BEGIN:VCALENDAR
PRODID:-//vBulletin 6//EN
VERSION:2.0
CALSCALE:GREGORIAN
BEGIN:VEVENT
UID:a56c5b94-97be-4c3b-88d8-a96850d9850a
DTSTAMP:20260620T111947Z
SUMMARY:Maxwell Dulin\, Nathan Kirkland\, Zachary Minneker\, Kenzie Dolan\,
  Elizabeth St. Germain - House...
DESCRIPTION:Title: Maxwell Dulin\, Nathan Kirkland\, Zachary Minneker\, Ken
 zie Dolan\, Elizabeth St. Germain - House of Heap Exploitation\n\nSchedule
 d Date and Time (Pacific Standard): Friday\, August 11\, 2023\, at 0900 PD
 T\n\nEventBrite Link: https://www.eventbrite.com/e/maxwell-dulin-house-of-
 heap-exploitation-tickets-668369620527?aff=oddtdtcreator\n\nMax Class Size
 : 90\n\n\n\n\nAbstract:\n\nHeap exploitation is an incredibly powerful too
 l for a hacker. As exploit mitigations have made exploitation more difficu
 lt\, modern exploit development has moved to the heap. However\, heap expl
 oitation is a major wall in the binary exploitation journey because of its
  complexity. To conquer this difficultly\, the workshop tackles the comple
 xity head on by diving into the weeds of the allocator directly\, taking o
 n many hands-on exercises/challenges and creating easy to grasp diagrams t
 o understand all of the concepts.\n\n\n\n\nThis workshop is for learning h
 eap exploit development in glibc Malloc\, which is the default allocator o
 n most Linux distributions. With this hands-on introduction into glibc Mal
 loc heap exploitation you will learn how the allocator functions\, heap sp
 ecific vulnerability classes and to pwn with a variety of techniques. To m
 ake the material easy to consumable\, there are many hands-on exercises\, 
 a pre-built virtual machine with everything necessary for binary exploitat
 ion and an immense amount of visuals for explaining the material. After ta
 king this course you will understand the internals of the glibc Malloc all
 ocator\, be able to uncover heap memory vulnerabilities and pwn the heap w
 ith a variety of techniques\, with the capability to go further into the a
 rt afterwards.\n\n\n\n\nSkill Level: Intermediate\n\nPrerequisites for stu
 dents:\n\n- Basic computer science background (x86_64 assembly\, stack\, p
 rogramming skills in C & Python)\n\n- Basic binary exploitation skills (bu
 ffer overflow exploitation\, ROP\, ASLR\, etc.)\n\n- Familiar with Linux d
 eveloper tools such as the command line\, Python scripting and GDB.\n\n\n\
 n\nMaterials or Equipment students will need to bring to participate:\n\n-
  Laptop with enough power for a moderately sized Linux VM:\n\n- ARM based 
 MacOS has support through either QEMU or servers that people can use.\n\n-
  Administrative access to the laptop\n\n- 8GB RAM minimum\n\n- 30GB harddr
 ive space\n\n- Virtualbox or another virtualization platform installed\n\n
 \n\n\nBio:\n\nMaxwell Dulin (also known as Strikeout) loves hacking all th
 ings under the sun. In his day job\, he works as a security engineer prima
 rily focused on web applications. But at night\, he leaves the tangled web
  into the open space of radio signals\, garage doors\, scoreboards\, RC ca
 rs\, and pwn challenges. From the latter\, he gained enough expertise to c
 reate a heap exploitation course that has been delivered at a number of se
 curity conferences\, including DEFCON. In his spare time\, he has found Li
 nux kernel 0-days\, and reverse engineered numerous wireless devices. To s
 ummarize\, if you put something in front of him\, he'll find a way to brea
 k it and make it do what he wants.\n\n\n\n\nRaised on a steady diet of vid
 eo game modding\, when Nathan found programming as a teenager\, he fit rig
 ht into it. Legend says he still keeps his coffee (and tear) stained 1980s
  edition of The C Programming Language by K&R stored in a box somewhere. A
  few borrowed Kevin Mitnick books later\, he had a new interest\, and bega
 n spending more and more time searching for buffer overflows and SQL injec
 tions. Many coffee fueled sleepless nights later\, he had earned OSCP\, an
 d graduated highschool a few months later. After a few more years of worki
 ng towards a math degree and trying fervently to teach himself cryptanalys
 is\, he decided to head back to the types of fun hacking problems that wer
 e his real first love\, and has worked at Security Innovation ever since.\
 n\n\n\n\nZachary Minneker is a security researcher and security engineer a
 t Security Innovation. His first computer was a PowerPC Macintosh\, an ISA
  which he continues to defend to this day. At Security Innovation\, he has
  performed security assessments on a variety of systems\, including robots
  for kids\, audio transcription codecs\, and electronic medical systems. H
 e has previous experience administrating electronic medical systems\, and 
 deep experience in fuzzing\, reverse engineering\, and protocol analysis. 
 His research has focused on techniques for in-memory fuzzing\, macOS sandb
 ox security\, and IPC methods.\n\n\n\n\nKenzie Dolan works for Security In
 novation as a Security Engineer focusing on engagements ranging from IoT h
 acking to kiosk exploitation. Her current research interests include emerg
 ing threats against Mobile and IoT devices. She has a degree in Computer a
 nd Information Science from University of Oregon. In her free time\, Kenzi
 e enjoys composing music\, playing video games or hiking in the greater Se
 attle area.\n\n\n\n\nElizabeth St. Germain started hacking from a young ag
 e when very few inputs were sanitized. She worked in systems administratio
 n and video game development before settling into hacking as a career. She
  now focuses her time on web and hardware hacking\, with a desire to explo
 re the security impacts that video games can have on consumers. Most of he
 r free time is split between either min/maxing games\, competing in CTFs\,
  exploring urban areas and nature\, or making music.\n\n\n\n​
URL:https://forum.defcon.org/node/246043
DTSTART:20230811T170000Z
DTEND:20230811T210001Z
LOCATION:Las Vegas\, NV\, DEF CON 31
END:VEVENT
END:VCALENDAR