Talks·46 min
Martin Herrmann
Traces how a pentest team's remote-access tunnel grew into an in-house command and control framework with custom transports.
frameworktoolattack+2
February 2025 · Helsinki, Finland
Disobey 2025
1 session · 30 talks
Sessions at this event
All Disobey 2025 talks
Filters+
1–24 of 30 talks
Talks·26 min
Johannes Kadak
Shows how Cloud Custodian YAML policies report, alert on, and auto-remediate AWS misconfigurations in practice.
cloudawsautomation+2
Talks·27 min
Ross Bailey
Shows how cheap, off-the-shelf AI tools can clone faces and voices, and why that undermines everyday trust.
aisocialtrust+2
Talks·43 min
Nicklas Keijser · Mattias Wåhlén
Traces a Rust-based ESXi ransomware group from a small-company breach back to its affiliate model and forum launch.
ransomwareintelligencemalware-analysis+3
Talks·46 min
Hannu Aronsson
Explains how email authentication standards like SPF, DKIM and DMARC work, and where they fail in practice.
emailphishingdefensive-security+2
Talks·45 min
Dr Nestori Syynimaa
Shows how stolen signing keys and primary refresh tokens let attackers forge logins and bypass MFA in Entra ID.
identitycloudattack+2
Talks·46 min
joohoi · STÖK
Shows how a single flipped bit in a DNS name lets an attacker collect credentials and tokens meant for legitimate services.
attacknetworkidentity+2
Talks·41 min
Examines how supply chain attacks can reach a global scale.
supplyattacktrust+1
Talks·45 min
Nicklas Keijser · Anders Olsson
Shows how attackers reach VMware ESXi hosts and run ransomware on them, and which hardening and logging steps counter it.
ransomwarevirtualincident-response+2
Talks·42 min
Janne Kastepohja · Miikka ’otter’ Saukko
Explains how organizational culture, scoping and executive support decide whether security work succeeds in practice.
managementteamlessons-learned+1
Talks·18 min
Bartek Pszczola
Shows how rapid actions during phone boot slipped past a Samsung kiosk lockdown and reached restricted device functions.
mobileandroiddevice+2
Talks·34 min
Andrei
Shows how OpenAPI specifications can be mined as graphs to surface API design flaws like inconsistent authorization and leaked identifiers.
webvulnerability-researchattack+2
Talks·36 min
Shamil Alifov
Gives an overview of infostealer malware, its service economy, and a rough analysis of leaked credential dumps.
malware-analysisthreatintelligence+2
Talks·45 min
Antti Rössi
Walks through how incident responders approach investigating industrial control system environments and the attacks that target them.
icsincident-responsethreat+2
Talks·45 min
Anne Honkaranta
Reviews literature on how DevOps practices affect software security and compares the findings with practitioner data.
devopsdevelopmentappsec+2
Talks·45 min
Inbar Raz
Shows how prompt injection and poisoned retrieval data can turn Microsoft Copilot into an attack path inside an organization.
aimachine-learningexploitation+2
Talks·39 min
Richard Suls
Walks through a prison's ransomware breach, from a phishing foothold to a public data leak and the response failures behind it.
ransomwareincident-responselessons-learned+2
Talks·46 min
Paul Malcomb
Explains the OODA loop and decision science, applying Boyd's ideas to incident response and organizational planning.
managementdecision-makingincident-response+2
Talks·44 min
James Henderson
Shows how skipped protocol steps let an IPMI management service bypass authentication, using reverse engineering, fuzzing and debugging.
vulnerability-researchnetworkreverse-engineering+2
Talks·43 min
Explores hiding and seeking within Java environments, framed as a playful hide and seek contest.
javaapplicationdetection+1
Talks·42 min
Sébastien Dudek
Surveys radio attack surfaces in cars, garage doors, cellular links and V2G charging, plus low-cost tooling for analysing signals.
attackdevicetool+2
Talks·44 min
Dorota Kozlowska
Walks through social engineering phases, influence tactics, elicitation and physical intrusion examples drawn from red team engagements.
socialphishingdefensive-security+1
Talks·35 min
Heikki Juva
Tests upcoming EU rules for connected consumer devices by dismantling popular products sold in Finland.
iotprivacydevice+2
Talks·28 min
Christian Philipov
Shows lesser-known Azure and Entra APIs that enumerate tenants with less logging, and where defenders should add detections.
cloudidentityattack+3