2.0 -//Pentabarf//Schedule//EN PUBLISH KCZJXM@@pretalx.com -KCZJXM "Goedkoop koop is duur koop" - the price of cheap thinking en en 20260725T093000 20260725T102000 005000

"Goedkoop koop is duur koop" - the price of cheap thinking

Cognition is expensive, so we buy cheaper substitutes, and someone else gets to set the price. PUBLIC CONFIRMED Keynote https://pretalx.com/bsides-joburg-2026/talk/KCZJXM/ Track 1 Roelof Temmingh PUBLISH MJG7ER@@pretalx.com -MJG7ER The Missing Drive: Proving a Hidden Linux HDD Through Windows Registry Forensics en en 20260725T102500 20260725T111000 004500

The Missing Drive: Proving a Hidden Linux HDD Through Windows Registry Forensics

In digital forensics, some of the most important evidence is not always the evidence that is immediately visible. Sometimes the real question is not what is present, but what is missing, why it is missing, and what traces it left behind. This talk presents a real-world forensic case study involving a suspect alleged to have conducted online financial fraud using a Linux-based system. The transactions had been traced back to the suspect through ISP records, and user agent string data suggested that the activity had originated from a Linux environment. However, when the suspect’s computer was examined, the police only considered the Windows hard drive that was present in the machine. They searched for familiar Windows artefacts, including LNK files and Shellbags, and found nothing that linked the fraud activity to that Windows installation. On that basis, they concluded that the computer could not have been used. That conclusion was wrong. The problem was not simply that the police had failed to find the right artefacts. The deeper problem was that they had asked the wrong forensic question. The allegation was not that the suspect had conducted the transactions from Windows. The allegation, supported by the user agent evidence, was that the activity had taken place from a Linux system. The relevant question was therefore not whether there were Windows user artefacts proving the transactions. The relevant question was whether the physical computer had also been configured to boot into, or otherwise use, a Linux system that was no longer present. Through a detailed forensic examination of the Windows registry hives and related system artefacts, it was possible to prove the prior existence of a second physical hard drive. Further analysis established evidence consistent with the computer having been configured as a dual-boot system, with Windows on one drive and Linux on another. The digital findings were then correlated with a physical examination of the computer itself, where tool marks and other physical indicators suggested that the second drive had been removed. This presentation will walk through the investigative reasoning and technical analysis used to move from an apparent absence of evidence to a defensible forensic conclusion. It will examine how Windows can retain traces of historical storage devices, how registry artefacts can assist in reconstructing prior system configurations, and how boot-related and storage-related evidence can be used to identify signs of a missing operating system drive. It will also consider how physical examination findings can support and corroborate digital forensic conclusions. The talk is not intended as a general overview of Windows artefacts. It is a practical, technical case study about forensic reconstruction in the face of deliberate concealment. It will show why forensic practitioners must be careful not to confuse the absence of expected artefacts with the absence of relevant evidence. It will also demonstrate the importance of hypothesis-led investigation, especially in cases where a suspect may have attempted to remove or conceal the most incriminating evidence. For the BSides Johannesburg theme of “Light the Way”, this case provides a very direct example of what digital forensics should do. It is about illuminating what was hidden, testing assumptions, challenging weak conclusions, and helping investigators and courts understand what really happened. In this case, the light did not come from a single artefact or a single tool. It came from methodical forensic reasoning, careful registry analysis, and the convergence of digital and physical evidence. Attendees will leave with a better understanding of how Windows registry artefacts can reveal the historical presence of missing storage devices, how dual-boot configurations may be reconstructed after a drive has been removed, and why forensic conclusions must be based on tested hypotheses rather than a narrow search for familiar artefacts. PUBLIC CONFIRMED Standard Talk https://pretalx.com/bsides-joburg-2026/talk/MJG7ER/ Track 1 Jason Jordaan PUBLISH GGUMFJ@@pretalx.com -GGUMFJ Rooting the Wink Hub 2 (finally) en en 20260725T111500 20260725T120000 004500

Rooting the Wink Hub 2 (finally)

The Wink Hub 2 is a 2016 multi-radio home automation hub, originally purchased by myself because of its appearance as a hardware hacking playground - multiple manufacturer radio reference implementations dotted around the board, each with their own programming interface brought out to headers. Due to how easily the prior generation Hub 1 was hacked, the company implemented Freescale/NXP High Assurance Boot v4 techniques to lock the Hub 2 down. These were effective for 10 years to the best of my knowledge - I have seen no reports of anyone else successfully executing their own code on the Hub 2. This talk will cover my efforts to break the security of the Wink Hub 2, and the lengths to which I went over a three year period to finally execute my own code on this device. PUBLIC CONFIRMED Standard Talk https://pretalx.com/bsides-joburg-2026/talk/GGUMFJ/ Track 1 Rogan Dawes PUBLISH VY8CVH@@pretalx.com -VY8CVH Stop Waiting for Unicorns: Bulding SA's Security Pipeline with 3,300 Interns en en 20260725T120500 20260725T125000 004500

Stop Waiting for Unicorns: Bulding SA's Security Pipeline with 3,300 Interns

## Talk Overview ### 1. The Gap Is Real (and Getting Louder) Framing the South African cybersecurity skills shortage with demand-side data and what it looks like from inside recruitment. Why the current model of "post a job and hope" isn't working. ### 2. Four Lenses on the Pipeline What MWR recruitment (600+ applicants), TryHackMe training data, university programmes (University of Pretoria, Wits), and the virtual internship each reveal about the talent funnel. Where candidates come from, where they stall, and what accelerates them. ### 3. 3,300 to 800: The Virtual Internship Experiment The design and structure of the programme, the three-strike attrition model, the dropout curve over 16 weeks, and what the data tells us about motivation versus readiness. Who stayed, who left, and what separated the two groups. ### 4. Where the Pipeline Breaks Why traditional recruitment signals (degrees, certifications, prior experience) miss good candidates. Why "job-ready" expectations are unrealistic when training structures don't exist. Why formal postgraduate programmes are arriving slowly and what that means for the next few years. ### 5. Where the Pipeline Is Stronger Than We Think The 800 who stayed and what they demonstrated. How self-learning platforms have changed the speed of skill acquisition. What effective junior development actually looks like when organisations invest in it. ### 6. The Call to Action Concrete, specific, low-barrier ways organisations and individuals can contribute: mentorship commitments, structured shadowing placements, open training content contributions, and hiring model adjustments that recognise non-traditional pathways. What MWR has learned about what works, and where we need the rest of the industry to step in. --- ## Key Takeaways 1. **The bottleneck isn't motivation, it's the gap between "interested" and "employable"**. 2. **Structured programmes surface committed candidates quickly**: Data from 3,300 virtual internship applicants shows that a deliberate attrition model identified 800 consistently engaged participants within five weeks. 3. **Traditional recruitment signals frequently fail**: Degrees, certifications, and prior experience don't reliably predict who will succeed when given structured support and practical training. 4. **Self-learning platforms have changed the game, but they're not enough**: Without industry investment in mentorship and practical pathways, the pipeline remains fragile and dependent on individual resilience. 5. **Small, concrete actions from the broader community can meaningfully widen the talent stream**: This isn't a problem that requires massive budgets, just willingness to meet emerging talent halfway. PUBLIC CONFIRMED Standard Talk https://pretalx.com/bsides-joburg-2026/talk/VY8CVH/ Track 1 Tinus Green Jonathon Everatt PUBLISH 3FQBRW@@pretalx.com -3FQBRW 1 LogSource to rule them all: What DNS Is Telling You(That You're Not Listening) en en 20260725T133000 20260725T141500 004500

1 LogSource to rule them all: What DNS Is Telling You(That You're Not Listening)

**Introduction — The Log Source You Already Have** Every organisation running a network has DNS. It is the first thing that fires when a device connects, the last thing that fires before data leaves, and the quiet witness to almost every stage of an attack. Yet in most African SOCs, DNS logs sit unqueried. This talk makes the case what defenders can do with less, they need to start listening to the one witness that never goes offline. The theme of this conference is "Light the Way." DNS is the flashlight that was always in your pocket. **Technical Deep Dive — Five Things DNS Sees That Your SIEM Misses** We walk through five concrete attacker behaviours that leave clear, detectable traces in DNS logs alone: C2 beaconing via regular query intervals to attacker-controlled domains; DNS tunneling for covert data exfiltration encoded in subdomains; domain generation algorithms (DGAs) used by malware to find live C2 infrastructure; newly registered domain (NRD) abuse for phishing and initial access; and lateral movement fingerprinted through internal DNS resolution patterns. For each, we show the exact query patterns, the ES|QL detection rule that catches it, and what a clean alert looks like versus noise. **Real-World Relevance — What African Attackers Are Actually Doing** Drawing on publicly documented attack patterns from recent African incidents, including telecom breaches and ransomware campaigns active in the region in 2025, we map the DNS artifacts those attackers left behind. Ransomware groups like Qilin, Akira, and DragonForce, all confirmed active in Africa as of early 2026, rely heavily on DNS for C2 and staging. Their tradecraft is well-documented. Their DNS fingerprints are detectable. **Key Takeaways — Getting the Most Out of What You Already Have** DNS logs are basic. What you do with them is not. Attendees will leave knowing how to enrich raw DNS telemetry, adding context like domain lengths, TXT payload size, DNS history, threat intel enrichment, domain age, and reputation scoring to transform a plain query log into a high-signal detection source. We cover the specific attack behaviours that DNS exposes at each stage of the kill chain, the signatures that distinguish malicious DNS patterns from legitimate traffic (query length anomalies, entropy scoring for DGA detection, beaconing intervals, TXT record abuse), and the detection rules that operationalise those signatures immediately. PUBLIC CONFIRMED Standard Talk https://pretalx.com/bsides-joburg-2026/talk/3FQBRW/ Track 1 Mohammed Anas PUBLISH WAKEAZ@@pretalx.com -WAKEAZ The Black Box Problem: Detection Engineering in the Age of AI Agents en en 20260725T142000 20260725T144000 002000

The Black Box Problem: Detection Engineering in the Age of AI Agents

Many organisations invest heavily in SIEM platforms and security tooling, yet struggle to answer a simple question: what attacks can we actually detect? Detection engineering seeks to bridge that gap by focusing on visibility, telemetry, attacker behaviour, and continuous improvement rather than simply collecting logs and generating alerts. At the same time, organisations are rapidly embedding AI into everyday business operations. AI assistants, autonomous agents, MCP servers, and AI-powered workflows are becoming trusted participants in enterprise environments. These systems are creating entirely new security challenges. AI agents increasingly operate with delegated permissions, access sensitive corporate data, and interact with critical business systems, introducing new identity risks that traditional security models were never designed to handle. The growing ecosystem of models, plugins, connectors, MCP servers, and open-source components also introduces significant supply chain risk, often with limited visibility into how these systems operate or what dependencies they rely upon. As adoption accelerates, these challenges will inevitably contribute to new classes of security incidents, compromises, and failures. Yet cybersecurity has a problem of its own. Unlike industries such as aviation, which have mature processes for investigating accidents and sharing lessons learned, cybersecurity lacks an effective mechanism for collective learning. Breaches are often hidden behind legal agreements, reputational concerns, or private incident reports, leaving the broader community unable to benefit from the lessons they contain. This talk explores what detection engineering is, how it extends beyond traditional SIEM deployments, and why it is becoming increasingly important as AI reshapes enterprise environments. It also examines the growing AI attack surface, the identity and supply chain risks that accompany it, and why the industry may need its own equivalent of an aviation accident investigation board if we want to stop repeating the same mistakes and start learning from each other's failures. PUBLIC CONFIRMED Lightning Talk https://pretalx.com/bsides-joburg-2026/talk/WAKEAZ/ Track 1 Jared Naude PUBLISH SCMAG7@@pretalx.com -SCMAG7 Cells and Claws: A Mental Model for Autonomous AI Agents en en 20260725T144000 20260725T145500 001500

Cells and Claws: A Mental Model for Autonomous AI Agents

Introduction Ask ten security professionals what an "AI agent" is and you will get ten different answers, most of them gesturing at something between an over-eager intern, a souped-up search engine, and an embryonic AGI. None of those models are wrong, but none of them are useful when you have to decide what to sandbox, what to log, or what to kill. As Claws, autonomous, tool-using, goal-pursuing systems with persistent identity move from labs into production, the cost of operating without a working mental model is measured in incidents. This talk is about lighting that path: building a model that is technically incomplete (all models are) but sharp enough to reason with. Technical Deep Dive We start at Generation 0: the base LLM as a probability distribution over tokens, demonstrated with a Galton board and grounded in a simplistic example of Karpathy's "200 lines of Python" microGPT. From there we climb seven generations Chat, Tool-Using, Workspace, Coding, Autonomous, Multi-Agent, and finally the Claw: a digital agent with persistent identity, file access, code execution, long-running tasks, and the ability to delegate. Along the way we look at what the industry currently uses to control these systems: sandboxing, prompt-injection guards, code / data separation attempts, and where each control breaks down at Claw scale. Real-World Relevance Cells are autonomous, tool-using, self-replicating agents, and they are the best-studied agents we have. They solve the same problems Claws do, code / data confusion, identity, surveillance, shutdown — and we can take some lessons from their solutions. We build a parallel mental model of the cell, DNA as code-and-data, mRNA as instruction stream, MHC (Major Histocompatibility Complex) presentation as mandatory observability, apoptosis as self-attested shutdown, and then introduce the adenovirus as a textbook hijack: code-flow takeover by injecting foreign DNA into a system that cannot distinguish self from non-self at the molecular level. The talk will discuss comparisons of Cell vs. Claw across code / data confusion, hijack vector, surveillance, shutdown, and identity. The findings are uncomfortable: the Claw shares most of the cell's failure modes, and has none of the cell's defenses. Key Takeaways The headline takeaway is the model itself. A useful mental model is not a list of answers, it is a reasoning tool. Once you have one for AI agents as a class, anchored by the seven-generation ladder and the cell mirror, you can think more clearly and make better decisions. PUBLIC CONFIRMED Lightning Talk https://pretalx.com/bsides-joburg-2026/talk/SCMAG7/ Track 1 Marinus van Aswegen PUBLISH YHKD9B@@pretalx.com -YHKD9B Pipe Dreams: Escalating to SYSTEM via Cooler Master MasterPlus en en 20260725T150500 20260725T155000 004500

Pipe Dreams: Escalating to SYSTEM via Cooler Master MasterPlus

OEM peripheral software ships trusted on millions of Windows machines, runs as SYSTEM, and almost never receives a security review. Inspired by Leon Jacobs' DEF CON 33 research, this talk applies the same methodology to a major peripheral manufacturer's management suite. Methodology: Systematic enumeration of SYSTEM services, IPC surface discovery, access control analysis, and binary reverse engineering. I'll cover the tooling and decision points that led from initial enumeration to a confirmed vulnerability. Root Cause Analysis: Static analysis identifies a privileged IPC handler that accepts unauthenticated connections from any local user and processes attacker-controlled input without validation. I'll walk through the decompiled code showing exactly where the trust boundary fails and why the impact is full SYSTEM code execution. Demo: Proof-of-concept demonstrated live: standard user to NT AUTHORITY\SYSTEM in a single step. No admin rights, no user interaction, no race condition. Remediation & Disclosure: Vendor disclosure process including what to expect when a vendor has no dedicated PSIRT. Takeaways & Q&A: Key Takeaways 1. A replicable methodology for auditing OEM/bloatware SYSTEM services 2. How Windows IPC access controls are commonly misconfigured 3. Navigating coordinated disclosure with vendors that lack a PSIRT PUBLIC CONFIRMED Standard Talk https://pretalx.com/bsides-joburg-2026/talk/YHKD9B/ Track 1 Tyron Kemp PUBLISH EQCAL7@@pretalx.com -EQCAL7 Shedding Light on Mobile Trust: Rethinking SSL Pinning en en 20260725T155500 20260725T161000 001500

Shedding Light on Mobile Trust: Rethinking SSL Pinning

**Bootstrapping Trust: Secure Distribution of SSL Pins in Mobile Applications** SSL pinning has long been considered a cornerstone of mobile application security. Yet most implementations still rely on hardcoded pins embedded within applications, creating an uncomfortable trade-off between security and operational agility. Certificate rotations, emergency key replacements, backend migrations, and application release cycles often turn a security control into an operational burden. This talk explores a different approach to establishing trust between mobile applications and backend services. Instead of shipping static trust anchors inside the application, we examine a protocol that securely bootstraps trust and dynamically distributes SSL pinning configuration to mobile clients. The architecture leverages modern cryptographic primitives, including Ed25519 for digital signatures, asymmetric key exchange for trust establishment, and AES encryption for secure transport of sensitive configuration data. During an initial registration phase, the mobile application generates a unique device trust identity and establishes a secure cryptographic relationship with the server. Once trust has been established, the server can securely distribute and rotate SSL pinning information without requiring application updates or exposing trust material to interception. The session walks through the protocol design, trust establishment process, cryptographic decision-making, and implementation challenges encountered while building the solution. We will discuss key rotation strategies, secure storage considerations, and how the design resists common attacks such as man-in-the-middle interception, and other pin distribution strategies. Attendees will gain practical insights into the future of mobile trust models, understand the limitations of traditional SSL pinning approaches, and leave with architectural patterns to build more resilient mobile security controls in environments where change is constant and trust cannot be hardcoded forever. PUBLIC CONFIRMED Lightning Talk https://pretalx.com/bsides-joburg-2026/talk/EQCAL7/ Track 1 Christoff Jacobs PUBLISH WKRNMH@@pretalx.com -WKRNMH From Unknown to Understood: Malware Triage in Minutes en en 20260725T161000 20260725T162500 001500

From Unknown to Understood: Malware Triage in Minutes

This session is aimed at analysts who want a practical starting point for malware analysis without immediately diving into reverse engineering. Using a lightweight workflow, I will show how simple triage steps can quickly uncover useful context, suspicious behaviour, infrastructure, and attacker intent. Static and dynamic analysis techniques are combined to show how hashes, strings, reputation data, and sandbox observations can be used together to build a clearer understanding of a sample. Along the way, we discuss the importance of treating indicators as clues rather than conclusions, and how defenders can turn scattered observations into practical, actionable insight. Rather than focusing on advanced reverse engineering, this session demonstrates that meaningful analysis begins much earlier, and that newer analysts can contribute valuable findings with the right approach. Key Takeaways: - A simple malware triage workflow for the first 10 minutes - How to combine simple static and dynamic analysis effectively - Ways to identify useful indicators and suspicious behaviour quickly - How to turn technical findings into a coherent analysis story PUBLIC CONFIRMED Lightning Talk https://pretalx.com/bsides-joburg-2026/talk/WKRNMH/ Track 1 Latasha Friend PUBLISH AXTUMN@@pretalx.com -AXTUMN Using CSC to build future cyber workforce en en 20260725T162500 20260725T164000 001500

Using CSC to build future cyber workforce

Most cyber security training is expensive, foreign, or assumes a level of access that many South African students and practitioners simply do not have. Many South African tertiary institutions do not even offer cyber security at undergrad level, only at Honours or Masters level. Yet many of these students have immense talent. It just needs _a guiding light_. This talk will cover the story behind building CTF challenges for the SANREN CSC, what worked, what did not, and what any motivated person or group can replicate without a large budget. Previously a similar talk was presented at BSides Cape Town 2025, this talk has been updated and expanded for BSides Joburg with new lessons learned and a broader focus on community building beyond the CTF context. PUBLIC CONFIRMED Lightning Talk https://pretalx.com/bsides-joburg-2026/talk/AXTUMN/ Track 1 Ivan Burke PUBLISH 3QBKMN@@pretalx.com -3QBKMN SocVel Live : The CISO's Gambit en en 20260725T164500 20260725T173000 004500

SocVel Live : The CISO's Gambit

This isn't a talk about security leadership. But a look at how those decisions are made collectively. Decisions that need to get taken because someone, probably someone in this room, found something. Flagged something. Wrote the email that landed in the wrong inbox at the wrong time and suddenly it's everyone's problem. The CISO's Gambit is the next evolution of SocVel Live, the interactive tabletop format that took home Best Speaker at BSides JHB 2025. This time, we're not hunting the threat. We're managing what comes after. Working through scenarios grounded in real threat intelligence from the past year: each one a moment where a technical finding collides with a business reality — and someone has to make a call with incomplete information, an impatient board, and a vendor on hold. Sound familiar? The scenarios cover the kind of things that have been quietly ruining people's Fridays since 2025. ClickFix campaigns, the AI apocalypse, geopolitical shenanigans, supply chain compromises and malicious dev tooling that handed your build pipeline over to someone called Vlad. The audience votes on what to do at each decision point. Consequences unfold in real time. And we track the impact across three metrics: Board Confidence, Reputation, and Threat Exposure. This session is built for techies. Because the best leadership decisions in security are only as good as the technical insight behind them. The techies are the ones who assess the new tool that is supposed to be the silver bullet, give feedback on what the blast radius of a change will be, or flag the dodgy process the entire business is running on. This simulation puts that work in context — and shows what happens when it hits the decision layer. No single right answer. No fixed path. Just trade-offs, pressure, and the collective weight of a room that knows exactly what's at stake. Hope you like awkward board meetings. PUBLIC CONFIRMED Standard Talk https://pretalx.com/bsides-joburg-2026/talk/3QBKMN/ Track 1 Jaco Swanepoel PUBLISH EFWTWY@@pretalx.com -EFWTWY Gimme! Gimme! Your Creds After Midnight: Weaponising Veeam Credential Extraction en en 20260725T102500 20260725T111000 004500

Gimme! Gimme! Your Creds After Midnight: Weaponising Veeam Credential Extraction

## Talk Overview ### 1. Why Attackers Love Your Backups The role of backup infrastructure in targeted attacks and ransomware operations. Why Veeam servers are high-value targets and what we keep finding during real-world engagements: domain-joined backup servers, over-privileged service accounts, and credentials that unlock far more than just backup jobs. ### 2. How Veeam Stores Credentials (And How We Extract Them) The technical internals: how VBR and Veeam ONE store credentials in MSSQL and PostgreSQL databases, how DPAPI encryption is applied differently between the two products, and the undocumented Veeam ONE entropy value that isn't covered in Veeam's own KB articles. We'll walk through the decryption chain step by step, from encrypted database blob to cleartext password. ### 3. Building VeeamDumper: From Manual Process to Automated Tooling How repeated encounters with Veeam during engagements drove us to automate the extraction process. The design of VeeamDumper's modules (ENUM, AUTO, MSSQL/PSQL, MAP), why we built it as a .NET assembly for execute-assembly compatibility, and how the MAP module connects extracted credentials to specific infrastructure targets. ### 4. From .NET to BOF: Porting Post-Exploitation Tooling to C The process of taking a working .NET tool and porting it into a Beacon Object File. Why BOFs exist, what changes when you move from managed .NET to raw C and practical lessons for anyone building red team tooling ### 5. Live Demo: VeeamDumper in Action Live demonstration of VeeamDumper against a lab environment: enumeration, automatic credential extraction, DPAPI decryption, and credential-to-target mapping. We'll show both the .NET execute-assembly path and the BOF execution. ### 6. Securing Your Backup Infrastructure Practical hardening guidance: why backup servers should not be domain-joined to your primary AD domain, how to restrict access to credential stores, detection opportunities for credential extraction activity, and the questions every organisation should be asking about their backup security posture. ## Key Takeaways 1. **Veeam backup servers frequently store Domain Admin-level credentials** in a reversible format and once an attacker has local admin on the server, extracting them is straightforward. 2. **Veeam ONE handles credential encryption differently to VBR** using an undocumented entropy value, a detail not covered in Veeam's public documentation that we had to reverse ourselves. 3. **VeeamDumper automates the full extraction chain** enumeration, database identification, DPAPI decryption, and credential-to-target mapping as both a .NET assembly and a BOF, released as an open-source tool on MWR's GitHub. 4. **Porting .NET post-exploitation tooling to a BOF** involves meaningful design tradeoffs of which we'll share the practical lessons for anyone building red team tools that need to operate across C2 frameworks. 5. **Domain-joining backup servers to your primary AD domain** creates a compounding risk that turns a single compromise into full infrastructure takeover, including the destruction of your recovery capability. PUBLIC CONFIRMED Standard Talk https://pretalx.com/bsides-joburg-2026/talk/EFWTWY/ Track 2 Stephen Logan Kroeger PUBLISH FJCUKR@@pretalx.com -FJCUKR The Device Doesn't Take No for an Answer en en 20260725T111500 20260725T120000 004500

The Device Doesn't Take No for an Answer

We tell each other to "segment the IoT device." Then we put it on a separate VLAN, the device gets quiet for ninety seconds, and goes back to phoning home from an IP that no DNS record ever pointed at. While the vendor app cheerfully reports "online." That gap, between what the device tells the user and what it's actually doing, is what this talk measures. This isn't a talk about zero-days. It's about the other dodgy things these devices do on the networks they sit on: talking to hosts they shouldn't, ignoring the policy you set, lying about their own state when you ask. Still a security problem. Still mostly invisible from where most owners and network admins are standing. I built a small enforcement lab around an open-source firewall and a Pi access point, and put six embedded devices through the same nine-phase routine: an IP camera, an attendance terminal, a SOHO router, a smart plug, a video doorbell, and a Zigbee smart-home hub. The sample mixes bottom-of-market kit with units from more recognisable vendors. Part of the point is that what the scorecard catches doesn't have much to do with what you paid. Cold boot. Idle baseline. Then a sequence of restrictions: full outbound block, vendor-domain sinkhole, wildcard DNS blackhole on the vendor zone, half a second of injected latency, two seconds of latency, a UDP block. At every step I pull the packet capture, the firewall counters, and the live filter log, and score the device against a four-axis scorecard: can you segment it, does it tell you the truth when you do, who does it actually trust, and how does it fail when something breaks? The findings are the kind of thing a typical owner can't see from the vendor app: - Devices that ignore the network's DHCP-assigned resolver and do their own DNS to a public address. Any DNS policy not fronted by a redirect rule does nothing in that case. - Devices that reach a long list of hardcoded public IPs that no DNS query ever resolved, across multiple cloud providers and continents, well before any user interaction. - Devices that ship credentials in cleartext alongside user-generated content over HTTP/80, in 2026. - Devices that enter sticky failure modes on a few seconds of injected latency. Only a hard power cycle gets them back. - Devices that announce a network failure to the user, then keep uploading at a steady rate to a hardcoded fallback for the next twenty minutes. The vendor app cheerfully reports "online" for minutes after the network has actually been cut. Pushing a device a little past its design envelope is itself a way to surface weaknesses you wouldn't see at rest. The wedged state machines above are the clearest example. The device was never built to handle the network it found itself on, and what was meant to be measurement turned into something that looks a lot like a bug report. The point isn't that any one of these devices is uniquely bad. The point is that for a real slice of the embedded device market, "secure deployment" stops being a configuration choice and becomes an architectural fact about what you bought. That conversation needs better ammunition than a feeling. This talk is an attempt to give it some. What you'll leave with: - A repeatable nine-phase test you can run on a device sitting on your desk, with open-source firewall and packet-analysis tools you probably already have. - A four-axis scorecard (segmentation viability, transparency, trust hygiene, fail posture) with worked examples you can defend with a line of packet capture per score. - The procurement questions that surface a hardcoded dependency on the spec sheet, not after install. - A concrete way to tell the difference between a device that fails safely under enforcement and a device that fails by lying to you. What you won't get: zero days, exploit chains, or vendor names on the slides. The talk is written for defenders and procurement people, not red teamers, though the failure modes will look familiar to both. PUBLIC CONFIRMED Standard Talk https://pretalx.com/bsides-joburg-2026/talk/FJCUKR/ Track 2 Travis More PUBLISH 3JE8KJ@@pretalx.com -3JE8KJ Lighting the Way in the Dark: Binary-Only Race Detection in Go with Zorya-Volos en en 20260725T120500 20260725T125000 004500

Lighting the Way in the Dark: Binary-Only Race Detection in Go with Zorya-Volos

Go’s concurrency model—built on the pillars of Goroutines and a sophisticated M:N scheduler—offers powerful performance but introduces complex, often non-deterministic, vulnerability surfaces. Because Go is the language of the cloud, powering critical infrastructure like Kubernetes and Docker, as well as high-stakes distributed systems and cryptocurrency utilities, these vulnerabilities are widespread. When source code is unavailable, identifying race conditions in Go binaries becomes a daunting challenge for security researchers navigating in the dark. This talk introduces Zorya-Volos, a concolic execution framework built on Rust and Ghidra’s P-Code IR, designed specifically to tackle the challenges of binary-only analysis of concurrent Go programs. We will light the way into the black box of the Go runtime, examining how the scheduler orchestrates Goroutine execution and manages thread mapping under the hood. Attendees will learn how Volos leverages advanced concolic execution to lift Go binaries, track execution paths without source code, and identify race conditions by modeling memory access patterns and lock states across threads. We will conclude with a comparative look at the current tooling landscape and demonstrate why our approach to in-depth manual vulnerability assessment remains essential for uncovering the race conditions that traditional scanners miss. What attendees will learn: - Go Runtime Internals: A deep dive into how Go binaries launch, how the scheduler distributes tasks across P, M, and G (Processor, Machine, and Goroutine) structures, and how to track the execution state of specific Goroutines. - Source-less Analysis: How Zorya-Volos disassembles and lifts binary code to track execution paths and identify concurrency-impacting operations without needing access to the original Go source. - Race Condition Detection: A technical breakdown of the Volos engine’s unique ability to correlate memory read/write operations with concurrency primitives to detect race conditions in compiled Go. - Tooling Landscape: A comparison of current binary analysis tools for Go, highlighting the limitations of current solutions and the unique advantages of the Zorya-Volos methodology in securing production-grade cloud and crypto infrastructure. PUBLIC CONFIRMED Standard Talk https://pretalx.com/bsides-joburg-2026/talk/3JE8KJ/ Track 2 Keith Makan PUBLISH BRXAF8@@pretalx.com -BRXAF8 Should've, Could've, Would've: How Organisations Drift Into Breach en en 20260725T133000 20260725T141500 004500

Should've, Could've, Would've: How Organisations Drift Into Breach

Most cyber breaches are framed as sophisticated technical attacks carried out by highly skilled threat actors. Although this might hold for certain situations, many breaches are ultimately enabled by decisions, trade-offs, and accepted risks that existed long before an attacker ever gained access. A delayed patch. A temporary exception. An ignored audit finding. A burned-out SOC team. A business decision to “accept the risk.” This talk examines the organisational behaviours, decisions, and trade-offs that quietly create ideal conditions for attackers. Drawing on publicly documented breach case studies across multiple industries, it explores how risk normalisation, recurring exceptions, technical debt, security fatigue, and competing business priorities can gradually increase an organisation's exposure to cyber threats. This discussion focuses on the often-overlooked pre-breach phase: the warning signs, decisions, and cultural patterns that frequently precede compromise. By understanding these signals, security professionals can better identify environments where cyber risk is accumulating before it manifests as a major incident. Organisations rarely approve breaches outright, but by normalising risky conditions they unintentionally pave the way for them. Takeaways from this talk will include: 1. Recognising organisational drift. 2. Spotting cultural warning signs and patterns that signal rising exposure. 3. Examining publicly documented case studies to see how organisational behaviours, not just attacker sophistication, paved the way for incidents. 4. Gaining practical methods to detect and counteract organisational drift. PUBLIC CONFIRMED Standard Talk https://pretalx.com/bsides-joburg-2026/talk/BRXAF8/ Track 2 Kitso Moema PUBLISH KVU7J3@@pretalx.com -KVU7J3 A journey through Cybersecurity Regulation in practice en en 20260725T142000 20260725T145500 003500

A journey through Cybersecurity Regulation in practice

**Introduction to the topic** South Africa’s cybersecurity landscape largely relies on best-effort security practices, often without strong regulatory enforcement to drive consistency and accountability. While this approach allows flexibility, it can make it difficult to achieve baseline security maturity across industries. In contrast, many international environments operate under detailed, enforceable cybersecurity regulations that actively shape how organisations build, operate, and maintain their security programs. Understanding how these regulations work in practice is key to evaluating how similar approaches could strengthen local cybersecurity outcomes. **Technical Deep Dive** This talk will explore a selection of modern cybersecurity regulations, including the Cyber Resilience Act (CRA), Germany’s KAS-51 and TRBS 1115-1. For each, we will examine: - Who is in scope and why - How the regulation is structured and applied - The role of regulators and oversight bodies - What organisations are concretely required to implement The focus will not be on legal text, but on translating regulatory requirements into actionable security practices - covering areas such as risk management, incident reporting, security controls, and audit readiness. **Real-World Relevance** To ground the discussion, the talk will include practical case studies drawn from implementing the CRA, KAS-51, and TRBS 1115-1 in real environments. These will cover: - How requirements were interpreted and operationalised - How audits and assessments were conducted in practice - Where the regulations drove meaningful improvements in security posture - Where challenges emerged, particularly around administrative burden and compliance-driven approaches These examples will provide a realistic view of both the strengths and limitations of regulatory-driven security. **Key Takeaways** Attendees will leave with: - A clear understanding of how modern cybersecurity regulations function in practice - Insight into the implementation realities behind major frameworks like the CRA - An appreciation of both the benefits and pitfalls of regulatory-driven security - Practical ideas for how similar approaches could be adapted to the South African context to support stronger, more effective cybersecurity outcomes PUBLIC CONFIRMED Short Talk https://pretalx.com/bsides-joburg-2026/talk/KVU7J3/ Track 2 Dietmar Marggraff PUBLISH HWSVHB@@pretalx.com -HWSVHB Turning Roadkill into braAI-VibeSDLC en en 20260725T150500 20260725T155000 004500

Turning Roadkill into braAI-VibeSDLC

Remember that scene where Grommit lays out the track while the train is going down an unbuilt section in Wallace & Grommit. Well thats what enterprise, AI coding agents and AI productivity tools rollouts are like in 2026. CTO says we need AI agents yesterday, MDM reports everyone has had it for a year anyway and your CISO says what are our controls. This is the war stories of a SOC and DevSecOps team rolling out agentic controls as we figure things out. This is a pro-active vs reactive story of all the disucssions, policy work, controls and incident response over the period. The talk will cover the following topics: - Rolling out claude code enterprise - AI agent controls - Sandboxing - MDM and EDR - OTEL for Agents - Costs: economic, incident, cognitive load - SDLC in the agentic era. - When automation goes wrong. - Security team leading the way with the torch of controls, education and setting the standard. - Opportunities for security team to use the tools for creating tools, vuln discovery. - Security validation testing on these controls Takeaways: - Agents, LLMs, etc pros and cons. - Infosec, Dev, Devops, Infra, etc have always been early adopters. Better they debug tech than the general public debugs medical answers. - SDLC is still relevant, might need tweaks - Ownership is key, claude doesn’t own your code, your responsibility remains - Trust but verify - Sandboxing is back - Enterprise is king ($$$$) - Manage risk, enable efficiency - Lead by example, get devs interested and involved. PUBLIC CONFIRMED Standard Talk https://pretalx.com/bsides-joburg-2026/talk/HWSVHB/ Track 2 Christo Goosen PUBLISH QV988R@@pretalx.com -QV988R Illuminating the Underground : How Infostealers are Bypassing MFA en en 20260725T155500 20260725T161000 001500

Illuminating the Underground : How Infostealers are Bypassing MFA

This talk perfectly embodies the "Light The Way" theme by shining a spotlight on the hidden risks and emerging threats lurking in the darkest corners of the internet, specifically, dark web markets and the tens of thousands of illicit Telegram channels where cybercrime thrives By exposing the mechanics of how attackers monetize infostealer infections to bypass modern defenses like MFA, this session shares critical knowledge that empowers the community. It guides defenders out of the dark, equipping them with the insights needed to illuminate their external attack surface and proactively protect their organizations against the unseen dangers of identity compromise. **Topic Outline:** - The Shift in the Threat Landscape: A data-driven look at how the barrier to entry for cybercrime has plummeted. We will review how malware-as-a-service operations distribute tools for as little as $200/month (R3500/Month), resulting in over 50 million breached identities traded weekly - Anatomy of a Stealer Log: Illuminating what attackers actually see when a device is infected. We'll break down the contents of a stealer log, which includes saved passwords, browser autofill data, system fingerprints, and most critically, active session cookies - The Death of Traditional MFA: A technical walkthrough of how active session cookies allow attackers to hijack authenticated sessions without needing a password or triggering an MFA prompt - The Enterprise Impact: Analysis of recent 2025/2026 data revealing that over 1 in 10 infostealer infections now contain enterprise Single Sign-On (SSO) or Identity Provider (IdP) credentials, with Microsoft Entra ID appearing in 79% of enterprise identity logs - We will discuss the trajectory that suggests 1 in 5 infections could yield enterprise credentials by Q3 2026 - Proactive Defense and Remediation: How to transition from reactive alert fatigue to proactive defense. We will discuss the principles of Identity Exposure Management (IEM), focusing on how to rapidly ingest intelligence, map the "blast radius" of an exposed user, and close the loop through automated validation and instant session revocation (Short 5 Min Max on how Flare Fits into this) **Key Takeaways (What Attendees Will Learn):** - The Cybercrime Supply Chain: How initial access brokers and automated Telegram bots distribute stolen credentials and stealer logs within hours of an infection - The Mechanics of Session Hijacking: Why traditional perimeter defenses and MFA are insufficient against session cookie theft, and how attackers leverage this data for rapid account takeover - Threat Forecasting: Real-world insights and statistical trends showing the rapid acceleration of enterprise identity compromise and the increasing targeting of centralized IdPs - Practical Defense Strategies: Actionable frameworks for implementing continuous monitoring and automated remediation (such as forcing password resets or terminating active sessions) to shrink an attacker's window of opportunity from days to seconds PUBLIC CONFIRMED Lightning Talk https://pretalx.com/bsides-joburg-2026/talk/QV988R/ Track 2 Drystan Govender PUBLISH VJYQQB@@pretalx.com -VJYQQB Lighting the Way to the Server Room en en 20260725T161000 20260725T164000 003000

Lighting the Way to the Server Room

Physical penetration testing is often portrayed as lockpicks, badge cloning, and dramatic break-ins. In reality, those activities represent only a small part of a successful engagement. The true challenge lies in understanding how physical security, human behaviour, operational processes, and technical controls intersect to either stop or enable an attacker. This talk provides a practical walkthrough of a real-world physical penetration test from start to finish. Attendees will follow the complete engagement lifecycle: defining scope and legal boundaries, conducting reconnaissance, developing social engineering pretexts, gaining access to facilities, operating within a target environment, and ultimately reporting findings back to the client. Drawing from real assessments and industry experience, the session focuses on the decision-making process behind physical testing rather than sensationalized lockpicking demonstrations. We will explore how attackers identify opportunities through open-source intelligence, exploit predictable human behaviours, leverage environmental weaknesses, and navigate physical spaces while balancing operational risk. **Presentation Outline**: **Introduction** * What physical penetration testing actually is and why it remains one of the most effective methods of assessing organisational security. * Common misconceptions surrounding physical security assessments. * Understanding how physical, human, and digital security controls overlap. **Scoping and Legalities** * Defining rules of engagement, success criteria, and operational constraints. * Authorisation requirements, legal considerations, and jurisdiction-specific concerns. * Planning for contingencies, escalation paths, and engagement safety. **Reconnaissance** * How attackers and physical testers build target intelligence before arriving on site. * Using publicly available information to identify entrances, staff routines, security technologies, and potential attack paths. * Translating reconnaissance findings into actionable engagement plans. **Breaching the Boundary** * Common access vectors including tailgating, piggybacking, pretexting, and badge-related weaknesses. * Understanding why social engineering remains one of the most effective physical attack techniques. * How human psychology influences security outcomes. * Building your own toolkit, (custom WIFI Pineapple, custom badge cloner, cheap gadgets to build a bigger toolkit) **Operating Once Inside** * Prioritising objectives after gaining access. * Identifying high-value targets such as boardrooms, network infrastructure, server rooms, and unattended workstations. * Leveraging C2 frameworks and Internal Attacks (MITM, ADCS, LLMNR, PTK) * Understanding the relationship between physical access and broader cyber compromise opportunities. **Contingency and “What If You're Caught?”** * Managing encounters with security personnel, facilities staff, or law enforcement. * Documentation, communication procedures, and safe disengagement strategies. * Lessons learned from real-world physical testing incidents. **Reporting and Debrief** * Converting observations into meaningful security findings. * Demonstrating impact without creating unnecessary risk. * Delivering remediation guidance that improves both physical and organisational security. This talk combines practical field experience, social engineering concepts, and physical security assessment methodologies to provide attendees with a realistic understanding of how physical penetration tests are planned, executed, and reported. **Key Takeaways**: **Understanding Physical Attack Methodology** Attendees will gain a clear understanding of how professional physical penetration tests are conducted from initial planning through final reporting. **Recognising Security Weaknesses Beyond Technology** The session demonstrates how human behaviour, organisational processes, and environmental design often create opportunities that technical controls alone cannot prevent. **Improving Defensive Readiness** Security practitioners, facilities teams, and business leaders will learn practical ways to identify and address weaknesses before they are discovered by real adversaries. PUBLIC CONFIRMED Short Talk https://pretalx.com/bsides-joburg-2026/talk/VJYQQB/ Track 2 Aaron Van Den Berg