Kawaiicon 2025 (Kawaiicon III)
New Zealand's cute infosec con returned after a break, with a single track of talks in Wellington on phishing detection with Canarytokens, macOS ransomware defense, MCP agent security, weaponised XSS, Jira and Confluence plugin bugs, an in-the-wild Chrome sandbox escape, a live Enigma machine demo and Peter Gutmann on why quantum cryptanalysis is bollocks.
→ See editor’s top picks at Kawaiicon 2025 (Kawaiicon III)
- nothing we do matters (so it can't hurt to try!) — elle armageddon
In her compelling Kawaiicon talk, "nothing we do matters (so it can't hurt to try!)," security leader elle armageddon delivers a powerful call to action, urging security professionals to translate…
- The High-Stakes Cat-and-Mouse Game of Phishing — Jacob Torrey
In "The High-Stakes Cat-and-Mouse Game of Phishing," Jacob Torrey, Head of Labs at Thinkst Applied Research, dissects the relentless and rapidly evolving struggle between phishing attackers and…
- Breached by a Ten Foot Clown — Lozza
In "Breached by a Ten Foot Clown," Lozza, a former circus performer turned Governance, Risk, and Compliance (GRC) professional, delivers a captivating and unconventional talk that challenges…
- Ransom Ain't Goin' Nowhere: Shutting Down macOS Ransomware with Native Apple Protections — Calum Hall
In this insightful talk from Kawaiicon, Calum Hall, founder of macOS endpoint detection and response (EDR) product Phorion and a seasoned macOS security researcher, delves into the evolving…
- Getting Down and Dirty with SBOMs — Colby Prior
In his Kawaiicon talk, "Getting Down and Dirty with SBOMs," Colby Prior, a Lead Security Engineer at Octopus Deploy, delves into the critical importance and evolving landscape of Software Bill of…
- Is My Job Even Real? Bullshit Jobs in Infosec — errbufferoverfl
In her thought-provoking Kawaiicon talk, "Is My Job Even Real? Bullshit Jobs in Infosec," security engineer errbufferoverfl (also known as Beck or Buffy) delves into the pervasive feeling of…
- The Future of Social Media: An Optimistic Take — Jon Bell
In his Kawaiicon talk, "The Future of Social Media: An Optimistic Take," Jon Bell, a designer and former member of Twitter's Trust and Safety team, challenges the pervasive cynicism surrounding the…
- Weaponising XSS for Red Teams — Jesse, Noah
In this insightful Kawaiicon talk, Jesse and Noah from Tanto Security delve into the often-underestimated power of Cross-Site Scripting (XSS) vulnerabilities when weaponized for red team operations…
- Model Context Protocol is Insecure by Design — Jesse Merhi
In this insightful talk at Kawaiicon, Jesse Merhi, a Product Security Engineer at Atlassian, sheds light on the inherent security challenges within the Model Context Protocol (MCP), arguing that its…
- Stunt Hackers and Engineers and the Dawn of LOUD — Wade Winright
In his Kawaiicon talk, "Stunt Hackers and Engineers and the Dawn of LOUD," Wade Winright, Senior Director of Security at Aiven, masterfully draws parallels between the pioneering innovators of the…
- The Enigma Machine: Live Demo'd and Explained — Mike Pritchard
In an engaging and highly illustrative talk at Kawaiicon, Mike Pritchard, founder of the Australian Spy Museum, delivered a compelling presentation titled "The Enigma Machine: Live Demo'd and…
- Reversing Bytecode into Bounties: Uncovering Vulnerabilities in Jira and Confluence Plugins — Giuliana, Jamal
In their Kawaiicon presentation, "Reversing Bytecode into Bounties," Atlassian security engineers Giuliana and Jamal provided a comprehensive guide to identifying and exploiting vulnerabilities…
- Why Quantum Cryptanalysis is Bollocks — Peter Gutmann
In his compelling Kawaiicon talk, "Why Quantum Cryptanalysis is Bollocks," Peter Gutmann, a researcher from the Department of Computer Science at the University of Auckland, delivers a scathing…
- let's make malware but it might get caught so the malware gets worse — Alex
In this insightful Kawaiicon talk, "Let's Make Malware But It Might Get Caught So The Malware Gets Worse," Alex, founder of mangopdf Communication and a seasoned red teamer, demystifies the…
- Those Who Do Not Learn from Advisories Are Doomed to Repeat Them — Louis Nyffenegger
In his Kawaiicon talk, "Those Who Do Not Learn from Advisories Are Doomed to Repeat Them," Louis Nyffenegger, founder of PentesterLab, passionately advocates for the proactive study of past Common…
- From Plug to Pwn — Kylie McDevitt
In this compelling talk, Kylie McDevitt, founder of InfoSect, takes the audience on a detailed journey through the intricate process of compromising a high-end consumer smart device: the Sonos Era…
- What Permaculture Design Taught Me About Security — Laura Wratten
In a refreshing departure from typical technical security talks, Laura Wratten, an Application Security Engineer at Canva, presented a unique perspective on security design, drawing parallels from…
- Who's the Bose? — @adamparsonz
In his Kawaiicon talk, "Who's the Bose?", IT Solutions Consultant Adam Parsonz shared a compelling personal journey that seamlessly blended enterprise-grade security principles with the…
- Disregard Buzzwords: Effectively Building Secure Stuff — Adrian Hayes
In his Kawaiicon talk, "Disregard Buzzwords: Effectively Building Secure Stuff," Adrian Hayes, Managing Director and Principal Consultant at Pulse Security, delivers a compelling and pragmatic…
- Buzzkill: How Using Hacker Tools Can Get You Owned — Justin Steven
In "Buzzkill: How Using Hacker Tools Can Get You Owned" at Kawaiicon, Justin Steven, Head of Research at Tanto Security, delivered a compelling and technically rich presentation on a critical, often…
- Responding to an ITW Chrome Sandbox Escape (Twice!) — Alex Gough
In this compelling talk from Kawaiicon, Alex Gough of Google's Chrome security team provides a detailed, post-mortem analysis of two critical in-the-wild (ITW) sandbox escape vulnerabilities…
- How to Use God Mode in Windows — James Spicer
In the realm of advanced Windows exploitation, achieving kernel read/write primitives (often referred to as "god mode" by the speaker) is frequently considered a definitive victory. However, as…