BSides Ume 2026

16 Jun 2026, 09:00 → 17 Jun 2026, 17:40 Europe/Copenhagen

HUM.D.210 Hummelhonung (Umeå Universitet)

Keynote speaker: Prof Alexandre Bartel -  Benign-Looking Code Changes for Software Supply Chain Attacks

 

The fourth BSides Conference in Umeå, Sweden will take place June 16th to 17th. It is a community conference on IT security and related fields, part of the global BSides community and is arranged by Academic Computer Club in Umeå.

Previous events are available here: https://indico.neic.no/category/29/

For more interactions and micro updates, follow us on Mastodon or join our discord or slack server

Gold sponsors:

Silver sponsors:

Truesec

Omegapoint

 

 NetNordic 

Bronze sponsors: 

Tuesday 16 June

09:00 → 10:00 Registration and snacks

10:00 → 12:20 Talks

10:00 Introduction and Practical Matters

Welcome from the organizers and practical matters

Speaker: Mattias Wadenstein (NeIC)

20260616-PracticalMatters.pdf

10:15 Benign-Looking Code Changes for Software Supply Chain Attacks

Software supply chain attacks can rely on multiple vectors, targeting the different stages of the software lifecycle from compromizing the build servers to social engineering on developers. After an overview of these techniques, we discuss an approach which introduces stealthy code changes to activate individual gadgets. In the context of Java deserialization, these gadgets could be combined to form full chains leading to RCE. We present empirical insights into the prevalence of such an attack vector in real code bases. Identifying code locations where gadgets can be introduced is the first step to prevent such supply chain attacks.

Speaker: Alexandre Bartel (Umeå University)

11:00 Avoid Being Bounced from the Party - Persistence for Fun & Profit 2026 Edition

In any cyber attack, adversaries must maintain a presence within the target environment to achieve their objectives. Whether aiming to disrupt critical infrastructure, spy on and extract data from industrial or intellectual targets, or execute a ransomware operation, sustained access is crucial.

Persistence provides stable access, enabling adversaries to better explore, move laterally, gather information, and generally impact the environment. Even those seeking a quick victory prefer to leave a backdoor for potential future access.

We will explore and analyze techniques observed in real attacks carried out by a diverse range of adversaries, from nation-state-sponsored actors to less sophisticated criminals.

Additionally, we will discuss the efforts required to effectively detect and neutralize ongoing attacks before they reach their goals.

Speaker: Hasain Alshakarti (TRUESEC)

12:20 → 13:20 Lunch

13:30 → 15:00 Talks

13:30 A Stealth and Safety Issue - Exfiltration using 'data bouncing'

Overview

The concept of “data bouncing” via a third-party web server provides an extremely stealthy method of bypassing traditional network safeguards. By directing web requests to certain domains that process hostnames in headers, you can relay small pieces of data to your DNS listener, allowing you to collect and reconstruct data, be it strings, files, or any other type of data.
The discovery of this technique has received minimal publicity, which seems to be partly attributable to the unfamiliar use of familiar services, and partly to a lack of easy to use tooling. This talk aims to rectify both of these by providing a clear explanation of the concept and presenting a new tool to allow the exfiltration to be carried out easily.

Agenda

Introduction:
-whoami
-What will I be talking about?
History of Data Exfiltration:
-Quick recap of older techniques
-Coverage of the reasons for data exfiltration
HTTP and DNS Lookups Overview:
-Short explanation of what's going on when lookups happen
Discovery of Data Bouncing
-The original discovery of the issue (by accident) during a pen test
How Does this Work and What Does it Mean?:
-The technique and how ir can be used
-Coverage of uses for almost undectable data exfiltration, C2 heartbeat, etc.
Putting it to Use:
-Tool demo
Conclusion

Speaker: Nick Dunn

14:15 Mobile Is the New Perimeter (And It’s Already Broken)

Mobile devices are everywhere in the enterprise—but they are still frequently out of scope for security testing. That blind spot creates real risk.

Modern mobile platforms introduce a wide range of attack surfaces, from phishing and malicious applications to vulnerabilities that allow silent device compromise. Once compromised, mobile devices can act as pivot points into internal networks and sensitive corporate systems, bypassing many traditional security controls.

In this talk, I will walk through the current mobile threat landscape and show how to bring mobile devices and enterprise mobility solutions into scope for meaningful security testing. We will look at common attack vectors, including mobile phishing, malicious applications, and device-level exploitation, as well as how attackers can use compromised devices to move further into enterprise environments.

I will also cover practical approaches to testing mobile security using freely available tools, along with an evaluation of enterprise mobile security solutions such as MDM, MTD, and MAM. Attendees will leave with concrete techniques they can apply in their own environments, as well as a clearer understanding of where existing defenses succeed—and where they fall short.

Speaker: Georgia Weidman (Bulb Security)

15:00 → 15:30 Coffee break

15:30 → 17:00 Talks

15:30 Bypassing App Control via Managed Installer

App Control is the latest Microsoft solution to determine what application are allowed to run on Windows 11. To increase the security, it is possible to create signed policies that even should prevent administrators from changing the policies.
One day, Microsoft introduced Managed Installer to simplify installation and updating of App Control rules - gues what: It allows to completely bypass any signed App Control policy.
During this talk we will explain the basic idea befind App Control and explain and demonstrate an attack were the Managed Installer rule is abused by an attacker with administrative privileges to bypass any App Control policies. The attack is automated using PowerShell to setup the necessary App Locker ruleset and define PowerShell as Managed Installer allowing an attacker to download and execute any arbitrary software.

Speaker: Christian Biehler (Deutsch)

Talk_Bsides_Umea_2026-Windows-ManagedInstaller-AppControl-Bypass_ext.pdf

16:15 Hardening of a Linux appliance

The decision of which remote computers you can trust and which you can’t is hard. You probably think that you can trust a machine that you’ve just done a fresh install upon, but when that machine leaves your physical control and is shipped off somewhere in the world, has it then left your trust boundary and is completely untrusted? How can you know it’s the same machine, running the same configuration, and it hasn’t been tampered with?

In this talk I’ll discuss techniques that can be used to try to keep that machine in a trustworthy state, and procedures to prove that it’s still running the expected configuration and code.
The same and closely related techniques are also used to prevent the machine from running code which aren't approved.
Another side of the same techniques can be used to establish trust in a remote machine that’s not in your physical control, like a VM in a cloud provider, a remote machine needing a reinstall, initial keying of your fleet of compute nodes etc.

This talk is about TTP’s which are applicable to any system where you run reasonably controlled workloads, like managed laptops, workstations, kubelets, or as in my case, Linux appliances.

Speaker: Anton Lundin

19:00 → 21:00 Dinner

Wednesday 17 June

09:15 → 10:30 Talks

09:15 Software Supply Chain Security - why should I care?

Software supply chain attacks are increasing in frequency and impact—but how concerned should we really be, and what can we do about it?

To deploy software rapidly and safely, organizations must ensure their software is trustworthy, compliant, and secure. In this session, you’ll learn how a shift-left security approach introduces security checks and guardrails at every stage of the software development lifecycle to protect the software supply chain.

We’ll explore different tools we can use as well as easy-to-adopt practices that empower developers, platform engineers, and security teams alike—such as generating Software Bills of Materials (SBOMs), analyzing dependencies, and using Git commit signing and verification — to significantly reduce supply chain risk without slowing down delivery.

Speaker: Magnus Eklund (Red Hat)

BSides Ume - Trusted Software Supply Chain.pdf

10:00 Context is the Moat: Why AI Security Tools Fail Without It

The Problem (Why This Talk Exists)

Security teams are under pressure to "add AI", to code review, SCA, incident response,
infrastructure analysis, mobile security. The tooling market has responded with a flood of
products that promise intelligent, automated security coverage. Most of them work beautifully
in demos. Most of them fail quietly in production.

The failure isn't a bug. It's architectural. Almost every AI security tool on the market
operates without the one thing that makes security decisions meaningful: context.

Not generic context. Not "we trained on a lot of code." Org-specific context. Codebase-specific
context. Infrastructure topology context. Incident history context. The kind of context that
only exists inside your environment, and that no off-the-shelf model has.

This talk is about that gap, why it's being systematically ignored, and what it costs when
real threats slip through because an AI reviewed your code without knowing how your code works.

---

Why This Talk Should Be at BSides

BSides audiences are practitioners pentesters, security engineers, AppSec leads, blue teamers.
They are the people being handed AI tools by leadership and expected to trust them. They are
also the people who will be blamed when those tools miss something critical.

This isn't a talk about AI being bad. It's a talk about AI being incomplete and about
giving practitioners the vocabulary and mental models to push back intelligently, evaluate
tools honestly, and build workflows that don't treat AI output as ground truth.

The examples in this talk are drawn from real-world deployment scenarios across product
security, infrastructure security, and mobile security. The audience will recognize them
immediately because they've lived them.

---

What This Talk Covers

1. The Context Problem Defined

A precise framing of what "context" means in security AI, why it's different from training
data quality, and why even well-trained models fail without it. This section establishes the
central thesis with a concrete failure taxonomy.

2. Product Security

The talk will walk through how AI breaks down at the product security layer not because
the tools are poorly built, but because they have no knowledge of your codebase's internal
patterns, patch history, or compensating controls. From SAST tools that can't distinguish a
sandboxed dangerous function from an exploitable one, to SCA that flags unreachable
vulnerability paths as critical, to API security tooling that misses authorization flaws
because it doesn't understand your data model the same blind spot shows up everywhere.
The core problem: AI reviews code in isolation. Real security decisions never are.

3. Infrastructure Security

At the infrastructure layer, the context gap becomes a topology problem. The talk covers
how AI misconfiguration tooling routinely misreads intentional architecture decisions as
vulnerabilities flagging IAM roles that have compensating controls at the org level,
recommending changes to Kubernetes workloads it doesn't understand the purpose of, and
missing real CI/CD attack surfaces while fixating on low-signal misconfigurations. Incident
response is where this compounds most dangerously: an AI that triages by CVSS score without
knowing your environment's lateral movement paths isn't accelerating your response it's
redirecting attention away from actual risk. Covered here too is the longer-term cost: teams
that stop building contextual judgment because they've outsourced it to a model that doesn't
have it either.

4. Mobile Security

Mobile is the domain where AI security tooling is most confidently wrong. The talk examines
how static analysis tools fire on patterns that are safe in context, miss vulnerabilities that
only surface when the mobile client and backend are reviewed together, and consistently
underperform on third-party SDK supply chain risk, where the most impactful findings live in
runtime behavior no static model can observe. The cross-repo trust boundary problem is
particularly underappreciated: auth flaws in mobile applications rarely exist in one file,
one service, or one codebase. AI that reviews them in isolation will miss the ones that matter.

5. The Pattern: A Unified Failure Model

Across every domain, the same failure repeats:

Domain	What AI Sees	What AI Misses
Code Review	Syntax, known patterns	Org libraries, dead code, compensating controls
SCA	CVE matches	Reachability, stripped layers, execution context
Cloud IAM	Policy documents	Architecture intent, migration state, org SCPs
Kubernetes	Manifest fields	Build graphs, network policy, workload purpose
Incident Response	Alert + CVSS score	Lateral movement paths, env risk, team history
Mobile	File-level analysis	Cross-repo flows, client-server boundaries, SDK behavior

6. What Good Looks Like: Context-Aware Security AI

Not a vendor pitch. A framework for evaluating what "context readiness" looks like before
deploying any AI security tool, and the hard questions to ask when a vendor claims their
model "understands your codebase."

---

What the Audience Leaves With

• A precise mental model for the context problem and why it's distinct from model quality
• A practical evaluation framework for auditing their current AI security integrations
• Domain-specific red flags across AppSec, InfraSec, and Mobile to watch for in AI output
• An honest conversation about skill atrophy the long-term cost of over-delegating
  to AI without building the judgment to validate it

---

Speaker: Akshansh Jaiswal

10:30 → 11:15 Coffee break

11:15 → 12:00 Talks

11:15 Controlled Flight into Terrain: Why Cybersecurity Startups Fail

Have you ever walked through the vendor hall at a major security conference and thought, that could be me?

Cybersecurity startups are often portrayed as a fast track to success—funding, acquisitions, and independence. The reality is far more complicated.

In this talk, I will walk through what it actually takes to turn a security tool or research idea into a company, and why so many fail along the way. Drawing from firsthand experience as a founder, along with insights from investors, advisors, and other security entrepreneurs, we’ll examine the critical decisions that shape a startup’s trajectory.

We will cover topics including how (and whether) to pursue venture funding and accelerators, what it really takes to land early customers, common mistakes in company structure and leadership, and when it makes sense to bring in outside executives. Attendees will leave with a clearer understanding of the risks, tradeoffs, and realities of building a cybersecurity startup—and how to avoid the most common pitfalls.

Speaker: Georgia Weidman (Bulb Security)

12:00 → 13:00 Lunch

13:00 → 15:00 Workshops

13:00 Cyber Crisis Table Top Exercise

Maximum: 20 participants

This half day workshop provides a focused, scenario‑based cyber crisis exercise designed to build competence in crisis coordination, communication, and decision‑making. Participants receive a short introduction to crisis management, engage in a light icebreaker, and then work through an escalating cyber incident simulation.

Speaker: Maria Edblom Tauson (SUNET)

13:00 Hands-On Penetration Testing: From Recon to Exploitation

Penetration testing is often presented as a collection of tools—but effective testing requires understanding how attacks actually unfold in real environments.

In this hands-on workshop, participants will walk through the core phases of a penetration test, from reconnaissance and vulnerability discovery to exploitation and post-exploitation. Rather than focusing on a single tool, we will emphasize methodology and decision-making: how to identify viable attack paths, prioritize findings, and move from initial access to meaningful impact.

Participants will work through guided exercises using accessible tools and techniques that can be applied immediately in real-world environments. Topics will include reconnaissance, vulnerability scanning, exploitation, and basic post-exploitation concepts.

This workshop is designed to be accessible to beginners while still providing useful insights for more experienced practitioners. Attendees will leave with a practical framework for conducting penetration tests and a deeper understanding of how attackers think.

Speaker: Georgia Weidman (Bulb Security)

15:00 → 15:30 Coffee break

15:30 → 16:50 Workshops

15:30 Cyber Crisis Table Top Exercise

Maximum: 20 participants

This half day workshop provides a focused, scenario‑based cyber crisis exercise designed to build competence in crisis coordination, communication, and decision‑making. Participants receive a short introduction to crisis management, engage in a light icebreaker, and then work through an escalating cyber incident simulation.

Speaker: Maria Edblom Tauson (SUNET)

15:30 Hands-On Penetration Testing: From Recon to Exploitation

Penetration testing is often presented as a collection of tools—but effective testing requires understanding how attacks actually unfold in real environments.

In this hands-on workshop, participants will walk through the core phases of a penetration test, from reconnaissance and vulnerability discovery to exploitation and post-exploitation. Rather than focusing on a single tool, we will emphasize methodology and decision-making: how to identify viable attack paths, prioritize findings, and move from initial access to meaningful impact.

Participants will work through guided exercises using accessible tools and techniques that can be applied immediately in real-world environments. Topics will include reconnaissance, vulnerability scanning, exploitation, and basic post-exploitation concepts.

This workshop is designed to be accessible to beginners while still providing useful insights for more experienced practitioners. Attendees will leave with a practical framework for conducting penetration tests and a deeper understanding of how attackers think.

Speaker: Georgia Weidman (Bulb Security)

16:50 → 17:00 Talks: CTF price ceremony

16:50 CTF price ceremony

Celebrating the winners of the CTF with some prizes.

Speaker: Mattias Wadenstein (NT1)