meetings

QR code phishing travels through carrier networks completely unseen - existing spam filters check text but can’t see inside QR code images. My research includes 190 real live scans across 55 participants with zero hesitations, introduces the Signal Switch behavioral framework, and includes a live audience demo where attendees scan a real QR code and experience the attack firsthand.

CTFs. The thrill of getting a flag is unmatched, but the narratives tend to be… flat. But they don’t have to be! Play an analog-horror, ARG-style capture-the-flag set in the heart of Denver. OSINT, crypto, web app vulnerabilities unlock a story about how a fictional man went missing (mostly) without a trace.

I’ll walk you through the story and infrastructure before opening it up for live play. Difficulty is easy to medium. but experience is not necessary (I have non-cyber friends who solved this as well)! See you there.

Ask of the audience: Bring a laptop. To participate, confirm that you have FTP, SSH, and nmap ready to go on your machine. Whether they’re built-in depends on the operating system but the obvious answer is just use Linux.

This will be an interactive lab covering the reverse engineering of msfvenom’s stageless Windows x64 reverse TCP shellcode. We will cover the basics of Windows internals, x86_64 assembly code in Windows, as well as the obfuscation techniques used by the shellcode author in an attempt to hinder static analysis.

To participate in the lab, you will need a fresh Windows 11 VM with 2 cpu cores, 4GB of RAM, and 64GB of disk space allocated. A script has been provided to set up the VM with the necessary software and configurations before the talk:

https://github.com/nick-neal/msfvenom-win-reveng-lab

Quantum computing is moving from a theoretical threat to a looming security crisis, and asymmetric cryptography is right in the crosshairs. This talk breaks down exactly how Shor’s algorithm dismantles the public-key foundations—like RSA and ECC—that secure everything from our web traffic to our identities.

We’ll cut through the hype to look at immediate, real-world risks—like “Harvest Now, Decrypt Later” and “Trust Now, Forge Later”—to help you pinpoint which of your systems and data are most vulnerable based on their lifespan and value. From there, we’ll dive into NIST’s new post-quantum standards and look at what they actually mean for your PKI, TLS, and enterprise architecture.

To bridge the gap between theory and execution, I’ll introduce pqcscan, an open source tool built to scan your infrastructure and hunt down vulnerable public-key implementations before adversaries can exploit them. We’ll wrap up by weighing the tradeoffs of post-quantum cryptography, hybrid rollouts, and quantum key distribution. You’ll walk away with a no-nonsense action plan for crypto agility, asset discovery, and the exact steps needed to build a quantum-resilient future.

Fire up JADX-gui and poke around a real malware sample of the AndroRAT android malware family. Learn about how android apps are structured and explore malicious functionality.

WARNING THERE WILL BE LOTS OF JAVA

Prereqs:

• Optional (recommended) download and setup an analysis linux vm like ubuntu.
  • Sample is primarily Dalvik bytecode / compiled Java and is relatively low risk for static analysis.
• Install Java
• Download Jadx https://github.com/skylot/jadx/releases/tag/v1.5.5
• Acquire malware sample by going to https://vx-underground.org/Samples/Families/Android.AndroRAT and downloading version 7729b69281dd037739b6f2802e5b90636694e59482288438ad43b5dfb8d3ad15.7z

Have you ever heard that Macs don’t get malware? Well that’s not true. Bad Brew was a click fix malware campaign that tricked users into downloading and running malware by imitating the homebrew package manager. I will compare an earlier and a more advanced malware sample that shows how the threat actors tactics changed over time

“What am I working on?”

Building a flexible cybersecurity training range — one that can simulate everything from simple flat networks to complex multi-site enterprises with legacy systems, modern infrastructure, and all the messy realism in between.

Why?

Because learning security requires a safe space to fail. Red teamers need targets they can attack without consequences. Blue teamers need environments where missed detections are lessons, not disasters. Students need room to break things and understand why. CDX provides that space — fully isolated, fully contained, and ready to reset as often as the learning demands.

What makes it different?

The range isn’t just isolated networks in a vacuum. There’s underlying infrastructure that makes it feel like operating within a larger ecosystem — realistic enough to be worth a longer conversation if you’re curious.

Where is this headed?

The project is open source and actively evolving. I’m building exercises, refining automation, and exploring opportunities to support hands-on training for security professionals, students, and teams who want something more than a typical lab experience. Interested in training, contributing, or learning more? I’d welcome the conversation.

Finding vulnerabilities in automobiles… Some old ones and some ??

At this month’s meeting, Alan will preview his upcoming SnowFROC talk, Crash Course into the OWASP API Top 10. As a DC303 exclusive complimenting the talk, we will practice on the vulnerable applications Completely Ridiculous API (crAPI) and VAPI.

To participate in the interactive part of the event, bring your own laptop with an intercepting proxy (Burp, ZAP, etc.) as well as an API testing tool like Postman. There will be several options for accessing the labs, including using API Sec University’s hosted environment, a local Proxmox lab network we will host in the space for the event, or setting up your own VMs on your laptop.

Recommended Tools:

https://portswigger.net/burp/communitydownload
https://www.zaproxy.org/
https://www.postman.com/
https://github.com/OWASP/crApi (or alternative to deploying a VM: http://crapi.apisec.ai/)
https://github.com/roottusk/vapi (or alternative to deploying a VM: http://vapi.apisec.ai/)

Talk Abstract:

Application Programming Interfaces (APIs) are the glue that allows independently evolving systems to communicate with each other, and are an important focus for security investment due to their privileged access to sensitive data and functionality. Recently, the OWASP API Top 10 has been updated for 2023, so join us as we introduce the OWASP API Security Project. We’ll cover what’s new in the 2023 API Top 10, as well as compare the differences with the previous 2019 version. For those interested in hands-on practice, we’ll also briefly introduce the OWASP crAPI (completely ridiculous API) Project which demonstrates common API vulnerabilities.

At this month’s meeting we’ll spend some quality time with a truly insecure CRM application that has something for every level of web hacker. Entry level participants can explore a poorly designed authentication system, mid-level hackers will have plenty of opportunities to run SQL and JavaScript Injection attacks, and there is even a pathway to shell, but it will take some real dedication to get there. A walkthrough is available for those who need it so everyone should come away knowing a little more about how to attack (and defend) web applications. Bring your own laptop with an intercepting proxy (Burp, ZAP, etc.) installed to participate.

COME LEARN ABOUT WIFI HACKING! We’ll be going over wifi’s evolution over the years, learning about vulnerabilities, mitigations, the tooling available, what’s under the hood of most wifi routers, and how you can run your own audits and even defend wifi in an enterprise or home environment.

INCLUDING PRACTICAL LABS! We’ll be putting out a bunch of wifi access points, maybe even some vulnerable clients, and you’re going to be hacking them.

HACK THE PLANET!

Examining the complex relationship between AI and Cybersecurity and Privacy. May do some exploration of the Claude family of AI models. Be ready for good discussion.