BSidesSLC

In this presentation, we will go over the basics of Bluetooth, with a focus on vulnerabilities. Then we will move on to the basics of setting up an environment to monitor bluetooth packets, send bluetooth packets, and reverse engineer bluetooth devices. If you'd like to try the demos out for yourself, make sure to bring a linux-friendly USB Bluetooth dongle, a Linux-Powered Laptop with Docker installed (or a laptop w/ VirtualBox or VMWARE).

At a recent conference, a few of us were discussing how there are a ton of great info security peeps in the area that have really cool ideas and project, yet many don't feel comfortable presenting them or submitting papers about their ideas. We've also felt that many of the same people present due to lack of submissions. The overall goal of this presentation will be about stepping out of our comfort zone, overcoming your imposter syndrome and offering some tips of giving your 1st or your 20th conference talk.

The internet is crawling with bots. A bot is a software program that runs automated tasks over the internet, typically performing simple, repetitive tasks at great speeds unattainable, or undesirable by humans. They are responsible for many small jobs that we take for granted such as search engine crawling, website health monitoring, fetching web content, measuring site speed and powering APIs. They can also be used to automate security auditing by scanning your network and websites to find vulnerabilities and help remediate them. One of the ways that bots can harm businesses is by engaging in web scraping. We work with customers often on this issue and wanted to share what we’ve learned. This presentation discusses what web scraping is, how it works, and why it’s a problem for website owners. Lastly, we will introduce a number of techniques website owners can use to protect themselvers and their business.

Cloud services are frequently misconfigured due to their rapid adoption and engineers not fully understanding the security ramifications of different configurations, which can frequently enable red teams to gain, expand, and persist access within Google Cloud Platform (GCP) environments. In this talk we will dive into how GCP services are commonly breached (e.g. SSRF vulnerabilities, discovering insecure cloud storage), and then show how attackers are expanding access within Docker & Kubernetes (K8s) environments (e.g. CVEs, insecure daemons). Finally we will demonstrate some unique techniques for persisting access within GCP environments for prolonged periods of time!

Let's talk about all-the-things badge related: design, challenges, magic, assembly, etc…