BSides Canberra 2026

Version 0.22 July 27, 2026

We released a new schedule version!

We have new sessions!

• “Just spoof the government?” by Ben™
• “API Key Attribution Sucks, Lets Change That” by Luke Marshall
• “Find My... And Yours: Exploiting Tracker Ecosystems To Track Individuals” by Carter Smith

Version 0.21 July 26, 2026

We released a new schedule version!

We had to move some sessions, so if you were planning on seeing them, check their new dates or locations:

• “From Dream Jobs to Developer Tokens: How North Korea-based threat actors abuse trust” by Sohan Lokula (Sept. 25, 2026, 3:45 p.m. → Sept. 25, 2026, 4:45 p.m.)
• “Bark to the Future: Network Security with Wi‑Fido” by Chewhacker (Sept. 25, 2026, 3:15 p.m. → Sept. 25, 2026, 4:15 p.m.)
• “Inside of an Android” by Aaron (Sept. 25, 2026, 4:15 p.m. → Sept. 25, 2026, 3:15 p.m.)

Version 0.20 July 26, 2026

We released a new schedule version!

We have a new session: “From Copilot to Commander: Building Agentic AI for Security Investigations” by Sindre Breda.

Version 0.19 July 22, 2026

We released a new schedule version!

We have a new session: “Careers Village” by Ricki Burke.

Version 0.18 July 22, 2026

We released a new schedule version!

We had to move some sessions, so if you were planning on seeing them, check their new dates or locations:

• “Malicious Entra ID Apps - what they are, how to find them and how to stop them” by Sam Brazier-Hollins (Sept. 24, 2026, 2:30 p.m. → Sept. 26, 2026, 11 a.m.)
• “Bark to the Future: Network Security with Wi‑Fido” by Chewhacker (Sept. 24, 2026, 10 a.m. → Sept. 25, 2026, 3:15 p.m.)
• “Venting Steam: Hunting C2 in Unexpected Places” by Mike Vriesema (Sept. 24, 2026, noon → Sept. 26, 2026, 11:30 a.m.)
• “Inside of an Android” by Aaron (Sept. 24, 2026, 11 a.m. → Sept. 25, 2026, 4:15 p.m.)
• “From Dream Jobs to Developer Tokens: How North Korea-based threat actors abuse trust” by Sohan Lokula (Sept. 24, 2026, 10:30 a.m. → Sept. 25, 2026, 3:45 p.m.)

Version 0.17 July 22, 2026

We released a new schedule version!

We have new sessions!

• “You Get a C2! And YOU Get a C2!: The democratisation of sophisticated Command & Control” by Joseph Ganter, Tom Marsden
• “Malicious Entra ID Apps - what they are, how to find them and how to stop them” by Sam Brazier-Hollins

Version 0.16 July 21, 2026

We released a new schedule version!

We have new sessions!

• “Software Supply Chain Threat Intelligence: Hands-On Training for SecOps and Threat Hunting Teams” by Paul McCarty
• “Hooked: Tracking Linker and Generator Persistence on Linux” by JasonTrapp

Version 0.15 July 20, 2026

We released a new schedule version!

We have a new session: “OculaRCE: From Bluetooth to Contactor” by Brendan Scarvell.

Version 0.14 July 20, 2026

We released a new schedule version!

We have new sessions!

• “Exploiting the Microsoft 365 Substrate: How their OAuth Clients Became an MFA Bypass Across Enterprise Tenants” by Rawson Wade
• “Novel Router Emulation for Malware Reverse Engineering & Infrastructure Discovery” by Kendo
• “Let It Sync In” by Dylan Bradley
• “Venting Steam: Hunting C2 in Unexpected Places” by Mike Vriesema
• “Headless Hunter - Automated exploitation of headless Chrome using V8 n-days” by Daniel Cooper
• “Identity Is the New SOC: Hunting Entra, SCIM, PIM, and Password Manager Abuse” by Maple

Version 0.13 July 15, 2026

We released a new schedule version!

We have new sessions!

• “From Dream Jobs to Developer Tokens: How North Korea-based threat actors abuse trust” by Sohan Lokula
• “Chasing Shadows: Portable Memory Corruption in Ghostscript” by Rick de Jager

Version 0.12 July 14, 2026

We released a new schedule version!

We have new sessions!

• “Inside of an Android” by Aaron
• “javascript:pwn() - A Field Guide to Hacking ServiceNow” by Paul Alkemade

Version 0.11 July 14, 2026

We released a new schedule version!

We have moved a session around: “Waffling Around WAFs” by Aeriana Lawler (Sept. 25, 2026, noon → Sept. 26, 2026, noon)

Version 0.10 July 14, 2026

We released a new schedule version!

We have new sessions!

• “Waffling Around WAFs” by Aeriana Lawler
• “Bark to the Future: Network Security with Wi‑Fido” by Chewhacker

Version 0.9 July 13, 2026

We released a new schedule version!

We have a new session: “Fatal Errors: Forensics Pitfalls in the "Mushroom Murders" Case Study” by Zoran Iliev.

Version 0.8 July 13, 2026

We released a new schedule version!

We have a new session: “Kubernetes Capture the Flag” by Mario Weigel.

Version 0.7 July 10, 2026

We released a new schedule version!

We have a new session: “Password MisManagers: Hunting for Authentication Bypasses in Enterprise Password Managers” by Aidan Stansfield.

Version 0.6 July 9, 2026

We released a new schedule version!

We have new sessions!

• “[redacted] until 7Aug 2026”
• “Doppelganger - Weaponizing CVE-2026-23066 at ZeroDay.Cloud” by Faraz
• “Viral Vulnerabilities: Unpacking Copy.Fail and related Linux Kernel bugs” by Angus
• “Escalating XSS into session hijacking in modern SSO ecosystems” by Animesh Acharya

We had to move some sessions, so if you were planning on seeing them, check their new dates or locations:

• “Time Crisis: Exploiting time-based padding oracle vulnerabilities using Timeless Timing Attacks” by Justin Steven (Sept. 25, 2026, 1:30 p.m. → Sept. 25, 2026, 3:15 p.m.)
• “Unlimited Exploitation of Signed Windows Drivers” by Christopher Vella (Kharosx0) (Sept. 24, 2026, 4 p.m. → Sept. 24, 2026, 4:15 p.m.)

Version 0.5 July 9, 2026

We released a new schedule version!

We have new sessions!

• “Time Crisis: Exploiting time-based padding oracle vulnerabilities using Timeless Timing Attacks” by Justin Steven
• “Azul: How to build “good” malware analysis platforms” by James L
• “Black Box Zero - Physical Challenge Box” by Nathan Cobbald and Bayley Skerman
• “Finding vibe leaked API keys every day” by "Alex"
• “Unlimited Exploitation of Signed Windows Drivers” by Christopher Vella (Kharosx0)

Version 0.4 July 8, 2026

We released a new schedule version!

We have new sessions!

• “Hardware Village (Day Two)” by Volunteers
• “Locksport (Day 2)” by Volunteers
• “Locksport (Day 3)” by Volunteers
• “Hardware Village (Day One)” by Volunteers
• “Hardware Village (Day Three)” by Volunteers
• “Locksport (Day 1)” by Volunteers

Version 0.3 July 7, 2026

We released a new schedule version!

We had to move some sessions, so if you were planning on seeing them, check their new dates or locations:

• “Black Bag - Day 2” by TBA (Murray-Fitzroy Room → Derwent Room)
• “Black Bag - Day 1” by TBA (Murray-Fitzroy Room → Derwent Room)
• “Black Bag - Day 3” by TBA (Murray-Fitzroy Room → Derwent Room)

Version 0.2 July 7, 2026

We released a new schedule version!

We have new sessions!

• “Black Bag - Day 2” by TBA
• “Black Bag - Day 1” by TBA
• “Black Bag - Day 3” by TBA

Version 0.1 July 7, 2026

We released our first schedule!