Main Stage·42 min
James Kettle
Presents HTTP request smuggling as a modern attack primitive for cache poisoning, session hijacking, and WAF bypass.
http-smugglingrequest-desyncweb-security+2
DEF CON 27/Main Stage across years
Main Stage DC27
Paris, Bally's, Flamingo, and Planet Hollywood hotels, Las Vegas · 8-11 August 2019 · 91 talks
DEF CON 27 Main Stage — 90 talks from the canonical 2019 playlist covering offensive security, cloud attacks, wireless exploitation, hardware hacking, privacy, policy, and hacker culture from Las Vegas.
1–24 of 89 talks / 91
Main Stage·48 min
Alexandre Borges
Deep-dives into .NET CLR internals to equip analysts with techniques for reversing obfuscated .NET malware families.
dotnetmalware-analysisreverse-engineering+2
Main Stage·53 min
Ali Islam
Proposes using lightweight hypervisors as a security enforcement layer for automotive ECUs and implantable medical devices.
hypervisorautomotive-securityhealthcare+2
Main Stage·18 min
Alon Weinberg
Introduces a novel x64 code injection technique that bypasses modern Windows security controls without process hollowing.
code-injectionwindowsprocess-injection+2
Main Stage·37 min
Alvaro Muñoz
Catalogs critical vulnerability classes in SAML, OAuth, and JWT SSO implementations used across enterprise environments.
ssosamloauth+2
Main Stage·49 min
Andreas Baumhof
Separates hype from reality on quantum computing's timeline for breaking current public-key cryptography.
quantum-computingcryptographypost-quantum+2
Main Stage·22 min
Andy Grant
Dissects macOS PKG installer internals to reveal how malware authors abuse the package format for persistence and privilege escalation.
macosinstaller-packagesmalware+2
Main Stage·44 min
Anish Athalye
Proposes processor reset as an isolation primitive to provide stronger guarantees than cache flush-based mitigation of microarchitectural side channels.
processor-resetsecurity-isolationmicroarchitecture+2
Main Stage·29 min
Ariel Herbert-Voss
Provides a structured adversarial ML red team methodology for attacking production AI systems beyond naive input perturbation.
ai-securitymachine-learningadversarial-ml+2
Main Stage·29 min
Ben Sadeghipour
Demonstrates how SSRF vulnerabilities provide a direct path from web application to cloud metadata service, IAM credentials, and full account compromise.
ssrfcloudaws+2
Main Stage·48 min
Bernhard Mueller
Analyzes the adversarial ecosystem of Ethereum smart contract exploits and counter-exploits, including honeypot contracts designed to trap attackers.
ethereumsmart-contractsblockchain+2
Main Stage·42 min
Bill Demirkapi
A high school student discovers unauthenticated API endpoints exposing millions of K-12 student records from major edtech platforms.
education-securitystudent-dataapi-security+2
Main Stage·46 min
Bill Graydon
Demonstrates that restricted key systems — marketed as uncopyable — can be precisely duplicated using 3D printing and inexpensive blank grinding.
physical-securitylockpickingkey-duplication+2
Main Stage·41 min
Bill Swearingen
Exposes persistent plaintext transmission failures in P25 public safety radio networks used by law enforcement and first responders.
law-enforcementp25radio+2
Main Stage·39 min
Brad Dixon
Reverse engineers the Zwift virtual cycling platform to demonstrate trivial speed cheating via client-side protocol manipulation.
esportsgame-hackingreverse-engineering+2
Main Stage·18 min
Brent Stone
Demonstrates automated CAN bus reverse engineering tooling that maps unknown message IDs to physical vehicle functions in minutes.
automotive-securitycan-busreverse-engineering+2
Main Stage·43 min
Bruce Schneier
Bruce Schneier argues that security technologists have a moral obligation to engage with policy and serve the public interest, not just clients.
policypublic-interestgovernment-surveillance+2
Main Stage·38 min
Campbell Murray
Demonstrates practical GSM interception using commodity SDR hardware and open-source software to decrypt 2G voice calls.
gsmcellularimsi-catcher+2
Main Stage·33 min
Christopher Roberts - Firmware Slap: Automating Discovery of Exploitable Vulnerabilities in Firmware
Christopher Roberts
Presents Firmware Slap, a framework combining concolic execution and fuzzing to automatically discover exploitable bugs in embedded firmware.
hardwarebinary-analysisvulnerability-research+2
Main Stage·36 min
Christopher Wade
Demonstrates NFC tag-side attacks that manipulate reader-side applications via malformed tag responses and relay injection.
nfcrfidwireless+2
Main Stage·46 min
Beto O'Rourke · Deth Vegetable · Misha Kubecka · Grandmaster Ratte
cDc members, including presidential candidate Beto O'Rourke, discuss the group's 35 years of hacktivism and political impact.
hacker-culturehacktivismcdc+2
Main Stage·37 min
Damien Cauquil
Breaks the BLE 5.0 channel hopping PRNG to predict future advertisement channels and enable targeted jamming of Bluetooth 5 devices.
bluetoothbleprng+2
Main Stage·49 min
Daniel Crowley
Revisits meet-in-the-middle and other key search attacks against symmetric ciphers, examining their relevance to modern key length choices.
cryptographysymmetric-cryptokey-search+2
Main Stage·45 min
Daniel Romero
Demonstrates persistent backdoors and network pivots achievable through common office equipment including printers, scanners, and VOIP phones.
printersoffice-equipmentiot+2