Talks·51 min
Organizers and their children explain how a volunteer-run hacker conference is built, funded, and finally wound down.
lessons-learnedbuildingteam+2
Talks ShmooCon 2025
Washington, DC, USA · January 2025 · 49 talks
Talks from ShmooCon 2025.
1–24 of 49 talks
Talks·49 min
Jay Beale · Mark Manning
Walks through how a benchmark-compliant Kubernetes cluster with no flagged CVEs can still be taken over through overprivileged roles.
kubernetescloudlinux+3
Talks·52 min
Deviant Ollam
Traces safe and vault attacks from Cold War espionage teams to modern lock manipulation and drilling.
attackintelligencestate+2
Talks·12 min
nyxgeek
Shows how public Microsoft 365 endpoints expose usernames and employee availability at scale, with survey data to back it up.
cloudidentityrecon+2
Talks·13 min
Meghan Jacquot
Shares how to start and run a book club, from picking titles and discussion questions to building community around reading.
discussionlearningcommunity+1
Talks·47 min
Michael Ossmann
Walks through open-source FPGA tools for building USB devices, analyzing USB traffic, and emulating hardware.
hardwareopen-sourcedevice+2
Talks·42 min
Robert Weiss
Traces hacker culture from 19th-century lock picking and wireless hacks to MIT pranks, early hacker ethics, and today's hacker spaces.
hacklessons-learnedlearning+1
Talks·21 min
Estelle Ruellan
Shows how infostealer logs exposed command-and-control operators whose own machines were infected, revealing a malware ecosystem.
malware-analysisintelligencethreat+2
Talks·21 min
Brittney Argirakis · Chapin Bryce
Shows how a triage tool maps exposed AWS resources to answer early incident response questions quickly.
cloudincident-responseaws+2
Talks·18 min
David Cheeseman
Shows how a covert channel can hide encrypted messages inside QUIC connection ID fields to evade entropy-based detection.
networkattackdetection+1
Talks·26 min
Russell Handorf
Shows how to plan a deception operation, using a rural trespasser case study to illustrate a practical framework.
deceptiondefensive-securitythreat-detection+1
Talks·50 min
Bil Swearingen · Larry Pesce
Shows how to build a low-cost ESP32 device that detects nearby Bluetooth Low Energy trackers such as AirTags.
devicedetectionprivacy+2
Talks·50 min
Brett Hawkins · Chris Thompson
Shows how stolen cloud tokens let attackers steal models from MLOps platforms, and how to detect that activity.
aimachine-learningcloud+2
Talks·22 min
Luke Berndt · Mike Chadwick
Shows how to build a low-cost ADS-B system that automatically points a PTZ camera at passing aircraft.
open-sourcebuildingdevice+2
Talks·20 min
Guilherme Santos
Surveys how attackers poison, invert and evade machine learning models, from prompt injection to adversarial patches.
aimachine-learningattack+2
Talks·53 min
Carol Fenley · Jonathan Klene · Liz Warden · Desiree Saturnly · Jessica Wilkerson
A mock arbitration stages a dispute over liability after an eyewear joint venture's software is breached.
panelsupply-chainrisk+2
Talks·54 min
Greg Conti · Danielle Scalera
Traces twenty years of ShmooCon talks and turns them into a labeled taxonomy, dataset and visualizations.
historytaxonomyopen-source
Talks·18 min
Richo Butts
Follows a home-battery owner who reverse engineers an Android app to control a solar battery's smart relay for EV charging.
iotreverse-engineeringvulnerabilities+2
Talks·13 min
Kali Fencl
Shows how security practitioners and marketers can team up to turn research into credible, buyer-relevant content.
teamtrustintelligence+1
Talks·21 min
Ian
Describes how volunteer IT teams restore connectivity to communities after disasters and how to join the ITDRC.
networkinfrastructureteam+2
Talks·27 min
Matthew Wollenweber
Shows how to catch lookalike domains from public registry data before attackers start phishing or sending fake invoices.
threat-detectionopen-sourceintelligence+2
Talks·49 min
Olivier Bilodeau · Eric Clay
Traces how infostealer malware harvests credentials and session cookies, and how the Redline operation was disrupted.
malware-analysisthreatintelligence+2
Talks·22 min
Christian Paquin
Explains how cryptographically signed content credentials like C2PA can help verify whether online images and videos are authentic.
aitrustprivacy+2