Breaking Ground·38 min
Ali Kabeel
Walks through invitation flow bugs on Facebook and Snapchat that let attackers regain access or add unwanted users.
appsecwebvulnerabilities+2
Breaking Ground BSidesLV 2025
Las Vegas, USA · August 2025 · 21 talks
Breaking Ground talks from BSides Las Vegas 2025.
1–21 of 21 talks
Breaking Ground·42 min
Wraps up the event with thanks to staff, charity totals, raffle results, and a call to return next year.
villagecommunitychallenge+1
Breaking Ground·13 min
Noah Grosh
Shows how small edits to a malware file's features can lower an ML detector's malicious score without changing behavior.
aimachine-learningmalware-analysis+2
Breaking Ground·39 min
David McDonald
Shows how tree-sitter syntax queries can detect and unwrap obfuscated PowerShell before it runs, via a custom AMSI provider.
malware-analysisthreat-detectiondefensive-security+2
Breaking Ground·47 min
Mackenzie Jackson
Shows how LLMs uncover undisclosed open-source vulnerabilities and malicious packages, including a Lazarus backdoor in a Ripple SDK.
supply-chainopen-sourcevulnerability-research+2
Breaking Ground·1 hr 11 min
Larry Trowell
Shows how low-cost, mostly 3D-printed and off-the-shelf parts can build laser fault injection and chip imaging rigs.
hardwareembeddedopen-source+3
Breaking Ground·43 min
Chris Merkel
Traces a North Korean remote IT worker scheme from pandemic-era hiring to detection signals and process-based fixes.
threatdetectionhunting+2
Breaking Ground·22 min
Ariel Kalman
Shows how a permissive Google Cloud IAP setting lets an attacker smuggle secrets out through CORS preflight responses.
cloudidentityweb+2
Breaking Ground·21 min
Anya Vesna
Shows how poisoned training data changes graph-based views of a dataset, using an open-source browser tool called GraphLeak.
aimachine-learningopen-source+2
Breaking Ground·26 min
Junki Yuasa · Yoshiki Kitamura
Shows an open-source tool that automatically evaluates and hardens LLM system prompts against injection attacks.
aiopen-sourceapplication+2
Breaking Ground·19 min
Coby Abrams · Tal Peleg
Shows how a trusted Postgres language extension lets a low-privilege user run code on cloud-hosted databases.
vulnerability-researchcloudexploitation+2
Breaking Ground·40 min
Terada Yu
Shows how a command channel built on Outlook automation over SMTP and IMAP can get past web isolation controls.
attackwebnetwork+2
Breaking Ground·45 min
Rafael Felix
Explains how major browsers protect stored cookies and saved logins, and how Chrome's app-bound encryption can be bypassed on Windows.
webwindowsreverse-engineering+2
Breaking Ground·30 min
Yuval Gordon
Shows how a delegated managed service account in Active Directory can be abused to inherit domain admin privileges.
windowsidentityvulnerability-research+2
Breaking Ground·41 min
Tricta
Shows how injecting code into Android's Zygote process lets an analyst hook apps and bypass runtime protections.
androidmobileattack+2
Breaking Ground·35 min
Srajan Gupta · Vinay Kumar
Walks through MCP attack paths such as tool poisoning, line jumping and version drift, with demos and a drift-tracking tool.
aiattackvulnerabilities+3
Breaking Ground·43 min
Allison Nixon
Traces how the hacker underground shifted from curious tinkering to exploitation, and what the industry should do about it.
threatsociallessons-learned+1
Breaking Ground·27 min
Casey John Ellis
Argues that security needs knowledge sharing across generations, and offers practical ways to pass on hard-won experience.
lessons-learnedlearningteam+2
Breaking Ground·48 min
Stacey Schreft
Draws parallels between the 2008 financial crisis and fragility in IT systems, from leverage to third-party dependence.
riskvulnerabilitiesmanagement+2
Breaking Ground·43 min
Chris Butera · Madison Oliver · Jerry Gamblin · Tod Beardsley
Panelists debate the funding, governance and data quality problems facing the CVE program and its users.
panelvulnerabilitiesopen-source+2
Breaking Ground·37 min
Covers exploitation of Trend Micro Mobile Security, asking who checks the security scanner itself.
mobilevulnerability-researchexploitation