GCC

Ethical Session

10:00 ~ 11:00

Trainer: (TBC)

(Abstract TBC)

Car Hacking Crash Course - All About Automotive Networks and Exploitation

Session 1: 11:00 ~ 13:00 · Session 2: 14:00 ~ 18:00

This beginner-intermediate Automotive Cybersecurity and Car Hacking Crash Course delivers hands-on experience attacking and defending real vehicle systems, from in-vehicle networks and infotainment to electric vehicles and charging infrastructure. Participants gain practical, risk-focused insight into how modern vehicles are compromised and secured, making the course valuable for both technical security engineers and decision-makers responsible for connected transportation systems.

Trainer: Kamel Ghali

A seasoned expert with over nine years of experience in automotive and IoT cybersecurity, Kamel has worked across the U.S. and Japan as a vehicle penetration tester, security consultant, and car hacking trainer. He currently serves as Vice President of International Affairs for the DEF CON Car Hacking Village, where he leads global outreach and awareness efforts focused on vehicle security.

Kamel brings deep expertise in cyber-physical systems security and is fluent in English, Arabic, and Japanese. Passionate about transportation cybersecurity, he actively engages with communities worldwide to promote education and awareness in this critical domain. His community contributions include organizing major Japanese cybersecurity conferences such as CODE BLUE and BSides Tokyo, and he regularly seizes opportunities to advocate for cybersecurity and privacy in connected transportation systems.

Kamel has spoken at numerous cybersecurity events around the world and is a frequent contributor to online journals and other publications, where he speaks about cyber-physical security.

Understanding ICS/OT Attacks: From Real-World Incidents to Hands-on Exploitation and Defense

09:00 ~ 13:00

Industrial Control System and Operational Technology environments operate under requirements and constraints that differ significantly from traditional IT systems. While IT security primarily focuses on protecting data confidentiality, integrity, and availability, security incidents in ICS/OT environments can directly affect physical processes, equipment safety, production continuity, and critical infrastructure.

This workshop introduces the fundamental architecture, technologies, and communication protocols commonly found in ICS/OT environments. Participants will examine common attack techniques through a series of real-world case studies and hands-on labs based on major incidents, including TRITON, EKANS, Industroyer2, FrostyGoop, and ZionSiphon. The labs demonstrate how attackers communicate with safety systems, terminate ICS-specific processes, manipulate industrial device states through protocols such as IEC 60870-5-104 and Modbus, and identify exposed industrial services.

The workshop also explores attack vectors beyond network-based exploitation, including wireless, physical, and supply-chain attacks. Finally, participants will learn practical defensive approaches, including threat analysis and the use of Software Bills of Materials to identify and manage cybersecurity risks across industrial environments.

Trainer: Zeze Lin

Zeze Lin is a Senior Threat Researcher at the Threat Research and Product Security Center of TXOne Networks Inc., where he focuses on product security and threat research. His primary research area is Windows system security, and he has discovered numerous Windows-related vulnerabilities. He has presented on a wide range of security topics at international conferences, including VXCON, CYBERSEC, HITCON, CODE BLUE, and ROOTCON. Zeze is also an active CTF player.

Hunting Next-Gen Threats: Tracing and Reversing APT Malware in the EtherHiding Era

14:00 ~ 18:00

In recent years, malware forms and C2 (Command and Control) concealment techniques have continuously evolved. Starting in 2020, threat actors began leveraging various third-party platforms and communication applications as dead drop resolvers. Beginning in 2024, EtherHiding emerged in malware campaigns, followed by a rapid proliferation of various EtherHiding variants. Because this new type of dead drop resolving fundamentally differs from traditional threat intelligence indicators, conventional search and detection mechanisms have struggled to effectively track these malwares.

In this course, we will guide participants to understand next-generation malware and threat models. Through hands-on, step-by-step analysis of the latest malware samples from internationally renowned APT (Advanced Persistent Threat) groups, students will master advanced reverse engineering and EtherHiding tracking techniques. This will enable them to uncover the hidden objectives, data exfiltration techniques, RATs (Remote Access Trojans), and C2 infrastructures used by these APT organizations.

Trainer: Vic Huang, Sol Yang

Vic Huang is an independent researcher and security engineer in cybersecurity with over 8 years of experience in the field. He is interested in web, mobile and privacy domains. Vic has delivered presentations and workshops at numerous cybersecurity conferences, such as BlackHat, DEFCON, TROOPERS, Hack.lu, HITB, CODE BLUE, SINCON, Ekoparty, ROOTCON, REDxBLUE pill, HITCON, CYBERSEC, and GCC.

Sol Yang is a seasoned cyber threat researcher with 7 years of experience in the cybersecurity industry. He specializes in malware analysis, threat hunting, network traffic analysis, industrial control systems (ICS) security, and AI-assisted threat investigation, with expertise spanning advanced threat attribution, detection rule development, EDR, penetration testing, and SIEM-based log analysis. He has over six years of cybersecurity teaching experience, delivering professional training to government agencies, public organizations, and universities, and has taught more than one thousand students. Sol is an active speaker in the global cybersecurity community, having presented at major conferences including Black Hat, Code Blue, HITB, RootCon, SINCON, Red x Blue Pill, and iThome CYBERSEC.

Adversarial AI Attacks in Practice: Breaking Vision Models, Jailbreaking LLMs, and Why the Defenses Keep Losing

09:00 ~ 13:00

Over one day, students build working attacks themselves rather than reading about them. They start by crafting an imperceptible perturbation that forces an image classifier into a target class of their choosing. They then apply a standard preprocessing defense to their own attack, watch it fail, and rebuild it using adaptive techniques (Expectation Over Transformation and Backward Pass Differentiable Approximation) until it works again. The second half repeats the same cycle against a language model: first in discrete token space using Greedy Coordinate Gradient to find an adversarial suffix, then in continuous embedding space using an optimised latent prefix.

Students benefit in three ways: they leave with runnable code for four canonical attacks they can point at their own models and pipelines; they gain a working threat model, able to say what an attacker actually needs (labels, confidences, logprobs, gradients, or API-level embedding access) before a given attack becomes viable, and therefore which mitigations are worth funding; and they learn to evaluate defensive claims critically — the recurring lesson of the day is that a defense tested against a static attacker proves nothing, and that most published defenses raise attacker cost rather than eliminating the attack.

Trainer: Chang Shiau Huei

Curious and passionate cybersecurity professional with a strong foundation in leading and growing communities, including founding the Malaysian cybersecurity community SherpaSec, and active involvement in multiple cybersecurity-related organizations. Experienced in delivering talks on automotive hacking, AI security and safety, while serving as a speaker and panelist for various events, including CYDES and DEFCON. Demonstrated excellence in CTF competitions with multiple top placements at national and international levels. Currently an instructor for AI Security Bootcamp Las Vegas and Frontier AI Security Training Singapore.

(TBC)

14:00 ~ 18:00

Trainer: (TBC)

(Abstract TBC)