Conference recordings are now online!

We've highlighted a few talks worth checking out:

• Tunnel Vision: What Microsoft’s Secure Edge Can’t See. The author reverse-engineers the Microsoft Global Secure Access protocol and builds an independent client for connecting to GSA from Linux and macOS. The talk also covers device posture spoofing, token extraction from TokenBroker, and hiding C2 traffic inside the tunnel.

• DDD: DCOM, DotNet, Deserialization. The authors present a new lateral movement technique for Windows hosts that combines DCOM with .NET object deserialization. Code executes in the remote process’s memory without dropping files or registering a new COM object.

• EDR Introspection. The author presents a tool that gains PPL-level access, disables kernel callbacks registered by the EDR, and injects a monitoring module into the security process. Analysis of ETW and ETW-TI events helps identify the stage at which a payload is detected.

• Downgrading FIDO MFA With AI Slop. The creator of Evilginx demonstrates Phishlets 2.0, a new configuration format for setting up phishing reverse proxies, and attacks that downgrade FIDO authentication. The proxy hides the phishing-resistant sign-in option, forces the user to choose a phishable MFA method, and passes the credentials to an attacker-controlled browser.

• A Raspberry Pi-based Ethernet Implant That Bypasses 802.1X and Allows the Same IP Address to Be Used in Parallel. The author presents a Raspberry Pi network implant that relays the 802.1X exchange, clones the device’s MAC address, and shares its IP address. Its inline position enables interception of RDP and Microsoft SQL Server traffic when certificate validation is insufficient.

• From Misimplementation to Full Compromise: Exploring a Dangerous Attack Surface in MCP. Automated analysis of official MCP integrations uncovered an SQL injection in Apache Doris, missing authentication in Apache Pinot, and unauthorized access to database metadata through Alibaba RDS.