| 10:00 |
Phipps
|
ThinSIM-based Attacks on Mobile Money Systems |
| 11:00 |
Dai,
Gong,
Yang
|
Pwning "the toughest target": the exploit chain of winning the largest bug bounty in the history of ASR program |
| 12:00 |
Borges
|
Ring 0/-2 Rootkits: bypassing defenses |
| 13:00 |
Burke
|
A Journey Into Hexagon: Dissecting a Qualcomm Baseband |
| 14:00 |
Si,
X
|
WAGGING THE TAIL—COVERT PASSIVE SURVEILLANCE AND HOW TO MAKE THEIR LIFE DIFFICULT |
| 15:00 |
Champion,
Law
|
Building the Hacker Tracker |
| 15:30 |
HighWiz,
Jericho,
Nikita,
Roamer,
Shaggy,
Sumner,
Wiseacre
|
DEF CON 101 Panel |
| 10:00 |
Rozner
|
Synfuzz: Building a Grammar Based Re-targetable Test Generation Framework |
Dark Tangent
|
Welcome To DEF CON & Badge Maker Talk |
|
Caliskan,
Greenstadt
|
De-anonymizing Programmers from Source Code and Binaries |
|
Manfra
|
Securing our Nation's Election Infrastructure |
|
| 10:30 |
m010ch_
|
Please do not Duplicate: Attacking the Knox Box and Other Keyed Alike Systems |
| 11:00 |
McGrew
|
An Attacker Looks at Docker: Approaching Multi-Container Applications |
Joyce
|
NSA Talks Cybersecurity |
|
egypt,
Vu
|
One-liners to Rule Them All |
|
Huang,
Li,
Zeng
|
Lora Smart Water Meter Security Analysis |
|
| 12:00 |
Gangwere
|
It's Assembler, Jim, but not as we know it: (ab)using binaries from embedded devices for fun and profit |
Johnson,
Stavrou
|
Vulnerable Out of the Box: An Evaluation of Android Carrier Devices |
|
Tsai
|
Breaking Paser Logic: Take Your Path Normalization Off and Pop 0days Out! |
|
Lawshae
|
Who Controls the Controllers—Hacking Crestron IoT Automation Systems |
|
| 13:00 |
zenofex
|
Dissecting the Teddy Ruxpin: Reverse Engineering the Smart Bear |
Vigo
|
Compromising online accounts by cracking voicemail systems |
|
Rousseau,
Seymour
|
Finding Xori: Malware Analysis Triage with Automated Disassembly |
|
Martin
|
One-Click to OWA |
|
| 13:30 |
Tarnovsky
|
You can run, but you can't hide. Reverse engineering using X-Ray. |
Kain
|
Dragnet—Your Social Engineering Sidekick |
|
Huang,
Liu,
Xiao
|
Hacking the Brain: Customize Evil Protocol to Pwn an SDN Controller |
|
Bai,
Zheng
|
Fasten your seatbelts: We are escaping iOS 11 sandbox! |
|
| 14:00 |
Michael,
Shkatov
|
UEFI exploitation for the masses |
Domas
|
GOD MODE UNLOCKED: Hardware Backdoors in [redacted] x86 CPUs |
|
Holtmanns,
Singh
|
4G—Who is paying your cellular phone bill? |
|
Ossmann,
Spill
|
Revolting Radios |
|
| 15:00 |
Tarquin
|
Weaponizing Unicode: Homographs Beyond IDNs |
Ryan
|
Bypassing Port-Security In 2018: Defeating MacSEC and 802.1x-2010 |
|
Alguacil,
Moya
|
Playback: a TLS 1.3 story |
|
yawnbox
|
Privacy infrastructure, challenges and opportunities |
|
| 16:00 |
Haken
|
Automated Discovery of Deserialization Gadget Chains |
Cao,
Jian,
Qun,
Zheng
|
Your Peripheral Has Planted Malware—An Exploit of NXP SOCs Vulnerability |
|
singe
|
Practical & Improved Wifi MitM with Mana |
|
Aqil,
_delta_zero
|
Your Voice is My Passport |
|
| 17:00 |
Danneman
|
Your Bank's Digital Side Door |
Borges,
Levinson
|
I'll See Your Missile and Raise You A MIRV: An overview of the Genesis Scripting Engine |
|
DilDog,
Grand,
Mills,
Mudge,
Pond,
Rogue,
Silicosis,
Tan
|
The L0pht Testimony, 20 Years Later (and Other Things You Were Afraid to Ask) |
|
Buchwald,
Nirenberg
|
Reverse Engineering, hacking documentary series |
|
| 20:00 |
Cardozo,
White
|
Disrupting the Digital Dystopia or What the hell is happening in computer law? |
Corman,
Dameff,
Levchenko,
MD,
Nathans,
Radcliffe,
Suarez,
Woods
|
D0 N0 H4RM: A Healthcare Security Conversation |
|
Potter,
Potter
|
Oh Noes! — A Role Playing Incident Response Game |
| 10:00 |
Krotofil,
Wetzels
|
Through the Eyes of the Attacker: Designing Embedded Systems Exploits for Industrial Control Systems |
Ommeren,
Paternotte
|
It WISN't me, attacking industrial wireless mesh networks |
|
Adams,
Greco,
Matthews
|
You're just complaining because you're guilty: A DEF CON Guide to Adversarial Testing of Software Used In the Criminal Justice System |
|
Bai,
Chai,
Wang,
Zheng
|
You may have paid more than you imagine—Replay Attacks on Ethereum Smart Contracts |
|
| 11:00 |
Alves
|
Hacking PLCs and Causing Havoc on Critical Infrastructures |
Metcalf
|
Exploiting Active Directory Administrator Insecurities |
|
Nafeez
|
Compression Oracle Attacks on VPN Networks |
|
smea
|
Jailbreaking the 3DS through 7 years of hardening |
|
| 12:00 |
Joyce
|
Building Absurd Christmas Light Shows |
Hakimian,
Riedesel
|
Tineola: Taking a Bite Out of Enterprise Blockchain |
|
Cauquil
|
You'd better secure your BLE devices or we'll kick your butts ! |
|
Mitchell
|
Ridealong Adventures—Critical Issues with Police Body Cameras |
|
| 13:00 |
Nevermoe
|
One Step Ahead of Cheaters -- Instrumenting Android Emulators |
Sesterhenn
|
In Soviet Russia Smartcard Hacks You |
|
Amiet,
Romailler
|
Reaping and breaking keys at scale: when crypto meets big data |
|
Marcelli
|
Looking for the perfect signature: an automatic YARA rules generation algorithm in the AI-era |
|
| 13:30 |
Sharma
|
House of Roman—a "leakless" heap fengshui to achieve RCE on PIE Binaries |
Domas
|
The ring 0 façade: awakening the processor's inner demons |
|
0x200b
|
Detecting Blue Team Research Through Targeted Ads |
|
Alex,
Zach
|
Infecting The Embedded Supply Chain |
|
| 14:00 |
Giese
|
Having fun with IoT: Reverse Engineering and Hacking of Xiaomi IoT Devices |
Martin
|
SMBetray—Backdooring and breaking signatures |
|
Colli,
Izycki
|
Digital Leviathan: a comprehensive list of Nation-State Big Brothers (from huge to little ones |
|
Ma
|
Playing Malware Injection with Exploit thoughts |
|
| 14:30 |
Mayhem
|
Sex Work After SESTA/FOSTA |
Wardle
|
Fire & Ice: Making and Breaking macOS Firewalls |
|
| 15:00 |
Cano
|
Project Interceptor: avoiding counter-drone systems with nanodrones |
sghctoma
|
All your math are belong to us |
|
Bulazel
|
Reverse Engineering Windows Defender's Emulator |
|
hon1nbo,
Levison
|
Booby Trapping Boxes |
|
| 16:00 |
Crowley,
Paredes,
Savage
|
Outsmarting the Smart City |
McKee
|
80 to 0 in under 5 seconds: Falsifying a medical patient's vitals |
|
Arzt,
Huber,
Rasthofer
|
All your family secrets belong to us—Worrisome security issues in tracker apps |
|
Eckert,
Krause,
Sumner
|
Inside the Fake Science Factory |
|
| 17:00 |
Thieme
|
The Road to Resilience: How Real Hacking Redeems this Damnable Profession |
Cano
|
Relocation Bonus: Attacking the Windows Loader Makes Analysts Switch Careers |
|
| 20:00 |
Vincent
|
Privacy Is Equality—And It's Far from Dead |
Donovan,
Goerzen,
Matthews
|
Beyond the Lulz: Black-Hat Trolling, White-Hat Trolling, Attacking and Defending Our Attention Landscape |
|
Arrieta,
Cardozo,
Opsahl,
Rodriguez,
Sheard,
Williams
|
EFF Fireside Hax (AKA Ask the EFF) |
| 10:00 |
Wardle
|
The Mouse is Mightier than the Sword |
Berta,
Santos
|
Rock appround the clock: Tracking malware developers by Android "AAPT" timezone disclosure bug |
|
Franklin,
Franklin
|
Defending the 2018 Midterm Elections from Foreign Adversaries |
|
Galloway,
Yunusov
|
For the Love of Money: Finding and exploiting vulnerabilities in mobile point of sales systems |
|
| 11:00 |
Grand
|
Searching for the Light: Adventures with OpticSpy |
Rodriguez
|
Breaking Extreme Networks WingOS: How to own millions of devices running on Aircrafts, Government, Smart cities and more. |
|
Zolnikov
|
Politics and the Surveillance State. The story of a young politician's successful efforts to fight surveillance and pass the nation's strongest privacy bills. |
|
zerosum0x0
|
Demystifying MS17-010: Reverse Engineering the ETERNAL Exploits |
|
| 12:00 |
HuiYu,
Wenxiang
|
Breaking Smart Speakers: We are Listening to You. |
Antikainen,
Aura,
Bui,
Rao
|
Last mile authentication problem: Exploiting the missing link in end-to-end secure communication |
|
Wang
|
Attacking the macOS Kernel Graphics Driver |
|
Knight,
Speers
|
Designing and Applying Extensible RF Fuzzing Tools to Expose PHY Layer Vulnerabilities |
|
| 13:00 |
Broadbent
|
Trouble in the tubes: How internet routing security breaks down and how you can do it at home |
Makkaveev
|
Man-In-The-Disk |
|
King
|
Micro-Renovator: Bringing Processor Firmware up to Code |
|
magicspacekiwi,
West
|
barcOwned—Popping shells with your cereal box |
|
| 13:30 |
Ando
|
Asura: A huge PCAP file analyzer for anomaly packets detection using massive multithreading |
Ayrey,
Foster
|
Lost and Found Certificates: dealing with residual certificates for pre-owned domains |
|
ldionmarcil
|
Edge Side Include Injection: Abusing Caching Servers into SSRF and Transparent Session Hijacking |
|
| 14:00 |
Wixey
|
Betrayed by the keyboard: How what you type can give you away |
Choi,
Kim
|
Your Watch Can Watch You! Gear Up for the Broken Privilege Pitfalls in the Samsung Gear Smartwatch |
|
Tan
|
Hacking BLE Bicycle Locks for Fun and a Small Profit |
|
Bai,
Zheng
|
One bite and all your dreams will come true: Analyzing and Attacking Apple Kernel Drivers |
|
| 15:00 |
Bourbonnais,
Moss,
Roberts,
S0ups,
Street,
White,
Wright
|
PANEL: DEF CON GROUPS |
Balmas,
Itkin
|
What the Fax!? |
|
Shudrak
|
Fuzzing Malware For Fun & Profit. Applying Coverage-guided Fuzzing to Find and Exploit Bugs in Modern Malware |
|
| 16:00 |
Dark Tangent
|
DEF CON Closing Ceremonies |
This "Old School" schedule is an automatically-generated evolution of a manually-generated hack Darth Null has been using at ShmooCon since 2007. It won't work too well for a large conference, like DEFCON, but for smaller events like ShmooCon or BlackHat DC, it might be useful.
Simply print this out at whatever scale is most helpful to you. For example, for ShmooCon: print at 65%, fold Friday and Sunday back behind Saturday, and laminate, for a two-sided 3" x 4" card that you can keep in your shirt pocket.