Conference on SRA Labs | Cybersecurity Research & Innovation by Security Risk Advisors https://labs.sra.io/tags/conference/ Recent content in Conference on SRA Labs | Cybersecurity Research & Innovation by Security Risk Advisors Hugo -- gohugo.io en-us Tue, 08 Sep 2026 12:00:00 +0000 DEFCON 34 Recap https://labs.sra.io/posts/dc34recap/ Tue, 08 Sep 2026 12:00:00 +0000 https://labs.sra.io/posts/dc34recap/ <p>Oh my God, we&rsquo;re back again! Another year, another DEFCON. And a Backstreet Boys reunion. This year we sent 12 people, gave 1 workshop, gave 1 talk, and participated in 2 panels. This post is gonna be bringing the flavor, showcasing the teams personal highlights from our DEFCON34 experience.</p> <h2 id="sra--defcon">SRA @ DEFCON</h2> <ul> <li><a href="https://github.com/sh0ckSec/FlipperHIDecoder" target="_blank">Clone to Pwn: Remote Badge Cloning with the Flipper Zero</a> <ul> <li>Langston Clement - Physical Security Village (Talk)</li> </ul> </li> <li>Purple Teaming? Simulating the Adversary in the World of AI Systems <ul> <li>Evan Perotti - Adversary Village (Panel)</li> </ul> </li> <li>Detection Coverage Is a Hypothesis: Testing it Through Adversarial Execution Variance <ul> <li>Connor Jackson, Nahid Sarker, Raphael Soto, Russell Harvey - Adversary Village (Workshop)</li> </ul> </li> <li>From Threat-Intel to Tested Defense, the Adversary Simulation Playbook <ul> <li>Sarah Hume - Adversary Village (Panel)</li> </ul> </li> </ul> <h2 id="highlights">Highlights</h2> <p>Across the 12 of us that went, here are our personal picks for content that stood out:</p> <p>Oh my God, we&rsquo;re back again! Another year, another DEFCON. And a Backstreet Boys reunion. This year we sent 12 people, gave 1 workshop, gave 1 talk, and participated in 2 panels. This post is gonna be bringing the flavor, showcasing the teams personal highlights from our DEFCON34 experience.</p> <h2 id="sra--defcon">SRA @ DEFCON</h2> <ul> <li><a href="https://github.com/sh0ckSec/FlipperHIDecoder" target="_blank">Clone to Pwn: Remote Badge Cloning with the Flipper Zero</a> <ul> <li>Langston Clement - Physical Security Village (Talk)</li> </ul> </li> <li>Purple Teaming? Simulating the Adversary in the World of AI Systems <ul> <li>Evan Perotti - Adversary Village (Panel)</li> </ul> </li> <li>Detection Coverage Is a Hypothesis: Testing it Through Adversarial Execution Variance <ul> <li>Connor Jackson, Nahid Sarker, Raphael Soto, Russell Harvey - Adversary Village (Workshop)</li> </ul> </li> <li>From Threat-Intel to Tested Defense, the Adversary Simulation Playbook <ul> <li>Sarah Hume - Adversary Village (Panel)</li> </ul> </li> </ul> <h2 id="highlights">Highlights</h2> <p>Across the 12 of us that went, here are our personal picks for content that stood out:</p> <table> <thead> <tr> <th>Title</th> <th>Author</th> <th>Description</th> <th>Link</th> </tr> </thead> <tbody> <tr> <td>Transformers: Dark Side of the Type - Weaponizing the Conversion Layer</td> <td>Oleksandr Mirosh</td> <td>A new class of attacks that works similarly to insecure deserialization, but targets the type transformation layer rather than a deserializer.</td> <td><a href="https://i.blackhat.com/BH-USA-26/Presentations/BHUS26-Mirosh-Transformers-Dark-Side-WP.pdf" target="_blank">link</a></td> </tr> <tr> <td>Can AI do novel security research? Meet the HTTP Terminator</td> <td>James Kettle</td> <td>A deep dive into using AI for developing novel attack classes</td> <td><a href="https://portswigger.net/research/can-ai-do-novel-security-research" target="_blank">link</a></td> </tr> <tr> <td>CRLF-Powered Desync Attacks: Beheading HTTP Streams</td> <td>Tom Stacey &amp; Tobia Righi</td> <td>Using HTTP Header Injection to enable novel desync attacks</td> <td><a href="https://portswigger.net/research/crlf-powered-desync-attacks" target="_blank">link</a></td> </tr> <tr> <td>Identity Crisis: Novel Vulnerabilities Leading to Kerberos Downgrade, DoS, and Full Domain Takeover</td> <td>Shai Laron</td> <td>Using unfilterable/invisible Unicode characters to bypass Kerberos uniquiness constraints for SPNs &amp; UPNs</td> <td><a href="https://www.semperis.com/blog/identity-crisis-novel-vulnerabilities-leading-to-kerberos-downgrade-dos-and-full-domain-takeover/" target="_blank">link</a></td> </tr> <tr> <td>Certified Re-Pwned: escalating all the way up</td> <td>Daniel Monzon &amp; Eric Labrador</td> <td>Five new ADCS exploits</td> <td></td> </tr> <tr> <td>Breaking BIOS in ATMs</td> <td>Arnold Jared Morales Yepez</td> <td>Using DMA attacks for ATM jackpotting</td> <td><a href="https://www.paymentvillage.org/def-con-34/speakers" target="_blank">link</a></td> </tr> <tr> <td>LaunchBreak: RCE Through Custom URIs</td> <td>Gavin Zhong, Zhengyu Liu, &amp; Jinajia Yu</td> <td>RCE in Electron apps via custom URI schemas</td> <td><a href="https://media.defcon.org/DEF%20CON%2034/DEF%20CON%2034%20presentations/DEF%20CON%2034%20presentations/DEF%20CON%2034%20-%20Gavin%20Zhong%2C%20Zhengyu%20Liu%2C%20Jianjia%20Yu%20-%20LaunchBreak%20a%20Sip%20of%20Tea%2C%20a%20Click%2C%20and%20a%20Full%20Multi-stage%20Desktop%20Takeover%20-%20launchbreak%201%200.pdf" target="_blank">link</a></td> </tr> <tr> <td>Lights Out – Out Of Band Management Exploitation</td> <td>HD Moore</td> <td>Introduced several new BMC attack techniques</td> <td><a href="https://github.com/runzeroinc/oobscan" target="_blank">link</a></td> </tr> <tr> <td>Click Me: Turning URI Links into Bug Bounty RCEs</td> <td>Tobias Diehl</td> <td>Abusing Windows protocol handlers for RCE</td> <td></td> </tr> <tr> <td>What Scammers Know That Social Engineers Don&rsquo;t</td> <td>Megan Squire</td> <td>Improve social engineering interactions by learning from techniques used by scammers</td> <td></td> </tr> <tr> <td>Anyone Can Hack IoT - Even Easier Now</td> <td>Andrew Bellini</td> <td>Using AI to perform IoT hacking tasks</td> <td><a href="https://github.com/digitalandrew/Defcon_IoT_Talk/blob/main/Anyone%20Can%20Hack%20IoT%20-%20Even%20Easier%20Now%20%28DC34%29.pdf" target="_blank">link</a></td> </tr> <tr> <td>Bring Your own EDR</td> <td>Shahak Morag</td> <td>Abusing SentinelOne&rsquo;s privileged COM interfaces to attack other EDR processes</td> <td><a href="https://www.akamai.com/blog/security-research/bring-your-own-edr-turn-commercial-edr-trojan-horse" target="_blank">link</a></td> </tr> <tr> <td>Bypassing the Human EDR</td> <td>Daniel Isler</td> <td>Identify existing phishing/scam training to create pretexts that your target won&rsquo;t flag as suspicious</td> <td></td> </tr> <tr> <td>Lyra</td> <td>Rafael Felix</td> <td>A cross-platform, LLVM-based obfuscator for Rust</td> <td><a href="https://github.com/hakaioffsec/lyra" target="_blank">link</a></td> </tr> <tr> <td>SilentChrome</td> <td>Gordon Long</td> <td>Using chrome extension hollowing to overwrite legitimate plugins with malicious content</td> <td><a href="https://github.com/asaurusrex/Silent_Chrome" target="_blank">link</a></td> </tr> <tr> <td>pathfinding.cloud</td> <td>DataDog</td> <td>AWS privilege escalation methods</td> <td><a href="https://pathfinding.cloud" target="_blank">link</a></td> </tr> <tr> <td>EvilFont</td> <td>Drew G</td> <td>Hiding invisible machine-readable text in fonts to enable social engineering and prompt injection</td> <td><a href="https://github.com/DoctorEww/EvilFontTool" target="_blank">link</a></td> </tr> </tbody> </table>