices
Tournament Yuwei Zheng & Lin
11:20

Tess Schrodinger Gus Fritschie & Evan spaceB0x

Abusing Webhooks for Joe FitzPatrick & Huang
skud (Mark Williams) & Teitelman
Command and Control Michael Leibowitz
Sky (Rob Stanley)
Genetic Diseases to

12:00
Dimitry Snezhkov
All Your Things Are Guide Digital Hacks of
Belong To Us The Call Is Coming
the Human Genome: How
Are all BSDs are From Inside the House!
12:00

Driving down the rabbit When Privacy Goes Poof! DNS - Devious Name The Black Art the Cancer Moonshot
Zenofex, 0x00string, created equally? A Are You Ready for the
hole Why It’s Gone and Never Services - Destroying of Wireless Post Program will Enable
CJ_000, & Maximus64 survey of BSD kernel Next Evolution in DDoS
Coming Back Privacy & Anonymity Exploitation Almost Anyone to Crash
vulnerabilities. Attacks?
Mickey Shkatov, Jesse Without Your Consent the Operating System
Michael, & Oleksandr Richard Thieme a.k.a. Gabriel “solstice” Ryan that Runs You or to End
Ilja van Sprundel Steinthor Bjarnason &
Bazhaniuk neuralcowboy Jim Nitterauer Civilization...
Jason Jones
John Sotos
A Picture is Worth
13:00

Koadic C3 - Windows a Thousand Words, Malicious CDNs:

13:00
Demystifying Windows COM Command & Control Twenty Years of Literally: Deep Neural Revoke-Obfuscation:
Game of Chromes: Bypassing Android Identifying Zbot
Kernel Exploitation by Framework MMORPG Hacking: Better Networks for Social PowerShell Obfuscation
Owning the Web Password Manager Apps Domains en Masse via
Abusing GDI Objects. Graphics, Same Exploits Stego Detection (And Evasion)
with Zombie Chrome Without Root SSL Certificates and
Sean Dillon Using Science
Extensions Bipartite Graphs
5A1F (Saif El-Sherei) (zerosum0x0) & Zach Manfred (@_EBFE) Philip Tully & Michael Stephan Huber &
Harding (Aleph-Naught-) T. Raggo Daniel Bohannon (DBO) &
Tomer Cohen Siegfried Rasthofer Thomas Mathew & Dhia
Lee Holmes
Mahjoub

Linux-Stack Based V2X

14:00

14:00
Trojan-tolerant Framework: All You Weaponizing Machine
Attacking Autonomic Hardware & Supply Chain Need to Hack Connected XenoScan: Scanning Call the Plumber - You Friday the 13th: JSON
Learning: Humanity Was
Networks Security in Practice Vehicles Memory Like a Boss Have a Leak in Your Man in the NFC attacks!
Overrated Anyway
(Named) Pipe
Omar Eissa Vasilios Mavroudis & p3n3troot0r (Duncan Nick Cano Haoqi Shan & Jian Yuan Alvaro Muñoz &
Dan “AltF4” Petro & Ben
Dan Cvrcek Woodbury) & ginsback Gil Cohen Oleksandr Mirosh
Morris
(Nicholas Haltmeyer)
15:00

15:00
MS Just Gave the Blue Tracking Spies in the Digital Vengeance:
DOOMed Point of Sale 25 Years of Program
Team Tactical Nukes Skies Exploiting the Most
Systems Analysis
(And How Red Teams Notorious C&C Toolkits
Need To Adapt) Jason Hernandez, Sam
trixr4skids Zardus (Yan
Richards, & Jerod Professor Plum
Chris Thompson MacDonald-Evoy Shoshitaishvili)

From “One Country -

16:00

16:30

One Floppy” to “Startup

Nation” - The Story Game of Drones: Putting
CableTap: Wirelessly
Dealing the Perfect of the Early Days of the Emerging “Drone
Tapping Your Home
Hand - Shuffling the Israeli Hacking Defense” Market to the
Network
Memory Blocks On z/OS Community, and the Test Closing Ceremonies
Journey Towards Today’s
Marc Newlin, Logan
17:00

Ayoul3 Vibrant Startup Scene Francis Brown & David

Lamb, & Chris Grayson
Latimer
Inbar Raz & Eden
Shochat
17:00

Taking Windows 10
Here to stay: Gaining
Kernel Exploitation
persistency by Abusing Introducing HUNT: Data
to the next level -
Advanced Authentication Driven Web Hacking & Popping a Smart Gun
Leveraging write-what-
Mechanisms Manual Testing
where vulnerabilities
Plore
in Creators Update
Marina Simakov & Igal Jason Haddix
Gofman

78 79
Morten Schenk
 DEF CON 25 Floorplan DEF CON 25 Floorplan - Nocturnal
CAESAR’S PALACE CONFERENCE CENTER CAESAR’S PALACE CONFERENCE CENTER
PROMENADE LEVEL EMPEROR’S LEVEL PROMENADE LEVEL EMPEROR’S LEVEL
PROMENADE SOUTH PROMENADE SOUTH
NEOPOLITAN
PACKET HACKINGBALLROOM
VILLAGE NEOPOLITAN BALLROOM
I II III IV V VI I II III IV VHACKER JEOPARDY
VI
TRACK 2
PACKET DRUNK HACKER HISTORY
V VI VII VIII
HACKING NIGHT: GAMESHOWS V VI VII VIII
23 1 VILLAGE 23 1
VENDORS TALKS
III AGUSTUS IV
TRACK
22 3 TRACK 4 2 MILANO III AGUSTUS IV
SPEAKER OPS

UMBRIA
Elevator

Elevator
BALLROOM UMBRIA 22 2 MILANO

Elevator

Elevator
MOVIE 24 25 BALLROOM DEF CON THURS: 25 BALLROOM
21 NIGHT 3 21
24 BALLROOM
MOVIE NIGHT n00b PARTY 3
TUSCANY 20 OCTAVIUS 4 Office I II III IV 4 I II III IV
TUSCANY 20 OCTAVIUS Office
FRI/SAT:
WORKSHOPS

8
19 BALLROOM BALLROOM 8
5 I II 19 WHOSE SLIDE I II
18 IS IT ANYWAY? 5
Ramp

18

Ramp
Registration

VEND
IMPERIAL

Registration
TSOK NOC VEND
Desk

BOARD SALERNO SORRENTO IMPERIAL

17 6 Office 4
TSOK NOC

Desk
SALERNO SORRENTO
INFO OPSROOM 17 6 Office 4 BOARD
OPSROOM
BOOTH
16 15 14 13 12 11 10 9 8 7 16 15 14 13 12 11 10 9 8 7

Balcony Office 6
INFO Balcony

Registration
Elevator Office 6

Registration
Elevator

Desk
BOOTH

Desk
SKYTALKS/303

VERONA
ROOTZ ASYLUM
VERONA FRI:
BIO II EVENING LOUNGE II
HACKING TURIN
TURIN INFOSEC UNLOCKED
VILLAGE
PISA EMPERORS PISA EMPERORS
TREVI SEBALLROOM BALLROOM
VILLAGE TREVI
SAT: 303
I I
POOL LEVEL RECON
PALERMO
TALKS
RECON
PALERMO
TARRANTO

SIENA SE A&E
VENICE

TARRANTO
VILLAGE SIENA A&E

VENICE
VILLAGE OPS BANQUET KITCHEN BANQUET KITCHEN
OPS
SICILY

SICILY
SOC SOC
DUPER LOUNGE SILENT DISCO
MODENA

NAPLES

MODENA
NAPLES
Freight LOUNGE
Elevators Freight Freight
Freight
BOARDROOM

OPS/ Elevators Elevators

BOARDROOM
OPS/ Elevators
SENATE

SENATE
PROD PROD
Registration

Registration
Desk

Desk
ICS 23 1 PRESS
TRIBUNE2
SWAG QM
BOARDROOM

LOCKPICK INFO QM

BOARDROOM
POMPEIAN BALLROOM INFO
CONSUL

CTF POMPEIAN BALLROOM

Registration

VILLAGE

CONSUL

Registration
CAMPANIA

VILLAGE BOOTH Office 3 BOOTH Office 3

II STORES
CEV OPS/
Desk

22 2 SWAG
Office 3
II STORES

Desk
DISPATCH
INFOSEC
UNLOCKED
PATRICIAN I III IV SWAG
Office 3
I III IV
24 25
Elevator

2 21 3 INFO PRE-FUNCTION TRACK 1 (101) I INFO PRE-FUNCTION DEF CON I

Registration

PRESS AREA 1 PRESS

Office 7

IOT BOOTH AREA 1

CALABRIA

VILLAGE LIVORNO
NIGHT: MUSIC EVENTS BOOTH
Desk

LIVORNO
TALKS VILLAGE
4
INFO INTERVIEW INTERVIEW ENTERTAINMENT
20 MAIN FORUM
CONTEST AREA BOOTH FRI: VOTING
ABRUZZI

Business Kiosks

VILLAGE VILLAGEI TALKS II PALACE BALLROOM HACKER

Business Kiosks
BALLROOM MESSINA
PRESS Elevators I II Elevators PALACE BALLROOM
Elevator

Elevator

MESSINA
PRESS

Elevator

Elevator
TALKS
Elevators

Phones

KARAOKE
Promenade

19 SAT/SUN:

Elevators

Phones
Promenade
DEMO LABS ROMAN
NORTH PROMENADE

5 Escalators FRI & SATROMAN Escalators

CAR 18 BALLROOM
Elevators
A II CHILLOUT
BALLROOM
Elevators
A II
HARDWARE HACKING

HACKING TAMPER FRI:

17
VILLAGE EVIDENT 6 CHILLOUT
III IV DCG III
MIXER IV
GENOA

GENOA
VILLAGE DISPATCH
B DISPATCH
CHILLOUT B
Escalators PRE-FUNCTION Escalators PRE-FUNCTION
VILLAGE

16 15 14 13 12 11 10 9 8 7 CHILLOUT AREA 2 AREA 2

REGISTRATION
BACCHUS Office 2 BACCHUS Office 2 FRI:
Registration

Registration
RICHARD CHEESE
Desk

CRYPTO &
WIFI FLORENTINE

Desk
VOTING FLORENTINE DUAL CORE
Elevator MACHINE
CAPRI
VILLAGE PRIVACY
BALLROOM III LOUNGE BALLROOM III
VILLAGE INHUMAN CAPRI
FRI: HAM I II VILLAGE
III IV I II III IV
EXAMS
VOTING
ANZIO
MACHINE ANZIO
VILLAGE

80 81
-SHOUT OUTS-
I’d like to thank everyone who supports DEF CON, either CFP Board: The Dark Tangent, Leah, Jericho, High Wizard, Shaggy, attend all of the vendors, speakers, press, contests, attendees Hanzo, iole, JAFO, John Doll, Judo, k3rn3l, Kallahar, KRS, kruger,
by running a contest, workshop, speaking, playing music, Roamer, Claviger, Zoz, Medic, Suggy, PWCrack, ZFasel, Malware to those awesome DC TV channels for your enjoyment Lordy, M0rph1x, mattrix, mauvehed, MAXIMUS, MIM, n1cFury,
planning a event, throwing a party, being a hacker Unicorn, CrYpT, SecBarbie, Yan, Dead Addict, Wiseacre, Weasel, along with your hangover in the your hotel room. n3x7, NextInLine, Nohackme, Nothingness, P33v3, ph3r, Phat
community vendor, or just engaging with the community. Vulc@n, Singe, Vyrus, Grifter. Special Reviewers: Wonk, Mouse, mac, videoman, #sparky, booger, CRV, naifx, c0mmiebstrd, Hobbit, Plasma, polish_dave, Precore, Priest, Rabbit, RadioActive,
I also want to specifically thank all the people and departments snow, Andrea Matwyshyn, Tuna. Workshop Reviewers: Ash, Da serif, c7five, Jon2, James and Mansi dedicated a great portion Raven, Red, SAGE, Shib, Siviak, sl3dge, Slick, SomeNinja, Sonicos,
of DEF CON who put their time in year round to make this con Kahuna, Highwiz, Leah, Munin, CyberSulu, Beaker, Tottenkoph. of their DEF CON 25 expedition to making sure everything sp00ns, Spedione, stan, stealth, Sumdunce, Synn, TBD, TieFighter,
possible. As you can see by the lists below there are hundreds of DC Forums: TheCotMan gives thanks to all the volunteers breaks (and if it does, to fix it right away). If you run into any timball, WarFlower, Wetod, wham, Wheels, WhiteB0rd, wilnix,
them, and I am amazed and humbled by their work each year. that help keep the forums running. Shout-out thanks to of them, please make sure you buy them a beverage, will ya? winx, Wreaktifier, xenophyx, xtremelatino, and zerofux.

A special thank you to Aruba Networks who donated 75 present admins: Dark Tangent and Neil. Shout-out thanks to The entire NOC team would like to thank the Caesar’s IT and We also wish to honor Goons who have retired, some after
AP-305s for DC25, on top of the APs and controllers they present mods: AlxRogan, blakdayz, noid, astcell, and Thorn. Encore for the tireless support in making it all happen. 10+ years of Gooning: Arclight, captain, chs, crzyhrse, cyber,
donated a couple of years ago. Thanks to them we can Double thanks to Dark Tangent for buying hardware, getting Danozano, dc0de, flea, freshman, Gadsden, godminusone,
us Internet access, and required software to run the forums, Lastly, looking back to 25 years of DEF CON, I would Gonzo, Jake, JustaBill, Krassi, Londo, lunaslide, noid, Nynex,
retire the AP-70s and AP-65s that were purchased back in like to also thank all of those who did good things for
2005/2006 that have served us well for over a decade. and for working on the system when things fail. Thanks to Pappy, Pescador, Queeg, quiet, rik, riverside, SkyDog, Vidiot.
Grifter and the CVE department for Contests/Villages/Events the NOC along the way, especially: Lockheed, Heather,
Finally I’d also like to thank the Caesar’s hotel teams, the Derek, Sqweak, t34se, rukbat and arh@wk. Finally, a very special thanks goes out to all SOC Goons
information synchronization with matching CVE forums. who have given their time, treasure, blood, sweat and
CTF competitors, speakers, and events organizers, and all the Photo: DEF CON Photo Goons would like to thank:
others behind the scenes. A special thank you to the back end Thanks to DCG department for notices on forums for new/expired tears over the past 25 years. Pax Per Imperium.
DCG. Thanks to goons for gooning. This is my 13th year as an Viss, ASTCell, Cannibal, Loather and InfoSystir.
staff of Charel, Jeff, Nikita, Neil, Darington, Mar, Janet, and Speaker Ops: Proctor would like to thank the Speaker Operations
Will, who all help the trains run on time. THANK YOU! Admin (and a moderator even longer) and in all these years, I’ve Press: A Big Thank You to all the press who not only cover the staff for another year of great service to DEF CON and its speakers.
failed to thank the users: Thanks to the users that pose questions, DEF CON community, but are part of it, as well as all the Press These goons are pwcrack, Mnky, idontdrivecars, Shadow, Goekesmi,
- The Dark Tangent and users that answer them. Thanks to users that provide feedback Goons who support the press who are covering DEF CON: Melanie, Crash, Jur1st, Scout, Bitmonk, Bushy, notkevin, Pasties, CLI,
Arts & Entertainment: ChrisAM would like to thank after DEF CON on how to make it better and users that pose Sylvia, Tracy, Jeff, Alan, David, Lin, Linda, Heather, Monika, Alex. Jinx, gattaca, roundRiver, Vaedron, K-hole, St0neHouse, Jutral,
everyone responsible for this year’s entertainment & complaints and suggestions to resolve them. Thank you users! Surreal_Killer, Milhouse, Flattire, phliKtid, Snarf, C@sper,
Production: Charel in Production would like to thank:
decor: Krisz Klink, Great Scott, Zziks, Mindy, djdead, Dispatch: RF and Ahab would like to thank the Dispatch C0njur3r, kampf, Ouze1, Betsy, Ira, Killerspud, Spencural, daKahuna, mubix, #s0sayw3all, Cursor, shortcake and AMFYOYO!
CTRL, Zebbler Studios, Mobius, and SomaFM. staff: AsmodianX, Voltage Spike, Mat, BonBon, Fosgood, jup1t3r, Chunk, supertechguy, L34N, metacortex, Swag: Secret would like to thank all the Swag Goons: lisal33, Dasha,
Contests, Events, Villages: Grifter would like to thank every Goon Tony, K0DEZ, L0G1C, Craig, w00k, dll3ma, Maj, and Ben. A, and skyria. Call us when you need us! gingerjet, spiggy, Serenity, furysama, Pelican, Themikeconnor,
on the Contests, Events, Villages, Parties, and Demo Labs team. InfoBooth: Mello and LittleBruzer would like to QM: QM Stores would like to thank Caesar for coming up with gLoBuS, Bearclaw, Mr.Katt, 5kyf4ll, Magnar, daedala, 10rn4 ,
Many thanks to 0x58, Apexxor, ArmyTra1n3d, BoKnows, Br00zer, thank all the InfoBooth goons for bad information his famous “Veni Vidi laceratus” quote, and also for conquering Brizan, redacted, Heal, and Chade for all their hard work, and all
Config, Cube, Drizzt, heisenberg, jinteki, m0hgarr, Mack, phartacus, and sending humans in the wrong direction: those pesky Goths. We recognise Marc Antony for being a player the other departments for what they do to make a great con!
phorkus, Respondo, Saltr, Secove, Sketch, Stumper, Xploit, Zant, and Cleopatra for being a saucy minx. ETA, Sunsh1ne, Zac, Waz,
and Zigy for the long hours and late nights; this wouldn’t be 0xNBE1, Artifakt, Banasidhe, Big, Doug, Boudica, Cheshire, Vendors: HexdumP and PushPin from vendors would like to
Chris, Drew, Jerel, Jixion, Khadija, Littleroo, MajorMayhem, Buttersnatcher, Multigrain, Saint, Youngblood, Lord Drimacus, Geo, take a moment to recognize everyone who has participated
possible without you guys. A HUGE thank you goes to the DEF CON Shell_E, Seven, Red Ace, Mr. Bot, Noise, Big Easy, Cell Wizard and
HQ team, Nikita, Neil, Darington, Charel, Will, and of course, The Medic, PEZHead, Sanchez, ScurryFool, Seth, Sl33pE, in DEF CON over the past twenty five years. The environment,
TACSAT, Telecon, algorythm, dara, deety, jimi2x, krav, Agent X for just being plain awesome and all the Goons for being culture, and the community that we know today has been built
Dark Tangent, for dealing with one of the most insane planning Goons on a hot hot weekend in Vegas. Feds for being sneaky and
years I’ve seen in my 17 years as a Goon. (They also get my madstringer, n00bz, p0lr, telecommunist, titor by working together with Production, Network and Dispatch,
conspicuous and Black Hats for keeping it real. White Hats, Red QM, the Safety Goons, our vendors, and even our attendees.
apologies for the stress I constantly add to them, I love you guys.) Inhuman Reg: Inhuman reg would like to thank: Nikita, Neil, Teams, Blue Teams and their pimps for keeping the wolf from the
Lastly, to the many organizers that have filled DEF CON with Cstone, Sauce, Drizzt, Charel, Will, Shaggy, Mouse, Anne, Pyr0, door. We’re also quite grateful for all the Humans who give a small Year after year it becomes more apparent how everyone, regardless
countless contests, villages, events, parties, and just plain mayhem, Agent X, Hony, Maggie, and everyone who stepped forward spark of meaning to our otherwise pointless and desolate little of department, is willing to step up and help one another out.
for the past 25 years...Thank You! Keeping 20,000+ hackers to help create & prepare the badges for 25,000 hackers. By lives, and give us a reason to get up at “Oh Dark Early” and work Wiseacre, CrYpT, Wad, AlxRogan, Jenn, latenite, redbeard, and
entertained in new and challenging ways may actually be the the time DEF CON starts we’ve put in months of planning, until “Is That The Fucking Time?” in order to dispense shiny. We Pinball have done a fantastic job in making sure that DC25 goes
biggest challenge of them all, and you make it look easy. organizing, and coordination. We’re proud of the small dedicated love our DEF CON family! See you next year! Major Malfunction. as smoothly as possible for both our vendors and attendees. Lastly,
team that’s spent a week on site before con, assembling the vendor area just wouldn’t have been the same if anyone other
Content: Nikita would like to thank the DEF CON 25 Reviewers for thousands of Human & Inhuman Badge registration bags so Registration:Reg shout outs: TW; Tyler and Matt; SOC, QM, than Roamer, he has set the standard that we all are working
their help in selecting the content for DEF CON. Through countless that LineCon has an expedient and joyous dénouement. Swag, and Info Booth; the line wranglers; anyone anywhere towards achieving each year. Thank you again to everyone.
hours, sleepless nights, tense gif wars, and heavy deliberation we who spends their con moving heavy stuff from one place to
came together to provide hackers with: 4 speaking tracks, 4 days NOC: Wow, DEF CON 25! As usual effffn and DEF CON would another; and the attendees, as always, for their patience. Workshops: Tottenkoph thanks all of those who worked to review
of content, 3 days of workshops, and several evening lounges. like to thank all the efforts of our industrious NOC team, the workshop proposals this year, Neil and Nikita for all of the
they put a lot of work in so you guys can enjoy the con. SOC: Cjunky and tacitus would like to thank AdaZebra, AK81, Alex hard work and help they do, and her amazing team of goons for
Thank you tremendously to all the speakers, co-speakers, and C, Amber, Angie, arcon, Ast0r, Atriyan, atropine, b3l, BeaMeR,
workshop instructors who’ve brought their content to us and made By the time you’re reading this, months of planning happened the effort they’re putting in. Thank you: Beaker, CyberSulu, Joel,
Blakdayz, Br1ck, Carric, Chosen1, CHRIS, Crusader, cymike, Dallas, Jen, SinderzNAshes, Jay, Flipper, Fallible, Brian, RandomInterrupt,
it accessible to the very hacker community we all love so much. and crazy few implementation days on site have been lived Darkwolf, deelo, dr.kaos, DrFed, Duckie, echosixx, Faz, FoxCaptain,
to cover everything we do for the con. From requests to BinaryBuddha. She would also like to give a shout-out to the
fr0gg3r, gadams, George, Glasswalk3r, GodFix, Hamster, Hattori QM, production, and SOC departments for their support.