Red Team
The purpose of the Red Team Training is to understand the underlying concept of red teaming. The training will cover payloads generation, lateral movement techniques, initial foothold and internal reconnaissance. The training is aiming to provide a deep understanding of all the previously described aspects of a red team. Click here for Training Syllabus
Charles F. Hamilton (Mr.Un1k0d3r) ,
Charles Hamilton is a Red Teamer with over ten years of experience delivering offensive testing services for various government clients and commercial sectors. In recent years, Charles has specialized in covert Red Team operations targeting complex and highly secured environments. These operations have enabled him to refine his skills in stealthily navigating client networks without detection.
Since 2014, he has been the founder and operator of the RingZer0 Team website, a platform dedicated to teaching hacking fundamentals. The RingZer0 community currently boasts over 50,000 members worldwide. Charles is also a prolific toolsmith and trainer who has delivered this training more than 20 times, both online and onsite. He is a speaker in the InfoSec industry, known under the handle Mr.Un1k0d3r.
White Knight Labs - Offensive Development
Dive deep into cutting edge techniques that bypass or neuter modern endpoint defenses. Learn how these solutions work to mitigate their utility and hide deep within code on the endpoint. The days of downloading that binary from the internet and pointing it at a remote machine are over. Today’s defenses oftentimes call for multiple bypasses within a single piece of code. Click here for Training Syllabus
Greg Hatcher , White Knight Labs
Greg has a background in Army Special Forces and teaching Windows internals at the NSA. He also led a 3-man red team for CISA that specialized in attacking America’s critical infrastructure. He authored and teaches WKL’s flagship course, Offensive Development, at Wild West Hackin’ Fest and virtually on the Antisyphon platform. Greg is passionate about C programming for the Windows operating system and abusing Active Directory. Greg is an active member of the following organizations: Cloud Security Alliance, the Right Place, American Corporate Partners, West Michigan Technology Council. He regularly appears in the news discussing cyber warfare and the impact of Chinese APTs on America's critical infrastructure. Greg has the following certifications: GXPN, GCPN, CRTP, CISSP, GWAPT, and GSEC.
John Stigerwalt , White Knight Labs
John has worked as blue teamer, vCISO, developer, senior penetration tester, and red team lead. John served as the F-Secure red team lead for the western hemisphere. He has led long‐term red team engagements in highly complex Fortune 500 companies. He has worked together with Microsoft to increase kernel security for the Windows operating system. He has led training at BlackHat, DerbyCon, and Wild West Hackin’ Fest. He is the author WKL’s Advanced Red Team Operations course (ARTO). John has the following certifications: OSCP, OSCE, CRTP (Certified Red Team Professional), CRTE (Certified Red Team Expert), and SLAE (Assembly Language and Shellcoding). John is known as one of the most talented offensive cyber security experts in the world and can do whatever is asked of him on a computer.
NotSoSecure - Hacking and Securing the Cloud
As cloud innovation gives birth to new technologies and new threats, now is the time to modernize your cloud security skills and bring them up to the industry standard. Join this hands-on, 4-day course to push your cloud hacking and vulnerability remediation skills to the next level and widen your career prospects. Get your hands dirty with our popular virtual labs and learn from experienced, practicing penetration testers with a legacy of training at Black Hat. Click here for Training Syllabus
Practical Burp - Advanced Tactics
Do you feel pretty good about your Web Application Security testing methodology, but think you might be able to get more out of your tools? Years of experience providing instruction on the process of conducting Web Application Security assessments has made it clear. Even the most experienced testers lack a complete understanding of everything that is available in the industry's #1 Web Application Security testing tool: PortSwigger's Burp Suite Pro. It's time to fix that with Practical Burp Advanced Tactics (PBAT). Click here for Training Syllabus
Efficient Web Hacking with Caido
Level: Beginner Capacity: 45Workshops are first-come, first-serve and have limited capacity. Some workshops may be streamed for additional passive participation.
The world of Web Hacking is evolving, and with it, our tooling must evolve as well. Caido, the new guy on the HTTP Proxy block, brings a new set of tools and capabilities to web hackers that minimize friction and increase efficiency in your hacking process. Join us as we explore: * Caido Workflows (easy to understand & integrate low-code/no-code automation) * Organization/Note Taking * Shift - Caido AI Integration * Environment Variables (no, not that kind) * HTTPQL Search * and much more
Caido has been adopted by many top hunters in the bug bounty scene - maybe you’re next.
Location: Workshop 1 room located between Vieux-Montreal hall and Ville-Marie room
Baremetal emulation
Level: Beginner Capacity: 45Workshops are first-come, first-serve and have limited capacity. Some workshops may be streamed for additional passive participation.
Ever wanted to make a CPU says Hello world? Or figure how a driver to communicate with hardware? Or how to reverse engineer a bootloader? Then this workshop is for you.
The ultimate goal of this workshop is to make participants understand how they could emulate and debug binaries which runs directly on a CPU, without an underlying operating system. Good examples of such binaries are bootloaders and the kernel of the operating system itself.
To this end, this workshop propose the following:
- Install a cross compiler toolchain and compile the Qemu emulator from source code.
- Try code samples with our compiled Qemu
- Modify these samples to make them work on different machine types
- Solve CTF challenge with static and dynamic analysis of a more complex binary using Qemu's debugging capabilities.
Marc-andre Labonte was a system administrator for more than a decade at the McGill Genome Center while it was known as the McGill University and Genome Quebec Innovation Center. There, he took part in the design, deployment, operation and maintenance of the data center as it went through multiple upgrade cycles to accommodate ever powerful high throughput genome sequencers coming to market.
Then, he joined the ETTIC team at Desjardins in 2016 as infrastructure penetration tester. Currently doing vulnerability research on IOT devices, he also presented "Automated contact tracing experiment on ESP Vroom32" workshop at NSEC in 2021. His work is motivated by curiosity and a strong sense of personal privacy in a world of connected devices and data hungry organizations.
Location: Workshop 1 room located between Vieux-Montreal hall and Ville-Marie room
Flying Under the Radar: Abusing HTTP to Bypass Suricata
Level: Medium Capacity: 45Workshops are first-come, first-serve and have limited capacity. Some workshops may be streamed for additional passive participation.
Network protocols are messy! Sure, there are standards - RFCs, IEEEs, you name it - but there are also multiple ways to do basically everything. If you're relying on network IDS/IPS tools like Suricata, I have bad news - a sufficiently clever attacker can bypass a lot of your signatures, leaving you completely blind.
Many attackers use off-the-shelf tools/exploits that are based on proofs of concept, while many defenders use detections based on the same proofs of concept and tools, which creates a really boring armistice. But as attackers (and defenders!) we can do so much better! The cool part about HTTP is that, at every level of the stack, your software tries to make sense of the user's (aka: the attacker's) requests. From the web server (Apache, IIS, etc) to the language parser (PHP, .NET, etc) to the various frameworks to the application code itself - everything just wants your requests to work. That's great for ensuring the internet keeps working, but creates makes it really hard to write signatures!
In this workshop, we'll learn about the structure of an HTTP request, including the URI, headers, post body, and all that. Then we'll learn a bunch of different exploit types - shell command injection, SQL injection, path traversal, and more - and how they fit into an HTTP request.
Once we have a firm footing in HTTP exploits, we'll learn how to write a Suricata rule to detect each of them. You'll get hands-on experience on both sides of the table - after writing exploits, you'll learn how to detect them!
Finally, once you're comfortable with basic exploit development and basic Suricata usage, we'll add a final twist: you'll exploit all of the same vulnerabilities again, several times each, but this time you'll have to evade my rules.
Can YOU bypass my Suricata rules? We'll see!
Ron Bowes Principle Security Researcher, GreyNoise Intelligence
Ron Bowes is a Principle Security Researcher on the GreyNoise Labs team, which tracks and investigates unusual--typically malicious--internet traffic. His primary role is to understand and track the big vulnerabilities of the day/week/month/year; often, that means parsing vague vendor advisories, diff'ing patches, reconstructing attacks from log files, and--most complex of all--installing and configuring enterprise software. When he's not at work, he runs the BSides San Francisco Capture the Flag contest, is a founder of The Long Con conference in Winnipeg, takes improv classes, and continues his project to finish every game in his Steam library.
Location: Workshop 2 room located in Community Room
Playing the game of tag with modern day AV and EDRs: A guide to evading the watchdogs.
Level: Medium Capacity: 45Workshops are first-come, first-serve and have limited capacity. Some workshops may be streamed for additional passive participation.
The perpetual race to safeguard and secure our infrastructures have given birth to robust defensive mechanisms, such as antiviruses (AV), Endpoint Detection and Response (EDRs), and Extended detection and response (XDR) just to name a few. Over the years the detection methodologies employed by them have evolved. From the very basic string and hash matching techniques, defensive mechanisms have enhanced their capabilities by employing machine learning, in memory scanning and other sophisticated techniques. From the perspective of a malware developer, developing malware is considerably easier as compared to evading it. In this talk we will discuss various techniques employed by malware developers to circumvent detection measures implemented by modern day AVs and EDRs. This talk will solely focus on the Windows ecosystem. We will discuss the nitty gritties of the Windows OS, followed by various detection techniques implemented by AVs and EDRs. After understanding the detection methods we will shift our focus on various techniques that can be implemented to bypass aforementioned detection techniques. Some techniques included are Unhooking, BlockDLL, Repatching, API Hashing, ETW and AMSI patching etc. In order to better understand the concepts discussed, we present real life PoCs. These PoCs will showcase the discussed evasion techniques on a popular red teaming tool (Juicy Potato). The implemented techniques will be tested against ‘Windows Defender’, a popular and widely used inbuilt AV solution by Microsoft. Furthermore these PoCs will showcase the exact detection methods and how we were able to bypass them to gain access.
Aryan Jogia Independent Security Researcher, Independent Security Researcher
Aryan is a security researcher with over 4+ years of experience. He’s a full time malware researcher and loves to evade AV and EDRs. His research interests are not just limited to Windows, but he even develops low level code for *nix systems. Even though his expertise lies in the domain of malware development and reversing, he also dabbles in the domain of red teaming. With his experience in low level programming, he also curates and develops toolkits extensively used for red team engagements. He has presented sessions at WildWest Hackin Fest, The Hack Summit, Carolina Con 4 and BSides Ahmedabad. With his CRTO certification in tow, he has led and participated in numerous red team engagements with strong defense mechanisms.
tChetanya Kunndra is a security researcher with over 3+ years of experience. His major area of expertise lies within the domain of pentesting and red teaming. Apart from red teaming, he has a knack for developing automation toolkits. He often dabbles with malware development and reverse engineering. With this knowledge he has been successfully able to evade sophisticated defenses in numerous red teaming exercises. He has published several researches in the domain of application of artificial intelligence in cyber security. He has presented sessions at WildWest Hackin Fest, The Hack Summit, Carolina Con 4 and BSides Ahmedabad. He has received his Masters of Technology in the domain of Cyber Security and also holds the CRTO certification.
Location: Workshop 2 room located in Community Room
Attacking AWS - From initial access to hardcore persistance
Level: Medium Capacity: 45Workshops are first-come, first-serve and have limited capacity. Some workshops may be streamed for additional passive participation.
Cloud platforms like Amazon Web Services (AWS) are foundational to many critical infrastructures and enterprise applications, making them prime targets for attackers. In this session, we will not only explore the most relevant attack vectors cybercriminals use to compromise AWS infrastructures but will also simulate these attacks using known threat actor techniques in an adversary emulation context. From initial access to hardcore persistence, this talk will provide a comprehensive look at how attackers operate in AWS environments.
We will take a technical journey through the tactics, techniques, and procedures (TTPs) employed by attackers at every stage of the threat lifecycle, aligned with the MITRE ATT&CK framework. We’ll start by reviewing common methods of initial access, such as exploiting exposed credentials or vulnerabilities in services like IAM, Lambda, and EC2. From there, we’ll detail how attackers escalate privileges, move laterally, and evade detection from tools like CloudTrail.
The session will conclude with an in-depth look at advanced persistence techniques in AWS, including the manipulation of IAM policies, backdooring Lambda functions or Docker containers, and tampering with logs. Along the way, we’ll demonstrate how security teams can implement defensive and detection strategies to mitigate these risks. By leveraging AWS-native services and third-party tools, attendees will learn how to enhance their incident response capabilities.
This hands-on workshop will give attendees practical, technical insights into AWS security, adversary behavior, and how to better defend against sophisticated, persistent attacks. With only two slides and full hands-on experience, this talk ensures deep technical immersion.
Santiago Abastante Incident Responder, Solidarity
Former Police Officer from Argentina, now a Cloud Incident Responder and Security Engineer with over 10 years of IT experience. A Digital Nomad an international speaker, I've presented on Cloud Security and Incident Response at Ekoparty, FIRST, Virus Bulletin (three times), Hack.Lu, and various BSides events worldwide. I hold a Bachelor's degree in Information Security and an MBA (Master in Business Administration).
Location: Workshop 1 room located between Vieux-Montreal hall and Ville-Marie room
Get off your high horse : How your expertise doesn't matter in an IPV context
Level: Beginner Capacity: 45Workshops are first-come, first-serve and have limited capacity. Some workshops may be streamed for additional passive participation.
This interactive workshop is designed for cybersecurity professionals and students at all levels - beginner to expert - who want to expand their understanding of how cybersecurity concepts can be applied to assist vulnerable communities.
The workshop uses intimate partner violence (IPV) survivors as a case study, illustrating the importance of tailoring digital security practices to meet the unique needs of this population. Drawing on real-world scenarios and insights from experts, the session emphasizes the importance of trauma-informed approach to cybersecurity, but also humility, adaptability, and collaboration in establishing threat models, helping people secure their digital life and designing systems, policies, and support mechanisms that truly prioritize their safety.
Through a combination of conceptual discussions and hands-on exercises, the workshop will challenge participants to critically examine how conventional expertise, rigid frameworks, and assumed best practices often fail to address the unique needs of vulnerable and high-risk communities.
This workshop will be led by members of Lab2038, a research and development collective specializing in cybersecurity, digital rights, and privacy. Lab2038 works at the intersection of technology and social justice, designing security solutions that prioritize marginalized communities. Their work bridges the gap between technical security measures and real-world needs, advocating for inclusive and adaptive digital security practices.
Corinne Pulgar Collaborator, Lab2038
Corinne Pulgar brings a unique blend of technical expertise and social awareness to the field of digital security. With a Master's in Software Engineering from École de Technologie Supérieure (ETS) and a Bachelor's in Computer Science from Université du Québec à Montréal (UQAM), they possess a deep understanding of software development and security. They have shown a steadfast commitment to education through their contributions as a project manager and InfoSec at Lab2038 and a teaching assistant and lecturer at multiple institutions, including McGill University, ETS and UQAM. Their ability to translate complex technical concepts into accessible knowledge has made them a sought-after lecturer and mentor.
Corinne’s research, presented at conferences and published in journals, focuses on model-driven software engineering and DevOps, demonstrating their innovative approach to software development. Their work at the intersection of technology and inclusivity reflects their dedication to leveraging their technical expertise for social good, specifically in enhancing digital privacy and security for vulnerable groups. Their unique perspective, combining technical acumen with a passion for social impact, makes them an ideal speaker to address the critical issue of digital privacy in the context of IPV.
Location: Workshop 1 room located between Vieux-Montreal hall and Ville-Marie room
Reconstructing Rust Types: A Practical Guide for Reverse Engineers
Level: Nose bleed Capacity: 45Workshops are first-come, first-serve and have limited capacity. Some workshops may be streamed for additional passive participation.
As of 2024, most reverse engineers still struggle to statically reverse Rust binaries. Static RE tools are beginning to develop features for analyzing Rust, and tools for recovering Rust library function signatures now exist. However, even when function symbols and signatures are available, analyzing data flow in Rust binaries is not trivial. The Rust type system, standard library, and compiler differ in many ways from C and C++, making type recovery difficult even for experienced reverse engineers.
This workshop provides a guide for reverse engineers on reconstructing types in Rust binaries. We will cover the basic building blocks of the Rust type system, from both the Rust programmer's perspective and the Rust compiler's perspective. From the primitive types, we will move to constructing the layouts of common standard library types found in Rust binaries, including types used in string formatting and in error handling. We will also cover artifacts inside Rust binaries that give information about type layout - how to find them, how to use them, and where in the Rust toolchain they actually come from.
The goal for this workshop is to provide the audience with a solid mental model for the layouts of Rust types, and present bite-sized practical techniques for Rust structure recovery. The intended audience for this workshop is reverse engineers who are familiar with reversing C or C++ code, but who are unfamiliar with both developing and reversing Rust.
Cindy Xiao Senior Security Researcher, CrowdStrike
Cindy Xiao is a security researcher who works primarily on malware reverse engineering, in support of cyber threat intelligence reporting. Cindy enjoys learning from other security practitioners (both offensive and defensive), developing tools to help with analysis, and mentoring others.
Location: Workshop 2 room located in Community Room
Reading The Docs: Hardware Hacking
Level: Beginner Capacity: 45Workshops are first-come, first-serve and have limited capacity. Some workshops may be streamed for additional passive participation.
Reading datasheets might not be glamorous, but it's crucial for hardware hacking - understand your target, then bend it to your will. In this workshop, we'll dive into technical details that even experts need the docs for, but we'll break it down to be beginner-friendly.
If you are curious about hardware and are into CTF challenges, this session might turn out to be a fun and insightful ride for you to learn something new. Let’s get hands on how hardware security works, or doesn’t, with flash memory and cryptographic coprocessors chips.
This workshop will use CTF challenges and electronic devices that will be provided to you for the duration of the session. Challenges are accessible through a console interface and don't require any special hardware devices.
All you need is a laptop, an USB C cable and the desire to learn and hack!
For those already advanced in that realm, we’ll go over a W25Q64JV and an ATECC608B using an ESP32, with some quirks and features that you can’t actually find easily online.
If you’re curious and just want to watch and learn, that’s fine too. We’ll go over concepts around content that was exclusively researched and developed for the CTF challenges.
By the end of this workshop, you should be able to understand how some electronic components work and what weaknesses can lead them to be hacked.
Come join us, you’ll see, hardware is really not that hard!
Jonathan Marcil Challenge Designer, NorthSec
Jonathan is part of NorthSec as a CTF challenge designer. He is passionate about Application Security and enjoys architecture analysis, code review, threat modeling and debunking security tools. Jonathan holds a bachelor's degree in Software Engineering from ETS Montreal and has 20+ years of experience in Information Technology and Security.
Patrick Downing Senior Manager - Secure Access Engineering, GitHub
Patrick is a cybersecurity and technology leader with over 15 years of experience in financial services and tech. He has managed complex security infrastructures, led global cryptographic operations, and pursued advanced research in quantum cryptography and AI. His hands-on expertise is demonstrated through active participation in CTF competitions, quantum computing hackathons, and his recent role as a badge team and challenge designer at NSEC. Merging practical hardware hacking knowledge with comprehensive cryptographic practices, Patrick continues to redefine the frontiers of cybersecurity, sharing insights that illuminate the practical application of security principles within hardware environments.
Location: Workshop 2 room located in Community Room
CTF Registration // Enregistrement
Setup your table, connect to the VPN, update your OS, rage because IPv6 does not work on your machine...
Installez-vous, connectez-vous au VPN, mettez à jour votre ordinateur, fâchez-vous qu'IPv6 ne fonctionne pas sur votre ordinateur...
Location: Salle de bal and de la commune rooms
Hacker Jeopardy
The classic Hacker Jeopardy at NorthSec. 2 rounds of 3 teams of 3 participants will answer weird, niche and funny questions in a Jeopardy!-style friendly contest. Then, a final round with the previous round's winners and NorthSec staff. Grab a drink and take a mandatory break from the CTF with us! The CTF infrastructure will be closed during this time.
//
Le Hacker Jeopardy classique de NorthSec. 2 rondes de 3 équipes de 3 participants vont répondre à des questions étranges, obscures et drôles dans une compétition amicale de style Jeopardy! Ensuite, il y a une ronde finale avec les gagnants des rondes précédentes et des bénévoles de NorthSec. Prennez un verre et une pause obligatoire du CTF avec nous! L'infrastructure du CTF sera fermée pendant ce temps.
Location: Salle de bal and de la commune rooms
CTF Day 2 + Breakfast by Corsek / CTF jour 2 et déjeuner par Corsek
<img alt="Corsek" src="https://nsec.io/img/partners/corsek.svg" width="150px" style="float: right" /> 🥐 ☕ 🥯 🧃 Breakfast thanks to CorSek! Déjeuner gracieuseté de CorSek!
CTF re-opens. Le CTF rouvre.
Location: Salle de bal and de la commune rooms
Podcast PolySécure
Participez à l'enregistrement d'un épisode du balado PolySécure pour un panel spécial pour revenir sur la première journée de conférences.
Garderie - Childcare
FREE on-site childcare services during NorthSec 2025 !
We believe that having kids should never be a barrier to participating in the most exciting cybersecurity event of the year. That’s why NorthSec is offering free childcare services for the entire event! 🎉
👶👦 Ages: 0 to 12 years old
🎲🎨 What’s included? Professional caretakers will provide a variety of games, toys, and activities to keep your little ones entertained while you focus on learning, competing, and networking.
📅 Childcare Schedule: ✅ May 15: 8:30 – 17:30 ✅ May 16: 8:30 – 20:00 ✅ May 17: 8:00 – 20:00 ✅ May 18: 8:00 – 17:00
If you’re interested, help us assess your needs by filling out this quick form: 👉 This is just for planning purposes and does not commit you to anything. https://docs.google.com/forms/d/e/1FAIpQLSc4qPc1Ck9mv8yzJN6m0qkV-SJ4LxkE_VnzE-2KoIU0esC1qQ/viewform
So let’s bring the next generation along and make NorthSec 2025 an event for everyone! 💙
Garderie - Childcare
FREE on-site childcare services during NorthSec 2025 !
We believe that having kids should never be a barrier to participating in the most exciting cybersecurity event of the year. That’s why NorthSec is offering free childcare services for the entire event! 🎉
👶👦 Ages: 0 to 12 years old
🎲🎨 What’s included? Professional caretakers will provide a variety of games, toys, and activities to keep your little ones entertained while you focus on learning, competing, and networking.
📅 Childcare Schedule: ✅ May 15: 8:30 – 17:30 ✅ May 16: 8:30 – 20:00 ✅ May 17: 8:00 – 20:00 ✅ May 18: 8:00 – 17:00
If you’re interested, help us assess your needs by filling out this quick form: 👉 This is just for planning purposes and does not commit you to anything. https://docs.google.com/forms/d/e/1FAIpQLSc4qPc1Ck9mv8yzJN6m0qkV-SJ4LxkE_VnzE-2KoIU0esC1qQ/viewform
So let’s bring the next generation along and make NorthSec 2025 an event for everyone! 💙
Garderie - Childcare
FREE on-site childcare services during NorthSec 2025 !
We believe that having kids should never be a barrier to participating in the most exciting cybersecurity event of the year. That’s why NorthSec is offering free childcare services for the entire event! 🎉
👶👦 Ages: 0 to 12 years old
🎲🎨 What’s included? Professional caretakers will provide a variety of games, toys, and activities to keep your little ones entertained while you focus on learning, competing, and networking.
📅 Childcare Schedule: ✅ May 15: 8:30 – 17:30 ✅ May 16: 8:30 – 20:00 ✅ May 17: 8:00 – 20:00 ✅ May 18: 8:00 – 17:00
If you’re interested, help us assess your needs by filling out this quick form: 👉 This is just for planning purposes and does not commit you to anything. https://docs.google.com/forms/d/e/1FAIpQLSc4qPc1Ck9mv8yzJN6m0qkV-SJ4LxkE_VnzE-2KoIU0esC1qQ/viewform
So let’s bring the next generation along and make NorthSec 2025 an event for everyone! 💙
Garderie - Childcare
FREE on-site childcare services during NorthSec 2025 !
We believe that having kids should never be a barrier to participating in the most exciting cybersecurity event of the year. That’s why NorthSec is offering free childcare services for the entire event! 🎉
👶👦 Ages: 0 to 12 years old
🎲🎨 What’s included? Professional caretakers will provide a variety of games, toys, and activities to keep your little ones entertained while you focus on learning, competing, and networking.
📅 Childcare Schedule: ✅ May 15: 8:30 – 17:30 ✅ May 16: 8:30 – 20:00 ✅ May 17: 8:00 – 20:00 ✅ May 18: 8:00 – 17:00
If you’re interested, help us assess your needs by filling out this quick form: 👉 This is just for planning purposes and does not commit you to anything. https://docs.google.com/forms/d/e/1FAIpQLSc4qPc1Ck9mv8yzJN6m0qkV-SJ4LxkE_VnzE-2KoIU0esC1qQ/viewform
So let’s bring the next generation along and make NorthSec 2025 an event for everyone! 💙
A Pirate's Guide to Snake Oil and Security
Watch the stream Level: MediumTalks will be streamed on YouTube and Twitch for free.
Welcome aboard the CVSS Bonsecours! Our first stop is the island of Vulnerability Management; a wild place first settled by hackers, now congested with warring tribes, each selling magick ointments that they claim will protect your ship from ghosts, whirlpools, termites, and giant squids alike. We'll visit these tribes, compare their warez, identify the useful products, and highlight those that just leave you greasy and poor.
Most recognized for creating Metasploit
HD Moore is a pioneer of the cybersecurity industry who has dedicated his career to vulnerability research, network discovery, and software development since the 1990s. He is most recognized for creating Metasploit and is a passionate advocate for open-source software and vulnerability disclosure.
HD serves as the CEO and co-founder of runZero, a provider of cutting-edge cyber asset management software and cloud services. Prior to founding runZero, he held leadership positions at Atredis Partners, Rapid7, and BreakingPoint. HD has also been a frequent speaker at industry events such as Black Hat and DEF CON.
HD’s professional journey began with exploring telephone networks, developing exploits for the Department of Defense, and hacking into financial institution networks. When he’s not working, he enjoys hacking on weird Go projects, building janky electronics, running in circles, and playing single-player RPGs.
Location: Ville-Marie Hall
A Tabletop As Big As the World
Watch the stream Level: MediumTalks will be streamed on YouTube and Twitch for free.
Most tabletop exercises for cybersecurity focus on the known issues and challenges in a particular organization: the architecture, the known vulnerabilities, the dynamics of incident response among different departments, and the current processes. When you're designing something bigger, for a multinational corporation, or for a competition that involves students in law, policy, international relations, and cybersecurity, the stakes get a lot bigger (and more fun to plan out). In this session, we'll talk about what we can learn from building a "bad day in cyber" exercise that involves geopolitical intrigue as well as an array of threat actors.
Wendy Nather Senior Research Initiatives Director, 1Password
Wendy Nather is the Senior Research Initiatives Director at 1Password. She was previously Director of Advisory CISOs at Duo Security, and Research Director at the Retail ISAC, where she was responsible for advancing the state of resources and knowledge to help organizations defend their infrastructure from attackers. Wendy was also Research Director of the Information Security Practice at independent analyst firm 451 Research, covering the security industry in areas such as application security, threat intelligence, security services, and other emerging technologies. Wendy has served as a CISO in both the private and public sectors. She led IT security for the EMEA region of the investment banking division of Swiss Bank Corporation (now UBS), as well as for the Texas Education Agency. Wendy is co-author of The Cloud Security Rules, as well as Splunk’s Bluenomicon. She was listed as one of SC Magazine’s Women in IT Security “Power Players” in 2014, and an “Influencer” in the Reboot Leadership Awards in 2018; she was inducted into the Infosecurity Europe Hall of Fame in 2021. She serves on the board of directors for Sightline Security, an organization that helps provide free security assessment services to nonprofit groups. Wendy is a Senior Fellow at the Atlantic Council’s Cyber Statecraft Initiative, and a steering committee member for the IST Ransomware Task Force. She is based in Fort Collins, Colorado.
Location: Ville-Marie Hall
Malware Q&A
Watch the stream Level: BeginnerThis is a Q&A session. Moderators will take audience questions both remotely and on-site via sli.do.
Q&A Panel for the Malware block
Axelle Apvrille Principal Security Researcher, Fortinet
Axelle Apvrille is a Principal Security Researcher at Fortinet, Fortiguard Labs. Her research interests are mobile and IoT malware that she reverses every day. In addition, she is the lead organizer of Ph0wn CTF, an on-site competition which focuses on ethical hacking of smart objects. In a prior life, Axelle used to implement cryptographic algorithms and security protocols.
Axelle has spoken at many conferences such as Black Hat Europe, Confidence, Hack.Lu, Hacktivity, Insomni'hack, ShmooCon, Troopers, Virus Bulletin... NorthSec 2021 ;-) She has also published in academic journals such as IEEE Security & Privacy, or Journal in Computer Virology. She regularly writes in the French magazine MISC and Hackable, and has recently published in Phrack #71.
Matthieu Faou Senior Malware Researcher, ESET
Matthieu Faou is a senior malware researcher at ESET where he specializes in researching targeted attacks. His main duties include threat hunting and reverse engineering of APTs. He finished his Master’s degree in computer science at École Polytechnique de Montréal and at École des Mines de Nancy in 2016. In the past, he has spoken at multiple conferences including Black Hat USA, BlueHat, Botconf, CYBERWARCON, NorthSec and Virus Bulletin.
Amaury-Jacques Garçon CTI analyst, Sekoia.io
Amaury-Jacques Garçon is a cybersecurity engineer working as technical Threat Intelligence analyst and focusing on the investigation of state-sponsored threats, currently at Sekoia.io . With professional experience in open source investigation, he has worked for the French Ministry of Armed Forces.
Location: Ballroom
Red Team Q&A
Watch the stream Level: BeginnerThis is a Q&A session. Moderators will take audience questions both remotely and on-site via sli.do.
Q&A Panel for the Red Team block
Jake Mayhew , White Knight Labs
Jake Mayhew is an experienced information security professional who currently serves as the technical lead for the offensive security team at UPMC. Before serving on an internal red team, he spent several years in consulting delivering security tests for clients in finance, healthcare, retail, critical infrastructure/nuclear energy, and law. He holds the OSCE3 (OSED, OSWE, OSEP), OSCP, CRTO, and OSDA certifications and loves to assist others in their cybersecurity learning path. Jake is one of the founding members of Applied Technology Academy's Asymmetric Training Group (ATG), and has a passion for sharing real-world knowledge and cutting-edge solutions with his students. Jake has led & co-led offensive security trainings including the PEN-200 OSCP training at BlackHat USA.
Charles F. Hamilton (Mr.Un1k0d3r) ,
Charles Hamilton is a Red Teamer with over ten years of experience delivering offensive testing services for various government clients and commercial sectors. In recent years, Charles has specialized in covert Red Team operations targeting complex and highly secured environments. These operations have enabled him to refine his skills in stealthily navigating client networks without detection.
Since 2014, he has been the founder and operator of the RingZer0 Team website, a platform dedicated to teaching hacking fundamentals. The RingZer0 community currently boasts over 50,000 members worldwide. Charles is also a prolific toolsmith and trainer who has delivered this training more than 20 times, both online and onsite. He is a speaker in the InfoSec industry, known under the handle Mr.Un1k0d3r.
Dorota Kozlowska Penetration Tester, Black Hills Information Security
Experienced cybersecurity professional with experience in Penetration Testing across Web, API, Network, and Mobile platforms, coupled with 7 years as a versatile Test Engineer & QA. Known for independently identifying and exploiting vulnerabilities to fortify organizational security, and backed by 8 years of Project Management expertise.
Skilled in simulating real-world attacks, conducting comprehensive security assessments, and providing actionable insights to enhance defenses. Certified in Covert Access, Physical Audit, and Elicitation Toolbox from the Covert Access Team, with demonstrated proficiency in physical penetration testing and security audits. Actively pursuing advanced Red Teaming training, dedicating personal time to mastering adversarial tactics, techniques, and procedures (TTPs). Eager to combine my Penetration Testing knowledge, physical security capabilities, and evolving Red Teaming skills to contribute to a team focused on proactive threat emulation and defense enhancement.
Recognized for a strong investigative mindset, meticulous attention to detail, and exceptional communication skills, ensuring assignments are completed with confidence and precision. Praised by colleagues as 'the glue that holds the team together,' I bring kindness and support to every endeavor.
Additionally, a published author of cybersecurity and offensive security articles, featured in HVCK and Top Cyber News Magazine. Creator of the preface to the upcoming book, "INTRODUCTION TO RED OPERATIONS 2.0 - A Basic Guide for Your Red Team Operations," authored by Joas A. Santos, and a technical reviewer for the upcoming "Hacking Mainframes: Dispelling the Myth of the Impenetrable Fortress" book authored by Kevin Milne.
Honored with the Cyber Woman Hope Award by CEFCYS and recognized among the "40 under 40" in Cybersecurity 2023 by Top Cyber News Magazine. As a keynote speaker, I've presented at FIC EUROPE 2023 and 2024, WGU 2024, BSIDES Kraków 2024, DEFCON Warsaw Meetup dc4822 2024, Virtual CON 2023, and The Hack Summit 2023.
I am an avid cyclist, archer, and guitar player.
Jeremy Miller Sr. Manager, Content Strategy and Development, OffSec (Offensive Security)
Jeremy has spent the last decade helping individuals and organizations improve their cybersecurity skills, mindset, and understanding. Prior to jumping into penetration testing, Jeremy was a martial arts instructor and a philosophy student. Both disciplines continue to deeply influence his unique perspective on teaching and learning cybersecurity. Jeremy currently serves as Sr. Manager of Content Strategy and Development at OffSec (formerly Offensive Security).
Location: Ville-Marie Hall
ML Q&A
Watch the stream Level: MediumThis is a Q&A session. Moderators will take audience questions both remotely and on-site via sli.do.
Q&A Panel for the Machine Learning Block
Logan MacLaren Senior Red Team Engineer, GitHub
Logan is a Senior Red Team Engineer at GitHub where he spends his time finding out how to best break (and fix) security controls. When not hacking on GitHub itself, Logan can be found doing security research focused on open source projects or learning and refining skills with CTF challenges!
Aditi Bhatnagar Founder, Offgrid Security
Aditi Bhatnagar is the founder of Offgrid Security - the company offering state-of-the-art AI solutions to up-level product security. Her interest lies in AI security, Android Privacy Posture and Web Application security. She has previously worked as a Lead Security Engineer at Atlassian building security into cloud, Core Engineer building features for end point security products and Data Scientist working on cutting edge AI algorithms at Microsoft. She has previously presented at dozens of international conferences including RSAC, May Contains Hackers, Diana Initiative, Android Security Symposium, Nullcon amidst others. Through her initiative, Infinite Hacks, she is spreading cyber awareness. She has conducted trainings and initiated discussions on LLM security, digital rights, and techno-sociology. She’s an avid blogger and publishes posts on cybersecurity, ethical hacking, and several aspects of the evolving relationship between humans and technology on her website.
François Labrèche Senior Data Scientist, Sophos
François Labrèche is a Senior Data Scientist at Sophos, who focuses on applying machine learning approaches to research problems related to security alerts and vulnerabilities. He focuses on using machine learning to improve the prioritization of alerts and vulnerabilities, in the context of XDR and vulnerability management. He explores the use of OSINT sources and the dark web in assessing the importance of newly published vulnerabilities.
He has a Ph.D. from École Polytechnique de Montréal, and has published research papers on the topics of spam detection, malware analysis, threat research and machine learning applied to cybersecurity. He has presented at ACSAC 2024, CAMLIS 2022, BSides Montreal 2021, University College London and École Polytechnique de Montréal, and has published papers in conferences such as the ACM Conference on Computer and Communications Security (CCS).
Location: Ville-Marie Hall
AppSec Q&A
Watch the stream Level: Nose bleedThis is a Q&A session. Moderators will take audience questions both remotely and on-site via sli.do.
Q&A Panel for the AppSec block
Most recognized for creating Metasploit
HD Moore is a pioneer of the cybersecurity industry who has dedicated his career to vulnerability research, network discovery, and software development since the 1990s. He is most recognized for creating Metasploit and is a passionate advocate for open-source software and vulnerability disclosure.
HD serves as the CEO and co-founder of runZero, a provider of cutting-edge cyber asset management software and cloud services. Prior to founding runZero, he held leadership positions at Atredis Partners, Rapid7, and BreakingPoint. HD has also been a frequent speaker at industry events such as Black Hat and DEF CON.
HD’s professional journey began with exploring telephone networks, developing exploits for the Department of Defense, and hacking into financial institution networks. When he’s not working, he enjoys hacking on weird Go projects, building janky electronics, running in circles, and playing single-player RPGs.
François is a Senior Product Security Engineer for BoostSecurity, where he leads the Supply Chain research team. With over 10 years of experience in building AppSec programs for large corporations (such as Intel) and small startups he has been in the heat of the action as the DevSecOps movement took shape. François is one of founders of NorthSec and was a challenge designer for the NorthSec CTF.
Jessa Riley Gegax Information Security Testing Analyst, Surescripts LLC
Jessa Gegax is an Information Security Testing Analyst at Surescripts LLC in Minneapolis, MN. Jessa holds an undergraduate degree in Computer Science and minor in Environment and Natural Resources with research interests in offensive cloud security, IoT devices, and web application/API penetration testing. In their free time, Jessa likes to go backpacking, practice yoga, and spend time with their dog (in no particular order).
Location: Ville-Marie Hall
Stolen Laptops - A brief overview of modern physical access attacks
Watch the stream Level: MediumTalks will be streamed on YouTube and Twitch for free.
Laptops have become ubiquitous in modern times. An all but guaranteed organizational asset that quite literally holds keys to the kingdom, in every employee's hands. For an attacker, what's not to love? From large government organizations to fortune 500 companies, these assets are constantly on the move and often poorly secured against advanced threat actors seeking to extract their secrets. Encryption at rest is NOT enough in 2025! And I can show you why.
This talk will showcase methodologies used by our offensive security team to penetrate well-hardened, modern laptops during engagements we call “stolen laptop scenarios”. No power? No credentials? No problem! We push the envelope to the limit of what can be realistically expected of next-generation adversaries. We begin by exploring the potential impact that a compromised laptop can have on an organization, briefly discussing potential lateral movement through extracted domain credentials, tickets, certificates, cookies, and sensitive data. After exposing the audience to the value obtained through physical compromise, we will discuss real attack vectors, with examples and video demos.
We will explore together direct-memory access attacks, the physical and logical implementations of these techniques, defenses, bypasses, and more. On the menu is an overview of PCI Express technology, DMA hardware including FPGA boards and what we do with them, practical demonstrations of attacks against modern laptops, countermeasures introduced by hardware vendors to protect against these attacks, and ways that attackers circumvent these protection mechanisms. Naturally, we will discuss BIOS/UEFI security, how it relates to DMA, and how we exploit pre-boot environments to gain access to a stolen computer. This includes showcasing physical attacks against BIOS EEPROM chips using a universal programmer.
Finally, we will talk about encryption at rest, specifically BitLocker, TPM implementation, and the potential implications of using these technologies for attackers, with a focus on why these are not sufficient for preventing attackers with physical access from compromising a PC. This section will culminate with an exploit demonstration compromising windows OS from UEFI via DMA when all modern countermeasures are enabled. Of course, we will discuss proper configuration that can limit or eliminate these attack vectors as well! We will discuss open-source tooling such as PCILeech, MemProcFS, UEFITool, etc, and some closed source tooling including XGPro.
Pierre-Nicolas Allard-Coutu Senior Penetration Tester, Bell Canada
Pierre-Nicolas Allard-Coutu is a senior penetration tester and offensive security R&D lead at Bell Canada's Security Testing and Incident Response team (STIRT). He is a seasoned red team operator with many years of experience specialized in the development of malware payloads and payload delivery systems. More recently, he has spearheaded the creation of physical penetration test methodologies including novel exploitation techniques aimed at compromising UEFI pre-boot environments and enabling Direct Memory Access vectors against modern laptops. He is currently the top public contributor to the Quebec Government Cyber Defense Center's vulnerability disclosure program, and part of the HackFest Challenge design team. The type of person who could never resist placing "><script>alert(1);<!-- in his bio.
Location: Ville-Marie Hall
Living Off the Pipeline: From Supply Chain 0-Days to Predicting the next XZ-like attacks
Watch the stream Level: Nose bleedTalks will be streamed on YouTube and Twitch for free.
The next wave of Supply Chain attacks is brewing in our Build Pipelines (CI/CD), where 0-days and novel attack paths are still waiting to be discovered. In 2024, the XZ compression library compromise was used as a trojan horse to backdoor OpenSSH, thankfully, this was caught early on, but the next time it might go unnoticed for much longer. This talk picks up where we left off last year, and we tell the story of how we went from finding 0-day vulnerabilities in the Build Pipelines of critical Open Source packages to predicting TTPs for the next XZ-like attacks. This time we've adapted MITRE's ATT&CK framework for CI/CD environments. We'll go in depth on how Threat Actors can "Live Off the Pipeline" by abusing legitimate build tools to do their bidding proving why this has become Red Teamer's favorite new soft spot.
The session introduces practical methods for predicting and identifying threats before they materialize by mapping build pipeline tactics to our adapted ATT&CK model. Real-world case studies, based on our forensics of the recent Kong Kubernetes Ingress Controller and Ultralytics YOLOv5 ML library compromises, will demonstrate how adversaries exploit build pipelines, escalate privileges, and can remain undetected long enough to have significant impact.
This session empowers attendees to proactively identify and defend against advanced supply chain attacks, effectively countering adversaries that seek to "Live Off the Pipeline" as demonstrated in the XZ compromise.
François is a Senior Product Security Engineer for BoostSecurity, where he leads the Supply Chain research team. With over 10 years of experience in building AppSec programs for large corporations (such as Intel) and small startups he has been in the heat of the action as the DevSecOps movement took shape. François is one of founders of NorthSec and was a challenge designer for the NorthSec CTF.
Location: Ville-Marie Hall
When the threat actor lives under your roof: Fighting Technological Violence in Domestic Abuse Cases
Watch the stream Level: BeginnerTalks will be streamed on YouTube and Twitch for free.
Spied on, followed, tormented: 70% of victims of domestic violence report experiencing technological abuse. As the technological environment around victims becomes more complex, how can we work to improve digital literacy among vulnerable populations and implement support tools?
Co-founder at cybercitoyen.org - an organization dedicated to making cybersecurity accessible to everyone to promote digital literacy and contribute to shaping cyber citizens who are alert, engaged, and proactive in protecting their personal information. Teacher at Polytechnique Montréal.
Location: Ville-Marie Hall
Weaponizing XSS: Cyberespionage tactics in webmail exploitation
Watch the stream Level: MediumTalks will be streamed on YouTube and Twitch for free.
Cross-site scripting (XSS) vulnerabilities allow attackers to inject malicious script code into legitimate web pages. Identifying XSS vulnerabilities is a typical pentesting exercise, as they are commonly found in web applications that use user-provided, including attacker-controlled, data as output. The theory is well understood, but what do real-world attacks look like?
Our research team at ESET has spent the last two years investigating the exploitation of XSS vulnerabilities in webmail portals. These portals are particularly vulnerable: their main purpose is to display untrusted HTML content, in the form of email messages, in the context of their web applications, which run in their users’ web browsers. During our research, we discovered two zero-day vulnerabilities, one each in Roundcube and MDaemon, and identified the use of multiple N-day vulnerabilities in Roundcube, Zimbra, and Horde.
Our presentation showcases the webmail vulnerabilities we uncovered, and provides a detailed analysis of the exploits and JavaScript payloads used by three cyberespionage groups: Russia-aligned Sednit and GreenCube, and Belarus-aligned Winter Vivern. We demonstrate how these groups leveraged XSS vulnerabilities to steal email messages from government officials and other high-value targets.
Matthieu Faou Senior Malware Researcher, ESET
Matthieu Faou is a senior malware researcher at ESET where he specializes in researching targeted attacks. His main duties include threat hunting and reverse engineering of APTs. He finished his Master’s degree in computer science at École Polytechnique de Montréal and at École des Mines de Nancy in 2016. In the past, he has spoken at multiple conferences including Black Hat USA, BlueHat, Botconf, CYBERWARCON, NorthSec and Virus Bulletin.
Location: Ballroom
Lightning Talks
Watch the streamTalks will be streamed on YouTube and Twitch for free.
Short 5 minutes talks from the community!
Location: Ballroom
UNO Reverse Card: Exposing C2 Operators Through Their Own Logs
Watch the stream Level: MediumTalks will be streamed on YouTube and Twitch for free.
Infostealers are malware that collect sensitive data from infected devices and transmit it to Command-and-Control (C2) servers operated by cybercriminals. The resulting stealer logs, containing credentials and system information, fuel a lucrative underground market. But what if C2 operators also fell victim to their own skim : the biters bit. Our research reveals that C2 operators themselves sometimes become unwitting victims, exposing valuable intelligence about their operations. In this presentation, we will be turning the tables on the very actors behind infostealers. Through analysis of stealer logs, we uncover diverse profiles within the infostealer ecosystem. Most notably "NoObSec" - amateur operators with critically poor security practices who can be de-anonymized through their own logs, and "Skip Tracers' Nightmares" - sophisticated actors operating from dedicated virtual machines who maintain strict operational security. These contrasting profiles demonstrate the wide spectrum of expertise in the infostealer landscape, from those who inadvertently expose their identities to those who masterfully conceal their tracks while orchestrating complex campaigns. This presentation presents case studies including a malware distributor using cracked software for infection and a threat actor operating multiple malware families to create a complex cybercriminal ecosystem. These examples demonstrate how stealer logs serve as powerful investigative tools for understanding both cybercrime infrastructure and techniques shaping the infostealer landscape. Join us as we pull back the curtain on the cybercriminal backstage.
Estelle Ruellan Cyber Threat Intelligence Researcher, Flare
Estelle is a Threat Intelligence Researcher at Flare. With a background in Mathematics and Criminology, Estelle lost her way into cybercrime and is now playing with lines of codes to help computers make sense of the cyber threat landscape. Estelle presented at conferences like ShmooCon 2025, Hack.lu 2024, eCrime APWG 2024 in Boston and the 23rd Annual European Society of Criminology Conference (EUROCRIM 2023) in Florence.
Location: Ballroom
Persōna Theory: Infiltration and Deception of Emerging Threat Groups
Watch the stream Level: MediumTalks will be streamed on YouTube and Twitch for free.
Our personas are fabrications and constructions of our inner self that we project outwards. We do this through various means and influences such as race, gender, sex, ability, age, culture, religion, norms, class, and status. For the “real world” aka “irl” we do all this by expression in our clothing, makeup, hairstyling, our hobbies, our network of friends, colleagues, and acquaintances. We leverage all of these facets and we create masks, personas, that we think will best interact with the world around us. The same concepts apply when creating personas for infiltrating online communities. Online communities are built on trust, reputation, and currency which can take various forms such as data, crypto, intel and notoriety. This talk is an exploration of techniques; linguistics, OPSEC, OSINT, and SOCENG. Tactical operations and concepts like hours of online operation, timezone shifting, and using low ranking accounts as canon fodder for probing, and psychological models used in the infiltration of emerging threat actor groups.
Persona Theory applies the understanding of threat actors, how they think, how they operate, their language, their motivations, fears, methods, the "game" and reflects it back at them like an obsidian mirror. The talk features case studies showcasing active infiltration chat logs and we present this first hand showing how established ransomware threat actors communicate during their ARP (Active Recruitment Phase). Recruitment for RaaS (Ransomware-as-a-Service) functions very similarly to a job interview. You need to show you got the goods such as the ability to provide your initial access into organizational infrastructure, pentesting, and overall business acumen. The case studies go from initial contact, to obtaining the ransomware builder and affiliate panel access. We also explore the use of transliteration (preserving pronunciation) vs translation (preserving meaning) and how machine translation engines like DeepL and Google Translate aren't necessarily the best for passing yourself off as a native speaker.
Tammy Harper Senior Threat Intelligence Researcher, Flare
Tammy is a Senior Threat Intelligence Researcher and Certified Dark Web Investigator at Flare. She is a contributor and volunteer threat intelligence researcher for the open-source project RansomLook. When not working on threat intelligence, she listens to techno and ambient music. Her other hobbies include street and nature photography, reading, camping, hiking, and learning about theoretical astrophysics, hypothetical stars, and exotic forms of matter.
Location: Ballroom
Uplevel your security program with AI
Watch the stream Level: BeginnerTalks will be streamed on YouTube and Twitch for free.
In this session, we’ll explore how LLMs can be leveraged to uplevel your product security program. Discover practical strategies for integrating LLMs into your workflows, including dynamic risk assessment.
Learn how to harness their natural language understanding capabilities to streamline communication between engineering, security, and business teams—bridging gaps and enhancing collaboration.
Through real-world examples and actionable takeaways, we’ll show how LLMs are not just tools for efficiency but catalysts for innovation in securing your products and protecting your users. Whether you're building out your first security program or looking to amplify an established one, this talk will leave you inspired to embrace the power of AI and redefine what’s possible in product security.
Join us to learn how AI can be your ultimate ally in staying ahead of the curve and ensuring your product security program is future-ready.
Aditi Bhatnagar Founder, Offgrid Security
Aditi Bhatnagar is the founder of Offgrid Security - the company offering state-of-the-art AI solutions to up-level product security. Her interest lies in AI security, Android Privacy Posture and Web Application security. She has previously worked as a Lead Security Engineer at Atlassian building security into cloud, Core Engineer building features for end point security products and Data Scientist working on cutting edge AI algorithms at Microsoft. She has previously presented at dozens of international conferences including RSAC, May Contains Hackers, Diana Initiative, Android Security Symposium, Nullcon amidst others. Through her initiative, Infinite Hacks, she is spreading cyber awareness. She has conducted trainings and initiated discussions on LLM security, digital rights, and techno-sociology. She’s an avid blogger and publishes posts on cybersecurity, ethical hacking, and several aspects of the evolving relationship between humans and technology on her website.
Location: Ville-Marie Hall
Executing shellcode without changing memory permission in .NET
Watch the stream Level: BeginnerTalks will be streamed on YouTube and Twitch for free.
This talk will present a technique that allows red teamers to execute shellcode within a .NET process without the need to create a RWX memory section limiting the EDR detection. This technique abuses the underlying concept of how .NET executes the CIL code once it is compiled. No external dependencies are needed, only the .NET framework's magic.
Charles F. Hamilton (Mr.Un1k0d3r) ,
Charles Hamilton is a Red Teamer with over ten years of experience delivering offensive testing services for various government clients and commercial sectors. In recent years, Charles has specialized in covert Red Team operations targeting complex and highly secured environments. These operations have enabled him to refine his skills in stealthily navigating client networks without detection.
Since 2014, he has been the founder and operator of the RingZer0 Team website, a platform dedicated to teaching hacking fundamentals. The RingZer0 community currently boasts over 50,000 members worldwide. Charles is also a prolific toolsmith and trainer who has delivered this training more than 20 times, both online and onsite. He is a speaker in the InfoSec industry, known under the handle Mr.Un1k0d3r.
Location: Ville-Marie Hall
Noise Pollution is Damaging Your SOC: Prevent IoCs From Turning Into Indication of Cacophony
Watch the stream Level: MediumTalks will be streamed on YouTube and Twitch for free.
Noise pollution is linked to high blood pressure, headaches, fatigue, stress, and impaired focus, leading to decreased performance over time. This analogy accurately describes the impact of excessive obscure alerts and unlabelled data on SOC analysts. Awareness of noise pollution is crucial for both mitigating (blue team) and exploiting (red team) its effects.
This talk will explore the sources of noise and propose methods to reduce or transform it into music. The ultimate goals are to enhance how CTI analysts operationalize indicators of compromise (IoCs), prevent alert fatigue, and avoid the aforementioned health issues.
Attendees will step into the shoes of a SOC analyst navigating a high-severity alert on a Friday at 4 p.m. (as is tradition). The high-confidence IoC is linked to known malicious infrastructure, threatening to ruin weekend plans if confirmed malicious.
Spoiler Alert: The false positive turns out to be the Windows Delivery Optimization (DO) service functioning as intended on port 7680.
We will dig into this feature, revealing that Windows devices have participated in a peer-to-peer (P2P) network by default since Windows 10 to speed up updates delivery. A deep understanding of the DO ecosystem is necessary to interpret telemetry from XDRs and contextualize the noise.
Noise reduction strategies will be proposed at various stages of the telemetry lifecycle, applicable to other services, protocols, features, and XDR artifacts.
Joey D Detection Engineering Lead, Canadian Centre for Cyber Security (Cyber Centre)
Joey is the lead of a detection engineering team at the Canadian Centre for Cyber Security. With a focus on Tactics, Techniques, and Procedures (TTP) analytics, he brings a decade of experience in blue-team roles to his position. He enjoys tackling high-profile cybersecurity events, such as his recent deployments to Latvia, where he supported the Canadian Armed Forces' Operation REASSURANCE in securing NATO's eastern front.
As the coach for Team Canada in CTF (CyberSci), he has enabled the team to win gold medals in the guest category at the European Cybersecurity Challenge (ECSC) for the past three consecutive years. He is also proud to deliver challenges for his fifth consecutive NorthSec CTF as a volunteer for the non-profit.
Location: Ballroom
Red Team Road Rage: Weaponizing Vulnerable Drivers to Blind EDR
Watch the stream Level: MediumTalks will be streamed on YouTube and Twitch for free.
Endpoint Detection & Response (EDR) tools are becoming more and more sophisticated, requiring attackers (both good & evil) to work ever harder to subvert them. This talk will address the architecture of EDR solutions (with a focus on kernel-mode components), the various sources of telemetry, and how an attacker can leverage 3rd-party vulnerable drivers to blind an EDR agent. The audience should walk away with a deeper understanding of the inner workings, capabilities, and limitations of market-leading EDR tools.
Jake Mayhew , White Knight Labs
Jake Mayhew is an experienced information security professional who currently serves as the technical lead for the offensive security team at UPMC. Before serving on an internal red team, he spent several years in consulting delivering security tests for clients in finance, healthcare, retail, critical infrastructure/nuclear energy, and law. He holds the OSCE3 (OSED, OSWE, OSEP), OSCP, CRTO, and OSDA certifications and loves to assist others in their cybersecurity learning path. Jake is one of the founding members of Applied Technology Academy's Asymmetric Training Group (ATG), and has a passion for sharing real-world knowledge and cutting-edge solutions with his students. Jake has led & co-led offensive security trainings including the PEN-200 OSCP training at BlackHat USA.
Location: Ville-Marie Hall
Exploring Azure Logic Apps and Turning Misconfigurations into Attack Opportunities
Watch the stream Level: MediumTalks will be streamed on YouTube and Twitch for free.
Azure Logic Apps, a powerful tool for automating workflows and system integration, plays a pivotal role in modern cloud operations. However, these capabilities come with hidden risks numerous potential security vulnerabilities and attack vectors that can be exploited due to unnoticed misconfigurations. This session will examine the complex attack surface of Azure Logic Apps, revealing how attackers can manipulate its features to compromise cloud environments.
We will cover critical topics such as the exposure of sensitive data due to improperly secured Logic Apps, the execution of inline C# code to perform malicious actions, privilege escalation within storage accounts, hijacking API connections, and techniques for facilitating cloud-to-on-premises lateral movement. Additionally, we will address the often-overlooked risks associated with custom authorization logic, showcasing real-world examples of how weak authentication mechanisms can be bypassed, resulting in unauthorized access and data breaches.
Furthermore, we will explore the broader implications of misconfigured Logic Apps, such as overly permissive role-based access control (RBAC), insecure service principals, and unprotected connections to external systems. These misconfigurations can open the door to privilege escalation, unauthorized access, and even cloud-to-cloud or cloud-to-on-premises lateral movement.
By examining these threats and their countermeasures, organizations can strengthen the security of their Logic App implementations and ensure resilient cloud operations. Real-world scenarios and exploitation techniques will be dissected to highlight critical vulnerabilities in these workflows.
Raunak Parmar , White Knight Labs
Raunak Parmar works as a senior cloud security engineer at White Knight Labs. His areas of interest include web penetration testing, Azure/AWS security, source code review, scripting, and development. He enjoys researching new attack methodologies and creating open-source tools that can be used during cloud red team activities. He has worked extensively on Azure and AWS and is the author of Vajra, an offensive cloud security tool. He has spoken at multiple respected security conferences like Black Hat, Defcon, Nullcon, RootCon, and also at local meetups.
Chirag Savla , White Knight Labs
Chirag Savla is a cyber security professional with 10+ years of experience. His areas of interest include penetration testing, red teaming, azure and active directory security, and post-exploitation research. For fun, he enjoys creating open-source tools and exploring new attack methodologies in his leisure. Chirag has worked extensively on Azure, Active Directory attacks and defense, and bypassing detection mechanisms. He is the author of multiple open source tools such as Process Injection, Callidus, and others. He has presented at many conferences and local meetups and has trained people in international conferences like Blackhat, BSides Milano, Wild West Hackin’ Fest, HackSpaceCon, VulnCon etc.
Location: Ballroom
Exploiting the not so misuse-resistant AES-GCM API of OpenSSL
Watch the stream Level: MediumTalks will be streamed on YouTube and Twitch for free.
AES-GCM is robust when used properly, but in practice, some APIs make it easy to introduce vulnerabilities giving the possibility to alter the content of encrypted ciphertexts. One of these APIs lacking misuse resistance is implemented by OpenSSL; a library providing cryptography functions to products such as browsers and even to some programming languages (eg: Ruby and PHP).
In this talk, we go through AES-GCM, why it's robust and what is needed to affect its integrity property. We'll go briefly over specifications only to introduce the required concepts. Then, we'll continue with a few examples where misuse resistance was never considered when implementing cryptography APIs. We'll see how to detect these misuses and how to exploit them in real-life scenarios. The abuse cases vary depending on how AES-GCM is used, but we'll see what techniques can be used to leverage this vulnerability.
Theory is one thing, but implementation choices can be questionable and lead to real issues which results in the popular saying: "It works on my paper..."
Location: Ville-Marie Hall
Enhancing Identity Credential Privacy with Zero-Knowledge Proofs
Watch the stream Level: BeginnerTalks will be streamed on YouTube and Twitch for free.
Digital identity credentials are coming of our mobile wallets. In North America, several states have begun deploying mobile Driver's Licenses (mDL), with others, including the Canadian provinces, are preparing to follow suit. In Europe, plans are underway for a unified digital identity wallet. Similarly, corporate identities, like those provided by Microsoft Entra, are enabling various online authentication scenarios, such as employment verification. Together, these innovations are building the long-missing identity layer of the internet.
However, the internet’s foundational business model, rooted in tracking user activities to serve targeted ads, has created persistent privacy challenges. Modern identity frameworks like Selective-Disclosure JSON Web Tokens (SD-JWT) and mDLs address some concerns by enabling selective disclosure, thereby minimizing data oversharing. While this is an important step forward, one critical gap remains: breaking the cryptographic link between the issuance and presentation of credentials. Without this, issuers and verifiers can still track users’ activities, eroding user privacy.
Several cryptographic schemes, such as blind or group signatures, have been proposed to address this issue. However, these solutions require significant overhauls to existing identity systems, making widespread adoption difficult. An interesting alternative is to leverage zero-knowledge proof mechanisms to present unmodified existing identity credentials while achieving any desired levels of privacy. This approach allows users to prove specific claims — such as "I reside in QC" (without revealing the full address) or "I am an adult" (without disclosing the date of birth) — without unnecessary data disclosure.
In this talk, I'll present our recently released Crescent open-source framework implementing such a zero-knowledge scheme, and demonstrate how it can be used to 1. prove you are currently employed by a specific company to access employer-provided sensitive resources (e.g., a mental health clinic or an anonymous survey system), and 2. prove you are over-18 to a social network using your mDL
This is achieved without the employer and government being able to track the usage of the credentials.
For further details, visit: https://christianpaquin.github.io/2024-12-19-crescent-creds.html
Christian Paquin Principal Research Software Engineer, Microsoft Research
Christian is a security specialist in the Microsoft Research Cryptography team with a mission to bridge the gap between academic research and real-world systems. With 25 years of experience, Christian has been involved in many industry-wide initiatives such as the development of privacy enhancing identity technologies (such as anonymous credentials), the ongoing post-quantum cryptographic migration, and the Coalition for Content Provenance and Authenticity (C2PA) to fight online disinformation. Christian shares some of his work results on his blog: https://christianpaquin.github.io
Location: Ville-Marie Hall
The Evolution of Malware Distribution Through Ghost Networks
Watch the stream Level: MediumTalks will be streamed on YouTube and Twitch for free.
A new era of malware distribution is here, where “ghost”/bot accounts spread malicious links across multiple platforms. The Ghost Network is a sophisticated operation that uses fake and compromised accounts to act in a legitimate way while spreading and promoting malware. The first discovered Ghost Network operates on GitHub. The operator behind Stargazers Ghost Network controls over 30,000 GitHub accounts, driving rapid infections and generating significant profits in a remarkably short period. What makes this operation particularly dangerous is its ability to bypass platform defenses, minimizing the impact of any countermeasures imposed by GitHub. The continuous activity and low downtime of the distribution process allow the malware campaign to persist with little interruption. The great success of the original GitHub-based Ghost Network has spurred its expansion to multiple other popular online platforms, significantly broadening the reach of this insidious malware distribution method and making it harder to contain.
Antonis Terefos Malware Reverse Engineer, Check Point Software Technologies
Antonis Terefos is a malware reverse engineer at Check Point Research with experience in the cyber threat landscape. He specializes in dissecting and analyzing malicious software to uncover hidden threats within the ever-evolving cyber threat landscape. In addition to his professional work, Antonis enjoys testing malware command-and-control (C2) infrastructures in his spare time. By exploring these C2 systems, he gains valuable insights into the strategies and tactics employed by threat actors, enriching his overall understanding of the adversarial landscape.
Location: Ballroom
Exploring MSIX Threat Landscape
Watch the stream Level: Nose bleedTalks will be streamed on YouTube and Twitch for free.
BlueTeam analyzes new attack methods that attackers consider and comes up with detection and defense methods. This is an eternal cat and mouse game. However, the attackers are always ahead of us. The attack using the installer file MSIX is a prime example. To overcome this situation, we have discovered a new attack method that attackers will use MSIX in the future. This gives us an advantage over attackers.
This presentation will briefly describe existing attack techniques, followed by an introduction to the Virtual File System (VFS) in Windows. In particular, we will share in detail the functionality of VFS in MSIX files, a Windows application package. This allows the audience to understand how MSIX files utilize VFS. We will then demonstrate how the VFS mechanism can be exploited to perform DLL Side-Loading and AppDomainManager Injection in a far stealthier way than traditional ones. These are attack techniques that has not yet been observed to date. Finally, we will explore defensive strategies to safeguard systems against these attack methods. The talk will include detailed operational logs and detection logic, providing actionable insights for implementing effective countermeasures.
Please see the attached document for details.
Teruki Yoshikawa SOC Analyst, NTT Security Holdings
Teruki Yoshikawa is a security analyst at NTT Security Holdings. He is responsible for monitoring NW/EDR alerts, while also being involved in malware analysis and development of in-house systems. He is currently interested in Red Teaming, particularly in Windows environments. He has been a speaker at JSAC.
Location: Ballroom
Social Engineering for Physical Pentesting Assignments
Watch the stream Level: BeginnerTalks will be streamed on YouTube and Twitch for free.
Abstract: Social Engineering for Physical Pentesting Assignments
This presentation will explore the strategic use of social engineering in penetration testing, focusing on gaining covert access to a client's server room. I will outline how to perform reconnaissance, gather intelligence on company structure, employee behavior, and security vulnerabilities. Attendees will learn effective social engineering tactics such as pretexting, tailgating, baiting, and phishing, all designed to manipulate human behavior and bypass physical security.
I will cover the importance of crafting a believable pretext, from creating fake work orders to using props like ID badges and uniforms, and demonstrate techniques for gaining access to restricted areas like server rooms, and later on how to navigate the target environment, avoid detection, and plant a symbolic flag.
Finally, the session will discuss post-engagement reporting, vulnerabilities identified, and recommendations for strengthening defenses against social engineering attacks. This talk emphasizes the ethical considerations and the need for careful planning, confidence, and adaptability throughout the operation.
Dorota Kozlowska Penetration Tester, Black Hills Information Security
Experienced cybersecurity professional with experience in Penetration Testing across Web, API, Network, and Mobile platforms, coupled with 7 years as a versatile Test Engineer & QA. Known for independently identifying and exploiting vulnerabilities to fortify organizational security, and backed by 8 years of Project Management expertise.
Skilled in simulating real-world attacks, conducting comprehensive security assessments, and providing actionable insights to enhance defenses. Certified in Covert Access, Physical Audit, and Elicitation Toolbox from the Covert Access Team, with demonstrated proficiency in physical penetration testing and security audits. Actively pursuing advanced Red Teaming training, dedicating personal time to mastering adversarial tactics, techniques, and procedures (TTPs). Eager to combine my Penetration Testing knowledge, physical security capabilities, and evolving Red Teaming skills to contribute to a team focused on proactive threat emulation and defense enhancement.
Recognized for a strong investigative mindset, meticulous attention to detail, and exceptional communication skills, ensuring assignments are completed with confidence and precision. Praised by colleagues as 'the glue that holds the team together,' I bring kindness and support to every endeavor.
Additionally, a published author of cybersecurity and offensive security articles, featured in HVCK and Top Cyber News Magazine. Creator of the preface to the upcoming book, "INTRODUCTION TO RED OPERATIONS 2.0 - A Basic Guide for Your Red Team Operations," authored by Joas A. Santos, and a technical reviewer for the upcoming "Hacking Mainframes: Dispelling the Myth of the Impenetrable Fortress" book authored by Kevin Milne.
Honored with the Cyber Woman Hope Award by CEFCYS and recognized among the "40 under 40" in Cybersecurity 2023 by Top Cyber News Magazine. As a keynote speaker, I've presented at FIC EUROPE 2023 and 2024, WGU 2024, BSIDES Kraków 2024, DEFCON Warsaw Meetup dc4822 2024, Virtual CON 2023, and The Hack Summit 2023.
I am an avid cyclist, archer, and guitar player.
Location: Ville-Marie Hall
Salesforce Snafus: Unveiling and Exploiting Security Misconfigurations Using Commonly Used Widgets
Watch the stream Level: MediumTalks will be streamed on YouTube and Twitch for free.
This talk explores how to leverage the nooks and crannies of Salesforce to find and abuse misconfigurations that chain together and create serious vulnerabilities that leak sensitive data to adversaries. It highlights that security concerns still exist on applications built on a well-known CRM tool with declarative or "point-and-click" development, where to discover them, and how they can be remediated. It provides a real-world scenario of using various Salesforce widgets to find security vulnerabilities like Insecure Direct Object References (IDORs) and Broken Authorization as a means of stealing sensitive client information. It offers solutions for detection and prevention for these elevated attacks that relate to common security best practices. At the end of this discussion, you will walk away with better awareness of the vulnerabilities existing in Salesforce, how they can be discovered, remediated, then prevented. You may even learn a new trick or two on how to think like a hacker when building your company's next communication tool!
Jessa Riley Gegax Information Security Testing Analyst, Surescripts LLC
Jessa Gegax is an Information Security Testing Analyst at Surescripts LLC in Minneapolis, MN. Jessa holds an undergraduate degree in Computer Science and minor in Environment and Natural Resources with research interests in offensive cloud security, IoT devices, and web application/API penetration testing. In their free time, Jessa likes to go backpacking, practice yoga, and spend time with their dog (in no particular order).
Location: Ville-Marie Hall
Why preventing phishing is so difficult, and what we can do about it
Watch the stream Level: MediumTalks will be streamed on YouTube and Twitch for free.
We still haven’t solved phishing. Why does phishing still happen and why do security professionals struggle to understand user behavior? This presentation demystifies the challenge of phishing and presents key findings from one of the largest independent studies of phishing behavior in Canada.
Drawing from five years of research, this talk challenges assumptions about human decision-making and security training. By integrating insights from a range of scientific perspectives, we explore why phishing remains effective despite increasing awareness. This research will also present results of a large scale, Canada-wide study of phishing behaviours, offering an unparalleled view into real-world phishing trends. Key questions addressed include: - When are phishing emails most dangerous? We show the time and day of the week that is the riskiest, and evidence as to why. - How often should cybersecurity training be conducted? We Investigate the decay rate of training effectiveness to balance reinforcement with security fatigue. - Does Cybersecurity Awareness Month actually change behavior? We evaluate the real-world impact of this national event. - Can strong technical security measures increase phishing risk? We look into the potential negative impact that confidence in technology can have. By the end of this session, you will gain a deeper understanding of phishing psychology and training, helping you design more effective security programs that account for human behavior. Attendees will learn why traditional training can fails, the why of phishing simulations, and how to better interpret user behavior. This talk will debunk common misconceptions and provide practical, data-driven approaches to phishing mitigation.
This presentation is based on PhD research conducted at the University of Montreal in collaboration with Beauceron Security. These findings are being presented publicly for the first time, offering a unique opportunity to engage with groundbreaking research
Michael Joyce is the Executive Director of the Human-Centric Cybersecurity Partnership (https://hc2p.ca), a transdisciplinary group of scholars, government, industry, and not-for-profit partners working to generate research and mobilize knowledge that fosters a safer, more secure, democratic, and inclusive digital society. He has over a decade of experience in the development and management of national and international cybercrime and cybersecurity knowledge mobilization programs, including Canada’s Smart Cybersecurity Network (https://serene-risc.ca).
He is also a doctoral candidate in criminology at the University of Montreal's Cybercrime Prevention Laboratory (https://www.prevention-cybercrime.ca/), where he researches personal guardianship behaviors and related interventions. Put simply, he wants to understand why people click on things they later regret—and whether we can do anything about it. Michael is the host of the long-running Cybercrimeology podcast (https://cybercrimeology.com), which explores cybercrime science and research.
He has been a volunteer at NorthSec since well before the pandemic.
Location: Ville-Marie Hall
From Security to Safety: Navigating the Ethics of AI as Red Teamers and Penetration Testers
Watch the stream Level: BeginnerTalks will be streamed on YouTube and Twitch for free.
This talk explores the intersection of philosophy, ethics, security, and AI. As AI systems like LLMs become increasingly ubiquitous in our lives, security practitioners are shifting from testing security to testing for safety - a fundamentally normative issue. A transition to this new paradigm can be an uneasy one for professionals accustomed to the comfort of (relatively) objective processes. I argue that despite some initial discomfort, penetration testers & red teamers - with our rich history of social awareness and ethically motivated action - are well-positioned to tackle AI safety and responsibility challenges. We can do this by reframing what we already know how to do so well in other contexts: balance technical rigour on a robust foundation of humility, curiosity, compassion and epistemological self-awareness.
Jeremy Miller Sr. Manager, Content Strategy and Development, OffSec (Offensive Security)
Jeremy has spent the last decade helping individuals and organizations improve their cybersecurity skills, mindset, and understanding. Prior to jumping into penetration testing, Jeremy was a martial arts instructor and a philosophy student. Both disciplines continue to deeply influence his unique perspective on teaching and learning cybersecurity. Jeremy currently serves as Sr. Manager of Content Strategy and Development at OffSec (formerly Offensive Security).
Location: Ville-Marie Hall
Linux and IoT malware analysis with r2ai
Watch the stream Level: BeginnerTalks will be streamed on YouTube and Twitch for free.
A full malware analysis is quite long to perform. Depending on its complexity and the desired level of details, it takes between half a day and 10 days. Can we speed up the process with assistance from Artificial Intelligence (AI)? Will the quality of the analysis be good enough?
I started the research open minded, not knowing whether the outcome would be positive or not. For my tests, I collected recent Linux and IoT malware that I had never worked on before, and analyzed the binaries with r2ai. The r2ai project handles the communication between r2 - the Radare2 open source disassembler - and a LLM. The results were astonishingly good. The main functions of the malware were often decompiled in a very correct and understandable manner. We can even get the AI to defeat obfuscation mechanisms. Personally, I hadn't expected the AI to be that good, but - as with everything? - there were many caveats:
- You cannot expect the best results in a single go. Using an AI is comparable to team work with a smart intern. You need to discuss and guide the AI towards what you are interested in.
- The AI is very convincing, but you should not trust it blindly (never!). You need to check everything it claims. Hallucinations are the best known issues, but we also need to take care of omissions (very frequent) and exaggerations.
- Costs are usually controlled and very low, but in some cases, they can grow a bit too quickly if you do not pay attention to the amount of data you send to the AI.
In this presentation, I will show how to use r2ai over recent versions of Linux/Ladvix (aka Rhomba, Ebola) and a Linux shellcode of March 2025. We will tackle the 3 issues we mentioned previously, and see how to get the best results, spot hallucinations etc while keeping costs below 10 dollars.
Expect several demos.
Axelle Apvrille Principal Security Researcher, Fortinet
Axelle Apvrille is a Principal Security Researcher at Fortinet, Fortiguard Labs. Her research interests are mobile and IoT malware that she reverses every day. In addition, she is the lead organizer of Ph0wn CTF, an on-site competition which focuses on ethical hacking of smart objects. In a prior life, Axelle used to implement cryptographic algorithms and security protocols.
Axelle has spoken at many conferences such as Black Hat Europe, Confidence, Hack.Lu, Hacktivity, Insomni'hack, ShmooCon, Troopers, Virus Bulletin... NorthSec 2021 ;-) She has also published in academic journals such as IEEE Security & Privacy, or Journal in Computer Virology. She regularly writes in the French magazine MISC and Hackable, and has recently published in Phrack #71.
Location: Ballroom
Nice to meet you! That will be 20 million please
Watch the stream Level: BeginnerTalks will be streamed on YouTube and Twitch for free.
A ransomware attack isn’t just a technical compromise of a company; it’s also a game of negotiation and perhaps even chess. In this talk, I plunge into 133 recorded conversations and more than 7,000 messages exchanged between ransomware gangs and their victims, unraveling the narrative of cyber extortion. This is an insider’s look at how these dark operators blend intimidation, persuasive rhetoric, and even a twisted sense of humor to secure their demands. I dive deep into the qualitative nuances of these dialogues, decoding the linguistic tricks, psychological maneuvers, and power dynamics that define the art of ransomware negotiation. Each conversation is a case study in negotiation that flows between capitulation and defiance, where subtle cues and strategic language can be the difference between a quick surrender and a prolonged standoff. Furthermore, I integrate comprehensive data detailing who paid their ransom, how much, and under what circumstances to construct a predictive model that exposes the critical factors influencing ransom decisions. This model not only sheds light on the financial and behavioral patterns of cybercriminal interactions but also unearths trends that could forecast future threats. By examining variables such as company size, industry type, and security stance, I reveal a multifaceted picture of vulnerability and response. Beyond the numbers and narratives, the talk will present real conversations to clearly show how these conversations unfold. With this data-driven roadmap, my aim is to better prepare companies and individuals facing the all too common ransomware attack, and to empower defenders, incident responders, and policymakers with actionable strategies designed to disrupt these criminal networks and mitigate future threats.
David Décary-Hétu Associate Professor, Université de Montréal
Prof. David Décary-Hétu has a Ph.D. in criminology from the Université de Montréal (2013). He first started as a Senior Scientist at the School of Criminal Sciences of the Université de Lausanne before moving to his current position as an Associate Professor at the School of Criminology of the Université de Montréal. The main research interests of Prof. Décary-Hétu focus on the impacts of technology on crime. Through his innovative approach based on big and small data, as well as social network analysis, Prof. Décary-Hétu studies how offenders adopt and use technologies, and how that shapes the regulation of offenses, as well as how researchers can study offenders and offenses. Prof. Décary-Hétu is the Deputy Director of the International Centre for Comparative Criminology (ICCC), the Chair of the Division of Cybercrime of the American Society of Criminology and the Chair of the Darknet and Anonymity Research Centre (DARC) that was funded by the John R. Evans Leaders Funds from the Canada Foundation for Innovation. His team collects and studies data from all types of offenders who use anonymity technologies such as the darkweb, cryptocurrencies and encryption. Prof. Décary-Hétu has received funding from both public and private grantors operating at the local, provincial, federal and international level. He has published in leading academic journals and is invited regularly in the news media to comment on recent events.
Location: Ballroom
Vulnerability Haruspicy: Using Woo To Confirm Your Biases
Watch the stream Level: BeginnerTalks will be streamed on YouTube and Twitch for free.
Vulnerability scoring is supposed to bring order to the chaos of risk management, but in practice, it can feels more like reading tarot cards or poking at entrails than applying science. CVSS performs monkey math to force fractal bell curves, EPSS tries to predict exploitation with statistical black magicks, and SSVC ditches math entirely in favor of structured gut feelings.
Meanwhile, defenders mix and match shortcuts — KEV lists, vendor advisories, and lived experience — to separate the truly urgent from the merely annoying. But are we actually making better risk decisions, or just using these frameworks to justify what we were going to do anyway?
This talk will dig into the strengths, weaknesses, and absurdities of CVSS, EPSS, and SSVC, comparing them to the reality of how security teams actually handle vulnerabilities. Tod will explore where these models help, where they mislead, and whether any of them are meaningfully better than rolling a D20 saving throw vs exploitation. Expect debate, disagreements, and plenty of astrology jokes.
Tod Beardsley VP of Security Research, runZero
Tod Beardsley is VP of Security Research at runZero, where he "kicks assets and fakes frames." Prior to 2025, he was the Section Chief for the Vulnerability Response section for CSD/VM/VRC at CISA, the Cybersecurity and Infrastructure Security Agency, part of the US government. He's also a founder and CNA point of contact for AHA!. He spends much of his time involved in vulnerability research and coordinated vulnerability disclosure (CVD). He has over 30 years of hands-on security experience, stretching from in-band telephony switching to modern ICS/OT implementations. He has held IT ops, security, software engineering, and management positions in large organizations such as the Rapid7, 3Com, Dell, and Westinghouse, as both an offensive and defensive practitioner. Tod is a CVE Board member, has authored several research papers, and hosted Rapid7's Security Nation podcast with Jen Ellis. He is also a Travis County Election Judge in Texas, and is an internationally-tolerated horror fiction expert.
Location: Ville-Marie Hall
One certificate to rule them all: the story of a Chinese-nexus botnet
Watch the stream Level: MediumTalks will be streamed on YouTube and Twitch for free.
Let's dive into the domain of edge devices and botnets through our discovery of a vast cluster of ~70,000 compromised hosts. This story stemmed from a simple error - the repeated use of a self-signed certificate across multiple hosts. In this talk, we will demonstrate how this small SecOps oversight allowed us to unveil a whole network of Operational Relay Boxes and a multi-layered cyber attack infrastructure involving the GobRAT malware and a previously undocumented backdoor, which we named Bulbature. A unique attribute of this infrastructure is the fact that a majority of the C2s possess open directories. Altogether, over 5,000 varied types of files have been analysed, enabling us to effectively place ourselves in the operators’ shoes. This infrastructure is touching corners around the globe and hints at ties to China.
Amaury-Jacques Garçon CTI analyst, Sekoia.io
Amaury-Jacques Garçon is a cybersecurity engineer working as technical Threat Intelligence analyst and focusing on the investigation of state-sponsored threats, currently at Sekoia.io . With professional experience in open source investigation, he has worked for the French Ministry of Armed Forces.
Location: Ballroom
How not to do ML: Showing the Negative Impact of Improper CVE Feature Selection in a Live Exploit Prediction Model
Watch the stream Level: MediumTalks will be streamed on YouTube and Twitch for free.
Machine learning has been used extensively for the prediction of cyber security threats for a number of years. More specifically, building predictive models for the exploitation of security vulnerabilities and the publication of vulnerability exploits is essential in anticipating threats in the cyber security landscape.
Many published approaches train ML models using publicly available data, be it online discussions or vulnerability details available through the publication of CVEs. Unfortunately, many challenges arise when encoding this data to predict exploitation. More importantly, many of these do not impact the model's performance on historical data, but instead result in a poor performance when used as a live model in a real environment.
In this talk, we will demonstrate our implementation and deployment of several of these methods. We show that performance of these models in a live environment underperforms in comparison with its historical evaluation. Vulnerability and threat information evolve over time, and are often not available on the day of a vulnerability's publication. We identify four incorrect ways to encode and evaluate features for the prediction of exploits, that causes the model to incorrectly predict exploits when used in a day-to-day live system.
Ultimately, we show how a model that has a lower performance on its historical data evaluation can better predict the publication of exploits in a live setting, by encoding the features correctly.
François Labrèche Senior Data Scientist, Sophos
François Labrèche is a Senior Data Scientist at Sophos, who focuses on applying machine learning approaches to research problems related to security alerts and vulnerabilities. He focuses on using machine learning to improve the prioritization of alerts and vulnerabilities, in the context of XDR and vulnerability management. He explores the use of OSINT sources and the dark web in assessing the importance of newly published vulnerabilities.
He has a Ph.D. from École Polytechnique de Montréal, and has published research papers on the topics of spam detection, malware analysis, threat research and machine learning applied to cybersecurity. He has presented at ACSAC 2024, CAMLIS 2022, BSides Montreal 2021, University College London and École Polytechnique de Montréal, and has published papers in conferences such as the ACM Conference on Computer and Communications Security (CCS).
Location: Ville-Marie Hall
Oops, I Hacked It Again: Tales and disclosures
Watch the stream Level: BeginnerTalks will be streamed on YouTube and Twitch for free.
Breaking into supermarket systems, ticketing platforms, and more. I’ll share some of my latest hacking stories, showing how I found the vulnerabilities, reported them, and collaborated with the companies. We’ll dive into tools, the challenges of disclosure, the importance of being “ethical”, lessons learned and how these experiences help improve security and build trust between hackers and organizations.
Ignacio Navarro Ethical Hacker, N/A
Ignacio Navarro, an Ethical Hacker and Security Researcher from Cordoba, Argentina. With around 6 years in the cybersecurity game, he's currently working as an Application Security. Their interests include code analysis, web application security, and cloud security. Speaker at DEFCON, H2HC, Troopers, LeHACK, NorthSec, TyphoonCon, Security Fest, SASCON, 8.8 among others. @Ignavarro1
Location: Ballroom