2.0 -//Pentabarf//Schedule//EN PUBLISH BRFRYD@@talks.toorcon.net -BRFRYD KEYNOTE: The Demise of the Cybersecurity Workforce (!?) en en 20211012T100000 20211012T105000 005000 KEYNOTE: The Demise of the Cybersecurity Workforce (!?) . PUBLIC CONFIRMED Talk https://talks.toorcon.net/toorcon-2021/talk/BRFRYD/ The Point G. Mark Hardy PUBLISH CYLURG@@talks.toorcon.net -CYLURG Fuzzers, analyzers, and other Gophers insecticides en en 20211012T110000 20211012T115000 005000 Fuzzers, analyzers, and other Gophers insecticides Go is a great language that is explicit, simple, and it makes writing concurrency extremely easy. Yet, it suffers from many of the same vulnerabilities you'd encounter in C and C++ applications. Writing concurrent Go code can also be risky, as vicious concurrency bugs can slowly sneak into your application. So, how can you get started discovering vulnerabilities in Go code? This talk will discuss approaches to finding vulnerabilities in Go code and the state of static and dynamic analysis tools for automated discovery of Go vulnerabilities, from static analysis to fuzzing to fault injection. We will learn about common vulnerabilities in Go and how to catch them, whether you are a security researcher or a Go developer. We will focus on: - Learning common bugs in Go applications - Learn the types of concurrency bugs that are common to Go - Discuss the state of tooling for catching and discovering Go bugs and the techniques that they rely on - Demonstrate Gotico, a tool currently in development for catching library-specific bugs PUBLIC CONFIRMED Talk + Hands-On Demo https://talks.toorcon.net/toorcon-2021/talk/CYLURG/ The Point Alex Useche PUBLISH WRQEVD@@talks.toorcon.net -WRQEVD Sleight of ARM: Demystifying Intel Houdini en en 20211012T130000 20211012T135000 005000 Sleight of ARM: Demystifying Intel Houdini NOVEL CONTRIBUTIONS OF THIS RESEARCH: The Intel Houdini emulator is a black box that does not appear to have undergone any significant public research into its inner workings or security impact. Existing work has focused on implementing function hooks targeting ARM code running through Houdini, but has not gone much deeper than that. This research dives into the internals of Houdini, discusses the security issues it introduces, and introduces several novel abuses of the runtime it provides. WHY THIS RESEARCH MATTERS: This research sheds a light onto the internal workings of a poorly understood binary emulator -- that among other issues, can enable malware to enter mobile app stores undetected -- and offers remediation strategies to app stores. The research also offers remediation and hardening advice to implementers of binary translators. In the near future, due to ISA diversification across x86, ARM, and RISC-V, there will likely be an increased need for binary translators to support porting software across both architectures and operating systems. Due to the compatibility and performance needs required, it is likely that "in-process" binary translators, such as Houdini and Rosetta 2, will be used over OS- or "hypervisor"-style sandbox emulators such as QEMU. Due to their "direct" mode of operation, they can introduce various kinds of risks that are highly specific to the implementation and host system. Our work extends modern security research into this newer style of emulator with a focus on ensuring that these newer binary translator emulators do not weaken the existing security model for native processes nor introduce additional vulnerabilities. PUBLIC CONFIRMED Talk https://talks.toorcon.net/toorcon-2021/talk/WRQEVD/ The Point Brian Hong PUBLISH QKZRPV@@talks.toorcon.net -QKZRPV Extra Better Program Finagling (eBPF) for Attack and Defense en en 20211012T140000 20211012T145000 005000 Extra Better Program Finagling (eBPF) for Attack and Defense Program instrumentation and tracing is a key component of any offensive persistence framework or defensive endpoint detection and response (EDR) technology. Desktop and Server platforms have included various tracing tools and APIs over the years from strace and truss to DTrace and SystemTap. This talk will focus on the latest tracing infrastructure known as Extended Berkeley Packet Filters (eBPF) which is currently supported on Linux and is coming to Windows as well. eBPF has the ability to trace arbitrary kernel and userland binaries and includes a program verifier for the attached hook functions implemented by the user. As the tracing technologies are merging into a unified API layer, we see adoption happening for both the offensive and defensive tooling. eBPF is complex with several front end languages and backend hooking engines. This talk will explain how eBPF works, what it takes to write eBPF based hooks, and demonstrate two simple tools for verfiying or infecting ELF binaries on the fly. Some of the topics we will cover: - What workflows allow rapid development of eBPF programs - How to use eBPF to verify privileged processes and build your own telemetry - How to use eBPF to stealthily infect ELF binaries from kernel - Why you should never load eBPF with Python w/ demo against real EDR - Fuzzing results for uBPF, the eBPF front end for Windows - The future of eBPF on Windows and Linux PUBLIC CONFIRMED Talk https://talks.toorcon.net/toorcon-2021/talk/QKZRPV/ The Point Richard Johnson PUBLISH UV79FN@@talks.toorcon.net -UV79FN Getting Down with Bringup en en 20211012T150000 20211012T155000 005000 Getting Down with Bringup Systems these days depend on the lowest stages of start up to provide a base for security further up the chain. As the security community and hackers have gotten better tools and better at sniffing out bugs, security has been forced to move down the chain. But how far? Is the boot loader enough? At what point can you really call it "SecureBoot"? Do you need a TPM? We are going down the rabbit hole to find out where the bits get flipped, whats signed, whats not, and what IS signing anyway? Let's take a look at chip ROMs, BIOS, UEFI, e-fuses, pre-boot partitions (like TrustZone and aBoot), where TPMs get involved, and when boot loaders go wrong. Lets see if we can get a "secure" boot environment going on cheap, easy to debug hardware, and juts how secure we can make it. After all, doesn't every hacker need a place where they can try out their boot loader and firmware exploits? PUBLIC CONFIRMED Talk + Hands-On Demo https://talks.toorcon.net/toorcon-2021/talk/UV79FN/ The Point Gene Erik PUBLISH UQ7RVJ@@talks.toorcon.net -UQ7RVJ Making Mischief with Machine Specific Register Based Exploits en en 20211012T160000 20211012T165000 005000 Making Mischief with Machine Specific Register Based Exploits This talk will introduce the audience to the concept of model specific registers, with a brief overview of their history and introduction. An overview of the commonly used model specific registers will be given, with examples in a vulnerable driver being used to illustrate how and where they are used. A sample driver will be reverse engineered to demonstrate the process of assessing a vulnerability with model specific register use, an example exploit will also be given to demonstrate how the registers can be successfully leveraged in order to gain kernel code execution. Finally, mitigation strategies for model specific register based attacks will be given for kernel mode driver developers. PUBLIC CONFIRMED Talk https://talks.toorcon.net/toorcon-2021/talk/UQ7RVJ/ The Point John D Dunlap PUBLISH C8BGWG@@talks.toorcon.net -C8BGWG Free as in Beer: Building a low cost static analysis program en en 20211012T170000 20211012T175000 005000 Free as in Beer: Building a low cost static analysis program Scaling static analysis across languages and multiple codebases is a difficult process at best. Here we walk through our setup, which we've designed to be easy to maintain, trivial to add additional codebases, and provide few false positives. Plus, the primary tool we use is free, as in beer. Cheers. PUBLIC CONFIRMED Talk + Hands-On Demo https://talks.toorcon.net/toorcon-2021/talk/C8BGWG/ The Point Erin Browning Tim Faraci PUBLISH BJHYZ7@@talks.toorcon.net -BJHYZ7 Wakeboarding and Wakesurfing en en 20211012T063000 20211012T090000 023000 Wakeboarding and Wakesurfing PUBLIC CONFIRMED Activity https://talks.toorcon.net/toorcon-2021/talk/BJHYZ7/ Wake Boarding Somerset Recon PUBLISH XYPTTH@@talks.toorcon.net -XYPTTH Private Viewing: James Bond No Time to Die en en 20211012T200000 20211012T230000 030000 Private Viewing: James Bond No Time to Die PUBLIC CONFIRMED Activity https://talks.toorcon.net/toorcon-2021/talk/XYPTTH/ AMC 18 (Fashion Valley) PUBLISH ELQA8C@@talks.toorcon.net -ELQA8C ToorCon CTF en en 20211012T100000 20211012T180000 080000 ToorCon CTF PUBLIC CONFIRMED Activity https://talks.toorcon.net/toorcon-2021/talk/ELQA8C/ ToorCon CTF PUBLISH X3LW87@@talks.toorcon.net -X3LW87 KEYNOTE: On Hardware Hacking and Turtles en en 20211013T100000 20211013T105000 005000 KEYNOTE: On Hardware Hacking and Turtles . PUBLIC CONFIRMED Talk https://talks.toorcon.net/toorcon-2021/talk/X3LW87/ The Point Jasper van Woudenberg PUBLISH KCFGVF@@talks.toorcon.net -KCFGVF The Unauthorized Guide to the LUNA USB Multitool en en 20211013T110000 20211013T115000 005000 The Unauthorized Guide to the LUNA USB Multitool The Great Scott Gadgets LUNA USB Multitool hardware is set to begin shipping in late May of 2022. Unfortunately, global events will likely prevent the GSG team from being able to present their new platform before its release, so you get the next best thing – the 100% unofficial, unauthorized talk. Based on my experience with the latest beta hardware and LUNA’s open-source design, I’ll first introduce LUNA, its history, its goals, and its capabilities, then cover applications that currently work out-of-the box, including high-speed USB traffic capture and analysis (in conjunction the open-source ViewSB software) and device emulation/manipulation using FaceDancer. I’ll then pivot to talk about how you can extend LUNA’s functionality by writing new gateware, briefly covering digital logic design, hardware description languages, the nMigen Python-based HDL, and testing your design in simulation. I’ll demonstrate how to build a simple System-on-Chip design based on a simple RISC-V core and write firmware for it to control custom logic, making LUNA a standalone FPGA/SoC development board. I will show off some weird, powerful, and definitely unsupported projects you can create with LUNA. Finally, I’ll talk about other unofficial hardware platforms LUNA targets, how to create additional targets, and how you can get started with LUNA on hardware you might already own! Keep hacking. PUBLIC CONFIRMED Talk + Hands-On Demo https://talks.toorcon.net/toorcon-2021/talk/KCFGVF/ The Point Karl Koscher PUBLISH M9ETDR@@talks.toorcon.net -M9ETDR House of Heap Exploitation (Workshop) en en 20211013T130000 20211013T170000 040000 House of Heap Exploitation (Workshop) - Module 1 - Introduction to the GLibC Heap Allocator: - History of dynamic memory allocators - Basic Data structures - Chunks - Bins (Free Chunks Handling) - Challenge #1: Fixing a chunk - Malloc & Free Ordering - Module 2 - Heap Vulnerability Classes: - Ideal heap environment testing setup - Buffer overflows - Use after frees - Challenge #2: Use after free - Double frees - Module 3 - Fd Poisoning: - Understanding the TCache Bin - Exploiting fd pointers - Challenge #3: Fd Poison - Introduction to TCache leaks - Fastbin Variation - Pointer Mangling - Module 4: Unlink: - Understanding the original bins (unsorted, small and large) - Removing a chunk from a bin - Unlink attack for arbitrary write primitive - Modern unlink attack - Unsafe unlink demo - Challenge #5: Unlink Attack - Module 5 - Overlapping Chunks: - Understanding the size and prev_size chunk metadata - Corrupting the size field - Overlap chunks by growing the size - Challenge #6: Overlap two chunks - Variant analysis (shrinking, mmap, unsorted bin, etc.) - Conclusion PUBLIC CONFIRMED Workshop https://talks.toorcon.net/toorcon-2021/talk/M9ETDR/ The Point Maxwell (Strikeout) Dulin Kevin Choi PUBLISH GFTAYN@@talks.toorcon.net -GFTAYN The isle of tortuga, but on the internet en en 20211013T170000 20211013T171000 001000 The isle of tortuga, but on the internet This is a high-level talk about the colorful antics that attackers are getting up to outside of the typical "phish-to-ransomware" approach that has become popular in the last few years. The bar isn't going up, exactly, but more like the bar is getting wider. Attackers are employing interesting and colorful tactics and these sorts of behaviors typically fall outside of the comfort-zone of defenders, as they will involve things like sim cloning, DNS attacks, theft of cookies and taking advantage of lax business logic and misconfigurations to avoid triggering sensors by using actual exploits, or doing things like classical scan-and-attack techniques. Defenders will get an idea of some of the new tricks attackers are deploying, and attackers may learn some new tricks! PUBLIC CONFIRMED Lightning Talk https://talks.toorcon.net/toorcon-2021/talk/GFTAYN/ The Point Dan Tentler PUBLISH XGYT99@@talks.toorcon.net -XGYT99 HACK THE, er... WESTERN HEMISPHERE!! en en 20211013T171500 20211013T172500 001000 HACK THE, er... WESTERN HEMISPHERE!! The Shadytel cabal has been provided an unprecedented opportunity to legally uplink to and use a vacant transponder slot on a geostationary satellite about to be decommissioned. This lightning talk will cover the tools we used (including the HackRF, GNU Radio, tsduck, Flusonic, OBS, and others) to convert an unused commercial uplink facility into the ultimate, legitimate information broadcast. PUBLIC CONFIRMED Lightning Talk https://talks.toorcon.net/toorcon-2021/talk/XGYT99/ The Point Karl Koscher PUBLISH GNT7YX@@talks.toorcon.net -GNT7YX The Unauthorized Guide to the LUNA USB Multitool (Demo Time) en en 20211013T130000 20211013T150000 020000 The Unauthorized Guide to the LUNA USB Multitool (Demo Time) I will have my LUNA prototype with me that people will likely be able to experiment with. I’m hoping to have a CodeSpaces-like environment where people can simply load up the base LUNA code base in their browser, hack on some Python or nMigen gateware, run tests, and finally see their hacks running on real hardware. PUBLIC CONFIRMED Hands-On Demo https://talks.toorcon.net/toorcon-2021/talk/GNT7YX/ The Lawn - Alpha Karl Koscher PUBLISH LWDTPB@@talks.toorcon.net -LWDTPB Getting Down with Bringup (Demo Time) en en 20211013T150000 20211013T170000 020000 Getting Down with Bringup (Demo Time) For the demo, we will take a loot at a modern arm based platform and an x86/64 platform that are easy to recover from if broken. We'll build some firmware, learning the tools, break a device, recover it, look at debug points. Attendees will probably need/want some VU meters, FTDI/TTL connectors, power strips, and something raspbery-pi like to follow along. PUBLIC CONFIRMED Workshop https://talks.toorcon.net/toorcon-2021/talk/LWDTPB/ The Lawn - Alpha Gene Erik PUBLISH XAQEHG@@talks.toorcon.net -XAQEHG Free as in Beer: Building a low cost static analysis program (Demo Time) en en 20211013T130000 20211013T150000 020000 Free as in Beer: Building a low cost static analysis program (Demo Time) We will demo tuning static analysis rules to specific environments. Attendees will need to download Semgrep, the static analysis engine our program is based upon, beforehand. We have tuned our rules extensively, which has greatly reduced our false positive rate. PUBLIC CONFIRMED Workshop https://talks.toorcon.net/toorcon-2021/talk/XAQEHG/ The Lawn - Beta Erin Browning PUBLISH PHDDMD@@talks.toorcon.net -PHDDMD Fuzzers, analyzers, and other Gophers insecticides (Demo Time) en en 20211013T150000 20211013T170000 020000 Fuzzers, analyzers, and other Gophers insecticides (Demo Time) I will demo three tools: - Go-fuzz for fuzzing Go applications - GCatch for detecting concurrency bugs in Go code - gotico, a tool currently in development for catching library-specific bugs PUBLIC CONFIRMED Workshop https://talks.toorcon.net/toorcon-2021/talk/PHDDMD/ The Lawn - Beta Alex Useche PUBLISH TMVUJA@@talks.toorcon.net -TMVUJA Nerf Modding 101 (Workshop) en en 20211013T130000 20211013T170000 040000 Nerf Modding 101 (Workshop) Are you a gadgeteer, modder, tinkerer? Do you want to be but hardly know how to use a screwdriver? Well, then this workshop is for you... There is no reason to settle for a stock blaster out of the box! Join long time prop maker, inventor & nerf modifier Riverside in a workshop that will go step by step through modding the Nerf Zombie Strike Hammershot Blaster; one of the hottest blasters on the market. What will I learn if I join this workshop? In this workshop you will learn the secret inner workings of the four major classes' of nerf blaster (Electric, Spring, Air, Gas). We will cover modification principles for both functionality (shoot farther) and cosmetic (wow that's pretty/cool!) This includes masking & paint, form factor changes (addition and reduction), air-flow restriction removals, and a lot more... As part of our nerf gun cosmetics instruction, we will be covering an introduction to basic electronics and the use of LED lights to make things glow as well as the basics of Bondo to change shapes of basic guns. Of course all of this amazing stuff will require some crazy tools; drills, hammers, saws, dremmel's, etc. So we will be going over the proper "safe" use of each tool for beginners. NOTE: Basic paint colors will be provided. If you would like super fancy colors and want to bring your own, please contact the instructor ahead of time to ensure it is the right type of paint (Must be paint for plastic). PUBLIC CONFIRMED Workshop https://talks.toorcon.net/toorcon-2021/talk/TMVUJA/ The Lawn - Gamma Riverside PUBLISH YGHLGR@@talks.toorcon.net -YGHLGR Beach Luau en en 20211013T183000 20211013T200000 013000 Beach Luau PUBLIC CONFIRMED Activity https://talks.toorcon.net/toorcon-2021/talk/YGHLGR/ Beach Lounge PUBLISH NF33MH@@talks.toorcon.net -NF33MH Party! en en 20211013T210000 20211014T000000 030000 Party! PUBLIC CONFIRMED Activity https://talks.toorcon.net/toorcon-2021/talk/NF33MH/ Toro (Downtown) Keith Myers PUBLISH RNET8S@@talks.toorcon.net -RNET8S ToorCon CTF en en 20211013T100000 20211013T160000 060000 ToorCon CTF PUBLIC CONFIRMED Activity https://talks.toorcon.net/toorcon-2021/talk/RNET8S/ ToorCon CTF PUBLISH G7EQQC@@talks.toorcon.net -G7EQQC Beach Lounge & Activities en en 20211014T100000 20211014T172000 072000 Beach Lounge & Activities PUBLIC CONFIRMED Activity https://talks.toorcon.net/toorcon-2021/talk/G7EQQC/ Beach Lounge PUBLISH DDVQES@@talks.toorcon.net -DDVQES Party Cruise en en 20211014T200000 20211014T220000 020000 Party Cruise PUBLIC CONFIRMED Activity https://talks.toorcon.net/toorcon-2021/talk/DDVQES/ Bahia Belle PUBLISH GW39ME@@talks.toorcon.net -GW39ME Escape Rooms! en en 20211014T173000 20211014T190000 013000 Escape Rooms! PUBLIC CONFIRMED Activity https://talks.toorcon.net/toorcon-2021/talk/GW39ME/ Escape Rooms PUBLISH DJZMXS@@talks.toorcon.net -DJZMXS Paddle Pub & San Diego Beer Tasting en en 20211014T150000 20211014T170000 020000 Paddle Pub & San Diego Beer Tasting ## **Beer List 2021** This year we focus on three different breweries for different samples of San Diego brewing. #### **Ballast Point** ***** * **Longfin Lager** - https://untappd.com/b/ballast-point-brewing-company-longfin/11602 * **California Kölsch** - https://untappd.com/b/ballast-point-brewing-company-california-kolsch/1387947 * **Blood Orange Lager** - https://untappd.com/b/ballast-point-brewing-company-blood-orange-lager/4539244 * **Grapefruit Sculpin** - IPA with Grapefruit - https://untappd.com/b/ballast-point-brewing-company-grapefruit-sculpin/285658 #### **Alesmith** ***** * **Tropical Marmalade** - Hazy IPA https://untappd.com/b/alesmith-brewing-company-tropical-marmalade/3215328 * **San Andreas Shake** - Milkshake IPA with Lactose and Pineapple https://untappd.com/b/alesmith-brewing-company-san-andreas-shake/4469840 * **Speedway Stout** - Imperial Stout with Mexican Dark Chocolate, Sea Salt, and Mexican Coffee https://untappd.com/b/alesmith-brewing-company-speedway-stout-w-mexican-dark-chocolate-sea-salt-and-mexican-coffee/4474854 * **.394 Pale Ale** - San Diego Style Pale Ale https://untappd.com/b/alesmith-brewing-company-san-diego-pale-ale-394/705460 * **Aleschmidt Oktoberfest** - German-Style Märzen Lager https://untappd.com/b/alesmith-brewing-company-aleschmidt-oktoberfest-2021/4428298 #### **Mikkeler ** ***** * **Falling Sparks** - West Coast IPA https://untappd.com/b/mikkeller-brewing-san-diego-falling-sparks/4464234 * **Træblod** - Imperial Stout brewed with Maple & Coffee https://untappd.com/b/mikkeller-brewing-san-diego-traeblod/3877424 * **This Just In!** - Imperial Tart Ale with Pear and Vanilla Beans https://untappd.com/b/mikkeller-brewing-san-diego-this-just-in/4442726 * House Mikkeller of San Diego's **Ghost Visions Lager** - Winter is HERE https://untappd.com/b/mikkeller-brewing-san-diego-game-of-thrones-ghost-visions/4535436 * **Spontanblueberry** - Blueberry Lambic Mikkeller https://untappd.com/b/mikkeller-spontanblueberry/2273521 * **Hammock Bound** - `Fruited Berliner Weisse Ale with Key Lime` https://untappd.com/b/mikkeller-brewing-san-diego-hammock-bound/4409430 PUBLIC CONFIRMED Activity https://talks.toorcon.net/toorcon-2021/talk/DJZMXS/ Paddle Pub