BRIEFINGS DAY 1 WEDNESDAY | AUGUST 5 BRIEFINGS DAY 1 WEDNESDAY | AUGUST 5

Level 2 Level 3

ROOM , Lagoon K Mandalay Bay BCD Mandalay Bay EF Mandalay Bay GH Jasmine Ballroom South Seas ABE South Seas CDF South Seas GH South Seas IJ

07:00-19:00 Registration // Black Hat Blvd Hardware/Embedded Crypto Network Security Development Lifecycle 08:00-08:50 Breakfast // Shoreline B Sponsored by: Human Factors Defense OS, Host and Container Security Smart Grid/Industrial Security 08:50-09:00 Welcome & Introduction to Black Hat USA 2015 // Mandalay Bay Ballroom

LEGEND Internet of Things Enterprise Panels Virtualization Exploit Development Malware Reverse Engineering Web AppSec 09:00-10:00 Keynote Speaker // Jennifer Granick // Mandalay Bay Ballroom Mobile Forensics/Incident Response Risk Management/Compliance 10:00-10:20 Break

How to Hack Government: Internet Plumbing for Writing Bad @$$ Malware for Android Security State of the Server-Side Template Bring Back the Why Security Data Spread Spectrum Unicorn: Next Technologists as Policy Security Professionals: The OS X by Patrick Wardle Union by Adrian Ludwig Injection: RCE for the Honeypots... by Haroon Science Matters and Satcom Hacking: Generation CPU 10:20-11:10 Makers by Ashkan Soltani State of BGP Security Modern Web App Meer + Marco Slaviero How It’s Different: Attacking the GlobalStar Emulator Framework by + Terrell McSweeny by Wim Remes by James Kettle Pitfalls and Promises Simplex Data Service Nguyen Anh Quynh of Data Science Based by Colby Moore + Hoang-Vu Dang Breach Detection and Threat Intelligence by Joshua Saxe

Coffee Service // Level 2, 3, Microsoft 11:10-11:30 Sponsored by: Business Hall Networking Lounge

Breaking HTTPS with Attacking Interoperability - Defeating Pass-the-Hash: Winning the Online Banking Emanate Like a Boss: Take a Hacker to Work Why Security Data The Battle for Free Understanding and BGP Hijacking by Artyom An OLE Edition by Haifei Li Separation of Powers War by Sean Park Generalized Covert Day - How Federal Science Matters and Speech on the Internet Managing Entropy 11:30-12:20 Gavrichenkov + Bing Sun by Seth Moore + Baris Saydag Data Exfiltration with Prosecutors Use the How It’s Different: by Matthew Prince Usage by Bruce Potter Funtenna by Ang Cui CFAA by Leonard Bailey Pitfalls and Promises + Sasha Wood of Data Science Based Breach Detection and Threat Intelligence by Joshua Saxe

12:20-13:50 Lunch Break

Data-Driven Threat Adventures in Femtoland: Red vs. Blue: Modern Active GameOver Zeus: Badguys Exploiting the DRAM SMBv2: Sharing More Abusing Silent Mitigations The Tactical Application These are Not Your Intelligence: Metrics on 350 Yuan for Invaluable Fun Directory Attacks, Detection, and Backends by Elliott Rowhammer Bug to than Just Your Files - Understanding Security Program: Grand Daddy’s CPU Indicator Dissemination and by Alexey Osipov + Alexander and Protection Peterson + Michael Sandee + Gain Kernel Privileges by Jonathan Brossard + Weaknesses Within Getting Stuff Done by Performance Counters 13:50-14:40 Sharing by Alexandre Sieira Zaitsev by Sean Metcalf Tillman Werner by Mark Seaborn + Halvar Hormazd Billimoria Internet Explorer’s Cory Scott + David Cintz - CPU Hardware + Alex Pinto Flake Isolated Heap and Performance Counters Memory Protection for Security by Nishad by Brian Gorenc Herath + Anders Fogh + Abdul-Aziz Hariri + Simon Zuckerbraun

Schedule as of July 20, 2015. Subject to Change.

WWW.BLACKHAT.COM # BHUSA BRIEFINGS DAY 1 WEDNESDAY | AUGUST 5 BRIEFINGS DAY 1 WEDNESDAY | AUGUST 5

Level 2 Level 3

ROOM , Lagoon K Mandalay Bay BCD Mandalay Bay EF Mandalay Bay GH Jasmine Ballroom South Seas ABE South Seas CDF South Seas GH South Seas IJ

14:40-15:00 Break

WSUSpect - Compromising Stagefright: Scary Code in Remote Exploitation of an Big Game Hunting: The Targeted Takedowns: Back Doors and Front Switches Get Stitches Distributing the Stranger Danger! What the Windows Enterprise via the Heart of Android Unaltered Passenger Vehicle Peculiarities of Nation-State Minimizing Collateral Doors Breaking the by Colin Cassidy + Robert Reconstruction of is the Risk from 3rd Windows Update by Paul by Joshua Drake by Charlie Miller + Chris Malware Research Damage Using Passive Unbreakable System Lee + Eireann Leverett High-Level Intermediate Party Libraries? 15:00-15:50 Stone + Alex Chapman Valasek by Morgan Marquis-Boire DNS by Paul Vixie by James Denaro + Representation for Large by Kymberlee Price + Jake + Marion Marschalek Matthew Green Scale Malware Analysis Kouns + Claudio Guarnieri by Rodrigo Branco + Gabriel Negreira Barbosa + Alexander Matrosov + Eugene Rodionov

Networking Break // Microsoft Business 15:50-16:20 Sponsored by: Hall Networking Lounge // Shoreline A

Faux Disk Encryption: Optimized Fuzzing IOKit in Abusing Windows Attacking Hypervisors Using The Little Pump Gauge Crash & Pay: How Securing Your Big Data Panel: Getting It Right: Behind the Mask: The Realities of Secure Storage iOS by Lei Long + Peng Xiao + Management Firmware and Hardware that Could: Attacks to Own and Clone Environment by Ajit Straight Talk on Threat Agenda, Tricks, and 16:20-17:10 on Mobile Devices by Daniel Aimin Pan Instrumentation (WMI) by Yuriy Bulygin + Alexander Against Gas Pump Contactless Payment Gaddam & Information Sharing Tactics of the Federal Mayer + Drew Suarez to Build a Persistent, Matrosov + Mikhail Gorobets Monitoring Systems Devices by Peter Fillmore moderated by Trey Ford Trade Commission Asynchronous, and Fileless + Oleksandr Bazhaniuk by Kyle Wilhoit + Stephen as they Regulate Backdoor by Matthew Hilt Cybersecurity by Michael Graeber Daugherty

17:10-17:30 Break

17:30-18:00

Subverting Satellite Graphic Content Ahead: Cloning 3G/4G SIM Commercial Mobile Spyware The Node.js Highway: How Vulnerable are We Attacking ECMAScript Mobile Point of Scam: THIS IS DeepERENT: Receivers for Botnet and Towards Automated Cards with a PC and an - Detecting the Undetectable Attacks are at Full to Scams? by Markus Engines with Attacking the Square Tracking App Behaviors Profitby Sofiane Talmat Scalable Analysis of Oscilloscope: Lessons by Joshua Dalman + Valerie Throttle by Maty Siman Jakobsson Redefinitionby Natalie Reader by Alexandrea with (Nothing Changed) Graphical Images Learned in Physical Security Hantke + Amit Ashbel Silvanovich Mellen + John Moore Phone for Evasive Embedded in Malware by Yu Yu Android Malware by Alex Long by Yeongung Park + Jun Young Choi

17:30-19:00 Business Hall Reception // Shoreline A Sponsored by:

18:30-19:30 Pwnie Awards // Mandalay Bay D

Schedule as of July 20, 2015. Subject to Change.

WWW.BLACKHAT.COM # BHUSA BRIEFINGS DAY 2 THURSDAY | AUGUST 6 BRIEFINGS DAY 2 THURSDAY | AUGUST 6

Level 2 Level 3

ROOM , Lagoon K Mandalay Bay BCD Mandalay Bay EF Mandalay Bay GH Jasmine Ballroom South Seas ABE South Seas CDF South Seas GH South Seas IJ

08:00-08:50 Breakfast // Shoreline B Sponsored by:

08:30-17:00 Registration // Black Hat Blvd

CrackLord: Maximizing Remote Physical Damage Attacking Your Trusted Core: TrustKit: Code Injection on The Applications of ROPInjector: Using My Bro the ELK: Exploiting XXE Taxonomic Modeling 09:00-09:25 Password Cracking Boxes 101 - Bread and Butter Exploiting Trustzone on iOS 8 for the Greater Good Deep Learning on Traffic Return Oriented Obtaining Context from Vulnerabilities in File of Security Threats by Lucas Morris + Michael Attacks by Jason Larsen Android by Di Shen by Alban Diquet + Eric Castro Identificationby Zhanyi Programming for Security Events by Travis Parsing Functionality in Software Defined McAtee + Angela On-kit Chow Wang + Chuanming Polymorphism and Smith by Willis Vandevanter Networking by Jennia Huang Antivirus Evasion Hizver by Christos Xenakis

09:25-09:45 Break

Web Timing Attacks Made Repurposing OnionDuke: A The NSA Playset: A Year of The Memory Sinkhole - Battle of the SKM and Bringing A Cannon to a Certifi-gate: Front- Bypass Surgery Abusing The Kali Dojo Practical by Timothy Morgan Single Case Study Around Toys and Tools by Michael Unleashing an x86 Design IUM: How Windows Knife Fight by Adam Kozy Door Access to Pwning Content Delivery Workshop #1: Rolling 09:45-10:35 + Jason Morgan Reusing Nation State Ossmann Flaw Allowing Universal 10 Rewrites OS + Johannes Gilger Millions of Androids Networks with Server- Your Own - Generating Malware by Joshua Pitts by Architecture by Alex by Ohad Bobrov + Avi Side-Request Forgery Custom Kali Linux 2.0 Christopher Domas Ionescu Bashan (SSRF), Flash, and DNS ISOs by Mati Aharoni by Mike Brooks + Matthew Bryant

Coffee Service // Level 2, 3, Microsoft 10:35-11:00 Sponsored by: Business Hall Networking Lounge

Breaking Access Controls Panel: How the Wassenaar Defeating Machine Learning: Ah! Universal Android Taking Event Correlation How to Implement IT Return to Where? You Staying Persistent The Kali Linux Dojo with BLEKey by Eric Arrangement’s Export What Your Security Vendor Rooting is Back by Wen Xu with You by Rob King Security After a Cyber Can’t Exploit What You in Software Defined Workshop #2: Kali USB 11:00-11:50 Evenchick + Mark Baseggio Control of “Intrusion is Not Telling You by Bob Meltdown by Christina Can’t Find by Christopher Networks by Gregory Setups with Persistent Software” Affects the Klein + Ryan Peters Kubecka Liebchen + Ahmad- Pickett Stores and LUKS Nuke Security Industry Reza Sadeghi + Andrei Support by Mati Aharoni moderated by Kim Zetter Homescu + Stephen Crane

11:50-12:10 Break

Forging the USB Armory, an Information Access and From False Positives Fingerprints on Mobile Internet-Facing PLCs - A ZigBee Exploited the Bypass Control Flow Breaking Honeypot for BGP Stream by Dan 12:10-13:00 Open Source Secure Flash- Information Sharing: Where to Actionable Analysis: Devices: Abusing and New Back Orifice Good, the Bad, and the Guard Comprehensively Fun and Profit by Dean Hubbard + Andree Toon Drive-Sized Computer We are and Where We Behavioral Intrusion Leaking by Yulong Zhang by Johannes Klick Ugly by Tobias Zillner by Yunhai Zhang Sysman + Gadi Evron by Andrea Barisani + Daniele are Going by Alejandro Detection, Machine + Tao Wei + Stephan Lau + Sebastian Strobl + Itamar Sher Bianco Mayorkas Learning, and the SOC by Joseph Zadeh

Schedule as of July 20, 2015. Subject to Change.

WWW.BLACKHAT.COM # BHUSA BRIEFINGS DAY 2 THURSDAY | AUGUST 6 BRIEFINGS DAY 2 THURSDAY | AUGUST 6

Level 2 Level 3

ROOM , Lagoon K Mandalay Bay BCD Mandalay Bay EF Mandalay Bay GH Jasmine Ballroom South Seas ABE South Seas CDF South Seas GH South Seas IJ

13:00-14:30 Lunch Break

When IoT Attacks: Hacking a Is the NSA Still Listening Automated Human Pen Testing a City by Greg Internet-Scale File Broadcasting Your Assessing and Exploiting Understanding the Review and Exploit Linux-Powered Rifle by Runa to Your Phone Calls? Vulnerability Scanning with Conti + Tom Cross + David Analysis by Zachary Hanif Attack: Security Testing BigNum Vulnerabilities Attack Surface and Neglected Attack 14:30-15:20 A. Sandvik + Michael Auger A Surveillance Debate: AVA by Laura Bell Raymond + Tamas Lengyel + George DAB Radio in Cars by by Ralf-Philipp Weinmann Attack Resilience of Surfaces in iOS 8 Congressional Success or Webster Andy Davis Project Spartan’s New by Tielei Wang + Hao Xu Epic Fail by Mark Jaycox EdgeHTML Rendering + Xiaobo Chen + Jamil Jaffer Engine by Mark Vincent Yason

Ice Cream Social // Microsoft Business 15:20-15:50 Sponsored by: Hall Networking Lounge // Shoreline A

Abusing XSLT for Practical Rocking the Pocket Book: Advanced IC Reverse Social Engineering the ThunderStrike 2: Sith Deep Learning on HI THIS IS URGENT Using Static Binary Breaking Payloads with 15:50-16:40 Attacks by Fernando Hacking Chemical Plant for Engineering Techniques: In Windows Kernel: Finding Strike by Xeno Kovah Disassembly by Matt PLZ FIX ASAP: Critical Analysis to Find Runtime Code Stripping Arnaboldi Competition and Extortion Depth Analysis of A Modern and Exploiting Token + Corey Kallenberg Wolff + Andrew Davis Vulnerabilities and Bug Vulnerabilities and and Image Freezing by Marina Krotofil Smart Card by Olivier Thomas Handling Vulnerabilities + Trammell Hudson Bounty Programs Backdoors in Firmware by Collin Mulliner by James Forshaw by Kymberlee Price by Christopher Kruegel + Matthias + Yan Shoshitaishvili Neugschwandtner

16:40-17:00 Break

Fuzzing Android System Harnessing Intelligence from Most Ransomware Isn’t as FileCry - The New Age of Dom Flow - Untangling Exploiting Out-of- Hidden Risks of API Deobfuscator: Dance Like Nobody's 17:00-18:00 Services by Binder Call to Malware Repositories Complex as You Might Think XXE by Xiaoran Wang the DOM for More Easy- Order Execution for Biometric Identifiers and Resolving Obfuscated Watching, Encrypt Like Escalate Privilege by Guang by Arun Lakhotia + Vivek by Engin Kirda + Sergey Gorbaty Juicy Bugs by Ahamed Covert Cross-VM How to Avoid Them API Functions in Modern Everyone Is: A Peek Gong Notani Nafeez Communication by Thomas Keenan Packers by Seokwoo Inside the Black Hat by Sophia D’Antoine Choi Network by Neil Wyler + Bart Stump

Schedule as of July 20, 2015. Subject to Change.

Hardware/Embedded STAY CONNECTED Crypto Network Security Development Lifecycle Human Factors Defense OS, Host and Container Security Smart Grid/Industrial Security

LEGEND Internet of Things .com/BlackHatEvents or @BlackHatEvents youtube.com/user/BlackHatOfficialYT Enterprise Panels Virtualization Malware facebook.com/BlackHat flickr.com/photos/blackhatevents/ Exploit Development Reverse Engineering Web AppSec Mobile https://www.linkedin.com/grp/home?gid=37658 plus.google.com/+BlackHatOfficialYT Forensics/Incident Response Risk Management/Compliance

WWW.BLACKHAT.COM # BHUSA ARSENAL DAY 1 WEDNESDAY | AUGUST 5 ARSENAL DAY 1 WEDNESDAY | AUGUST 5

Breakers DEJK Breakers DEJK

STATION , 1 2 3 4 5 6 7 8 9 10 % STATION

08:00-08:50 Breakfast // Shoreline B Sponsored by: 08:00-08:50

08:50-09:00 Welcome & Introduction to Black Hat USA 2015 // Mandalay Bay Ballroom

09:00-10:00 Keynote Speaker // Jennifer Granick // Mandalay Bay Ballroom 09:00-10:00

Osxcollector Damn Vulnerable iOS Bearded Sphinx by Takehiro Nsearch by Juan MITMf Triforce FindSecurityBugs QARK - Android SERPICO by Ivan Leichtling App (DVIA) by Prateek by Viacheslav Takahashi Jacobo Tibaquirá by Marcello Salvati by David Cowen by Philippe Arteau Application SCA and by Willis Vandevanter 10:00-12:30 10:00-12:30 Gianchandani Bakhmutov Exploit Tool by Tony + Peter Arzamendi Trummer + Tushar Dalvi

12:30-12:45 Break 12:30-12:45

Nishang - The Black Sqlchop by Yusen Rudra - The Destroyer OWASP Distributed CTF Tools Exploit Pack Dradis Framework 3.0 Breachego Intrigue ElastAlert 12:45-15:15 Hat Version Chen of Evil by Ankur Tyagi Web Honeypots by Yan Shoshitaishvili by Juan Sacco by Daniel Martin by Christian Heinrich by Jonathan Cran by Quentin Long 12:45-15:15 by Nikhil Mittal Project by Ryan Barnett

15:15-15:30 Break 15:15-15:30

WireEdit by Michael peepdf by Jose Miguel CapTipper by Omri Openioc_Scan The Volatility Burp-hash by Scott SAMLyze PixelCAPTCHA - A CuckooDroid - An Seclists by Jason Sukhar Esparza Herscovici by Takahiro Haruyama Framework Johnson + Tim by Jon Barber Unicode Based Automated Malware Haddix + Daniel 15:30-18:00 15:30-18:00 by Michael Ligh MalcomVetter + Matt CAPTCHA Scheme Analysis Framework Miessler South by Gursev Singh Kalra by Idan Revivo + Ofer Caspi

ARSENAL DAY 2 THURSDAY | AUGUST 6 ARSENAL DAY 2 THURSDAY | AUGUST 6

Breakers DEJK Breakers DEJK

STATION , 1 2 3 4 5 6 7 8 9 10 % STATION

08:00-08:50 Breakfast // Shoreline B Sponsored by: 08:00-08:50

Reissue Request SimpleRisk WATOBO - The ChipWhisperer SpeedPhishing D1c0m-X OWASP Broken Web ShinoBOT Mana Pestudio 10:00-12:30 Scripter (Burp Plugin) by Josh Sokol WebApplication by Colin O’Flynn Framework (SPF) by Michael Hudson Applications VM v1.2 by Shota Shinogi by Dominic White by Marc Ochsenmeier 10:00-12:30 by Philippe Arteau ToolBox by Adam Compton by Chuck Willis by Andreas Schmidt

12:30-12:45 Break 12:30-12:45

TARDIS Backdoor Factory Digital Disease UTIP - Unstructured Preeny Linux-Inject OWASP Dependency- Active Directory Noriben by Travis Smith (BDF) and BDFProxy Tracking Tool Threat Intelligence by Yan Shoshitaishvili by Tyler Colgan Check by Jeremy Long Backdoors: Myth or by Brian Baskin 12:45-15:15 by Joshua Pitts by Efrain Ortiz Processing Reality BTA: Open-Source 12:45-15:15 by Elvis Hovor Tool for AD Analysis by Joffrey Czarny

15:15-15:30 Break 15:15-15:30

Chellam Lynis Objective-See’s OS X Kautilya Faraday ThreadFix HEYBE - Pentest CuckooSploit YARD Stick One by Vivek Ramachandran by Michael Boelen Security Tools by Nikhil Mittal by Federico by Dan Cornell Automation Toolkit by by David Oren by Michael Ossmann + 15:30-18:00 15:30-18:00 by Patrick Wardle Kirschbaum Bahtiyar Bircan Taylor Streetman + Gokhan Alkan

16:00-18:00 Arsenal Happy Hour 16:00-18:00 Schedule as of July 20, 2015. Subject to Change.

WWW.BLACKHAT.COM # BHUSA SPONSORED SESSIONS DAY 1 WEDNESDAY | AUGUST 5 SPONSORED WORKSHOPS DAY 1 WEDNESDAY | AUGUST 5

ROOM , Business Hall - Theater A Business Hall - Theater B ROOM , Mandalay Bay J Mandalay Bay K Mandalay Bay L Session Name Sponsor Session Name Sponsor Session Name Sponsor Session Name Sponsor Session Name Sponsor

Next-Gen Vulnerability DNS Arms Race: Exploiting IT 10:20-11:05 Typography of a Many Roles DNS Analytics to Create Management and Compliance Security in Focus 10:20-11:10 with Cloud Agents Cyber Attack Plays in Security a 'Human Layer' Battles Security Initiative Malware Prospecting: Tactical Diversion-Driven 11:30-12:15 Separating the Advanced from 11:10-11:30 Break Defense the Annoying Turf War: Using Exploiting IT Typography of a Geo-Intelligence Analytics to Create Zero-Day Inferno: Aggressive, 11:30-12:20 Fear of the Dark: The Life of a Cyber Attack to Thwart Cyber a 'Human Layer' 12:40-13:25 Automated Privileged Identity Tier 3 Analyst Threats Security Initiative Management for Cyber Defense 12:20-13:50 Lunch Two Steps Forward, One Back: Can DLP Thwart Malware How Poorly 13:50-14:35 Exploiting IT Security Research and the Law Attacks? Obfuscated Kaizen Capture the Analytics to Create 13:50-14:40 MobileApp Code Flag a 'Human Layer' Leads to Vulnerable Tailored Attacks Require Security Initiative Tailored Defenses: Improving IoT Devices 15:00-15:45 Wild Wild Web Experience Your Incident Response Strategy 14:40-15:00 Break Through Advanced Threat How Poorly Hunting Exploiting IT Obfuscated Kaizen Capture the Analytics to Create Beyond Detection – Using 15:00-15:50 MobileApp Code Flag a 'Human Layer' Adaptive Security to Discover Leads to Vulnerable 16:10-16:55 Man in the Cloud Attacks Security Initiative Threats in a Dynamic IoT Devices Environment SPONSORED WORKSHOPS DAY 2 THURSDAY | AUGUST 6 SPONSORED SESSIONS DAY 2 THURSDAY | AUGUST 6 ROOM , Mandalay Bay J Mandalay Bay K Mandalay Bay L ROOM , Business Hall - Theater A Business Hall - Theater B Session Name Sponsor Session Name Sponsor Session Name Sponsor Session Name Sponsor Session Name Sponsor A Cyber Overcoming Chaos Professional’s Endpoints, Threat and Disruption: A Utilizing Contextual Awareness Principles of the Application of 11:00-11:50 11:00-11:45 Guide to Deception Feeds, FPs and You New World Order in to Combat Cyber Threats Threat Intelligence Technologies Security

Open-Source IDS Laika BOSS: Understanding Threats 11:50-12:10 Break 12:10-12:55 Protecting Your Enterprise from Using Machine Learning and A Cyber Overcoming Chaos Malicious Files Contextual Analytics Professional’s Endpoints, Threat and Disruption: A 12:10-13:00 Security Assurance and Guide to Deception Feeds, FPs and You New World Order in Security Operations: Moving to a 13:20-14:05 Tenable's Five Cyber Security Technologies Security Narrative-Driven Model Controls 13:00-14:30 Lunch The Cyber Supply Line: A Can Your IaaS Workloads Take The Information 14:30-15:15 Geospatial Approach to Security Landscape: A Punch? 14:30-15:20 Cybersecurity What Security Pros REALLY Worry About The Privileged Aspect of 15:40-16:25 15:20-15:40 Break Kerberos Attacks

Schedule as of July 20, 2015. Subject to Change. How to Find a Better 15:40-16:30 Job in IT Security

WWW.BLACKHAT.COM # BHUSA