BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.ozsecurity.org//ozsec-2026//talk//SJULJG
BEGIN:VTIMEZONE
TZID:CST
BEGIN:STANDARD
DTSTART:20001029T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10;UNTIL=20061029T080000Z
TZNAME:CST
TZOFFSETFROM:-0500
TZOFFSETTO:-0600
END:STANDARD
BEGIN:STANDARD
DTSTART:20071104T030000
RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=11
TZNAME:CST
TZOFFSETFROM:-0500
TZOFFSETTO:-0600
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000402T030000
RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=4;UNTIL=20060402T090000Z
TZNAME:CDT
TZOFFSETFROM:-0600
TZOFFSETTO:-0500
END:DAYLIGHT
BEGIN:DAYLIGHT
DTSTART:20070311T030000
RRULE:FREQ=YEARLY;BYDAY=2SU;BYMONTH=3
TZNAME:CDT
TZOFFSETFROM:-0600
TZOFFSETTO:-0500
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-ozsec-2026-SJULJG@cfp.ozsecurity.org
DTSTART;TZID=CST:20261023T141500
DTEND;TZID=CST:20261023T150000
DESCRIPTION:This talk covers a real unauthenticated account takeover found 
 against a mature enterprise client's .NET Blazor WebAssembly application. 
 We will discuss how hardcoded encryption keys slip into client-side .NET a
 ssemblies and how that can compound with other common vulnerabilities into
  a full arbitrary account takeover from an unauthenticated threat actor.\n
 \nThese vulnerabilities were partially discovered by a frontier model (Cla
 ude Sonnet 4.5\, tested Mar 2026) with refusal behavior bypassed. However\
 , it couldn't put the full exploitation chain together. This talk demonstr
 ates that a much smaller local large language model (LLM) with the right s
 caffolding achieves full account takeover and\, in some cases\, appears to
  surpass the frontier cloud model’s capabilities.\n\nThis talk also cove
 rs how to defend against this class of vulnerabilities\, advantages of loc
 al LLMs\, and the tooling and resources to help you do the same.\n\nNote: 
 The finding was reported to the client\, remediated\, and their informatio
 n has been redacted and anonymized. The target is described generically an
 d all demonstrations run against a purpose-built replica.
DTSTAMP:20260920T122539Z
LOCATION:Redbud A
SUMMARY:Scaffolding Over Scale: Unauthenticated Account Takeover in Blazor 
 with a Local LLM - Ryan Chaplin
URL:https://cfp.ozsecurity.org/ozsec-2026/talk/SJULJG/
END:VEVENT
END:VCALENDAR