Opening Ceremony #
Abstract
No description provided.
2017 Speakers
You are viewing the schedule and materials for a past BSides DFW event.
The Long Con - Lessons From Early 20th Century Con Artists For Modern Hackers #
Abstract
The history of confidence scams, or "cons", of the early 20th century contains a wealth of lessons, tools, and techniques that we can apply to modern social engineering and the defense of organizations' networks. In this talk, we will explore the various types of "classic" cons, focusing on the structure of "big store" games, while simultaneously discussing how the principles of these historic cons can be applied to modern social engineering (and criminal) operations. We will also discuss the similarities, in terms of culture, community, slang, and media representation of confidence artists, hackers, and professional information security practitioners. MSU.
Presented By:
Wesley McGrew @McGrewSecurity
Dr. Wesley McGrew oversees penetration testing as Director of Cyber Operations for HORNE Cyber Solutions. He has presented on topics of penetration testing and malware analysis at DEF CON and Black Hat USA. He holds a Ph.D. in CS from Mississippi State University for his research in vulnerability analysis of SCADA HMI systems, and served as a professor teaching reverse engineering at MSU.
Designing, Fabricating, and Building an Electronic Badge #
Abstract
The process of building your first Printed Circuit Board (PCB) has never been easier, inexpensive, and faster than it is right now. We will walk through a recent project from concept to final product where I was tasked with building an electronic badge for a user conference. There are many choices for free and easy to use Integrated Development Environments (IDE) for programming microcontrollers. There are multiple CAD packages for designing your circuits and laying out the PCB. The cost and turnaround times for having beautiful PCBs and it's associated components show up at your door are hard to believe. Anyone interested in cranking out your first PCB, programming microcontrollers, or even discussing high-level techniques (reflow/iron) for soldering surface mount devices (SMD) to your PCB will walk away well prepared to start or extend your journey as a maker.
Presented By:
Jim Apger
Jim is a 20-year veteran of the tech industry. He began his career in the manufacturing environment developing solutions to interconnect heterogeneous robotics, controls, analytics and supervisory systems. His digital hardware and software background paved a path for him to spend nearly ten years as an innovator in the network intrusion prevention space. Prior to joining Splunk as a Security Architect in 2014, Jim made many key contributions in the fields of web fraud detection, anti-money laundering, security information/event management (SIEM), Security Operations, and cyberthreat intelligence. Jim earned his bachelor's degree in Electrical Engineering from The Ohio State University.
Open #
Abstract
No description provided.
cookie theft and reuse via cookie sheet and GNAWS #
Abstract
No description provided.
Presented By:
@integgroll
Pulling back the hood(ie): What do security threats look like? #
Abstract
Threats are complex, detecting anomalies in nebulous log data is difficult, and mapping out the attacker’s malicious infrastructure can be tedious. Trying to build intuitions and identify patterns in log data can be daunting, but with the use of visual intelligence pivoting through your data becomes a far easier task. In this talk I will dive into a different approach to visualizing threat data that focuses on constructing a cohesive narrative for threats and the infrastructure that support them. By understanding the components required for distributing malware and visualizing their infrastructure we are in a better position to spot trends, identify key bottlenecks, and mitigate compromises. Using open sourced data visualization software and other tools I will demonstrate how to use visualizations to enrich DNS, IP, ASN, and WHOIS data to better understand threats and how to build classifiers to identify, flag, and block them. I will demo three use cases in this talk: 1) Mapping out threats to easily pivot between domains, IPs, and domain registrants to find and block additional malware delivery vectors. 2) Visualizing ASNs domain hosting volume over time to spot suspicious patterns and block specific IP ranges or the entire ASN. 3) The use of visual intelligence in developing classifiers to automatically block malicious infrastructure.
Presented By:
Austin McBride
Austin McBride is a Database Architect at OpenDNS (now Cisco Umbrella) with a background in data mining, analytics, security research, and data visualization. Currently, his research focuses on mapping out the relationship between attackers malicious infrastructures and the malware they distribute.
Lesser-Known Application Vulnerabilities #
Abstract
Vulnerabilities are expensive, there’s simply no way around it. Whether it's mitigation costs, Penetration Testing fees, auditing, or bug bounties - vulnerabilities and bugs are pricey. While SQLi and XSS are certainly dangerous, this talk will focus on some of the more obscure application vulnerabilities which were identified within apps and services we use every day. This presentation won’t simply stop at introducing these talking points; rather, we will dive into identification, both risk and technical analysis, and finally remediation techniques. The goal of this discussion will be to arm security practitioners, of all skill levels, in better understanding application risks in 2017.
Presented By:
Kevin Cody @kevcody
Kevin is a Senior Consultant with experience working at several Fortune 500 enterprises. Although his particular expertise is geared toward hacking Web and Mobile applications, he is also experienced in the entire gamut from mainframes to embedded systems. Kevin is adamant on helping build-up developers through security, which can be seen in his involvement within OWASP or while speaking at events like CodeMash or BSides. In his spare time, Kevin can be found attempting to repair something (via online DIY videos), reading tech books, fishing, or simply spending time with his wife and children.
tracking People for Fun and Profit #
Abstract
No description provided.
Presented By:
Marcus
Open #
Abstract
No description provided.
Return From The Underworld - The Future Of Red Team Kerberos #
Abstract
This talk discusses Kerberos Key derivation, cracking and the future of Kerberos, kerberoasting and NTLM. Also discusses the possibilities for increased knowledge around Kerberos in the security community.
Presented By:
Jim Shaver @elitest
Jim Shaver is a penetration tester working on penetration assessments, infrastructure security reviews as well as social engineering. Jim has been working in IT, security and pen testing for 9 years. Jim is a contributor to mitmproxy and pyOpenSSL.
Mitchell Hennigan @mrconan312
Mitchell Hennigan is a penetration tester working on penetration assessments, infrastructure security reviews as well as social engineering. Mitchell has been involved in the penetration testing field for 2 years.
Love is in the Air - DFIR and IDS for WiFi Networks #
Abstract
Every company uses wireless networks in some way and asking for the WiFi password, simply expecting a wireless network to be present, is the new normal. We are constantly surrounded by dozens of devices, constantly blasting out wireless packets that are not only full of interesting information but also unencrypted. The WiFi attack vector has been identified a long time ago and the famous Wifi Pineapple devices make it possible to exploit issues with the 802.11 WiFi standard even without strong wireless expertise. To make things worse, access point logs are rarely centralized and even if they are, they don't contain information that could let you spot an attack early. In this talk, we will walk through the the 802.11 standard and demonstrate how to collect wireless frames using an Open Source tool, “nyzme.”
Presented By:
Lennart Koopmann
Abusing Protocols for Dynamic Addressing in Space #
Abstract
No description provided.
Presented By:
Jacen
Open #
Abstract
No description provided.
BSidesDFW: The Future #
Abstract
No description provided.
Presented By:
@0isac0
Doar vs the Application #
Abstract
No description provided.
Presented By:
Doar
Facilitating Fluffy Forensics 3.0 #
Abstract
No description provided.
Presented By:
Andrew Hay @andrewsmhay
Malware From Thin Bits #
Abstract
No description provided.
Presented By:
Itzik Kotler @itzikkotler
hacking the world with 4th grade math #
Abstract
No description provided.
Presented By:
chris
Pawning managed engine #
Abstract
No description provided.
Presented By:
init_6
The FaaS and the Curious #
Abstract
No description provided.
Presented By:
Bryan McAninch
Defending Against the Grifter #
Abstract
Maybe you've seen the movies and read the psychological thrillers that imply con artists have almost magical abilities to re-program your brain or hypnotize a mark in order to bypass pesky locks, or even swindle your wallet away from you. But this is simply not the case. We will go through several real-life examples of social engineering attacks and detail how you can protect yourself and your company against the grifter.
Presented By:
Sophie Daniel @HydeNS33k
Sophie Daniel is a penetration tester and information security consultant. She specializes in social engineering penetration assessments including, physical, voice (vishing), and text (phishing) and red team pentests. Further, she consults in remediation and prevention through the creation and implementation of policy and procedure, as well as in-person customized training. Prior to working in InfoSec, Sophie was a journalist.
Digital forensics with open source tools #
Abstract
No description provided.
Presented By:
@forensico
Open #
Abstract
No description provided.
Strengthen Your SECOPS Team by Leveraging Neurodiversity #
Abstract
No description provided.
Presented By:
Megan Roddie @megan_roddie
Barcowned - Popping Shells with your Cereal Box #
Abstract
No description provided.
Presented By:
Michael West @t3hub3rk1tten
PSAmsi: Offensive PowerShell Interaction with the AMSI #
Abstract
No description provided.
Presented By:
Ryan Cobb @cobbr_io
Protecting Yourself from Golden Ticket Attacks with Rainmaker #
Abstract
This talk highlights the risk of kerberos attacks against Active Directory, specifically the Golden Ticket attack. Andy demonstrates the phases of an advanced targeted attack against a SWIFT banking organization using nothing but PowerShell empire and some bad techno music. It's so easy, you don't have to be a 400lb hacker living in your mother's basement to do it!
Presented By:
Andy Thompson @R41nM4kr
Andy Thompson is the Strategic Advisor of Customer Success in the Southwest region for CyberArk Software. He is responsible for providing guidance in securing organizations with technologies and security best practices in order to prevent credential theft and breach. Andy spent the last 20 years in the fields of Web Development, Systems Engineering/Administration, Architecture, and the last 6 in Information Security and Architecture primarily focusing on large retail organizations. Andy is also active in the Information Security communities of Texas as a member of Shadow Systems Hacker Collective and the Dallas Hackers Association. Andy holds a Bachelor's of Science degree in Information Systems from the University of Texas at Arlington as well as the Certified Information Systems Security Professional (CISSP), and Systems Security Certified Practitioner (SSCP) certifications from (ISC)2. He is also COMPTIA Security+ Certified as well as a GIAC Certified Penetration Tester (GPEN). Andy is also a member of the SANS advisory council and CISSP instructor Previous speaking events include BSidesTampa 2017, BSides Oklahoma 2017, BSides Iowa 2017, BSides Denver 2017, BSides Cincinatti 2017, Information Warfare Summit 2016, ISSA International 2016 and others.
Closing Ceremony / Raffle #
Abstract
No description provided.