def con

At DEF CON 27, Nina Kollars tells how buying Nespresso capsules on eBay led her to investigate fraudsters reselling goods bought with stolen credit cards. She describes her non-technical tracking and reporting efforts.

A DEF CON 23 talk on researching whether a commercial quadcopter could be forced to land by interfering with its GPS signal, inspired by a neighbor's kid's drone. It covers the research and the legal and technical issues encountered.

Charlie Miller and Chris Valasek present their DEF CON 23 talk on remotely compromising an unmodified Jeep, pivoting from the entertainment system to the vehicle's internal networks to send control messages. They aim to show the reality of car hacking.

John Sotos, a physician and former Intel chief medical officer, argues at DEF CON 25 that genetic diseases are exploitable vulnerabilities in the genome. He warns that CRISPR and related tools will make malicious genome hacks and targeted bioweapons feasible.

A DEF CON 26 talk by investigative journalists and hackers on the fake science industry, with bogus conferences and predatory journals that give studies false credibility. It draws on a large investigation into the money behind them.

Deviant Ollam and Howard Payne give an in-depth DEF CON 22 explanation of how elevators work, from the pit to the penthouse. It covers their control modes and how pen testers use elevators to bypass building security.

A DEF CON 23 talk showing how weak controls in electronic death registration systems let someone virtually kill a person and obtain a real death certificate, with consequences for their identity and life.

Moxie Marlinspike's DEF CON 19 talk on the weaknesses of SSL and the certificate authority system. He explains how CA trust became a problem and proposes an alternative that removes the CA oligopoly without reducing security.

A DEF CON 29 talk by Richard Henderson about encoding the EICAR antivirus test string into QR codes and barcodes and scanning them at real systems. Many systems that do not expect such input misbehave or collapse, including a parking garage system.

Moxie Marlinspike's DEF CON 18 talk argues that privacy threats have shifted from centralized state databases like TIA to corporate data collection by companies like Google, despite wins in strong cryptography and decentralization.

Chris Domas's DEF CON 23 talk on psychological warfare against reverse engineers. He builds code whose disassembly and control flow graphs mislead, intimidate and demoralize anyone analyzing it.

Christopher Domas presents research at DEF CON 26 showing a hidden alternate instruction set and undocumented hardware backdoor in some x86 processors, found on a third-party CPU. He uses it to ask how feasible wider hardware backdoors are.

A DEF CON 30 talk by Sam Bent, a former darknet vendor, on operational security when using Tor and the darknet. He applies the hacker mindset to staying anonymous and avoiding capture.

Adrian Crenshaw's DEF CON 22 talk gives an overview of Tor and I2P, then goes through real cases where darknet users were caught. These include Silk Road and its operator.

Christopher Domas's DEF CON 26 talk on secret processor registers that vendors reserve for third parties holding trusted keys. He examines how users are locked out of parts of their own CPUs.

Zoz's DEF CON 23 talk explores practical, often explosive ways to destroy data and hard drives quickly. It tests methods such as thermite and other physical techniques for rapid destruction.

Artem Dinaburg's DEF CON 19 talk on bit-squatting, where DRAM bit flips cause DNS requests to go to domains one bit off from the intended one. It shows how hardware faults can be exploited for hijacking without any software exploit.

A DEF CON 24 talk on how a cyber mercenary group could forge identities and create the conditions for overthrowing a government. It is entertainingly outlandish and includes a drone-mounted saw for cutting power lines.

Scott Arciszewski's DEF CON 26 Crypto and Privacy Village talk critiquing the JOSE standards (JWT, JWS, JWE) and showing how to design cryptographic tokens more safely.

A DEF CON 23 talk by Marc Rogers and Kevin Mahaffey walking through the architecture of the Tesla Model S, what Tesla got right and wrong, and how the interconnected systems can be hacked. It also covers the data the car collects.

Deviant Ollam's DEF CON 17 talk explains how legally checking a firearm in luggage can be the most secure way to fly with valuable tech. It covers firearm transport rules and luggage locks.

Jason Scott's DEF CON 18 talk tells the history of software piracy over thirty years, centered on the feuds and drama among rival warez groups. It is full of archival material and insider lingo.

Zoz's DEF CON 22 talk on operational security in the age of pervasive surveillance. He shows how hard it is to avoid mistakes even for people who should know better.

Cory Doctorow's DEF CON 31 talk describes how platforms decay in a pattern he calls enshittification. He lays out a plan to stop it through antitrust, interoperability and fixing the law.

Artem Dinaburg's DEF CON 19 talk on bit-squatting, where flipped bits in DRAM cause devices to contact domains that differ by one bit from legitimate ones. He shows how registering such domains can hijack traffic without exploiting any software bug.

A DEFCON 20 panel with NSA whistleblower William Binney, journalist James Bamford and ACLU lawyers on the NSA's mass collection of communications and its conflict with the Constitution.

Moxie Marlinspike's DEF CON 18 talk on changing threats to privacy argues that surveillance arrived through convenient services and network effects, so opting out is not a real solution. It also includes his framing of getting social democracy rather than the fascism people feared.

A DEF CON 21 talk by Adam Laurie and Zac Franken on decapping chips, covering how to remove chip packaging and image the die to read out contents such as ROM.

A DEF CON 21 talk by Karl Koscher and Eric Butler on how SIM cards work, including Java Card applets, the SIM toolkit and the OS running on the card. It shows how much control the network and the card have independent of the phone.

Dan Tentler's DEF CON 20 talk on odd things he found on the internet through Shodan, such as stoplights, power systems and other non-computer devices exposed online. It highlights how many devices need no credentials.

A DEF CON 20 talk by RenderMan on the security weaknesses of ADS-B, the unencrypted, unauthenticated aircraft tracking broadcast. It shows how easily the data can be spoofed and what that means for security designed in too late.

Jayson E. Street's DEF CON 19 talk shows photos from real security engagements where he was already inside client facilities, illustrating how social engineering and physical intrusion can cause huge losses. For each attack he also explains what defenses would have stopped him.

Chris Paget's DEF CON 18 talk on practical cellphone spying, showing how GSM traffic can be intercepted with a fake base station. It covers 2G interception and the weaknesses of cellular networks.

A DEF CON 19 talk by datagram introducing tamper-evident devices. It reviews how seals and similar products are designed and shows that they are often easily defeated, drawing on the DEF CON tamper-evident contest.

A DEFCON 21 talk by Robert Stucke on DNS errors caused by single-bit flips, which lead to requests for misspelled domains. It shows real-world data on bitsquatting.

A DEF CON 22 panel with Rob Graham, Paul McMillan and Dan Tentler on the quirks of scanning the entire internet with masscan. They discuss how fast IPv4 can be scanned and what the results reveal.

Chandler Carruth's CppCon 2016 talk tries to defuse the heated debate over undefined behavior in C and C++. He explains from the compiler writer's perspective why UB exists and how it enables optimization.

Jason Scott of textfiles.com tells the story at DEFCON 17 of being sued for two billion dollars by a scammer who plagued him and others for over a decade. The talk is tragic and funny, covering what he learned about misleading schemes.

Herb Sutter's CppCon 2015 plenary on writing safe, modern C++ by default using the C++ Core Guidelines. It includes a demo of lifetime-checking static analysis tooling.

Okta developer advocate Nate Barbettini explains OAuth 2.0 and OpenID Connect in a roughly hour-long talk. It starts from the problems the protocols solve and walks through the flows. The description notes the implicit flow material is now out of date.