BSidesNEPA 2025

The rapid advancement of drone technology has opened up new opportunities across a wide range of sectors, including agriculture, surveillance, and delivery services. Specifically, the accessibility and affordability of drones suggest a surge in their prevalence in the coming years. Nonetheless, this growth opened new doors for bad actors to use drones for nefarious activities; thereby, raising safety and security concerns attributed to the unmanned aerial vehicles (UAVs). In this paper, we focus on systematically investigating the data recovery mechanisms for confiscated drones. First, we discuss the potential security threats associated with the drones and different detection methods to spot drones. Then, we propose a structured data recovery framework to effectively retrieve crucial data from a malicious drone. In particular, we analyze the popular DJI Mini 2 SE drone and show how our proposed framework can facilitate forensic investigators to uncover crucial data beyond the drone’s metadata. Our experiments show that investigators can effectively recover sensitive historical data that was even deleted from the drone’s external secure digital (SD) card.

Add to Calendarcalendarcalendarcalendarcalendar

In this session, attendees will learn some of the most impactful techniques and tools to increase the value of OSINT to their organizations. A guided learning experience, instructor(s) will immerse attendees in hands-on exercises.

Add to Calendarcalendarcalendarcalendarcalendar

https://github.com/EFForg/rayhunter

Add to Calendarcalendarcalendarcalendarcalendar

Operationalizing MITRE ATT&CK requires a structured approach to mapping cyber threat intelligence (TI) to adversary tactics, techniques, and procedures. This session will focus on translating threat intelligence reports, Incident reports, indicators of compromise, and behavioral data into actionable MITRE ATT&CK mappings, and different implementation planning to proactively defend against real-world threats. Additionally, we will explore how to enrich detection engineering based on ATT&CK mapping, in the context of developing a detection engineering program at enterprise level. Attendees will do hands-on exercises for CTI reports mapping and detection development, comparing gen AI and traditional methods, learning to extract key insights from cyber threat intelligence reports, and correlate them with ATT&CK techniques, and use this mapping to develop detections that align with adversary behaviors, discussing how to develop, manage and validate detections. Based on first hand experience on developing and non-existing detection engineering program, managing detection development and how to convince executives and peers to implement a proactive defence in depth in an organization.

Add to Calendarcalendarcalendarcalendarcalendar

When an anonymous actor calling themselves “ExploitWhispers” posted nearly a year’s worth of BlackBasta’s internal Matrix chats in February 2025, the industry received an unfiltered window into the criminal enterprise behind dozens of high-profile intrusions.

Twelve weeks later, a separate breach dumped the entire MySQL backend of LockBit’s affiliate panel. 20 tables covering build pipelines, negotiation transcripts, and cryptocurrency payout data were released onto public code-sharing sites with a Tor-site defacement confirming the compromise. Together these disclosures offer something incident responders rarely get: the attackers own words, workflows, and source artifacts.

In this talk we will take a deep dive into those data sets—walking through the process of parsing thousands of lines of attacker conversations, configuration files, and build logs to surface the tactics, techniques, and procedures (TTPs) that drive day-to-day ransomware operations.

This talk will focus on the approach for processing these large data sets, how affiliate recruitment, initial access, payload testing, negotiation, and cash-out weave together into a repeatable playbook, and the CI/CD build pipelines which allow for rapid development and deployment of malicious payloads.

Add to Calendarcalendarcalendarcalendarcalendar

Building a Security Operations Center (SOC) from the ground up is a rare opportunity, and a massive challenge. At Boscov’s, I led the creation of our first in-house SOC, transitioning away from an outsourced model to a dedicated 24/7 operation built on passion, documentation, and local talent. This presentation will walk through the full lifecycle of that process, from business alignment and executive buy-in to hiring analysts with zero experience, designing shift coverage, and choosing tools on a budget. I’ll share what worked, what didn’t, and the unexpected lessons I learned along the way as a former USAF crew chief and cybersecurity lead.

Attendees will learn how to foster a strong security culture, document effectively, and train junior analysts into critical thinkers who take ownership of their work. Topics include playbook development, tool integration (Splunk, XDR, Rapid7, Recorded Future), and how to scale processes without sacrificing team morale. Whether you’re building a SOC, inheriting one, or simply looking to improve analyst performance, this talk offers practical, real-world insights from someone who’s been through it all.

Add to Calendarcalendarcalendarcalendarcalendar

Mach-O is Apple’s native executable format, used for everything from kernel extensions to user applications—and it is rich with metadata. This is a tour of Mach-Os, pointer authentication codes, and code signing. This talk is designed for those new to macOS reversing, although a basic understanding of reversing topics would be helpful.

Add to Calendarcalendarcalendarcalendarcalendar

Every great invention stands on the shoulders of giants. For many Static Application Security Testing (SAST) tools (e.g., Semgrep, CodeQL), that giant is data-flow analysis—a framework to automatically reason and understand code statically or without running it. One reason behind the popularity of data-flow analysis is that it is memory efficient, fast to execute, and most importantly, can detect the so-called taint-style vulnerabilities that many vulnerability types fall under. Null-pointer dereference, OS command injection, and buffer overflow vulnerabilities are all examples of taint-style vulnerabilities. This talk will be divided into the three parts: (1) an introduction to taint-style vulnerabilities and the encompassing vulnerability types; (2) a demonstration of how data-flow analysis works using an example taint-style vulnerability; and (3) a discussion on current limitations of SAST tools.

Add to Calendarcalendarcalendarcalendarcalendar

What do types, tests and monitoring provide insight in to your application throughout the development lifecycle. Monitoring in production provides an opportunity to identify and improve problems in the design/architecture of the application and build an understanding or normal, desired behavior. This familiarity can serve as a first line of defense when a threat or abnormal traffic affects a system.

Add to Calendarcalendarcalendarcalendarcalendar