"Do you work at a company that has a magical, mysterious red team? Do you ever wonder what exactly they do or how exactly they manage to pwn your company? Do you wish you spent your overtime yelling “woot woot, got loot!” instead of querying Splunk to get a trail of pivots from their latest shenanigans?

That was me. I loved responding to Red Team incidents. As a defender, it was one of the most valuable and insightful parts of my job: allowing the defenders to see where our blind spots were, chasing down an attacker, and tracking them across our network and systems. And I couldn’t help but want to be on the other side.

This talk is about how I transitioned from a defensive role in security to an offensive roll, a basic framework for how to accomplish your own career transition, and the benefits of doing so. It also touches on the importance of defining the term “red team” for our industry and how the right definition might not be the one you expected."

Brianna Malcomson is a Red Teamer living in San Francisco. Originally from Australia, a former State and Collegiate golfer, she has studied and worked in the information security industry for 10 years. Her passions include running CTF teams, decrypting credit card information, and working to help keep information secure. Brianna is an administrator of the Information Security groups Platypus Initiative and No Fox Given.

Phishing attacks may seem like a breeze, however sometimes the hard part is getting past the series of barriers that are encountered before the target. This talk discusses some of the common limitations encountered during short term phishing campaigns and how to ensure more successes. Techniques discussed in the this talk will include how to choose an effective pretext and payload as well as how to improve the likelihood and legitimacy of delivery.

Sarah Norris is a Security Consultant for TrustedSec. She started her career in Information Security after conducting PCI audits for Trustwave. Before Trustwave, Sarah worked on Linux systems writing and debugging custom Python modules for Zenoss. Her favorite animal is horses and her favorite person is Martha Stewart.

In this talk, we will cover the process of setting up a CTF from start to finish, specifically the one run both internally at Square and externally at Grace Hopper 2017. We will talk about some of the decisions we made around this (including building our own infra from scratch hosted in Google, and gearing it towards underrepresented groups in tech+security), in addition to the challenges we encountered along the way. We will share the feedback we got from this and hope to demonstrate that you don't need to be a good CTFer to run a fun CTF.

Sarah Harvey is a software/security engineer on the mobile security team at Square, with a speciality in data analytics for security data. She has given a handful of talks on infrastructure security and privacy education. She organized the first ever large CTF at Grace Hopper in 2017 with the help of several Square volunteer engineers, and has helped with running prior internal CTFs at Square.

Wearable platforms today enable rich, next-generation experiences such as secure payments, specialized sports tracking and precise location monitoring. Data collection is only the first step for these products. The real "user experience" is often the result of a complex mesh of interactions between wearables, smartphones, cloud-hosted array of web applications and analytics software. Designing and validating security for such ecosystems, the kind of which never existed until a few years ago, demands brand-new lines of thinking and security best practices. Wearables live and operate on the human body, collecting a wealth of personal data. This gives rise to new challenges in storing such data securely and conforming to privacy regulations, especially in a world where consumer privacy laws are so diverse.

The Oakley Radar Pace is a head-worn real time, voice activated coaching system that creates and manages training programs for track running or cycling. The "coach" is an NLP-powered voice assistant on the eyewear. User can converse with it hands-free, and get advanced feedback on their performance.

In our presentation, we talk about the security and privacy research that went into designing and developing Radar Pace, including a custom Security Development Lifecycle (SDL) that accounted for the three "branches" of the program: wearable, phone and the cloud. We present examples of vulnerabilities and privacy problems associated with such new classes of products. While the applications and use cases for wearables are limited only by the designers' imagination, the best practices we have pioneered will be useful and can easily be reapplied by vendors creating new wearables and IoT products. The goal of our presentation is to educate attendees about shedding the old notions of privacy and Security Development Lifecycle when preparing for the products of the future, as well as to discuss interesting security vulnerabilities in such technologies.

Sumanth has worked in the information security industry for a decade in a variety of roles, including incident response, feature development and security assurance. He worked for Sun Microsystems and Palm before his current job at Intel. He has a Masters in Computer Science (Security) from Columbia University.

Kavya is the lead security researcher for the New Devices Group at Intel. She worked for Oracle and Qualcomm’s security teams before she started her current job at Intel. She has a Masters in Information Security from the Johns Hopkins University and a passion for Security.

"By now, you've heard that WPA is all broken due to the magic of KRACK.
But what exactly is KRACK? I've read the paper so you don't have to! Join me
as I share my understanding of the vulns and some guidelines on testing for and patching the vulns."

Nikki Brandt is currently Product Security at eero, formerly Senior Security Consultant at NCC/Matasano.

"It is the biggest cop-out in information security: when a major security incident hits the news, security practitioners are quick to place the blame on users and shout from the rooftops that it is the humans who are the weakest link in security. Focused on building and maintaining highly sophisticated technical systems, however, many security teams make the mistake of approaching human problems with highly technical solutions. By ignoring much of the research, data, and information we have about how people interact with machines, technologists miss the opportunity to design for (or around) expected human behaviors. As a result, many technologies ignore the needs, knowledge, and experience of the average person and set them up for failure through counterintuitive design and externalized risk when they do face security-critical tasks.

This talk will take on the myth that users are the root of all failure and explores how security teams can transform their thinking to even the playing field for non-expert, nontechnical humans and introduce actionable strategies to transform people into an extra line of defense when we need them the most."

Jessy Irwin is a security expert who excels in translating complex cybersecurity issues into simple, relatable terms for nontechnical audiences. In her work as an consultant, security executive, and former security empress at 1Password, she has taught consumers how to better protect themselves, their data, and their identities online.

 What if you could turbocharge your web hacking without having to sacrifice efficiency? Since pure automation misses so much important information, why not use powerful alerts created from real threat intelligence? What if you had these powerful alerts in as a plugin in a tool that that is so ubiquitous in web hacking that it’s synonymous to its very definition? What if this plugin not only told you where to look for vulnerabilities, but also gave you curated resources for additional exploitation and methodology? What if you could organize your web hacking methodology inside of your tool? Well, dream no more! HUNT is a new Burp Suite extension that aims to arm web hackers with parameter level suggestions on where to look for certain classes of vulnerabilities such as SQL Injection, Command Injection, Local/Remote File Inclusion, and more! The data that drives this plugin are parsed from hundreds of real-world assessments which provide the user with the means to effectively root out critical issues. Not only will HUNT help you assess large, hard targets more thoroughly, but it also aims to organize common web hacking methodologies right inside of Burp Suite. As an open source project, we will go over the data driven design of HUNT and its core functionality. 

JP Villanueva is a Trust & Security Engineer at Bugcrowd. Before Bugcrowd, JP spent 4 years at WhiteHat Security as an Application Security Engineer and later as a Solutions Architect helping customers become more secure. JP has also presented at local OWASP chapters, BlackHat Arsenal 2017, DEF CON 25, and AppSecUSA 2017. In his free time, JP enjoys playing and collecting classic video games as well as hacking on bug bounty programs.

2017 has been a monumental year for massive breaches. It's gotten to the point that they're starting to blend together. The Equifax and Deloitte breaches were so close together they are easily confused, and initial sweeps of their risk surfaces are nearly congruent. Additional sweeps of other large organizations are also unsurprisingly congruent. In this talk we'll be going over all the recent, major breaches, and doing a fly-over of their publicly available surfaces, comparing news reports and other public data, and analyzing what could have possibly gone wrong, if it isn't already known. It is also likely that we will spot new entrypoints and discover new and interesting vectors by which attackers can gain entry to these orgs, since in many cases the IR teams that are hired are hands-off and can merely "give advice" on how to resolve any security gaps discovered. It is clear that at a 100,000 foot level what we're doing isn't working as an industry. This talk aims to point out low hanging fruit, examples of vulnerable infrastructure, techniques on how to self-diagnose and suggestions on how to prevent these sorts of oversights.

Viss