2024 Agenda
9AM
Beyond Login Attempts: Detecting Threats in SaaS Applications
Julie Agnes Sparks
Enterprise adoption of SaaS applications is rapidly increasing, leading to a growing repository of critical customer and production system data within these cloud-based platforms. Consequently, cyberattacks targeting SaaS environments are becoming a significant concern. Threat detection plays a crucial role in mitigating these risks by providing additional security coverage for these applications.
We'll explore the unique challenges of threat detection in SaaS environments, including shared responsibility models and limited visibility into application internals. You'll learn how to craft threat detections that go beyond basic login attempts and focus on identifying malicious behavior within the application itself.
10AM
Flags to CVEs: Moving From CTFs to Real World Targets
Jack Maginnes
Learning offensive security through CTFs is a tried and true method. Most of the best researchers in the world got their start by playing CTFs. However, moving from finding vulnerabilities in small, bite-sized challenge problems to full blown applications can be a daunting task. Often times, it requires a shift in mindset, methodology, and tooling.In this talk, we will walk through the key points to consider when attacking real world applications and devices.
We'll start with high level methodology such as understanding attack surfaces, subsystem selection and vulnerability research tooling. We'll then delve into practical exercises, such as crafting an exploit for a known vulnerability (CVE-2023-35138) and conducting variant analysis to identify ineffective patches.
Finally, we will look at a handful of 0-days discovered using this methodology, including a kernel driver overflow leading to a local privilege escalation (CVE-2023-30257), and a command injection leading to RCE (CVE-2022–23900).
11AM
Beyond Interactions: Hacking Chatbots Like a Pro
Naveen Konrajankuppam Mahavishnu & Mohankumar Vengatachalam
In an era where AI-driven chatbots seamlessly integrate into our daily lives, it's high time we understand the risks caused by vulnerabilities associated with these chatbots.In this talk, we will explore common vulnerabilities encountered in AI chatbots, highlighting the top three categories most susceptible to exploitation: Prompt Injection, Insecure Output Handling, and Training Data Poisoning.
Through a combination of live hacking demonstrations and real-world attack scenarios, we will illustrate how malicious actors leverage these vulnerabilities to compromise sensitive information, propagate misinformation (e.g., spreading fake news articles), etc.
By the conclusion of our talk, participants will have gained a deeper awareness of the challenges inherent in securing AI chatbots and will be equipped with actionable insights to bolster their defenses. We will also extend an invitation to participants to use our lab exercise, where they can further explore and exploit additional attack paths beyond those covered in the talk.
12PM
LUNCH
Network. Sit down with someone you don’t know and get to know them. It’ll pay off in the long run - trust me.
Signed, a practicing introvert.
1PM
"Grumpy People Grumping" a.k.a. CISO Panel
Robb, Doug, Josh, Alex
2PM
Spy-Fi: The Thrilling World of Vision AI Surveillance
Zoe Steinkamp
Ever dreamed of having X-ray vision or eyes everywhere? Dive into the thrilling realm of Vision AI surveillance, where technology transforms ordinary cameras into extraordinary spies. Join us as we embark on a mission to explore the fascinating synergy of covert operations and cutting-edge AI.
In this daring journey, we'll reveal how Vision AI, powered by NVIDIA DeepStream, sneaks into our everyday lives. From tracking people, cars, and even road signs, to streaming real-time footage through RTSP servers, our AI agents leave no stone unturned.
Moreover, we will delve into the nuances of MQTT and InfluxDB, the discreet architects orchestrating the comprehensive collection and astute analysis of data acquired by our AI operatives. Brace yourself for a spy-fi narrative where technology converges with intrigue, transcending commonplace conventions to unveil the extraordinary.
3PM
Bluetooth Demystification: Who Are The People in Your Neighborhood
Jimi 2x
Explore the hidden world of Bluetooth/BLE for info gathering, situational awareness, and some lulz. Identify people and their devices using simple logging & visualizations using low-cost Raspberry Pis.
We will cover both Red Team (Offensive) and Blue Team (Defensive) uses and strategies, Proximity awareness, OUI & UUID correlations, and customizing your own classifiers for tagging and grouping devices so you can easily discover 'who are the people in your neighborhood.'
4PM
AI Security: Everything Old is New Again!
Wesley Kuzma
Artificial Intelligence is being adopted at record pace , and every organization on the planet is making impactful decisions regarding the use, governance and security of AI platforms and capabilities. This novel “notes from the field” style presentation is meant to highlight common AI security pitfalls and provide vendor agnostic mitigations based on the application of commonly accepted security principles.
One of the most interesting findings is that enterprise AI adoption isn’t really changing the threat model, but it is amplifying the impact of historical pain points. The adoption of the new AI platforms is bringing visibility to security domains that have long been neglected in many organizations.
By the end of this presentation the audience will better understand the identified pitfalls and being able to apply real-world mitigations to enable their organizations to securely adopt AI platforms and capabilities.
5PM
The Cyber Battlefield of M&A: Key Takeaways and Guidance
Ashley Fairman
In this presentation, Ashley Fairman, Founder & CEO of DICE Cyber, LLC, delves into the critical intersection of cybersecurity and mergers and acquisitions (M&A). Speaking from 5 M&A experience at Google, this talk emphasizes the often-overlooked cyber threats that can significantly impact M&A transactions, offering attendees valuable insights, lessons from real-world case studies, best practices, and actionable guidance to mitigate these risks.
6PM
Confessions of a Pentesting Punk
woland
Offensive security roles are often considered to be the most desired and "sexy" gigs in information security, but what truly resides behind all the hype?
Join the speaker as she recounts all the lessons she's learned after more than three years in the trenches as a modern-day pentester and security consultant, including the good, the bad, and the unexpected. Using a punk rock ethos, the speaker will highlight the harsh realities of what it means to thrive as a pentester, and how to navigate the pitfalls and nonsense that come with the job.
Attendees will learn about offensive techniques, DIY methodologies, and real world examples. Does pentesting actually help keep people and their data safe in any tangible way? Without pulling any punches, this talk will let the audience decide.
7PM
Happy Hour - Tivoli Brewing
© 2024 BSides Denver