Black Hat had a reduction that was obvious, but that makes sense, since it's more corporate and government based attendance, it's also more expensive and formal.

Hackers, Network administrators, Security Experts, Wannabe hackers, wannabe security experts, Federal Agents (the kind that can arrest you), Lawyers(the kind that can sue you) and me.

This counter culture entrenched group is a convergence of the dark side of the force mingling with the light side (We legitimize our presence by thinking of our selves as modern day jedi knights). It's legitimized by the size of the crowd and feared by all because of it's legitimacy. There are freaks, mad scientists, angry digital citizens,  messed up people with power because of their skills and lack of respect for anyone, I mean anyone... especially those that are technically stupider then them and all around anti social people in large proportions. There are also nice, carefree, sexually free teddy bear huggers here as well. It all seems to fit very well.

It became painfully obvious over a year ago that the hackers were not just script kiddies, trying to break into stuff just because they could, but that real professional organizations of hundreds of hackers were forcefully trying to constantly penetrate our servers. I decided that I had to step it up and learn more about the black craft of hacking in order to create measures and counter measures to the constant attacks. It is not longer if you will be hacked, it's when you will be.

My travel plans changed at the last minute and I was able to go. Already attending were lots (12?) of Southern Oregon Alum and Students. (We started something last year that is growing - which makes it more work to coordinate with everyone) The good news about the recession is last minute travel doesn't penalize you.

No pre-registration, so it was easy for me to get in, even last minute. I got my hotel room the night before because of a flight change and we were ready to go. I just had to get in line and pay cash.

When you do not pre-register, in fact you don't register at all, it's all anonymous, you have no idea how many badges to make. Since these are special badges, many people went without this year.

Wait in line to get your badge - A long, long line.

Hacking the AppleTV

A great session on how cool the apple tv is to hack. it was hacked in less then 5 minutes in front of our eyes and the additional functionality that it gained post-hack turned it into an amazing home entertainment system even beyond what Apple has. I watched intently as I am currently trying to find a great solution for my customers that provides all the capabilities of the apple tv and a dvr.

I love the AppleTV because it is fanless. Having the xbox 360 in my family room has been a nasty experience because of how loud it is.

A whimsical, funny, engaging presentation by a master electronic solderer, dcFlux. I loved his style. Part Nerd, Part Mad Scientist, Part different. He showed what tools he uses to solder and how he removes parts and puts parts back on and cleans up after himself so that you can't look at the circuit board and tell that any of the chips are different. He knows his craft. He told us never to solder naked.

He shared with us that Microsoft's factory (as well as boeing and others) have had massive problems because of the non-lead based solder that society is requiring them all to use. There is a new phenomena called "whiskers" that grow from lead free solder.

 

Microsoft has a 38% failure rate of xbox 360's even before leaving the factory floor and as I can attest a even higher rate of failure in the first year of operation. "Whiskers" have even brought down satellites and shorted out critical systems all over the globe.

I found myself remembering my childhood and how I used to spend hours soldering electronic circuitry in my room. I loved it. I want to do it again. Mid-life crisis twinges inside me.

I saw a high level Nasa official looking at me with a certain look of disgust, I haven't shaved in weeks and small children run from me screaming when they look upon my scruffy face (he was probably looking for his 30 something year old, basement living son, somewhere in the crowd)

I wore a shirt today that I got at PAX ("Getting BOOTY since 1720 - Pirates") that had several young women come up and rub my chest and tell me they loved my shirt.

I did not give them more then a smile, trust me, trust no-one at this conference. 

Welcome to DefCon and Making/Hacking the Badge traditionally starts the conference and was traditionally started late by the founder, Dark Tangent, a young, clever man that started DefCon 17 years ago, when I assume he was 12, by the looks of him. He defies the stereotypical hacker look. He looks very GQ.

He welcomed us and introduced us to KingPin (yes all real hackers go by handles and no, I do not have one) the designer of the badge. The badge is a work of art. It is like no other conference badge I have ever seen. It is a painted printed circuit board with real unique circuitry. KingPin's walk through of the circuit found me staring at the work of art several times, admiring the clean simplicity of it's design and the sexiness of the technical elegance. The badge this year has a RGB led, a microphone and a single cpu. It's colors shift as you hear sound in different places. In fact one hack is that when Kingpin played a tone during one of his slides, all of our badges rebooted. Cool. They have a hack the badge contest that people participate in to try to impress Kingpin and win the coveted black badge of honor. There are 7 different badge types, most of which are Human, for us attendees, but there are others such as Goon (more on them later), vendor, Press and so forth. If you bring the badges together they will react and commands will be sent from the Human to all the others to get them to do something.

Defcon is held in the Riviera, I assume because of cost. The hotel cannot handle our shear numbers. It is a real world example of taking a castle by storm. We fill every hallway, every corner, every chair, every nook in the conference center. It is the worse design I have ever seen for moving people to sessions, but they do a commendable job in crowd control. They are of course "Goons". These red shirt clad warriors are loud, strong, mean and in charge. They are drill sergeants and we are the recruits. They yell at us to control us and we obey. They drink beer while they work and cuss at us like pirates and we scurry out of the way. Even though there are times where I fear a stampede I do enjoy the Goons and how they berate us. I always smile at them as they yell, and yes sometimes they yell about my smile, but it's all part of the fun. I think they are having fun or why would they do it.

There are over 6000 hackers here and they have 99.999% uptime, since most of them are men of one form or another. Most are social misfits, some are corporate hacks slumming as an excuse to get to vegas and not work. But they are men and men have testosterone, yes even nerdy men. The Goons fire huge SCUD missiles filled with it and I find that most men here just ooze it, mine is encased deep in my heart, throbbing, but it is there. So the less then 1% women are showered in it and many seem to enjoy it.  The red-headed Gypsies revel in it and leverage it all to their benefit. There is not a safe man in the building. Many flaunt what they have with costumes and ducktape. Many hide behind their thick glasses, long straight hair and intense gazes.

I am of course just reflecting on what I see, I will attempt to interview a few at the after parties and see if I'm right. The counter culture gypsies are the ones I will stay away from. They can hypnotize you with their eyes and make you succumb to them with whispers of hacking, firewalls, open source, frag fests, lock picking and hand cuffs.

This talk was a little elementary but it gave a good couple of DOD tips on how to set up your network and it showed "war games" that are now played out by the military that are entirely cyber based. The network design was notable and the counter measures are what interest me. They currently "upgraded" to FreeBSD for many services. This is a constant theme I heard through out the conference so far. I made a note to review this with the team when I get back.

A nice little talk put on by 3 young college boys that  showed how you could use the bluetooth and infrared in Wii wireless controllers and a pair of special glasses they constructed for $10 to allow someone to control the computer with no hands. Feet are required if they want to use the Wii Fit board. This was inline with the EKG session I was intrigued with from last year. I find myself wishing I could do more.

Hacking with the iPod Touch

A standing room only talk. (Side note, most people here at defcon seem to be using an iPhone). Jailbreak your ipod touch and turn it into a perfect little hacking tool for Pen Testing (that's short for Penetration Testing, where you purposely hack into your network). He also showed how to surface mount it and provide power to it so that it can hack an office from inside unnoticed.

Standing room only. These rooms are all large. 1,000 seat auditoriums. Crazy hack on the blizzard API to make bots that cheat in the game. 11 million people pay $15 a month to play this game online. Hackers spend sleepless nights attempting to hack it's system. Blizzard's counter measures run the gamut from lawyers, policy makers, security experts and a few hackers I'm sure.

Reverse engineering by crayon, game changing Hypervisor based malware analysis and visualization

An academia based presentation on how to reverse engineer apps to find out what they are doing on your systems and network. Not as exciting as some of the other talks, but very informative.

Jason Scott is a very outspoken and humorous presenter that had us laughing most of the presentation. He showed us how he was sued because of something that was on his server for $2B and what he did about it. His moral was no matter how absurd it was, it was a real lawsuit and demanded attention. He was smart "ass" enough to ride it out and come out ok. But he showed us why others might fall prey to the just pay now and put it behind us.

Freakshow was a great title for this. It freaked me out. Sent chills up and down my spine several times. These computer security experts showed real world case studies and forensics of malware from casinos, restaurants and other POS systems that scanned your credit card data and sold it. It makes me feel vulnerable. It makes me wonder what we have done to ourselves. Normal programs that Microsoft windows uses to run, were not really what they seemed and they were malicious. Malware infects most people with computers. Shiver me timbers.

A great talk put on by one of my favorite hacker speakers, Potter. He loves Team Fortress 2 and showed how to hack the server to do certain things. He talked about the game industry in the same way I think of it, a giant furball of computers, software and networking. Gaming is a 34 Billion dollar business and it's all just as vulnerable.
He also set up a TF2 tourney and I visited that room to check it out. The game looks fun and I can't wait to play it. I bought the Orange box because of his fan boyness last year but my xbox 360 died and I can't play it. I might buy the PC version.

I'll write more about the game after I play it.

This benign looking older hacker (in his late 50's?) from New york showed how he built a EMP generator from parts on his kitchen table and how he can send pulses to disrupt electronic devices. Eerily he talked about airplanes, subways, acts of terror and showed how easy it was to force systems to never be able to reboot because of the constant pulsing.

I have to admit, this one creeped me out. The room was packed. People were smiling as they watched how this man built a EMP pulse generator. I could see wheels turning in their heads. I left the room a little queazy.

I realized I forgot to eat today. My head was throbbing. I wandered as far away from the hackers as I could. The red-headed sirens taunt to party had no effect on me. I needed peace and quiet and found it in my room. I opened my laptop and decided to write it all down.

One of the more intriguing elements of the DefCon is how some of the presenters drink beer while presenting and even those that do not seem to use the F word in every sentence.  It makes for some interesting presentations.

An interesting presentation by KingPin and Woz on how they hacked the parking meters in San Francisco. Apparently the city spent $20+ million dollars on a pilot project to put in super secure smart card based meters. They were able to order a surplus meter on ebay, hack it and figure out how easy it was to change the smart card. They then made a smart card that would give itself the maximum amount of money 999.99 and free unlimited parking every-time you used it. They did release the code but they are hackers with a conscious they pre announced the hack to the SF transit folks and they removed all the code parts that would allow people to duplicate it for SF. Key takeaways. 1. The meters are 1 of 3 manufacturers of meters globally. Hack one, Hack them all. 2. The "Pilot" project cost $20+ million and it was not evaluated for security and 3. Hardware hacking is cool. I was getting excited.

I fell in love with hardware hacking after seeing this. Two young college aged men from France used a French military contract to pay for their hack. They created a quad(4) rotor(propellor) flying machine that they controlled with remote controls. They did not know or want to know anything about aeronautics when starting so they built a quad rotor helicopter thinking that they would not need to know anything to get it to fly. They had video of all the flights. First flight was short, wobbly, scary but very cool. They then realized the stabilizing the craft was not fun so they hacked a processor to stabilize it and all they had to do was control speed, direction and lift. Second video. Success. The video showed them pushing it as it hovered and it would auto-react and stabilize. Very Cool. They they hacked digital cameras starting with pc type cameras but it sucked. They wanted spy quality. So they hacked a digital camera added telemetry and were able to capture shots. But they wanted more resolution so they hacked 3 of the camera's together, controlled it with remote controls and were able to take 30 megapixel images and movies.

They then took us outside to a field (we climbed fence) outside of the hotel grounds (no permission) and demo's it live. I have video from my iPhone. Amazing, Fun and very, very cool. Click here to view my video.

The more things change the more things stay the same. Examples of the same security pitfalls we have been working so hard to stop are found in the webs largest sites. Mashups are the most interesting since they are by nature cross site scripting. Portals and widgets sending clear text authentication and linking sites in a single sign on kind of fashion allowing something that should not have access to have full access to all your other accounts. Also, interesting issue around data. If you mashup data on google maps about your customers, or sex offenders or any other geo spatial data you have, who has access to that?

Adam Savage is from MythBusters, a Discovery Channel show. The lines for this were long, long, long. People waited in line for hours to see him. I just went upstairs for some lock picking training and watched it on tv monitors, no muss, no fuss. Celebrity is a human condition. Even hackers are charmed by TV personalities. His talk was about failure and how he has had some doozie of failures in his life. He shared them and then told us not to trust anyone that says they haven't failed. The key message was also about teamwork. You cannot do it all alone.

KingPin and Woz were back on stage talking about a short run series they did on Discovery Channel (is there a theme here) called Prototype this. They showed each episode and how they hacked together the solutions. The premise of the show was to prototype something from design, development and production in 2 weeks time. They did a firefighter helmet with Heads Up Display and nozzles in your jacket that would shoot out a fire from 20 feet. (Cool super hero look) and remote control lifeguard and lifevest canon, waterslide simulator ride and a self parking car that would elevate itself above another parked car. Cool projects. Lots of insight to the process of TV and how many takes something like walking into a room to meet a guy for the first time would take and they key message here was do not believe anything you see on TV.

How does all our power in the US get distributed? How will terrorists take down the grid? How will smart homes allow hackers to take over your home? How can you manipulate electric usage of other people to throw the feds off you tracks?

People have hacked the consumer reporting agencies for years. They manipulate what shows up on your credit report and when. They can get $100,000 in credit in a day because of the way the system works. They can manipulate bad credit on enemies.

A room was set up for Team Fortress 2 tournament play. I didn't get a chance to play but I watched until I was ready to throw up. This insanely fast moving, first person shooter has very cool art style and fun humor injected in the game play. I want to get this game for the fair next year. I bought this game after hearing about it last year, for my xbox 360, which broke and it also requires xbox live, so now I'm thinking I need to buy the pc version.

The room also had a fully working, full scale, real world PDP 11 mini computer setup with terminals and tape to tape reels. Very cool retro lounge. The guys had side burns and there was a dj playing 8 track tapes and records with quadraphonic sound. The floor was marked where the sweet spot was so you knew where to stand to listen.

Military experts explaining and denying any cyber warfare. Great panel, great talk, great questions. Very interesting. It got me thinking. One panelist warned us not to fight back against a foriegn attack as it might be considered an act of war. Interesting. I also wonder about a war. war today is usually country based. What about online? What faction will you be in? Will hackers feel a sense of patriotism and want to enlist? Will protestors stand on the street saying no more "hacking"?

I've been at the MGM 2 weeks prior for a pool party. This sir was no pool party. Discussion on killer bees attacking pool party goers. Are they real? or is this some crazy hack? Like I said, trust no one.

I have to say I like the buffet at Treasure Island. (We tried several) It had several varieties of fresh food and all of it was excellent. The desert is all made onsite and the service was outstanding.

An amazing talk by Richard Thieme (I need to buy his book - www.thiemeworks.com) that was spoken like a sermon. He spoke of hackers and biohacking and genome hacking and DIY scientists and what is a hacker and where will it all go? And what the heck have we created and where is it all going? Human transformation was at the root of his spirited talk. He was a breath of fresh air and had nothing seemingly prepared but spoke as if it were all prepared. He said many things that I agree with and many things I do not, but in the end 4 people gave him a standing ovation (out of 2,000) and I was one of them.

A great followup to the first talk. The speaker was my favorite from last year, Ne0nRa1n. 1. She's deeply intelligent, witty and funny. 2. She wore wings 3. She has died pink, red, purple hair and 4. She's hot! (you knew that was coming). Anyways as a follow up to last years talk when she built her own EKG based video game she build a sleep lab. (She has lots of help) The sleep lab was presented after her long presentation on sleep and dreaming and stages and dolphins sleeping one side of the brain at a time. If you think about your sleep and how when working late you wish you didn't have to sleep, this hack might be a gateway for future hackers to realize what is sleep and what can they do in sleep and how do you get REM sleep sooner, especially after being up for 30 hours straight.

A nice presentation on a device (broken for demo) that would counter act the motion sickness we feel at times. It was in the form of a baseball cap and lots of wires (reminds me of the ekg hack from last year) around your brain. Remember the crazy scientist in back to the future. He was a hacker. I find myself dreaming during these biohacking sessions. My mind is racing faster and faster with possibilities. I'm wishing I could just work on this full time.

Lawyer and Security guy presented on the legalities of what's on your mind. Most of us share it via twitter and facebook. Thought crime police force are becoming more and more possible because of the tools we use today to blog what we have going on in our lives. The social misfits known as hackers are no different. They share what they are working on and what they are thinking about doing. We also share what we eat and consume when we purchase in a store with credit cards and rewards club cards. Cops can get access to all of this and string it all together.

I didn't do awards last year and I don't know if I will again. I found myself drained, mentally and physically. Some cool tidbits came from it. How much bandwidth they used. How many people did bad things on the network. Outcomes from all the contests and I realized that people come for different reasons. Some people played all weekend. Some people competed in contests and did not attend any sessions. Interesting. I don't know if I could do that.

There is a cool area with vendors selling wallets, handcuffs (fuzzy and not so fuzzy), sexy stuff (leather, vinyl and latex?), books, smokeless cigarettes, DJ selling music they played all week. (I found myself liking much of the music and supporting these artists as much as I could) and lots and lots and lots of tshirts.

I took the gang to a farewell drink (tradition) where we debrief and I get them drunk on their last night in Las Vegas. The sangrias from this place we go are amazing (and the tapas are awesome) and I love hanging out and having fun with these guys from Southern Oregon University, I learn a lot from them.

I didn't make it through defcon without drinking.

 

I learned a lot. I'm more paranoid then I was before I got here and I'm planning next years already. I do find myself wishing that I could be a hardware hacker. I find that very, very intriguing.

 

Lots and lots of stuff I did not cover. Maybe later.
 
 
 
 
 

1.  I was visiting Paul one day when Steve walked in with David's old football jersey and showed it to Paul and Paul jumped up and gave Steve a huge hug filled with happy/sad tears.

2. The church ceremony that was filled to capacity and Paul gave a powerful and moving eulogy of his son, sharing their last conversation and showing the entire community the strongest, loving, caring, faith-filled man I have been blessed to call my friend. In that same ceremony, David's sister, Christianne, gave a eulogy that showed deeper strength then I would ever hope to have.

3. The community ceremony that filled the football stadium where David's friends shared stories and memories and the larger community ceremony that filled the Amphitheater, that reminded me about all the other lives lost that day and all the other families effected.

4. The number of people in our community that came out to help.

5. The outpouring of love and sorrow from our clients. It still to this day, reminds me why we work so hard for our clients. We are not just vendors, we care about them, take care of them and when in need they take care of us.