2.0 -//Pentabarf//Schedule//EN PUBLISH TXUJF3@@pretalx.com -TXUJF3 Opening Speech en en 20230211T090000 20230211T091000 001000 Opening Speech Hello and Welcome! PUBLIC CONFIRMED Pecha Kucha https://pretalx.com/bsides-cymru-2023-2022/talk/TXUJF3/ Track 1- Dragon Suite Craig Jones, Clare Johnson + Stuart Criddle PUBLISH ECGZYB@@pretalx.com -ECGZYB Keynote Speech en en 20230211T091500 20230211T094500 003000 Keynote Speech Keynote/Opening Speech PUBLIC CONFIRMED Talk https://pretalx.com/bsides-cymru-2023-2022/talk/ECGZYB/ Track 1- Dragon Suite John Shier PUBLISH BZQBXJ@@pretalx.com -BZQBXJ Let that think in: Thought experiments and their application to cyber security en en 20230211T095000 20230211T103500 004500 Let that think in: Thought experiments and their application to cyber security Brief outline of the talk: 1. INTRODUCTION: who I am, what I do; my interest in thought experiments; aims of the talk 2. WHAT IS A THOUGHT EXPERIMENT? Competing definitions; history and examples in various fields (philosophy, physics, law); types of thought experiment (destructive, constructive, platonic); format and usage (how they're presented; unfolding of scenario; why they should be used, Kuhnian crises); outputs (models); caveats (biases, where does new knowledge come from, idealisation, imagination as a negative); unusual forms (koans, fiction) 3. APPLICATIONS TO CYBER SECURITY: Background (usage, distinction vs. tabletop exercises, scenarios, 'thinking like an attacker'); why we need thought experiments (Kuhnian crisis, challenging assumptions); examples of pre-existing thought experiments in related areas (AI, cryptography, privacy); benefits; examples (adapting pre-existing thought experiments and coming up with new ones - examples include attribution, innovation, cyberweapons) 4. HOW TO DESIGN A THOUGHT EXPERIMENT: destructive and constructive forms; outline of the process 5. CONCLUSION: Reiterate aims; first step; call for collaboration and cooperation; references, contact details, and questions. PUBLIC CONFIRMED Talk - long https://pretalx.com/bsides-cymru-2023-2022/talk/BZQBXJ/ Track 1- Dragon Suite Matt Wixey PUBLISH YQR3J7@@pretalx.com -YQR3J7 Fangxiao, a Chinese phishing threat actor en en 20230211T104000 20230211T111000 003000 Fangxiao, a Chinese phishing threat actor Have you ever seen a fake survey site spready by WhatsApp? If so, you might have interacted with Fangxiao. Starting from a single phishing website, this talk will cover how we identified tens of thousands of phishing domains and de-anonymised domains behind Cloudflare. Pivoting across sites, we uncover a shady world of lead generation agencies, fake dating sites, and a frankly ridiculous number of domains. We will explain how we identified and tracked the group behind these sites and discuss their operational security failures. PUBLIC CONFIRMED Talk https://pretalx.com/bsides-cymru-2023-2022/talk/YQR3J7/ Track 1- Dragon Suite Emily Dennison Alana Witten PUBLISH YCASUH@@pretalx.com -YCASUH Electryone: In the land with no sun en en 20230211T111500 20230211T120000 004500 Electryone: In the land with no sun Targeting an installer cloud means that a successful attack would give elevated access to the inverters , including functions not accessible to PV’s owners. In this talk we are going to review how attacking a PV installer cloud could lead to taking hundreds of thousands of inverters offline and introduce instability into countries’ power grids. All attacks are remotely exploitable and a result of logic flaws introduced by the web portals’ developers. Those logic flaws vary from simple Insecure Direct Object References (IDORs) to self-promoting your user to platform admin. PUBLIC CONFIRMED Talk - long https://pretalx.com/bsides-cymru-2023-2022/talk/YCASUH/ Track 1- Dragon Suite Vangelis Stykas PUBLISH EN7TT3@@pretalx.com -EN7TT3 Lunch - Click for Menu en en 20230211T120500 20230211T130500 010000 Lunch - Click for Menu Lunch will be a buffet and cater for a spectrum of dietary requirements: • Salad boxes including- • Green salads, • Coleslaw, • Mediterranean couscous • Tomato salad • With a choice of Caesar chicken, bbq chicken, teriyaki salmon, selection of cheese and then dietary appropriate options- these will be labelled for self-service and collection. • Rustic Bread roll selection • Assortment of sweet treats- carrot cakes, muffins, mini cakes, cookies • Packets of crisps- assorted flavours • Assortment of soft drinks Any special dietary requirements provided in advance will be labelled and accessible. PUBLIC CONFIRMED Talk - long https://pretalx.com/bsides-cymru-2023-2022/talk/EN7TT3/ Track 1- Dragon Suite Craig Jones, Clare Johnson + Stuart Criddle PUBLISH VXJRWD@@pretalx.com -VXJRWD Bohemian IcedID - Queen of Loaders en en 20230211T131500 20230211T134500 003000 Bohemian IcedID - Queen of Loaders IcedID (also referred to as BokBot) first appeared in early 2017 as a 'traditional' banking trojan leveraging webinjects to steal financial information from victims. Since this time, it has evolved to include dropper functionality, and is now primarily used as a vehicle for the delivery of other tools, such as Cobalt Strike, and the eventual deployment of ransomware. IcedID itself is commonly delivered in phishing (spam) campaigns, leveraging an assortment of lure types and execution processes. IcedID has two stages to its initial command and control (C2) communications, prior to further tools being downloaded on the victim host. Patterns in the way these C2 communications are setup and appear in network telemetry data allow us to follow threat actor campaigns, often from a starting point of 'pre-spam' (before infrastructure is used actively in the wild). We look forward to sharing more details in our talk! PUBLIC CONFIRMED Talk https://pretalx.com/bsides-cymru-2023-2022/talk/VXJRWD/ Track 1- Dragon Suite Josh Hopkins Thibault Seret PUBLISH QVMLF3@@pretalx.com -QVMLF3 The Office of Danger: A Choose Your Own adventure story! en en 20230211T135500 20230211T142500 003000 The Office of Danger: A Choose Your Own adventure story! The Office of Danger: A Choose Your Own adventure story! This session will put the audience in the driving seat of a real-life social engineering engagement against a high security office building in central London. Simulating the high-pressure environment of a social engineering engagement, the slides will present the audience with a choice that must be made quickly to avoid detection, unlock new areas of the office and achieve their objective. So, what will you do? • Head for the stairs or the elevator? • Sweet talk the receptionist, or try and blend in with the crowd? • Run as quickly as you can from Security, or hide in the toilet? You are presented with two options to take each adventure in a unique direction, with over 30 different choices to be made, resulting in a different and unique presentation each time! This is the first of its kind talk, which puts you in the driving seat and shows the level of quick thinking that is needed to avoid detection and reach your targets! PUBLIC CONFIRMED Talk https://pretalx.com/bsides-cymru-2023-2022/talk/QVMLF3/ Track 1- Dragon Suite Phil Eveleigh PUBLISH 8JRWD9@@pretalx.com -8JRWD9 Hacking to defend: How we hacked into a Polar Orbit Satellite and managed to get a full system compromise en en 20230211T143000 20230211T150000 003000 Hacking to defend: How we hacked into a Polar Orbit Satellite and managed to get a full system compromise While researching a Polar Orbit Satellite we managed to identify a critical vulnerability allowing full system compromise, we managed to completely own the box within a time span of a few hours. The vulnerabilities were reported and patched. PUBLIC CONFIRMED Talk https://pretalx.com/bsides-cymru-2023-2022/talk/8JRWD9/ Track 1- Dragon Suite James (0xJay) Josh Allman PUBLISH FEPNNU@@pretalx.com -FEPNNU Bypassing Anti-Virus using BadUSB en en 20230211T151000 20230211T155500 004500 Bypassing Anti-Virus using BadUSB During this presentation, we will take a look over how we can bypass most Anti-Virus detection using a payload embedded on a BadUSB device, resulting in a silver bullet for gaining initial access inside a victim network. Demo will be also included during the presentation. PUBLIC CONFIRMED Talk - long https://pretalx.com/bsides-cymru-2023-2022/talk/FEPNNU/ Track 1- Dragon Suite Cristian Cornea PUBLISH BNC8W3@@pretalx.com -BNC8W3 Needles Without the Thread: Threadless Process Injection en en 20230211T160000 20230211T163000 003000 Needles Without the Thread: Threadless Process Injection As red teamers, we always find ourselves in a cat and mouse game with the blue team. Many Anti-virus and EDR solutions over the past 10 years have become significantly more advanced at detecting fileless malware activity in a generic way. Process injection, a technique used for executing code from within the address space of another process is a common method within the offensive operator’s toolbox. Commonly used to mask activity within legitimate processes such as browsers and instant messaging clients already running on the target workstation. Within the last 2 years, tools such as Sysmon have added new detections and events for process injection along with big improvements in detections within commercial EDR space. With this in mind, a new method of injection was researched that would not fall foul to the traditional methods that are often detected today. Throughout the talk we will cover some of these traditional process injection techniques followed by a technical dive into the novel method that was researched and release a corresponding open-source tool that leverages the technique. PUBLIC CONFIRMED Talk https://pretalx.com/bsides-cymru-2023-2022/talk/BNC8W3/ Track 1- Dragon Suite Ceri Coburn PUBLISH VCTQJK@@pretalx.com -VCTQJK Closing Speech en en 20230211T164000 20230211T164000 000000 Closing Speech A short thanks to everyone and details of the afterparty. PUBLIC CONFIRMED Talk https://pretalx.com/bsides-cymru-2023-2022/talk/VCTQJK/ Track 1- Dragon Suite Craig Jones, Clare Johnson + Stuart Criddle PUBLISH AGYTSR@@pretalx.com -AGYTSR Robots for Complete Beginners en en 20230211T095000 20230211T103500 004500 Robots for Complete Beginners Robots look fun, right? We'd all love to build robots... but how? This talk is about the "how". Using some tools that most of us will be familiar with (Lego!!) and some that are perhaps less familiar... but easy (Arduino) we'll examine how to turn an off-the-shelf toy into something more special. PUBLIC CONFIRMED Talk - long https://pretalx.com/bsides-cymru-2023-2022/talk/AGYTSR/ Track 2 - Foxhunter Mark Goodwin PUBLISH TXYBVN@@pretalx.com -TXYBVN Verify, then Trust en en 20230211T104000 20230211T111000 003000 Verify, then Trust From dummy think tanks to false academic credentials and degree mills, Dr Jennings, author of the acclaimed book on establishing false identities 'When You're Not You', presents a fascinating session on how people claim false authority. Covering everything from the principles of influence involved, to the techniques, and how to verify the claims people make. PUBLIC CONFIRMED Talk https://pretalx.com/bsides-cymru-2023-2022/talk/TXYBVN/ Track 2 - Foxhunter Rick Jennings PUBLISH QKGJMM@@pretalx.com -QKGJMM Extending the capabilities of Dependency Modelling for Risk Identification in an ICS environment en en 20230211T111500 20230211T112500 001000 Extending the capabilities of Dependency Modelling for Risk Identification in an ICS environment Dependency modelling (DM) is a standardised approach proposed by the Open standard Institute as a methodology to manage risk and build trust between inter-dependent enterprises . This approach aligns with the National Cyber Security Centre (NCSC)’s advocacy of system-driven risk analysis. measures risk as the degree of uncertainty - uncertainty that a system will be at a required (desired) state. DM is expressed as the probability of achieving the desired state of a goal and how it is impacted by things beyond the control, predictability or understanding of the system/process owner. These probabilities of events (nodes) change when the probabilities of some other events change. However, there exist limitations in the current expressions of DM that hinder its complete adaptation for risk identification in a complex environment such as ICS. This research investigates how the capability of DM could be extended to address the identified limitations and proposes additional variables to address phenomena that are unique to ICS environments. The proposed extension is built into a system-driven, ICS dependency modeller, and we present an illustrative example using a scenario of a generic ICS environment. We reflect that the proposed technique supports an improvement in the initial user data input in the identification of areas of risk at the enterprise, business process, and technology levels. PUBLIC CONFIRMED Pecha Kucha https://pretalx.com/bsides-cymru-2023-2022/talk/QKGJMM/ Track 2 - Foxhunter Ayo Rotibi PUBLISH GPH7YY@@pretalx.com -GPH7YY Developing cybersecurity curriculum for secondary school en en 20230211T113000 20230211T114000 001000 Developing cybersecurity curriculum for secondary school This study answers the following essential questions: (1) what the challenges of teaching cyber security between 12 to 15 are? (2) How is cyber security education addressed in secondary school curricula worldwide? (3) What are the issues with the existing cyber security curricula worldwide? PUBLIC CONFIRMED Pecha Kucha https://pretalx.com/bsides-cymru-2023-2022/talk/GPH7YY/ Track 2 - Foxhunter Maha Alotaibi1 PUBLISH RX87LC@@pretalx.com -RX87LC Trust & Blame in Self-Driving Cars Following a Cyber Attack en en 20230211T114500 20230211T115500 001000 Trust & Blame in Self-Driving Cars Following a Cyber Attack One increasingly pertinent concern related to self-driving car technology (and its connected infrastructure) is the potential for it to be cyber attacked. Should (or when) an adverse experience occurs, such an event is likely to erode human trust in the technology and potentially inhibit its uptake. It is therefore important to understand who is blamed for the attack and how/when trust is affected so that appropriate cyber security measures can be implemented (pre and post attack) to mitigate its impact on users and other stakeholders. PUBLIC CONFIRMED Pecha Kucha https://pretalx.com/bsides-cymru-2023-2022/talk/RX87LC/ Track 2 - Foxhunter Victoria Marcinkiewicz PUBLISH W9PAQ8@@pretalx.com -W9PAQ8 A Review of Intrusion Detection Systems in Large-scale IoT Systems: Challenges, Approaches, and Needs en en 20230211T120000 20230211T121000 001000 A Review of Intrusion Detection Systems in Large-scale IoT Systems: Challenges, Approaches, and Needs In this talk, I will present a comprehensive review of current intrusion detection systems for IoT systems to shed light on the challenges and associated solutions. PUBLIC CONFIRMED Pecha Kucha https://pretalx.com/bsides-cymru-2023-2022/talk/W9PAQ8/ Track 2 - Foxhunter Othmane Belarbi PUBLISH WCL8S7@@pretalx.com -WCL8S7 Why critical thinking is not the answer to misinformation en en 20230211T121500 20230211T122500 001000 Why critical thinking is not the answer to misinformation This presentation focuses on how the interaction of the digital environment and a user’s psychology may lead to incorrectly evaluating the trustworthiness of online information. The two studies aim to demonstrate how asking users to critically think when assessing digital information overlooks how the digital environment may increase psychological biases to distort our ability to successfully evaluate the trustworthiness of digital information. The first study reviews the current evidence for digital trust cues that increase a user’s perception of trustworthy information. The second study focuses on how trust cues are used to make judgements over the trustworthiness of information within open-source software libraries. PUBLIC CONFIRMED Pecha Kucha https://pretalx.com/bsides-cymru-2023-2022/talk/WCL8S7/ Track 2 - Foxhunter Rob Peace PUBLISH FHP3U9@@pretalx.com -FHP3U9 Vulnerability Management Sucks. en en 20230211T123000 20230211T124000 001000 Vulnerability Management Sucks. This talk aims to highlight some of the issues that seem to be a common headache. The task of combining the varying vulnerability management solutions you may have and presenting it back to relevant stakeholders in a neat package, all while trying to properly understand what data matters. Not forgetting the varying compliance and certification requirements that need meeting.... There is a larger focus on traditional infrastructure vulnerability management in this talk. PUBLIC CONFIRMED Pecha Kucha https://pretalx.com/bsides-cymru-2023-2022/talk/FHP3U9/ Track 2 - Foxhunter Luke Jones PUBLISH CK9QSG@@pretalx.com -CK9QSG Lunch - Click for Menu en en 20230211T124500 20230211T134500 010000 Lunch - Click for Menu Lunch will be a buffet and cater for a spectrum of dietary requirements: • Salad boxes including- • Green salads, • Coleslaw, • Mediterranean couscous • Tomato salad • With a choice of Caesar chicken, bbq chicken, teriyaki salmon, selection of cheese and then dietary appropriate options- these will be labelled for self-service and collection. • Rustic Bread roll selection • Assortment of sweet treats- carrot cakes, muffins, mini cakes, cookies • Packets of crisps- assorted flavours • Assortment of soft drinks Any special dietary requirements provided in advance will be labelled and accessible. PUBLIC CONFIRMED Talk - long https://pretalx.com/bsides-cymru-2023-2022/talk/CK9QSG/ Track 2 - Foxhunter Craig Jones, Clare Johnson + Stuart Criddle PUBLISH P8FVTA@@pretalx.com -P8FVTA IOC What You Mean en en 20230211T135000 20230211T142000 003000 IOC What You Mean The Pyramid of Pain made by David Bianco and popularised by MITRE et al. It is ultimately a conceptual model to increase the adversaries operational cost via the effective use of Cyber Threat Intelligence. Is the Pyramid of Pain too high to climb without very expensive vendor support? In this talk we'll slice up the pyramid of pain using analytical techniques, to reveal how you can prioritise and effectively reduce the permutations of each indicator type via the use of open-source tooling. This will result in tailored 'byte' sized high fidelity chunks for respective courses of action. PUBLIC CONFIRMED Talk https://pretalx.com/bsides-cymru-2023-2022/talk/P8FVTA/ Track 2 - Foxhunter Darren Kingsnorth PUBLISH E9HTYX@@pretalx.com -E9HTYX When diplomats send Beacon - A retrospective view of APT29 malicious phishing campaigns en en 20230211T143000 20230211T150000 003000 When diplomats send Beacon - A retrospective view of APT29 malicious phishing campaigns (happy to write a description if needed) PUBLIC CONFIRMED Talk https://pretalx.com/bsides-cymru-2023-2022/talk/E9HTYX/ Track 2 - Foxhunter Mathias Frank PUBLISH CBQJRN@@pretalx.com -CBQJRN Getting In: Initial Access in 2023 en en 20230211T151000 20230211T154000 003000 Getting In: Initial Access in 2023 The days of initial access being a case of sending a basic phishing email and get creds are long gone. With email filters so much more effective, end user training more frequent, corporate procedures enhanced, phishing is no longer trivial. We need to think differently, we need to be creative. That is what this talk is all about. Showing you the TTPs we ave developed over the years to evade or even bypass corporate controls and trick staff into giving us access. We will reveal less used TTPs that we have developed over time, showing how they can be leveraged. This is much more than phishing, this is full spectrum initial access, from OSINT led exploits, to in person SE, to creative remote social engineering, providing the many ways of getting in and gaining initial access in 2023. Are you a blue teamer? Don't worry we will show you all the ways you can stop our attacks, using your defensive onion to make the bad guys cry! PUBLIC CONFIRMED Talk https://pretalx.com/bsides-cymru-2023-2022/talk/CBQJRN/ Track 2 - Foxhunter Tony Gee PUBLISH NWWJHM@@pretalx.com -NWWJHM EVSE Ecosystems & Connected Vehicle Privacy en en 20230211T154500 20230211T163000 004500 EVSE Ecosystems & Connected Vehicle Privacy EVSE Ecosystems & Connected Vehicle Privacy PUBLIC CONFIRMED Talk - long https://pretalx.com/bsides-cymru-2023-2022/talk/NWWJHM/ Track 2 - Foxhunter PUBLISH SSNZU8@@pretalx.com -SSNZU8 Trans Tech Tent - (Talks begin at 10 am) Click for Schedule of talks en en 20230211T090000 20230211T170000 080000 Trans Tech Tent - (Talks begin at 10 am) Click for Schedule of talks The Trans Tech Tent is a Welsh organisation that started out as a community repairs group for queer people in the Cardiff area. Two years later, we hack everything, fix everything, and have a global support community. Come visit us for talks, chats, and workshops throughout the day on every topic we could reasonably fit into a security BSides event! See https://pretalx.c3voc.de/trans-tech-tent-2023/schedule/ for current schedule 10:00 AM 30min Risky Business - using risk-based analysis to detect bad things Jaime McCallion 10:35 AM 30min Giving you the ICK - Industrial Cyber Knowledge for n00bs Jamie Grant 11:10 AM 45min Biohacking in the 21st Century - A guide to transition Abby 1:00 PM 30min Reimplementing game servers for fun and giggles Eva Lauren Kelly (thejsa) 1:35 PM 30min Reversing UK mobile rail tickets eta 2:10 PM 30min Smart Watches are dumber than you think June Fleetwood 2:45 PM 30min Why Don't I Know Kung Fu Yet? Misha Whitney 3:20 PM 30min Wandering wombs - A History of Medical Misogyny Raven Gough 3:55 PM 30min it's borked - programming was a mistake Maya 5:00 PM 15min Closing Statement Abby PUBLIC CONFIRMED Village https://pretalx.com/bsides-cymru-2023-2022/talk/SSNZU8/ Track 3 (TTT) - St David's Suite a[gk]i|ab+y PUBLISH JMZHJM@@pretalx.com -JMZHJM Introduction to GEOINT en en 20230211T093000 20230211T130000 033000 Introduction to GEOINT A workshop describing the techniques to identify important parts of an image or video that could be used to locate it (and also when location may not be possible). It will descend into the geekery of sites that can identify various aspects of an image. It is designed to be fully interactive. It will demonstrate the art of locating through examples and practice. Common search engines and Internet resources will be used to aid in this. Attendees are encouraged to bring their own images with them so that they can be used in the workshop to practice their own skills. They are also encouraged to share databases or knowledge that other attendees may not know about. PUBLIC CONFIRMED Workshop https://pretalx.com/bsides-cymru-2023-2022/talk/JMZHJM/ Workshops - Glamorgan Suite David Lodge Tony Gee PUBLISH QEQ7G9@@pretalx.com -QEQ7G9 Mastering Android Application Reverse Engineering en en 20230211T130000 20230211T170000 040000 Mastering Android Application Reverse Engineering # Summary This workshop will be broken down into three sections,: an introduction and talk on the fundamentals, a guided challenge / exercise, followed by free-form challenges and activities. By the end of this workshop you'll be able to develop simple Android applications, reverse Android applications to both Java and SMALI, and apply other dynamic techniques to your reverse engineering efforts such as using Frida and Patching. # Prerequisites - A foundation knowledge of Linux CLI use - A laptop that can run a virtual machine (with VMWare Player or equivalent installed) - An Android Phone with ADB enabled or Android Studio installed with an emulator (please check the emulator works before hand). # About James James is a vulnerability researcher focusing on the Android system and applications. James has over five years experience in the industry and has worked in a variety of roles from startups to global organizations. PUBLIC CONFIRMED Workshop https://pretalx.com/bsides-cymru-2023-2022/talk/QEQ7G9/ Workshops - Glamorgan Suite James Stevenson PUBLISH XPKMPQ@@pretalx.com -XPKMPQ ICS Village (Opens at 9.45) en en 20230211T090000 20230211T170000 080000 ICS Village (Opens at 9.45) Industrial control systems, such as those controlling many aspects of critical infrastructure including energy, water and manufacturing, are increasingly the target of sophisticated cyber attacks. At the ICS village you can see practical attack demonstrations against real ICS devices, including demonstrations of attack scenarios which can cause physical processes to go wrong. Demonstrations include reconnaissance of ICS devices, the exploitation of programmable logic controllers and password cracking of human machine interfaces. PUBLIC CONFIRMED Village https://pretalx.com/bsides-cymru-2023-2022/talk/XPKMPQ/ Workshops - ClockTower Joe Gardiner PUBLISH CVFVFM@@pretalx.com -CVFVFM Battle Bots (Opens at 9.45) en en 20230211T090000 20230211T170000 080000 Battle Bots (Opens at 9.45) Mini Battle Bots! PUBLIC CONFIRMED Village https://pretalx.com/bsides-cymru-2023-2022/talk/CVFVFM/ Workshops Clocktower (more)