{"schedule": {"version": "0.7", "base_url": "https://cfp.bsidesvienna.at/bsidesvienna-0x7ea/schedule/", "conference": {"acronym": "bsidesvienna-0x7ea", "title": "BSidesVienna 0x7EA", "start": "2026-06-27", "end": "2026-06-27", "daysCount": 1, "timeslot_duration": "00:05", "rooms": [{"name": "Mittlerer Saal (Track 1)", "guid": null, "description": null, "capacity": 260}, {"name": "Dachsaal (Track 2 )", "guid": null, "description": null, "capacity": 190}, {"name": "Kreativraum 3.1 (Track 3 - Women4Cyber/Rookie)", "guid": null, "description": null, "capacity": 50}, {"name": "Kleiner Saal (Workshops Track)", "guid": null, "description": null, "capacity": 20}], "days": [{"index": 1, "date": "2026-06-27", "day_start": "2026-06-27T04:00:00+02:00", "day_end": "2026-06-28T03:59:00+02:00", "rooms": {"Mittlerer Saal (Track 1)": [{"id": 666, "guid": "29ed270b-4a14-561e-9532-0268671e6b55", "logo": "", "date": "2026-06-27T09:30:00+02:00", "start": "09:30", "duration": "00:45", "room": "Mittlerer Saal (Track 1)", "slug": "bsidesvienna-0x7ea-666-mcp-most-concerning-protocol", "url": "https://cfp.bsidesvienna.at/bsidesvienna-0x7ea/talk/K7JNE8/", "title": "MCP - Most Concerning Protocol", "subtitle": "", "track": "Mittlerer Saal (Track 1 - 260 pax)", "type": "Medium Talk", "language": "en", "abstract": "TLDR: If you as an attacker want more tools to gain RCE and persistence MCP is exactly that.\r\n\r\nAI agents are rapidly becoming a new interface to enterprise systems: they read internal knowledge, call APIs, and execute actions through connected tools. MCP standardizes this tool access, but it also creates a new, high-impact attack surface: tool execution integrity.", "description": "Basically our talk shows all the ways attackers can leverage MCP for RCE and persistence.\r\n\r\nIn this talk we demonstrate \u201cMCP hijacking in the wild\u201d through an attack demo that shows how a compromised or malicious MCP tool execution path can become an attacker control channel. Critically, we show why common hardening approaches are insufficient in practice by demonstrating bypass and/or time-of-check/time-of-use gaps during the demo itself.\r\n\r\nWe close with a proof-of-concept integrity protection method designed to raise the bar against MCP toolchain compromise by enforcing trustworthy tool identity and invocation integrity, with practical guidance", "recording_license": "", "do_not_record": false, "persons": [{"id": 584, "code": "MJ3KNB", "public_name": "Paul Zenker", "biography": "I am a security consultant at KPMG. I love breaking AI and using AI to break other stuff. When AI becomes too much hype and magic I go touch some grass and break into buildings.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"id": 630, "guid": "2fd11c18-677b-5fc5-822d-3fa9b030a1dd", "logo": "", "date": "2026-06-27T10:20:00+02:00", "start": "10:20", "duration": "00:45", "room": "Mittlerer Saal (Track 1)", "slug": "bsidesvienna-0x7ea-630-hey-claude-find-0days-using-ai-for-vulnerability-research-red-teaming", "url": "https://cfp.bsidesvienna.at/bsidesvienna-0x7ea/talk/LQVWHG/", "title": "Hey Claude, find 0days - Using AI for Vulnerability Research & Red Teaming", "subtitle": "", "track": "Mittlerer Saal (Track 1 - 260 pax)", "type": "Medium Talk", "language": "en", "abstract": "\"Friends don't let friends upload their tradecraft to VirusTotal\", but what about AI? More and more companies are integrating AI into their pipelines and workflows, and we can see headlines of AI finding hundreds of bugs everywhere online. So how can we integrate this technology into our work without burning our tradecraft - is this even possible?", "description": "We'll examine the capabilities of AI itself, how we can integrate it into our research to find more bugs more quickly, and how well it can be used for weaponization. To visualize this, we'll walk through at least one real-world vulnerability: my original approach, how that approach can be improved by AI, and to what degree.\r\n\r\nBut the advantages of AI come at a (hidden) cost: we're sharing everything with a third party, be it Anthropic, Google, or whoever. Would you upload your C2 beacon to VirusTotal during a Red Team? So, where exactly should we draw the line on AI?", "recording_license": "", "do_not_record": false, "persons": [{"id": 679, "code": "JSTPKN", "public_name": "Niels Pfau", "biography": "Niels is a Red Teamer at Mantodea Security who is well-known for (accidentally) breaking things, even if he doesn't want to. His work is focused on red team operations and researching technology on a low level in the hopes of finding just one more bug.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"id": 625, "guid": "5302d38a-b986-5e26-bf1b-9a77e6d9cd04", "logo": "/media/bsidesvienna-0x7ea/submissions/C37PNQ/readme_g73zddj.png", "date": "2026-06-27T11:10:00+02:00", "start": "11:10", "duration": "01:00", "room": "Mittlerer Saal (Track 1)", "slug": "bsidesvienna-0x7ea-625-bofs-in-the-background-async-object-file-execution-in-modern-c2-frameworks", "url": "https://cfp.bsidesvienna.at/bsidesvienna-0x7ea/talk/C37PNQ/", "title": "BOFs in the Background: Async object file execution in modern C2 frameworks", "subtitle": "", "track": "Mittlerer Saal (Track 1 - 260 pax)", "type": "Talk", "language": "en", "abstract": "Using Beacon Object Files (BOFs) to execute external post-exploitation capabilities from a C2 agent has been a staple technique in offensive security for years now. The self-contained programs are great for one-off tasks, such as gaining situational awareness, elevating privileges or dumping credentials. Recently, BOFs have received a powerful upgrade that allows for them to be executed in the background, enabling long-running real-time monitoring functionality. This talk shows how the [Conquest](https://github.com/jakobfriedl/conquest/) framework supports Async BOFs and how they can benefit modern red teaming.", "description": "In [last year's](https://cfp.bsidesvienna.at/bsidesvienna-0x7e9-2025/talk/VCQATE/) talk, I introduced Conquest, a command and control framework written in Nim. Since then, the project has been under heavy development and has seen countless new features, fixes and improvements. One of the most substantial changes was the addition of a Python module system, which allows red teamers and penetration testers to turn their favourite BOFs into Conquest commands. This drastically decreases the amount of functionality that has to be included in the base agent, because post-exploitation capabilities can simply be executed as external BOFs.\r\n\r\nHowever, regular BOF loading is boring. There are countless open-source implementations and it's a feature in almost all C2 frameworks on the market. On the other hand, the number of frameworks that support asynchronous BOFs can almost be counted on one hand. In fact, Conquest is one of the only C2s that features stable async object file execution, even when the agent memory is obfuscated or encrypted, something that until now has been exclusive to commercial tooling. \r\n\r\nThis talk goes beyond proof-of-concepts by also featuring novel use-cases for async BOFs that benefit real engagements.\r\n- [TGT Monitoring](https://github.com/jakobfriedl/tgt-monitor-bof)\r\n- [KeePass Abuse](https://github.com/jakobfriedl/keelog-bof)\r\n- [Clipboard Monitoring](https://github.com/jakobfriedl/clipboard-monitor-bof)\r\n- ...", "recording_license": "", "do_not_record": false, "persons": [{"id": 630, "code": "3AY9BB", "public_name": "Jakob Friedl", "biography": "Jakob is a penetration tester and security professional from Austria. He is particularly passionate about offensive security, including network penetration testing and Windows malware development. By day he works in an internal penetration testing team, conducting and leading engagements, while at night he mostly works on Conquest, a malleable and modular C2 framework written in Nim.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"id": 678, "guid": "3ea62090-2003-5349-90f4-c7d270214b5a", "logo": "", "date": "2026-06-27T13:15:00+02:00", "start": "13:15", "duration": "00:45", "room": "Mittlerer Saal (Track 1)", "slug": "bsidesvienna-0x7ea-678-net-shredder-coverage-guided-network-fuzzing-for-the-linux-kernel", "url": "https://cfp.bsidesvienna.at/bsidesvienna-0x7ea/talk/TVJ7J8/", "title": "Net Shredder: Coverage-Guided Network Fuzzing for the Linux Kernel", "subtitle": "", "track": "Mittlerer Saal (Track 1 - 260 pax)", "type": "Medium Talk", "language": "en", "abstract": "Net Shredder is a network coverage-guided fuzzer for the Linux kernel. Built with a modular approach, and focused on the ease of use, it could be adapted to fuzz other types of targets (e.g., usermode applications) as well. During development, it found three remote vulnerabilities in the Linux kernel, one of which resulted in CVE-2025-22037.", "description": "Net Shredder was built out of desire to build the simplest fuzzing setup possible for the Linux kernel:\r\n\r\n- Unlike grammar based fuzzing, this approach doesn\u2019t require rewriting the protocol spec in terms of fuzzer grammar;\r\n- Just a basic setup and a fuzzing corpus is enough;\r\n- Only small target modifications required.\r\n\r\nThis talks covers building it as a solo project I did in 2025:\r\n\r\n- Collecting remote KCOV outside process context, turning raw PCs into edge coverage\r\n- The struggle of restricting coverage to the targeted subsystem (2 failed and the one that worked)\r\n- Three bugs it found, including CVE-2025-22037 with bug analysis.", "recording_license": "", "do_not_record": false, "persons": [{"id": 704, "code": "7VXZWM", "public_name": "Vyacheslav \"Slava\" Moskvin", "biography": "Slava is a security researcher with 15 years of experience in information security. He has found more than 60 zero-day security vulnerabilities in IoT devices, Windows, and Linux applications. Currently working in the automotive field, his greatest interests are embedded systems and Linux internals.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"id": 631, "guid": "443d8785-4917-5f86-bb57-4ed69b8cc37c", "logo": "/media/bsidesvienna-0x7ea/submissions/W9MWHG/TEMPA_v2-Titleslide_IouA11d.png", "date": "2026-06-27T14:05:00+02:00", "start": "14:05", "duration": "00:45", "room": "Mittlerer Saal (Track 1)", "slug": "bsidesvienna-0x7ea-631-project-tempa-getting-phon-e-key-with-tesla-security-again", "url": "https://cfp.bsidesvienna.at/bsidesvienna-0x7ea/talk/W9MWHG/", "title": "Project TEMPA: Getting Phon(e)key with Tesla Security Again", "subtitle": "", "track": "Mittlerer Saal (Track 1 - 260 pax)", "type": "Medium Talk", "language": "en", "abstract": "Four years ago, Project TEMPA exposed the fundamental vulnerabilities within Tesla\u2019s Bluetooth Low Energy (BLE) Passive Entry system and the Vehicle Controller Secondary (VCSEC) protocol. The research demonstrated how trivial it was to execute Man-in-the-Middle (MitM) relay attacks to unlock and drive away modern vehicles. In response, Tesla embarked on a multi-year effort to overhaul its access systems. But did they actually fix the underlying problems, or just change the locks?\r\n\u200bIn this presentation, we are getting \"phonkey\" again. We will dive into a comprehensive 4-year retrospective of Tesla\u2019s Phonekey security evolution, dissecting the ongoing tug-of-war between seamless user experience and robust vehicle security.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"id": 577, "code": "NYHFTY", "public_name": "Martin Herfurt", "biography": "Martin Herfurt is an Austrian IT\u2011security researcher, Bluetooth\u2011security expert, and founder of the Salzburg-based security company IT\u2011Wachdienst. He is best known internationally for uncovering vulnerabilities in Tesla\u2019s Bluetooth PhoneKey system and for his long-standing work in wireless security.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"id": 681, "guid": "22020756-76dc-51de-b705-94a9e877ea30", "logo": "/media/bsidesvienna-0x7ea/submissions/J9QR9K/back2thebinary_q4q2w91.jpg", "date": "2026-06-27T15:20:00+02:00", "start": "15:20", "duration": "00:45", "room": "Mittlerer Saal (Track 1)", "slug": "bsidesvienna-0x7ea-681-back-to-the-binary-revisiting-similarities-of-android-apps", "url": "https://cfp.bsidesvienna.at/bsidesvienna-0x7ea/talk/J9QR9K/", "title": "Back to the Binary: Revisiting Similarities of Android Apps", "subtitle": "", "track": "Mittlerer Saal (Track 1 - 260 pax)", "type": "Medium Talk", "language": "en", "abstract": "New versions are usually exciting and full of possibilities, but keeping up with every new edge-case can be a very exhausting task. Especially on Android tools go out of date quickly and the latest research paper's implementation probably relies on a Java version most developers roll their eyes at.\r\n\r\nBut binaries? Binary tooling is forever. Well, let's say slightly more stable. We'll explore on a practical example how to use the Android Runtime to compile apps' Dalvik bytecode into binary ELFs and use BinDiff for similarity analysis.", "description": "Quickly determining whether two apps are related is interesting for a couple of reasons: Malware detection, impersonification, lineage analysis, and more. But making this decision based on their code has many pitfalls, even if we don't take obfuscation into account. Stale tools, no updates, missing dependencies - instead of those we'll use the binary representation of apps and a combination of open source tools to get an estimator for code similarity.\r\n\r\nThe talk will cover some Android internals based on examples, and will provide a practical blueprint how to calculate code-based similarity of apps based on open-source tools. Suitable for non-reverse-engineers.", "recording_license": "", "do_not_record": false, "persons": [{"id": 566, "code": "UFQ8A9", "public_name": "Jakob Bleier", "biography": "themoep.at, security scholar at TU Wien, conjurer of pretty pixels, wiggles air into sound, he/him", "answers": []}], "links": [], "attachments": [], "answers": []}, {"id": 669, "guid": "f4ef7429-4381-5ea2-865a-2990f0b6e833", "logo": "", "date": "2026-06-27T16:10:00+02:00", "start": "16:10", "duration": "00:55", "room": "Mittlerer Saal (Track 1)", "slug": "bsidesvienna-0x7ea-669-windows-ce-memory-archaeology-recovering-files-from-windows-ce-5-0-on-nxp-i-mx28-nand-flash", "url": "https://cfp.bsidesvienna.at/bsidesvienna-0x7ea/talk/UDUZHL/", "title": "Windows CE Memory Archaeology - Recovering Files from Windows CE 5.0 on NXP i.MX28 NAND Flash", "subtitle": "", "track": "Mittlerer Saal (Track 1 - 260 pax)", "type": "Medium Talk", "language": "en", "abstract": "This talk tells the story how a \u201clet\u2019s quickly look at the files\u201d span to a multi-day journey into ancient Windows CE filesystems and NXP processor NAND flash handling in an embedded system. Expect a deeply technical talk that explains how handling single bits make a difference and lets you peek into the complexity below (embedded) operating systems.", "description": "One of the first steps in embedded systems vulnerability research is to access the firmware, obtained from firmware updates or from a physical device. How hard can it be? Usually not that much. But in this case, after failing miserably using the quick and easy standard approach, we doubled down and layer by layer uncovered how files are stored by Windows CE 5.0 on devices using the NXP i.MX28 processor. The single topics are nothing new, but due to the age and targeting (mobile phones and PDAs) of most Windows CE tooling and hardware specifics, ready-to-use tools failed repeatedly. Starting with no clue about Windows CE internals, our approach was to leverage a combination of ancient technology (Windows XP) and modern technology (AI) to understand what we are dealing with and to adapt and build our customized tooling.", "recording_license": "", "do_not_record": false, "persons": [{"id": 535, "code": "8UZ3UP", "public_name": "Gerhard Hechenberger", "biography": "Gerhard is a Principal Security Consultant at SEC Consult who specializes in embedded systems and critical infrastructure. He works in the SEC Consult Hardware Laboratory in Vienna. His main job is executing security assessments of embedded systems, IoT/OT devices and OT networks to uncover configuration issues and zero-day vulnerabilities. He is a holder of several IT security certificates, speaker at local conferences, and has published numerous security advisories and blog posts.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"id": 686, "guid": "4b4b8659-b1a0-5c8c-9027-89a8e1d362e3", "logo": "", "date": "2026-06-27T17:10:00+02:00", "start": "17:10", "duration": "01:00", "room": "Mittlerer Saal (Track 1)", "slug": "bsidesvienna-0x7ea-686-zero-files-zero-noise-checkmate-in-three-", "url": "https://cfp.bsidesvienna.at/bsidesvienna-0x7ea/talk/FHQ7JH/", "title": "Zero Files, Zero Noise: Checkmate in Three.", "subtitle": "", "track": "Mittlerer Saal (Track 1 - 260 pax)", "type": "Talk", "language": "en", "abstract": "In this talk, we walk through a real intrusion observed in an EDR-monitored enterprise environment. The case did not start with a major incident or a flood of alerts. It began with two ambiguous notifications in the Defender portal that the customer could not immediately classify. What looked like a minor signal turned into a live hunt: an operator attempting fileless execution, interacting with endpoint controls, trying to disable or bypass defenses, and carefully pivoting through the network.", "description": "Modern intrusions rarely fail because one alert says everything. They fail when small, imperfect traces are recognized early enough and correlated into a timeline the operator did not expect.\r\nIn this case, OSINT and TTP comparison helped us put the observed behavior into context. We found overlaps with previously reported activity dating back to 2022, showing which parts of the operator\u2019s tradecraft remained stable and which had been adapted to the current defensive environment. This makes the case relevant now: the tooling changed, but the operational habits, decision points, and forensic residue remained recognizable. The focus is not attribution for its own sake, but understanding how recognizable patterns can support an active investigation.\r\nWe will show how the investigation moved through three decisive phases: identifying the initial execution pattern, separating real attacker activity from low-signal security telemetry, and reconstructing the operator\u2019s movement from endpoint, identity, and network evidence. Along the way, we will discuss what the defender\u2019s environment made possible, where visibility was missing, and why the attacker\u2019s interaction with Defender became an investigative advantage rather than just a detection failure.\r\nThe focus is Incident Response depth: not attribution, not tool training, but the reconstruction of attacker behavior from imperfect telemetry. Attendees will see how current fileless and defense-evasion techniques can still produce useful traces, which log sources made the difference in this case, and how two initially unclear Defender for Endpoint notifications were turned into a defensible incident timeline.", "recording_license": "", "do_not_record": false, "persons": [{"id": 708, "code": "DWXGGT", "public_name": "Jonas Plitt", "biography": "Jonas has been working in Cyber security for more than 15 years, specializing in Incident Response and the defense against advanced persistent threats. His experience spans firewall security, endpoint security, and digital forensics, with a strong focus on supporting organizations during critical security incidents. In his work, Jonas helps customers investigate complex intrusions, contain active threats, and turn technical findings into actionable decisions for crisis management. He regularly works at the intersection of technical analysis, organizational response, external advisors, and law enforcement. He is particularly interested in identifying and disrupting APT actors by combining forensic evidence, endpoint and network telemetry, and threat intelligence to understand attacker behavior and improve defensive strategies.", "answers": []}], "links": [], "attachments": [], "answers": []}], "Dachsaal (Track 2 )": [{"id": 635, "guid": "a8c5268e-554d-5a04-a266-0377a4984574", "logo": "", "date": "2026-06-27T10:05:00+02:00", "start": "10:05", "duration": "00:30", "room": "Dachsaal (Track 2 )", "slug": "bsidesvienna-0x7ea-635-it-s-not-you-it-s-your-dependencies-a-nerdy-lawyer-s-guide-to-the-software-supply-chain", "url": "https://cfp.bsidesvienna.at/bsidesvienna-0x7ea/talk/AJN9TG/", "title": "It's Not You, It's Your Dependencies: A Nerdy Lawyer's Guide to the Software Supply Chain", "subtitle": "", "track": "Dachsaal (Track 2 - 190 pax)", "type": "Short Talk", "language": "en", "abstract": "This talk is about SBOM \u2014 the thing that has become the most important compliance artifact in software development. I'll cover:\r\n\r\n* **Why?** A brief, painful tour through the legal plot twists that turned the SBOM from a nice-to-have into a \"you literally cannot sell this product without one\" because too many discovered they had no idea what they were actually running.\r\n* **What?** what actually goes in one, what people *think* goes in one, why legal and IT security want one, and what happens if you vibe-coded the whole thing.\r\n* **Who?** What this all means for software developers, open source maintainers who never signed up to be vendors, and where the liability actually lies.\r\n\r\nExpect war stories, regulatory translation services, a healthy amount of \"I am not your lawyer, but\u2026\", less \u201cit depends\u201d and a takeaway list of things you can actually do on Monday morning \u2014 whether you're shipping software, consuming it, or maintaining the one library that all of your products depend on.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"id": 684, "code": "DZ8K3C", "public_name": "Katharina Bisset", "biography": "I deal with IT law so you can take care of tech.\r\nMag. Katharina Bisset, MSc is an attorney in Lower Austria, co-founder of the legal tech companies NetzBeweis and Nerds of Law. Before that, she worked for several years in large IT companies. Her areas of expertise are IT, IP, AI-, and data protection law. In addition to her legal education, she holds a MSc in Business Process Management and Engineering. She is also member of the disciplinary council at the Lower Austria Bar Association and a university lecturer.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"id": 664, "guid": "d2a6c288-8ed9-5ce1-bcf5-d518156fd140", "logo": "", "date": "2026-06-27T10:40:00+02:00", "start": "10:40", "duration": "01:00", "room": "Dachsaal (Track 2 )", "slug": "bsidesvienna-0x7ea-664-locks-opened-keyless-the-hard-way", "url": "https://cfp.bsidesvienna.at/bsidesvienna-0x7ea/talk/Z7XYAA/", "title": "Locks opened keyless the hard way", "subtitle": "", "track": "Dachsaal (Track 2 - 190 pax)", "type": "Talk", "language": "en", "abstract": "Possibly you already know lock picking.  Possibly not.\r\nWe explain what happens in the lock while picking or regularly with a key.\r\nLock picking itself, we will show you in an own workshop at the bsides vienna.\r\n\r\nAdditional, there are competitions.  For example the yearly austrian championship.\r\nOr the belt-system, which be presented.", "description": "A lock can be a hard challenge to open without a key.  Regularly these are installed in a door.\r\nWe do it a little bit easier, we do not install them, we hold them in our own hand.  But additionally we do it a little bit harder, because we do not want to destroy them.\r\nIf you want to open the door, there are much easier ways, but they will damage something.\r\n\r\nYou do not need to know, how a lock works, to pick them.  Usually, we do not explain it, we let beginners open the lock for the first time and anybody is surprised, it works easy.  But it was an easy lock.\r\nBut what are the differences between an easy and a hard lock?\r\n\r\nSo for that we have to explain a lock and the key.  Which technical behaviors are used to make it more and more challenging.  Somebody could think, the manufactures do it for more fun for the lock pickers.\r\n\r\nFor more fun, it is nice to use rules for competitions.  The belt-system is one.  Anybody can participate.\r\nAnd you can use it to describe the fun - sorry - the easiness or hardness of a lock for lock pickers.", "recording_license": "", "do_not_record": false, "persons": [{"id": 637, "code": "NGKZMV", "public_name": "deac", "biography": "There is nothing to tell about my past year.\r\nThere are totally different, but mostly follow the same principle.\r\nDetails i do not write public.\r\nYou can ask me!\r\n\r\nMy world are layer 1 to layer 8.\r\nI do anything in the IT from hardware to frontend and beyond the keyboard.\r\nYou can challenge me.\r\n\r\nI do not stand on the side of the attackers, i'm on the side will be attacked.\r\nI do not want, that you are smiling, that you broke my system.\r\nSo I talk, listen and laugh to/with the attackers, that I know, what they do.\r\nFor the others I'm the guy, who made the backups for them.  Or not.\r\nYou can trust me!\r\n\r\nAnd I'm a lock picker since 2018.\r\nYou can try it!", "answers": []}, {"id": 698, "code": "9UGL9N", "public_name": "TiborElias", "biography": "I started picking locks in 2024 and have been a member of the Lock Picker's United (better known as LPU) online community for 2 years. Picking locks for me is more of a leisure activity, which I do out of curiosity and for the feeling of accomplishment. There's nothing better than tackling a hard lock and finally getting it to open.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"id": 647, "guid": "c8b01653-91c6-5fd7-8ebd-4f10cdcfc029", "logo": "", "date": "2026-06-27T11:45:00+02:00", "start": "11:45", "duration": "00:20", "room": "Dachsaal (Track 2 )", "slug": "bsidesvienna-0x7ea-647-your-firewall-won-t-save-you-from-a-crowbar-introducing-the-pact-framework", "url": "https://cfp.bsidesvienna.at/bsidesvienna-0x7ea/talk/3GKCFS/", "title": "Your Firewall Won\u2019t Save You From a Crowbar: Introducing the PACT Framework", "subtitle": "", "track": "Dachsaal (Track 2 - 190 pax)", "type": "Short Talk", "language": "en", "abstract": "For years, the cybersecurity community has worshiped at the altar of the MITRE ATT&CK\u00ae framework to track digital adversary behaviors. We spend millions hardening the cloud, fine-tuning EDRs, and chasing zero-days, yet we consistently forget one glaring reality: an adversary can just walk through the front door with a high-vis vest and a clipboard. \r\nEnter PACT (Physical Access & Control Taxonomy). Built to bridge the grand canyon between meatspace and cyberspace, PACT is an open-source, community-driven framework that translates physical tactics, techniques, and procedures (TTPs) into a structured matrix that mirrors the MITRE ATT&CK format.", "description": "We spend millions hardening the cloud, fine-tuning EDRs, and chasing zero-days, yet we consistently forget one glaring reality: an adversary can just walk through the front door with a high-vis vest and a clipboard. For years, the cybersecurity community has worshiped at the altar of the MITRE ATT&CK\u00ae framework to track digital adversary behaviors. Meanwhile, physical security has remained trapped in a legacy bubble of \"locks, blocks, and glocks,\" utilizing entirely different risk languages.\r\n\r\nWhen a threat actor breaks into a facility to deploy a network implant, is it a cyber attack or a physical breach? It's both-and our current defense matrices fail to map this convergence.\r\n\r\nEnter PACT (Physical Access & Control Taxonomy). Built to bridge the grand canyon between meatspace and cyberspace, PACT is an open-source, community-driven framework that translates physical tactics, techniques, and procedures (TTPs) into a structured matrix that mirrors the MITRE ATT&CK format. This talk will rip off the band-aid of siloed security, break down the anatomy of the PACT matrix, and demonstrate how Red and Blue teams can finally use a single, unified language to hunt threats across both the digital and physical realms.", "recording_license": "", "do_not_record": false, "persons": [{"id": 640, "code": "JYSE3Z", "public_name": "Darius Beckert", "biography": "I\u2019m a caffeine-powered Red Teamer @ slashsec specializing in tearing apart Active Directory, conducting physical reconnaissance, and talking my way into places I shouldn't be. If I'm not dumping your credentials, I'm probably casing your facility or cloning your badge.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"id": 634, "guid": "14e5d87b-d7b1-5c29-ba41-a35778224751", "logo": "", "date": "2026-06-27T13:05:00+02:00", "start": "13:05", "duration": "00:50", "room": "Dachsaal (Track 2 )", "slug": "bsidesvienna-0x7ea-634--the-human-factor-cybersecurity-s-weakest-link-or-most-adaptive-defense-", "url": "https://cfp.bsidesvienna.at/bsidesvienna-0x7ea/talk/MAKHRG/", "title": "\"The Human Factor. Cybersecurity's weakest link or most adaptive defense?\"", "subtitle": "", "track": "Dachsaal (Track 2 - 190 pax)", "type": "Medium Talk", "language": "en", "abstract": "In Cybersecurity there is a narrative existing: The problem is sitting in front of the screen\u2026 but is it?\r\n\r\nOur understanding of humans in cybersecurity is shaped by problematic metaphors, which influence how we design security systems. The way we likely describe humans, shapes how we approach cybersecurity.\r\n\r\nHumans are as seen as the weakest link: Humans are viewed as the main source of failure > Assumption: Technology is strong, humans are weak\r\n\r\nHumans are seen as driven by fear: as frightened animal > Assumption: Fear and punishment drive secure behavior\r\n\r\nAnd once you believe, that the human is the problem, you stop looking for better explanations.\r\n\r\nIn our talk we will have a deeper look at these assumptions and the psychological as well as technical factors of (in)secure behavior in organizations\r\nCognitive biases often cause individuals to underestimate rare but catastrophic risks or to place excessive trust in automation. Routine blindness may result in subtle anomalies being ignored when tasks become repetitive. Furthermore, poor collaboration and information silos weaken collective intelligence, while misguided prioritization\u2014such as choosing convenience over security\u2014can undermine defense efforts. Yet, to fully leverage the strengths like pattern recognition, intuition, adaptive reasoning and ethical decision making, organizations should minimize human error through training, supportive tools, and sustainable working conditions, ensuring that human intelligence can function as a powerful ally in defending against digital threats.", "description": "In our talk we scrutinize the critical role of human behavior in cyber defense and how it reframes defense strategies beyond purely technical or machine-driven approaches. Human cognition acts as complementary system, not just a weak link. This creates a hybrid model, where adaptive human-decision making works in tandem with machine efficiency. One of its core strengths lies in pattern recognition and contextual understanding.\r\n\r\nSecurity analysts are often able to spot unusual behaviors or subtle anomalies that automated systems might overlook.\r\n\r\nEqually important are creativity and intuition, which allow humans to anticipate novel attack methods and think beyond established rules or signatures.\r\n\r\nLike the immune system, humans are capable of adaptability, adjusting strategies quickly in response to emerging threats.\r\n\r\nIn addition, they bring ethical judgment and strategic decision-making, enabling a nuanced evaluation of risks that goes beyond metrics and algorithms.\r\n\r\nHowever, the human factor also introduces vulnerabilities. Alert fatigue and cognitive overload can reduce vigilance, leading to missed threats.\r\n\r\nAgenda:\r\n\r\n    Assumptions \u201eThe problem is sitting in front of the screen\u201c (User)\r\n    Security Behavior in Organizations \u2013 Security Compliance vs. Security Participation\r\n    People don\u2019t fail randomly. They fail predictably within the system we design.\r\n    Organizational, Individual & Environmental influencing factors & dimensions of security behavior and the question \u201cWhy does security often not work in practice\u201d\r\n    \u201ePolicies are made to pass audits \u2013 not actually for you to follow\u201c\r\n    Practical examples: force of habits, alert fatigue, psychological Acceptability: Phishing\r\n    \u201cComputers are weird\u201d\r\n    Key Takeaways", "recording_license": "", "do_not_record": false, "persons": [{"id": 682, "code": "Q3LFHE", "public_name": "Yvonne Bauer", "biography": "Yvonne Bauer humanist with many years of expertise in human resources, recruiting, and diversity. After studying psychology and knowledge management, she worked for two consulting firms that focused on comprehensive HR consulting for IT companies. For several years now, she has been working in the cybersecurity industry, where her primary concern is to get more women excited about this field and encourage them to pursue and advance their careers in information security by volunteering as board member and national coordinator at Women4Cyber Austria.", "answers": []}, {"id": 699, "code": "SL9SX7", "public_name": "Wolfgang Ettlinger", "biography": "Wolfgang Ettlinger is heavily interested in the technical aspects of IT security, in particular application security. In the past decade he has gathered experience with a broad range of languages, technologies and frameworks in e.g. penetration testing, source code review and secure software development projects. He is responsible for the identification of dozens of CVEs affecting products from Citrix, Oracle, Symantec, Sophos, Trend Micro, etc. He currently serves as the Head of Research and Director for Application Security at Certitude Consulting.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"id": 633, "guid": "591b14c3-5071-5485-a7fb-47b7f9608a87", "logo": "", "date": "2026-06-27T14:00:00+02:00", "start": "14:00", "duration": "00:45", "room": "Dachsaal (Track 2 )", "slug": "bsidesvienna-0x7ea-633-the-sky-is-no-longer-the-limit", "url": "https://cfp.bsidesvienna.at/bsidesvienna-0x7ea/talk/USUBHG/", "title": "The sky is no longer the limit", "subtitle": "", "track": "Dachsaal (Track 2 - 190 pax)", "type": "Medium Talk", "language": "en", "abstract": "How drones (UAV\u2019s) are the threat everyone saw coming but no one acted in time. Drones are the \"Gray Rhino\" of modern security: a visible, high-probability threat we failed to mitigate. This talk explores how rapid UAV proliferation outpaced regulation, creating critical vulnerabilities in privacy and infrastructure. We\u2019ll analyze the shift from hobbyist novelty to sophisticated aerial risk and the urgent need for counter-UAS strategies.", "description": "While drones offer immense potential, they have introduced a complex new landscape of risk. This talk examines the \"Gray Rhino\" threats of 2026 high-probability security challenges often ignored until impact. We will analyze the transition of advanced drone tech from warzones to criminal enterprises, including the rise of unjammable fiber-optic controls and AI-enabled targeting. Beyond physical safety, we\u2019ll explore the escalating vulnerabilities of critical infrastructure and the too slow shifting regulatory response to aerial sabotage. We will dive deeper in the actual risk and legal mitigations we could and should take. The are shaping the battlefield already so society will be next.", "recording_license": "", "do_not_record": false, "persons": [{"id": 681, "code": "W7CVYR", "public_name": "Stephan Van Dyck", "biography": "Incident responder by trade coffee addict by choice. knows that in Incident Response, \"unprecedented\" is just another Tuesday. With a career dedicated to mitigating high-stakes digital and physical threats.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"id": 677, "guid": "67029650-17ba-52db-9fee-b3c3873a1495", "logo": "", "date": "2026-06-27T15:30:00+02:00", "start": "15:30", "duration": "00:30", "room": "Dachsaal (Track 2 )", "slug": "bsidesvienna-0x7ea-677-defending-identity-infrastructure-of-the-active-directory-with-deception-technologies", "url": "https://cfp.bsidesvienna.at/bsidesvienna-0x7ea/talk/VDQMNY/", "title": "Defending Identity Infrastructure of the Active Directory with Deception Technologies", "subtitle": "", "track": "Dachsaal (Track 2 - 190 pax)", "type": "Short Talk", "language": "en", "abstract": "Active Directory remains the core identity system in most enterprise and governmental environments, making it a primary target for attackers after initial network compromise. Once inside a network, adversaries typically focus on AD reconnaissance, privilege escalation, and lateral movement in order to gain full domain control.\r\n\r\nThis presentation explores how attackers perform Active Directory enumeration using common tools and techniques, and why traditional security monitoring often fails to detect these early-stage activities. It then introduces deception-based defense strategies as an effective approach for early detection of malicious behavior within identity infrastructures.\r\n\r\nThe session focuses on the use of Active Directory honeypots and canary tokens as proactive detection mechanisms. These decoy assets are designed to appear legitimate within the environment while acting as high-fidelity tripwires for suspicious activity. Any interaction with these objects can immediately signal potential reconnaissance or compromise attempts.\r\n\r\nThrough practical examples and a simulated attack scenario, the talk demonstrates how deception techniques can detect attacker behavior during directory enumeration, credential discovery, and privilege mapping. The presentation also highlights how these mechanisms integrate into Purple Team methodologies and support incident response and forensic investigations.\r\n\r\nAttendees will gain insight into how deception technologies enhance visibility within Active Directory environments, reduce attacker dwell time, and enable earlier detection of identity-based attacks before they escalate into full domain compromise.", "description": "Modern enterprise and governmental IT infrastructures rely heavily on identity systems to control access to critical resources. Among these systems, Active Directory (AD) remains the dominant identity management platform and therefore represents one of the most attractive targets for cyber attackers. Once an adversary gains an initial foothold inside a network\u2014whether through phishing, credential compromise, or exploitation of a vulnerable system\u2014the next strategic objective is typically the compromise of the identity infrastructure. By targeting Active Directory, attackers can escalate privileges, move laterally across systems, establish persistence, and ultimately achieve full domain dominance.\r\n\r\nIn recent years, numerous large-scale breaches have demonstrated that attackers often operate inside networks for extended periods before detection. During this dwell time, adversaries perform extensive reconnaissance activities within the directory environment. These reconnaissance steps typically involve directory enumeration, credential harvesting, privilege path analysis, and the identification of high-value targets such as administrative accounts or privileged service identities. Tools such as BloodHound are commonly used by attackers to map relationships between users, groups, and systems, enabling them to identify potential privilege escalation paths.\r\n\r\nTraditional detection approaches frequently struggle to identify these early-stage reconnaissance activities. Security monitoring systems generate vast volumes of log data, making it difficult to distinguish malicious behavior from legitimate administrative activity. As a result, attackers are often detected only after significant damage has already occurred, such as during lateral movement, privilege escalation, or the deployment of ransomware.\r\n\r\nThis presentation explores a proactive defensive strategy based on deception technologies, specifically focusing on the use of Active Directory honeypots and canary tokens as early-warning mechanisms within enterprise identity infrastructures. Deception techniques allow defenders to strategically place decoy assets within the directory environment that appear legitimate to attackers but are monitored closely by security teams. These assets function as highly sensitive tripwires: any interaction with them can immediately indicate suspicious or malicious activity.\r\n\r\nThe talk will examine how deception-based controls can be integrated directly into Active Directory environments through multiple layers of defensive instrumentation. These layers may include honey user accounts, decoy service identities, embedded credential lures, deceptive group memberships, and carefully crafted scripts placed in shared directories such as SYSVOL. When adversaries enumerate the directory or attempt to leverage these artifacts during their reconnaissance phase, detection mechanisms can trigger alerts and provide defenders with early indicators of compromise.\r\n\r\nParticular attention will be given to the implementation of canary tokens, a form of digital tripwire that generates alerts when accessed or used. By embedding tokens within configuration files, service account descriptions, administrative scripts, or backup documentation, defenders can create realistic artifacts that attackers are likely to interact with during credential discovery or environment mapping. When these tokens are triggered, alerts can be delivered through email notifications, security monitoring platforms, or integrated SIEM systems, providing immediate visibility into suspicious activity.\r\n\r\nThe presentation will also demonstrate how deception mechanisms can be incorporated into Purple Teaming methodologies, enabling collaboration between offensive and defensive security teams. Through controlled attack simulations performed by Red Teams, organizations can test whether their defensive monitoring systems successfully detect interactions with deception artifacts. Blue Teams can then refine detection rules, improve security monitoring workflows, and strengthen incident response procedures based on these insights.\r\n\r\nBeyond detection, deception technologies offer substantial benefits for digital forensic investigations. When attackers interact with honeypot objects or canary tokens, investigators can collect valuable forensic artifacts, including authentication attempts, directory queries, network activity, and timestamps associated with attacker behavior. These artifacts allow security teams to reconstruct the attacker\u2019s timeline, understand the reconnaissance techniques used, and determine the scope of a potential compromise. In this way, deception systems act not only as detection mechanisms but also as forensic sensors that capture high-fidelity evidence of adversary activity.\r\n\r\nA practical implementation scenario will be presented in which an attacker performs Active Directory reconnaissance using common tools such as BloodHound. During the enumeration process, the attacker encounters a realistic honey account that appears to belong to a backup service. Embedded credential lures and a hidden token trigger lead the attacker to interact with a decoy artifact. As soon as the attacker attempts to use the discovered credentials or access the embedded token, an alert is generated through a monitoring system such as Microsoft Defender for Identity or a SIEM platform. This early detection enables defenders to begin incident response activities before the attacker can escalate privileges or achieve domain control.\r\n\r\nIn addition to demonstrating the technical implementation of deception techniques, the presentation will discuss operational considerations and potential challenges. Effective deception requires realistic design to avoid detection by skilled adversaries. Honey accounts must follow believable naming conventions, deceptive artifacts must appear consistent with normal operational practices, and monitoring infrastructure must be properly configured to ensure reliable alerting. Maintenance and lifecycle management of deception assets are also important to maintain credibility within the environment.\r\n\r\nThe session concludes by exploring the broader strategic implications of deception technologies in modern cyber defense architectures. As attackers increasingly target identity systems, defensive strategies must evolve to detect adversaries earlier in the attack lifecycle. Deception-based detection mechanisms provide a powerful complementary layer to traditional monitoring controls by focusing on attacker behavior rather than relying solely on anomaly detection within large datasets.\r\n\r\nBy integrating honeypots, canary tokens, Purple Teaming exercises, and digital forensic analysis, organizations can significantly improve their ability to detect intrusions at an early stage, reduce attacker dwell time, and collect valuable intelligence about adversary techniques. The insights gained from these systems can help security teams strengthen defensive capabilities, refine detection strategies, and ultimately improve the resilience of enterprise identity infrastructures against modern cyber threats.", "recording_license": "", "do_not_record": false, "persons": [{"id": 628, "code": "BLKPWW", "public_name": "Ahmed Hassan", "biography": "Ahmed Hassan is an austrian cybersecurity engineer and penetration tester with over 7 years of experience in offensive security, recognized for speaking at major international conferences including Black Hat Saudi Arabia, Hack Red Con, and the Arab Security Conference. He has identified vulnerabilities for organizations such as United Nations, SAP, NASA, and multiple government institutions worldwide, while also earning 52 CVEs and numerous industry certifications including OSCP and CRTP.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"id": 663, "guid": "369c61a8-7745-5918-9c43-61eb8578750e", "logo": "/media/bsidesvienna-0x7ea/submissions/MZYRYC/quantum_encryption-not_IknJhEO.png", "date": "2026-06-27T16:05:00+02:00", "start": "16:05", "duration": "00:45", "room": "Dachsaal (Track 2 )", "slug": "bsidesvienna-0x7ea-663-quantum-secure-communication", "url": "https://cfp.bsidesvienna.at/bsidesvienna-0x7ea/talk/MZYRYC/", "title": "Quantum Secure Communication", "subtitle": "", "track": "Dachsaal (Track 2 - 190 pax)", "type": "Short Talk", "language": "en", "abstract": "Open Source Quantum Secure VPN - QKD + PQC over WireGuard\r\n\r\nQuantum computers will break the encryption we rely on today, and the clock is ticking. But what does that actually mean, and what can you do about it right now?\r\nThis talk starts from the ground up, giving attendees an accessible introduction to the two quantum-safe building blocks: Post-Quantum Cryptography (PQC), a mathematical software-based replacement for classical key exchange, and Quantum Key Distribution (QKD), a physics-based approach that uses quantum optical channels to distribute keys with information-theoretic security. No prior knowledge of quantum mechanics required.\r\nThe second half of the talk is around ARNIKA (https://github.com/arnika-project/arnika) and how to build a fully open-source quantum secure VPN that wraps WireGuard with both PQC (Rosenpass) and QKD (via the ETSI014 API) into a single deployable solution.\r\n\r\nAttendees will leave with:\r\nQKD and PQC fundamentals, what they are, how they differ, and when to use each\r\nA technical dive into open-source quantum secure VPN architecture, key derivation, ETSI014 integration, and WireGuard PSK injection\r\n\r\nTarget audience:\r\nSecurity professionals and engineers curious about quantum-safe networking, no quantum physics or crypto background needed.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"id": 697, "code": "ANNHQN", "public_name": "Andreas Neuhold", "biography": "Andreas Neuhold has 17+ years of experience building and operating core and security solutions for cable, fibre, and mobile internet access for leading international Tier-1 ISPs.\r\nCurrent areas of activity include projects and R&D aimed at developing new technologies, standards, and integrations in the fields of Quantum Communication using both Quantum Key Distribution (QKD) and Post-Quantum Cryptography (PQC).", "answers": []}], "links": [], "attachments": [], "answers": []}, {"id": 648, "guid": "9ccf777a-d0ee-593b-a47a-592da81a1aae", "logo": "", "date": "2026-06-27T16:55:00+02:00", "start": "16:55", "duration": "00:30", "room": "Dachsaal (Track 2 )", "slug": "bsidesvienna-0x7ea-648-attackbed-a-damn-vulnerable-network-for-profit-and-fun", "url": "https://cfp.bsidesvienna.at/bsidesvienna-0x7ea/talk/H7CXVP/", "title": "Attackbed: A Damn Vulnerable Network for Profit and Fun", "subtitle": "", "track": "Dachsaal (Track 2 - 190 pax)", "type": "Talk", "language": "en", "abstract": "In the last few years, I was responsible, together with my colleagues, for the fully open-source framework \"Attackbed\". We developed simulated networks with automated attacks and collected data for further evaluation of security measures or for building machine learning datasets. One example of such an evaluation is testing the performance of LLMs when used to detect malicious behavior in logfiles.  We not only created a simulation with complex attack chains but also developed several public Metasploit Exploits and an automated attack tool. I will cover all the technologies and attack chains, and provide a perspective on potential use cases for this open-source framework.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"id": 319, "code": "AG9NKZ", "public_name": "Wolfgang Hotwagner", "biography": "Wolfgang Hotwagner is a Research-Engineer at the Security Research Team of the Austrian Institute of Technology(AIT), where he works on various topics like \"Log File Anomaly Detection\", \"Bug Hunting\" and \"Cyberrange\". He is a Linux enthusiast with a focus on IT security.", "answers": []}], "links": [], "attachments": [], "answers": []}], "Kreativraum 3.1 (Track 3 - Women4Cyber/Rookie)": [{"id": 685, "guid": "54524bc8-b350-5cf7-a94a-66feb6031757", "logo": "", "date": "2026-06-27T09:45:00+02:00", "start": "09:45", "duration": "00:30", "room": "Kreativraum 3.1 (Track 3 - Women4Cyber/Rookie)", "slug": "bsidesvienna-0x7ea-685-when-machines-hack-back-how-ai-rewrote-the-threat-landscape-in-12-months", "url": "https://cfp.bsidesvienna.at/bsidesvienna-0x7ea/talk/AXV9VA/", "title": "When Machines Hack Back: How AI Rewrote the Threat Landscape in 12 Months", "subtitle": "", "track": "Kreativraum 3.1 (Track 3 - 50 pax - Women4Cyber/Rookie)", "type": "Short Talk", "language": "en", "abstract": "AI has industrialized cybercrime. Exploit timelines collapsed from days to hours, ransomware victims surged 389%, and 4.6 billion stolen credentials flooded darknet markets. Then Claude Mythos showed autonomous zero-day discovery at scale. This talk presents current threat data, examines how AI reshapes both offense and defense, and offers practical strategies for security leaders.", "description": "In 2025, cybercrime became a continuous, machine-speed system. Exploitation attempts surged 25% to 120 billion globally, time-to-exploit dropped to 24\u201348 hours, and AI tools like WormGPT eliminated the skill barrier for attackers. Identity replaced malware as the primary attack vector, with billions of stolen credentials enabling login-based intrusions at scale. Deepfakes now target executives directly for fraud and access.\r\n\r\nThe Claude Mythos announcement in April 2026 marked an inflection point: autonomous discovery of decade-old zero-days across all major operating systems overnight, for under $2,000 per exploit. This talk covers current threat data, the implications for defenders, and why Continuous Threat Exposure Management and AI-enabled defense are no longer optional.", "recording_license": "", "do_not_record": false, "persons": [{"id": 707, "code": "YXYKFW", "public_name": "Ronke Babajide", "biography": "Dr. Ronke Babajide is Manager Systems Engineering at Fortinet Austria, where she leads a technical team advising organizations on securing hybrid IT/OT environments. \r\nWith a PhD in Theoretical Chemistry from the University of Vienna, she started her IT career during the commercialization of the internet \u2014 progressing from web development and systems engineering into network performance, application delivery, and security.\r\nOver 15+ years in technical presales and advisory roles at Riverbed, Radware, VMware, and Fortinet, she has built deep expertise across the full infrastructure stack. This background gives her a practical, grounded perspective on how AI is transforming cybersecurity on both sides of the equation.\r\nAt Fortinet, she sees this shift firsthand: AI-driven threat detection and automated response are now core to the security platform, while adversaries increasingly use generative AI to scale phishing, develop malware, and accelerate attacks. \r\nHer daily work involves helping customers navigate this new reality \u2014 where AI is both the tool and the threat, and where traditional security models no longer hold up against the speed and sophistication of modern attacks.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"id": 645, "guid": "6e600f6c-1c16-52fb-b411-3a5844c543d8", "logo": "", "date": "2026-06-27T11:00:00+02:00", "start": "11:00", "duration": "00:45", "room": "Kreativraum 3.1 (Track 3 - Women4Cyber/Rookie)", "slug": "bsidesvienna-0x7ea-645-hacking-mobile-apps-in-a-structured-way", "url": "https://cfp.bsidesvienna.at/bsidesvienna-0x7ea/talk/A7AUTY/", "title": "Hacking Mobile Apps in a Structured Way", "subtitle": "", "track": "Kreativraum 3.1 (Track 3 - 50 pax - Women4Cyber/Rookie)", "type": "Medium Talk", "language": "en", "abstract": "Mobile app testing has many pitfalls and a structured approach is needed to get a holistic picture of the attack surface. The OWASP Mobile Application Security (MAS) project is able to support you with that. In this talk, you'll get a practical introduction to the MAS ecosystem which consists of the standard, mobile weaknesses and how to test them. You will see test cases and demos for iOS and Android in action for static and dynamic analysis, and learn how to perform a mobile penetration test on a non-jailbroken iOS device.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"id": 692, "code": "YTRBUT", "public_name": "Sven Schleier", "biography": "Sven is a co-founder of Bai7 GmbH in Austria, which is specialized in trainings and advisory. He has expertise in cloud security, offensive security engagements (Penetration Testing) and Application Security, notably in guiding software development teams across Mobile and Web Applications throughout the Software Development Life Cycle (SDLC) to integrate robust security measures in from the start. \r\n\r\nBesides his day job, Sven is involved with the Open Worldwide Application Security Project (OWASP) since 2016. As a co-project leader and author, he has significantly contributed to the OWASP Mobile Application Security Testing Guide (MASTG), Mobile Application Security Weakness Enumeration (MASWE) and the OWASP Mobile Application Security Verification Standard (MASVS).", "answers": []}], "links": [], "attachments": [], "answers": []}, {"id": 650, "guid": "63e72e78-5bd3-586d-a996-031e012b9226", "logo": "/media/bsidesvienna-0x7ea/submissions/8ACFFK/Auteria-banner_kKekdy7.png", "date": "2026-06-27T13:00:00+02:00", "start": "13:00", "duration": "00:30", "room": "Kreativraum 3.1 (Track 3 - Women4Cyber/Rookie)", "slug": "bsidesvienna-0x7ea-650-hackerone-club-austria", "url": "https://cfp.bsidesvienna.at/bsidesvienna-0x7ea/talk/8ACFFK/", "title": "HackerOne Club Austria", "subtitle": "", "track": "Kreativraum 3.1 (Track 3 - 50 pax - Women4Cyber/Rookie)", "type": "Short Talk", "language": "en", "abstract": "HackerOne Club Austria!\r\n\r\nThis club is dedicated to building a collaborative and welcoming hacker community across Austria. Whether you are an experienced bug bounty hunter, cybersecurity professional, student, or someone just getting started in ethical hacking, you are welcome to join and grow with the community.\r\n\r\nThe Austria HackerOne Club organizes a wide range of events including:\r\n- local meetups\r\n- live hacking sessions\r\n- educational workshops\r\n- Capture The Flag (CTF) competitions\r\n- conference gatherings\r\n- world cup meetings (AWC)\r\n- discussions focused on bug bounty, ethical hacking, and cybersecurity.", "description": "HackerOne Club Austria!\r\n\r\nThis club is dedicated to building a collaborative and welcoming hacker community across Austria. Whether you are an experienced bug bounty hunter, cybersecurity professional, student, or someone just getting started in ethical hacking, you are welcome to join and grow with the community.\r\n\r\nThe Austria HackerOne Club organizes a wide range of events including:\r\n- local meetups\r\n- live hacking sessions\r\n- educational workshops\r\n- Capture The Flag (CTF) competitions\r\n- conference gatherings\r\n- world cup meetings (AWC)\r\n- discussions focused on bug bounty, ethical hacking, and cybersecurity.\r\n\r\nThese events are designed to encourage hands-on learning, knowledge sharing, collaboration, and stronger connections within the local security community.\r\n\r\nHacking Meeting:\r\nThe hacking meetings are especially interesting to community members. Hackers come together in person or virtually to hack on bug bounty programs. HackerOne may partner with private programs to provide an interesting meetup. Members may get access to new and fresh hacking scope or invitations to private programs. HackerOne provides a leaderboard to track the progress of the meetup. There is the possibility of special reward multipliers or better payouts for researchers.\r\n\r\nBy joining this club, you'll stay informed about upcoming HackerOne community events in Austria, connect with fellow hackers in your region, and become part of a global community that values learning, responsible disclosure, and collaboration.", "recording_license": "", "do_not_record": false, "persons": [{"id": 696, "code": "ATHGNR", "public_name": "Alexander Krenn", "biography": "Mit \u00fcber einem Jahrzehnt Erfahrung in Softwareentwicklung und Sicherheitsl\u00f6sungen unterst\u00fctze ich derzeit als selbst\u00e4ndiger Software und Security Consultant Unternehmen dabei, innovative und sichere Softwarel\u00f6sungen zu entwickeln. \r\n\r\nMeine Arbeit als Senior Software Architect hat mir tiefe Einblicke in die Architektur komplexer Softwarel\u00f6sungen erm\u00f6glicht. Aktuell bin ich als Ethical Hacker und Bounty Hunter speziell auf #Hackerone aktiv.\r\n\r\nSeit Mai 2026 bin ich Hackerone Ambassador f\u00fcr \u00d6sterreich.\r\nhttps://h1.community/austria-hackerone-club/", "answers": []}], "links": [], "attachments": [], "answers": []}, {"id": 636, "guid": "e8cd75eb-77a8-508b-9ee6-66f93b116dcc", "logo": "/media/bsidesvienna-0x7ea/submissions/VA3RKU/offensive-ai_ftNLjx8.png", "date": "2026-06-27T13:35:00+02:00", "start": "13:35", "duration": "00:45", "room": "Kreativraum 3.1 (Track 3 - Women4Cyber/Rookie)", "slug": "bsidesvienna-0x7ea-636-offensive-ai-red-teaming-machine-learning-systems", "url": "https://cfp.bsidesvienna.at/bsidesvienna-0x7ea/talk/VA3RKU/", "title": "Offensive AI: Red Teaming Machine Learning Systems", "subtitle": "", "track": "Kreativraum 3.1 (Track 3 - 50 pax - Women4Cyber/Rookie)", "type": "Medium Talk", "language": "en", "abstract": "This talk explores offensive security techniques against ML and LLM systems, from adversarial inputs and data poisoning to prompt injection and model extraction, with a live local demonstration of indirect prompt injection against a self-hosted model. The attendees will learn about the risks of deploying AI systems without proper security measures.", "description": "This talk introduces the Offensive AI Framework, an open, structured knowledge base mapped to OWASP ML Top 10, OWASP LLM Top 10, and Google's SAIF. There will be a public repository where all the information related to the frameworks will be matched between the frameworks. Attendees will learn how ML models are trained and where that process introduces risk, how the major AI vulnerability frameworks are organized, and see practical exploitation of real vulnerabilities including data poisoning, prompt injection, and model fingerprinting. The session closes with a fully local live demo, no internet required, showing how reconnaissance leads to successful exploitation through indirect prompt injection (I will have a recorded video of the exploitation just in case as well).\r\n\r\n[Offensive-AI Framework](https://github.com/hardsoftsecurity/Offensive-AI)", "recording_license": "", "do_not_record": false, "persons": [{"id": 685, "code": "GQ3TFF", "public_name": "David De Maya Merras", "biography": "Cybersecurity Analyst focused on Offensive Security. I spend my time between terminals looking for the next challenge. That means that I have jumped between different topics on this huge Cyber Security world (Incident Response, Forensics, Threat Hunting, Pentesting & Red Teaming) but between us I like the feeling of getting a reverse shell ;). However this time I am comming up with:\r\n\r\n- Offensive AI: Red Teaming Machine Learning Systems\r\n\r\nHappy Hacking!", "answers": []}], "links": [], "attachments": [], "answers": []}, {"id": 667, "guid": "8233d8e9-7301-5d10-9cc8-29ab838d7fb1", "logo": "", "date": "2026-06-27T15:05:00+02:00", "start": "15:05", "duration": "01:00", "room": "Kreativraum 3.1 (Track 3 - Women4Cyber/Rookie)", "slug": "bsidesvienna-0x7ea-667-xpc-client-validation-music-to-my-ears-", "url": "https://cfp.bsidesvienna.at/bsidesvienna-0x7ea/talk/XX8GYX/", "title": "XPC Client Validation? Music to my ears!", "subtitle": "", "track": "Kreativraum 3.1 (Track 3 - 50 pax - Women4Cyber/Rookie)", "type": "Medium Talk", "language": "en", "abstract": "This talk examines how established macOS exploitation techniques can be applied to a largely overlooked attack surface: audio plugin installers. By analyzing installers from multiple major vendors, I demonstrate how common design and implementation flaws can be leveraged to achieve local privilege escalation. The presentation covers nine CVEs across five different vendors, highlighting recurring vulnerability patterns, exploitation strategies, and the security implications for both developers and end users. Attendees will gain insight into the intersection of macOS installer security and the audio software ecosystem, along with practical lessons for identifying and mitigating similar issues.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"id": 701, "code": "LNXRNX", "public_name": "Florian Haselsteiner", "biography": "Florian Haselsteiner is a Security Consultant, Penetration Tester, and Red Teamer at SEC Consult, specializing in offensive security and advanced security assessments. With several years of experience in penetration testing, vulnerability management, and adversary simulation, he helps organizations identify and mitigate complex security risks across enterprise environments.\r\n\r\nHis primary area of expertise is macOS security, which was also the focus of his master's research in Information Security (Dipl.-Ing.). His work led to the discovery and responsible disclosure of nine CVEs affecting five different vendors, contributing to improvements in the security of the Apple ecosystem and related technologies.\r\n\r\nHe holds a BSc. in Information and Software Engineering and industry-recognized certifications including CWES, CPTS, OSCP, and COAE. His interests include macOS internals, offensive security research, red teaming, and vulnerability discovery.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"id": 680, "guid": "ae412ca1-1602-5e6e-82a5-5d598ae4fe8f", "logo": "", "date": "2026-06-27T16:10:00+02:00", "start": "16:10", "duration": "01:00", "room": "Kreativraum 3.1 (Track 3 - Women4Cyber/Rookie)", "slug": "bsidesvienna-0x7ea-680-what-is-software-", "url": "https://cfp.bsidesvienna.at/bsidesvienna-0x7ea/talk/78ZAJJ/", "title": "What is software?", "subtitle": "", "track": "Kreativraum 3.1 (Track 3 - 50 pax - Women4Cyber/Rookie)", "type": "Talk", "language": "en", "abstract": "The answer to this question seems quite straightforward until we really start to think about it. My talk is inspired by a concept of Fred Brooks' 1986 paper \"No Silver Bullet\": the difference between essential and accidental complexity of software, only the first of which is an inherent and unremovable part of it. I want to investigate if such an \"essence\" of software really exists, and what follows if we take this view seriously.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"id": 705, "code": "8W7VEK", "public_name": "M\u00e1ria Kamilla Husz\u00e1r", "biography": "I studied at the 42 Vienna coding school, which is in Heiligenstadt, and work at RBI, which is also there. I am also doing MA in Philosophy at University of Szeged (Hungary).", "answers": []}], "links": [], "attachments": [], "answers": []}, {"id": 679, "guid": "7405f943-da77-55cf-bea0-8c4f2f8d04a8", "logo": "/media/bsidesvienna-0x7ea/submissions/V7JZEW/cbor_minesweeper_cover_lKZgHg1.png", "date": "2026-06-27T17:15:00+02:00", "start": "17:15", "duration": "00:30", "room": "Kreativraum 3.1 (Track 3 - Women4Cyber/Rookie)", "slug": "bsidesvienna-0x7ea-679-parsing-cbor-is-a-minefield-a-study-of-cbor-parser-behavior", "url": "https://cfp.bsidesvienna.at/bsidesvienna-0x7ea/talk/V7JZEW/", "title": "Parsing CBOR is a Minefield: A Study of CBOR Parser behavior", "subtitle": "", "track": "Kreativraum 3.1 (Track 3 - 50 pax - Women4Cyber/Rookie)", "type": "Short Talk", "language": "en", "abstract": "CBOR (RFC 8949) is a binary serialization format used in constrained security-critical systems like FIDO2/WebAuthn and COSE. Despite a precise specification, implementations diverge across languages and systems, leading to different behavior when confronted with the same input. In this talk, 11 CBOR parsers across seven languages are compared to identify security-relevant behavior, such as unexpected acceptance/rejection of input, hangs and crashes.", "description": "CBOR underpins much of modern security infrastructure. Yet whether two implementations agree on what a given byte sequence means, and how they handle edge cases and malformed data, has received little public systematic attention. This talk examines 11 widely-used CBOR parsers spanning C, Rust, Python, Java, Go, C#, and JavaScript, selected for real-world deployment, active maintenance, and architectural diversity. I cover the testing methodology, including fuzzing and a differential-testing harness that runs shared valid and invalid inputs across all parsers, as well as how the resulting divergences are visualized and analyzed.\r\n\r\nFinally, I discuss the observed divergences and any crashes the testing uncovered, their underlying reasons, and the security implications. As this talk presents ongoing research as part of my master's thesis, the results are still preliminary and open to change.", "recording_license": "", "do_not_record": false, "persons": [{"id": 670, "code": "LA3JZB", "public_name": "Jakob Pachmann", "biography": "Originally from Germany, Jakob is a penetration tester and security consultant based in Vienna, currently completing a Master's in Information Security at the University of Applied Sciences St. P\u00f6lten. He spent over two years at SBA Research conducting penetration tests of web applications, fat clients, and corporate networks, alongside source-code audits and social engineering assessments. Most recently, he worked as a penetration tester at Raiffeisen Informatik, where his work spanned penetration testing, CERT activities, and security incident management. He holds the OSCP and BSCP certification. His current research, part of his Master's thesis, examines divergences and security-relevant behavior across CBOR parser implementations.", "answers": []}], "links": [], "attachments": [], "answers": []}], "Kleiner Saal (Workshops Track)": [{"id": 638, "guid": "f20a4d6a-db63-5cc7-b9f0-2e3a2769965d", "logo": "", "date": "2026-06-27T09:30:00+02:00", "start": "09:30", "duration": "02:00", "room": "Kleiner Saal (Workshops Track)", "slug": "bsidesvienna-0x7ea-638-ntlm-relaying-in-practice", "url": "https://cfp.bsidesvienna.at/bsidesvienna-0x7ea/talk/FP9L8D/", "title": "NTLM-Relaying in Practice", "subtitle": "", "track": "Kleiner Saal (Workshops Track - 20 pax)", "type": "Workshop", "language": "en", "abstract": "In a lab environment we are going to do some hands-on sessions about NTLM-Relaying and showing common protection mechanisms that are effective against these kinds of attacks. So the workshop should be interesting for sysadmins and pentesters alike.\r\nIt ties into our talk about modern NTLM-Relaying methods and lets participants try out the attacks in a simulated environment provided by us.", "description": "In a Windows Active Directory environment, minor misconfigurations can lead to total domain compromise. This hands-on workshop dives into NTLM-Relaying attacks and explores exactly what happens when critical defenses like SMB signing and LDAP signing are left disabled and how NTLM-Relaying can still be abused with these mechanisms enabled.\r\n\r\n\u200bThrough practical, real-world demonstrations, participants will learn:\r\n<ul>\r\n  <li>How attackers intercept and abuse NTLM authentication</li>\r\n  <li>Lateral movement and privilege escalation scenarios caused by missing mitigations</li>\r\n  <li>Step-by-step blueprints to effectively secure your AD environment against these threats</li>\r\n</ul>\r\n\u200bBy the end of this session, you will not only understand how attackers exploit NTLM-Relaying but also how to shut them down.\r\n\r\nTo attend this workshop, participants will need a laptop with an installed SSH client.", "recording_license": "", "do_not_record": false, "persons": [{"id": 635, "code": "L8NEN9", "public_name": "Benjamin Floriani", "biography": "My fascination about complex systems began early on - with hacking computer games. While studying computer science at the University of Innsbruck, I discovered the Austrian Cyber Security Challenge, a capture-the-flag competition that promotes IT security talents in Austria.\r\n\r\nMy successful participation in this competition opened my way into professional IT security at the end of 2017. Since then, I have been pursuing my passion as a penetration tester. I have specialized in the field of red teaming and attack simulations through numerous further education and training courses - a field that continues to fascinate me.\r\n\r\nI am currently deepening my knowledge in the areas of internal infrastructures and malware development. This enables me not only to increase the precision of our penetration tests, but also to implement techniques such as lateral movement, local privilege escalation and full domain compromise in red team engagements even more effectively.", "answers": []}, {"id": 636, "code": "PGCB8K", "public_name": "Patrick Pongratz", "biography": "I have been passionate about ethical hacking and cyber security for as long as I can remember.\r\n\r\nI currently have more than eight years of experience in Red Teaming and Penetration Testing and am winner of multiple Austrian (and European) Cyber Security Challenge CTFs.\r\n\r\nWhile I was still studying computer science at Graz University of Technology, I dedicated myself to Penetration Testing and have been working in this industry continuously since summer 2017.\r\n\r\nI am proud to also be part of the Pentesting 101 Master's lecture at the ISEC Institute at TU Graz.\r\n\r\nMy current focus lies on cloud environments and infrastructure, improving Red Team engagements by leveraging cloud-native technologies and tools for initial access, lateral movement and data exfiltration.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"id": 665, "guid": "6ef9615a-cae8-5e61-a5e1-e79811a3320d", "logo": "", "date": "2026-06-27T12:30:00+02:00", "start": "12:30", "duration": "01:59", "room": "Kleiner Saal (Workshops Track)", "slug": "bsidesvienna-0x7ea-665-try-to-open-a-lock-keyless", "url": "https://cfp.bsidesvienna.at/bsidesvienna-0x7ea/talk/8Q9BGK/", "title": "Try to open a lock keyless", "subtitle": "", "track": "Kleiner Saal (Workshops Track - 20 pax)", "type": "Workshop", "language": "en", "abstract": "Really short:  You can try to open a lock without a key for you first time.\r\nYou do not need own tools for that, we provide everything you need, also the locks.\r\nIf you have your own tools, you can use it.\r\n\r\nAfter the workshop, you would be ready for the Austrian championship next year.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"id": 637, "code": "NGKZMV", "public_name": "deac", "biography": "There is nothing to tell about my past year.\r\nThere are totally different, but mostly follow the same principle.\r\nDetails i do not write public.\r\nYou can ask me!\r\n\r\nMy world are layer 1 to layer 8.\r\nI do anything in the IT from hardware to frontend and beyond the keyboard.\r\nYou can challenge me.\r\n\r\nI do not stand on the side of the attackers, i'm on the side will be attacked.\r\nI do not want, that you are smiling, that you broke my system.\r\nSo I talk, listen and laugh to/with the attackers, that I know, what they do.\r\nFor the others I'm the guy, who made the backups for them.  Or not.\r\nYou can trust me!\r\n\r\nAnd I'm a lock picker since 2018.\r\nYou can try it!", "answers": []}, {"id": 698, "code": "9UGL9N", "public_name": "TiborElias", "biography": "I started picking locks in 2024 and have been a member of the Lock Picker's United (better known as LPU) online community for 2 years. Picking locks for me is more of a leisure activity, which I do out of curiosity and for the feeling of accomplishment. There's nothing better than tackling a hard lock and finally getting it to open.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"id": 682, "guid": "5fb1a986-19ce-524d-82c6-0703a13d1534", "logo": "/media/bsidesvienna-0x7ea/submissions/9JKBGC/3-1_3BGf0PD.jpg", "date": "2026-06-27T15:15:00+02:00", "start": "15:15", "duration": "00:45", "room": "Kleiner Saal (Workshops Track)", "slug": "bsidesvienna-0x7ea-682-before-there-was-a-password-the-philosophy-and-politics-of-secrecy", "url": "https://cfp.bsidesvienna.at/bsidesvienna-0x7ea/talk/9JKBGC/", "title": "Before There Was a Password \u2014 The Philosophy and Politics of Secrecy", "subtitle": "", "track": "Kleiner Saal (Workshops Track - 20 pax)", "type": "Medium Talk", "language": "en", "abstract": "\"Secrecy is not a technical problem with a technical solution \u2014 it is a social contract so old we've forgotten we signed it.\" \r\nBefore encryption. Before firewalls. Before the first wax seal was pressed into a letter \u2014 someone decided that some things should not be known by everyone. Why? \r\nThis workshop doesn't start with algorithms. It starts much earlier: with the question of why humans began keeping secrets at all, what social and cognitive machinery that required, and what it might mean to dismantle those categories entirely.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"id": 706, "code": "QLGWBL", "public_name": "Iryna", "biography": "Hello everyone, my name is Iryna. I was born in Ukraine, but I live in various parts of the world. I am a teacher, a senior specialist in IT security and GRC, and a lecturer in Media Philosophy, Media Sociology and Intercultural Communication.\r\n\r\nEnglish and German are not my native languages, but I take every opportunity in my daily life to speak, read and think in English (and German anyway).\r\n\r\nIf I were asked to write about my life, I would talk about growing up in a working-class family, religious discrimination, financial and social inequality, unequal access to education, the long and slow path to an academic degree, migration and integration.\r\n\r\nI\u2019m more of a jack-of-all-trades with a wide range of interests; I get hooked on new things quickly, and I happily give 200 per cent when something catches my interest.\r\n\r\nIn my spare time \u2013 if I have any \u2013 I go bouldering or sometimes work shifts for the emergency medical service :)", "answers": []}], "links": [], "attachments": [], "answers": []}]}}]}}}