BSides Day 2 Summary - AI

BSidesSF is an amazing event. It comes and goes so quickly, but it just has a special place in my heart. It’s the place where I first played a CTF and made some lifelong friends in the industry.

Fast forward to today it’s like a mini, yet grown up, Def Con with villages, talks, and more. A worthwhile event.

Table of Contents

• Some facts about BSidesSF

• Headshots at BSidesSF

• AI Talks

  • Talk: Insane In The Supply Chain: Threat Modeling …

  • Talk - AI: Best Janitor or Worst Superhero?

• Villages

Some facts about BSidesSF

• $4435 was raised for charities via T-Shirt Sales

• BSidesSF is the most expensive Besides in the world as it takes place in one of the most expensive cities in the world

• 10+ lbs of jelly beans was consumed by staff

Headshots at BSidesSF

Something new at BSidesSF is headshots! Yes, they had free headshots all day! A great opportunity to stand in an awkward position and show the world your best side.

AI Talks

Considering the theme of the conference was “You can’t spell dystopia without AI”, I found it was befitting to see some talks on AI and Security.

Talk: Insane In The Supply Chain: Threat Modeling For Attacks on AI Systems

By Marta Janus, Eoin Wickens

Link: https://sched.co/1abFH

My main takeaway from this talk is that AI Security is like taking software security back to 2000. 

Back to basics like scanning for signatures, checksums, and other table stakes these days.

Takeaways

• Security Of ML Formats Are Insecure By Design

  • Insecure Code

  • Often vulnerable by design

  • No digital signatures / certs

  • No integrity checks

  • No malware scanning

  • Not quite considered “software”

• Model Hijacking Issues

  People want a plug and play solution for their models

  • Check signatures from the author

  • Scan for malware or erroneous data

  • Deploy in a sandbox first

  • Monitor Constantly

  • Don’t allow direct access to models

I highly recommend watching this talk when published if you are building anything with AI models!!

Talk - AI: Best Janitor or Worst Superhero?

By Adrian Sanabria

Link: https://sched.co/1abFl

The title of this talk reminded me of the Space Quest series from Sierra games, where a hapless janitor named Roger Wilco accidentally saves the galaxy.

Adrian always has a knack for framing things. I love his perspective and it always adds great color to some of our problems in the industry.

Takeaways and Quotes:

• People sometimes put pressure on the AI for it perform better

  • “I will lose my job if you don’t do…”

  • Stroking its ego! “You are amazing…”

• Why make AI do high stakes items, when it can just do simple and low stake things we need in security

  • Pumping pcaps and analyzing event data

  • Fill out security questionnaires

    • People are copying and pasting anyway!!

  • Board deck slides?

• AI Made some suggestions and created a slide!!

  • Help desk tickets

  • Password resets

  • This slide was ENTIRELY created by AI

    

Villages

Below is the full list of villages at the con:

• Adversary Village

• Bug Bounty Village

• Career Village

• Crypto & Privacy Village

• Hardware Challenge Village

• Personal Security Village

• API Security Village

• Capture the Flag

• Cloud Village

• Embedded Systems Village

• Lockpick Village

• AI Village (Of course!)