DEFCON 34 - Red Team VillageDemonstrated how three techniques from VPN privacy research - constant-size packet morphing, Poisson cover traffic injection, and Maybenot-inspired probabilistic pattern distortion - can be adapted for offensive C2 operations, layered with application-layer malleable profiles (Microsoft Graph, Slack, Okta) and cloud storage dead-drops (S3, OneDrive) to defeat ML-based DPI and DLP detection at the behavioral, flow, and application layers.
DEFCON 34 - Malware VillagePresented Lyra, an open-source, cargo-native LLVM IR obfuscator for Rust. Covered the RUSTC_WRAPPER interception architecture, Windows/MSVC engineering challenges, and live before-and-after demos in IDA Pro, Ghidra, and Binary Ninja - including a YARA rule matching the plain build returning zero hits on the obfuscated binary, and consecutive unseeded builds producing different hex patterns.
DEFCON 33 - Red Team VillageExplored advanced security mechanisms that major browsers implemented to prevent cookie theft. Demonstrated vulnerabilities in Chrome's AppBound encryption, including 2-way DPAPI encryption and ChaCha20Poly1305 state-key encryption layers.
BSides Las Vegas 2025Same presentation covering browser security mechanisms, encryption methodologies, and Chrome's Device Bound Session Cookies (DBSC) technology designed to mitigate session hijacking through TPM chip-based encryption.
Hakai Offensive Security BlogDetailed analysis of CVE-2024-21338, a Windows admin-to-kernel elevation of privilege vulnerability. Exploits the appid.sys driver through IOCTL communication to corrupt the PreviousMode field in _KTHREAD thread context, enabling kernel access.
Ekoparty 2023Presentation on COFF (Common Object File Format) and beacon_inline_execute. Covered how BOFs can be used to execute code in-memory without loading shellcode, bypassing AV/EDR protection and escalating C2 agent capabilities.