Opening Ceremony #
Abstract
Join us as we kick off BSidesDFW with a welcome from the organizers, a quick overview of the day, important announcements, and the information attendees need before sessions begin.
2026 Speakers
Conference Program
Sessions
Infosec Content Creator Panel #
Abstract
The infosec industry runs on content. Blog posts, conference talks, YouTube deep-dives, Twitter threads, livestreams, podcasts — the people who shape the conversation are the ones creating it. But how do you actually *become* a content creator in infosec without burning out, getting doxxed, or producing noise instead of signal? This panel brings together 3-4 infosec content creators from different platforms and backgrounds to discuss the reality of creating technical security content. We'll cover building an audience from zero, balancing depth with accessibility, dealing with imposter syndrome, handling criticism and harassment, monetization (or lack thereof), and the surprisingly hard part: consistently producing work that matters while holding down a day job. **Panel topics:** - How each panelist got started and what they wish they'd known - Platform strategy: Blog vs video vs podcast vs social — what fits your style? - Technical depth: How do you make complex topics accessible without dumbing them down? - The burnout trap: Sustainable content creation in a 24/7 news cycle - Dealing with the internet: Criticism, harassment, doxxing, and legal concerns - Monetization reality: Speaking fees, sponsorships, Patreon, merch — what actually works? - Q&A with the audience
Presented By:
Andy Thompson
Andy Thompson brings almost 30 years of hands-on IT and security experience to everything he does. He's a highly certified infosec professional and a Senior Research Evangelist at Palo Alto Networks, and he's built a career on making complex technical topics land with any audience, from a packed conference hall to someone who's never heard the word "CVE." He's a fixture of the Dallas hacking scene, where he hosts and emcees the Dallas Hackers Association along with Hacker Movie Night, Hacker Book Club, and a long list of other community events. He's a regular on the speaking circuit and has delivered keynotes around the world.
Phillip Wylie
Phillip Wylie is an offensive security professional with over 22 years of cybersecurity experience, building on six years as a systems administrator before transitioning into cybersecurity. His diverse background spans multiple disciplines including network security, application security, web application pentesting, Wi-Fi assessments, social engineering, and red team operations. He holds industry-recognized certifications including CISSP, OSCP, and GWAPT. Currently serving as Chief Evangelist and Senior Consultant at Suzu Labs, Phillip brings a uniquely well-rounded perspective to both the technical and strategic sides of offensive security. Phillip is a dedicated educator who has taught pentesting and web application pentesting as an adjunct instructor at Dallas College, and has created and delivered offensive security content for P3F and INE. His personal brand, "The Hacker Maker," reflects his passion for making cybersecurity accessible to non-traditional career entrants. His contributions to the cybersecurity community extend well beyond the technical. Phillip is the concept creator and co-author of The Pentester Blueprint: Starting a Career as an Ethical Hacker, a widely respected book that grew from a lecture he gave at Dallas College into a conference talk and ultimately a published resource for aspiring pentesters. He is also a featured contributor in Tribe of Hackers Red Team. Phillip hosts The Phillip Wylie Show and Simply Offensive, co-hosts CYBR.HAK.Cast, and previously hosted The Hacker Factory Podcast, a SANS Difference Makers Award recipient. He is a frequent speaker and workshop instructor at US and international conferences including DEF CON, Black Hat, BSides, and RSAC, and remains an active mentor and community advocate throughout the cybersecurity industry.
Promptware: How Attackers Exploit Agentic AI and What Defenders Actually Do About It #
Abstract
In July 2026, Sysdig documented JadePuffer - the first confirmed fully autonomous agentic ransomware campaign: reconnaissance, credential theft, lateral movement, privilege escalation, and file encryption, end-to-end, no human at the keyboard.¹ The breach window for agentic AI attacks has collapsed to 22 seconds from initial access to handoff - compared to approximately 8 hours in traditional attacks.² CVE-2025-53773 (CVSS 9.6) demonstrated that a hidden prompt injection in a pull request description could trigger remote code execution through GitHub Copilot; CVE-2026-22708 let attackers poison Cursor's execution environment, allowing arbitrary payloads to be delivered.³ This is not a theoretical threat surface. The attack chain is documented, reproducible, and it targets developers and the tools they trust. This session breaks down how promptware actually works, how the kill chain executes, and what defensive architectures can actually stop it - not the ones that look good in a slide deck.
Presented By:
Moeez Khan
Moeez, a first-generation learner from a small Asian village, has built a dynamic and multidisciplinary journey through technology, education, and leadership. During college, Moeez completed 6 software engineering internships, collaborated with 9 international educational institutions to teach over 2200 underrepresented and privileged students, founded both a tech education and an e-commerce start-up, led 6 college student bodies, pursued 2 global sports semi-professionally, and developed over 85 technical projects before graduating in the class of 2024. Currently, Moeez is building AWS Transform, an Agentic AI service focused on transforming .NET, mainframe, and VMware workloads. This work centers on accelerating enterprise modernization across full-stack Windows, mainframe, and VMware systems, alongside enabling custom transformations of APIs, codebases, frameworks, and more. Aside from technical responsibilities, Moeez actively participates in Amazon hackathons and mentors junior engineers, finding fulfillment in guiding their career paths. Moeez also champions diversity and inclusion, advocating for greater equality within the tech industry. Through these efforts, Moeez positions himself not only as a technical contributor but also as a catalyst for meaningful and lasting change.
Practical Privacy: Modern Surveillance Requires Modern Solutions #
Abstract
This talk is a practical crash course on personal privacy and its implications in a surveillance state. When surveillance from governments, private companies, and criminals is prevalent with no end in sight, you are responsible for protecting yourself and your data from exploitation. Throughout this session, we will discuss what personal privacy looks like, how we ended up in a surveillance state, what modern surveillance looks like, and how to opt out. From ALPRs, to mobile surveillance, to OS-based surveillance, we will cover a majority of the surveillance vectors in this talk. As a participant, you will learn the following: an understanding of technical surveillance and how it is used to target you, technical solutions to regain your privacy, how to view legislation and technology from a more private lens, and how to empower yourself to gain autonomy and control over your life.
Presented By:
John Doe
The speaker has presented at multiple conferences on the topic of privacy, spreading awareness of the modern surveillance ecosystem. For a good part of the last decade, they have made privacy a focus in their lifestyle.
How EDR Killers Blind the Security Stack, and What To Do About It #
Abstract
EDR is a critical layer of endpoint defense, but an entire class of tools now exists to kill it before payloads execute. AI is accelerating the problem: attackers are using LLMs to generate novel EDR killer variants and mutate driver signatures faster than detection tooling can keep up. This talk dissects how those tools work, step by step through the attack chain. It covers the specific techniques in play across active ransomware operations, including BYOVD, legitimate driver abuse, in-memory hooking, and kernel-level persistence, and explains why behavioral and signature-based detection fails at each stage. Attendees leave able to recognize the EDR killer class, trace how it defeats detection at the driver and kernel level, and understand how AI compresses the attacker's timeline.
Presented By:
Scott Fuhriman
Scott Fuhriman is a seasoned technology and security leader with hands-on technical experience in cybersecurity, cloud and data center infrastructure, managed services, and IT operations. He has been responsible for R&D, Technology and Security Architecture, Technical Operations and Support, and servicing thousands of customers across industry verticals. He has built and led managed security operations, digital forensics and incident response teams, private cloud services, disaster recovery and backup services, as well as compliance initiatives.
Invisible Gateways: How Threat Actors Exploit IoT to Breach Organizations #
Abstract
Threat actors increasingly exploit vulnerable IoT devices to breach organizations and are becoming more of a threat due to endpoint protection improvements. This talk reveals real-world tactics, common misconfigurations, and practical defenses to help security teams protect against IoT-based intrusions.
Presented By:
Phillip Wylie
Phillip Wylie is an offensive security professional with over 22 years of cybersecurity experience, building on six years as a systems administrator before transitioning into cybersecurity. His diverse background spans multiple disciplines including network security, application security, web application pentesting, Wi-Fi assessments, social engineering, and red team operations. He holds industry-recognized certifications including CISSP, OSCP, and GWAPT. Currently serving as Chief Evangelist and Senior Consultant at Suzu Labs, Phillip brings a uniquely well-rounded perspective to both the technical and strategic sides of offensive security. Phillip is a dedicated educator who has taught pentesting and web application pentesting as an adjunct instructor at Dallas College, and has created and delivered offensive security content for P3F and INE. His personal brand, "The Hacker Maker," reflects his passion for making cybersecurity accessible to non-traditional career entrants. His contributions to the cybersecurity community extend well beyond the technical. Phillip is the concept creator and co-author of The Pentester Blueprint: Starting a Career as an Ethical Hacker, a widely respected book that grew from a lecture he gave at Dallas College into a conference talk and ultimately a published resource for aspiring pentesters. He is also a featured contributor in Tribe of Hackers Red Team. Phillip hosts The Phillip Wylie Show and Simply Offensive, co-hosts CYBR.HAK.Cast, and previously hosted The Hacker Factory Podcast, a SANS Difference Makers Award recipient. He is a frequent speaker and workshop instructor at US and international conferences including DEF CON, Black Hat, BSides, and RSAC, and remains an active mentor and community advocate throughout the cybersecurity industry.
THE INVISIBLE ECHO: Shedding Light on Personal Data Leaks #
Abstract
Your personal data is already a commodity. Data brokers have been selling out data to anyone willing to pay — and attackers are buying. We look at how AI is changing our world and how personal data will be used and weaponized. We will get uncomfortable. An OSINT demonstration to show exactly what an attacker can build on any person and employee in under three minutes using only free, legal tools. Then, we will earn how to fight back and protect yourself. You'll leave with a personal 30-day action plan and a toolbox of free tools you can use today. If you work in security, handle sensitive data, or simply want to stop being an easy target — this talk is for you. Audit. Act. Amplify.
Presented By:
Brian Culver
Brian is a Cybersecurity and AI Security Researcher with over 25 years of architecting, building and delivering secure environments and software at enterprise scale - spanning cloud architecture, application security, AI-driven software and DevSecOps, and front-line incident response.
Establishing a Beachhead: Post-Exploitation in Azure DevOps #
Abstract
You phished a token, found a leaked PAT, or popped a single low-privilege identity. Now you're staring at an Azure DevOps organization wondering what's actually within reach. This is the part that never makes the breach report: what an operator does in the hours after initial access. This talk walks through post-exploitation in Azure DevOps from the operator's seat. Assuming a foothold (ADO PAT), we show how an attacker enumerates ADO resources, harvests credentials scattered across repos, wikis, logs, and pipeline variables, maps attack paths across the tenant, and escalates by turning CI/CD pipelines against the organization that runs them. The centerpiece is a technique called pipeline variable-dumping: cloning or modifying a build definition so that a pipeline you already have write access to leaks its own secret variables and service-connection tokens into build logs you can read. We cover both the classic and YAML pipeline variants and post-exploit clean-up activities. We demonstrate all of this through Beachhead, an open post-exploitation framework we built to consolidate our ADO tradecraft into a single, auditable operator surface. Crucially, this is not a talk about a smash-and-grab tool. Every call passes through a scope guardrail, dangerous operations are gated behind explicit confirmation, and every action lands in an append-only audit log.
Presented By:
Jon Rhodes
Jon Rhodes is an Adversarial Engineer at Blackbaud and a member of the Synack Red Team (when he needs extra cash for new farm equipment).
Jared Dobbelaer
Jared Dobbelaer (Fr13ndz) is an Adversarial Engineer at Blackbaud, conducting Red Team engagements and Penetration Testing in the Cloud. Fr13ndz enjoys creative solutions that both help targets with organizational needs and requirements, while also borrowing their bearer tokens.
SuperBOX Returns: New Discoveries, Updated TTPs, and What It Means for Security Research #
Abstract
Influence operations don't stand still. As we saw with BadBOX 2.0, they adapt, rebrand, and route around the researchers tracking them. SuperBOX is no exception, and the changes since 2024 have real implications for how defenders and researchers approach this kind of work today. BSidesDFW was one of the first stages where I shared my initial research into SuperBOX. Since then, the story has taken more twists and turns than expected, so it's only fitting that BSidesDFW gets the update first. This talk covers what's changed since 2024: new discoveries about the operation, how its tactics, techniques, and procedures have evolved, and what these shifts mean for researchers tracking it going forward. Attendees will leave with a current picture of the threat landscape around SuperBOX and practical takeaways for anyone doing similar investigative work.
Presented By:
Ashley Sequeira
Ashley(D3ada55) is a cybersecurity researcher specializing in IoT security and adversarial threat intelligence. At Censys, she conducts research on IoT botnets and emerging threat campaigns, including illicit streaming device ecosystems activity, data exfiltration, and coordinated influence operations. She is an adjunct professor, serves as Chief Security Officer for BSides Las Vegas, and is currently pursuing a PhD in Cyber Defense. Her research has been featured on the Darknet Diaries podcast and at conferences including DEF CON, CactusCon, and our very own Bsides DFW.
Remember When We Said, “Don’t Believe Everything You Read on the Internet”? #
Abstract
We used to tell people, “Don’t believe everything you read on the internet.” Today, that advice feels almost quaint. Misinformation isn’t new, but the speed, scale, and credibility with which it can spread have changed dramatically. Artificial intelligence is accelerating a problem that already existed. Pulling inspiration from *Metropolis* (1927), this talk looks at how trust can be gained, manipulated, and ultimately weaponized. In the film, people act on false information because it comes from someone they already know and trust. Nearly a century later, we are confronting the same human vulnerability in a world of social media, impersonation, deepfakes, AI generated content, and increasingly convincing digital identities. This talk explores misinformation as a security problem, focusing on how attackers can exploit trust and influence human behavior without needing to compromise a system first. Rather than asking whether AI itself is the threat, we will look at how technology can make misinformation easier to create, harder to recognize, and faster to spread. The technology has changed. Our vulnerability to misplaced trust has not.
Presented By:
Kayley McRae
I’m an IT and cybersecurity professional who loves learning and exploring where technology is taking us. I’m especially interested in cybersecurity, AI, and conversations about how technology will shape our future. Outside of tech, I love music, fashion, and going down rabbit holes whenever a new topic catches my attention.
Living Off The SaaS: The Attacker in the Workflow #
Abstract
Threat actors are no longer limited to abusing operating system tools, or social engineering burnt out support staff. They increasingly leverage trusted SaaS platforms, cloud services, free infrastructure, and legitimate business workflows to conduct attacks while appearing indistinguishable from normal users and services. This session explores the evolution of “Living Off The Land” to “Living Off The SaaS” and how defenders can adapt to a world where attackers hide in plain sight. Attendees will gain a new perspective on modern attack tradecraft and walk away with practical techniques for identifying, investigating and responding to threats hiding within trusted environments.
Presented By:
Emily Skaggs
Emily Skaggs is an Incident Response Manager, DEF CON Goon, and active member of the Dallas-Fort Worth security community. Before moving into incident response, she worked across nearly every layer of the technology stack including help desk, systems administration, network engineering, physical security assessments and even a stint building self-checkouts. These days she spends her time investigating security incidents, talking shop with other defenders and trying to understand what attackers will abuse next.
The Rainmaker Report - How I Automated Threat Intel Into Social Media Content Creation #
Abstract
Most threat intelligence talks present the finished product: the report, the brief, the curated list of indicators. This session goes behind it, walking through a complete, one-person threat intelligence pipeline that turns the daily flood of cybersecurity news into actionable intelligence and publishes it, end to end, with almost no human effort. Every night the system ingests from hundreds of sources across three authority tiers, then deduplicates and clusters roughly 1,800 raw headlines into about 200 distinct stories. A weighted scoring model ranks each one on source authority, velocity, severity, novelty, and audience relevance, while a strict freshness filter discards anything no longer current. What remains is a short list of the stories that genuinely matter that day. From there the pipeline drafts the analysis, packages it for each destination, and automates delivery across six platforms, from long-form video and podcast to short-form social. The entire nightly run costs roughly seventeen cents. The talk covers the architecture, the automation, and the failures behind it, and includes a live demonstration: a real story taken from raw feed through selection to finished, ready-to-publish intelligence, in the time it takes to explain how the pipeline works.
Presented By:
Andy Thompson
Andy Thompson brings almost 30 years of hands-on IT and security experience to everything he does. He's a highly certified infosec professional and a Senior Research Evangelist at Palo Alto Networks, and he's built a career on making complex technical topics land with any audience, from a packed conference hall to someone who's never heard the word "CVE." He's a fixture of the Dallas hacking scene, where he hosts and emcees the Dallas Hackers Association along with Hacker Movie Night, Hacker Book Club, and a long list of other community events. He's a regular on the speaking circuit and has delivered keynotes around the world.
Quantum Readiness: Preparing Today for Tomorrow’s Computing Revolution #
Abstract
Quantum computing is no longer a distant research topic, Infact it is an emerging business risk. Advances in quantum algorithms threaten to break the public key cryptography that secures today’s internet, from TLS and VPNs to digital signatures, identity systems, and software supply chains. The result is not just a future problem because adversaries are already using “harvest now, decrypt later” tactics, capturing encrypted data today to exploit once quantum capabilities mature.
Presented By:
Anitha Dakamarri
I am Anitha Dakamarri, a seasoned IT professional with over 19 years of experience in the field of information security. Over the years, I have honed my skills in various domains, including threat modeling, application security assessments, and network security assessments. My work experience spans across reputable organizations like DFIN, USCELLULAR, and Syntel Inc., where I have led teams, developed security standards, and implemented robust security frameworks. hold several industry certifications like CISSP,CISM,CEH,CHFI, which reflect my commitment to continuous learning and professional growth. My passion for security extends beyond technical assessments; Im active speaker and volunteer at ISACA(CISM Exam development, Mentor ), ISC2(Exam development and UBK panel, 50*50 volunteer) OWASP(Contributor, CFP review), Women4Cyber (Mentor) and WiCys(Mentor), CSA(Contributor).
Beyond Metadata: Runtime Defenses for Tool-Poisoning in MCP #
Abstract
Model Context Protocol is fast becoming the default way AI agents connect to tools, and the default way to attack them. This talk presents MCP-Poison-Bench, a cross-vendor benchmark of roughly 2,500 trials testing how language models hold up against tool-poisoning attacks across multiple injection vectors. The results are uncomfortable in three ways. Defenses that inspect tool metadata are blind to injection that arrives in tool results, the "rug pull" class, so they guard the wrong door. Resistance to poisoning isn't a feature you can bolt on; it tracks model capability rather than something defenders control directly. And frontier models resist these attacks while cheaper models break, which means in a real agent chain your security is set by the weakest model at any hop, not the best one. I'll cover the benchmark methodology, including how the trials were de-circularized so attacks aren't graded with the same assumptions that generated them, show where current MCP guardrails fail, and explain why "just use a better model" is an argument for defense-in-depth rather than a real fix. Attendees will leave able to tell which MCP defenses are security theater and which genuinely constrain the attack surface. The benchmark is open source.
Presented By:
Chirag Dewan
Chirag Dewan is a cybersecurity and AI security researcher focused on securing agentic AI systems, tool-using LLMs, and the Model Context Protocol. He is a Software Engineer II at GM Financial, where he works on production multi-agent AI systems, detection engineering, and AI-driven guardrails. Previously, he worked in offensive security research on vulnerability discovery and exploit development for cyber-physical systems.
Evidence-as-Code: Automating Compliance Without the Audit Theater #
Abstract
Most compliance programs are built to satisfy an assessor, not to describe reality. Screenshots, spreadsheets, and annual fire drills change what the auditor sees without changing a single system. This talk treats compliance evidence like code: queried read-only from the running system, normalized to one schema, versioned, and hash-verified. We’ll cover why a scan finding isn’t evidence, how one schema maps across clouds and frameworks, why an unassessed control should never quietly pass, and how drift turns compliance into a detection source. A demo walks through real evidence from deliberately misconfigured AWS and OCI labs. You’ll leave with three moves to start Monday using tools you already have.
Presented By:
Darius Davis
Darius Davis is a Principal Security Architect and the founder of Kascade Security, Inc., a security company focused on regulated industries. He created TitanGuard, a platform that turns live cloud configuration into versioned, auditor-ready compliance evidence. He has more than a decade of experience across security operations, cloud security, detection engineering, and incident response, and holds the CISSP-ISSAP, CCSP, CISM, and several other industry-recognized certifications. Darius has chaired InfoSec Nashville for the past two years, serves as Vice President of ISSA Middle Tennessee, and has spoken at conferences across the Southeast. His work centers on making compliance prove what’s actually true about a system, not what’s been staged for the assessor.
Cryptography in Education and Entertainment #
Abstract
An overview of Cryptography in its uses for education and entertainment, particularly in the field of ARGs and their usefulness to take the complex topics we engage in as professionals, and teach them to broader audiences
Presented By:
Joshua Stromberg
With 4 1/2 years of experience in Cybersecurity Consulting, Joshua Stromberg is a graduate of the University of North Texas with a Bachelors in Cybersecurity and a Minor in English. Enjoying communicating with others and helping everyone to understand, is a strong believer in the free flow of information, and more than happy to strike up conversation with anyone. Aspiring Writer, and Engineer who can Communicate.
Lock, Badge, Breach: Inside a Real-World Physical Pentest #
Abstract
Ever wondered how hackers break into buildings, not just networks? This talk pulls back the curtain on real-world physical pentests — OSINT, lockpicks, cloned badges, hidden cams, and social engineering — showing how attackers bypass physical defenses to reach your crown jewels.
Presented By:
Paul Nieto III
Paul Nieto III is the Founder and Principal Operator of 0x3 Security, a hacker-built Red Team and Managed Security firm based in Texas specializing in offensive security, adversary simulation, and autonomous threat response. A seasoned penetration tester and red team operator, Paul holds multiple advanced certifications including OSCP, CPTS, CBBH, and CRTO, and has spent years conducting offensive operations for organizations such as Royal Caribbean, Apple, and Box. His background blends physical security, cyber operations, and real-world red teaming, giving him a unique edge in understanding how attackers truly breach environments—both digitally and physically. At 0x3 Security, Paul leads engagements ranging from full-scope penetration testing to nation-state-style adversary emulation, combining tools like CrowdStrike Falcon, NinjaOne, and custom C2 frameworks with hands-on hacker tradecraft. He’s passionate about helping businesses move from reactive defense to proactive resilience—arming defenders with the same mindset as the attackers who target them. When he’s not simulating ransomware or bypassing RFID systems, you’ll find Paul speaking at security conferences, mentoring up-and-coming hackers, and creating educational content across YouTube, LinkedIn, and Instagram (@0x3_Security) to bridge the gap between enterprise defense and hacker reality.
When CAD Automation Becomes an Attack Surface: Securing Custom Plugins, APIs & Engineering Workflow #
Abstract
Custom CAD automation tools can save hours of repetitive work, but they can also introduce overlooked security risks. A plugin loaded through a DLL may have access to sensitive drawings, engineering data, local files, configuration settings, and application commands. This session explores the defensive security considerations involved in building CAD automation tools with C#, .NET, Visual Studio, and application APIs. Using practical examples, I will discuss risks such as untrusted plugins, weak input validation, excessive access, unsafe configuration handling, unauthorized drawing changes, and limited auditability. Attendees will learn how to add validation, safer configuration practices, controlled deployment, error handling, logging, and traceability to custom engineering tools. The goal is not to teach offensive exploitation, but to help developers and engineering teams recognize CAD plugins as part of their software attack surface and build automation that is both productive and secure. No previous CAD experience is required.
Presented By:
Janvi Saddi
I am a Computer Science graduate and CAD/Data Automation professional with experience across data center design workflows, AutoCAD automation, process improvement, data analytics, and FMCG market research. I currently work as a CAD Tech 2 at Astreya, supporting Google data center design workflows by building custom tools that reduce manual effort, improve accuracy, and streamline engineering processes. My background also includes FMCG and consumer insights experience, where I worked with panel Data, market research data, SQL, Power BI, dashboards, survey operations, and client reporting for business decision-making. I am passionate about using technology to solve real workflow problems, improve productivity, and help teams work more efficiently. I enjoy sharing practical lessons around automation, workflow improvement, analytics, and career growth in tech.
Intersectionality of Hackers & Homos #
Abstract
This session breaks down a timeline of hacking history, while overlapping that timeline with Queer History. It explores notable events and figures in both the hacking & queer communities and highlights how much the histories of these groups overlap.
Presented By:
Samantha Millsaps
-DEI Evangalist. -Former Cybersecurity Recruiter, turned marketer. -Local meetup enthusiast. -NTX ISSA board member. -Resume reviewer, interview prepper, & MAJOR believer in community powered career growth.
Closing Ceremony / Raffle #
Abstract
Stick around as we close out BSidesDFW, share a few final announcements, thank the folks who made the day happen, and draw the raffle winners. We'll send everyone off with one last round of thanks to our speakers, sponsors, volunteers, and community.
Hands-on Learning
Workshops & Training
Breaking Bad Crypto: Hands-On Attacks on the Code Around Cryptography #
Abstract
Most cryptography does not fail because someone broke the math. It fails because someone used it wrong. A missing check, a reused number, a token the server trusts a little too much, and the padlock quietly opens for anyone who knows where to push. This is a hands-on workshop about breaking real cryptographic implementations, with no number theory required. You will not attack AES or elliptic curves themselves. You will attack the code around them, the same way attackers do in the wild, and you will do it on your own laptop. Everything is organized around the questions an attacker asks when they read your code: - Did you reuse it? - Did you check it? - Did you let me choose? - Did you leak it? - Did you roll it yourself? - Did you use a real random number generator? Each answer is a family of real-world breaks, and several of them get their own live lab. Over three hours you will work through a series of escalating challenges hosted on a local network: - Watch "encrypted" data hand you its secrets using the famous ECB penguin, then learn why deterministic encryption leaks equality everywhere, including database columns nobody thinks of as readable. - Flip a few bytes of a session token, with no key, and promote yourself from user to admin. - Recover a private signing key from two signatures, the exact mistake that unlocked the Sony PlayStation 3. - Forge an admin login by telling a JSON Web Token server which algorithm to trust. - Predict a "random" password-reset token after watching only a handful of outputs. Every lab follows the same rhythm: you see the system, you predict where it breaks before we reveal it, you break it yourself, then we show the one line of code that fixes it. Nothing is a slide-only demo. Each challenge is a small, self-contained server you exploit from a starter script with a single missing piece. You leave with a public repository of every challenge, solver, and slide, those same six questions as a checklist you can run against any codebase, and the uncomfortable ability to spot these bugs in production. The examples come from real CVEs and CTF challenges, and every defense is generic and tool-agnostic, so nothing here is tied to a vendor or product. No cryptography background is required. If you can read a little Python and you enjoy watching something you were told was safe fall apart in front of you, this workshop is for you.
Presented By:
Diptendu Kar
Diptendu Kar is a security researcher focused on supply chain and dependency risk. He works on triaging open-source vulnerabilities, writing detection rules, and exploring how AI can automate tedious parts of security research. He also teaches Software Security Practices at Northeastern University part time and holds a Master’s in Cybersecurity. Before security, he worked as a Java developer at TCS. He’s especially interested in patch diffing, vulnerable function detection, and the use of LLMs in AppSec. He believes cryptography is magic and AI is a noisy intern—helpful but always needs supervision.
Hack The Box Workshop #
Abstract
No description provided.
Getting Started with Self-hosting (Part 1) #
Abstract
You don't need expensive hardware to run a server. In fact, any old laptop or PC can be used to securely host a wide variety of services in your home for free! Or for the cost of a virtual private server, you can have your own cloud storage, search engine, or video chat service that doesn't sell your personal data to advertisers. At this BSides workshop, you will get hands on experience with installing a server OS on a virtual machine, setting up a virtual private server, and installing a variety of applications for yourself, your family, or your organization. Already savvy on setting up a server? Then join the afternoon sessions where we discuss overlay networks and advanced security hardening! This workshop has a unique format in that participants can learn about a variety of topics at different times throughout the day. Workshop Activity Schedule (Part 1) 9:30 - Self Hosting Overview Why Self-Host? Comparisons - Hosting locally vs. in the cloud - Bare metal vs. virtual machine - Running app host vs. in containers Selecting your hardware 10:30 - Creating Your Server Demo: - Create a cloud-based server instance Hands on: - Create a virtual machine in Proxmox - Install Ubuntu Server 11:30 - Running your First Application Hands on: - Set up Docker - Create first container with Docker Compose - App choices: - Pi-hole – Network ad blocker - Jellyfin – Media server - SearXNG – Private search engine - Homepage – Personal dashboard - Mealie/Tandoor – Recipe management and meal prep - Using Docker helpers like Portainer or Dockhand Discovering self-hosting platforms - Reviewing Tipi, Caprover, and Yunohost
Presented By:
Quantum Cheap
LibreTechnica shares knowledge about technologies developed for the benefit of the commons. By promoting open-source technologies that are free from and resistant to corporate control, government censorship, political coercion, and environmental harm, we can together heighten and sustain the common good.
Getting Started with Self-hosting (Part 2) #
Abstract
You don't need expensive hardware to run a server. In fact, any old laptop or PC can be used to securely host a wide variety of services in your home for free! Or for the cost of a virtual private server, you can have your own cloud storage, search engine, or video chat service that doesn't sell your personal data to advertisers. At this BSides workshop, you will get hands on experience with installing a server OS on a virtual machine, setting up a virtual private server, and installing a variety of applications for yourself, your family, or your organization. Already savvy on setting up a server? Then join the afternoon sessions where we discuss overlay networks and advanced security hardening! This workshop has a unique format in that participants can learn about a variety of topics at different times throughout the day. Workshop Activity Schedule (Part 2) 1:30 - Securing your server Hands on: - Create SSH keys - Lock down SSH - Disable root login - Enable host firewall 2:30 - Networking Accessing your remotely remotely VPNs and Overlay networks 3:30 - Advanced Topics Intro to Ansible Security hardening for your with OpenSCAP
Presented By:
Quantum Cheap
LibreTechnica shares knowledge about technologies developed for the benefit of the commons. By promoting open-source technologies that are free from and resistant to corporate control, government censorship, political coercion, and environmental harm, we can together heighten and sustain the common good.
Moloch in the Clouds: A Hands-On FaaS Defense Workshop #
Abstract
While serverless abstracts the underlying infrastructure, it doesn’t reduce responsibility. In highly dynamic, event-driven cloud environments, security teams face fast-moving threats that traditional models weren’t designed to handle. Misconfigurations, fuzzy trust boundaries, and insecure integrations create new attack surfaces, including vulnerable libraries, leaky secrets, wildcard IAM roles, and misconfigured triggers. In this immersive workshop (3-hour or more as per the slot available), participants will build a cloud lab using serverless components to design and secure an end-to-end AI pipeline with LynxLab. Teams will tackle gamified, challenge-based scenarios, identifying vulnerabilities, mapping them to STRIDE and OWASP serverless categories, and exploring real-world attack paths. This session emphasizes practical skills over theory. Attendees will learn how ephemeral execution, event-driven chains, and implicit trust boundaries can be exploited, and leave with actionable patterns, checklists, and defensive strategies to secure modern serverless applications without slowing delivery. # Workshop Outline ## Module 1| Attack & Defense Breakdown (STRIDE + OWASP Serverless Top 10) Objective: Walk through an example of serverless use case and explain each challenge in detail, with real-world exploitation paths and corresponding defensive strategies. Discussion Framework: Each challenge is analyzed through - - STRIDE categories (Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privilege) - Relevant OWASP Top 10 categories (e.g., Serverless A6: Function Permission Misuse, A3: Event Injection) Deep-Dive Examples: - Privilege escalation via wildcard IAM → Elevation of Privilege / STRIDE - Secret leakage in environment variables → Information Disclosure - Insecure event trigger chaining → Event Injection / Tampering Defense Patterns: - IAM least privilege scaffolding - Event schema validation - Secret rotation & parameter store usage - Secure dependency management practices Hands-On Deliverables: - Completed attack/defense matrix - Mapped security controls to each misconfiguration - Templates and best-practice patterns to reapply at work ## Module 2| Gamified Challenges - Hunt the Vulnerability Objective: Engage teams in interactive, challenge-based discovery of common serverless weaknesses. Gamification: Points are awarded for identifying vulnerability and we will display a real-time dashboard of scores for each team Hands-On Deliverables: - Documented findings per challenge ## Module 3 | Building Your Home Cloud Lab (LynxLab Setup) Objective: Equip participants with a fully functional cloud-based environment to safely explore serverless attacks and defenses. Topics Covered: - Overview of LynxLab architecture (serverless components, event triggers, IAM wiring) - Guided installation and configuration Hands-On Deliverables: - Fully deployed personal cloud lab
Presented By:
Shivam Dhar
With nearly a decade of experience across sectors such as e-commerce, healthcare, gaming, open-source, and cybersecurity, within both large enterprises and agile startups, Shivam brings a creative, solutions-driven approach to complex challenges. Committed to community engagement, he actively mentors early-career cybersecurity professionals, judges prestigious tech awards, peer-reviews academic research, and contributes to tech-for-good initiatives with nonprofit organizations. He currently leads cloud security efforts at JPMorganChase, driving robust solutions to support the firm’s ongoing growth.
Nimish Sharma
Results - driven Cybersecurity Engineer with diverse experience across Healthcare, Banking, Public, and Telecom sectors, cross-functional project guidance and stakeholder support, security architecture strategy, application/ agentic AI security, predictive analytics, and enterprise risk management. Adept at designing and implementing scalable solutions, driving automation, and delivering quantifiable value and innovation.
Interactive Areas
Villages
Hardware Hacking Village #
Abstract
Come build your badge for BSidesDFW, then figure out what it actually does. This year’s badge is more than a piece of swag — it forms a mesh network with other badges, because how can we take down capitalism without organization? Oh, and somehow there’s a MIDI keyboard involved? We could explain exactly how, but where’s the fun in that? The badge for this year’s event needs to be powered by a USB-C device. Your phone or a power bank will work. We’ll supply a USB-C to USB-C cable.
Presented By:
Malcolm Galland
Lockpicking Village #
Abstract
Stop by the Lockpicking Village and learn what’s actually happening inside a lock when you turn the key and then learn how to convince it to open without one. We’ll have locks, picks, and folks on hand to help whether this is your first time or not. Learn the basics, practice your technique, challenge yourself. No experience necessary. Curiosity encouraged. Please only pick locks you own or have permission to open.