Tessera

Folgen

BSides Buffalo

@bsidesbuffalo.bsky.social

Buffalo's favorite information security conference.

230 Posts251 Follower 22 Folgt

BSides Buffalo @bsidesbuffalo.bsky.social · 2w ago

Happy August, all! This month's Infosec 716 meetup will feature a demonstration of SO-CRATES, the new log and packet analysis platform from @dougburks.bsky.social of @securityonion.bsky.social - hope to see you there! As always, you can join in person at @bithavenllc.bsky.social or remotely.

Infosec 716 August Virtual Meetup, Wed, Aug 19, 2026, 6:00 PM | Meetup

Our August meetup will feature a demonstration of SO-CRATES (https://github.com/dougburks/so-crates), a new open source tool for analyzing packet captures, files, and logs.

meetup.com

BSides Buffalo @bsidesbuffalo.bsky.social · 2mo ago

Welcome to July, all! As is tradition, this month's Infosec 716 meetup will be a taco picnic in Delaware Park. All are welcome, but please RSVP so we've got a good headcount and know how many tacos to bring. Feel free to share, and see you there! www.meetup.com/infosec-716/...

July - Tacos In The Park!, Wed, Jul 15, 2026, 6:00 PM | Meetup

As has now become tradition - for July, let's meet up and eat tacos in the park! This is usually the week in between the shows for Shakespeare in the Park, so there should

meetup.com

BSides Buffalo @bsidesbuffalo.bsky.social · 2mo ago

Happy Monday, all! The videos from this year's BSides Buffalo have been posted to our YouTube channel, along with all the videos from past events. Thanks once again to our fantastic speakers, thanks so much for sharing your knowledge with the community. www.youtube.com/@bsidesbuffalo

BSides Buffalo @bsidesbuffalo.bsky.social · 2mo ago

This reboot of 8 Mile looks terrible. 😄

BSides Buffalo @bsidesbuffalo.bsky.social · 2mo ago

Yeah we are! www.youtube.com/watch?v=lvdc...

Buffalo We're Lookin' Good 1987

YouTube video by Retrontario

youtube.com

BSides Buffalo @bsidesbuffalo.bsky.social · 2mo ago

Feeling those post-conference blues after such an awesome day yesterday? We get it. You know what might help? Make plans to join the Buffalo hacker community for tacos in Delaware Park next month! Hope to see you there! www.meetup.com/infosec-716/...

July - Tacos In The Park!, Wed, Jul 15, 2026, 6:00 PM | Meetup

As has now become tradition - for July, let's meet up and eat tacos in the park! This is usually the week in between the shows for Shakespeare in the Park, so there should

meetup.com

BSides Buffalo @bsidesbuffalo.bsky.social · 2mo ago

Our fifth annual event: 332 tickets sold, 23 talks across three tracks, a CTF, and lockpick/soldering/career villages that were bustling all day. Thank you so much to the sponsors, the speakers, the volunteers, and the attendees for making this the biggest and best BSides Buffalo yet.

BSides Buffalo @bsidesbuffalo.bsky.social · 2mo ago

Tomorrow.

BSides Buffalo @bsidesbuffalo.bsky.social · 2mo ago

Things to bring to BSides Buffalo tomorrow: * Coming to the Career Village? Bring a copy of your resume. * Playing the CTF? Bring your laptop. * Stickers to trade or share? Bring them for the table. * Lockpicking or soldering challenges? Bring them for help. See you all in the morning!

BSides Buffalo @bsidesbuffalo.bsky.social · 2mo ago

PARKING INFORMATION FOR TOMORROW The conference will be held in Science Hall, at the corner of Main Street and Jefferson Avenue (N on the map below). There is parking available at either end of the building, in the lots labelled 14 and 15, or street parking on Main Street in front of the building.

Matthew Gracie @infosecgoon.bsky.social · 2mo ago

Going to be giving away some classic Captain Crunch 2600 whistles from our friends at @bithavenllc.bsky.social at @bsidesbuffalo.bsky.social tomorrow. Toot toot little phreaks!

BSides Buffalo @bsidesbuffalo.bsky.social · 2mo ago

After closing remarks tomorrow, join the local hacker community at Bit Haven in the Tri Main Building (2495 Main Street) for the official BSides Buffalo after party! Music, food, drinks, and a chance to hang out and meet your peers and talk about all the cool stuff you learned. See you there!

BSides Buffalo @bsidesbuffalo.bsky.social · 2mo ago

Our final Lightning Talk of the day will be Sai Jagadeesh presenting "Deep Link Vulnerabilities: When One Click Leads to Account Takeover". (talk description in alt text)

"Deep links are widely used in mobile applications to provide seamless navigation to specific screens inside an app. However, when deep links are improperly validated, they can become powerful attack vectors that allow external inputs to directly influence internal application behavior.

This lightning talk explores how seemingly harmless deep links can lead to serious security issues such as token leakage, WebView exploitation, and even one-click account takeover.

In one example, a crafted deep link forces the app to open an attacker-controlled URL inside a WebView while automatically appending the victim’s authentication token, allowing the attacker to hijack the account with a single click.

We will also look at how vulnerable WebView configurations combined with exported deep link activities can enable attackers to exfiltrate session cookies, load malicious content, or execute privileged actions inside the app context.

This talk highlights common developer mistakes, demonstrates how attackers chain deep link handling with WebView behavior, and provides practical mitigation strategies to secure mobile applications against these hidden entry points."

BSides Buffalo @bsidesbuffalo.bsky.social · 2mo ago

Our final talk of the day in Track One will be the Lightning Talk "Still Cracking: WPA2 Prevalence and Password Weakness in 2026" by Dimitri Weaver. (talk description in alt text)

"In 2021, a CyberArk researcher collected 5,000 network hashes across Tel Aviv using $50 in equipment and cracked over 70% of them via the clientless PMKID attack technique. Five years later, this talk revisits that methodology — this time closer to home.

This session presents the results of a real-world WPA2 survey conducted locally in 2026, measuring how prevalent WPA2 remains, how password hygiene has (or hasn’t) improved, and how accessible this attack vector continues to be for any motivated adversary. No live cracking — just honest data, a reproducible methodology, and a candid look at whether the security community has meaningfully moved the needle on wireless security.

Attendees will walk away with a clear understanding of the PMKID attack surface, what current data says about password practices in the wild, and actionable guidance for individuals and organizations looking to actually secure their wireless environments."

BSides Buffalo @bsidesbuffalo.bsky.social · 2mo ago

Our second 4pm Lightning Talk is Billy Gibson and Ryan Conry presenting "Bad Apples: Orchestrating Movement and Execution via Native macOS Protocols". (talk description in alt text)

"As macOS adoption accelerates—with over 45% of enterprises now utilizing the platform—Mac endpoints have become high-value targets for attackers seeking cloud credentials, source code, and privileged access. Despite this trend, macOS lateral movement remains a significant blind spot; the MITRE ATT&CK framework documents far fewer techniques for macOS than for Windows, and recent industry reports indicate that macOS environments prevent significantly fewer attacks than their Linux or Windows counterparts. This research aims to close that gap by systematically validating macOS-native lateral movement and execution primitives.

While Remote Apple Events (RAE) are traditionally documented as a lateral movement vector (T1021.001), we also approach the protocol through the lens of Software Deployment Tools for Execution (T1072). We demonstrate how RAE can be weaponized as a standalone primitive for deploying and executing complex, multi-line shell scripts. Our investigation analyzes the inherent security features of the System Events handler and the parsing constraints of the AppleScript interpreter that typically restrict remote orchestration. We then present a robust bypass methodology utilizing Base64 transport encoding and Terminal.app orchestration to achieve arbitrary code execution."

BSides Buffalo @bsidesbuffalo.bsky.social · 2mo ago

Our first Lightning Talk of the day will be in Track One at 4pm, Christopher Bruns presenting "Mapping Internal Networks - The Art of Finding Things". (talk description in alt text)

"As a Pentester, the discovery process is one of the most important steps to get right. With timed engagements, quick and efficient discovery processes are a must to produce meaningful results for customers. This session will talk about the art of internal network enumeration. How to find networks. How to find assets within networks. Useful tools and strategies for large networks. And how to take the data found and use it to formulate attacks against systems and Active Directory."

BSides Buffalo @bsidesbuffalo.bsky.social · 2mo ago

Kicking off the 4pm hour in the atrium, we have a panel session with Catherine Ullman and Qasim Ijaz discussing "Hacker Mindset, Defender Mission". (talk description in alt text)

"Whether you're building a SOC, developing detection capabilities, hiring a pentest firm, or training analysts, understanding how attackers think changes everything from the questions you ask to the gaps you find.

In this panel we discuss how offensive awareness strengthens defensive operations from the inside out: building detection logic informed by real attacker tradecraft, preparing your team to get the most out of offensive engagements, and fostering a culture where defenders are encouraged to think like hackers without needing to become one."

BSides Buffalo @bsidesbuffalo.bsky.social · 2mo ago

Closing out Track Three is Hemanth Gorijala, presenting "Secrets That Survive Everything: Finding Runtime Credentials in Production Web Applications". (talk description in alt text)

"A bug bounty researcher found Azure credentials in a JavaScript file and called it done. I kept going — four Azure AD credentials sitting in a public JS file, enough to authenticate as the application itself. The frontend had documented its own backend. Full account takeover. The application's token had been granted the ability to perform user-level operations — every account in the system was reachable. The organization had GitLeaks in CI/CD and static secret scanning on pull requests. The credentials were still live.

That was one chain. A second application used CryptoJS to encrypt its configuration — a common pattern in SPAs where developers believe encrypting the config protects it. The decryption key was hardcoded in the same JavaScript file, three lines away from the encrypted blob. The secret to unlock everything was sitting next to the lock. Same credential pattern at the end. Same result.

Shift-left tools scan what you commit. They do not scan what you serve. Build-time environment injection bakes live keys into webpack bundles that never touch the repository. CI/CD pipeline variable substitution materializes secrets only in the build artifact, after every scanner has run. SSR state blobs injected by Next.js and Nuxt carry credentials into HTML that no pre-deployment scanner ever sees. Once a secret reaches production, it disappears from every scanner's view. The only things finding runtime secrets are manual penetration testers, bug bounty researchers, and attackers. Two of those three report what they find.

This talk walks through both exploitation chains in detail, maps the full shift-right gap in the security tooling landscape, and closes with a live demo using a purpose-built intentionally vulnerable healthcare portal — a HIPAA-branded application exposing Twilio, SendGrid, Stripe, and Firebase credentials in its public JavaScript files, and leaking internal service keys in response headers on every single request."

BSides Buffalo @bsidesbuffalo.bsky.social · 3mo ago

Closing out our Introsec track at 3pm is Jerrad Bartczak, MBA, CISSP, CISA, CCSFP, CHQP, presenting "What Is IT Audit: What IT Auditors Do and Why It Matters". (talk description in alt text)

"The function of an IT auditor is often misunderstood in the greater cybersecurity and GRC landscape. This session cuts through the confusion and provides a clear, accessible overview of what IT auditors actually do, why the discipline exists, and how it fits into the broader governance, risk, and compliance landscape. Attendees will explore the different types of IT audits — from SOC 2 examinations and HITRUST assessments to HIPAA, CMMC, and ISO audits — and learn how each serves a distinct purpose in building organizational trust and compliance. The session will also cover how IT audits evaluate the design and effectiveness of controls across areas like access management, change management, endpoint security, and data protection. Whether you are a business leader trying to understand an upcoming SOC 2 examination, an IT professional preparing for your first audit, or a student exploring career paths, this session will give you a practical foundation for understanding how IT audit drives trust, accountability, and operational resilience."

BSides Buffalo @bsidesbuffalo.bsky.social · 3mo ago

At 3pm in Track One, we've got Kelsey O'Connell presenting "It Wasn’t Spoofed: Investigating Authenticated Email Abuse in Real Environments". (talk description in alt text)

At 3pm in Track One, we've got Kelsey O'Connell presenting "It Wasn’t Spoofed: Investigating Authenticated Email Abuse in Real Environments".

"A suspicious email spreading internally was initially attributed to spoofing after a user reported a message sent from their account that they had not sent. However, analysis revealed the message originated from within the organization.

Authentication had succeeded, the message was treated as internal, and no alerts were generated. The activity was not spoofing, but authenticated abuse using valid credentials.

This session walks through how to investigate and differentiate between spoofed and authenticated activity, and what control gaps allow this type of behavior to persist in real-world environments."

BSides Buffalo @bsidesbuffalo.bsky.social · 3mo ago

Excited to announce our latest Gold Sponsor for BSides Buffalo 2026, first-time sponsors Sekoia.io!

homepage

Sekoia.io provides cyber teams with a SOC platform that can respond to security incidents, regardless of the attack surface.

sekoia.io

BSides Buffalo @bsidesbuffalo.bsky.social · 3mo ago

Closing out the 2pm slot in Track Three, we've got Ian Litschko presenting "Four Years at War: Trends in Russian State Nexus Cyber Operations". (talk description in alt text)

"After four years of war, Russia's cyber-enabled operations have adapted, representing one of a few countries that now have directly applied cyber capabilities in a state vs state conflict. This talk will explore notable trends across Russia's cyber-enabled capabilities, including introducing a novel addition to the list of cyber-enabled Russian organizations.

This talk will explore several trends including an emerging powerhouse amongst existing capabilities, adaptations to initial access capabilities, the incorporation of malware-as-a-service and an examination of the impact of wartime conditions to cyber-enabled operations."

BSides Buffalo @bsidesbuffalo.bsky.social · 3mo ago

With about a week to go until our conference, we would like to once again thank all of our sponsors for their support. Like all BSides conferences, we strive to be as accessible as possible - without the support from our sponsors, we wouldn't be able to make BSides Buffalo happen. Thank you so much!

BSides Buffalo @bsidesbuffalo.bsky.social · 3mo ago

At 2pm in Introsec, Track Two, we've got Nick Regelman 🚨presenting "Looking for a mentor? You might already be one." (talk description in alt text)

"A lot of people in infosec want a mentor but don’t know how to find one. Either they don’t know how to ask or feel like they haven’t earned the right, yet at the same time, there are plenty of experienced people who want to give back but don’t think they’re qualified to mentor anyone.

This talk is for both.

We’ll talk about why mentorship in security is way harder than it should be, why “just network” is shitty advice and what mentorship actually looks like. This isn’t about titles, seniority or having everything figured out. It's about sharing what you know, listening and being willing to offer support to others along the way.

If you’re looking for a mentor, you’ll leave with practical ways to ask without feeling out of place. If you’ve been around for a while and want to give back, you’ll likely leave realizing you have way more to offer than you think."

BSides Buffalo @bsidesbuffalo.bsky.social · 3mo ago

At 2pm in Track One we're excited to annouce Shounak D. and Harshit Kumar presenting "RoAM-eo & Juliet: How Roblox Solved Access Governance for Production Services". (talk description in alt text)

"Bring-your-own-IAM sounds like an attractive security policy, but in practice it's a euphemism for security debt. Every team rolls their own authorization, ignores access governance, and hopes audits never arrive. Roblox lived in that world for years. While infrastructure IAM has matured (AWS IAM, KMS, VPCs), application-layer access remains a free-for-all. Internal services—admin dashboards, data stores, bespoke tools—reinvent "who can do what" with no shared model for time-bound access, multi-tier approvals, or consistent audit. The industry is starting to name this gap, but almost nobody has built and deployed application-layer access governance across heterogeneous services at scale.

This talk tells the story of RoAM (Roblox Access Manager), a generic access governance platform built to orchestrate requests, approvals, expirations, and recertifications—and then notify downstream policy engines via an interface modeled on OpenID AuthZEN. RoAM does not replace the authorization systems teams already have. It wraps them in a shared governance layer: time-bounded access, approval workflows, centralized audit, and automatic revocation. RIF (RoAM Ingestion Framework) is the continuous data ingestion layer that keeps the authorization graph current, projecting resource ownership from upstream data sources into Guard, Roblox's ReBAC authorization service.

Expect us to cover real incidents, design mistakes, and concrete engineering patterns for turning brittle, bespoke authorization into a reusable access governance layer across services—without forcing a single policy engine or a greenfield rewrite."

BSides Buffalo @bsidesbuffalo.bsky.social · 3mo ago

Rounding out the 1pm talks, in Track Three we've got Erik Bataller presenting "From Chaos to Capability: Building Resilient AI Workflows for Personal and Business Use". (talk description in alt text)

"AI is remarkably good at producing things — blog posts, architecture diagrams, resumes, strategy documents, security proposals. Hand it a rough idea, and it will synthesize a draft faster than most teams can schedule a meeting. But that's where the honeymoon ends.

After six months of intensive daily use building real deliverables — thought leadership papers, consulting proposals, career materials, and a personal AI agent security stack — I've learned that AI without workflow discipline is just a very fast way to produce unreliable output. It forgets context mid-project. It drifts from your intent. It confidently delivers wrong answers. It has no concept of version control, traceability, or iteration management. And it will happily lose everything you've built together if you don't have a system for capturing and organizing its output.

None of this is new. These are the same challenges every technology faces when it moves from experimentation to production — and they have the same solutions. Process, governance, clear direction, and operational discipline.

Drawing on decades of building technology programs for organizations ranging from startups to Fortune 500 enterprises, I applied the same programmatic thinking to my personal and small-business AI use that I would to an enterprise capability rollout — and discovered that one person with the right workflow can achieve what used to require teams and significant budgets. In this session, I'll share the practical framework I built, the mistakes I made getting there, and the security and governance considerations that most AI users never think about until something goes wrong."

BSides Buffalo @bsidesbuffalo.bsky.social · 3mo ago

Ever thought about what it's like to work in the world of digital forensics? Kicking off the afternoon in the Introsec track is local luminary Catherine Ullman with "So You Want to Be a Forensicator". (talk description in alt text)

"Imagine starting your first day on the job with a single clue: a five-second gap in the logs that absolutely shouldn’t exist. No flashy “zoom to enhance,” no instant answers—just you, a timestamp, and the question every forensicator lives for: What happened in the missing moment? This talk uses that small but mysterious anomaly to illustrate the real heart of digital forensics: quiet puzzles hidden inside ordinary data.

From that opening mystery, we’ll transition into the practical realities of entering the field. Attendees will learn how people actually break into computer forensics and the skills that matter more than pedigree. We’ll examine the core personality traits that make someone effective in this career, including the ability to clearly communicate what the evidence does (and does not) prove.

The session also sets realistic expectations for daily work in digital forensics. By the end, attendees will understand not only what it takes to become a forensicator, but what it feels like to think, work, and solve problems like one—no TV magic required, just skill, patience, and a passion for uncovering the truth hidden in the data."

BSides Buffalo @bsidesbuffalo.bsky.social · 3mo ago

Kicking off the afternoon at 1pm in Track One we've got Patrick Rost, CISSP of InfoSecurity Blueprint, LLC presenting "Breaking Down Your Incident Response Plan Before It Breaks Down on You". (talk description in alt text)

"This session breaks down the key components of an effective incident response plan and explores how to avoid common pitfalls that undermine response efforts. We will look at why many plans fail in practice, what elements make a plan usable during a real incident, and how to maintain readiness through testing and improvement:

• Why Incident Response Planning Matters

• Core Components of an Effective Plan

• Common Pitfalls and How to Avoid Them

• Testing and Maintaining the Plan"

BSides Buffalo @bsidesbuffalo.bsky.social · 3mo ago

DOOR PRIZE: Every year we have something unique for our door prize, and this year is no different. If you get your card stamped at every sponsor table you can enter to win one of these awesome "WE'RE HACKING PROUD" flags.

BSides Buffalo @bsidesbuffalo.bsky.social · 3mo ago

Finishing the morning in Track Three we've got Dawn Cooper presenting "Cyborg Security". (talk description in alt text)

"So you're thinking about becoming a cyborg. It may or may not surprise you to learn that there are several of us around already, and while cybernetic enhancement can greatly improve our lives, it also has its downsides. Adaptive devices used by people with disabilities and medical conditions have been failing in unexpected ways for years, despite oversight from government bodies. Recreational implants, which are much less regulated, have even more scope for interesting bugs. On the other hand, while commercially available augments and implants require extensive testing and are almost always closed-source, it's possible to build and install your own - theoretically.

How do we secure medical devices that constantly collect telemetry? How hard would it be for someone to skim the data on that NFC chip that you got implanted in your hand? And when we find flaws in these machines, how are we meant to fix them if they're already in our bodies? Whether you're interested in joining the human IoT network for recreational purposes, want to explore, code, and create implantable devices yourself, or have a medical need for augmentation, join me for this briefing to prepare for the security and privacy implications of connecting ourselves directly to the Internet."