Tales from the Decrypt: Wacky Intrusion Stories Unearthed at a DFIR Shop

Incident response teams often handle unconventional breaches that bypass standard controls. This Halloween, we will examine several spooky, sanitized intrusions our team has investigated, mixing in both public and unreleased cases. We will walk through specific attacks, ranging from multi-stage vishing to SSRF tampering to LLM denial-of-wallet attacks. We will analyze a mix of old and new tradecraft to discuss our response methods, what went wrong for the victim, and which detection opportunities were missed. Attendees will leave with some holiday entertainment, but also hopefully actionable notes their organizations can implement to prevent similar compromises in the future.

Michael Bailey works in North Boulder remotely as a Sr. Staff Software Engineer at Unit 42 by Palo Alto Networks.
Michael got an early start in cybersecurity, joining a defense subcontractor at age 17. After graduating he transitioned to The Crypsis Group as their sixth hire, which eventually was acquired as Unit 42 Security Consulting. At the time, he also helped support DVWA. His hands-on Cloud DFIR case experience has supporting and occasionally tech leading specialized, client-facing investigations. This experience combined with Crypsis's growth led him to platformization and automation of components of these investigations, with particular automation wins in Office 365 Business Email Compromise, AWS breaches, and Case Intel Management. This included co-leading the forensic capabilities project that Crypsis had that inspired components of Cortex Forensics.

Special thanks to the Rule4 Team for hosting!

AGENDA
6:00 - 6:30 Food, Drinks, Networking
6:30 - 7:30ish Spooky Security Stories
7:30 - 8:00 More Networking

You can also get announcements from:
LinkedIn: https://www.linkedin.com/company/owasp-boulder