2.8 bsidespdx-2025 2025-10-24 2025-10-25 2 00:05 https://cfp.bsidespdx.org America/Los_Angeles Talk 1 Other 2025-10-24T09:00:00-07:00 09:00 00:00 Registration opens at the registration room. bsidespdx-2025-107-registration-opens-all-day- Registration Room Registration Room en false https://cfp.bsidespdx.org/bsidespdx-2025/talk/AQAFJM/ Talk 1 Remarks 2025-10-24T09:30:00-07:00 09:30 00:15 Opening remarks bsidespdx-2025-104-opening-remarks Talk 1 BSidesPDX 2025 Organizers en false https://cfp.bsidespdx.org/bsidespdx-2025/talk/UAS9ZC/ Talk 1 Keynote 2025-10-24T09:45:00-07:00 09:45 01:00 Day 1 Keynote bsidespdx-2025-103-day-1-keynote Talk 1 Perri Adams en false https://cfp.bsidespdx.org/bsidespdx-2025/talk/7TCNV8/ Talk 1 Other 2025-10-24T10:58:00-07:00 10:58 00:00 Stop by the Registration Room to chat with our amazing sponsors, grab some swag, and learn about the cool things they’re building. They’ll be here throughout the day! bsidespdx-2025-112-meet-the-sponsors-all-day- Sponsors Registration Room en false https://cfp.bsidespdx.org/bsidespdx-2025/talk/HPQW7B/ Talk 1 Other 2025-10-24T10:59:00-07:00 10:59 00:00 BSidesPDX 2025 CTF The annual BSidesPDX 2025 CTF competition, brought to you by an amazing group of volunteers! Go to https://ctf.bsidespdx.org to register and play! bsidespdx-2025-113-ctf-live-challenges-open-for-the-day-all-day- CTF Room CTF Room en false https://cfp.bsidespdx.org/bsidespdx-2025/talk/SJPXCX/ Talk 1 Presentation 2025-10-24T11:00:00-07:00 11:00 00:20 In 2020, I registered a domain as a joke and privacy experiment. I never expected it to become a passive honeypot. But over the next five years, I received over 30,000 unsolicited emails. From pizza orders and job applications to password resets, IT tickets, and sensitive government faxes, it turns out a lot of systems assume that “noreply” means no one is actually watching. In this 20-minute talk, I’ll walk through how I accidentally built a data-collecting black hole, what I’ve uncovered inside, and what it reveals about our collective assumptions around placeholder email addresses, dev defaults, and ghost domains. Spoiler: someone is reading the mail. bsidespdx-2025-1-accidental-honeypot-how-i-ended-up-receiving-tens-of-thousands-of-emails-meant-for-no-one- Talk 1 /media/bsidespdx-2025/submissions/QYQNDG/wronginbox_icon_420TB54.png Cory Solovewicz en This talk is a follow-up to my 10-minute lightning talk from Hackboat. I’ll go deeper into the types of misdirected email I’ve received, the Python tooling I built to analyze the data, and the broader security, privacy, and ethical questions this raises. This is equal parts funny, unsettling, and surprisingly useful for anyone managing email infrastructure or threat modeling misconfiguration risks. false https://cfp.bsidespdx.org/bsidespdx-2025/talk/QYQNDG/ Talk 1 Presentation 2025-10-24T11:30:00-07:00 11:30 00:20 Critical-infrastructure sites have hardened perimeters, access controls, and robust camera systems that deter and catch ground-level intrusions. But what about the airspace above them? This talk addresses a gap many sectors share: detecting and responding to drones. We’ll walk through how airspace pentesting over critical infrastructure actually works, what on-site defenders can do to strengthen detection and response, and demystify how to legally and safely get started with aerial assessments. Attendees will leave with equipment recommendations, a clear runbook for performing this work, and a persuasive narrative to secure budget and buy-in for launching aerial assessment and drone-defense programs. bsidespdx-2025-26-drone-blind-spots-pentesting-the-airspace-above-critical-infrastructure Talk 1 Alec Hunter en **Who this talk is for:** • Offensive-security practitioners: penetration testers, red-teamers, and physical-security assessors who want to add an aerial dimension to their repertoire. • Defenders & Incident Responders: facility-security, SOC analysts, and OT/ICS staff responsible for protecting critical sites and infrastructure. • Aspiring newcomers: students, hobbyists, and those curious about where drones, radio frequency, and physical security intersect. **Helpful Knowledge:** • A working grasp of the standard pentest workflow and common physical-security controls (cameras, access systems, perimeters). • Basic awareness of FAA Part 107 / small-UAS regulations (key points and every acronym will be spelled out on slides). false https://cfp.bsidespdx.org/bsidespdx-2025/talk/KLX7SV/ Talk 1 Presentation 2025-10-24T12:00:00-07:00 12:00 00:40 Zero Trust is everywhere: on vendor datasheets, compliance frameworks, and executive roadmaps. But how do you separate real enforcement from marketing noise? In this talk, I present a practical, adversary-informed evaluation of several leading ZTNA solutions tested across the five core pillars of Zero Trust: Identity, Device, Network, Application, and Data. Using a controlled lab environment, I simulated trusted and untrusted scenarios, configured granular access policies, and executed known attack patterns to test each vendor’s actual enforcement capabilities. Some solutions successfully blocked unauthorized access, enforced policy based on device posture, and prevented common web exploits and data loss. Others fell short: failing to detect endpoint misconfigurations, bypassing service cloaking, or letting malware and sensitive data flow freely. In multiple cases, achieving basic Zero Trust behavior required purchasing additional modules outside the core ZTNA platform. This session delivers clear results, testing methodology, and takeaways any security team can apply when evaluating ZTNA vendors. If you're tired of buzzwords and want to see how “Zero Trust” actually performs under pressure, this talk is for you. bsidespdx-2025-22-how-zero-trusty-is-your-network-access- Talk 1 Derron Carstensen en This presentation is designed for security architects, blue teamers, and red teamers alike—anyone involved in selecting, testing, or bypassing Zero Trust Network Access (ZTNA) solutions. It provides value to defenders who want to validate vendor claims under real-world conditions, and to offensive security professionals interested in understanding how ZTNA solutions can be fingerprinted, evaded, or misconfigured in ways that expose internal assets. A foundational understanding of Zero Trust architecture is helpful, as is familiarity with common security controls like MFA, endpoint posture checks, and DLP. Attendees with experience in adversary simulation, web exploitation (e.g., OWASP Top 10), and network enumeration (e.g., Nmap) will find deeper value in the testing methodology presented. However, the session is structured to benefit both technically savvy practitioners and strategic stakeholders looking to cut through the noise and assess ZTNA solutions based on evidence—not just promises. false https://cfp.bsidespdx.org/bsidespdx-2025/talk/VFDN3T/ Talk 1 Presentation 2025-10-24T13:00:00-07:00 13:00 00:20 Learn to secure GraphQL interfaces by looking at design decisions and actual attacks. This talk dives into a half dozen GraphQL services that were deployed at a tech unicorn. You'll learn practical defensive strategies, discover where common security controls fall short, and see the fall out from attack scenarios that were missed. bsidespdx-2025-11-securing-graphql-from-design-to-production Talk 1 Corey Le en People who are already familiar with REST APIs and HTTP requests. No prior GraphQL required. We'll cover enough to highlight key aspects of GraphQL and how it could impact security decisions for blue and red teams. false https://cfp.bsidespdx.org/bsidespdx-2025/talk/FXWBEA/ Talk 1 Presentation 2025-10-24T13:30:00-07:00 13:30 00:20 Microsoft's Configuration Manager (more commonly known as System Center Configuration Manager or SCCM) has received a great deal of attention from the offensive security community in recent years. The service's 30 year history includes a mountain of techincal debt that is still heavily relied on by enterprises across the globe. In fact, even with the industry's shift to cloud, SCCM remains the most depended on solution for endpoint management. This presentation will publicly disclose how an attacker under the right circumstances can abuse this dependence to escalate to SCCM admin simply by implying it. bsidespdx-2025-81-i-m-not-actually-an-sccm-admin-i-just-implied-it Talk 1 Garrett Foster en false https://cfp.bsidespdx.org/bsidespdx-2025/talk/YGBGET/ Talk 1 Presentation 2025-10-24T14:00:00-07:00 14:00 00:40 Following the discovery of BadBox 1.0, I identified another device disguised as a streaming product called [redacted]. This one is particularly concerning, as it includes: [redacted] This situation has underscored the growing need for research at the intersection of cybersecurity and social psychology, highlighting the importance of helping users recognize and protect themselves from products that offer services that seem “too good to be true.” Public reporting on this activity began emerging in early 2024, with major coverage appearing in March 2025. I initially discovered this campaign in February 2024 and have since tracked its evolution and broader ecosystem connections. This led to a second PSA from IC3 in May of 2025. In this talk, I’ll provide: [redacted] bsidespdx-2025-68-redacted Talk 1 D3ada55 en Anyone. Everyone has likely encountered these at some point. true https://cfp.bsidespdx.org/bsidespdx-2025/talk/D7VR9J/ Talk 1 Presentation 2025-10-24T15:00:00-07:00 15:00 00:20 Ever dreamed of a portable hacking device that packs the punch of a full Linux system but is cool enough to wear on your arm? This talk is for you. We'll dump the bulky laptops and dive into creating a powerful, Pip-Boy-inspired wearable from scratch, without breaking the bank. I'll take you through my whole chaotic journey: from picking the right parts to the rage-inducing 3D modeling, cramming a jungle of wires into a tiny space, making a Linux GUI actually usable on a touchscreen, and keeping the thing powered for more than five minutes. I’ve already bricked the components, scoured the darkest corners of GitHub, and copy-pasted with pride, so you get the blueprint without the pain. You’ll leave ready to build your own rig for whatever digital mayhem you have in mind. bsidespdx-2025-7-from-pi-to-pwnage-building-a-wearable-hacking-station Talk 1 Stefan en Hardware Enthusiast & Maker: Anyone who loves tinkering, building custom gadgets, and working with single-board computers like the Raspberry Pi. Aspiring Hardware Hacker: If you've been curious about building your own devices but felt intimidated, I break down the entire process, sharing the mistakes so you can avoid them. Cybersecurity practitioners looking for creative, low-cost ways for pentests, assessments, or just for fun. false https://cfp.bsidespdx.org/bsidespdx-2025/talk/8MC8MG/ Talk 1 Presentation 2025-10-24T15:30:00-07:00 15:30 00:20 Most organizations that deploy surveillance / safety technology don't actually know what they're putting on their networks exactly. i got curious about one specific device i had found in my high school's network. when i finally got my hands on one, it raised bigger questions then i expected, not just about the software or hardware. but about how widely it had been deployed without much scrutiny. Sharing the research publicly showed me just how much people were questioning it, both inside and outside the security community. what really surprised me was realizing how tightly knit the Portland Infosec community is, and how many people helped me along this journey. in this talk, I'll share that story. from the initial discovery, to the struggles, and reflections. bsidespdx-2025-45-beyond-the-mask-the-snitchpuck Talk 1 Rey en false https://cfp.bsidespdx.org/bsidespdx-2025/talk/ZFZDA7/ Talk 1 Presentation 2025-10-24T16:00:00-07:00 16:00 00:40 A lot has changed since the 80s. Gone is the boom box with a cassette tape. You have a Flipper Zero instead of a magstripe writer. Forget ISDN: you can get better than an OC-24 at your house for less than your long distance bill. Viruses don't put random text on your screen, they shut down hospitals. But you know what hasn't changed? The CFAA. It's about time we look at how our laws can transform the incentives and move us beyond the cyber-vandalism era to respond to real threats with real defenses. Let's stop wringing our collective hands about evil hackers, and get real about how it actually works. bsidespdx-2025-28-cfaa-plus-moving-computer-law-past-the-world-of-the-boombox-and-magnetic-tape Talk 1 Falcon Darkstar Momot en I'm sending a policy talk here mostly because Sen Wyden has established Portland as one of the most important constituencies in infosec policy. But this is also near to the heart of any hacker who hated what happened to everyone from Aaron Swartz to Marcus Hutchens to Paige Thompson and beyond, and anyone who's watched security programs get cut to the point of ineffectiveness and then experienced a preventable breach. I previously briefed democratic congressional staff on this topic. false https://cfp.bsidespdx.org/bsidespdx-2025/talk/GPX8BE/ Talk 1 Remarks 2025-10-24T17:00:00-07:00 17:00 00:15 Closing remarks and reception bsidespdx-2025-109-closing-remarks Talk 1 BSidesPDX 2025 Organizers en false https://cfp.bsidespdx.org/bsidespdx-2025/talk/8Z3EFS/ Talk 1 Other 2025-10-24T17:15:00-07:00 17:15 00:00 Appetizers and drinks in the back room of Track 1 bsidespdx-2025-115-friday-reception-evening- Social Event Back Room in Talk 1 en false https://cfp.bsidespdx.org/bsidespdx-2025/talk/XMFSQG/ Talk 1 Event 2025-10-24T17:30:00-07:00 17:30 01:00 This is the game where we take some BSides attendees and pit them against each other in a battle of wits to see who’s the smartest… who’s the fastest… who’s going to emerge with the ultimate alpha- geek status for the next year! WHAT’S IT LIKE? Just like many TV game shows you’re probably already familiar with. We take three contestants, put them on stage and ask them a series of questions relating to aspects of system and network security, exploits, hacking, hardware, software, administration, history, and even some random bits of pop culture thrown in for hack value. And then maybe we'll do it again with three more contestants! This event is for anyone with an interest in any or all of the topics that bring people to BSides. Questions for the quiz show are drawn from current events, information security, computer technology, hardware, software, geek culture, games, and general interest topics. bsidespdx-2025-30-bsides-pdx-quiz-show Talk 1 Steve WilloughbyJohn Mechalas en false https://cfp.bsidespdx.org/bsidespdx-2025/talk/QYYSYK/ Talk 2 Presentation 2025-10-24T11:00:00-07:00 11:00 00:20 Last year at BSides Portland we started the conversation about creating the Portland Hacker Foundation, and by many measures it seems to have been a roaring success. This session will talk about what we've done, where we're going, and what you can do to help. bsidespdx-2025-44-portland-hacker-foundation-asymmetric-impact-year-1 Talk 2 Dean Pierce en People interested in making an impact in their community, and interested in learning how to start a 501(c)(3). false https://cfp.bsidespdx.org/bsidespdx-2025/talk/RZMNNX/ Talk 2 Presentation 2025-10-24T11:30:00-07:00 11:30 00:20 "Instant API Hacker" is a fast-paced, 20-minute presentation that demonstrates how quickly someone can learn to identify and exploit API vulnerabilities. Led by Corey Ball, author of "Hacking APIs" and founder of APIsec University and hAPI Labs. This talk provides a practical introduction to API security testing using real-world tools and techniques. Attendees will witness the exploitation of critical vulnerabilities from the OWASP API Security Top 10, including broken authentication, authorization flaws (BOLA), and excessive data exposure. Through live demos using the crAPI vulnerable lab, participants will see firsthand how APIs can be compromised and gain actionable insights they can apply immediately. The presentation concludes with free resources for continued learning, including access to vulnerable labs and APIsec University courses. bsidespdx-2025-29-instant-api-hacker Talk 2 /media/bsidespdx-2025/submissions/JYWGKZ/Kve73rdIVQJqi7_R4LxPCE.jpg Corey Ball en This presentation is designed for anyone interested in API security, regardless of experience level: Developers who want to understand how their APIs can be attacked Security professionals seeking to add API testing to their skillset IT managers and leaders who need to understand API security risks Students and beginners curious about getting started in API security Anyone interested in cybersecurity and how modern applications can be compromised No prior API hacking experience required. false https://cfp.bsidespdx.org/bsidespdx-2025/talk/JYWGKZ/ Talk 2 Presentation 2025-10-24T12:00:00-07:00 12:00 00:40 Seattle was one of the first USA cities to have a Surveillance Ordinance. This enables Seattle residents to pull back the curtain on a type of mass surveillance not as commonly discussed by the news media: a service that provides real-time travel time calculations using a system of WiFi/Bluetooth MAC address sniffers deployed across the city. I'll bring you up to speed on this surveillance technology, the variety of issues that have been identified with it (both technical and non-technical), and its removal from Seattle. I'll also discuss some aspects about privacy of mobile devices specific to challenges with MAC addresses (i.e. randomization, anonymization, etc). Lastly, I will give you pointers on how to get started reviewing surveillance technologies your local municipality has deployed, so that you too can put your technical/security skills to use to help your neighbors and community. bsidespdx-2025-89-the-life-and-death-of-a-municipal-surveillance-technology-in-seattle Talk 2 C.S. en This presentation is for a technical audience interested in privacy and anti-surveillance. I'll discuss hashing (naming algorithms but not explaining them). I will also assume the audience will know what a rainbow table is and salting. true https://cfp.bsidespdx.org/bsidespdx-2025/talk/A9ZD8V/ Talk 2 Presentation 2025-10-24T13:00:00-07:00 13:00 00:20 When traditional infrastructure fails, as it often does in the PNW, we may lose power, water, and even accessible roads. How do you plan to check in with your friends, family, share resources, and help others? In this talk, we’ll cover what options are available for long-distance remote communications between individuals: FRS, GMRS, CB, Amateur Radio, as well as Meshtastic. For the second half of the talk, we'll dive in deeper on Meshtastic: how it compares in terms of capabilities, legality, range, and ease of integration, as well as edge cases. By the end of the presentation, participants will be equipped with actionable knowledge to select affordable communication tools for their needs, ensuring they remain connected when it matters most. bsidespdx-2025-31-from-walkie-talkies-to-meshtastic-an-overview-of-communication-platforms Talk 2 Slava I. Maslennikov en When traditional infrastructure fails, as it often does in the PNW, we may lose power, water, and even accessible roads. How do you plan to check in with your friends, family, share resources, and help others? In this talk, we’ll cover what options are available for long-distance remote communications between individuals: FRS, GMRS, CB, Amateur Radio, as well as Meshtastic. For the second half of the talk, we'll dive in deeper on Meshtastic: how it compares in terms of capabilities, legality, range, and ease of integration, as well as edge cases. By the end of the presentation, participants will be equipped with actionable knowledge to select affordable communication tools for their needs, ensuring they remain connected when it matters most. Those new to radio communications in general, and those new to Meshtastic will be most interested in listening. false https://cfp.bsidespdx.org/bsidespdx-2025/talk/J7FAJ8/ Talk 2 Presentation 2025-10-24T13:30:00-07:00 13:30 00:20 Safety Net Project, the tech safety team at the National Network to End Domestic Violence (NNEDV) has seen a significant uptick in recent years with local organizations requiring additional aid and guidance on best practices to support survivors of domestic violence and continue critical communication, in the face of natural disaster events like fires, hurricanes, and flooding. This project was born out of a direct response to this need - inspired by literal natural disasters across the United States. Graduate students from the University of Washington (UW) are conducting research on this critical topic of cyber security best practices and guidelines for local victim service providers in the context of disaster preparedness and response. Some key topics covered include: emergency response communication plans, privacy and digital protection during disasters, as well as location tracking (stalkerware, tracking through car, airtag, dog pet finder, children’s devices, etc.), detection, and prevention. The research presented will serve as a comprehensive guide that fills the current gap in NNEDV’s resources, by offering actionable recommendations to help local organizations continue critical communication and safeguard survivors during and after natural disasters. bsidespdx-2025-75-disaster-ready-digital-safety-building-resilient-support-systems-for-domestic-violence-survivors Talk 2 Naomi Meyer en Anyone! false https://cfp.bsidespdx.org/bsidespdx-2025/talk/JJS3TQ/ Talk 2 Presentation 2025-10-24T14:00:00-07:00 14:00 00:40 Many a presenter, including myself, has talked about fuzzing. Usually, we touch on a small amount of theory and then show off what a cool tool we built or what a difficult target we fuzzed. Instead this talk will focus on fuzzing history. Where did we start? How did we get here? What were the turning points along the way? For each major development, we'll cover a motivating example, the theory behind a solution, and a tiny implementation until we arrive at the modern day. bsidespdx-2025-49-a-history-of-fuzzing Talk 2 Rowan Hart en This presentation is for both people who are interested in fuzzing as a security method and practitioners who do it on a daily basis. Because I'll be starting at the beginning, attendees won't need any previous fuzzing knowledge or experience, but some knowledge of common software defects like memory corruption and some knowledge of general testing practice will help contextualize the topic. false https://cfp.bsidespdx.org/bsidespdx-2025/talk/GKC3X3/ Talk 2 Presentation 2025-10-24T15:00:00-07:00 15:00 00:20 Hackers are turning AI into a force multiplier for cybercrime. In this 20-minute talk, we’ll demo real hacker AI tools such as WormGPT and show how criminals use them to uncover vulnerabilities, generate exploits, and even weaponize zero-days at unprecedented speed. These tools also churn out phishing emails and call scripts in any language, letting novice hackers attack like experts on a global scale. See how AI is reshaping cybercrime and what defenders must prepare for now. bsidespdx-2025-51-hackers-ai-faster-smarter-more-dangerous Talk 2 /media/bsidespdx-2025/submissions/83PV9P/AI-Sasquatch-smaller_mkoyOZB.jpg Sherri DavidoffMatt Durrin en This talk is for anyone in cybersecurity. Whether you’re a novice or an experienced professional, you’ll benefit from seeing real hacker AI tools in action. Attendees will gain an understanding of how criminals are already using AI to accelerate attacks—and why defenders need to adapt quickly. false https://cfp.bsidespdx.org/bsidespdx-2025/talk/83PV9P/ Talk 2 Presentation 2025-10-24T15:30:00-07:00 15:30 00:20 Do burner phones really still exist, or are they the stuff of urban legend? Can you get a phone that's untraceable any more? Why would you even want to? Follow my journey as I find out, and maybe discover some privacy tips along the way. bsidespdx-2025-65-new-phone-who-dis-the-quest-for-a-true-burner-phone Talk 2 Mike Niles en * Why would you want one? * Getting the phone - the easy part, right? * Prepaid cards * Don't cross the streams! * Signing up for service * Picking a number * Identity theft is a crime, Jim * Anonymous email * Location, location, location * Summary Target audience: Privacy advocates, political activists, and data-broker haters false https://cfp.bsidespdx.org/bsidespdx-2025/talk/FCGW8Y/ Talk 2 Presentation 2025-10-24T16:00:00-07:00 16:00 00:20 In this raw, open, and honest session, I'll pull from my own and fellow VC-backed founder experiences on the crazy journey to build a security startup based in the PNW. We'll cover all major parts of the 0 -> 1 journey, including: ideation / idea validation, learning to sell, raising capital, building an MVP, finding PMF, and building a team. 1 year after graduating from the Y Combinator 2024 cohort, I'll open up about the things I wish I knew sooner, and the secrets to YC's success. I'll specifically talk about the challenges and strengths of building a non-SF-based startup. bsidespdx-2025-83-pnw-vs-bay-area-observations-from-the-seattle-startup-scene Talk 2 Emily Choi-Greene en Folks thinking about starting a startup, PNW folks considering relocating to Bay Area (or vice versa!) false https://cfp.bsidespdx.org/bsidespdx-2025/talk/L9FEKD/ Talk 2 Presentation 2025-10-24T16:30:00-07:00 16:30 00:20 Threat modeling has always been critical but also slow, manual, and often skipped. What if your security champions could generate a first draft of a STRIDE analysis from architecture diagram itself ? In this talk, we’ll explore how vision models (like Gemini Vision) and LLMs can automate early threat modeling by “seeing” system diagrams and translating them into structured security insights. I’ll show how we built an agent that ingests architecture diagrams, interprets flows and trust boundaries, and outputs threat models in a developer-friendly format. We’ll cover practical benefits (speed, adoption, developer engagement) as well as real challenges: hallucinations, missing context, and having humans in the loop. Finally, I’ll share how we turn these outputs into generating adversarial test cases, making threat modeling more actionable. Attendees will leave with a framework to experiment with their own AI-assisted threat modeling pipeline, lessons learned from real reviews of AI agents, and a realistic sense of what today’s vision models can (and can’t) do for security. bsidespdx-2025-100-automating-threat-modeling-with-vision-models-lesson-learned Talk 2 Pankaj UpadhyayMAYANK VATS en false https://cfp.bsidespdx.org/bsidespdx-2025/talk/XWDACA/ Workshop A Workshop 2025-10-24T11:00:00-07:00 11:00 02:00 Join us in this workshop to engage in hands-on attacks to identify weaknesses in generative AI. If you’re interested in learning about getting started in red teaming generative AI systems, this is the workshop for you. ⚠️ Important: Workshops require registration via this link: https://square.link/u/LYlZ89gC (Registration will open at 12:00 Noon PDT, on Friday, October 10th) bsidespdx-2025-8-llm-mayhem-hands-on-red-teaming-for-llm-applications Workshop A Travis SmithDavid Lu en We welcome any attendee who is interested in learning about the resiliency of a LLM based application against an adversary set on causing it to output unintended content. No prior experience with red teaming or attacking LLMs is necessary, as we will cover the basics and ramp students up throughout the session. false https://cfp.bsidespdx.org/bsidespdx-2025/talk/YX9EAY/ Workshop A Workshop 2025-10-24T13:00:00-07:00 13:00 02:00 So, you’d like to present at a conference? Awesome - but making that decision is just the first step of a long journey. This workshop is primarily intended for people who already have ideas of things to present, but need some help fine-tuning them and understanding the process. We’ll start off in a lecture format covering all the parts of preparing, submitting and presenting your work, answering a lot of questions you might ask yourself. We’ll proceed into an extended question and answer session. Think of your questions ahead of time, and perhaps even ask them before the workshop. Finally, we’ll use the remaining time to team up in groups to share our ideas and give each other feedback. Hopefully you’ll leave with a better idea of how to navigate the process, as well as a clearer idea of how to structure your submission and presentation. ⚠️ Important: Workshops require registration via this link: https://square.link/u/LYlZ89gC (Registration will open at 12:00 Noon PDT, on Friday, October 10th) bsidespdx-2025-111-so-you-d-like-to-present-at-a-conference Workshop A Joe FitzPatrick en false https://cfp.bsidespdx.org/bsidespdx-2025/talk/JH3GBP/ Workshop A Workshop 2025-10-24T15:00:00-07:00 15:00 02:00 Advances in Generative AI have enabled the development of autonomous agents, combining large-language models (LLMs) and custom tools with plan generation, reasoning, and tool execution to automate security tasks. One drawback of initial agentic approaches has been their monolithic development. However, much like HTTP decoupled the development of web clients and servers by standardizing the communication protocol between them, the Model-Context-Protocol (MCP) has emerged to decouple the development of agents and their tools. This workshop will provide an introduction to LLM agents and their construction using MCP. Attendees will first walk through a set of simple MCP clients and servers for automating database and file system tasks to get an understanding of how agents and MCP work using labs from https://codelabs.cs.pdx.edu. They will then experiment with a range of MCP servers from the open-source PentestMCP project https://github.com/Craftzman7/pentest-mcp that leverage penetration testing tools such as nmap, nuclei, and metasploit to automatically find, exploit, and exfiltrate data from a vulnerable web application. Note: Due to the nature of the exercises, they will be hosted on a Google Cloud Project that registered attendees will be given access to during the workshop. ⚠️ Important: Workshops require registration via this link: https://square.link/u/LYlZ89gC (Registration will open at 12:00 Noon PDT, on Friday, October 10th) bsidespdx-2025-14-pentestmcp-a-toolkit-for-agentic-penetration-testing Workshop A Wu-chang FengZachary Ezetta en Security practitioners interested in automating their workflows with Generative AI, LLM agents, and MCP. Students interested in learning about agentic security. false https://cfp.bsidespdx.org/bsidespdx-2025/talk/UFVTME/ Workshop B Workshop 2025-10-24T11:00:00-07:00 11:00 06:00 Abstract Binary exploitation can feel overwhelming for beginners. With so many tools, techniques, and architectures to learn, it’s easy to get lost without a structured path. Binary Jiu-Jitsu is designed to guide students through the fundamentals of binary exploitation using a skill-based, hands-on approach inspired by martial arts training. In this workshop, we’ll cover the essential building blocks for exploiting simple 64-bit Linux ELF binaries. Attendees will learn the fundamentals of computer architecture, reverse engineering with Ghidra, debugging with GDB, finding stack-based buffer overflows, and developing custom exploits using pwntools. Throughout the session, participants earn “stripes” by completing progressively harder hands-on challenges in a live CTFd environment. By the end, students will have the knowledge — and practical skills — to identify vulnerabilities, write working exploits, and pop their first shell. ⚠️ Important: Workshops require registration via this link: https://square.link/u/LYlZ89gC (Registration will open at 12:00 Noon PDT, on Friday, October 10th) bsidespdx-2025-69-binary-jiu-jitsu-white-belt-fundamentals Workshop B Joshua Connolly en This workshop is geared towards complete beginners. Linux CLI experience would be helpful but can be learned on the fly. false https://cfp.bsidespdx.org/bsidespdx-2025/talk/CPJTNR/ Talk 1 Other 2025-10-25T09:00:00-07:00 09:00 00:00 Registration opens at the registration room. bsidespdx-2025-108-registration-opens-all-day- Registration Room Registration Room en false https://cfp.bsidespdx.org/bsidespdx-2025/talk/S9CDWJ/ Talk 1 Remarks 2025-10-25T09:30:00-07:00 09:30 00:15 Opening remarks bsidespdx-2025-105-opening-remarks Talk 1 BSidesPDX 2025 Organizers en false https://cfp.bsidespdx.org/bsidespdx-2025/talk/3S83HA/ Talk 1 Keynote 2025-10-25T09:45:00-07:00 09:45 01:00 Day 2 Keynote bsidespdx-2025-106-day-2-keynote Talk 1 Micah Lee en false https://cfp.bsidespdx.org/bsidespdx-2025/talk/JKBL8M/ Talk 1 Other 2025-10-25T10:58:00-07:00 10:58 00:00 Stop by the Registration Room to chat with our amazing sponsors, grab some swag, and learn about the cool things they’re building. They’ll be here throughout the day! bsidespdx-2025-116-meet-the-sponsors-all-day- Sponsors Registration Room en false https://cfp.bsidespdx.org/bsidespdx-2025/talk/7V3ALW/ Talk 1 Other 2025-10-25T10:59:00-07:00 10:59 00:00 BSidesPDX 2025 CTF The annual BSidesPDX 2025 CTF competition, brought to you by an amazing group of volunteers! Go to https://ctf.bsidespdx.org to register and play! bsidespdx-2025-114-ctf-live-challenges-open-for-the-day-all-day- CTF Room CTF Room en false https://cfp.bsidespdx.org/bsidespdx-2025/talk/QEAGEJ/ Talk 1 Presentation 2025-10-25T11:00:00-07:00 11:00 00:20 Context switching during incident response is a silent productivity killer that costs security engineers hours of valuable time and significant cognitive load. This talk shares a real-world case study of how we transformed our on-call experience at Databricks by implementing Model Context Protocol (MCP) servers to enable AI-assisted incident triage and investigation. Attendees will learn how traditional incident response workflows—involving dozens of browser tabs, multiple tools, and constant context rebuilding—can be revolutionized through natural language interfaces. We'll demonstrate how MCP servers provide a standardized way for AI assistants to interact with infrastructure tools like PagerDuty and Databricks, reducing incident investigation time from 15+ minutes to under 2 minutes. Through real-world examples, we'll show how this approach eliminated overhead during on-call rotations, enabled cross-cloud investigation capabilities without manual intervention, and allowed engineers to focus on actual problem-solving rather than tool navigation. The talk includes practical implementation details and lessons learned from production deployments across 55+ multi-cloud Databricks workspaces. bsidespdx-2025-17-from-context-switching-hell-to-ai-powered-ops-eliminating-security-on-call-toil-with-the-model-context-protocol Talk 1 Will Urbanski en This talk is designed for security professionals who handle incident response or participate in on-call rotations, including SOC analysts, security engineers, detection engineers, and incident responders. It's particularly relevant for those looking to reduce the cognitive burden and operational friction of interrupt-driven investigations. Technical leaders considering AI-assisted tooling for their teams will also find valuable insights. While the examples use Databricks and PagerDuty, the concepts apply broadly to any security operations environment dealing with multi-tool workflows and context switching challenges. Participants will leave this presentation with concrete ideas for applying these concepts in their own environments. false https://cfp.bsidespdx.org/bsidespdx-2025/talk/FEKYPS/ Talk 1 Presentation 2025-10-25T11:30:00-07:00 11:30 00:20 In March 2025, the tj-actions/changed-files GitHub Action, which is used by 24,000 repositories, was weaponized to steal CI/CD secrets. All 361 version tags were pointed to malicious code that dumped credentials from memory directly into build logs. We were the first responders. Come hear the untold story of the 72-hour incident response. You'll learn how we detected an attack that traditional tools missed, built an IOC scanner over a weekend while the attack was live, and coordinated disclosure with dozens of organizations. You'll walk away with: - A tested incident response playbook you can adapt for your organization - Open-source tools: harden-runner (behavioral monitoring) and ghscan (IOC scanning) - Practical defenses for resilience against similar attacks bsidespdx-2025-95-tag-you-re-leaked-surviving-the-tj-actions-supply-chain-attack Talk 1 Mark EslerAshish Kurmi en ### Talk Outline **The Alert** - March 14, 1:01 PM: harden-runner's behavioral monitoring detects anomaly - Quick realization of scope: 24,000 affected repositories - Ashish and Mark were first responders to attack **The Attack** - Attack masqueraded as renovate[bot] with commit 0e58ed8 - All 361 version tags redirected to malicious commit - Memory scraping exfiltrated secrets to action logs - Brief demo: What the malicious base64 logs looked like **Initial Response** *Friday: Detection & Triage* - March 14, 22:20 UTC: StepSecurity reports compromise - Internal and external response of orgs *Saturday: Emergency Engineering* - Creating tj-scan/ghscan from scratch (live code snippet) - Scanning results reveal : 233 system.github.tokens, 151 github_tokens compromised - Discovering cloud.gov, CISA, and other government credentials leaked *Sunday: Disclosure Coordination* - Managing disclosure to 50+ organizations with leaked credentials - Reporting government credentials to CISA **What Actually Helped** *Quick Wins* - Demo: How harden-runner detected the attack - Demo: Using ghscan to check for similar compromises - Action pinning that doesn't break your workflows *Longer-term Improvements* - Migrating from static secrets to OIDC - Setting up runtime monitoring - Config changes that made the biggest difference **Resource** - Links to tools and response playbook (QR code) - Open invitation for questions and help false https://cfp.bsidespdx.org/bsidespdx-2025/talk/KPQTX3/ Talk 1 Presentation 2025-10-25T12:00:00-07:00 12:00 00:40 Intel's CET Shadow Stack is a CPU feature aimed at preventing Control-Flow Hijacking shenanigans by implementing a redundancy copy of the process stack, which can be verified for integrity through the program execution. Supporting CET Shadow Stacks in Linux applications is something that took a long long time to be implemented and deployed, and given the magnitude of changes required both in the kernel and in the toolchain, there was a reasonable chance that security details could be missed in the process. In this talk we'll cover the interactions between a kernel engineer and a security researcher regarding a last minute security finding that ended-up surfacing an intricate trade-off discussion around safety, performance and compatibility. These discussions led into redesigns of the shadow stack support at the brink of its release and are still relevant as new feature designs still stumble on the gritty details of these trade-offs. Besides the technical scope, this talk aims on emphasizing how the collaborations between software engineers and security researchers can be fruitful, fun and crucial to achieving more reliable security outcomes. bsidespdx-2025-27-keep-your-return-address-close-and-your-enemies-closer-how-a-kernel-engineer-and-security-researcher-collaborated-to-tighten-up-linux-shadow-stack Talk 1 Joao MoreiraRick Edgecombe en Open source warriors, security ninjas and apprentices, kernel sorcerers, toolchain forgers, low level dwellers. false https://cfp.bsidespdx.org/bsidespdx-2025/talk/E3QPU9/ Talk 1 Presentation 2025-10-25T13:00:00-07:00 13:00 00:20 GitHub forks are...weird. A couple implementation quirks lead to some funny (or alternatively, scary) consequences. And yeah, this is publicly documented, but who reads these days? This talk walks through real-world personal examples: recovering commits from a deleted project, brute forcing hidden commit history back into existence, and skirting a DMCA takedown by inserting hidden commits in a someone else's repository. bsidespdx-2025-57-nintendon-t-look-at-my-github-dmca-dodging-and-other-shenanigans Talk 1 James Martindale en This talk was originally given at an internal conference for a small pentesting firm, with a mixture of technical pentesters and nontechnical project managers/executive staff in the audience and written to be accessible to all. Familiarity with Git/GitHub is recommended (and mostly a given, considering BSides' audience) but there is a brief explanation at the beginning in case it is helpful (and to set up a joke). false https://cfp.bsidespdx.org/bsidespdx-2025/talk/M8J3NP/ Talk 1 Presentation 2025-10-25T13:30:00-07:00 13:30 00:20 Quantum computing has sparked both excitement and alarm in the cybersecurity world and honestly, I’ve felt both. Between promises of solving problems previously thought impossible and fears of cracking RSA wide open, it’s hard to tell what’s real and what’s just well-dressed science fiction. In this talk, I want to cut through the noise not from a purely academic standpoint, but from the perspective of someone who's actively working on quantum readiness in the fintech world. I’ve been navigating the hype, hope, and hard truths that come with trying to future-proof sensitive systems against a threat that’s not quite here… but definitely not imaginary. We'll look at quantum computing from a high level without drowning in math and break down what's real vs. speculative. We'll cover which cryptographic algorithms are truly at risk, where post-quantum cryptography (PQC) comes into play, and how to think about timelines without spiraling into paranoia. Whether you're in offensive security, defense, leadership, or just crypto-curious, this session will give you a clear picture of where things stand and how to start preparing without panicking (or overpaying a vendor with a quantum logo slapped on their pitch deck). bsidespdx-2025-79-quantum-computing-hype-hope-and-the-cybersecurity-horizon Talk 1 Neha Srivastava en Security Engineers / Architects – interested in threat modeling and cryptographic resilience CISOs / Security Leaders – making strategic decisions about long-term security posture Researchers / Students – wanting a no-nonsense intro to quantum’s real implications Crypto Curious – those overwhelmed by the jargon but want the signal, not the noise Technical Depth: Intermediate – no quantum physics or cryptography background required, but technical familiarity with cybersecurity concepts (PKI, encryption, risk modeling) will help. true https://cfp.bsidespdx.org/bsidespdx-2025/talk/3Q9WWR/ Talk 1 Presentation 2025-10-25T14:00:00-07:00 14:00 00:40 Webcams secretly running Linux reveal embedded system vulnerabilities, insecure firmware, and broken update mechanisms. Tracing the tech stack from distributors to chipset manufacturers exposes supply chain issues, security oversights, and risks at the hardware-software boundary. The talk includes demos and highlights the need for transparency and responsibility. bsidespdx-2025-66-this-is-not-a-camera Talk 1 Mickey ShkatovJesse Michael en Hackers This talk was presented at DEFCON, a link to the video is here: https://drive.google.com/file/d/1-WCn2r5TLD2L9waDJggugB-DtkebX04Z/view?usp=sharing true https://cfp.bsidespdx.org/bsidespdx-2025/talk/H9ZHVX/ Talk 1 Presentation 2025-10-25T15:00:00-07:00 15:00 00:20 Residential proxy networks, which reroute user traffic through residential IP addresses, present unique risks to enterprise networks and individual users. These proxies, often bundled with low-reputation applications, enable external traffic to appear as if originating from legitimate endpoints, frequently without user consent. Cisco Security's research highlights that residential proxies are 4.8 times more likely to connect to malicious domains compared to regular enterprise network traffic, underscoring the threats posed by such activity. This research investigates the mechanics, detection, and prevalence of residential proxies, leveraging datasets from Cisco Network Visibility Module (NVM) and the open-source mercury tool. By analyzing billions of network flows and telemetry data from approximately 240,000 devices, researchers identified residential proxy activity linked to applications like Infatica and Rave Helper. These programs, while not inherently malicious, misuse enterprise resources and can serve as vectors for attacks, including click fraud, spam, and internal reconnaissance by adversaries. The research also presents a novel detection approach based on Transport Layer Security (TLS) random nonces enables robust identification of residential proxy behavior in network traffic. This study underscores the risks posed by residential proxies and emphasizes the importance of addressing these threats to safeguard enterprise environments. By detailing threat detections for this behavior and some of the tools that exhibit it, it provides practical tools that can be leveraged to identify residential proxy behavior through network traffic analysis. These insights aim to empower organizations with actionable strategies to mitigate the misuse of their resources and reduce exposure to malicious activity. bsidespdx-2025-88-unwitting-hosts-how-residential-proxies-increase-risk Talk 1 Darin SmithBlake Anderson en Security analysts and IT administrators, we'll define all terms and concepts so it should be a pretty approachable entry level talk, but hopefully interesting to more advanced practitioners as well. false https://cfp.bsidespdx.org/bsidespdx-2025/talk/KRR9NX/ Talk 1 Presentation 2025-10-25T15:30:00-07:00 15:30 00:20 In a state agency responsible for fighting wildland fires (including a fleet of drones, aircraft, and firetrucks) and responding to regional natural disasters, securing sensitive data and IT infrastructure is critical and challenging. From protecting endangered species data to ensuring secure computing at the most remote locations, a cybersecurity program in such an agency requires speed, flexibility, and hand-tailored problem solving. This session will share how the Washington State Dept of Natural Resources built a cybersecurity program from the ground up, addressing unique challenges like risk tolerance, rapid deployment, and balancing security with mission-critical operations. bsidespdx-2025-4-an-unexpected-journey-building-a-cybersecurity-program-from-scratch-at-a-risk-taking-state-agency Talk 1 Ralph HogaboomLiz Lewis-Lee en Anyone looking for inspiration in what's possible with little resources and a whole lot of heart. false https://cfp.bsidespdx.org/bsidespdx-2025/talk/CJV8TZ/ Talk 1 Remarks 2025-10-25T16:00:00-07:00 16:00 00:15 Closing remarks bsidespdx-2025-110-closing-remarks Talk 1 BSidesPDX 2025 Organizers en false https://cfp.bsidespdx.org/bsidespdx-2025/talk/QUPP8Z/ Talk 1 Other 2025-10-25T17:00:00-07:00 17:00 03:00 PDX Hackerspace (Ctrl-H) 7600 N Interstate Ave Portland, OR 97217 Take the Yellow Line MAX to the N. Lombard Station - Parking is VERY limited https://maps.app.goo.gl/tw4NeRZEG9jMt8CG7 bsidespdx-2025-117-afterparty-ctrl-h Social Event BSidesPDX 2025 Organizers en false https://cfp.bsidespdx.org/bsidespdx-2025/talk/TY88XJ/ Talk 2 Presentation 2025-10-25T11:00:00-07:00 11:00 00:20 From LM hashes and rainbow tables to GPU rigs and Kerberoasting, the art of cracking Active Directory (AD) passwords has changed dramatically over the past two decades. What once took hours on a desktop can now be achieved in seconds with cloud GPUs and smarter wordlists. At the same time, attackers have shifted tactics—favoring low-and-slow spraying, ticket roasting, and credential theft over brute force. This talk traces the history of AD password cracking, exploring the techniques that defined each era and how defenses evolved in response. We’ll walk through legacy weaknesses, modern attacks like AS-REP roasting, and the growing role of hybrid AD/cloud identity. Along the way, you’ll see demos of cracking in action and gain a deeper appreciation of why old best practices (like complexity rules) don’t hold up today. Most importantly, we’ll cover practical steps defenders can take right now: from smarter password policies and banned password lists to detection strategies and long-term mitigations like MFA and passwordless authentication. Whether you’re red team, blue team, or somewhere in between, you’ll walk away with a clear understanding of how AD password cracking works, how it’s evolved, and what you can do to stay ahead of the curve. bsidespdx-2025-63-cracking-the-domain-evolution-of-active-directory-password-attacks Talk 2 Zach Mead en false https://cfp.bsidespdx.org/bsidespdx-2025/talk/YTF7RW/ Talk 2 Presentation 2025-10-25T11:30:00-07:00 11:30 00:20 Security teams drown in endpoint telemetry: processes spawned, commands executed, binaries triggered. But not every log line should become an alert, and not every alert should trigger a 2 a.m. wake-up call. The real challenge is knowing when a query result crosses the line from “informational” to “actionable.” In this talk, I’ll walk through how different types of endpoint queries; single-process anomalies, correlated multi-event queries, and time-bounded patterns; map to thresholds that determine whether engineers should escalate or suppress. We’ll explore practical heuristics for building alert thresholds that balance false positives and false negatives, tie signals back to MITRE ATT&CK techniques, and prioritize based on host and user context. Using an open-source EDR as a demo environment, I’ll showcase how raw suspicious process data can be transformed into high-confidence detections. The goal: give engineers and SOC analysts a framework for deciding not just what they can detect, but when they should start worrying. bsidespdx-2025-77-from-suspicious-query-to-real-incident-deciding-when-endpoint-alerts-really-matter Talk 2 Udochi Nwobodo en Who: SOC analysts, detection engineers, incident responders, and security engineers designing endpoint detections. Background helpful: Basic familiarity with endpoint telemetry (Windows/Linux process logs, Sysmon, EDR/XDR data). No need for deep reverse engineering or malware expertise. Takeaway: A mental model and practical heuristics for designing, tuning, and escalating endpoint detections without drowning in alert fatigue. false https://cfp.bsidespdx.org/bsidespdx-2025/talk/RKFEPJ/ Talk 2 Presentation 2025-10-25T12:00:00-07:00 12:00 00:40 Okta is at the heart of identity for many organizations, which also makes it a prime target for attackers. For security engineers, the real challenge isn’t just understanding Okta logs — it’s turning them into reliable detections that catch threats without overwhelming the SOC with noise. This talk provides a hands-on roadmap for building Okta detections from the ground up. We’ll begin by breaking down the different types of Okta logs and classifying them into meaningful categories (authentication, application access, administrative actions, MFA events, etc.). From there, we’ll show how multiple log types can be grouped to reveal attack patterns such as account takeovers, suspicious MFA bypasses, or privilege escalations. The core of the session focuses on the detection design process itself: Researching and threat hunting to baseline your Okta environment. Identifying the behaviors or signals you want to catch. Mapping those behaviors back to specific log fields and event types. Enriching with user, device, and IP context to reduce noise and add clarity. Testing and tuning the detection to validate it in production. Attendees will walk away not just knowing what data Okta provides, but how to use that data to design, build, and test an effective detection end-to-end. Whether you’re starting from zero or refining your existing Okta detections, this talk gives you a repeatable workflow for turning identity logs into actionable security signals. bsidespdx-2025-67-okta-detection-engineering-from-logs-to-detections Talk 2 Fevin George en Intermediate (security engineers, detection engineers, incident responders) false https://cfp.bsidespdx.org/bsidespdx-2025/talk/ZRPCLV/ Talk 2 Presentation 2025-10-25T13:00:00-07:00 13:00 00:20 LLMs are racing into clinics and back offices, but a single prompt, log or misstep can leak Protected Health Information (PHI) and erode trust. This fast paced, vendor agnostic talk shows how to ship useful Large Language Model (LLM) features in healthcare without violating privacy or slowing delivery. Instead of theory, we’ll focus on what can go wrong across the LLM lifecycle (e.g. in training, prompts, logs, embeddings etc.) and how to think like an attacker. Then translate all of it into a pragmatic, privacy by design workflow you can adopt immediately. You’ll leave with a concise blueprint, a threat to control matrix you can copy into your program, and a simple decision rubric for on-premises versus cloud deployments. If you own security, ML or compliance and need practical patterns, this session is for you! bsidespdx-2025-98-keeping-phi-out-of-the-model-practical-patterns-for-privacy-preserving-llms-in-healthcare Talk 2 Anoop N.Snahil en Healthcare AI systems face two simultaneous pressures: deliver real utility (focusing on intake, documentation, triage and clinical guidance) and avoid exposing Protected Health Information (PHI) at any point in the lifecycle. This talk presents a practical, privacy by design workflow for Large Language Model (LLM) use in healthcare that teams can implement without stalling delivery. We begin with a concise threat model that traces how PHI can leak during training, inference, logging and analytics. From there, we build a layered architecture: (1) a deterministic de-identification pipeline that removes identifiers, tokenizes sensitive terms, and generalizes identifiers before prompts or training (2) input, output and system guardrails that block prompt injection, redact emergent PHI, enforce tone/policy and create auditable traces (3) Retrieval Augmented Generation (RAG) constrained to pre approved, up to date clinical sources to reduce hallucinations and citation drift (4) a hosting decision rubric for on-device/on-premises vs cloud going over points like maximal control, scale etc. while also discussing relevant compensating controls On top of that foundation, we cover where Privacy Enhancing Technologies (PETs) fit. This would go over Differential Privacy for training to resist membership/attribute inference, Federated Learning with Secure Aggregation to keep raw data local while learning across institutions, Confidential Computing for data in use protection at inference/training time, and Machine Unlearning to honor “right to be forgotten” events without full retrains. The aim is for attendees to leave with a minimal threat to control matrix, a rollout checklist and concrete patterns they can adopt in hospital or vendor environments. true https://cfp.bsidespdx.org/bsidespdx-2025/talk/EAZZL7/ Talk 2 Presentation 2025-10-25T13:30:00-07:00 13:30 00:20 The last decade has been revolutionary for making embedded security research intellectually and financially accessible for thousands of curious minds around the world. Just by watching YouTube recordings of talks and reading blogposts from individual tinkerers and security firms alike, one can quickly start making a splash in a research area that was formerly thought to be prohibitively expensive and required lots of prerequisite knowledge. Pan back to you: you saw the title of this presentation, and thought it was interesting. You have a $5 multimeter, a crusty soldering iron, a few bootleg debug adapters, and a wallet full of lint and toothpicks, but not a lot of bread. Where to now? This talk presents the Hardware Procurement Iceberg (not coincidentally modeled off of the iceberg meme template): three distinct visualizations that show off different ways to procure (see: legally purchase and own) hardware to probe and modify for the sake of vulnerability and security research. Each visualization lays out various procurement methods measured by cost effectiveness, ethicality, and ease, which is left to the audience as to which route they choose to take. Whether it be eBay, GovDeals, or somewhere more obscure/exotic, this talk walks through all possible routes to find your desired router, medical equipment, ICS/SCADA device, or whatever you fancy to complete your end-to-end research testbed. bsidespdx-2025-92-the-hardware-procurement-iceberg-a-framework-for-keeping-embedded-research-fun-cheap-and-ethical Talk 2 yltsi en Any and all novice to intermediate hardware security researchers that want to improve their workflows by testing bugs/throwing PoCs at live physical targets. false https://cfp.bsidespdx.org/bsidespdx-2025/talk/QNBEK7/ Talk 2 Presentation 2025-10-25T14:00:00-07:00 14:00 00:40 In 2023 one of the largest libraries in the world fell victim to a ransomware attack. Their online catalogs were down for months, and the cost of recovery exceeded eight million dollars. In March 2024 the Library posted a detailed 18-page account of what happened and what they learned from the experience. I studied the full report so you don’t have to. If the analysis contains any surprises, it’s that there are no real surprises: the problems the British Library faced are common to many businesses, and the improvements the Library developed in response to the attack are reassuringly familiar best practices. We know how to reduce risk from ransomware. This 35-minute talk draws from the Library’s report to summarize the attack and explain how security controls such as network monitoring capabilities, multi-factor authentication, defined intrusion response processes, holistic risk management, and cyber-risk awareness at senior levels would have made a difference for the British Library-–and might in your company too. bsidespdx-2025-72-kidnapping-a-library-how-ransomware-taught-the-british-library-to-follow-well-known-best-practices Talk 2 Brian Myers en This talk is for a general audience interested in understanding how a specific ransomware attack unfolded at a major cultural institution. false https://cfp.bsidespdx.org/bsidespdx-2025/talk/AJD8HP/ Talk 2 Presentation 2025-10-25T15:00:00-07:00 15:00 00:20 This talk explores the converging risk factors that could transform helpful AI systems into potential security threats within organizations. We examine three critical ingredients that create this vulnerability: increasing capability, expanding agency, and exploitable motivation. As AI task capabilities surpass human performance in some domains, organizations naturally grant these systems greater autonomy and access privileges—mirroring how we treat valuable human employees. However, current AI systems remain fundamentally gullible, lacking robust skepticism when faced with indirect prompt injections and social engineering techniques. This talk will analyze how these three factors interact to create novel security challenges. bsidespdx-2025-90-from-assistant-to-adversary-when-agentic-ai-becomes-an-insider-threat Talk 2 Jason Martin en This is a technical presentation connecting concrete examples of generative AI system attacks to the ramifications viewed through the lense of agents as insider threats. While the audience doesn't need to have deep understanding of LLMs, the presentation will cover some basic aspects of how LLMs work and why that translates to gullibility, and give examples of agentic systems with dangerous agency. false https://cfp.bsidespdx.org/bsidespdx-2025/talk/XWLBHM/ Talk 2 Presentation 2025-10-25T15:30:00-07:00 15:30 00:20 As automation and orchestration become key components in security operations, their limitations are becoming equally apparent. Static workflows and predefined playbooks often fall short when facing novel threats or when responders are overwhelmed by false positives and incident fatigue. Agentic solutions—where large language models (LLMs) operate as autonomous or semi-autonomous agents—arises then as a promising evolution. This talk will explore the spectrum of AI-enabled assistance, starting with simple LLM usage for text-based tasks and moving toward autonomous multi-agent systems designed to handle complex, dynamic security scenarios. We will highlight both the opportunities and the challenges: while LLMs are accessible through simple chat interfaces, applying agentic solutions to real-world incident handling requires thoughtful orchestration, integration with tools, and recognition of inherent limitations. Examples will be provided, including email Security Agents implemented on top of workflow orchestration frameworks. Attendees will gain insight into the technical, operational, and human factors needed to responsibly adopt agentic solutions in security. By the end, they will better understand how to balance ambition with practicality, and how to begin experimenting with agent-driven incident response in their own environments. bsidespdx-2025-59-towards-agentic-incident-handling Talk 2 Cristian Fiorentino en Incident responders, threat analysts, threat researchers, SOC managers, and practitioners interested in the intersection of AI, agents, and security. false https://cfp.bsidespdx.org/bsidespdx-2025/talk/SD9L8Z/ Workshop A Workshop 2025-10-25T11:00:00-07:00 11:00 02:00 Capture the flag (CTF) exercises can be great practice and fun. However, sometimes things get complicated. Even the best of us may sometimes be lost, move in the wrong direction or get frustrated. In this workshop, not only are we giving you an overview and access to several CTF exercises, you are also provided hints (in case you need some). This way, everybody who shows up and spends some time can successfully complete some CTF exercises. Instruction for attendees: Bring a laptop. (It is nice if you can ssh via terminal. Otherwise have a browser ready.) ⚠️ Important: Workshops require registration via this link: https://square.link/u/LYlZ89gC (Registration will open at 12:00 Noon PDT, on Friday, October 10th) bsidespdx-2025-42-capture-the-flag-ctf-with-hints Workshop A Jens MacheRichard Weiss en Short descriptions of some of our CTF exercises can be found at https://edurange.org/scenarios.html false https://cfp.bsidespdx.org/bsidespdx-2025/talk/FWLJ7B/ Workshop A Workshop 2025-10-25T14:00:00-07:00 14:00 02:00 Learn how to configure, use, and abuse long-range, cheap communication devices through Meshtastic, without a license! Talk to friends, control remote devices, gather remote sensor data - all at low power use, low cost, with encryption. This workshop is designed for experience levels ranging from 0/5 to 2/5: * Beginner: never touched Meshtastic * Intermediate: installed Meshtastic, played with the app, messaged people Specifically, we’ll cover: * Hardware involved, mild theory * Configuration and set-up * Messaging and interacting with others * Working with telemetry and sensors * Basic walkthrough of controlling remote devices * Show and tell of several projects that use Meshtastic * How to keep advancing after the workshop For the price of admission ($50), you’ll receive hardware you’ll be working with at the workshop, that you will keep: * Heltec v3 * 4000mAh battery * Temperature/humidity/barometric pressure sensor * GPS sensor * A custom case to house all of the above * An ultrasonic distance sensor * Stickers ⚠️ Important: Workshops require registration via this link: https://square.link/u/LYlZ89gC (Registration will open at 12:00 Noon PDT, on Friday, October 10th) bsidespdx-2025-47-long-range-cheap-comms-through-meshtastic Workshop A Slava I. MaslennikovRyan en false https://cfp.bsidespdx.org/bsidespdx-2025/talk/AX3LJT/ Workshop B Workshop 2025-10-25T11:00:00-07:00 11:00 02:00 In this hands-on workshop, you'll learn to design intelligence-driven exercises using the Hero's Journey storytelling format. We'll explore how to transform generic "bad thing happened, now what?" scenarios into compelling stories that energize players and highlight real gaps. You'll walk away with: • A draft tabletop scenario outline tailored to YOUR organization • Practical techniques for incorporating adversary tradecraft using MITRE ATT&CK Navigator • Facilitation skills for managing the room, asking the right questions, and avoiding common pitfalls Please bring a laptop if possible. ⚠️ Important: Workshops require registration via this link: https://square.link/u/LYlZ89gC (Registration will open at 12:00 Noon PDT, on Friday, October 10th) bsidespdx-2025-25-tabletop-exercises-de-cryptid Workshop B Chloe Tucker en Engineers seeking buy-in for their security recommendations, managers building team cohesion, leaders dusting off IR plans, or anyone who thinks work should be more fun (because, let’s face it, security is stressful). No prior exercise experience required - just bring your organization's context and a willingness to think like an adversary. Whether you're planning for 3 people or 30, this workshop offers the tools to create exercises that prepare your team for the inevitable. Please bring a laptop if possible. true https://cfp.bsidespdx.org/bsidespdx-2025/talk/LRA3HH/ Workshop B Workshop 2025-10-25T14:00:00-07:00 14:00 02:00 We will be taking a look at a photo printer firmware for no particular purpose other than having fun and learning something. We will start by downloading a firmware update from the manufacturer's website, continue with figuring out firmware update format and start digging into the code. We will be using free and open tools, we will be introducing common reverse engineering principles and learning firmware and microcontroller concepts. We'll go as slow as necessary and will get as far as we can in the time allotted. ⚠️ Important: Workshops require registration via this link: https://square.link/u/LYlZ89gC (Registration will open at 12:00 Noon PDT, on Friday, October 10th) bsidespdx-2025-70-introductory-firmware-reverse-engineering Workshop B Aleks Nikolic en The goal of this workshop is to introduce common reverse engineering principles to wide audience. Beyond C programming basics, no other experience is required to follow along. The target firmware is an RTOS running on an ARM application processor, but that doesn't matter. We will be relying on Ghidra and its decompiler as our main reverse engineering tool. false https://cfp.bsidespdx.org/bsidespdx-2025/talk/UJPGWQ/