DEF CON 33

August 7-10, 2025 · Las Vegas, NV · 249 talks

The world's largest underground hacking conference. 99 main stage talks spanning hardware exploitation, web security, AI attacks, nation-state TTPs, and everything in between. Every talk includes slides from media.defcon.org.

→ See editor’s top picks at DEF CON 33

• DisguiseDelimit: Exploiting Synology NAS with Delimiters and Novel Tricks — Ryan Emmon

  Ryan Emmons, a staff security researcher at Rapid7, delivered this talk to chronicle his zero-day research into Synology network-attached storage (NAS) devices and the $40,000 prize it earned him at t

• Browser Extension Clickjacking: One Click and Your Credit Card Is Stolen — Marek Tóth

  Browser extensions occupy a uniquely dangerous position in the web security ecosystem. They run with elevated privileges, can observe and modify web content across every tab, and are trusted by defaul

• Can't Stop the ROP: Automating Universal ASLR Bypasses — Bramwell Brizendine

  Address Space Layout Randomization (ASLR) has long been hailed as one of the most consequential mitigations Microsoft has deployed against memory corruption exploits on Windows. By randomizing the bas

• Breakin 'Em All – Overcoming Pokemon Go's Anti Cheat Mechanism — Tal Skverer

  Pokémon Go launched in July 2016 and immediately became a global phenomenon, blending augmented reality with a location-based game mechanic that required players to physically move through the world.

• BitUnlocker: Leverage Windows Recovery to Extract BitLocker Secrets — Alon Leviev, Netanel Ben Simon

  BitLocker is Microsoft's flagship full-disk encryption feature, and for years it has been the frontline defense against physical theft attacks — the scenario where an adversary steals your laptop and

• Gateways to Chaos - How We Proved Modems Are a Ticking Time Bomb — Chiao-Lin Yu

  Home modems and residential gateways occupy a uniquely dangerous position in modern network architecture: they sit entirely outside the security perimeter that organizations and consumers meticulously

• New Red Team Networking Techniques for Initial Access and Evasion — Shu-Hao Tung

  In this DEF CON 33 talk, red team researcher Shu-Hao Tung from Taiwan presents a suite of novel network-layer attack techniques that challenge common assumptions about corporate perimeter security. Th

• Ghost Calls - Abusing Web Conferencing for Covert Command & Control — Adam Crosser

  Command and control (C2) infrastructure is the nervous system of an adversary operation. Once a foothold is established on a target environment, attackers need a reliable, stealthy channel to issue co

• Carding, Sabotage & Survival: A Darknet Market Veteran's Story — Godman666

  In a candid and often harrowing first-time DEF CON talk, the speaker known as Godman666 delivered an unfiltered, first-person account of over 15 years in the underground economy — spanning carding, da

• Building a Malware Museum — Mikko Hypponen

  Mikko Hypponen's DEF CON 33 keynote is equal parts cultural manifesto and preservation call-to-arms. The longtime Chief Research Officer at WithSecure argues that the security community is the only gr

• 7 Vulns in 7 Days - Breaking Bloatware Faster Than It's Built — Leon Jacobs

  Leon Jacobs, a security researcher from Orange Cyber Defense's Sense Post team, spent a portion of his summer holiday noticing something odd: an ASUS DriverHub utility installed silently on his gaming

• Recording PCAPs from Stingrays With a $20 Hotspot — Cooper Quintin, oopsbagel

  Cell-site simulators — commonly known as Stingrays, IMSI catchers, or IMEI grabbers — are surveillance devices used by law enforcement agencies worldwide to track and intercept mobile devices. Despite

• Help! Linux in my Webcam! — Mickey Shkatov, Jesse Michael

  Most people think of a webcam as a simple optical sensor with a USB cable. Plug it in, the operating system loads a driver, and a video stream appears. The security model, implicitly, is that the webc

• Breaking Wi-Fi Easy Connect: A Security Analysis of DPP — George Chatzisofroniou

  Wi-Fi has a long history of protocols that trade security for convenience and then regret it. WPS — Wi-Fi Protected Setup — was designed to simplify device onboarding onto wireless networks using shor

• Turning your Active Directory into the attacker's C2 — Quentin Roland, Wilfried Bécard

  Group Policy Objects (GPOs) are one of the most powerful — and most underappreciated — attack surfaces in Active Directory environments. At DEF CON 33, penetration testers Quentin Roland and Wilfried

• Exploiting Vulns in EV Charging Comms — Jan Berens, Marcell Szakály, Sebastian Köhler

  Electric vehicle charging infrastructure runs on a stack of aging, largely unpatched hardware. The data link that negotiates charging sessions between a car and a DC fast charger uses Power Line Commu

• Journey to the center of PSTN - I became a phone company — Enzo Damato

  Enzo Damato's DEF CON 33 talk is a tour-de-force walkthrough of the Public Switched Telephone Network (PSTN) from the inside—not from the perspective of a hacker probing someone else's infrastructure,

• Amber64 - Mining Hacker History from Over 500k Commodore 64 Disks — Wesley McGrew

  Forty years ago, teenagers with Commodore 64 computers were dialing into bulletin board systems with stolen calling card codes, trading pirated software with groups operating across international bord

• Win-DoS Epidemic - Abusing RPC for Win-DoS & Win-DDoS — Or Yair, Shahak Morag

  Or Yair and Shahak Morag from SafeBreach presented a comprehensive study of Denial of Service (DoS) vulnerabilities in Windows, centered on the abuse of Remote Procedure Call (RPC) interfaces. Their r

• ReVault! Compromised by your Secure SoC — Philippe Laulheret

  Philippe Laulheret, a senior vulnerability researcher at Cisco Talos, presents a comprehensive attack chain against Dell's ControlVault 3 — a dedicated security System-on-Chip (SoC) found in over 100

• How to secure unique ecosystem shipping 1 billion+ cores? — Adam Zabrocki, Marko Mitic

  Adam Zabrocki and Marko Mitic, both from NVIDIA's offensive security team, present a rare and candid look inside how one of the world's largest silicon and AI platform companies approaches security ac

• LLM Identifies Info Stealer Vector & Extracts IoCs — Olivier Bilodeau, Estelle Ruellan

  Information stealers are among the most damaging commodity malware families in circulation today. They silently harvest credentials, cryptocurrency wallets, and any other extractable data from infecte

• AutoDetection & Exploitation of DOM Clobbering Vuln at Scale — Zhengyu Liu, Jianjia Yu

  DOM Clobbering is a class of web vulnerability that has existed since browser developers decided that HTML elements with `id` or `name` attributes should be accessible as properties on the global `win

• Playing Dirty w/o Cheating - Getting Banned for Fun — Sam Collins, Marius Muench, Tom Chothia

  Modern anti-cheat systems are some of the most sophisticated rootkits deployed at consumer scale. They run at kernel level, intercept system calls, monitor loaded drivers, and in some cases enforce in

• One Key, Two Key, I Just Stole Your goTenna Key — Erwin Karincic, Dale Wooden

  When traditional communications infrastructure fails during disasters, first responders and emergency personnel turn to off-grid mesh radio networks like those provided by goTenna. These devices form

• Metal-as-a-Disservice: Exploiting Legacy Flaws in Cutting Edge Clouds — Bill Demirkapi

  The rise of GPU-focused cloud providers has created a new class of infrastructure security problems. Unlike established hyperscalers such as AWS, Azure, and Google Cloud — which have invested more tha

• AppleStorm - Unmasking the Privacy Risks of Apple Intelligence — Yoav Magid

  AppleStorm is a research project by Yoav Magid that investigates the privacy implications of Apple Intelligence—Apple's on-device and cloud AI platform launched in late 2024. The research was sparked

• 'We are currently clean on OPSEC' - The Signalgate Saga — Micah Lee

  In March 2025, the world witnessed what security researcher Micah Lee described as "unbelievable incompetence from the highest levels of the Trump administration" — the Signalgate scandal. The inciden

• The Ghost of Internet Explorer in Windows — George Hughey, Rohit Mothe

  George Hughey and Rohit Mothe from Microsoft's Security Response Center (MSRC) delivered a deep technical examination of how Internet Explorer's security zone model — code written in the 1990s — conti

• Turning Microsoft's Login Page into our Phishing Infrastructure — Keanu Nys

  Keanu Nys presents a class of abuse techniques that weaponize legitimate Microsoft authentication infrastructure — specifically Microsoft's own login pages and identity services — to conduct convincin

• Making a custom Hashcat module to solve a decade-old puzzle challenge — Joseph Gabay

  About ten years ago, an anonymous person posted a puzzle challenge to the internet. The prize: one Bitcoin, locked in a "brain wallet." To claim it, a solver would need to work through 20 cryptographi

• Mastering Apple Endpoint Security for Advanced macOS Malware Detection — Patrick Wardle

  Apple's Endpoint Security framework (ESF) is the official, Apple-sanctioned mechanism for building security products on macOS. It replaced the deprecated kext-based approach and is the foundation upon

• Invoking Gemini Agents with a Google Calendar Invite — Ben Nassi, Or Yair, Stav Cohen

  A team of three researchers — Ben Nassi (Black Hat board member and Tel Aviv University faculty), Or Yair (security research team leader at SafeBreach), and Stav Cohen (Technion PhD student) — present

• The UnRightful Heir - My dMSA Is Your New Domain Admin — Yuval Gordon

  Yuval Gordon, a security researcher at Akamai Technologies, presented a critical vulnerability in Windows Server's newest identity feature: Delegated Managed Service Accounts (dMSA). Introduced by Mic

• Infecting the Boot to Own the Kernel — Alejandro Vazquez, Maria San Jose

  Bootkits and rootkits represent some of the most powerful and most feared categories of malware. They persist below the operating system, survive reinstallation, and can subvert every security control

• TSPU: Russia's Firewall and Defending Against Digital Repression — Benjamin Mixon-Baca

  Benjamin Mixon-Baca delivered a deeply technical dissection of Russia's TSPU (Tekhnicheskoe Sredstvo Protivodeystviya Ugrozam, or Technical Means to Counter Threats) — the in-path deep packet inspecti

• Unveiling the Perils of the TorchScript Engine in PyTorch — Ji'an Zhou, Lishuo Song

  This DEF CON 33 talk—titled in full "Safe Harbor or Hostile Waters: Unveiling the Hidden Perils of the TorchScript Engine in PyTorch"—presents a systematic security analysis of PyTorch's TorchScript e

• Preventing One of The Largest Supply-Chain Attacks in History — Maksim Shudrak

  Security researcher Maksim Shudrak delivered one of DEF CON 33's most concrete supply-chain attack analyses by doing something no prior researcher had done at scale: he actually claimed 5,155 abandone

• Building the first open source hackable Quantum Sensor — Mark Carney, Victoria Kumaran

  Mark Carney and Victoria Kumaran, co-founders and co-organizers of Quantum Village at DEF CON, presented "Diamonds Are For Hackers" — a talk about building the world's first fully open source, hackabl

• Automated Unpacking & Deobfuscation of Nested VM-Based Protectors — Agostino Panico

  Agostino Panico (known as "Vanish") presents VM Dragon Slayer — an open-source framework for automatically defeating virtualization-based obfuscation (VBO) protectors, including multiple nested layers

• SCCM: The tree that always bears bad fruits — Mehdi Elyassa

  Microsoft Configuration Manager — still widely known in the industry as SCCM (System Center Configuration Manager) — is one of the most privileged and most abused systems in enterprise Windows environ

• Rebadged, Relabeled, Rooted: Pwnage via Solar Supply Chain — Anthony Rose, Jake Krasnov

  Solar energy infrastructure is expanding rapidly across residential, commercial, and utility scales — but its supply chain is riddled with security problems that most buyers never think to ask about.

• Emulating Embedded Linux Devices at Scale w LightTouch Firmware Rehosting — Sigusr Polke

  Vulnerability research on embedded Linux devices — the routers, access points, and network appliances that constitute much of the internet's physical layer — has historically required either physical

• Bypassing Intent Destination Checks, LaunchAnyWhere Privilege Escalation — Qidan He

  LaunchAnyWhere is one of Android's most consequential historical vulnerability classes: an unprivileged application leveraging a privileged bridge to invoke protected or unexported activities on its b

• Stories from a Tor dev — Roger Dingledine

  Roger Dingledine co-created the Tor anonymity network over two decades ago, and at DEF CON 33 he delivered something rare in security conference talks: a frank, first-person narrative of what it actua

• Unmasking the Snitch Puck: IoT surveillance tech in the school bathroom — Reynaldo, nyx

  Two researchers — one a recent high school graduate, one an experienced hardware hacker — conducted a comprehensive teardown and security audit of the Halo 3C, an IoT surveillance device manufactured

• Mac PRT Cookie Theft & Entra ID Persistence — Shang-De Jiang, Dong-Yi Ye, Tung-lin Lee

  This DEF CON 33 talk—titled in full "Original Sin of SSO: macOS PRT Cookie Theft & Entra ID Persistence via Device Forgery"—presents a novel attack chain against Microsoft Entra ID (formerly Azure Act

• Finding and Exploiting Kernel Vulnerabilities in the eBPF Subsystem — Agostino Panico

  > **Editor's Note:** This talk attracted substantial post-conference scrutiny. In late September 2025, Alexander Peslyak (Solar Designer) published a thread on the Openwall oss-security mailing list r

• HTTP 1.1 Must Die! The Desync Endgame — James Kettle

  James Kettle's fourth annual DEF CON session on HTTP desync attacks represents both the culmination of a multi-year research program and a sobering conclusion: the attack class has not been resolved,

• Pre-Auth RCE, Arbitrary SMS & Adjacent Attacks on 5G and 4G/LTE Routers — Edward Warren

  Edward Warren, a senior cybersecurity analyst who conducted this research while working at a security operations center, presents a series of vulnerabilities in Tuoshi and Cufi branded 5G and 4G/LTE m

• CTRAPS-CTAP Impersonation, API Confusion Attacks on FIDO2 — Marco Casagrande, Daniele Antonioli

  FIDO2 is the current gold standard for phishing-resistant multi-factor and passwordless authentication, deployed by major platform vendors and recommended by CISA, NIST, and enterprise security guidan

• Client or Server? Hidden Sword of Damocles in Kafka — Ji'an Zhou, Ying Zhu, ZiYang Li

  Apache Kafka is the backbone of modern data-intensive architectures. Deployed by thousands of enterprises for real-time data pipelines, event streaming, and critical application integration, a single

• Siriously Leaky: Exploring Overlooked Attack Surfaces in Apple's Ecosystem — Richard Im

  Apple's iOS security model rests on a layered architecture combining hardware-backed authentication, process isolation via XPC, and tightly scoped permission frameworks. The implicit promise to users

• Passkeys Pwned: Turning WebAuthn Against Itself — Shourya Pratap Singh, Jonny Lin, Daniel Seetoh

  Passkeys are widely positioned as the successor to passwords — phishing-resistant, cryptographically bound to origins, and immune to replay attacks. Google, Apple, Microsoft, and major enterprise plat

• China's 5+ year campaign to penetrate perimeter network defenses — Andrew Brandt

  For more than five years, a collection of threat actors affiliated with the Chinese state systematically identified, weaponized, and exploited vulnerabilities in enterprise perimeter network devices —

• Cyber Volunteering & Community Defense 1 yr in - DC Franklin — Sarah Powazek, Jake Braun, Adrien Ogee

  Most DEF CON talks center on offensive techniques, novel vulnerabilities, or adversary tradecraft. This one is different. At DEF CON 33, Sarah Powazek, Jake Braun, and Adrien Ogee presented a frank on

• Cash, Drugs, and Guns - Why Your Safes Aren't Safe — Mark Omo, James Rowley

  Mark Omo and James Rowley spent two years reverse-engineering electronic safe locks—primarily the SecuRAM lock series used by Liberty Safe and other major safe manufacturers—and found a systematic set

• Exploiting Security Side Channels in E2E Encrypted Messengers — Gabriel Gegenhuber, Maximilian Günther

  End-to-end encryption (E2EE) is the centerpiece of modern secure messaging. Signal, WhatsApp, and similar applications are built on the premise that even the platform operator cannot read user message

• Not Just a Pipeline Leak: Reconstructing Real Attack Behind tj-actions — Aviad Hahami

  On March 14, 2025, an attacker compromised the popular GitHub Actions repository `tj-actions/changed-files` and injected code that printed CI runner secrets to job logs. The widely reported story was

• Remote code execution via MIDI messages — Anna Antonenko

  Anna Antonenko — a firmware developer at Flipper Devices who describes herself as a "decent forward engineer but not a great reverse engineer" — presents the discovery of what she characterizes as a b

• Kill Chain Reloaded: Abuse legacy paths for stealth persistence — Alejandro Hernando, Borja Martinez

  Modern Windows security — Secure Boot, Virtualization-Based Security (VBS), Credential Guard, Hypervisor-Protected Code Integrity (HVCI), and kernel-level EDR telemetry — has raised the bar for mainta

• Conjuring Hardware Failures for Cross-ring Privilege Escalation — Christopher Domas

  Machine Check Exceptions (MCEs) are among the most catastrophic events an x86 processor can experience: they signal that hardware — the CPU itself, memory controllers, cache hierarchy, or system buses

• Escaping the Privacy Sandbox with Clientside Deanonymization Attacks — Eugene Lim

  Google's Privacy Sandbox is the industry's most ambitious attempt to replace third-party cookies with privacy-preserving alternatives for the web advertising ecosystem. Conceived as a way to maintain

• So Long, and Thanks for All the Phish — Harrison Sand, Erlend Leiknes

  Harrison Sand and Erlend Leiknes, both penetration testers at Norwegian security firm Mnemonic, delivered a methodical account of how they traced a single phishing SMS — impersonating the Norwegian Po

• You snooze you lose: RPC Racer winning RPC endpoints against services — Ron Ben Yizhak

  The Windows Remote Procedure Call (RPC) protocol is the backbone of interprocess communication on Windows systems, used by virtually every service in the OS and by countless enterprise applications. A

• Inside Look at a Chinese Operational Relay Network — Michael Torres, Zane Hoffman

  Michael Torres (MTU) and Zane Hoffman (Earl) present a months-long investigation that began with a simple research question — "what secrets are people accidentally publishing in Docker Hub container i

• Man in the Malware: Intercepting Adversarial Communications — Ben Folland

  Ben Folland's DEF CON 33 talk presents a threat intelligence methodology for intercepting malware communications—specifically, the C2 (command and control) channels and data exfiltration pipelines of

• Kill List: Hacking an Assassination Site on the Dark Web — Carl Miller, Chris Monteiro

  This talk is one of the most unusual presentations ever given at DEF CON: a meticulous account of how a darknet investigator (Chris Monteiro) and a think-tank researcher (Carl Miller) spent nearly a d

• Investigating Threat Actor Targeting Researchers, Academics — Christophe Tafani-Dereeper, Matt Muir

  Christophe Tafani-Dereeper and Matt Muir from Datadog presented "Weaponizing Trust," a detailed investigation into a threat actor they designate MUD-1244, which they began tracking in December 2024. M

• How a vuln in dealer software could've unlocked your car — Eaton Zveare, Roshan Piyush

  Eaton Zveare presents research he titles "Unexpected Connections" — a vulnerability in obscure automotive dealer management software that cascaded into full administrative control of an entire automot

• Voice Cloning Air Traffic Control: Vulnerabilities at Runway Crossings — Andrew Logan

  Andrew Logan, an audio engineer attending his fourth DEF CON, presents a sobering threat scenario: the use of AI voice cloning technology to impersonate air traffic controllers on VHF aviation communi

• Virtualization Based Insecurity: Weaponizing VBS Enclaves — Ori David

  Windows Virtualization Based Security (VBS) is Microsoft's flagship security architecture innovation of the past decade, isolating the most sensitive OS components — credential stores, security polici

• Where's My Crypto, Dude? The Ultimate Guide to Crypto Money Laundering — Thomas Roccia

  In February 2025, North Korean threat actors stole $1.4 billion from the Bybit cryptocurrency exchange — the largest single theft in the history of cryptocurrency — and then laundered the money with b

• Breaking into thousands of cloud-based VPNs with one bug — David Cash, Rich Warren

  Zero Trust Network Access (ZTNA) products — marketed as the successor to legacy VPNs — are increasingly deployed across enterprise environments following high-profile Ivanti, Pulse Secure, and Fortine

• Rusty pearls: Postgres RCE on cloud databases — Tal Peleg, Coby Abrams

  PostgreSQL is one of the most widely deployed open-source relational databases in the world, and virtually every major cloud provider — AWS, Azure, GCP, and others — offers a managed PostgreSQL servic

• How to Fake a Badge like a Pro: Counterfeiting Event Credentials — Russell Phillips

  The event credentialing industry has operated on a foundation of security through obscurity for decades. Badges, wristbands, lanyards, and stickers guard entry to everything from music festivals to pr

• From Shanghai to the Shore: Threats in Global Shipping — Kenneth Miltenberger, Nicholas Fredericksen

  Lieutenant Commanders Kenneth Miltenberger and Nicholas Fredericksen of the United States Coast Guard present a maritime cybersecurity briefing focused on a specific, underappreciated threat: Chinese-

• OverLAPS: Overriding LAPS Logic — Antoine Goichot

  Microsoft's Local Administrator Password Solution (LAPS) is one of the most widely deployed defenses against lateral movement in enterprise Windows environments. By ensuring every managed endpoint has

• Turning Camera Surveillance on its Axis — Noam Moshe

  Noam Moshe, Team Lead and Lead Vulnerability Researcher at Claroty, presented an investigation into critical vulnerabilities in Axis Communications IP cameras — enterprise-grade surveillance equipment

• Silent Leaks: Harvesting Secrets from Shared Linux Environments — Cernica Ionut Cosmin

  Cernica Ionut Cosmin, an application security engineer and bug bounty hunter, presents a systematic examination of information leakage vectors in shared Linux environments — hosting panels, developmen

• Hacking OBD II Emissions Testing — Archwisp

  What happens when a security researcher buys a rotary-engined sports car that kills catalytic converters, moves from a state without emissions testing to one that has strict emissions laws, and decide

• The Ultimate Hack: Applying Lessons Learned from the loss of TITAN — John Mauger

  On June 18, 2023, five people were sealed inside the Titan submersible and began their descent to 3,800 meters below the surface of the North Atlantic, bound for the wreck of the Titanic. None of them

• Shaking Out Shells with SSHamble — HD Moore

  SSH has long been treated as a solved problem — a cryptographically sound protocol that, once properly deployed, provides a trustworthy remote administration channel. That assumption has eroded sharpl

• Paywall Optional: Stream for Free w/ New Technique, RRE — Farzan Karim

  Modern streaming platforms and paywalled services invest heavily in content delivery infrastructure, licensing enforcement, and DRM — yet the authorization logic that gates entitlement to that content

• Mind the Data Voids: Hijacking Copilot Trust — Tobias Diehl

  Microsoft Copilot integrates the Bing search engine as a live retrieval backend — when users ask about topics not covered by Copilot's training data, it fetches current information from Bing and uses

• Reversing approaches to extract embedded scripts in macOS malware — Patrick Wardle

  Malware analysis is fundamentally a triage and classification problem. When a new sample arrives, the analyst's first goal is to determine whether it is benign, known-malicious (already documented and

• Orion: Fuzzing Workflow Automation — Max Bazalii, Marius Fleischer

  Orion is a fuzzing workflow automation platform developed by Max Bazalii and Marius Fleischer at NVIDIA's offensive security team. Presented at DEF CON 33, the talk addresses a persistent pain point i

• No VPN Needed? Cryptographic Attacks Against the OPC UA Protocol — Tom Tervoort

  OPC UA (Unified Architecture) is the dominant open-standard protocol for industrial automation, connecting PLCs, SCADA systems, and remote monitoring endpoints in facilities ranging from gas pipelines

• Advanced Active Directory to Entra ID Lateral Movement Techniques — Dirk-jan Mollema

  Dirk-jan Mollema, founder of Outsider Security, presented new and advanced techniques for lateral movement from an on-premises Active Directory (AD) environment to Microsoft Entra ID (formerly Azure A

• Ghosts of REvil: Inside Look with Hacker Behind Kaseya Ransomware Attack — Jon DiMaggio, John Fokker

  Jon DiMaggio and John Fokker present an inside account of the REvil ransomware operation, centered on exclusive access to and conversation with a hacker directly involved in the 2021 Kaseya VSA supply

• RATs & Socks: Abusing Google Services — Valerio Alessandroni

  Legitimate cloud services have increasingly become the preferred communication backbone for sophisticated malware — a technique sometimes called "living off trusted services" (LOTS). By channeling com

• SSH-nanigans: Busting Open the Mainframe's Iron Fortress through Unix — Philip Young

  IBM mainframes (z/OS systems) are among the most security-hardened computing platforms on earth. They run global financial transactions, process enormous volumes of government and healthcare data, and

• Direct Memory Access Everywhere — Joe FitzPatrick, Grace Parrish

  Direct Memory Access (DMA) attacks have been a fixture in hardware security research for decades. The threat model is straightforward in principle: an attacker who gains physical access to an exposed

• Blind Trailer Shouting — Ben Gardiner

  Semi-trailer trucks share public roads with millions of other vehicles. Their braking systems are safety-critical infrastructure — a compromised brake controller on a tanker trailer is not an abstract

• Loading Models, Launching Shells: Abusing AI File Formats for Code Execution — Cyrus Parzian

  The explosion of AI model sharing has created a new attack surface that combines the risks of untrusted code execution with the trust dynamics of scientific software distribution. At DEF CON 33, Cyrus

• Killing Killnet — Alex Holden

  Killnet was one of the most publicly visible Russian hacktivist groups of the post-2022 era. With a Telegram channel in the tens of thousands of followers, regular appearances in Russian state media,

• Planting C4: Cross-Compatible External C2 for All Your Implants — Scott Taylor

  Scott Taylor's DEF CON 33 talk introduces C4—Cross-Compatible External C2—a framework for building command-and-control infrastructure that operates as an intermediary between diverse red team implants

• 40 Years of Phrack: Hacking, Zines & Digital Dissent — richinseattle, Netspooky, Chompie

  Phrack is the longest-running hacker technical publication in existence. Born in 1985 on a BBS in an era before the World Wide Web, it has survived Secret Service raids, legal battles, the commerciali

• Claude: Climbing a CTF Scoreboard Near You — Keane Lucas

  Keane Lucas from Anthropic's Frontier Red Team presented a detailed experimental study of Claude's performance on Capture the Flag (CTF) competitions across a broad range of security categories. The r

• Redefining Purple Teaming for Max impact - A Pennington, S Marrone, L Proehl — Sydney Moroni, Lauren Pill

  In an insightful panel discussion at DEF CON, security experts Sydney Moroni, Lauren Pill, and Adam Pennington explored the evolving landscape of **purple teaming** and **adversary emulation**. The…

• Go Malware Meets IoT - Challenges, Blind Spots, and Botnets — Asher Davila

  This talk, presented by Asher Davila and Chris from Palaton Networks, delves into the growing trend of malware written in Google's Go programming language, specifically focusing on its impact on…

• From Pwn to Plan: Turning Physical Exploits Into Upgrades — Shawn

  In this compelling DEF CON presentation, Shawn, a seasoned physical red teamer, challenges the traditional "hack and report" mentality prevalent in security assessments. Titled "From Pwn to Plan…

• Deepfake Image and Video Detection — Mike Raggo

  In an era increasingly saturated with synthetic media, the ability to discern genuine content from sophisticated fabrications is paramount. This talk, delivered by veteran security researcher Mike…

• Hacker v. Triage - Inside Bug Bounty Battleground — Richard Hyunho Im, Denis Smajlović

  In the DEF CON talk "Hacker v. Triage - Inside Bug Bounty Battleground," security researcher Richard Hyunho Im and Principal Security Consultant Denis Smajlović delve into the often-strained…

• The Anatomy of a Crypto Scam — Nick Percoco, Kitboga

  In an engaging and often humorous presentation at DEF CON, Nick Percoco, Chief Security Officer at Kraken, and Kitboga, a renowned scam baiter and YouTuber, delved into the pervasive and…

• Winners of DARPA’s AI Cyber Challenge — Andrew Carney, Jason Roos, Stephen Winchell

  The DARPA AI Cyber Challenge (AICC) is a landmark public competition aimed at revolutionizing software security by developing autonomous systems capable of discovering and patching vulnerabilities…

• Intro to Physical Security Bypass — Karen Ng, Matthew Cancilla

  In "Intro to Physical Security Bypass," Karen Ng and Matthew Cancilla deliver a rapid-fire exploration of common physical security vulnerabilities, demonstrating how many seemingly secure entry…

• Thinking Like a Hacker in the Age of AI — Richard 'neuralcowboy' Thieme

  In his captivating DEF CON talk, "Thinking Like a Hacker in the Age of AI," Richard 'neuralcowboy' Thieme, a revered figure who has spoken at 27 DEF CONs over three decades, delivered a profound…

• Regex For Hackers — Adam 'BuildHackSecure' Langley, Ben 'nahamsec' Sadeghipour

  In their DEF CON talk, "Regex For Hackers," Adam Langley and Ben Sadeghipour, co-founders of Hackinghub, delivered a rapid-fire, comprehensive session on the critical role of **regular expressions**…

• Hacking Context for Auto Root Cause and Attack Flow Discovery — Ezz Tahoun

  In this compelling DEF CON talk, Ezz Tahoun presents a radical rethinking of how cybersecurity organizations approach log management, correlation, and threat detection. Titled "Hacking Context for…

• Whose Slide Is It Anyway? — Killer Grizz

  The DEF CON tradition of "Whose Slide Is It Anyway?" stands as a vibrant testament to the hacker community's capacity for humor, spontaneity, and resilience. Far from a conventional technical…

• Designing and Participating in AI Bug Bounty Programs — Dane Sherrets, Shlomie Liberow

  This talk, originally titled "Securing Intelligence: How Hackers are Breaking Modern AI Systems and How Bug Bounty Programs Can Keep Up," delves into the cutting-edge intersection of artificial…

• No Brain No Gain — Mehmet Önder Key, Temel Demir, Dr Ahmet Furkan Aydogan

  This talk, "No Brain No Gain," presented by Temel Demir, Mehmet Önder Key, and Dr. Ahmet Furkan Aydogan, introduces a novel approach to authentication in **Industrial Internet of Things (IIoT)**…

• Managing Bug Bounties @ Scale — Gabriel Nitu, Jay Dancer, PayPal, Ryan Nolette, Goshak

  This DEF CON panel, "Managing Bug Bounties @ Scale," brings together industry leaders from major technology and financial companies—Splunk, Shopify, and PayPal, alongside an experienced former AWS…

• How Not to IoT:Lessons in Security Failures — Zoltan "zh4ck" Balazs

  In "How Not to IoT: Lessons in Security Failures," Zoltan "zh4ck" Balazs dissects a litany of pervasive security vulnerabilities found in common Internet of Things (IoT) devices, from smart…

• Thinking like an attacker is no longer optional — Abhijith 'Abx' B R, Keenan Skelly

  In an insightful panel discussion at DEF CON, a group of seasoned cybersecurity experts — Abhijith 'Abx' B R, Bryson Bort, Anant, and Lt. Col. Gordon Boom — delved into the critical importance of…

• No Spook Leaves Randomness to Chance — Shaanan Cohney

  In "No Spook Leaves Randomness to Chance," Shaanan Cohney, an academic researcher at the University of Melbourne, delves into the elusive question of how state-level adversaries, such as the NSA…

• Exploiting Shadow Data from AI Models and Embeddings — Patrick Walsh

  Patrick Walsh, CEO of Iron Core Labs, delivered a compelling talk at DEF CON, "Exploiting Shadow Data from AI Models and Embeddings," shedding light on the alarming ease with which sensitive data…

• All your keyboards are belong to us! — Federico Lucifredi

  In this comprehensive DEF CON talk, Federico Lucifredi, an experienced embedded engineer and co-founder of an R&D shop, delves into the often-overlooked and repeatedly rediscovered world of keyboard…

• Carding is Dead, Long Live Carding — Federico Valentini, Allesandro Strino

  This talk, "Carding is Dead, Long Live Carding," delivered by Federico Valentini and Alessandro Strino from Clifi, delves into the alarming evolution of credit card fraud, specifically highlighting…

• Threat Dynamics on the Seas — John Mauger, Michael Sulmeyer, Adam Segal

  This talk, sponsored by the Maritime Hacking Village at DEF CON, delves into the critical intersection of cybersecurity policy and geopolitical competition, specifically focusing on the Indo-Pacific…

• Fingerprint-Based Bot Blocking & Dynamic Deception — Adel Karimi

  In this DEF CON talk, Adel Karimi introduces an innovative approach to bot detection and adversary deception through network fingerprinting and dynamic response generation. His presentation, titled…

• DEF CON 33 3- Red teaming fraud prevention systems with GenAI — Karthik Tadinada, Martyn Higson

  This talk, presented by Karthik Tadinada and Martyn Higson, delves into the escalating threat of payment fraud, specifically how **Generative AI (GenAI)** is democratizing sophisticated attack…

• How NOT to Perform Covert Entry Assessments — Brent White, Tim Roberts

  In this highly engaging and refreshingly candid DEF CON talk, Brent White and Tim Roberts, seasoned physical security penetration testers with over 12 years of experience, dismantle common…

• Access to secure dependency management everywhere w Nix- T Berek, F Zakaria & D Baker — Thomas Berek, Fared, Morgan Jones

  This talk, "Rebuild the World," at DEF CON marks a significant moment as the first official DEF CON stage presentation dedicated entirely to **Nix**. Speakers Morgan Jones, Thomas Berek, and Fared…

• Passing the Torch - Mentoring and Protecting Our Students — Navaar Johnson, Sam Comini

  "Passing the Torch - Mentoring and Protecting Our Students" at DEF CON was an unconventional yet highly insightful session that transformed from a planned panel discussion into an interactive…

• Securing Agentic AI Systems and Multi-Agent Workflows — Andra Lezza, Jeremiah Edwards

  In an era witnessing the rapid proliferation of AI agents and multi-agent systems, this DEF CON talk by Andra Lezza and Jeremiah Edwards of Sage delves into the critical security considerations for…

• Scamming Scammers - Weaponizing OSS Against Pig Butchering, Organized Crime — Erin West

  Erin West, a veteran prosecutor with 26 years of experience in Santa Clara County, delivered a stark and urgent call to action at DEF CON, exposing the devastating global crisis of **pig butchering…

• Private, Private, Private Access Everywhere — Meghan Jacquot

  Meghan Jacquot's DEF CON 33 workshop, "Private, Private, Private Access Everywhere," delved into the critical subject of personal digital privacy in an era where information is increasingly…

• DC101 Panel - Alethe Denis, Nikita Kronenberg , zziks, Nicole Schwartz, Nina Alli — Alith, Nina Ali, Circuit Swan, Zeke

  This talk, titled "DC 101: Your Hacker Survival Guide to Defcon," serves as an indispensable primer for navigating the world's largest and most chaotic hacker conference, DEF CON. Presented as a…

• How malicious packages on npm bypass existing security tools — Paul McCarty

  In this compelling talk from DEF CON, Paul McCarty, Head of Research at Safety, sheds light on the escalating threat of malicious packages within the open-source ecosystem, particularly **npm**…

• So you want to make a badge? Badge Creation 101 — Jeff Geisperger

  Jeff Geisperger, also known as Big Taro, delivered an insightful and highly practical talk at DEF CON titled "So you want to make a badge? Badge Creation 101." Geisperger, a security engineer by day…

• How Extra Features In Contactless Payments Break Security, What We Can Do — Tom Chotia

  In this DEF CON talk, Tom Chotia from the University of Birmingham dives deep into the often-overlooked security implications of "extra features" added to the otherwise robust **EMV contactless…

• Hacking Hotel Locks: The Saflok Vulnerabilities Expanded -Noah Holland, Josh Stiebel — Noah Holland, Josh Stiebel

  This talk, "Hacking Hotel Locks: The Saflok Vulnerabilities Expanded," presented by Noah Holland and Josh Stiebel, delves into the pervasive security flaws within Dormakaba's Saflok and Sapphire…

• Game Hacking 101 — Julian 'Julez' Dunning

  In "Game Hacking 101," Julian 'Julez' Dunning, co-founder of **Truffle Security** and founder of the **Game Hacking Village**, delves into the fascinating intersection of video games and…

• DDoS: The Next Generation — Andrew Cockburn

  In "DDoS: The Next Generation," Andrew Cockburn from NetScout delivers a compelling and data-driven presentation on the evolving landscape of Distributed Denial of Service (DDoS) attacks. Drawing…

• SSH Honeypots and Walkthrough Workshops: A History — Ryan Mitchell

  In this engaging DEF CON talk, software engineer Ryan Mitchell, known as "clugist" at the Packet Hacking Village (PHP), delves into his dual passions: SSH honeypots and the evolution of interactive…

• State of Open Source in the Federal Government — Jordan Kasper

  Jordan Kasper's DEF CON talk, "State of Open Source in the Federal Government," delivers a candid and critical assessment of how U.S. federal agencies interact with open source software (OSS)…

• Post Quantum Panic: When Will the Cracking Begin, & Can We Detect it? — K Karagiannis

  In a stark and urgent presentation at DEF CON, K Karagiannis, Quantum Computing Services Leader at Pertivity, delivered a sobering assessment of the impending threat posed by quantum computers to…

• Elevators 101 — Bobby Graydon, Ege Feyzioglu

  In "Elevators 101," Ege Feyzioglu and Bobby Graydon from the Physical Security Village at DEF CON shed light on the often-overlooked vulnerabilities inherent in modern elevator systems. The talk…

• Quantum Resistant Healthcare — Katarina Amrichova

  Katarina Amrichova's talk, "Quantum Resistant Healthcare," addresses the critical and looming threat that quantum computing poses to current cryptographic standards, particularly within the…

• Dark Capabilities - When Tech Companies Become Threat Actors — Greg Conti, Tom Cross

  In an era where technology giants wield immense influence, Tom Cross and Greg Conti presented a provocative and deeply analytical talk at DEF CON titled "Dark Capabilities - When Tech Companies…

• The 2025 Pwnie Awards — Ian Roos, Mark Trumpbour

  The 2025 Pwnie Awards, presented at DEF CON, served as a vibrant and often humorous retrospective on the most significant achievements, spectacular failures, and critical vulnerabilities discovered…

• Fighting a Digital Blockade: View from Taiwan — Herming Chiueh, Jason Vogt, Frank Smith

  This talk, "Fighting a Digital Blockade: View from Taiwan," delves into the critical challenges Taiwan faces in maintaining digital connectivity and resilience in the event of a conflict with the…

• How Nation-State Hackers Turn Human Error into Catastrophic Failures — N Case, J McCoy

  In this DEF CON talk, "How Nation-State Hackers Turn Human Error into Catastrophic Failures," speakers N Case and J McCoy pull back the curtain on the insidious tactics employed by nation-state…

• Building Onramps for Emergency Web Archiving in Ukraine and Beyond — Quinn Dombrowski

  In the wake of Russia's full-scale invasion of Ukraine in February 2022, a critical but often overlooked battlefront emerged: the preservation of Ukraine's digital cultural heritage. Quinn…

• Third Party Access Granted : Postmortem on Student Privacy — Sharlene Toney

  In "Third Party Access Granted: Postmortem on Student Privacy," Sharlene Toney dissects the intricate and often opaque flow of student data from educational institutions to commercial data brokers…

• What Game Hackers teach us about Offensive Security & Red Teaming — Joe 'Juno' Aurelio

  In this DEF CON talk, security researcher Joe 'Juno' Aurelio explores the intricate world of game hacking, drawing compelling parallels between the techniques employed by game cheats and those…

• Defending Reddit at Scale — Pratik Lotia, Spencer Koch

  In "Defending Reddit at Scale," Spencer Koch and Pratik Lotia, veteran security engineers from Reddit, pull back the curtain on the intricate strategies and architectural decisions behind protecting…

• Satellite Networks Under Siege: Cybersecurity Challenges of Targeted DDoS — Roee Idan

  In an increasingly interconnected world, **Low Earth Orbit (LEO) satellite networks** like Starlink, OneWeb, and Kuiper are becoming indispensable. They bridge connectivity gaps in remote areas…

• Letthemin: Facilitating High Value Purple Teams Using Assumed Compromise — Sarah Hume

  In this DEF CON talk, Sarah Hume, Purple Team Service Lead at Security Risk Advisors, introduces a unique and highly effective strategy for conducting purple team engagements: the **assume…

• The Worst ICS OT Love Story Ever Told — Mike Holcomb

  Mike Holcomb's DEF CON talk, "The Worst ICS OT Love Story Ever Told," delves into the alarming state of cybersecurity within Industrial Control Systems (ICS) and Operational Technology (OT)…

• Tunnelpocalypse — Rich Compton

  Rich Compton's DEF CON talk, "Tunnelpocalypse," unveils a critical and pervasive vulnerability that significantly escalates the threat of IP spoofing and, consequently, distributed denial-of-service…

• State of the Pops: Mapping the Digital Waters — Vlatko Kosturjak, MJ Casado

  In "State of the Pops: Mapping the Digital Waters," MJ Casado and Vlatko Kosturjak present a groundbreaking, passive open-source intelligence (OSINT) investigation into the cybersecurity posture of…

• Examining Access Control Vulnerabilities in GraphQL: A Feeld Case Study — Bogdan Tiron

  In this compelling DEF CON presentation, Bogdan Tiron, a Senior Pentester at Brbridge, delivered a critical analysis of access control vulnerabilities within modern API architectures, specifically…

• Blurred Lines: Evolving Tactics of North Korean Cyber Threat Actors — Seongsu Park

  In his DEF CON talk, "Blurred Lines: Evolving Tactics of North Korean Cyber Threat Actors," Seongsu Park, a Staff Threat Researcher at Gscaler, delves into the increasingly complex landscape of…

• The Worst ICS/OT Love Story Every Told - 2025 Mike Holcomb — Mike Holcomb

  In "The Worst ICS/OT Love Story Ever Told," Mike Holcomb, a seasoned professional from Fluor, delves into the critical and often overlooked cybersecurity challenges within Industrial Control Systems…

• Escaping the Privacy Sandbox with Client Side Deanonymization Attacks — Eugene Lim

  In this insightful DEF CON talk, Eugene Lim, also known as Space Raccoon, delved into the intricacies of Google's **Privacy Sandbox** and exposed critical client-side deanonymization vulnerabilities…

• Red Russians: How Russian APT groups follow offensive security research — Will Thomas

  In this compelling DEF CON talk, Will Thomas, a Senior Threat Intelligence Adviser at Team Camry, unveils a critical trend observed over years of tracking sophisticated adversaries: Russian advanced…

• China's Health Sector Ambitions and Info Needs — Amelia Shapiro

  In this compelling DEF CON presentation, Amelia Shapiro of Margin Research delivered a critical analysis of the People's Republic of China's (PRC) strategic motivations for targeting US medical big…

• Take all my money - penetrating ATMs — Fredrik Sandstom

  Fredrik Sandstrom, a veteran penetration tester with a decade of experience in offensive security, delivers a revealing talk at DEF CON titled "Take all my money - penetrating ATMs." This…

• Pirates of the North Sea — John Andre Bjørkhaug-
• Hacking the Nautical Rules of the Road Turn Left for Global Pwnage — Amp, Data

  In an era where cyber warfare often focuses on digital infrastructure, the DEF CON talk "Hacking the Nautical Rules of the Road Turn Left for Global Pwnage" by Amp and Data pivoted the conversation…

• What’s Really in the Box? The Case for Hardware Provenance and HBOMs — Allan Friedman

  In this DEF CON talk, Allan Friedman, a prominent figure in the **Software Bill of Materials (SBOM)** movement during his decade as a US government lead for supply chain security, shifts focus to…

• ReclaimTech: A community movement — Janet Vertesi, Andy Hull

  The "ReclaimTech: A community movement" talk at DEF CON presented a compelling vision for a **grassroots social movement** aimed at empowering individuals to reclaim control over their digital lives…

• They deployed Health AI on us: We’re bringing the rights & red teams — Andrea Downing

  In this compelling DEF CON talk, Andrea Downing, co-founder and board president of the light collective, shines a critical light on the rapid deployment of Artificial Intelligence in healthcare…

• Sometimes you find bugs, sometimes bugs find you — Jasmin Landry JR0ch17

  In the dynamic world of cybersecurity, the pursuit of vulnerabilities often involves meticulous reconnaissance, advanced tooling, and complex exploit chains. However, as Jasmin Landry (JR0ch17)…

• Hacking a head unit with malicious PNG — Danilo Erazo

  In a compelling presentation at DEF CON, Danilo Erazo, founder of RE Everything, unveiled a significant **zero-day technique** targeting Kia **infotainment consoles**. The talk, titled "Hacking a…

• Never enough about cameras: Firmware keys hidden under the rug — Alexandru Lazar

  In this DEF CON talk, Alexandru Lazar, a Security Researcher at B Defender, delves into the often-overlooked security posture of IP cameras, specifically focusing on devices from Dahua Technology…

• Resilient & Reconfigurable Maritime Comms — Avinash Srinivasan, Brien Croteau

  In an era of increasing global trade and geopolitical complexities, the security and efficiency of maritime communications are paramount. This talk, "Resilient & Reconfigurable Maritime Comms,"…

• Fingerprinting Maritime NMEA2000 Networks — Constantine Macris TheDini, Anissa Elias

  In this DEF CON presentation, Constantine Macris (TheDini) and Anissa Elias introduce a novel method for deterministically fingerprinting **NMEA 2000** networks, a critical bus protocol for maritime…

• Red Teaming Space: Hacking the Final Frontier — Tim Fowler

  Tim Fowler, Founder and CEO of Ethos Labs and RBX Space, delivered a compelling talk at DEF CON titled "Red Teaming Space: Hacking the Final Frontier." This presentation illuminated the critical and…

• Uncovering the Secrets of Tire Pressure Monitoring Systems — Yago Lizarribar

  In this DEF CON talk, Yago Lizarribar, a researcher specializing in the intersection of cybersecurity and artificial intelligence, sheds light on significant vulnerabilities within **Tire Pressure…

• Modern Odometer Manipulation - collin & oblivion — Colin

  In this insightful DEF CON talk, Colin delves into the surprisingly straightforward world of modern odometer manipulation. Challenging the common assumption that digital odometers are tamper-proof…

• Welcome to DEF CON 33 - The Dark Tangent — The Dark Tangent

  The "Welcome to DEF CON 33" address by The Dark Tangent (DT), the founder of DEF CON, is a quintessential opening keynote that transcends a mere greeting to encapsulate the ethos, history, and…

• Veilid la revoluçion : Your data is yours to own — Katelyn Bowden, Paul Miller

  In an era where personal data is increasingly commodified and centralized platforms dominate digital communication, Katelyn Bowden and Paul Miller presented "Veilid la revolución: Your data is yours…

• Cryptocurrency Weekend Keynote Chelsea Button, Alfonso Tinoco & Elaine Shi — Elaine Shi

  In this keynote address, Professor Elaine Shi from Carnegie Mellon University demystifies **Oblivious RAM (ORAM)**, a foundational cryptographic primitive that has transitioned from complex…

• Decision Making in Adversarial Automation — Bobby Kuzma, Michael Odell

  In the intricate dance between attackers and defenders, the speed and accuracy of decision-making often dictate the outcome. This talk, "Decision Making in Adversarial Automation," delivered by…

• Cryptocurrency Opening Keynote — Michael Schloh MsvB, Chad Calease, Param D Pithadia

  The DEF CON Cryptocurrency Opening Keynote for 2024 provided a comprehensive overview of the current security landscape within the rapidly evolving cryptocurrency space. Moderated by Michael Schloh…

• Don’t Cry Wolf: Evidence based assessments of ICS Threats — Jimmy Wylie, Sam Hanson

  In the realm of Industrial Control Systems (ICS) security, the stakes are exceptionally high. Misinformation, sensationalized reporting, or a lack of analytical rigor can lead to unnecessary panic…

• Reverse Engineering Marine Engines: Make powerboats do your bidding — Alex Lorman

  In this illuminating DEF CON talk, Alex Lorman unveils practical strategies for gaining autonomous control over marine engines, challenging the prevailing industry trend of heavily locked-down…

• Reconfigurable HSMs: Future Proofing Hardware Security — Pablo Trujillo

  This talk, presented by Pablo Trujillo at DEF CON, addresses the critical need for robust and adaptable security mechanisms in an increasingly complex threat landscape. Trujillo, an FPGA designer…

• Locked Down, Not Locked Out: How I Escaped Yr Secure Operator Workstation — Aaron Boyd

  In his compelling DEF CON talk, "Locked Down, Not Locked Out: How I Escaped Yr Secure Operator Workstation," Aaron Boyd, a seasoned system engineer at Liberty Energy with a distinguished background…

• Making the DEF CON 33 Badge — Mar

  Mar Williams, a distinguished UX designer and artist with a long history of contributing to DEF CON's unique aesthetic, took the stage to demystify the complex process behind creating the iconic DEF…

• How Computers Kill People: Marine Systems — Michael DeVolld, Austin Reid

  In an era dominated by discussions of nation-state hackers, ransomware, and AI-driven threats, Michael DeVolld and Austin Reid from ABS Consulting, joined by Chris Stein, delivered a sobering talk…

• How AI + Hardware can Transform Point of Care Workflows — PamirAI

  In a compelling presentation at DEF CON, Dr. Shiferlay Olen Brock, affectionately known as Jen Su, delivered a powerful "call to action from the front lines of healthcare," advocating for the…

• Firmware Decryption: For, and By, the Cryptographically Illiterate — Craig Heffner

  In this insightful DEF CON talk, Craig Heffner, renowned for developing the **Binwalk** firmware analysis tool, delves into the increasingly common practice of firmware encryption by device…

• HoloConnect AI - From Space to Biohacking — Dr. Fernando De La Peña Llaca

  In a captivating DEF CON presentation, Dr. Fernando De La Peña Llaca from AXA introduced **HoloConnect AI**, a groundbreaking system designed to provide real-time holographic presence and AI-driven…

• Moonlight Defender : Purple Teaming in Space! — Ben Hawkins

  This talk, "Moonlight Defender: Purple Teaming in Space!", delivered by Ben Hawkins, a Senior Research Engineer at Aerospace Corporation, delves into a critical initiative aimed at bridging the…

• What is Dead May Never Die: The Immortality of SDK Bugs — Richard Lawshae

  In "What is Dead May Never Die: The Immortality of SDK Bugs," Richard Lawshae, a Principal Security Researcher at Ksite Technologies, delves into the pervasive and enduring threat posed by…

• Navigating the Invisible — Mehmet Onder Key, Furkan Aydogan

  This talk, "Navigating the Invisible," delivered by Furkan Aydogan at DEF CON, delves into the complex and often opaque world of maritime security, presenting a dual perspective on intelligence…

• Operational Twilight: APTs, OT, & geopolitics of a dying climate — Cybelle Oliveira

  In an increasingly volatile global landscape, Cybelle Oliveira, a prominent CTI researcher and founder of Lavilla Hacker, presented a compelling and urgent talk at DEF CON titled "Operational…

• Safeguarding the Industrial Frontier OT SOC & Incident Response — Adam Robbie

  This talk delves into the critical and often overlooked realm of Operational Technology (OT) security, specifically focusing on the establishment and operation of an **OT Security Operations Center…

• Hull Integrity: Applying MOSAICS to Naval Mission Systems — Michael Frank

  In a revealing talk at DEF CON, Michael Frank, the Deputy CTO for the Department of the Navy, presented a critical initiative aimed at fortifying the cybersecurity posture of the U.S. Navy and…

• Fear vs Physics: Diagnosing Grid Chaos — Emma Stewart

  Emma Stewart, Chief Grid Scientist at Idaho National Lab, delivered a compelling talk titled "Fear vs Physics: Diagnosing Grid Chaos" at DEF CON, challenging the prevalent tendency within the…

• How AI + Hardware can Transforming Point-of-Care Workflows — PamirAI

  This talk, presented by a co-founder of PamirAI, delves into the transformative potential of integrating **Artificial Intelligence (AI)** with **hardware** to revolutionize various workflows…

• Bare Metal Reverse Engineering — SolaSec

  This talk, "Bare Metal Reverse Engineering" by SolaSec, dives deep into the intricate world of analyzing firmware that runs directly on hardware without a conventional operating system. SolaSec…

• Your Passkey is Weak: Phishing the Unphishable — Chad Spensky, Ph D

  In a revealing and impactful presentation at DEF CON, Chad Spensky, Ph D, delivered a critical analysis of the current state of **passkeys**, challenging the prevailing industry narrative that they…

• Killing Killnet — Alex Holden

  In a captivating talk at DEF CON, Alex Holden, a cybersecurity veteran and founder of Hold Security, unveiled an extraordinary tale of cyber warfare and unconventional disruption. Titled "Killing…

• Here and Now: Exploiting the Human Layer at the Right Moment — Daniel Isler

  In a field often fixated on meticulously crafted plans and technical exploits, Daniel Isler's DEF CON talk, "Here and Now: Exploiting the Human Layer at the Right Moment," offers a profound paradigm…

• Reclaim Tech: A Community Movement — Janet Vertesi, Andy Hull

  In an era defined by perpetual digital and sociopolitical upheaval, Rebecca Miller, a seasoned cyber risk analyst and CISSP instructor, delivered a compelling talk at DEF CON, challenging attendees…

• Referral Beware, Your Rewards Are Mine — Whit @un1tycyb3r Taylor

  In his compelling DEF CON talk, "Referral Beware, Your Rewards Are Mine," Whit Taylor from Rhino Security Labs delves into the often-overlooked security vulnerabilities within incentive referral…

• Dead Reckoning: Hijacking Marine Autopilots — Carson Green, Rik Chatterjee

  In "Dead Reckoning: Hijacking Marine Autopilots," Carson Green and Rik Chatterjee from Colorado State University's System Cyber Research Lab unveil critical vulnerabilities within marine autopilot…

• Prompt Scan Exploit AI’s Journey Through 0Days and 1000 Bugs — D. Jurado, J. Nogue

  This talk, presented by D. Jurado and J. Nogue at DEF CON, delves into the development and capabilities of an autonomous AI-powered penetration testing system. The speakers unveil a sophisticated…

• How API flaws led to admin access to 1k+ USA dealers & control of yr car — Eaton Zveare

  In an eye-opening presentation at DEF CON, security researcher Eaton Zveare unveiled a critical vulnerability chain that granted him national administrative access to the proprietary dealer system…

• VDP in Aviation How it shouldn't be done! — Matt Gaffney

  Matt Gaffney, known as "gaffers," delivers a candid and critical assessment of **Vulnerability Disclosure Programs (VDPs)** within the aviation sector, highlighting pervasive failures and offering…

• Countering Forensics Software by Baiting Them — Weihan Goh, Joseph Lim, Isaac Soon

  This talk, presented by Professor Weihan Goh and his students Joseph Lim and Isaac Soon from Singapore, delves into a novel approach to anti-forensics in the mobile domain. Titled "Countering…

• Cybersecurity in Latin America - Stories of Resilience & Innovation — Giovanni Forero

  Giovanni Forero's talk, "Cybersecurity in Latin America - Stories of Resilience & Innovation," delivers a compelling narrative about the unique cybersecurity landscape in Latin America. Far from…

• The depths that marketers will plummet to - 4dw@r3 — Adwear

  In this DEF CON talk, "The depths that marketers will plummet to," speaker Adwear exposes the increasingly invasive and legally ambiguous data collection practices employed by the digital marketing…

• Bio Cryptography is the Game Genie in a post quantum dystopia — James Utley, PhD

  Dr. James Utley's DEF CON talk, "Bio Cryptography is the Game Genie in a post quantum dystopia," introduces a provocative vision for secure human communication in an age dominated by pervasive…

• There and Back Again: Detecting OT Devices Across Protocol Gateways — Rob King

  In the realm of Operational Technology (OT) and Industrial Control Systems (ICS), maintaining a comprehensive inventory of devices is paramount for security and operational integrity. Rob King's DEF…

• Back to Basics: Building Resilient Cyber Defenses — Yael Grauer

  In "Back to Basics: Building Resilient Cyber Defenses," Yael Grauer, a Program Manager overseeing cybersecurity research at Consumer Reports and an investigative tech reporter, challenges the…

• Evolution of Drain Attacks — Utvecklas, George

  The talk "Evolution of Drain Attacks" by Utvecklas and George at DEF CON delves into the escalating sophistication of cryptocurrency drain attacks, a prevalent and financially devastating form of…

• Creating a Virtual Ship Environment Optimized for Cybersecurity Use — Jeff Greer

  In an increasingly interconnected world, the maritime industry, once seen as a realm apart, is now a critical frontier for cybersecurity. Jeff Greer, a professor at the University of North Carolina…

• Context Aware Anomaly Detection in Automotive CAN Without Decoding — Ravi Rajput

  In this DEF CON presentation, Ravi Rajput, a Principal Architect at New Tech Global, addresses the critical challenge of securing the **Controller Area Network (CAN) bus** in modern vehicles. The…

• Hacking Space to Defend It: Generating IoBs with SPARTA — Brandon Bailey

  In an increasingly space-dependent world, securing orbital assets against cyber threats is paramount. Brandon Bailey's DEF CON talk, "Hacking Space to Defend It: Generating IoBs with SPARTA,"…

• Vulns to end your space mission - A. Olchawa, M. Starcik, R. Fradique & A.Boulaich — Mileno, Andre, Ricardo

  This talk by the Vision Space team, led by Mileno and featuring Andre and Ricardo, delves into critical security vulnerabilities discovered in widely used software components of space systems…

• QRAMM: The Cryptographic Migration to a Post Quantum World — Emily Fane, Abdel Sy Fane

  In this critical DEF CON presentation, Emily Fane and Abdel Sy Fane introduced the **Quantum Readiness Assurance Maturity Model (QRAMM)**, an open-source framework designed to guide organizations…

• The PowerPoint Glove — Parsia Hakimian

  In "The PowerPoint Glove" at DEF CON, Parsia Hakimian from Microsoft presented an ambitious and entertaining project: repurposing a vintage Nintendo Power Glove as a modern Bluetooth Human Interface…

• Intro to Common Industrial Protocol Exploitation — Trevor Flynn

  Trevor Flynn's DEF CON talk, "Intro to Common Industrial Protocol Exploitation," provides a foundational yet detailed exploration into the Common Industrial Protocol (**CIP**), a cornerstone…

• Crossing the Line: Advanced Techniques to Breach the OT DMZ — Christopher Nourrie

  This talk, presented by Christopher Nourrie at DEF CON, delves into advanced penetration testing techniques specifically designed to breach the **Operational Technology (OT) Demilitarized Zone…

• Planting C4: Cross Compatible External C2 for Your Implants — Scott Taylor

  In the ever-evolving landscape of red team operations and advanced persistent threats, establishing resilient and covert command and control (C2) channels is paramount. Scott Taylor, a Red Team…

• Let AI Autogenerate Neural ASR Rules for OT Attacks via NLP — Mars Cheng, Jr Wei-Huang

  In this DEF CON talk, Mars Cheng and Jr Wei-Huang (Jay Jong) from TX1 Networks presented a groundbreaking approach to enhance Operational Technology (OT) security by leveraging Artificial…

• Unveiling IoT Vulns: From Backdoors to Bureaucracy — Kai-Ching Wang, Chiao-Lin Yu

  This talk by Kai-Ching Wang and Chiao-Lin Yu, seasoned security researchers from Trend Micro and CHT Security in Taiwan, delves into the often-overlooked realm of manufacturer-created backdoors and…

• Cloned Vishing : A case study — Katherine Rackliffe

  In an era where digital threats evolve at an unprecedented pace, social engineering tactics continue to be a primary vector for cybercriminals. Katherine Rackliffe's DEF CON talk, "Cloned Vishing: A…

• The Things know What You Did Last Session — Will Baggett

  Will Baggett's DEF CON talk, "The Things know What You Did Last Session," delves into the critical intersection of digital forensics and the Internet of Things (IoT). Baggett, a seasoned expert with…

• Off Grid Datarunning in Oppresive Regimes: Sneakernet and Pirate Box — Robert Menes

  In an era of increasing digital fragility and pervasive censorship, Robert Menes of Hacker Town delivered a compelling talk at DEF CON, advocating for the revival and modernization of **off-grid…

• The Missing Link: Draytek’s New RCEs Complete the Chain — O. Gianatiempo, G. Aznarez

  This talk, presented by Gastonas Narees and Octavio Gianatiempo, security researchers at Faraday, unveils new pre-authentication remote code execution (RCE) vulnerabilities in Draytek routers…

• Quiet Confidence An Introvert's Journey to Technical Public Speaking — Emma Fang

  In her compelling DEF CON talk, "Quiet Confidence: An Introvert's Journey to Technical Public Speaking," Emma Fang, a Senior Security Architect at EPAM, shared her transformative experience of…

• Vibe School: Making dumb devices smart with AI — Dr Katie Paxton Fear

  Dr. Katie Paxton Fear, known online as Insider PhD and a Security Advocate at Smrat, took the DEF CON audience on a "deeply unserious" yet highly insightful journey into the practicalities and…

• Smart Bus Smart Hacking: Free WiFi to Total Control — Kai Ching Wang, Chiao-Lin Yu

  In an era where smart infrastructure is rapidly integrating into daily life, the security implications of these interconnected systems often lag behind their convenience. This talk, "Smart Bus Smart…

• OSINT Enabled Ghost Mode: Counter Surveillance for Everyday People — Desiree Wilson

  In an era defined by ubiquitous data collection and constant digital exposure, Desiree Wilson's DEF CON talk, "OSINT Enabled Ghost Mode: Counter Surveillance for Everyday People," presents a…

• Access Control Done Right the First Time — Tim Clevenger

  In this insightful DEF CON talk, Tim Clevenger, a Network Cyber Security Engineer with a unique background in physical access control system installation and maintenance, dissects the common…

• TotalTest Simulations 2 Oh! From Exploits to Economics — Nebu Varghese

  In his DEF CON talk, "TotalTest Simulations 2 Oh! From Exploits to Economics," Nebu Varghese, a Senior Director in FDI Consulting's cybersecurity practice, presented a compelling framework designed…

• Secure software dependency management everywhere with Nix — Tom Berek, Farid Zakaria

  In this groundbreaking DEF CON talk, "Secure software dependency management everywhere with Nix," Tom Berek, Farid Zakaria, and Morgan Jones introduce the Nix ecosystem as a revolutionary approach…

• Smart Devices, Dumb Resets:Testing Firmware Persistence in Commercial IoT — Matei Jose

  In "Smart Devices, Dumb Resets," Matei Jose, a Senior Penetration Tester at Happening XYZ, delves into the critical security vulnerability posed by the inadequate sanitization of returned Internet…

• Incident Response from a Maritime Sysadmin’s War Room — Kit Louttit, Steve Winston
• Bypassing Intent Destination Checks, LaunchAnyWhere Privilege Escalation — Qidan He

  In this DEF CON talk, Qidan He, a distinguished security researcher, unveils "Bad Resolve," a novel class of **LaunchAnywhere** privilege escalation vulnerabilities impacting modern Android systems…

• Breaking into thousands of cloud based VPNs with 1 bug -David Cash, Rich Warren — Dave, Rich

  In their DEF CON talk, "Zero Trust, Total Bust," Dave and Rich from Amberwolf unveiled a disturbing reality: the much-touted Zero Trust Network Access (ZTNA) solutions, often marketed as the secure…

• Ask EFF — Cooper Quintin, Lisa Femia, Thorin Klosowski, Alexis Hancock, Hannah Zhao

  This DEF CON talk, "Ask EFF," brings together key members of the Electronic Frontier Foundation (EFF)'s Public Interest Technology and Activism teams to discuss their multifaceted approach to…

• Hard Hat Brigade Creations Q&A — MrBill, M0nkeyDrag0n, CoD_Segfault

  The "Hard Hat Brigade Creations Q&A" talk at DEF CON provided a fascinating deep dive into a burgeoning subculture that merges art, technology, and community engagement through the medium of…

• Preventing One of The Largest Supply Chain Attacks in History — Maksim Shudrak

  Maksim Shudrak's DEF CON talk, "Preventing One of The Largest Supply Chain Attacks in History," unveils a critical and widespread supply chain vulnerability rooted in the recycling of cloud storage…

• Critically Neglected: Cybersecurity for buildings — Thomas Pope

  In an era where digital infrastructure underpins nearly every aspect of modern life, the cybersecurity of physical buildings remains a critically overlooked and dangerously vulnerable attack…

• DEF CON 33 VIdeo — TeamHackerPager

  The "Hacker Pager" talk at DEF CON unveiled a unique and highly anticipated hardware badge that transcends the typical conference collectible, evolving into a robust open-source communication and…

• 40 Years Of Phrack: Hacking, Zines & Digital Dissent -richinseattle, Netspooky, Chompie — Rich in Seattle, Net Spooky, Chompy

  The DEF CON talk "40 Years Of Phrack: Hacking, Zines & Digital Dissent" offered a comprehensive journey through the history, evolution, and enduring cultural significance of **Phrack**, arguably the…

• One Modem to Brick Them All -Vulns in EV Charging Comms — Jan Berens, Marcell Szakaly

  This talk, "One Modem to Brick Them All," delivered by Marcell Szakaly from the University of Oxford and Jan Berens from Albertronic, delves into critical security vulnerabilities found within the…

• Turning Camera Surveillance on its Axis — Noam Moshe

  In this compelling DEF CON presentation, Noam Moshe, a lead vulnerability researcher at Clarity, unveiled critical security flaws within Axis Communications' enterprise-grade IP camera management…

• DEF CON 33 Preview — Cryptocurrency Preview

  This presentation served as a concise yet informative preview of the expanded **Cryptocurrency Areas** at DEF CON 33. Delivered by Michael, one of the founding members, the talk outlined the…

• DEF CON 33 Preview - AIXCC — Andrew Carney

  The DEF CON 33 Preview for the **AI Cyber Challenge (AICC)** introduces an ambitious and critical initiative spearheaded by DARPA and ARPAH. This 2-year competition is designed to accelerate the…