Agenda

The conference focuses on highly technical offensive security issues such as vulnerability discovery, advanced exploitation techniques, reverse engineering and many more.

Loading...

From zero to the anti-hero: journey of building a low profile elite hacking team

This session explores the journey from zero to leading an elite offensive security team. It covers skill development, ethical dilemmas in disclosure, and the power of staying low-profile. Whether you're a CTF player, exploit developer, or an underdog in the field, learn how working behind the scenes can be a strategic advantage.

[Keynote Speaker]
Loading...
Phuong Nguyen
Founder & Troublemaker at ECQ
Loading...
This session explores the journey from zero to leading an elite offensive security team. It covers skill development, ethical dilemmas in disclosure, and the power of staying low-profile. Whether you’re a CTF player, exploit developer, or an underdog in the field, learn how working behind the scenes can be a strategic advantage.
Phuong Nguyen has been involved in computer security since 1998 and has over 25 years of experience in offensive security. For the shenanigans and trouble he caused, he was recognized by the U.S. government as an Individual with Extraordinary Ability and was granted O-1 visa status. Phuong is also the author of multiple critical zero-day vulnerabilities—such as remote code execution—in software including browsers, antivirus programs, and archive/compression tools, with a market value worth millions of USD.

Leveling Up: How Hacking Consoles Launched My Cybersecurity Career

From playing consoles to hacking consoles, and now hacking for a living. Andy shares his journey from barely knowing about computers to finding and exploiting memory corruption bugs in consoles, and how it changed his life and launched an amazing cyber security career. 16 years later, and Andy is still working hard on vulnerability research and 0day exploits with the same curiosity he had as a kid. Andy will share the mindset, approach & methodologies to vulnerability research with some case studies on his most famous findings.

[Keynote Speaker]
Loading...
Andy (TheFlow) Nguyen
Staff Security Engineer at Google Specializing in Low-Level Vulnerability Research for Google Cloud
Loading...
From playing consoles to hacking consoles, and now hacking for a living. Andy shares his journey from barely knowing about computers to finding and exploiting memory corruption bugs in consoles, and how it changed his life and launched an amazing cyber security career. 16 years later, and Andy is still working hard on vulnerability research and 0day exploits with the same curiosity he had as a kid. Andy will share the mindset, approach & methodologies to vulnerability research with some case studies on his most famous findings.
Andy Nguyen is a Staff Security Engineer at Google, specializing in low-level vulnerability research within Google Cloud. With extensive experience in information security, Andy plays a pivotal role in identifying, analyzing, and mitigating security risks to ensure the integrity and safety of Google’s cloud infrastructure. With a deep understanding of security protocols and cutting-edge vulnerability research, they work to stay ahead of emerging threats and continually enhance the security posture of Google Cloud services.
Loading...

Dialing into the Past: RCE via the Fax Machine – Because Why Not?

Rick de Jager,

Master's Student at TU/e, Cybersecurity Enthusiast, CTF Competitor, and Pwn2Own Participant

Carlo Meijer,

Founding Partner at Midnight Blue Specializing in Embedded Security and Critical Infrastructure

This talk showcases how a printer bug, discovered at Pwn2Own Ireland, was exploited to gain remote code execution via the device’s fax interface. Despite the seemingly outdated nature of fax technology, the session demonstrates how this vintage feature can still serve as a potential attack vector. The presenters will explore the possibilities of exploiting legacy tech in modern environments, with playful and harmless live demos, including running Doom on the device. Expect a mix of technical insights and humorous moments, highlighting the surprising vulnerabilities hidden in outdated technology.
Carlo Meijer is a founding partner at Midnight Blue. He specializes in embedded security and critical infrastructure. His most notable research includes the reverse engineering and subsequent analysis of TETRA, a telecommunication standard mostly found in law enforcement and critical infrastructure, wherein a backdoored cipher and other critical vulnerabilities were discovered. Furthermore, he is known for breaking a hardened variant of the Mifare Classic Crypto1 RFID cipher, breaking the security of Self-Encrypting Drives, and compromising default password generators in ISP-deployed consumer routers.
Rick de Jager is a master’s student at Eindhoven University of Technology (TU/e) with a strong passion for cybersecurity and competitive hacking. As an avid CTF player, Rick is an active member of the CTF teams Superflat and 0rganizers. He also represented Team Europe in the International Cybersecurity Challenge (ICC) in 2022, 2023, and 2024, and wrote the open source traffic analyzer “tulip”. Rick has participated in Pwn2Own for three consecutive years, successfully demonstrating exploits in consumer hardware and automotive targets.

SOS (Supply chain Of Supply chain) Attack – Discover and exploit 0-day from 1-day at scale

Chuong "Cobra" Nguyen,

Exploit Developer at ECQ

Thai Nguyen,

BAM (Binary/APT/Mobile) Team Leader at ECQ

This talk explores supply chain security from a hacker’s perspective, highlighting how vulnerabilities in nested dependencies can be turned into 0-day exploits. We demonstrate automated techniques for identifying and exploiting 0-day vulnerabilities in popular software, revealing the limitations of current SBOM-based and static analysis methods.
Thai Nguyen is a security researcher at ECQ, an offensive security company, leading the BAM team (Binary/APT/Mobile Exploitation). He specializes in breaking mobile applications, Linux systems, and browsers, likes to innovate in vulnerability research and exploit development. As a low-key exploit developer, he has created several exploits for unpublished 0day vulnerabilities. He has also received public acknowledgments from bug bounty programs, competition and companies including Google VRP, Pwn2Own, Oracle and more. Chuong “Cobra” Nguyen is an Exploit Developer at ECQ and a member of BAM team, specializing in Browser Exploitation and Red Teaming. He has successfully compromised numerous browser-based software, and like to developing highly reliable exploits. He is a two-time Pwn2Own winner with Team ECQ.

Attacking Debug Modules in the Android Ecosystem

Lewei Qu,

Automotive Security Team Leader and Top Bug Hunter with 500+ CVEs

Debug modules play a crucial role in the Android ecosystem by capturing logs, managing exceptions, and supporting vendor-specific verification. These modules help diagnose system issues and improve product quality, but they also introduce security risks, such as local privilege escalation and information leakage, due to their access to sensitive system data. This session explores the native debug architecture of Android, delves into vendor-specific debug modules from two vendors, and builds a threat model to analyze potential attack surfaces. Through real-world examples, we highlight the security issues discovered, leading to 49 CVEs, and provide recommendations for improving the security of debug modules.
Lewei Qu is a Security Architect at ByteDance, specializing in cloud and infrastructure security. Previously, he focused on mobile, IoT, and vehicle security, significantly contributing to the discovery of vulnerabilities in platforms such as Google Android, MediaTek, and UniSoC. With over 500 CVE credits to his name, Qu has been recognized as the top bug hunter in the UniSoC Product Security acknowledgments and was honored by Google as a top bug hunter in 2022. He has presented at numerous prominent security conferences, including Black Hat Europe 2021, Black Hat Asia 2022, 2024 and 2025, Black Hat USA 2022, and KCon 2023.

Shadows in the Cloud: The Invisible Pathways to Breaching AWS Accounts

Assaf Morag,

Director of Threat Intelligence at Aqua Nautilus

This talk will introduce new attack vectors that have led to the discovery of multiple critical vulnerabilities in AWS services and open-source projects. We will showcase novel exploitation techniques that leverage default roles and shared resources within AWS to gain unauthorized access, leading to full account takeovers.
Assaf is the Director of Threat Intelligence at Aqua Nautilus, where is responsible of acquiring threat intelligence related to software development life cycle in cloud native environments, supporting the team’s data needs, and helping Aqua and the broader industry remain at the forefront of emerging threats and protective methodologies. His research has been featured in leading information security publications and journals worldwide, and he has presented at leading cybersecurity conferences. Notably, Assaf has also contributed to the development of the new MITRE ATT&CK Container Framework.

Journey to freedom: Escaping from VirtualBox and Unchaining Objects in the Windows Kernel

Corentin Bayet,

CTO of REverse Tactics, security researcher with 7+ years of experience, specializing in low-level technologies

Learn how the team successfully exploited a VirtualBox escape and chained it with a Windows kernel LPE to gain full host compromise. See how their approach involved identifying multiple vulnerabilities, bypassing mitigations, and using a memory exhaustion technique to escalate privileges on the Windows host.
Corentin Bayet is the CTO of REverse Tactics and a seasoned security researcher with over 7 years of experience in vulnerability research and exploitation. His expertise lies in low-level technologies, including operating systems, kernels, and hypervisors. Corentin has publicly demonstrated multiple VM escapes at high-profile events like Pwn2Own. He has also delivered talks and papers on bug hunting in virtualization and exploitation on Windows kernel.

Fun with Binary Polynomials: Obfuscation and Reverse Engineering

Arnau Gàmez i Montolio,

Hacker, security researcher and mathematician with a strong bias towards software security and reverse engineering

Binary polynomials might sound theoretical, but they have powerful real-world applications in security. This talk explores how these mathematical structures can be used for code obfuscation, reverse engineering, and program analysis. We’ll break down key concepts in a hands-on, accessible way, with real code examples and practical takeaways for security researchers and developers.
Hacker, security researcher and mathematician with a strong bias towards software security and reverse engineering. Specialized in software protection research and development (obfuscation, cryptography, mixed boolean-arithmetic algebra, inverse mappings, etc.) from a dual attack-and-defense perspective, both in academia and industry. Experienced malware analyst in the antivirus sector and security engineer in the gaming industry. Founder of Fura Labs, a boutique security firm and consultancy focused on software protection research and education. Speaker and trainer at several international security conferences.

The Crypto Game of North Korea: Stealing Money with Chrome 0-days

Boris Larin,

Principal Security Researcher at Kaspersky, Expert in Threat Hunting & Reverse Engineering

In May 2024, the team discovered a North Korean malware campaign targeting the cryptocurrency sector, exploiting zero-day vulnerabilities in Google Chrome. The attackers used a custom online game as bait, achieving remote code execution and stealing personal data through a sophisticated exploit chain.
Boris Larin is a renowned expert in the fields of threat hunting and software reverse engineering. He works as a Principal Security Researcher in GReAT at Kaspersky. Boris discovered and investigated a number of high-profile APT attacks (e.g. Operation Triangulation – the famous attack on iOS devices) and reported two dozen zero-day exploits. While working at Kaspersky, Boris has presented his work at a large number of conferences: CanSecWest, SAS, BlueHat, TyphoonCon, CodeBlue, Chaos Communication Congress, OffensiveCon, and many others.

Advanced Hacking of IoT Smart Home Devices

Dr. Carlos Nkuba,

Research Professor at Korea University’s Center for Software Security & Assurance (CSSA)

This talk features live demos of advanced attacks on Z-Wave smart home controllers, exposing memory vulnerabilities. It shows how attackers can modify device properties to trigger DoS attacks, disrupting entire smart home systems.
Dr. Carlos Nkuba is a Research Professor at Korea University’s Center for Software Security & Assurance (CSSA). As a cybersecurity researcher and IoT security expert, he specializes in wireless protocols, smart home security, and vulnerability research. He has discovered multiple zero-day vulnerabilities in IoT smart home networks and contributed to their security enhancements.

Desync the Planet – Rsync Remote Code Execution

Simon Scannell,

A Self-taught vulnerability researcher and part of Google's Cloud Vulnerability Research team

Google’s Cloud Vulnerability Research team discovered five critical Rsync vulnerabilities, including a 9.8 severity CVE, affecting 18,000+ exposed servers. This talk covers root causes, exploitation, and supply chain risks, backed by real-world data.
Simon is a self-taught vulnerability researcher and is part of Google’s Cloud Vulnerability Research team. Apart from playing board-games and traveling, he enjoys finding memory unsafety issues and exploiting logic bugs.

Invisible Disclosures: The Hidden Risks of URL Protocol Handler Leaks

Satoki Tsuji,

Cybersecurity Enthusiast, CTF Player and Bug Hunter

This talk explores vulnerabilities in Mozilla Firefox, focusing on security risks in URL protocol handlers, including side-channel attacks that expose installed applications. It highlights two flaws (CVE-2024-5690 & CVE-2024-9398) enabling system profiling without user interaction and offers mitigation strategies for developers and security professionals.
Cybersecurity Enthusiast, CTF Player and Bug Hunter, Satoki Contributed to the organization of SECCON CTF, took the stage at Security Analyst Summit 2024 and AVTOKYO2020/2023/2024, and competed in the DEF CON CTF Finals. Renowned for uncovering and reporting vulnerabilities in web services and software including Google and Firefox.

Pwning Shopping Mall CMS (with a Contribution to Korea’s Cybersecurity)

SeongJoon Cho,

Security researcher at SSD Labs, specializing in web security

Online shopping malls are a major part of South Korea’s digital economy, powered by CMS platforms that handle products, transactions, and customer data. Our research uncovered 15 critical vulnerabilities across two widely used CMS solutions, including file read, account takeover, and remote code execution flaws. This talk explores CMS architecture, security measures, and how these vulnerabilities were responsibly patched through South Korea’s unique bug report program.
SeongJoon Cho is a security researcher at SSD Labs, specializing in web security. He has been working in the field of offensive security since 2020, with past experience in researching embedded devices, web applications, and Windows systems.

Hack the Sky: Exploring Satellite Vulnerabilities and Cyber Threats

Shahmeer Amir,

Entrepreneur and ethical hacker

This presentation delves deep into the world of satellite technology, revealing the astonishing vulnerabilities that exist within these critical components of our modern infrastructure. While satellites have undoubtedly revolutionized our way of life, they have also become prime targets for hackers, cybercriminals, and state-sponsored actors seeking to exploit their weaknesses.
Shahmeer Amir is a renowned entrepreneur and ethical hacker, ranked among the world’s top bug hunters and awarded Entrepreneur of the Year 2024. He has helped over 400 Fortune companies, including Facebook and Microsoft, resolve critical security issues. As CEO of Speeqr, he leads next-gen audio-video communication tech, while also heading Veiliux, Asia’s first mainstream cybersecurity startup, and Authiun, a password-less authentication solution. He advises Pakistan’s Ministry of Finance on cybersecurity and is a Forbes Technology Council member. A prolific author and keynote speaker, Shahmeer has presented at over 80 global conferences and is currently exploring Blockchain for his doctorate.

Inside a New OT/IoT Cyberweapon: IOCONTROL

Sharon Brizinov,

Leading security researcher at Claroty

In December 2024, we uncovered IOCONTROL, a modular malware attributed to Iranian threat actors, targeting IoT and OT systems worldwide. Designed for maximum adaptability, it infects Linux-based devices across ARM (LE/BE), MIPS, x86, and more—compromising PLCs, gas pump controllers, routers, firewalls, and IP cameras. This talk by Sharon will provide an in-depth technical analysis of the malware, covering static and dynamic reverse engineering techniques, embedded environment emulation, and real-time behavioral analysis. We will also examine its stealth tactics, including MQTT-based C2 communication, DNS-over-HTTPS obfuscation, and remote control capabilities. Finally, we’ll discuss its impact on victims and how the campaign was disrupted.
Sharon Brizinov is a renowned expert in IoT and OT vulnerability research currently leading Claroty’s research group – Team82. With over 200 CVEs to his name he has shared his insights at prestigious conferences such as DEFCON, BlackHat, SANS, and more. Sharon has competed in Pwn2Own five times, earning the title of Master of Pwn, and has been honored with the SANS Institute Researcher of the Year Award and a DEFCON Black Badge.

How to Steal a Drone (Drone Hijacking) – From Myth to Reality: A Live Demonstration

Neo Theone,

Leader of IoT Pentest - VNPT Cyber Immunity

Explore a newly discovered vulnerability in ExpressLRS (ELRS), an open-source, long-range radio link used in FPV drone systems. A recently identified bug could force drones into full throttle, leading to uncontrollable acceleration until the battery is depleted. This talk will examine the implications of this issue, its potential risks in critical environments, and ongoing discussions within the ELRS community to address the vulnerability.
Lê Phạm Thiên Hồng Ân, also known as Neo Theone, is a Vietnamese cybersecurity expert specializing in Internet of Things (IoT) security. He graduated among the top five students from the Academy of Cryptography Techniques in Vietnam and began his career at Viettel’s Cyber Security Center, focusing on software vulnerability assessments. Later, he joined VNPT Cyber Immunity as the Head of IoT Security Research, where he developed VNPT IoT Guard, a pioneering solution addressing IoT security challenges in Vietnam. Hồng Ân has been an active speaker at various cybersecurity conferences, including Security Bootcamp and TyphoonCon, sharing insights on IoT device exploitation and security measures.
Loading...

Vulnerability Research and Exploitation on Edge Devices

Marco Ortisi,

Zerodays and vulnerability researcher

Edge devices attacks are on the rise. They provide attackers with an easily identifiable network entry point due to their deliberate internet exposure. Edge devices encompass a wide variety of different solutions such as virtual private network (VPN) servers, firewalls, load balancers, routers, mail systems, etc… and therefore they represent one of the most attractive targets for criminals and nation-state entities to establish initial access inside victim networks. Furthermore, bug bounty programs are increasingly looking for these types of vulnerabilities. Whether you want to create a working proof of concept with only a few public technical details as a starting point, reproduce a 1-day exploit through patch diffing or discover new 0day vulnerabilities on your own, this class aims to teach and show students the approaches, techniques and tools to do so. No bullsh*t XSS or missing secure cookie attribute vulnerabilities here. Anything less than critical impact/RCE is banned from this course. What is really scary, students don’t need to be l33t hackers to discover and exploit vulnerabilities with the potential of having devastating impacts in the edge device world.
Marco has been professionally dealing with IT security since 1999. After several experiences in Italy and abroad as penetration tester, vulnerability researcher, team leader and ultimately red team manager, he went through a midlife crisis that made him deciding to switch back to vulnerability research/analysis (especially 0days) and rediscover the pleasure of being the only person into his own business reporting line. Marco is a former speaker & trainer at Blackhat, BruCON, hackinbo and many others.
Read More

Automated Reverse Engineering

Kyle Martin,

Computer Engineer, Educator and Security Researcher at Vector 35

This class, for experienced reverse engineers, leverages the latest in modern program analysis theory to simplify and automate many every-day reverse engineering tasks. We’ll cover how to model high-level language patterns and identify them in binaries regardless of target architecture, automate source-to-sink analysis, build a collection of scripts to run on any binary you open to extract key program attributes, and so much more. We’ll discuss how to use automation in long-term reverse engineering projects on large code bases and leverage user annotations to make incremental progress towards your goals, as well as batch processing to make quick, automated decisions and reports on binaries as they come in the door.
Kyle Martin is a cybersecurity software engineer and educator, focused on making all things “binary” easier to understand. Kyle has over 10 years of teaching and presenting experience, going all the way back to when he was the head counselor at a computer camp, rewriting their C++ and x86 assembly courses at just 15 years old. Since then, he’s been involved in organizing highly-specialized cybersecurity events around the world, spanning concepts such as reverse engineering, incident response, vulnerability research, malware analysis, capture the flag, offensive security, and cutting-edge program analysis. Kyle brings with him the expertise and support of the entire Vector 35 team, creators of Binary Ninja.
Read More

침투 테스트 에센셜: 윤리적 해킹에 대한 초보자의 여정 Penetration Testing Essentials: A Beginner’s Journey into Ethical Hacking

Han Soo Kim,

Penetration Testing Expert & Hacking Content Creator

This course provides a comprehensive introduction to penetration testing with a focus on web application security. Students will learn essential concepts such as network communication, common hacking techniques, and the penetration testing methodology. Key topics include identifying and exploiting vulnerabilities like parameter tampering, file upload issues, Cross-Site Scripting (XSS), and SQL injection. The course also covers advanced techniques for bypassing security measures like Web Application Firewalls (WAFs). Students will gain hands-on experience through practical labs, including mini Capture the Flag (CTF) challenges. Finally, they will learn how to effectively document and report their findings, an essential skill in penetration testing and bug bounty programs.
With over seven years of experience in penetration testing, Normaltic has developed a deep expertise in ethical hacking. He began his career at SK Infosec as a Penetration Tester from 2018 to 2021 and is now a freelance penetration tester and instructor. In addition to his work in penetration testing, he consults on hacking scenarios for drama productions and creates content on YouTube under the name “Normaltic.” Through his YouTube channel, he shares hacking techniques and incidents in an easy-to-understand format, aiming to inspire others to explore cybersecurity and contribute to a safer online world. Normaltic is also passionate about teaching and frequently delivers lectures on penetration testing and bug bounty programs, focusing on making complex technical concepts accessible to beginners.
Read More

**SOLD OUT!** Hands-On Fuzzing: Identifying Vulnerabilities Across Linux and Windows Platforms **SOLD OUT!**

Hardik Shah,

Principal Security Researcher

Fuzzing is a powerful technique for identifying vulnerabilities in software. This hands-on training will cover the theory and practical aspects of fuzzing, including coverage-guided fuzzing, basic blocks and binary instrumentation, corpus collection and minimization, target selection, crash triage and root cause analysis, and real-life CVE analysis. In this workshop, attendees will have the opportunity to practice fuzzing on Linux and windows platforms and apply the concepts and techniques learned in the training to fuzz real world software. The training will also showcase how can we customize WinAFL to add new features and suit our needs. This training is suitable for attendees with a basic understanding of software development and testing and is beginner friendly. This training will start from user mode fuzzing and later on covers topics like linux kernel fuzzing and firmware fuzzing etc. In this training, attendees will also learn about the different types of vulnerabilities that can be found through fuzzing, including buffer overflows, heap overflows, integer overflows, use-after free errors, and out-of-bounds read/write errors. We will discuss the underlying causes and potential impacts of these vulnerabilities, as well as how to identify and address them through fuzzing. In addition to coverage-guided fuzzing, we will also introduce other types of fuzzer, such as dumb fuzzers and mutation fuzzers, and discuss their benefits and limitations. Attendees will also learn how to use tools such as GDB, WinDBG and Crashwalk to debug and analyse crashes, and to perform root cause analysis to identify the underlying cause of vulnerabilities. We will also see how to debug crashes using time travel debugging on windows, measure code coverage, collect corpus and minimise them.
Hardik Shah (@hardik05) is an experienced cybersecurity professional with 19+ years of experience in the computer security industry. Currently works as a Principal Security Researcher at a cyber security company where he is responsible for analyzing the latest threats, detecting them and driving product improvements. In the past he has worked with various security companies like Sophos, McAfee, and Symantec, where he has built research teams from the ground up, managed various critical cyber threats to provide protection to customers, implemented various product features and has mentored many people. Hardik is also known for his skills in fuzzing and vulnerability discovery and analysis. He has discovered 50+ vulnerabilities in Microsoft and various open source software. He had conducted workshops at various industry leading cyber security conferences such as DEFCON, BSides, RSA Dark arts, and many others. Hardik enjoys analyzing latest threats and figuring out ways to protect customers from them.
Read More
Conference
Training

Take Part in the [] All-Offensive Security Conference in Asia!

Buy Tickets