Najam Ul Saqib
With five years of experience in application and cloud security, I have honed my expertise at industry leaders like Systems Ltd, Tkxel, and Constellation Software. My professional journey is rooted in a deep technical understanding of securing complex ecosystems, further sharpened by a successful track record in independent bug bounty programs.
Currently, I am the founder of Exfiltra, a specialized consultancy firm dedicated to delivering high-quality application and cloud security services. While I provide comprehensive security solutions, my primary cloud focus is Azure, helping organizations navigate and fortify their Microsoft cloud environments.
Driven by a passion for the security community, I am a dedicated advocate for open-source intelligence and education. I actively contribute back by developing FOSS tools, authoring insightful blog posts, and producing educational videos. My mission is to bridge the gap between sophisticated threats and robust defense through both professional consultancy and community-driven knowledge sharing.
Session
Electron has evolved significantly over the years, adopting safer defaults and introducing security mechanisms aimed at reducing the risk of application compromise. While many of the well-known "secure by default" issues have been addressed, modern Electron applications remain vulnerable due to insecure implementation patterns, unsafe IPC designs, dangerous preload exposure, protocol handler abuse, and misplaced trust assumptions between renderer and main processes.
This talk explores how contemporary Electron applications can still be exploited even with recommended security configurations enabled. Through hands-on demonstrations using DVEA — a purpose-built vulnerable Electron application designed for security training and research — attendees will learn how common development mistakes can transform seemingly hardened applications into viable attack surfaces.