May 26, 9:10-10:00AM - TRACK 1, ROOM 1900
The Truth is Out There? Navigating and Exploiting Misinformation and Disinformation in the 21st Century
Chester Wisniewski is Director, Global Field CISO at next-generation security leader Sophos. With more than 25 years of security experience, his interest in security and privacy first peaked while learning to hack from bulletin board text files in the 1980s, and has since been a lifelong pursuit.
Chester works with Sophos X-Ops researchers around the world to understand the latest trends, research and criminal behaviors. This perspective helps advance the industry's understanding of evolving threats, attacker behaviors and effective security defenses. Having worked in product management and sales engineering roles earlier in his career, this knowledge enables him to help organizations design enterprise-scale defense strategies and consult on security planning with some of the largest global brands.
Based in Vancouver, Chester regularly speaks at industry events, including RSA Conference, Virus Bulletin, Security BSides (Vancouver, London, Wales, Perth, Austin, Detroit, Los Angeles, Boston, and Calgary) and others. He’s widely recognized as one of the industry’s top security researchers and is regularly consulted by press, appearing on BBC News, ABC, NBC, Bloomberg, Washington Post, CBC, NPR, and more.
When not busy fighting cybercrime, Chester spends his free time cooking, cycling, and mentoring new entrants to the security field through his volunteer work with InfoSec BC.
LinkedIn: https://www.linkedin.com/in/chester-wisniewski/
Mastodon: https://securitycafe.ca/@chetwisniewski
May 26, 10:40-11:30
Practical Biometric System Hacking
Biometric systems, such as facial recognition and voice-print identification, are widely used for personal identification. In recent years, an increasing number of consumer products have integrated facial or voice recognition technology. However, how secure are these systems? In this talk, we will demonstrate simple yet highly practical attack methods to bypass some of these biometric recognition systems.
Kevin (Kevin2600) Chen is a security researcher who primarily focuses on vulnerability research in wireless and embedded systems. He has spoken at various conferences, including BSides, DEFCON, and CANSECWEST.
May 26, 11:40-12:30
The Deception Engine: How Cybercriminals Use AI to Hack Your Perception
In today’s digital world, cybercriminals are increasingly turning to Artificial Intelligence (AI) to amplify the scale and sophistication of their attacks. "The Deception Engine" explores how AI-powered tools are revolutionizing social engineering tactics, enabling criminals to manipulate human behavior and perception with startling precision. From deepfakes to AI-driven phishing campaigns, this talk uncovers how these technologies are being leveraged to deceive, manipulate, and exploit vulnerabilities in mobile devices, social media, and personal interactions.
Drawing on emerging trends and ethical dilemmas, we will examine the evolving role of AI in cybersecurity threats, including the ethical implications of AI-generated misinformation and the challenges it presents to mobile device security. Attendees will gain a deeper understanding of the defense strategies required to protect individuals and organizations from these cutting-edge AI-driven attacks, and how to stay ahead in an age where perception is as valuable as data itself.
Sourabh Aggarwal is a dynamic leader at the forefront of technology, innovation, and cybersecurity. As a Cybersecurity Professor at Westcliff University and Senior Consultant at iTED Consultant Inc., he empowers organizations and individuals with cutting-edge strategies to thrive in the evolving digital landscape.
With over decade of experience in teaching and consulting, Sourabh has shaped the careers of cybersecurity professionals who have gone on to work at leading companies/government agencies like RBC, Amazon, GeoComply, City of Sakatoon.
His academic journey continues as he pursues advanced studies in Management and Technology, exploring the intersection of entrepreneurship and digital transformation.Sourabh’s passion lies in fostering innovation, driving collaboration, and equipping others with the knowledge and tools to excel in the cybersecurity space, making him a respected figure in both academic and industry circles.
May 26, 1:30-2:20
Debunking Fake Social Media Profiles Using SOCMINT
Misinformation and disinformation abound in online spaces. From bots and sock puppets to state-sponsored influencers and deepfake-enhanced personas, there is no shortage of false and fraudulent profiles across social media platforms.
In this talk, we’ll look at the different types of fake accounts you may encounter online, how to train your “spidey sense”, and how to verify accounts and content with various SOCMINT (Social Media Intelligence) tools and techniques, including image verification, Google dorking, network analysis, behavioral profiling, lateral reading, and many others.
Beyond exploring the traditional “red flags”, we’ll be taking a look at the evolving techniques and trends in fake social media profile and content creation. Hang on to your @handle; it’s going to be a wild ride!
Ionatan Waisgluss is a cybersecurity and OSINT specialist licensed as a Private Investigator in British Columbia, with credentials including CompTIA Security+, Certified Information Privacy Professional (CIPP/C), and Certified Cryptocurrency Investigator. He brings extensive hands-on experience across diverse cases such as insurance files, skip traces, class action lawsuits, fraud investigations, due diligence, cyber incident response, cyberstalking, and missing persons investigations. Ionatan is skilled in digital footprinting, business intelligence, risk assessment, and high-stakes investigations of many flavours. His subject experience is complemented by his expertise in seeking out, developing, and using a wide range of investigative tools and techniques.
May 26, 2:30-3:20
The Evolution of Digital Forensics in Brazil: Empowering Federal Prosecution Through Advanced Investigative Techniques
Digital forensics has revolutionized crime investigations in Brazil, significantly enhancing the capabilities of federal prosecutors at the Federal Prosecution Service (MPF). This presentation will delve into the evolution of digital forensics within MPF, highlighting its pivotal role in modern investigative processes. Attendees will gain insights into the importance of digital forensics through real-world examples, showcasing its impact on various types of crimes.
The session will cover notable cases involving warrant returns, internet investigations, and the detection of child sexual abuse material on the darknet. It will also explore high-profile corruption scandals, environmental disasters, and the intersection of COVID-19 with privacy concerns. Additionally, the presentation will address crimes against the financial system, illustrating the breadth of digital forensics applications.
By examining these examples, the presentation will underscore how digital forensics has developed within MPF, providing federal prosecutors with advanced tools and methodologies to tackle complex crimes. The discussion will include the integration of cutting-edge technologies and the continuous adaptation to emerging threats, emphasizing the dynamic nature of digital forensics.
Join us to explore the transformative journey of digital forensics in Brazil and its critical role in supporting the MPF's mission to uphold justice and security nationwide
Marcelo Caiado is a distinguished Computer Forensics Analyst at the Federal Prosecution Service of Brazil (MPF), boasting over 25 years of expertise in the cybersecurity domain. Throughout his career, Marcelo has spearheaded numerous projects encompassing information security, incident response, and digital forensics.
At MPF, Marcelo has held pivotal leadership roles, including Head of Computer Forensics and Head of the Computer Security Division. Under his guidance, his team has managed the cybersecurity infrastructure of over 200 locations across Brazil, adeptly responding to security incidents and conducting comprehensive computer forensics investigations.
In 2017, Marcelo established the computer forensics division at MPF, leading investigations into a myriad of cybercrimes, both internal and external. His work has tackled organized crime, ransomware, child exploitation, racism, and crimes committed by federal public servants, including theft, embezzlement, corruption, influence peddling, and misuse of public funds. Marcelo's expertise extends to participating in administrative and judicial proceedings, reflecting his profound impact on the field.
Marcelo's career also includes a tenure as a cybersecurity investigator at BlackBerry from 2008 to 2010, where he addressed various security incidents such as denial-of-service attacks, virus outbreaks, and internal fraud, investigating breaches and violations committed by employees.
Additionally, Marcelo has provided training, lectures, and classes for universities on cybercrime, computer forensics, information security, and management. He is an official instructor for several courses from Cellebrite and some from EC-Council. Furthermore, Marcelo mentored courses from the SANS Institute for 8 years.
Marcelo currently holds numerous certifications, including CISSP, GCFA, GCIH, GSLC, GISP, CHFI, CTIA, CEI, CCME, CCO, CMFF, CCPA, CCI, CCFC and CRC.
As a published author, Marcelo co-authored various books about investigations, digital forensics, cyber security and cyber risk.
Academically, Marcelo holds a Master’s Degree in Computer Science from the University of Brasília (UnB), an MBA in Public Management from the Getúlio Vargas Foundation (FGV). He is also an adjunct professor of Digital Forensics at the Master of Science in CyberSecurity program at the New York Institute of Technology. He teaches post-graduate courses at Escola Superior do MPU – ESMPU, WB Educação, and Insper.
May 26, 3:30-4:20
SBOM Shelter in the Dependency Storm: Resilience Brick by Brick
In today's rapidly evolving software landscape, organizations face a critical decision: write it all yourself or rely on someone else's code. Writing it yourself will consume endless hours of time, loads of money and require you to support it into the foreseeable future. Relying on external dependencies can provide a significant shortcut, but comes with a plethora of challenges ranging from vulnerability management to compliance risks. This talk chronicles our journey from chaos to control in software supply chain management, focusing on the implementation of a robust Software Bill of Materials (SBOM) strategy. We'll explore how SimpleRisk transformed from having no visibility into our software dependencies to establishing a fortified "SBOM Shelter" – a comprehensive system for dependency management and automated SBOM generation within our CI/CD pipeline. Whether you're just starting your SBOM journey or looking to fortify your existing processes, this talk will provide valuable strategies for building a more secure and transparent software supply chain and transforming vulnerability into resilience, brick by brick. Discover how not just to weather the dependency storm, but to thrive in it.
Josh Sokol is the founder of SimpleRisk, an open-source Governance, Risk, and Compliance (GRC) platform used by organizations worldwide to streamline their risk management processes. With over 15 years of experience in information security and risk management, Josh is a passionate advocate for empowering businesses to make informed, strategic decisions through effective risk management practices. A dynamic and engaging speaker, Josh has presented at numerous industry conferences, sharing actionable insights on building security programs, managing organizational risk, and driving compliance. His innovative approach and dedication to the field have made him a recognized leader in the GRC space.
May 26, 4:30-4:50
Not So Secret: The Hidden Risks of GitHub Actions Secrets
If your CI/CD pipelines are built on GitHub Actions, you might be using GitHub Actions secrets to securely store credentials for connecting to your cloud environments. The security model for GitHub Actions secrets is not very intuitive. Many organizations assume that repository and organization-level secrets offer sufficient protection, but in reality these secrets lack granular access controls, exposing organizations to hidden security risks.
In this talk, we’ll break down the different types of secrets in GitHub Actions (organization, repository, and environment), the protections they offer, and their limitations. We’ll explore how misconfigurations lead to a false sense of security and discuss a more robust approach using environments and environment protection rules. We’ll also examine OpenID Connect (OIDC) for cloud authentication - where there are no long-lived secrets - but where misconfigurations can still introduce risks, and how environment-based protections help.
You’ll leave with a clearer understanding of GitHub Actions secrets, their exposure risks, and practical strategies to better protect cloud permissions of your CI/CD pipelines. Whether you’re securing sensitive credentials or refining your OIDC configurations, this session will equip you with actionable defenses to keep your automation secure at scale.
Amiran is a passionate product security professional with over 20 years of experience spanning systems engineering, security operations, GRC, and product and application security. As a security engineering leader, he champions a pragmatic, scalable approach to security - where collaboration between security, developer, and platform teams turns security into a business enabler rather than a bottleneck.
With a deep understanding of evolving cloud architectures and modern development practices, Amiran focuses on helping organizations align security with velocity, ensuring defenses scale effectively in dynamic environments.
An avid supporter of the local security community, he is actively involved with the OWASP Vancouver chapter and DC604 DEFCON group.
May 26, 5:00-5:20
Malicious Packages - They're Gonna Get Ya!
Supply chain security has been all the rage recently - we keep hearing over and over again, about how numerous malicious packages have been found on this package repository or that. This talk gives an overview of malicious packages and the different ways that they can pose a danger: from simple mistakes like mistyping a package name all the way up to well known and loved packages being compromised.
So how can we protect ourselves from these threats? There are various options such as checking package health, source code reviews/scans, or use of tooling such as SCA tools. SCA scans, while very useful for vulnerability scanning, cannot be relied upon to protect against malicious packages. This talk will discuss their blind spots and other options for adding further protection. It will further reinforce that security should always take a multi-layered approach.
I'm an application security engineer who started out as a web developer. Security drew me in with the endless puzzles and challenges put forth by the field. I love sharing knowledge, particularly when I can both educate and horrify my audience at the same time. After all, what can happen when security goes wrong is pretty scary. I also enjoy working closely with software engineering teams to try to make security work within existing development practices, or at least try to minimize how painful "doing security" can be. When not behind a computer, I can usually be found making some sort of costume piece or shiny object.