BSidesNYC 2026: Trust Has an Attack Surface

New York City runs on connections. Subway lines, fiber, financial networks, and millions of daily relationships keep the city moving. Every connection creates a path for something valuable. Every path also creates a place where trust can be redirected.

BSidesNYC 2026 filled John Jay College of Criminal Justice on October 17. The event sold out, welcomed 1,323 people, a record for the event, and a 14% increase in check-ins. Organizers even ran out of badges but got creative and everyone was taken care of

The sessions moved through civil liberties, CI/CD, identity, open data, malware, leadership, and developer tooling. A shared concern ran through all of them. Systems rely on trusted relationships, and attackers look for the places where those relationships grant more authority than anyone intended.

Trust has an attack surface.

Some Systems Should Stay Unbuilt

Eva Galperin, Director of Cybersecurity at the Electronic Frontier Foundation, opened with “Do Not Build the Torment Nexus.” Her keynote connected surveillance infrastructure, AI-generated authority, and centralized power.

AI news slop can attach plausible quotes to plausible experts who do not exist. Grammarly's former expert-review feature used AI to select experts and extrapolate writing advice under their names. Eva described the resulting dispute as “Sloppergate.” Generated credibility can become misappropriated identity at product scale.

Flock camera networks showed the physical version of the same problem. Broadly shared location data supported searches beyond local jurisdictions. Residents and officials in Verona, Wisconsin, chose to end their contract, yet removing the cameras took a protracted fight. More than 270 cities have rejected Flock contracts through the DeFlock movement.

Communications backdoors carry the same structural risk. Salt Typhoon reportedly persisted inside major telecommunications providers and reached systems created for lawful interception. A privileged path built for one authority becomes a target for every capable adversary.

AI expands the amount of data these systems can process. Much of the current pitch repackages big data with faster analysis and broader automation. The core questions remain familiar. Who holds the data, who can search it, and how can that power be used against people?

“The answer needs to be no. We're not going to build that.”

Eva's closing advice was direct. Decentralize power, refuse anticipatory obedience, and future-proof work against authoritarian use. Technical possibility does not create an obligation to ship.

CI/CD Trust Extends Through Every Dependency

Kennedy Toomey and Max Saltonstall presented “Rethinking CI/CD Security in the Age of GitHub Actions.” Their data showed that 71 percent of organizations never pinned actions to a full commit SHA. Only one percent always did.

A tag is a movable pointer. Pinning to a commit makes the selected version explicit, yet direct pinning covers only the first layer. An action can call other actions, and every transitive dependency adds another trusted execution path.

Common workflow attacks exploit risky triggers, untrusted input, and excessive permissions. A pull_request_target workflow can combine attacker-controlled code with repository write access or secrets. Shell interpolation can turn issue titles and branch names into command injection.

S1ngularity also demonstrated why teams must repair vulnerable workflows across every active branch. Fixing the default branch leaves old branches available as alternate paths. The March compromises of Trivy and KICS actions showed how quickly poisoned tags can spread through trusted automation.

GitHub's new workflow dependency locking preview aims to capture direct and transitive actions in a lockfile. Teams still need safer triggers, minimal permissions, dependency scanning, and detection. Every public workflow should expect continuous adversarial testing.

Authorization Phishing Goes Around Strong Authentication

Luke Jennings demonstrated “Authorization Phishing: Phishing, but Without the Creds.” Passkeys and security keys protect authentication. OAuth abuse can target the authorization granted after identity has already been proven.

Device code phishing abuses a flow designed for input-constrained devices such as televisions and printers. The victim signs in on a legitimate Microsoft page and approves a code controlled by the attacker. The resulting OAuth tokens reach the attacker even when the victim uses a YubiKey.

ConsentFix targets pre-approved applications and steals an OAuth authorization code. A victim may copy a localhost URL into an attacker-controlled page after completing a legitimate sign-in. The exchange feels trustworthy because much of it happens on the real identity provider.

Conditional access can block device code flows, but configurations vary by tenant and resource. A policy left in report-only mode provides observations without enforcement. Device-compliance requirements stopped device code phishing in Luke's tests while ConsentFix still succeeded.

Security awareness training has to cover authorization prompts, device codes, and copy-and-paste instructions. Strong authentication solves one stage of the attack. Teams also need to test what tokens can authorize and which applications can receive them.

Publicly Reachable Data Can Become Passive Intelligence

Ringmast4r presented “5.6 Million Domains, 400 GB of Code, Zero Alerts: How Nation-States Conduct Passive Intelligence.” This section honors the session's no-photo policy.

The research began with public websites, exposed repositories, and metadata. Images on a Venezuelan news site retained EXIF data that could help identify contributors. Government technology stacks exposed hardcoded credentials, environment files, and election-control systems through public code.

The work expanded into ODINT, a nonprofit effort to document and audit public-sector technology. The findings crossed borders and data types. Open endpoints exposed civil records, police dispatch data, and government archives.

One Mexican university connection led to 177 federal endpoints and tens of gigabytes of accessible data. A Juárez police system exposed millions of records, including locations and caller details, until it was quietly closed. Similar mistakes appeared in Haiti, Rwanda, Peru, and other countries.

Four patterns repeated across the research. Organizations collected too much data. Old files remained online. Sensitive material sat inside public directories. Individual mistakes reached national scale.

Passive collection can continue for years without triggering a traditional alert. A defender eventually closing the door cannot know how many scanners already copied what was behind it.

Log Value Requires Evidence and Human Judgment

Mona Ghadiri used the economics of the penny to frame “It Costs More to Make Than It's Worth: Lessons from the Penny for Your Sentinel Deployment.” A penny costs about 3.5 cents to manufacture. Security teams make a similar mistake when they compare ingestion cost with the apparent daily use of a log source.

Her entity-mapping review flagged 82 of 262 enabled rules. Nearly one-third of those rules depended on data relationships that could break when a table moved or disappeared. A low-volume source may support a long detection window or provide a rare event that completes an investigation.

Table insights can compare day-over-week fluctuations, top daily costs, and the last time data supported a detection. Actual contracts and billing context also belong in the calculation because list prices can misrepresent the decision.

Mona's proposed advisor keeps evidence and uncertainty visible. AI can identify dependencies and suggest options. Humans should approve changes because they carry the operational context and accountability for what the SOC can still see.

Owning the Hardware Changes the Reading Experience

Katie Paxton-Fear brought embedded systems and digital ownership together in “Off The (Book)Shelf Hacking: Hackable eReaders.” E-readers are custom Linux or Android computers with unusual screens, strict resource limits, and active modding communities.

Kindle jailbreaks such as WinterBreak use flaws in active-content handling to run custom code. The Kindle Modding Wiki documents the community's tools and techniques. KOReader adds PDF support, synchronization, and alternative library management.

Android-based readers provide broader software choices at the cost of battery life and interface polish. Tiny devices such as the Xteink X4C create a different challenge. Its ESP32 platform has roughly 400 KB of RAM, so ordinary string handling and large libraries can overwhelm the device.

Community firmware has to treat every allocation as an engineering decision. That constraint encourages a deeper relationship with the hardware. A reader becomes something its owner can inspect, change, and understand.

Ransomware Uses Familiar Paths at Industrial Speed

Antoine Valadon walked through “You're Qilin Me! Dissecting Qilin's 2026 Attack on TWU Local 100.” Qilin operates as a Russian-speaking ransomware-as-a-service group and has remained among the most active ransomware operations.

The suspected path into the union began with phishing against an administrative login. The attacker relayed valid credentials and the MFA exchange, then used the resulting access for takeover. MFA completed successfully inside an attacker-controlled session.

Qilin's workflow follows a repeatable sequence. Gain access, steal data, reduce visibility, detonate ransomware, and reuse the method while defenders are still piecing together the incident. The union confirmed exposure affecting about 67,000 people, while dark-web conversations suggested roughly 551 GB of stolen data.

Antoine emphasized recovery plans aligned with CISA's Cross-Sector Cybersecurity Performance Goals. Behavioral hunting offers more durable coverage than a single indicator. Recovery practice decides how quickly operations return after the familiar path works again.

Malware Samples Can Carry Live Credentials

Jonathan Fuller examined an overlooked consequence of shared malware in “When Malware Analysis Leaks Passwords: What Shared Samples Reveal.” A sample may contain credentials that remain valid after researchers upload and exchange it.

Extraction alone does not prove compromise. Jonathan described a chain that moves from leaked material to recovery, authentication, and pivoting. Analysts have to connect a credential with the endpoint and code path that actually uses it.

API relationships provide that evidence. WinHTTP calls transfer a host, request handle, and credentials across separate functions. Database connectors may reveal the username and password closer to the network call. Following values backward through assembly shows how each field was produced.

The stopping point depends on the access boundary. Static analysis can decode and emit a masked record. Symbolic analysis can expand into the caller when the value remains unresolved. The practical workflow is locate, recover, and record.

Vulnerabilities Emerge Between Components

Ariel Fogel explored “Weirder Machines: Compositional Attack Surfaces at the LLM-Tool Boundary.” His examples focused on behavior that appeared only after several locally reasonable components passed data to one another.

His n8n research treated the entire automation chain as a weird machine. A user-controlled value moved through an expression language and reached host authority. Local checks covered each stage while the handoff created the exploit.

Coding agents have the same shape. A model emits shell text, an evaluator classifies it, and a shell expands it. Ariel showed how trusted shell built-ins and parameter expansion created zero-click execution paths around approval logic.

Human approval also degrades under decision fatigue. A prompt offers limited protection when the dangerous operation appears only after several transformations. Security reviews need to trace data and authority across the complete composition.

The model is one component inside a much stranger machine. The exploitable instruction set includes every parser, template language, shell feature, and credentialed tool surrounding it.

Leadership Grows Through Action

Chris Maenner shifted the conversation toward career growth with “The Accidental Leader: An Engineer's Path to Startups and Conferences.” Technical work prepares people to lead by teaching them how to learn, recover, and earn trust.

Chris described failing an IT role at Facebook because enterprise security demanded deeper web-application knowledge. Learning Next.js helped fill that gap. The failure became preparation for later work.

Volunteer communities make influence especially visible. A title cannot compel people who are donating their time. Leaders keep the group functional, create room for fun, and act with enough integrity to retain trust.

“Action builds confidence.”

Bravery means moving before confidence arrives. A new role, a startup, and a conference stage each become possible through the first concrete step. Career paths take shape through accumulated decisions rather than a complete map.

An Extension ID Is a Supply-Chain Boundary

Raphael Silva closed the day with “Install Me Maybe: Turning Claimable VS Code Extension IDs into Supply-Chain Attacks.” VS Code extensions run with access to workspace files, terminals, tasks, and Git operations. Automatic updates keep that code present for a long time.

An identifier such as publisher.extension looks portable while its ownership remains marketplace-specific. Microsoft Marketplace and Open VSX maintain separate namespaces. A trusted extension in one registry can point to an unclaimed publisher in another.

The attack combines name takeover with dependency confusion. A repository or dev container recommends a trusted ID. An editor resolves that ID through a different registry. The attacker claims the available namespace, publishes the extension, and gains code execution when installation triggers.

Raphael scanned popular extensions and GitHub repositories, then published clearly labeled research extensions with minimal collection. His project found 2,056 claimable namespaces associated with 187 million installs. The extensions received almost two million callbacks from about 180,000 distinct IP addresses and led to more than 300 reports.

Organization-wide allowlists can limit approved extensions by marketplace. Teams can restrict unknown installations, review dev containers and onboarding templates, and add a cooling-off period before newly published versions reach developers. Endpoint protection provides another layer around the editor process.

Open VSX has since strengthened ownership checks and added review for suspicious publication attempts. Registry identity needs an explicit chain of ownership because a familiar string can conceal a different publisher.

Follow the Authority Through the Whole System

BSidesNYC 2026 kept returning to trusted paths that crossed boundaries.

A lawful-intercept system carried privileged communications. A GitHub Action reached secrets through a workflow trigger. An OAuth flow issued a token after a legitimate sign-in. An extension ID moved between marketplaces while keeping the same familiar shape.

Composed systems make these paths hard to see. Each component can behave as designed while the complete chain produces an outcome nobody reviewed. Scale then turns one overlooked path into millions of records, thousands of repositories, or hundreds of thousands of developer environments.

Security work has to follow data and authority across the entire chain. Identify what can invoke the path. Record which identity it uses. Limit what it can reach. Test the handoffs where one component turns untrusted input into trusted action.

New York's connections create its strength. BSidesNYC showed how careful engineering can keep those connections from becoming someone else's route through the system.