Hardware, RFID and Signaling Security (TBC)

TBC

Workshop: Hardware, RFID and Signaling Security (TBC)

TBC

Vulnerabilities Assembled! The Cross-Component Vulnerability Factory Inside the Windows Kernel (VXCON Exclusive Edition)

This talk will be delivered remotely via Zoom.

As a fundamental part of the Windows networking stack, AFD (Ancillary Function Driver for Winsock) has undergone years of security hardening and is often considered a well-investigated target with a shrinking attack surface. But is that really true? By viewing AFD from a cross-layer composition perspective and combining drivers and components like LEGO blocks, we uncovered more than 30 vulnerabilities.

We introduce the concept of transport-layer gadgets and show how different transports, execution paths, and fragile assumptions can be combined to create entirely new bug classes. The resulting LPE primitives are stable, exploitable, and affect multiple generations of Windows. Under certain conditions, they can also break AppContainer isolation and enable practical sandbox escapes.

In this talk, we explain how this attack surface emerges, present representative case studies, and share guidelines for identifying similar composition-driven vulnerabilities across the Windows ecosystem.

Automating N-Day PoC Generation: A Hybrid LLM + Program Analysis Framework for Patch-to-PoC

Patch diffing is one of the most effective techniques in N-day vulnerability research, yet it remains slow and manual: analysts must track upstream releases, separate security-relevant changes from noise, and hand-craft a trigger to reproduce the fix. In this talk I demonstrate a working framework that automates the pipeline end to end. The system combines LLM-based reasoning with classical program analysis—using retrieval and code-diff summarization to interpret changes, an LLM classifier to flag security-relevant patches, and LLM-guided input synthesis backed by fuzzing to produce a proof-of-concept that reproduces the patched bug. I will show the tool running live against real-world targets, walking from an opaque vendor patch to a validated PoC, and discuss where automation succeeds, where it breaks, and how the AI and program-analysis components compensate for each other’s weaknesses.

Reading Between the Fixes: Variant Hunting in WebKit

A WebKit patch is worth reading even when it doesn’t hand you a new bug. It shows the assumption the fix depends on, the shape of the bug it closes, and whether that same assumption holds up elsewhere in the code. Even a fully fixed bug points to the next place to look.

This talk is about reading patches that way. Through real examples, it follows a patch from its root cause to the nearby code that might share the same weakness, then weighs whether a variant is really there. Some readings turn up a new bug. Others reach a dead end, which still sharpens what to look for next. Both are the point.

The talk also introduces WebKit Weekly, a project that uses AI to review commits and draft security analyses. It shows how that fits into the research workflow, where the AI’s output is wrong, and how the researcher checks every finding against the code.

New Car Hacking Techniques and Research (VXCON Exclusive)

New car hacking techniques and research, presented exclusively at VXCON. Details to be announced.

New Car Hacking Techniques and Research (VXCON Exclusive)

New car hacking techniques and research, presented exclusively at VXCON. Details to be announced.

Full-Automatic CTF Agent: Lessons from CODEGATE 2026

In this talk, we present the Full-Automatic CTF Agent deployed at the CODEGATE 2026 Finals. The system was designed to participate in an entire CTF without human intervention. It manages the competition, prepares challenge environments, and solves challenges using frontier LLMs such as Codex and Claude. The system autonomously solved 22 out of 26 unique challenges across six categories. It also achieved First Bloods in both the General and Junior divisions. We share several interesting cases, including cross-challenge dependencies, dynamic environment changes, and unintended solutions. We also discuss where full automation struggled and why. Finally, we discuss the role of experienced hackers in the LLM era. Experienced hackers do more than know exploitation techniques. They narrow the search space, recognize dead ends, and decide when to change direction. We discuss how such experience can be incorporated into future autonomous security agents.

No Spec, No Historian, No Problem: Catching Process Manipulation in Proprietary OT Traffic

Your OT monitoring knows the HMI talked to the PLC. It has no idea the setpoint just changed. Proprietary protocols and undocumented function codes bury every command in bytes no dissector reads, and published reverse-engineering methods lean on historians and specs most plants don’t have. We’ll recover tags straight from SPAN traffic by turning the operators’ own writes into ground truth, then catch manipulation with detectors matched to how each tag behaves. When someone pushes a new PLC program, every decoded value breaks at once, and we’ll show how that failure becomes the alert. You’ll leave with false-positive numbers from dataset and a blunt account of where ML earned its place and where plain statistics won.

No ROM to Hide: Dumping Hidden Bootrom Code from a Tamagotchi Paradise

Tamagotchi Paradise devices encrypt part of their firmware and hide part of their bootrom, making it hard to understand what’s running your digital pet.

In this workshop, we’ll learn how to get around those protections. We’ll start by disassembling the Tamagotchi and soldering a bunch of wires onto various test points in order to interact with it over UART and SWD. We’ll then take an initial bootrom dump and examine its behavior. From there, we’ll abuse a quirk in the device’s CPU architecture to perform The Great Unhiding™: we’ll prevent the bootrom from hiding itself, dump it again, and discover a treasure trove of secrets that will let us take a better peek at the underlying game firmware.

If time allows, we’ll also think about how we can decrypt the game firmware using our newly obtained secrets.

There’s also an optional detour out of Paradise. Some pets would rather rip and tear.

Prerequisites: You should be comfortable using the command line and writing basic Python. A basic understanding of hexadecimal numbers, bitwise operations, and basic computer architecture (registers, memory accesses, etc.) will help. Some experience reading assembly will help, but you don’t need to know ARM or have used a hardware debugger before. We’ll also be soldering wires to small test points, so some soldering experience is recommended.