DEFCON 21: L33tism Yields to Unrestricted Access

Projector Art in the
Chillout Cafe at DEFCON 21

The hacker community is many things. We are curious, smart, knowledgable, subversive, rebellious, libertarian-leaning, technical, opinionated, unorthodox, and l33t.

But most of all l33t. Historically, we felt special, like our merits had won us the right to gloat in glory. We dabbled in technoarts and arcane secrets of circuits and mystical crypto that put us above everyone else. We were the best of the best, we pwned every test, earned the right to beat our chest.

Well, I didn't. Only "real" hackers did, and I wasn't a real hacker. In the DEFCON recap I wrote in 2009, I called myself a "Hacker Groupie". That was bullshit. Because I am every inch a hacker, and always have been, since second grade when I solved the weekly brainteaser without fail. When I begged my parents for a chemistry set. When I used university lasers to run the Michelson-Morely experiment. I'm less technical these days than I ever have been, with my shift away from a thirteen-year IT career in 2010, yet I am still a hacker.

Hax0rz Wild!
From the DEFCON 21 Playing Card Deck

L33tist hacker culture is changing, and it's about damn time. L33tism comes with problems. L33t = elite = elitism, and the price for that is exclusion of alot of really smart people who belong, but are too humble or shy to think of themselves as hackers. For too many wasted years, I was one of those people on the outside looking in, wishing to be part of an exclusive club that I actually had every right to belong to. It took meeting someone who never asks for permission and didn't think I should either. Roland taught me that to belong, I had to shove my way into the circle and simply be who I am. I had to have the rights granted to me by a boyfriend before I could enter.

No, this is not going to be a rant against sexism, though I will address that topic at some point. My exclusion wasn't due to my gender, though that was a factor. I self-excluded because I bought into the chest-thumping and was unwilling to call bullshit and be who I wanted to be. Too many men and women have done the same. I met several of them at DEFCON this year, and I tried to talk them into realizing their potential.

In 2009, at my second DEFCON, I somehow considered myself an outsider, a groupie, a tagalong. This year was my sixth DEFCON. Why did it take so many years to finally stop feeling like a poser? Like any topic worth talking about, it is complex and there are many reasons, but I want to focus on culture here, since I've been around to observe it since 1992.

To be fair, my outlook on hacker culture is just one perspective based on my six DEFCONs, my lifelong-passion for computers, living on BBSes and IRC for a decade, and my career in IT. It's a bit like dipping a thermometer into the water from various beaches over a 20 year period and declaring the global average of the ocean. But that's the nature of commenting on culture. It's hard to get an objective look without running a longitudinal study and relying on survey data from a group of anarchists who want to break every system. No such study exists, so you have my analysis from my point of view in my little corner of geekdom. If you have a different take, please blog about it or comment.

The source of l33tist culture is perfectly understandable. Even the broader geek culture attracts the cocky and self-assured who try to prove their worth by one-upping everyone else through superior skills and knowledge. I've called this the Geek Hierarchy, and it likely comes from a feeling that merit is all we have. We were bullied and rejected by the mainstream as kids, so we learned to distrust people and instead trusted our hobbies. We embraced them fully, clutching at these remnants of our self-esteem, which entirely revolves around the things we're good at doing. So it's no surprise when many of us shove our knowledge and skill in other people's faces. I've done it. Many of my friends have done it. The gloaty tone of voice is part of the geek affect. It's part of our identity.

Hacker culture became a distilled versions of this. After all, hackers were the smartest of the smart. They'd earned the right to snobbery through sheer prowess. Breaking into hacker culture was like getting root. Aside from the need to understand difficult technical concepts, social firewalls included strange language, snarky attitudes, isolationist cliques, and intellectual superiority. There was a sense to outsiders that in order to be accepted, you needed to capture some impressive trophy that all other hackers previously thought impossible. 

Worse, when a newbie wanted to break in by doing, and requested help, even Linux help channels met questions with rudely stated RTFM flames. Back then, you learned quickly to never ask questions unless you had already proven yourself l33t. And sometimes that meant giving up too soon or never trying in the first place.

RTFxkcd

In reality, the bar isn't actually set all that high. Had young Luna in 1992 realized this, she might have thought it worthwhile to jump in and start hacking. She might have realized hacking is like anything else -- everyone learns the basics, then the intermediates, and if they really want to go far, they're finally prepared for the advanced stuff. I thought I had to start with the advanced stuff because of the swagger of those who'd already been down that road. I didn't have patience in myself to struggle with the basics because I didn't see the point. And no one was about to help me.

I wasn't unique. There was a perception that the bar was set at the top of Mt. Everest. This perception hasn't changed. I've seen through the illusion, but thousands of others haven't. When I got back, I chatted with a friend who was worried DEFCON was too technical to be useful in his job (he works in IT). At the con, I chatted with a girl who had previously been "The Girlfriend", but this year had her own badge. She still didn't consider herself a hacker, even though she's a skilled lockpicker with a mathematics background and an interest in pen testing and crypto. I pointed her to the online tools for learning more crypto and pen testing, and gave her permission to call herself a hacker.

Another guy has been trying to convince his girlfriend to come to DEFCON. She knows how to something-something with DNA (the technical terms escape me, because it's not my field, but I knew what he was talking about), and considers it "easy", and yet he can't get her to go to local biohacking meetings or to DEFCON because she feels she's not good enough. I told him it sounded like she qualified to give a home-biohacking talk at DEFCON, because she knows how to do things I don't, and I'd love for her to teach me how.

This is a problem. There aren't enough qualified employees in the InfoSec world to fill demand. While the numbers have been improving, unemployment is still at 1.95% (as of April 2013). What that means is that when a company wants to hire a hacker, they will have a difficult time filling the position. This is detrimental to the IT industry, as we struggle to secure infrastructure. It is detrimental to employed InfoSec workers, who have to do the work of two or three other people. It is detrimental to our economy that companies can't expand quickly enough, or they are forced to expand with unsecured systems even though they very much would like to secure them. It works against the goals of the white hat hacker community, who wants to evangelize security to the world, but don't have enough bodies to do so.

It's also a problem for more squishy reasons. The hacker community needs an influx of new minds. We need entrepreneurs to build new future companies and non-profits inspired by the hacker ethic, not just in InfoSec, but in biohacking and other fields. We need fresh perspectives and new thinkers.

Two new cards, Hacker and Crypto,
allows for a "HACK" poker hand.

Perhaps most importantly is the principle of the thing. Elitism has always been at odds with hacker community ideals like openness, democracy, & equality. These contradictions need to be corrected. In general, hackers want an open society while clinging to privacy and secrecy for themselves. Hackers want open source, yet fail to make participation welcoming and accessible to all. Hackers protest the 1%, yet hoard a wealth of knowledge through snobbish attitudes and indecipherable language, effectively establishing themselves as the intellectual 1%. Hackers want everyone to be included, yet mock newbie mistakes, underestimate women, and require proof of worth before allowing access into exclusive social circles.

DEFCON should be proud of it's meritocratic society. Merit certainly does need to be rewarded, and in the past, bragging rights and social glory was a generous reward indeed. But so is camaraderie and having more friends and brilliant minds in the community. That is the direction we should be headed. And I think we are.

Up until recently, I was blindly unaware of this dynamic. I was a part of the system itself, and therefore, ignorant of it. As an outsider, I played the game by staying outside. As a geek, I gloated along with the rest of the geeks, (though I at least tried to be inclusive and not require proof-of-geekdom). As I slowly embraced my hacker side, I gloated in what little cred I had.

It took the cultural shift at DEFCON this year to set the past in stark relief against the now, and to show where as a culture, we've been wrong. The shift wasn't sudden. It's been building, evolving for years, as DEFCON has grown from a handful of people to 14,000, and as computer ownership spread from the rare nerd to every single household, and now to every purse and pocket. In recent years, the shift accelerated as prominent figures like Lost giving "I'm just like you" and "Be by doing" talks to thousands of hackers.

Hacker Spaces and DIY Maker culture has also influenced hacker culture to include rather than exclude. Makers preach a populist message to the masses: Make it and fix it. You can do it. Anyone can.

But perhaps a larger influence is generational. We GenX were born jaded. As youth, we were characterized by our rebellious nature and distrust of authority. We have since matured and mellowed. And while we still have plenty of distrust in authority, we've learned to work within the system. We've proven ourselves in a hundred other ways, and no longer need the trophies and chest-thumping.

And "kids these days", why aren't they replacing our immaturity with theirs? Because GenY is very different. They come with built-in self-esteems. They may have been bullied, but they don't know what it's like to be excluded from society merely for owning a computer or being into sci-fi (hi Harry Potter and Pokemon). They also tend to trust authority and each other a little more than we did. I believe GenY is less interested in cliquish crowing and more interested in making things with others. (Now get off my lawn.)

The GenZ has something neither GenX or GenY had. They have rootz Asylum (formerly DEFCON Kids). This year, there were hundreds of kids, and again, they found dozens of 0days in real products, including the Samsung Smart TV. The kids had several tracks of programming and a bunch of contests just for them. One was an elaborate capture the flag game. As I watched the Social Engineering CTF, sometimes a trained military sniper stood on a chair and nerfed little kids who ran through the room to deliver a package.

Art in the Chillout Cafe, video.

Filmed by Roland who chats with a stranger.

Another welcome change this year was a steep reduction in sexism. What sexism I saw was on the ground-level, committed by individuals, and in one case via sheer ignorance from newbies and not malice. No more presentation slides showing bound women. No more sexist comments by panelists. No more icky behavior supported by Goons. No more bingo cards with "Tits" as a requirement. And no more parties with themes like "Pimp". I'm pretty sure this was all intentional, and I certainly noticed. The waves of these actions are rippling down to the ground level and causing real change. I heard zero talk from women about feeling uncomfortable. That's not to say it didn't exist, but if it did, it was certainly subdued.

I was a little afraid that a less-sexist DEFCON would mean less fun. But nope! Sexual freedom maintained an appropriate level of looseness, and discussions about sex at parties still flowed as liberally as the alcohol. So it seems it is possible to strike a balance between freedom and respect for women. Huzzah!

Skulls know no class or hate.
Every skull is l33t!
(Except for numbskulls. They're dumb.)

The one incident worth noting happened when I was standing in the badge line. The group of guys behind me couldn't seem to stop talking about sex and cute chicks and the body parts of cute chicks and the penis-shaped light-saber one of the Goons carried. It seemed to be their only interest. I started to get hungry and realized the only snacks I'd brought were pepperoni sticks and a banana. I remained hungry because there was no way I would be putting either two phallic symbols in my mouth and give them a chance to harass me about it.

Later on, they started talking about other things, and I joined their conversation. I learned they were DEFCON first-timers, and in reality nice guys. That's how most of these things work, and why I'm hesitant to turn into a flaming furious feminist without giving people a chance. The uncomfortable environment they'd created was unintentional, and I'm sure they remain ignorant to this moment about how their conversation might have affected me. There was no point in explaining it to them, since this sort of thing is really hard to convince anyone of in the moment. Instead I blog about it and let culture work its magic.

The influx of DEFCON newbs does create some ground-level cultural awkwardness. Being inclusive of plebes means they won't immediately share the sense of tolerance for fashion that DEFCON has always enjoyed. At a Thursday party during the cusp between Blackhat and DEFCON, Roland received some guff for his clothing choice. If you've ever been to DEFCON (which these guys apparently hadn't), you would quickly realize that the black Utilikilt is a traditional geek uniform. Most guys wear jeans, and those who want to spruce up a little wear kilts. At this party, a couple of guys told Roland his kilt made him look gay and it wouldn't help him pick up chix. Roland told them he wasn't dressing for them and was doing just fine with the womens, kthanksbai.

Given the prominence of the Queercon party and the fact that many of the Goons are from west coast cities and tend to be socially liberal and that DEFCON in general has become extremely LGBT-friendly, I doubt their attitude lasted long into the weekend. Girls like me happen to think kilts are dashing. I'd definitely hit that, but no so much the guys who concern-troll any sort of gayness.

The Wall of Sheep was almost empty this year. For those who don't know, DEFCON NOC traditionally packet-sniffs for passwords going over the network in the clear. They post pwned pws on a giant screen called the Wall of Sheep. It's a very good thing the number of pwnable pws is going down. In part, credit goes to DEFCON having two wifi networks, one being (more or less) secure. But also heartening is that more internet services are forcing SSL for logins, which is a beautiful thing. In 2009, my Twitter account got owned, because Twitter didn't use SSL at the time. This time, nearly all the ten or so sheeped accounts were unencrypted POP3 and IMAP.

DEFCON 21 Playing Card.
I mean, badge.

back

The badge, as usual, was very cool. ~54 unique badges represented playing cards. The suits were replaced by the three DEFCON symbols (smile & crossbones, diskette, rotary dial), plus a new one added this year: a keyhole. They were printed on circuit boards (PCBs) but with no evident electronics. Part of the badge puzzle involved using a multimeter to trace internal wiring. The Uber Badge (given only to those who have won DEFCON's most challenging contests) included a watch mechanism designed and hand-built by Lost. He chose that design to learn a few of the skills his grandfather must have known as a watchmaker.

Uber Duber Badge!

Badges will alternate yearly, electronic and non-electronic. Next year we can expect batteries and blinkies again.

Crypto Sign is part of the DEFCON 21 Badge Puzzle.
I still don't know what it means!

I didn't work on the puzzle at all this year, other than taking a few notes. I was far too caught up in attending talks and other DEFCON activities. I did recognize that one of the rotunda decals looked like a giant clock. People in the hall around me didn't seem to realize this. It was set to 7:50:15. That's the only thing I solved. Lots of other people participated this year, though, and I think there was far more in-person socializing, since a special room had been designated for participants to network.

See? It's clearly a clock!

My experience of attending talks was colored slightly by my unpopular opinion of the Edward Snowden and NSA stories which were prominent this year.

I proudly will keep this
and hold it ironically close to my heart.

I don't want to get too far into my opinion, since that would be its own post. Short version: I think Snowden is an idiot and that Greenwald is one of the most irresponsible journalists this side of WorldNetDaily.

 The NSA is in need of criticism to be sure, but what Greenwald presented is not what the NSA is actually doing and not what the leaked slides show. Prism and Boundless Informant and XKeyScore have been debunked, and here, and here, and many elsewheres. At Blackhat, General Alexander confirmed the conjecture made by tech-journal debunkers. The cellphone metadata story has more meat to it, though it was also exaggerated to some extent. I wish that's what the discussion is centered around, because I like discussing facts, not made up stuff that should be on Snopes.

I was greatly saddened by the fact that DEFCON attendees, speakers, and Goons seemed to be buying the sensationalist narrative. The technical community should know better. Of all people, hackers should be able to reality check Snowden/Greenwald's claims and see right through it. I did. Unfortunately, the story hits hacker-community fears related to government surveillance and loss of privacy rights and a historical mistrust of government. The cognitive consonance is just too delicious to let go. Just goes to show we are all vulnerable to cognitive bias attack-vectors, even the most brilliant of us.

The NSA inspires a lot of tinfoil hats at DEFCON 21!

Tinfoil Tophat
Deflecting government brain scanners in style!

So many of the talks I attended assumed everything Snowwald/Greenden said was true. Some of the speakers seemed to know the reality, but made no attempt to clarify or discuss the debunkings, so everything they said still went through the Snowwald filter of OMG THE GOV CAN SEE ALL MY EMAILZ FROM FIVE YEARZ AGO!!11oneeleven.

I spent alot of the talks squirming in my seat and madly tweeting opinions (pontifitweeting?). I will spare you since you can read it on Twitter and I don't have room here for a more detailed explanation of my controversial opinion.

I will specifically call out the ACLU talk on the subject, since they ought to know better and did nothing to debunk the myths. The way they phrased things, they seemed to know the truth of it, but anyone who hasn't seen the debunks would have had their bias confirmed by everything the ACLU said. So it was a bit dishonest. But I'm sure they made more money from it.

The one argument I get regularly is the "Ends justify the means" rationale. It goes something like this: No one listens to privacy advocates, and there is still bad stuff going on, even if it's not the way Snowdald says it is, so this non-issue gives attention to the topic in general, therefore the story is good even if it's wrong. I counter-reason that all arguments should be based in fact so they cannot be easily dismantled. Fighting against imaginary dragons does nothing to defeat real dragons.

That said, the EFF did bring in ~$100,000 this year at DEFCON, so in that sense, maybe the Greenwden hoax has an upside.

Another happy thing about the EFF is they seem to be shifting their stance on the "What to do about privacy" problem. They seem to be promoting more reciprocal transparency side, which is to say, the only way to combat ubiquitous government cameras is to focus on defending the citizen's right to point cameras back at the government. Let the Feds look, as long as we know what they're looking at and why. It warms my heart, because I've hesitated to support the EFF while they uselessly spin their wheels trying to keep the government from snooping.

I attended a talk by Mudge, an old school hacker whose been working for DARPA for the last three years. He told a number of interesting anecdotes centered around a theme about communication between the government and hackers. We come from two very different cultures, and in order to communicate between them, everyone needs to consider the language we're using. Feds need to act like diplomats entering an advanced alien civilization, and hackers need to realize that Feds are focused far more on doing their jobs than on how to fuck with citizens and hackers.

He suggested that in order to be trusted, the Feds need to give back to the hacker community. They need to show up at hacker cons and give technical talks to share things they know. And they need to realize hacker = researcher, not hacker = criminal.

He also pointed out that between private companies and the government, no one is incentivized to improve security. Defense contractors actually get financially rewarded for letting secrets leak, because our national strategic advantage is in being the most technologically advanced. When secrets leak, contractors get new contracts to produce new tech.

To hackers, he implored us to reward the government for good behavior. When a department or elected individual does something awesome, praise them. Help them. Encourage them. Offer assistance.

I also attended the opening talk and closing ceremonies, as well as Lost's talk on Decrypting DEFCON. Aside from dropping badge clues and describing the badge design process, Lost again evangelized on a theme of "doing". This time the underlying point was, "You'll be a better hacker if you understand the technology and knowledge that underlies the high-level stuff you're doing." To developers, he encouraged learning binary, processor logic, and assembly. The best quote I pulled from this talk is: "Technology is nothing more than learning to communicate." Which is a bit like I used to say in my job -- writing is programming where humans are the hardware. These fields have so much in common, which is why, as a writer, I still feel confident in saying I'm a hacker. Especially since I'm currently writing about mind exploits.

I also attended a thought-provoking and balanced talk on white hat hacker ethics by Alex Stamos, and an emotionally difficult talk by Amber Baldet on suicide risk assessment and intervention. I caught the tail end of a village talk on tamper evident basics, if you've ever wanted to open an envelope or void a warranty without getting caught.

I spent a little bit of time watching people peel back "VOID" tape in the Tamper Evident Village, though I didn't stop long enough to do it myself.

The villages may be another part of why DEFCON is growing to feel more inclusive. There were four this year, the Lockpick, Tamper Evident, Wireless, and Hardware Village. Tables were strewn with tools and materials for practicing the craft, with helpful experts available to teach and demonstrate. The villages permit a hands-on experience, and since they cover the rudimentary basics, and say "Yes, everyone can pick a lock or solder a circuit", they reveal that the price for entry to learning hacking is actually quite low. Everyone starts somewhere, and it's stated clearly that no one will to judge you for not knowing anything or asking newbie questions.

This year, Roland and I challenged one another to submit talks next year. We're already busy working on our ideas. I know exactly what I'd like to speak on: Reverse Engineering Mind Control, using Mormonism as a case study. I bounced the idea off a couple of the people who run Skytalks, and they like it. While I love hacking tech, I've always been more comfortable with squishy topics, like culture, religion, and psychology. Which doesn't mean I'm good at people -- quite the opposite. I just think people are the most interesting type of machine to analyze.

Last year I said DEFCON was the best EVER. And this year, I would say I was the best Luna ever at DEFCON. Part of this of course is that I'm always self-improving. But the biggest change this year is that I was on an SSRI for anxiety. (Say it with me, Selective Serotonin Reuptake Inhibitor. What a fun phrase!)

I couldn't ignore the change. My social anxiety was gone and my inhibitions towards talking to people nearly vanished. No more internal feedback loops of self-conscious second guessing. I just opened my mouth and let words pour forth not worrying too much if I'd say the wrong thing or talk to the wrong people or monolog too long. My bravery was greatly rewarded because people actually engaged with me. I met so many people and had so many great conversations. I stood up for myself and others when needed and didn't worry I might be hurting someone else's feelings.

For years I've tried to talk myself into not being afraid, but talking never quite did it. Medication did. So hacking-the-Luna-through-biochemistry project was a huge success. Moreover I felt more aware during conversations, like the world of humans had slowed down just enough for me to understand what was going on and think well enough to respond. Any awkwardness I felt was a mild discomfort, not the mind-scorching panic it would have been a month ago. My Aspergers diagnosis has also given me an understanding of the many causes of my brokenness so I can accept those things about myself and feel a little more l33t because of it. It wasn't a panacea. I still have old habits and hesitations. But I now have hopes my attempts to rid myself of them will go smoothly.

I had the wonderful opportunity to meet Bernie Mojzes, editor at Unlikely Story, where I was published last year in the Journal of Unlikely Entomology. There are currently calls for stories in the Journal of Unlikely Cryptography, so if any DEFCON writers are reading this, make something and go submit it. I plan to take my own advice here.

The parties were also great, as usual. We didn't party too hard this year. Queercon was good but it will never recapture the intimacy and fun spirit and wild dancing it had at the much smaller room in the Skyboxes at the Riv. We found a small private party offsite at The Palms, hosted by (I think?) PasswordCon. It was in a suite that looked strangely like the one in Four Rooms where Quinten Tarantino chops off a guy's finger. No fingers were lost, just good conversations were had.

The Freakshow was sadly canceled due to the death of Barnaby Jack, who worked for IOActive.

DEFCON threw a poolside party instead, and we were treated to some sick rhymes by Dual Core, and the impressive medley of musical madness played by the Sex Havers who were having way too much contagious fun to not enjoy every second of it.

I missed watching DEFCON: The Documentary at the con, because the timing was awkward. But I'm looking forward to torrenting it and pressing play. So many thanks to Jason Scott and DEFCON for making this film.

So many other things happened, which I will remember after clicking "Publish". If you'd like these sorts of things to happen to you, head on down to DEFCON next year. The only requirement is that you be interested in related topics like information security, national security, privacy, data, locks, cryptography, solder, robots, cyberwarfare, or social engineering. That's all it takes to be smart enough. Join us and learn. I give you permission.

Past posts about DEFCON:
Defcon Recap 2009: Adventures of a Hacker Groupie
Culture War at Defcon 17 (by Roland Lindsey)
Defcon 19 Badge Contest: In General
Defcon 19 Badge Contest: In Specific
DEFCON 20: Coming of Age
DEFCON 20: The Badge Contest

UPDATE: Edited to correct the fact that Dual Core is actually on Spotify, and Dual Core is two words not one. :D

Paid, Published Story: Let the Bugs Work Themselves Out

Wait, what? I forgot to announce on this blog!

I sold a story. And it is now published at the Journal of Unlikely Entomology's 'Hello, World' mini-issue. The theme: A new world begins when technology and insects meet.

The title of the piece is Let the Bugs Work Themselves Out, and in short, it is about cyberpunk ants. It is my first paid, published story, with a real live editor and everything! I've read this piece aloud at two public readings, and it is the favorite of my pieces. It was reviewed favorably at Locus Magazine.

Read it here.

DEFCON 20: The Coming Of Age

My first DEFCON began five summers ago, right after I met Roland.  He told me in three weeks he'd be flying down to Vegas.  I immediately knew what con he was talking about.  I'd dreamed of attending since I'd first heard about it in the late 90s.  I hadn't gone for two reasons: as a penny-pincher, I didn't like wasting my money on plane tickets, and... I didn't think I had any right to be there.

Awesome Track 1 Stage. Each bit is hanging in 3D.
A projector makes this interesting throughout the con.

I couldn't have been more wrong on both counts.  That was 2008, DEFCON 16.  I flew down and I had a blast.

Now it's 2012, and the 20th DEFCON known to mankind.  To put history into perspective, the first Defcon began right about the time the World Wide Web was being invented.  It was before Yahoo, before Amazon, before blogs.  It started during a time when terms like "email" and "download" were known only to a small minority of people, an extremely niche subculture.  I remember that time, even if I do not remember the first Defcon.

Like every year, this con was bigger.  Way bigger.  I would estimate, based on badge sales rumors, that there were roughly 16-19,000 people total.  (There were thankfully plenty of badges -- no one went home with a paper badge).  And not only did I feel like I belonged, I felt like a veteran.

Almost everyone I talked to said this was their first Defcon. When speakers asked for shows of hands, about 40% of the hands went up. This was a Defcon of newbies. Welcome n00bs.

The theme for me this year is a lesson that has been slowly dawning on me for the past half-decade.  It's a lesson that applies to all areas of life: Hacking is Doing.  The winners, leaders, experts, and elite in life are those who simply DO.  Life isn't High Fantasy.  No one is born The Chosen One.  Magic powers aren't something you're born with.

Destiny is guided by doers.  Not even by people who decide they want to be good at something -- but people who decide they want to learn.  People who want to play.  People who take a little time to do more than simply consume.  Those who make something.  There is no certification for cool.  There is no pay-wall, and all l33tist clique-barriers are social illusions -- merely games played by doers.

Fun facts: They let anyone into Defcon.  And you can be a hacker, too.

Want to be an expert at crypto?  Go solve some puzzles.  Want to learn about application security hands-on?  There's an app for that.  Want to play at being a hacker, or even become an expert?  If you have a mind for wiggling through cracks -- and if you're interested, it means you have a mind for it -- then go get it. Any other related field: hardware, programming, lockpicking, Morse code. Go learn it just because. There are some links, and you've got Google.  No time has ever been easier. (A shout-out to two more hacking-related games: Telehack and Uplink.)

The field is wide open.  I don't work in IT anymore, but if I did, I'd head straight for a job in infosec.  Unemployment is less than one percent.  You do not have to be Uber to be useful in this field.  Pen Testing is about finding low-hanging fruit -- the obvious numb-headed simple security flaws that anyone could find, if organizations gave a crap and bothered to hire you.  If I wasn't focusing on this writing career, I'd go immediately into that field.  And I'd be damn good at it.  Even though I'm a newb.  All it takes is a driving curiosity and an passion for peering inside closed boxes.

Did I mention Defcon is inspiring?  It was especially inspiring this year.

Lost preached the "Just Do Things" message every time he had a mic in front of him. As I said, it's a lesson life has been slowly teaching me, and Lost is a perfect example of this. As he tells it, he came to Defcon not that long ago as a newbie and immediately involved himself.  He started up a robot building party in one of the rooms and gathered lots of people.  He made himself official.  Simply by doing.  Now he's one of the "Elite", and his point, which he drove home over and over is: You should just go do things, too.

All DEFCON Badges Designers are born with a special birthmark,
proving their magical birthright from the gods.
(Not really.)

While I made a lengthy critique of the badge puzzle this year, the lasting message is that there was a badge puzzle this year.  Because Lost went and did it.  Not only that, but even though I made no progress on solving it, it rekindled my interest in puzzles for the second year in a row.  Three weeks after Defcon I'm still rabidly chasing puzzles.  I'm playing The Secret World because it has puzzles (and we are introducing two of our kids to the same joy).  I'm casually poking at TryThis0ne when I get time.  And I've started playing text adventures again, something I've not seriously done since I was 12.  (A Scott Adams girl here.)  My mind is filling with ideas for puzzle games that I could write, and even though I know I won't have time to actually do them, the energy is spilling into my other work.

Everything cool at Defcon exists because someone just up and did it.  From the electronic badges to the lockpicking village to each of the talks to the contest winners.  To the existence of Defcon itself.  People who are cool at Defcon are people who do.  There is no certification program, no minimum level of knowledge, and even the most expert black-badge CTF winner uber hacker still doesn't know some of the things you know, and is missing talents you possess.  It took me five Defcons to truly figure this out, so listen up.

Your brain is awesome, and it will grow to fill the requests you make of it.  A positive action is a butterfly wing-flap.  Not only can it cause awesome weather all over the world in places you never would have expected, but the workout builds the muscles in your wings until you become a mighty dragon.  Yeah, it's a cheesy metaphor, but I'm the one writing it... If you don't like it, go write your own metaphor.  That's the whole point of this rant.

I'd like to especially stress this message to women, who are more likely to wait to be given permission.  Don't wait till you're in your 30's to learn this lesson like I did, and if you're in or past your 30s?  Now is the best time to start doing.  If you need permission, here you go.  Permission granted, achievement unlocked, go do something.

This authentic WWII Enigma Machine was made by doers! Go make something!

So this year I'm going to focus more on doing.  I'm not going to worry about whether I'm qualified, or whether it will be cool.  I won't worry who the gatekeepers are, or if I'm smart enough to get very far, or if I might get tired and give up at some point.  I will not worry about any end-game.  I will just do what I find interesting and what will make me feel smarter when I'm finished.

DEFCON 20 was far more diverse.  As I said, lots of first-timers.  Sadly, accessibility comes at a cost.  The past two Defcons have been far more tame.  My first couple of Defcons, the twitter stream and rumor mills were full of exciting stories, and it was a bit of a game to anticipate hearing about the next antic.  The next prank, the next rumor of an arrest, the next hacked hotel facility, the next killer bee attack.  Of course every other story left us wondering if Defcon would be kicked out of the Riv.

This year?  I can't think of much that happened.  Not much at all, actually.  At least last year Sabu and the J3st3r were chasing each other around, and the phones got man-in-the-middled.

The downside of course is less excitement.  But less excitement equals less fear, and that's a beautiful upside!  The amazing feats this year seemed to be constructive, and that is something I can get behind.  Most notable, Ninja Networks built their own phone network and distributed special smart phones for those deemed l33t enough.  That's a trend I can support, and I'll just have to be grateful I got to experience the last few years of the wild-west-style DEFCON.

The Goons did an excellent job of Line Management this year.  Though I got in line at peak hours, I only had to stand there for about an hour.  I'd guess there were at least 3,000 people ahead of me.  And the line didn't block the hall.  For the most part, (with one exception), I did not find myself stuck in a between-panel hallway traffic jam.  I was allowed to sit in the same track across multiple talks, and there was (almost) always enough seating.  So very huge kudos to all those who pulled off that amazing social engineering hack.

Goon attitudes were definitely awesome this year.  It's not like the Goons ever sucked... I can't quite put my finger on it, but the Goons seemed more upbeat, and less... bossy?  More fun-loving?  Less oppressive?  Dunno what you guys did, but it was a joy to be ordered around by you guys this year.

On that same token, Defcon seemed like a better experience for women this year.  I've heard some pretty horrific stories, and like many geek cons, DEFCON has a reputation.  Personally, I've been protected from a lot of it since I attend every year with Roland.  But I've seen my share of sexist remarks in talks, and there was one incident last year involving Goons I thought worthy of filing a complaint over.

Yes, there were sexist remarks this year in talks and in hall-conversations.  But the culture made a definite shift in a positive direction.  Partly I'm sure due to official efforts, but also due to attendees taking action.  (See above about "doing".)  An attendee named KC distributed creeper cards, which brought awareness to the whole concept of sexual harassment, which seemed to have a huge overall effect.  In one talk, one of the Core Goons said something rather inappropriate to a woman asking a question at the microphone.  Instead of laughing, the audience groaned, and someone suggested he get a creeper card.

In general, sexist remarks (like tired jokes about being surprised there are any women in the room) met with very little reward.  So I expect next years Defcon to be a much more friendly environment for women.  Which is a good thing, because I saw more women as a percentage at Defcon this year than ever before. It helps that there are a number of female Core Goons, including Nikita, who can give a female voice in the upper echelons.  I am grateful for their hard work.

DEFCON Kids was growing up this year, too.  It makes me wish I could be a Defcon kid.  One of the most impressive things is that they have a Zero Day contest, in which kids find actual zero days in actual live systems, like online games.  I didn't write down the number, but this year they collectively found dozens of zero days.  We're talking twelve-year-olds here.  Just like it was in the late 80's, only now the adults are teaching them how to do it.  So awesome.

This year was the second at the Rio, and I think I missed the Riviera more than ever.  Every time I had a Defcon memory, it was set at the Riv, and I looked around to find myself in a different place.

I got to see way more talks this year than last.  The talks seemed to lean more technical, and since I'm not in the field anymore, I'm more interested in higher-level talks.  Things like theory and the state of global cyberwarfare and lock picking exploits and biohacking.  Talks on the five newly discovered SQL Injection Techniques with play-by-play how-tos aren't really useful to me.  So in a sense, the talks weren't much for me to write home about.  I probably managed to miss some really good talks, but there you go.  I'll highlight the ones that stood out.

Obviously the keynote by General Alexander, Commander, U.S. Cyber Command, Director, National Security Agency, is worth commenting on.  I had mixed feelings about his talk.

I love the fact that the NSA and hacker communities are finally on speaking terms.  I've read Crypto: How The Rebels Beat the Government Saving Privacy in the Digital Age, and understand the historical context.  The NSA fought every effort to bring encryption technology to the private sector, where it was sorely needed.  Remember when you couldn't export Netscape because of SSL?  Thank the NSA for that.  A lot of our core technologies like email and DNS are fundamentally non-secure for lots of reasons, but a big one is that the private and academic sectors had no access to cryptography, on threat of arrest.

So to see the NSA finally "getting it" on some level was amazing.  And to hear the head of the NSA agreeing with the hacker community on many levels was like Javert telling Jean Valjean that maybe the system was a little corrupt, and perhaps Valjean should be pardoned.

On the flip side, some other things he said made it very clear that the fundamental philosophies of the NSA are still quintessentially opposed to the philosophies of the hacker community.  So while the two groups are agreeing on a lot of the higher concepts, their root reasoning is still at odds.  For instance, after acknowledging that many things which shouldn't have been illegal are now legal thanks to hackers, he then made it very clear that all attempts to improve security should only be done above ground, within the legal sphere.

At its core, the Feds are still Javert.  They don't get that sometimes the law is fundamentally flawed, and that the only way to change those laws is to continually act against them to prove how flawed they are.  If it weren't for lawbreakers, we'd still be at 1980's level security, and encryption and the internet would be owned by true criminals.  (One could argue that this is actually the case.)

So his talk really rubbed me the wrong way.  The Feds are still the Feds.  Don't get me wrong -- hackers should absolutely go work for the NSA.  For starters, your country needs you.  For seconders, their philosophies aren't going to change without more of our culture on the inside.  Like last year, I still hold that the community should take advantage of these olive branches.  Get to work.

I also got to see an unscheduled talk by Kevin Mitnick in the Social Engineering room.  I'd always wanted to watch the Social Engineering contest, so when I had a moment, I wandered over.  Nothing much was going on, so I parked, waiting for the next round to start.  Soon it was announced that Mitnick would be there, and the room filled right up.  I had third-row seats, and got to listen to a lot of stories about Back In The Day.

I knew a lot of hackers Back In The Day.  They traded Zero Days and hacked payphones and cracked games and ran elite boards.  When the "Free Mitnick" campaign started, the hardcore hackers criticized Mitnick, saying he was merely a social engineer, and anyone can pick up a phone and steal a password.

I'm sorry, but those guys were wrong.  Mitnick had to know what he was talking about to call up software companies and get copies of source code.  He used a lot of technical hacks to secure social engineering hacks, and to be honest, he was far more hardcore that most of the tech-only hackers I knew.  He wasn't just hacking servers, he was hacking every single system he could get his hands on.  Including social systems.

And frankly, he deserved to get arrested.  Though a lot of the charges against him were trumped up, he committed a number of real crimes.  Nevertheless, his stories were very cool, and he was clearly a pioneer in this field.  If you ever get a chance to hear him speak, go take a listen.  You will learn more about the hows and whys of security than anywhere else.

I watched three social engineering contest rounds.  The contest works like this:  Contestants are give a list of 20 "flags" they have to capture.  Examples: What OS and browser version are you using?  Is it kept updated?  Who is your shipping vendor?  Do you have a cafeteria?

Contestants are placed in a sound-proof booth and are assigned a company to attack.  The moderator does all the dialing, and the audience can listen to the caller and the callee.

I learned so much from watching this.  The first guy called HP Sales, and claimed to be a new art student. He played dumb about computers, which not only made for a hilarious conversation, but he also managed to capture most of the flags.  I started to get an inkling what kind of information is important to a hacker, and combined with Mitnick's talk, I could easily see why.  Why would you want to know their shipping provider?  Well if you wanted physical access to the building, you might want to dress up as the UPS guy.  If you wanted to send a Trojan, you might want to know what exploits would work, so it would be good to know OS version and the type of anti-virus software.

The third guy was also interesting.  They gave him AT&T, which is notoriously difficult to sosh, and I quickly learned why.  He called a local retail store, and used an interesting (and entertaining) meta tactic.  He had done a lot of research ahead of time, which as Mitnick's stories proved, is very important because it makes you appear convincing.  He told her he was from internal security, and that the DEFCON hacker convention was going on, and they were doing social engineering contests, and for some reason, her store was on a list.  As an audience, we had to suppress our reactions to maintain silence, but inside I was dying of laughter.  It really doesn't get much more meta than that.

At first his strategy seemed to be working, but at some point she just clammed up.  She was well-trained, and about the time he started asking about their operating system, her red flags started waving.  She played it really cool and refused to answer his questions, or if she did, she did so vaguely.  I was very impressed.  The contestant's technique was probably too pushy, and he talked too much, but either way, it was obvious AT&T security had done its job on training.

So he tried again, to another store.  The guy he got started out pretty quiet, but after a while, out comes a fair amount of information.  Which goes to prove that security is only as strong as the weakest link.  And there will always be weak links, so the best route is to try to cover every single angle as best as you can.

I also learned about how innocent-seeming information can be leveraged.  If you're attending Defcon in the future, definitely check out this event.

I also saw the talk by Kevin Poulsen.  I remembered the article from Wired in 1999, which I re-read every few years.  Poulsen describes his exit from prison in 1996.  He went in in 1991, when BBSes reigned and the Internet was only available to academics and hackers.  I nearly cried every time I read his description of stepping out of jail and looking up at a billboard with URL printed on it.  When he went in, the web hadn't even been invented, and just five years later, mainstream advertisements were sending people to websites.  If you're interested in computer history at all, it's an article well-worth reading.

Like Mitnick's talk, Poulsen's was entertaining and old school and I learned that Poulsen was arrested for very good reason.  He'd definitely crossed that line from hacker to con man, and stole real money and property using some pretty ingenious schemes.  (As an aside, this Unsolved Mysteries episode made while Poulsen was still a fugitive is a beautiful bit of history.)

The parties were pretty great this year, and the Crystal Method concert totally rocked.  Roland and I danced  ballroom style.  I remember at one point, standing there awash in music and joy and marvel, thinking of my 16 year old Mormon self, with my first modem, logging onto BBSes.  I imagined how I would explain any of this life to her.  She was so very, very different from who I am now.  Although I am just now rediscovering how cool she was, too, and that's the person I'm uncovering as I do all these puzzles.

Like last year, I entered the Short Story Contest this year.  And I was given an opportunity to do a reading at the Forum Meetup.  I read my entry, "Where the Eye Lacks Message", to a small crowd of about ten people.  I hadn't prepared, other than a couple of practice readings in the room, and I didn't have a handy printout with underlines like I did at my Wayward Reading.  But I found reading from my smart phone to be almost as good, and perhaps in some ways, better.  Someone else decided to do a reading as well, and I really enjoyed it.  I wouldn't mind if DEFCON made this a "thing", but even if it just stays a small impromptu deal in a side-room, I would totally repeat the experience.

My story was a paranoid conspiracy adventure based on last year's badge contest.  So it was really thrilling when Lost bumped into me in the hall and said he liked it.  As I said, recognition is all about the doing.

DEFCON always makes me look at the world in a different way, and on the last day, we saw this at the Carnival World Buffet:

Defcon 20 is closed.
This ATM is WIDE OPEN.

This is an ATM.  It accepts money.  Including cash.  If you're new to computer security, you might wonder why this is interesting... after all, there is no keyboard attached.  But even a little vague information is necessary for a good hack, and here I learned lots of specific information.  Including what kind of financial processing software it uses (which would tell me what ports to scan on a network to find this machine), and something even more damning: It's running VNC, which could allow an attacker to remotely connect to the full desktop.  I hope they got that thing fixed... but probably they didn't.

This year was the best DEFCON I've attended.  It's a great place for learning and doing and meeting, I'm looking forward to seeing you there next year, when DEFCON turns 21 and will finally be old enough to drink!

DEFCON 20: The Badge Contest

DEFCON 20 = Best Defcon Evar.  For me at least.

This post is about the Badge Contest.  I have also written about the rest of the con, like how my reading went, the amazing parties, and the surprise talk by Kevin Mitnick I was lucky enough to catch.

Last year Roland and I spent a lot of time distracted by the first annual badge challenge.  I wrote about it here.  This year, I knew there would be another contest, and I debated whether I wanted to obsess over clues and miss a lot of talks.  I figured I'd play it by ear.

We did end up playing around with the badge challenge for a while... and we made zero progress in the first two days.  None.  Not a budge.  We decrypted one very simple newbie puzzle, which was just a clue to a real puzzle, and that's it.

This year's challenge was much, much harder.  Not a casual game, but hardcore mode.  The bar was frankly too high for amateur solvers.  We didn't expect to win this year.  After all, we're newbies.  But we did expect to get past the first level.

So unfortunately, this post is going to be more of a critique than a write-up of puzzle details.  It breaks my heart, because I know Lost puts his soul into giving people a good experience.  He's made it clear that he does not want to overly frustrate and that he wants to encourage everyone to participate.  Lost fills many, many shoes at the con, and I appreciate all he does.  Defcon was truly awesomesauce this year, and I'm sure a lot of that was due to his efforts.

However I'm a big believer in constructive critique, and in transparency, so here is a rundown of the frustrations that we experienced.  For actual detailed write-ups of the clues, there are two: 1o57.wikispaces.com and elegin.com.

The short answer is, there were too many locks, too many keys, and no way to tell which key fit what lock, or even which were keys or locks.  None of the first layer puzzles were easy, so we couldn't start eliminating factors from a huge pile of raw data.  The Mystery Challenge was also going on this year, which added to the confusion for those of us purely working the Badge Challenge.  At least one major clue has now been identified as mC (the circuit rotunda), and I now suspect several other clues we found (and spent time on) were part of the mC because they were not mentioned in the badge write-ups.  As novices, we had no way to distinguish the bC clues from the mC clues.

I arrived at Defcon on Thursday while Roland was still at BlackHat at Caesars Palace.  The news came pretty fast that we'd have to do some electronic badge hacks in order to solve the puzzle.  That intimidated me, and I almost decided to enjoy Defcon without the added distraction...

Then I found myself in the greater rotunda, staring at the numbers and the symbols, and I was hooked.  As with last year, I whipped out the notebook and started writing everything down.  Started taking pictures.  Started basic cryptanalysis.  For example, I immediately noticed the numbers in the greater rotunda were 1-26, so it was some kind of substitution cipher.  So far so good.

Then Roland arrived and we went at it for a few hours.  We had piles of crypto and clues, from the program, from the lanyards, from the badges, from the Defcon DVD, from other attendees, from around the con.  And...

We got nowhere.

Lost's Twitter hints weren't helpful.  Some of them were things we'd already gathered from the Badge Talk or other sources.  Like that we needed all three lanyards.  That we needed to use Quick Fox (the pangram clue already told us that).  Other tweets only added to the pile of data we had, with no arrows as to how to apply any of it.  At one point, based on a Tweet, we started trying to apply Rail Fence to all the codes, which was another big time waster.

Lost hinted at the hall signs, but I saw nothing.  Part of the problem was my mistaken assumption, based on last year's example, that all the signs were the same (so I only checked a couple of signs).  The other issue is that the special signs were stolen at some point, so it would have been impossible to notice them.  We had one of the sign codes from the DVD, but not the other two.

From a game design perspective, the first layer of puzzles was too hard and gave no encouraging breakthroughs.  Had we managed to unlock the second layer, it would have been easier, with lots of carrots.  The write-ups describe several URLs (unlocked by solving the difficult first layer puzzles) containing simple reversed-letter strings.  Easy-sauce.  Accessible.  (What to do with them would have been the challenging part.)

If the goal of the game is to get everyone involved, you have to make the first levels easy and rewarding.  On the first day, groups of random strangers were forming in the halls to examine the clues.  We were sharing, we were playing with the badges, we were taking pictures of each other's notes.  By Friday afternoon, the groups had dwindled to a few lone souls, and by Saturday, all but the most hardcore had given up.  The winner of the contest was a Mystery Challenge team.  I'm sure that wasn't the point.

It would have worked better had there been multiple easy first-layer ciphers all vaguely pointing to a deduction.  Some examples of "easy" ciphers might be: a brute-forceable cryptogram, clues hidden in the source of an HTML page, image steganography, an obvious OTP, ROT13, binary or hex.  Instead, there was a single Atbash code with a specific URL, which in and of itself might have been easy without the overwhelming distractions.

Atbash was totally fair.  It's simple enough, and listed at the top of the list on the Rumkin cipher reference  page.  But our chances of guessing or brute forcing this were reduced by all the other distractions and time wasters we tried based on other clues and obvious suspects, like multiple pangram cypher types, OTPs, Rail Fence...

Like rats (or polar bears) whacking at the food button, we eventually gave up when no pellets came out.

I have a few suggestions, from a game design perspective, which could help next years challenge be more fun and accessible.

First, have some method of separating the bC from the mC.  That may not be a problem next year since the rumor is that this year's mC was truly (and sadly) the last.  But if both are going on, maybe a "#bC" and "#mC" signature next to clues from each (as is done in Twitter).  Or create fictional characters who are leaving the clues, and include signatures (initials, a name, a symbol like a rose or Kanji character or the Eye of Horus).  Make it clear those are the rules, so that any beginner can quickly pattern-match and easily figure out, "This clue is not for me."  Of course this method will make it harder to place intentional red herrings, and it throws many forms of steganography right out, but ... maybe it doesn't have to. :)

Another thing would be to give hints as to which clue goes to what puzzle.  I'm not asking for dead giveaways, and I still want to be able to sort some things out.  I don't want to be applying all three forms of Quick Brown Fox (plus the Wizard's Pangram, et. al), to every single crypto at the con.  (To be fair, the pangram clue was right next to the puzzle it belonged to, but also to be fair, not all clues this year and last were so closely associated.)  So perhaps a color scheme - puzzles printed in green match clues printed in green.  Or some other scheme.. again, it could leverage fictional characters: this key has Agent X's signature, but this puzzle has Horus's Eye, so they don't go together.  Or some indicator of when you'll need each piece of information.  If from the start we're being given bits of a later puzzle, there should be some indicator that we don't know enough to work that one.

Some misdirection and confusion is fun.  Too much is overwhelming.

If there are going to be interactive badges, have them spit our some kind of content out early on.  Anyone who tries even a little bit should get some kind of, "Nice try, keep going".  The method of getting that should lead logically to the more difficult and meaningful answer.  Like if you sync with one other badge type, it flashes SOS in Morse Code or "MISS!" in binary or says "GAME OVER" when you wave the LEDS back and forth.  Then we'd know when we're barking up the right tree.

My last suggestion: Give some low hanging fruit.  Make a couple early of puzzles so ridiculously easy that any Defcon attendee will realize this game actually is for them.  TryThis0ne's first puzzle is one such example.  You have to solve it before you can even access the other puzzles.  Anyone who's ever done a newspaper cryptogram can solve it.  Feel free to taunt those who crack them, like, "I was just testing to make sure you were awake, but my dog could solve that puzzle."  After that, ramp it up.  Steeply.  Terribly.  Painfully.

Parenthetically, DEFCON 20's contest, a few easy attempts rewarded you with a taunt, like, "Did you really think it would be that easy?"  If I recall, they were things like guessing Lost's name in the URL, and messages hidden in same-color text on the HTML page.  Those messages were actually encouraging.  They sent a clear subtext: "Hey, you're smart enough to try the obvious things, and you found something.. not something useful, but something.  You can do this."

Now for the good points:

In the badge talk, Lost mentioned a goal that he successfully accomplished: He wanted the game to be more social.  That definitely worked.  I found myself talking to more people on the first day than I've talked to for entire cons.  People were excited to share and help and try to beat the challenge.  We were holding up badges, talking about them, trying to figure out what made them tick.  We were looking at each other's lanyards, trying to figure out why we needed all three...

He also continued the backstory mythology from last year, of the Brotherhood of Horus and secret societies.  There was mention of a comic book, and I'm looking forward to that.  I wrote a story for this year's short story contest based on the clues from last year's badge contest, so I'm looking forward to see how next year's mythology develops.

The contest was also inspiring.  Lost did a great job both years of making us curious.  These puzzles remind me that I'm smart, and they bring back the feeling I had as a kid, when I'd excitedly try the brainteaser every Friday at school, and I'd usually win.  It helps me remember that I love puzzles, and that just because I've aged and experienced failures and forgotten how to do grade school math doesn't make me any less capable than I was as an eight year old.

The hands-on aspects of the Badge Challenge is essential and awesome and inspiring.  It lets me participate in Defcon in a way that makes me feel I could participate in "higher-level" contests, if I wanted.  The badge challenges have made me feel like I belong at Defcon and I'm not just a poser or a tag-along.

After DEFCON 19, Roland and I were inspired to do more puzzles during the year, but we didn't follow up.  This year, we did.  We found TryThis0ne.com, which is a site full of puzzles and hacking challenges.  And we started playing a new MMORPG, The Secret World, based on its inclusion of real puzzles and crypto that you have to actually solve before you can complete quests.  My brain cells are grateful for the exercise.

A questioner at the badge talk Q&A asked about online resources for doing more puzzles, and he was directed to Martin Gardener (possibly these sites, Puzzle Playground and Math Puzzle) and Notpron.  I haven't checked those out, but if I tire of TryThis0ne and TSW, I have a fallback plan.

Most of all, I look forward to the badge challenge at DEFCON 21!  Maybe with some practice, we'll get a little further next year.

Hacker Revelations (photo)

Defcon 17, 2009, Las Vegas, NV

 Not sure if this was hacked by the Defcon attendees, or if someone just ordered a hat.

Defcon 19 Badge Contest: In General

Of my four years of going to Defcon, I had the most fun this year at Defcon19.

Granted, my first year was pretty fun.  There were lots of antics going on, and I went to a lot of talks.  And Defcon17, we got an invite to the Facebook party at Studio54 where DualCore and YTCracker were playing.  And last year, Defcon18, was kind of a blur.

But none of those years had a badge hacking contest I could actually participate in.

When I heard the badge this year was going to be non-electronic, I scowled.  I waxed cynical.  I joked to people that they were going to print the badges on hot-pink cardstock.  It was hard to imagine any badge being as cool as this, this, or this.

As with every year, there were not enough badges.  Here's a quick summary of just how lucky I was to even get one.  I got in line at 2:50 on Thursday.  I stood in line for an hour and a half, the line stopped 14 people away from the front, waited 30 minutes, got told lots of conflicting information about badge availability and wait-times, waited longer, got to the front of the line, got told more metal badges on there way, but if I registered right then I'd get a badge of shame paper badge non-redeemable for a metal badge later, heard there were badges left at Caesar's Palace (where Blackhat was letting out), left the line, tried to call Roland so he could get me a badge there but my phone battery died, heard that all metal badges were gone for good, Roland arrived from Caesar's, got back in line for two hours, and 25 people away from the front of the line it stopped again, then heard the good news ripple up from the front: A small Fedex package had arrived with a small number of metal badges.

Color me ecstatic and incredibly lucky.  Here's a picture of my beautiful badge:

And not only is it stamped on antiqued oxidized titanium, printed on the last supply of .040"sheet-titanium left in the United States, but it is also part of a complex series of puzzles, a conspiracy if you will, that permeated the entire con.

Clues were hidden in the badge itself, in the lanyard (see the binary in the pic?), in the con program, in the T-shirt art, in the badge talk, on twitter, in the signs, in the hallway art.  There was even a hired actor, though I never saw him, who would play out scenes to give further clues.

It was a well-designed game.  Most of the clues were repeated in various places, so everyone had a chance to find them.  I also get the sense clues hidden behind incredibly complex encryption or puzzles could also be found through much more simple means.  For example, we heard that one person build some kind of gear machine that eeked the word "candy" from the crypto wheel, but most people got that answer by giving a password to a "Z" agent, and the agent just told them the word.  (Not that it was easy to find all the clues that gave you the password or told you about the Z agents, but that was certainly more accessible than whatever crazy math and hardware hacking was required to interrogate the crypto wheel.)

Starting Thursday night, Roland and I became obsessed with finding clues and cracking codes.  We stayed up until 2am Thursday night.  Every once in a while, one of us would ask the other, "Want to go out tonight, find a party?"... no.

I haven't had this much fun in this kind of way since I was a kid, back when I was the first in my class, every week, to crack the weekly brain-teaser.  Or when I'd obsess on a text adventure on my TI 99/4A, trying to solve puzzles for days at a time.  These days with whiz-bang video games, and busy schedules, it's hard to find the patience for recreational intellectual heavy-lifting, when we can simply google a solution or even a full walk-through on the internet.

This badge contest made me remember how much fun it can be to work something out.  It made me feel smart.  For the first time at Defcon, amongst some of the l33test people on earth, I actually felt l33t.

That's not to say we actually solved the puzzle, and we couldn't have gotten as far as we did without stealing other people's solutions talking to people.  But it wasn't designed for any one person to beat.  LosT designed it to make us all more social.  The clues required too broad a skillset and knowledge spectrum, mostly the sort of thing you can't simply google.  And the badges themselves were all different, requiring interaction to gather the data.

I must say, we started the contest being secretive, hoarding our knowledge.  There's a certain type of elation when you can gloat personally and sometimes publicly that you know something they don't know.  But it really would have been much more productive to share, I think.  And it would have made us just as happy.  Not only that, but if we were going for l33tness and geek status points, we probably would have gotten more if we'd shared from the get-go.  Especially given just how light-weight and inexperienced at puzzle-solving that we are (or were....)

We did much better at the early puzzles, and my personal strong-point was noticing clues.  I usually didn't have the foggiest what to do with the clues, even though I thought I did...  If I had pointed them out early, publicly, I would have earned higher hacker cred.  Since I didn't solve the puzzle, the fact that I noticed the 33 tattoo in the program on the first day, doesn't really matter since I still don't know what that damn 33 was for.  I know it was important because I saw this clue coming up again over time -- on an added sticker in the rotunda, written on a coin stuck on the wall, etc.  i.e. LosT was saying, "Hey you guys keep missing this clue!" ... I had it all along, and someone else could have done something with it.

Not that geek status is the end-goal.  It's just part of the fun.  Solving the pieces for their own sake was its own kind of elation.  But there are multiple ways to display l33tness, and sharing is one of them.

We are definitely planning to do this again next year, and when we do, we plan to collaborate this time.  I'm not exactly sure what form that will take.  This year, there was an IRC channel, but I wanted to keep my netbook off the Defcon network and didn't want to pay for (pwned) hotel wireless.  Next year I may consider bothering with it.

In fact, being without internet+netbook was a huge barrier.  My method of problem-solving relies on the gathering of as much information as quickly as possible, then eliminating distractions as quickly as possible.  Use of the internet on a larger screen with a keyboard is necessary for that.  My Android simply wasn't up to that task.  I would also like to develop a more systematic method for storing information and testing theories.

Here are a couple of pictures from my notebook, to illustrate some of my thought processes and the kinds of clues we were collecting:

A collaboration group did form, and even though we didn't participate with them, we happened to be present when they won.  That was was really cool.  On Sunday afternoon, we found the collaborators in the chill-out room and started hovering, listening to them, and trying to figure out how they'd solved this or that, and what they were currently working on.  Thirty minutes later, they got the email reply from LosT confirming they'd won.  I'm not sure the full solution, but they emailed the number 108 and some other info to eban at 1o57.org, but we had no idea how they found that or what the other info was.  Roland and I spent another hour or so trying to reverse engineer from there, and actually got a lot further along, but decided to quit out of sheer exhaustion.

So thanks very much to LosT boY for accomplishing the goals you listed in the badge talk: The badge contest was accessible to all, and you got some of us introverted nerds to interact for a change.

In my next post, I will detail some of the specifics and list the clues we found and puzzles we solved or at least worked on for a long time.  Some of the clues from this year were intended to carry over to next year, so if you plan to participate, pay attention!

See you next year!