Skip to main content
Lama Alshuhail

Lama Alshuhail

Cybersecurity Researcher
Independent
Cybersecurity and Digital Forensics graduate from Imam Abdulrahman Bin Faisal University, First Honors. Research focuses on machine learning for industrial control system security and adversarial attacks against machine learning pipelines. Published in Sci (MDPI) and ISDIA-2026 (Springer). Builds what she researches, including an ICS operator behavioral detection system and a portable mobile forensics device. Black Hat MEA CTF finalist, third at the Gulf Cybersecurity Forum in Doha, shortlisted for AIREA 2026 with a final pitch at The Education University of Hong Kong. Holds ICS300 from Idaho National Laboratory.

Speaker sessions

Briefings and Arsenals | Confirmed Speakers | No Session Assigned

Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
  • 07:30
  • Tue
  • 01 Dec
Stage: Briefing Stage 2
Sessions Type: Keynote

Pixtra: iOS Forensic Triage on a Raspberry Pi

Pixtra is an iOS mobile forensic triage platform built to run entirely on a Raspberry Pi 5 with a 7-inch touchscreen. No cloud, no foreign vendor, no data leaving the device. The tool acquires, decrypts, and parses encrypted iTunes backups, surfacing over one million artifacts across 13 evidence categories: WhatsApp, SMS, iMessage, GPS-tagged photos with automated trip detection, contacts, call history, browser history, calendar, wallet passes, AirDrop identity recovery, Bluetooth paired devices, Apple Watch history, and a keychain inventory of 8,652 items indexed by protection class, including generic passwords, internet passwords, certificates, and private keys. Beyond backup parsing, Pixtra performs live SIM card extraction via PC/SC smart card reader, pulling ATR, ICCID, IMSI, MCC/MNC breakdown, and the full APDU command trail. SIM and handset are treated as linked entities within a case, preserving chain of custody for each physical object while enabling cross-source timeline reconstruction. Chain of custody is enforced via SHA-256 hash manifests per acquisition, an append-only hash-chained JSONL audit log that is tamper-evident rather than tamper-proof, a distinction explained in the demo, and fstab-anchored evidence storage that survives USB hot-swap without losing case state. Arabic-language context’s the core differentiator. Saudi investigators currently depend on foreign tools that process sensitive data abroad and degrade Arabic dialect, cultural nuance, and mixed-script content. Pixtra’s designed from the ground up for the GCC investigative workflow. An NCA Phase 1 grant application is in submission for an Arabic-aware AI triage layer covering entity extraction, dialect-aware classification, and semantic search on Arabic forensic data.
  • 14:40
  • Tue
  • 01 Dec
Stage: Arsenal 4
Sessions Type: Keynote

Every Command Was Valid: Operator Behavior Monitoring for the ICS HMI Blind Spot

On 23 December 2015, operators at three Ukrainian distribution companies watched their own HMI cursors move across the screen and open circuit breakers. They could not stop it. One operator was logged out of his workstation and could not log back in, because the password had been changed. Two hundred and twenty-five thousand customers lost power.The attackers were not exploiting a vulnerability. They were using stolen credentials to operate the HMI the way an operator operates it. The E-ISAC and SANS analysis of the incident makes the defensive problem explicit: application whitelisting on the operator HMI will not help against software that is already authorized.That is the gap this session addresses. Commercial OT platforms monitor infrastructure: network traffic, sensor values, control logic. None of them monitor the operator. When an attacker holds working credentials and issues in-range commands through the interface, the stack stays silent, and this is architectural rather than a configuration failure.Studying it required building the environment first: a gas pipeline simulator with a three-zone hydraulic model, PID control, fault injection, a web HMI, a Modbus TCP server for external SCADA integration, and a six-phase shift protocol. Twenty-four operators, including practicing ICS engineers, ran 160 sessions in it.Detection uses eighteen behavioral features across five layers, correlated to MITRE ATT&CK for ICS. Cross-operator validation flagged 17 of 20 identity mismatches. I will present what the evaluation showed, including where it works and where it does not.
  • 15:10
  • Thu
  • 03 Dec
Stage: Briefing Stage 1
Sessions Type: Keynote