meetings

Seemly all of a sudden many theorized cryptographic systems are becoming practically usable. Programmable Cryptography is an exciting vision for novel applications using these new tools to empower privacy, verifiability, and much more. This talk will highlight some of these new tools and cover a few key use cases. We will invite discussions from the audience about how we might use these, helping drive adoption and innovation here in our local community and beyond! With any luck, we will come away with a few groups to kick-off a series of talks and workshops around this theme. Speaker bio: Nuke 🌄 is a developer relations advocate at https://risczero.com/ working to evangelize Verifiable Computation and is a huge fan of all things Programmable Cryptography Application. He is a community Steward for https://cryptorado.org that in home for web3 innovators and open source tools to empower people to be self sovereign, focused on engineering coworking and community hackin’. Connect with him on Cryptorado’s Zulip (join at https://Cryptorado.org, or directly on signal

Couldn’t make it to Hacker Summer Camp? Made it, but didn’t see every talk available? Join us for a group brain dump on the most interesting talks, research, and tools released at Blackhat, BSides Las Vegas, or DEF CON. Really anything recent and interesting is fair game. Please come with at least one item to share, even if it was just something you saw referenced and would like to know more about.

Have you agreed to a hardware pentest but don’t know where to start? Or perhaps you’re interested in hacking electronics for fun or profit. In any case, this talk will provide a gentle introduction to the hardware hacking scene. If you’re a software hacker, this session will empower you to start probing signals with confidence. For those already familiar with hardware hacking, we’ll delve into advanced attacks such as glitching and power analysis. We’ll even explore some fun analog hacking of cassettes. Join us for an informative and hands-on journey into the world of hardware hacking.

(Preview of upcoming conference talk…)

This is a story of how Python can fit into the physical world around us. It is a story of system design and product development. It is a tale of great breadth, covering distributed computing, custom printed circuits, electromagnetism, some of the largest hydropower generators in the world, and the software and hardware that brings this all together. This tale covers several years of research and development, culminating in a cyber physical system built on open-source software and easily attainable off-the-shelf products and components.

We will also discuss performing security reviews and penetration tests of these types of systems.

Abstract: The HardenedBSD Project is a “spork” of FreeBSD that aims to provide the wider BSD community with a clean-room reimplementation of the publicly-documented bits of the grsecurity patchset for Linux. The cofounders of the project started collaborating in 2013, and the project become official in 2014.

HardenedBSD goes above and beyond its original goal by providing extra security enhancements, exploit mitigation strategies, and unique access into our infrastructure. We seek out ways to serve in global human rights endeavors, navigating the nexus between {cyber,info}sec and human rights.

This presentation recaps the last decade of development and dives into where we aim to go in the next one, five, and ten year periods. We give tangible (yet sanitized) examples of the impact of our human rights focus.

Active Directory lab setup, exploitation, and walkthroughs. If you want to set your own up, cloud cost should be under 5 dollars for the evening, or people can use mine. (Sharing means you have to take turns.)

Compilation of the best hacks across AWS, Azure, and Kubernetes; showing off common security misconfigurations.

Source code analysis is consistently regarded as one of the most effective strategies for uncovering vulnerabilities. However, manual reviews can be time consuming, not to mention difficult to scale for large applications or across application portfolios. Advancements in tooling have traditionally not kept pace with the industry’s needs, with security researchers often relying exclusively on non-security focused solutions such as Developer IDEs and grep.

Enter: CodeQL. CodeQL is a semantic code scanning engine that introduces a rich, custom query language. This query language can augment manual source code review by highlighting areas of interest to focus on, or it can be used to model entire vulnerability classes and provide alerts when those models are detected in a code base.

This workshop starts out with an introduction to CodeQL, how it works and what sets it a part from other solutions. It ramps up quickly to showcase how CodeQL can be applied to find vulnerabilities in real world applications. Tips and tricks, as well as strengths and weaknesses will also be covered. No experience is required.

Ruby on Rails makes it easy to spin up a web application in minutes, but has proven to be reliable enough to run large company product offerings as well. Web Pentesters don’t technically need to know the platform behind the websites they’re testing, but when we do, we can sometimes find more interesting bugs more quickly. At this meeting we’ll start with the fundamentals by spinning up a trivial Rails app and then take a look at some vulnerabilities that often arise within Rails’s “sensible defaults”. Bring a laptop you’re willing to install Rails on to play along.

The how and why of a threat informed, offensive driven Defense