DEF CON 33 - Locked Down, Not Locked Out: How I Escaped Yr Secure Operator Workstation - Aaron Boyd

Based on the feedback and the transcript, here's a revised summary that more accurately captures the content, structure, and emphasis of Aaron Boyd's presentation:

Revised Summary:
"Locked down" operator workstations in industrial environments consistently fail to provide real security due to fundamental implementation gaps and cultural issues, necessitating a shift from checklist compliance to adversarial testing and ownership 12:12-12:18.

Key Vulnerabilities:
• Bypassed Controls: Misconfigured GPOs and allow-listing tools allow attackers to rename malicious executables (e.g., PowerShell as "alarms.exe") to bypass restrictions, exploiting the gap between policy intent and enforcement 1:29-3:01.
• Ineffective Allow-Listing: Tools like McAfee Solid Core or App Locker are frequently left in "learning mode," creating a false sense of security while permitting unapproved binaries and living-off-the-land techniques (e.g., bitsadmin, regsvr32) 4:16-5:02.
• Pervasive Default Credentials: Vendor-supplied passwords are reused system-wide; in 39 recent assessments of a specific DCS solution, 38 used identical credentials 5:57-6:58.
• Exploitable Login Scripts: Editable scripts often contain hard-coded secrets or can be modified to create privileged accounts, enabling lateral movement via pass-the-hash attacks 8:23-8:16.

Root Causes:

• Vendor/Integrator Shortcuts: Pressure for rapid deployment leads to reused, unvalidated configurations and "set-it-and-forget-it" security tools 9:59-10:11.
• Compliance Over Security: Checklists (e.g., "Is allow-listing enabled?") replace adversarial testing, creating blin