
Global Bob Show
Global Bob Show
Episode 20 - Raise the Alert Level to DEF CON 30!
In this episode Global Bob (Brian Varner) talks about the history of Def Con and some of his favorite talks and villages to attend. He gives an overview of what Def Con is all about for those that have never heard or attended the annual conference in Las Vegas Nevada.
Transcripts are automatically generated.
All right. All right, here we go. You are jacked into the Globalbob show. Episode number 20. We got the 67 caddy. Deville fired up. We got the Rochester Quadrajet carburetor, all clean, and we are going to cruise the highways and byways from Polk County, Florida out to sin. City, Nevada. That's right. We're going to be cruising out to Las Vegas for DEF CON 30. And I cannot wait. For those of y'all that don't know DEF CON is summer camp for hackers and nerds such as myself. Episode number 20. Here we're going to talk about DEF CON, because I've gotten that question quite a bit Globalbob. What is this DEF CON? What's it all about? And why do you go and simply put, it is the Superbowl, the biggest event? The Daytona 500. The Indianapolis 500 is the big show for us security professionals. I've had the distinct honor of talking at one of the villages at DEF CON, the voting village, one of the highlights of my career. And so in this episode, we are going to talk about what is DEF CON, how it got started. And why do security experts such as myself, and 30 plus 1000 People from intelligence agencies all around the world. And we're going to be able to explain why we all go out there once a year to hang out, learn a little bit, teach a little bit and make our connections. I really appreciate everybody that tunes in every week had a little audio issue on the last episode, but I think we got it all worked out now. Oh, man, I tell you, it's a lot getting ready to go out there. You know, it's one of those things. It's the date is there. And you know, it's common, but as always, last minute stuff I need to get done. And this trip was no exception. Now, DEF CON is a conference that was founded by Jeff Moss, also known as THE DARK TANGENT, he didn't really set out from what I understand, to start a conference. And everything I'm going to bestow upon you during this episode is a culmination of some research I've done throughout the years. Also, it's some stories I've heard, and some of the things that I've experienced. So please do not use this and cite it in your research papers and your editorials. This is just my perspective on things. So what happened in 1993? Well, Jeff, wanted to throw a party for one of his friends. And at the time, Jeff was around 18 years old. And true to DEF CON fashion, things did not go to plan. So his buddy was a security fella. And he was moving to Canada with his dad from what I understand he was getting his dad was getting a new job. And so Jeff said, Hey, why don't we throw a party in Las Vegas? Well, hackers from all over the place showed up. And all probably about 100 of them. Were there. So all these hackers and security folks kind of descended on the Sands Hotel. And the sands since then has been demolished. And if I had to say maybe a little bit of that demolishing happened from some of the attendees. So where did DEF CON actually get its name? Now reading from the DEF CON site, this is new to me. I never really asked where it got its name from, but according to the site, that at the time that the security folks and hackers or freak errs would get together. Then they would do it in the summer. And they called that summer con because it was in the summer. Now for those that don't know con is just short for conference. And then in the winter they had hoho con and then a pump con during Halloween. And according to the site He did not want to associate DEF CON or what would become DEF CON. With a time of the year now I call it summer camp for hackers and nerds. But he didn't want that. So when he set out to come up with a name, he wanted to use def, which is def, and it's number three on the phone. And if you're in the military lingo, it says DEF CON is short for defense condition. So putting the two together, he came up with DEF CON. Now, we should note that DEF CON in military terms is all ran together. It's DEF CON, all one word. But in this case, DEF CON is actually two words. So when everybody got together for this party, he got such great feedback that he decided to do it the next year. So the first year there was about 100 people. But word spread. And each year, more and more people began to just descend on Las Vegas. And by 1998, there were 2000 people that showed up to tangents annual event. Now we all know that 1998 That was in the.com, boom, bust error. And then a lot of us like myself, we were just graduating high school and we were going, you know into the cybersecurity profession. And it was becoming very well defined. So each year brought more and more people. Now all the way up to 2019. It's estimated that 30,000 people attended DEF CON, which is just amazing. I mean, when you go there, it's like a conference of magnitude that you just cannot describe. So if you're into motorcycles, it would be Bike Week down in Daytona are Sturgis and South Dakota. And like I said, if you're into NASCAR, then it would be the Daytona 500. But the DEF CON in person conference went all the way up until when do you think they did not have it in person? That's right. It was during COVID. And that was the first time and I believe 27 years that they didn't have it in person. Now something you need to know about DEF CON, since it is a underground conference, that up until a few years ago, the only way to get in attendance of DEF CON was to pay cash at the door. And when you think about this 30,000 people showing up and paying cash at the door. That's a lot of cash that's been acquired. And you can imagine one of the reasons why they wanted to have cash at the doors for anonymity. And that's really, really big at the conference, because you have folks there that are in industry. And just the mere fact that they're attending certain villages and conferences could tip the adversary off that there's a weakness in their systems. You have folks there from the FBI, NSA CIA. And that's not me speculating, they actually have a program there called spot the Fed. Because, as we know, sometimes federal agents stick out with their haircuts and their fancy shoes and clothes. So that's always been an annual event called spot the Fed. But however, so you paid your $200 cash. This year, it's $360 cash. And with the amount of people showing up, it's just a lot of cash. But the reason why they do that is for anonymity. And anybody that's ever been to DEF CON will know that taking pictures at the conference of people may get your butt whooped. Or it could get your camera taken away from you and destroyed. There's one particular talk that I attend, it's actually a group of talks. And I'll leave the talk name out of it. But they are very, very clear that if you get caught recording something or getting out your phone during a talk that violators of the rule will be violently violated. So they take it pretty serious. But now in the later years here at DEF CON you can actually you purchase your tickets online with a credit card. And the first time I heard about that, I was like, Wow, that's crazy. Because when we all go there, we all want to be part of the community and just part of the people and anonymity. And we don't necessarily want folks to know who we are if we don't want to. And so that's a little change in DEF CON. But when COVID hit DEF CON, went into what they call Safe Mode, just like your computer back in the day, remember, when your computer had a virus, or it had some kind of malware on it, or you messed up your driver, you could hit that key combination, and it would boot up in safe mode. Matter of fact, some Windows boxes would automatically boot up in safe mode, if it detected an error. So for the first time, DEF CON 28 was put in safe mode because of COVID. Now if we talk about one of the the found stones of DEF CON is being anonymous and being able to have a cloak of anonymity, you just show up pay your cash. Now you can pay for it ahead of time with a credit card. And with DEF CON safe mode, they put the content online. And so that was something that I feel like that kind of took away from it a little bit, but I totally understand it. I'm not. I mean, we were in very uncharted territories and times. So I was very glad that they did do it that way. But some people that give their talks out there, they don't want you to know who they are, who they work for. And some of these people work for. I mean, they're high profile industries that they work for. But when they go out there, they want to just have the free flow of information. And so they can choose to have that cloak of anonymity. And then DEF CON 29 was after, you know, the COVID years, I like to call it and they did have in person conference again, but you had to have your vaccine card, and the vaccine card was verified by a third party. And so I wonder I want to find out whenever I get out there this year, what was it like during 29? When people were allowed to show up? The some of the people that were going to give the more advanced talks? Or maybe the gray area talks not show up? Because one maybe they don't believe in the vaccine or didn't want to get vaccinated? Or do they not show up because there's a chance that they could get on mast. Now, in the past reason why I say that anonymity is important. There have been people arrested by by the feds, either on their way at DEF CON, or in the event of participating in things outside of the conference. But in the area. As far as I know, there has not been anybody that's been dragged off stage by the fence. But it just makes me wonder. So there's a couple years there basically three years where maybe your true identity could have been unmasked either because of, you know, having to present online or having to show the vaccine card. But I guess the people that pay on their credit card or want to pay on their credit card, they probably didn't care. And they just showed up anyways, because they were not into trying to mask their identity as much. So I've talked about two things here so far that people may say, Commander Bob, what are you talking about? You mean to tell me that the feds go to this underground hacker conference. And you tell me that violators that tried to take pictures and violate the rules get violently violated? Well, I'm going to give you a couple of real world examples. And 2007 TV show by the name of Dateline tried to secretly record hackers admitting to illegal activity. And when the crew was outed by founder Jeff himself, one of the reporters was heckled and chased out of the conference. So yes, they take this very seriously. Now the thing with Dateline is, is that they could have applied for a press pass, which is another way to get a pass to to DEF CON is to you know, have press credentials. And if they accept it, though, that you come in, but the thing is, is that Dateline wanted to you No sir petition Asli record secretly record. And that's a that's a big no, no, that was in 2007. Now, when I say the Feds go to this conference, I mean, you gotta realize some of these folks are doing illegal stuff. Or maybe they're doing, you know, things that are completely legal, but the Feds want to keep their eye on him. I know that whenever I was involved with the election, hacking, and I was invited to speak at the voting village, there were a lot of Feds there, it was pretty interesting that, you know, to talk to them and tell them what I discovered, and they were very interested in they were over. But I can tell you that the Fed of all Feds was at the conference one year, and this was the chief hacker in charge, his name, ready for it. Director of the NSA, General Keith Alexander, and he gave the keynote address, and may not tell you that was just absolutely awesome, because here you have an underground conference, where hackers and Feds all come together and they have all this anonymity. And for them to be able to book General Keith Alexander in 2012. That was just a ha ha moment where to me, you saw the convergence of hey, during this time, we may chase each other all around the highways and byways of cyberspace, and through the digital ocean. But for this moment in time, once a year, we're all going to get along. And we'll speak at your conference. And it's just to me, that was just amazing. Now, one subject that is near and dear to my heart, it made its appearance at DEF CON, and 2017. And that was the voting village. And friend of mine, Harry was very instrumental in putting that on. And Harry invited me out to talk. And it was just a real. Like I said, that was kind of one of the cap stones of my career. A lot of people, they have stuff that they look to achieve. And to me, that was one of them. And actually, in 2018, the following year, the voting village actually received the cybersecurity Excellence Award. Now, I tell you, when you're involved in something that you're very passionate about, and then you're invited to talk at a talk like that, or conference like that. It's just, you know, I just cannot explain it. And now we're going to talk more about the election nuances as the podcast series matures. But right now is not the time, but we will do a lot of talking about voting machines, and what I discovered and some of the work I was able to do with Harry, and crew. But what I want to draw attention to is just how the voting village was something that I was very happy to see become a village. DEF CON isn't just a conference. It has conferences inside of conferences, and think of these villages as little Mini Cons. And some of them like the voting village, there was an area where there was official talks like what I gave, but then there's areas of where people just bring in a bunch of voting machines and say you got a special voting machine. And you bring it in and someone has another one that they got off eBay and you can bring it to the voting village. And people that are experts can play with your machine and you play with theirs. And it's really cool. But they also have these villages. And some of the ones that are the most notable to me that I think's amazing, is the bio hacking village. Now that village is all about hacking, biometrics, and other bio systems. So if you would ever like to have an RFID chip implanted in your neck, well, you can go to the bio voting Village and I'm sure somebody has has an RFID chip that they would implanted into your neck. And you can also experiment with hacking those devices that are in the bio hacking genre. Some of the other ones that are big deals at DEF CON is the car hacking village. And it's the same thing bio hacking the voting machine well and car hacking. They bring real automobiles, some of these automobiles may be from industry, some automobiles may be personally home. And don't quote me on this. But I think a time or two, there was a few rental cars that were automobiles that people were trying to hack into. And they do things like try to hack into the entertainment system to make it do different things, actually, trying to hack into them remotely. And so if that's your your bag, then you can go to the car hacking village and stay there during the whole conference and not even go to the other talks. Just go to where your people are, and, and hang out and just make connections make friends make everybody is just so nice. And they're so passionate, and they're willing to, to listen to you and to have you demonstrate what you know. But other ones also include the industrial control systems. Now, as you guys know, I have actually developed a zero day exploit at one time into an industrial control system. And so that little village is one that I'll hang out in some times, just because I want to see where all people have done just since I quit doing my research into that. And I've already mentioned the voting village, but also crypto and pot and privacy. So if you're one of these people that are into that, then you can spend the whole conference with people that are just as passionate about that subject as you now two of my favorites. And I want to say that probably this one's the oldest, you know, a little sub conference village. And that's the lock picking village. And all my Jesus, if you can get by just one village, where are you saying, Hey, I just want to go see what all this is about. I'm not that technical, but I want to be amazed, go to the lock picking village and look around. Now some of us that are in industry, we know that Medeco Ooh medica, no one can hack the Medeco key. I've have a bunch of different Medeco keys myself. But I guarantee if you go to the lock picking village, you will find that one person or group of people that are teaching each other how to hack the Medeco key. And these folks are like puzzle solvers. It's amazing the dexterity they have in their fingers, and how they can just feel for things and just make these locks just pop open. Probably quicker than if you had a key in your pocket. Because you'd have to find the key these folks, they just know how to put it in there and wiggle it around. And next thing you know, wildlife. So that lock picking village is really cool. Now one of my favorites. And this is where I if you guys want to run into Globalbob Look for me, I will be at the sky talks. And that is the what from what people describe it. To me I know what I think of it is that's where they are very, very, very serious. There's no recording devices, some of some famous people that I don't want to mention their names. They've actually been hauled out of there by some guys that are in girls that are a lot larger than some of these people. I mean, we're talking about some of these folks that are at the sky talks. They are quite capable of taking someone apart systematically. I don't know if they could get them back together. But there has been some famous, at least one that I know a very, very famous reporter that was escorted quite sternly out the door when they tried to surreptitiously record now sky talks, you're going to go in there. And one thing is for sure, you're going to have a heck of a lot of fun. You may see demonstrations that go off the rails, you may see demonstrations that you don't understand what's going on. But what's really cool is is that from what people have described it to me is that that's the original DEF CON. Way, right? I mean very underground, anything kind of goes That's not, you know, illegal. And it's pretty cool. I was there one time, and someone had a cell phone and the cell phone rang. And one of the folks that run the village, they got the cell phone and they put it in a jar of mayonnaise and they gave it back to the person. There's another time I was in there that I saw a cell phone get smashed with a sledgehammer. And like I said, it's just a real cool talk. Now we I don't know if those were plants or not. But I went and try him. And that's where I like to hang out. Because I mean, I've seen some of the most amazing talks in there, where people are just really, really down in the weeds, they're just there to share the knowledge. They're not there for the wow factor. And so that's really a place that I like to hang out. So to wrap it up, I just want everybody to realize that there is a place where both security professionals those that may or may not be involved in illegal activity, and federal governments from around the world descend on Sin City to go to DEF CON. And if you ever go out there, especially as big as DEF CON is now there's something that goes on 24 hours a day. And for the whole life of the conference, whether it's private parties, whether it's the EFF, the Electronic Frontier Foundation normally does a really big party out there. And there's, you know, capture the flags going on, there's great techno music playing. I mean, you got folks that are setting up fake cell sites. And one time I was out there, they even set up their own real cellular site. And they called themselves ninja Patel, and you can make a phone call. But just know when you go out there, just take it all in, you can't see everything a lot of stuff is standing room only. I mean, back in the day, there was 100 people 2019 There's 30,000 plus people. And that's just from, you know, some people go out, they don't actually go into the conference, they're just there in the hotels hanging out with their buds and stuff. But it's just amazing to know that everybody can come together during the summer, and have a good time. Now, when you are out there, just note that you don't want to use the ATM machines at the conference. I mean, you're at a place with 30,000 Plus hackers, security professionals, chances are, there's probably someone there that knows something about skimming. There's all kinds of pranks that goes on. I mean, sometimes they take over the TV system there and, and just be mindful that not everybody is there for the right intentions, and you got to have your human firewall up. As a matter of fact, you should have your human firewall up anytime you travel. Because it's during those times that adversaries can do what they call bump you which means to try to get information from you try to compromise you, especially if you're involved in federal government. And I do know that there's some corporations and agencies that actually give their employees DEF CON training, which I think's amazing. And they basically go over everything of Hey, make sure you keep a low profile. Make sure you don't get to a knee abbreviated that you don't know where you're at. And something that one of my bosses used to say all the time is don't be the story. And that's the moral of this story. Don't be the story. All right, we're at the bottom of the half hour. I would just like to thank everybody that continues to tune in to the Globalbob show. You can reach me at Globalbob show on Twitter. So hit me up. If you're out at DEF CON, send me a DM through Twitter, I will respond. And maybe we can meet up. You can also email Globalbob show@gmail.com. You can also find us out on Facebook. So in Globalbob Show news. We are now on i m dB, which is really cool. Can't believe it. You can go to IMDb and type in Globalbob show and you will see my smiling face. And that's pretty cool. Some of the things we're working on I don't know yet. I haven't made it up in my mind whether I'm going to do it or not. But we may be able to start an internet radio station. And on that station you will hear the global Bob Show from time to time. But we will be playing music good music I guess. I don't know what the format would be. I'm still kind of toiling around in my head. Looking at licensing the music so maybe we'll do some cool, you know, shows maybe music sets like the hack two If I like all kinds of music, from techno music to country music 80s Music, gangster rap, I just like it all. I love music, and I love talking. So I'm going to try to put the two together. So if anybody has any ideas, send them my way. As always, I'm looking for folks that may want to come on the show. We can do a couple different podcast around whatever you're interested in. I don't know. So reach out to me and give me some ideas. Maybe you just want to play stump the chump with me where I just hang out. And you asked me rapid fire, technical and political questions, and I answered them. So anyways, lots of good stuff happening. Looking forward to getting out to Vegas. And I will be doing a show while I'm out there. I'll probably do a wrap up show whenever I get back. So everybody will be well educated on what DEF CON is. And like one of my bosses used to say, don't be the story and I promise about the story. So until next time,