WELCOME TO

DEF CON is a time to celebrate hacking, hijinks, curiosity, but most importantly community.
Being with the people that get it. Not having to explain why you have a WIFI scanning
hat on or that bottle of nitrogen you are carrying for the beverage cooling contest. Over
the decades community has become one of the most important aspects of the con as the
mysteries and secrets of hacking have gone mainstream. No longer an underground
conference, we emerged above ground and like it here!

Hacking is where the rubber meets the road, where what is technically possible is different
than what its creators imagined. Hacking has also become political as technology runs the
world. But hacking is ultimately social, trying to understand the larger systems, building
and breaking things together, mentoring, partnering, and ultimately even some getting
married at DEF CON. If that’s not social I don’t know what is.

When I started DEF CON THIRTY (!) years ago it was a simple idea: throw a party for
hackers, phreakers, artists, lawyers, and everyone adjacent. Hear from people you would
normally never come into contact with, and have a party. I decided against being invite
only and to hold it in a city that never sleeps. Back then I never anticipated or imagined
the potential of gathering people with so many different backgrounds together. I’d like to
say it was my master plan, but really it was a combination of luck, timing, friends helping,
and a desire from the community that made this all possible.

I dedicate this conference to you, who have traveled to the desert in the middle of the
summer to be with the communities you care about. I hope you make new friends and
unlock some new knowledge.

Cheers!

The Dark Tangent

TH3 BADG3
We're excited to be back this year with another awesome electronic badge for you! This year's
concept came from talking with many of you last year and the overwhelming majority wanted
something music based. It seems that everywhere you go at DEF CON there's music being played.
Ah, the sounds of DEF CON. A chaotic mixture of techno and excited chatter. Whether it's an official
party or someone with a portable speaker, there's music all around. It's part of the very fabric of
the con and we wanted to give everyone the chance to contribute to the sounds of DEF CON.

The badge is a sampling keyboard, which means that you can record sounds and play
them back to your favorite beat. There's a built-in microphone, or you can record audio
through the line-in jack. Listen to your beats with the onboard speaker, or connect the line-
out to something larger. You can even chain badges together and jam with your fellow
hackers. So go out and add your unique voice to the amazing sounds of DEF CON!
Thank you for allowing us the honor of making the DEF CON badge again. There were so many people
who helped us in this journey from concept to design, assembly, testing and more. Thank you!

-MK Factor

4
 N3TW0RK AND DCTV
For updated information and instructions on
NETWORK how to connect to the Wi-Fi with the n0t-s0-1337
INSTRUCTIONS Operating Systems along with the link to
download the digital certificate to be used, visit:
DEF CON 30! And here we are, the DEF CON https://wifireg.defcon.org.
NOC is back, delivering the best questionable
And if you don’t know how to properly configure
zero-trust network access throughout the new
the Wi-Fiz on your üb3r-1337 linux distro, you
awesome Caesars Forum (not to be confused
should consider a new platform.
with the Forum Shops at Caesars. But if you go
there, make sure to say hi to Micah, #1 Genius For NOC updates visit https://noc.defcon.org ,
Bar Employee <3), Flamingo, LINQ and Harrah’s and also follow us on twitter @DEFCON_NOC.
conference floors. Machine Learning, AI Peace, love and taco grease!
optimization, shift-left, IPv7 and Malört drinking,
it all should be working by the time you are
reading this.
Now to the important stuff, what should you do
in order to connect to Wi-Fi?
DCTV RETURNS!
Remember there are three (and no more than
three) official ESSIDs you should use to HACK DEFCON will be televised! Visit
THE PLANET!!!:
https://dctv.defcon.org
- The encrypted one with 802.1X authentication
and digital certificate verification: DefCon for the latest info including hotels, channels, and
limited streaming.
- The (other, yet legit) encrypted one with 802.1X
authentication and digital certificate verification.
But also, with some shiny WPA3 benefits:
DefCon-WPA3
- And the original, unencrypted, stick-shift, no
ABS, wildest-westest of the wireless networks:
DefCon-Open
DEF CON 30
“Choice. The problem is choice”
CONVENTION MEDIA
Wi-Fi and 802.1X authentication have had a SERVER
pretty good relationship in the past few years.
And, believe or not, we test stuff before we go All DC 30 Content is HERE
onsite. But things might change and there might
be some devices out there that really do not like https://10.0.0.16/
802.1X with PEAP authentication.
or
Important 802.1X fact: By configuring 802.1X
and choosing for your device to “not verify https://dc30-media.defcon.org/
server certificate” will probably not only let that
device connect to one of the hundreds of rogue Find this year’s presentation materials, music,
access points on the show floor but will also send white papers, slides, and more plus leech files
your login credentials to a rogue radius server. from all the past DEF CON conferences and the
Despite technology advancements, this is still no infocon.org conference archives!
bueno and defeats the whole purpose of this
authentication method. We expect you to leech at full speed, and the
server is warmed up and ready to go. Enjoy!
And the usual Guy Fieri special: Be an advocate
of cyber common sense (™), and do not, I To make things easier for you here are some
repeat, do NOT choose the same credentials example wget commands:
(aka: username and password) used for stuff
that matters: shopping sites, online-banking, the EXAMPLE wget command to download all of DEF
twitterz AND, especially your windows domains CON 25:
(yeah, it keeps happening) to connect to the
hacker conference network. Make something up, wget -np -m “https://dc30-media.defcon.org/
be creative and funny. infocon.org/cons/DEF CON/DEF CON 25/”

5
 C0DE 0F C0NDUCT/R3SOURCES
CONFERENCE CODE
OF CONDUCT
Last updated 3.6.15

DEF CON provides a forum for open

discussion between participants, where radical
viewpoints are welcome and a high degree of
skepticism is expected. However, insulting or
harassing other participants is unacceptable.
We want DEF CON to be a safe and
productive environment for everyone. It’s not
about what you look like but what’s in your
mind and how you present yourself that counts
at DEF CON.

We do not condone harassment against any

participant, for any reason. Harassment
includes deliberate intimidation and targeting
individuals in a manner that makes them feel
uncomfortable, unwelcome, or afraid.
DEF CON SUPPORT
HOTLINE
Participants asked to stop any harassing
behavior are expected to comply immediately.
Sometimes you may not want to contact a
We reserve the right to respond to harassment
Goon at the Info Booth or walking around in
in the manner we deem appropriate, including
person with a problem, and for the second
but not limited to expulsion without refund and
year in a row we have a phone option to tell
referral to the relevant authorities.
us about concerns.
This Code of Conduct applies to everyone
You can reach DEF CON staff during
participating at DEF CON - from attendees and
normal hours of operation (8am to 4am) to
exhibitors to speakers, press, volunteers, and
anonymously report any behavior violating
Goons.
our code of conduct or to find an empathic ear
Anyone can report harassment. If you are by calling +1 (725) 222-0934.
being harassed, notice that someone else is
For relevant issues, we are collaborating
being harassed, or have any other concerns,
with several organizations including Kick at
you can contact a Goon, go to the registration
Darkness, The Rape Crisis Center Las Vegas,
desk, or info booth.
and the Nevada Coalition to End Domestic
Conference staff will be happy to help and Sexual Violence to provide expert
participants contact hotel security, local resources for survivors, including dedicated
law enforcement, or otherwise assist those support for LGBTQ+.
experiencing harassment to feel safe for the
duration of DEF CON.

Remember: The CON is what you make of it,

and as a community we can create a great
experience for everyone.

- The Dark Tangent

6
 MASK P0LICY
Masks requirements include: The following do not fulfill
the mask requirements:
•Mask should be a solid,
multi-layer piece of material •Face shields or goggles
without slits, exhalation (unless to supplement a proper
valves, or punctures. and properly worn mask)
•A properly worn mask •Scarves, ski masks,
completely covers the nose balaclavas, or bandannas
and mouth and is well-fitted.
•Shirt or sweater collars pulled
•May contain filter up over the mouth and nose.
pockets or sleeves.
•Masks made from loosely woven or
•Medical masks and N-95 knitted fabrics that let light pass through
respirators fulfill the requirements.
•Masks made from non porous or too dense
materials (such as vinyl, plastic or leather)
•Masks that do not fit properly

G00NS
DEF CON Goons are the electrons that enable the conference to run, and
should you have a question or need help they are there for you. Here are
some goon facts:

DEF CON 30 Goons should all have visible

patches with their nickname on them so it is
easier to remember who you talk to about
what.

Goons are in one of two states, either ON duty or OFF duty.

If they are ON DUTY they will be wearing a current year, red, DEF CON
30 Goon shirt, a current year Goon badge, and a name patch.

If Goons are OFF DUTY they will not be wearing the red Goon shirt,
but may still have a Goon badge on so they can still access the meeting
spaces.

Goons ON DUTY are not supposed to drink alcohol.

Goons OFF DUTY have been known to drink alcohol.

PAST Goons may seen wearing previous red shirts or badges as they
helped run a past DEF CON, but that DOES NOT make them a current
DEF CON 30 Goon.

Please use the name patch if you have any feedback on Goons, good or
bad. Feedback can be sent to [email protected]

Goons Goon for many reasons, but the pay isn’t one of them. They put
in long hours and many weeks or months of planning and take time off
work to make the con happen for everyone. Please feel free to ask them
questions if you have any desire to join the ranks at a future Con.

7
 HACKER TRACKER

Download the official DEF CON app! It contains all of the happenings
of DEF CON. It is easy to use and updated as things change during the
conference. It contains all of the maps and schedules so you can plan
your best DEF CON experience.

FORUM.DEFCON.ORG
No matter what part of the DEF CON
universe you’re interested in, you
should start at the DEF CON Forums.
With a forum account you can reach
out to a local DEF CON group, help
us plan future events or even chat with
other hackers. DEF CON’s heart is its
community, and the community meets
at the DEF CON Forums. Join us!

HTTPS://PLAY.GOOGLE.COM/
STORE/APPS/DEVELOPER?ID=
DEF+CON+COMMUNICATIONS,+INC.

8
 W0RKSH0PS SCH3DUL3
WORKSHOP REGISTRATION WAS HELD ONLINE JULY 5TH. THERE IS NO ONSITE
REGISTRATION. SIGNUP SHEET, AND ALL SEATS (INCLUDING STANDBY) ARE SOLD OUT. FOR
MORE INFO ON THE WORKSHOPS VISIT DEFCON.ORG. PRE-REGISTRATION WILL BE ONLINE
AGAIN FOR DEF CON 31!
THURSDAY
Goldfield + Tonopah Elko Ely Reno
Protect/hunt/respond with The Purple Malware Network Hacking 101 Hands-On TCP/IP Deep
10:00-14:00

Fleet and osquery Development Approach Dive with Wireshark - How

this stuff really worksRyan
Holeman

reno SILVER Ely Elko

House of Heap Exploitation Introduction to Azure Pentesting Industrial Control Introduction to Software
15:00-19:00

Security Finding Security Systems 101: Capture the Defined Radios and RF
Vulnerabilities Through Flag! Hacking
Fuzzing

FRIDAY
Elko Copper Ely Lake Tahoe Reno
Finding Security CICD security: A new Introduction to The Art of DFIR Against the
10:00-14:00

Vulnerabilities eldorado Cryptographic Modern Malware Digital Darkness: An

Through Fuzzing Attacks Analysis: Initial Intro to Forensicating
Infection Malware, Evil
Infrastructure, and C2
Frameworks

Elko Copper Ely Lake Tahoe Reno

Hand On Mainframe Hacking the Metal Securing Industrial From Zero To Hero In Securing Smart
15:00-19:00

Buffer Overflows - 2: Hardware and Control Systems from A Blockchain Security Contracts
RCE Edition the Evolution of C the core: PLC secure
Creatures coding practices

SATURDAY
Reno Silver Copper Ely Lake Tahoe
Windows Defence CTF 101: Breaking Pivoting, Tunneling, Master Class: Dig Dug: The Lost Art
10:00-14:00

Evasion and into CTFs (or “The and Redirection Delivering a New of Network Tunneling
Fortification Primitives Petting Zoo” - Master Class Construct in Advanced
Breaking into CTFs) Volatile Memory
Analysis for Fun and
Profit

Reno ELKO Copper SILVER Lake Tahoe

Securing Web Apps Creating and Hybrid Phishing Automated Evading Detection: A
uncovering malicious Payloads: From Debugging Under Beginner’s Guide to
15:00-19:00

containers Threat-actors to You The Hood - Building Obfuscation

A Programmable
Windows Debugger
From Scratch (In
Python)

9
10
11
 PARTI3S & M33TUPS
A RCADE PA RT Y
Party at Caesars Forum - 136, 104, 105
Saturday: 21:00 - 00:00
The Arcade Party is back! Come play your favorite classic arcade games
while jamming out to Keith Myers DJing. Your favorite custom built 16
player LED foosball table will be ready for some competitive games.
This epic party is hosted by the Military Cyber Professionals
Association (a tech ed charity) and friends.
More info: ArcadeParty.org (open to all DEF CON attendees)

B L A NK E TFO RT CO N
Party at Caesars Forum - 109-110
Saturday: 19:30 - 01:00
Blanket Fort Con: Come for the chill vibes and diversity, stay for the
Blanket Fort Building, Cool Lights, Music, and, Kid Friendly\Safe
environment. Now with less Gluten and more animal onesies!

B LU E TE A M VI L L AGE
Party at LINQ Pool
Pool Party - BTV’s Five Year Anniversary
This year BTV will be celebrating five years at DEF CON!!! Join
us Friday night 8pm-11pm at the LINQ pool. Libations will be
available at the cash bar. Free tacos, sliders, and other goodies.
Dual Core will be performing at 9pm!
We hope to see you during this special Homecoming event.

DC4 0 4/ DC678/ DC7 70/ DC470 (ATL A NTA

ME TRO) MEE TU P
Meetup at Caesars Forum - 109-110
Friday: 16:00 - 19:00
They say Atlanta is the city too busy to hate, but it also has too much
traffic for its widespread hacker fam to get together in a single meetup.
So instead we’re meeting up in the desert during DEF CON - the one
time of year when intown, northern burbs, south siders, and anyone
else connected to (or interested in!) DC404’s 20+ year legacy can
catch up, share stories, and make new connections. Come prepared
to share your interests, hacks, swag, stories, and good times!

DC70 2 PW N AGOTCHI PA RT Y
Meetup at Caesars Forum - 110
Thursday: 18:00 - 21:00
Join DC702 for a Pwnagotchi party. The DC702 team will be auctioning off
kits and donating the proceeds to the EFF, as well as providing instructions
and guidance for assembly. Everyone is welcome to come by, and if you
have your own assembled or unassembled kit, feel free to bring it!

12
DEFCO N HO L L A N D DC3115 & DC3120
GRO U P MEE TU P
Meetup at Bird Bar in Flamingo
Friday: 16:00 - 19:00
In The Netherlands it’s a tradition to catch up with your colleagues
just before the end of the workday on Friday when the weekend
starts to kick in. In The Netherlands this is called the “VrijMiBo”
(Vrijdag/Friday - Middag/Afternoon Borrel/Drink)
“VrijMiBo/Friday afternoon Drink” at DefCon is a perfect moment to talk
about what your favorite thing is at DefCon, show your cool handmade
badges, impress other hackers about your latest hacks, make new
friends, gossip about your boss and show your cat or dog pictures.
Vrijdag Middag Borrel, Freitag Mittags Getränk, Apéritif du
vendredi après-midi, trago de viernes por la tarde.

DENIA L , DECEPTIO N , A N D DRINKS WITH

MITRE ENGAGE
Meetup at Society boardroom
Saturday: 17:00 to 19:00
Interested in cyber denial, deception, and adversary
engagement? Come join the MITRE Engage team for
conversations, war stories, and cyber shenanigans.

FRIEN DS OF BI L L W
Meetup at Caesars Forum - Unity Room
Thursday: 12:00 / 17:00, Friday: 12:00 / 17:00,
Saturday: 12:00 / 17:00, Sunday: 12:00
For all those Friends of Bill W. looking for a meeting or just a
quiet moment to regroup, we have you covered with meetings
throughout #DEFCON - Noon & 5pm Thurs-Sat, Noon Sun.

GI RLS HACK VI L L AGE

Meetup at Caesars Forum - 409
Friday: 18:30 - 21:30
You miss 100% of the shots you don’t take’ - Wayne Gretzky’
-Michael Scott” - Girls Hack Village. This meetup will be a fun
networking event that gives attendees the opportunity to meet and
make connections. Are you awkward at social gatherings? Are
you the life of the party? We endeavor to create an environment
where those on either side and anywhere in between are welcome
and feel as though they belong. Want to grow your brand or just
make new Hacker Summer Camp friends? Come one, come all.

GI RLS HACK VI L L AGE 90 ’S HO US E PA RT Y

Party at Caesars Forum - 409
Saturday: 20:30 - 00:00
Nostalgia, maybe? I think so. In honor of DEF CON 30, we’re
throwing it back to the era of slow jams and house party mixtapes.
We’ll be playing everything from power ballads and rap to
r&b and pop. Do like Kris Kross and Jump on the opportunity
to have a good time with good people to good music.
13
 PARTI3S & M33TUPS
GOTHCO N (#DCGOTHCO N)
Party at Caesars Forum - 136, 104, 105
Friday: 21:00 - 02:00
Back for their 5th year, GOTHCON welcomes everyone to come
dance and stomp the night away at their Techno Coven. 9pm-2am
Friday Aug 12th. Follow @dcgothcon on twitter for updates and details
on location. All are welcome (except nazis), and dress however you
want - whatever makes you the most comfortable and happy.

HACK E R FL AI RGRO U N DS
Meetup at Caesars Forum - Accord Boardroom
Saturday: 20:00 - 22:00
The destination for badge collectors, designers, and hardware hacks
to celebrate the flashier side of DEF CON. It is a melding of the 1337
and the un1eet interested in hardware and IoT. We see #badgelife,
#badgelove, SAOs and badge hacking as a great potential for securing
IoT and keeping the power in the hands of the consumer by spreading
knowledge about the craft/trade. Those involved should be celebrated for
sharing their knowledge. Many of them do not like the limelight, so this
gives us a chance to personally say thank you in a chill environment.

HACK E R K A R AOK E
Meetup at Caesars Forum - 133
Friday: 19:30 - 02:00, Saturday: 19:30 - 02:00
For those who love to sing and perform in front of others,
we are celebrating our 14th year of Love, Laughter, and
Song from 8 PM to 2 AM Friday and Saturday night.
We are open to everyone of any age, and singing is not required.
For more information visit:
https://hackerkaraoke.org or Twitter @hackerkaraoke.

L AW YE RS MEE T
Meetup at Parlor D & The Veranda at Harrah’s
Friday: 18:00
If you’re a lawyer (recently unfrozen or otherwise), a judge
or a law student please make a note to join Jeff McNamara
for a friendly get-together, drinks, and conversation.

MEE T THE DIGITA L L AB AT CO NS UME R

REPO RTS
Meetup at Caesars Forum - Accord Boardroom
Friday: 17:00 - 20:00
Consumer Reports Digital Lab is a team of hackers, technologists
and advocates that break the products we use every day to identify
vulnerabilities that harm consumers. Come meet CR’s resident hackers
and learn how you can hack alongside us. We’ll be showcasing our
work in IoT, VPNs, and data rights and asking you how we can better
leverage our security testing and research to provoke industry change.

14
MEE T THE EFF
Meetup at Caesars Forum - 410
Saturday: 20:00 - 22:00
Join the Electronic Frontier Foundation - The leading non-profit fighting for
civil liberties in the digital world- to chat about the latest developments in
Tech and Law and how these can help each other to build a better future.
The discussion will include updates on current EFF issues such as
Disciplinary technologies, Stalkerware, LGBTQ+ Rights, Reproductive
Rights, drones, updates on cases and legislation affecting security
research, and law enforcement partnerships with industry.
Half of this session will be given over to question-and-answer, so
it’s your chance to ask EFF questions about the law and tech.

PI LOTS A N D HACK E RS MEE TU P

Meetup at Caesars Forum, Caucus & Society Boardrooms
Friday: 20:00 to 22:00
Aerospace Village presents....
Buzzing the tower – a Pilot / Hacker meetup
Whether you are a hacker, a pilot, or have an interest in either
you are welcome to join us at Buzzing the Tower, a meetup
hosted by the Aerospace Village. Come and relax, squawk with
others, and try your hand at our DEF CON 30 themed Flight Sim
challenge! So please stow your tray table in readiness for landing
at the destination favoured by pilots and hackers alike!

Q U EE RCO N MIXE R
Meetup at Caesars Forum - Chillout
Thursday: 16:00 - 18:00, Friday: 16:00 - 18:00, Saturday: 16:00 - 18:00
The lgbtqia+ community in InfoSec is throwing a party to bring our folk
together and have a good time. Meet others like you or hang out with
those you’ve met over the years. This is a safe and inclusive space meant
to make you feel comfortable and help you socialize with others like you.

Q U EE RCO N PA RT Y
Party at Caesars Forum - 108-110
Friday: 22:00 - 01:00
The lgbtqia+ community in InfoSec is throwing a party to bring our folk
together and have a good time. Meet others like you or hang out with
those you’ve met over the years. This is a safe and inclusive space meant
to make you feel comfortable and help you socialize with others like you.

VE TCO N
Party at Caesars Forum - 139, 106
Saturday: 21:00 - 02:00
Co-founded in 2018 by Jim McMurry and William Kimble, the founders
of Milton Security and Cyber Defense Technologies, respectively, the
VETCON conference is the official Veteran event of the DEFCON Hacker
Conference. VETCON, through its Discord server and in person events, we
connect and support veterans in the Information Security field. The event
is open to all DEFCON attendees with a focus on military veterans.
VETCON Is a Conference for Veterans, Run by Veterans,
During the Largest Hacker Conference, DEFCON
15
 VILLAG3S
A DV E RS A RY VILL AG E
Friday: 10:00 - 17:00, Saturday: 10:00
- 17:00, Sunday: 10:00 - 15:00
Location: Flamingo, Scenic Ballroom
Adversary Village is a community initiative which purely focuses
on Adversary simulation/emulation, threat/APT emulation,
Breach and adversarial attack simulation, supply chain security
simulation, adversary tactics, life, adversary philosophy,
survival skills and Purple teaming.Adversary Village will be
organizing technical talks, workshops, live demos, Adversary
Wars CTF, panel discussions and other hands-on activities
on adversary simulation, emulation and purple teaming.
This is different from any of what has been covered in the existing
villages, because our focus is on simulation of the actions of a threat actor or an adversary
and this being simulated here. As this domain matures, we anticipate active participation from
enterprises, as such simulations would help immensely towards internal capacity building
from having a “live fire” training opportunity. An increasing number of researchers too
are focusing on building tools and techniques for simulation of various adversarial actions
against an organization or Supply chain, instead of actual real-world exploitation.
The goal of the Adversary Village would be to build a vendor neutral open security
community for the researchers and organizations, who are putting together new means and
methodologies towards the simulation/emulation of adversary tactics then purple teaming.
Adversary Wars CTF
Adversary Village will be hosting a CTF named “Adversary Wars”, where
the participants will have to pose as adversaries and simulate adversarial
actions against each element of the dummy target organization.
Our end-goal is to build a CTF platform for adversary simulation/
emulation knowledge sharing and exercises.
Adversary Wars would have real world simulation CTF scenarios and challenges, where the
adversaries can simulate attacks and learn new attack vectors, TTPs, techniques, etc.
There would be combined exercises which include different levels
of threat/adversary emulation and purple teaming.
Adversary Simulator booth
Adversary Simulator booth has hands-on adversary emulation plans specific
to a wide variety of threat-actors, these are meant to provide the participant/
visitor with a better understanding of the Adversary tactics.
This is a volunteer assisted activity where anyone, both management and technical folks
can come-in and experience different categories of simulation, emulation and purple
scenarios. Adversary Simulator booth will be having a lab environment focused on
recreating enterprise infrastructure, aimed at simulation and emulating various adversaries.
Visitors will be able to view, simulate and control various TTPs used by adversaries.
The simulator is meant to be a learning experience, irrespective of whether one is
hands-on with highly sophisticated attack tactics or from the management.

A E ROS PAC E VILL AG E

Friday: 10:00 - 17:00, Saturday:
10:00 - 17:00, Sunday: 10:00 - 13:00
Location: Caesars Forum, Forum Ballroom 112-117
The aviation and space industries, security researchers, and the public share a common goal:
safe, reliable, and trustworthy aviation and space operations. For too long, negative perceptions
and fractured trust on all sides have held back collaboration between the aviation, space, and

16
security researcher communities that has advanced safety, reliability, and security of other
industries. As the traditional domains of aviation safety and cybersecurity increasingly overlap,
more effective collaboration between stakeholders ensures we will be safer, sooner, together.
Through the Aerospace Village, the security research community invites industry leaders,
researchers and academia interested in aviation and space security, safety, and resilience
to attend, understand, collaborate together to achieve our common goals. Empathy
and understanding build common ground, while acts and words likely to increase
division between these two communities undermine these efforts. The Aerospace Village
welcomes those who seek to improve aviation and space security, safety, and resilience
through positive, productive collaboration among all ecosystem stakeholders.
Our Goal
The Aerospace Village is a volunteer team of hackers, pilots, and policy advisors who come
from the public and private sectors. We believe the flying public deserves safe, reliable, and
trustworthy air travel which is highly dependent on secure aviation and space operations.
Our Mission
Create, sustain, and grow an inclusive community focused on aerospace cybersecurity;
Inspire the next generation of aerospace cybersecurity leaders;
Promote and develop aerospace cybersecurity expertise and knowledge.
The Aviation Village will do this by:
- Building connections, trust, and understanding among all Village participants.
- Developing aerospace security skills among DEF CON attendees
through workshops and hands-on activities.
- Promoting constructive dialog through talks and interaction.

AI VILL AG E
Friday: 10:00 - 17:00, Saturday: 10:00 - 17:00,
17:00 - 19:00 meetup, Sunday: 10:00 - 14:00
Location: Caesars Forum, Summit Ballroom 236
Artificial Learning techniques are becoming more prevalent in core
security technologies like malware detection and network traffic
analysis. Its use has opened up new vectors for attacks against non-
traditional targets, such as deep learning based image recognition
systems used in self driving cars. There are unique challenges in
defending and attacking these machine learning systems that the security community needs to be
made aware of. This AI Village will introduce DEF CON attendees to these systems and the state
of the art in defending and attacking them. We will provide a setting to educate DEF CON at
large through workshops and a platform for researchers in this area to share the latest research.
We will have talks from our CFP, tutorials, and trainings during the earlier part of each day. On
Friday, our afternoon sessions will focus on the ethical use of AI technologies unlying different
business activities and the policies around them. We have commitment from federal government
policymakers to attend and participate in the policy panel discussion. On Saturday, our focus
will be how AI and artists are hacking creative endeavors in the visual arts and music. This
will include a generative art workshop, a gallery showing, and a music performance from the
Dadabots. Sunday will contain more talks from our CFP and our ending talk about AI.

17
 VILLAG3S
A P P S E C VILL AG E
Friday: 10:00 - 17:00, Saturday: 10:00
- 17:00, Sunday: 10:00 - 14:00
Location: Flamingo, Twilight Ballroom
The first three AppSec Villages were a resounding success. We
learned that whether in person or online, our AppSec community
is fantastic. We are pumped to be back bigger and better.
Come immerse yourself in everything the world of application security
has to offer. Whether you are a red, blue, or purple teamer, come
learn from the best of the best to exploit software vulnerabilities and secure software. Software is
everywhere, and Application Security vulnerabilities are lurking around every corner, making the
software attack surface attractive for abuse. If you are just an AppSec n00b or launch deserialization
attacks for fun and profit, you will find something to tickle your interest at the AppSec Village.
Software runs the world. Everything from IoT, medical devices, the power grid, smart
cars, voting apps - all of it has software behind it. Such a variety of topics will be reflected
in our cadre of guest speakers representing all backgrounds and walks of life.
AppSec Village welcomes all travelers to choose from talks by expert community members, an all
AppSec-focused CTF, contests that challenge your mind and your skillz, and more. Bring your thirst
for knowledge and passion for breaking things, and your visit to AppSec Village will be a thrill!

BIO HACK IN G
VILL AG E
Friday: 10:00 - 18:00,
Saturday: 10:00 - 18:00,
Sunday: 10:00 - 13:00
Location: Flamingo, Laughlin I,II,III
DEVICE LAB: The highly-collaborative environment builds health care, connecting
security researchers, manufacturers, clinicians, and regulators, to learn from each other
and develop skills, codifying best practices and paths for high fidelity cyber safety.
SPEAKER LAB: Speakers foster critical thinking, problem solving, human interaction literacy,
ethics debates, creativity, and collaboration. Subject matter experts and researchers share
the future of their research, reflecting the biological technologies and emerging threats.
CATALYST LAB: Providing interaction with thought leaders from the medical device
and citizen science communities through training and hands-on workshops and solutions
design, to cover the entirety of the biomedical device and security ecosystem.
CAPTURE THE FLAG: Featuring the virtual learning environment of St. Elvis Hospital, the CTF offers
protocol, regulatory, and biological challenges to access and assess vulnerabilities in real devices.
TABLE TOP EXERCISES: Discussion-based sessions of increasing complexity and difficulty
regarding vulnerabilities in a series of Machiavellian healthcare industry scenarios

18
 B L ACK S IN C YB E RS E CU RIT Y
VILL AG E
Friday: 10:00 - 16:00, Saturday:
10:00 - 16:00, Sunday: -
Location: Flamingo, Twilight Ballroom
The Blacks In Cybersecurity (B.I.C.) Village seeks to bring culturally
diverse perspectives to the holistic Cybersecurity community; by
way of a series of talks and a capture the flag event. In providing
these activities, we hope to help highlight Black experiences,
innovations in the field, Black culture and educate the community about Black history.
In doing this, we believe that we can better educate and normalize the discussion of deficiency or
prejudices in Cybersecurity education/development for minority communities. We also believe this
effort can be translated to aid in eradication of these issues in the Cybersecurity and Hacker/Maker
community and allow for more diverse hobbyists and professionals to engage and contribute.

B LU E TE A M VILL AG E
Friday: 10:00 - 18:00, Saturday: 10:00
- 18:00, Sunday: 10:00 - 15:00
Location: Flamingo, Savoy Ballroom
Welcome to the other side of the hacking mirror. Blue Team Village (our
friends just call us BTV) is both a place and a community built by defenders
for defenders. It’s a place to gather, talk, share, and learn from each
other about the latest tools, technologies, and tactics that our community
can use to detect attackers and prevent them from achieving their goals.
This year BTV will be running a series of hands-on workshops and
panel discussions that are part of BTV’s Project Obsidian project.
Project Obsidian is an immersive, defensive cybersecurity
learning experience that provides attendees with the opportunity to gain knowledge
of Incident Response (IR), Digital Forensics (DF), Reverse Engineering Malware (REM),
Cyber Threat Intelligence (CTI), and Cyber Threat Hunting (CTH). Deep dive into technical
topics through workshops and exercises that provide practical hands-on experience across
each discipline. Workshops provide the training necessary to help attendees develop
skills needed to be successful in their current and/or future role in cybersecurity.
Two of the most important takeaways we highlight is how to strategically approach a task and
the operational processes that support the goals and objectives behind each task. Knowing
ʻhow’ to do something is only part of the challenge. Knowing ʻwhen’ and ʻwhy’ to perform
certain tasks adds the required context for developing the full story of defensive security.
Sunday will include a recap and discussion on how we created three killchains that our redteam
executed for Project Obsidian. We’ll also discuss our approach and provide a behind-the-scenes
look at all the things that went into building content for Project Obsidian. Everything built for
Project Obsidian, from the ansible scripts used to build the infrastructure to the source code used
to develop our malware emulation programs will be provided to the community under the Creative
Commons Attribution-NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0) license.

19
 VILLAG3S
C A R HACK IN G VILL AG E
Friday: 10:00 - 17:00, Saturday: 10:00
- 17:00, Sunday: 10:00 - 12:00
Location: Caesars Forum,
Forum Ballroom 124-128
Learn, hack, play. The Car Hacking Village is an
open, collaborative space to hack actual vehicles
that you don’t have to worry about breaking! Don’t
have tools? We’ll loan you some. Never connected
to a car? We’ll show you how. Don’t know where the
controllers are? We’ll show you how to take it apart.
Check out CarHackingVillage.com or @CarHackVillage on Twitter for up-to-date information.
Want to learn more about automotive hacking and cyber security? Check
out our Discord server - https://discord.gg/JWCcTAM
We’ll also have a Car Hacking CTF which allows one to challenge their
automotive security skills. Come learn, hack and play!

C LO U D VI LL AG E
Friday: 10:00 - 17:00, Saturday: 10:00
- 17:00, Sunday: 10:00 - 13:00
Location: Flamingo, Scenic Ballroom
With the industry shifting towards cloud infrastructure at a
rapid speed, the presence of an open platform to discuss
and showcase cloud research becomes a necessity.
Cloud village is an open platform for researchers interested in the area of cloud security. We plan
to organize talks, tool demos, CTF, and workshops around Cloud Security and advancements.
Our CTF will be a jeopardy style 2.5 days contest where participants will have
to solve challenges around Cloud infrastructure, security, recon, etc. These
challenges will cover different cloud platforms including AWS, GCP, Azure, Digital
Ocean, Alibaba, etc. We will also reward our top 3 teams with awards.

C RYP TO P RIVAC Y
VILL AG E
Friday: 10:00 - 18:00, Saturday: 10:00
- 18:00, Sunday: 10:00 - 15:00
Location: Flamingo, Vista Ballroom
Crypto & Privacy Village helps bring cryptography &
privacy knowledge and practical skills to the hacker
community. Learn how to secure your own systems while picking up some tips and tricks on
how to break classical and modern encryption. CPV features workshops and talks on a wide
range of cryptography and privacy topics from experts. We’ll also have some Crypto 101 talks,
crypto-related games and puzzles, as well as running our imfamous Goldbug Challenge.

20
DATE DU P LIC ATION VILL AG E
Thursday: 16:00 - 19:00 Dropoff, Friday:
10:00 - 17:00, Saturday: 10:00 - 17:00,
Sunday: 10:00 - 11:00 Pickup
Location: Flamingo, exec conf ctr,
Lake Meade and Valley of Fire
The Data Duplication Village is ready for DC 30! We have all the
updated bits and bytes available from infocon.org packed up into
nice, neat packages. If you’re looking for something to fill up all
your unused storage, we have a few nice hash tables and all of
the DefCon talks. Add to that just about every other security con
talk known to human-kind! We provide a “free-to-you” service
where of direct access to terabytes of useful data to help build those hacking skills.
Check the schedule and/or dcddv.org for the most up-to-date information.
HOW IT WORKS
The DDV provides a core set of drive duplicators and data content options. We accept 6TB and
larger drives on a first come, first served basis and duplicate ʻtill we can no longer see straight.
Bring in your blank SATA3 drives - check them in early - to get the data you want. Come back
in about 24 hours to pick up your data-packed drive. Space allowing, we’ll accept drives all
the way through until Saturday morning - but remember, it’s FIFO - get those drives in early!
WHAT YOU GET
We’re working on more content right up until the last minute but for dc29, we provided:
- 6TB drive 1-3: All past hacking convention videos that DT could find, built on last years collection
and always adding more for your data consuming appetite.
- 6TB drive 2-3: freerainbowtables.com hash tables (1-2)
- 6TB drive 3-3: GSM A5/1 hash tables plus remaining freerainbowtables.com data (2-2)
The DC 30 content will be posted at dcddv.org once finalized
DT and KnightOwl post the up-to-date details in the DC Forum thread and you
are encouraged to ask any questions you have there as con approaches.

GI R L S HACK VILL AG E
Friday: 10:00 - 18:00, Saturday: 10:00
- 18:00, Sunday: 10:00 - 15:00
Location: Flamingo, Virginia City III
Girls Hack Village seeks to bring gender diverse perspectives of the
contributions, perspectives, and issues facing women/girl hackers.
It is a space to discuss issues affecting girls in cybersecurity and will
include Talks, Hands on Workshops, and Discussion Panels. The village
will also be having a networking event and a 90s house party.
Conference Day 1
Friday, August 12, 2022
Intro: Girls Hack Village Welcome- Tennisha Martin
Keynote 1: Mary Chaney
Workshop 1: Intro to CTF
LUNCH
Panel 1: Leading the Way – Mari Galloway, Tennisha Martin, Rebekah Skeete, Tayla Parker,
Monique Head, Eric Belardo, Yatia Hopkins: Moderator - Alshlon Banks
Session 1: First Year 1&2- Tasha Halloway & Crystal Phinn

21
 VILLAG3S
Workshop 2: Network Penetration Testing
Session 2: First Year 3 -Slam
Session 3: Varsity 1 – Melissa Miller
Session 4: Upper Class- Chantel Simms aka Root
Party: Shoot your Shot Networking
Conference Day 2
Saturday, August 13, 2022
Keynote 2: Yatia ( Tia) Hopkins
Session 5: Upperclassmen 1- Tanisha O’Donoghue
Session 6: Varsity 2- Saman Fatiman
Session 7: Upperclass 2 - Katorah Williams
Session 8: Upperclass 3- Ebony Pierce
LUNCH
Panel 2: Hacking Diversity – Tracey Z. Maleeff, Tennisha Martin, Rebekah Skeete, Tayla Parker,
Ebony Pierce, Melissa Miller, Sonju Walker: Moderator - Tessa Cole
Workshop 3: Protect the Pi
Session 8: Upperclass 4- Rebekah Skeete
Session 9: Varsity 3 – Tracy Z. Maleeff
Session 10: Upperclass 5- Tessa Cole
Closing: - Tennisha Martin
Party: 90s House Party
Conference Day 3
Sunday, August 14, 2022
Workshop 4: Mobile Penetration Testing

HA M R A DIO VILL AG E
Friday: 9:00 - 18:00, Saturday: 9:00
- 18:00, Sunday: 10:00 - 12:00
Location: Flamingo, Virginia City I, II
Ham radio isn’t just what your grandpa does in the shed
out back. Radios are an important piece of technology we
use everyday, and amateur (“ham”) radio has been at the
forefront of its development since day one -- we are some
of the original hardware hackers! DIY, exploration, and
sharing has always been a vital part of our community and the goal of Ham Radio Village is
to nurture this growth into the next generation with all of the amazing people at DEF CON.
Our village will have demos, talks, presentations, and of course, free license exams!
So come visit Ham Radio Village to learn more about the hobby, including how antennas
work (and how to build your own), how to actually use that software defined radio sitting
on the shelf, how to trackdown a rogue transmitter with a handheld radio, and how you can
*legally* transmit 1,500 Watts into the airwaves after taking a simple multiple-choice test!

22
 HA RDWA R E HACK IN G
VILL AG E
Friday: 10:00 - 18:00, Saturday: 10:00
- 18:00, Sunday: 10:00 - 13:00
Location: Flamingo, exec conf
ctr, Red Rock VI, VII, VII
Every day our lives become more connected to consumer
hardware. Every day the approved uses of that hardware
are reduced, while the real capabilities expand. Come discover
hardware hacking tricks and tips regain some of that capacity, and
make your own use for things! We have interactive demos to help you learn new skills. We have
challenges to compete against fellow attendees. We have some tools to help with your fever
dream modifications. Come share what you know and learn something new. Details @ dchhv.org

IC S VI LL AG E
Friday: 10:00 - 18:00, Saturday: 10:00
- 18:00, Sunday: 10:00 - 15:00
Location: Caesars Forum, Alliance
Ballroom 314 - 319
| Mission. ICS Village is a non-profit organization with the
purpose of providing education and awareness of Industrial
Control System security. Connecting public, industry,
media, policymakers, and others directly with ICS systems
and experts. Providing educational tools and materials to
increase understanding among media, policymakers, and
general population. Providing access to ICS for security
researchers to learn and test.Hands on instruction for industry to defend ICS systems.
Why. High profile Industrial Controls Systems security issues have grabbed
headlines and sparked changes throughout the global supply chain. The ICS
Village allows defenders of any experience level to understand these systems and
how to better prepare and respond to the changing threat landscape.
Exhibits. Interactive simulated ICS environments, such as Hack the Plan(e)t and Howdy Neighbor,
provide safe yet realistic examples to preserve safe, secure, and reliable operations. We bring
real components such as Programmable Logic Controllers (PLC), Human Machine Interfaces
(HMI), Remote Telemetry Units (RTU), actuators, to simulate a realistic environment throughout
different industrial sectors. Visitors can connect their laptops to assess these ICS devices
with common security scanners, network sniffers to sniff the industrial traffic, and more!
The Village provides workshops, talks, and training classes.

IOT VILL AG E
Friday: 10:00 - 18:00, Saturday: 10:00
- 18:00, Sunday: 10:00 - 15:00
Location: Caesars Forum, Alliance
Ballroom 310, 320
IoT Village advocates for advancing security in the Internet of
Things (IoT) industry through bringing researchers and industry
together. IoT Village hosts talks by expert security researchers,
interactive hacking labs, live bug hunting in the latest IoT tech, and
competitive IoT hacking contests. Over the years IoT Village has served as a platform to showcase

23
 Friday 1000 - 1800 | Saturday 1000 - 1800 | Sunday 1000 - 1300
For scehdules and other info: https://www.wallofsheep.com/pages/dc30
The Packet Hacking Village at DEF CON provides a learning experience for people of all skill levels, from absolute
beginners to seasoned professionals. We host practical training, network forensics and analysis games, and the renowned
Capture The Packet event, which has been a Black Badge contest over 10 times and draws the best of the best elite hackers
from around the world. Our mission has always been simple: to teach people good internet safety practices, and to provide
an atmosphere that encourages everyone to explore and learn. Everyone is welcome, period - regardless of industry or
experience. And when it’s time to relax and escape the convention craziness, our DJs provide a chill atmosphere while they
spin for the crowd in an open lounge area.

Wall Of Sheep
An interactive look at what can happen when you let your guard down on public networks, the infamous Wall of Sheep
passively monitors the DEF CON network looking for traffic utilizing insecure protocols. Drop by, hang out, and see for yourself
just how easy it can be! We strive to educate the “sheep” we catch, and provide a good-natured reminder that security
matters, and someone is always watching.

Wall of Sheep DJ Community - WoSDJCo

Come chill with us while we play all your favorite deep tracks,
underground house, techno, psytrance, dubstep yodeling, breaks, and
DnB beats mixed live all weekends. Chill and enjoy the sick beats and ill
stylings of our talented hacker DJs while you hack all the things. Check
website for schedule.

D J C o | Wa l l o f
OS Sh
|W ee
s
p

p
ho

|C
ks

ap
l k t h r o u gh Wor

tur
e The Pack

@wallofsheep

@capturetp
a

e
|W

t |P
o r

a
ct

ke
tD e
ete I n sp
ctive | Packet
 The Packet Hacking Village offers a revolving series of Walkthrough Workshops for people of all ages and skills, where
participants will take a deep dive into a variety of topics. Join the self-guided journey to learn about topics like honeypots,
botnets, RegEx, and more guided by our expert mentors! Check website for schedule of activities.

Capture The Packet - CTP

Come compete in the world’s most challenging cyber defense competition based on the Aries Security Cyber Range,
which DT has honored as a Black Badge event over 10 years. Tear through the challenges, traverse a hostile enterprise class
network, and diligently analyze your findings in order to make it out unscathed. Glory and prizes await those that emerge
victorious from this upgraded labyrinth, and only the best prepared and battle hardened will escape the fiendish crucible.
Follow us on Twitter at @Capturetp for the latest information on competition dates and times, as well as prizes.
Teams consist of up to 2 players and can register at the CTP table in the Packet Hacking Village.

Packet Inspector - Beginner/Intermediate

The perfect introduction to network analysis, sniffing, and forensics. Do you want to understand how hackers tap into
a network, steal passwords, and listen to conversations? Packet Inspector is your boot camp! Using a license of the world
famous Capture The Packet engine from Aries Security, we teach hands-on skills in a controlled real-time environment.
Join us in the Packet Hacking Village to start your quest towards getting a black belt in Packet-Fu.

Packet Detective - Intermediate/Advanced

Ready to upgrade your skills or see how you would fare in Capture The Packet? It’s time to play Packet Detective. A step
up in difficulty from Packet Investigator, Packet Detective will test your network hunting abilities t with real-world scenarios
at the intermediate level. Improve your network mastery in a friendly environment, learn from mentors and peers, and take
another step closer to preparing yourself for the highly competitive Capture The Packet contest.
 VILLAG3S
and uncover hundreds of new vulnerabilities, giving attendees the opportunity to learn about
the most innovative techniques to both hack and secure IoT. IoT Village is organized by security
consulting and research firm, Independent Security Evaluators (ISE), and Loudmouth Security.
Follow both ISE (@ISEsecurity) and IoT Village (@IoTvillage) on Twitter for updates.

LO CK PICK VILL AG E
Friday: 10:00 - 18:00, Saturday: 10:00
- 18:00, Sunday: 10:00 - 13:00
Location: Caesars Forum, Summit Ballroom 235
Want to tinker with locks and tools the likes of which you’ve
only seen in movies featuring police, spies, and secret
agents? Then come on by the Lockpick Village, run by The
Open Organization Of Lockpickers, where you will have the
opportunity to learn hands-on how the fundamental hardware
of physical security operates and how it can be compromised.
The Lockpick Village is a physical security demonstration and participation area. Visitors can
learn about the vulnerabilities of various locking devices, techniques used to exploit these
vulnerabilities, and practice on locks of various levels of difficultly to try it themselves.
Experts will be on hand to demonstrate and plenty of trial locks, pick tools, and other devices
will be available for you to handle. By exploring the faults and flaws in many popular lock
designs, you can not only learn about the fun hobby of sport-picking, but also gain a much
stronger knowledge about the best methods and practices for protecting your own property.

MIS IN FO R M ATION
VI LL AG E
Friday: 10:00 - 18:00, Saturday:
10:00 - 18:00, Sunday: -
Location: Caesars Forum, Summit Ballroom 218,236
Cognitive security is the application of information security principles, practices, and
tools to misinformation, disinformation, and influence operations. Cognitive Security
takes a socio-technical lens to high-volume, high-velocity, and high-variety forms of
“something is wrong on the internet”. Cognitive security can be seen as a holistic view
of disinformation and misinformation from a security practitioner’s perspective”.
MisinfoCon is a global movement focused on building solutions to promote online
trust, boost research and raise the profile of reliable and credible information.
The MisinfoCon event series are a learning, social and network opportunities for the
industry to come together and address the challenges of misinformation in all of its forms
and interdisciplinary domains. The first MisinfoCon was held at MIT in 2017. 5 years
later, we have hosted 8 MisininfoCon’s in Europe and the USA. This MisinfoCon 9.0. will
feature important sessions that advance our understanding of new content moderation
policies, regulating disinformation, protecting democratic elections and building trust.

PACK E T HACK IN G VILL AG E

Friday: 10:00 - 18:00, Saturday: 10:00
- 18:00, Sunday: 10:00 - 15:00
Location: Caesars Forum, Acadamy Ballroom 411-414, 420

26
 PA S S WO R D VILL AG E
Friday: 10:00 - 18:00, Saturday: 10:00
- 18:00, Sunday: 10:00 - 15:00
Location: Caesars Forum, Summit Ballroom 221
The Password Village provides training, discussion, and hands-
on access to hardware and techniques utilized in modern
password cracking, with an emphasis on how password
cracking relates to your job function and the real world . No
laptop? No problem! Feel free to use one of our terminals
to access a pre-configured GPGPU environment to run
password attacks against simulated real-world passwords.
Village staff and expert volunteers will be standing by to assist you with on-the-spot training
and introductions to Hashcat, as well as other FOSS cracking applications. Already a
password cracking aficionado? Feel free to give a lightning talk, show off your skills, help a
n00b learn the basics, or engage in riveting conversation with other password crackers.

PAYM E NT VI LL AG E
( VI RTUA L ON LY )
Friday: 10:00 - 18:00, Saturday: 10:00
- 18:00, Sunday: 10:00 - 15:00
Location: Virtual ONLY - Discord channels
Payment technologies are an integral part of our lives, yet few
of us know much about them. Have you ever wanted to learn
how payments work? Do you know how criminals bypass security
mechanisms on Point of Sales terminals, ATM’s and digital wallets?
Payment technologies are an integral part of our lives, yet few of us know much about them.
Have you ever wanted to learn how payments work? Do you know how criminals bypass
security mechanisms on Point of Sales terminals, ATM’s and digital wallets? Come to the Payment
Village and learn about the history of payments. We’ll teach you how hackers gain access to
banking endpoints, bypass fraud detection mechanisms, and ultimately, grab the money!

PHYS IC A L S E CU RIT Y
VILL AG E
Friday: 10:00 - 18:00, Saturday: 10:00
- 18:00, Sunday: 10:00 - 15:00
Location: Caesars Forum, Summit Ballroom 201-202
The Physical Security Village (formerly known as the Lock Bypass
Village) explores the world of hardware bypasses and techniques
generally outside of the realm of cyber security and lockpicking. Come
learn some of these bypasses, how to fix them, and have the opportunity to try them out for yourself!
We’ll be covering the basics, including the under-the-door-tool and latch slipping
attacks, as well as an in-depth look at more complicated bypasses. Learn about
elevator hacking, try out alarm system attacks at the sensor and communication
line, and have an inside look at common hardware to see how it works..
No prior experience or skills necessary - drop in and learn as much or as little as you’d like!
Looking for a challenge? Show us you can use lock bypass to escape from a
pair of standard handcuffs in under 30 seconds and receive a prize!

27
 VILLAG3S
P O LIC Y@ DE FCON .O RG
Friday: 10:00 - 18:00, Saturday: 10:00 - 18:00, Sunday: 10:00 - 15:00
Location: Caesars Forum, Summit Ballroom 224-227
Interested in the cutting edge of hacking technology and its policy implications? Interested
in talking with policy folks wanting an honest assessment of what is possible?
Hackers are early users and abusers of technology, and that technology is now critical to modern life.
As governments make policy decisions about technology hackers, researchers and academics need to
be part of that conversation before the decisions are made, and not after policies are implemented.
To do that DEF CON is a place for everyone on the policy and technology spectrum
to interact, learn from each other, and improve outcomes. As with previous
years, the Policy Team will be supporting DEF CON 30 in several ways:
1. By helping the policy community register for the event and orient themselves with the
opportunities to participate and join the conversation.
2. By building connections with technical and policy experts.
3. By providing opportunities for those interested in learning more about the challenges at the
intersection of policy and technology.
Our Policy program will consist of Main stage presentation and panels, daytime
sessions in our policy track, and some evening lounges that will provide an off the
record and more intimate setting to have policy-focused conversations.

Q UA NTUM VILL AG E
Friday: 10:00 - 18:00, Saturday: 10:00
- 18:00, Sunday: 10:00 - 15:00
Location: Caesars Forum, Summit Ballroom 217
!! CALLING ALL QUANTUM HACKERS !!
Q-Day is coming! Or is it…?
Welcome to DEF CON’s inaugural Quantum Village. At QV we want you to come and engage with,
explore, and discuss quantum technologies, and we have brought a few for you to play with, too!
We have a track of talks and workshops, and hands-on interactive ways you will learn how to use
(and hack) quantum tech. Come and play with quantum computers, learn about quantum sensors,
and see that you don’t need a PhD in physics to write quantum software (and maybe exploit it)!!

R A DIO FR EQU E N C Y VILL AG E

Friday: 10:00 - 18:00, Saturday: 10:00
- 18:00, Sunday: 10:00 - 15:00
Location: Flamingo, Eldarado Ballroom
After 14 years of evolution, from the WiFi Village, to the Wireless
Village, RF Hackers Sanctuary presents: The Radio Frequency Village
at DEF CON 30. The Radio Frequency Village is an environment where people come to learn
about the security of radio frequency (RF) transmissions, which includes wireless technology,
applications of software defined radio (SDR), Bluetooth (BT), Zigbee, WiFi, Z-wave, RFID, IR
and other protocols within the usable RF spectrum. As a security community we have grown
beyond WiFi, and even beyond Bluetooth and Zigbee. The RF Village includes talks on all
manner of radio frequency command and control as well as communication systems.
While everyone knows about the WiFi and Bluetooth attack surfaces, most of us rely on many
additional technologies every day. RF Hackers Sanctuary is supported by a group of experts in the
area of information security as it relates to RF technologies. RF Hackers Sanctuary’s common purpose
is to provide an environment in which participants may explore these technologies with a focus on

28
improving their skills through offense and defense. These learning environments are provided in the
form of guest speakers, panels, and Radio Frequency Capture the Flag games, to promote learning
on cutting edge topics as it relates to radio communications. We promise to still provide free WiFi.
https://rfhackers.com/the-crew
Speaker and contest schedule can be found on our website:
https://rfhackers.com/calendar
Co-located with the RF Village is the RF Capture the Flag. Come for
the talks, stay for the practice and the competition.

R E CON VI LL AG E
Friday: 10:00 - 18:00, Saturday: 10:00
- 18:00, Sunday: 10:00 - 13:00
Location: Linq, 3rd flr Social B and C
Recon Village is an Open Space with Talks, Live Demos, Workshops,
Discussions, CTFs, etc. with a common focus on Reconnaissance.
The core objective of this village is to spread awareness about the
importance of reconnaissance, open-source intelligence (OSINT) and demonstrate how even a small
information about a target can cause catastrophic damage to individuals and organizations.
As recon is a vital phase for infosec as well as investigations, folks should definitely have this
skill set in their arsenal. People should check out Recon Village, as they get to learn novel
osint / recon techniques, play hands-on CTF, and most of all, have fun. At RV, we keep things
simple and the focus is on generating quality content using talks, CTF, hackathons, etc.
We will also have our Jeopardy Style OSINT CTF Contest throughout the Village timings. Based on
the feedback from last year, we plan to make the CTF more challenging this year. The challenges will
be around harvesting information about target organizations, their employee’s social media profiles,
their public svn/gits, password breach dumps, darknet, paste(s) etc. followed by active exploitation,
bug hunting, investigation and pentest scenarios of virtual targets. All the target organizations,
employees, servers, etc. will be created by our team and hence will not attract any legal issues.
Similar to the previous years, there will be Awesome rewards for CTF winners, along with free
t-shirts, stickers, village coins, and other schwag which attendees can grab and show off.
Guess what! our Badge will also be more interesting this time and as usual, it will be free.

R E D TE A M VILL AG E
Friday: 10:00 - 18:00, Saturday: 10:00
- 18:00, Sunday: 10:00 - 13:00
Location: Flamingo, Mesquite Ballroom
The Red Team Village is focused on training the art of critical
thinking, collaboration, and strategy in offensive security. The
RTV brings together information security professionals to share
new tactics and techniques in offensive security. Hundreds of
volunteers from around the world generate and share content with
other offensively minded individuals in our workshops, trainings, talks, and conferences.

29
 VILLAG3S
R E TAI L HACK IN G
VILL AG E
Friday: 10:00 - 18:00, Saturday:
10:00 - 18:00, Sunday: 10:00 - 15:00
Location: Caesars Forum, Alliance Ballroom
320
Cha-ching. Love it or not we are surrounded by retail, be a point of sale systems, grocery
stores, clothing stores, and more. At the Retail Hacking Village, you will be able to lay hands
on retail technology such as point of sale units, electronic tags and systems, and more. And,
we can dig in and explore retail talks, with insiders showing you a glimpse into this industry.

RO G U E S VILL AG E
Friday: 10:00 - 18:00, Saturday: 10:00
- 18:00, Sunday: 10:00 - 15:00
Location: Linq, 3rd flr Evolution
Rogues Village is a place to explore alternative approaches
and uses for security concepts, tools, and techniques by
looking to non-traditional areas of knowledge. Incorporating
expertise from the worlds of magic, sleight of hand, con games,
and advantage play, this village has a special emphasis on
the overlap between Social Engineering, Physical Security, and Playful Mischief.

S K Y TA LK S 3 0 3
Friday: 08:30-
18:30, Saturday: 08:30-18:30, Sunday: 08-30-14:00
Location: Linq, 5th flr BLOQ
Since DEF CON 16, Skytalks has been proud to bring you Old School DEF CON in a non-
recorded, off-the-record track. Talks include technical deep dives, off-the-beaten path
discussions, name-and-shame rants, cool technology projects, and plenty of shenanigans.
We pride ourselves on a simple creed: “No recording. No photographs. No bullshit.”

S O CIA L E N GIN E E RIN G

COM MU NIT Y
Friday: 10:00 - 19:00, Saturday: 10:00
- 19:00, Sunday: 10:00 - 15:00
Location: Linq, 3rd flr Social A
The Social Engineering Community is formed by a group of individuals
who have a passion to enable people of all ages and backgrounds
interested in Social Engineering with a venue to learn, discuss,
and practice this craft. We plan to use this opportunity at DEF CON to present a community
space that offers those elements through panels, presentations, research opportunities, and
contests in order to act as a catalyst to foster discussion, advance the craft and create a space
for individuals to expand their network. DEF CON attendees can either participate in these
events (watch for our Call for Papers, Call for Contestants, Call for Research, etc.), or they

30
can watch the events unfold and learn about Social Engineering as an audience member.
JC and Snow plan to accomplish the above by bringing together passionate individuals to have a
shared stake in building this community. To do this, positions which can be rotated such as judges,
coaches, speakers and panelists will be offered to different community members each year allowing
for new faces and ideas so that more individuals have an opportunity to give back equally. You can
stay up-to-date with the SE Community by visiting our Twitter account https://twitter.com/sec_defcon

S O LDE R S K ILL S VILL AG E

Friday: 10:00 - 18:00, Saturday: 10:00 - 18:00, Sunday: 10:00 - 13:00
Location: Flamingo, exec conf ctr, Red Rock I, II, III, IV, V
Have you ever fused metal to create electronic mayhem? Do you want to learn? Travel too far
to take your solder tools with you? Hotel take your irons cause they thought it was a fire risk?
Come on over to the Solder Skills village. We have irons and supplies. Volunteers (and some
attendees) help teach, advise or just put out fires. We aim to grow the skill-set of the community
and overcome inhibitions to this most basic skill to make electronic dreams happen.

TA M P E R E VIDE N C E VILL AG E
Friday: 10:00 - 18:00, Saturday: 10:00 - 18:00, Sunday: 10:00 - 13:00
Location: Caesars Forum, Summit Ballroom 235
“Tamper-evident” refers to a physical security technology that provides evidence of tampering
(access, damage, repair, or replacement) to determine authenticity or integrity of a container
or object(s). In practical terms, this can be a piece of tape that closes an envelope, a
plastic detainer that secures a hasp, or an ink used to identify a legitimate document.
Tamper-evident technologies are often confused with “tamper resistant” or “tamper proof”
technologies which attempt to prevent tampering in the first place. Referred to individually
as “seals,” many tamper technologies are easy to destroy, but a destroyed (or missing) seal
would provide evidence of tampering! The goal of the TEV is to teach attendees how these
technologies work and how many can be tampered with without leaving evidence.

VOTIN G M ACHIN E VILL AG E

Friday: 10:00 - 18:00, Saturday: 10:00
- 18:00, Sunday: 10:00 - 15:00
Location: Caesars Forum, Alliance
Ballroom 313-314, 320
Voting Machine Village explores all aspects of election
security and works to promote a more secure democracy.

31
 DEF CON CTF powered by

NAUTILUS INSTITUTE
After a spectacular run by the Order of the Overflow, the
Nautilus Institute is looking forward to bringing you the future
of DEF CON Capture The Flag: three days of attack-defense
action with sixteen of the best hacking teams in the world.
Our teams will be reverse engineering, pwning, and pushing
other hackers off their boxes in a head to head computing
competition to directly demonstrate effective exploitation for
the future.

How to Qualify
DEF CON CTF is a popular contest. Over 1200 teams played
in DEF CON CTF Qualifiers in May, with over 200 solving
two or more challenges. We qualified last year’s champions,
Katzebin, and 15 of the top quals teams.
Our competitors hacked their way through an ARM trustzone
applet, dug deep into the Missouri Encryption Standard
(base64, of course), and pieced together a flag by reverse
engineering 24,315 binaries for 16 different architectures.
Interested in bringing a team to DEF CON 31? Study up on
previous DEF CON CTF challenges, perfect your techniques,
and stay tuned for news about how to qualify in 2023.

Game schedule, Scores, and More

https://nautilus.institute
 Quals Scores
2649
perfect r✪✪✪t
Spectating CTF 2303
[email protected]
Visit the CTF room to take 2069
The Duck
in the ambience of the 1921
contest. CTF is a marathon, Sauercloud
1889
not a sprint, so the vibes in Water Paddler
1829
the room may shift as the PTB_W TL
1823
contest progresses through ./V /home/r/.bin/tw
1722
Sunday. Straw Hat
1567
PPP
Enjoy yourself, learn about 1556
Katzebin
the game, but please be 1489
StarBugs
respectful! The competitors 1388
Shellphish
have worked very hard to 1311
r3kapig
qualify, and distractions 1287
DiceGuesser
may not be appreciated. 1151
OSUSEC
If you have questions the new organizers
1148
about CTF, members of 侍
1128
the Nautilus Institute can More Bush Smoked Whack
ers 1084
probably help you with mhackeroni
1054
answers! 1054
0xEA

Brighter Tomorrows
We’re excited to be making the world of DEF CON CTF a
better place. As we grow, we hope to allow more disciplines
to flex at CTF, and we hope you’ll be a part of that. Thank you
to the CTF and DEF CON communities for this incredible
opportunity. We hope to build a bright future for you to break.

Announcements and News

https://twitter.com/nautilus_ctf
 C0NT3STS & EV3NTS
in 3D simulators. This year, we propose a hybrid
A L PAC@TAC K event with in-person challenges on-site. We also
In-person Contest plan to introduce some new challenges with real
vehicles involved, in addition to those based
Alpac@tack is an interactive defense simulation on autonomous driving simulators. We hope
suite, which challenges participants to to continue the engagement with the hacking
apply a wide variety of tools, knowledge community to raise the awareness of real-world
and problem-solving skills to assess security challenges in autonomous driving.
network and log activity, and build threat
intelligence in a honeypot environment. The AutoDriving CTF contest focuses on the
emerging security challenges in autonomous
Unlike most Defcon contests, Alpac@tack driving systems. Various levels of self-driving
provides a unique opportunity for participants to functionalities, such as AI-powered perception,
develop and hone a more holistic skill set when sensor fusion and route planning, are entering
it comes to threat assessment. Other contests the product portfolio of automobile companies.
will focus on breaking machines or defending From the security perspective, these AI-powered
systems from a particular threat, where Alpac@ components not only contain common security
tack presents a leveled-up experience and problems such as memory safety bugs, but
challenges attendees to evaluate whether the also introduce new threats such as physical
honeypot is under attack, and if so, by what. adversarial attacks and sensor manipulations.
Teams achieve success during the contest by Two popular examples of physical adversarial
expeditiously analyzing activity and accurately attacks are camouflage stickers that interfere
identifying threats. Every team will be presented with vehicle detection systems, and road graffitis
with a graph and a set of tools––the game that disturb lane keeping systems. The AI-
platform––including Wireshark, Suricata, powered navigation and control relies on the
Velociraptor, and Wazuh, which will act as their fusion of multiple sensor inputs, and many of the
source of truth for analyzing network and logging sensor inputs can be manipulated by malicious
activity in the honeypot. The graph will update attackers. These manipulations combined
every 5 seconds, reflecting events and packets with logical bugs in autonomous driving
on ports and services. Participant teams must systems pose severe threats to road safety.
then select and leverage the appropriate tools to We design autonomous driving CTF
investigate and determine whether the incident is (AutoDriving CTF) contests around the
a benign anomaly or an attack. For each event security challenges specific to these self-
and packet cataloged in the game platform, the driving functions and components.
team submits a report classifying the activity.
The goals of the AutoDriving
While Alpac@tack is designed for players with CTF are the followings:
some degree of literacy in defense systems, we
will offer an associated workshop to provide - Demonstrate security risks of poorly designed
an overview of the relevant systems and autonomous driving systems through hands-
technologies the day prior to the contest with on challenges, increase the awareness
the goal of lowering the barrier to entry. So, of such risks in security professionals,
if you’re a beginner––or just a little rusty–– and encourage them to propose defense
don’t be discouraged! Alpac@tack is for you! solutions and tools to detect such risks.
- Provide CTF challenges that allow players
to learn attack and defense practices related
AU TODR IVIN G C TF  to autonomous driving in a well-controlled,
repeatable, and visible environment.
Hybrid Contest - Build a set of vulnerable autonomous
driving components that can be used for
security research and defense evaluation.
The contest is based on a Jeopardy style of CTF
game with a set of independent challenges. A
typical contest challenge includes a backend
that runs autonomous driving components in
simulated or real environments, and a frontend
#Overview that interacts with the players. This year’s
Last year, we organized the AutoDriving CTF as contest will follow the style of last year and
an official contest of DEF CON 29 (https://forum. includes the following types of challenges:
defcon.org/node/237292) and did reasonably - “attack”: such as constructing adversarial
well: more than 100 teams participated and 93 patches and spoofing fake sensor inputs,
teams had valid scores. Last year, due to the
pandemic, the contest was online only with on-site - “forensics”: such as investigating a security
demonstrations. All the challenges were deployed incident related to autonomous driving,
34
- “detection”: such as detecting spoofed Most of the challenges do not require domain
sensor inputs and fake obstacles, knowledge of autonomous driving software
or adversarial machine learning, although
- “crashme on road!”: such as creating
knowledge of those helps. For example, the
dangerous traffic patterns to expose logical
players can generate images the way they
errors in autonomous driving systems.
like (e.g., drawing, photoshopping) to fool the
Most of these challenges will be developed AI-components or write a short python script to
using game-engine based autonomous driving control the vehicle. Some challenges, such as
simulators, such as CARLA and SVL. incident forensics likely would require players
The following link containssome challenge to learn domain knowledge such as sensor
videos from AutoDriving CTF at DEF CON 29 information format and how fusion works.

https://www.youtube.com/channel/ - What do we expect players to

UCPPsKbVpxwk-464KIzr8xKw learn through the CTF event?

# What’s new in 2022 Players can (1) gain a deep understanding of

real-world autonomous driving systems’ design,
This year, we will unlock new security-critical implementation, and their corresponding
driving scenarios such as stop-controlled and security properties and characteristics; and (2)
signalized intersections. New difficulty levels learn the attack and defense practices related
will be added to challenges in such scenarios to autonomous driving in a well-controlled,
by integrating real downstream AI modules repeatable, visible, and engaging environment.
such as object tracking from open-source
autonomous driving software like Apollo, @autodrivingctf
Autoware and OpenPilot. For example, players
will be required to generate adversarial masks
which will be overlayed on the surface of a
stop sign to prevent the self-driving vehicle from
B E VE R AG E COOL IN G
stopping. The self-driving vehicle is equipped CON TR A P TION CON TE S T
with a tracking component so merely hiding
the stop sign in several frames will not work. In-person Contest

A video demonstrating an attacked

scenario is available at
https://youtu.be/4aedG1GNfRw
In addition to the simulation challenges, we
will add challenges with real vehicles in the
loop. In this setup, the vehicle under attack
will be placed on a rack and the driving
environment will be displayed on a monitor in 3 0
front of the windshield camera. We will have
the real vehicle running in a lab and players
and players will interact with the vehicle by
remotely manipulating the virtual surrounding
environments (such as the projected road signs
in front of the vehicle). The attack results will
6
be judged based on systems logs (for open-
source systems, such as openpilot) or dashboard It’s DEFCON 30 and the world is a tumultuous
visualizations (for closed-source vehicles). place. Maybe Putan has invaded NATO.
Maybe China has invaded Taiwan or doubled
The following URL shows some down on its bid to claim the oddly sack-shaped
specifications about the real vehicles “nine dash line”. I think Pooh Bear may be
https://docs.google.com/ trying to compensate for something. Whatever
document/d/1oFC5Swn-UQ3hqIBA_ the current events, I’m going to claim WWIII
Pw511o8WZqToU4TcQCb3UYocFc/ is right around the corner and you should be
edit?usp=sharing prepared! Prepared to chill your beverage
that is. If the world is ending, do you really
In order to enable the audience to experience want to see it out with a warm beverage!? I
the challenges more directly, we plan to set thought not! If I’m going out in a nuclear hellfire
up a vehicle wheel controller on site this year. I want it to be with ice cold suds. So come on
Audiences can drive themselves to compete with down and let’s get prepped! In person only
the self-driving vehicle in some of the challenges.
Friday 1100 - 1400
# For players
Maybe something on Saturday if
- What do players need to do to beverage remains and interest exists.
participate AutoDriving CTF?
35
 C0NTESTS & EV3NTS
BIC VIL L AG E C A P TUR E C A R HAC K IN G VIL L AG E
TH E FL AG  C TF
Hybrid Contest In-person Contest
The Car Hacking
Village CTF is a
fun interactive
challenge which gives
contestants first hand
experience to interact
with automotive
The BIC Village Capture The Flag Event is technologies. We
a jeopardy style event designed to practice work with multiple
solving challenges in multiple categories. automotive OE’s
and suppliers
This event seeks to not only be a series of puzzles
to ensure our challenges give a real-world
and challenges to solve, but a gamified way to
experience to hacking cars. We understand
learn concepts of social justice and Black history.
car hacking can be expensive, so please
The gamified and challenge oriented sections
come check out our village and flex your
of the event will not only challenge one’s mind
skills in hacking automotive technologies.
in problem solving and critical thinking but also
charge one with the mission of identifying and https://www.carhackingvillage.com/
learning about historical facts and figures that @CarHackVillage
they would not otherwise be exposed to.
https://www.blacksincyberconf.com/ctf
@BlackInCyberCo1 C M D + C TR L 
Hybrid Contest

C A P TUR E TH E PAC K E T
In Packet Hacking Village
The time for those of hardened mettle is
drawing near; are you prepared to battle?
Friday 1000 PDT (GMT -7) to
Compete in the world’s most challenging Saturday 1800 PDT (GMT -7)
cyber defense competition based on the Aries
Security cyber range. Tear through hundreds HEY HACKERS! ARE YOU LEET? PROVE
of bleeding-edge challenges, traverse a IT BY BEATING MAILJAY, OUR NEW
hostile enterprise-class network, and diligently CYBER RANGE. POSTMESSAGE XSS!
analyze the findings to escape unscathed. MFA BYPASS! RCE! LEENUX PRIVESC!
Glory and prizes await those who emerge HTTP DESYNC!?!?!? AND MORE!?!?!?
victorious from this upgraded labyrinth. Join CMD+CTRL @ DEF CON 30
While Capture The Packet can easily scale for for this challenging CTF.
users of every level, for DEF CON we pull out all CMD+CTRL Cyber Range is an interactive
the stops and present our most fiendishly difficult learning and hacking platform where
puzzles. Capture The Packet has been a DEF development, security, IT, and other roles
CON Black Badge event for over 10 years, and come together to build an appreciation for
we don’t plan on stopping. This event attracts the protecting the enterprise. Players learn security
best of the best from around the world to play techniques in a real-world environment where
– are you ready to show us what you’ve got? they compete to find vulnerabilities. Real-time
https://www.capturethepacket.com/ scoring keeps everyone engaged and creates
friendly competition. Our Cloud and App
@capturetp, @wallofsheep Cyber Ranges incorporate authentic, fully
functioning applications and vulnerabilities
often found in commercial web platforms.
At DEF CON 30: We will be debuting our latest
Cloud Cyber Range, MailJay, which focuses on
exploiting a modern email marketing platform
comprised of web applications, services, and a
variety of cloud resources. Inspired by the latest
trends and real world exploits, try your hands at
36
bypassing a WAF, HTTP Desync, postMessage
XSS, RCE, MFA bypass, and so, so much more! C R A S H A ND COM P IL E 
With twice as many challenges as our past Cloud In-person Contest
Ranges do you think you can complete them all?
What happens when you take an ACM style
This year we are happy to announce that we will programming contest, smash it head long into
be returning to DEF CON in person. We will be a drinking game, throw in a mix of our most
running this event both on site and online via distracting helpers, then shove the resulting
Discord. Join us Friday (8/12) through Saturday chaos incarnate onto a stage? You get the
(8/13) for this invite-only CTF by signing up contest known as Crash and Compile.
with the registration form below. This event is
limited to 250 players, so save your seat now! Teams are given programming challenges and
have to solve them with code. If your code
Register here: https://forms. fails to compile? Take a drink. Segfault? Take a
gle/3TbT4JWsTfWVwr6r9 drink. Did your code fail to produce the correct
More info: http://defcon30.cmdnctrl.net answer when you ran it? Take a drink. We set
you against the clock and the other teams. And
Twitter: @cmdnctrl_defcon because our “Team Distraction” think watching
defcon30.cmdnctrl.net(will be online shortly) people simply code is boring, they have taken it
upon themselves to be creative in hindering you
@cmdnctrl_defcon
from programming, much to the enjoyment of
the audience. At the end of the night, one team
will have proven their ability, and walk away
C R AC K M E IF YO U C A N with the coveted Crash and Compile trophy.

(C M IYC) Crash and Compile is looking for the top

programmers to test their skills in our contest.
Contest Can you complete our challenges? Can you
do so with style that sets your team ahead
In its 13th year,
of the others? To play our game you must
the premiere
first complete our qualifying round. Gather
password
your team and see if you have the coding
cracking
chops to secure your place as one of the
contest
top teams to move on to the main contest.
“CrackMeIfYouCan” is back again to challenge
the world’s best password crackers. The contest Qualifications for Crash and Compile
is broken up into Pro and Street teams - so will take place Friday from 10am to 3pm
ʻtake a chill pill’ if you are new to password online at https://crashandcompile.org.
cracking (and don’t have jigowatts of GPU You may have up to two people
power), there is still plenty of fun to be had. per team. (Having two people on
We’ve spent all year coming up with password- a team is highly suggested)
related challenges for our Pro teams that
are DaBomb! So listen up home skillet, come Of the qualifiers, nine teams will move on to
see us in the Villages area where we will compete head to head on the contest stage.
have some hella nice professional password The main contest takes place
crackers who are all that, and a bag of chips! Saturday 17:00 - 20:00.
This year’s contest is going to be totally radical! Contest Area Stage
We are like, totally psyched to be partnering
with the Password Village this year. I kid you web: https://crashandcompile.org/
not, the contest is going to be so easy that @CrashAndCompile
even an airhead or a jock could crack these
passwords! PYSCH! The challenges are going
to be bodacious and like totally dope. This
year, it is not about wordlists, rules, patterns, C R E ATIVE WR ITIN G
or about forensics. In the past we’ve asked our
teams how passwords have changed over time... S HORT S TORY CON TE S T 
now we are going to ask them to go back, to online Contest
the future of password cracking. Like, totally.
The DEF CON Short Story contest is a pre-
https://contest.korelogic.com/ con contest that is run entirely online utilizing
@CrackMeIfYouCan the DEF CON forums, Twitter, and reddit. This
contest follows the theme of DEF CON for the
year and encourages hackers to roll up their
sleeves, don their proverbial thinking cap, and
write the best creative story that they can. The
Short Story Contest encourages skills that are
37
 C0NTESTS & EV3NTS
invaluable in the hacker’s world, but are often
overlooked. Creative writing in a contest setting DE F CON 3 0 C H E S S
helps celebrate creativity and originality in
arenas other than hardware or software hacking
TO UR N A M E N T
and provides a creative outlet for individuals who In-person Contest
may not have another place to tell their stories.
More Info: @dcshortstory
https://twitter.com/dcshortstory

DA R K N E T- N G 
Hybrid Contest

Chess, computers, and hacking. In the 18th

century, the Mechanical Turk appeared to play
a good game, but there was a human ghost in
the shell. Some of the first computer software was
written to play chess. In 1997, world champion
Garry Kasparov lost to Deep Blue, but he
accused IBM of cheating, alleging that only a
rival grandmaster could make certain moves.
At DEF CON 30, we will run a human
chess tournament with a “blitz” time control
of 5 minutes on each player’s clock, in a
Darknet-NG is an In-Person Massively Multiplayer Swiss-system format. In each round, match
Online Role Playing Game (MMO-RPG), where pairings are based on similar running scores.
the players take on the Persona of an Agent who Everyone plays the full tournament, and the
is sent on Quests to learn real skills and gain winner has the highest aggregate score.
in-game points. If this is your first time at DEF The Las Vegas Chess Center (LVCC) will
CON, this is a great place to start, because we manage the tournament. To help crown
assume no prior knowledge. Building from basic the best chess player at DEF CON 30, we
concepts, we teach agents about a range of will register the rated players first, on site,
topics from Lock-picking, to using and decoding starting one hour prior to the tournament.”
ciphers, to Electronics 101, just to name a few,
Saturday 15:00 - 18:00 Room 133 Forum
all while also helping to connect them to the
larger DEF CON Community. The “Learning
Quests” help the agent gather knowledge from
all across the other villages at the conference, DE F CON BIK E R IDE
while the “Challenge Quests” help hone their
skills! Sunday Morning there is a BOSS FIGHT “ C YC L E OVE R R IDE ”
where the Agents must use their combined
Hybrid Event
skills as a community and take on that year’s
challenge! There is a whole skill tree of personal At 6am on
knowledge to obtain, community to connect Friday, the
with and memories to make! To get started, cycle_override
check out our site https://darknet-ng.network crew will be
and join our growing Discord Community! hosting the
10th Defcon
Friday: 10 am - 4:30 pm
Bikeride. We
Saturday: 10 am - 4:30 pm miscounted
Sunday: 10 am - 12 pm last year which
was really
https://darknet-ng.network/ the 9th. We’ll
@DarknetNg meet at a local
bikeshop,
get some
rental bicycles, and about 7am will make the
ride out to Red Rocks. It’s about a 15 mile ride,

38
all downhill on the return journey. So, if you
are crazy enough to join us, get some water, DE F CON S C AVE N G E R
and head over to cycleoverride.org for more
info. See at 6am Friday! jp_bourget gdead
HU N T
heidishmoo. Go to cycleoverride.org for more In-person Contest
info. In the event that there is no on site Defcon,
we will do a virtual ride during Defcon,.

DE F CON M UD
Hybrid Contest
Multi User Dungeons or MUD’s are the text
based precursors to MMO’s. THe DEFCON
MUD is an intentionally vulnerable game written
in a language called LPC. The theme every
year varies. This year we will be going back
to the original engine as featured in DEFCON
27. All new areas will be built to frustrate
players. The game will launch 2 weeks before
DEFCON and will run until DEFCON Sunday.
Can you beat the game, can you find the sword
of 1000 truths, can you find the exploits?
Game opens 2 weeks before DEFCON to
allow people time to explore and play.
There will be a formal scoring system which
will be released thursday evening. On site
The DEF CON Scavenger Hunt is back for
activity will be related to shenanigans and
the 25th hunt. We are gearing up to once
powerful item drops at random locations.
again catch Las Vegas with its pants down
Friday: 24 hours #pantslessvillage. This year, we return
Saturday: 24 hours to in-person only operations with up to 5
people per team and table submissions.
Sunday: 24 hours (scoring cutoff at noon)
For those new to DEF CON, or otherwise
A website documenting the MUD is uninitiated, the DEF CON Scavenger Hunt is
at https://mog.ninja and a CTFd is regarded by many as the best way to interact
setup at https://ctf.mog.ninja with the con. We do our best to encourage
you to challenge your comfort zone, meet
people, and otherwise see and do a bit of
DE F CON R E D TE A M C TF  everything that DEF CON 30 has to offer.
For those who have aspirations to become
In-person Contest more involved with DEF CON in the future,
many of our veteran contestants include
Website: https://threatsims.
goons, speakers, and contest organizers.
com/redteam-2022.html
So, how does a scavenger hunt run for 25
Once again this year’s DEF CON Red Team CTF
years? As this is DEF CON, this is not your
will be hosted by Threat Simulations! We have
ordinary scavenger hunt. The list is open to
an amazing, immersive scenario that stresses
interpretation, it is a hacker con after all,
strong red team skills as players traverse through
so hack the list. Because how you interpret
an enterprise network. This event is not for the
the list is entirely out of our hands, we have
faint of heart, first you will battle with hundreds
posted trigger warnings. You will be finding
of teams in a jeopardy board style ctf, then the
and doing a variety of things, it is up to you to
top teams will enter the finals where your Red
convince the judges whatever you are turning
Team skills will be tested in a full Active Directory
in meets the criteria and is worth the points.
environment. Your team will compete against
some of the best red teamers in the world as you You don’t have to devote all of your time to play
exploit, pivot, and loot the target environment. and have fun, come turn in a couple items and
enjoy yourself. If you want to win however, you
will have to scavenge as much as you can over
the weekend. While the hunt starts on Friday
morning, with determination and a lack of sleep,
we have seen people start at 2AM on Saturday

39
 C0NTESTS & EV3NTS
night and place. Likewise, if you don’t play well As part of our challenge we will present
with others, we have seen single-players also contestants with the exact same design
place. In other words, we work very hard to and compare the outputs they produce
keep the barrier to entry as low as possible. You against a number of categories in order
don’t need to be some binary reversing wizard, to identify a winner and crown DEF
and there’s no qualifier to compete, you can CON’s Next Top Threat Model(er).
just show up and win if you want it enough. Friday: 10:00-18:00
The hunt was started by Pinguino at DEF Saturday: 10:00-18:00
CON 5 simply to avoid being bored; there
was no hunt at DEF CON 8, for those Contest Area Stage
doing math. In the intervening years, to
further avoid boredom, we have been out
scavenging and went from having a simple
cardboard sign to a truly mesmerizing table.
D C 3 0 HA M R A DIO FOX
So come to the scav hunt table in the contest HU N T CON TE S T
area (it’s hard to miss us) with a team name In-person Contest
ready. Once you get a list, your assignment is
to turn in as many items as you can before noon
on Sunday. The team with the most points wins.
Items are worth more points the sooner you turn
them in, so come on down and turn in frequently.
We want to thank Pinguino, Grifter, Siviak
, Salem, all of the judges, and all of the
players that have made it possible for us to
host the 25th DEF CON Scavenger Hunt.
The DEF CON 30 Scavenger Hunt is
brought to you by DualD, EvilMoFo,
Kaybz, Sconce, Shazbot, Zhora.
THE RULES:
In the world of amateur radio, groups of hams
1: the judges are always right will often put together a transmitter hunt (also
2: not our problem called “fox hunting”) in order to hone their
radio direction finding skills to locate one or
3: make it weird more hidden radio transmitters broadcasting.
4: don’t disappoint the judge(s) The Defcon Ham Radio Fox Hunt will require
participants to locate a number of hidden radio
5: team name, item number, present your item transmitters broadcasting at very low power
If you capture pictures or video of items from which are hidden throughout the conference.
our list happening, or have some from previous A map with rough search areas will be given
years, please send it to us via email scavlist@ to participants to guide them on their hunt.
gmail.com . http://defconscavhunt.com/ Additional hints and tips will be provided
throughout Defcon at the contest table to help
@DefConScavHunt people who find themselves stuck. This contest
is designed to be an introduction to ham radio
fox hunting and as such will be simple to
participate in and all people who participate
will be guided towards successful completion!
Friday: 10:00-20:00
Saturday: 10:00-20:00
DE F CON ’ S N E X T TOP Sunday: None
THR E AT M ODE L  In-person only.
Hybrid Contest defcon27foxhunt.com
Threat Modeling is arguably the single most @richsentme
important activity in an application security
program and if performed early can identify
a wide range of potential flaws before a
single line of code has been written. While
being so critically important there is no single
correct way to perform Threat Modeling, many
techniques, methodologies and/or tools exist.
40
 https://twitter.com/ICS_Village
E FF TE C H TR IVIA  Hack the Plan[e]t Capture the Flag (CTF)
In-person Contest contest will feature Howdy Neighbor and
the Industrial Control System (ICS) Range.
This first of its kind CTF will integrate both
Internet of Things (IoT) and ICS environments
with interactive components for competitors
to test their skills and knowledge.
Howdy Neighbor is an interactive IoT CTF
challenge where competitors can test their
hacking skills and learn about common
oversights made in development, configuration,
and setup of IoT devices. Howdy Neighbor is
a miniature home - made to be “smart” from
EFF’s team of technology experts have crafted basement to garage. It’s a test-bed for reverse
challenging trivia about the fascinating, obscure, engineering and hacking distinct consumer-
and trivial aspects of digital security, online focused smart devices, and to understand
rights, and Internet culture. Competing teams how the (in)security of individual devices can
will plumb the unfathomable depths of their implicate the safety of your home or office,
knowledge, but only the champion hive mind and ultimately your family or business. Within
will claim the First Place Tech Trivia Plaque Howdy Neighbor there are over 25 emulated
and EFF swag pack. The second and third or real devices and over 50 vulnerabilities
place teams will also win great EFF gear. that have been staged as challenges. Each of
Room 410 Friday, 20:00-22:00 the challenges are of varying levels to test a
competitors ability to find vulnerabilities in an
https://eff.org IoT environment. Howdy Neighbor’s challenges
@EFF are composed of a real and simulated devices
controlled by an App or Network interface
and additional hardware sensors; each Howdy
Neighbor device contains 1 to 3 staged
HAC K FORTR E S S vulnerabilities which when solved present a key
In-person Contest for scoring/reporting that it was discovered.

Hackfortress is a In the same vein, this CTF challenge will

unique blend of also leverage the ICS Village’s ICS Ranges
Team Fortress 2 including physical and virtual environments
and a computer to provide an additional testbed for more
security contest. advanced challenges in critical infrastructure
Teams are made and ICS environments. There will be integrated
up of 6 TF2 elements from DHS/CISA with their ranges
players and 4 that are realistically miniaturized assets (ie -
hackers, TF2 operational oil and natural gas pipeline, etc.)..
players duke https://www.icsvillage.com
it out while
@ICS_Village
hackers are busy with challenges like application
security, network security, social engineering, or
reverse engineering. As teams start scoring they
can redeem points in the hack fortress store for HAC K3 R R U N W@Y
bonuses. Bonuses range from crits for the TF2,
lighting the opposing team on fire, or preventing In-person Contest
the other teams hackers from accessing the After 2 years virtual and one in person, we’d
store. HackFortress challenges range from like to return to stage for our 4th year where
beginner to advanced, from serious to absurd. this contest shines best. Hack3r Runw@y brings
http://hackfortress.net out all the sheek geeks out there. It encourages
rethinking fashion in the eyes of hackers. Be it
@tf2shmoo smartwear, LED additions, obfuscation, cosplay
or just everyday wear using fabrics and textures
that are familiar to the community. Contestants
HAC K TH E P L A N [ E ]T can enter clothing, shoes, jewelry, hats or
accessories. If it can be worn, it is perfect for
In-person Contest the runway. For convenience, contestants can
https://www.icsvillage.com/ enter the contest with designs made ahead
of the conference, however it needs to be
41
 C0NT3STS & 3V3NTS
made by them and not just store bought.
Awards will be handed out in 4 categories and
HO S P ITA L U NDE R S E IG E
one trophy for the People’s Choice category Contest
where the winner is anyone’s guess: Hospital Under
Digital wearable - LED, electronic, passive Siege is a
scenario-driven
Smart wear - interactive, temperature sensing, Capture the Flag
mood changing, card skimmers, etc contest run by
Aesthetics and More - 3d printed, geeky the Biohacking
wear, passive design, obfuscation, cosplay Village, pitting
teams of
Functional wear - did you bling out your
participants
mask and/or shield, have a hazmat suit,
against
lock pick earrings, cufflinks shims
adversaries
Winners will be selected based and against a
on, but no limited to: clock, to protect
Uniqueness human life and public safety. Participants will
compete against each other on both real and
Trendy simulated medical devices, in the fully immersive
Practical Biohacking Village: Device Lab, laid out as a
working hospital. Teams of any size are welcome,
Couture as are players from all backgrounds and skill
Creativity levels. Challenges will be tailored for all skill
levels and draw from expertise areas including
Relevance forensics, RF hacking, network exploitation
Originality techniques, web security, protocol reverse
engineering, hardware hacking, and others.
Presentation
You will hack actual medical devices and play
Mastery with protocols like DICOM, HL7 and FHIR.
Friday: 2pm – 4pm https://www.villageb.io/
Saturday: 4pm – 6pm (or 2 hours before @DC_BHV
the contest stage and then 1 hr on stage)
Hack3rRunway.square.site , https://
hack3rrunway.github.io/ IOT C TF C R E ATOR S
@Hack3rRunway
C HA L L E N G E (IOT CCC)
In-person Contest
HAC K E R J E OPA R DY  https://www.iotvillage.org/
In-person Event @IoTvillage
Hacker Jeopardy, the classic DEF CON
game show, is returning for yet another
year of answers, questions, NULL beers, P TFS PR E S E N TS : M AYH E M
and occasionally some impressive feats
of knowledge. You don’t want to miss this IND US TR I E S - O U TS IDE
opportunity to encourage the contestants,
your fellow Humans, “DON’T FUCK IT UP! TH E BOX
We will be opening auditions, with the call In-person Contest
posted on the dfiu.tv website, and linked to DEF There’s a cube. It
CON formus. (promoted on social media) does stuff. IoT stuff.
Track 4 Hack it and find
out! Capture flags
Friday: 2000-2200 and turn them in for
Saturday: 2000-2200 points. Team with
the most points wins!
https://dfiu.tv
This contest is
@HackerJeopardy being ran by team
pTFS. We’ve won
black badges in
the past, and this is our way to contribute back
42
What’s this all about lateral pivoting, vulnerability research,
hardware hacking, firmware analysis, reverse
It’s a cube that has
engineering, and exploit development.
IoT stuff that can
be hacked. This So, join a team (or even by yourself) and
may include SDR, compete for fun and prizes! Exploit as
Bluetooth, Wifi, many as you can during the con and the
Infrared / Sonar, top three teams will be rewarded.
Zigbee, etc... People https://www.iotvillage.org/#yolo
who hack in may
be able to interact @IoTvillage
with the physical
elements on the
box (such as the display, door, LED array,
speakers, etc...) and enter flags they capture
KUB E R N E TE S C A P TUR E
into an online scoring engine for points. TH E FL AG 
Online-only Contest

IOT VIL L AG E HAC K IN G The DEF CON

Kubernetes Capture
C TF - ( TH E C TF the Flag (CTF)
contest features a
FOR M A L LY K NOWN A S Kubernetes-based
CTF challenge,
S OHOP L E S S LY BROK E N)  where teams and
In-person Contest individuals can
build and test
IoT Village Hacking CTF is hosted in IoT Village, their Kubernetes
teams of 1-6 players access a local network filled hacking skills. Each
with IoT devices primed to be exploited. You will team/individual
compete against others by successfully exploiting is given access to a single Kubernetes cluster
real IoT products and finding the hidden flags that contains a set of serial challenges, winning
in each. The hacking contest features more flags and points as they progress. Later flags
than 30 real-world, vulnerable IoT devices. pose more difficulty, but count for more points.
This event has been redesigned to include A scoreboard tracks the teams’ current and
challenges which highlight tangible impacts final scores. In the event of a tie, the first
when exploiting real vulnerabilities on real IoT team to achieve the score wins that tie.
devices. Hidden in the network are devices
which require advanced skills to exploit or Friday: 10:00-20:00
require creative attack chaining to find the Saturday: 10:00-17:00
flag. Players will encounter unique hacking
scenarios like, exfiltrating files off a NAS to https://containersecurityctf.com/
find “clues” or bypassing a router firewall to @ctfsecurity
access a camera on a hidden network to “see”
a flag. Prepare to outwit, see, sneak, move,
and listen your way through these hidden
scenarios which have a cyber-physical effect. M A P S OF TH E DIGITA L
The IoT devices in the contest are not simulated L A NDS
and do not contain contrived/made-up
vulnerabilities. Competitors must figure out what In-person Contest
real-world vulnerabilities exist in these devices Maps of the digital lands is a fusion of network
and exploit them to get a shell and find the flag. engineering and drawing. This is a contest for all
This is what makes the IoT Village CTF special. levels to come and show how good you are with
This 3-time DEF CON Black Badge awarded a pen. We give you a few scenarios to choose
contest CTF is open to anyone! Our from and you have to draw a map to show what
contest provides a wonderful experience the scenario would look like. Maybe apply your
to learn more about security and test your 1337 skills to show how you’d take control of the
skills, and the IoT CTF provides the most network! All skills are welcome. Also come join
realistic hacking experience around! us for some TBD brainstorming sessions! Check
out https://www.alienvualt.com for schedule!
A few devices are approachable for entry
level people to experience getting their first https://www.alienvualt.com
root shell, but to win this CTF your team must @mapsofdigiland
perform detailed network reconnaissance,
43
 C0NT3STS & 3V3NTS
happening at the RFCTF desk, #rfctf on our
O C TOP US GA M E  discord, on Twitter rf_ctf, rfhackers, and the
In-person Contest interwebz, etc. If you have a question - ASK!
We may or may not answer, at our discretion.
FOR THE NEW FOLKS
Our virtual RFCTF environment is played
remotely over ssh or through a web browser.
It may help to have additional tools installed
on your local machine, but it isn’t required.

“Are you the next Octopus Champion? Find Read the presentations at: https://
out at DEF CON 30! Enter here: https:// rfhackers.com/resources
www.mirolabs.info/octopusgame Hybrid Fun
Once entered, contestants are provided a For DEF CON 30 we will be running in “Hybrid”
random opponent. Locate your opponent and mode. That means we will have both a physical
challenge them to a contest: rock-paper-scissors, presence AND the virtual game. All of the
Ddakji, staring contest, etc. Winners receive challenges we have perfected in the last 2 years
their opponents’ targets and the game continues in our virtual game will be up and running,
until we reach the top 4. The Octopus Champion available to anyone all over the world (including
is then decided at a special tournament with at the conference), free of charge. In addition
events designed by the Octopus Master.” to the virtual challenges, we will also have a
https://www.mirolabs.info/octopusgame large number of “in person” only challenges.
These “in-person” only challenges will include
@OctopusGameDC our traditional fox hunts, hide and seeks, and
king of the hill challenges. Additionally, we will
have many challenges which we simply haven’t
R A DIO FR E Q U E NC Y had time or ability to virtualize. It should be
clear that playing only the virtual game will put
C A P TUR E TH E FL AG you in a severe available point disadvantage.
Please don’t expect to place if you play virtual
Hybrid Contest only, consider the game an opportunity to
Do you have what it learn, practice, hone your skills, and still get
takes to hack WiFi, on the scoreboard. The virtual challenges
Bluetooth, and Software which are available will have the same flags
as the in-person challenges, allowing physical
Defined Radio (SDR)? attendees the choice of hacking those challenges
RF Hackers Sanctuary using either (or both) methods of access.
(the group formerly THE GAME
known as Wireless
Village) is once again To score you will need to submit flags which
holding the Radio Frequency Capture the will range from decoding transmissions in the
Flag (RFCTF) at DEF CON 30. RFHS runs this spectrum, passphrases used to gain access to
game to teach security concepts and to give wireless access points, or even files located on
people a safe and legal way to practice attacks servers. Once you capture the flag, submit it to
against new and old wireless technologies. the scoreboard right away, if you are confident
it is worth *positive* points. Some flags will
We cater to both those who are new to radio be worth more points the earlier they are
communications as well as to those who have submitted, and others will be negative. Offense
been playing for a long time. We are looking and defense are fully in play by the participants,
for inexperienced players on up to the SIGINT the RFCTF organizers, and the Conference
secret squirrels to play our games. The RFCTF itself. Play nice, and we might also play nice.
can be played with a little knowledge, a
pen tester’s determination, and $0 to $$$$$ To play our game at DEF CON 30 join SSID:
worth of special equipment. Our new virtual RFCTF_Contestant with password: iluvpentoo
RFCTF can be played completely remotely Getting started guide: https://
without needing any specialized equipment github.com/rfhs/rfhs-wiki/wiki
at all, just using your web browser! The key
is to read the clues, determine the goal of Helpful files (in-brief, wordlist, resources) can
each challenge, and have fun learning. be found at https://github.com/rfhs/wctf-files

There will be clues everywhere, and we will Support tickets may be opened at https://
provide periodic updates via discord and github.com/rfhs/wctf-support/issues
twitter. Make sure you pay attention to what’s TL;DR

44
Twitter: rf_ctf and rfhackers halls of DEF CON, one can see more modern
versions manifesting as stickers - especially
Discord: https://discordapp.com/invite/JjPQhKy
on laptops and other electronic equipment.
Website: http://rfhackers.com - play with us
The DEF CON art contest showcases art of many
Github: https://github.com/rfhs different forms - wallpapers etc. However, there
Official Support Ticketing System: https:// is not presently a medium for expression that is
github.com/rfhs/rfctf-support/issues more portable and ubiquitous in hacker culture,
especially at DEF CON. Just like DEF CON
https://rfhackers.com usually bundles stickers in its conference schedule
@rf_ctf booklet, which ends up on a majority of laptops
and other devices of attendees, the winning
entry in this contest could be either added to
that list of stickers, or sold standalone as swag.
R E D A L E RT IC S C TF We use stickers to break the ice with
In-person Contest strangers, as a barter currency, to tell the
Red Alert ICS CTF tales of our struggles and triumphs. After
is a competition all, is a hacker really a hacker without a
for Hackers by laptop adorned with these markings?
Hackers. The event Here’s your chance to be part of hacker culture,
exclusively focuses by creating something that people around
on having the the world will treasure and proudly display.
participants break Submit original artwork in the theme of the
through several con, that you believe best exemplifies hacker
layers of security in culture, that will be used as printed stickers.
our virtual SCADA
On your marks... Make your mark.
environment and
eventually take over - The contest is open to artists of
complete control of the SCADA system. any age, in any country.
The contest would house actual ICS (Industrial - Please submit a PNG file of no more than 6
Control System) devices from various vendors inches x 6 inches (or 4096 px x 4096 px), any
on a testbed showcasing different sectors of shape inside these dimensions is acceptable.
critical infrastructure. The participants would - Artwork can be an original painting,
be able to view and engage with the devices drawing, photo, computer generated
in real time and understand how each of them illustration or screen print.
control each of the aspects of the testbed and
leverage this to compromise the devices. - Artwork must be original/copyright-
free - please do not include copyrighted
Red Alert ICS CTF is back with a ton of content in your submissions.
fun challenges after successfully running
the CTF at DEF CON 29, DEF CON 27 Submissions must be made via email
and DEF CON 26 (Black Badge). ([email protected])
Highlights of the Red Alert ICS CTF is available On the forums as: https://forum.defcon.
at: https://youtu.be/AanKdrrQ0u0 org/member/47018-247arjun
@icsctf Follow: https://twitter.com/
InfosecStickers For updates.
@infosecStickers
S TIC K E R DE S IG N
CON TE S T  TE L E C HA L L E N G E 
Pre-con contest (like the short story contest)
Hybrid Contest
Ancient warriors
used tattoos as a
means of indicating
rank in battle; it was
the sort of mark that
told the tales of their
various conquests -
The TeleChallenge is a fast-paced, epic battle
their struggles and
of wits and skill. Previous winners are few in
triumphs. Similarly,
number, and are among the most elite hackers
traversing the
at DEF CON. Designed to be played by teams,
45
 C0NT3STS & 3V3NTS
and running through the whole weekend, the top Vegas style hacking contest for Defcon
TeleChallenge is entirely playable over a touch attendees. Once joined, attendees can
tone phone. Don’t let fear of the Challenge hold run the game anywhere in Vegas and hack
you for ransom. Your voice is your passport! nearby locations for points and prizes. Wi-
Fi Cracking? Got it. Exploit research? Got
https://www.youtube.com/channel/
it. Betraying your friends for prizes? Got it!
UCWxrz1cHRbiy5bDRTNDlQkg/playlists
Throughout the weekend, we will be
@TeleChallenge
broadcasting location events, bonuses,
and news through Twitter, Discord, and
our YouTube live stream at our booth.
TH E G OL D B U G – C RYP TO Watch this space for more information
A ND PR IVAC Y VIL L AG E on dates, prizes, and promotions.
Hack. Slash. Crash. Burn. Fun!
P UZ Z L E https://www.hacknattack.com
Hybrid Contest
@hack_n_attack
Love puzzles? Need a
place to exercise your
classical and modern
cryptography skills? TH E S C H E M AVE R S E
This puzzle will keep
you intrigued and busy
C HA M P ION S HIP 
throughout Defcon Online Contest
- and questioning
how deep the layers
of cryptography
go.The Gold Bug an annual Defcon puzzle hunt,
focused on cryptography. You can learn about
Caesar ciphers, brush up your understanding
of how Enigma machines or key exchanges
work, and try to crack harder modern crypto.
Accessible to all - and drop by for some kids’ Online Only this year.
puzzles too!PELCGBTENCUL VF UNEQ The Schemaverse [skee-muh vurs] is a space
https://goldbug.cryptovillage.org/ battleground that lives inside a PostgreSQL
database. Mine the hell out of resources
@CryptoVillage and build up your fleet of ships, all while
trying to protect your home planet. Once
you’re ready, head out and conquer the
map from other DEF CON rivals.
TH E HAC K- N - AT TAC K
This unique game gives you direct access to
HAC K E R HOM E COM IN G the database that governs the rules. Write
SQL queries directly by connecting with any
H E IS T supported PostgreSQL client or use your favourite
In-person Contest language to write AI that plays on your behalf.
This is DEF CON of course so start working
The Hack-n- on your SQL Injections - anything goes!
Attack Hacker
Homecoming Heist https://schemaverse.com
Real-World hacking, @schemaverse
real world rewards!
Hack-N-Attack is an
online mobile game
where you hack real
world locations for
points and prizes.
Pizza shop? Hack
it! Friend next to you? Hack them! If you take
Defcon, Pokémon Go, and Oceans 11, and
squished them all together, you’d get…a lot of
copyright complaints. But also Hack-N-Attack.
The Hacker Homecoming Heist an over-the-

46
47
 C0NT3STS & 3V3NTS
TIN FOIL HAT CO N TE S T TR AC E L A B S O S IN T
In-person Contest S E A RC H PA RT Y C TF 
Want to block Hybrid Contest
those pesky 5G
microchips coursing The Trace Labs
through your Search Party CTF is
vaccinated body? a non theoretical,

TFH Were you hacking

back against
Putin, and need to
gamified effort
that allows for the
crowdsourcing
DEFCON 30 hide? Or do those of contestants to
alien mind control perform a single
rays just have you task: Conduct open
down lately? Fear source intelligence
not, for we here operations
at the Tin Foil Hat contest have your back for to help find missing persons
all of these! Come find us in the contest area, You can have teams of 1-4 people, 4 person
and we’ll have you build a tin foil hat which is teams provide many benefits which include
guaranteed to provide top quality protection the coaching of more junior members. Often a
for your noggin. How you ask? SCIENCE! great learning opportunity if you are able to
Show us your skills by building a tin foil pair up with OSINT veterans. Get your team
hat to shield your subversive thoughts, together and join us in our Discord group to get
then test it out for effectiveness. started here: https://tracelabs.org/discord
There are 2 categories: stock and unlimited. https://www.tracelabs.org/
The hat in each category that causes the initiatives/search-party
most signal attenuation will receive the @tracelabs
“Substance” award for that category. We all
know that hacker culture is all about looking
good, though, so a single winner will be
selected from each category for “Style”. WHO S E S L IDE IS IT
http://www.psychoholics.org/tfh A N Y WAY? 
@DC_Tin_Foil_Hat In-person Event
It’s our sixth year
but since we had
TOX IC B BQ to be virtual last
year this will
In-person Event
be our 5 YEAR
16:00- 22:00 ANNIVERSARY
Thursday, Off-site at show of
Sunset Park, Pavilion F, “Whose Slide
(36.0636, -115.1178) Is It Anyway?”!
The humans of We’re an unholy
Vegas invite you to union of improv
the 16th in-carne- comedy, hacking
tion of this unofficial and slide deck
welcome party. sado-masochism.
Go AFK 4 BBQ off-Strip and make us the first Our team of slide monkeys will create a stupid
stop on your DC30 reunion tour. Burgers and amount of short slide decks on whatever
dogs are provided; attendees are encouraged nonsense tickles our fancies. Slides are not
to pitch in with more food, drinks, volunteer exclusive to technology, they can and will be
labor, rides, and and everything that makes about anything. Contestants will take the stage
this cookout something to remember. and choose a random number corresponding
Grab flyers from an Info Booth after to a specific slide deck. They will then improvise
Linecon, check out https://www.toxicbbq. a minimum 5 minute / maximum 10 minute
org for the history of this event, and watch lightning talk, becoming instant subject
#ToxicBBQ on Twitter for the latest news. matter experts on whatever topic/stream
of consciousness appears on the screen.
https://www.toxicbbq.org
Whether you delight in the chaos of watching
your fellow hackers squirm or would like to
48
sacrifice yourself to the Contest Gods, it’s a and defenses by actual companies.
night of schadenfreude for the whole family. Teams can consist of 1-3 individuals, which we
Oh, and prizes. Lots and lots of prizes. hope allows for teams to utilize novel techniques
to implement different Social Engineering tactics.
ImprovHacker.com
Each team is provided limited time to place
@WhoseSlide as many calls as possible from a soundproof
booth. During that time, their goal is to elicit
from the receiver as many objectives as possible.
Whether you’re an attacker, defender, business
S O C IA L E N GIN E E R IN G executive, or brand new to this community, you
COM M U NIT Y (S E C) can learn by witnessing firsthand how easy it
is for some competitors to schmooze their way
YO U TH C HA L L E N G E to their goals and how well prepared some
companies are to shut down those competitors!
In-person Contest
Friday: 9:00 – 16:00
VI CALLING ALL
E S LL KIDS! Come Saturday: 9:00 – 16:00
R O AI use your In the SEC Village Linq
HE VS
N
S super skills
and powers https://www.såe.community/
to work with a events/vishing-competition/
team of heroes @sec_defcon
SE COMMUNITY YOUTH CHALLENGE
or villains.
The balance of good and evil will be determined
by individual participants completing various
challenges in this ʻChoose Your Own Adventure’ B E T TIN G ON YO UR
style event. By participating in this event, you
will have opportunities to interact and learn
DIGITA L R IG HTS : E FF
from many other incredible villages at DEF CON
while at the same time improving your Social
P OK E R TO UR N A M E N T
Engineering abilities. If successful, you may even In-person Contest
have the chance to help your team prevail and
become the ultimate Superhero or Supervillain!
Friday: 9:00 – 18:00
Saturday: 9:00 – 18:00
Sunday: 9:00 – 14:00
In the SEC Village Linq
https://www.se.community/
events/youth-challenge/
@sec_defcon
Betting on Your Digital Rights: EFF
Benefit Poker Tournament
We’re going all in on internet freedom. Take a
S E COM M U NIT Y (S E C) break from hacking the Gibson to face off with
VIS HIN G COM P E TITION / your competition at the tables—and benefit EFF!
Your buy-in is paired with a donation to support
#S E C VC EFF’s mission to protect online privacy and free
expression for all. Play for glory. Play for money.
In-person Contest Play for the future of the web. Seating is limited,
so reserve your spot today at eff.org/poker.
Tournament Specs: $100 Bally’s tournament
buy-in with a suggested donation of $250 to
EFF to sign up. Rebuys are unlimited to level
6 with each having a suggested donation of
In this competition, teams go toe to toe by $100. Levels will be fifteen minutes, and the
placing live vishing (voice phishing) phone calls blinds go up at each level. Attendees must
in front of the Social Engineering Community be 21+. More details at eff.org/poker.
audience at DEF CON. These calls showcase
the duality of ease and complexity of the craft Friday, August 12th 12:00 to 15:00
against the various levels of preparedness https://eff.org/poker

49
 PR3S3NTATI0NS
Listed by Day, Time, Track is inspiring for us, looking at modern malicious
software, looking at how things are done and how
the same things could have been done instead.
FRIDAY
COMPUTER HACKS IN THE
PANEL - “SO IT’S YOUR FIRST DEF RUSSIA-UKRAINE WAR
CON” - HOW TO GET THE MOST Friday at 10:00 in Track 4
20 minutes
OUT OF DEF CON, WHAT NOT Kenneth Geers
TO DO. Very Good Security / NATO Cyber Centre / Atlantic Council
Friday at 10:00 in Track 1 The Russia-Ukraine war has seen a lot of computer
45 minutes hacking, on both sides, by nations, haxor collectives,
and random citizens, to steal, deny, alter, destroy,
DEF CON Goons and amplify information. Satellite comms have gone
Panel - “So It’s your first DEF CON” - How to down. Railway traffic has been stymied. Doxing
get the most out of DEF CON, What NOT to is a weapon. Fake personas and false flags are
do. This talk is a guide to enjoying DEF CON. expected. Every major platform has had issues with
We hope to talk about how to get the most out confidentiality, integrity, and availability. Hacked
of your first con and asnwer questions live from social media and TV have been a hall of mirrors
the audience. Feel free to come meet some long and PSYOP. Russian comms are unreliable, so
time goons, attendees, and DEF CON staff as Ukrainian nets have become honeypots. Hackers
we discuss how to navigate Las Vegas hotels have been shot in the kneecaps. Talking heads
with 30k hackers surrounding around you. have called for a RUNET shutdown. The Ukrainian
government has appealed for hacker volunteers
– just send your expertise, experience, and a
PANEL - DEF CON POLICY DEPT - reference. The Great Powers are hacking from afar,
while defending their own critical infrastructure,
WHAT IS IT, AND WHAT ARE WE including nuclear command-and-control. Ukraine
has many hacker allies, while Russian hackers are
TRYING TO DO FOR HACKERS IN fleeing their country in record numbers. Some
THE POLICY WORLD? lessons so far: connectivity is stronger than we
thought, info ops are stealing the day, drones are
Friday at 10:00 in Track 2 the future, and it is always time for the next hack.
75 minutes
DEF CON Policy Dept
DEF CON Policy Dept - What is it, and what are
OOPSSEC -THE BAD, THE WORST
we trying to do for hackers in the policy world? AND THE UGLY OF APT’S
OPERATIONS SECURITY
OLD MALWARE, NEW TOOLS: Friday at 10:30 in Track 4
45 minutes | Demo, Tool
GHIDRA AND COMMODORE
Tomer Bar
64, WHY UNDERSTANDING OLD Director of Security Research at SafeBreach
MALICIOUS SOFTWARE STILL Advanced Persistent Threat groups invest in
MATTERS developing their arsenal of exploits and malware
to stay below the radar and persist on the
Friday at 10:00 in Track 3 target machines for as long as possible. We
45 minutes | Tool were curious if the same efforts are invested in
the operation security of these campaigns.
Cesare Pizzi
Hacker We started a journey researching active campaigns
from the Middle East to the Far East including the
Why looking into a 30 years old “malicious” Palestinian Authority, Turkey, and Iran, Russia,
software make sense in 2022? Because this little China, and North Korea. These campaigns were
“jewels”, written in a bunch of bytes, reached both state-sponsored, surveillance-targeted attacks
a level of complexity surprisingly high. With no and large-scale financially-motivated attacks.
other reason than pranking people or show off
technical knowledge, this software show how
much you can do with very limited resources: this
50
We analyzed every technology used throughout
FRIDAY
the attack chain: Windows (Go-lang/.Net/
DEF CON POLICY DEPT - SPECIAL
Delphi) and Android malware; both on EDITION POLICY TALK
Windows and Linux-based C2 servers.
Friday at 11:30 in Track 2
We found unbelievable mistakes which allow 45 minutes
us to discover new advanced TTPs used by
attackers, for example: bypassing iCloud two- DEF CON Policy Dept
factor authentication’ and crypto wallet and TBA
NFT stealing methods. We were able to join the
attackers’ internal groups, view their chats, bank
accounts and crypto wallets. In some cases, we
were able to take down the entire campaign.
RUNNING ROOTKITS LIKE A
We will present our latest breakthroughs from our NATION-STATE HACKER
seven-year mind-game against the sophisticated Friday at 11:30 in Track 4
Infy threat actor who successfully ran a 15- 20 minutes | Demo, Tool
year active campaign using the most secured
opSec attack chain we’ve encountered. We Omri Misgav
will explain how they improved their opSec CTO, Security Research Group Fortinet
over the years and how we recently managed
Code Integrity is a threat protection feature first
to monitor their activity and could even cause
introduced by Microsoft over 15 years ago. On
a large-scale misinformation counterattack.
x64-based versions of Windows, kernel drivers
We will conclude by explaining how must be digitally signed and checked each time
organizations can better defend themselves. they are loaded into memory. This is also referred
to as Driver Signature Enforcement (DSE).
The passing year showed high-profile APT
THE PACMAN ATTACK: groups kept leveraging the well-known
BREAKING PAC ON THE APPLE tampering technique to disable DSE on runtime.
Meanwhile, Microsoft rolled out new mitigations:
M1 WITH HARDWARE ATTACKS driver blocklists and Kernel Data Protection
Friday at 11:00 in Track 3 (KDP), a new platform security technology
for preventing data-oriented attacks.
45 minutes | Demo, Tool, Exploit
Since using blocklist only narrows the attack
Joseph Ravichandran vector, we focused on how KDP was applied
First year PhD Student working with Dr. Mengjia Yan at MIT in this case to eliminate the attack surface.
What do you get when you cross pointer We found two novel data-based attacks to
authentication with microarchitectural side bypass KDP-protected DSE, one of which is
channels? feasible in real-world scenarios. Furthermore,
they work on all Windows versions, starting
The PACMAN attack is a new attack technique
with the first release of DSE. We’ll present each
that can bruteforce the pointer authentication
method and run them on live machines.
code (PAC) for an arbitrary kernel pointer without
causing any crashes using microarchitectural We’ll discuss why KDP is an ineffective mitigation.
side channels. We demonstrate the PACMAN As it didn’t raise the bar against DSE tampering,
attack against the Apple M1 CPU. we looked for a different approach to mitigate
it. We’ll talk about how defenders can take
a page out of attackers’ playbook to cope
THE DARK TANGENT & with the issue until HVCI becomes prevalent
and really eliminates this attack surface.
MKFACTOR - WELCOME TO DEF
CON & THE MAKING OF THE
DEF CON BADGE
Friday at 11:00 in Track 1
45 minutes
The Dark Tangent
Mkfactor, Michael and Katie Whiteley
The Dark Tangent welcomes you to DEF CON
and introduces the DEF CON 30 badge makers
Mkfactor, they discuss the labor of love that
went into producing the DEF CON 30 Badge.
51
 PR3S3NTATI0NS
GLITCHED ON EARTH BY AVOIDING MEMORY SCANNERS:
HUMANS: A BLACK-BOX CUSTOMIZING MALWARE TO
SECURITY EVALUATION OF EVADE YARA, PE-SIEVE, AND
THE SPACEX STARLINK USER MORE
TERMINAL Friday at 12:00 in Track 3
45 minutes
Friday at 12:00 in Track 1
45 minutes | Demo, Exploit Kyle Avery
Hacker
Lennert Wouters
researcher at imec-COSIC, KU Leuven Tired of encoding strings or recompiling to
break signatures? Wish you could keep PE-sieve
This presentation covers the first black-box hardware from ripping your malware out of memory?
security evaluation of the SpaceX Starlink User Interested in learning how to do all of this with
Terminal (UT). The UT uses a custom quad-core your existing COTS or private toolsets?
Cortex-A53 System-on-Chip that implements verified
boot based on the ARM trusted firmware (TF-A) For years, reverse engineers and endpoint security
project. The early stage TF-A bootloaders, and in software have used memory scanning to locate
particular the immutable ROM bootloader include shellcode and malware implants in Windows
custom fault injection countermeasures. Despite the memory. These tools rely on IoCs such as signatures
black-box nature of our evaluation we were able and unbacked executable memory. This talk will dive
to bypass signature verification during execution of into the various methods in which memory scanners
the ROM bootloader using voltage fault injection. search for these indicators and demonstrate a
stable evasion technique for each method. A new
Using a modified second stage bootloader we position-independent reflective DLL loader, AceLdr,
could extract the ROM bootloader and eFuse will be released alongside the presentation and
memory. Our analysis demonstrates that the fault features the demonstrated techniques to evade
model used during countermeasure development all of the previously described memory scanners.
does not hold in practice. Our voltage fault The presenter and their colleagues have used
injection attack was first performed in a laboratory AceLdr on red team operations against mature
setting and later implemented as a custom printed security programs to avoid detection successfully.
circuit board or ʻmodchip’. The presented attack
results in an unfixable compromise of the Starlink This talk will focus on the internals of Pe-sieve,
UT and allows us to execute arbitrary code. MalMemDetect, Moneta, Volatility malfind, and
YARA to understand how they find malware
Obtaining root access on the Starlink UT is a in memory and how malware can be modified
prerequisite to freely explore the Starlink network to fly under their radar consistently.
and the underlying communication interfaces.
This presentation will cover an initial exploration
of the Starlink network. Other researchers ONE BOOTLOADER TO LOAD
should be able to build on our work to
further explore the Starlink ecosystem. THEM ALL
Friday at 12:00 in Track 4
45 minutes | Demo, Tool, Exploit
DEF CON POLICY DEPT - SPECIAL Mickey Shkatov
EDITION POLICY TALK Hacker
Friday at 12:30 in Track 2 Jesse Michael
45 minutes Hacker
DEF CON Policy Dept Introduced in 2012, Secure Boot - the OG
trust in boot - has become a foundational
TBA
rock in modern computing and is used by
millions of UEFI-enabled computers around the
world due to its integration in their BIOS.
The way Secure Boot works is simple and
effective, by using tightly controlled code signing
certificates, OEMs like Microsoft, Lenovo, Dell
and others secure their boot process, blocking
unsigned code from running during boot.

52
But this model puts its trust in developers developing
FRIDAY
code without vulnerabilities or backdoors; in this
YOU’RE MUTED ROOTED
presentation we will discuss past and current flaws Friday at 13:00 in Track 4
in valid bootloaders, including some which misuse 45 minutes | Demo, Tool, Exploit
built-in features to inadvertently bypass Secure Boot.
We will also discuss how in some cases malicious Patrick Wardle
executables can hide from TPM measurements used Founder, Objective-See Foundation
by BitLocker and remote attestation mechanisms. With a recent market cap of over $100
Come join us as we dive deeper and explain billion and the genericization of its name, the
how it all works, describe the vulnerabilities we popularity of Zoom is undeniable. But what
found and walk you through how to use the about its security? This imperative question is
new exploits and custom tools we created to often quite personal, as who amongst us isn’t
allow for a consistent bypass for secure boot jumping on weekly (daily?) Zoom calls?
effective against every X86-64 UEFI platform. In this talk, we’ll explore Zoom’s macOS
application to uncover several critical security
flaws. Flaws, that provided a local unprivileged
EMOJI SHELLCODING: , , attacker a direct and reliable path to root.
AND The first flaw, presents itself subtly in a core
Friday at 13:00 in Track 1 cryptographic validation routine, while the second
is due to a nuanced trust issue between Zoom’s
45 minutes | Demo, Tool
client and its privileged helper component.
Hadrien Barral After detailing both root cause analysis and full
Hacker exploitation of these flaws, we’ll end the talk by
Georges-Axel Jaloyan showing how such issues could be avoided …both
Hacker by Zoom, but also in other macOS applications.

Shellcodes are short executable stubs that are

used in various attack scenarios, whenever code WEAPONIZING WINDOWS
execution is possible. After quickly recalling what
a shellcode is and why designing shellcodes SYSCALLS AS MODERN, 32-BIT
under constraints is an art, we’ll study a new
constraint for which (to the best of our knowledge) SHELLCODE
no such shellcode was previously known: Friday at 13:30 in Track 3
emoji shellcoding. We’ll tackle this problem by 20 minutes | Demo
introducing a new and more generic approach to
shellcoding under constraints. Brace yourselves, Tarek Abdelmotaleb
you’ll see some black magic weaponizing these Security Researcher, VERONA Labs
cute little emojis into merciless exploits . Dr. Bramwell Brizendine
While much knowledge exists on using syscalls
for red team efforts, information on writing
BACKDOORING PICKLES: A original shellcode with syscalls so in modern x86
DECADE ONLY MADE THINGS is sparse and lacking. Our reverse engineering
efforts, however, have revealed the necessary
WORSE steps to take to successfully perform syscalls
Friday at 13:00 in Track 3 in shellcode, both for Windows 7 and 10,
20 minutes | Demo, Tool as there are some significant differences.
In this talk, we will embark upon a journey that
ColdwaterQ will show the process of reverse engineering how
Senior Security Engineer at Nvidia Windows syscalls work in both Windows 7 and 10,
Eleven years ago, “Sour Pickles” was presented by while focusing predominately on the latter. With this
Marco Slaviero. Python docs already said pickles necessary foundation, we will explore the process
were insecure at that time. But since then, machine of effectively utilizing syscalls inside shellcode. We
learning frameworks started saving models in will explore the special steps that must be taken
pickled formats as well. So, I will show how simple to set up syscalls – steps that may not be required
it is to add a backdoor into any pickled object using to do equivalent actions with WinAPI functions.
machine learning models as an example. As well This talk will feature various demonstrations
as an example of how to securely save a model to of syscalls in x86 shellcode.
prevent malicious code from being injected into it.

53
 PR3S3NTATI0NS
DEF CON POLICY DEPT - SPECIAL PROCESS INJECTION: BREAKING
EDITION POLICY TALK ALL MACOS SECURITY LAYERS
Friday at 13:30 in Track 2
45 minutes
WITH A SINGLE VULNERABILITY
Friday at 14:00 in Track 3
DEF CON Policy Dept 45 minutes | Exploit
TBA Thijs Alkemade
Security Researcher at Computest
SPACE JAM: EXPLORING RADIO macOS local security is shifting more and more
to the iOS model, where every application is
FREQUENCY ATTACKS IN OUTER codesigned, sandboxed and needs to ask for
permission to access sensitive data. New security
SPACE layers have been added to make it harder for
Friday at 14:00 in Track 1 malware that has gained a foothold to compromise
45 minutes | Demo, Tool the user’s most sensitive data. Changing the security
model of something as large and established as
James Pavur macOS is a long process, as it requires many
Digital Service Expert, Defense Digital Service existing parts of the system to be re-examined. For
example, creating a security boundary between
Satellite designs are myriad as stars in the
applications running as the same user is a large
sky, but one common denominator across all
change from the previous security model.
modern missions is their dependency on long-
distance radio links. In this briefing, we will turn CVE-2021-30873 is a process injection
a hacker’s eye towards the signals that are the vulnerability we reported to Apple that affected
lifeblood of space missions. We’ll learn how all macOS applications. This was addressed in
both state and non-state actors can, and have, the macOS Monterey update, but completely
executed physical-layer attacks on satellite fixing this vulnerability requires changes to all
communications systems and what their motivations third-party applications as well. Apple has even
have been for causing such disruption. changed the template for new applications
in Xcode to assist developers with this.
Building on this foundation, we’ll present
modern evolutions of these attack strategies In this talk, we’ll explain what a process injection
which can threaten next-generation space vulnerability is and why it can have critical impact
missions. From jamming, to spoofing, to signal on macOS. Then, we’ll explain the details of this
hijacking, we’ll see how radio links represent a vulnerability, including how to exploit insecure
key attack surface for space platforms and how deserialization in macOS. Finally, we will explain
technological developments make these attacks how we exploited it to escape the macOS sandbox,
ever more accessible and affordable. We’ll elevate our privileges to root and bypass SIP.
simulate strategies attackers may use to cause
disruption in key space communications links and
even model attacks which may undermine critical PHREAKING 2.0 - ABUSING
safety controls involved in rocket launches.
The presentation will conclude with a
MICROSOFT TEAMS DIRECT
discussion of strategies which can defend ROUTING
against many of these attacks. Friday at 14:00 in Track 4
While this talk includes technical components, 20 minutes | Demo, Exploit
it is intended to be accessible to all audiences
and does not assume any prior background Moritz Abrell
in radio communications, astrodynamics, SySS GmbH
or aerospace engineering. The hope is to Microsoft Teams offers the possibility to integrate
provide a launchpad for researchers across the your own communication infrastructure, e.g.
security community to contribute to protecting your own SIP provider for phone services. This
critical infrastructure in space and beyond. requires a Microsoft-certified and -approved
Session Border Controller. During the security
analysis of this federation, Moritz Abrell identified
several vulnerabilities that allow an external,
unauthenticated attacker to perform toll fraud.
This talk is a summary of this analysis, the
identified security issues and the practical
exploitation as well as the manufacturer’s
capitulation to the final fix of the vulnerabilities.
54
 FRIDAY
Advanced security monitoring solutions on Linux
LEAK THE PLANET: VERITATEM VMs and containers offer system call monitoring
COGNOSCERE NON PEREAT to effectively detect attack behaviors. Linux
system calls can be monitored by kernel tracing
MUNDUS technologies such as tracepoint, kprobe, ptrace, etc.
Friday at 14:30 in Track 2 These technologies intercept system calls at different
45 minutes places in the system call execution. These monitoring
solutions can be deployed on cloud compute
Emma Best instances such as AWS EC2, Fargate, EKS, and the
Distributed Denial of Secrets corresponding services from other cloud providers.
Xan North We comprehensively analyzed the Time-of-check-
Distributed Denial of Secrets to-time-of-use (TOCTOU) issues in the Linux kernel
syscall tracing framework and showed that these
As leaks become more prevalent, they come from an issues can be reliably exploited to bypass syscall
increasing variety of sources: from data that simply tracing. Our exploits manipulate different system
isn’t secured, to insiders, to hacktivists, and even interactions that can impact the execution time
occassional state-actors (both covert and overt). of a syscall. We demonstrated that significant
Often treated as a threat, when handled responsibly syscall execution delays can be introduced
leaks are a necessary part of the ecosystem of a to make TOCTOU bypass reliable even when
healthy and free society and economy. In spite seccomp, SELinux, and AppArmor are enforced.
of prosecutors’ love of prosecution, the eternal Compared to the phantom attacks in DEFCON
fixation with Fear, Uncertainty and Doubt and 29, the new exploit primitives we use do not
DDoSecrets’ apocalyptic motto, leaks won’t require precise timing control or synchronization.
destroy the world - they can only save it.
We will demonstrate our bypass for Falco on
In this presentation, we’ll discuss the necessity Linux VMs/containers and GKE. We will also
and evolution of leaks, and how various demonstrate bypass for pdig on AWS Fargate.
types of leaks and sources can offer different In addition, we will demonstrate exploitation
sorts of revelations. We’ll then explore how techniques for syscall enter and explain the reason
we can responsibly handle different types why certain configurations are difficult to reliably
of leaks even during volatile and politically exploit. Finally, we will summarize exploitable
charged situations, as well as past failures. TOCTOU scenarios and discuss potential mitigations
We’ll also debunk the myth that hacktivism is just in various cloud computing environments.
a cover for state actors by exploring examples of
entities with state ties and how they were identified,
as well as how both hacktivists and state actors EXPLORING THE HIDDEN ATTACK
have been misidentified or mishandled in the past.
SURFACE OF OEM IOT DEVICES:
Finally, we’ll discuss some of the lessons
activists, newsrooms and governments can PWNING THOUSANDS OF
learn from the last decade, and where
we should collectively go from here. ROUTERS WITH A VULNERABILITY
IN REALTEK’S SDK FOR ECOS OS.
Friday at 15:00 in Track 1
TRACE ME IF YOU CAN: 45 minutes
BYPASSING LINUX SYSCALL Octavio Gianatiempo
TRACING Security Researcher at Faraday
Friday at 14:30 in Track 4 Octavio Galland
45 minutes | Demo, Tool, Exploit Security Researcher at Faraday
Rex Guo In this presentation, we go over the main challenges
Principal Researcher, Lacework we faced during our analysis of the top selling
router in a local eCommerce, and how we found a
Junyuan Zeng
zero-click remote unauthenticated RCE vulnerability.
Senior Software Engineer, Linkedin.com We will do a walkthrough on how we located the
In this talk, we will present novel vulnerabilities and root cause of this vulnerability and found that it
exploitation techniques that reliably bypass Linux was ingrained in Realtek’s implementation of a
syscall tracing. A user mode program does not need networking functionality in its SDK for eCos devices.
any special privileges or capabilities to reliably We then present the method we used to automate
avoid system call tracing detections by exploiting the detection of this vulnerability in other firmware
these vulnerabilities. The exploits work even when images. We reflect on the fact that on most routers
seccomp, SELinux, and AppArmor are enforced. this functionality is not even documented and can’t

55
 PR3S3NTATI0NS
be disabled via the router’s web interface. We take
this as an example of the hidden attack surface
HOW RUSSIA IS TRYING TO
that lurks in OEM internet-connected devices. BLOCK TOR
We conclude by discussing why this vulnerability Friday at 15:30 in Track 2
hasn’t been reported yet, despite being easy 45 minutes | Tool
to spot (having no prior IoT experience),
widespread (affecting multiple devices Roger Dingledine
from different vendors), and critical. The Tor Project
Our research highlights the poor state of firmware In December 2021, some ISPs in Russia started
security, where vulnerable code introduced down blocking Tor’s website, along with protocol-level
the supply chain might never get reviewed and end (DPI) and network-level (IP address) blocking to
up having a great impact, evidencing that security try to make it harder for people in Russia to reach
is not a priority for the vendors and opening the the Tor network. Some months later, we’re now
possibility for attackers to find high impact bugs at a steady-state where they are trying to find
with low investment and little prior knowledge. new IP addresses to block and we’re rotating IP
addresses to keep up. In this talk I’ll walk through
what steps the Russian censors have taken, and
LSASS SHTINKERING: ABUSING how we reverse engineered their attempts and
changed our strategies and our software. Then
WINDOWS ERROR REPORTING we’ll discuss where the arms race goes from here,
TO DUMP LSASS what new techniques the anti-censorship world
needs if we’re going to stay ahead of future
Friday at 15:00 in Track 3 attacks, and what it means for the world that more
45 minutes | Demo, Tool and more countries are turning to network-level
blocking as the solution to their political problems.
Asaf Gilboa
Security Researcher, Deep Instinct
This presentation will show a new method of BROWSER-POWERED DESYNC
dumping LSASS that bypasses current EDR
defenses without using a vulnerability ATTACKS: A NEW FRONTIER IN
but by abusing a built-in mechanism in the HTTP REQUEST SMUGGLING
Windows environment which is the WER Friday at 15:30 in Track 4
(Windows Error Reporting) service. 45 minutes | Demo, Exploit
WER is a built-in system in Windows designed
James Kettle
to gather information about software crashes.
Director of Research, PortSwigger
One of its main features is producing a
memory dump of crashing user-mode The recent rise of HTTP Request Smuggling has seen
processes for further analysis. a flood of critical findings enabling near-complete
compromise of numerous major websites. However,
We discovered a new attack vector for the threat has been confined to attacker-accessible
dumping LSASS, dubbed LSASS Shtinkering, systems with a reverse proxy front-end... until now.
by manually reporting an exception to WER
on the LSASS process without crashing it. In this session, I’ll show you how to turn your
victim’s web browser into a desync delivery
The technique can also be used to dump the platform, shifting the request smuggling frontier
memory of any process on the system. by exposing single-server websites and internal
This attack can bypass defenses that wrongfully networks. You’ll learn how to combine cross-
assume that a memory dump generated from domain requests with server flaws to poison
the WER service is a benign activity. browser connection pools, install backdoors, and
release desync worms. With these techniques I’ll
In this talk, we’ll show a step-by-step approach compromise targets including Apache, Akamai,
of how we reverse-engineered the WER dumping Varnish, Amazon, and multiple web VPNs.
process, the challenges we found along the way,
as well as how we have managed to solve them. While some classic desync gadgets can be
adapted, other scenarios force extreme
innovation. To help, I’ll share a battle-tested
methodology combining browser features and
custom open-source tooling. We’ll also release
free online labs to help hone your new skillset.
I’ll also share the research journey, uncovering a
strategy for black-box analysis that solved several
long-standing desync obstacles and unveiled

56
an extremely effective novel desync trigger.
FRIDAY
perform Wireless Key Injection (WKI) on its
The resulting fallout will encompass client-side, behalf. It can occur after a legitimate BLE
server-side, and even MITM attacks; to wrap keyboard automatically closes its connection
up, I’ll live-demo breaking HTTPS on Apache. because of inactivity. In that situation, an attacker
can impersonate it and wirelessly send keys.
In this talk we will demonstrate the attack
HACKING ISPS WITH POINT- live and we will explain the theoretical
TO-PWN PROTOCOL OVER basis behind it and the process that led us
to discover the vulnerability. We will also
ETHERNET (PPPOE) release the tool that allows to reproduce the
Friday at 16:00 in Track 1 attack and we will detail how to use it.”
45 minutes | Demo
Gal Zror DEF CON POLICY DEPT - SPECIAL
Vulnerability Research Manager at CyberArk Labs
EDITION POLICY TALK
Hello, my name is BWL-X8620, and I’m a SOHO Friday at 16:30 in Track 2
router. For many years my fellow SOHO routers 45 minutes
and I were victims of endless abuse by hackers.
Default credentials, command injections, file DEF CON Policy Dept
uploading - you name it. And it is all just because
TBA
we’re WAN-facing devices. Just because our
ISP leaves our web server internet-facing makes
hackers think it’s okay to attack and make
us zombies. But today, I say NO MORE! A DEAD MAN’S FULL-YET-
In this talk, I will show that if a web client RESPONSIBLE-DISCLOSURE
can attack a web server, then an ISP
client can attack the ISP servers!
SYSTEM
Friday at 16:30 in Track 4
I will reveal a hidden attack surface and
vulnerabilities in popular network equipment used by
45 minutes | Demo, Tool
ISPs worldwide to connect end-users to the internet. Yolan Romailler
BRAS devices are not that different from us SOHO Applied Cryptographer
routers. No one is infallible. But, BRAS devices
Do you ever worry about responsible disclosure
can support up to 256,000 subscribers, and
because they could instead exploit the time-
exploiting them can cause a ruckus. Code executing
to-patch to find you and remove you from the
can lead to a total ISP compromise, mass client
equation? Dead man switches exist for a reason...
DNS poisoning, end-points RCE, and more!
In this talk we present a new form of vulnerability
This talk will present a high severity logical
disclosure relying on timelock encryption of
DOS vulnerability in a telecommunications
content: where you encrypt a message that
vendor implementation of PPPoE and a critical
cannot be decrypted until a given (future) time.
RCE vulnerability in PPP. That means we, the
This notion of timelock encryption first surfaced
SOHO routers, can attack and execute code
on the Cypherpunks mailing list in 1993 by the
on the ISP’s that connect us to the internet!
crypto-anarchist founder, Tim May, and to date
Today we are fighting back! while there have been numerous attempts to
tackle it, none have been deployed at scale, nor
made available to be used in any useful way.
WIRELESS KEYSTROKE This changes today: we’re releasing a free,
INJECTION (WKI) VIA open-source tool that achieves this goal with
proper security guarantees. We rely on threshold
BLUETOOTH LOW ENERGY (BLE) cryptography and decentralization of trust to
Friday at 16:00 in Track 3 exploit the existing League of Entropy (that is
running a distributed, public, verifiable randomness
45 minutes | Demo, Tool, Exploit
beacon network) in order to do so. We will first
Jose Pico cover what all of these means, we will then see
Founder at LAYAKK how these building blocks allow us to deploy a
responsible disclosure system that guarantees that
Fernando Perera your report will be fully disclosed after the time-
Security Analyst at LAYAKK to-patch has elapsed. This system works without
We present a Microsoft Windows vulnerability any further input from you, unlike the usual Twitter
that allows a remote attacker to impersonate SHA256 commitments to a file on your computer.
a Bluetooth Low Energy (BLE) keyboard and
57
 PR3S3NTATI0NS request. Moreover, we’ll demonstrate how we
HUNTING BUGS IN THE TROPICS bypass the authentication requirement with a single,
Friday at 17:00 in Track 1 crafted password by colliding the identity cache!
45 minutes | Exploit
Daniel Jensen
DEANONYMIZATION OF TOR
Aruba Networks makes networking
products for the enterprise. I make HTTP HIDDEN SERVICES
enterprise products run arbitrary code. Friday at 17:30 in Track 4
Over the past couple of years, I’ve been hunting 20 minutes | Demo, Exploit
for vulnerabilities in some of Aruba’s on-premise Ionut Cernica
networking products and have had a bountiful
PHD Student Department of Computer Science, Faculty of Automatic
harvest. A curated (read: patched) selection of
these will be presented for your enjoyment. Pre- Control and Computer Science, University Politehnica of Bucharest
auth vulnerabilities and interesting bug chains Anonymity networks such as Tor are used
abound, as well as a few unexpected attack to protect the identity of people or services.
surfaces and a frequently overlooked bug class. Several deanonymization techniques have been
This talk will explore some of the vulnerabilities described over time. Some of them attacked the
I’ve found in various products in the Aruba range, protocol, others exploited various configuration
and include details of their exploitation. I’ll issues. Through this presentation I will focus on
elaborate on how I found these bugs, detailing deanonymization techniques of the http services of
my workflow for breaking open virtual appliances such networks by exploiting configuration issues.
and searching for vulnerabilities in them. In the first part of the presentation, I will
present deanonymization techniques on TOR
which are public, and I will also present the
LET’S DANCE IN THE CACHE - techniques developed by me and the interesting
story of how I came to develop them.
DESTABILIZING HASH TABLE ON
In the last part of my presentation, I will do a demo
MICROSOFT IIS with the exploitation of http hidden services in TOR
Friday at 17:00 in Track 3 and I will present each technique separately. I will
45 minutes | Demo, Tool, Exploit also present how one of the techniques can be used
successfully not only in the TOR network, but also
Orange Tsai on the internet in order to obtain information about
Principal Security Researcher of DEVCORE the server that will help you discover other services.
Hash Table, as the most fundamental Data Structure
in Computer Science, is extensively applied in
Software Architecture to store data in an associative
DEF CON POLICY DEPT - SPECIAL
manner. However, its architecture makes it prone EDITION POLICY TALK
to Collision Attacks. To deal with this problem, 25
Friday at 17:30 in Track 2
years ago, Microsoft designed its own Dynamic
Hashing algorithm and applied it everywhere in IIS, 45 minutes
the Web Server from Microsoft, to serve various DEF CON Policy Dept
data from HTTP Stack. As Hash Table is everywhere,
isn’t the design from Microsoft worth scrutinizing? TBA

We dive into IIS internals through months of Reverse-

Engineering efforts to examine both the Hash
Table implementation and the use of Hash Table
KILLER HERTZ
algorithms. Several types of attacks are proposed Friday at 18:00 in Track 1
and uncovered in our research, including (1) A 45 minutes | Demo, Tool, Exploit
specially designed Zero-Hash Flooding Attack
Chris Rock
against Microsoft’s self-implemented algorithm.
(2) A Cache Poisoning Attack based on the Hacker
inconsistency between Hash-Keys. (3) An unusual Governments and the private sector around the
Authentication Bypass based on a hash collision. world spend billions of dollars on Electronic
By understanding this talk, the audience won’t be Counter Measures (ECMs) which include
surprised why we can destabilize the Hash Table jamming technologies. These jammers are
easily. The audience will also learn how we explore used by police departments to disrupt criminal
the IIS internals and will be surprised by our results. communication operations as well as in prisons
These results could not only make a default installed to disrupt prisoners using smuggled in cell
IIS Server hang with 100% CPU but also modify phones. The military use jammers to disrupt
arbitrary HTTP responses through crafted HTTP radar communications, prevent remote IEDs from
58
FRIDAY SATURDAY SUNDAY
09:30 COMBATTING SEXUAL ABUSE WITH THREAT 09:30 CONFESSIONS OF A CISO // LAURA 09:30 ERADICATING DISEASE WITH BIOTERRORISM
INTELLIGENCE TECHNIQUES // AARON DEVERA WHITT-WINYARD // MIXÆL S. LAUFER

10:35 HUNDREDS OF INCIDENTS, WHAT CAN WE 10:35 WHAT YOUR STOLEN IDENTITY DID ON ITS 10:35 BASIC BLOCKCHAIN FORENSICS // K1NG_CR4B
SHARE? // GUY BARNHART-MAGEN & BRENTON COVID VACATION // JUDGE TAYLOR
MORRIS
11:40 ANDROID, BIRTHDAY CAKE, OPEN WIFI... 11:40 THIS ONE TIME, AT THIS HOSPITAL, I GOT 11:40 ABORTION TECH // MAGGIE MAYHEM
OH MY! // A.KRONTAB RANSOMWARE // EIRICK LURAAS

12:10 THE RICHEST PHISHERMAN IN COLOMBIA // 12:45 VOTER TARGETING, LOCATION DATA, AND YOU
NICK ASCOLI AND MATT MOSLEY // L0NGRANGE
OFF THE RECORD.
12:45 TAKING DOWN THE GRID // JOE SLOWIK 13:50 INTERNET WARS 2022: THESE WARS AREN'T NO VIDEO RECORDING ALLOWED.
JUST VIRTUAL // JIVESX, HARRI HURSTI, CHERYL BISWAS, BE THERE OR MISS IT FOREVER.
CHRIS KUBECKA, RUSS HANDORF, BRYSON BORT, AND GADI EVRON
13:50 DON'T BLOW A FUSE: SOME TRUTHS ABOUT 16:00 DANCING AROUND DRM // GAME TECH CHRIS & CHECK SKYTALKS.INFO
FUSION CENTRES // 3NCR1PT3D ギンジー ターラノー �� FOR ANY SCHEDULE UPDATES

LOCATION INFO
14:55 CLOUD THREAT ACTORS: NO LONGER 17:05 COMING HOME TO DEF CON: A DEEP DIVE LINQ HOTEL
CRYPTOJACKING FOR FUN AND PROFIT // INTO THE REAL ESSENCE AND ETHOS OF BLOQ BALLROOM
NATHANIEL QUIST HACKING // RICHARD THIEME
16:00 AUTOMATED TROLLING FOR FUN AND NO ILLUSTRATION BY: @RAYGUNRX
PROFIT // BURNINATOR ASSISTED BY: @HACKTHELIGHT
MODELS: SPOON & SEHRO
17:05 DEADLY RUSSIAN MALWARE IN UKRAINE //
CHRIS KUBECKA

59
 PR3S3NTATI0NS
triggering and radio communications. The private
sector use jammers to disrupt espionage in the
PULLING PASSWORDS OUT OF
board room and to protect VIPS from RC-IEDs. CONFIGURATION MANAGER:
What if there was a way of communicating
that was immune to jammers without knowing
PRACTICAL ATTACKS AGAINST
the point of origin. A way of communicating at MICROSOFT’S ENDPOINT
short to medium distances, an Electronic Counter
Countermeasure ECCM to the jammer. MANAGEMENT SOFTWARE
Using a custom-built Tx/Rx, I will use the Friday at 18:00 in Track 3
earth’s crust to generate a H-field Near Field 45 minutes | Demo, Tool
Communication (NFC) channel spanning 1-11km
Christopher Panayi
away in the sub 9 kHz range to communicate
encrypted messages in a jammed environment. Chief Research Officer, MWR CyberSec
System Center Configuration Manager, now
Microsoft Endpoint Configuration Manager
DRAGON TAILS: SUPPLY-SIDE (MECM), is a software management product
that has been widely adopted by large
SECURITY AND INTERNATIONAL organizations to deploy, update, and manage
VULNERABILITY DISCLOSURE software; it is commonly responsible for
the deployment and management of the
LAW majority of server and workstation machines
Friday at 18:30 in Track 2 in enterprise Windows environments.
20 minutes This talk will provide an outline of how MECM
is used to deploy machines into enterprise
Stewart Scott environments (typically through network booting,
Assistant Director, Cyber Statecraft Initiative, Atlantic Council although it supports various Operating System
Trey Herr deployment techniques), and will explore attacks
Director, Cyber Statecraft Initiative, Atlantic Council that allow Active Directory credentials to be
extracted from this process. The common MECM
This talk will present a study of the reliance misconfigurations leading to these attacks will be
of proprietary and open source software on detailed and, in so doing, the talk will aim to show
Chinese vulnerability research. A difficult political how to identify and exploit these misconfigurations
environment for Chinese security researchers and how to defend against these attacks. Each
became acute when a law requiring vulnerability viable attack will be discussed in depth (mostly by
disclosure to government and banning it to all discussing the protocols and architecture in use, but
others but the affected vendor took effect in Sept. sometimes by diving into relevant code, if necessary)
2021. No public evaluation of this law’s impact so that the context of how and why the attack works
has yet been made. This talk will present results of will be understood. These concepts will be illustrated
a quantitative analysis on the changing proportion through the demo and release of a tool that allows
of Chinese-based disclosures to major software for the extraction of credentials from several of the
products from Google, Microsoft, Apple, and onsite deployment techniques that MECM supports.
VMWare alongside several major open source
packages. The analysis will measure change over
time in response to evolving Chinese legislation,
significant divergence from data on the allocation
TEAR DOWN THIS ZYWALL:
of bug bounty rewards, and notable trends in BREAKING OPEN ZYXEL
the kinds of disclosed vulnerabilities. The Chinese
research community’s prowess is well known, ENCRYPTED FIRMWARE
from exploits at the Tianfu Cup to preeminent Friday at 18:00 in Track 4
enterprise labs like Qihoo 360. However, the 45 minutes
recent law aiming to give the Chinese government
early access to the community’s discoveries—and Jay Lagorio
the government’s apparent willingness to enforce Independent Security Researcher
it even on high-profile corporations as seen in its
How do you go bug hunting in devices you own
punishment of Alibaba—demand more thorough
when the manufacturer has slapped some pesky
scrutiny. This talk will address implications for
encryption scheme on the firmware? Starting from
policy and the wider hacker community.
an encrypted blob of bits and getting to executable
code is hard and can be even more frustrating
when you already know the bug is there, you
just want to see it! Join me on my expedition to
access the contents of my Zyxel firewall’s firmware
using password and hash cracking, hardware and

60
software reverse engineering, and duct taping
FRIDAY/SATURDAY
puzzle pieces together. We’ll start with a device
LITERAL SELF-PWNING:
and a firmware blob, flail helplessly at the crypto, WHY PATIENTS - AND THEIR
tear apart the hardware, reverse engineer the
software and emulate the platform, and finally ADVOCATES - SHOULD BE
identify the decryption routine – ultimately breaking
the protection used by the entire product line to ENCOURAGED TO HACK,
decrypt whatever firmware version we want. IMPROVE, AND MOD MED TECH
Saturday at 10:00 in Track 4

SATURDAY 45 minutes
Cory Doctorow
Science fiction author, activist and journalist
BRAZIL REDUX: SHORT Christian “quaddi” Dameff MD
Emergency Medicine Physician & Hacker at The University of California
CIRCUITING TECH-ENABLED San Diego
DYSTOPIA WITH THE RIGHT TO Jeff “r3plicant” Tully MD
Anesthesiologist at The University of California San Diego
REPAIR
Saturday at 10:00 in Track 1 What do Apple, John Deere and Wahl Shavers
75 minutes have in common with med-tech companies? They
all insist that if you were able to mod their
Paul Roberts stuff, you would kill yourself and/or someone
Founder, SecuRepairs.org, Editor in Chief, The Security Ledger else... and they’ve all demonstrated, time and
Joe Grand again, that they are unfit to have the final
Founder and CEO, Grand Idea Studios say over how the tools you depend on should
Corynne McSherry work. As right to repair and other interoperability
Legal Director, Electronic Frontier Foundation movements gain prominence, med-tech wants
Louis Rossmann us to think that it’s too life-or-death for
Founder, Rossmanngroup.com modding. We think that med-tech is too life-or-
death NOT to to be open, accountable and
Kyle Wiens
CEO, iFixit configurable by the people who depend on
it. Hear two hacker doctors and a tech activist
Terry Gilliam’s 1985 cult film Brazil posits a talk about who’s on the right side of history
polluted, hyper-consumerist and totalitarian
dystopia in which a renegade heating engineer, and how the people on the wrong side of
Archibald Tuttle, takes great risks to conduct repairs history are trying to turn you into a walking
outside of the stifling and inefficient bureaucracy of inkjet printer, locked into an app store.
“Central Services.” When Tuttle’s rogue repairs are
detected, Central Services workers demolish and
seize repaired systems under the pretext of “fixing” SCALING THE SECURITY
them. It’s dark. It’s also not so far off from our
present reality in which device makers use always-on
RESEARCHER TO ELIMINATE OSS
Internet connections, DRM and expansive copyright VULNERABILITIES ONCE AND
and IP claims to sustain “Central Services”-like
monopolies on the service and repair of appliances, FOR ALL
agricultural and medical equipment, personal Saturday at 10:00 in Track 3
electronics and more. The net effect of this is a 45 minutes | Demo
less- not more secure ecosystem of connected things
that burdens consumers, businesses and the planet. Jonathan Leitschuh
Our panel of repair and cybersecurity experts will OSS Security Researcher - Dan Kaminsky Fellowship @ HUMAN Security
delve into how OEMs’ anti-repair arguments trumpet
cybersecurity risks, while strangling independent Hundreds of thousands of human hours are invested
repair and dissembling about the abysmal state of every year in finding common security vulnerabilities
embedded device security. We’ll also examine how with relatively simple fixes. These vulnerabilities
the emergent “right to repair” movement aims to aren’t sexy, cool, or new, we’ve known about
dismantle this emerging “Brazil” style dystopia and them for years, but they’re everywhere!
lay the foundation for a “circular” economy that The scale of GitHub & tools like CodeQL (GitHub’s
reduces waste while also ensuring better security code query language) enable one to scan for
and privacy protections for technology users. vulnerabilities across hundreds of thousands of
OSS projects, but the challenge is how to scale the

61
 PR3S3NTATI0NS
triaging, reporting, and fixing. Simply automating
the creation of thousands of bug reports by itself
MY FIRST HACK WAS IN
isn’t useful, & would be even more of a burden 1958 (THEN A CAREER IN
on volunteer maintainers of OSS projects. Ideally
the maintainers would be provided with not only ROCK’N’ROLL TAUGHT ME
information about the vulnerability, but also a fix
in the form of an easily actionable pull request. ABOUT SECURITY)
Saturday at 11:00 in Track 2
When facing a problem of this scale, what is
the most efficient way to leverage researcher 45 minutes
knowledge to fix the most vulnerabilities across Winn Schwartau
OSS? This talk will cover a highly scalable solution Security Thinker Since 1983
- automated bulk pull request generation. We’ll
discuss the practical applications of this technique My first hack was in 1958, and it was all my
on real world OSS projects. We’ll also cover mother’s fault. Or perhaps I should also blame
technologies like CodeQL & OpenRewrite (a style- my father. They were both engineers and I got
preserving refactoring tool created at Netflix & now their DNA. As a kid I hacked phones… cuz,
developed by Moderne). Let’s not just talk about well, phones were expensive! (Cardboard was
vulnerabilities, let’s actually fix them at scale. an important hacking tool.) At age 6 I made a
decent living cuz I could fix tube TVs. True!
In roughly 1970 (thanks to NYU) we moved
HOW TO GET MUMPS THIRTY on to hacking Hollerith (punch) cards
YEARS LATER (OR, HACKING to avoid paying for telephone and our
utilities, and of course, shenanigans.
THE GOVERNMENT VIA FOIA’D As a recording studio designer and builder, we
CODE) dumpster dived for technology from AT&T. We
never threw anything out and learned how to
Saturday at 11:00 in Track 4 repurpose and abuse tech from the 1940s.
45 minutes | Demo, Exploit
As a rock’n’roll engineer, I learned to live with
Zachary Minneker constant systems epic failures. Anything that
Senior Security Engineer, Security Innovation could break would break: before a live TV
event or a massive concert. Talk about lessons
In the 60s, engineers working in a lab at in Disaster Recovery and Incident Response.
Massachusettes General Hospital in Boston
invented a programming environment for use in This talk, chock full of pictures and stories
medical contexts. This is before C, before the from the past, covers my hacking path as a
Unix epoch, before the concept of an electronic kid then as a necessary part of survival in
medical records system even existed. But if you the entertainment industry. 1958-1981.
have medical records in the US, or if you’ve Come on down for the ride and see how 64
banked in the US, its likely that this language years of lessons learned can give you an entirely
has touched your data. Since the 1960s, this different view of Hacking and how and why I
language has been used in everything from have embraced failure for both of my careers!
EMRs to core banking to general database
needs, and even is contained in apt to this day.
This is the Massachusettes General Hospital Utility NO-CODE MALWARE:
Multi-Programming System. This is MUMPS.
WINDOWS 11 AT YOUR SERVICE
This talk covers new research into common open-
Saturday at 11:00 in Track 3
source MUMPS implementations, starting with an
45 minutes | Demo, Tool, Exploit
application that relies on MUMPS: the Department
of Veterans Affairs’ VistA EMR. We’ll cover a Michael Bargury
short history of VistA before diving into its guts and Co-Founder and CTO, Zenity.io
examining MUMPS, the language that VistA was
written in. Then we’ll talk about 30 memory bugs Windows 11 ships with a nifty feature called
discovered while fuzzing open source MUMPS Power Automate, which lets users automate
implementations before returning to VistA to mundane processes. In a nutshell, Users can build
cover critical vulnerabilities found in credential custom processes and hand them to Microsoft,
handling and login mechanisms. We’ll close by which in turn ensures they are distributed to
taking a step back and asking questions about all user machines or Office cloud, executed
how we even got here in the first place, the right successfully and reports back to the cloud. You
moves we made, and what we can do better. can probably already see where this is going..

62
In this presentation, we will show how Power
SATURDAY
In late 2021, Google increased the vulnerability
Automate can be repurposed to power malware reward program in kCTF infrastructure, which
operations. We will demonstrate the full cycle of was built on top of Kubernetes and Google
distributing payloads, bypassing perimeter controls, Container Optimized OS, with a minimum
executing them on victim machines and exfiltrating reward of $31,337 per submission.
data. All while using nothing but Windows baked-in
In this talk, we will share about how we
and signed executables, and Office cloud services.
managed to have 4 successful submissions on
We will then take you behind the scenes and kCTF VRP by exploiting four Linux kernel bugs
explore how this service works, what attack to perform container escape on kCTF cluster,
surface it exposes on the machine and in the we will explain some interesting kernel exploit
cloud, and how it is enabled by-default and can techniques and tricks that can be used to bypass
be used without explicit user consent. We will the latest security mitigation in Linux kernel.
also point out a few promising future research We will also share what we did wrong that
directions for the community to pursue. causes us to nearly lose 1 of the bounty.
Finally, we will share an open-source command As of writing, there are 14 successful entries to
line tool to easily accomplish all of the above, kCTF. In this presentation, we are willing to share
so you will be able to add it into your Red our full, in-depth details on the research of kCTF.
Team arsenal and try out your own ideas.
To the best of our knowledge, this presentation
will be the first to talk about a complete
methodology to pwn kCTF (find and exploit
REVERSING THE ORIGINAL XBOX bugs within 0-day and 1-day) in public.
LIVE PROTOCOLS
Saturday at 11:30 in Track 1
45 minutes | Demo, Tool
THE EVIL PLC ATTACK:
Tristan Miller
WEAPONIZING PLCS
Hacker Saturday at 12:00 in Track 4
20 minutes | Demo, Tool, Exploit
Xbox Live for original Xbox systems launched
on November 15, 2002 and was subsequently Sharon Brizinov
discontinued on April 15, 2010. The first half of Vulnerability Research Team Lead @ Claroty
this talk will be an infromation dense overview of
These days, Programmable Logic Controllers
the gritty details of how the underlying protocols
(PLC) in an industrial network are a critical attack
work and intermixing a retrospective of two
target, with more exploits being identified every
decades of how the industry has approached
day. But what if the PLC wasn’t the prey, but
IOT and network security. The second half of the
the predator? This presentation demonstrates a
talk will use that base to discuss the architecture
novel TTP called the “Evil PLC Attack”, where
of drop in replacement server infrastructure,
a PLC is weaponized in a way that when an
how the speaker approaches the ethics of third
engineer is trying to configure or troubleshoot
party support for non-updatable abandoned
it, the engineer’s machine gets compromised.
networked devices, and culminating in a demo.
We will describe how engineers diagnose PLC
issues, write code, and transfer bytecode to PLCs
ALL ROADS LEADS TO GKE’S for execution with industrial processes in any
number of critical sectors, including electric, water
HOST : 4+ WAYS TO ESCAPE and wastewater, heavy industry, and automotive
Saturday at 12:00 in Track 3 manufacturing. Then we will describe how we
45 minutes | Demo, Exploit conceptualized, developed, and implemented
different techniques to weaponize a PLC in order to
Billy Jheng achieve code execution on an engineer’s machine.
Security Researcher at STAR Labs The research resulted in working PoCs
Muhammad ALifa Ramdhan against ICS market leaders which fixed all
Security Researcher at STAR Labs the reported vulnerabilities and remediated
the attack vector. Such vendors include
Container security is a prevalent topic in security Rockwell Automation, Schneider Electric,
research. Due to the great design and long- GE, B&R, Xinje, OVARRO and more.
term effort, containers have been more and
more secure. Usage of container technology is
increasingly being used. Container security is a
topic that has started to be discussed a lot lately.

63
SUNDAY

64
65
 PR3S3NTATI0NS from Drago’s lab including an assessment of the
TRACKING MILITARY GHOST breadth of impact of PIPEDREAM’s CODESYS
HELICOPTERS OVER OUR modules on equipment beyond Schneider
Electric’s PLCs, testing Omron servo manipulation,
NATION’S CAPITAL as well as OPC-UA server manipulation.
Saturday at 12:00 in Track 2 While a background in ICS is helpful to
20 minutes understand this talk, it is not required. The
audience will learn about what challenges
Andrew Logan they can expect to encounter when testing
There’s a running joke around Washington D.C. ICS malware and how to overcome them.
that the “State Bird” is the helicopter. Yet 96% of
helicopter noise complaints from 2018-2021 went
unattributed: D.C. Residents can not tell a news THE HITCHHACKER’S GUIDE TO
helicopter from a black hawk. Flight tracking sites
remove flights as a paid service to aircraft owners IPHONE LIGHTNING & JTAG
and government agencies; even in the best case
these sites do not receive tracking information from
HACKING
most military helicopters due to a Code of Federal Saturday at 12:30 in Track 1
Regulations exemption for “sensitive government 20 minutes | Demo, Tool
mission for national defense, homeland security,
intelligence or law enforcement.” This makes an stacksmashing
enormous amount of helicopter flights untraceable Hacker
even for the FAA and leaves residents in the dark. Apple’s Lightning connector was introduced almost
What if we could help residents identify 10 years ago - and under the hood it can be used
helicopters? What if we could crowd source for much more than just charging an iPhone: Using
helicopter tracking? What if we could collect a proprietary protocol it can also be configured
images to identify helicopters using computer to give access to a serial-console and even expose
vision? What if we could make aircraft radio as the JTAG pins of the application processor! So
accessible as reading a map? What if we could far these hidden debugging features have not
make spotting helicopters a game that appeals been very accessible, and could only be accessed
to the competitive spirit of Washingtonians? And using expensive and difficult to acquire “Kanzi”
what if we could do all of this... on Twitter? and “Bonobo” cables. In this talk we introduce
the cheap and open-source “Tamarin Cable”,
bringing Lightning exploration to the masses!
ANALYZING PIPEDREAM: In this talk we are diving deep into
the weeds of Apple Lightning:
CHALLENGES IN TESTING AN
What’s “Tristar”, “Hydra” and “HiFive”? What’s
ICS ATTACK TOOLKIT. SDQ and IDBUS? And how does it all fit together?
Saturday at 12:30 in Track 4 We show how you can analyze Lightning
45 minutes | Demo communications, what different types of cables (such
Jimmy Wylie as DCSD, Kanzi & co) communicate with the iPhone,
and how everything works on the hardware level.
Principal Malware Analyst II , Dragos, Inc.
We then show how we developed the “Tamarin
Identified early in 2022, PIPEDREAM is the Cable”: An open-source, super cheap (~$5
seventh-known ICS-specific malware and the fifth and a sacrificed cable) Lightning explorer
malware specifically developed to disrupt industrial that supports sending custom IDBUS & SDQ
processes. PIPEDREAM demonstrates significant commands, can access the iPhone’s serial-
adversary research and development focused console, and even provides a full JTAG/
on the disruption, degradation, and potentially, SWD probe able to debug iPhones.
the destruction of industrial environments and
physical processes. PIPEDREAM can impact We also show how we fuzzed Lightning to
a wide variety of PLCs including Omron and uncover new commands, and reverse engineer
Schneider Electric controllers. PIPEDREAM some Lightning details hidden in iOS itself.
can also execute attacks that take advantage
of ubiquitous industrial protocols, including
CODESYS, Modbus, FINS, and OPC-UA.
This presentation will summarize the malware,
and detail the difficulties encountered during the
reverse engineering and analysis of the malware
to include acquiring equipment and setting up our
lab. This talk will also release the latest results

66
 SATURDAY
UFOS, ALIEN LIFE, AND THE EXPLORING ANCIENT RUINS
LEAST UNTRUTHFUL THINGS I TO FIND MODERN BUGS:
CAN SAY. DISCOVERING A 0-DAY IN AN
Saturday at 12:30 in Track 2
45 minutes
MS-RPC SERVICE
Saturday at 13:00 in Track 3
Richard Thieme 45 minutes | Demo, Tool, Exploit
ThiemeWorks
Ben Barnea
I have explored the subject of UFOs seriously and Senior Security Researcher, Akamai
in depth and detail for 44 years. I have worked
with some of the best and brightest in the “invisible MS-RPC is Microsoft’s implementation of the Remote
college” to do academic research and reach Procedure Calls protocol. Even though the protocol
conclusions based on the evidence. I contributed to is extremely widespread, and serves as the basis
the celebrated history, “UFOs and Government: A for nearly all Windows services on both managed
Historical Inquiry,” the gold standard for historical and unmanaged networks, little has been published
research into the subject now in over 100 university about MS-RPC, its attack surface and design flaws.
libraries. This talk more than updates the latest In this talk, we will walkthrough and demonstrate
government statements on the subject--it is the most a 0-day RCE vulnerability which we discovered
complete, honest, and forthright presentation I through our research of MS-RPC. When exploited,
can make. I will tell the most truth I can, based this vulnerability allows an attacker to execute
on data and evidence. As an NSA analyst told code remotely and potentially take over the
me, “Richard, they are here. They’re here.” Domain Controller. We believe this vulnerability
may belong to a somewhat novel bug-class
which is unique to RPC server implementations,
CHROMEBOOK BREAKOUT: and would like to share this idea as a possible
research direction with the audience.
ESCAPING JAIL, WITH YOUR
To aid future research into the topic of MS-RPC, we
FRIENDS, USING A PICO DUCKY will share a deep, technical overview of the RPC
Saturday at 13:00 in Track 1 system in Windows, explain why we decided to
45 minutes | Demo target it, and point out several design flaws. We
will also outline the methodology we developed
Jimi Allee around RPC as a research target along with some
CEO @ Lost Rabbit Labs tools we built to facilitate the bug-hunting process.

Learn how we used our Pico Ducky to escape

Chromebook jail, rescue our friends along the way,
and have some fun Living Off the Land! Leveraging
EXPLORING ANCIENT RUINS
a discovered (but previously disclosed) Command TO FIND MODERN BUGS:
Injection vulnerability in the ChromeOS crosh shell,
we rabbithole into the internal ChromeOS Linux DISCOVERING A 0-DAY IN AN
system, obtain persistence across reboots, and
exfiltrate user data even before Developer Mode
MS-RPC SERVICE
has been enabled. Learn how to provision and Saturday at 13:00 in Track 3
utilize local services in order to perform Privilege 45 minutes | Demo, Tool, Exploit
Escalations, and also create a ʻMaster Key’ with
the Pico Ducky and custom GTFO 1-liners, in Ophir Harpaz
order to perform a full Chromebook Breakout! Senior Security Research Team Lead, Akamai
MS-RPC is Microsoft’s implementation of the Remote
Procedure Calls protocol. Even though the protocol
is extremely widespread, and serves as the basis
for nearly all Windows services on both managed
and unmanaged networks, little has been published
about MS-RPC, its attack surface and design flaws.
In this talk, we will walkthrough and demonstrate
a 0-day RCE vulnerability which we discovered
through our research of MS-RPC. When exploited,
this vulnerability allows an attacker to execute
code remotely and potentially take over the
Domain Controller. We believe this vulnerability
may belong to a somewhat novel bug-class

67
 PR3S3NTATI0NS
which is unique to RPC server implementations,
and would like to share this idea as a possible
HACK THE HEMISPHERE! HOW
research direction with the audience. WE (LEGALLY) BROADCASTED
To aid future research into the topic of MS-RPC, we
will share a deep, technical overview of the RPC
HACKER CONTENT TO ALL OF
system in Windows, explain why we decided to NORTH AMERICA USING AN
target it, and point out several design flaws. We
will also outline the methodology we developed END-OF-LIFE GEOSTATIONARY
around RPC as a research target along with some
tools we built to facilitate the bug-hunting process.
SATELLITE, AND HOW YOU CAN
SET UP YOUR OWN BROADCAST
DO NOT TRUST THE ASA, TOO!
Saturday at 13:30 in Track 2
TROJANS! 45 minutes | Demo
Saturday at 13:30 in Track 4
45 minutes | Tool, Exploit Karl Koscher
Hacker
Jacob Baines
Andrew Green
Lead Security Researcher, Rapid7
Hacker
Cisco ASA and ASA-X are widely deployed
firewalls that are relied upon to protect internal The Shadytel cabal had an unprecedented
networks from the dangers of the outside world. opportunity to legally uplink to and use a vacant
This key piece of network infrastructure is an transponder slot on a geostationary satellite
obvious point of attack, and a known target about to be decommissioned. This talk will
for exploitation and implantation by APT such explain how we modified an unused commercial
as the Equation Group. Yet it’s been a number uplink facility to broadcast modern HD DVB-S2
of years since a new vulnerability has been signals and created the media processing chain
published that can provide privileged access to generate the ultimate information broadcast.
to the ASA or the protected internal network. You’ll learn how satellite transponders work, how
But all good things must come to an end. HDTV is encoded and transmitted, and how you
can create your own hacker event broadcast.
In this talk, new vulnerabilities affecting the Cisco
ASA will be presented. We’ll exploit the firewall,
the system’s administrators, and the ASA-X
FirePOWER module. The result of which should
OPENCOLA. THE ANTISOCIAL
call into question the firewall’s trustworthiness. NETWORK
The talk will focus on the practical exploitation of Saturday at 14:00 in Track 1
the ASA using these new vulnerabilities. To that 45 minutes | Demo, Tool
end, new tooling and Metasploit modules will be
presented. For IT protectors, mitigation and potential John Midgley
indicators of compromise will also be explored. Cult of the Dead Cow
Oxblood Ruffin
Cult of the Dead Cow
The internet, as it stands today, is not a very
trustworthy environment, as evidenced by the
numerous headlines of companies abusing personal
data and activity. This is not really surprising since
companies are responsible for optimizing revenue,
which is often at odds with user benefit. The result
of these incentives has produced or exacerbated
significant problems: tech silos, misinformation,
privacy abuse, concentration of wealth, the
attention economy, etc. We built OpenCola, free
and open source, as an alternative to existing
big-tech applications. It puts users in control of
their personal activity and the algorithms that
shape the flow of data to them. We believe that
this solution, although simple, can significantly
mitigate the challenges facing the Internet.

68
 SATURDAY
steal money from your digital wallet? To answer
THE COW (CONTAINER ON these questions, we researched the payment system
WINDOWS) WHO ESCAPED THE built into Xiaomi smartphones based on MediaTek
chips, which are very popular in China. As a result,
SILO we discovered vulnerabilities that allow forging
Saturday at 14:00 in Track 3 payment packages or disabling the payment system
45 minutes | Demo, Tool, Exploit directly from an unprivileged Android application.
Mobile payment signatures are carried out in the
Eran Segal Trusted Execution Environment (TEE) that remains
Security research team leader at SafeBreach secure on compromised devices. The attacker needs
Virtualization and containers are the to hack the TEE in order to hack the payment.
foundations of cloud services. Containers There is a lot of good research about mobile TEEs
should be isolated from the real host’s in the public domain, but no one pays attention
settings to ensure the security of the host. to trusted apps written by device vendors like
Xiaomi and not by chip makers, while the core
In this talk we’ll answer these questions: of mobile payments is implemented there. In our
“Are Windows process-isolated containers research, we reviewed Xiaomi’s TEE for security
really isolated?” and “What can an attacker issues in order to find a way to scam WeChat Pay.
achieve by breaking the isolation?”
Before we jump into the vulnerabilities, we’ll explain
how Windows isolates the container’s processes, DOING THE IMPOSSIBLE: HOW
filesystem and how the host prevents the container
from executing syscalls which can impact the host. I FOUND MAINFRAME BUFFER
Specifically, we’ll focus on the isolation OVERFLOWS
implementation of Ntoskrnl using Saturday at 14:30 in Track 4
server silos and job objects. 45 minutes | Demo, Tool, Exploit
We’ll compare Windows containers to Linux
containers and describe the differences
Jake Labelle
between their security architectural designs. Mainframes run the world, literally. Have
you ever paid for something, a mainframe
We’ll follow the scenario of an attacker-crafted
was involved, flown? Used a bank? Gone to
container running with low privileges. We’ll show
college? A mainframe was involved. Do you live
in multiple ways how to gain privilege escalation
in a country with a government? Mainframes!
inside the container to NT/System. After gaining
The current (and really only) mainframe OS
NT/System permissions, we’ll talk about how
is z/OS from IBM. If you’ve ever talked to a
we escaped the isolation of the container and
mainframer you’ll get told how they’re more
easily achieved a dump of the entire host’s
secure because buffer overflows are (were)
kernel memory from within the container. If the
impossible. This talk will prove them all wrong!
host is configured with a kernel debugger, we
can even dump the host’s Admin credentials. Finding exploits on z/OS is no different than any
other platform. This talk will walk through how you
We’ll finish by demonstrating how an attacker-
too can become a mainframe exploit researcher!
crafted container with low privileges can read UEFI
settings and then set them. Using this technique an Remote code execution is extra tricky on a
attacker can communicate between containers and mainframe as almost all sockets read data with the
cause a permanent Denial-of-Service (DoS) to a host ASCII character set and convert that to EBCDIC for
with default settings, through the UEFI interface. the application. With this talk you will find out how
to find and then remotely overflow a vulnerable
mainframe C program and create a ASCII ->
DIGGING INTO XIAOMI’S TEE TO EBCDIC shellcode to escalate your privileges
remotely, without auth. Previous mainframe talks
GET TO CHINESE MONEY focused on infrastructure based attacks. This talk
Saturday at 14:30 in Track 2 builds on those but adds a class of vulnerabilities,
20 minutes | Demo, Exploit opening up the mainframe hacking community.

Slava Makkaveev
Security Researcher, Check Point
The Far East and China account for two-thirds of
global mobile payments in 2021. That is about $4
billion in mobile wallet transactions. Such a huge
amount of money is sure to attract the attention of
hackers. Have you ever wondered how safe it is
to pay from a mobile device? Can a malicious app
69
 PR3S3NTATI0NS This talk will go over the coordination required
DÉJÀ VU: UNCOVERING STOLEN to execute a hack of this scale and the logistics
ALGORITHMS IN COMMERCIAL of commanding a botnet of IoT systems. It will
also describe the operational security measures
PRODUCTS taken so that *you* can evade detection, avoid
Saturday at 15:00 in Track 1 punishment, and successfully walk at graduation.
20 minutes | Demo
Patrick Wardle YOU HAVE ONE NEW
Founder, Objective-See Foundation
Tom McGuire
APPWNTMENT - HACKING
In an ideal world, members of a community work PROPRIETARY ICALENDAR
together towards a common goal or greater good.
Unfortunately, we do not (yet) live in such a world.
PROPERTIES
Saturday at 15:00 in Track 3
In this talk, we discuss what appears to be a 45 minutes | Demo, Tool, Exploit
systemic issue impacting our cyber-security
community: the theft and unauthorized use of Eugene Lim
algorithms by corporate entities. Entities who Cybersecurity Specialist, Government Technology Agency of Singapore
themselves may be part of the community.
First defined in 1998, the iCalendar standard
First, we’ll present a variety of search techniques remains ubiquitous in enterprise software. However,
that can automatically point to unauthorized it did not account for modern security concerns
code in commercial products. Then we’ll show and allowed vendors to create proprietary
how reverse-engineering and binary comparison extensions that expanded the attack surface.
techniques can confirm such findings.
I demonstrate how flawed RFC implementations
Next, we will apply these approaches in a real- led to new vulnerabilities in popular applications
world case study. Specifically, we’ll focus on a such as Apple Calendar, Google Calendar,
popular tool from a non-profit organization that Microsoft Outlook, and VMware Boxer. Attackers
was reverse-engineered by multiple entities such can trigger exploits remotely with zero user
that its core algorithm could be recovered and used interaction due to automatic parsing of event
(unauthorized), in multiple commercial products. invitations. Some of these zombie properties were
The talk will end with actionable takeaways abandoned years ago for their obvious security
and recommendations, as who knows, this may problems but continue to pop up in legacy code.
happen to you too! For one, we’ll present strategic Furthermore, I explain how iCalendar’s integrations
approaches (and the challenges) of confronting with the SMTP and CalDAV protocols enable
culpable commercial entities (and their legal teams). multi-stage attacks. Despite attempts to secure
Moreover, we’ll provide recommendations for these technologies separately, the interactions
corporations to ensure this doesn’t happen in the that arise from features such as emailed event
first place, thus ensuring that our community can reminders require a full-stack approach to
remain cohesively focused on its mutual goals. calendar security. I conclude that developers
should strengthen existing iCalendar standards
in terms of design and implementation.
THE BIG RICK: HOW I I advocate for an open-source and open-
RICKROLLED MY HIGH SCHOOL standards approach to secure iCalendar
rather than proprietary fragmentation. I will
DISTRICT AND GOT AWAY WITH release a database of proprietary iCalendar
properties and a technical whitepaper.
IT
Saturday at 15:00 in Track 2
20 minutes
Minh Duong
Student at University of Illinois at Urbana-Champaign
What happens when you have networked
projectors, misconfigured devices, and a bored
high school student looking for the perfect senior
prank? You get a massive rickroll spanning six
high schools and over 11,000 students at one of
the largest school districts in suburban Chicago.

70
 SATURDAY
AUTOMOTIVE ETHERNET PERIMETER BREACHED! HACKING
FUZZING: FROM PURCHASING AN ACCESS CONTROL SYSTEM
ECU TO SOME/IP FUZZING Saturday at 15:30 in Track 4
45 minutes | Demo
Saturday at 15:30 in Track 1
20 minutes | Tool Sam Quinn
Senior Security Researcher, Trellix
Jonghyuk Song
Leader of Verification and Validation, Autocrypt Steve Povolny
Principal Engineer & Head of Advanced Threat Research, Trellix
Soohwan Oh
Blueteam Engineer, Autocrypt The first critical component to any attack is an entry
point. As we lock down firewalls and routers, it
Woongjo choi
can be easy to overlook the network-connected
Blueteam Leader, Autocrypt physical access control systems. A study done by
Car hacking is a tricky subject to hackers because IBM in 2021 showed that the average cost of a
it requires lots of money and hardware knowledge physical security compromise is $3.54 million and
to research with a real car. An alternative way takes an average of 223 days to identify a breach.
would be to research with an ECU but it also Carrier’s LenelS2 is a global distributor of
difficult to know how to setup the equipment. access control systems, deployed across
Moreover, in order to communicate with Automotive multiple industries and certified for use in
Ethernet services running on the ECU, you need federal and state government facilities.
additional devices such as media converters and Trellix’s Threat Labs team uncovered 8 0-day
Ethernet adapters supporting Virtual LAN(VLAN). vulnerabilities leading to remote, unauthenticated
Even if you succeed in building the hardware code execution on the LenelS2 Mercury 4420
environment, you can’t communicate with the access control panel. These findings lead to full
ECU over SOME/IP protocol of Automotive system control including the ability for an attacker
Ethernet if you don’t know the network to remotely manipulate door locks. During this
configuration, such as VLAN ID, service IDs presentation, we will deep dive into our hardware
and IP/port mapped to each service. hacking process including the challenges faced
such as bypassing the bootloader, hardware-
This talk describes how to do fuzzing on based watchdog timers, and authentication. We
the SOME/IP services step by step. will describe emulation and provide a detailed
First, we demonstrate how to buy an walkthrough of the 8 discovered zero-day
ECU, how to power and wire it. vulnerabilities, and end to end exploitation using
malware we designed to control system functionality.
Second, we explain network configurations
We culminate the talk with a live demo featuring
to communicate between ECU and PC.
full system control, unlocking doors remotely
Third, we describe how to find out the information without triggering any software notifications.
required to perform SOME/IP fuzzing and
how to implement SOME/IP Fuzzer.
We have conducted the fuzzing with the TOR: DARKNET OPSEC BY A
BMW ECUs purchased by official BMW
sales channels, not used products.
VETERAN DARKNET VENDOR
Saturday at 15:30 in Track 2
We hope this talk will make more people to 45 minutes
try car hacking and will not go through the
trials and errors that we have experienced. Sam Bent
KS LLC
The hacking subculture’s closest relative is that of the
Darknet. Both have knowledgeable people, many
of whom are highly proficient with technology and
wish to remain somewhat anonymous. They are
both composed of a vast amount of introverts and
abide by the same first rule: “Don’t get caught.”
Over the past decade, there have been many
DEF CON talks that have discussed topics related
to Tor and the Darknet. Having an IT, Infosec,
and hacking background, the goal is to present a
unique perspective from a hacker turned Darknet
Vendor, who then learned about the law and–

71
 PR3S3NTATI0NS
using metaphorical privilege escalation and social
engineering–got himself out of federal prison after
TRAILER SHOUTING: TALKING
a year and a half by acting as his own lawyer. PLC4TRUCKS REMOTELY WITH
The focus of this talk will surround operational
security policies that a skilled Darknet Market
AN SDR
Vendor (DMV) implements to avoid compromising Saturday at 16:00 in Track 1
their identity. We will look at tactics used by Law 45 minutes | Demo, Tool, Exploit
Enforcement and common attacks prevalent on
the Darknet, ranging from linguistic analysis and
Ben Gardiner
United States Postal Inspector operations all the Senior Cybersecurity Research Engineer, National Motor Freight Traffic
way to correlation attacks and utilizing long-range Association Inc.,
wifi antennas to avoid detection as a failsafe. Chris Poore
By focusing less on the basics of Tor and more Senior Reverse Engineer, Assured Information Security
on how insiders operate within it, we will Ben Gardiner, Chris Poore and other security
uncover what it takes to navigate this ever- researchers have been analyzing signals and
evolving landscape with clever OpSec. performing research against trailers and Power Line
Communication for multiple years. This year the
team was able to disclose two vulnerabilities focused
LOW CODE HIGH RISK: on the ability to remotely inject RF messages onto
the powerline and in turn send un-authenticated
ENTERPRISE DOMINATION VIA messages to the brake controller over the link. The
LOW CODE ABUSE team will discuss the details of PLC4TRUCKS, identify
what led to this research and the discovery of the
Saturday at 16:00 in Track 3
vulnerabilities, and then highlight the details of
45 minutes | Demo, Tool, Exploit the SDR and software used to perform the attack.
Michael Bargury The talk will conclude with the demonstration of
Co-Founder and CTO, Zenity.io a remotely induced brake controller solenoid test
using an FL2K and the release of the GNU radio
Why focus on heavily guarded crown block used to perform the test to the community
jewels when you can dominate an to promote further research in the area.
organization through its shadow IT?
Low-Code applications have become a
reality in the enterprise, with surveys showing DEFEATING MOVING ELEMENTS
that most enterprise apps are now built
outside of IT, with lacking security practices.
IN HIGH SECURITY KEYS
Unsurprisingly, attackers have figured out ways Saturday at 16:30 in Track 4
to leverage these platforms for their gain. 45 minutes | Tool, Exploit
In this talk, we demonstrate a host of attack Bill Graydon
techniques found in the wild, where enterprise Principal, Physical Security Analytics, GGR Security
No-Code platforms are leveraged and abused
for every step in the cyber killchain. You will A recent trend in high security locks is to add
learn how attackers perform an account takeover a moving element to the key: this prevents
by making the user simply click a link, move casting, 3D printing and many other forms of
laterally and escalate privileges with zero network unauthorised duplication. Pioneered by the Mul-
traffic, leave behind an untraceable backdoor, T-Lock Interactive locks, we see the technique
and automate data exfiltration, to name a few used in recent Mul-T-Lock iterations, the Abloy
capabilities. All capabilities will be demonstrated Protec 2 and most recently, the Medeco M4,
with POCs, and their source code will be shared. which is only rolling out to customers now.

Next, we will drop two isolation-breaking We have identified a major vulnerability in this
vulnerabilities that allow privilege escalation technology, and have developed a number of
and cross-tenant access. We will explain techniques to unlock these locks using a key made
how these vulnerabilities were discovered from a solid piece of material, which defeats all of
and assess their pre-discovery impact. the benefits of an interactive key. I’ll demonstrate
how it can be applied to Mul-T-Lock Interactive,
Finally, we will introduce an open-source recon tool Mul-T-Lock MT5+ and the Medeco M4, allowing
that identifies opportunities for lateral movement keys to be duplicated by casting, 3D printing
and privilege escalation through low-code platforms. and more. I’ll also cover other techniques
to defeat moving elements in a key, such as
printing a compliant mechanism and printing a
captive element directly. With this talk, we’re
also releasing a web application for anyone to
generate 3D printable files based on this exploit.
72
Finally, I’ll also discuss the responsible disclosure
SATURDAY
process, and working with the lock manufacturers
INTERNAL SERVER ERROR:
to patch the vulnerability and mitigate the risk. EXPLOITING INTER-PROCESS
COMMUNICATION WITH
WHY DID YOU LOSE THE NEW DESYNCHRONIZATION
LAST PS5 RESTOCK TO A PRIMITIVES
BOT TOP-PERFORMING APP- Saturday at 17:00 in Track 3
45 minutes | Demo, Tool, Exploit
HACKERS BUSINESS MODULES,
Martin Doyhenard
ARCHITECTURE, AND Security Researcher at Onapsis
TECHNIQUES In this talk I will show how to reverse engineer
Saturday at 16:30 in Track 2 a proprietary HTTP Server in order to leverage
45 minutes memory corruption vulnerabilities using high level
HTTP protocol exploitation techniques. To do so, I
Arik will present two critical vulnerabilities, CVE-2022-
Threat Intelligence Researcher, PerimeterX 22536 and CVE-2022-22532, which were found
The rise of the machines. in SAP’s proprietary HTTP Server, and could be
used by a remote unauthenticated attacker to
Whenever you are buying online, especially if it’s a compromise any SAP installation in the world.
limited stock item, you are competing against Bots
and lose miserably. Even when you are asleep, First, I will explain how to escalate an error in
there’s a 14% chance that a bot trying to log the request handling process to Desynchronize
into one of the 200+ digital accounts you own. data buffers and hijack every user’s account with
Advanced Response Smuggling. Furthermore, as the
Your mom called to say someone from her bank primitives of this vulnerability do not rely on header
ask for 4 digit SMS? It was an OTP bot. parsing errors, I will show a new technique to persist
Malicious automation is here to stay as it serves the attack using the first Desync botnet in history.
tens of thousands of hackers and retail scalpers and This attack will prove to be effective even in an
drives billions of dollars worth of marketplaces. “impossible to exploit” scenario: without a Proxy!
During my talk, we will deep dive into Next I will examine a Use-After-Free in the shared
the most fascinating architecture, business memory used for Inter-Process Communication. By
modules, and techniques top-performing exploiting the incorrect deallocation, I will show
of account crackers and retail bots use to how to tamper messages belonging to other TCP
maximize their success rate and revenue. connections and take control of all responses using
Cache Poisoning and Response Splitting theory.
Finally, as the affected buffers could
HACKING THE FARM: BREAKING also contain IPC control data, I will
explain how to corrupt memory address
BADLY INTO AGRICULTURAL pointers and end up obtaining RCE.
DEVICES.
Saturday at 17:00 in Track 1
45 minutes | Demo, Tool, Exploit
BLACK-BOX ASSESSMENT OF
Sick Codes
SMART CARDS
Hacker Saturday at 17:30 in Track 4
45 minutes | Demo, Tool
Hacking the farm. In this session, I’ll demonstrate
tractor-sized hardware hacking techniques, Daniel Crowley
firmware extraction, duplication, emulation, Head of Research, X-Force Red
and cloning. We’ll be diving into how the inner
You probably have at least two smart cards in
workings of agricultural cyber security; how such
your pockets right now. Your credit card, and
low-tech devices are now high-tech devices. The
the SIM card in your cell phone. You might also
“connected farm” is now a reality; a slurry of
have a CAC, metro card, or the contactless key
EOL devices, trade secrets, data transfer, and
to your hotel room. Many of these cards are
overall shenanigans in an industry that accounts
based on the same basic standards and share
for roughly one-fifth of the US economic activity.
a common command format, called APDU.
We’ll be discussing hacking into tractors, combines,
cotton harvesters, sugar cane and more.

73
 PR3S3NTATI0NS
This talk will discuss and demonstrate how even introduce the vulnerability to their web apps when
in the absence of information about a given utilizing popular libraries. I will end the talk by
card, there are a series of ways to enumerate the sharing the complex disclosure timeline and the
contents and capabilities of a card, find exposed difficulty of patching the vulnerability due to the
information, fuzz for input handling flaws, and interconnected nature of web specifications.
exploit poor authentication and access control.

DIGITAL SKELETON KEYS - WE’VE

CROSSING THE KASM -- A GOT A BONE TO PICK WITH
WEBAPP PENTEST STORY OFFLINE ACCESS CONTROL
Saturday at 17:30 in Track 2
45 minutes | Exploit SYSTEMS
Samuel Erb Saturday at 18:30 in Track 4
Hacker 20 minutes | Demo, Tool, Exploit
Justin Gardner Miana E Windall
Full-time Bug Bounty Hunter Software Development Engineer
In this talk we will tell the story of an insane exploit Micsen
we used to compromise the otherwise secure Software developer, Installer, And much more!
KASM Workspaces software. KASM Workspaces Offline RFID systems rely on data stored within the
is enterprise software for streaming virtual key to control access and configuration. But what if a
workstations to end users built on top of Docker. key lies? What if we can make the system trust those
This talk will span python binary RE, header lies? Well then we can do some real spooky things…
smuggling, configuration injection, docker This is the story of how a strange repeating
networking and questionable RFC interpretation. data pattern turned into a skeleton key
We hope to show you a little bit of what that can open an entire range of RFID
worked and a lot a bit of what didn’t work access control products in seconds.
on our quest to exploit this heisenbug.

THE CSRF RESURRECTIONS! EMULATION-DRIVEN REVERSE-

STARRING THE UNHOLY TRINITY: ENGINEERING FOR FINDING
SERVICE WORKER OF PWA, VULNS
Sunday at 11:00 in Track 2
SAMESITE OF HTTP COOKIE, 45 minutes | Demo, Tool
AND FETCH atlas
Saturday at 18:00 in Track 3 chief pwning officer, 0fd00m c0rp0ration
45 minutes | Demo, Tool do your eyes hurt? is your brain aching? is
Dongsung Kim your pain caused from too much deciphering
IT-Security Expert, Truesec difficult assembly (or decompiled C) code?
assembly can hurt, C code can be worse.
CSRF is (really) dead. SameSite killed it.
partial emulation to the rescue!
Browsers protect us. Lax by default!
let the emulator walk you through the code,
Sounds a bit too good to be true, doesn’t it? We
let it answer hard questions/problems you
live in a world where browsers get constantly
run into in your reversing/vuln research.
updated with brand new web features and new
specifications. The complexity abyss is getting this talk will introduce you the power of emulator-
wider and deeper. How do we know web driven reversing. guide your RE with the help of
technologies always play perfectly nice with each an emulator (one that can survive limited context),
other? What happens when something slips? emulate code you don’t want to reverse, be better,
learn more, be faster, with less brain-drain.
In this talk, I focus on three intertwined web
features: HTTP Cookie’s SameSite attribute, make no mistake, RE will always have room
PWA’s Service Worker, and Fetch. I will start for magicians to show their wizardry...
by taking a look at how each feature works but after this talk, you may find yourself
in detail. Then, I will present how the three a much more powerful wizard.
combined together allows CSRF to be resurrected,
bypassing the SameSite’s defense. Also, I will
demonstrate how a web developer can easily
74
 SATURDAY/SUNDAY abused for taking over legitimate applications.
EXPLOITATION IN THE ERA OF Taking a systemic approach, we will demonstrate
FORMAL VERIFICATION: A PEEK that over 80 Windows-native executables are
vulnerable to this special type of DLL Hijacking.
AT A NEW FRONTIER WITH As this raises additional opportunities for User
Account Control (UAC) bypass and Privilege
ADACORE/SPARK Escalation, we will discuss the value and further
Sunday at 11:00 in Track 1 implications of this technique and these findings.
45 minutes | Demo
Adam ʻpi3’ Zabrocki STRACE - A DTRACE ON
Principal System Software Engineer (Offensive Security) at NVIDIA
Alex Tereshkin WINDOWS REIMPLEMENTATION.
Principal Offensive Security Researcher at NVIDIA Sunday at 11:00 in Track 4
45 minutes | Demo, Tool
For decades, software vulnerabilities have remained
an unsolvable security problem regardless of years Stephen Eckels
of investment in various mitigations, hardening
II’ll document the kernel tracing APIs in modern
and fuzzing strategies. In the last years there have
versions of windows, implemented to support
been moves to formal methods as a path toward
Microsofts’ port of the ʻDTrace’ system to windows.
better security. Verification and formal methods can
This system provides an officially supported
produce rigorous arguments about the absence
mechanism to perform system call interception
of the entire classes of security bugs, and are a
that is patchguard compatible, but not secure boot
powerful tool to build highly secure software.
compatible. Alongside the history and details of
AdaCore/SPARK is a formally defined programming DTrace this talk will also cover a C++ and Rust
language intended for the development of based reimplementation of the system that I call
high integrity software used in systems where STrace. This reimplementation allows users to write
predictable and highly reliable operation is crucial. custom plugin dlls which are manually mapped to
The formal, unambiguous, definition of SPARK the kernel address space. These plugins can then
allows a variety of static analysis techniques to log all system calls, or perform any side effects
be applied, including information flow analysis, before and after system call execution by invoking
proof of absence of run-time exceptions, proof the typical kernel driver APIs – if desired.
of termination, proof of functional correctness,
and proof of safety and security properties.
In this talk we will dive-into AdaCore/SPARK, cover DEFAULTS - THE FAULTS.
the blind spots and limitations, and show real-
world vulnerabilities which we met during my work
BYPASSING ANDROID
and which are still possible in the formally proven PERMISSIONS FROM ALL
software. We will also show an exploit targeting
one of the previously described vulnerabilities. PROTECTION LEVELS
Sunday at 12:00 in Track 4
45 minutes | Demo, Exploit
SAVE THE ENVIRONMENT
Nikita Kurtin
(VARIABLE): HIJACKING Hacker
LEGITIMATE APPLICATIONS WITH Exploring in depth the android permission
mechanism, through different protection levels.
A MINIMAL FOOTPRINT
Step by step exploitations techniques that
Sunday at 11:00 in Track 3
affect more than 98% of all Android devices
45 minutes | Demo, Tool including the last official release (Android 12).
Wietze Beukema In this talk I reveal a few different techniques that I
Threat Detection & Response at CrowdStrike uncovered in my research, which can allow hackers
to bypass permissions from all protection levels in
DLL Hijacking, being a well-known technique
any Android device, which is more than 3 billion
for executing malicious payloads via trusted
active devices according to the google official stats.
executables, has been scrutinised extensively,
to the point where defensive measures are These vulnerabilities enable the hacker to
in a much better position to detect abuse. To bypass the security measures of android, by
bypass detection, stealthier and harder-to- abusing default (built in) services and get
detect alternatives need to come into play. In access to abilities and resources which are
this presentation, we will take a closer look at protected by permission mechanism.
how process-level Environment Variables can be

75
 PR3S3NTATI0NS
Some vulnerabilities are partially fixed, others won’t
be fixed as google considers as intended behavior.
THE CALL IS COMING FROM
In this talk I’ll survey the different vulnerabilities, INSIDE THE CLUSTER: MISTAKES
and deep dive into a few of different exploitations.
THAT LEAD TO WHOLE CLUSTER
Finally, I’ll demonstrate how those techniques
can be combined together to create real life PWNERSHIP
implications and to use for: Ransomware, Sunday at 12:00 in Track 1
Clickjacking, Uninstalling other apps and more, 45 minutes | Demo
completely undetected by security measures.
Dagan Henderson
Principal / RAFT
PREAUTH RCE CHAINS ON AN Will Kline
Senior Principal / Dark Wolf Solutions
MDM: KACE SMA
Sunday at 12:00 in Track 3 Kubernetes has taken the DevOps world by storm,
45 minutes | Demo, Exploit but its rapid uptake has created an ecosystem
where many popular solutions for common
Jeffrey Hofmann challenges—storage, release management,
Security Engineer at Nuro observability, etc.—are either somewhat immature
or have been “lifted and shifted” to Kubernetes.
MDM solutions are, by design, a single point of What critical security smells can pentesters look
failure for organizations. MDM appliances often for when looking at the security of a cluster?
have the ability to execute commands on most of
the devices in an organization and provide an We are going to talk through five different
“instant win” target for attackers. KACE Systems security problems that we have found (and
Management Appliance is a popular MDM choice reported, no 0-days here) in popular open-
for hybrid environments. This talk will cover the source projects and how you can look for
technical details of 3 preauthentication RCE as similar vulnerabilities in other projects.
root chains on KACE SMA and the research steps
taken to identify the individual vulnerabilities used.
ELECTROVOLT: PWNING
TAKING A DUMP IN THE CLOUD POPULAR DESKTOP APPS WHILE
Sunday at 12:00 in Track 2 UNCOVERING NEW ATTACK
45 minutes | Demo, Tool SURFACE ON ELECTRON
Melvin Langvik Sunday at 13:00 in Track 3
Security Consultant, TrustedSec Targeted Operations 45 minutes | Demo, Exploit
Flangvik Aaditya Purani
Taking a Dump In The Cloud is a tale of countless Senior Security Engineer, Tesla
sleepless nights spent reversing and understanding
Max Garrett
the integration between Microsoft Office resources
Application Security Auditor, Cure53
and how desktop applications implement them. The
release of the TeamFiltration toolkit, connecting all Electron based apps are becoming a norm
the data points to more effectively launch attacks these days as it allows encapsulating web
against Microsoft Azure Tenants. Understanding the applications into a desktop app which is
lack of conditional access for non-interactive logins rendered using chromium. However, if Electron
and how one can abuse the magic of Microsofts apps load remote content of attackers choice
OAuth implementation with Single-Sign-On to either via feature or misconfiguration of Deep
exfiltrate all the loot. Streamlining the process of Link or Open redirect or XSS it would lead
account enumeration and validation. Thoughts to Remote Code Execution on the OS.
on working effectively against Azure Smart
Lockout. Exploring options of vertical movement Previously, it was known that lack of certain
given common cloud configurations, and more! feature flags and inefficiency to apply best
practices would cause this behavior but we have
identified sophisticated novel attack vectors
within the core electron framework which could
be leveraged to gain remote code execution
on Electron apps despite all feature flags being
set correctly under certain circumstances.

76
This presentation covers the vulnerabilities
SUNDAY
found in twenty commonly used Electron
RINGHOPPER – HOPPING FROM
applications and demonstrates Remote Code USER-SPACE TO GOD MODE
Execution within apps such as Discord,
Sunday at 13:00 in Track 2
Teams(local file read), VSCode, Basecamp,
Mattermost, Element, Notion, and others. 45 minutes | Demo, Exploit

The speaker’s would like to thank Mohan Jonathan Lusky

Sri Rama Krishna Pedhapati, Application Security Research Team Lead, Intel
Security Auditor, Cure53 and William Bowling, Benny Zeltser
Senior Software Developer, Biteable for Security Researcher, Intel
their contributions to this presentation.
The SMM is a well-guarded fortress that holds
a treasure – an unlimited god mode. We
LESS SMARTSCREEN MORE hopped over the walls, fooled the guards,
and entered the holy grail of privileges.
CAFFEINE – CLICKONCE (AB)USE An attacker running in System Management
FOR TRUSTED CODE EXECUTION Mode (SMM) can bypass practically any security
Sunday at 13:00 in Track 1 mechanism, steal sensitive information, install
a bootkit, or even brick the entire platform.
45 minutes | Demo, Tool
We discovered a family of industry wide TOCTOU
Steven Flores vulnerabilities in various UEFI implementations
Senior Consultant at SpecterOps affecting more than 8 major vendors making
Nick Powers billions of devices vulnerable to our attack.
Consultant at SpecterOps RingHopper leverages peripheral devices that
exist on every platform to perform a confused
Initial access payloads have historically had limited deputy attack. With RingHopper we hop from
methods that work seamlessly in phishing campaigns ring 3 (user-space) into ring -2 (SMM), bypass all
and can maintain a level of evasion. This payload mitigations, and gain arbitrary code execution.
category has been dominated by Microsoft Office
types, but as recent news has shown, the lifespan In our talk, we will deep-dive into this class of
of even this technique is shortening. A vehicle for vulnerabilities, exploitation method and how it
payload delivery that has been greatly overlooked can be prevented. Finally, we will demonstrate
for initial access is ClickOnce. ClickOnce is a PoC of a full exploitation using RingHopper,
very versatile and has a lot of opportunities for hopping from user-space into SMM.
maintaining a level of evasion and obfuscation.
In this talk we’ll cover methods of bypassing
Windows controls such as SmartScreen, application THE JOURNEY FROM AN
whitelisting, and trusted code abuses with ClickOnce
applications. Additionally, we’ll discuss methods
ISOLATED CONTAINER TO
of turning regular signed or high reputation CLUSTER ADMIN IN SERVICE
.NET assemblies into weaponized ClickOnce
deployments. This will result in circumvention of FABRIC
common security controls and extend the value of Sunday at 13:00 in Track 4
ClickOnce in the offensive use case. Finally, we’ll 45 minutes | Demo, Exploit
discuss delivery mechanisms to increase the overall
legitimacy of ClickOnce application deployment in Aviv Sasson
phishing campaigns. This talk can bring to attention Principal security researcher, Palo Alto Networks
the power of ClickOnce applications and code
execution techniques that are not commonly used. Service Fabric is a scalable and reliable
container orchestrator developed by Microsoft.
It is widely used in Microsoft Azure as well as in
Microsoft’s internal production environments as
an infrastructure for containerized applications.
Developing a container orchestrator is not an easy
task as it involves harnessing many technologies
in a complicated and distributed environment.
This complexity can ultimately lead to security
issues. Such security issues can impose a critical
risk since compromising an infrastructure allows
attackers to escalate their privileges and take over
an entire environment quickly and effectively.

77
 PR3S3NTATI0NS
In this session, Aviv will share his research on history of eBPF in the Linux kernel, and the lack
Service Fabric and his journey of escalating from of previous public, low-level Solana research, we
an isolated container to cluster admin. He will go decided to dig deeper: We built Solana reverse-
through researching the code and finding a zero- engineering tooling and fuzzing harnesses as
day vulnerability, explaining his exploitation process we slowly dug our way into the JIT - eventually
in Azure Service Fabric offering while dealing with discovering multiple out-of-bounds vulnerabilities.
race conditions and other limitations, and explain
how it all allowed him to break out of his container
and HyperV virtual machine to later gain full CONTEST CLOSING
control over the underlying Service Fabric cluster.
In the end, he will share his thoughts on security in
CEREMONIES & AWARDS
the cloud and his concerns on cloud multitenancy. Sunday at 14:00 in Track 3
75 minutes
Grifter
SOLANA JIT: LESSONS FROM DEF CON, Contests & Events
FUZZING A SMART-CONTRACT DEF CON Contest & Events Awards,
COMPILER come find out who won what!!
Sunday at 14:00 in Track 4
45 minutes | Demo, Tool DEF CON CLOSING CEREMONIES
Thomas Roth & AWARDS
Solana is a blockchain with a $37 billion dollar Sunday at 15:30 in Tracks 1 & 2
market cap with the security of that chain relying Till it ends
on the security of the smart contracts on the chain
- and we found very little research on the actual The Dark Tangent
execution environment of those contracts. In contrast
to Ethereum, where contracts are mostly written
DEF CON
in Solidity and then compiled to the Ethereum DEF CON Closing Ceremonies & Awards,
Virtual Machine, Solana uses a different approach: the Uber Black badges are awarded to the
Solana contracts can be written in C, Rust, and winners of CTF and several other contests that
C++, and are compiled to eBPF. Underneath the earned a Black badge for DEF CON 30! We
hood, Solana uses rBPF: A Rust BPF implementation will wrap up the con, say thanks where it’s
with a just-in-time compiler. Given the security due, and acknowledge special moments.

78
79
 D3M0 LABS vulnerable applications such as DVWA and bWAPP
AADINTERNALS: THE ULTIMATE have helped the infosec community in understanding
AZURE AD HACKING TOOLKIT the popular web attack vectors. However, at this point
in time, we do not have a similar framework for the
Nestori Syynimaa cloud environment. In this talk, we will be introducing
Friday from 14:00 – 15:55 in Committee
AWSGoat, a vulnerable by design infrastructure on
AADInternals is an open-source hacking toolkit for AWS featuring the latest released OWASP Top 10
Azure AD and Microsoft 365, having over 14,000 web application security risks (2021) and other
downloads from the PowerShell gallery. It has over misconfiguration based on services such as IAM,
230 different functions in 15 categories for various S3, API Gateway, Lambda, EC2, and ECS. AWSGoat
purposes. The most famous ones are related to mimics real-world infrastructure but with added
Golden SAML attacks: you can export AD FS token vulnerabilities. The idea behind AWSGoat is to provide
signing certificates remotely, forge SAML tokens, security enthusiasts and pen-testers with an easy
and impersonate users w/ MFA bypass. These to deploy/destroy vulnerable infrastructure where
techniques have been used in multiple attacks during they can learn how to enumerate cloud applications,
the last two years, including Solorigate and other identify vulnerabilities, and chain various attacks to
NOBELIUM attacks. AADInternals also allows you compromise the AWS account. The deployment scripts
to harvest credentials, export Azure AD Connect will be open-source and made available after the talk.
passwords and modify numerous Azure AD / Office
Audience: Cloud, Ofference, Defense
365 settings not otherwise possible. The latest update
can extract certificates and impersonate Azure
AD joined devices allowing bypassing device based AZUREGOAT: DAMN
conditional access rules. https://o365blog.com/
aadinternals/ https://attack.mitre.org/software/S0677 VULNERABLE AZURE
Audience: Blue teamers, red teamers, administrators, wannabe-hackers, INFRASTRUCTURE
etc. Nishant Sharma, Rachna Umraniya
Friday from 12:00 – 13:55 in Committee
ACCESS UNDENIED ON AWS Microsoft Azure cloud has become the second-largest
vendor by market share in the cloud infrastructure
Noam Dahan providers (as per multiple reports), just behind
Friday from 10:00 – 11:55 in Caucus AWS. There are numerous tools and vulnerable
Access Undenied on AWS analyzes AWS applications available for AWS for the security
CloudTrail AccessDenied events – it scans the professional to perform attack/defense practices,
environment to identify and explain the reasons but it is not the case with Azure. There are far fewer
for which access was denied. When the reason options available to the community. AzureGoat
is an explicit deny statement, AccessUndenied is our attempt to shorten this gap by providing
identifies the exact statement. When the reason is a ready-to-deploy vulnerable setup (vulnerable
a missing allow statement, AccessUndenied offers application + misconfigured Azure components +
a least-privilege policy that facilitates access. multiple attack paths) that can be used to learn/
teach/practice Azure cloud environment pentesting.
Audience: Cloud Security, Defense.
Audience: Cloud, Offence, Defense

AWSGOAT : A DAMN
VULNERABLE AWS BADRATS: INITIAL ACCESS MADE
INFRASTRUCTURE EASY
Kevin Clark, Dominic “Cryillic” Cunningham
Jeswin Mathai, Sanjeev Mahunta
Friday from 14:00 – 15:55 in Society
Friday from 14:00 – 15:55 in Caucus
Remote Access Trojans (RATs) are one of the defining
Compromising an organization’s cloud infrastructure is
tradecraft for identifying an Advanced Persistent
like sitting on a gold mine for attackers. And sometimes,
Threat. The reason being is that APTs typically leverage
a simple misconfiguration or a vulnerability in web
custom toolkits for gaining initial access, so they
applications, is all an attacker needs to compromise
do not risk burning full-featured implants. Badrats
the entire infrastructure. Since cloud is relatively
takes characteristics from APT Tactics, Techniques,
new, many developers are not fully aware of the
and Procedures (TTPs) and implements them into
threatscape and they end up deploying a vulnerable
a custom Command and Control (C2) tool with a
cloud infrastructure. When it comes to web application
focus on initial access and implant flexibility. The key
pentesting on traditional infrastructure, deliberately
80
goal is to emulate that modern threat actors avoid
loading fully-featured implants unless required, instead
FISSURE: THE RF FRAMEWORK
opting to use a smaller staged implant. Badrats Christopher Poore
implants are written in various languages, each with Friday from 10:00 – 11:55 in Council
a similar yet limited feature set. The implants are
FISSURE is an open-source RF and reverse engineering
designed to be small for antivirus evasion and provides
framework designed for all skill levels with hooks for
multiple methods of loading additional tools, such
signal detection and classification, protocol discovery,
as shellcode, .NET assemblies, PowerShell, and shell
attack execution, IQ manipulation, vulnerability analysis,
commands on a compromised host. One of the most
automation, and AI/ML. The framework was built to
advanced TTPs that Badrats supports is peer-to-
promote the rapid integration of software modules,
peer communications over SMB to allow implants to
radios, protocols, signal data, scripts, flow graphs,
communicate through other compromised hosts.
reference material, and third-party tools. FISSURE is a
Audience: Offense workflow enabler that keeps software in one location
and allows teams to effortlessly get up to speed while
sharing the same proven baseline configuration for
CYBERPEACE BUILDERS specific Linux distributions. The framework and tools
Adrien Ogee included with FISSURE are designed to detect the
Friday from 14:00 – 15:55 in Accord presence of RF energy, understand the characteristics
of a signal, collect and analyze samples, develop
The CyberPeace Builders are pro hackers who transmit and/or injection techniques, and craft custom
volunteer to help NGOs improve their cybersecurity. payloads or messages. FISSURE contains a growing
Through a portal that I’ll demo, hackers can access library of protocol and signal information to assist
a variety of short engagements, from 1 to 4 hours, in identification, packet crafting, and fuzzing. Online
to provide targeted cybersecurity help to NGOs archive capabilities exist to download signal files and
on topics ranging from staff awareness to DMARC build playlists to simulate traffic and test systems.
implementation, password management and
authentication practices, breach notification, OSINT Audience: RF, Wireless, SDR, Offense, Defense
and dark web monitoring, all the way to designing
a cyber-related poster for the staff, reviewing their
privacy policy and cyber insurance papers. The
MERCURY
programme is the world’s first and only skills-based David McGrew, Brandon Enright
volunteering opportunity for professionals in the Friday from 12:00 – 13:55 in Society
cybersecurity industry; it has been prototyped over
Mercury is an open source package for network
2 years, was launched in July 2021 and is now being
metadata extraction and analysis. It reports session
used by over 60 NGOs worldwide, ultimately helping
metadata including fingerprint strings for TLS, QUIC,
to protect over 350 million vulnerable people and
HTTP, DNS, and many other protocols. Mercury
$500 million in funds. I’ll demo the platform, show the
can output JSON or PCAP. Designed for large
type of help NGOs need and explain how NGOs and
scale use, it can process packets in real time at
security professionals can leverage the programme.
40Gbps on server-class commodity hardware,
Audience: Security professionals, NGOs using Linux native zero-copy high performance
networking. The Mercury package includes tools
for analyzing PKIX/X.509 certificates and finding
EMBA - OPEN-SOURCE weak keys, and for analyzing fingerprints with
FIRMWARE SECURITY TESTING destination context using a naive Bayes classifier.

Michael Messner, Pascal Eckmann Audience: Network defense, incident response, forensics, security and
Friday from 12:00 – 13:55 in Council privacy research

Penetration testing of current embedded devices

is quite complex as we have to deal with different PACKET SENDER
architectures, optimized operating systems and special
protocols. EMBA is an open-source firmware analyzer Dan Nagle
with the goal to simplify, optimize and automate Friday from 12:00 – 13:55 in Accord
the complex task of firmware security analysis. Packet Sender is a free open-source (GPLv2) cross-
Audience: Offense (penetration testers) and defense (security team and platform (Windows, Mac, Linux) tool used daily by
security researchers, college students, and professional
developers).
developers to troubleshoot and reverse engineer
network-based devices. Its core features are crafting
and listening for UDP, TCP, and SSL/TLS packets via IPv4

81
 D3M0 LABS
or IPv6. It can listen simultaneously on any number of out-of-the-box modeling, including emulated
ports while sending to any UDP, TCP, SSL/TLS packet client browser HTTPS traffic, DNS queries, and
server. It is available for direct download or through email traffic. The tool chain includes support for
the Winget, Homebrew, Debian, or Snap repos. several common Red Team tactics, such as Remote
Desktop tunneling and FODHelper UAC bypass.
Audience: Offensive, Defensive, Developers, Testers
This implementation effectively generates both client
side and network traffic indicators of compromise.
PCILEECH AND MEMPROCFS Audience: Offense, Defense
Ulf Frisk, Ian Vitek
Friday from 14:00 – 15:55 in Council
VAJRA - YOUR WEAPON TO
The PCILeech direct memory access attack toolkit was
presented at DEF CON 24 and quickly became popular
CLOUD
amongst red teamers and game hackers alike. We will Raunak Parmar
demonstrate how to take control of still vulnerable Friday from 10:00 – 11:55 in Committee
systems with PCIe DMA code injection using affordable
Vajra (Your Weapon to Cloud) is a framework
FPGA hardware and the open source PCILeech
capable of validating the cloud security posture of the
toolkit. MemProcFS is memory forensics and analysis
target environment. In Indian mythology, the word
made super easy! Analyze memory by clicking on files
Vajra refers to the Weapon of God Indra (God of
in a virtual file system or by using the API. Analyze
Thunder and Storms). Because it is cloud-connected,
memory dump files or live memory acquired using
it is an ideal name for the tool.Vajra supports multi-
drivers or PCILeech PCIe FPGA hardware devices.
cloud environments and a variety of attack and
Audience: Offense, Defense, Forensics, Hardware enumeration strategies for both AWS and Azure. It
features an intuitive web-based user interface built
with the Python Flask module for a better user
THEALLCOMMANDER experience. The primary focus of this tool is to have
Matthew Handy different attacking and enumerating techniques all in
Friday from 10:00 – 11:55 in Accord one place with web UI interfaces so that it can be
accessed anywhere by just hosting it on your server.
TheAllCommander is an open-source tool which offers The following modules are currently available:
red teams and blue teams a framework to rapidly
prototype and model malware communications, as well • Azure
as associated client-side indicators of compromise. - Attacking
The framework provides a structured, documented,
and object-oriented API for both the client and 1. OAuth Based Phishing (Illicit Consent
server, allowing anyone to quickly implement a novel Grant Attack)
communications protocol between a simulated malware - Exfiltrate Data
daemon and its command and control server. For - Enumerate Environment
Blue Teamers, this allows rapid modeling of emerging
threats and comprehensive testing in a controlled - Deploy Backdoors
manner to develop reliable detection models. For Red - Send mails/Create Rules
Teamers, this framework allows rapid iteration and 2. Password Spray
development of new protocols and communications
schemes with an easy to use Python interface. The 3. Password Brute Force W
framework has many tools or techniques used by red - Enumeration
teams built in, such as a SOCKS5 proxy, which then 1. Users
use the implemented communication scheme. This
allows comprehensive testing of the detection and 2. Subdomain
functional capability of the communication scheme, 3. Azure Ad
allowing for efficient design and development choices
4. Azure Services
to be made before committing to production tool
development. To facilitate this goal, TheAllCommander - Specific Service
includes a Java based command and control server 1. Storage Accounts
with a simple API to allow new plug-ins for server-
• AWS
side control. There is a python-based emulation
client, which can be easily extended using the API - Enumeration
to allow new client side communications code. 1. IAM Enumeration
Several reference implementations for covert
2. S3 Scanner
malware communication are provided to allow
82
 - Misconfiguration in their infrastructure. Zuthaka presents a simplified
API for fast and clear integration of C2s and provides
Audience: Security Professional Cloud Engineer a centralized management for multiple C2 instances
through a unified interface for Red Team operations. A
collaborative free open-source Command & Control
WAKANDA LAND development framework that allows developers to
concentrate on the core function and goal of their C2.
Stephen Kofi Asamoah
Zuthaka is more than just a collection of C2s, it is also
Friday from 12:00 – 13:55 in Caucus
a solid foundation that can be built upon and easily
Wakanda Land is a Cyber Range deployment tool customized to meet the needs of the exercise that
that uses terraform for automating the process of needs to be accomplished. This integration framework
deploying an Adversarial Simulation lab infrastructure for C2 allows developers to concentrate on a unique
for practicing various offensive attacks. This project target environment and not have to reinvent the
inherits from other people’s work in the Cybersecurity wheel. After we first presented Zuthakas’ MVP at
Community, to which I have added some additional Black hat USA 2021 and DEFCON demo labs, we are
sprinkles to their work from my other research. The now presenting the first release with updated post-
tool deploys the following for the lab infrastructure exploitation modules to support text based modules,
(of course, more assets can be added): -Two Subnets as well as file based ones. With a lab populated of
-Guacamole Server --This provides dashboard access to commonly used C2s and its out-of-the-box integrations.
--Kali GUI and Windows RDP instances The Kali GUI,
Audience: Red team operators, wishing a centralized place to handle all
Windows RDP and the user accounts used to log into
C2s instances. C2 developers, wishing to save the effort of writing the
these instances are already backed into the deployment
Frontend. Hackers, wishing a strong infrastructure to run C2s.
process --To log into the Guacamole dashboard with
the guacadmin account, you need to SSH into the
Guacamole server using the public IP address (which is
displayed after the deployment is complete) and then
ALSANNA
change into the guacamole directory and then type Jason Johnson
cat .env for the password (the guacadmin password Saturday from 12:00 – 13:55 in Accord
is randomly generated and saved as an environment alsanna is a command-line based intercepting proxy
variable) -Windows Domain Controller for the Child for arbitrary TCP traffic. It includes built-in support
Domain (first.local) -Windows Domain Controller for for decrypting TLS streams, and allows editing the
the Parent Domain (second.local) -Windows Server stream as it passes over the network. It is deliberately
in the Child Domain -Windows 10 workstation in lightweight and documented to help hackers who
the Child Domain -Kali Machine - a directory called need to modify its behavior. This demo will
toolz is created on this box and Covenant C2 is include live instances of the tool which can be
downloaded into that folder, so its just a matter of used by visitors, live support for anyone looking to
running Covenant once you are authenticated into Kali learn how to use alsanna, and a short on-demand
-Debian Server serving as Web Server 1 - OWASP’s walkthrough for visitors, covering how the tool
Juice Shop deployed via Docker -Debian Server works and what you need to know to modify it.
serving as Web Server 2 - Vulnerable web apps
Audience: Researchers, reverse engineers, pentesters, bug bounty hunters
Audience: Offensive - Defensive - Any Cybersecurity enthusiasts

ZUTHAKA: A COMMAND & CONTROL VALIDATION

CONTROLS (C2S) INTEGRATION COMPASS – THREAT MODELING
FRAMEWORK AIDE & PURPLE TEAM CONTENT
REPO
Lucas Bonastre, Alberto Herrera
Friday from 10:00 – 11:55 in Society Scott Small
Saturday from 14:00 – 15:55 in Caucus
The current C2s ecosystem has rapidly grown in
order to adapt to modern red team operations Control Validation Compass (“Control Compass”)
and diverse needs (further information on C2 provides a needed public resource that enables
selection can be found here). This comes with a lot of cyber security teams to actually operationalize
overhead work for Offensive Security professionals MITRE ATT&CK for its best purpose: prioritized
everywhere. Creating a C2 is already a demanding control validation. Control Compass unites tens
task, and most C2s available lack an intuitive and of thousands of detection rules, offensive security
easy to use web interface. Most Red Teams must scripts, and policy recommendations from 60+ open
independently administer and understand each C2 sources – all aligned with MITRE ATT&CK – into the

83
 D3M0 LABS
largest single, continuously updated reference library EDR detection capabilities can be bypassed, using
for such content, wrapped in an easily searchable multiple unhooking techniques and a vulnerable signed
interface. This saves defenders, red teamers, and driver to unregister kernel callbacks and disable the
intel & GRC analysts serious time & effort when ETW Threat Intelligence provider. Since the initial
researching content for purple teaming efforts (aka release, multiple improvements have been implemented
control validation). Like its input components and in EDRSandBlast: it is now possible to use this toolbox
sources, Control Compass resource sets are openly as a library from another attacking tool, new bypasses
available to all, no strings attached. Control Compass have been implemented, the embedded vulnerable
supports a powerful second use case informed by its driver is now interchangeable to increase stealthiness
author’s experience advising security & intelligence and the use of a pre-built offsets database is no more
teams across maturity levels: the tool also provides required! Come discover our tool and its new features,
a library of unique, openly available threat landscape learn (or teach us!) something about EDRs and discuss
summaries organized by key adversary categories, about the potential improvements to this project.
including motivation, location, and victim industry.
Audience: Offense, Defense, Windows, EDR
By enabling easy identification of relevant threat
intelligence – and a simple UI-based workflow to
instantly surface corresponding security controls – EMPIRE 4.0 AND BEYOND
Control Compass greatly lowers the barrier to building
accurate, intelligence-driven threat models and helps Vincent “Vinnybod” Rose, Anthony
drive tighter control validation feedback loops around W“Cx01N” Rose
the threats that matter most to a given organization. Saturday from 10:00 – 11:55 in Accord
Audience: Intelligence analysts, SOC/blue team/defenders, red team/ Empire is a Command and Control (C2) framework
adversary emulation, GRC analysts powered by Python 3 that supports Windows, Linux,
and macOS exploitation. It has evolved significantly
since its introduction in 2015 and has become one
DEFENSIVE 5G of the most widely used open-source C2 platforms.
Starting life as PowerShell Empire and later merging
Eric Mair, Ryan Ashley
in Empyre, Empire is now a full-fledged .NET C2
Saturday from 12:00 – 13:55 in Council
leveraging PowerShell, Python, C#, and Dynamic
In this work we developed a 4.5G/5G network using Language Runtime (DLR) agents. It offers a flexible
only commercial off the shelf (COTS) hardware and modular architecture that links Advanced Persistent
open-source software to serve as test-infrastructure Threats (APTs) Tactics, Techniques, and Procedures
for studying vulnerabilities in 5G networks. We are (TTPs) through the MITRE ATT&CK database. The
using software defined networking (SDN) tools such as framework aims to provide a flexible and easy-to-
Faucet and Dovesnap and software defined radio(SDR) use interface to easily incorporate a wide array of
capabilities such as Open5gs and srsRAN along with tools into a single platform for red team operations
Docker Containers to facilitate the rapid and reliable to emulate APTs. This presentation will explore
setup and configuration of network topologies that our most recent upgrades in Empire 4.0, including
can be used to represent the 5G networks that we C# and IronPython agents, Customizable Bypasses,
intend to test. By having a configurable and repeatable Malleable HTTP C2, Donut Integration, Beacon
mechanism that could be shared among multiple users Object File (BoF), and much more. In addition,
with differing hardware setups we were able to test our team will be giving a preview of Empire 5.0
5G network configurations in a variety of ways and and its features. The most exciting of these being
have those results validated by other team members. the brand-new web client (Starkiller 2.0) and v2
Audience: Network Defense and Attack, 5G, Software Defined Radio and API, which will be released later this year.
Infrastructure-as-Code. Audience: Offense

EDR DETECTION MECHANISMS HLS4ML - OPEN SOURCE

AND BYPASS TECHNIQUES WITH MACHINE LEARNING
EDRSANDBLAST ACCELERATORS ON FPGAS
Thomas Diot, Maxime Meignan Ben Hawks, Andres Meza
Saturday from 10:00 – 11:55 in Society Saturday from 14:00 – 15:55 in Council
EDRSandBlast is a tool written in C that implements Born from the high energy physics community at the
and industrializes known as well as original bypass Large Hadron Collider, hls4ml is an open-source Python
techniques to make EDR evasion easier during package for machine learning inference in FPGAs
adversary simulations. Both user-land and kernel-land (Field Programmable Gate Arrays). It creates firmware
84
implementations of machine learning algorithms by
translating traditional, open-source machine learning
MEMFINI - A SYSTEMWIDE
package models into optimized high level synthesis MEMORY MONITOR INTERFACE
C++ that can then be customized for your use case
and implemented on devices such as FPGAs and
FOR LINUX
Application Specific Integrated Circuits (ASICs). Hls4ml Shubham Dubey, Rishal Dwivedi
can easily scale the implementation of a model to take Saturday from 10:00 – 11:55 in Caucus
advantage of the parallel processing capabilities that
Surprisingly, memory related events logging has been
FPGAs offer, not only allowing for low latency, high
ignored by monitoring tool’s authors since a long
throughput designs, but also designs sized to fit on
time. There are multiple event loggers present for
lower cost, resource constrained hardware. Hls4ml also
Linux that are capable of monitoring processes, i/o
supports generating accelerators with different drivers
operations, function calls or whole systemwide events.
that build minimal, self-contained implementations
But something which lacks in most is global monitoring
which enable control via Python or C/C++ with
of memory related events like allocation, attachment
little extra development or hardware expertise.
to a shared memory, memory allocation in foreign
Audience: Hardware, AI, IoT, FPGA process etc. This has many applications in security
domain or even software engineering in general. The
main area of focus or use case for Memfini is to assist
INJECTYLL-HIDE: PUSHING Security professionals for carrying out memory specific
THE FUTURE OF HARDWARE Dynamic Malware Analysis, in order to help them
in finding indicators for malicious activities without
IMPLANTS TO THE NEXT LEVEL reversing the behavior. Below listed are few of the use
Jonathan Fischer, Jeremy Miller cases (which we will also be demonstrating in the talk).
Saturday from 10:00 – 11:55 in Council
• Process Injection
Enterprises today are shifting away from dedicated • Fileless malware execution
workstations, and moving to flexible workspaces
with shared hardware peripherals. This creates • Shellcode Execution
the ideal landscape for hardware implant attacks; • Malicious shared memory usage
however, implants have not kept up with this shift.
On the other hand, it can also be helpful for
While closed source, for-profit solutions exist and
Software developers, who wish to have an
have seen some recent advances in innovation, they
eagle eye on the memory allocations
lack the customization to adapt to large targeted
deployments. Open-source projects exist but focus • Finding Memory Leaks
more on individual workstations (dumb keyboards/
terminals) relying on corporate networks for remote • Error detection for debugging purposes.
control. Our solution is an open source, hardware This is possible as Memfini is capable of monitoring
implant which adopts IoT technologies, using non- memory allocations on User space, Kernel space
standard channels to create a remotely managed as well as some under looked allocations like PCI
mesh network of hardware implants. Attendees will device mapping, DMA allocations etc. It provides a
learn how to create a new breed of open-source command line interface with multiple filters, allowing
hardware implants. Topics covered in this talk include a user to interact with the logs generated & get the
the scaling of implants for enterprise takeover, creating required data. Currently, the user will be able to filter
and utilizing a custom C2 server, a reverse shell that the events by individual process, type of access etc.
survives screen lock, and more. They will also leave
Audience: Defensive security(Malware researcher, IR/Forensics) and
with a new platform from which to innovate custom
Offensive security(memory based vulnerability discovery)
implants. Live demos will be used to show these new
tactics against real world infrastructure. This talk builds
off of previous implant talks but will show how to OPENTDF
leverage new techniques and technologies to push the
innovation of hardware implants forward evolutionarily. Paul Flynn, Cassandra Bailey
Saturday from 14:00 – 15:55 in Accord
Audience: Offense and Red Teams with a focus on a hardware approach
OpenTDF is an open source project that
provides developers with the tools to build data
protections natively within their applications
using the Trusted Data Format (TDF).
Audience: AppSec, Defense, Mobile, IoT

85
 D3M0 LABS addition, ResidueFree can help forensic analysts
PMR - PT & VA MANAGEMENT & and application security engineers isolate filesystem
REPORTING changes made by a specific application. The same
implementation ResidueFree uses to ensure that any
Abdul Alanazi, Musaed Bin Muatred file changes an application makes are not stored to
Saturday from 12:00 – 13:55 in Committee
disk can also be used to isolate those changes to a
PMR (PTVA Management & Reporting) is an open- separate folder without impacting the original files.
source collaboration platform that closes the gap
Audience: ResidueFree was primarily developed for individuals facing
between InfoSec Technical teams and Management in all
privacy threats that can access the information stored on the individualsʼ
assessment phases, from planning to reporting. Technical
device. However, this presentation is also designed for security trainers
folks can focus on assessment methodology planning,
that want to expand the tools they can suggest as well as for privacy
test execution ,and engagement collaboration. Whereas
engineers interested in contributing to ResidueFree or expanding it to more
management can plan engagements, track progress,
commonly used operating systems. ResidueFree also has features built for
assign testers, monitor remediation status, and escalate
malware or forensic analysts, application security engineers, or others who
SLA breaches, this is an All-in-One fancy dashboard.
The main features are: A) *Asset Management* wish to easily isolate an applicationʼs changes to a deviceʼs filesystem with
which allows IT asset inventory tracking with system a simple tool.
owner contacts. B) *Engagements Management &
Planning* that enable security testers to follow a
test execution roadmap by creating a new testing
SHARPSCCM
methodology or follow execution standards such as Chris Thompson, Duane Michael
NIST, PTES or OWASP. It definitely will keep pentesting Saturday from 12:00 – 13:55 in Society
engagements and projects more professional. Also, it SharpSCCM is a post-exploitation tool designed to
enables collaborative testing, gathering information leverage Microsoft Endpoint Configuration Manager
and evidence uploading. C) *Report Automation* (a.k.a. ConfigMgr, formerly SCCM) for lateral
that automates boring tasks such as writing technical movement from a C2 agent without requiring access
reports and validation reports. Generating a PDF to the SCCM administration console. SharpSCCM
report that is ready to share with clients and supports lateral movement functions ported from
management can be accomplished with one-click. D) PowerSCCM and contains additional functionality to
*All-in-One Dashboard* that will keep executives abuse newly discovered attack primitives for coercing
and management up-to-date with the organization’s NTLM authentication from local administrator and
security posture. The dashboard components are: SCCM site server machine accounts in environments
- High level of current vulnerabilities. where automatic client push installation is enabled.
SharpSCCM can also dump information about the
- Engagement progress. SCCM environment from a client, including domain
- Remediation Status. credentials for Network Access Accounts. Further, with
access to an SCCM administrator account, operators
- Track SLA breaches.
of SharpSCCM can execute code as SYSTEM or coerce
- Monitoring risk exceptions. NTLM authentication from the currently logged-in
Audience: Security professionals, Vulnerability Analysts , AppSec, Offense, user or the machine account on any SCCM client.
Risk Management Audience: Offense, Defense, System Administrators

RESIDUEFREE SVACHAL + MACHINESCLI

Logan Arkema Ankur Tyagi
Saturday from 14:00 – 15:55 in Committee Saturday from 10:00 – 11:55 in Committee
ResidueFree is a privacy-enhancing tool that allows Writeups for CTF challenges and machines are a
individuals to keep sensitive information off their critical learning resource for our community. For the
device’s filesystem. It takes on-device privacy author, it presents an opportunity to document their
protections from TAILS and “incognito” web browser methodology, tips/tricks and progress. For the audience,
modes and applies them to any app running on a it serves as reference material. Oftentimes, authors
user’s regular operating system, effectively making switch roles and become the audience to learn from
the privacy protections offered by TAILS more usable their own work. This demo aims to showcase tools,
and accessible while improving the on-device privacy svachal and machinescli, developed with these insights.
guarantees made by web browsers and extending
them to any application. While ResidueFree currently
runs on Linux, its maintainers are hoping to port it
to other operating systems in the near future. In
86
These work in conjunction to help users curate their
learning in .yml structured files, find insights and
XAVIER MEMORY ANALYSIS
query this knowledge base as and when needed. FRAMEWORK
Audience: Offense/Defense Solomon Sonya
Saturday from 14:00 – 15:55 in Society
UNBLOB - TOWARDS EFFICIENT Malware continues to advance in sophistication. Well-
engineered malware can obfuscate itself from the user
FIRMWARE EXTRACTION and the OS. Volatile memory is the unique structure
Quentin Kaiser, Florian Lukavsky malware cannot evade. I have engineered a new
Saturday from 12:00 – 13:55 in Caucus construct for memory analysis and a new open-source
tool that automates memory analysis, correlation, and
Unblob is a command line extraction tool to user-interaction to increase investigation accuracy,
obtain content from any kind of binary blob. It has reduce analysis time and workload, and better detect
been initially developed for the sound and safe malware presence from memory. This talk demos a
extraction of arbitrary firmware images. It has new visualization construct that creates the ability to
been built as a modular framework where anyone interact with memory analysis artifacts. Additionally,
can develop and submit new format handlers and this talk demos new, very impactful data XREF and
extractors. Its public version already supports a large a system manifest analysis features. Data XREF
number of filesystems, archive, and compression provides an index and memory context detailing
formats: https://github.com/onekey-sec/unblob how your search data is coupled with processes,
Audience: Reverse Engineers, Embedded Security modules, and events captured in memory. The System
Manifest distills the analysis data to create a new
memory analysis snapshot and precise identification of
malicious artifacts detectable from malware execution
especially useful for exploit dev and malware analysis!
Audience: Malware Analysts/Software Reverse Engineers Exploit
Developers CTF Subject Matter Experts Incident Responders Digital
Forensics Examiners Offense & Defense

CONNECT
Official Sites U.S. Social Media
Website: https://defcon.org Twitter: https://twitter.com/defcon

DEF CON Media: https://media.defcon.org Facebook: https://facebook.com/defcon/

DEF CON Groups: https:/defcongroups.org Instagram: https://www.instagram.com/

wearedefcon/
DEF CON Forums: https:/forum.defcon.org
Reddit:http://www.reddit.com/r/defcon

Download the presentation materials

and more from the DEF CON media server
at:
https://media.defcon.org/DEF CON 30/

87
 V3ND0RS
BOARD SOURCE
Boardsource sells custom keyboard kits designed for
programmers, geeks, hackers, or anyone who spends a
lot of time in a text editor. Products range from entry-level
solderable kits and electrical components to products that
are ready to use out of the box. Come by the booth to
test out some keyboards and see what we have to offer!

CAPITOL TECHNOLOGY
UNIVERSITY
Capitol Technology University, an independent, non-
profit university in Maryland, is laser-focused on STEM
careers and gives students the hands-on, real-world
experience they need to enter today’s tech job market.
With one of the best cybersecurity programs in the
nation, Capitol is a CAE institution. Most recently,
Capitol was awarded a two-year grant from the NSA to
lead the CAE Northeast Regional Hub, which includes
14 states, the District of Columbia, and hundreds
of institutions offering cybersecurity programs.

CARNEGIE MELLON
UNIVERSITY
Deepen your technical knowledge and secure competitive
salaries at the Information Networking Institute (INI),
a department within the highly ranked College of
Engineering at Carnegie Mellon University (CMU).
We offer master’s degrees in information networking,
security and mobile and IoT engineering, with a variety
of study options so you can customize your program.

CRYPTOCURRENCY HACKERS
Experience modern finance technology first hand by
visiting the Cryptocurrency Hackers stand at the Defcon
vendor area. We distribute items relating to a number
of projects including Monero, Bitcoin, Ethereum, and
others. Show your cryptohacker colours with high
quality wearables and custom badges. Try new devices
and electronics, with access to the designers on site.
Inform yourself of cryptocurrency science by exploring
our infocard display rack. Our stand is your one stop
shop for cryptocurrency hacker items and information.

88
 EFF
EFF is the leading defender of online civil liberties.
We promote innovator rights, defend free speech,
fight illegal surveillance, and protect rights and
freedoms as our use of technology grows.

GIRLS HACK VILLAGE

Girls Hack Village is designed to highlight the
contributions and experiences of girls in cybersecurity.
Women are underrepresented in cybersecurity and
our goal is to highlight the female experience in the
industry. Women are traditionally underrepresented at
many cybersecurity conferences and Girls Hack Village
will give attendees the opportunity to learn about
cybersecurity and hacking in a gender-friendly place.

HACKER WAREHOUSE
HACKER WAREHOUSE is your one stop shop for hacking
equipment. We understand the importance of tools and
gear which is why we carry only the highest quality gear
from the best brands in the industry. From RF Hacking to
Hardware Hacking to Lock Picks, we carry equipment that
all hackers need. Check us out at HackerWarehouse.com.

HACKERBOXES
HackerBoxes is the monthly subscription box for hardware
hacking, DIY electronics, cybersecurity, and hacker
culture. Each monthly HackerBox includes a carefully
curated collection of projects, components, modules,
tools, supplies, and exclusive items. HackerBox hackers
connect online as a community of experience, support,
and ideas. Your HackerBox subscription is like having
a tiny hacker convention in your mailbox every month.

HACKERS FOR CHARITY

Hackers for Charity’s mission is to provide technical
cyber support to other non-profits and charities. Our
efforts focus on those organizations without internal
help desks or other technical support. As a technical
enabler, HFC empowers those non-profits and charities
to succeed at their mission. HFC provides the breadth
of cyber services and disaster relief, from basic help
desk to threat hunting to incident remediation.

89
 V3ND0RS
HAK5
Discover the devices that have found their way into
the hearts and tool-kits of the modern hacker. Notable
for ease of use. Celebrated by geek culture. From
comprehensive WiFi audits to covert network implants and
physical access mayhem - Hak5 Gear gets the job done.

HOTWAN
HotWAN is selling the “Pen Test Assistant” and the
“Boot Monkey”. The Assistant is Pen Test attack box
used in Red Teaming, Penetration Testing and Hardware
Hacking. It can be used as a drop box, pivot box
or C2. The “Boot Monkey” provides remote access
to the local laptop power button. This addresses
laptop freezes. Physical touch for Power on, power
off. Hard resets for laptops. It can also be used as a
laptop jiggler to prevent screensavers occuring.

KEYPORT
Keyport® combines keys, pocket tools, & smart
tech into one secure everyday multi-tool. We will
be selling our latest modular product line (co-
branded DEFCON 30 Editions) including the
Keyport Pivot, Modules, Inserts, and accessories.

MISCREANTS
Miscreants is a creative agency working with cybersecurity
clients. Besides our design work, we’re creating clothing
heavily influenced by streetwear and security culture,
looking to document the past, present, and future of
cybersecurity history. As a brand, we strive to deliver
original pieces that belong in your closet for decades.

NO STARCH PRESS
No Starch Press has been publishing the finest in
Geek Entertainment since 1994 and we’re glad to
be back! We have so many new books to show you
and even a new death metal t-shirt. Everything is
discounted. Come by and meet some of our editors
and our founder, Bill Pollock, before he loses his
voice. We look forward to seeing all of you again!

90
 OWASP
As the world’s largest non-profit organization
concerned with software security, OWASP:

- Supports the building of impactful projects;

- Develops & nurtures communities through events

and chapter meetings worldwide; and

- Provides educational publications & resources

In order to enable developers to write better

software, and security professionals to make
the world’s software more secure.

PHYS SEC VILLAGE STORE

The Physical Security Village (formerly Lock Bypass
Village) will be present in the vendor area too this
year, loaded with physical hacking gear! We will have
bypass tools, common keyed-alike keys, handcuffs,
village swag, and more. We’ll have hands-on exhibits
in the Village area where you can go and try out
your new toys right away, without ever leaving DEF
CON! Whether you’re new to hacking the physical
world, or a seasoned pro, we’re sure we’ll have
something for your needs (or at least… something you
really want but totally don’t need). All proceeds go
towards the cost of putting on the village each year.

SCAM STUFF
Scam Stuff is gear for the Modern Rogue:
magic tricks, lock picking, puzzle boxes, spy
gear, novelty items, and more! If it’s designed
to get you ahead in life, you’ll find it here.

SHADOWVEX
Purveyors of limited edition clothing, music, art and
hacker culture. From stickers to unique NFT Art and
0-day limited edition swag just for DEF CON 30. Follow
the music in the vending area to find our booth!

91
 V3ND0RS
THE CALYX INSTITUTE
The Calyx Institute is a member-supported non-profit
privacy research organization. We host Tor exit nodes,
operate a free VPN service and are developing a
privacy and security focused Mobile phone operating
system, CalyxOS. Become a member and you could
get great free membership premiums such as a 5G
or 4G mobile hotspot with unlimited un-throttled
& un-capped mobile data for a year, or a Google
Pixel phone with CalyxOS pre-installed on it.

THE TOR PROJECT

The Tor Project is a nonprofit developing free and
open source software to protect people from tracking,
censorship, and surveillance online. Tor’s mission is to
advance human rights and freedoms by creating and
deploying free and open source anonymity and privacy
technologies, supporting their unrestricted availability
and use, and furthering their scientific and popular
understanding. Stop by our table to learn more, pick
up some gear, and find out how you can get involved.

TOOOL
The Open Organisation Of Lockpickers is back as
always, offering a wide selection of tasty lock goodies
for both the novice and master lockpicker! A variety
of commercial picks, handmade picks, custom designs,
practice locks, handcuffs, cutaways, and other neat
tools will be available for your perusing and enjoyment!
Stop by our table for interactive demos of this fine
lockpicking gear or just to pick up a T-shirt and show
your support for locksport. All sales exclusively benefit
Toool, a 501(c)3 non-profit organization. You can
purchase picks from many fine vendors, but ours is
the only table where you know that 100% of your
money goes directly back to the hacker community.

XCAPE, INC.
Looking for reliable drop boxes, do you need 2.4
& 5 GHz wireless auditing? Looking for a reliable
and secure bastion host? Check out the Xcape
Booth for the gear we use, make, and sell.

92
 ZERO TIER
ZeroTier (https://www.zerotier.com) enables users
to deploy and maintain secure peer-to-peer overlay
networks. Already supporting millions of devices globally,
and with a proud open-source heritage, ZeroTier provides
unrivaled ease of connectivity and management for
modern networking use cases. ZeroTier is trusted by
professionals worldwide in industries including Infosec,
IT, Cloud, Telecommunications, IoT, Manufacturing,
Media, Automotive, Aerospace, and Defense.

BOOK SIGNINGS
FRIDAY SATURDAY
11am - Craig Smith, The Car Hacker’s NOON - Corey Ball, Hacking APIs
Handbook
1pm - Joe Gray, Practical Social Engineering
NOON - Jasper van Woudenberg,
Hardware Hacking Handbook 2pm - Jon DiMaggio, The Art of Cyberwarfare

1pm - Fotios Chantzis, Paulino Calderon,

& Beau Woods, Practical IoT Hacking

2pm -Travis Goodspeed, PoC or GTFO

Volume 3

93
 MAPS

LINQ Third Floor

SKYTALKS
Up 2nd Escalators in the BLOQ (5th Floor)
ROGUES
VILLAGE
Connection A Connection B Evolution
INFO BOOTH
Social Square

RECON
Social VILLAGE CHILLOUT
SOCIAL ENGINEERING
A B C
COMMUNITY
Showroom

94
 FLAMINGO EXECUTIVE CONFERENCE CENTER

LOWER LEVEL

BRYCE ZION
VALLEYDATA
OF LAKE HARDWARE
FIRE II MEAD II RED ROCK
HACKING
DUPE Escalator/
Stairs
VI
VII
VIII
VILLAGE
VALLEYVILLAGE
OF LAKE
FIRE I MEAD I

CRYPTO & SOLDERING

PRIVACY Vista INFO BOOTH SKILLS
I II III VILLAGE
IV
VILLAGE RED ROCK

ADVERSARY VILLAGE
SUNSET BALLROOM
Scenic
CLOUD VILLAGE Banquet
Kitchen
APPSEC VILLAGE
Twilight
BIC VILLAGE
Elevators

RegistrationDesk
INFO BOOTH

I
CHILL
RENO
II
CORPORATE CONVENTION CENTER
I

LAUGHLIN
BIOII Third floor

HACKING
VILLAGE
III
ROOFTOP
INFO BOOTH
CHILLOUT
Garden View
Elevators HAM alators
l t
Escalators
GIRLS

VILLAGE
HACK

MEMORIAL

IIIIII
VIRGINIA CITY RED TEAM Savoy
CHILLOUT

Eldorado CARSON CITY MESQUITE

Foyer
VILLAGE Foyer
ROOM

I II

Elevators
RADIO FREQUENCY
ELDORADO BALLROOM Banquet BLUE TEAM
VILLAGE Kitchen VILLAGESAVOY

95
 THANK Y0U!
The Dark Tangent would like to thank everyone who supports to the Dark Tangent, Janet, Darrington, and Will...and of
DEF CON and the hacking community. DEF CON is possible course a massive thanks to Nikita, our light in the storm,
because of all the hard work from the people who make up without whom we would truly be lost.
the following departments: CFP Review, Contests and Events,
DCTV, Defacement, DEF CON Groups, Demo Labs, Discord DESIGN AND DEFACEMENT:
DevOps, Dispatch, Entertainment, Forums, Hackers With
Neil would like to give a big shout out to the Defacement
Disabilities, Infobooth, Inhuman Registration, Infrastructure,
Team: Medic, S4mG0ld, BigSam, xaphan and p0sterboy
Parties, Photo Corps, Press, Production, Policy@DEFCON,
for their hard work keeping you on track and aware of your
QM Stores, Registration, the SOC, Speaker Ops, DEF CON
surroundings. Huge thanks to Sleestak and Nikita for support
Store, Vendor, Villages, and Workshops.
on the printed program, and CotMan for getting all the
Over 1,100 Goons, Creators, and speakers came together to details online. Finally, to all the department leads who got
organize and made DEF CON 30 happen! me everything I needed on time to make this book, it was
tight, I know, but thank you.
Thank you to the HQ staff for adapting as plans kept shifting:
Bill, Cayce, Cot, Darington, Janet, Jeff, Neil, Nikita, and
Will. Everyone had to deal with last minute changes and DEVOPS:
remain flexible in a year where decisions are being made Riverside and Fox would like to thank all of the DevOps
last minute. goons:
Thank you to the badge designers, MK Factor, for a fantastic Ari, BSE, cstone, Lightning, mauvehed, mcmayhem, mubix,
second year designing the badge and keeping it fresh with a Nebberz, NightWolf, respondo, TCMBC, thephreak,
human to human connection. Thank you to Zebbler Studios VoltageSpike.
for designing the great badge stations and head to head
music competitions. A shout out to the Packet Hacking Village team for being the
bot beta testers year round.
A special Thanks to Coastwide Promotions, The Source of
Knowledge, Black Hat, and Caesars Entertainment - You DCTV:
have all been fantastic to work with and have gone above
and beyond this past year. Thanks to all the members of our team. Alex, GhostPepper,
Hanna, Sandwich, Tuna, skw33k, and Videoman.
Thank you everyone! The 30th year milestone is amazing
and you made it happen! DEF CON GROUPS:
-The Dark Tangent DEF CON Groups (April, Casey, Jayson, Sleestak, 800xl,
and Brent) offer our sincerest gratitude to DT, Nikita, and
Will for their continued support and amazingness throughout
ARTS & ENTERTAINMENT: the year! Massive thanks to our amazing AltspaceVR event
volunteers: Giglio, Xray, Charmander, AldeBaran, TX, Drip,
ChrisAM would like to thank everyone responsible for this and Scribbles, who created and manage a truly incredible
year’s entertainment & decor: Krisz Klink, Great Scott, Zziks, virtual DC experience. We would also like to give thanks
dead, CTRL, stitch, davesbase, ch0wn35, Trotfox5, C0njur3r, and recognition to all of our global DCGs for their awesome
HiveQueen, sven, Zebbler Studios, SomaFM, Mobius, work being local ʻhacker ambassadors’; Every DCG is
Imagine Stage Lighting, and all the DJs and artists who an example of the great things we can do when we come
donated their time and talent to this event. together with endless curiosity and the willingness to share
our knowledge for the benefit of all. Each and every global
CONTENT: DCG makes the world better through bits, bytes, wires,
Nikita would like to thank The Dark Tangent, Alex and solder, and a lot of heart. Find your local community on
the DC30 Content Reviewers for Talks and Workshops: defcongroups.org! *HUGS* to you all! <3
AlxRogan, Anullvalue, Ash, Beaker, carnal0wnage, Suggy,
Claviger, CyberSulu, DaKahuna, Dead Addict, Deanna, DEMOLABS:
Dino, efffn, LawyerLiz, HighWiz, Jay Healy, Magen Wu, Heisenberg would like to thank Nikita and DT for help with
Malware Unicorn, Marcia Hoffman, Medic, n00bz, Roamer, the selection process, and a shout out to Grifter and the
Pwcrack, SecBarbie, Shaggy, SinderznAshes, Snow, Solstice, other Contest Goons for help during the con. A big shout
Vyrus, Yan, Zfasel, Zoz. Massive thanks to Dept Leads, mad out to all the folks in the community who submitted demos for
props to Janet, Neil, Bestie, Rick Astley, Buggins & Squish. Demolabs - this could not happen without you!

CONTESTS: DISPATCH:
Grifter would like to thank all of the creators and RF and Ahab would like to thank the Dispatch Goons:
coordinators of the multitude of contests and events at AsmodianX, Taclane, Archangel, Fosgood, L0G1C, Rixon,
DEF CON 30. The time, effort, and passion that goes into w00k, dymz, miggles, dirtclod, dll3ma, Offroad, Merg,
your events does not go unnoticed, and the entertainment skyria, TheKillerSpud, Goon22, yosg, and Treble.
you bring not only to the contestants, but to the general
attendees and overall atmosphere of DEF CON is hugely FORUMS:
appreciated, so thank you, thank you, thank you. A
huge thanks also goes to the C&E Goons for making sure The DEF CON Forums and all the DEF CON Servers wish
things go off without a hitch and for putting out fires when to thank Jeff Moss Jeff for giving them meaningful purpose
they’re still just smoldering, so thank you to stumper, saltr, in service to DEF CON and the DEF CON Community: they
heisenberg, apexxor, secove, rugger, gomer, rcu83d, zero3, all fight for the users! Cotman thanks Cayce, Darington,
psychoticide, p0lr, CyDefe, V3rbaal, H4r0ld, Kaybz, and Janet, Jeff, Neil, Nikita, and Will for being so easy to
Ell o Punk; this wouldn’t be possible without you. Big thanks work with and tolerating my need to be specific and
explicit with details. Thanks to staff/goon from various
departments for getting me ToDo from all the organizers

96
of CVE-W-2022-08_11-14 (Contests, Villages, Events, PRESS:
Workshops for 2022 ;-) in each department necessary
to populate the forums with details about each: Nikita, Thank you to all the journalists, bloggers, and podcasters
Magen, Paydreaux, Zantdoit, Grifter. Thanks to info.defcon. who contribute to building & documenting our community
org peeps: Seth, Caleb, and others that work Info booth experiences! Over the years, it has become ever more
and department for your work on the box to keep people apparent how important it is to be able to laugh at and learn
informed. Thanks to the DevOps team working on our from our collective history. A special thanks to the Press
Discord server: Riverside, Ari, cstone, Lightning, Fox, Mubix, Goons who make it all possible: Claire, Jeff, and Sean. <3@
Nightwolf, Respondo, ThePhreak, Mauvehed, Nebberz, BSE, Wednesday & Monika
VoltageSpike, and mcmayhem. Thanks to all of DEF CON
attendees for working with each other to make DEF CON an PRODUCTION & HOTEL:
enjoyable experience for everyone. :-)
Thanks to the Production Team members Bill, Janet, Ira,
Proctor, Sparkles, Cybnew, Scout and Delchi for their tireless
INHUMAN REG: efforts doing <redacted>. Thanks to Cannibal, Silk, AJ702,
Inhuman Registration would like to thank Cstone, Undertaker, and Amanda for their photo magic. Janet would like to
Will, Nikita, Janet, Wendy, KC, McMayhem, Cylon, 50ph33 thank all of you, department leads, goons, and everyone in
and all the department heads for putting up working with us. between. Without you, this could not happen.

NOC: QUARTERMASTER:
effffn, mac and DEF CON would like to thank the Quartermasters Stores is brought to you this year by
indefatigable NOC team for their hard work. the letter Q and the number Seven. ETA is August 11th,
assuming no Major Malfunction or failopen. It will be good
Sparky, booger, CRV, c0mmiebstrd, Dp1i, c7five, Jon2, to back in the SunSh1ne hanging with the YoungBlood in the
deadication, musa, wish, johntitor, MikeD, Toph and strange Helium rich atmosphere, but of course keeping an eye out for
do a great job and work long hours so you can internetz. any Buttersnatcher or sp1kedshell at the Multigrain buffet.
Lastly, a huge thank you to Phil, Kevin, Mable and the whole shell-e, Drimacus, alizarinMegalodon, SP3ZN45, Nanook,
Caesars IT and Encore staff for going above and beyond to Pthamm, QBot, Cell Wizard and The Saint, I’m sorry but I
make our lives easier. just can’t keep this up, lol. Thank you all for being our sisters
and brothers and keeping the shiny shiny!
NFO BOOTH:
Littlebruzer and Littleroo would like to thank all of the NFO
REGISTRATION:
goons: 0tter, 50 Caliber, Aask, algorythm, ARI, BLu3f0x, cstone from Human Registration would like to thank
Boudica, Bufo Alvarius, Cheshire, Commrade, D1Gger, everyone on SOC, QM, Swag, IHR, the Admin team, and
dL@w, Hankashyyyk, jimi2x, Krav, Lo, madstringer, Magpie, the reg goons: 0x90ebfe, Chimera, Crackerjack, funnyguy,
MajorMayhem, Nav, Nymphaea Caerulea, Parenthetical, holmestrix, indigo, Jup1t3r, Model-A, Phear, Pozer, Prophet,
Paul, PEZHead, Razzies, ReloadRtr, S747IK, Sanchez, qumqats, Temtel, Undertaker, and wra1th.
SchematicAddict, securityfirst, SmileFiles, Smo0otchy,
Sparkle, and Viva. A shout out to the Apps and Web team: SOC:
”Advice, aNullValue, derail, and l4wke for their hard work
Cjunky and tacitus would like to thank: stealth, JulietBravo,
on the mobile applications and the web site. A special shout
OIFhax, th0m4s, StellarDrift, kruger, Junior, George,
to MajorMayhem for all the helping out in a PM capacity
Si, Rose, nohackme, Gretchen, M0rph1x, Arc, Mouse,
and keeping the team on track.The entire NFO team would
DoktorMayhem, Faz, Rez, John Doll, Rubi, Skiznotic,
like to thank DT, Nikita, Janet, Will, Neil, and the rest of
kerbear, arcon, Sif, SAGE, pr0ph37, cymike, Ada Zebra,
the HQ team. Without your support, we would not have
Echo Sixx, mauvehed, do2er, TRINITY, 0r3g0n V1x3n,
this great conference. Thank you humans for the interesting
CarpeDiemT3ch, motsu, Andibrat, nesquik, Chof, G00dn1t3,
questions and allowing us to tell you where to go and how
cocktail, Vaidu, Wham, mattrix, NextInLine, Chosen1, Hattori
to get there.
Hanzo, Thirsty Goat, rand0h, duckie, polish dave, sl3dge,
ZephrFish, shuu, bm0nkey, prec0re, Randy_Waterhouse,
PARTIES: anna, LabRat, WHITE CHRIS, Colonel Ghona, Las0mbra,
0x58 would like to thank all of the parties that bring the wilnix, Scrimshaw, Priest, Glasswalk3r, zombie, Lady
noise and fun, and the meetups that bring people together Chaos, Siviak, Geekspeed, skroo, Nothingness, 4chtung,
face to face while in Las Vegas. Nikita and Janet, couldn’t Baybe Doll, timball, Ast0r, Logkiller, WhiteBrd, TBD, Alice
do it without you! And a thanks to my small team of boots on Kalli, Yaga, BeaMeR, whiskey, Strandloper, milkyline,
the ground: Rickglass, s3gfault, sylv3on_, and Sage! Kitty, Wreaktifier, MIM, SystM_Ov3rL04d, BMP51, deelo,
AlphaKilo, Br1ck, Sumdunce, Zerorez, Sonicos, Cherno,
POLICY: Synn, St1ngray, Havoc, zerofux, JusticeStorm, Radio Active,
Judo, stan, redoubt, Plasma, Zulu, Sami, hamster, Heylel,
Beau and Matt want to give a huge thank you to all the HoneyBadger, Mr. M, Binarywishes, Infojanitor, Strider,
people who helped make the Policy Department possible Krassi, Wasted, Red, n1cfury, Jbone, dr.kaos, cRusad3r,
this year, including Winnona, Cathy Gellis, Moniru, Sarah DrFed, and all retired SOC Goons. Pax Per Imperium.
Powazek, Lin Wells, Linda Wells, Duck Duck, Harley, Roro,
Trey, Stew, Will, LawyerLiz, Ayan, AlexK, Mosfet, PWCrack, SPEAKER OPS:
Nikita, Janet, William Leonard, Neil, Wednesday, and Zant.
And especially everyone in the hacker and public policy pwcrack would like to thank the Speaker Operations staff for
communities who act as voices of reason to help each other another year of great service to DEF CON and its speakers.
get more technical and public policy literate. These goons are #s0sayw3all, Agent X, archwisp, Bushy,
CLI, Code24, Crash, DaKahuna, Flattire, g8, Gattaca,
gdead, Goekesmi, idontdrivecars, Jinx, Jur1st, Jutral, K-hole,
kampf, kylef, MaltLiquor, manchmod, Milhouse, Mnky,

97
 THANK Y0U!
notkevin, Pardus, Pasties, phliKtid, RoundRiver, Shadow, Paydreaux, Raze, Respondo, Sven, Trixie, Tuh-kah-kus, Void_
SIGAD, squirrel, stikk, SurrealKill3r, triw0lf, TruBluFan, star, Zachadakka, (Virtual) Cybersulu, Eddie the Yeti, and
usako, Vaedron and, as always, AMFYOYO! Woodpeka THANKS for all your time, help, and hard work!!
Villages would not be possible without it.
VENDORS:
Kevin would like to say thanks to the whole Vendor team
WORKSHOPS:
for being awesome as usual (special thanks to Fivepenny, Magen and Sinderz would like to thank our Workshop
the Vendor 2nd!). Thanks to all the DEF CON departments. goons: mav, BinaryBuddha, LawyerLiz, Integgroll, Dave,
Thanks for all the vendors that came to DEF CON 30! And Beaker, Fallible, Jen and Joel Cardella, Chrissy, adamO,
the attendees who give us all their money. And of course and RandomInterrupt; the Workshop Review Board and the
thank you to Janet, DT, and all of the DEF CON staff! instructors for all of the time and energy they volunteered
for the community; and the teams who support us before
VILLAGES: and during the show (DT, Nikita, Neil, Janet, Will, Cotman,
Darrington, QM, NOC, and SOC).
Zantdoit would like to thank Hony and F4ux for their
support as leads for each of the hotels. There is no way I
would be able to do this without you. BIG thanks to DVS
and Paydreaux for taking care of the village forums and
Discord... keeping them up to date and organized.
Zant, Hony, and F4ux, and the village team want to thank
all the Village leads and organizers for everything they do
to make DEF CON a huge success by bringing great villages
and content here for us to experience. Thanks to DEVOPS for
getting all the village channels organized up and running!
Thanks: Amlazar, Athena, Broozer, clutch, config, Curtis,
DVS, Furb, griff, Grimfodr, Hunny, Kralik, Margraf, Monster,

INFOCON IS A COMMUNITY SUPPORTED, NON-COMMERCIAL ARCHIVE OF ALL THE

PAST HACKING RELATED CONVENTION MATERIAL THAT CAN BE FOUND.
CONVENTIONS, SKILLS, RAINBOW TABLES, HACKER DOCUMENTARIES, PODCASTS.
AND MORE ALL AVAILABLE FOR DIRECT DOWNLOAD OR AS TORRENTS.
HOW BIG? 262K FILES, 16.4T!

98