Monday

The recording runs through a full conference day in the Breaking Ground track. It opens with venue logistics, code of conduct reminders and a schedule overview before the technical sessions begin. Early talks cover attacker persistence in Google Cloud through workload identity federation, including open provider pools, silent edits to provider conditions, and rogue certificate trust anchors. They also explain the audit log gaps that hide this activity and offer queries and organization policies to catch it.

Middle sessions move into memory forensics for Go malware, where a set of Volatility 3 plugins recovers strings, function call graphs and active goroutines from memory samples. Other talks look at automated S/MIME certificate issuance over ACME, at dangling DNS records that point to released AWS Elastic IPs with a read-only detection script, and at email abuse through trusted cloud application workflows, device code phishing and multi-tenant authorization flaws. A business logic session shows how promo code guessing, refund abuse and order-edit gaps in e-commerce and ride-hailing apps can yield free goods and services.

Later sections include a policy keynote on how the Justice Department changed its stance toward good-faith security research, and a RISC-V talk on shadow stacks and landing pads for control-flow integrity. The practical takeaways across the day are to enable the right cloud logs, validate tokens and tenants on the server, monitor dangling DNS entries, and enforce business rules server side rather than trusting the client.