Breaking Ground·38 min
Ali Kabeel
Walks through invitation flow bugs on Facebook and Snapchat that let attackers regain access or add unwanted users.
appsecwebvulnerabilities+2
August 2025 · Las Vegas, USA
BSides Las Vegas
8 sessions · 124 talks
Sessions at this event
Breaking Ground
21 talks
Breaking Ground talks from BSides Las Vegas 2025.
Common Ground
17 talks
Common Ground talks from BSides Las Vegas 2025.
Ground Floor
16 talks
Ground Floor talks from BSides Las Vegas 2025.
Ground Truth
14 talks
Ground Truth talks from BSides Las Vegas 2025.
Hire Ground
9 talks
Hire Ground talks from BSides Las Vegas 2025.
I Am The Cavalry
13 talks
I Am The Cavalry talks from BSides Las Vegas 2025.
PasswordsCon
15 talks
PasswordsCon talks from BSides Las Vegas 2025.
Proving Ground
19 talks
Proving Ground talks from BSides Las Vegas 2025.
All BSidesLV 2025 talks
Filters+
1–24 of 122 talks / 124
Breaking Ground·42 min
Wraps up the event with thanks to staff, charity totals, raffle results, and a call to return next year.
villagecommunitychallenge+1
Breaking Ground·13 min
Noah Grosh
Shows how small edits to a malware file's features can lower an ML detector's malicious score without changing behavior.
aimachine-learningmalware-analysis+2
Breaking Ground·39 min
David McDonald
Shows how tree-sitter syntax queries can detect and unwrap obfuscated PowerShell before it runs, via a custom AMSI provider.
malware-analysisthreat-detectiondefensive-security+2
Breaking Ground·47 min
Mackenzie Jackson
Shows how LLMs uncover undisclosed open-source vulnerabilities and malicious packages, including a Lazarus backdoor in a Ripple SDK.
supply-chainopen-sourcevulnerability-research+2
Breaking Ground·1 hr 11 min
Larry Trowell
Shows how low-cost, mostly 3D-printed and off-the-shelf parts can build laser fault injection and chip imaging rigs.
hardwareembeddedopen-source+3
Breaking Ground·43 min
Chris Merkel
Traces a North Korean remote IT worker scheme from pandemic-era hiring to detection signals and process-based fixes.
threatdetectionhunting+2
Breaking Ground·22 min
Ariel Kalman
Shows how a permissive Google Cloud IAP setting lets an attacker smuggle secrets out through CORS preflight responses.
cloudidentityweb+2
Breaking Ground·21 min
Anya Vesna
Shows how poisoned training data changes graph-based views of a dataset, using an open-source browser tool called GraphLeak.
aimachine-learningopen-source+2
Breaking Ground·26 min
Junki Yuasa · Yoshiki Kitamura
Shows an open-source tool that automatically evaluates and hardens LLM system prompts against injection attacks.
aiopen-sourceapplication+2
Breaking Ground·19 min
Coby Abrams · Tal Peleg
Shows how a trusted Postgres language extension lets a low-privilege user run code on cloud-hosted databases.
vulnerability-researchcloudexploitation+2
Breaking Ground·40 min
Terada Yu
Shows how a command channel built on Outlook automation over SMTP and IMAP can get past web isolation controls.
attackwebnetwork+2
Breaking Ground·45 min
Rafael Felix
Explains how major browsers protect stored cookies and saved logins, and how Chrome's app-bound encryption can be bypassed on Windows.
webwindowsreverse-engineering+2
Breaking Ground·30 min
Yuval Gordon
Shows how a delegated managed service account in Active Directory can be abused to inherit domain admin privileges.
windowsidentityvulnerability-research+2
Breaking Ground·41 min
Tricta
Shows how injecting code into Android's Zygote process lets an analyst hook apps and bypass runtime protections.
androidmobileattack+2
Breaking Ground·35 min
Srajan Gupta · Vinay Kumar
Walks through MCP attack paths such as tool poisoning, line jumping and version drift, with demos and a drift-tracking tool.
aiattackvulnerabilities+3
Breaking Ground·43 min
Allison Nixon
Traces how the hacker underground shifted from curious tinkering to exploitation, and what the industry should do about it.
threatsociallessons-learned+1
Breaking Ground·27 min
Casey John Ellis
Argues that security needs knowledge sharing across generations, and offers practical ways to pass on hard-won experience.
lessons-learnedlearningteam+2
Breaking Ground·48 min
Stacey Schreft
Draws parallels between the 2008 financial crisis and fragility in IT systems, from leverage to third-party dependence.
riskvulnerabilitiesmanagement+2
Breaking Ground·43 min
Chris Butera · Madison Oliver · Jerry Gamblin · Tod Beardsley
Panelists debate the funding, governance and data quality problems facing the CVE program and its users.
panelvulnerabilitiesopen-source+2
Breaking Ground·37 min
Covers exploitation of Trend Micro Mobile Security, asking who checks the security scanner itself.
mobilevulnerability-researchexploitation
Common Ground·46 min
Candid Wuest
Assesses whether agentic AI malware is already a real threat, with a PowerShell proof of concept and defender takeaways.
aiattackdetection+2
Common Ground·45 min
Blake Hudson · Caleb Sargent
Shows how built-in tools and misconfigurations let attackers disable Zscaler and Microsoft Defender protections.
attackdefensive-securitydetection+3
Common Ground·47 min
Klaus Agnoletti · Glen Sorensen
Shows how role-playing game mechanics can make incident response tabletop exercises more engaging and memorable.
incident-responselearningteam+2