Best Talks at DefCamp 2025

1. 1

   Another One Bites the DAST

   István Albert-Tóth

   In "Another One Bites the DAST," István Albert-Tóth, DevSecOps and Product Development Director at VerSprite cybersecurity, delivers a compelling and critically important talk on the pervasive shortcomings of enterprise Dynamic Application Security Testing (DAST) tools…

   0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆
2. 2

   0-Click Compromise hits the Enterprise - thx AI!

   Inbar Raz

   Inbar Raz, VP Research at Zenity, delivered a compelling and unsettling talk at DefCamp titled "0-Click Compromise hits the Enterprise - thx AI!", building upon previous research presented at the same conference. The presentation meticulously detailed a new generation of…

   0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆
3. 3

   Access Denied (eventually)

   Ioan Constantin

   In a candid and insightful presentation at DefCamp, Ioan Constantin, a Cyber Security Expert at Orange România, shared a detailed post-mortem analysis of a significant data breach that impacted the telecommunications giant in February 2024. Titled "Access Denied (eventually),"…

   0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆
4. 4

   CLR DLL Side-Loading, a secret technique used by APT41

   Georgy Kucherin

   In this insightful talk, Georgy Kucherin, a security researcher from Kaspersky's Global Research and Analysis Team, unveils a sophisticated and often overlooked technique for **DLL sideloading** leveraged by the notorious threat actor **APT41**. While DLL sideloading is a known…

   0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆
5. 5

   C2 by Microsoft: What can go wrong if SCCM ends up in the wrong hands

   Alexander Rodchenko

   In the modern enterprise, **Microsoft System Center Configuration Manager (SCCM)** stands as a powerful, indispensable tool for managing a vast array of endpoints. It streamlines everything from operating system deployment and software updates to application distribution across…

   0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆
6. 6

   Deceiving LLM into Attacking its Own Agent through natural language

   Eric Kim, Chunghyun Kang

   In an insightful and technically detailed presentation at DefCamp, Eric Kim and Chunghyun Kang from Korea's Information Technology Research Institute (KITRI) unveiled critical vulnerabilities within **Large Language Model (LLM) agent** applications. Their talk, "Deceiving LLM…

   0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway SOLID ★★★☆☆
7. 7

   Exploring Browser Permissions and Exploiting Permission Hijacking

   Alberto Fernandez-de-Retana

   In this insightful DefCamp talk, Alberto Fernandez-de-Retana, also known as Boou in the CTF community, sheds light on the often-overlooked complexities and critical vulnerabilities within browser permission models. The presentation, titled "Exploring Browser Permissions and…

   0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway SOLID ★★★☆☆
8. 8

   NightmareFactory

   Matei "Mal" Badanoiu

   In "NightmareFactory," Matei "Mal" Badanoiu, Offensive Security Research Lead at Pentest-Tools.com, unveils a series of critical vulnerabilities discovered within Dream Factory, a platform that paradoxically prides itself on "code automation for securing REST API." The…

   0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway SOLID ★★★☆☆
9. 9

   New Kerberos Attack Vector : Disabled SPN Kerberoasting

   Yeonwoo Park

   In a compelling presentation at DefCamp, Yeonwoo Park, a seasoned red team operator from RaonSecure's Team SaturnX, unveiled a novel Kerberos attack vector dubbed "**Disabled SPN Kerberoasting**." This research exposes a critical design flaw within Microsoft's Active Directory…

   0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway SOLID ★★★☆☆
10. 10

    Trust No Format: Risks and Defenses for ML Model Serialization

    Octavian Purcaru, Văşcuță Denis

    In the rapidly evolving landscape of machine learning, the seemingly innocuous act of downloading and executing a pre-trained model carries significant, often overlooked, security risks. Octavian Purcaru, Incident Response Commander at Adobe, and Văşcuță Denis, a seasoned…

    0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway SOLID ★★★☆☆
11. 11

    Hidden Risks: Pitfalls in Learnable Obfuscation for Private A.I.

    Mihail-Iulian Pleșa

    In an era defined by stringent data privacy regulations like GDPR and the increasing need for collaborative data analysis across multiple, sensitive data silos, **privacy-preserving machine learning (PPML)** has emerged as a critical field. This talk by Mihail-Iulian Pleșa, a…

    0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway SOLID ★★★☆☆
12. 12

    TEE in Web3: Myths, Risks, and Real-World Pitfalls

    Kang Li

    In this insightful DefCamp talk, Kang Li, CTO of CertiK, delves into the complex interplay of **Trusted Execution Environments (TEEs)** and **Web3** applications, aiming to demystify common misconceptions and highlight critical security pitfalls. The presentation addresses the…

    0 Dr. Zero SOLID ★★★☆☆ H Heather Calloway STRONG ACCEPT ★★★★☆

View all talks at DefCamp 2025 →