BSides Buffalo

@bsidesbuffalo.bsky.social

250 Followers 22 Following

Buffalo's favorite information security conference.

"Deep links are widely used in mobile applications to provide seamless navigation to specific screens inside an app. However, when deep links are improperly validated, they can become powerful attack vectors that allow external inputs to directly influence internal application behavior. This lightning talk explores how seemingly harmless deep links can lead to serious security issues such as token leakage, WebView exploitation, and even one-click account takeover. In one example, a crafted deep link forces the app to open an attacker-controlled URL inside a WebView while automatically appending the victim’s authentication token, allowing the attacker to hijack the account with a single click. We will also look at how vulnerable WebView configurations combined with exported deep link activities can enable attackers to exfiltrate session cookies, load malicious content, or execute privileged actions inside the app context. This talk highlights common developer mistakes, demonstrates how attackers chain deep link handling with WebView behavior, and provides practical mitigation strategies to secure mobile applications against these hidden entry points."
"In 2021, a CyberArk researcher collected 5,000 network hashes across Tel Aviv using $50 in equipment and cracked over 70% of them via the clientless PMKID attack technique. Five years later, this talk revisits that methodology — this time closer to home. This session presents the results of a real-world WPA2 survey conducted locally in 2026, measuring how prevalent WPA2 remains, how password hygiene has (or hasn’t) improved, and how accessible this attack vector continues to be for any motivated adversary. No live cracking — just honest data, a reproducible methodology, and a candid look at whether the security community has meaningfully moved the needle on wireless security. Attendees will walk away with a clear understanding of the PMKID attack surface, what current data says about password practices in the wild, and actionable guidance for individuals and organizations looking to actually secure their wireless environments."
"As macOS adoption accelerates—with over 45% of enterprises now utilizing the platform—Mac endpoints have become high-value targets for attackers seeking cloud credentials, source code, and privileged access. Despite this trend, macOS lateral movement remains a significant blind spot; the MITRE ATT&CK framework documents far fewer techniques for macOS than for Windows, and recent industry reports indicate that macOS environments prevent significantly fewer attacks than their Linux or Windows counterparts. This research aims to close that gap by systematically validating macOS-native lateral movement and execution primitives. While Remote Apple Events (RAE) are traditionally documented as a lateral movement vector (T1021.001), we also approach the protocol through the lens of Software Deployment Tools for Execution (T1072). We demonstrate how RAE can be weaponized as a standalone primitive for deploying and executing complex, multi-line shell scripts. Our investigation analyzes the inherent security features of the System Events handler and the parsing constraints of the AppleScript interpreter that typically restrict remote orchestration. We then present a robust bypass methodology utilizing Base64 transport encoding and Terminal.app orchestration to achieve arbitrary code execution."
"As a Pentester, the discovery process is one of the most important steps to get right. With timed engagements, quick and efficient discovery processes are a must to produce meaningful results for customers. This session will talk about the art of internal network enumeration. How to find networks. How to find assets within networks. Useful tools and strategies for large networks. And how to take the data found and use it to formulate attacks against systems and Active Directory."
"Whether you're building a SOC, developing detection capabilities, hiring a pentest firm, or training analysts, understanding how attackers think changes everything from the questions you ask to the gaps you find. In this panel we discuss how offensive awareness strengthens defensive operations from the inside out: building detection logic informed by real attacker tradecraft, preparing your team to get the most out of offensive engagements, and fostering a culture where defenders are encouraged to think like hackers without needing to become one."
"A bug bounty researcher found Azure credentials in a JavaScript file and called it done. I kept going — four Azure AD credentials sitting in a public JS file, enough to authenticate as the application itself. The frontend had documented its own backend. Full account takeover. The application's token had been granted the ability to perform user-level operations — every account in the system was reachable. The organization had GitLeaks in CI/CD and static secret scanning on pull requests. The credentials were still live. That was one chain. A second application used CryptoJS to encrypt its configuration — a common pattern in SPAs where developers believe encrypting the config protects it. The decryption key was hardcoded in the same JavaScript file, three lines away from the encrypted blob. The secret to unlock everything was sitting next to the lock. Same credential pattern at the end. Same result. Shift-left tools scan what you commit. They do not scan what you serve. Build-time environment injection bakes live keys into webpack bundles that never touch the repository. CI/CD pipeline variable substitution materializes secrets only in the build artifact, after every scanner has run. SSR state blobs injected by Next.js and Nuxt carry credentials into HTML that no pre-deployment scanner ever sees. Once a secret reaches production, it disappears from every scanner's view. The only things finding runtime secrets are manual penetration testers, bug bounty researchers, and attackers. Two of those three report what they find. This talk walks through both exploitation chains in detail, maps the full shift-right gap in the security tooling landscape, and closes with a live demo using a purpose-built intentionally vulnerable healthcare portal — a HIPAA-branded application exposing Twilio, SendGrid, Stripe, and Firebase credentials in its public JavaScript files, and leaking internal service keys in response headers on every single request."
"The function of an IT auditor is often misunderstood in the greater cybersecurity and GRC landscape. This session cuts through the confusion and provides a clear, accessible overview of what IT auditors actually do, why the discipline exists, and how it fits into the broader governance, risk, and compliance landscape. Attendees will explore the different types of IT audits — from SOC 2 examinations and HITRUST assessments to HIPAA, CMMC, and ISO audits — and learn how each serves a distinct purpose in building organizational trust and compliance. The session will also cover how IT audits evaluate the design and effectiveness of controls across areas like access management, change management, endpoint security, and data protection. Whether you are a business leader trying to understand an upcoming SOC 2 examination, an IT professional preparing for your first audit, or a student exploring career paths, this session will give you a practical foundation for understanding how IT audit drives trust, accountability, and operational resilience."
At 3pm in Track One, we've got Kelsey O'Connell presenting "It Wasn’t Spoofed: Investigating Authenticated Email Abuse in Real Environments". "A suspicious email spreading internally was initially attributed to spoofing after a user reported a message sent from their account that they had not sent. However, analysis revealed the message originated from within the organization. Authentication had succeeded, the message was treated as internal, and no alerts were generated. The activity was not spoofing, but authenticated abuse using valid credentials. This session walks through how to investigate and differentiate between spoofed and authenticated activity, and what control gaps allow this type of behavior to persist in real-world environments."
"After four years of war, Russia's cyber-enabled operations have adapted, representing one of a few countries that now have directly applied cyber capabilities in a state vs state conflict. This talk will explore notable trends across Russia's cyber-enabled capabilities, including introducing a novel addition to the list of cyber-enabled Russian organizations. This talk will explore several trends including an emerging powerhouse amongst existing capabilities, adaptations to initial access capabilities, the incorporation of malware-as-a-service and an examination of the impact of wartime conditions to cyber-enabled operations."
"A lot of people in infosec want a mentor but don’t know how to find one. Either they don’t know how to ask or feel like they haven’t earned the right, yet at the same time, there are plenty of experienced people who want to give back but don’t think they’re qualified to mentor anyone. This talk is for both. We’ll talk about why mentorship in security is way harder than it should be, why “just network” is shitty advice and what mentorship actually looks like. This isn’t about titles, seniority or having everything figured out. It's about sharing what you know, listening and being willing to offer support to others along the way. If you’re looking for a mentor, you’ll leave with practical ways to ask without feeling out of place. If you’ve been around for a while and want to give back, you’ll likely leave realizing you have way more to offer than you think."
"Bring-your-own-IAM sounds like an attractive security policy, but in practice it's a euphemism for security debt. Every team rolls their own authorization, ignores access governance, and hopes audits never arrive. Roblox lived in that world for years. While infrastructure IAM has matured (AWS IAM, KMS, VPCs), application-layer access remains a free-for-all. Internal services—admin dashboards, data stores, bespoke tools—reinvent "who can do what" with no shared model for time-bound access, multi-tier approvals, or consistent audit. The industry is starting to name this gap, but almost nobody has built and deployed application-layer access governance across heterogeneous services at scale. This talk tells the story of RoAM (Roblox Access Manager), a generic access governance platform built to orchestrate requests, approvals, expirations, and recertifications—and then notify downstream policy engines via an interface modeled on OpenID AuthZEN. RoAM does not replace the authorization systems teams already have. It wraps them in a shared governance layer: time-bounded access, approval workflows, centralized audit, and automatic revocation. RIF (RoAM Ingestion Framework) is the continuous data ingestion layer that keeps the authorization graph current, projecting resource ownership from upstream data sources into Guard, Roblox's ReBAC authorization service. Expect us to cover real incidents, design mistakes, and concrete engineering patterns for turning brittle, bespoke authorization into a reusable access governance layer across services—without forcing a single policy engine or a greenfield rewrite."
"AI is remarkably good at producing things — blog posts, architecture diagrams, resumes, strategy documents, security proposals. Hand it a rough idea, and it will synthesize a draft faster than most teams can schedule a meeting. But that's where the honeymoon ends. After six months of intensive daily use building real deliverables — thought leadership papers, consulting proposals, career materials, and a personal AI agent security stack — I've learned that AI without workflow discipline is just a very fast way to produce unreliable output. It forgets context mid-project. It drifts from your intent. It confidently delivers wrong answers. It has no concept of version control, traceability, or iteration management. And it will happily lose everything you've built together if you don't have a system for capturing and organizing its output. None of this is new. These are the same challenges every technology faces when it moves from experimentation to production — and they have the same solutions. Process, governance, clear direction, and operational discipline. Drawing on decades of building technology programs for organizations ranging from startups to Fortune 500 enterprises, I applied the same programmatic thinking to my personal and small-business AI use that I would to an enterprise capability rollout — and discovered that one person with the right workflow can achieve what used to require teams and significant budgets. In this session, I'll share the practical framework I built, the mistakes I made getting there, and the security and governance considerations that most AI users never think about until something goes wrong."
"Imagine starting your first day on the job with a single clue: a five-second gap in the logs that absolutely shouldn’t exist. No flashy “zoom to enhance,” no instant answers—just you, a timestamp, and the question every forensicator lives for: What happened in the missing moment? This talk uses that small but mysterious anomaly to illustrate the real heart of digital forensics: quiet puzzles hidden inside ordinary data. From that opening mystery, we’ll transition into the practical realities of entering the field. Attendees will learn how people actually break into computer forensics and the skills that matter more than pedigree. We’ll examine the core personality traits that make someone effective in this career, including the ability to clearly communicate what the evidence does (and does not) prove. The session also sets realistic expectations for daily work in digital forensics. By the end, attendees will understand not only what it takes to become a forensicator, but what it feels like to think, work, and solve problems like one—no TV magic required, just skill, patience, and a passion for uncovering the truth hidden in the data."
"This session breaks down the key components of an effective incident response plan and explores how to avoid common pitfalls that undermine response efforts. We will look at why many plans fail in practice, what elements make a plan usable during a real incident, and how to maintain readiness through testing and improvement: • Why Incident Response Planning Matters • Core Components of an Effective Plan • Common Pitfalls and How to Avoid Them • Testing and Maintaining the Plan"
"So you're thinking about becoming a cyborg. It may or may not surprise you to learn that there are several of us around already, and while cybernetic enhancement can greatly improve our lives, it also has its downsides. Adaptive devices used by people with disabilities and medical conditions have been failing in unexpected ways for years, despite oversight from government bodies. Recreational implants, which are much less regulated, have even more scope for interesting bugs. On the other hand, while commercially available augments and implants require extensive testing and are almost always closed-source, it's possible to build and install your own - theoretically. How do we secure medical devices that constantly collect telemetry? How hard would it be for someone to skim the data on that NFC chip that you got implanted in your hand? And when we find flaws in these machines, how are we meant to fix them if they're already in our bodies? Whether you're interested in joining the human IoT network for recreational purposes, want to explore, code, and create implantable devices yourself, or have a medical need for augmentation, join me for this briefing to prepare for the security and privacy implications of connecting ourselves directly to the Internet."
"Everyone likes to talk about the latest and greatest security tools, but what if your target provides all the things you need? Living-off-the-land (LOTL) allows you to recon, pivot, and escalate using their own environment against them. Learn how knowing the basics (and knowing them well) can allow you to take your toolkit wherever you go. Some simple LOTL tools will be demonstrated. o WE'LL COVER: - Free online computing resources that can help learn more about the Linux operating system in readily-available environments (e.g. JSLinux running in your browser and the OneCompiler bash environment) - Free online reference materials (manpages, Wheeler's _Secure Programming HOWTO_, Garrel's _Bash Guide For Beginners_, Shotts' _The Linux Command Line_, etc.) - Demonstrate how ping and netcat can be used for reconnaissance - Demonstrate how scripting with ping and netcat can be used for ping sweeps and port scans, including some more advanced features, like introducing "jitter." - Demonstrate how environments like JSLinux provide network connectivity for those learning the basics to experiment. I will also emphasize ethics and caution when trying some of these things out by using yourself or scanme.nmap.org as a target. - The goal is to show that you don’t need a complex setup to safely and legally gain experience with Linux basics and LOTL--just a network connection, a browser, publicly available hosts to scan, some time, and ultimately, a desire to learn."
"Active Directory remains one of the fastest paths to full enterprise compromise, and attackers know it. Modern AD breaches rarely rely on a single “big exploit.” Instead, threat actors chain misconfigurations, delegated rights, and credential abuse into repeatable attack paths that quietly lead to Tier‑0 control. This talk breaks down the real‑world attack techniques used to compromise Active Directory today, including credential theft methods such as Kerberoasting, AS‑REP Roasting, password spraying, NTDS.dit extraction, and DCSync. It also examines common privilege escalation and persistence techniques, including Kerberos unconstrained delegation, Golden and Silver Tickets, AD CS abuse, SIDHistory injection, and identity trust exploitation. Attendees will leave with a practical understanding of how attackers move from initial access to full domain compromise, along with the “toxic combinations” of permissions and configurations that create hidden attack paths most defenders do not recognize until control is already lost."
Plain badge on the left, LED adorned badge to the right.
"What does a container do? What does it actually contain? Get back to basics and we will talk about containers from the ground up, practical uses for the aspiring security professional and maybe even learn a few new tricks."
"This talk explores a rare yet powerful Active Directory attack path that emerges from legacy DACL misconfigurations, recycled accounts, and residual object ownership. These overlooked conditions can silently reintroduce privileges even after apparent revocation, creating persistent escalation and access opportunities. We analyze how inherited permissions, transitive group memberships, and reanimated accounts from the AD Recycle Bin can combine to bypass conventional defenses. To address this, we developed a BloodHound integration that automatically detects, visualizes, and safely simulates these hidden paths, enabling defenders to identify and remediate dormant escalation routes before they can be abused."
"Since Macs have become more popular over the past 5+ years, malware targeting macOS has also been on the rise. And for iPhone users, commercial spyware has been becoming a more common headline, both in infosec news sources and the mainstream media. This talk is geared toward two main target audiences— - Rank beginners who want to learn about Apple security, even if you have no background in tech - Windows / Linux professionals who need to deal with these devices at work, but aren’t sure where to start HEADS UP! We will be digging into some technical topics along the way, but only after we cover enough fundamentals to help you stay afloat."
"A new threat report lands and it comes with 15 detection rules your team should deploy. But you don’t have unlimited engineering hours, and half of those rules target log sources you don’t even collect. So which ones do you actually implement? This talk uses a real case study — the Handala/Stryker wiper attack of March 2026 and the 15 Sigma rules published in response — to walk through a two-layer prioritization framework for narrowing a detection pack down to the rules worth shipping. Layer one is a Detection Severity Framework that scores each rule on potential impact and expected accuracy. Layer two is an environment validation check: do you have the logs, do you use the technology, and is this rule redundant with what you already have? By the end, 15 becomes 4, and every decision has a clear rationale behind it."
MTB Logo
Rich's logo.
Niagara University logo.
MetaCTF logo.
CACI Logo
St Bonaventure Cybersecurity logo.
Binary Defense logo.
Four soccer-style scarves with BSIDES BUFFALO woven into them.
Professor Farnsworth.
BSides Buffalo sponsorship on a little league softball jersey.
A blue and white soccer scarf with BSIDES BUFFALO printed on one side and HACK THE PLANET on the other.
The biggest nerd you've ever seen, standing behind a lectern wearing a blue and white scarf that says BSIDES KANSAS CITY
A backpack festooned with velcro patches.