Speaker 1: Get in texts with technology with tex Stuff from stuff
Speaker 1: works dot com. Hey there, and welcome to tex Stuff.
Speaker 1: I'm your host, senior writer, Jonathan Strickland. I worked for
Speaker 1: how stuff works dot com been recording text stuff since
Speaker 1: two thousand eight, and I cannot believe that I've gone
Speaker 1: that long without covering this next topic. I'm talking about
Speaker 1: def Con. It's a really interesting subject. I've touched on
Speaker 1: it once or twice in the past, and I've talked
Speaker 1: to people who have presented at def Con or attended
Speaker 1: def Con. I personally have never been to one, but
Speaker 1: I felt like now was the time. It would be
Speaker 1: really cool to take a look at a conference filled
Speaker 1: with people who know all about bypassing security and getting
Speaker 1: to all of your precious secrets. These are hackers and
Speaker 1: security experts who can identify vulnerabilities and weak implementations and
Speaker 1: then exploit them. It's a conference where if you're not careful,
Speaker 1: you'll be publicly mocked for your poor security protocols. And
Speaker 1: it's called def Con. Jeff Moss, who is a hacker
Speaker 1: who used the handle the dark Tangent, founded the conference
Speaker 1: back in Moss operates some bulletin board systems or bbs
Speaker 1: is back in the early nineties on Phyto networks, and
Speaker 1: you may have my brother has forgotten what these bbs
Speaker 1: is would like. Things changing so scoring nowadays and people
Speaker 1: quick to forget, So I thought maybe we should go
Speaker 1: back and talk about what the heck is a bulletin
Speaker 1: board system? What is phto net well, A bulletin board
Speaker 1: system is a pretty simple concept. You have a host
Speaker 1: computer running some special software, and that software sets aside
Speaker 1: certain assets for the bulletin board system or BBS, such
Speaker 1: as hard drive storage space and maybe uh filing system
Speaker 1: of some sort of navigation system, a user interface, if
Speaker 1: you will, and this would typically include this message board system.
Speaker 1: It allows participants to communicate with each other, typically asynchronously,
Speaker 1: which means that you could leave a message and then
Speaker 1: the next time someone checks in they could read their
Speaker 1: messages respond to them. The next time you check in
Speaker 1: you could see the responses, very similar to email um
Speaker 1: and many bbs is would only allow one person to
Speaker 1: connect to the bbs at a time because you actually
Speaker 1: were using dial up modems in those days. So you
Speaker 1: hook up a dial up modem to your computer, it
Speaker 1: would call out a number using the telephone system. The
Speaker 1: plain old telephone system or pots, if you will, and
Speaker 1: that would dial up the host computer's modem, which would
Speaker 1: then allow you to connect. And some would have the
Speaker 1: capacity for multiple connections, maybe up to three or so,
Speaker 1: but a lot were just single connections and you would
Speaker 1: be you would have to wait if someone was already
Speaker 1: on there, you get a busy signal and you'd have
Speaker 1: to try again later. Uh. Many BBSs would include simple
Speaker 1: games or drives where you could upload or download files
Speaker 1: at incredibly slow speeds. Imagine the Internet if it were
Speaker 1: limited to just the stuff that was on this one
Speaker 1: guy's computer across town. And you kind of get the idea. Now,
Speaker 1: because we're talking about the era of dialot modems, we're
Speaker 1: also talking about time when long distance calls were expensive
Speaker 1: and there was no free long distance in those days
Speaker 1: unless you were getting around the system. But we'll get
Speaker 1: into that. So you're spending money in order to connect
Speaker 1: to anything that's not within your area code. Typically most
Speaker 1: people would just stick to bbs is that we're in
Speaker 1: the area codes that were in the local dialing options
Speaker 1: that they had, and initially that was the only way
Speaker 1: you could check messages on other bbs is you could
Speaker 1: you'd have to call into that BBS. So if you
Speaker 1: have a friend who's three cities over and they're technically
Speaker 1: in long distance range and you want to check any
Speaker 1: messages they were leaving for you on the their local BBS,
Speaker 1: you had to call a long distance or they had
Speaker 1: to do the same for your low gold BBS. There
Speaker 1: wasn't really any inner connectivity in the early days, So
Speaker 1: if your BBS of choice was called I don't know,
Speaker 1: let's say it's moss Eisley Cantina, So yours is moss
Speaker 1: Eiseley Cantina, my BBS of choice is called the Raven,
Speaker 1: we wouldn't be able to leave messages for each other
Speaker 1: unless we were willing to visit the other person's favorite BBS,
Speaker 1: and thus we'd be unable to share our love of
Speaker 1: Harrison Ford, who obviously inspired the names of both of
Speaker 1: those bbs is and bonus points if you know what
Speaker 1: the Raven is. But either way, one of us or
Speaker 1: both of us would have to spend money on a
Speaker 1: long distance call if we wanted to drop a communication
Speaker 1: to the other. But then along came Fido net, and
Speaker 1: this was a network designed in the nineteen eighties to
Speaker 1: allow different BBS is to have exchanges between them. So
Speaker 1: if both the Moss Eiseley Cantina and the Raven connected
Speaker 1: through Fido Net, you could communicate between the two. You
Speaker 1: could leave a message for your friend over at In
Speaker 1: my case, you would leave a message on the Raven
Speaker 1: for me, and the message you left at Moss Eisley
Speaker 1: Cantina would be relayed to the Raven. I could read
Speaker 1: your message. I could then send a message to you
Speaker 1: and it would be relayed to Moss Eisley Cantina and
Speaker 1: you could read it there. So again, very much like email,
Speaker 1: BBS culture allowed people who otherwise would have had problems
Speaker 1: meeting up with folks who shared their similar interests like
Speaker 1: I don't know, let's say hacking, for example, and I
Speaker 1: should probably talk about what hacking actually is now. The
Speaker 1: popular definition of hacking is very narrow and misleading. It
Speaker 1: tends to focus on super negative stuff like breaking into
Speaker 1: secure systems in order to steal stuff or commit sabotage
Speaker 1: or install malware. You know, you're designing viruses and worms
Speaker 1: in order to be some sort of online menace to society.
Speaker 1: But the basic definition of a hacker is just someone
Speaker 1: who wants to know how something works. They want to
Speaker 1: understand a system or a product or software or hardware.
Speaker 1: They just want to know how it works, and then
Speaker 1: how to make changes to it, how to tweak it
Speaker 1: so it does things it wasn't and just you know,
Speaker 1: expected to do it wasn't designed to do. You increase
Speaker 1: its utility by making it do other things, or maybe
Speaker 1: you do things better or often worse, but in an
Speaker 1: entertaining way. So they hack a system up and see
Speaker 1: what makes it tick, and then they put it back together.
Speaker 1: And sometimes they'll hack together code to accomplish something, and
Speaker 1: there's no requirement for that code to be in any
Speaker 1: way malicious or illegal. Hackers might make a program that
Speaker 1: lacks elegance or efficiency, but it gets the job done,
Speaker 1: and the same is true for hackers who work with
Speaker 1: physical gadgets as opposed to just code. They might make
Speaker 1: circuits that do nifty things, though it may be a
Speaker 1: primitive or particularly inelegant approach, refinement can come later. Hacking
Speaker 1: is just can I take this stuff and make it
Speaker 1: do what I wanted to do? So again, it could
Speaker 1: be hardware, it could be software, and there's also some
Speaker 1: social hacking as well. The ability to manipulate people into
Speaker 1: doing things, not necessarily maliciously, though frequently it is uh.
Speaker 1: Sometimes it's just meant as a way of seeing how
Speaker 1: people tick. That's really what hackers are interested in. So
Speaker 1: working for a company like how Stuff Works, we appeal
Speaker 1: to that same sort of sensibility, that sense of curiosity
Speaker 1: that wants to be uh satisfied by learning how the
Speaker 1: world works. Now back to Jeff Moss. He operated a
Speaker 1: few different bulletin board systems on Fido net, and his
Speaker 1: bulletin board systems were part of a larger network of
Speaker 1: people interested in hacking or freaking, which is sort of
Speaker 1: like the telephone system version of hacking. Now. I did
Speaker 1: a full episode about freaking years ago, and you can
Speaker 1: learn all about it, and also about some of the
Speaker 1: famous people who were freaks, like uh Wosniak so Wasniac
Speaker 1: being one of the co founders of Apple back in
Speaker 1: the seventies, was one of the phone freakers. You can
Speaker 1: also learn about Captain Crunch, who used a toy whistle
Speaker 1: found in cereal boxes to help hack the phone systems.
Speaker 1: These were people who were learning how those phone systems
Speaker 1: worked and then how to manipulate them. Whether it was
Speaker 1: to make long distance phone calls for free, or just
Speaker 1: to really figure out how all those network switches worked
Speaker 1: because it was interesting and not a lot of material
Speaker 1: was available publicly for people to look into. Uh Well,
Speaker 1: there were also people who were interested in just sharing information.
Speaker 1: They had access to information that they thought other people
Speaker 1: needed access to, and so they would use bolton board
Speaker 1: systems to disseminate that information to other folks. His BBS is,
Speaker 1: that is, Jeff Mosses BBS is connected to other systems
Speaker 1: located around the world through this network. Now, Mosses bb
Speaker 1: as were popular and he started to function as sort
Speaker 1: of the centralized hub for many of these other BBS platforms,
Speaker 1: including platforms like hacknet, freak Net, and platinum Net. There
Speaker 1: were eleven in total that used his BBS as sort
Speaker 1: of a connecting point, and platinum Net out of Canada
Speaker 1: had a request for moss or more specifically, the administrator
Speaker 1: of the BBS platinum Net, which was located in Canada,
Speaker 1: was asking moss for a favor. The operator of that
Speaker 1: BBS was going to go offline because quote his dad
Speaker 1: got a better job in the quote. So this was
Speaker 1: someone who is fairly young. One can presume living with
Speaker 1: his dad and that he was soon going to lose
Speaker 1: access to the computer they were using, the phone line
Speaker 1: they were using because they were going to relocate. And
Speaker 1: this is where we remember there were a lot of
Speaker 1: young folks really interested in the way computers and complicated
Speaker 1: systems worked, and the operator of Platinum Net was hoping
Speaker 1: that Jeff Moss would be able to organize a big bash,
Speaker 1: a big going away party for Platinum Net. Because Jeff
Speaker 1: Moss again was operating this sort of centralized hub and
Speaker 1: Moss was in the United States, whereas this guy was
Speaker 1: in Canada. So most of the members of these networks
Speaker 1: that we're using these bbs is happened to be in
Speaker 1: the US. That's why Platinum Net really wanted Jeff Moss
Speaker 1: to organize this, because he wanted as many of his
Speaker 1: friends to be able to go as possible, and it
Speaker 1: would be difficult to organize a party in the United
Speaker 1: States while you are actually in Canada. Now, Moss had
Speaker 1: talked to Platinum nets administrator. And by the way, the
Speaker 1: reason why I'm not using any names here is because
Speaker 1: Moss himself says he forgot the name of the kid
Speaker 1: from so many years ago. He's forgot what the kid's
Speaker 1: name was. So Moss decided that the best place to
Speaker 1: locate the party would be Las Vegas, Nevada, for a
Speaker 1: couple of different reasons. For one, he had never been
Speaker 1: to Vegas, so he was kind of curious. He's like,
Speaker 1: why don't we have the party in Vegas? And he
Speaker 1: felt that the party if it fell apart, if it
Speaker 1: was a bust and no one showed up, worst case scenario,
Speaker 1: he'd be sitting by a pool drinking a Pinia Colada
Speaker 1: in Las Vegas, Nevada. So he saw it as a
Speaker 1: win win, and that's when things took a turn. So
Speaker 1: platinum Net disappeared, the administrator that is of the BBS disappeared,
Speaker 1: the BBS itself went offline. Apparently his father took the
Speaker 1: job earlier than was expected, and Platinum Net went dark.
Speaker 1: So Moss had already begun preparations for this great, big
Speaker 1: party in Las Vegas, and people were already expecting a
Speaker 1: big shin dig. So Moss was left, as he said,
Speaker 1: holding the bag. He decided that instead of canceling it
Speaker 1: or making excuses, he would actually turn it up a notch.
Speaker 1: He decided to invite everyone across the eleven networks that
Speaker 1: were connected to his BBS, and then he got on
Speaker 1: I r C also known as Internet Relay Chat and
Speaker 1: posted to Pound hack and Pound freak or if you prefer,
Speaker 1: hashtag hack and hashtag freak in these days, and those
Speaker 1: are chat rooms. IRC uses the hashtag or pound symbol
Speaker 1: to designate different chat rooms. Back in the day, there
Speaker 1: was only one hack chat room and only one freak
Speaker 1: chat room, and he posted about the party there. Essentially,
Speaker 1: he was opening it up to everybody. He also says
Speaker 1: that he sent faxes out to tons of different people
Speaker 1: and organizations, including law enforcement agencies, agencies like the FBI
Speaker 1: and the Secret Service, and he said, we're gonna have
Speaker 1: a big hacking conference in Las Vegas. Now. Later on,
Speaker 1: he said he knew information about the gathering was gonna
Speaker 1: get out anyway. It was going to become public, so
Speaker 1: he might as well get in front of it and
Speaker 1: let people know ahead of time, rather than make it
Speaker 1: seem like he's trying to be secretive and that perhaps
Speaker 1: these people are up to no good. He wanted to
Speaker 1: get in front of that and say no, no, no,
Speaker 1: we're getting together to have a party. Yes, we're all folks.
Speaker 1: Who are interested in information security, but we're not clandestinely
Speaker 1: trying to take down the government or something. And now
Speaker 1: he had to call the party something, and he was
Speaker 1: thinking about different names and ultimately decided upon def Con
Speaker 1: D E, F C O N. Now, in military speak,
Speaker 1: def con as an acronym stands for defense readiness condition,
Speaker 1: and it's generally followed by a number. And here's how
Speaker 1: the scale breaks down. If you've ever heard about def
Speaker 1: con followed by number, this is what it means. Def
Speaker 1: Con five is normal peacetime readiness, meaning you are not
Speaker 1: on high alert in any way, shape or form. Def
Speaker 1: Con four is normal increased intelligence and strengthened security measures,
Speaker 1: so not quite as laid back as normal peacetime readiness.
Speaker 1: Def Con three is an increase in four readiness above
Speaker 1: normal readiness, so you've got perhaps some various military units
Speaker 1: and equipment on standby. Def Con two is further increase
Speaker 1: in force readiness, but less than maximum readiness, so somewhere
Speaker 1: in between being a little more ready than usual and
Speaker 1: being totally ready. Def Con one is maximum force readiness.
Speaker 1: You are ready to go to war at a moment's notice. Now,
Speaker 1: Moss like the term def con partly because it was
Speaker 1: in a film called War Games starring Matthew Broderick. Highly
Speaker 1: recommend that movie, by the way, It's one of my
Speaker 1: favorites from the eighties. In that movie, Broderick plays a
Speaker 1: young hacker who uncovers some interesting games that, unbeknownst to him,
Speaker 1: are controlled by a supercomputer called Whopper w O p
Speaker 1: R that stands for War Operation Planned Response, and that
Speaker 1: particular supercomputer belonged to the North American Aerospace Defense Command
Speaker 1: also known as NORAD, and it turns out that the
Speaker 1: supercomputer runs on a program that was designed by an
Speaker 1: eccentric programmer named Stephen Falcon. Now, Broderick's character, whose name
Speaker 1: is David Lightman, has no idea that he's accessed a
Speaker 1: defense computer. He was actually doing what he called war dialing.
Speaker 1: In in old days, people called demon dialing, which is
Speaker 1: where you would set up your computer's phone modem to
Speaker 1: just automatically dial a list of phone numbers, and your
Speaker 1: goal is to see if any of those phone numbers
Speaker 1: match up with another computer hooked up to a modem
Speaker 1: so that you can get access to that computer. In
Speaker 1: the movie, what Lightman is trying to do is he's
Speaker 1: heard about a computer game company, and he wants to
Speaker 1: play the games that that computer game company is making
Speaker 1: before they come out. He wants to play them and
Speaker 1: test them and find out they're worthwhile. So he said
Speaker 1: this list of numbers. Why he doesn't know is that
Speaker 1: his computer is actually called into a defense computer, not
Speaker 1: a gaming companies computer. He just thinks he's playing games.
Speaker 1: So he launches a game called Thermonuclear War, it's really
Speaker 1: a thermonuclear war simulator, and tries to decide where he'll
Speaker 1: attack first, and he decides cheekily that he's going to
Speaker 1: attack Las Vegas, Nevada. So Moss, who was living in
Speaker 1: Seattle at the time, uh the same place that David
Speaker 1: Lightman was supposed to be from, decides he's gonna hold
Speaker 1: a party in Las Vegas, and inspired by war games,
Speaker 1: he calls it def Con. He also mentioned that the
Speaker 1: letters D E F correspond to the phone key number three.
Speaker 1: So in the old text days, each number on a
Speaker 1: phone was related to three letters, and the number three
Speaker 1: was related to the letters D E n F. So
Speaker 1: that was where the phone freakers out in the audience.
Speaker 1: And at that first def Con Moss accepted cash only
Speaker 1: that is true today. By the way, it is a
Speaker 1: cash only experience, and about a hundred people showed up.
Speaker 1: They had a few speakers talk about various programming projects
Speaker 1: and concepts and information security. Moss says that everyone seemed
Speaker 1: to enjoy themselves, and afterwards he was completely exhausted and
Speaker 1: decided to go hibernate for a while. But then he
Speaker 1: started getting messages from people about how to improve the
Speaker 1: event for the next year, and a lot of requests about, hey,
Speaker 1: are you going to do this next year? And according
Speaker 1: to Moss, that was the first time he had ever
Speaker 1: considered making it an annual event. It was originally just
Speaker 1: gonna be this one time going away party. Remember it
Speaker 1: was originally going to be for Platinum Net, but Platinum
Speaker 1: Net had already gone away, and so he decided, well,
Speaker 1: I guess, I guess we can make it an annual party.
Speaker 1: Well they decided to hold it again the next year,
Speaker 1: and according to Moss, it was about twice the size
Speaker 1: of the year before, and then the third year they
Speaker 1: held it it increased in size again. And shenanigans would
Speaker 1: happen at these parties. For example, you might get into
Speaker 1: a building's elevator and discover that someone had rewired all
Speaker 1: the buttons, so they go to different floors than what
Speaker 1: you pushed. You might push floor three and end up
Speaker 1: on floor twelve, or you might see folks lugging around
Speaker 1: an enormous satellite up link dish for reasons that they
Speaker 1: wouldn't be willing to explain. But Moss says the tone
Speaker 1: of the conference really began to change around this time too.
Speaker 1: The Internet was starting to take off and information security
Speaker 1: was transitioning from something that people were interested in as
Speaker 1: a personal passion into a legitimate career, and Moss says
Speaker 1: that the years between def Con four, which would have
Speaker 1: been and when the bubble burst in two thousand one,
Speaker 1: the tone of the show had turned into one centered
Speaker 1: around money and commerce and less about the geeky technical
Speaker 1: details of how to get around problems or to ensure
Speaker 1: your own Internet security. We've got a lot more to
Speaker 1: talk about with def Con, including how it works and
Speaker 1: what goes on there, but first let's take a quick
Speaker 1: break to thank our sponsor. So pretty soon Defcon was
Speaker 1: just way too big for any one person to carry off,
Speaker 1: and so Moss depended upon a growing staff of volunteers.
Speaker 1: They're affectionately referred to as goons, their departments within the goons,
Speaker 1: such as people who maintain the network connections for def
Speaker 1: Con or folks who act as points of information or security.
Speaker 1: The goons typically wear an identifiable element, like a red
Speaker 1: shirt to let people know they are part of the
Speaker 1: volunteer staff. Moss says that the year before the bubble bursts,
Speaker 1: so in around two thousand, the show had swelled up
Speaker 1: to seven thousand attendees, and according to Moss, only about
Speaker 1: half of those folks really seemed to belong there, like
Speaker 1: they seemed to be the actual geeky people who were
Speaker 1: interested in learning how this stuff worked and playing with
Speaker 1: it and exploring it and breaking it and fixing it,
Speaker 1: and the other half didn't really seem to be those folks.
Speaker 1: They seem to be more people interested in commodity, commodifying security,
Speaker 1: making money, and and making deals. After the bubble bursts,
Speaker 1: the attendants dropped closer to five thousands, So some of
Speaker 1: those people that you might refer to as posers or
Speaker 1: just people who didn't belong at def Con sorry to
Speaker 1: not go anymore, because everyone was pretty much freaking out
Speaker 1: about whether or not tech would even be profitable anymore.
Speaker 1: Especially in the dot com space. By def Con twenty
Speaker 1: in two thousand twelve, the numbers had increased up to
Speaker 1: fifteen thousand, and by then it was a lot of
Speaker 1: the legit folks who were really interested in info SEC
Speaker 1: and not just hangers on. The venue for the conference
Speaker 1: has changed a few times too. For several years, the
Speaker 1: con took place at Alexis Park, which I've actually stayed
Speaker 1: at on a trip to c e S. Alexis Park
Speaker 1: in Las Vegas is a former apartment complex and it
Speaker 1: doesn't have a casino. That was the reason I stayed there.
Speaker 1: I was thinking, if there's no casino, I don't have
Speaker 1: to walk through this enormous casino to get to an
Speaker 1: elevator to get up to my room. I can skip
Speaker 1: all that. Because casinos are notoriously labyrinthian and difficult to
Speaker 1: get through. They don't want you to make they don't
Speaker 1: want it to be easy for you to get out right.
Speaker 1: Uh So I thought, oh, Alexis Park, it doesn't have
Speaker 1: a casino, I'll do that. I did not realize that
Speaker 1: it was a bunch of apartment buildings separate from each other,
Speaker 1: and I was booked in a room that was like
Speaker 1: five apartment buildings back from the entrance, so it meant
Speaker 1: walking I don't know, maybe half a mile to get
Speaker 1: to my room. Uh, so I didn't save any time
Speaker 1: in the long run. Well, Alexis Park was where they
Speaker 1: had several def cons in the early years, and it
Speaker 1: was a very popular place. Uh. It has several pools
Speaker 1: and lots of open spaces, and apparently a ton of
Speaker 1: shenanigans happened in and around those spots during the Alexis
Speaker 1: Park years. The pool parties, in particular, were the stuff
Speaker 1: of legend and sometimes of law enforcement. The hotel even
Speaker 1: printed up sheets that explained how much it would cost
Speaker 1: to replace stuff in your room. So if you wanted
Speaker 1: to trash your room, you could, but you'd have to
Speaker 1: pay for it. But you would know right up front
Speaker 1: how much you had to pay. And actually the hackers
Speaker 1: like this. They liked the idea that, oh, well, if
Speaker 1: we destroy this television, it's gonna be two hundred bucks.
Speaker 1: But I got two hundred bucks, so let's go ahead
Speaker 1: and do it. And it was funny because Alexis Park
Speaker 1: management was totally cool with this. Is said, well, if
Speaker 1: you pay your build and that's fine because we'll just
Speaker 1: replace it. So it was an interesting experience and an
Speaker 1: interesting relationship between Alexis Park and the hackers, and everyone
Speaker 1: seemed to really dig that. But it got to the
Speaker 1: point where Alexis Park just could not handle Defcon. It
Speaker 1: wasn't big enough. The convention had grown so large that
Speaker 1: they needed to have space that had better meeting facilities.
Speaker 1: The rooms weren't large enough to hold the crowds that
Speaker 1: were coming in, and so they eventually moved out of
Speaker 1: Alexis Park. Now, there are a lot of people who
Speaker 1: have nostalgia for the Alexis Park days, even though everyone
Speaker 1: knows that logistically it and and't work anymore. And so
Speaker 1: that is why often to this day, someone at some
Speaker 1: point during def Con, we'll go to Alexis Park and
Speaker 1: they will go into the lobby of the area and
Speaker 1: they will steal the Alexis Park welcome Matt and smuggle
Speaker 1: it out and bring it over to the actual def
Speaker 1: Con meeting area and people will pose with the Alexis
Speaker 1: Park welcome Matt that has been stolen from their lobby
Speaker 1: and they'll return it, typically at the end of the conference.
Speaker 1: But yeah, while they are no longer located in Alexis Park,
Speaker 1: the hackers will still, you know, bring it along as
Speaker 1: as a reminder of the good old days. Parties are
Speaker 1: a huge thing at def Con, and there are tons
Speaker 1: of parties, dances, DJ sets, lots of plausible deniability. Def
Speaker 1: Con frequently attracts musicians who work in digital media and
Speaker 1: use technology like chip tunes and other forms of musical
Speaker 1: exprestion that rely heavily on technology. I've actually seen some
Speaker 1: of the sets, of course I've never attended to def Con,
Speaker 1: but watching some videos of the various DJ performances, it's incredible.
Speaker 1: You've got high tech light shows, You've got really cutting
Speaker 1: edge technology which is being used to make music. You've
Speaker 1: got people hacking each other the whole time, like technologically speaking,
Speaker 1: not physically hacking one another. Although bio hacking is one
Speaker 1: of the areas of interest at def Con, the scheduled
Speaker 1: talks at def Con often revolve around important or even
Speaker 1: critical computer and network security issues, and sometimes the presentations
Speaker 1: are humorous. There's a great one that you can find online.
Speaker 1: You can actually watch it on YouTube, in which a
Speaker 1: programmer described how he was able to track down his
Speaker 1: stolen computer and lead police to the thief who took
Speaker 1: it by monitoring when it came online. And this was
Speaker 1: a process that took a lot of creative thinking because
Speaker 1: he had already taken several steps to protect his computer,
Speaker 1: and once it was physically stolen, meant that some of
Speaker 1: those options were no longer available, Like he couldn't find
Speaker 1: it in certain ways because he had already removed that
Speaker 1: as a capability. But eventually he was able to discover
Speaker 1: his computer and even retrieve much of, although not all,
Speaker 1: of the data that was on his computer when it
Speaker 1: was stolen. Other talks are a little more sobering. For example,
Speaker 1: take the talk titled go beyond tabletop Scenarios by building
Speaker 1: an Incident Response Simulation Platform. So this is a talk
Speaker 1: where a security expert with the Texas Department of Safety
Speaker 1: named Eric Capuano explained how organizations need to prepare themselves
Speaker 1: to respond to serious security threats by building out simulations
Speaker 1: that allow I T. Professionals the chance to train and
Speaker 1: hone their skills. So he's saying, it doesn't do you
Speaker 1: any good to learn how to deal with an emergency
Speaker 1: when the emergency is happening. You want to train yourself
Speaker 1: in all of those strategies early on so that when
Speaker 1: something like that does happen, you can respond appropriately. There's
Speaker 1: another talk that was titled Fooling the Hound Deceiving Domain
Speaker 1: Admin Hunter hunters uh. This focused on ways to trick
Speaker 1: attackers into following a false pathway while they are seeking
Speaker 1: out admin login credentials to a network system. So hacker
Speaker 1: gets access to perhaps a machine on a network and
Speaker 1: wants to see if they can find the admin level
Speaker 1: access to the whole network. Well, this was a talk
Speaker 1: saying that might happen. So here's some ways to lay
Speaker 1: down a trap where the hacker thinks they're getting access
Speaker 1: to the admin credentials, but in fact what they're really
Speaker 1: doing is revealing their presence to the network administrator, who
Speaker 1: can then perhaps pursue that or handover information to law enforcement.
Speaker 1: So very interesting talks about not just circumventing security, but
Speaker 1: how to improve security. In fact, almost all the discussions
Speaker 1: ultimately revolve around the fact that vulnerabilities aren't necessarily there
Speaker 1: for you to explore, eight they are there for you
Speaker 1: to examine, to learn from, and then to patch. So
Speaker 1: a lot of interesting approaches. Although the people who attend
Speaker 1: def con can sometimes seem like they're on the other
Speaker 1: side of the law, and often they are people who
Speaker 1: want to protect their identities and their security, and so
Speaker 1: they'll go to great pains to do that. And to
Speaker 1: some people that might seem like it's an admission of guilt,
Speaker 1: but in fact that's not necessarily the case. Other recent
Speaker 1: talks have looked at security vulnerabilities and shortcomings and autonomous
Speaker 1: and connected cars. Chris Valisek and Charlie Miller showed that
Speaker 1: they could compromise a jeep and connect to its systems
Speaker 1: from miles away using a laptop computer connected to the internet.
Speaker 1: They could even cut the brakes or the transmission from
Speaker 1: their laptop pretty easily. Another presenter did a talk about
Speaker 1: how air traffic control systems work and pointed out some
Speaker 1: serious concerns and security vulnerabilities, and he did this be us.
Speaker 1: There was no easy way to communicate to anyone appropriate
Speaker 1: about the concerns. It's not like he could just pick
Speaker 1: up the phone and talk to air traffic control and say, hey,
Speaker 1: I noticed that this is how you are using your systems.
Speaker 1: Did you know that it could be manipulated in a
Speaker 1: way that could cause catastrophic results if you aren't able
Speaker 1: to address this issue. So he had to talk about it,
Speaker 1: which got a lot of attention and got people talking
Speaker 1: to him, and he said, well, that was my whole purpose.
Speaker 1: It wasn't too give people the keys to the air
Speaker 1: traffic control system. It was to alert the world to
Speaker 1: the presence of these vulnerabilities so that those vulnerabilities could
Speaker 1: be patched. There's um they're They're not meant to be
Speaker 1: something to inspire terror in people. They're not meant to
Speaker 1: make people scared to use technology, but just raise awareness
Speaker 1: of those gaps in security so that experts can close
Speaker 1: those gaps and we create better systems further down the
Speaker 1: road as a pun, because we were just talking about
Speaker 1: cars and planes and travel, so down the road anyway.
Speaker 1: There's also tracks of programming for kids. People have been
Speaker 1: bringing their kids to def Con over the past several years,
Speaker 1: and now the kids themselves have actual programming tracks they
Speaker 1: can follow. Uh. A lot of the same speakers who
Speaker 1: will talk to the adults will come and do presentations
Speaker 1: for the kids. And according to all the videos I saw,
Speaker 1: the speakers love it because kids pay attention and they
Speaker 1: want to know how things work. They have interesting questions,
Speaker 1: sometimes ones that people don't anticipate that lead to amazing
Speaker 1: discoveries down the line, and the kids get to learn
Speaker 1: how to do cool skills like soldering, or some scary
Speaker 1: skills like luck picking or programming, and lots of other stuff.
Speaker 1: Def Con celebrates hacking in its many forms, so you'll
Speaker 1: find lots of talks about coding, security, security vulnerabilities, how
Speaker 1: to make sure you don't end up a victim of
Speaker 1: security vulnerabilities, including which software packages you probably want to avoid,
Speaker 1: ways you can improve your Internet browsing behaviors to minimize
Speaker 1: the risk of someone sniffing out what you are doing
Speaker 1: or trying to take advantage of you in some way.
Speaker 1: There are also tons of contests and games that take
Speaker 1: place over the weekend. Some of them are getting really, really,
Speaker 1: really clever. For example, at Defcon twenty, the convention held
Speaker 1: an intrusion challenge, so teams of three could compete, and
Speaker 1: the challenge simulated a physical break in of a locked
Speaker 1: office space and required teams to document evidence and try
Speaker 1: to return everything to its original place so that their
Speaker 1: presence wouldn't be detected. You also had to unlock a
Speaker 1: smartphone and get information off hit And then there was
Speaker 1: the computer. The computer had some forms of protection on
Speaker 1: it like password protection, but more than that, it had
Speaker 1: information stored on it that would disappear if the computer
Speaker 1: were to lose power. So there was a bonus element
Speaker 1: of stealing the computer without having the power cut to
Speaker 1: the machine, which would require using government level spy a
Speaker 1: agency stuff where you could cut a power chord, splice
Speaker 1: it to another power source in such a way that
Speaker 1: the power supply is never interrupted, and then you could
Speaker 1: put the computer on a cart and cart it out.
Speaker 1: But it requires you to actually physically cut the power
Speaker 1: chord that goes to the computer and do it in
Speaker 1: such a way that you never break the connection entirely,
Speaker 1: so that you can actually move the computer with its
Speaker 1: still powered on, and that way you could retrieve the
Speaker 1: information that's on that computer, but otherwise we'd be lost
Speaker 1: if the power went out. It's really cool and it's
Speaker 1: fun to watch those sort of things. Uh, and again
Speaker 1: it gets you thinking into the different types of security
Speaker 1: you need to put in place if you want your
Speaker 1: information to be secure, not just the computer systems, but
Speaker 1: the physical locks that you use things like that. It's
Speaker 1: important to know how it all works so that you
Speaker 1: can make sure you create the most secure system to
Speaker 1: protect your data and other equipment. So all told, this
Speaker 1: competition required you to pick a lock, get access to
Speaker 1: an office, photograph some documents, access a phone, and steal
Speaker 1: a power down computer without turning its power off, which
Speaker 1: was pretty intense. Another popular game at Defcon, In fact,
Speaker 1: one of the most defining experiences at def Con is
Speaker 1: ct F, which stands for Capture the Flag. Now, in
Speaker 1: a traditional capture the Flag game, teams compete to try
Speaker 1: and steal a competing team's flag and return it to
Speaker 1: their own home base, while simultaneously protecting their own flags
Speaker 1: from being stolen by the other team. But DevCon changes
Speaker 1: things up a bit. You have multiple teams playing, and
Speaker 1: your team has a computer on a network, and all
Speaker 1: the other competing teams have their computers on a network.
Speaker 1: On each computer is some piece of data that represents
Speaker 1: a flag, So this is the information on your computer
Speaker 1: that other people are trying to steal. Your opposing teams
Speaker 1: have those same sort of flags on their computers on
Speaker 1: that network, So everyone's trying to secure other teams flags
Speaker 1: while protecting their own flag from being taken by other teams,
Speaker 1: and the administrators have had to come up with rules
Speaker 1: to help prevent teams from circumventing criteria for play, such
Speaker 1: as taking a computer completely offline the network. I mean
Speaker 1: that kind of is unfair because you have to be
Speaker 1: on the network in order to participate. So people have
Speaker 1: come up with creative ways to meet these criteria, and
Speaker 1: every year the administrators have to kind of tweak the
Speaker 1: rules a little bit so that people don't just find
Speaker 1: creative workarounds and they are actually actively trying to play
Speaker 1: the game as it was intended to be played. However,
Speaker 1: that being said, finding workarounds is really what hacking is
Speaker 1: all about. So it can it can. It might work
Speaker 1: once and you get rewarded, and then later on it
Speaker 1: gets written out of the options that you have. Uh,
Speaker 1: the next time they do a CTF. At the twenty
Speaker 1: six team def Con and AI played in the CTF
Speaker 1: for the first time ever, so and un chaperoned art
Speaker 1: actual intelligent program participated in the CTF and for a
Speaker 1: while it would pull ahead of some of the human teams,
Speaker 1: but by the end of the game it actually placed
Speaker 1: last in the competition, So we don't have to worry
Speaker 1: about the computer hackers actual like computer hackers just yet.
Speaker 1: Then there's the crash and Compile drinking game competition in
Speaker 1: which competitors are given a task. Typically it's to create
Speaker 1: a program that will take certain types of input and
Speaker 1: produce certain types of output, which is only normal. That's
Speaker 1: a normal programming you know, assignment. You might have a
Speaker 1: programming course and it says you need to build a
Speaker 1: program that's gonna take this input. You run it through
Speaker 1: the program, you get that output. Build a program that
Speaker 1: does that. But in Crashing compile, it's a drinking game,
Speaker 1: so there are all these rules that come into play.
Speaker 1: If you try to compile your code and that doesn't work,
Speaker 1: you have to take a drink. If the code works
Speaker 1: but it's unstable and it crashes, you've got to take
Speaker 1: a drink. If it's stable but it's not producing the
Speaker 1: right output, you how to take a drink. And obviously
Speaker 1: the less careful you are, the more mistakes you make.
Speaker 1: The more you have to drink, and the more likely
Speaker 1: you'll make even more mistakes due to that influence of drink.
Speaker 1: Perhaps my favorite of all the challenges is a different
Speaker 1: kind of drinking game. It's the Beverage Cooling Contraption Contest
Speaker 1: or b C c C. This is a competition that
Speaker 1: took its inspiration from an episode of MythBusters in which
Speaker 1: the team on MythBusters were trying to come up with
Speaker 1: ways to quickly cool cans of beer to what was
Speaker 1: determined to be the ideal temperature for drinking, which on
Speaker 1: the show was thirty eight degrees fahrenheit or three point
Speaker 1: three three degrees celsius. Teams of up to three people
Speaker 1: can compete in this competition to create an air temperature
Speaker 1: beverage in the quickest and most creative way possible. They
Speaker 1: are not allowed to use any commercial appliances in their efforts,
Speaker 1: and the contraptions have to be designed and built by
Speaker 1: the team, so they can't just buy something and use that.
Speaker 1: The team with the fastest time to cool their beverage
Speaker 1: to the proper temperature wins. Points are deducted for fouls.
Speaker 1: So if your methodology creates a beer or other drink,
Speaker 1: whatever drink they're using at that time, that has a
Speaker 1: metallic taste to it, like, if it alters the taste
Speaker 1: of the drink, you get points taken off. If it
Speaker 1: makes the drink go flat, you get points taken off.
Speaker 1: If you spill drink, you get points taken off. That
Speaker 1: sort of thing. Other contests are equally cheeky. There's a
Speaker 1: counterfeit badge contest. In recent years, the badges have been electronic.
Speaker 1: They've been circuit boards that actually do something, and they
Speaker 1: have USB ports and you can connect them to computers
Speaker 1: and you can actually hack the badges if you want,
Speaker 1: and do interesting things with them. So one thing that
Speaker 1: people try to do is they'll try and spoof a badge.
Speaker 1: They'll try and create a copy of the badge and
Speaker 1: create a counterfeit one. Jeff Moss has actually said that
Speaker 1: if you're good enough to hack a badge and fool security,
Speaker 1: you probably belong at deaf Con and you should be
Speaker 1: able to attend without forking over the participation fee. Of course,
Speaker 1: you're probably spending more time and effort building your version
Speaker 1: of the badge then they did designing the badge in
Speaker 1: the first place, and in a way that kind of
Speaker 1: shows your own level of dedication. Other contests include things
Speaker 1: like forensics puzzles as in computer forensics and network forensics puzzles,
Speaker 1: and scavenger hunts, which can get absolutely insane, and nearly
Speaker 1: all the contests test attendees knowledge and skill encoding or
Speaker 1: hacking in some way While winning a contest will get
Speaker 1: you a claim, landing on the Wall of Sheep will
Speaker 1: mean you're an example of someone practicing poor security behaviors.
Speaker 1: The Wall of Sheep is a display that lists logins
Speaker 1: and the first part of passwords that have been harvested
Speaker 1: off of the Defcon network, and it illustrates how many
Speaker 1: authentication technologies on the web use clear text authentication rather
Speaker 1: than a more secure method. Clear text authentication is terrible.
Speaker 1: You don't want passwords stored in clear text, you want
Speaker 1: that encrypted. So if you're using services that have unencrypted
Speaker 1: clear text passwords stored in them, then your password is
Speaker 1: gonna get posted up on the Wall of Sheep. Typically,
Speaker 1: they only post the very beginning of the password. The
Speaker 1: rest of it will be asterisks out. But if your
Speaker 1: word is a plain English word, people might be able
Speaker 1: to guess it just from the letters that are showing.
Speaker 1: So this is a way of demonstrating, hey, you're using
Speaker 1: some bad stuff and you should probably change that. Speaking
Speaker 1: of secure methods, the only way you can attend def
Speaker 1: Con is to show up at the door with your
Speaker 1: cash in hand in order to purchase the badge, or
Speaker 1: you have to create a spoofed badge that can fool security. Now,
Speaker 1: Defcon does not accept any form of payment other than
Speaker 1: cash at the door, and this helps keep those transactions
Speaker 1: away from prying eyes, such as any agencies that might
Speaker 1: have an interest in identifying people who are particularly least
Speaker 1: skilled at let's say, intrusion attacks against secure systems, and
Speaker 1: everyone apart from official convention staff and guest speakers, will
Speaker 1: pay full price to get in, including the media. So
Speaker 1: Jeff Moss has actually said that one of the purposes
Speaker 1: of this is that if def Con has ever hit
Speaker 1: with a lawsuit to hand over the list of attendees,
Speaker 1: they can't because there's no record apart from just cash
Speaker 1: transactions which don't have any paper trail to them other
Speaker 1: than there's a badge and there was cash given for it.
Speaker 1: There's no name associated with that, no credit card, no location.
Speaker 1: So that's one of the reasons Jeff Moss insists on
Speaker 1: doing cash only. And while the cost might be a
Speaker 1: couple hundred dollars to get in, you're really getting into
Speaker 1: a bunch of different conferences, all related to information security
Speaker 1: and hacking and programming. There are tons of different projects
Speaker 1: and tracks that you can follow, and lots of different
Speaker 1: activities you can participate in. For example, if you ever
Speaker 1: wanted to learn how to pick locks, you can head
Speaker 1: over to lock pick Village at def Con and get
Speaker 1: a lesson. Within five to ten minutes, you might be
Speaker 1: picking locks. You can practice your skills on various types
Speaker 1: of locks. You can learn how they work and how
Speaker 1: they're vulnerable. And again this isn't so that you can
Speaker 1: become a cat burglar extraordinaire, but rather understand how secure
Speaker 1: these locks actually are. So if a lock is fiendishly
Speaker 1: difficult to pick, that's a darn fine lock and one
Speaker 1: you might want to use for yourself. You might want
Speaker 1: to use that to secure your belongings. But if you
Speaker 1: find a lock that you're able to get in in
Speaker 1: less than five minutes with bare minimum training, that's probably
Speaker 1: not the best lock to use. So in a way,
Speaker 1: it's kind of a consumer service learning which locks are
Speaker 1: really the most reliable, because you can bet the bad
Speaker 1: guys already know this, that's what they look for, So
Speaker 1: learning it and then putting that information to use is
Speaker 1: actually a good thing because it means that you're keeping
Speaker 1: stuff safe. The conference and its attendees haven't been connected
Speaker 1: to some stuff that goes beyond pranks and mischief, maybe
Speaker 1: some stuff that crosses over into illegal territory. Mostly the attendees,
Speaker 1: not really the conference. The conference does try very hard
Speaker 1: to distance itself from anything that is outright illegal. Most
Speaker 1: of the stuff that they encourage is more on the
Speaker 1: mischief side of things. But some people have decided that
Speaker 1: while they're attending def Con they want to try and
Speaker 1: show off and shut down maybe a computer system belonging
Speaker 1: to a particularly powerful company or organization. And some of
Speaker 1: that is for bragging rights. Uh. Some of that is
Speaker 1: because a lot of the attendees have kind of an
Speaker 1: anarchist ethos that they subscribe to, but not everybody does.
Speaker 1: It's not like it's just a convention filled with people
Speaker 1: trying to watch the world burn. There are some interesting stuff,
Speaker 1: like I love that there's a competition to take a
Speaker 1: box that has a lot of tamper proof materials inside
Speaker 1: of it, and your job is to access all of
Speaker 1: those materials in that tamper proof system and then return
Speaker 1: them so that it looks like you haven't tampered with
Speaker 1: it at all. It requires a lot of creative thinking
Speaker 1: and using different skills if you want to actually be
Speaker 1: able to get into that stuff without being found out. Now,
Speaker 1: there's a ton of other things that go on over
Speaker 1: at def Con and interesting stories that come out of it,
Speaker 1: but I think the best way to learn about it
Speaker 1: is to talk to someone who has been there. So
Speaker 1: when we come back, I'm gonna have a little conversation
Speaker 1: with my friend Shannon Morris. We'll talk about her experiences
Speaker 1: of attending def Con. But we'll talk about that in
Speaker 1: just a second after we take this quick break to
Speaker 1: thank our sponsor guys. I am so pleased we are
Speaker 1: joined by Shannon Morris, a good friend of mine. She's
Speaker 1: been on the show a few times and she has
Speaker 1: generously agreed to dedicate some of her precious time to
Speaker 1: talking with us about def Con. Shannon, Welcome back to
Speaker 1: Tech Stuff. Hi, how are you doing, Jonathan? I'm great.
Speaker 1: I'm so happy that you are here. So to catch
Speaker 1: you up, Shannon. What has happened previously? On text I
Speaker 1: recorded an episode about the history of def Con. But
Speaker 1: I told all my listeners I have not ever actually
Speaker 1: been to a deaf Con. However, you have been to
Speaker 1: a couple. How many deaf cons have you attended? Almost ten?
Speaker 1: The first year I went, I believe was in two
Speaker 1: thousand eight and I never stopped going, So come next year,
Speaker 1: it'll be a decade awesome. So, as someone who has
Speaker 1: actually attended def con, can you can you tell me
Speaker 1: in your own words, how would you describe the convention
Speaker 1: to someone who has only heard the name but has
Speaker 1: no real idea of what it's all about. So I
Speaker 1: would say def Con is it's the largest hacker con
Speaker 1: in the United States. But it's not only hackers that go.
Speaker 1: Sometimes it's government people, sometimes it's hackers uh, and sometimes
Speaker 1: it's the kids that the hackers have had that will
Speaker 1: also go to the convention. So a lot of people
Speaker 1: go to this convention in Las Vegas every single year,
Speaker 1: uh in the summertime, and we lovingly refer to it
Speaker 1: as hashtag hacker summer camp because it is always it
Speaker 1: always feels like it's a big family get together. There's
Speaker 1: lots of hugs, there's a lot of get togethers after
Speaker 1: the convention hours, like at restaurants and stuff like that
Speaker 1: just to hang out. UH. And it's also a big party.
Speaker 1: There's a lot of partying. There's a lot of booze
Speaker 1: for the people that can legally drink UH and there's
Speaker 1: a lot of really good time. So it's it's become
Speaker 1: a really big part of my life in the fact
Speaker 1: that a lot of my very close friends, some of
Speaker 1: which that went to my wedding, even I met at
Speaker 1: def Con. So it's it's a big part of my life.
Speaker 1: So what would it be like like walk people through?
Speaker 1: I know that there's not really a typical def Con experience,
Speaker 1: as most conventions tend to change quite a bit from
Speaker 1: year to year. They do this because they don't want
Speaker 1: to remain static and just be known for the same thing.
Speaker 1: But if you were attending def Con, what are the
Speaker 1: sort of things you would be going to? Like do
Speaker 1: you get do you go to any of the presentations
Speaker 1: for example? So for me, Um, I'm not your normal
Speaker 1: convention goer. I always go as either either press or
Speaker 1: as a vendor. Uh so I usually get my badge
Speaker 1: ahead of time. I pay for my badge ahead of time.
Speaker 1: But for an attendee, what you have to do is
Speaker 1: show up on the first day, stand in a really
Speaker 1: really long line, and pay in cash because they don't
Speaker 1: accept any credit cards and that's for the hacker anonymity.
Speaker 1: But once you get there, you just stand in line
Speaker 1: you pay. I think this year was like two hundred
Speaker 1: dollars in cash or something like that, and then you
Speaker 1: get your badge and you're good to go. Um. There
Speaker 1: are talks, there are the vendor the vendor hall, of course,
Speaker 1: and then there's also a whole bunch of different rooms
Speaker 1: that you can hang out and called villages. Um. Each
Speaker 1: of these villages kind of focuses on a hacker specialty,
Speaker 1: whether that is WiFi hacking or car hacking. There's a
Speaker 1: lock picking village. There's even a village that is just
Speaker 1: for kids. So you can pretty much find whatever you
Speaker 1: are interested in, as long as it has to do
Speaker 1: with breaking things and then making them work again, which
Speaker 1: is kind of the epitome of being a hacker, right,
Speaker 1: And I'm glad you brought that up, because, as I
Speaker 1: mentioned in the podcast section where I was chatting about
Speaker 1: this whole concept, the term hacker has been misused dramatically
Speaker 1: over the past twenty thirty years, and it's been the
Speaker 1: definition has been too narrow for the common definition, because
Speaker 1: of course, hacker originally meant people who, as you say,
Speaker 1: like to take things apart, see how they work, put
Speaker 1: them back together, maybe tweak them so they do something
Speaker 1: they weren't intended to do in the first place, or
Speaker 1: maybe do it differently, or perhaps even do it better
Speaker 1: than it had been doing before. But it didn't necessarily
Speaker 1: have this connotation that it tends to have in popular media,
Speaker 1: which is a person who specializes in uh, penetrating a
Speaker 1: secure system and then exploiting it in some way. Yeah. Absolutely,
Speaker 1: I think a lot of and I know we've talked
Speaker 1: about this before, but I think a lot of the
Speaker 1: hacker name in the biased against it comes from Hollywood,
Speaker 1: like the Hollywood core movies and TV shows that we
Speaker 1: have seen in the eighties and nineties that have made
Speaker 1: us think like, oh, hackers are really bad people, like
Speaker 1: there is no way you could be a good hacker.
Speaker 1: But that's actually not true of all of the hackers
Speaker 1: I know. I don't know anybody that does something illegal.
Speaker 1: All of them work as a penetration tester, as a
Speaker 1: professional who goes in with a contract to a company
Speaker 1: and then breaks into their network under that contract to
Speaker 1: make sure that it is safe. Because if you don't
Speaker 1: take the time to find the vulnerabilities, you won't know
Speaker 1: how to secure yourself in the future. So hackers for
Speaker 1: me are the good guys. And I think um a
Speaker 1: lot of our community and lot of the people out
Speaker 1: in the world who don't really understand hackers. What they
Speaker 1: need to relate to is the fact that hackers are
Speaker 1: good people who come in and make sure your stuff
Speaker 1: is safe. Because there are bad guys out there, but
Speaker 1: I don't refer to them as hackers. I refer to
Speaker 1: them as criminals, right right. And I'm glad you mentioned
Speaker 1: that too, because we've seen in the past a lot
Speaker 1: of different def Con presentations, for example, have focused on vulnerabilities,
Speaker 1: and it becomes clear that the presenter has said, you know,
Speaker 1: in multiple instances of this that I tried to reach
Speaker 1: out there was either no one to reach out to
Speaker 1: or no one would listen to me about this vulnerability.
Speaker 1: And so in order to force the issue, I am
Speaker 1: going to bring this forward to everybody because because trust me,
Speaker 1: if I don't talk about it, it just means the
Speaker 1: people who are aware of it are going to exploit it.
Speaker 1: If I talk about it, then it forces the hand
Speaker 1: of whatever entity to patch that vulnerability or address it
Speaker 1: in some way, because secrecy only helps the criminals, it
Speaker 1: doesn't help like the The The assumption is that if
Speaker 1: I talk about this thing, I've opened up the floodgates
Speaker 1: and everyone can exploit it. Trust me, the criminals know already,
Speaker 1: they're just not talking about it. Yeah, exactly a lot
Speaker 1: of times you'll see these hawks that are exactly just that.
Speaker 1: Um At Defcon, somebody will bring up a presentation and
Speaker 1: turn in a call for paper paper to the def
Speaker 1: Con committee, and they'll either accept it or deny it.
Speaker 1: And when they show up at the convention and give
Speaker 1: their talk, that's generally a very important disclaimer to say is, hey,
Speaker 1: I reached out to this company two or three times,
Speaker 1: I gave them six months to fix it. It has
Speaker 1: not been fixed. Or maybe on the other hand, they
Speaker 1: could say I reached out to the company, this has
Speaker 1: already been fixed, but this is what I found and
Speaker 1: this is why you need to update. For example, if
Speaker 1: there is a smartphone vulnerability, they might say this has
Speaker 1: already been released by the operating systems smartphone manufacture. Uh,
Speaker 1: so this is very important for you to make sure
Speaker 1: that you are updating on your own personal devices or
Speaker 1: something around that. But basically they'll go in, they'll give
Speaker 1: this disclaimer and then hopefully the company won't go after them.
Speaker 1: After that fact, because since they can prove that they've
Speaker 1: already reached out to this company, they have that that
Speaker 1: they can fall back on. So there's unfortunately, there's a
Speaker 1: lot of uh legal issues when it comes to what
Speaker 1: information you can release, and a lot of it comes
Speaker 1: down to you, how is the company actually dealing with
Speaker 1: these things behind the scenes, Like what do what kind
Speaker 1: of policies do they have in place for their own devices? Wow? Yeah,
Speaker 1: I mean it's to me, it's fascinating to take that
Speaker 1: into consideration, the idea that uh, this this this group
Speaker 1: that has this reputation. Mostly I think because a lot
Speaker 1: of the people over at Defcon also have kind of
Speaker 1: a mischievous streak. So there's a lot of Yeah, there's
Speaker 1: a lot of mischief making. I'm gonna ask you about
Speaker 1: that in a minute. Uh, but there's a lot of
Speaker 1: mischief making that goes on at the convention. It's largely
Speaker 1: because you know, once you know how something works, it's
Speaker 1: a lot of fun to show that off to other
Speaker 1: people and sometimes show how it could potentially be misused.
Speaker 1: Not in a way of like maliciously trying to promote
Speaker 1: that misuse, but rather say, like, look at this crazy
Speaker 1: thing I found and uh, this should not exist or
Speaker 1: or the fact that this exists delights me, but however
Speaker 1: we should probably address it. But it is interesting to
Speaker 1: also know that, you know, there's this very cognizant approach
Speaker 1: to what can and cannot be said. So that's so,
Speaker 1: that's so that it's all done in it and as
Speaker 1: as responsible away as possible. I mean, there is definitely
Speaker 1: a tongue in cheek kind of approach. I mean the
Speaker 1: thing that the convention is called def Con, and it
Speaker 1: largely is because of the movie War Games, which is
Speaker 1: one of those Hollywood films that has created this image
Speaker 1: of the hacker that although I would you the War
Speaker 1: Games hacker was more mischievous than anything else. Uh that uh,
Speaker 1: that has continued to be perpetuated in media. Uh So
Speaker 1: let me ask you this, like, as a vendor, I
Speaker 1: understand that it's a pretty small number of vendors in
Speaker 1: the grand scheme of things that tend to be invited
Speaker 1: to def Con. Isn't it one of those things where
Speaker 1: every single vendor must be approved before they can actually
Speaker 1: uh show up and set up a table. That's correct, Yeah,
Speaker 1: you have to be approved as a vendor. You ask
Speaker 1: you also have to pay a fee for that table,
Speaker 1: which is why you know, we we generally choose to
Speaker 1: go to def Con and not the smaller cons because
Speaker 1: since uh, yes, we do have to pay a rather
Speaker 1: expensive fee, but we also have a very large audience
Speaker 1: that is coming to purchased equipment from us, it ends
Speaker 1: up offsetting the cost, so it ends up working out
Speaker 1: pretty well. Um, but as a vendor, each and everyone
Speaker 1: has to apply. You don't get invited every year anything
Speaker 1: like that. So even the Hack five has been going
Speaker 1: for ten years, Hack five is the company that I
Speaker 1: work with, We've never been invited. We've always had to apply.
Speaker 1: And with that application, you know, you go through all
Speaker 1: the business e jargon, but you also have to say like, hey,
Speaker 1: this is why I think we should go to the convention,
Speaker 1: and this is what we think that we can bring
Speaker 1: to it. In Hack five's case, we are filling this
Speaker 1: void of giving giving the hacker community something that is
Speaker 1: very introductory. A lot of the community basis on very
Speaker 1: expertise related information that may already assume that you already
Speaker 1: know the foundational information that you need to use equipment.
Speaker 1: So we came in and we were like, hey, we
Speaker 1: need to introduce something that gives beginners a way to
Speaker 1: understand how to use not only to the devices that
Speaker 1: we use, but also understand the fundamentals of why these
Speaker 1: devices were built. Uh so, and that's one of the
Speaker 1: reasons why we also do podcasts. But the vendors come in,
Speaker 1: we all build our own boot so nobody builds them
Speaker 1: for us. Of course, if you want to hang anything,
Speaker 1: there's the the unions in Las Vegas that will do
Speaker 1: that for you. But we set up our own boots
Speaker 1: and we sell our equipment throughout the weekend. One big
Speaker 1: thing that vendors have noticed in recent years is even
Speaker 1: though the convention itself only accepts cash at the door,
Speaker 1: a lot more people that are coming as guests or
Speaker 1: attendees are paying with credit card, which is the strangest
Speaker 1: thing given that it's a hacker con and the general
Speaker 1: consensus is you do not want to use your credit
Speaker 1: card whenever you are at the convention, but people still do.
Speaker 1: And I think it's because since we as vendors are
Speaker 1: part of the community, they trust us not to take
Speaker 1: advantage of that. And we are using third parties, you know,
Speaker 1: we're using Square, we're using Shopify or whatever. The company
Speaker 1: might be that you choose to use at the convention,
Speaker 1: so they know that their information is um encrypted and
Speaker 1: it's safe with that third party, and we don't actually
Speaker 1: even see anything except for the physical card, right, So
Speaker 1: you can't if you were for some reason, let's say,
Speaker 1: a shadowy government agency or command commanding you to hand
Speaker 1: over those customer transactions. All you would have is just
Speaker 1: the fact that well, we've got I can't give you
Speaker 1: any more data than this. This is not I know that.
Speaker 1: That's like the purpose behind cash only at the door
Speaker 1: for the conventions that we aren't. We can't hand hand
Speaker 1: over the people who are here because it's all a
Speaker 1: cash based transaction. So you've either paid cash or you've
Speaker 1: somehow managed to perfectly spoof the badge for that year, which,
Speaker 1: as the founder of Deacon has said, like if you
Speaker 1: can do it, then you probably deserve to be here.
Speaker 1: Oh yeah, there's a whole bunch of contests that happened
Speaker 1: at def Conto, and that's one of them where people
Speaker 1: make their own badges to see who can make the
Speaker 1: best one, and generally they'll either win something that's not
Speaker 1: necessarily like a totally recorded contest, but you know, they
Speaker 1: might go up to one of the goons that work
Speaker 1: at Defcon and be like, hey, check out my badge,
Speaker 1: and they might you know, end up giving them a prize.
Speaker 1: There's a lot of really cool contests. There's a lot
Speaker 1: of cool villages. There's the vendors, the talks um, There's
Speaker 1: a lot of really interesting things that happen at Defcon.
Speaker 1: There's also conventions that happen during dev Con in Vegas,
Speaker 1: which is part of the reason why we call it
Speaker 1: Hackers Summer Camp, because the whole community is getting a
Speaker 1: lot more aware of being inclusive to minorities, to women too,
Speaker 1: people that aren't necessarily you know, the norm that you
Speaker 1: would see at Defcon. So for example, we're starting to
Speaker 1: see um last I think in the last several years,
Speaker 1: there's been Queer Con, which is for the l g
Speaker 1: B t Q community. It's a big suite, it's a convention.
Speaker 1: They also have their own pool party that people can
Speaker 1: go to and everybody's invited. Of course. Uh, there's a
Speaker 1: bunch of women's sweet setup that are very that generally
Speaker 1: talked about inclusiveness for women. And there's you know, the
Speaker 1: kids convention to the kids villages, so kids are invited.
Speaker 1: It's not necessarily just like the twenty one upcrowd that
Speaker 1: we've seen in the past. So it's becoming a much
Speaker 1: larger convention. It's becoming a lot more friendly to people
Speaker 1: that didn't necessarily uh know that they could go or
Speaker 1: feel safe at the convention. And I think that's a
Speaker 1: really positive effort that def con and the other conventions
Speaker 1: that happen in Vegas are trying to do. Yeah, I
Speaker 1: like that a lot. I like I like the fact that,
Speaker 1: you know, because the general perception, more frequently than not,
Speaker 1: I think of of what the stereotypical hacker is is
Speaker 1: they tend to be twenty something to maybe early thirty something.
Speaker 1: More frequently than not, they're portrayed as white, and they're
Speaker 1: almost always male. And so to see that this convention
Speaker 1: is actively or even just encouraging the participation of other
Speaker 1: groups that don't fall into those categories and is acknowledging, Hey,
Speaker 1: you know, there are people who are not falling into
Speaker 1: the stereotypical view of what a hacker is supposed to be,
Speaker 1: who have valid opinions, They have contributions to make to
Speaker 1: the community, They have great ideas that we should listen to.
Speaker 1: Is really encouraging, because you know, we we want to.
Speaker 1: I've always been one of those people who championed the
Speaker 1: idea of more inclusiveness with any sort of stem kind
Speaker 1: of approach, and that includes hacking, and I'm pleased to
Speaker 1: see that there are people who have taken up that
Speaker 1: banner and they have really pushed it, especially over the
Speaker 1: last few years. I was looking into some of the
Speaker 1: stuff about the children's village, like you pointed out, and
Speaker 1: I think it's fantastic that they book some of the
Speaker 1: same speakers who give the big presentations to the entire con.
Speaker 1: They'll come in and they'll do a session with the kids,
Speaker 1: and I think that's amazing. You know that you're getting
Speaker 1: these people, some of whom have national reputations in the
Speaker 1: form of information security, coming in and talking to kids
Speaker 1: on their level, like not talking down to them, because
Speaker 1: kids are way smarter than we give them credit for,
Speaker 1: and they pick up on this stuff way faster than
Speaker 1: old fogies. Me um, it's great to see that. So
Speaker 1: I find that really interesting. I am somewhat sad Shannon
Speaker 1: that that your first your first def con was two
Speaker 1: thousand eight, because it means I cannot ask you about
Speaker 1: the legendary by gone days of the Alexis Park. I've
Speaker 1: heard stories the last Alexis Park def Con took place
Speaker 1: in two thousand five, so those days were over by
Speaker 1: the time you came in. However, you have been there since.
Speaker 1: They've changed locations a few times. It started off at
Speaker 1: the Riviera Hotel, and then it was at the Rio,
Speaker 1: and then at Paris and Valleys, and now I think
Speaker 1: the most recent one was at Caesar's Palace, and it
Speaker 1: will be at Caesar's Palace again next year as well.
Speaker 1: So with those changes in location, have you noticed any
Speaker 1: other like subsequent changes in the con itself or is
Speaker 1: it just one of those things where it's just gotten
Speaker 1: bigger with each change in venue. Um, it's mostly just
Speaker 1: been getting bigger and bigger with the changes of venue,
Speaker 1: and I think that's the main reason. Although given some
Speaker 1: of the strange things that happened at the hotels, they
Speaker 1: could change those hotels because of something else, Tangent Assigne.
Speaker 1: More on that later, but yeah, it's It's one of
Speaker 1: the really strange things about Defcon is the fact that
Speaker 1: they do change hotels every two to three to four years. Uh,
Speaker 1: And I don't know why that is necessarily because I'm
Speaker 1: not on the board, but I can make my own
Speaker 1: personal assumptions based on what I've seen. You know, first
Speaker 1: of all, there's always i mean one, when you're ever,
Speaker 1: you're doing events, planning for a big event, there's always
Speaker 1: long term contract type stuff that you have to look at.
Speaker 1: So there's that. So some of it could very well
Speaker 1: be that it's just oh, we were only able to
Speaker 1: secure that location for two years and we knew it
Speaker 1: was going to be a transition. Sometimes it might be oh,
Speaker 1: this hotel wasn't so pleased when it found out all
Speaker 1: the elevator buttons were rewired to the wrong floor. Yeah,
Speaker 1: So on that fact um, there have been many different
Speaker 1: things that happen at dev Con, and it doesn't matter
Speaker 1: which hotel is at there are always these funny little
Speaker 1: pranks that get pulled all around the hotel. It could
Speaker 1: be anything from the hotel elevators getting switched up like that.
Speaker 1: It could be them getting stopped in the middle of
Speaker 1: two floors. Uh. It could be a great example as
Speaker 1: Caesar's Palace this year is they have a food court,
Speaker 1: and the food court all of the different restaurants give
Speaker 1: out those little wireless handset things. Uh, those little square
Speaker 1: boxes that vibrate whenever your food is ready. They all
Speaker 1: run on the same frequency. And of course, since you
Speaker 1: have a bunch of hackers at Caesar's Palace, if they
Speaker 1: find out everything runs on the same frequency and they
Speaker 1: can recreate that pattern to make all of the devices
Speaker 1: vibrate and go off at the same time, they will
Speaker 1: do it, and then everybody's sitting in that food court
Speaker 1: will stand up all at the same time expecting their
Speaker 1: food to be ready. Wow. Um, I've seen another example
Speaker 1: here in Caesar's Palace this year was Uh, there are
Speaker 1: a whole bunch of statues that are supposed to be
Speaker 1: like Roman, you know, the Roman gods, Roman, all the
Speaker 1: different beings from histories past. And they're like animatronic, aren't they. Um.
Speaker 1: There are some animatronic ones in one of the shopping centers,
Speaker 1: and then a lot of the other ones are just
Speaker 1: like made out of really nice stone and they're in
Speaker 1: the middle of walking areas. They're very easy to get
Speaker 1: up to. And Google eyes are a really big thing
Speaker 1: at def Con, so you will find all of these
Speaker 1: statues by the end of the convention weekend. With Google's
Speaker 1: Google eyes on them, and it is the funniest thing. Luckily,
Speaker 1: I think Caesar's Palace was really dealing with it kind
Speaker 1: of humorously because they left a lot of those things
Speaker 1: on even after the janitorial staff went through in the
Speaker 1: middle of the night, So I think that they were
Speaker 1: taking it with like a good positive appeal, like, hey,
Speaker 1: this is a part of the hacker community, this is
Speaker 1: def con, Like, this is what we were expecting. So
Speaker 1: we're just going to leave those up for the weekend
Speaker 1: and let y'all have your fun as long as you
Speaker 1: do follow follow the rule of MPD no permanent damage. Yes,
Speaker 1: no permanent damage. So luckily Google eyes don't cause permanent damage. Um.
Speaker 1: I don't like it when the elevators get messed with
Speaker 1: because I'm an old lady and I like to go
Speaker 1: to sleep at night and not get stuck in an elevator,
Speaker 1: which has happened before. But it also comes with the territory,
Speaker 1: so I understand that if I'm going to def con,
Speaker 1: those things will happen. Well, if you were if you
Speaker 1: were talking to someone who was possibly thinking about going
Speaker 1: to def con, what is what is your pitch and
Speaker 1: convincing that person to say, like you know what, Yeah,
Speaker 1: this is something that you should try. If you're interested
Speaker 1: in it, you should give it a go. What would
Speaker 1: you tell that person? So, I would say that def
Speaker 1: Con is unlike any of the other hacker cons that
Speaker 1: I've been to. All of the local conventions are much smaller,
Speaker 1: which also have a huge deal of appeal. But if
Speaker 1: you really want to see the uh the prankster def Con,
Speaker 1: if you want to see the family get together, the
Speaker 1: Hacker summer camp, if you want to get that huge
Speaker 1: deal of inspiration throughout the weekend from all of the
Speaker 1: different villages uh, and if you want to feel included.
Speaker 1: Defcon has a code of Contact, which means that they
Speaker 1: are very very inclusive, and if anything happens there, you
Speaker 1: can report it and know that you'll be okay. UM.
Speaker 1: Def Con is the one place that I go every year,
Speaker 1: and I just love going, even though at the end
Speaker 1: of the week my voice is shot, even though I
Speaker 1: am tired, and sometimes I come home with the con
Speaker 1: flu which will generally happen if you go to Vegas
Speaker 1: and you don't drink enough water because it's a desert. Um.
Speaker 1: It's it's the one place that I can go and
Speaker 1: feel like I'm not only included, even as a woman
Speaker 1: in a very even though I'm considered a minority in
Speaker 1: the hacker genre, even as a woman, I can go
Speaker 1: there and I feel included and I feel real embraced
Speaker 1: in that community. But it's it's friendly, it's fun, and
Speaker 1: it's big. It's huge. So if you're looking for a party,
Speaker 1: it's also a very good time. If you're looking for
Speaker 1: a job, it's a great place to go as well.
Speaker 1: Oh yeah, fantastic uh networking opportunity in more ways than one.
Speaker 1: Now I also have to ask, but this will kind
Speaker 1: of be our sign off because I talked about in
Speaker 1: the actual podcast, But I want to hear what your
Speaker 1: thoughts are and perhaps just the sort of the general
Speaker 1: uh conception of the Wall of Sheep. Um. Yes, so
Speaker 1: the Wall of Sheep is hilarious. I think it is
Speaker 1: a great way to spread awareness of the fact that
Speaker 1: wireless is not necessarily safe. It is very vulnerable, especially
Speaker 1: to people that go to the convention and forget to
Speaker 1: turn wireless off on their devices. Um. I've never been
Speaker 1: on the Wall of Sheep, so I can't tell you
Speaker 1: from experience it is how it feels to be on
Speaker 1: the wall of sheep, but I would probably be embarrassed
Speaker 1: if I showed up on there, but I would take
Speaker 1: it as a learning experience. If if I was to
Speaker 1: show up on there, I would be like, Okay, how
Speaker 1: did this happen? And I would want to learn so
Speaker 1: that that would never happen to me again in the future,
Speaker 1: and I could take that into the real world and
Speaker 1: know that I am safe with my own devices. Right again. More,
Speaker 1: while you might have suffer a little bit of embarrassment
Speaker 1: in the short term as you appear on a wall,
Speaker 1: the lesson you learn is more valuable because again, the
Speaker 1: criminals aren't going to alert you that you are sharing
Speaker 1: any information. They're going to be using that. So it's
Speaker 1: better for you to be aware of it and be
Speaker 1: able to prevent that from happening than to be unaware
Speaker 1: of it and then just be taken advantage of perpetually.
Speaker 1: So absolutely I see it. I see it as a
Speaker 1: valuable service, even though I know that I would be
Speaker 1: paranoid the entire time that was going to show up.
Speaker 1: Do you take do you take a burner phone with you?
Speaker 1: I used to um I I stopped doing the burner
Speaker 1: phone just out of pure laziness the past few years,
Speaker 1: which is very bad. You should take a burner phone
Speaker 1: with you. I am not the norm, but there are
Speaker 1: a few things that I would recommend to people that
Speaker 1: are going just for their own security and privacy because
Speaker 1: it is a very target rich environment. I would say,
Speaker 1: if you can take a burner phone, UH, if you
Speaker 1: can erase all the data off that burner phone, any
Speaker 1: personal data, and don't log into like your bank, for example,
Speaker 1: while you are at the convention on that phone. UM.
Speaker 1: I would also recommend keeping NFC, Bluetooth, and wireless turned
Speaker 1: off the entire time, because there are hacks for all
Speaker 1: of those uh. And if you want to on sites
Speaker 1: like Amazon, there's these really cool things called Faraday bags,
Speaker 1: and I bought one myself and it works great. I've
Speaker 1: tested it, and Faraday bags will If you put your
Speaker 1: smartphone inside of a Faraday bag, the Faraday bag will
Speaker 1: stop any kind of UH wireless frequencies from coming into
Speaker 1: the bag and coming onto your device, so it'll protect
Speaker 1: your device from anything out there that might be trying
Speaker 1: to attack the devices in the wild. I would also
Speaker 1: recommend water because it is Vegas, really good tennis shoes
Speaker 1: because any hotel you go to that def Con is
Speaker 1: in Ore, You'll you will be walking very very far
Speaker 1: uh and get lots of sleep and make sure to
Speaker 1: take a shower, just like any other convention. Yep. Personal
Speaker 1: hygiene does not stop just because the convention has started. No,
Speaker 1: it does not. Hand sanitizer not a bad idea, or
Speaker 1: at least washing your hands frequently, not a bad idea
Speaker 1: at any of these sort of conventions. I've been the
Speaker 1: champion of that at c e S so many years running,
Speaker 1: especially at a place like CES, because you're just handling
Speaker 1: your handling stuff that so many other people have handled, Yes, exactly,
Speaker 1: but valuable tips and take advantage of the learning experience
Speaker 1: to make sure that you get out there and you
Speaker 1: ask questions. Because the people that go to def Con
Speaker 1: and have vendor booze have villages that they running there
Speaker 1: there to answer your questions. I believe that no question
Speaker 1: is a stupid question. If you are a beginner, you
Speaker 1: come up to me and you ask a question. If
Speaker 1: I don't think that my product that I'm selling at
Speaker 1: my vendor booth is correct for you, I've I've done
Speaker 1: this in the past. I will lead you out of
Speaker 1: my booth and take you to the bookstore where you
Speaker 1: can pick up a book that teaches you all the
Speaker 1: fundamentals and the theory behind the products that we sell.
Speaker 1: So I I highly recommend that if you're a beginner,
Speaker 1: to go to these conventions, especially def COM, because the
Speaker 1: learning experience that you'll you will get there and the
Speaker 1: networking that you'll get is like no other You can't
Speaker 1: get that same kind of experience online. Yeah. And and
Speaker 1: in my now I've not been to death count, but
Speaker 1: in my experience talking with people who do this sort
Speaker 1: of stuff, they get they get a thrill out of
Speaker 1: being able to talk about and explain it to other people.
Speaker 1: They they enjoy sharing that knowledge. It's not like they're
Speaker 1: hoarding knowledge and they don't want other people to have it.
Speaker 1: So in fact, I often see it as the act opposite,
Speaker 1: Like people learn something cool and they immediately want to
Speaker 1: share it with other folks so that they also know
Speaker 1: how to do it. So yeah, So that to me
Speaker 1: is something that is really a valuable thing to take away,
Speaker 1: is that these are folks who really want to share
Speaker 1: that experience and to explain and to teach and to
Speaker 1: have that knowledge expand beyond just their own circle, So definitely.
Speaker 1: You know, Defcon is not like a participant not not
Speaker 1: like a spectator sport. You know, it's fully participatory. And
Speaker 1: the more I heard this more and more every time
Speaker 1: I was watching any video about it or anything, everyone
Speaker 1: was saying the more you participate, the more you get
Speaker 1: out of it, and that it's it's an environment that
Speaker 1: encourages participation. And you know, I'm sure that you've you've
Speaker 1: had a chance to practice all sorts of skills that
Speaker 1: you didn't necessarily go into, you know, with any uh
Speaker 1: real affinity for at the beginning. Like I mean, it
Speaker 1: wouldn't surprise me at all to learn that you have
Speaker 1: started to really get good at picking locks. Yeah, that's
Speaker 1: actually a thing that I was going to mention. I
Speaker 1: started picking locks at def Con, and I didn't know
Speaker 1: that I was that it was a skill that I
Speaker 1: had naturally until I started doing it, And I wouldn't
Speaker 1: have done it if I hadn't gone to Defcon. But
Speaker 1: now I have that skill that I could use for
Speaker 1: more security awareness, like even on my own house, I
Speaker 1: can make sure that my house isn't you know, luck pickable,
Speaker 1: for example. But you you do learn skills there, you
Speaker 1: get to. You get to meet a lot of really
Speaker 1: amazing people and it's a great experience all around. Um,
Speaker 1: even if you go on your own there's some really
Speaker 1: awesome people that you can meet there. Shannon Morrise, thank
Speaker 1: you so much for joining our show. Please tell people
Speaker 1: where they can find all the stuff what you do.
Speaker 1: Uh So, you can follow me on Twitter, I'm snubs
Speaker 1: S and U b S. That is where I post
Speaker 1: most frequently, and I can also answer any questions that
Speaker 1: you have about def Con as well over there. If
Speaker 1: you are interested in the podcast that I do, you
Speaker 1: can check out all of those over at h K
Speaker 1: five dot org o r G and hack five is
Speaker 1: also the place where I do all of my own teachings.
Speaker 1: So if you have questions about the hacker community, or
Speaker 1: if you're interested in pent testing as a profession, definitely
Speaker 1: check out our podcast there because we go through not
Speaker 1: only the fundamentals, but also the theory and sometimes some
Speaker 1: expert advice as well. Awesome, it was a pleasure having
Speaker 1: you back on the show. I'll make sure to have
Speaker 1: you on again before too long. Thank you guys. That
Speaker 1: is the history of def Con. This was a really
Speaker 1: interesting subject for me to look into. I was completely
Speaker 1: in the dark ha ha about this convention. I had
Speaker 1: only had some idea of what was going on, and
Speaker 1: the more I looked into it, the more I realized
Speaker 1: that a lot of those notions were based on misinformation.
Speaker 1: And again, big thanks to Shannon Morris for jumping on
Speaker 1: here and giving me the first person perspective of what
Speaker 1: it's like to go to one of these conventions. It
Speaker 1: sounds like it would be really fascinating. I know I
Speaker 1: would be completely out of my element where I to attend,
Speaker 1: and yet I feel like I gotta make an effort
Speaker 1: to go at least one year and experience this just
Speaker 1: as an attendee and to learn and to to see
Speaker 1: that community and to experience this for myself. If you
Speaker 1: guys have suggestions for future topics of tech stuff, please
Speaker 1: let me know. You can send me an email that
Speaker 1: addresses tech stuff at how stuff works dot com, or
Speaker 1: you can always drop me a line on Facebook or Twitter.
Speaker 1: The handle for both of those is text stuff hs W.
Speaker 1: Remember you can watch me record episodes live on twitch
Speaker 1: dot tv slash text Stuff. I record on Wednesdays and Friday's.
Speaker 1: Just pop over to that U r L and you'll
Speaker 1: be able to see the schedule there, and I'll talk
Speaker 1: to you again really soon for more on this and
Speaker 1: thousands of other topics. Is it how stuff Works? Dot
Speaker 1: com