[un]prompted.au — AI × Cybersecurity Conference · Sydney, 18–19 September 2026

Notes from the field: vulnerability researchers, exploit developers, and frontier-AI-lab researchers on how AI is reshaping security research. ILUMINA, Sydney.

unprompted.au

Watch Your Language: A Multi-Lingual Approach to Bypassing Email Filters BSides Canberra 2026

_Modern email filters use a number of metrics to determine whether an incoming email is likely to be spam, including language, link/attachment analysis and sender details. For an ordinary sender, it m...

cfp.bsidescbr.com.au

Reverse Engineering Games. Common methods and traps for devs. BSides Canberra 2026

Why do people spend years of their lives painstakingly recreating the source code of a 20-year-old video game? While the motivation is often nostalgia or speedrunning, the techniques used are the gold...

cfp.bsidescbr.com.au

WebKit Archaeology: Finding Treasure in the Past BSides Canberra 2026

Starting security research into modern platforms that have been around for a while can be extremely daunting. Getting your foot in the door and beginning to understand the system and its components is...

cfp.bsidescbr.com.au

Whaling on mobile apps with Leviathan BSides Canberra 2026

Mobile pentesters don't have a tooling problem. They have five tools and many problems. Between Frida, decompilers, instrumentation bridges, and platform-specific utilities, practitioners end up conte...

cfp.bsidescbr.com.au

Tearing Down a DPRK-Linked macOS Crypto Stealer BSides Canberra 2026

This talk presents a technical analysis of a multi-stage macOS attack chain attributed with moderate-high confidence to the Lazarus/BlueNoroff cluster, targeting cryptocurrency users across a broad ra...

cfp.bsidescbr.com.au

Exploiting the Microsoft 365 Substrate: How their OAuth Clients Became an MFA Bypass Across Enterprise Tenants BSides Canberra 2026

Every time you sign in to Microsoft 365, a quiet exchange happens behind the scenes. Entra ID issues a token, and a sprawling backend known as the Microsoft 365 Substrate decides what that token is al...

cfp.bsidescbr.com.au

Testing Second-Order Prompt Injection Across AI Agent Deployments BSides Canberra 2026

Direct prompt injection is well understood. An attacker controls the input, inserts a payload, and the model executes it. Second-order injection works differently. The malicious payload does not come ...

cfp.bsidescbr.com.au

How to hack a quantum system BSides Canberra 2026

Quantum technologies are coming, with major advances over the last couple of years making them closer than ever. In the security community, this often leads to discussions about how a quantum computer...

cfp.bsidescbr.com.au

AIxploit: Reliable Prompt Injection Exploits Against Database-Enabled AI Agents BSides Canberra 2026

AIxploit: Reliable Prompt Injection Exploits Against Database-Enabled AI Agents Most prompt injection demos work once and fail the next — LLMs are stochastic, and a prompt that fires today may not fi...

cfp.bsidescbr.com.au

Ares: decompiling React Native bytecode bundles BSides Canberra 2026

React Native mobile applications bundle JavaScript application logic in compiled Hermes bytecode form, with a notable lack of open-source decompilers. In this talk, the decompiler and analysis tool Ar...

cfp.bsidescbr.com.au

Attacking Passkeys: Offensive Tooling and Implementation Vulnerabilities BSides Canberra 2026

Passkeys are showing up everywhere, but how many people can actually say how they work, where they break, or how to test one? We'll start with a Passkey 101: what FIDO2, WebAuthn and CTAP actually ar...

cfp.bsidescbr.com.au

Troubleshooting to SYSTEM: Local Privilege Escalation in Windows Diagnostics BSides Canberra 2026

Windows Diagnostics is easy to overlook. To most users it appears as a combination of troubleshooters and recovery actions that sometimes solve problems. Under the hood is a privileged automation fram...

cfp.bsidescbr.com.au

yeaaaaaaaaaaaaaaaaaaaalink! - dissecting an android Teams phone BSides Canberra 2026

This talk cover exploration of elderly android devices and the risks they can pose when you chuck them in the proverbial trash (filsy's house...). I've found a new, (infuritating to his partner) hobb...

cfp.bsidescbr.com.au

Just spoof the government? BSides Canberra 2026

During an authorised social engineering engagement for a state government department, email security flaws were identified which led to successful target interaction with “malicious” infrastructure. ...

cfp.bsidescbr.com.au

API Key Attribution Sucks, Lets Change That BSides Canberra 2026

When a secret is leaked most people look at who leaked the secret; the GitHub committers email, package author, but this sucks. Millions of commits are created by noreply emails, clankers and personal...

cfp.bsidescbr.com.au

Find My... And Yours: Exploiting Tracker Ecosystems To Track Individuals BSides Canberra 2026

Modern Bluetooth Low Energy tracking ecosystems: Apple Find My, Samsung SmartThings, Tile, and Google Fast Pair, have each implemented privacy controls designed to prevent persistent observation and p...

cfp.bsidescbr.com.au

You Get a C2! And YOU Get a C2!: The democratisation of sophisticated Command & Control BSides Canberra 2026

Sophisticated espionage focused Command and Control (C2) frameworks and offensive cyber tooling has been historically restricted to use by large powers and developed economies due to the high cost or ...

cfp.bsidescbr.com.au

Malicious Entra ID Apps - what they are, how to find them and how to stop them BSides Canberra 2026

We've all heard of password guessing and MFA bypass techniques that are used to attack M365 - but those are old news now! The newer and more interesting vector - to both attackers and defender alike -...

cfp.bsidescbr.com.au

Hooked: Tracking Linker and Generator Persistence on Linux BSides Canberra 2026

Standard Linux persistence tracking typically focuses heavily on the more obvious artefacts like cron jobs, rc.local scripts, and standard systemd services. Because security teams look there first, mo...

cfp.bsidescbr.com.au

OculaRCE: From Bluetooth to Contactor BSides Canberra 2026

A full-stack teardown of a commercial EV charger, from default credentials in the installation guide through to unauthenticated control of the AC power contactors. This research covers multiple pre-a...

cfp.bsidescbr.com.au

Exploiting the Microsoft 365 Substrate: How their OAuth Clients Became an MFA Bypass Across Enterprise Tenants BSides Canberra 2026

Every time you sign in to Microsoft 365, a quiet exchange happens behind the scenes. Entra ID issues a token, and a sprawling backend known as the Microsoft 365 Substrate decides what that token is al...

cfp.bsidescbr.com.au

Novel Router Emulation for Malware Reverse Engineering & Infrastructure Discovery BSides Canberra 2026

Traditional reverse engineering of edge networking firmware frequently stall at the system emulation layer due too proprietary headers, missing vendor kernel sources, and strict dependencies on physic...

cfp.bsidescbr.com.au

Let It Sync In BSides Canberra 2026

In this talk, I'll present my research into the internals of the Microsoft Edge Sync Service, examining how the platform authenticates users, protects synchronized data, and exposes functionality thro...

cfp.bsidescbr.com.au

Venting Steam: Hunting C2 in Unexpected Places BSides Canberra 2026

If the Lumma and Vidar stealers taught us one thing, it's that literally anything can be used as a Command and Control channel. DNS TXT records, Pastebin drops, Steam profiles, telegram, discord - if ...

cfp.bsidescbr.com.au

Headless Hunter - Automated exploitation of headless Chrome using V8 n-days BSides Canberra 2026

Consider a website. One that allows you to export PDF documents. Have you ever stopped to wonder how this works under the hood? Commercial libraries exist to do the PDF generation heavy lifting, but ...

cfp.bsidescbr.com.au

Identity Is the New SOC: Hunting Entra, SCIM, PIM, and Password Manager Abuse BSides Canberra 2026

Identity used to be the front door. Now it is the keys, the key cabinet, the floor plan, the alarm panel, and sometimes the weird emergency exit nobody has checked since 2021. Most organisations hav...

cfp.bsidescbr.com.au

Chasing Shadows: Portable Memory Corruption in Ghostscript BSides Canberra 2026

Ghostscript is one of the most ubiquitous PostScript interpreters in the world. Even if you never run it directly, your systems probably do: rendering thumbnails, converting documents, previewing uplo...

cfp.bsidescbr.com.au

From Dream Jobs to Developer Tokens: How North Korea-based threat actors abuse trust BSides Canberra 2026

For years, defending against North Korea-based threat actors meant defenders using the same standard checklist. Block the phishing email, sandbox the lure document, or kill the macro. Since 2021 that ...

cfp.bsidescbr.com.au

Inside of an Android BSides Canberra 2026

Have you ever been curious what *really* happens inside a mobile device? How often are different syscalls used? Are syscall errors common? What binaries are executed, and when? Whose actually making...

cfp.bsidescbr.com.au