| Main Stage |
| Opening Remarks |
9:15 AM
Friday |
| Information about what all ya'll Jawn are about to experience! |
Russell Handorf |
| Keynote |
10:00 AM
Friday |
| Social media exploits and manipulation for fun and/or profit |
Dr. Rachel Greenstadt |
| [Panel] Industry Hot Takes |
11:00 AM
Friday |
| In our ever changing industry, there is always a new term, a new topic, or a new technology, and with it, comes opinions. See some of your opinionated faves draw your topic submissions at random and give their unadulterated, unmoderated, no holds barred thoughts and opinions, how spicy can we get? |
Moderator
GuardianCosmos
Panelists
gdead
Gwydd
Knarphie |
| Nothing is Safe: An Introduction to Hardware (In)Security |
1:00 PM
Friday |
| In much the same way that no lockbox is permanently safe when left in a room with a determined and skilled lockpicker, no electronic device is ever truly safe when left with a determined and skilled hardware hacker. Password protections can be bypassed with techniques such as voltage glitching (or even simpler ones such as a timing analysis!), but they may not enter a project's threat model if the engineers on that project don't know they exist. The objective of this talk is to bring awareness to the current suite of techniques a person has at their disposal to reverse engineer or otherwise "hack" an electronic device if they can hold it in their hands and probe it on their workbench. The techniques discussed will include "easy" ones (such as the password timing analysis mentioned above, and probing unencrypted, on-board signal lines), "medium" ones (such as clock- and voltage-glitching), and "hard" ones (such as differential power analysis and chip decapping). Mitigation strategies will be briefly discussed at the end (so as to not end on a sour note!), though this is not the main objective of the talk. |
Nathan Jones |
| Get More Radio Frequency Curious |
2:00 PM
Friday |
| Using Open Source Software Kismet Wireless - We review the devices and details needed for users to scan and become more Radio Frequency Investigative while getting it into a dashboard and web browser GUI to be used and viewed easily. We will attempt some live viewing of these things around us. |
BusySignal |
| The Rapid Disappearance of Digital Games as Seen in Japanese Feature Phones |
3:00 PM
Friday |
| This presentation will discuss the precariousness of digital games using Japanese feature phones as a case study. We will look at why most of these games have disappeared, why this disappearance is a major cultural loss, and what we can do in the future to prevent a media wipe out on the digital game platforms we use today. |
Ellen Cooper |
| The Remote Grift: Cunning Meets Naivete, and the Victims Become the Criminals [Off the Record Talk] |
4:00 PM
Friday |
For DFIR professionals, the remote grift is no mystery. It's a hybrid crime, blending an old-fashioned con with technical tools. The grifter is cunning. The victim is trusting - a classic 'mark.' The grifter manipulates the mark, who unknowingly commits a crime. The only fingerprints at the scene belong to the mark.
In this session, we'll explore several real-life incident responses where the victim ended up in handcuffs. We'll reveal details that don't make the headlines. |
Ira Victor |
| Classroom XYZ |
| Stingrays: Who Ya Gonna Call? |
9:00 AM
Saturday |
Who ya gonna call when a Stingray shows up at your con, protest, or street corner? These phantom cell-towers formally known as cell-site simulators (CSS) masquerade as legit cell towers, tricking your phone into connecting so they can slurp up IMSIs, track devices, and sometimes even intercept communications. The problem? They operate in stealth mode, and despite years of rumors, court cases, and conspiracy theories, we're still flying blind. Nobody really knows how often we're caught in their dragnet.
This talk will show how Rayhunter works, why it fills a critical gap in current detection methods, and what early field ops are revealing. Attendees will learn how to spin up their own Rayhunter, contribute to the collective hunt, share the logs, and help the community map one of the most secretive surveillance technologies in existence. |
Michael Raymond |
| Seriously, this should be the last one... |
10:00 AM
Saturday |
| As technology advances faster and faster, it carries us further and further away from the real connections we used to have with our technology. Because of this, some people find themselves drawn to 'the old days' to connect with our earlier roots in hacking and computing. Like people who cosplay Medieval times or collect artifacts of history, as humans, we have a intrinsic desire to connect with our past. As technology enthusiasts, there is no better way to feel that connection than through collecting 'vintage' or retro computers. Why? Modern technology is disconnected from us. Every thing is designed for speed, convenience, and ease of replacement with the latest widget. Vintage computers bring you back to the tactile essence of computing. You had control of the computer to a far more granular level than now. Yes, we have amazing devices, FPGAs that can become just about any computing device, SDRs that you reprogram in an instant, emulators, online IDEs, augmented reality displays, but none of these can take the place of rolling up your sleeves up and 'getting dirty with the components'.
This presentation will take attendees on a trip through the whys and hows of vintage computer collecting and restoring. The talk is designed for those who either have not thought about collecting, are just getting started, or for seasoned collector attendees, to see how there experienced compares. |
Mark DeVito (Stargeezer) |
| Delete yourself: lessons learned from OSINT [Off the Record Talk] |
11:00 AM
Saturday |
| This talk will walk attendees through the journey of working as an OSINT analyst to deleting yourself from common data brokers. The talk will cover the realities of what private investigations OSINT analysts look for and how to ultimately obscure an identity to render that work useless. |
50m3one |
| The importance of thinking of security while designing software: through the lens of case studies |
1:00 PM
Saturday |
| A lot of development teams will tackle practices like documentation, performance analysis and security hardening after a feature is complete. However, since these practices are not treated as a part of the development process, they rarely have any impact on the developed feature. Punting on documentation prevents developers from really validating user experience. Conducting performance analysis at the end limits efficient design decisions during implementation. Security hardening as an afterthought results in bad designs that are hard to backtrack from. This talk will survey how some software systems historically made bad design decisions when not incorporating security as part of the process. |
Shayan Patel |
| Everything I Need To Know About Cybersecurity I Learned From Building Networks in Alaska |
2:00 PM
Saturday |
| Part history lesson, part cybersecurity advice, Bruce will talk about building networks both large and small in Alaska in the mid-1990's. Dropping out of college and with very little network experience, Bruce worked with talented people to learn and help build networks throughout the state. He will discuss the history of Internet access in the state including local dial-up ISP's, state and university networks, and the evolution of commercial broadband. Bruce will also examine what advanced WAN engineering looked like in a place where there are almost as many moose as people, and lessons he learned that served him well in his future career in cybersecurity. Lots of story telling, lots of old technology, and lots of lessons learned. |
Bruce Potter |
| Making the GameTank - A New, Real 8-Bit Game Machine |
3:00 PM
Saturday |
| The GameTank is a new, genuine 6502-powered 8-bit game console, that anyone can build, build for, and build on! How the heck did we pull that off in the 21st century? Find out how one enterprising individual assembled the powers of open source hardware and the local hacker community to devise this deceptively complex device, from prototyping through production, concept to concrete - and learn how you can join in! |
Clyde |
| Main Stage |
| Bluetooth Warwalking: Hacking the Airwaves with Your Phone and a Pair of Sneakers |
9:00 AM
Saturday |
What if the most vulnerable access point in a business isn't a Wi-Fi network or phishing email-but a Bluetooth speaker hidden behind the counter? In this talk, I'll walk you through the overlooked attack surface of open and misconfigured Bluetooth devices, discovered while warwalking through urban environments with nothing more than a regular smartphone - and occasionally a Flipper Zero.
From hijacking audio systems to sending rogue print jobs to receipt printers, I'll share real examples of how Bluetooth devices in the wild can expose businesses to unauthorized control and data leakage. This session is both a wake-up call and a hands-on walkthrough of what attackers can do with minimal gear and maximum curiosity. |
Matt Miller
(kn0ck0ut) |
| Masscan the Internet with a Twist - Misconfigurations and RFC Violations [Off the Record Talk] |
9:30 AM
Saturday |
| The public-facing Internet is a wild and sometimes scary place. This talk will touch on the kind of stuff you can normally see on the Internet, network misconfigurations that expose even more, and a peek into what you can see when people treat RFCs like a suggestion! |
Livebeef |
| Why integer factorization is so f***ing hard: a history |
10:00 AM
Saturday |
Integer factorization (breaking down a whole number into its prime factors) is an action that many of us (and certainly computers) do every day, but which we take for granted. Figuring out if a number is prime and decomposing a composite number into its prime factors is actually pretty hard... Have you ever paused to ask why?
This talk traces the history of integer factorization, from Fermat's 17th-century breakthrough to the status of integer factorization and the General Number Field Sieve (GNFS). We'll watch trial division fail spectacularly, see how the Quadratic Sieve made 100-digit ""impossible to factor"" numbers trivial, and witness the moment distributed computing first tasted blood with RSA-130. We will eventually work our way up to the GNFS-an algorithm so elegant (or maybe... bizarre?) it operates in parallel mathematical universes, exploiting algebraic structures that can be hard to wrap your mind around (but we'll try our best!). We'll demystify how this mathematical monster works without drowning in theory, explore why it represents the current ""final boss"" of classical factoring, and discuss why quantum computers might be the only way to level up from here. Along the way, I plan to discuss notable moments in cryptographic history, and the relationship between integer factorization algorithms and topics in cybersecurity.
As a general warning, there WILL be mathematics in this talk... but there will also be history, hacking, and horseplay. No prior number theory or mathematical experience required - just a healthy respect for algorithms and some patience. I promise this talk will be way cooler than your high school algebra class (and yes, I realize how low that bar might already be). |
ringer
Robert Weiss |
| An Indecent Proposal: A Love Story Told in 6502 ASM [Off the Record Talk] |
11:00 AM
Saturday |
| This is a story about creating an original NES game as a Marriage proposal. Completely from scratch using 6502ASM for the nes. |
[REDACTED] |
| Rolling Recon && Tire Prints: Perimeter Intrusion Detection and Remote Shenanigans via Rogue Tire Stem RF |
11:30 AM
Saturday |
In an era of encrypted comms and hardened perimeters, why breach the firewall when you can watch for [Tire Co. Redacted]?
This talk exposes how Tire Pressure Monitoring Systems (TPMS)-those chirpy, chatty little wireless tire valves-can be repurposed as passive perimeter tripwires or active remote triggers. Whether you're securing a location, testing your neighbor's paranoia levels, or just really into wheels, this RF reconnaissance technique is a clever (and totally legal-ish) way to make your mark on mobility monitoring. |
scp |
| Modem Madness - Recent Experiments with Dial-up Modems |
1:00 PM
Saturday |
Once the premier way to access the Internet and different computer systems, the venerable dial-up modem has mostly been ignored and pushed by the wayside as it has been replaced with newer technologies. However, over the past few years we've been using modems in a collection of projects that give them a new lease on life.
In this talk we will discuss several projects we have been working on that utilize modems, debunk myths about using modems in the present day, and outline our future efforts in the space. If we're lucky, we may inspire you to dust off your old modem and put it back to work! |
Mike Dank
Naveen Albert |
| Connecting Social Engineering Education to OWASP Through Experiential Design [Off the Record Talk] |
2:00 PM
Saturday |
| How do you teach undergraduates to think like social engineers without crossing ethical or legal boundaries? This talk presents the design and infrastructure behind a new classroom project where students explore human-centered vulnerabilities through staged environments. By simulating the reconnaissance phase of the OWASP Web Security Testing Guide (WSTG), the project demonstrates how the human element is often the key to initiating technical exploits. Using only a WordPress-based mock company, carefully crafted fake documents, and in-person props, students are guided through safe, low-tech exercises such as dumpster diving and baiting. These activities help them understand how attackers piece together discarded fragments of information into powerful pretexts, often as the initial vector for attacks found in the OWASP Top 10. |
Aunshul Rege
Jonathan Dobisch |
| From Polyglots to Prompt Injections: Parsing is Still Execution (And Your LLM Didn't Get the Memo) |
3:00 PM
Saturday |
Remember when we thought parsing untrusted data was hard? Welcome to 2025, where your PDF is also a Nintendo ROM, your resume photo contains hidden SQL, and your helpful AI assistant just `rm -rf`'d your home directory because someone asked it nicely.
This talk bridges classic file format exploitation techniques with modern LLM security through the lens of Language-theoretic Security (LangSec). We'll start with examples of polyglot files that execute differently depending on the parser, then show how the exact same principles apply to AI vulnerabilities like model backdoor, prompt injection, multimodal, and Model Context Protocol attacks.Bring your polyglot files, your prompt injections, and your sense of humor. The parsers are still broken, they're just fancier now. |
Evan Sultanik |
| Closing Remarks |
4:00 PM
Saturday |
| Let's see how this went! |
Russell Handorf |