DerbyCon 8.0 Evolution (2018)

DerbyCon 8.0 Evolution took place Oct. 5, 2018 through Oct. 7, 2018 (5 years, 6 months ago) at Marriott Louisville in Louisville, Kentucky, USA.

Presentations

Friday, Oct. 5, 2018

08:30 - Opening Ceremonies Logistics
09:00 - How to influence security technology in kiwi underpants Keynote
10:00 - Panel Discussion: At a Glance: Information Security Panel
12:00 - Red Teaming gaps and musings
12:00 - IRS, HR, Microsoft and your Grandma: What they all have in common
12:00 - I Can Be Apple, and So Can You
12:00 - Invoke-EmpireHound - Merging BloodHound & Empire for Enhanced Red Team Workflow
12:00 - The History of the Future of CyberEducation
12:30 - A Process is No One: Hunting for Token Manipulation
13:00 - Fuzz your smartphone from 4G base station side
13:00 - #LOLBins - Nothing to LOL about!
13:00 - When Macs Come Under ATT&CK
13:00 - State of Win32k Security: Revisiting Insecure design
13:00 - From Workstation to Domain Admin: Why Secure Administration Isn’t Secure and How to Fix It
13:30 - Clippy for the Dark Web: Looks Like You’re Trying to Buy Some Dank Kush, Can I Help You With That?
14:00 - Offensive Browser Extension Development
14:00 - Abusing IoT Medical Devices For Your Precious Health Records
14:00 - Everything Else I Learned About Security I Learned From Hip-Hop
14:00 - MS17-010?
14:00 - Synfuzz: Building a Grammar Based Re-targetable Test Generation Framework
14:30 - Escoteric Hashcat Attacks
15:00 - Hackers, Hugs, & Drugs: Mental Health in Infosec
15:00 - Protect Your Payloads: Modern Keying Techniques
15:00 - The Unintended Risks of Trusting Active Directory
15:00 - Detecting WMI exploitation
15:00 - NOOb OSINT in 30 Minutes or less!
15:30 - RFID Luggage Tags, IATA vs Real Life
16:00 - Gryffindor | Pure JavaScript, Covert Exploitation
16:00 - Jump Into IOT Hacking with the Damn Vulnerable Habit Helper Device
16:00 - #LOL They Placed Their DMZ in the Cloud: Easy Pwnage or Disruptive Protection
16:00 - Lessons Learned by the WordPress Security Team
16:00 - Android App Penetration Testing 101
16:30 - Maintaining post-exploitation opsec in a world with EDR
17:00 - In-Memory Persistence: Terminate & Stay Resident Redux
17:00 - Instant Response: Making IR faster than you thought possible!
17:00 - IronPython... omfg
17:00 - Draw a Bigger Circle: InfoSec Evolves
17:00 - Hey! I found a vulnerability – now what?
17:30 - Foxtrot C2: A Journey of Payload Delivery
18:00 - Ridesharks

Saturday, Oct. 6, 2018

09:00 - Hardware Slashing, Smashing, and Reconstructing for Root access
09:00 - VBA Stomping - Advanced Malware Techniques
09:00 - Disaster Strikes: A Hacker’s Cook book
09:00 - Tales From the Bug Mine - Highlights from the Android VRP
09:00 - Building an Empire with (Iron)Python
09:30 - Decision Analysis Applications in Threat Analysis Frameworks
10:00 - App-o-Lockalypse now!
10:00 - How Russian Cyber Propaganda Really Works
10:00 - Ninja Looting Like a Pirate
10:00 - Media hacks: an Infosec guide to dealing with journalists
10:00 - SAEDY: Subversion and Espionage Directed Against You
10:30 - Make Me Your Dark Web Personal Shopper!
12:00 - Hacking Mobile Applications with Frida
12:00 - Web App 101: Getting the lay of the land
12:00 - OSX/Pirrit - Reverse engineering mac OSX malware and the legal department of the company who makes it
12:00 - Driving Away Social Anxiety
12:00 - Deploying Deceptive Systems: Luring Attackers from the Shadows
12:30 - Off-grid coms and power
13:00 - CTFs: Leveling Up Through Competition
13:00 - How to test Network Investigative Techniques(NITs) used by the FBI
13:00 - Invoke-DOSfuscation: Techniques FOR %F IN (-style) DO (S-level CMD Obfuscation)
13:00 - The Money-Laundering Cannon: Real cash; Real Criminals; and Real Layoffs
13:00 - Victor or Victim? Strategies for Avoiding an InfoSec Cold War
13:30 - Mapping wifi networks and triggering on interesting traffic patterns
14:00 - Perfect Storm: Taking the Helm of Kubernetes
14:00 - Extending Burp to Find Struts and XXE Vulnerabilities
14:00 - Ubiquitous Shells
14:00 - Cloud Computing Therapy Session
14:00 - WE ARE THE ARTILLERY: Using Google Fu To Take Down The Grids
14:30 - Introduction to x86 Assembly
15:00 - How to put on a Con for Fun and (Non) Profit
15:00 - Pacu: Attack and Post-Exploitation in AWS
15:00 - Silent Compromise: Social Engineering Fortune 500 Businesses
15:00 - Just Let Yourself In
15:00 - 99 Reasons Your Perimeter Is Leaking Evolution of C&C
15:30 - An Inconvenient Truth: Evading the Ransomware Protection in Windows 10
16:00 - Ship Hacking: a Primer for Today’s Pirate
16:00 - Brutal Blogging - Go for the Jugular
16:00 - Dexter: the friendly forensics expert on the Coinbase security team
16:00 - A “Crash” Course in Exploiting Buffer Overflows (Live Demos!)
16:00 - Web app testing classroom in a box - the good, the bad and the ugly
16:30 - RID Hijacking: Maintaining Access on Windows Machines
17:00 - Metasploit Town Hall 0x4
17:00 - Your Training Data is Bad and You Should Feel Bad
17:00 - Code Execution with JDK Scripting Tools & Nashorn Javascript Engine
17:00 - Going on a Printer Safari – Hunting Zebra Printers
17:00 - Living in a Secure Container, Down by the River
17:30 - So many pentesting tools from a $4 Arduino
18:00 - PHONOPTICON - leveraging low-rent mobile ad services to achieve state-actor level mass surveillance on a shoestring budget
18:00 - Community Based Career Development or How to Get More than a T-Shirt When Participating as part of the Community

Sunday, Oct. 7, 2018

09:00 - Bug Hunting in RouterOS
09:00 - Patching: Show me where it hurts
09:00 - Social Engineering At Work – How to use positive influence to gain management buy-in for anything
09:00 - Goodbye Obfuscation, Hello Invisi-Shell: Hiding Your Powershell Script in Plain Sight
09:00 - Red Mirror: Bringing Telemetry to Red Teaming
09:30 - Advanced Deception Technology Through Behavioral Biometrics
10:00 - Cloud Forensics: Putting The Bits Back Together
10:00 - We are all on the spectrum: What my 10-year-old taught me about leading teams
10:00 - Two-Factor, Too Furious: Evading (and Protecting) Evolving MFA Schemes
10:00 - Breaking Into Your Building: A Hackers Guide to Unauthorized Access
10:00 - Ham Radio 4 Hackers
10:30 - No Place Like Home: Real Estate OSINT and OPSec Fails
11:00 - The Layer2 Nightmare
11:00 - The making of an iOS 11 jailbreak: Kiddie to kernel hacker in 14 sleepless nights.
11:00 - Killsuit: The Equation Group’s Swiss Army knife for persistence, evasion, and data exfil
11:00 - IoT: Not Even Your Bed Is Safe
11:00 - Getting Control of Your Vendors Before They Take You Down
11:30 - Attacking Azure Environments with PowerShell
12:00 - The MS Office Magic Show
12:00 - Cyber Intelligence: There Are No Rules, and No Certainties
12:00 - Fingerprinting Encrypted Channels for Detection
12:00 - Who Watches the Watcher? Detecting Hypervisor Introspection from Unprivileged Guests
12:00 - Blue Blood Injection: Transitioning Red to Purple
12:30 - Mirai, Satori, OMG, and Owari - IoT Botnets Oh My
13:00 - Getting Started in CCDC
13:00 - On the Nose: Bypassing Huawei’s Fingerprint authentication by exploiting the TrustZone
13:00 - Pwning in the Sandbox: OSX Macro Exploitation & Beyond
13:00 - Living off the land: enterprise postexploitation
13:00 - Comparing apples to Apple
13:30 - How online dating made me better at threat modeling
14:00 - Threat Hunting with a Raspberry Pi
14:00 - Hillbilly Storytime: Pentest Fails
14:00 - Changing Our Mindset From Technical To Psychological Defenses
14:00 - Bypassing Port-Security In 2018: Defeating MacSEC and 802.1x-2010
14:00 - IOCs Today, Intelligence-Led Security Tomorrow
15:30 - Closing Ceremony Logistics

Presenters