2.0 -//Pentabarf//Schedule//EN PUBLISH ZTPWJS@@cfp.bsidesfrankfurt.org -ZTPWJS Intro en en 20260910T092000 20260910T093000 001000

Intro

PUBLIC CONFIRMED Short-Talk https://cfp.bsidesfrankfurt.org/call-for-paper-presentations-2026/talk/ZTPWJS/ Großer Saal PUBLISH 7ZNYWP@@cfp.bsidesfrankfurt.org -7ZNYWP Keynote (Jörn Schneeweisz) en en 20260910T093000 20260910T101000 004000

Keynote (Jörn Schneeweisz)

Jörn Schneeweisz is a Principal Security Engineer at GitLab who managed to turn a decade of breaking other people's broken Ruby on Rails code into a legitimate corporate career, because apparently, getting paid to tell companies how bad their security is qualifies as a real job. PUBLIC CONFIRMED Talk https://cfp.bsidesfrankfurt.org/call-for-paper-presentations-2026/talk/7ZNYWP/ Großer Saal Joernchen PUBLISH KVLR3V@@cfp.bsidesfrankfurt.org -KVLR3V Welcome to Hybrid Hell - Breaking Entrpise Identity beyond Active Directory en en 20260910T101000 20260910T110500 005500

Welcome to Hybrid Hell - Breaking Entrpise Identity beyond Active Directory

Enterprise identity is no longer defined by a single directory service. Modern organisations operate complex identity architectures spanning Active Directory, Microsoft Entra ID, Azure, Microsoft 365, SaaS platforms, synchronisation services, multiple identity providers and increasingly multiple business units, subsidiaries and cloud tenants. Every integration introduces new trust relationships. Every trust relationship introduces new attack paths. This session approaches enterprise identity from the perspective that matters most during an assessment: the attacker’s. Rather than presenting a catalogue of Active Directory or Entra ID attack techniques, the talk focuses on how modern enterprise identity is constructed, why traditional assessment methodologies frequently fail to capture the complete attack surface, and how attackers move across identity boundaries by abusing trust instead of exploiting individual technologies. Using realistic enterprise architectures, practical demonstrations and real-world attack scenarios, the session examines common challenges encountered during offensive security engagements, including hybrid identity deployments, synchronisation, multi-forest environments, multiple Entra ID tenants, delegated administration, identity trust relationships and assessment scoping. The audience will see how architectural decisions influence attack paths, why trust relationships become the true security boundary, and how weaknesses in one part of the identity architecture can create unexpected consequences elsewhere. The presentation concludes with a practical framework for mapping enterprise identity architecture from an attacker’s perspective, enabling security teams to define more realistic assessment scopes, prioritise the trust relationships that matter most, and better understand how identity has become one of the largest and least visible enterprise attack surfaces. Key takeaways * Understand how enterprise identity has evolved beyond a single directory service. * Learn why attackers focus on trust relationships rather than technology boundaries. * Identify common architectural patterns that expand the enterprise identity attack surface. * Recognise the challenges of scoping and assessing complex hybrid identity environments. * Apply an attacker-focused methodology for analysing enterprise identity architecture and prioritising risk. PUBLIC CONFIRMED Talk https://cfp.bsidesfrankfurt.org/call-for-paper-presentations-2026/talk/KVLR3V/ Großer Saal georg PUBLISH QDB7NB@@cfp.bsidesfrankfurt.org -QDB7NB What Windows 11 Remembers (And Most Investigators Miss) en en 20260910T110500 20260910T120000 005500

What Windows 11 Remembers (And Most Investigators Miss)

PUBLIC CONFIRMED Talk https://cfp.bsidesfrankfurt.org/call-for-paper-presentations-2026/talk/QDB7NB/ Großer Saal Maurice Fielenbach PUBLISH AXSXQW@@cfp.bsidesfrankfurt.org -AXSXQW Hacking Consumer Drones: From Flash Dumping to Root Exploits en en 20260910T130000 20260910T135500 005500

Hacking Consumer Drones: From Flash Dumping to Root Exploits

This talk tracks an IT security researcher’s journey through the process of disassembling, dumping and exploiting the Potensic Atom 2 consumer drone. We’ll follow the full lifecycle of a hardware exploit: Starting with low-level chip identification and flash desoldering, we make a detour into recovering heavily corrupted flash firmware by reverse engineering error correction codes. From there, we pivot to the software, reverse-engineering the binary firmware to uncover hidden backdoors in the drone's control protocol. Ending with a presentation of a custom exploit designed to hijack the drone and gain full root access. Whether you're interested in hardware RE or binary exploitation, this is a fast-paced look at every stage of the IoT research process. PUBLIC CONFIRMED Talk https://cfp.bsidesfrankfurt.org/call-for-paper-presentations-2026/talk/AXSXQW/ Großer Saal Tim Schmidt PUBLISH ZETL7P@@cfp.bsidesfrankfurt.org -ZETL7P Deconstructing Modern macOS Initial Access Vectors en en 20260910T140000 20260910T145500 005500

Deconstructing Modern macOS Initial Access Vectors

We begin by exploring the top of the funnel. Attackers have moved far beyond easily identifiable spam. We will deconstruct recent campaigns to show how adversaries are successfully lowering user guard through: How threat actors weaponize Google Ads to push malicious software disguised as legitimate enterprise tools (e.g., Slack, Notion, or VPN clients). A deep dive into localized, highly convincing fake browser updates and system notification campaigns that socially engineer users into bypassing native warnings. Once the user interacts with the lure, how does the malware actually run? macOS is a rich Unix-based environment with multiple scripting avenues. We will analyze the "Living off the Land" (LotL) techniques currently dominating the macOS threat landscape, including: The use of Bash, Zsh, and legacy Python/Perl scripts to establish persistence and pull down secondary payloads. How attackers weaponize Apple’s native automation languages to silently interact with system APIs, bypass sandbox restrictions, and generate convincing fake credential prompts. Techniques used by threat actors to obfuscate their code, making static analysis incredibly difficult for defenders. Finally, we will break down how these threats are packaged to evade Gatekeeper and initial static analysis. We will compare and contrast real-world samples across: The weaponization of standard Apple Disk Images (.dmg) and Installer Packages (.pkg), including pre-install/post-install script abuse. The shift from standalone Mach-O binaries to hiding malicious routines inside Platypus-packaged applications and bloated Electron frameworks, which are notoriously difficult for traditional AV to parse effectively. PUBLIC CONFIRMED Talk https://cfp.bsidesfrankfurt.org/call-for-paper-presentations-2026/talk/ZETL7P/ Großer Saal Stephan Berger PUBLISH XPLEJW@@cfp.bsidesfrankfurt.org -XPLEJW Lessons learned while building an Agentic SOC: The good, the bad, and the scary. en en 20260910T152500 20260910T162000 005500

Lessons learned while building an Agentic SOC: The good, the bad, and the scary.

PUBLIC CONFIRMED Talk https://cfp.bsidesfrankfurt.org/call-for-paper-presentations-2026/talk/XPLEJW/ Großer Saal Aaron Jewitt PUBLISH 3WDFBK@@cfp.bsidesfrankfurt.org -3WDFBK Keyless Entry: Hacking SwitchBot Smartlocks en en 20260910T162000 20260910T164500 002500

Keyless Entry: Hacking SwitchBot Smartlocks

While selecting targets for a team IoT hacking event, the SwitchBot Lock Pro Combo stood out: it is one of the most sold smart locks on the market, offering PIN, fingerprint, NFC, and app-based entry. The hardware consists of an indoor actuator that turns the physical key and an outdoor keypad. However, our initial recon of the Android app revealed, that the outdoor keypad holds the decision-making logic and sends execution commands to the indoor actuator over unprotected BLE, relying entirely on a custom application-layer encrypted protocol. Diving deeper into this custom protocol, we discovered a fatal cryptographic failure. The devices negotiate a secret key and a nonce, but they encrypt their commands using AES in Counter (CTR) mode. Because CTR mode turns a block cipher into a stream cipher and lacks any integrity protection (like a MAC), bit-flips in the ciphertext propagate directly to the plaintext upon decryption without an opportunity to detect the manipulation. In this 30-minute presentation, we will walk the audience through how we weaponized this exact flaw. Because a keypad's LOCK button always broadcasts an encrypted command, an attacker only needs to sniff it. We will explain the math behind our "master key", which only required a pre-computed XOR between encrypted LOCK and UNLOCK commands that is identical across all sessions and locks. By simply applying this to any sniffed LOCK ciphertext, we can instantly forge a valid UNLOCK command and open the door. We will give a live demonstration of this software-only attack in action. Finally, we will detail our responsible disclosure journey, which serves as a perfect case study in the difficulties of patching IoT ecosystems. The vendor's initial beta patch attempted to add a 2-byte truncated MD5 "YOLO hash" for integrity verification. However, because updating the entire ecosystem takes time, the lock still had to accept legacy commands from the smartphone app. We will show how we trivially bypassed the new patch by simply spoofing the smartphone app, ignoring the checksum entirely. PUBLIC CONFIRMED Short-Talk https://cfp.bsidesfrankfurt.org/call-for-paper-presentations-2026/talk/3WDFBK/ Großer Saal Kolja Grassmann PUBLISH ZCPUYM@@cfp.bsidesfrankfurt.org -ZCPUYM Pentesting in the age of AI - where are we? en en 20260910T164500 20260910T174000 005500

Pentesting in the age of AI - where are we?

An AI agent for a few hundred euros doing the job of a highly skilled senior penetration tester? That sounds great. But are we actually there yet? This talk explores different ways of using AI for static and dynamic security analysis. We will look at AI as the pentester, AI as an assistant for validating tool output, and AI as the convenient interface for people who are too lazy to read the manual. Evaluating the results of today’s AI-based pentesting projects can feel familiar to anyone who has reviewed a junior tester’s first report: some valid findings, some interesting ideas, some missing context, and a few confidently incorrect conclusions. So what is the real issue? Is AI still not good enough, or is the person in front of the prompt part of the problem? Focusing on Static Application Security Testing and Dynamic Application Security Testing, this talk presents practical examples, real-world observations, and a sober assessment of where AI can support penetration testing today. We will discuss what works, what fails, and why blindly trusting AI-generated security results is still a bad idea. PUBLIC CONFIRMED Talk https://cfp.bsidesfrankfurt.org/call-for-paper-presentations-2026/talk/ZCPUYM/ Großer Saal Christian Biehler PUBLISH ELHBVZ@@cfp.bsidesfrankfurt.org -ELHBVZ Outro en en 20260910T174000 20260910T175500 001500

Outro

PUBLIC CONFIRMED Short-Talk https://cfp.bsidesfrankfurt.org/call-for-paper-presentations-2026/talk/ELHBVZ/ Großer Saal