| 10:00 |
Yair
|
Exploiting Windows Exploit Mitigation for ROP Exploits |
| 11:00 |
Li,
Qian,
Wu
|
Breaking Google Home: Exploit It with SQLite(Magellan) |
| 12:00 |
Baumhof
|
Are Quantum Computers Really A Threat To Cryptography? A Practical Overview Of Current State-Of-The-Art Techniques With Some Interesting Surprises |
| 13:00 |
Laulheret
|
Intro to Embedded Hacking—How you too can find a decade old bug in widely deployed devices. [REDACTED] Deskphones, a case study. |
| 14:00 |
Qin,
Wang,
Zhou
|
Web2Own: Attacking Desktop Apps From Web Security's Perspective |
| 15:00 |
Highwiz,
Jacobs,
n00bz,
Nikita,
Shaggy,
Tottenkoph,
Will
|
DEF CON 101 Panel |
| 10:00 |
Grand
|
Behind the Scenes of the DEF CON 27 Badge |
Ellis,
Harman,
Langevin,
Lieu,
Thomas
|
Hacking Congress: The Enemy Of My Enemy Is My Friend |
|
Bilodeau,
Paquet-Clouston
|
Behind the Scenes: The Industry of Social Media Manipulation Driven by Malware |
|
Graydon,
Graydon
|
Duplicating Restricted Mechanical Keys |
|
| 11:00 |
Herbert-Voss
|
Don't Red-Team AI Like a Chump |
Dingledine
|
The Tor Censorship Arms Race: The Next Chapter |
|
Huang,
Hui,
Zhang
|
All the 4G modules Could be Hacked |
|
Dileo
|
Evil eBPF In-Depth: Practical Abuses of an In-Kernel Bytecode Runtime |
|
| 12:00 |
Klein,
Kotler
|
Process Injection Techniques - Gotta Catch Them All |
WillC
|
Phreaking Elevators |
|
Chang,
Tsai
|
Infiltrating Corporate Intranet Like NSA ̶Pre-auth RCE on Leading SSL VPNs |
|
Maddux
|
API-Induced SSRF: How Apple Pay Scattered Vulnerabilities Across the Web |
|
| 13:00 |
Bai,
Zheng
|
HackPac: Hacking Pointer Authentication in iOS User Space |
Bereza,
McKee
|
HVACking: Understand the Difference Between Security and Reality! |
|
Davis
|
No Mas – How One Side-Channel Flaw Opens Atm, Pharmacies and Government Secrets Up to Attack |
|
Morris
|
More Keys Than A Piano: Finding Secrets In Publicly Exposed Ebs Volumes |
|
| 14:00 |
Wardle
|
Harnessing Weapons of Mac Destruction |
Demirkapi
|
Are Your Child's Records at Risk? The Current State of School Infosec |
|
Bursztein,
Picod
|
A Hacker Guide To Deep-Learning Based Side Channel Attacks |
|
Crowley,
Pagan
|
Practical Key Search Attacks Against Modern Symmetric Ciphers |
|
| 15:00 |
Grace
|
MOSE: Using Configuration Management for Evil |
Menn,
Omega,
Rioux,
Vegetable,
Zatko
|
Change the World, cDc Style: Cow tips from the first 35 years |
|
Cui,
Housley,
Kataria
|
100 Seconds of Solitude: Defeating Cisco Trust Anchor With FPGA Bitstream Shenanigans |
|
Simakov,
Zinar
|
Relaying Credentials Has Never Been Easier: How to Easily Bypass the Latest NTLM Relay Mitigations |
|
| 16:00 |
Weinberg
|
Please Inject Me, a x64 Code Injection |
Spicer
|
I Know What You Did Last Summer: 3 Years of Wireless Monitoring at DEF CON |
|
Kain
|
Surveillance Detection Scout - Your Lookout on Autopilot |
|
Brizendine,
Stroschien
|
The JOP ROCKET: A Supremely Wicked Tool for JOP Gadget Discovery, or What to Do If ROP Is Too Easy |
|
| 16:30 |
Oberli
|
Poking the S in SD cards |
Wyden
|
Can You Track Me Now? Why The Phone Companies Are Such A Privacy Disaster |
|
Pickett
|
Breaking The Back End! It Is Not Always A Bug. Sometimes, It Is Just Bad Design! |
|
Müller
|
Re: What's up Johnny? – Covert Content Attacks on Email End-to-End Encryption |
|
| 20:00 |
Dameff,
Moe,
Radcliffe,
Rios,
Schwartz,
Tully
|
D0 N0 H4RM: A Healthcare Security Conversation |
| 22:15 |
Bourbonnais,
Darington,
Roberts,
s0ups,
Street,
White,
Wright
|
Panel: DEF CON Groups |
| 10:00 |
Islam,
Regalado
|
Weaponizing Hypervisors to Fight and Beat Car and Medical Devices Attacks |
finalphoenix
|
Rise of the Hypebots: Scripting Streetwear |
|
Schneier
|
Information Security in the Public Interest |
|
Leibowitz,
Timzen
|
EDR Is Coming; Hide Yo Sh!t |
|
| 11:00 |
Jmaxxz
|
Your Car is My Car |
Swearingen
|
HAKC THE POLICE |
|
Pratt
|
Hacking Your Thoughts - Batman Forever meets Black Mirror |
|
Jacobs
|
Meticulously Modern Mobile Manipulations |
|
| 12:00 |
Cox
|
How You Can Buy AT&T, T-Mobile, and Sprint Real-Time Location Data on the Black Market |
Cauquil
|
Defeating Bluetooth Low Energy 5 PRNG for Fun and Jamming |
|
Rivas,
Romero
|
Why You Should Fear Your “mundane” Office Equipment |
|
Snezhkov
|
Zombie Ant Farm: Practical Tips for Playing Hide and Seek with Linux EDRs |
|
| 13:00 |
Mittal
|
RACE - Minimal Rights and ACE for Active Directory Dominance |
Buckley,
Kulikowski,
Murray
|
GSM: We Can Hear Everyone Now! |
|
Wade
|
Tag-side attacks against NFC |
|
Mirosh,
Muñoz
|
SSO Wars: The Token Menace |
|
| 14:00 |
Gull
|
SELECT code_execution FROM * USING SQLite;—Gaining code execution using a malicious SQLite database |
Huber,
Roskosch
|
I'm on your phone, listening - Attacking VoIP Configuration Interfaces |
|
Shudrak
|
Zero bugs found? Hold my Beer AFL! How To Improve Coverage-Guided Fuzzing and Find New 0days in Tough Targets |
|
Gwinnup,
Holowczak
|
Next Generation Process Emulation with Binee |
|
| 15:00 |
Michael,
Shkatov
|
Get off the Kernel if you can’t Drive |
richter
|
Reverse-Engineering 4g Hotspots for Fun, Bugs and Net Financial Loss |
|
Doussot,
Meyer
|
State of DNS Rebinding - Attack & Prevention Techniques and the Singularity of Origin |
|
Borges
|
.NET Malware Threats: Internals And Reversing |
|
| 16:00 |
Stone
|
Reverse Engineering 17+ Cars in Less Than 10 Minutes |
NOC NOC. Who's there? All. All who? All the things you wanted to know about the DEF CON NOC and we won't tell you about |
||
Kollars
|
Confessions of an Nespresso Money Mule: Free Stuff & Triangulation Fraud |
|
jiska,
Ullrich
|
Vacuum Cleaning Security—Pinky and the Brain Edition |
|
| 16:30 |
Grant
|
Unpacking Pkgs: A Look Inside Macos Installer Packages And Common Security Flaws |
droogie
|
Go NULL Yourself or: How I Learned to Start Worrying While Getting Fined for Other’s Auto Infractions |
|
Stepankin
|
Apache Solr Injection |
|
| 20:00 |
Buttar,
Cyphers,
Fischer,
Opsahl,
Sheard
|
Meet the EFF - Meetup Panel |
| 22:15 |
Carr,
Godfrey
|
We Hacked Twitter… And the World Lost Their Sh*t Over It! |
| 10:00 |
Berta
|
Backdooring Hardware Devices By Injecting Malicious Payloads On Microcontrollers |
smea
|
Adventures In Smart Buttplug Penetration (testing) |
|
Baker
|
Hacking WebAssembly Games with Binary Instrumentation |
|
Liu,
Zhang
|
Your Secret Files Are Mine: Bug Finding And Exploit Techniques On File Transfer App Of All Top Android Vendors |
|
| 11:00 |
Barral,
Géraud-Stewart,
Jaloyan
|
The ABC of Next-Gen Shellcoding |
Camara
|
SDR Against Smart TVs: URL and Channel Injection Attacks |
|
Gong,
Pi
|
Exploiting Qualcomm WLAN and Modem Over The Air |
|
Itkin
|
Say Cheese - How I Ransomwared Your DSLR Camera |
|
| 12:00 |
Mollema
|
I'm In Your Cloud... Pwning Your Azure Environement |
Cohen,
Waisel
|
Malproxying: Leave Your Malware at Home |
|
Kettle
|
HTTP Desync Attacks: Smashing into the Cell Next Door |
|
Baines
|
Help Me, Vulnerabilities. You're My Only Hope |
|
| 13:00 |
Thompson
|
[ MI CASA-SU CASA ] My 192.168.1.1 is Your 192.168.1.1 |
Wixey
|
Sound Effects: Exploring Acoustic Cyber-weapons |
|
Brocious,
Sadeghipour
|
Owning The Cloud Through Server-Side Request Forgery |
|
Athalye
|
Want Strong Isolation? Just Reset Your Processor |
|
| 14:00 |
Roberts
|
Firmware Slap: Automating Discovery of Exploitable Vulnerabilities in Firmware |
Dixon
|
Cheating in eSports: How to Cheat at Virtual Cycling Using USB Hacks |
|
Luca,
Mueller
|
The Ether Wars: Exploits, counter-exploits and honeypots on Ethereum |
|
Contests Awards Ceremony |
||
| 16:00 |
Tangent
|
Closing Ceremonies |
This "Old School" schedule is an automatically-generated evolution of a manually-generated hack Darth Null has been using at ShmooCon since 2007. It won't work too well for a large conference, like DEFCON, but for smaller events like ShmooCon or BlackHat DC, it might be useful.
Simply print this out at whatever scale is most helpful to you. For example, for ShmooCon: print at 65%, fold Friday and Sunday back behind Saturday, and laminate, for a two-sided 3" x 4" card that you can keep in your shirt pocket.