HITCON (Hacks In Taiwan Conference)

HITCON, short for "Hacks In Taiwan Conference" (台灣駭客年會), is Taiwan's best-known information security conference, held annually since 2005. According to HITCON's own conference materials, it describes itself as "an annual, vendor-neutral cybersecurity conference since 2005, dedicated to sharing commercial-free research, bleeding-edge hacking technologies, and advanced security practices through talks and community engagement." The inaugural event, "Hacks In Taiwan 2005," established the format that continues today: a non-commercial venue where researchers present original technical work.

HITCON is a community-organized event rather than a single company's product. Its 2024 edition listed the Taiwan-based groups HIT (Hackers In Taiwan) and CHROOT alongside the security firm DevCore among its organizing partners and sponsors, reflecting HITCON's roots in Taiwan's grassroots hacker/security scene rather than a single founder. No single founder is consistently documented across available sources, consistent with treating this as a group/organizational entry.

Growth and Format

Over two decades, HITCON expanded from a single conference into several distinct tracks and sub-events documented on its own site archive (spanning 2005–2026): the main community talk track (CMT), an enterprise track (ENT), HITCON CTF (a globally recognized capture-the-flag competition), CyberRange hands-on training, a CISO Summit for security executives, and in earlier years an international/regional edition called HITCON Pacific. In 2023 several of these were combined under a "Carnival" format.

Notable Editions and Disclosures

HITCON has served as a venue for significant public security disclosures in Taiwan. At the sixth HITCON (2010), National Taiwan University professor Cheng Chen-mou (鄭振牟) publicly demonstrated a method to alter stored balances on Taiwan's EasyCard (悠遊卡) transit cards, exposing weaknesses the card issuer had reportedly known about but not fully addressed — a disclosure documented on Chinese Wikipedia's EasyCard article. In December 2014, HITCON worked alongside Trend Micro to notify game publisher Garena of a PlugX malware compromise affecting League of Legends and Path of Exile distribution files, an incident later attributed to the Winnti Group. HITCON's CMT track has also hosted the traveling "Wall of Sheep" security-awareness exhibit (seen at HITCON CMT 2019), the same exhibit format used at DEF CON and Black Hat.

The 2024 edition, held at Academia Sinica in Taipei under the theme "Mind Meld: Hacker Spirit from Human to AI," marked HITCON's 20th anniversary and featured a keynote from longtime security researcher Saumil Shah ("25 Years of Attacks and Defense"), alongside talks on VPN vulnerabilities, APT groups (Tropic Trooper, Kimsuky), LLM prompt-injection attacks, and kernel exploitation. The 2025 edition ran under the theme "Perimeter Security is Dead, Long Live Resilience," addressing ransomware, critical-infrastructure resilience, and the EU Cyber Resilience Act.

Through its continuous run since 2005, HITCON is widely regarded as a central pillar of Taiwan's security research community and a recognized fixture in the broader Asia-Pacific hacker-conference circuit alongside events like DEF CON and Black Hat.

Timeline

• 2005HITCON founded; inaugural event "Hacks In Taiwan 2005" (台灣駭客年會) held, establishing an annual, vendor-neutral security research conference in Taiwan.
• 2010-07At the 6th HITCON, NTU professor Cheng Chen-mou publicly demonstrates a vulnerability allowing manipulation of stored balances on Taiwan's EasyCard transit cards.
• 2014-12-26HITCON, working with Trend Micro, notifies Garena of a PlugX malware compromise affecting League of Legends and Path of Exile game files, later attributed to the Winnti Group.
• 2019HITCON CMT 2019 hosts the "Wall of Sheep" security-awareness exhibit, also used at DEF CON and Black Hat.
• 2024HITCON marks its 20th anniversary; CMT held at Academia Sinica, Taipei, under the theme "Mind Meld: Hacker Spirit from Human to AI," with a keynote by Saumil Shah.
• 2025HITCON CMT held under the theme "Perimeter Security is Dead, Long Live Resilience," focused on cyber resilience and critical-infrastructure security.