LosT: So, welcome, DEF CON 21. Last year was DEF CON 20, this is 21. Welcome.
(Laughter.) LosT: We thought about calling it DEF CON
20++. So last year, surrounding the badges, there is always this a little bit of panic
here. Some of you guys aren't getting any audio, are you? So this is me saying basically
this is my empty lanyard. This was Wednesday afternoon last year right before the conference
and me holding up the lanyards and saying, yeah, where's my badges? Where are they? That's
the kind of stress and panic that usually surrounds the creation process of the DEF
CON badges. We try and keep pretty tight security because every year we have people that try
and figure out where we're going to fabricate. We've had people contact the PCP fab houses
we used before and social engineered them into making a set of badges for themselves
preCON. We have had people contact the PCP houses
post‑CON and get uber badges fabricated. It has been quite an adventure trying to maintain
security just around the badges themselves and with a security conference, it is kind
of ‑‑ it is not really malicious per se. It is more of a trophy a demonstration of
skill. But, you know, it's fun stuff. So this year, I've had quite a few discussions
with Jeff, Dark Tangent. For those of you not familiar with some of the traditions and
things surrounding DEF CON ‑‑ how many of you have been to DEF CON for more than
five years? So the n00bs outnumber the seasoned vets here by quite a number based on the hands
that you guys have been raising. So one of the things that you'll notice with
the DEF CON iconography is we have traditionally had ‑‑ we've traditionally had a series
of three, what I call, PIPs associated with us which are the rotary dial. Those of you
in high school, you know what that is, right? (laughter).
LosT: Yeah. So if you see the Goon badges, the rotary dial is actually a brass knuckle.
(Feedback). LosT: Hello. So the rotary ‑‑ are
you getting this? Sounds like when I talk, it cuts out.
The rotary dial was part of our culture because back in the day when we didn't have Internets
we were all using BCBs and phone lines. A kid on a Commodore 64 with a modem, the only
way you could connect is dial‑up. It suddenly became valuable to get these sprint and MCI
codes to reach out and touch your friends on Fito net and all these BCBs. It became
a big part of hacker culture to be able to get free long distance.
The smiley face with the skull and cross‑bones has become ubiquitous with DEF CON as well.
It ties into the piracy aspect. And the floppy disk, again, all you high school guys out
there know what that is. It's later cousin, the click, click, click, click, disk, I mean
zip disk. You guys all remember those, right? How many of those have a pile somewhere in
a back closet? Yeah. (laughter). LosT: Anybody still using one? Yeah.
(laughter). LosT: I'm sorry. So I talked ‑‑ I
was talking to Jeff and I said, you know, we've got these symbols that are on our lanyards,
they are on our programs and half of them haven't really kept up with the times. It
is more just a tradition. We need a fourth. We need to round out the trifecta here. So
I asked Jeff's permission to introduce a new symbol that will become part of the DEF CON
iconography. And I did this pre all of the Snowden garbage
that's going on right now which is really scary that it happened on the timing. And
so I have introduced the key hole. Now, when I went to Jeff with the key hole, I said I
think it is timeless and it fits in several different aspects of our hacker culture. I
said, first of all, we've got physical security. We do the lock picking stuff, the lock is
indicative of that. Locks and keys and key holes are also usually represented to represent
cryptography so I think we have the crypto aspect.
And I said, they're also surreptitious observation all lot of times, peeking through the key
hole, listening through the key holes. A lot of history novels will have a magnifying glass
and the key hole up there or you will see the eyeball peeking through. I thought it
was appropriate to introduce. And so from this point forward, when we do all of our
designs and everything else, instead of the three circle symbols, we will have the fourth.
You guys are really quiet. Whew! (applause).
(speaker off microphone.) LosT: So, another tradition that I'm going
to break ‑‑ oh, and side tangent. I kind of pictured this year as you know those magicians'
famous secrets reveal where the dude wore the stupid hockey mask and told how the magic
tricks were done on a cable show and he did that so that the same magicians couldn't keep
reusing the same crap over and over again. This year with the breaking of traditions
was kind of my foray into I have been doing this stuff for many, many years for DEF CON
now but my personal challenge is to try and vest myself every year with badge design crypto,
the game design and all the things that I touch. And one of the ways I'm motivating
myself to do some really good things moving forward is to do this is kind of my DEF CON's
greatest secrets revealed so I can't keep pulling the same old stuff out and keep retreading
because I think it is a copout. So one of the things we also never do every
year is we always hold the uber badge and information regarding the uber badge back
until the last day of the conference on Sunday when they're awarded. How many of you have
no concept what the uber badge is at DEF CON? So when you attend DEF CON, you get badges
that basically say I paid for the conference. They say what level you are. And you will
hear us say human and inhuman that's because the general attend dance or general populous
are referred to as humans. Everyone else is inhumans. That would be vendors, the press,
the speakers. I'm getting there with the press, just wait.
(laughter). LosT: And so you have the human and inhuman.
But you also have a very special badge every year that is known as the uber badge.
Now, we like DEF CON to be very interactive conference. It is a put up or shut up place.
It is like everybody talks a big game. Everybody has hacked with Gibson. Everybody has trained
with Bruce Lee. We have more contests than any contest. We have between 40 and 80 contests
running. Some of them are incredibly difficult and challenging. Some are just for fun. You
will see them going on as you go. You may have noticed some of the crypto that's involved
on the graphics on the floor and out in the program and in your lanyards. So if you come
to DEF CON and you compete in what we call a black badge competition which means a competition
that warrants enough effort and skill, you are awarded a black uber badge and that's
free entrance into DEF CON for the rest of your life.
To give you an idea how rare they are, last year we had roughly 15,000 people attend and
we gave out about 15 uber badges. It is a very elite club to have a black uber badge.
It is more bragging rights in the community than anything. It is kind of a token of appreciation
for people who share or demonstrate skill. But the uber badge, because it is awarded
at the end of the conference usually you don't get to see them or know anything about them
until Sunday at the closing ceremonies. You will see people who have uber badges will
often wear them from that point forward. So you will see some folks that have badges that
look like they don't match within the theme of the year. That's probably an uber badge
from previous years. Excuse me. I'm going to grab some water.
So breaking with another tradition, they say, hey, Jeff, I want to show the uber badge on
Thursday. He's like, man, what are you doing to me, Ryan? He's like you're adding key holes.
You are going to show the uber badge. You did not dye your hair. You are not wearing
a hat. The world is changing, I guess. (laughter). So, if you have noticed on your map, there
is a room listed at 1057, that is the room I will be in and I will have uber badges on
display for people to handle and look at. And we'll get more into what they are later
on. Before I move forward in that ‑‑ I'm
getting feedback here. So the last thing that I asked Jeff ‑‑ and this is a doozy and
I just thought, man, there is no way in hell he will go for this. Those of you coming here
expecting an electronic badge this year, this is kind of my it is electronic but not electronic.
I wanted to do a tick tock cycle on badge design where I do a year electronic a year
non‑electronic. So this one is kind of faux electronic in some ways. It is a PCB.
But the reason I want to do that is it becomes passe. You go to conferences and everybody
has an electronic badge. We had the blinking LEDs and last year we had a processor with
eight 32‑bit cores on a dye with a propellor chip. I don't want it to get people come expecting
an electronic badge because for my competitions if you know what to expect, it gives you an
unfair advantage to those who are new. And ironically the year I did the titanium
badges that were non‑electronic I had far greater participation by the attendees in
the competition than I did last year with the electronic badges. And I asked people
that and it appears as though people just don't want to mess with the electronics at
the conference. It is a very small subset, about 10%, because if you are not familiar
with an architecture or the language or the tool chain for a new chip, you don't want
to come to DEF CON and use up your three days here, you know, sitting at a laptop trying
to figure that out. So I went to Jeff and I said, you know, one
of the really iconic parts of DEF CON is the badge. And we keep it secret every single
year until the conference starts. And I go, I want to tell them about DEF CON 22's badge
at DEF CON 21 so that they have a year to prepare.
And he didn't get back to me for a while. He said he had to think about it. And he said,
you know what? Let's give them partial information. Let's give them a little bit information because
next year's badge will be an electronic badge. The games will be every bit as intense as
they are this year and as they were last year and the year before. But we want to people
to be able to get exposure to the tool chain and the chip and the architecture.
So we're also going to release a monthly blog that's kind of a mini how‑to on how to develop
or program for those of you who are just straight coders for what the badge will be next year.
We won't give you the details and specs on what it does.
I had prepared to announce what an architecture was today. However, I was told ‑‑ and
it was actually pretty exciting because it is a processor that is not yet released, and
I was going to be able to say, hey, we are one of the first groups to get our hands on
this new architecture. I have just been told that based on their
last engineering run, they're not quite sure they will be able to deliver chips to me in
time to get next year's badge produced. That being said, I've got to wait to tell you what
that architecture is because if they can't get me that architecture before next year,
then obviously I can't do it. (speaker off microphone.)
I can neither nor deny that. And I have set a deadline that by December
this year if that information hasn't been ‑‑ if they haven't told me that they can source
that chip for me by December, then I'm just going to pick a different architecture. I
can tell you that my fall‑back architecture will most likely be a MSP430 or something
in that series from TI. So anyway, secret information. See, it is
kind of like my doc dump. You guys have hacked into my system and getting all my secrets
and all my information. I will have to go back and rethink my security cycle, I guess.
So here on the screen you'll see some of the CAD work that was done for the uber badge
this year. And I normally use Altium for my design stuff if you are familiar with the
tool chain. I wanted to use software that was able to be accessible or free to everyone.
So all of the badges were designed on the free version of Eagle. Those of you who do
design work, that means, Simon, you are nuts, over and over again. (laughter).
It wasn't fun and I found some really cool errors in Eagle. There is an error that comes
up too many pixels in the Y direction. What the hell does that mean? That's like PC Load
Letter. (laughter). Being a hacker ‑‑ also, it was German.
Being a hacker, I took obviously my work and I rotated it because I wanted to see if there
are too many pixels in the opposite direction. There's not. (laughter).
I still don't know why I got that error because I couldn't reproduce it just by ‑‑ because
then, of course, you start reducing a bit at a time to find out where that extreme is,
right? So this year's badge, the uber badge specifically
is a homage to my grandfather. He was a watchmaker. He said when he was in watch making school,
they would hand them raw metal and they had to make a watch. That included the springs,
the case, everything. Since this is something I just started doing since last DEF CON, I
didn't have that level of skill or the equipment to do that. So I ordered some of the parts
preassembled but then assembled those parts. For those of you familiar with watch making,
I couldn't possibly do the hair spring to the balance wheel myself so those came assembled.
If you look at the graphic that's on the bottom there, most mechanical watch movements only
have five main components. And I had this whole cool spiel prepared to show how we could
map security and hacking in using the watch to move that forward but then I decided I
can't share that with you yet because it will ruin some of the badge challenge that is happening
this year. If you go across the bottom, you have basically
a mainstream and the balance wheel and the escape that controls how the energy is released.
That's kind of like your firewall. And then at the end, the 5 and the 6 are displayed
to show you the time. So all of the glass that's on the uber badge,
they are actual watch crystals on the front and the back. Can you hear this?
(Ticking). Yes!
LosT: So it is really hard to sleep when you have 30 of these ticking in your room.
(laughter). And I'm getting to the point now where I just
started blocking the noise out because I have been working on these for so many months.
It is just ticking all the time. There's some of the movement out with the
PCB on top on one of my desks. (Clapping).
LosT: Thank you. Somebody clapped. (applause).
Yeah, they were just a little bit of work. So all of them were hand assembled by myself
for the ubers. And that's why I can only do the ubers like this because there's no way
I could possibly get 15,000 badges done for all you guys. Sorry.
There's a few more pictures and I will leave that one up there for a minute in case anybody
is participating in the badge challenge because I thought you might want to get a picture
of the code that's on the back there. Geez, you guys are quiet. This is DEF CON. You know,
the people that are new here, you are supposed to make noise and yell at me and throw things.
Yeah! LosT: This is not black hat.
(laughter). LosT: I mean, this is not an infomercial
or a trade show. (speaker off microphone.)
LosT: What's that? (speaker off microphone.)
LosT: Are you done? No? Yes? Ten seconds. Marco.
Polo! (laughter). LosT: By the way, the copper that's underneath
the solder mass doesn't quite show up in the picture, just FYI. Some of you may have noticed
that on your own badges. There's some ‑‑ well, we'll get to that in a minute. So one
of the other things we did this year, more variations on the badge than ever. So up until
the time I started doing the badge design, we always did: Here's your human badge. Here's
your press badge. Here's your speaker badge. And there was only one human badge. So I started
because I'm a masochist doing multiple human designs to give you guys some variety and
flavor and it gave me more of a design palette for the crypto challenges.
I won't tell you how many because that's part of the game is for you to figure that out.
There are more human variations than we have ever had. In addition to that ‑‑ there
is us doing some of the sorting of the badges to make sure when we distribute them, there
was a mixture. Because there was one year, last year actually, the registration desks
were taking the boxes as they came in. And, of course, even those there were multiple
designs they came grouped together so all of a particular badge were going out like
on Thursday and all on Friday and it prevented people from moving forward in the game because
they couldn't find the other variants. So we actually hand mixed up all the badges this
year. (applause)
LosT: So, like I mentioned before, we have these things we call non‑human badges. You
will notice that all of the non‑human badges this year are, in fact, face cards with the
exception of one. That would be the press badge. The press badge is a deus.
(applause). LosT: And for the slow kids in the audience,
that is my "fuck you" to the press. (laughter). LosT: Oh, deuce. I get it. It is spelled
differently. The one on your left is the vendor badge. That's why he has the bit coin. The
one in the middle you got to kind of figure it out. But the base behind him is a GNL base.
So that's a little bit of a hint. So I added two new card types because, no
poker came would be complete without the ability to get the hack hand. I introduced the hacker
card and the crypto card instead of the two jokers. If you get a hacker, crypto, ace and
king you have the playing hand. There was to add variation. Those of you who have purchased
some of those decks, they came with two hackers in them because they did a misprint because
everything I do seems to get screwed up in production somehow.
We actually got the crypto cards printed and overnighted and we have them. I'm going to
have them in my 1057 room. So if you bought one of those decks, bring it in there. Show
me the deck and I will give you one of those crypto cards. So there's your hack hand.
(applause). Limited number, I think we made 2,000 or something
like that. So there is not very many. If you guys like them, we may do a blank run for
next year or whatever. For next year, I have been talking to Neil and DT, we think we have
a theme picked out. Won't release what the theme is but I was very excited that Jeff
actually gave me permission to tell you guys that we are he a going to release information
about the badges. And it feels kind of wrong and kind of dirty to be breaking tradition
like that, that we've been doing this for so long. But I also think it is time to move
forward on some things. And just like in the security field, if we don't continue to innovate
and move forward, we'll stagnate. And I think that's starting to happen in some areas, so
I really think we need to push the envelope and I hope that's what we do hear at DEF CON
and I hope that's what all of you do when you go back to your respective schools and
places of business. So thanks. The people in the front are clapping
for me. Yeah, come on! Innovate! Aren't you guys tired of shit being broken? Come on.
(applause). So if you take a look at your badges, some
of them, not very many, but some of them are four‑layer boards, not two. And I won't
tell you which ones they are. But they are ‑‑ the ones generally ‑‑ the general populous
badges are a two‑layer PCB with exposed copper a solder mask and were designed in
Eagle. The artwork could be done as vector art in Ink Scape. So I'm hoping to inspire
you, those of you that haven't even thought of it, you can download free tools and crank
out a circuit board like the one you have around your neck.
A what? LosT: A circuit board which is what they
are. They are printed circuit boards, PCBs. (speaker off microphone.)
LosT: Maybe. There may be other things. It's copper. You can solder to it. Just because
it doesn't look like a pad doesn't mean it might not be.
So, anyway, you guys like them? Are you enjoying the badges this year?
(applause). You guys make the CON for me. You do. I put
a crap ton of work into the stuff that I do. It's a unique challenge to design cryptography
puzzle that is are designed to be broken in a temporal space of about three days.
For smart people like that because you are all smarter than I am ‑‑ you are. I'm
just like this retard in my closet with a soldering iron and coding and I slap stupid
crap together and I come to DEF CON and barf it out and you guys actually solve this stupid
crap that I put out every year. And I'm amazed every single year somebody solves a piece
of the puzzle in a way that I had not even thought of. And that's why this is a hack
CON. That's why these are my people. That's why I can come here and do stupid crap like
that and not have to justify myself. This is my one time a year ‑‑ (applause).
This is my one time a year I can go in a large group like this and not feel like that odd
duck or I have to explain my T‑shirt or I have to explain why I did what I did. And
I hope you all feel that way, too. And for you guys that are new to DEF CON, everything
that I do in these contests is designed to make you interact with each other because
I know most of us tend to be introverted based on personality types that gravitate towards
certain fields. I have a background in mathematics. I'm used to looking at my own shoes.
I encourage you to talk to each other. You have an ice breaker around your neck. You
have an excuse to say: I haven't seen that badge yet, can I see that? In order to see
that, you have to be close to someone. You have to interact. I encourage you to do that.
I also encourage you to do that because it makes solving the puzzles easier and it is
actually impossible to solve the puzzles this year without looking at other people's badges.
Same thing was true last year and the year before that.
To me the most important thing that comes out of DEF CON are the relationships that
are built here that then produce other fruits that might not otherwise be out in the world
because I think there's too much wrong with what's going on. There is too much wrong in
security. We've seen a lot of bad stuff coming out in the news lately. And you all understand
we're odd. We're the odd folks in this ‑‑ if you go out and you think about the average
IQ of somebody on the planet, it's kind of frightening, yeah.
So, anyway, I'm glad you're all here. Welcome to DEF CON 21.
(applause) You're going to have to be more lively than
this for your other speakers. This is open ceremony. You have speakers up here who will
be drinking while they present and they want to talk to you. If somebody starts talking
bull shit in their speeches, call them on it. That's why we are here at DEF CON. Welcome
and have a great time. (applause).
Do I release the hounds now? What do I do? Tell the security story.
LosT: You guys want to hear the TSA security story? So I hand carried the ubers and several
of the badges and I had them in a box and duct taped shut with black duct tape. Probably
not the best choice. (laughter).
And I took it in my carry on because there was no way in hell I was going to check this.
This was real glass. These will break. So I checked the box. It is going through the
x‑ray machine and the lady is looking at me. And she looks at the screen and she looks
back at me and I see her eye kind of raise. She looks back at the screen and then they
do the whole call someone else over. According to Bruce, the security theater began. Curtain
rose and act 1 started. (laughter).
The TSA had another gal come over and look at the screen and, of course, then they pull
it out the other side of the x‑ray. Sir, is this your bag? Yes, it is. Would you mind ‑‑
because it was in a box inside of my carry on. So she goes, I'm going to take it out.
I said go ahead. Please be careful. It is fragile. (laughter).
So don't ever tell TSA something is fragile because they take that to mean explosive,
I guess. I don't know. Because, you know... So they open up my bag and once you open the
bag, then you can start to hear the ticking noise that's going.
(laughter). TSA doesn't like little boxes wrapped in black
duct tape that tick that show up with extreme amounts of metal in the x‑ray. Especially
when there is a big fuckin' skull on it. (laughter)
You know what? It was fun and I'm glad I made my flight. How's that? And consequently, that's
not the first time this has happened to me coming to DEF CON. I had the mystery boxes
declared as bombs at least four separate times and we have had hotel security here as people
competing in the mystery challenge carrying these metal boxes with mercury till sensors
on them so they are balancing them very precariously because if they tilt them the box wails because
I'm a jerk. (laughter). I will give you this one and then I got to
let you go. I had these thick steel boxes that were made out of a tube. And they had
locks on the top and bottom. And I put the mercury till switch inside so they couldn't
tilt the box but they had to pick the bottom lock first. I got these big ass heavy boxes
they can't tilt and they have to go up through the bottom. You have people holding these
boxes that weigh 50 pounds over the head of some guy who is underneath trying to pick
the log from the underside. And so here's security walks by and here's these guys holding
the box and you got this guy on the ground. (laughter).
And there were blinking lights on the outside. Looked like a bomb. So, anyway, those are
the kinds of stories that I will never forget about DEF CON. Anyway, thank you very much.
Have a great conference. (applause).
Okay, everybody. We are going to clear the room. So if you are seated, unseat yourself
and move towards the exits. Thanks a bunch.