BSides Berlin

Doors open - Registration

Opening Words

Ghosts in the Cluster: Hiding in Kubernetes for Years Rory McCune

You've popped a Kubernetes cluster. You've got admin creds. Now the real question is how do you stay? Kubernetes abstracts away enormous complexity across multiple layers, from container runtimes to cluster APIs, and each of those layers has dark corners where an attacker can set up shop and go unnoticed for months or even years.

This talk is a post-exploitation deep dive into Kubernetes persistence. We'll walk through a compromised cluster layer by layer, demonstrating how attackers can escape to cluster nodes, spin up containers invisible to kubectl, abuse the Kubelet API to dodge audit logging and admission control, and create phantom credentials that survive long after the initial breach is forgotten. If defenders aren't watching every layer of the stack, they won't see you coming, or going.

Break

The GitHub OIDC Trust Problem: When You Trust the Wrong String Alejandro Rusell

Everyone tells you to replace long-lived CI/CD credentials with OIDC, and for good reason: a short-lived, per-run token beats a static key sitting in a secrets manager. But GitHub Actions ships one property that quietly undermines the fix: GitHub itself is the OIDC issuer for every workflow on the platform, yours and everyone else's, and it authenticates all of them exactly the same way. Authentication is basically a given, as the token's signature will validate no matter which workflow requested it. The real security decision scopes down to authorization: how your cloud provider processes the claims inside that token. That's where the structural blind spot is.

GitHub builds the identity claim as a multi-segment value, gluing together organization, repository, branch, and workflow information. AWS's trust-policy engine, and its equivalents elsewhere, validates the whole thing as one opaque string. A wildcard doesn't know where one piece of information ends and the next begins, and that's exactly the gap behind the wildcard-trust-policy findings that keep surfacing in the wild.

This talk gives you the mental model for why that keeps happening, walks through GitHub's and AWS's changes during 2026 to how identity is expressed and validated, and shows precisely which parts of the problem they do and don't fix, with a demo of building and matching a vulnerable trust policy, not just slides. You'll leave knowing exactly what pattern to grep your own trust policies for tonight.

Break

Trusted Distribution, Untrusted Outcome: Malicious Proxyware via Microsoft Store Applications Piotr Bienias

Microsoft Store applications are often perceived as trustworthy because they undergo a certification process and are distributed through an official software marketplace. This presentation examines a malicious proxyware campaign that abused this trust model by distributing seemingly legitimate utility applications that contained a hidden proxyware payload.

The session follows the investigation from campaign discovery through technical analysis, showing how Electron-based MSIX applications loaded a Go-based payload using the Node.js FFI library koffi, achieved persistence through MSIX Startup Tasks, and ultimately transformed victim systems into residential proxy nodes. The presentation also discusses why the campaign avoided detection by traditional security controls, including the absence of Microsoft Defender for Endpoint alerts and limited antivirus detections, and concludes with key lessons learned from investigating malicious functionality operating within trusted application ecosystems.

Lunch Break

Keyless Entry: Hacking SwitchBot Smartlocks Kolja Grassmann

Smart locks are rapidly replacing physical keys, but trusting your front door to an IoT device still comes with significant risks. In this talk, we will dissect the highly rated SwitchBot Lock Pro and demonstrate how a classic cryptographic implementation flaw allowed anyone to silently unlock the door without any physical tampering.

By reverse-engineering the firmware and analyzing the custom Bluetooth Low Energy (BLE) protocol between the outdoor keypad and the indoor actuator, we discovered the system relies on AES in Counter (CTR) mode with zero integrity checks. We will demonstrate how we exploited this to create a universal, software-only UNLOCK payload. Join us as we showcase the live exploit, break down the vendor’s flawed patch, explain how backward compatibility significantly delayed the patch, and celebrate our massive 100€ bug bounty.

Break

Your AI Just Leaked a Secret Yunus Aydın

AI-assisted "vibe coding" is accelerating software development, but it also introduces subtle security risks. This research presents a three-month analysis of thousands of public GitHub repositories, using AI to examine commit messages as a side channel for detecting secret exposure. By identifying patterns such as "remove secret" or "fix leaked token," the study uncovers how sensitive data is briefly committed and later removed. The findings highlight how AI-generated code contributes to these leaks and demonstrate how commit metadata can enhance traditional secret detection and mitigation strategies.

Coffee Break

Beyond Coverage: How to Benchmark AI Web Pentest Agents and Frontier Models Eran Cohen

Evaluating an AI web red-teamer has no good options. Public CTFs are in every recent model's training data, so scores measure recall of a walkthrough. Real production targets are realistic but have no ground truth, so when the agent reports five findings and goes quiet, you cannot distinguish a clean app from a half-blind agent. "What it missed" is the whole question and neither option answers it.

We built ARENA, a lab generator that produces fresh, realistic web applications on demand with a known answer key: you specify vulnerability classes, counts, difficulty, and production friction such as hidden endpoints and WAF behavior. Seven frontier models ran as the exploitation engine inside one multi-agent harness (discovery through exploitation, this study benchmarking the exploitation half) against one generated ticketing app, three runs each. All seven got the same fixed 110-lead baseline, a subset of the leads discovery produced, holding every ground-truth bug plus extra leads. Allowing us to observe extra TP outside the answer key, FP and scope drifts.

Results. We start against the 8 seeded bugs: a heatmap of every model against every planted vulnerability, showing in how many of its three runs each one found it. Consistency shows up immediately. But the models kept reporting true positives that were never in our key, so we re-scored everything against a Validated Ground Truth built with LLM-as-a-judge and manual adjustment. The results then cover cost, full coverage, fallbacks, runtime, scope drift and advisor usage.

Break

The Agents of Chaos: AI Driven Malware Generation Arad Donenfeld

With the use of AI agents catching wind across the offensive security space, from social engineering to vulnerability research, it was inevitable that malware would follow suit. While most discussions focus on targeting AI, using it to generate malicious payloads at a malware’s runtime, or “vibe coding” it, we went a step further: we built a system where AI is the sole participant in the malware creation process itself.

We will begin by talking about how we got to this point, what sparked the idea, and jump into comparing different models, showing which gave the best code, which was most evasive, which prompts worked the best, and what we used in the agent.

We will then dig into the generation process itself: we will show the challenges with earlier approaches, how we solved them, how to build the workflow to maximize the malware’s capability and randomization, how it managed to break signatures, and how to generate millions of samples.

We will finish by showing how attackers are using similar methods, look at real examples in the wild, and discuss how to use these techniques for ourselves, both as attackers and defenders.

Closing Words