This month is a double feature! Khang will start us off with a beginner-friendly look at Juice Shop, OWASP's intentionally-insecure web application made for starting professionals to see what vulnerabilities look like in the wild (and how to attack them, or fix them).

Then, Bhargab is back again to give us the break down on filesystems from first principles. This technical review will show how data is stored, accessed, and manipulated --essential knowledge for defense or offense.

Hardware is often the final frontier of security—once you have physical access, what can you actually find? This month, Bhargab returns for "Hardware Reverse Engineering 101." We'll move beyond the software layer to explore the fundamental techniques and tools used to dissect physical devices and understand their inner workings. We'll cover the basics of identifying components, analyzing data flows, and the methodologies used to uncover vulnerabilities in embedded systems. Whether you are interested in IoT security, firmware analysis, or just want to know what's happening under the hood of your favorite gadgets, this session will provide a foundational look at the world of hardware hacking.

This month, Bhargab will be demonstrating a live Bluetooth impersonation attack! Using a raspberry Pi and a Honda car radio, he'll show how extracting pairing keys allows an attacker to silently reconnect to a phone without any user interaction — enabling theft of SMS, contacts, placing unauthorized calls, and more. We will also dive into Bluetooth fundamentals and discuss account takeover via OTP hijacking, and potentially some hands-on time with ESP32s for a mini CTF!

Most Linux systems are configured through layers of manual changes, scattered config files, and hope. NixOS takes a radically different approach: your entire Linux environment, every tool, every config, every service, declared in code, version-controlled, and reproducible down to the bit.

This month, John Dorion gives us a practical introduction to building reproducible cybersecurity labs with Nix and NixOS. We'll cover how the Nix ecosystem works, from the package manager and language to flakes and declarative OS configuration, and walk through building a custom images. Beyond the fundamentals, we'll explore why this matters for security practitioners:

• Eliminating 'works on my machine' problems for CTFs, training, and workshops
• Building custom images and containers preloaded with your exact cybersecurity toolkit or the perfect vulnerable environment
• Building development/hacking environments that activate on a directory change
• Learning about the state of the hacking ecosystem in Nix/NixOS and how to navigate fragmented documentation

Large Language Models don't have to live in someone else's cloud. Current hardware makes it possible to run powerful AI models entirely on your own systems — giving you full control over capability, privacy, and experimentation.

This month, null0perat0r provides us a practical introduction to running local LLMs. We'll cover the hardware needed to run models at home or in the lab, the tooling ecosystem (LM Studio, Ollama, vLLM, llama.cpp, Open WebUI, and more), and what terms like quantization, GGUF, and MLX actually mean in practice.

Beyond setup, we'll explore why you should care:

• Keeping sensitive research and targets off third-party APIs
• Automating recon, analysis, and workflow augmentation
• Building AI assistants that can interact with real tools and local environments
• Running models offline, uncensored, and fully customizable

"Locks keep honest people honest." — But what about the curious ones? Join us for another evening of exploring the fascinating world of physical security! Whether you're a seasoned locksmith, a security enthusiast, or just someone who's ever wondered how locks actually work, this meetup is for you. We'll dive into the mechanics of locks, the ethics of lockpicking, and the creative ways to (legally!) bypass physical security. Newcomers are especially welcome: no experience needed, just curiosity!

We started last year with a lively conversation about what it means to have (or fake) an identity, or take one someone else's. This year, let's put that to practice. I'll have a stack of "character sheets" available, so be ready to step into another's shoes and get a feel for being someone else in a room full of strangers. Whether you call it social engineering, improv, or just good old-fashioned deception, the ability to craft a believable identity and sell it is a very powerful tool. No recordings, no judgment, just a simple game of wit, charm, and manipulation.

Let's take an opportunity this month to talk about the various ethics related to hacker culture. How do you feel about software or media piracy? Where does one draw the line between protecting assets and "hacking back"? When does ransomware go from a business liability to terrorism? We'll explore the ethical implications of these topics and discuss how they impact society. Bring your questions, opinions, and knowledge to contribute to the discussion.

This Friday, the CyberTigers — UofM's legendary CTF team — are bringing you a custom Bluetooth CTF! They've flashed ESB-32 devices with vulnerable firmware, and it's your chance to hack, exploit, and grab those flags. This event is open to the public and n00b friendly, so whether you're a seasoned hacker or just curious about CTFs, come test your skills and learn something new.

This Friday, let's dive into cryptography. From ancient art to cutting-edge science, we'll trace the evolution of secrecy, from Caesar's ciphers to the Enigma machine and the looming quantum revolution. Want to flex your skills? We'll break Pigpen ciphers, craft our own codes, and dissect the tools used by governments, hackers, and criminals worldwide. Whether you're here to learn, experiment, or outsmart the system, bring your curiosity and a taste for challenge.

The WiFi standard started off with what they called "Wired Equivalent Privacy" for encryption. These days, that kind of connection could be cracked wide open in a matter of seconds. This month, we'll cover the basics of WiFi hacking and discuss how its security has developed over the years.

DEFCON 33 is next week! Are you going? Are you ready? (Can I go with you?)

I had an absolute blast at my first DEFCON (31), which is what convinced me to start this meetup. Since then, we've gained a few members that have been going for much longer. Heck, one of our members is going to be speaking at Black Hat (DEFCON in a business suit) next week! Whether you're going or not, come and chat about all the excitement, maybe even start plans for going next year.

Go shoot some fireworks or come hang out at the Midsouth Makers... we will not be meeting at FIT this month!

Ever want to just hang out and eat pizza? Well here's your chance! We've got no agenda or topic for this meetup; just meeting up and eating pizza. I'll probably bug you to join the signal chat and socialize more on there too.

One of the core traits of all hackers is curiosity, the thirst for knowledge and new skills. But what does one do with that knowledge? Do they pursue money, power, or fame? Perhaps their motivations are more noble—or sinister. This month, we're exploring the intersection of hacking and activism, where the lines between rebellion, resistance, and retribution blur. From Anonymous to whistleblowers, hacktivism has reshaped how we view both hacking and cybersecurity. Join us as we dive into the ethical gray areas, the tools, and the true impact of hacktivism. Whether you're inspired, skeptical, or just curious, this meetup is for anyone who's ever wondered if their skills could make a difference—or spark a revolution.

Are you curious about how to uncover vulnerabilities in web applications and understand how attackers might exploit them? OWASP ZAP is your ultimate tool for learning and practicing web security. It's not just about finding flaws—it's about understanding the risks, seeing how they work, and learning how to fix them. By walking through real scenarios, ZAP lets you simulate attacks like SQL injection and XSS, giving you a practical way to see how vulnerabilities happen and how to defend against them. In this session, null0perat0r dives into ZAP, explores its features, and gives you hands-on experience so you can start identifying and mitigating security issues like a pro. Whether you're new to security or looking to sharpen your skills, this is a chance to learn by doing and take control of your application's defenses.

Ostrich Lab invites you to crack the mysteries of The Secret Farm, a re-release of our first-ever CTF challenge, set in the most suspicious ostrich farm you've ever seen. Behind the fences lie hidden exploits, cryptic puzzles, and a few feathered surprises.

Think you can outsmart the keepers and uncover what's really going on? Test your skills and see if you can make it out with more than just a trail of feathers. To take on this challenge, you'll need two things:

• A laptop
• Your sharpest problem-solving skills

After the contest, we'll walk through the full puzzle, breaking down every twist and turn. But first—can you uncover the truth on your own?

WE'RE DOING IT AGAIN!!

Keys are important. They open doors, start cars, and protect valuables. They come in different shapes and materials... and get lost easily. Or stolen. Or duplicated. And sometimes, they aren't necessary at all. This month, let's talk about keys, locks, doors, motion sensors, pressure plates, and all the other gadgets made to keep unwanted people from certain places, and ways to exploit those systems. We'll also talk a little about Locksport, what it is (and isn't), and how you can learn & practice the completely legal skill of lockpicking.

New Year, New You: How to Create a Fake Identity! This month let's discuss what an "identity" is, both online and otherwise. Join us for an engaging and thought-provoking evening where we explore the creative and strategic aspects of personal reinvention. All discussions are welcome, whether you're looking to refresh your online presence, trying to leave the country and disappear entirely, delve into the world of storytelling, or simply gain insights into how identities are constructed and perceived. We will share tips on crafting compelling narratives, managing digital footprints, and the ethical considerations of personal transformation. Bring your curiosity and leave with a toolkit for a fresh start in 2025!

There are certain tools every hacker is expected to have in their toolbox. For anyone who messes with web applications, one such essential tool is the Burp Suite. Burp Suite offers insight into everything client-side, allows a number of automations, and is heavily customizable through extensions. This December, null0perat0r is giving us an entry-level introduction and demonstration.

Ever wondered how the mundane can be the backbone of greatness? This month in Squirrel's talk "Boring things are still important in Cybersecurity," we'll explore how the seemingly unremarkable elements of our daily routines hold significant value in keeping our digital world safe. Get ready to discover why the ordinary is anything but boring when it comes to protecting our data and privacy.

This month we're taking a look inside the penetration testing process using Faction with null0perat0r! Faction is an open-source framework for automated penetration report generation and real-time collaboration. This tool allows teams to share attack payloads, notes, and findings efficiently. null0perat0r is a Memphis local security engineer, pen tester, full stack developer, and musician recently featured at Vegas DEFCON32.

MEMSEC has relocated! We are now in room 225 of the FedEx Institute of Technology at the University of Memphis. This month we will be discussing recent cybersecurity headlines, and the process of keeping up with all the news and changes in the industry. Let's cooperate and share ideas so that attendees can leave with several resources and strategies for staying afloat.

DEFCON is happening in a week!! About a year ago I went to my first DEFCON, and immediately started planning these events to keep riding that same high. This month's discussion will be about what to expect at DEFCON (or most any hacker conference, really). If you've been, please come and share your experience! Maybe we can do some organizing for anyone who is planning to go this year, too.

How do you protect sensitive information? What do you do when that information has been compromised? How different are these methods for personal versus professional use? This month we are discussing Data Loss Prevention, what tools and methods are available, how they might fail and what to do about that.

How easy is it to crack modern wifi, anyway? What is promiscuous mode, and what does that have to do with stealing passwords or intercepting network traffic? Do you know the difference between WEP and WPA, or WPA2 vs WPA3? In this session, let's talk about your experiences and favorite tools for good ole 802.11. Does none of this make any sense to you? Come on by anyway! We're very n00b friendly and someone here can certainly answer whatever questions you may have.

Cars have been heavily engineered to be physically secure, but how safe are their electronics? How much can they be remotely secured, tracked, controlled? How often is this already happening? This month's topic is car hacking. We will discuss infotainment systems, CANbus/OBD2, cellular/wireless attacks... and anything else we feel like talking about.

"To a hacker, a closed door is an insult, and a locked door is an outrage." — Steven Levy, Hackers: Heroes of the Computer Revolution

There's always been a large overlap between hackers and the sport/hobby of lockpicking. Let's discuss physical access security, mechanical locks, and anything else we feel like. The hackerspace also has some practice locks as well! I have a single pick set I can share but if you have a set please bring them as well (-:

From kidnapping scares, to fake employment applications, to 25-million dollar scams, generative AI has already become quite a powerful tool for social engineers. Let's talk about headlines, our experiences so far, strategies used in attacking, and how to mitigate attacks from this new threat vector.

Can't really escape discussion of AI this and AI that these days, huh? A friend of mine wrote a book not on using AI but on attacking the AI itself, and I'm just about finished reading it. So I figure a good topic for a round-table discussion today would be anything AI related in cybersecurity.

HackerMane will be doing a presentation on introductory USB attacks including Rubber Ducky and OMG devices, as well as how to create your own with cheap dev boards/microcontrollers.

As always, there will be free food!

Sorry folks, but we will be unable to host on the 1st and the rest of the month is generally too busy. We will be returning in January!

HackerMane showed how easy it is to build and flash new firmware on a Flipper Zero.

Great meeting! A couple of return visitors and a few new faces. null0perat0r demoed his BurpSuite plugin, NoPE Proxy, and showed us how it can be used to MitM mobile apps (or anything using websockets).

Our first meeting! Nearly a dozen visitors and great conversations!