BEGIN:VCALENDAR
PRODID:-//Google Inc//Google Calendar 70.9054//EN
VERSION:2.0
CALSCALE:GREGORIAN
METHOD:PUBLISH
X-WR-CALNAME:44CON 2026
X-WR-TIMEZONE:Europe/London
BEGIN:VEVENT
DTSTART:20260918T090000Z
DTEND:20260918T095000Z
DTSTAMP:20260731T102914Z
UID:0hfvbiqq1p51ab0ic9406h2346@google.com
CREATED:20260723T152545Z
DESCRIPTION:Digital assistants are no longer just tools. They are becoming 
 trusted intermediaries\, assisting us with everyday decisions and acting on
  our behalf. That trust is exactly what makes them dangerous - every intera
 ction with our digital assistants\, every task we delegate\, creates a brid
 ge an attacker can exploit. Attackers no longer need to reach their victims
  directly: the digital assistant becomes the intermediary\, a familiar inte
 rface turned into a channel for manipulation\, control\, and harm. Digital 
 assistants can speak naturally\, respond empathetically\, and craft persona
 lised\, context-aware attacks on demand. And they can act autonomously acro
 ss connected apps and services\, amplifying the consequences of a single us
 er approval far beyond what the victim ever anticipated.\n\nThis talk intro
 duces DAMSE (Digital Assistant-Mediated Social Engineering)\, the first fra
 mework to measure social engineering risk based on what a digital assistant
  can do. Conversational capabilities determine how likely a digital assista
 nt is to successfully manipulate the user\, while its agentic capabilities 
 determine the impact of the attack once manipulation succeeds. By evaluatin
 g these two sets of capabilities together\, DAMSE identifies the risk each 
 assistant poses and which capabilities drive that risk.\n\nWe apply DAMSE t
 o digital assistants like Alexa+ and OpenClaw\, revealing that the most per
 suasive assistant is not always the most dangerous. We also show that risk 
 can shift dramatically with user behaviour and system configuration alone\,
  even without any technological change. We finally demonstrate that\, becau
 se the assistant mediates the attack\, raising user awareness alone is no l
 onger sufficient: providers must also act on the digital assistant itself –
  shaping its conversational capabilities to limit the assistant's ability t
 o manipulate\, and limiting its agentic capabilities to ensure that\, even 
 if a user is deceived\, the damage remains bounded. DAMSE translates these 
 insights into action: it tells defenders which capabilities to prioritise\,
  and by how much.
LAST-MODIFIED:20260723T152545Z
LOCATION:Track 2
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:Trust\, Treachery\, and Your Digital Assistant - DAMSE: A New Frame
 work for Measuring Social Engineering Risk - Salvatore Gariuolo
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260917T182000Z
DTEND:20260917T182900Z
DTSTAMP:20260731T102914Z
UID:0q2m52j98vd20aua0i6ouj1kff@google.com
CREATED:20260624T131547Z
LAST-MODIFIED:20260624T131547Z
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:Doors re-open
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260917T135000Z
DTEND:20260917T144000Z
DTSTAMP:20260731T102914Z
UID:7io71slqhen77fjolrlrtnhd38@google.com
CREATED:20260624T102212Z
DESCRIPTION:One of the attractions of Kubernetes is being able to save m
 oney on cloud bills\, and what better way to save money that running everyt
 hing in one massive cluster with all our different teams (or customers) dep
 loying their applications in one place! Unfortunately once we’ve got our cl
 uster set-up we might end up singing the multi-tenant blues as it can be a 
 bit tricky to isolate our workloads properly.\r\rWe’re going to talk abo
 ut the different layers that make up a Kubernetes cluster and how the stack
  of different projects and re-use of older Linux primitives makes good mult
 i-tenant security hard to achieve. We’ll also look at some of the risks of 
 breakout from containers down to shared cluster nodes\, how the Kubernetes 
 authorization system has edge cases that can allow for privilege escalation
  and why the networking model implemented by Kubernetes does not lend itsel
 f to scenarios where hostile tenants are present\, especially as Kubernetes
  is SSRF as a service!\r\rWe’ll also look at a high-level at how these p
 roblems can be solved and the trade-offs of different approaches to improvi
 ng multi-tenant Kubernetes cluster security\, so that attendees can make in
 formed decisions on where they want to place the security boundaries in the
 ir Kubernetes environments.
LAST-MODIFIED:20260624T150846Z
LOCATION:Track 1
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:Kubernetes Multi-Tenant Blues – Rory McCune
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260917T095000Z
DTEND:20260917T101000Z
DTSTAMP:20260731T102914Z
UID:2t0pjm8qvp6kk3aojncqv9u1ii@google.com
CREATED:20260624T100912Z
LAST-MODIFIED:20260624T100912Z
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:Coffee & tea break
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260918T134000Z
DTEND:20260918T143000Z
DTSTAMP:20260731T102914Z
UID:2b2voje4hlspj1om7qf3l002dn@google.com
CREATED:20260624T145452Z
LAST-MODIFIED:20260731T102830Z
LOCATION:Track 2
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:tbc
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260918T090000Z
DTEND:20260918T095000Z
DTSTAMP:20260731T102914Z
UID:4apvugtg7ebvk24tli15n2trpg@google.com
CREATED:20260624T132231Z
DESCRIPTION:Modern Endpoint Detection and Response (EDR) solutions live and
  die by kernel callbacks like PsSetCreateProcessNotifyRoutine. Windows kern
 el actively defends these critical APIs. If you attempt to register a callb
 ack from an unbacked driver\, the kernel blocks the request with STATUS_ACC
 ESS_DENIED\, utilizing MmVerifyCallbackFunctionCheckFlags to validate the c
 aller's legitimacy.\r\rThis talk introduces a novel\, post-exploitation
  Direct Kernel Object Manipulation (DKOM) technique that completely bypasse
 s these internal caller validations.\r\rWe will dive deep into the Wind
 ows memory manager to expose the undocumented mechanics behind MiLockLoaded
 DataTableEntry and MmFindDataTableEntryByAddress. Crucially\, we will revea
 l the structure of a completely undocumented AVL tree (assumed to be MmLoad
 edModuleTree) which lacks PDB documentation and hides as anonymous QWORDs i
 n memory. By reverse-engineering the nodes of this tree\, we can successful
 ly bridge the gap of undocumented kernel data and manually satisfy the OS's
  caller checks.\r\rThe result is the ability to subscribe an unbacked\,
  manually mapped driver to process creation and termination callbacks witho
 ut compromising the OS security posture. This technique operates cleanly on
  fully patched Windows 11 systems with all modern mitigations including Hyp
 ervisor-Enforced Code Integrity (HVCI) and Virtualization-Based Security (V
 BS) fully enabled. Attendees will see exactly how to turn a manually mapped
  driver into an invisible interceptor.\n\nDocumentation can be found at
 https://arth.imbeddex.com/Kernel_stuff/Windows/Kern
 el%20Callback%20Integrity%20Bypass/
LAST-MODIFIED:20260723T152448Z
LOCATION:Track 1
SEQUENCE:1
STATUS:CONFIRMED
SUMMARY:Reversing Undocumented AVL Trees to Bypass Kernel Callback Integrit
 y – Arth Maurya
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260918T125000Z
DTEND:20260918T134000Z
DTSTAMP:20260731T102914Z
UID:78jiq8jm66d9du5fp4mcvhmk5s@google.com
CREATED:20260624T145005Z
DESCRIPTION:This talk takes attendees inside the first 24 hours of a recent
  ransomware incident affecting a multinational factory environment. Rather 
 than presenting a generic ransomware checklist\, it follows an anonymized r
 eal response: what was discovered first\, what decisions had to be made und
 er pressure\, what could not be trusted\, and how recovery was planned with
 out creating a second compromise. This talk is based on a real ransomware i
 ncident that I personally responded to\, with all client-identifying detail
 s anonymized.\n\nThe session walks through the responder workflow from init
 ial triage to early recovery: understanding production impact\, preserving 
 evidence\, scoping identity and infrastructure compromise\, containing atta
 cker access\, validating backups\, deciding what systems to restore first\,
  and communicating recovery options to leadership.\n\nThe talk focuses on p
 ractical lessons from live ransomware response\, including mistakes that co
 mmonly increase downtime: premature shutdowns\, incomplete identity contain
 ment\, restoring from unvalidated backups\, overlooking remote access tooli
 ng\, and bringing systems online before trust has been rebuilt.\n\nA short 
 hands-on defensive demo will show how the case study methodology can be app
 lied to a simulated ransomware recovery scenario\, including backup trust a
 ssessment\, clean-room restore planning\, and post-restore compromise check
 s.\nAttendees will leave with a practical first-day ransomware response and
  recovery framework they can adapt to their own environments.
LAST-MODIFIED:20260721T110141Z
LOCATION:Track 1
SEQUENCE:1
STATUS:CONFIRMED
SUMMARY:Inside the First 24 Hours of a Ransomware Incident – Johnny Chiu
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260917T080000Z
DTEND:20260917T080900Z
DTSTAMP:20260731T102914Z
UID:0urhbvocim9jmr30n2n7n1j2h7@google.com
CREATED:20260624T101028Z
LAST-MODIFIED:20260624T144804Z
LOCATION:Track 1
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:44CON 2026 Opening
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260917T183000Z
DTEND:20260917T220000Z
DTSTAMP:20260731T102914Z
UID:3engp1ch9s1ak899f2vrf8a66a@google.com
CREATED:20260624T131740Z
LAST-MODIFIED:20260721T105958Z
LOCATION:Track 1
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:44CON 2026 Pub Quiz by 1Password & EPSD
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260917T115000Z
DTEND:20260917T130000Z
DTSTAMP:20260731T102914Z
UID:35mdq5vdufh0t3kag2co39fgra@google.com
CREATED:20260624T100949Z
LAST-MODIFIED:20260624T100949Z
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:Lunch
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260918T095000Z
DTEND:20260918T101000Z
DTSTAMP:20260731T102914Z
UID:5gu8id1d38jtoe8msf7jnlburl@google.com
CREATED:20260624T145020Z
LAST-MODIFIED:20260624T145021Z
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:Coffee & tea break
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260918T101000Z
DTEND:20260918T110000Z
DTSTAMP:20260810T150459Z
UID:3nv92f0osis3bdl6b272q7kic8@google.com
CREATED:20260624T102643Z
DESCRIPTION:When assessing the cryptographic security of algorithms\, we
  tend to use the description provided by the author.\r\rHowever it is not t
 he only possible description and there as a few cases where the official de
 scription of an encryption algorithm was not the most suitable one and serv
 ed in reality to hide some weaknesses actually.\r\rBased on former expe
 rience and analyses\, this talk propose a new approach in cryptanalysis bas
 ed on an evolution of the concept of Combinatorial Equivalence. The aim is 
 to rewrite a cryptosystem under a combinatorially equivalent form in order 
 to make appear new properties that are more strongly discriminating the sec
 ret key used during encryption.\r\rWe successfully applied this approa
 ch to the most secure stream ciphers category nowadays but also on block ci
 phers. 

We first define a concept cipher called Cipherbent6 that capture
  most of the difficulty of stream cipher cryptanalysis.\r\rWe significantl
 y outperformed all known cryptanalysis. We applied this approach to the Ach
 terbahn cipher and we obtained again far better cryptanalysis results. Fina
 lly when applying this approach to the most critical cryptographic primitiv
 es of block ciphers we have found such stronger biases that the original al
 gorithm description did not expose.
LAST-MODIFIED:20260624T150904Z
LOCATION:Track 1
SEQUENCE:1
STATUS:CONFIRMED
SUMMARY:A New Approach in Cryptanalysis Through Combinatorial Equivalence o
 f Cryptosystems – Eric Filiol\, Jaagup Sepp
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260917T101000Z
DTEND:20260917T110000Z
DTSTAMP:20260731T102914Z
UID:3i15k1ee12v3sttijcni690t0d@google.com
CREATED:20260624T101935Z
DESCRIPTION:As the Linux kernel evolves with enhanced security features\, i
 ncreases deprecation of various symbols (e.g. system call table) and featur
 es (e.g. disabling memory protection)\; and security monitoring evolves wit
 h deeper visibility into the internals\, traditional rookit methods do not 
 work on modern systems. To remain invisible\, modern offensive tooling must
  move beyond simple hooking and embrace more sophisticated stealth mechanis
 ms. This talk explores kernel-mode stealth mechanisms for modern Linux kern
 els enabling us to hide our traces from user-mode.
LAST-MODIFIED:20260721T104234Z
LOCATION:Track 1
SEQUENCE:1
STATUS:CONFIRMED
SUMMARY:Lord Of The Ring 0 – Adhokshaj Mishra
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260917T090000Z
DTEND:20260917T095000Z
DTSTAMP:20260731T102914Z
UID:6opoihhe6c0r1p08thvsej5mko@google.com
CREATED:20260624T101230Z
DESCRIPTION:MCP SDKs have moved fast. They were adopted widely and rapidly 
 - and quietly became the trusted identity brokers inside build systems\, CI
  pipelines\, and release automation.\nAnd that inherent trust is rarely que
 stioned.\n\nUntil it's abused.\n\nIn this talk we'll present a real world a
 ttack path against Anthropic's AI Model Context Protocol SDK where default 
 OAuth and browser security assumptions enable silent developer token theft.
  No memory corruption. No zero day. Just permissive configuration choices t
 hat turn convenience into a supply chain primitive.\n\nBy abusing cross ori
 gin OAuth endpoints and unvalidated redirect handling\, a malicious website
  can steal a fully privileged developer token from a logged in engineer wit
 h a single page visit. From there\, the attacker gains access to source rep
 ositories\, CI pipelines\, and automated signing workflows that treat the s
 tolen identity as legitimate\n.\nThe result is a clean supply chain comprom
 ise. Malicious code is committed\, built\, signed\, and distributed through
  trusted update channels without triggering traditional security controls. 
 And the irony is - everything works exactly as designed.\n\nThis session wa
 lks through the full exploit chain from browser based token exfiltration to
  signed artifact distribution. It connects modern AI tooling\, agent driven
  automation\, and OAuth trust boundaries into a single attack surface that 
 many organizations are already running in production.
LAST-MODIFIED:20260721T104051Z
LOCATION:Track 1
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:Poisoned by Design: MCP SDK Enabled OAuth Token Theft – Avidan Avra
 m
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260918T161000Z
DTEND:20260918T170000Z
DTSTAMP:20260731T102914Z
UID:4brsa0ud91mf7qtvsupplc75bh@google.com
CREATED:20260624T145709Z
LAST-MODIFIED:20260724T143537Z
LOCATION:Track 1
SEQUENCE:1
STATUS:CONFIRMED
SUMMARY:Closing tea break
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260918T081000Z
DTEND:20260918T090000Z
DTSTAMP:20260731T102914Z
UID:0rrog1kvs6e71obl0o5fvvfsm5@google.com
CREATED:20260624T144829Z
LAST-MODIFIED:20260624T150445Z
LOCATION:Track 1
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:tbc
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260918T115000Z
DTEND:20260918T125000Z
DTSTAMP:20260731T102914Z
UID:3hd2h1ohjkt9vop8dqgi85nd8p@google.com
CREATED:20260624T145150Z
LAST-MODIFIED:20260624T145150Z
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:Lunch
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260917T110000Z
DTEND:20260917T115000Z
DTSTAMP:20260731T102914Z
UID:38ne3evt67m0a8cdt3tte808jr@google.com
CREATED:20260624T132514Z
DESCRIPTION:Thin clients are deployed across healthcare\, finance\, gove
 rnment and critical infrastructure\, environments where full disk encryptio
 n is a compliance requirement\, not optional. Dell\, IGEL and HP all ship F
 DE backed by TPM hardware and modern cryptography. I broke all three.\r\rI present new research demonstrating vulnerabilities that permit full dis
 k encryption bypass across Dell ThinOS 9.x - 10.x\, HP ThinPro 8.x - 9.x\, 
 and IGEL 12. Four operating systems\, every attack achieving filesystem acc
 ess from a powered-off device with no credentials and no specialist hardwar
 e. What's behind the encryption matters: WiFi credentials\, 802.1x NAC clie
 nt certificates\, VDI session configs\, management server credentials\, and
  password hashes. Compromised devices yield network credentials and a footh
 old into the infrastructure it was connected to. I trace Dell's implementat
 ion across three generations getting progressively further from best practi
 ce\, show IGEL's correct PCR policy and modern cryptography bypassed throug
 h their own signed bootloader\, and demonstrate HP's implementation undone 
 by an unmeasured initramfs.
LAST-MODIFIED:20260721T105735Z
LOCATION:Track 2
SEQUENCE:1
STATUS:CONFIRMED
SUMMARY:Thin Client? Thin Crypto – Darren McDonald
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260918T143000Z
DTEND:20260918T152000Z
DTSTAMP:20260731T102914Z
UID:5soh2imlambbtr4oup46gv4r83@google.com
CREATED:20260724T143740Z
LAST-MODIFIED:20260724T143740Z
LOCATION:Track 1
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:Closing Keynote – G Mark Hardy
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260918T101000Z
DTEND:20260918T110000Z
DTSTAMP:20260901T144157Z
UID:03tfpahhfl8u6vt5melinu55q5@google.com
CREATED:20260901T143222Z
DESCRIPTION:AI is becoming a trusted adviser in cybersecurity – prioriti
 sing vulnerabilities\, mapping attack paths\, recommending fixes. But would
  you trust it to look after your dog? Most people say no: not because AI is
 n’t smart\, but because it lacks context.\r\rCybersecurity has the same 
 problem\, on both sides now that attackers use AI too. Attack path tools ar
 e only as good as their data – miss the network configs\, firewall rules\, 
 and segmentation controls\, and a “clean” result can hide a real path in.\r\rWe won’t just tell you. We’ll show you: live on stage\, we’ll take a “
 clean” environment and break it using nothing but its own configuration fil
 es.
LAST-MODIFIED:20260901T143222Z
LOCATION:Track 1
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:Would You Let AI Look After Your Dog? What attack paths teach us ab
 out trust\, visibility\, and exposure – Andrew Woodford
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260918T110000Z
DTEND:20260918T115000Z
DTSTAMP:20260901T143707Z
UID:2b2so2982dgm819ldlbqppl4mo@google.com
CREATED:20260624T145232Z
DESCRIPTION:\nShadow IT is undergoing a looming change. It's always represe
 nted a hulking attack surface\, with unattended and forgotten detritus\, bu
 t thanks to the push from AI\, it's also metastasized throughout the organi
 zation\, co-opting victims everywhere. We're looking at a potential busines
 s and cultural invasion that we're only now beginning to grasp. In this ses
 sion we'll discuss just how many silver bullets\, stakes\, torches\, pitchf
 orks\, and other weapons are necessary to fight this scourge -- or whether 
 we should just surrender to it.
LAST-MODIFIED:20260901T142641Z
LOCATION:Track 1
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:Friday Keynote: What We Do In the Shadows: An IT Story – Wendy Nath
 er
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260918T081000Z
DTEND:20260918T090000Z
DTSTAMP:20260804T104820Z
UID:6e4jvr6i7ila7c9v858mjrpijg@google.com
CREATED:20260624T150033Z
DESCRIPTION:*Workshop: Automating Attack TTPs for Fun*\n\nThis hands-
 on workshop explores basic attack automation techniques targeting Linux\, c
 ontainer and Kubernetes platforms. Participants will learn basic automation
  techniques using combination of scripting and programming. The workshop wi
 ll cover a range of TTPs commonly used by TeamTNT\, which has mostly target
 ed cloud and containerized environments.\n\n*Tools*\n1. Laptop with Ubuntu LTS (either host or
  VM)\n  - Host: minimum 16GB RAM\n  - VM: minimum 8GB RAM (headless mo
 de)\n2. Development tools and libraries (gcc\, g++. Gdb\, mak
 e\, make etc.)\n3. Optional: IDE (anything works)\n4. Mobile hotspo
 t / internet: to download shared resources\, packages\, lab materials\n\n*Knowledge*\n1. Prior programing experience (ideally in C++ o
 r C)\, enough to read and understand code\n2. Prior experience in shell
  scripting\n3. Prior debugging exp
 erience\n4. Foundations in Linux\, containers\, and Kubernetes
LAST-MODIFIED:20260731T104951Z
LOCATION:Workshop
SEQUENCE:1
STATUS:CONFIRMED
SUMMARY:Automating Attack TTPs for Fun – Adh
 okshaj Mishra
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260918T090000Z
DTEND:20260918T095000Z
DTSTAMP:20260804T104820Z
UID:19pkspg0147jlus9fovl8i22b9@google.com
CREATED:20260804T102941Z
DESCRIPTION:*Workshop: Defense Evasion f
 or Red Team*\n\nThis hands-on workshop covers various defense evasion te
 chniques targeting Linux platform. Participants will learn basics of securi
 ty monitoring\, telemetry collection\, and threat detection in Linux\; as w
 ell as deep dive into various evasion strategies targeting different securi
 ty monitoring mechanism. Participants will gain hands-on experience on evas
 ion from scanning\, process monitoring\, file integrity monitoring\, as wel
 l as hiding presence of their own payloads in the target system.\n\n*Pre
 requisites*\n\n*Tools*\n1. Laptop with Ubuntu LTS (either host or
  VM)\n  - Host: minimum 16GB RAM\n  - VM: minimum 8GB RAM (headless mo
 de)\n2. Development tools and libraries (gcc\, g++. Gdb\, mak
 e\, make etc.)\n3. Optional: IDE (anything works)\n4. Mobile hotspo
 t / internet: to download shared resources\, packages\, lab materials\n\n*Knowledge*\n1. Prior programing experience (ideally in C++ o
 r C)\, enough to read and understand code\n\n2. Prior debugging exp
 erience\n3. Foundations in Linux\, containers\, and Kubernetes
LAST-MODIFIED:20260731T104951Z
LOCATION:Workshop
SEQUENCE:1
STATUS:CONFIRMED
SUMMARY:Defense Evasion for Red Team – Adh
 okshaj Mishra
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260917T130000Z
DTEND:20260917T135000Z
DTSTAMP:20260731T102914Z
UID:5os76fioa7blq9i2td6pdlm1mo@google.com
CREATED:20260724T143136Z
DESCRIPTION:Most defences for agents sit at the edges: input filters\, g
 uardrails\, output classifiers\, system prompts hardened against the last j
 ailbreak someone posted on Discord. Nobody is watching what the agent is ac
 tually thinking.\n\nOpenAI and DeepMind set out to test this. Their thesis:
  monitoring an agent’s chain of thought catches misbehaviour that monitorin
 g its actions (tool calls\, API usage\, etc.) alone cannot. When you watch 
 what an agent is thinking rather than just what it does\, a whole category 
 of nuanced compromise becomes visible: indirect prompt injection\, tool poi
 soning\, goal drift\, subtle exfiltration patterns dressed up as legitimate
  tool use. Their thesis was right – the research found that it improve dete
 ction accuracy by 35% and was 4x more likely to catch nuanced attacks.\n\nMax Corbridge\, ethical hacker and red teamer\, turned that research into
  the first open-source runtime security monitoring system for agents\, watc
 hing not just what an agent does but what it’s reasoning about while it doe
 s it. This talk covers the attack surface\, what edge defences miss\, and i
 ncludes live demos of Adrian (the OSS detection system https://github.com/secureagentics/Adrian
 ) catching and stopping real attacks against production agents.
LAST-MODIFIED:20260724T143136Z
LOCATION:Track 1
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:The Agent's Inner Monologue: Catching Compromise in the Reasoning T
 race – Max Corbridge
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260918T134000Z
DTEND:20260918T143000Z
DTSTAMP:20260902T152715Z
UID:2b2voje4hlspj1om7qf3l002dn@google.com
CREATED:20260624T145452Z
DESCRIPTION:BPF programs don’t nest\; i.e. they don’t get suspended so t
 hat another program can run at a higher priority. That’s what the documenta
 tion said\, and it’s true for a lot of cases. But if you are using BPF CGro
 upSKB programs to access/inspect/analyse packets\, then this doesn’t apply.
  I will explain why nesting is preferred in these cases\, will describe the
  assumptions that fail\, and the mess that can result for a BPF-based EDR. 
 Packet storms are back\, but for more interesting reasons.\r\rFor backgr
 ound\, packets/datagrams can be hooked with XDP\, TC/TCX\, and CGroupSKB BP
 F programs – I will explain in the talk why we wouldn’t use or recommend ot
 her hooks or types of programs for this. Of these\, only CGroupSKB hooks\, 
 however\, are high enough up the stack to allow datagrams to be easily link
 ed to processes\, making them the obvious choice for BPF-based EDRs.\r\r
 Come with me on a journey through kernel sources to see what dragons need t
 o be slayed. I’ll conclude with tips for analysis and methods to avoid the 
 race conditions.\r\rIt’s a talk for the blue team\, that the red team mi
 ght want to know about.
LAST-MODIFIED:20260902T152627Z
LOCATION:Track 2
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:BPF\, Nesting\, And You – Concurrency Issues Your EDR Might Not Kno
 w It Has – Kev Sheldrake
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260918T152000Z
DTEND:20260918T161000Z
DTSTAMP:20260731T102914Z
UID:46qgb80e128fuqebiba53inhht@google.com
CREATED:20260624T145610Z
LAST-MODIFIED:20260724T143754Z
LOCATION:Track 1
SEQUENCE:6
STATUS:CONFIRMED
SUMMARY:CLOSE – Closing and prize giveaways
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260918T080500Z
DTEND:20260918T080900Z
DTSTAMP:20260731T102914Z
UID:0g40i99pk06aj69b7re1ge03bm@google.com
CREATED:20260624T144751Z
LAST-MODIFIED:20260624T144751Z
LOCATION:Track 1
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:44CON 2026 Day 2 Opening
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260917T130000Z
DTEND:20260917T144000Z
DTSTAMP:20260731T102914Z
UID:0e4np23bj7kc8c7qvn0abh8c1j@google.com
CREATED:20260624T132835Z
DESCRIPTION:This workshop follows Axelle’s talk.\n\nIn this workshop\
 , the audience learns how to setup binary disassembly with AI. The workshop
  consists of a collection of CrackMe or CTF binaries to reverse.\n\nPartici
 pants learn to setup OpenCode\, MCPs for Ghidra and Radare2. They experienc
 e with permissions\, creation of agents and skills for reverse engineering.
  The workshop is tailored to be used with free API keys from various provid
 ers. The results are even better if participants can afford a paid subscrip
 tion\, but it is not mandatory.\n\n*REQUIREMENTS*\n\n- Part
 icipants should have basic knowledge of assembly (what’s an instruction\, r
 egisters….) and be at ease with installing tools on their laptops.\n- 
 Ideally\, it’s better if participants have already used a disassembler or a
  decompiler once in their life before\,\n\nbut they do not need to expert r
 everse engineers at all.\n- Access to Internet is necessary for this w
 orkshop.
LAST-MODIFIED:20260625T135933Z
LOCATION:Workshop
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:Reversing with AI – Axelle Apvrille
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260917T110000Z
DTEND:20260917T115000Z
DTSTAMP:20260731T102914Z
UID:0s2ddluef7kl5h6lmjaeh4cm9r@google.com
CREATED:20260624T101521Z
DESCRIPTION:GoGra is an interesting backdoor family which emerged in 202
 4\, mostly targeting India and Afghanistan.\n\nIn April 2026\, its develope
 rs released a Linux variant with several smart mechanisms: an implant hidde
 n in the dropper ELF binary\, abuse of the Microsoft Graph API as an email-
 based dead-drop C2.\n\nIn this talk\, we detail the interesting function
 alities of GoGra (e.g how the implant is hidden\, how emails are encrypted)
 \, but also how we performed the reverse engineering. Indeed\, as the name 
 suggests\, GoGra is implemented in Go.\n\nMalware analysis of stripped Go b
 inaries is known to be painful: numerous unnamed functions\, presence of ru
 ntime and library code\, wrappers\, specific ABI conventions which confuse 
 disassemblers etc.\n\nConsequently\, we assisted our reverse engineering
  with AI\, with a setup of OpenCode\, Ghidra MCP and specific agents and sk
 ills. The good (?) news is that this is not a "single-click analysis" where
  the AI does all the work and we just sit and look. We have to guide LLMs t
 o answer our questions. For example\, I provided a "crash course" at revers
 ing Go to the LLM\, and working from that it was able to generate a useful 
 Ghidra script to parse the pclntab (this is a table which maps instruction 
 addresses to function names).\n\nThe talk continues with a workshop on "
 Reverse engineering with AI"\, where the audience learns how to setup binar
 y disassembly with AI. The workshop consists of a collection of CrackMe or 
 CTF binaries to reverse.\n\nParticipants learn to setup OpenCode\, MCPs for
  Ghidra and Radare2. They experience with permissions\, creation of agents 
 and skills for reverse engineering. The workshop is tailored to be used wit
 h free API keys from various providers. The results are even better if part
 icipants can afford a paid subscription\, but it is not mandatory.
LAST-MODIFIED:20260721T104216Z
LOCATION:Track 1
SEQUENCE:1
STATUS:CONFIRMED
SUMMARY:Inside Linux GoGra backdoor – Axelle Apvrille
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260917T130000Z
DTEND:20260917T135000Z
DTSTAMP:20260731T102914Z
UID:4ukhrogdcp6oud7ngf2smtu562@google.com
CREATED:20260624T132404Z
DESCRIPTION:Enterprise AI applications rarely expose OpenAI-compatible A
 PIs\, leaving pentesters with a choice: test manually or build custom tooli
 ng. During an engagement against a RAG-powered conversational assistant\, w
 e encountered a four-step API flow\, session creation\, query submission\, 
 completion polling\, and structured response retrieval\, that no existing p
 romptfoo provider could handle.\n\nThis talk walks through building a c
 ustom JavaScript provider that owns the full request lifecycle\, enabling a
 utomated red teaming with promptfoo's extensive plugin library. We cover: r
 everse-engineering the target's non-standard API\; implementing stateful se
 ssion management for multi-turn attack strategies like Crescendo\; routing 
 traffic through Burp Suite with raw socket connections for reliable token r
 efresh via the ATOR extension\; and using a locally-hosted Llama 3.3 70B mo
 del for both attack generation and automated grading\, keeping all client d
 ata off external APIs.\n\nWe demonstrate how combining 12+ red team plu
 gins (including RAG-specific attacks like document exfiltration and source 
 poisoning) with encoding strategies and multi-turn escalation uncovered vul
 nerabilities that single-shot manual testing would have missed. We also sha
 re the limitations: what promptfoo found at the LLM layer versus what still
  required manual testing at the application layer (IDOR\, authorization byp
 asses\, system prompt extraction).\n\nAttendees will leave with a reusa
 ble methodology for adapting promptfoo to any non-standard LLM API\, practi
 cal guidance on plugin and strategy selection\, and an understanding of whe
 n automated LLM red teaming adds value\, and when it doesn't.
LAST-MODIFIED:20260721T105811Z
LOCATION:Track 2
SEQUENCE:1
STATUS:CONFIRMED
SUMMARY:Red Teaming LLM Web Apps with Promptfoo: Building a Custom Provider
  for Real-World Pentesting – Adrian Tiron
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260917T155000Z
DTEND:20260917T164000Z
DTSTAMP:20260901T144157Z
UID:6fd5f9asvssh3oqfktqb26isfn@google.com
CREATED:20260624T145103Z
DESCRIPTION:One of the great things about Windows is it’s sufficiently comp
 lex to harbour multiple bugs that never quite meet the bar for a fix\, but 
 still have their uses when chaining vulnerabilities together. This talk wil
 l go through a few recent vulnerabilities that I’ve found in my research\, 
 ranging from a novel PPL injection technique\, service account privilege es
 calation without impersonation privileges and funky abuse of Windows regist
 ry features to change process behaviors. You can take these techniques away
  and maybe find a use for them in your own testing.
LAST-MODIFIED:20260901T144140Z
LOCATION:Track 1
SEQUENCE:1
STATUS:CONFIRMED
SUMMARY:A Windows Smorgasbord – James Forshaw
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260917T073000Z
DTEND:20260917T080000Z
DTSTAMP:20260731T102914Z
UID:1s0tmqutbo0t3jvl73bo292kg6@google.com
CREATED:20260624T100658Z
LAST-MODIFIED:20260624T100658Z
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:Doors Open
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260917T101000Z
DTEND:20260917T110000Z
DTSTAMP:20260731T102914Z
UID:3b08mfr9f51nh050ko7ophevd7@google.com
CREATED:20260624T131934Z
DESCRIPTION:Forget prompt injection. While the industry obsesses over ma
 nipulating model inputs to bypass guardrails\, it is overlooking a far more
  dangerous threat requiring no user interaction beyond opening the applicat
 ion embedded beneath the AI itself: the underlying platform architecture.\n\nTo deliver on the promise of full autonomy\, AI-powered coding environ
 ments wire Large Language Models directly into the developer workflow—handi
 ng them local filesystem access\, shell execution\, and cloud credentials. 
 Developers accept this tradeoff for the massive productivity gains\, but th
 e security cost is severe.\n\nIn these environments\, privileged OS acce
 ss is not a misconfiguration but a product requirement. For a chat interfac
 e to truly become an autonomous “agent\,” it must be equipped with tools. E
 quipping the AI with these tools creates a structural conflict with traditi
 onal application isolation\, like Electron’s security model. To make the AI
  function\, developers are forced to break the sandbox and expose highly pe
 rmissive IPC (Inter-Process Communication) bridges between the web renderer
  and the local operating system.\n\nThis presentation provides a technic
 al deep dive into how chained IDOR vulnerabilities can be escalated into ze
 ro-click RCE via persistent LLM conversation injection and unsafe Electron 
 IPC designs. To prove the real-world impact\, we will debut novel research 
 into Orchids\, a leading local\, Electron-based AI coding IDE with over a m
 illion users\, reported to be used by teams at firms including Google\, Ama
 zon\, and Uber.\n\nBy weaponizing the IDE’s automated context ingestion\
 , we turn the platform’s own features into a silent backdoor\, achieving fu
 ll remote system takeover with no user interaction beyond opening the appli
 cation.\n\nAttendees will leave this session with a practical understand
 ing of this emerging attack surface\, a live demonstration of the zero-clic
 k exploit chain\, and actionable defensive design patterns for safely archi
 tecting the next generation of AI-enabled desktop applications.
LAST-MODIFIED:20260624T131935Z
LOCATION:Track 2
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:VibeShell: How Trusting Your AI IDE Costs You Your Machine – Etizaz
  Mohsin
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260918T125000Z
DTEND:20260918T143000Z
DTSTAMP:20260731T102914Z
UID:33v87ol2v8cfrfb6f4d8g1rjds@google.com
CREATED:20260624T150013Z
DESCRIPTION:The implementation of cryptology is a complex domain\, and many
  cryptographic security issues lie at the implementation level. Insecure im
 plementations may lead to cryptographic flaws even in the most cryptographi
 cally secure algorithms. An intentionally poor implementation can also be u
 sed to conceal cryptographic backdoors.\n\nThis workshop is designed to
  teach how to avoid pitfalls when implementing cryptography and detect a fe
 w bad implementations. It does not cover the case of mathematical backdoors
  (such as DUAL ECC_RBG case) which is a far more complex domain.\n\nEac
 h main type of vulnerability (or backdoor) is presented followed by the pre
 sentation and explanations on how to exploit the identified vulnerability a
 nd how to do a secure implementation.\n\nMost of the cases presented ar
 e taken from real cases\, some of which will be presented later.\n\nThe
  workshop is part of a certification program in cryptography and networks f
 or Thales Group engineers. Moreover\, an undergraduate textbook dedicated t
 o this topic is scheduled for publication in early 2027 by Springer Verlag.
 \n\nThis workshop teaches how to implement cryptography securely and addres
 s the main security flaws encountered in the wild\, as well as how they cou
 ld have been exploited. Insights into backdoors are also provided through s
 ource code analysis.\n\n*Target audience and Prerequisites*\nPar
 ticipants are expected to have a relatively good command of C programming a
 nd to know the basic principles of cryptography and of secure programming.\
 n\n*Technical requirements*\nIn case participants would like to 
 test some of the code presented during the workshop\, a laptop running Linu
 x with GCC and the GMP library installed is necessary.
LAST-MODIFIED:20260626T083524Z
LOCATION:Workshop
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:Implementing Secure Cryptography – Avoid and detect flaws and backd
 oors – Eric Filiol
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260917T081000Z
DTEND:20260917T090000Z
DTSTAMP:20260731T102914Z
UID:4ue2mt5f54hl3o226uq9jrcrs5@google.com
CREATED:20260624T101125Z
LAST-MODIFIED:20260624T101413Z
LOCATION:Track 1
SEQUENCE:1
STATUS:CONFIRMED
SUMMARY:Opening Keynote – James Forshaw
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260917T150000Z
DTEND:20260917T155000Z
DTSTAMP:20260731T102914Z
UID:42rnal9tj58qp8uv3d00t20b27@google.com
CREATED:20260624T102416Z
DESCRIPTION:Before I was a security engineer\, I built market-making eng
 ines and low-latency trading systems in C++. Order management\, execution r
 outing\, exchange connectivity\, all running in environments where a micros
 econd of latency or a single mishandled edge case could cost real money in 
 real time.\n\nThat background broke my brain in ways that turned out
  to be useful for security. When you have spent years thinking about race c
 onditions\, memory layout\, state machines under adversarial conditions (th
 e market is adversarial)\, and systems that must never fail silently\, you 
 see attack surfaces and defensive gaps that most security engineers walk pa
 st.\n\nThis talk covers the specific lessons from building trading infrastr
 ucture that changed how I approach security engineering: how thinking about
  latency-sensitive systems reveals timing-based attack surfaces that scanne
 rs will never find\; why financial systems' approach to state management an
 d auditability is a better model for security logging than what most SOCs a
 ctually deploy\; how exchange protocol design (FIX\, binary protocols\, cus
 tom wire formats) teaches you more about parsing vulnerabilities than any w
 eb app pen test\; and why the failure modes of high-frequency systems map d
 irectly onto the failure modes of security automation at scale.\n\nT
 his is not a finance talk. This is a talk about what happens when someone t
 rained to think in microseconds and failure modes starts looking at your in
 frastructure with an attacker's mindset and a systems programmer's understa
 nding of what is actually happening at the metal.
LAST-MODIFIED:20260624T150927Z
LOCATION:Track 1
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:What Trading Systems Taught Me About Breaking (and Defending) Produ
 ction Infrastructure – Mert Satilmaz
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260918T125000Z
DTEND:20260918T134000Z
DTSTAMP:20260731T102914Z
UID:4i41bru8kt5shsaguup3gfsu4q@google.com
CREATED:20260624T150631Z
LAST-MODIFIED:20260731T102732Z
LOCATION:Track 2
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:Avidan Avram - Poisoned by Design: MCP SDK Enabled OAuth Token Thef
 t (Workshop)
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260918T134000Z
DTEND:20260918T143000Z
DTSTAMP:20260731T102914Z
UID:48mtg4sbdub5vvoc7hfhr8mufg@google.com
CREATED:20260624T132115Z
DESCRIPTION:
LAST-MODIFIED:20260731T102821Z
LOCATION:Track 1
SEQUENCE:2
STATUS:CONFIRMED
SUMMARY:The Wrong Trousers Problem: Supervising Agentic Cyber Engineers – C
 hris Cooper
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260917T150000Z
DTEND:20260917T164000Z
DTSTAMP:20260731T102914Z
UID:3sncqjt3neu04gpk1ikgt8q8hq@google.com
CREATED:20260724T143256Z
DESCRIPTION:The implementation of cryptology is a complex domain\, and m
 any cryptographic security issues lie at the implementation level. Insecure
  implementations may lead to cryptographic flaws even in the most cryptogra
 phically secure algorithms. An intentionally poor implementation can also b
 e used to conceal cryptographic backdoors.\n\nThis workshop is designed to 
 teach how to avoid pitfalls when implementing cryptography and detect a few
  bad implementations. It does not cover the case of mathematical backdoors 
 (such as DUAL ECC_RBG case) which is a far more complex domain.\n\nEach mai
 n type of vulnerability (or backdoor) is presented followed by the presenta
 tion and explanations on how to exploit the identified vulnerability and ho
 w to do a secure implementation.\n\nMost of the cases presented are taken f
 rom real cases\, some of which will be presented later.\n\nThe workshop is 
 part of a certification program in cryptography and networks for Thales Gro
 up engineers. Moreover\, an undergraduate textbook dedicated to this topic 
 is scheduled for publication in early 2027 by Springer Verlag.\n\nThis work
 shop teaches how to implement cryptography securely and address the main se
 curity flaws encountered in the wild\, as well as how they could have been 
 exploited. Insights into backdoors are also provided through source code an
 alysis.\n\n*Target audience and Prerequisites*\nParticipants are ex
 pected to have a relatively good command of C programming and to know the b
 asic principles of\n\ncryptography and of secure programming.\n\n*Techni
 cal requirements*\nIn case participants would like to test some of the
  code presented during the workshop\, a laptop running Linux with
GCC and the GMP library installed is necessary.
LAST-MODIFIED:20260724T143312Z
LOCATION:Track 2
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:The Agent's Inner Monologue: Catching Compromise in the Reasoning T
 race (Workshop) – Max Corbridge, Sunny Chau
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260918T073000Z
DTEND:20260918T080000Z
DTSTAMP:20260731T102914Z
UID:1rsvbpclnoebj4sq35bumuhfu2@google.com
CREATED:20260624T144707Z
LAST-MODIFIED:20260624T144708Z
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:Doors Open
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260917T070000Z
DTEND:20260918T160000Z
DTSTAMP:20260731T102914Z
UID:3lmi3s8omi4i7fturppsnhaq29@google.com
CREATED:20260624T100543Z
LAST-MODIFIED:20260624T100543Z
LOCATION:Novotel London West\, 1 Shortlands Hammersmith International Ctre\
 , London W6 8DR\, UK
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:44CON 2026
TRANSP:OPAQUE
END:VEVENT
BEGIN:VEVENT
DTSTART:20260917T144000Z
DTEND:20260917T150000Z
DTSTAMP:20260731T102914Z
UID:07qncucufttgarj05d18p69in2@google.com
CREATED:20260624T101309Z
LAST-MODIFIED:20260624T101310Z
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:Coffee & tea break
TRANSP:OPAQUE
END:VEVENT
END:VCALENDAR