Listen to this Post
Introduction:
The BxSec Security Conference, held on August 22, 2026, in Santos, Brazil, brought together over 600 cybersecurity professionals, students, and enthusiasts for a day of deep technical discourse. Now in its eighth edition, the conference served as a critical forum for discussing offensive security techniques, ranging from hardware-based payment fraud to sophisticated endpoint detection and response (EDR) evasion on macOS. This article extracts the core technical lessons from three key presentations—focusing on card cloning mechanics, contactless EMV protocol manipulation, and the evolving threat landscape for Apple’s operating system—and translates them into actionable intelligence for security practitioners.
Learning Objectives & Secrets:
- Objective 1: Understand the Mechanics of Physical Card Skimming (“Chupa Cabra”). Learn how attackers deploy hardware overlays on ATMs and point-of-sale (POS) terminals to capture magnetic stripe and chip data, and explore the forensic artifacts left behind by these devices.
- Objective 2 Secret Tips: Exploiting the EMV Contactless Protocol. Discover how man-in-the-middle (MitM) attacks can manipulate Card Transaction Qualifiers (CTQ) to force a terminal to bypass PIN verification for high-value transactions, a technique demonstrated against Apple Pay and Visa contactless systems.
- Objective 3 Secret Tips: Bypassing macOS Native Protections. Learn to circumvent Gatekeeper, Notarization, System Integrity Protection (SIP), and the native firewall to achieve stealthy persistence, a critical skill for modern red team operations against Apple endpoints.
You Should Know:
1. Physical Skimming and the “Chupa Cabra” Attack
The presentation by Demétrius Rafael, titled “Chupa Cabra: Direto das lendas para a ‘clonagem de cartão’,” provided a forensic breakdown of physical card skimming devices. The term “Chupa Cabra” (Goat Sucker) is Brazilian slang for an overlay device installed over legitimate card readers to capture data.
Step‑by‑step guide explaining what this does and how to use it (Defensive Perspective):
- Identification: Physically inspect ATMs and POS terminals for loose, misaligned, or oversized card slots. Attackers often use 3D-printed overlays that blend with the original equipment.
- Forensic Collection: If a skimmer is suspected, do not remove it. Photograph the device from multiple angles and bag it as evidence for law enforcement.
- Data Analysis: If you capture the skimmer’s internal storage (often a microSD card), use `dd` to create a forensic image:
dd if=/dev/sdb of=skimmer_image.img bs=4096. - Log Review: On Windows-based ATMs, check the Event Viewer (
eventvwr.msc) for USB device insertion logs (Event ID 20001, 20003) which may indicate when the skimmer was physically connected. - Network Monitoring: Advanced skimmers may exfiltrate data via Bluetooth or GSM. Use a spectrum analyzer or `airodump-1g` on Linux to detect anomalous RF signals near the terminal:
airodump-1g wlan0mon.
2. Contactless EMV Protocol Manipulation (PIN Bypass)
Penegui’s talk, “Contactless Under Attack: PIN Bypass, EMV e Apple Pay,” explored critical flaws in the EMV contactless standard. The attack exploits how the terminal interprets the Card Transaction Qualifiers (CTQ)—a 2-byte data object that dictates whether PIN verification is required. By using a relay device, an attacker can intercept the communication between the card/phone and the POS terminal, modifying the CTQ to indicate that “cardholder verification was performed on the consumer’s device,” thereby bypassing the PIN check for transactions above the contactless limit.
Step‑by‑step guide explaining what this does and how to use it (Red/Blue Team Perspective):
- Setting up the Relay (Red Team): This requires two NFC-enabled devices. One acts as a proxy to the victim’s card (or Apple Pay), the other as a proxy to the POS terminal.
- Modifying the CTQ (Conceptual): The attack manipulates the response from the card. In a Visa transaction, the CTQ instructs the terminal. By modifying this value (e.g., setting specific bits to ‘1’), the attacker can force the terminal to skip the PIN prompt.
- Detection (Blue Team): Monitor POS logs for anomalies. Specifically, look for high-value contactless transactions that did not require a PIN or biometric verification. Correlate these with the terminal’s location.
- Linux Command for Network Analysis: Use `tcpdump` to capture traffic if the POS system communicates over IP:
tcpdump -i eth0 -w pos_traffic.pcap. Analyze for unusual packet sizes or unexpected protocol behaviors that might indicate a relay device is injecting data. - Mitigation: Financial institutions should enforce stricter cryptographic checks on the CTQ and implement transaction velocity monitoring to flag multiple high-value contactless transactions in a short period.
3. macOS Malware and Bypassing Native Protections
Zoziel P. delivered a session titled “macOS Doesn’t Get Malware Until It Does,” shattering the myth of macOS immunity. The talk detailed how modern macOS malware achieves persistence and evades detection by systematically defeating Apple’s layered defenses, including `launchd` for persistence, Gatekeeper and Notarization for application validation, the native firewall, SIP, and XProtect.
Step‑by‑step guide explaining what this does and how to use it (Offensive Security Perspective):
- Bypassing Gatekeeper: Gatekeeper checks for a valid Developer ID signature. Attackers can sign their malware with ad-hoc certificates or leverage techniques to disable Gatekeeper temporarily (requires SIP to be disabled or a vulnerability to escalate privileges).
- Disabling SIP (If Privileged): SIP protects system files and processes. If an attacker gains root access, they can disable SIP by rebooting into Recovery Mode and using the command:
csrutil disable. However, this is a high-risk, high-1oise action. - Persistence via
launchd: To maintain persistence, create a Launch Agent or Daemon. Place a property list (.plist) file in `~/Library/LaunchAgents/` or/Library/LaunchDaemons/. Example:launchctl load ~/Library/LaunchAgents/com.malware.plist. - Evading XProtect: XProtect uses signature-based detection. Use obfuscation and encryption to mutate the malware’s signature. Packers like `upx` can be used, but custom encryption is more effective.
- Firewall Evasion: The native macOS firewall can be manipulated. Use `pfctl` (Packet Filter) to add rules that allow outbound traffic from the malware:
echo "pass out proto tcp from any to any port 443" | sudo pfctl -ef -. However, this requires root privileges. - Command for Detection (Blue Team): Monitor system logs for unauthorized modifications to protected directories. Use `fs_usage` to monitor file system activity in real-time:
sudo fs_usage -w -f filesys | grep "com.malware".
4. IT/OT Convergence and AI-Powered Threat Detection
Another notable session addressed the convergence of Information Technology (IT) and Operational Technology (OT) networks. The presentation “Quebrando o Mito do Isolamento IT/OT” highlighted that air-gaps are a myth and that attackers are increasingly targeting industrial control systems (ICS) through IT network pivots. The solution proposed was the integration of AI to detect anomalies in OT network traffic, where traditional signature-based detection fails.
Step‑by‑step guide explaining what this does and how to use it (Defensive Perspective):
- Network Segmentation: Use VLANs and firewall rules to strictly separate IT and OT networks. On a Cisco switch, create a VLAN: `vlan 100` and
name OT-1etwork. Assign ports to this VLAN. - Passive Monitoring: Deploy a tap on the OT network to mirror traffic to a Security Information and Event Management (SIEM) system without disrupting operations.
- AI Anomaly Detection: Implement machine learning models to baseline “normal” OT traffic (e.g., Modbus, DNP3 protocols). Alert on deviations such as unexpected write commands to a Programmable Logic Controller (PLC).
- Linux Command for PCAP: Capture OT traffic for analysis:
tcpdump -i eth0 -s 0 -w ot_traffic.pcap.
5. Threat Intelligence and RASP Bypass
The conference also covered Threat Intelligence (TI) and Runtime Application Self-Protection (RASP) bypass. The panel discussion emphasized that TI is not just about collecting Indicators of Compromise (IoCs) but about operationalizing intelligence to proactively hunt threats. Meanwhile, the RASP bypass talk demonstrated how attackers can manipulate user experience (UX) components to disable application-level security controls.
Step‑by‑step guide explaining what this does and how to use it (Red Team Perspective):
- RASP Bypass Technique: RASP often hooks into application functions to monitor for attacks. By triggering a denial-of-service (DoS) condition on the UI thread or overwhelming the RASP agent with junk data, an attacker can cause the agent to crash or enter a fail-open state.
- Threat Intelligence Integration: Set up a MISP (Malware Information Sharing Platform) instance to share and receive threat data. Use the API to pull IoCs and automatically update your firewall block lists.
- API Security: Use `curl` to test for API vulnerabilities. For example, test for rate limiting:
for i in {1..1000}; do curl -X GET "https://api.target.com/v1/data" -H "Authorization: Bearer $TOKEN"; done.
6. Cloud Hardening and Container Security
While not a specific talk, the conference’s focus on modern infrastructure implies a need for cloud and container security. With the rise of DevOps, securing cloud-1ative applications is paramount.
Step‑by‑step guide explaining what this does and how to use it (Defensive Perspective):
- Container Scanning: Use `trivy` to scan Docker images for vulnerabilities:
trivy image --severity HIGH,CRITICAL myapp:latest. - Kubernetes Hardening: Enforce Pod Security Standards (PSS). Apply a restrictive policy:
kubectl apply -f pss-restricted.yaml. - Cloud IAM: Implement the principle of least privilege. Use AWS CLI to list overly permissive roles:
aws iam list-roles | grep -A 5 "Action": "".
What Undercode Say:
- Key Takeaway 1: Offensive security is evolving rapidly. Physical skimming (Chupa Cabra) remains a significant threat in Latin America, but the most sophisticated attacks are now targeting the contactless payment protocols (EMV) that underpin global digital wallets.
- Key Takeaway 2: The macOS threat landscape is maturing. Security professionals can no longer assume that “Macs don’t get viruses.” Understanding how to bypass Gatekeeper, SIP, and XProtect is essential for effective red teaming and endpoint defense.
- Analysis: The BxSec 2026 agenda reflects a holistic approach to security, spanning hardware, software, and human factors. The inclusion of AI in both offensive (bypassing RASP) and defensive (OT monitoring) contexts highlights the double-edged nature of modern technology. The community-driven nature of BxSec, fostering networking and knowledge sharing among over 600 attendees, is a critical component in building a resilient cybersecurity ecosystem.
Prediction:
- -1: The EMV PIN bypass techniques demonstrated will likely be weaponized by cybercriminal groups within the next 12 months, leading to a surge in contactless fraud. Financial institutions will be forced to issue new cards with enhanced cryptographic protocols, a costly and logistically challenging process.
- -1: As macOS adoption increases in enterprise environments, we will see a corresponding rise in macOS-specific ransomware and info-stealers. The techniques shared by Zoziel P. will lower the barrier to entry for malware developers targeting Apple ecosystems.
- +1: The integration of AI in OT security, as discussed in the conference, promises to significantly reduce detection times for industrial cyber-attacks. This will be a positive development for critical infrastructure protection, potentially preventing incidents like the Colonial Pipeline ransomware attack.
- +1: Community-driven conferences like BxSec are vital for democratizing cybersecurity knowledge. By making advanced technical content accessible, they help train the next generation of security professionals, ultimately strengthening the global defense posture.
▶️ Related Video (78% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: https://lnkd.in/p/eFFgvhgD – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
