0.22 bsides-canberra-2026 2026-09-24 2026-09-26 3 00:05 https://cfp.bsidescbr.com.au Australia/Sydney Main Track 25 Mins (including questions) 2026-09-24T09:00:00+10:00 09:00 00:10 Welcome to BSides Canberra 2026! Join us as we kick off another year of Australia's largest hacker conference. In this opening session, we'll welcome you to BSides Canberra, introduce this year's event, and share what's in store over the next three days. We'll highlight this year's program, cover important announcements, and run through everything you need to know to make the most of the conference. Whether you're here to learn from world-class speakers, compete in the CTFs, explore the villages, discover new research, or connect with the community, we're thrilled to have you with us. Let's get BSides Canberra 2026 underway. bsides-canberra-2026-102970-opening-ceremony Main Track Kylie McDevittDr Silvio Cesare en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/UPZFD7/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/UPZFD7/feedback/ Main Track 55 minutes (including questions) 2026-09-24T09:10:00+10:00 09:10 00:40 TBA bsides-canberra-2026-102971-thursday-keynote-tba Main Track en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/VZENQH/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/VZENQH/feedback/ Main Track 55 minutes (including questions) 2026-09-24T11:00:00+10:00 11:00 00:55 Copy.Fail (CVE-2026-31431), a critical Linux kernel bug found by researchers at Theori, quickly rose to prominence after its public disclosure in April 2026. Discussion was fuelled by a 732-byte Python exploit script that anybody can run; a dedicated disclosure website with glaring mistakes; and the lack of security patches in some major distros upon release. In the following weeks, variant bugs named Dirty Frag (CVE-2026-43284/CVE-2026-43500) and Fragnesia (CVE-2026-46300) were discovered, starting further conversations about the future role of AI in vulnerability discovery. In this talk, I break down the Copy.Fail bug and exploit, hoping to explain them in a way that is understandable even if you haven’t looked at the Linux Kernel source before. We will take a look at how they work, how the bugs were patched and mitigated, related vulnerabilities, and discuss this bug class in general. bsides-canberra-2026-102546-viral-vulnerabilities-unpacking-copy-fail-and-related-linux-kernel-bugs Main Track Angus en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/8FNRMJ/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/8FNRMJ/feedback/ Main Track 25 Mins (including questions) 2026-09-24T12:00:00+10:00 12:00 00:25 Traditional reverse engineering of edge networking firmware frequently stall at the system emulation layer due too proprietary headers, missing vendor kernel sources, and strict dependencies on physical hardware controllers. This presentation demonstrates applied User-Mode Emulation and Environment Spoofing techniques via PRoot and QEMU-ARM-Static to execute, debug, and dynamically analyse malicious edge-device implants without a native kernel. By systematically bypassing hardware configuration dependencies through virtual memory reservation, RAM capacity spoofing, and writable system-file topology bind-mounting. Researchers should be able too successfully stabilise and interrogate volatile system management daemons reliably for reverse engineering and remediation. bsides-canberra-2026-101583-novel-router-emulation-for-malware-reverse-engineering-infrastructure-discovery Main Track /media/bsides-canberra-2026/submissions/E7QC78/image_d6dq2Bz.webp Kendo en true https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/E7QC78/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/E7QC78/feedback/ Main Track 55 minutes (including questions) 2026-09-24T13:30:00+10:00 13:30 00:55 _Alternatively: Azul - The Talk, or Azul - It’s Blue!_ Azul is ASD’s ACSC’s in-house malware analysis and clustering platform, designed to deal with the fast-paced and complex threat landscape that malware reverse engineers and incident responders face. This talk will describe why we have built Azul, what it does, and a technical deep-dive into how to build systems that meets both the needs of highly technical users and robustness required for large organisations. The talk will include live demos on the product’s use in real analysis situations, reflections on previous internal iterations of the product and anecdotes on what not to do when building products like this. The talk will answer why organisations might have a need for automated malware processing products like Azul and where to find our open-source release. bsides-canberra-2026-98431-azul-how-to-build-good-malware-analysis-platforms Main Track James L en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/CWSFLH/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/CWSFLH/feedback/ Main Track 25 Mins (including questions) 2026-09-24T14:30:00+10:00 14:30 00:25 In this talk, I'll present my research into the internals of the Microsoft Edge Sync Service, examining how the platform authenticates users, protects synchronized data, and exposes functionality through its backend APIs. We'll begin by exploring Family of Client ID (FOCI) tokens, how they fit into Microsoft's authentication ecosystem, and why they play a critical role in Edge Sync. From there, we'll dive into the Edge Sync APIs themselves, demonstrating how FOCI tokens can be leveraged to interact directly with synchronization endpoints. We'll examine the structure of synchronized data, the cryptographic protections applied to it, and the mechanisms used to store and transmit sensitive information. Building on this foundation, I'll demonstrate how synchronization functionality can be abused to extract sensitive data including saved passwords, history and other sync data from a victim's Edge profile. Finally, I'll reveal a novel technique that leverages the Edge Sync Service to transform a FOCI token into a fully authenticated user session through the acquisition of ESTSAUTH cookies, currently the ONLY known method of performing this type of token-to-session conversion. Attendees will leave with a deep understanding of Microsoft Edge Sync's architecture, authentication model, data protection mechanisms, and associated attack surface. Defenders will gain practical guidance for identifying, detecting, and mitigating these techniques within Microsoft 365 environments. bsides-canberra-2026-99702-let-it-sync-in Main Track Dylan Bradley en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/MMAHSM/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/MMAHSM/feedback/ Main Track 55 minutes (including questions) 2026-09-24T15:15:00+10:00 15:15 00:55 Enterprise password managers hold the keys to the kingdom. Pop one, and you can instantly compromise every piece of infrastructure whose admin credentials were kept inside. So how well do these pieces of software hold up? In this talk, I'll walk through three different authentication bypass vulnerabilities I've found in self-hosted enterprise password managers used by Australian organisations. Each one allowing a user without access to walk on in as an admin and loot all the secrets. Along the way, I'll discuss overcoming two commercial code obfuscators, a fun bonus vulnerability that wandered straight out of a CTF and into production, and what defenders should actually do about all of this. bsides-canberra-2026-101767-password-mismanagers-hunting-for-authentication-bypasses-in-enterprise-password-managers Main Track Aidan Stansfield en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/EQ7PKG/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/EQ7PKG/feedback/ Main Track 55 minutes (including questions) 2026-09-24T16:15:00+10:00 16:15 00:55 Bring your own vulnerable driver (BYOVD) is a technique used by many APTs and ransomware groups to gain privileged Kernel access to a Windows target, typically to terminate security software running in protected processes on the host that cannot be modified by regular processes. Its enough of a threat that Microsoft keep a list of vulnerable drivers that can be blocked from installation on Windows systems. Does this actually stop attackers though? How common are vulnerable signed Kernel drivers? This talk explores how I built tooling to automatically pull down hundreds of random signed drivers, perform automated analysis on them and also perform automated exploit generation to easily generate weaponised BYOVD bundles that are not known or present in the Window's blocklist. bsides-canberra-2026-95351-unlimited-exploitation-of-signed-windows-drivers Main Track Christopher Vella (Kharosx0) en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/MTNFGS/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/MTNFGS/feedback/ Off-Main Track Event 2026-09-24T10:00:00+10:00 10:00 07:00 The goal of the Career Village is all about supporting people in their cyber security careers and linking them up with hiring managers. When you come to the village, you'll have the chance to learn about making yourself look good to employers, putting together a killer resume, nailing the interview, and meeting industry professionals and people who want to hire more security staff. We've got experts in recruitment and security who can help you no matter what stage of your career you're at - whether you're just starting out or you're looking for the next stage in your cyber security career. bsides-canberra-2026-103507-careers-village Careers Village Ricki Burke en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/NN99FA/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/NN99FA/feedback/ Exhibition Hall Event 2026-09-24T10:00:00+10:00 10:00 04:00 Welcome to the Speedrun CTF Qualifier! Where precision, speed, and nerves of steel collide. Individual competitors will face two challenges drawn from a mix of web, pwn, reverse engineering, or crypto. You’ll have a maximum of 15 minutes to complete both. The faster you solve, the higher you climb. Only the top 8 fastest solvers will earn a spot in the live finale. No second chances. No warm-ups. Just you, the challenge, and the clock. Think you're fast enough? bsides-canberra-2026-102788-speedrun-ctf-qualifiers Event Track toasterpwn en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/ERKKBA/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/ERKKBA/feedback/ Exhibition Hall Event 2026-09-24T14:00:00+10:00 14:00 02:30 The top 8 have qualified - now it’s time to crown a champion live on stage. In the Speedrun CTF Finale, competitors go head-to-head in a single-elimination bracket, racing through a gauntlet of challenges in front of a live audience. The fastest solver in each match advances, with the pressure mounting as the field thins. Round by round, the competition intensifies - until only one winner remains standing. bsides-canberra-2026-102789-speedrun-ctf-finale Event Track toasterpwn en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/7EVT9P/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/7EVT9P/feedback/ Murray-Fitzroy Room Event 2026-09-24T10:00:00+10:00 10:00 07:00 A hands-on 8-hour workshop on building AI systems that run real security investigations - not just isolated copilot tasks. Most teams get useful help from Claude or ChatGPT on single questions. Few can reliably run multi-step investigations across logs, tools, and incidents. Taught by instructors behind the most popular Black Hat 2025 AI training and the team that built the first AI agent to autonomously solve the Splunk Boss of the SOC CTF. Investigation agents fail not because of model quality, but because investigations are multi-step, ambiguous, and tool-heavy - small errors compound and there are no unit tests to keep things on track. Four labs: Lab 1: Run an OSS LLM locally and watch it hallucinate on SOC questions Lab 2: Wrap it in an agent harness against Splunk BOTSv3 Lab 3: Author a plan.md timelining skill Lab 4: Score it, error-analyze traces, fix the skill, watch the score move Concept blocks cover harness anatomy, MCP and skills, planning patterns, evals, agentic memory and RAG, and securing agents against the lethal trifecta. You leave with a working agent, a reusable skill, an eval harness, and a methodology. Audience: SOC, IR, threat hunters, detection engineers, architects, technical leaders. Prereqs: Laptop, terminal comfort, optional Python. Pre-work to install harness + pull local model. We bring: LLM API key for attendees, bring your own key if prefered. bsides-canberra-2026-102325-from-copilot-to-commander-building-agentic-ai-for-security-investigations Event Track /media/bsides-canberra-2026/submissions/QWSKGN/image_uAOW5UJ.webp Sindre Breda en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/QWSKGN/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/QWSKGN/feedback/ Derwent Room Event 2026-09-24T10:00:00+10:00 10:00 07:00 The Black Bag is returning to BSides Canberra 2026. More details coming soon. bsides-canberra-2026-102988-black-bag-day-1 Event Track TBA en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/Z8EKP7/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/Z8EKP7/feedback/ Locksport Village Event 2026-09-24T10:00:00+10:00 10:00 07:00 The Locksport village is your gateway into the fascinating world of physical security. Whether you're a total newcomer or a seasoned picker, there's something here for everyone. Explore a wide variety of locks, pick tools, and hands-on challenges – all under the guidance of experienced instructors ready to share their tips and tricks. Learn how locks work, discover their vulnerabilities, and test your skills on locks ranging from beginner to expert difficulty. This isn’t just a display – it’s a fully interactive experience. Step into the shoes of a lockpicker, challenge yourself, and maybe even surprise yourself with a hidden knack for tumblers and tension wrenches. Come for the curiosity, stay for the challenge. You might just unlock a new obsession. bsides-canberra-2026-103041-locksport-day-1 Event Track Volunteers en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/CFPTRQ/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/CFPTRQ/feedback/ Hardware Village Event 2026-09-24T10:00:00+10:00 10:00 06:00 Step away from the keyboard – it’s time to get hands-on. Whether you're a seasoned tinkerer or just curious about what’s inside your badge, the Hardware Village is your space to learn, hack, solder, and explore. We’ll have soldering stations ready for badge mods and hardware experiments, plus friendly experts on hand to help with troubleshooting or inspiration. Bring your gear or just swing by to see what others are building and tinkering with. There’s always something to learn, create, or break (safely, of course). bsides-canberra-2026-103044-hardware-village-day-one Event Track Volunteers en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/CKHTDK/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/CKHTDK/feedback/ Main Track 55 minutes (including questions) 2026-09-25T09:10:00+10:00 09:10 00:40 TBA bsides-canberra-2026-102972-friday-keynote-tba Main Track en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/FYAJ8P/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/FYAJ8P/feedback/ Main Track 55 minutes (including questions) 2026-09-25T10:00:00+10:00 10:00 00:55 What happens when the kernel loses track of its own objects? Doppelganger (CVE-2026-23066) is a race-condition in the Linux kernel's RxRPC subsystem that allows the same object reference to be queued into a linked list more than once. Could such a simple primitive really be turned into a reliable kernel exploit? It can, and it was. This talk traces the full journey from discovery of the subtle bug in `rxrpc_recvmsg()` to a working exploit demonstrated live at the ZeroDay.Cloud competition in London. bsides-canberra-2026-95403-doppelganger-weaponizing-cve-2026-23066-at-zeroday-cloud Main Track Faraz en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/GZAL9B/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/GZAL9B/feedback/ Main Track 55 minutes (including questions) 2026-09-25T11:00:00+10:00 11:00 00:55 Digital forensics is often the "silent witness" that secures a conviction, but procedural missteps can risk the entire case. This presentation uses the infamous 2023 "Mushroom Murders" investigation as a case study to demonstrate critical failures in the collection, processing, and reporting of digital evidence. Drawing on first-hand experience as an examiner in the case, I will analyse high-profile technical hurdles, including remote wipes, SIM swapping, and contested data integrity that became focal points in the Supreme Court. Attendees will explore the technical "what-not-to-do" of forensics through real-world examples of factory resets and search history recovery, providing a roadmap for ensuring admissibility in high-stakes criminal litigation. bsides-canberra-2026-96775-fatal-errors-forensics-pitfalls-in-the-mushroom-murders-case-study Main Track Zoran Iliev en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/LESWA7/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/LESWA7/feedback/ Main Track 25 Mins (including questions) 2026-09-25T12:00:00+10:00 12:00 00:25 Ghostscript is one of the most ubiquitous PostScript interpreters in the world. Even if you never run it directly, your systems probably do: rendering thumbnails, converting documents, previewing uploads, or handling images that quietly become PostScript somewhere along the way. Ghostscript is also a C codebase with roots in the late 1980s, which means there is still plenty of room for memory corruption when parsing untrusted input. In this talk, we will walk through two heap corruption bugs we discovered in Ghostscript and show how we turned them into reliable memory read/write primitives callable from PostScript. Rather than relying on fixed offsets, the exploit uses those primitives to scan Ghostscript’s address space at runtime, locate the internal structures needed for the attack, and construct a data-only sandbox escape from PARANOIDSAFER that works across multiple versions and builds. We will then zoom out and look at where this kind of bug can actually be exploited. Thumbnailers, ImageMagick, LibreOffice, web applications, and document-processing pipelines all have different file formats and integration points, but the sink is often the same PostScript interpreter. bsides-canberra-2026-102381-chasing-shadows-portable-memory-corruption-in-ghostscript Main Track Rick de Jager en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/KHLBMX/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/KHLBMX/feedback/ Main Track 55 minutes (including questions) 2026-09-25T14:00:00+10:00 14:00 00:55 [redacted] until 7Aug 2026 due to disclosure timelines bsides-canberra-2026-103087-redacted-until-7aug-2026 Main Track en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/LFCLZK/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/LFCLZK/feedback/ Main Track 55 minutes (including questions) 2026-09-25T15:15:00+10:00 15:15 00:55 Cryptographic padding oracle vulnerabilities are far from new. If you can throw crafted ciphertext at a Cipher Block Chaining (CBC) decryption endpoint, and it is kind enough to tell you whether it was a padding error or something else that caused it to blow up, you can use some crafty block algebra to turn it into a byte-by-byte decryption/encryption machine. It may be tempting to fix a padding oracle vulnerability by normalising the error messages. Instead of saying, "Oops, there was a padding error!" simply say "Oops, there was an error." Better yet, just return a generic HTTP 500 response. The problem is that error messages are only a symptom of padding oracles, they are not the root cause. Any kind of divergent code path behaviour can give rise to a subtle sub-millisecond timing difference, which can be just enough to reveal the secrets of a padding oracle. Justin will walk you through the methodology behind CBC padding oracle exploitation, the curse of WAN jitter that can destroy a fragile timing signal, and the blessing of Timeless Timing Attacks (Van Goethem et al., 2020) which uses HTTP/2 co-scheduling to sniff out even the faintest of timing differentials. Join us to hear about the full suite of Timeless Timing Attacks tooling we're releasing at BSides Canberra 2026 including Go libraries, statistical engines, and command-line tools. Learn how to exploit time-based padding oracle vulnerabilities, get bamboozled by statistical methodologies you thought you'd never have to hear about again, and wonder whether there are other "obvious" vulnerability fixes that could come undone given careful consideration of time. We can't wait to hear what you come up with! bsides-canberra-2026-102359-time-crisis-exploiting-time-based-padding-oracle-vulnerabilities-using-timeless-timing-attacks Main Track Justin Steven en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/ZREJ37/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/ZREJ37/feedback/ Off-Main Track 55 minutes (including questions) 2026-09-25T10:00:00+10:00 10:00 00:55 Every time you sign in to Microsoft 365, a quiet exchange happens behind the scenes. Entra ID issues a token, and a sprawling backend known as the Microsoft 365 Substrate decides what that token is allowed to do. Most of that machinery is invisible, well trusted, and rarely questioned, which makes it exactly the kind of place worth questioning. Tucked inside those tokens are claims that downstream services lean on to decide whether you really are who you say you are, and whether you have done the things, like MFA, that policy demands. But what happens when two parts of Microsoft's own platform disagree about what a token has actually proven? In this talk I'll show how an asymmetry of authorisation between Microsoft Entra ID single sign-on and the Microsoft 365 Substrate led to enterprise account compromise on accounts where MFA should have been enforced. You'll see how the now-patched, Important-rated vulnerability I found works end to end, starting from where it began and following how a small finding grew into something much larger. I'll trace how misplaced trust in the claims of an access token turned into enterprise-scale data exfiltration, show some of the stranger quirks of the Substrate I ran into along the way, and explain why the asymmetry existed in the first place, with Windows Search, Microsoft Edge and Microsoft Teams all turning out to be the stars of the show. Finally, we'll change lens and see why this isn't just a Microsoft bug, and why it might be a cautionary tale for the applications you're building. We'll walk through the common OAuth and OIDC gotchas: where developers over-trust the IdP, which claims actually carry the guarantees you think they do, and why a growing number of application providers are taking MFA enforcement into their own hands rather than waiting on the IdP to do it for them. bsides-canberra-2026-102348-exploiting-the-microsoft-365-substrate-how-their-oauth-clients-became-an-mfa-bypass-across-enterprise-tenants Off-Main Track Rawson Wade en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/PZEVCX/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/PZEVCX/feedback/ Off-Main Track 55 minutes (including questions) 2026-09-25T11:00:00+10:00 11:00 00:55 Modern Bluetooth Low Energy tracking ecosystems: Apple Find My, Samsung SmartThings, Tile, and Google Fast Pair, have each implemented privacy controls designed to prevent persistent observation and protect user privacy. This talk demonstrates how those controls fail in practice. Through passive BLE advertisement collection, protocol-level attacks, linkage analysis, we shows how rotating identifiers can be correlated across time and space to re-identify devices, attribute them to individuals, and reconstruct movement histories. Specifically, it will explore how: - Rotating identifier schemes, designed to prevent tracking, can be defeated through cryptographic, temporal, and behavioural linkage analysis - Passive advertisement collection alone, requiring no active probing, no accounts, and no interaction with target devices or ecosystems and is sufficient to re-identify devices and reconstruct movement - Cross-vendor artefacts and advertisement structure leak identity signals that individual vendors have not accounted for in their threat models - The privacy guarantees communicated to hundreds of millions of users do not reflect the practical reality of what passive observers can determine The session will present a mix of linkage algorithms targeting different artifact classes across the four ecosystems and connect the findings to the broader question of what "privacy by design" actually requires when adversarial passive observation is the threat model. bsides-canberra-2026-100744-find-my-and-yours-exploiting-tracker-ecosystems-to-track-individuals Off-Main Track Carter Smith en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/3VQLVR/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/3VQLVR/feedback/ Off-Main Track 25 Mins (including questions) 2026-09-25T12:00:00+10:00 12:00 00:25 Standard Linux persistence tracking typically focuses heavily on the more obvious artefacts like cron jobs, rc.local scripts, and standard systemd services. Because security teams look there first, modern attackers are shifting to more elegant, hook-based execution vectors that bypass traditional file-integrity monitoring. This talk dives into dissecting two low-overhead Linux persistence mechanisms: dynamic linker hijacking and Systemd Generators. We will look at the underlying OS mechanics of both vectors, look at a live example of how easily it can blend into legitimate infrastructure and how you can audit them across your entire fleet tomorrow. bsides-canberra-2026-102364-hooked-tracking-linker-and-generator-persistence-on-linux Off-Main Track JasonTrapp en true https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/ZYRVZG/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/ZYRVZG/feedback/ Off-Main Track 55 minutes (including questions) 2026-09-25T15:15:00+10:00 15:15 00:55 Have you ever been curious what *really* happens inside a mobile device? How often are different syscalls used? Are syscall errors common? What binaries are executed, and when? Whose actually making all these network requests? Do these behaviours change when not connected to USB? If "yes", then you're not alone. This talk is a tour of modifications I made to Android to enable answering these questions, and more. Starting from source code, I'll discuss different Android technologies and the changes made to include a range of system and endpoint monitoring tools, as well as the services used to collect, analyse and alert on behaviour from both emulated and physical devices. bsides-canberra-2026-98116-inside-of-an-android Off-Main Track Aaron en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/QB3CLU/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/QB3CLU/feedback/ Off-Main Track 25 Mins (including questions) 2026-09-25T16:15:00+10:00 16:15 00:25 Turning the whimsical charm of a Pwnagotchi into a fully mobile, AI‑enabled robotic dog is more complex than strapping a Raspberry Pi to a chassis and calling it a day. This talk explores the challenges behind creating Wi‑Fido—a roaming, autonomous, cybersecurity companion that can literally sniff out trouble. We’ll examine the hurdles encountered during this evolution: adapting a traditionally stationary, packet‑sniffing program into a faithful friend capable of continuous, context‑aware wireless monitoring; integrating AI‑driven decision‑making to distinguish between benign and suspicious signals. Additional challenges include sharing localised data with an LLM, integrating robot interactions, and ensuring Wi-Fido's behavior remains transparent and interpretable—because no one wants a black‑box robot dog silently judging their Wi‑Fi hygiene. Attendees will leave with insights into the coding, AI models, and design philosophies that shaped Wi‑Fido—and practical lessons learned in turning a traditional Wi‑Fi capture workflow into a four‑legged, tail‑wagging cybersecurity assistant that makes network defense more effective and a lot more fun. bsides-canberra-2026-95338-bark-to-the-future-network-security-with-wi-fido Off-Main Track /media/bsides-canberra-2026/submissions/YDT9EC/image_5AqQ4hy.webp Chewhacker en true https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/YDT9EC/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/YDT9EC/feedback/ Off-Main Track 25 Mins (including questions) 2026-09-25T16:45:00+10:00 16:45 00:15 For years, defending against North Korea-based threat actors meant defenders using the same standard checklist. Block the phishing email, sandbox the lure document, or kill the macro. Since 2021 that checklist has been quietly going out of date. This talk looks at how North Korea-based threat actors changed their game. They did not just write better malware, but they moved closer to targeting the workflows and assets that organisations often implicitly trust. They target developers, maintainers, recruiters, SaaS logins, CI/CD pipelines, browser sessions, crypto wallets, and in a growing number of cases, they stopped breaking in entirely and simply got hired. Drawing on PwC Threat Intelligence research into North Korea-based threat actor activity through 2026, I will walk through how the access model works today, using real world examples. A recruiter message that turns into a terminal command. A job interview that becomes the malware delivery mechanism. A developer laptop that quietly hands over source code, cloud keys and wallets, and a new remote hire who was never a real person. The point is simple and a little uncomfortable. The North Korea-based threat actor’s intrusion path no longer starts where most defenders are looking. It starts in your hiring pipeline, your dependency tree, your build system and your payroll. Whether you work in defence, threat intel, offensive security, or you are just breaking into the industry, you will leave this talk able to spot what these intrusions look like, not just "what payload ran" but "which trust relationship did they abuse, and what did it expose?". bsides-canberra-2026-102336-from-dream-jobs-to-developer-tokens-how-north-korea-based-threat-actors-abuse-trust Off-Main Track Sohan Lokula en true https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/3BGZWM/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/3BGZWM/feedback/ Exhibition Hall Event 2026-09-25T10:00:00+10:00 10:00 07:00 CALLING ALL HACKERS, GAMERS, PUZZLE SOLVERS, CRYPTO NERDS, PWN ENJOYERS, REVERSERS, AND CURIOUS NEWCOMERS. skateboarding dog is back for another year of Capture the Flag featuring brand new challenges, puzzles, and games to put your skills to test. We've listened to your feedback! This year, dedicated teams will able to gun for the coveted leaderboard positions as usual, while a *new* mini CTF will be available for the part-time players, merch-oriented gatherers, fun-maximisers, and beginners looking for a more gentle introduction to the world of CTF. Changing times calls for a shift in our competition rules. We'll be placing restrictions on AI usage and limiting team sizes to keep things fair and fun for everyone. Prizes to be announced. bsides-canberra-2026-102974-capture-the-flag-day-one Event Track skateboarding dog en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/HBTFRM/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/HBTFRM/feedback/ Murray-Fitzroy Room Event 2026-09-25T09:00:00+10:00 09:00 04:00 Delve deeper into the dark and mysterious world of Kubernetes security. Start your journey deep inside the target infrastructure, collecting flags as you exploit your position in the environment and hunt for vulnerabilities. Attendees can play three increasingly beguiling and demanding scenarios to bushwhack their way through the dense jungle of Kubernetes security. Everybody is welcome, from beginner to hardened veteran but attendees will be expected to be hands-on to understand more about core Kubernetes components and how they can be misconfigured and compromised. Each attendee will be given access to their own Kubernetes cluster built within our bespoke sandboxed training environment. A laptop with an SSH client is required to participate. bsides-canberra-2026-98114-kubernetes-capture-the-flag Event Track Mario Weigel en true https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/GY3NLF/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/GY3NLF/feedback/ Murray-Fitzroy Room Event 2026-09-25T13:30:00+10:00 13:30 03:00 Finding an XSS and getting alert(1) to fire is one thing. Turning it into something a program or a client treats as high impact is another, and often the trickier part. A reflected or stored XSS on a subdomain that holds no session, or an XSS you can only trigger on yourself, is easy to set aside as low severity. Modern applications, though, are rarely a single site. They are ecosystems tied together by shared single sign-on, OAuth, parent-domain cookies, CDN caches, and postMessage. Once you understand how those pieces fit together, an XSS almost anywhere on an origin can often be escalated into a one-click account takeover of the main application. Over the last couple of years I have reported a number of these escalations to bug bounty programs, taking reflected, stored, DOM, and self XSS and chaining them into session hijacking. This workshop walks through how that is done, using a lab built from those findings. It is aimed at testers and bug bounty hunters who can already find XSS and want to learn how to take it further. This workshop will leave you with a set of techniques, a sense of which one fits a given situation, and the confidence to build your own session hijacking chains. bsides-canberra-2026-102385-escalating-xss-into-session-hijacking-in-modern-sso-ecosystems Event Track Animesh Acharya en true https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/G9B7GT/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/G9B7GT/feedback/ Derwent Room Event 2026-09-25T09:00:00+10:00 09:00 08:00 The Black Bag is returning to BSides Canberra 2026. More details coming soon. bsides-canberra-2026-102989-black-bag-day-2 Event Track TBA en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/XSJNE9/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/XSJNE9/feedback/ Locksport Village Event 2026-09-25T09:00:00+10:00 09:00 07:00 The Locksport village is your gateway into the fascinating world of physical security. Whether you're a total newcomer or a seasoned picker, there's something here for everyone. Explore a wide variety of locks, pick tools, and hands-on challenges – all under the guidance of experienced instructors ready to share their tips and tricks. Learn how locks work, discover their vulnerabilities, and test your skills on locks ranging from beginner to expert difficulty. This isn’t just a display – it’s a fully interactive experience. Step into the shoes of a lockpicker, challenge yourself, and maybe even surprise yourself with a hidden knack for tumblers and tension wrenches. Come for the curiosity, stay for the challenge. You might just unlock a new obsession. bsides-canberra-2026-103042-locksport-day-2 Event Track Volunteers en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/ESQF9W/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/ESQF9W/feedback/ Locksport Village - Physical Challenge Event 2026-09-25T09:30:00+10:00 09:30 07:00 Hello! Black Box Zero is a three stage physical challenge box that gets participants to solve ciphers, hack webapps, and learn to read/write NFC tags to unlock the final box. The brains are driven by a Raspberry Pi 4 that controls the webapp, hotspot, NFC reader, lights, and sounds. Suitable for someone with beginner/intermediate hacking/cybersecurity know how, but all skill levels are encouraged. bsides-canberra-2026-95309-black-box-zero-physical-challenge-box Event Track /media/bsides-canberra-2026/submissions/UWEBSR/image_5Hl5Zcd.jpg Nathan Cobbald and Bayley Skerman en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/UWEBSR/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/UWEBSR/feedback/ Hardware Village Event 2026-09-25T09:00:00+10:00 09:00 07:00 Step away from the keyboard – it’s time to get hands-on. Whether you're a seasoned tinkerer or just curious about what’s inside your badge, the Hardware Village is your space to learn, hack, solder, and explore. We’ll have soldering stations ready for badge mods and hardware experiments, plus friendly experts on hand to help with troubleshooting or inspiration. Bring your gear or just swing by to see what others are building and tinkering with. There’s always something to learn, create, or break (safely, of course). bsides-canberra-2026-103045-hardware-village-day-two Event Track Volunteers en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/CGFLPS/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/CGFLPS/feedback/ Main Track 55 minutes (including questions) 2026-09-26T09:10:00+10:00 09:10 00:40 TBA bsides-canberra-2026-102973-saturday-keynote-tba Main Track en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/C7HSRZ/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/C7HSRZ/feedback/ Main Track 55 minutes (including questions) 2026-09-26T10:00:00+10:00 10:00 00:55 ServiceNow is at the center of workflows and platform integrations for roughly 85% of enterprises - yet it rarely charts high as a priority in the pentesting backlog. Instances are generally put togther by "no-code / low-code" citizen developers who rarely have a software-engineering background. Combine all of this with the fact they are tinkering with a 20 year old monolith to plumb together some of your organisations most sensitive data - and you have an incredibly bespoke attack surface, unique to every org. This talk is a field guide to attacking that surface, how to navigate and dissect a ServiceNow instance to review the custom code and components for critical vulnerabilities. Covering insecure patterns that lead to unauthorized data access, privilege escalation, and even arbitrary code execution. While this talk isn't aimed at identifying platform level bugs, it reviews CVE-2026-0542, a critical unauthenticated arbitrary code execution vulberabiltiy discovered using the same techniques. This vulnerability was present in default components written by ServiceNow that affected every instance - and the deep dive reveals why customer instances could still harbor their own versions of this. Defenders leave knowing their actual attack surface and how to reduce it, what to audit in custom code, enabling better logging and monitoring, and awareness of a reporting gap between ServiceNow's own CVEs versus the advisories that go straight to customers — including a public CVE record that still reads "fixed" for a bug class only truly closed by patches much later. Since most customers get exactly one self-run pentest per calendar year, the goal of this talk is to leave you able to make that one shot really count. bsides-canberra-2026-102269-javascript-pwn-a-field-guide-to-hacking-servicenow Main Track Paul Alkemade en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/88SUTA/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/88SUTA/feedback/ Main Track 55 minutes (including questions) 2026-09-26T11:00:00+10:00 11:00 00:55 A full-stack teardown of a commercial EV charger, from default credentials in the installation guide through to unauthenticated control of the AC power contactors. This research covers multiple pre-auth RCE vulnerabilities including a Bluetooth attack requiring no network access, an unauthenticated manufacturing test mode that bypasses every safety interlock on the charger, and a design flaw that puts all safety mechanisms in a single Linux process with no independent hardware verification. The affected firmware platform is used by multiple resellers globally. A single broadcast UDP packet can disable ground fault protection across an entire fleet. bsides-canberra-2026-102061-ocularce-from-bluetooth-to-contactor Main Track Brendan Scarvell en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/V3BXU8/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/V3BXU8/feedback/ Main Track 25 Mins (including questions) 2026-09-26T12:00:00+10:00 12:00 00:25 Collecting data from the game of Pokemon Go involves bulk creation of game accounts. In order to combat bots and other abusers of the game, cloud WAFs are used to prevent mass account sign-ups. This talk outlines some cheap techniques that can be used to bypass anti-bot measures employed by Imperva and other similar security platforms. bsides-canberra-2026-101158-waffling-around-wafs Main Track Aeriana Lawler en true https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/LUJCEL/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/LUJCEL/feedback/ Main Track 25 Mins (including questions) 2026-09-26T13:30:00+10:00 13:30 00:25 “Wait hang on if everyone’s vibe coding I bet they’re accidentally leaking soooooo many API keys like, publicly. And they don’t even know”, is what I thought one day. “But *how* bad is it?” I had to know, so I tried scanning newly registered domain names every day. This talk is the story of how I found myself drowning in poor vibe coders’ diverse selection of API keys, and, um, how anyone could 😳. I tried to measure how easy it was to find actual, valid API keys on new, presumably vibe coded websites. I have, in my travels, calculated various numbers, such as the average time it takes for a valid API key to be leaked after a domain is registered. There will be a thrilling analysis of today’s results, so please nobody vibe code too hard the day before. bsides-canberra-2026-102227-finding-vibe-leaked-api-keys-every-day Main Track /media/bsides-canberra-2026/submissions/CWMDP3/image_RZskqNQ.webp "Alex" en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/CWMDP3/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/CWMDP3/feedback/ Main Track 55 minutes (including questions) 2026-09-26T15:15:00+10:00 15:15 00:55 Consider a website. One that allows you to export PDF documents. Have you ever stopped to wonder how this works under the hood? Commercial libraries exist to do the PDF generation heavy lifting, but as they can be quite costly, I wasn’t surprised to see developers reaching for Chrome’s “Print to PDF” functionality. What did surprise me was web applications not having up to date Chrome builds in their NPM dependencies, developers reaching for --no-sandbox rather than fiddling with Docker and Kubernetes security knobs, and web apps that allowed me to provide custom (and malicious) HTML and JavaScript for conversion to PDF. All of this inspired me to look into Chrome’s JavaScript engine, V8, to exploit these PDF generators. Chrome’s issue tracker documents many patched vulnerabilities that work on old Chrome versions, which is perfect for my use case. The main challenge was that the exploits and techniques vary depending on the target Chrome version, so I wondered, why not make a tool with enough exploits to cover all of them? In this talk I outline my journey for developing the tool, the design decisions I made, the problems that I overcame, and the lessons I learned along the way. The result is a single web page that can exploit 24 common Chrome versions (and counting) for remote code execution using V8 memory corruption. bsides-canberra-2026-100985-headless-hunter-automated-exploitation-of-headless-chrome-using-v8-n-days Main Track Daniel Cooper en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/UGYDQS/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/UGYDQS/feedback/ Off-Main Track 55 minutes (including questions) 2026-09-26T10:00:00+10:00 10:00 00:55 Sophisticated espionage focused Command and Control (C2) frameworks and offensive cyber tooling has been historically restricted to use by large powers and developed economies due to the high cost or lack of turn key solutions offered by open source. At the end of the day these platforms are just software suites built to strict and specialised requirements. LLMs through shifts in software development methodologies have become commonplace in enterprise software development life cycles and have lowered the barriers of the cost, maintainability and flexibility issues plaguing legacy offensive tooling. In this talk we will explore several frameworks that have been captured from the front lines to see first hand how actual APTs are building and breaking sophisticated C2 frameworks to prompt their way to success. We will explore the spec driven approaches that produce robust and battle ready tooling without guess work, review examples of development artifacts, documentation and prompts from a mistakenly exposed VoidLinkC2 development server and pass these lessons on to any budding red teamers wanting to replicate this success. Defenders and researchers need not worry - we will also discuss our lessons learned through researching AI built frameworks and what this means for the way we track and react to these threats in the future. bsides-canberra-2026-102372-you-get-a-c2-and-you-get-a-c2-the-democratisation-of-sophisticated-command-control Off-Main Track Joseph GanterTom Marsden en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/YXN8DD/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/YXN8DD/feedback/ Off-Main Track 25 Mins (including questions) 2026-09-26T11:00:00+10:00 11:00 00:25 We've all heard of password guessing and MFA bypass techniques that are used to attack M365 - but those are old news now! The newer and more interesting vector - to both attackers and defender alike - are malicious Entra ID (formerly Azure AD) apps. In this presentation I'll explain what Entra ID apps are (and what makes some malicious), how attackers trick users/victims into registering them, how you can find any that may already be in your environment, and what you can do to stop more in the future. This presentation is designed for technical audiences (or those wanting to become technical) to understand an emerging vector and what can be done to defend against them. The content is based on both our firsthand experience (as both attackers and defenders) as well as that from our partners. bsides-canberra-2026-99192-malicious-entra-id-apps-what-they-are-how-to-find-them-and-how-to-stop-them Off-Main Track /media/bsides-canberra-2026/submissions/CNKXQT/image_Mjuiymm.webp Sam Brazier-Hollins en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/CNKXQT/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/CNKXQT/feedback/ Off-Main Track 25 Mins (including questions) 2026-09-26T11:30:00+10:00 11:30 00:25 If the Lumma and Vidar stealers taught us one thing, it's that literally anything can be used as a Command and Control channel. DNS TXT records, Pastebin drops, Steam profiles, telegram, discord - if it can carry a string, it can carry instructions. This talk takes a blue team lens to the unconventional C2 landscape. We'll explore how platforms such as Steam and a handful of other legitimate services, are being quietly abused for command delivery and exfiltration. Hiding in plain sight behind trusted domains and allowlisted traffic. No blocked ports, no suspicious destinations, no alerts. bsides-canberra-2026-101849-venting-steam-hunting-c2-in-unexpected-places Off-Main Track Mike Vriesema en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/YUZAQX/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/YUZAQX/feedback/ Off-Main Track 25 Mins (including questions) 2026-09-26T12:00:00+10:00 12:00 00:25 Identity used to be the front door. Now it is the keys, the key cabinet, the floor plan, the alarm panel, and sometimes the weird emergency exit nobody has checked since 2021. Most organisations have put serious effort into endpoint alerts, phishing workflows, firewall rules, and dashboards. But the thing that quietly decides who can access almost everything is often treated as setup work: turn on MFA, plug in SSO, add Conditional Access, connect SCIM, move on. That is fine until someone uses a break-glass account, a privileged role lights up, a password manager owner gets added, a Conditional Access exclusion becomes the easiest path in, or SCIM decides to "help" by removing the wrong person from the wrong place. This talk is about hunting the identity control plane before it becomes an incident. We will walk through realistic Entra, SCIM, PIM, and password-manager failure modes, then turn those messy admin events into useful detections, triage paths, and response actions. Expect practical examples, awkward edge cases, noisy logs, bad assumptions, and the occasional reminder that "we logged it somewhere" is not the same thing as "someone can respond to it at 2am." bsides-canberra-2026-102368-identity-is-the-new-soc-hunting-entra-scim-pim-and-password-manager-abuse Off-Main Track Maple en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/ASV3UJ/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/ASV3UJ/feedback/ Off-Main Track 25 Mins (including questions) 2026-09-26T13:30:00+10:00 13:30 00:25 When a secret is leaked most people look at who leaked the secret; the GitHub committers email, package author, but this sucks. Millions of commits are created by noreply emails, clankers and personal emails with no attribution back to your org at all. We analysed hundreds of thousands of live, verified credentials with a new method of attribution, API calls to dynamically fetch ownership information. What we found will change the way you think about secret detection and remediation. Using this methodology we were able to achieve attribution at scale, uncovering contextless keys that had access to medical devices, defense equipment and some of the most popular software packages ever (GnuTLS, OpenConnect), KYC databases and much more. This session discusses: Why attribution in its current form is broken The challenges of attribution at scale What our methodology looks like Case studies of our findings bsides-canberra-2026-102046-api-key-attribution-sucks-lets-change-that Off-Main Track Luke Marshall en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/UHLRLX/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/UHLRLX/feedback/ Off-Main Track 55 minutes (including questions) 2026-09-26T14:00:00+10:00 14:00 00:55 During an authorised social engineering engagement for a state government department, email security flaws were identified which led to successful target interaction with “malicious” infrastructure. With the engagement a success, the question was raised; where else can these email security flaws be found across the gov.au domain, and can we 'just spoof the government?' bsides-canberra-2026-95829-just-spoof-the-government Off-Main Track Ben™ en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/TN98SC/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/TN98SC/feedback/ Exhibition Hall Event 2026-09-26T09:00:00+10:00 09:00 06:00 CALLING ALL HACKERS, GAMERS, PUZZLE SOLVERS, CRYPTO NERDS, PWN ENJOYERS, REVERSERS, AND CURIOUS NEWCOMERS. After an incredible debut at BSides Canberra 2025, Skateboarding Dog returns with an all-new Capture the Flag competition featuring fresh challenges, new ideas, and plenty of opportunities to test your skills. Expect all the classic categories: Crypto, Pwn, Reverse Engineering, Web, and more. Alongside the weird, creative, and unexpected challenges you've come to expect from Skateboarding Dog. Whether you're tackling your very first CTF or you're a seasoned competitor chasing the top of the leaderboard, there's something here for everyone. Bring your laptop, bring your team, and see if you have what it takes to claim the trophy. Prizes to be announced. bsides-canberra-2026-102975-capture-the-flag-day-two Event Track skateboarding dog en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/RMC8LB/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/RMC8LB/feedback/ Murray-Fitzroy Room Event 2026-09-26T09:00:00+10:00 09:00 06:30 Software supply chain attacks have become one of the most significant threats to organizations, with nation-state actors like DPRK's Lazarus Group actively compromising NPM packages, PyPI libraries, GitHub repositories, and VS Code extensions to target developers and steal credentials, cryptocurrency, and source code. This all-day hands-on training equips SecOps and threat hunting teams with practical skills to detect, analyze, and extract actionable threat intelligence from real-world supply chain malware—turning raw malware samples into finished intelligence products. Participants will work directly with sanitized samples from active campaigns including Contagious Interview, PolinRider (DPRK), and Glassworm (Russia), analyzing malicious artifacts across four major attack surfaces: NPM, PyPI, GitHub, and VS Code extensions. Beyond technical analysis, attendees will learn about Paul's custom software supply chain CTI workflow: extracting IOCs, pivoting across infrastructure to identify campaign scope, attributing activity to threat actors, producing actionable reports, and alerting the community to the threats you expose. The training culminates with a 90-minute live hunting CTF-style session where participants apply their new skills to hunt for real threats and document findings using professional intelligence standards bsides-canberra-2026-96294-software-supply-chain-threat-intelligence-hands-on-training-for-secops-and-threat-hunting-teams Event Track /media/bsides-canberra-2026/submissions/VVRUFE/image_et3hexz.webp Paul McCarty en true https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/VVRUFE/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/VVRUFE/feedback/ Derwent Room Event 2026-09-26T09:00:00+10:00 09:00 06:00 The Black Bag is returning to BSides Canberra 2026. More details coming soon. bsides-canberra-2026-102990-black-bag-day-3 Event Track TBA en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/JBCGY7/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/JBCGY7/feedback/ Locksport Village Event 2026-09-26T09:00:00+10:00 09:00 06:30 The Locksport village is your gateway into the fascinating world of physical security. Whether you're a total newcomer or a seasoned picker, there's something here for everyone. Explore a wide variety of locks, pick tools, and hands-on challenges – all under the guidance of experienced instructors ready to share their tips and tricks. Learn how locks work, discover their vulnerabilities, and test your skills on locks ranging from beginner to expert difficulty. This isn’t just a display – it’s a fully interactive experience. Step into the shoes of a lockpicker, challenge yourself, and maybe even surprise yourself with a hidden knack for tumblers and tension wrenches. Come for the curiosity, stay for the challenge. You might just unlock a new obsession. bsides-canberra-2026-103043-locksport-day-3 Event Track Volunteers en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/VDNHNZ/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/VDNHNZ/feedback/ Hardware Village Event 2026-09-26T09:00:00+10:00 09:00 06:30 Step away from the keyboard – it’s time to get hands-on. Whether you're a seasoned tinkerer or just curious about what’s inside your badge, the Hardware Village is your space to learn, hack, solder, and explore. We’ll have soldering stations ready for badge mods and hardware experiments, plus friendly experts on hand to help with troubleshooting or inspiration. Bring your gear or just swing by to see what others are building and tinkering with. There’s always something to learn, create, or break (safely, of course). bsides-canberra-2026-103046-hardware-village-day-three Event Track Volunteers en false https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/ES8WKY/ https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/ES8WKY/feedback/