Schedule

Hospitals are a perfect example of a complex System of Systems. Their infrastructure is like a small city, with multiple, independent, operationally distinct systems that interact to deliver healthcare services to users at the end of the day. No single system controls the whole, instead, clinical services emerge from the coordinated behavior of clinical, administrative, and logistical subsystems. This also mean multiple single points of failure. And the convergence of IT and OT in this small cities we call hospitals is ramping up their cascading risk profiles. In this talk, we will explore 1000 ways do die, from delayed surgeries caused by a ransomware attack on the scheduling software to patient evacuation from HVAC systems, from infusion pumps being manipulated to target kills to medical data exfiltration to some country in Asia, from backup generator damage to DICOM clinical image manipulation. We will marathon through many different scenarios, protocols and technologies, highlights as much as possible about the challenges hospitals face in this world where everything seems connected, online and at the reach of a button.

Everyone is hardening their AI. Prompt filtering, OWASP LLM guidance, jailbreak prevention — organizations are checking every box. This talk is not about any of that.

This is the true story of a security assessment where the AI held up fine and the cloud infrastructure collapsed completely. The story is real. The engagement was real. The AWS keys in the Terraform file were real. The DNS poisoning was real. The privileged Kubernetes pod was real. The four days of undetected access were real. The Poptart stories injected into the AI training corpus were also real — and that detail stays in the talk, because it is the moment the audience truly understands what unmonitored infrastructure access means in an AI environment. Not as a theoretical risk. As something that happened, was demonstrable, and went completely unnoticed.

This session delivers a full chronological walkthrough of attacker methodology, escalation chain, and cloud compromise against a production AI system — with technical honesty and structured so that both the humor and the horror land exactly where they should. The technical content covers OSINT methodology, credential exposure via IaC, cloud infrastructure enumeration, DNS cache poisoning for prompt interception, Kubernetes privilege escalation, and training data integrity — without ever touching the LLM directly.

Key takeaways:

• Securing the AI layer means nothing if the surrounding cloud infrastructure is neglected
• Exposed credentials in IaC files remain one of the most prevalent and preventable attack vectors
• Logging and monitoring are not optional — you cannot detect or respond to what you never captured
• Kubernetes RBAC and pod security are not defaults; they are decisions someone has to make deliberately
• Training pipeline integrity is an AI security control almost nobody is implementing
• A real attacker will always take the path of least resistance — and that path is rarely through your guardrails

The through line is simple and deliberately uncomfortable: the AI was the most secure part of the entire system.

Thermal residue attacks - recovering PINs and passwords from heat left behind on keypads have long been considered an esoteric threat due to the high cost of thermal imaging equipment. This talk proves that effective thermal attacks no longer require $200+ smartphone attachments or thousand-dollar FLIR units.

Using a $30 far-infrared thermal array (such as the 32x24 pixel MLX90640) hooked up to a Raspberry Pi Zero via I2C, we demonstrate how to capture, process, and analyze keypress heat signatures in real time. We will walk through:

• AI Super-Resolution: A lightweight Convolutional Autoencoder upscales low-density 32x24 thermal matrices into high-fidelity temperature maps, isolating key boundaries.

• Temporal Heat-Decay Classification: A Recurrent Neural Network (LSTM / 1D-CNN) analyzes heat dissipation across consecutive frames, converting cooling rates directly into keypress chronology (e.g., Button 4 pressed 2s ago, Button 9 pressed 8s ago).

• Autonomous Edge Inference: The entire model is quantized to TensorFlow Lite / ONNX Runtime, running locally on $30 sensor rigs without needing cloud GPU processing or internet access.

• Field Results & Countermeasures: Benchmarking model confidence across door materials (ABS vs. Metal vs. Glass) and detailing how tiny heat perturbations can defeat the AI model.

Take Aways:

• Complete Bill of Materials (BOM) and schematics to build a low-cost thermal attack device.
• Open-source Python code for real-time sensor upsampling and temporal sequence recovery.
• Empirical attack data showing time-to-decay across common door lock materials.

Large language models can already use shells, call security tools, inspect outputs and keep working on a target across many steps. Once planning, memory, reflection and tool orchestration are added, the resulting system starts to resemble an autonomous offensive operator. The problem is that we still have a poor idea of how much of that capability is real. Most public benchmarks compare complete systems, changing the model, controller, tools and execution budget at the same time. That makes rankings easy to produce and much harder to interpret.

We built a large controlled benchmark to measure offensive AI under a common execution contract. The campaign covers 60 models, 400 cybersecurity scenarios and more than 300,000 isolated executions, spanning frontier models, reasoning-oriented systems, coding models and open-weight families from multiple providers. Models were tested with different agent architectures while keeping tools, information, target conditions and resource limits comparable. Success was validated externally by the environment rather than by trusting the model’s own assessment.

The dataset lets us look at much more than final solve rate. We analysed multi-step progression, tool use, recovery after failed approaches, behaviour under resource pressure, generalisation across target variants, cost, latency and model-controller compatibility. Some agents burn through large amounts of compute while making almost no useful progress; others solve the same class of problem with surprisingly little structure around the base model.

We will present the benchmark design, the methodology used to keep the experiment reproducible, representative execution traces and the results across models, architectures and task families. The goal is to put numbers behind a question that is becoming increasingly relevant for defenders: how capable are autonomous offensive agents today, where do they still fail, and which parts of the stack are actually driving progress?

Arbitrary file write is often treated as an “almost critical” bug class in web security: interesting and dangerous, but hard to prove impact when you can’t drop a web shell in an obvious location.

In this talk, we present a novel methodology that will let you pop shells across the most popular languages and frameworks in different ecosystems, all with minimal information about the application - which is particularly useful for bug bounty engagements.

We start by assessing the state of the art of arbitrary file write in black box scenarios, then build a methodology to identify exploitation capabilities and gather as much target information as possible. From there, we showcase new techniques to abuse file write primitives and achieve code execution, covering the most popular runtime environments.

The audience will leave with fresh techniques and a reusable mental model for identifying their target’s execution context and proving maximum impact in arbitrary file write scenarios.

Every year, conference badges end up forgotten in a desk drawer the moment the event ends, certainly accompanied by a mental note: “I’ll play with it ASAP.” But beneath the blinking LEDs and flashy screens lies a highly capable hardware platform. This talk is a call to action: don’t let your badge collect dust. Instead, reverse it, flash it, and retool it.

We will walk through the journey of taking the previous Bsides conference badge, powered by the ESP32-C6, reverse-engineering its hardware quirks, and repurposing it from scratch into a fully functional “Threat Radar” tool. Starting from a black-box approach with zero documentation, I will detail how we mapped the pinouts using visual tracing and brute-force test code, fought screen entropy to find the right display drivers, and bypassed strict hardware power constraints. And finally cover how we eventually leveraged existing baseline code to unlock the true potential of the C6 chip.

Attendees will learn about the badge’s architecture and how we built a custom threat-hunting app capable of continuous background scanning and Wi-Fi promiscuous sniffing. We will explore exactly how to build RF signatures by parsing payloads to detect Red Team tools, covert wearables (smart glasses), trackers (AirTags), and surveillance networks (Flock ALPRs). Finally, we will demonstratethe Foxhunt mode to physically track down MAC addresses in real-time. By the end of the talk, you will have the blueprint, and hopefully the motivation, to plug in your badge and build something completely new.

A sophisticated Android TV-box botnet, spoofing devices as phones operated quietly, escaping public research for years. Now, its operators openly advertise it as a fleet of over 120,000 “AI digital humans”. This talk presents the first end-to-end dissection of the “Fuyao Enterprise,” an enterprise-level ad-fraud scheme.

Fuyao’s bots run a dual monetization: they click ads across a network of AI-generated content farms mimicking human browsing, or get resold as residential proxies. A web of shell entities collects the payout, quietly seeking to bypass modern anti-bot controls to generate millions a year.

This talk presents a teardown of Fuyao’s “fraud-as-a-product” architecture, including novelties such as dynamic fraud tasks using a custom drag-and-drop editor based on Blockly (a coding language designed for children), computer vision models and more. Finally, we will TRACE the money, map Fuyao’s web of shell entities, and trail it back to its corporate origins in mainland China.

Attendees will leave with a clear picture of what enterprise-grade ad-fraud looks like, how this grey market operates and how we traced, exactly who is behind it.

This session will examine GNSS jamming and spoofing as cyber-physical threats affecting systems that depend on trusted positioning, navigation, and timing data. While GNSS interference is often discussed as an aviation, RF, or military problem, this talk will reframe it as a cybersecurity issue for autonomous systems, critical infrastructure, logistics, maritime operations, drones, telecoms, and other timing-dependent environments.

The session will begin with a short technical primer on GNSS, explaining how jamming degrades signal availability and how spoofing manipulates receiver trust by injecting false positioning or timing data. I will then place these techniques in the context of hybrid warfare, showing how electromagnetic interference can create disruption, ambiguity, and strategic pressure without requiring a conventional network intrusion.

The core of the talk will walk through real-world European cases from 2015–2025, including incidents affecting the Baltic region, the Black Sea, Eastern Europe, northern Europe, and commercial aviation routes. These examples will be used to show how GNSS manipulation can move from local signal interference to broader operational risk.

The technical section will focus on detection and resilience. I will explain how defenders can test whether systems are blindly trusting GNSS data, and how spoofing can be detected when GNSS-derived positions diverge from expected movement or independent sensor inputs. Techniques discussed will include multi-constellation and multi-frequency comparison, Galileo OSNMA, inertial navigation systems, sensor fusion, route and velocity consistency checks, anomaly detection, and Kalman filter innovation monitoring.

We’ve moved past the era of users manually bypassing chatbot filters with ‘Ignore previous instructions.’ and entered a more dangerous era: Indirect Injection.

The 2025 EchoLeak exploit first proved that a single unread email could trigger Microsoft Copilot to silently exfiltrate private data without a single user click. This was followed by the 2026 Claude Code hijacks, which demonstrated that a poisoned .CLAUDE.md file in a repository could allow an attacker to execute arbitrary shell commands and harvest sensitive environment variables.

The fundamental lack of a security boundary between data and instructions causes LLMs to treat every input as a potential command, transforming seemingly benign files such as a CV or a RAG chunk into an injection vector that can force the model to ignore its safety boundaries.

This session deconstructs real-world injection attack examples and the obfuscation techniques that make them effective. You’ll see how attackers leverage hidden metadata, Unicode steganography, and homoglyph substitution to tunnel malicious instructions through ‘invisible’ channels.

We conclude by outlining a hardened design pattern for resilient LLMs to ensure your agents can process untrusted data without compromising their internal logic.

During the 2025 Mobile Pwn2Own competition, we identified a series of vulnerabilities affecting Samsung devices. Chained together, these issues resulted in remote system-level compromise triggered by a single user interaction.

What distinguishes this entry from previous submissions is its focus on design oversights in Samsung’s voice agent, Bixby, that enabled privilege escalation through a single auto-granted Android permission. Because this permission is implicitly approved in many Samsung applications, exploiting just one of them allowed us to issue unauthorized commands to Bixby.

Further analysis revealed that Bixby maintains interprocess communication channels with a wide range of applications, including system components. We leveraged this architecture to force the agent to relay arbitrary commands to privileged services, effectively turning it into a bridge between unprivileged and system domains.

This briefing presents an architectural and security analysis of the Bixby voice framework and highlights the systemic weaknesses that enabled end-to-end device compromise. Specifically, we demonstrate how chaining vulnerabilities in preinstalled applications allowed us to leverage the Bixby agent to exfiltrate sensitive data and silently install applications by abusing its system-level capabilities.

Data poisoning attacks add small, often imperceptible perturbations to training data so a model learns the wrong thing without any obvious sign in the data itself. Nightshade popularized this against text-to-image generators, but the underlying mathematics generalizes to any model trained on images, and the attack surface grows wherever training data comes from public or crowdsourced sources.

This talk walks through the perturbation objective, a bounded norm constraint optimized against the target model’s loss, and shows why that formulation is what makes the perturbation both imperceptible and effective. I’ll then apply it in two case studies. First, a malware image classifier, where poisoned samples slipped into a public training corpus cause the model to miss a targeted malware family after retraining. Second, a medical imaging classifier, where the same perturbation technique shifts diagnostic accuracy on a clean test set. You will learn how these attacks are done, how they can be caught, and how far current detection methods actually get against this class of attack.

Attackers are using AI to break into systems. Bug bounty researchers to flood your inbox. Even managers are using it to write emails. Defenders are still triaging last quarter’s backlog.

This talk is a field report from building an AI agent that audits and pentests a real banking ecosystem. We’ll walk through the engineering that made it work, what we learned and how the same foundation now automates a growing chunk of our product security team’s work, scaling a small team to something closer to attacker speed, on a realistic budget.