Dumping an Entire Conference CFP
Details
We WILL be meeting at DJs this month!
This month we are IN PERSON meetup.
Join us at 6 PM for social activities (some come even earlier) and 6:30 for the main presentation.
For Jun 2026:
"Dumping an Entire Conference CFP"
A few weeks ago I submitted a talk to a conference CFP and noticed something odd and started to poke around. Before long I was looking at data I definitely wasn't supposed to see.What started as simple curiosity became an unexpected journey through broken access control, questionable assumptions, and the realization that some of the most impactful vulnerabilities are also the least sophisticated.This talk is a hacker's-eye view of how a routine CFP submission unraveled into a full-scale authorization failure. We'll follow the breadcrumbs from the first weird response to the moment the scope of the vulnerability became clear, exploring the methodology, dead ends, discoveries, and "wait, that can't be right" moments along the way. No advanced exploitation. No exotic techniques. Just careful observation, a browser, and a web application that trusted users a little too much. The punchline? The vulnerable application was hosting the CFP for a security conference. By the time I understood what I was looking at, I had effectively gained a preview of every talk the organizers were still evaluating. We'll cover the bug, the disclosure process, and the strange experience of accidentally getting an advance copy of an entire security conference program... not because I was on the review committee, but because someone forgot to check whether I should be allowed to see it.Sometimes the most hacker thing you'll do all year is submit a CFP.
Speaker: Adam Schaal (@clevernyyyy)
Adam Schaal leads the Security Hub for Innovation and Efficiency (SHINE) engineering team at AWS. The SHINE team researches, experiments, and develops mechanisms and constructs to reinforce security at scale. Adam has an extensive background in both development and application security and is experienced with both sides of making and breaking applications. He is also very active in his local security community as a founder of Kernelcon, a mid-size information security conference, and DEF CON 402, a local DEF CON group. Adam works out of Omaha, Nebraska, one of the least likely places in the United States to encounter shark attacks or suffer altitude sickness.