Summercon 2025

Vlad Ionescu

In this talk we take a brief journey through time to understand how “AIs” have found security bugs from the beginning, up to today, and what the near future holds for attackers and responders alike. You will leave with an understanding of how traditional ML struggled to find impactful bugs, how you can use LLMs today to automate major parts of vulnerability research, and why all of this matters.

OMAR

Github Actions is increasingly becoming a popular tool for organizations to run CI and other automation tasks, and understandably so: they’re easy to use, composable, and have tons of available integrations. Like with any technology though, they come with security risks and concerns that can be easily overlooked.

Instead of dissecting common Github Actions vulnerabilities, we’ll talk about what makes them the perfect target for static analysis. We’ll talk about the principles behind great static analysis tools, then demonstrate these principles using the tool we wrote specifically to find vulnerabilities in Github Actions.

Guanxing Wen

Decentralized Physical Infrastructure Networks (DePIN) are the latest Web3 hype machine — powering cloud phones, GPU edge nodes, and rendering clients that promise to reshape the internet and reward you in tokens while doing it. But behind all the buzzwords and blockchain dashboards, we found a whole lot of the same old IoT security sins — just with more centralization and a bigger attack surface.

This talk walks through our analysis of three leading DePIN platforms with thousands of globally deployed nodes and billions in market cap. Spoiler: one MQTT command can hijack 62,000+ GPU nodes into a mining botnet. Another lets you backdoor a user’s cloud phone via a backend config that nobody remembered was public. And a rendering client with a $2B market cap? One malicious link = remote shell. Fun times.

We’ll break down each exploit path — from BLE interfaces and path traversal to cloud service misconfigs and full remote compromise — with demos, technical details, and enough “wait, what?” moments to go around. This is the first public teardown of DePIN from the attacker’s perspective, and it paints a messy picture: centralized control, proprietary blobs, and zero disclosure processes hiding behind a token-incentive façade.

Decentralization sounds cool. But when your orchestrator pushes unsigned payloads to 60,000 nodes, it doesn’t matter how many tokens you’re holding. Without open code, real audits, and actual bug bounties, DePIN is sleepwalking into an IoT-style disaster — just with more crypto and bigger GPUs.

Bring your popcorn, and maybe cancel that DePIN investment.

Winnona Bernsen

Dive into the broken, bureaucratic, and bizarre world of 0day acquisition. Over the last year, I scraped all of CTFTime, combed through the iSoon leaks, and interviewed over 30 hackers, brokers, policy wonks, and current/former spooks to map how the U.S. and China really acquire offensive capabilities.

Spoiler: China is beating us – underpaying researchers, weaponizing youth Capture-the-Flag leagues, and using vulnerability disclosure laws to create a scary funnel of exploits into their intelligence apparatus. Meanwhile, U.S. agencies cling to stealth over speed, shovel cash at defense primes, and ghost vendors mid-contract.

This talk is a breakdown of China’s terrifyingly efficient cyber-industrial complex, the U.S.’s terrifying bureaucracy around bugs, and the weird vibes of being a VR firm in a geopolitical game of Go, sticking around even though it would probably be easier to ragequit and do smart contract auditing instead. As with any good talk, there will be recommendations at the end, both for governments and for vendors.

If you’ve ever written an exploit, sold one, defended against one, or just screamed into the void about how slow the government is, this talk’s for you.