Talks·18 min
Carson Zimmerman
Presents 14 questions for judging how a security operations center is growing and performing.
security-operationsincident-responsedefensive-security+2
January 2024 · Washington, DC, USA
ShmooCon 2024
1 session · 48 talks
Sessions at this event
All ShmooCon 2024 talks
1–24 of 48 talks
Talks·23 min
Harley Geiger · Charley Snyder
Explains a new legal defense fund that pays lawyers for good-faith security researchers facing threats over their vulnerability work.
vulnerability-researchbug-bountyrisk+1
Talks·50 min
Ryan Ashley · Ari Chadda
Shows how a machine learning model can sit inside a man-in-the-middle attack and alter camera images in transit.
aimachine-learningattack+2
Talks·23 min
Drew hoodoer Kirkpatrick
Shows how a client-side JavaScript payload can persist in web apps and capture user activity during red team engagements.
webattackappsec+2
Talks·44 min
EVM
Explores the undocumented Elbrus processor architecture and a C++ vtable overflow exploit ported to its compiler.
reverse-engineeringarchitectureexploitation+1
Talks·22 min
Andréanne Bergeron
Analyzes brute-force RDP login attempts on an exposed Windows system to reveal when attackers work, pause and slow down.
attackthreatintelligence+2
Talks·51 min
Sean Gallagher
Traces how romance and crypto investment scams are built, from lure messages to fake trading apps and DeFi wallet drains.
socialthreatintelligence+2
Talks·53 min
XenoKovah
Shows how passive and active Bluetooth probing can identify the chip, firmware and vendor behind nearby devices.
vulnerability-researchdeviceiot+2
Talks·48 min
Ben Kallus · Prashant Anantharaman
Shows how HTTP parser mismatches in servers and proxies enable access control bypasses and cache poisoning.
webvulnerability-researchnetwork+2
Talks·13 min
Andrew Januszak · Keith Ericson
Explains how canary tokens feed an ELK stack and ElastAlert 2 to raise near real-time alerts on phishing activity.
threat-detectiondefensive-securitymonitoring+2
Talks·22 min
Brian Alexander
Walks through fuzzing Memcached's proxy, exploiting a stack overflow, and writing a network signature to detect it.
vulnerability-researchfuzzingexploit+2
Talks·51 min
Liz Wharton · Danette Edwards · Cyndi Gula
Explores how SEC enforcement, cyber disclosure rules and personal liability are reshaping the role of CISOs after recent breaches.
panelriskincident-response+1
Talks·16 min
Ian Foster
Explains lame DNS delegations and dependency trees, then demonstrates a tool that tests every resolution path.
networkinfrastructurevulnerabilities+2
Talks·48 min
Seth Jenkins
Maps overlooked Android chipset drivers beyond the GPU and walks one kernel race bug through to root.
androidkernelvulnerability-research+2
Talks·51 min
Aaron Brown
Shows how homophones, Unicode tricks and ARIA labels make screen readers speak misleading domains and messages.
attackthreatsocial+2
Talks·20 min
William
Shows how untrusted build code escapes SaaS trust boundaries through PATH, environment variables, git hooks, and LD_PRELOAD.
exploitationarchitecturevulnerabilities+2
Talks·50 min
Shane Angel · Wendy Knox Everette
Argues that the FedRAMP cloud authorization program adds burdens without improving security, and suggests how it could change.
cloudriskmanagement+2
Talks·50 min
Dillon Franke
Walks through fuzzing macOS Mach IPC handlers to find low-level vulnerabilities and possible sandbox escape paths.
fuzzingvulnerability-researchreverse-engineering+2
Talks·50 min
Ian Harris · Marcel Carlsson
Shows how template-based fuzzing with LLM paraphrasing finds jailbreak prompts that slip past chatbot safety guardrails.
aifuzzingmachine-learning+2
Talks·23 min
Luke Berndt
Shows how passive listening to encrypted public safety trunked radio systems leaks metadata about talk groups and radio activity.
open-sourcedeviceprivacy+2
Talks·51 min
Aleksandar Nikolic · Travis Goodspeed
Shows how film can replace a missing digital sensor when imaging electronics with a cabinet X-ray machine.
hardwarereverse-engineeringdevice+2
Talks·51 min
Casey Ellis · Katie Msurus · Leonard Bailey · Harley Guyer
Panelists debate whether the security community can agree on voluntary norms for good-faith vulnerability research.
panelvulnerability-researchbug-bounty+3
Talks·17 min
Dan Nagle
Shows how a network audio player's UDP and TCP protocols are reverse engineered, replayed, and rebuilt in Packet Sender.
networkreverse-engineeringiot+2