DEF CON 34

Identity is the new perimeter, and biometrics are its supposed gatekeepers. But what happens when the gatekeepers are blind to the reality they consume? We spent more than 6 months deconstructing the biometric "Root of Trust" across every top-tier framework we could find, solutions relied upon by the world's largest banks and providers worth billions. The result: A 100% bypass rate. From high-fidelity physical spoofs to a first-of-its-kind Cross-PID buffer hijack against integrated anti-tamper SDKs, we prove that even multi-million dollar "fortresses" can be reduced to client-side theater.

This talk is a technical journey through the guts of the mobile media pipeline, exposing how synthetic identities are manufactured at scale to bypass RASP, Kernel-level integrity, and AI models. When the "Master Key" is just another line of code an attacker can hook, the risk isn't just a bug, it's a systemic failure affecting millions of users. Customers are losing wealth, companies are buying illusions, and the glass perimeter is shattering.

ResearchersDan Borgogno AR·Javier Bernardo AR

You don't realize it until you see them; they're everywhere. From Wireless ISP links to the frontline of modern warfare. But nobody found anything? The devices behind those links are Ubiquiti AirMAX: critical infrastructure on a 17-year-old Linux kernel and a custom 802.11 extension built on "security by obscurity." So we took it apart. This talk covers our reverse engineering of the AirMAX protocol, AirOS, and the kernel modules behind this proprietary mode. It rides on 802.11 Information Elements that look encrypted, but we'll show why they aren't. What we found: two critical vulnerabilities (CVE-2026-21639, CVE-2026-21638) across airMAX AC, airMAX M, airFiber, and GigaBeam, over 50 devices. These are the bugs from the movies: Over-The-Air, unauthenticated, kernel-privilege RCE. No network access, just line of sight. They affect every AirMAX device ever shipped. We disclosed them through Ubiquiti's bug bounty program. The bugs were rated "Adjacent", except adjacent here means kilometers away. The same hardware can be turned around and pointed at the problem: we'll repurpose these devices as recon tools and release open-source software to locate AirMAX networks in the wild. This talk is about our journey, our tooling, and the state of security.

ResearchersFederico Kirschbaum AR·Gaston Aznarez AR

This talk examines the attack surface created by modern satellite communications as the industry moves toward commercial off-the-shelf hardware and standardized protocols such as CCSDS and Space Packet Protocol. It moves beyond simple RF command injection into a broader exploitation methodology for space links, ground stations, and satellite subsystems.

The session demonstrates protocol fuzzing, GNS spoofing, command exploitation over LoRa and FSK, lateral movement from a compromised RF link to an internal CAN bus, and ground-segment pivoting against mission operations infrastructure. The work uses PWNSAT and PWNCUBE as an open-source satellite exploitation ecosystem for simulating an end-to-end mission under attack.

ResearchersRomel Marin CR