Overview
BSides PDX is a gathering of information security minds in Portland and the Pacific Northwest. It is a tax-exempt charitable 501(c)(3) organization focused on cultivating the local information security and hacking community through inclusive learning, networking, collaboration, and teaching opportunities.
Speakers
2Schedule
Registration opens (all-day, room 101, first floor)
Registration opens (all-day)
Opening remarks
Translating Cybersecurity Expertise into Community Practice: Lessons from Minneapolis Mutual Aid Work Jessa Riley Gegax Off the record — do not record
BSidesPDX... How did we get here? Esteban, Joe, etc.
Translating Cybersecurity Expertise into Community Practice: Lessons from Minneapolis Mutual Aid Work
Cybersecurity is often framed as a discipline focused on protecting corporations, governments, and critical infrastructure. For many professionals in the industry, the work stops there. Yet these same skills used to defend enterprise systems can also be leveraged to support vulnerable communities, grassroots organizers, and mutual aid networks. This reframes cybersecurity knowledge as something that is not solely confined to corporate settings, but instead applicable to broader and more impactfu
Bring Your Own Trusted Caller (BYOTC): A New Way to Exploit Vulnerable Windows Drivers Xusheng Li
InQuorigible: Quora in OSINT Groucho Marxist
Bring Your Own Trusted Caller (BYOTC): A New Way to Exploit Vulnerable Windows Drivers
LLMs vs. Crypto: The Crypto Arms Race in Modern Ransomware
Missing: Live-Playing an ARG-Style CTF
One Request to Rule Them All
You wouldn't hack a satellite: Breaking the Cubesat Space Protocol Riccardo Nannini
How to catch your agent in a lie Chase Douglas
How to catch your agent in a lie
Trust the Output, Board the Ship: Why AI Security Workflows Fail in Production
Uncovering an Android dropper campaign Fernando Ruiz
Reverse Engineering A Camera/Lens Control Aleks Nikolic
Uncovering an Android dropper campaign
Second Set of Eyes: AI-Accelerated Security Analysis Without Giving Up the Wheel
Delete Your Data in the Age of AI Nick Shook
Post-Quantum Privacy with EFF and Let's Encrypt Jacob Hoffman-Andrews
Delete Your Data in the Age of AI
VibeCheck: Failed
Eyes Only: Build a Gate Detector for an Autonomous Drone
Malicious weights in LLMs Vladimir de Turckheim
No Model Was Harmed in the Making of This Exploit Harsh Akshit
Malicious weights in LLMs
Phishing With Misfortune Cookies - Onsite Social Engineering And Exploiting Assumed Trust
Privacy Challenges in Parenting manchicken
Your Sandbox Has an Identity Crisis: When Network Reachability Becomes Cloud Identity Rohit Gurunath
Privacy Challenges in Parenting
Catch Me If You Can: Stealing OAuth Tokens with an Interception Attack
Turning The Valve: Diving Into the Steam Platform Bryan Alexander
Good Boy: Turning Datadog into a C2 Channel Mike Kuenzel
Turning The Valve: Diving Into the Steam Platform
Why You (Still) Need SBOMs
BGP: A Gateway to Insecure Insanity: Why the internet works and when it doesn't. Nate Balmain
From Edge Telemetry to Automated Defense: Mining WAF Logs with Python Ash Naiku
BGP: A Gateway to Insecure Insanity: Why the internet works and when it doesn't.
ForesightOps - Automate Remediation before vulnerability reaches code: Not another security scanner
Theory and Practice of Intercepting Voice Radio Transmissions
Play our new card game to get better at defense
Retro Floppy Archive Project 0verShares
Telemetry to Detection: A Practitioner’s Guide to detection.wiki Sonny Yeung
Retro Floppy Archive Project
Put Community Lists in your Kill Chain
Das Blinken hpux735
Das Blinken
Detecting Inlined Functions in Compiled Binaries Using a Graph Neural Network
Death by a Thousand Paper Cuts Ken Hollis
Death by a Thousand Paper Cuts
How We Let an AI Agent Into Our Security Review Process (And What did we learn)
Closing remarks
Friday Reception Movie: The Conversation (1974)
Friday Reception Movie: The Conversation (1974) Drinks and Snacks
BSidesPDX... How did we get here?
This is the 15th BSidesPDX, so we’ll take a walk back into the history behind the conference Esteban, along with other members of the founding crew will start off with a bit about why the conference came to be, and what their original vision was - and how it turned out. Then we’ll hear from several other past organizers about how the event grew and evolved over the years. Finally, we’ll wrap up with this panel-of-panels with the current organizing crew to share what went in to making this year’s
InQuorigible: Quora in OSINT
Is North Korea in Your node_modules?
You wouldn't hack a satellite: Breaking the Cubesat Space Protocol
CSP (Cubesat Space Protocol) is the main open-source networking protocol for Cubesats: Rubik’s cube-looking miniature satellites gaining popularity due to their reduced cost and development time. This talk presents a vulnerability research deep dive into libcsp, the most popular implementation of the protocol. It uncovers a wide variety of vulnerabilities ranging from a Mitnick attack-like TCP connection forgery, insecure primitives and memory corruption. The talk will also cover the vulnerabili
PipeLive: Using LLMs as Duct Tape to Craft a Self-Healing Pipeline
Reverse Engineering A Camera/Lens Control
What I would do if I had to start my offensive cybersecurity journey today
The Prince and the Prompt: Automating Chaos for Email Scammers
Post-Quantum Privacy with EFF and Let's Encrypt
I Have No Mouth and I Must Slop: Human Security Engineering For Bot-Authored Codebases
We run a community hackerspace, AMA
No Model Was Harmed in the Making of This Exploit
In March 2026, people discovered Chipotle’s customer-support chatbot would happily solve LeetCode problems and write Python between burrito orders. Within days someone had tur