AtlasLatino — research feed, page 3

• August 7, 2026 Talk Offensive Security La Villa Hacker — DEF CON 2026 Arnold Morales MX Jackpoting? Bypass de EDR? - Hacking ATM

  En muchas ocasiones cómo pentesters nos aferramos a la idea de buscar multiples técnicas de ataque de manera "virtual", buscando software especializado o creando scripts que nos ayuden a identificar una vulnerabilidad para acceder a un programa o dispositivo en el que nos enfoquemos, pasamos tanto tiempo enfrente de nuestra pantalla, lanzando comandos a lo bastardo hasta ver que podemos encontrar que a veces ignoramos que existen soluciones alternativas y no simplemente de manera virtual, sino de una manera en que podemos tocar, armar y desarmar (esto suele ser menos buscado por pentester, entonces tambien hay menos documentacion).

  El proceso de arranque de Windows, conocido como boot process, se divide en varias fases como ya lo vimos: PreBoot (inicialización del firmware BIOS/UEFI y POST), Boot Manager (carga de bootmgr o bootmgfw.efi), OS Loader (ejecución de winload.exe para cargar el kernel) y Kernel Initialization (carga de ntoskrnl.exe y hal.dll, inicialización de controladores y servicios). Finalmente, se inicia winlogon.exe para presentar la interfaz de usuario. Este proceso permite pasar de un estado apagado a un sistema operativo funcional mediante una secuencia jerárquica y verificada.

  Respecto a los EDR (Endpoint Detection and Response) basados en el kernel, operan en modo kernel, el nivel más privilegiado del sistema (algunos juegan en UEFI), lo que les permite supervisar actividades de bajo nivel como llamadas al sistema, manipulación de memoria, carga de controladores y acceso a archivos. Al ejecutarse en este modo, los EDR pueden detectar y bloquear amenazas avanzadas como rootkits o malware persistente que intentan eludir las protecciones del modo usuario. Su integración profunda con el kernel les permite realizar monitoreo en tiempo real, análisis de comportamiento y respuesta inmediata ante actividades sospechosas durante y después del arranque.

  Normalmente los EDRs se encuentran en KERNEL pero como lo mencione, existen otros que se encuentran en UEFI y si recordamos como funciona windows atrás de UEFI esta SMM entonces es algo un poco mas dicil.

  Esta charla es pensada para personas interesadas no solo en ATMs y una simple dispensación si no la vista mas alla, el análisis y toda la experiencia adquirida cuando te enfrentas a ellos.

  ResearchersArnold Morales MX

  Presented at La Villa Hacker — DEF CON 2026

  View official session
• August 7, 2026 Workshop AppSec & Supply Chain Red Team Village — DEF CON 2026 Natan Morette BR Quality over Quantity: How to Publish CVEs that Actually Matter

  This hands-on tactic focuses on making CVE discovery and publication practical, accessible, and repeatable. Instead of treating vulnerability research as an individual or highly specialized skill, this session introduces a structured workflow that attendees can immediately apply.

  Attendees will follow a step-by-step approach to:

  • Explore a scoped attack surface
  • Apply a curated vulnerability pattern checklist
  • Identify and validate a potential vulnerability
  • Structure the finding in a simplified CVE-style format

  All materials are prepared in advance to ensure the activity can be completed within 30–60 minutes and repeated across multiple waves of participants.

  This tactic emphasizes doing over theory, helping attendees leave not just with knowledge, but with a clear, reusable method for identifying and documenting vulnerabilities and a better understanding of how CVE publishing can be integrated into team workflows.

  ResearchersNatan Morette BR

  Presented at Red Team Village — DEF CON 2026

  View official session
• August 7, 2026 Workshop Offensive Security La Villa Hacker — DEF CON 2026 Juan Camilo Palacio CO·Andrés Restrepo CO De la nube a la corona: Uso indebido de la identidad híbrida en Azure DevOps Azure, AD, AWS y EKS

  Demostrar cómo las relaciones de confianza entre entornos híbridos de Azure DevOps, Microsoft Azure, Active Directory, Amazon Web Services y Kubernetes pueden ser abusadas por un atacante para realizar movimientos laterales, escalamiento de privilegios y compromiso de identidades utilizando herramientas y funcionalidades legítimas de administración cloud en infraestructuras hibridas corporativas.

  ResearchersJuan Camilo Palacio CO·Andrés Restrepo CO

  Presented at La Villa Hacker — DEF CON 2026

  Speaker page (Juan Camilo Palacio) Speaker page (Andrés Restrepo)
• August 7, 2026 Talk Offensive Security Cloud Village — DEF CON 2026 Elzer Pineda PA·Jose Manuel Rivas PA Tokens and PRT: Advanced Attacks and Persistence in Microsoft Entra ID

  Is MFA and Conditional Access a real security guarantee? In this technical session, we will demonstrate how endpoint compromise allows an attacker to bypass traditional identity barriers in the cloud. The talk focuses on exploiting vulnerabilities in Microsoft Entra ID, breaking down an advanced attack chain:

  • Device Code Flow: Abuse of authentication flows for initial access (Demo with Entraith).
  • PowerShell Hijacking: Process interception to obtain session tokens (GrabTokenAzureAD).
  • Sliver BOF Extraction: Use of Beacon Object Files (BOF) for stealthy exfiltration of tokens and the Primary Refresh Token (PRT) from memory, evading anti-malware defenses.
  • MFA Bypass and Intune: Custom tools were developed to extract local PRTs, bypass Intune device management controls, and circumvent MFA. The entire process was automated through the open-source tool https://github.com/bl4cksku11/entraith, enabling attacks via device code flow, token renewal, email and app inspection, token exfiltration, and persistence generation.

  ResearchersElzer Pineda PA·Jose Manuel Rivas PA

  Presented at Cloud Village — DEF CON 2026

  View official session
• August 7, 2026 Talk Offensive Security La Villa Hacker — DEF CON 2026 Elzer Pineda PA·Jose Manuel Rivas PA Tokens and PRT: Advanced Attacks and Persistence in Microsoft Entra ID

  ¿Son el MFA y el Acceso Condicional una garantía de seguridad real? En esta sesión técnica, demostraremos cómo el compromiso de un endpoint permite a un atacante saltarse las barreras de identidad tradicionales en la nube. La charla se centra en la explotación de vulnerabilidades en Microsoft Entra ID, desglosando una cadena de ataque avanzada:

  • Abuso de Device Code Flow: Explotación de flujos de autenticación para acceso inicial (Demo con Entraith).
  • PowerShell Hijacking: Intercepción de procesos para la obtención de tokens de sesión (GrabTokenAzureAD).
  • Extracción con Sliver BOF: Uso de Beacon Object Files para la exfiltración sigilosa de tokens y del Primary Refresh Token (PRT) directamente desde la memoria, evadiendo defensas anti-malware.
  • Bypass de MFA e Intune: Hemos desarrollado herramientas personalizadas para extraer PRTs locales, eludir los controles de gestión de dispositivos de Intune y saltarse la aplicación de MFA a nivel de token.

  Todo este ciclo de vida de ataque ha sido consolidado en Entraith, un framework ofensivo desarrollado desde cero por nuestro equipo de investigación que será lanzado públicamente en DEF CON 34.

  ResearchersElzer Pineda PA·Jose Manuel Rivas PA

  Presented at La Villa Hacker — DEF CON 2026

  Speaker page (Elzer Pineda) Speaker page (Jose Manuel Rivas)
• August 7, 2026 Arsenal AppSec & Supply Chain AppSec Village — DEF CON 2026 Filipi Pires BR Drogonsec: SAST + SCA + Secrets + IaC in one open-source scanner

  Drogonsec is an open-source, high-performance security scanner built for developers and CI/CD pipelines. In a single run, it combines four analysis engines: SAST for 20+ languages, SCA for dependency CVEs, secret detection with 50+ patterns (AWS, GCP, GitHub, JWTs, SSH keys), and IaC misconfiguration analysis for Terraform and Kubernetes, all mapped to OWASP Top 10:2025 and CWE, with CVSS 3.1 scoring and SARIF output for GitHub and Azure DevOps integration.

  This Arsenal session will demo Drogonsec scanning real-world repositories live, showing findings across all four engines, explaining rule design decisions, and showcasing how teams can extend it with custom YAML rules. Attendees leave with a running tool they can drop into their pipelines the same day.

  ResearchersFilipi Pires BR

  Presented at AppSec Village — DEF CON 2026

  View official session
• August 7, 2026 Talk AppSec & Supply Chain La Villa Hacker — DEF CON 2026 Santiago Sepúlveda Veliz CL State Desync as a Weapon: Breaking Transactional Integrity in Payment Systems (ESP)

  El Price Tampering no es un simple cambio de parámetro ni un bug, es una falla de arquitectura que permite alterar el valor de una transacción sin romper ningún control tradicional en cualquier sistema que procese pagos, provocando fraude en diferentes industrias y negocios. En esta charla abordaré cómo un atacante modela el flujo de compra y pago completo, identifica puntos de desincronización entre cliente, backend y pasarela, y explota la ausencia de invariantes de negocio server-side para manipular el valor final de una transacción sin necesidad de CVEs, exploits ni malware. Basado en una investigación propia con casos reales autorizados y anonimizados en entornos de banca, retail y fintech en LATAM, presentaré una taxonomía de tres patrones de ataque recurrentes y un modelo defensivo concreto llamado FinSecure, sustentado en el principio del backend soberano, donde el precio nunca puede nacer fuera del servidor. La audiencia se irá con una visión diferente del problema y herramientas accionables para detectarlo y eliminarlo por diseño.

  ResearchersSantiago Sepúlveda Veliz CL

  Presented at La Villa Hacker — DEF CON 2026

  View official session
• August 6, 2026 Talk Malware & Reversing Black Hat USA 2026 Gaston Aznarez AR·Federico Kirschbaum AR·Dan Borgogno AR Root From Kilometers Away: Ubiquiti AirMax RCE

  You don't realize it until you see them; they are everywhere. From Wireless ISPs links, to the frontline of modern warfare. But no one found anything?

  Long-haul WiFi Links, specifically Ubiquiti AirMax. These devices are a critical part of networks running a 17 year old Linux kernel and a custom 802.11 extension that relies on the well-known "security by obscurity".

  This Briefing is about the reverse engineering of Ubiquiti's Airmax protocol, its AirOS, and its kernel modules in charge of this proprietary wireless mode. This is implemented on top of IEEE 802.11 Information Elements that look encrypted, but we will shed light and show you why they aren't.

  We found these devices were insecure, and we have evidence. Two critical vulnerabilities (CVE-2026-21639 and CVE-2026-21638) that affect seven device families, including airMAX AC, airMAX M, airFiber and GigaBeam platforms (over 50 currently-sold devices). These vulnerabilities are like the ones in movies, Over-The-Air unauthenticated remote code execution with kernel privileges, no network access, just line of sight. The bugs found affect all Airmax devices since inception.

  Vulnerabilities found by this research were responsibly reported through the official bug bounty program. They were rated in a lower tier, as "Adjacent", but this bug can be exploited kilometers away.

  Nonetheless, we will show how to use the same devices as recon tools and provide another open-source software to analyze and locate networks using this protocol.

  This Briefing is not only for showing vulnerabilities, but we also want you to know the state of security in these devices. We want to share our journey and share the tooling and discoveries we made along the way.

  Takeaway

  • Reconnaissance and network mapping: They will learn how to identify, enumerate, and map networks composed of these devices.
  • Remote exploitation of WISP infrastructure: Attendees will learn how we can exploit 2 new vulnerabilities at range against deployed wireless devices.
  • A roadmap for future research: We highlight device families we believe are still vulnerable and largely unexplored, giving attendees clear starting points to keep digging.

  ResearchersGaston Aznarez AR·Federico Kirschbaum AR·Dan Borgogno AR

  Presented at Black Hat USA 2026

  View official session
• August 5, 2026 Talk Offensive Security BSides Las Vegas 2026 Ignacio Navarro AR Every ride you take - Hacking a City's Public Transportation

  Let's talk about some critical infrastructure that millions of people use every day: Public transportation. In this talk, I'll present some findings that I discovered in the public transportation ecosystem of one of the largest cities in Argentina, impacting more than 1.5 million people daily. Reading code, chaining vulnerabilities, weak access controls, and flawed internal designs, I got full access to core mobility systems, from buses to taxis, including DVRs, transport cards, user data, real-time tracking and administrative panels. We'll walk through the technical exploitation path, the real-world impact and the lessons learned.

  ResearchersIgnacio Navarro AR

  Presented at BSides Las Vegas 2026

  View official session
• August 4, 2026 Talk Malware & Reversing BSides Las Vegas 2026 Rafael Felix BR·João Pedro Tricta BR Lyra: An LLVM IR Obfuscator for Rust

  Rust is rapidly becoming the language of choice for red team tooling, implants, and security-critical software. Yet the offensive security ecosystem has almost no obfuscation tooling for it. Nearly every production obfuscator targets C/C++ binaries or operates on final PE/ELF images; Rust's unique compile pipeline, name mangling, and LLVM IR patterns require a fundamentally different approach.

  This talk presents Lyra, an open-source, cargo-native LLVM IR obfuscator for Rust. Lyra intercepts each crate during a normal "cargo build" via RUSTC_WRAPPER, transforms the LLVM IR with a configurable pass pipeline, string encryption, basic-block shuffling, indirect-branch obfuscation, recompiles the result with llc + clang, and substitutes the object before the real MSVC linker runs. Zero changes to the Rust compiler, zero changes to the target project's source code, one flag on the command line.

  We walk through the architecture, the engineering challenges unique to Windows/MSVC (UTF-16 response files, allocator-shim object preservation, inkwell's undocumented panic guards), and live before-and-after demonstrations in IDA Pro, Ghidra, and Binary Ninja. We also show a YARA rule that confidently matches a plain demo build returning zero results on the obfuscated binary, and two consecutive unseeded builds producing different hex patterns, defeating a rule written on the first build.

  Lyra is released open-source at the time of the talk. All demos are reproducible from the release. Attendees leave with a working tool they can run against their own Rust projects the same day.

  ResearchersRafael Felix BR·João Pedro Tricta BR

  Presented at BSides Las Vegas 2026

  View official session
• August 4, 2026 Talk Offensive Security BSides Las Vegas 2026 Ignacio Navarro AR Every ride you take - Hacking a City's Public Transportation (PART 2) - TOKEN: 13

  Let's talk about some critical infrastructure that millions of people use every day: Public transportation. In this talk, I'll present some findings that I discovered in the public transportation ecosystem of one of the largest cities in Argentina, impacting more than 1.5 million people daily. Reading code, chaining vulnerabilities, weak access controls, and flawed internal designs, I got full access to core mobility systems, from buses to taxis, including DVRs, transport cards, user data, real-time tracking and administrative panels. We'll walk through the technical exploitation path, the real-world impact and the lessons learned.

  ResearchersIgnacio Navarro AR

  Presented at BSides Las Vegas 2026

  View official session
• August 4, 2026 Talk Malware & Reversing BSides Las Vegas 2026 Diego Tellaroli BR Finding vulnerabilities in windows kernel drivers & performing BYOVD attacks

  In this talk, we will cover reverse engineering Windows kernel-mode drivers, identifying vulnerabilities, and performing BYOVD (Bring Your Own Vulnerable Driver) attacks. We will learn techniques to exploit driver vulnerabilities in order to bypass EDRs or gain kernel-level permissions. Additionally, we will review BYOVD attacks carried out by real APTs and how they disable EDRs and antivirus software using kernel-mode techniques.

  ResearchersDiego Tellaroli BR

  Presented at BSides Las Vegas 2026

  View official session
• August 3, 2026 Workshop Incident Response BSides Las Vegas 2026 Rodrigo Montoro BR AWS Principal Threat Hunting: Behavioral Baselining for Malicious Activity

  Cloud security encounters attacks that elude standard detection. In AWS, unauthorized access keys are a common cause of breaches. The vastness of AWS, over 450 services and 19,000 API actions, complicates threat visibility and exposes gaps in traditional tools. This workshop empowers participants with direct, hands-on experience using the AWS Threat Hunter tool to improve threat detection.

  Attendees will focus on building behavioral baselines and leveraging data-driven analysis to detect subtle AWS principal anomalies, enabling more precise detection than traditional event monitoring. Attendees will move beyond standard techniques by building multi-stage detection pipelines that create individualized baselines for each IAM principal and systematically flag personalized deviations, linking outliers directly to risks.

  ResearchersRodrigo Montoro BR

  Presented at BSides Las Vegas 2026

  View official session
• August 3, 2026 Training Incident Response Black Hat USA 2026 Mariano E Quintana AR·Felipe Barbosa Alves BR Adversary Tradecraft Decoded: CTI from Zero to Hero

  Adversary Tradecraft Decoded: CTI from Zero to Hero is an immersive training program designed to bridge the gap between foundational cybersecurity knowledge and the practical, operational use of Cyber Threat Intelligence (CTI). This course provides a structured path for participants to transform raw adversary tradecraft into actionable intelligence products that support detection, response, and strategic defense.

  Starting from first principles, attendees will explore the intelligence lifecycle, types of CTI, and the role of cognitive biases in analysis. The course then advances into the practical decoding of adversary Tactics, Techniques, and Procedures (TTPs), mapping them against frameworks such as MITRE ATT&CK to create consistent and reliable intelligence outputs. Participants will learn to apply open standards (STIX, TAXII, OpenIOC), enrichment methods, and structured analytic techniques to normalize and contextualize threat data.

  The centerpiece of the training is a cloud-based lab environment that recreates realistic attack scenarios in a safe and controlled setting. Participants will investigate a simulated phishing and privilege escalation incident, reconstruct the cyber kill chain using the Diamond Model, extract indicators, and identify adversary behaviors. Through guided exercises, they will practice building competing hypotheses (ACH), mitigate the influence of analytical bias, and ultimately produce both technical and executive-level CTI reports.

  What makes this program unique is its dynamic and in-depth approach to understanding how intelligence is truly built, not just as a theoretical exercise, but as the foundation for making future decisions about whether and how to share it. Learners are pushed to challenge their own hypotheses and identify the biases inherent in the analytic process. While they work through a known case, the procedures and steps they follow can be directly applied to generating new, useful intelligence beyond the classroom.

  This hands-on, end-to-end process ensures that learners not only grasp the theory of CTI but also experience how to operationalize it in passive defense and threat hunting contexts. By simulating the work of real-world analysts, participants will leave with the ability to generate intelligence products that directly support security operations, reduce uncertainty in incident response, and inform decision-making at tactical, operational, and strategic levels.

  ResearchersMariano E Quintana AR·Felipe Barbosa Alves BR

  Presented at Black Hat USA 2026

  View official session
• August 3, 2026 Talk AppSec & Supply Chain BSides Las Vegas 2026 Aldo Salas MX Came for the AppSec scans, stayed for the flaky tests

  I'm an AppSec lead. My job was rolling out security scans in CI. Once the scans shipped, I stayed and fixed the parts of the pipeline nobody else would touch. Six months, solo, on top of the day job. Four AI-driven bots later, this talk focuses on two of them.

  The one that worked best: a CVE-fixing bot that's kept us at 0 CVEs for three months and counting. The one that miserably failed: a flaky DB test bot that couldn't see flakiness. To a one-shot AI review, a test that sometimes passes and sometimes fails just looks broken. The DB suite went from 42.3% peak failure rate to near zero, not by automating harder but by ditching the bot and pairing with Claude on each failure by hand.

  The fixes were technical (race conditions and cache, mostly) but the reason they didn't get fixed wasn't. People click "Run again" several times a day instead of looking at why. Nobody fixes it until somebody who isn't supposed to does. Walk out and measure your team's rerun rate (I'll share the script). Then go fix the smallest thing nobody else will.

  ResearchersAldo Salas MX

  Presented at BSides Las Vegas 2026

  View official session
• August 3, 2026 Talk AppSec & Supply Chain BSides Las Vegas 2026 Paulo Sarrin MX One Package, One Backdoor: Can AI Stop the Next Supply Chain Attack Before It Reaches You?

  Open source packages are the foundation of modern software development. They save time, reduce cost, and accelerate delivery. But every package you install is also a potential entry point for an attacker. This session takes a hands-on approach to understanding software supply chain attacks from both sides of the attack.

  On the offensive side, attendees will see how attackers introduce malicious code into a new package release without raising immediate suspicion. We cover how a malicious package establishes a command and control channel during installation, how it reads and exfiltrates environment variables including API keys, cloud credentials, and database connection strings, and how typosquatting tricks developers into installing the wrong package. We use real documented cases across npm, PyPI, and Maven to ground every concept in reality.

  On the defensive side, we explore how AI is changing the speed and accuracy of supply chain threat detection. We walk through the architecture of tools like the Elastic Supply Chain Monitor, which watches package registries in real time, generates diffs between old and new releases, and sends those diffs to a large language model for classification. The LLM looks for obfuscated code, unexpected network connections, process spawning, and credential access patterns. When it finds them, it alerts the security team before any developer installs the package.

  We also cover the hardening techniques that reduce your attack surface before an incident happens: using lockfiles to pin exact dependency versions, avoiding exposure of dependency files on public websites, using private artifact repositories to control what enters your environment, and integrating automated dependency scanning into your CI/CD pipeline. Attendees will leave with a clear mental model of the threat, a reference architecture for AI-assisted detection, and a practical checklist they can bring back to their team on Monday.

  ResearchersPaulo Sarrin MX

  Presented at BSides Las Vegas 2026

  View official session
• August 3, 2026 Training Malware & Reversing Black Hat USA 2026 Verónica Valeros AR·Sebastián García AR Advanced Malware Traffic Analysis

  This intensive two-day training teaches you how to understand, detect, and investigate modern malware attacks through hands-on network traffic analysis. Instead of relying on tools or dashboards, you will learn to recognize malicious behavior by developing analytical skills, technical intuition, and a solid methodology drawn from real incidents.

  Across nine modules, you will analyze real-world captures, build timelines, and learn to separate normal from malicious activity. You will investigate ransomware behavior, botnet communications, DGAs, encrypted traffic, and custom protocols. You will also generate and analyze network logs and use machine learning.

  The training combines short theory blocks with guided labs, peer discussions, and exercises distilled from decades of experience in traffic analysis. By the end, you will have the confidence and methodology required to analyse traffic and make informed decisions during real incidents.

  ResearchersVerónica Valeros AR·Sebastián García AR

  Presented at Black Hat USA 2026

  View official session
• June 22, 2026 Training AI Security TROOPERS26 Salvador Mendoza MX Automating Cybersecurity Operations with Models, Agents, and Orchestrators

  This training introduces cybersecurity automation using AI models, agents, orchestration, and MCP (Model Context Protocol). It focuses on building flexible security workflows where models help analyze alerts, logs, and security data; agents decide what actions to take; and orchestrators connect tools, data, and people into reliable processes.

  The course emphasizes practical design patterns and hands-on examples, including low-code workflow engines and human approval steps. By the end, participants are expected to be able to design scalable automations that reduce repetitive work, improve response time, and integrate AI into security operations while keeping human oversight in place.

  ResearchersSalvador Mendoza MX

  Presented at TROOPERS26

  View official training
• May 22, 2026 Talk Malware & Reversing Ekoparty Miami 2026 Asher Davila MX Lost in Disassembly: Building an LLM-Powered Toolkit for Reverse Engineering

  This session describes a practical reverse engineering workflow developed while analyzing different types of binaries. The talk focuses on combining manual reverse engineering with AI-assisted tools inside an existing workflow. These tools are used to support tasks such as function labeling, identifying runtime structures, and building an initial understanding of binary capabilities, allowing the analyst to spend more time on deeper analysis and validation.The methodology presented is based on hands-on analysis of active threats collected from Palo Alto Networks firewalls and WildFire. The samples include Go-based IoT botnets, OT-centric malware, and Android malware targeting TVs. Our analysis was performed using disassemblers and decompilers (radare2, Ghidra, IDA Pro), extended with AI agents integrated directly into the disassembler environment. The emphasis is on what worked, what did not, and where human analysis remains essential.

  ResearchersAsher Davila MX

  Presented at Ekoparty Miami 2026

  View official schedule
• May 22, 2026 Talk AppSec & Supply Chain Ekoparty Miami 2026 Ashley Hiram MX Minutos que salvan millones: Identificación y análisis de CVE-2025-71257 en menos de 3 hrs.

  Exploraremos el ciclo de vida de un ataque real en el cual se explotó el CVE-2025-71257 en un servidor de Ticketing llamado BMC Footprints y se encontraba expuesto a internet, lo cual permitió que atacantes de Sur Corea, USA, Malasia y España cargaran distintas Webshells a la aplicación web para generar persistencia, la ejecución de comandos de sistema operativo y posteriormente, movimientos laterales.

  ResearchersAshley Hiram MX

  Presented at Ekoparty Miami 2026

  View official schedule
• May 22, 2026 Talk Malware & Reversing Ekoparty Miami 2026 Danilo Erazo EC From Pentest to Hacktivism: A Journey into 6 Zero Days Hidden in widely used Routers

  This talk tells the story of how a routine penetration test of one day became a months long solo journey into uncovering six zero day vulnerabilities in a home ONT router used all over the world, but especially across the American continent, including the United States, Canada, Argentina, Mexico, Brazil, and Ecuador.

  In 2025, I was hired by an Ecuadorian entity after an ISP detected suspicious activity impacting its own infrastructure, potentially originating from users of these routers. They needed to understand what was happening. What began as a standard assessment quickly went far beyond typical testing. Instead of stopping at network level analysis with a port scan and check vulnerable services, I moved deeper into hardware hacking and firmware reverse engineering. What I found was unexpected. A massively deployed router with no prior CVEs!!!. That absence was not reassuring, it was suspicious. Working completely alone, I faced significant technical challenges, including reversing firmware built on the uncommon ARCompact architecture. Step by step, this led to the discovery of five zero day vulnerabilities.

  At that point, I was facing a difficult situation. The vendor initially refused to patch the vulnerabilities, even though there were around 60,000 of these end of life routers still in use just in one of the affected countries and many more deployed worldwide. Given the scale and urgency, I briefly considered turning to the black market as a way to force attention to the issue. However, I ultimately chose responsible disclosure instead (but I discovered a big black market about zero days in routers). What followed was a difficult, months long process with the vendor that eventually resulted in five CVEs and the patch in 2025. To make progress, I had to adopt a more assertive, hacktivist style approach with the vendor after their initial refusal to address the flaws (the timeline is quite emotional!).

  In March 2026, after I published the CVEs in my blog, an anonymous hacker contacted me. He had read my work and revealed something unexpected. He was the author of a sixth zero day vulnerability affecting the same routers, one I had previously come across without knowing its origin. What started as an individual effort suddenly connected to a hidden parallel discovery (in total 6 zero days were in the underground/undiscovered for more than 10 years)

  In March 20, 2026, I verified the vulnerability and conducted a global reassessment of these routers. The results are quite interesting. These devices are already end of life, yet they are still being used all over the world, with official support extended until 2027/2028. The message: EOL routers are very serious risk!"

  ResearchersDanilo Erazo EC

  Presented at Ekoparty Miami 2026

  View official schedule
• May 22, 2026 Talk AI Security Ekoparty Miami 2026 Emilio Oropeza MX From LLM to Agent Security: how risk scales with autonomy

  Los agentes de inteligencia artificial representan una evolución significativa respecto a los modelos de lenguaje tradicionales. Mientras que un LLM procesa texto y genera respuestas de forma aislada, un agente posee autonomía para razonar, planificar y ejecutar acciones en el mundo real mediante herramientas externas, APIs y acceso a datos sensibles. Esta capacidad amplificada introduce una superficie de ataque considerablemente mayor y riesgos que van más allá de las vulnerabilidades conocidas en modelos conversacionales. En esta charla exploraremos las diferencias fundamentales entre LLMs y agentes desde una perspectiva de seguridad, analizando por qué la autonomía, la persistencia de memoria y la capacidad de ejecución transforman el panorama de amenazas. Examinaremos los principales vectores de ataque que afectan a sistemas agénticos, incluyendo prompt injection indirecto, envenenamiento de herramientas, exfiltración de datos a través de canales laterales y ataques de confusión de identidad que explotan la cadena de confianza entre componentes. La sesión incluirá una demostración práctica de un ataque contra un agente, ilustrando cómo un adversario puede manipular el comportamiento del sistema para ejecutar acciones no autorizadas. Posteriormente, abordaremos los mecanismos de defensa más efectivos: sandboxing de herramientas, validación de salidas, principio de mínimo privilegio, supervisión humana en el bucle y arquitecturas de confianza cero. Finalmente, discutiremos marcos de gobernanza para el despliegue responsable de agentes, incluyendo políticas de acceso, auditoría de acciones, límites de autonomía y consideraciones regulatorias emergentes. Los asistentes obtendrán una comprensión clara de los riesgos únicos de los sistemas agénticos y estrategias prácticas para mitigarlos en entornos productivos.

  ResearchersEmilio Oropeza MX

  Presented at Ekoparty Miami 2026

  View official schedule
• May 22, 2026 Talk Offensive Security Ekoparty Miami 2026 Fabiola Oliveros VE Lost in translation: por qué tu kill chain perfecta muere en el comité ejecutivo

  Encadenaste cinco pasos hasta Domain Admin, dumpeaste NTDS y demostraste acceso a la base de datos de producción. Reporte impecable, CVSS 9.1, kill chain documentada. Tres meses después no se remedió nada, el presupuesto se fue al SIEM nuevo y el board sigue convencido de que el riesgo principal es "phishing a usuarios". Técnicamente impecable, operativamente irrelevante. El problema no es técnico: entre el shell que conseguiste y la decisión del negocio hay tres saltos de traducción que rara vez funcionan, del hallazgo al impacto operacional, del impacto al riesgo de negocio, y del riesgo a una decisión ejecutable. Esta charla es sobre ese gap, contado desde el cruce raro de hacer producto para organizaciones donde se hace seguridad ofensiva y aún así los hallazgos no siempre mueven la aguja: qué herramientas del mundo de producto se pueden importar al oficio sin convertirlo en consultoría. Para pentesters, equipos de VA, red teamers, líderes de seguridad y cualquiera que haya entregado un hallazgo crítico y se haya comido el silencio del otro lado.

  ResearchersFabiola Oliveros VE

  Presented at Ekoparty Miami 2026

  View official schedule
• May 22, 2026 Talk AI Security Ekoparty Miami 2026 Diego Forni AR·Rocío Baggio AR Deeper into Trident: When AI Threat, Defense, and Routine Collide

  Demo: While most cyber ranges are focused on attacker agents and limited by rigid abstractions that fail to model the complexity of modern threats, Trident addresses this gap by integrating attacker, defender and benign agents into a Docker-based, hyper-realistic autonomous cyber range. In this session, we shift the spotlight entirely to the Blue Team, exploring how researchers and developers can evaluate novel defender agents and security tools within authentic enterprise networks.

  ResearchersDiego Forni AR·Rocío Baggio AR

  Presented at Ekoparty Miami 2026

  View official schedule
• May 22, 2026 Talk AI Security Ekoparty Miami 2026 Gabriel Franco AR FARADAY - Automating your Continuous Scanning cycle with AI and Public Tools

  No abstract was found on the conference website.

  ResearchersGabriel Franco AR

  Presented at Ekoparty Miami 2026

  View official schedule