Professional Certifications & Continuous Training,
Training & Security Leadership
Pwning Ray-Bans and VWs, Finding Resilience, Escaping Containers, Embracing Chaos
The highly anticipated return of the cyberpunks to Berlin has set the stage for this year’s annual Nullcon cybersecurity conference. Spanning five days, the event encompasses a wide array of research-led briefings, training sessions, professional networking opportunities, and exhilarating capture-the-flag competitions tailored for cybersecurity enthusiasts and experts alike.
Nullcon, which began in 2010 in Goa, India, emerged from the country’s largest open-source security community and has made a significant mark in the cybersecurity landscape. This marks the fifth consecutive year that the conference has been held in Berlin, specifically in Berlin-Mitte, an area renowned for its historical significance and vibrant culture.
The core of Nullcon remains rooted in immersing participants in the latest tools, techniques, research findings, and collaborative discourse that shape contemporary cybersecurity. This week commenced with three distinct training tracks running from Monday to Wednesday, concentrating on various advanced topics. Key focus areas included agentic security, mastering offensive techniques related to strategic artificial intelligence penetration, advanced intrusion tactics for Active Directory, and methods for exploiting Windows binaries.
The program for Thursday and Friday heavily features community-led briefings. Opening the series of presentations is a keynote from Mario Heiderich, a recognized authority in web security and penetration testing, who is also the founder of Berlin-based security firm Cure53. He will discuss the implications of artificial intelligence in security, humorously referring to the concept of being a “meat proxy” for AI agents that perpetually acquiesce to requests.
On the following Friday, Pete Herzog from the Institute for Security and Open Methodologies, known for his catchphrase “I make bad things go away,” is set to deliver a keynote that promises a “high-velocity collision of physics, quantum mechanics, and hacker culture.” He aims to illustrate that true security transcends mere frameworks; rather, it becomes a fundamental force of nature that must be embraced.
The question of whether organizations can purchase cyber resilience through services and technology will be a focal point during a panel discussion moderated by Anna Delaney, director of productions at ISMG. Noteworthy participants in this discussion include Osama Jamaleddine, Chief Business Information Security Officer at Deutsche Bank, Sven Zehl, Chief Information Security Officer of German fintech Moss, and Frank Schwaak, Field CTO of Rubrik.
As artificial intelligence continues to evolve, Gavin Reid and Lindsay Kaye from Human Security will examine the latest trends in fraudulent activities, particularly the utilization of physical and cloud-based phone farms. They will also address how these fraudsters are leveraging AI and discuss methodologies to detect such abuses.
Another hot topic will be “hostile inference,” explored by Nitesh Surana from Trend Micro. He will discuss the vulnerabilities associated with Docker’s AI infrastructure, particularly in regards to container escape threats.
In an alarming revelation, security experts Radu Motspan and Abdellah Benotsmane will highlight risks associated with the Volkswagen ID.4, an all-electric compact sports utility vehicle. Their technical presentation will unveil an exploitation chain, cautioning that the Bluetooth, infotainment, and virtualization systems of the vehicle are susceptible to attacks with real-world ramifications.
Further exploring the cybersecurity landscape, Ray Goh from Mandiant will analyze the intersection of gaming anti-cheat systems and enterprise Endpoint Detection and Response (EDR) solutions, shedding light on what critical data might be missed by traditional security measures.
Lastly, participants will witness an intriguing demonstration by pamoutaf from Italian vulnerability research firm Bynario, who will exhibit arbitrary code execution on Meta’s Ray-Ban sunglasses, leaving attendees pondering the implications of future technologies.
This rich tapestry of sessions and discussions promises to provide invaluable insights and hands-on experience, cementing Nullcon as a pivotal event in the world of cybersecurity. As the speakers and participants converge in Berlin, the air is charged with a palpable sense of anticipation and a collective commitment to exploring the intricacies of modern cyber vulnerabilities and innovations. The fifth installment of Nullcon in Germany assures attendees that they will leave with not only knowledge but also strategies to navigate the ever-evolving landscape of cybersecurity.