The 11^th Annual

Security
BSidesCT

A conference for the Connecticut information security community, run by the Connecticut infosec community.

DateSaturday, September 26th, 2026

VenueFairfield University, Fairfield, CT

What's BSides?

BSides CT is an annual conference run by and for the Connecticut information security (infosec) community.

Security BSides started in 2009 as a community-led initiative where information security enthusiasts come together to learn, share, and connect. Our events are designed for everyone — whether you're presenting or just participating. We cultivate an environment that sparks collaboration and insightful conversations, breaking the mold of typical meetings with hands-on demos and deep discussions about what's next in our industry.

Every state and every country has held a Security BSides event, with many states holding more than one per year!

Serving You

BSides Connecticut, specifically, started in 2011 with an all-volunteer crew. We host our own annual event open to all people interested in cybersecurity — from students to seasoned professionals. As more people learned about us, we've grown ever larger in size and scope.

BSides events are about sharing and learning from each other — a platform for security experts and professionals to share ideas and make lasting connections. Each BSides event, including ours, is driven by the community. The idea is to take the conversation beyond the usual conference setting and encourage collaboration: a chance for participants to share their knowledge and learn from each other.

Reach out and touch someone

The annual BSides CT event is a place for the community to share ideas and learn.

Connect

Insightful
discussions

Formal and informal networking and educational opportunities.

Practical
demonstrations

Hands-on activities like our annual Capture the Flag (CTF) and workshops.

Learn

Interactive
sessions

Talks covering the latest trends and events shaping the future of infosec.

Schedule

Two tracks of talks across the day. The schedule is subject to change.

Heads up

The schedule is subject to change.

	Busy Signal (Track 1)	Dial Tone (Track 2)
Morning
08:00	Registration
09:00 - 10:00	Opening Remarks / Keynote John V with Joseph Magly
10:15 - 11:00	When the Allocator Fights Back: Debugging Modern glibc Heap Exploits Parshwa Bhojak This talk covers what to do when your classic heap exploit dies silently on modern glibc: since 2.34, the allocator stopped calling __free_hook, so the standard "overwrite it with system" trick no longer works. Working through a use-after-free on glibc 2.39 live, the speaker builds a working exploit by defeating safe-linking, the tcache double-free key, and tcache's alignment check — with the real lessons coming from failures like a movaps alignment fault and silent one-quadword corruption from glibc's own checks. It closes with a source-verified matrix of which classic techniques still work across glibc 2.23–2.41, plus the working code and a one-page field reference.	--
11:15 - 11:45	A Crowd of Nobody: Building a Synthetic BLE Crowd on Off-the-Shelf ESP32s John Costa Counter-surveillance hardware is cheap enough that most people can detect IMSI catchers, AirTags, and plate readers, but detection alone doesn't stop data from being collected. Simulacra takes the opposite approach: a multi-node ESP32 setup that generates a churning crowd of fake BLE and Wi-Fi devices around you, appearing, lingering, and leaving like real ones, so that anything passively logging the area sees too many realistic devices to tell which is yours. The talk covers why device tracking still works despite phone privacy features, how the generator works, the unexpected ways early fake crowds gave themselves away, and what the project does and deliberately doesn't do.	Obfuscation for Scripting Languages Ronnie Scarpa Obfuscation transforms readable scripting code into a functionally equivalent but harder-to-analyze form, raising the cost of reverse engineering without offering absolute protection. Techniques range from renaming identifiers and inserting junk code to compiling scripts into bytecode run by a custom virtual machine, with Lua serving as a practical testbed due to its simple syntax and lightweight runtime. While obfuscation protects intellectual property and embedded logic, it trades off against runtime overhead, debugging complexity, and maintainability—so effective obfuscation balances resistance to analysis against performance and development needs.
Lunch
12:00 - 13:00	Lunch
Afternoon
13:15 - 13:45	Chasing Memory Corruption: Four Months of Hands-on Exploration Kaoru "Mio" Fernandez Over a four-month journey from April to July 2026, the speaker moved beyond reading about modern exploit mitigations—NX, ASLR, PIE, and stack canaries—by building small hands-on experiments to observe how each one actually behaves. Coming from a non-traditional background, they share how curiosity, experimentation, and asking questions made low-level memory corruption accessible, and demonstrate that simple experiments can demystify these defenses even for attendees without an advanced computer science background.	Stop Losing the Room: A Technical Speaker's Guide to Client Debriefs Sabrina Henry Every security professional knows the thrill of finding a critical vulnerability, but the client debrief is where findings often die — jargon-heavy data dumps leave executives confused, development teams defensive, and critical issues unpatched. This fast-paced session breaks down the human element of security reporting, using proven communication frameworks to bridge the gap between complex exploits and executive decision-making. You'll leave with the 3-Part Debrief Architecture for streamlined client calls, a Translation Formula that converts raw technical metrics into business language, and simple rapport and de-escalation strategies to lower client defenses and build trust in the first 60 seconds.
13:55 - 14:45	The Hitchhiker's Guide to Hunting DPRK Remote IT Workers Jordan Saleh Suspected North Korean remote IT workers are increasingly finding their way into legitimate technical roles, passing interviews, identity verification, and onboarding. Once onboarded, the strategy is surprisingly simple: do enough work to stay employed, keep a low profile, and avoid drawing attention all while not even physically owning their company devices. From there, investigations shift to how that employee works. Odd browser searches, activity on collaboration and code-sharing platforms, attempts to establish remote connectivity, inconsistencies in location or working patterns can all provide valuable behavioral signals. The value of these signals comes from the pattern they eventually form together. This talk will follow the lifecycle of a suspected DPRK-linked worker from recruitment and hiring, through laptop-farm setup, to day-to-day behavior. Each stage will highlight what defenders can observe and where security, IT, HR, and investigative teams can find useful evidence. We will then turn those observations into practical threat-hunting approaches focused on behavioral signals rather than waiting for one clear indicator to stand out.	From Zero Trust to Zero Custody: Six Things an AI Agent Must Not Hold Srajan Gupta Zero Trust taught us to verify every actor, but never asked whether that actor should be holding anything worth stealing. AI agents change the calculus: they don't need to be hacked, just misdirected — an attack that hijacks the behavior of a correctly identified principal, as seen in incidents like OpenAI's eval escape where live credentials were reused across individually authorized production hops. This talk proposes a simple principle — the reasoning loop should hold nothing that matters — and walks through six control planes outside the loop (credential, data, authority, decision, environment, and tools) as a practical methodology you can apply without buying a product, covering the architecture, its advantages, and its trade-offs.
14:55 - 15:40	(Perfect) Cell Games: Ah No, Not the Beedrills! - Hunting Rogue Cellular Infrastructure Without Knowing What You're Looking For Mike Curnow Most rogue cell tower defenses rely on recognizing known attack patterns — an assumption that breaks when the adversary stops doing things we recognize. This talk tears into existing detection techniques to show where an adaptive adversary can slip between the rules, then introduces RIFT (Rigidity Inference From Trajectories), which learns the structural behavior of legitimate networks across movement, space, and time and hunts for violations of that structure. Using real-world cellular observations, the speaker explores how these relationships emerge and how RIFT's companion protocols extend the approach toward locating anomalous infrastructure — no list of bad towers, no magic "IMSI catcher detected" flag, just the deceptively difficult question of finding the impostor without knowing what an impostor looks like.	Are We Covered? Detection Coverage Beyond the ATT&CK Heat Map Charles Quansah Defenders commonly map detection rules to MITRE ATT&CK techniques to communicate coverage, but ATT&CK describes adversary behavior, not the underlying mechanisms needed to detect it. A heat map may show a technique as "covered" while hiding gaps like only 40% of domain controllers forwarding logs to the SIEM or process command-line logging being disabled—shortcomings that can prevent a detection from firing during a real incident. Through real-world examples, this talk shows why detection on paper doesn't always translate to detection in practice, and walks through the factors organizations should evaluate to build and communicate an accurate picture of coverage in answer to the million-dollar question: "Are We Covered?"
15:50 - 16:20	Your SOC Wasn't Built for This: Detecting Compromised AI Agents Before They Spread Sanjana Kale As AI agent frameworks spread through dev pipelines and internal tooling faster than SOCs can build detections, this talk examines agentic AI risk from the blue-team side—prompted by the August 2026 ChainDrop incident, in which a compromised agent framework self-propagated like a worm. It covers what telemetry exists today for agent behavior, what a hijacked agent looks like in your logs, and what you can realistically detect with the tools you already have. Attendees leave with a practical starting point: what to log, what to alert on, and what questions to ask their teams before agentic AI shows up as an incident.	RustFlux: A Framework for Rust-based Poly-Metamorphic Malware Generation using LLMs Sahilsinh Bharatsinh Chavda Attackers are now using LLMs to build AI-augmented malware like PromptFlux and VoidLink that generate distinct variants at runtime to evade heuristics. This talk explores using LLMs to meet the strict compilation demands of memory-safe Rust for polymorphic code. The authors demonstrate RustFlux, a framework that autonomously synthesizes hundreds of distinct, compilable Rust malware variants via a fixed pipeline feedback loop with models like DeepSeek-V3.2. By incorporating local compilation checks and automated error correction, RustFlux achieves a +146.50% increase in Halstead Volume and substantial forensic differences — including False ImpHash Matches — radically transforming a binary's structural "DNA" while preserving functional correctness.
16:30 - 17:15	Hunting Detection Resistent Things Using ML and AI Craig Chamberlain Recent studies show that security operations centers drown in false positive alerts—ranging from 75% to 99%—while red team activity goes undetected daily, prompting many AI vendors to promise a magical fix. This talk asks whether AI is truly the solution by tracing how we got here through the story of the PROTOSTAR project, which is not another AI SOC tool. Delivered interactively, the session has the audience work through a series of exercises—including the Hugging Face scenario—to experience the problem firsthand.	Exposure Management: From Heroics to Zero-Day Readiness Andrew Caron AI is compressing the time it takes to find and exploit vulnerabilities, but most organizations haven't compressed the time it takes to respond — and that delta is the exposure. This session defines what "machine speed" actually means (hint: not autonomous patching) and walks through a five-part operating model — understand, decide, act, verify, learn — grounded in a real 2026 attack campaign. You'll see where AI genuinely helps, where it measurably fails, and how to reduce the volume of work entering the system rather than just processing it faster.
Closing
17:30 - 18:00	Closing Remarks

Morning

08:00

Registration

09:00 - 10:00

Opening Remarks / Keynote

John V with Joseph Magly

10:15 - 11:00

When the Allocator Fights Back: Debugging Modern glibc Heap Exploits

Parshwa Bhojak

This talk covers what to do when your classic heap exploit dies silently on modern glibc: since 2.34, the allocator stopped calling __free_hook, so the standard "overwrite it with system" trick no longer works. Working through a use-after-free on glibc 2.39 live, the speaker builds a working exploit by defeating safe-linking, the tcache double-free key, and tcache's alignment check — with the real lessons coming from failures like a movaps alignment fault and silent one-quadword corruption from glibc's own checks. It closes with a source-verified matrix of which classic techniques still work across glibc 2.23–2.41, plus the working code and a one-page field reference.

11:15 - 11:45

A Crowd of Nobody: Building a Synthetic BLE Crowd on Off-the-Shelf ESP32s

John Costa

Counter-surveillance hardware is cheap enough that most people can detect IMSI catchers, AirTags, and plate readers, but detection alone doesn't stop data from being collected. Simulacra takes the opposite approach: a multi-node ESP32 setup that generates a churning crowd of fake BLE and Wi-Fi devices around you, appearing, lingering, and leaving like real ones, so that anything passively logging the area sees too many realistic devices to tell which is yours. The talk covers why device tracking still works despite phone privacy features, how the generator works, the unexpected ways early fake crowds gave themselves away, and what the project does and deliberately doesn't do.

Obfuscation for Scripting Languages

Ronnie Scarpa

Obfuscation transforms readable scripting code into a functionally equivalent but harder-to-analyze form, raising the cost of reverse engineering without offering absolute protection. Techniques range from renaming identifiers and inserting junk code to compiling scripts into bytecode run by a custom virtual machine, with Lua serving as a practical testbed due to its simple syntax and lightweight runtime. While obfuscation protects intellectual property and embedded logic, it trades off against runtime overhead, debugging complexity, and maintainability—so effective obfuscation balances resistance to analysis against performance and development needs.

Lunch

12:00 - 13:00

Lunch

Afternoon

13:15 - 13:45

Chasing Memory Corruption: Four Months of Hands-on Exploration

Kaoru "Mio" Fernandez

Over a four-month journey from April to July 2026, the speaker moved beyond reading about modern exploit mitigations—NX, ASLR, PIE, and stack canaries—by building small hands-on experiments to observe how each one actually behaves. Coming from a non-traditional background, they share how curiosity, experimentation, and asking questions made low-level memory corruption accessible, and demonstrate that simple experiments can demystify these defenses even for attendees without an advanced computer science background.

Stop Losing the Room: A Technical Speaker's Guide to Client Debriefs

Sabrina Henry

Every security professional knows the thrill of finding a critical vulnerability, but the client debrief is where findings often die — jargon-heavy data dumps leave executives confused, development teams defensive, and critical issues unpatched. This fast-paced session breaks down the human element of security reporting, using proven communication frameworks to bridge the gap between complex exploits and executive decision-making. You'll leave with the 3-Part Debrief Architecture for streamlined client calls, a Translation Formula that converts raw technical metrics into business language, and simple rapport and de-escalation strategies to lower client defenses and build trust in the first 60 seconds.

13:55 - 14:45

The Hitchhiker's Guide to Hunting DPRK Remote IT Workers

Jordan Saleh

Suspected North Korean remote IT workers are increasingly finding their way into legitimate technical roles, passing interviews, identity verification, and onboarding. Once onboarded, the strategy is surprisingly simple: do enough work to stay employed, keep a low profile, and avoid drawing attention all while not even physically owning their company devices. From there, investigations shift to how that employee works. Odd browser searches, activity on collaboration and code-sharing platforms, attempts to establish remote connectivity, inconsistencies in location or working patterns can all provide valuable behavioral signals. The value of these signals comes from the pattern they eventually form together. This talk will follow the lifecycle of a suspected DPRK-linked worker from recruitment and hiring, through laptop-farm setup, to day-to-day behavior. Each stage will highlight what defenders can observe and where security, IT, HR, and investigative teams can find useful evidence. We will then turn those observations into practical threat-hunting approaches focused on behavioral signals rather than waiting for one clear indicator to stand out.

From Zero Trust to Zero Custody: Six Things an AI Agent Must Not Hold

Srajan Gupta

Zero Trust taught us to verify every actor, but never asked whether that actor should be holding anything worth stealing. AI agents change the calculus: they don't need to be hacked, just misdirected — an attack that hijacks the behavior of a correctly identified principal, as seen in incidents like OpenAI's eval escape where live credentials were reused across individually authorized production hops. This talk proposes a simple principle — the reasoning loop should hold nothing that matters — and walks through six control planes outside the loop (credential, data, authority, decision, environment, and tools) as a practical methodology you can apply without buying a product, covering the architecture, its advantages, and its trade-offs.

14:55 - 15:40

(Perfect) Cell Games: Ah No, Not the Beedrills! - Hunting Rogue Cellular Infrastructure Without Knowing What You're Looking For

Mike Curnow

Most rogue cell tower defenses rely on recognizing known attack patterns — an assumption that breaks when the adversary stops doing things we recognize. This talk tears into existing detection techniques to show where an adaptive adversary can slip between the rules, then introduces RIFT (Rigidity Inference From Trajectories), which learns the structural behavior of legitimate networks across movement, space, and time and hunts for violations of that structure. Using real-world cellular observations, the speaker explores how these relationships emerge and how RIFT's companion protocols extend the approach toward locating anomalous infrastructure — no list of bad towers, no magic "IMSI catcher detected" flag, just the deceptively difficult question of finding the impostor without knowing what an impostor looks like.

Are We Covered? Detection Coverage Beyond the ATT&CK Heat Map

Charles Quansah

Defenders commonly map detection rules to MITRE ATT&CK techniques to communicate coverage, but ATT&CK describes adversary behavior, not the underlying mechanisms needed to detect it. A heat map may show a technique as "covered" while hiding gaps like only 40% of domain controllers forwarding logs to the SIEM or process command-line logging being disabled—shortcomings that can prevent a detection from firing during a real incident. Through real-world examples, this talk shows why detection on paper doesn't always translate to detection in practice, and walks through the factors organizations should evaluate to build and communicate an accurate picture of coverage in answer to the million-dollar question: "Are We Covered?"

15:50 - 16:20

Your SOC Wasn't Built for This: Detecting Compromised AI Agents Before They Spread

Sanjana Kale

As AI agent frameworks spread through dev pipelines and internal tooling faster than SOCs can build detections, this talk examines agentic AI risk from the blue-team side—prompted by the August 2026 ChainDrop incident, in which a compromised agent framework self-propagated like a worm. It covers what telemetry exists today for agent behavior, what a hijacked agent looks like in your logs, and what you can realistically detect with the tools you already have. Attendees leave with a practical starting point: what to log, what to alert on, and what questions to ask their teams before agentic AI shows up as an incident.

RustFlux: A Framework for Rust-based Poly-Metamorphic Malware Generation using LLMs

Sahilsinh Bharatsinh Chavda

Attackers are now using LLMs to build AI-augmented malware like PromptFlux and VoidLink that generate distinct variants at runtime to evade heuristics. This talk explores using LLMs to meet the strict compilation demands of memory-safe Rust for polymorphic code. The authors demonstrate RustFlux, a framework that autonomously synthesizes hundreds of distinct, compilable Rust malware variants via a fixed pipeline feedback loop with models like DeepSeek-V3.2. By incorporating local compilation checks and automated error correction, RustFlux achieves a +146.50% increase in Halstead Volume and substantial forensic differences — including False ImpHash Matches — radically transforming a binary's structural "DNA" while preserving functional correctness.

16:30 - 17:15

Hunting Detection Resistent Things Using ML and AI

Craig Chamberlain

Recent studies show that security operations centers drown in false positive alerts—ranging from 75% to 99%—while red team activity goes undetected daily, prompting many AI vendors to promise a magical fix. This talk asks whether AI is truly the solution by tracing how we got here through the story of the PROTOSTAR project, which is not another AI SOC tool. Delivered interactively, the session has the audience work through a series of exercises—including the Hugging Face scenario—to experience the problem firsthand.

Exposure Management: From Heroics to Zero-Day Readiness

Andrew Caron

AI is compressing the time it takes to find and exploit vulnerabilities, but most organizations haven't compressed the time it takes to respond — and that delta is the exposure. This session defines what "machine speed" actually means (hint: not autonomous patching) and walks through a five-part operating model — understand, decide, act, verify, learn — grounded in a real 2026 attack campaign. You'll see where AI genuinely helps, where it measurably fails, and how to reduce the volume of work entering the system rather than just processing it faster.

Closing

17:30 - 18:00

Closing Remarks