Returning to Hacker Summer season Camp · System Overlord

It’s that point of 12 months once more – Hacker Summer season Camp. (Hacker Summer season Camp is the
~weeklong interval the place a number of of the biggest hacker/info safety
conferences happen in Las Vegas, NV, together with DEF CON and Black Hat USA.)
This would be the third 12 months in a row the place it takes place below the spectre of a
worldwide pandemic, and the primary one to be totally in-person once more.
BSidesLV has returned to in-person, DEF
CON is in-person solely,
Black Hat might be in full swing, and
Ringzer0 might be offerring in-person trainings.
It’s nearly sufficient to overlook there’s nonetheless an ongoing pandemic.

I did attend final 12 months’s hybrid DEF CON in individual, and I’ve been round a couple of
occasions, so I wished to share a couple of tidbits, particularly for first timers.
Hopefully it’s helpful to a few of you.

Conferences/Occasions

• DEF CON is arguably the penultimate occasion of the week.
  By far the biggest by attendance, it additionally brings the best selection in
  hackers to the occasion. Starting from college students simply stepping into the scene to
  seasoned hackers with many years of expertise to business professionals, the
  networking alternatives are limitless. The talks are usually top quality,
  although they could be a little bit of a blended bag generally. Some will
  educate/reveal nice issues, and I at all times discover a couple of price watching, even
  if solely once they get printed on YouTube.

  There are “villages” for each subject and area – voting machines, {hardware}
  hacking, Pink Teaming, IoT, lockpicking, social engineering, and extra. The
  villages permit area of interest areas of hacking to showcase their particular pursuits, and
  are usually run by people with a pure ardour for his or her subject. Should you
  need to know extra a few explicit subfield of hacking, there is no such thing as a higher
  approach than discovering the suitable village.

  For the extra aggressive kind, there’s quite a lot of competitions. As well as
  to the principle “DEF CON CTF”, there’s additionally sometimes smaller CTFs within the Contest
  space or particular person villages, so these searching for a problem can put their
  expertise to the check. Different competitions prior to now have included a scavenger
  hunt, a password cracking competitors, a beverage cooling competitors, and
  extra.

  Within the night, there’s number of actions from events/concert events to “Hacker
  Jeopardy” – a really mature tackle Jeopdardy! with a hacker theme. There’s
  additionally loads of non-public events and locations to hang around with fellow hackers all
  night lengthy.

  You might also hear folks seek advice from “the badge” when speaking about admission to
  the convention. Whereas different conferences normally speak about registration or a
  ticket and have some boring piece of paper to current as your admission, DEF
  CON badges have turn out to be a murals. Roughly each different 12 months, the
  badge is digital and has microcontrollers and a few digital operate. In
  principle, DEF CON 30 ought to be a “passive” 12 months, the creators of the badge (MK
  Issue) have confirmed that it is going to be digital this
  12 months. (Try the linked
  interview in the event you’re curious.)

  New this 12 months is DEFCON
  trainings. These are taking
  place after DEF CON and offering some alternatives to get high-quality
  coaching related to the convention. They’re all 2-day trainings, however
  they look like a superb worth for cash compared to many different
  industrial coaching choices.

• Black Hat is the premiere safety business
  convention. I differentiate it from a hacking convention in that many of the
  people who find themselves there might be individuals who strictly work within the business and much
  fewer who’re hackers only for the enjoyable of it. A part of that is the fee (at
  least an order of magnitude greater than DEF CON), and
  a part of that is the overall environment. Polo shirts are the order of the day
  as a substitute of black t-shirts and mohawks.

  There’s numerous high-quality technical materials, but in addition a vendor gross sales ground
  with all of the gross sales pitches you’ll be able to probably think about. (However that is additionally the place
  you may get free SWAG and get together invitations, so it’s not all horrible information.)

  Black Hat additionally has a large number of coaching alternatives. In reality, Black Hat
  USA is probably going the biggest single website coaching occasion for the knowledge
  safety area annually. There’s trainings for each background and talent
  degree, for every kind of specialities, and in each 2- and 4-day codecs.

• BSidesLV is the B-Facet to Black Hat. A neighborhood
  convention through-and-through, it has many similarities to the DEF CON of
  a few years in the past, however with just a little extra chill perspective. BSides is a good
  alternative for brand new audio system in addition to those that need to work together with fellow
  hackers in a extra chill and (barely) smaller environment – although it’s
  gotten fairly busy itself over time. BSides takes over all of the convention
  area on the Tuscany, and many of the lodge rooms, so it’s an amazing alternative
  to be fully immersed within the hacker scene.

• The Diana Initiative is “A convention
  dedicated to serving to all these underrepresented in Info Safety.” In
  the previous, it’s been a 1 day or 1/2 day affair, however now it’s changing into a 2 day
  occasion, and I’m so completely satisfied to see such an necessary subject getting extra love.

• Ringzer0 is a training-only occasion focusing
  predominantly on reverse engineering and exploitation. It gives a pleasant
  different to Black Hat trainings (it’s the identical days, however an unbiased
  occasion). The trainings provided right here appear far more particular than Black Hat
  trainings, and I’m planning to take one, so I’ll have a evaluation right here after the
  occasion.

Planning

The most important single piece of recommendation I can provide is: don’t attempt to do
every little thing. You may’t do it, and managing your vitality is definitely an
necessary a part of the week, particularly in the event you’re attending a number of of the
conferences through the week.

Past that, I encourage you to consider what you hope to get out of your
time. Should you’d prefer to check out contests, select one or possibly two and give attention to
them. Should you’re searching for a brand new function or wanting to satisfy new folks, discover
social alternatives. Should you’re trying to broaden your expertise in a specific
route, determine the entire related content material within the space.

I’ve had years the place I attempted to do an excessive amount of and ended the week feeling I’d carried out
nothing in any respect. I sometimes prioritize interactive occasions – contests, assembly
folks, and so on., – over talks, as a result of the talks might be recorded and accessible
later, until the discuss is one thing I plan to instantly apply. On the larger
occasions (DEF CON and Black Hat) the viewers is prone to be so massive that even
if in case you have questions, it is going to be exhausting to get them answered by the speaker.

Logistics

Fairly frankly, the perfect time to plan lodge and airfare has most likely already
handed, however the 2nd greatest time to plan them is correct now. I anticipate each will
solely rise in value from this level ahead. Sadly, costs have been
very unstable this summer season. As of writing, the next group charges for inns
are nonetheless accessible:

• DEF CON Room
  Block
  – Be aware that this 12 months, DEF CON is at Caesar’s Discussion board, which is a brand new
  convention middle situated behind the Linq and Harrah’s. (It’s connected to
  these two inns by a skybridge.)
• The
  Tuscany
  is the off-strip resort that hosts BSidesLV. They nonetheless have quite a few
  rooms accessible, and many of the company on the lodge might be fellow hackers
  through the course of the week.
• Black Hat has charges on the Mandalay
  Bay. I’d solely suggest this in the event you’ll be attending Black Hat, nonetheless, as
  it’s on the far south finish of the strip.
• Ringzer0 has a particular price for these
  attending their coaching at Park MGM. One function of this lodge is that the
  complete factor is Non-Smoking. Together with Vdara and the Delano, that is an
  uncommon high quality on the strip and nice for these with allergy symptoms.

Airfare is clearly excessive dependant on the place you might be originating. If it’s not
too far and airfare seems a bit dear for you, take a look at whether or not anybody from a
native DEF CON Group is driving and possibly you’ll be able to cut up the gasoline and make a brand new
buddy! There’s additionally journey and room share threads on the DEF CON
Discussion board. Whereas there’s clearly good
causes to watch out of who you journey or room with, numerous folks have had
success and met new associates alongside the way in which.

Bringing Tech

Some folks need to spend the entire week hacking. Some need to be hands-off
keyboard the entire week. You may be someplace in between. What you need to
do through the week will dictate numerous the tech you carry with you.

Since I might be attending a coaching occasion and revel in taking part in within the
contests/CTFs, I’ll essentially be bringing a laptop computer with me – on this case,
my Framework Laptop computer that I really like. (Full evaluation of that
coming quickly.) I’ve a 1TB SSD which ought to be
sufficient for VMs for coaching and CTFs as properly, however I’ll most likely additionally carry alongside
an exterior SSD for sharing sources. They’re gentle
sufficient that the velocity benefit over a typical flash drive is price it.

Should you do intend to take a coaching or play a CTF for greater than just a little bit, I
can’t suggest a wi-fi mouse sufficient. Even the
nice trackpad on Macbooks simply doesn’t really feel nearly as good to me as a mouse after a
few hours.

Shops will also be fairly restricted, so in the event you carry a journey energy
strip, you’ll be able to at all times squeeze in the place another person
has plugged in and even present extra shops. Sharing is caring!

I’ll even have my Pixel 6 Professional, however received’t carry any
work tech together with me – I’m lucky to not be in an pressing/oncall function, and
this permits me to higher give attention to what I’m doing there as a substitute of what’s going
on within the workplace. Although cellphone battery life has gotten fairly good for lots of
telephones, I’ll nonetheless carry a backup battery financial institution.
There are even ones able to charging many laptops
accessible, although they get a bit cumbersome and heavy.

I’ll cowl defending your tech down beneath, however the brief kind is that I’ve
no drawback bringing issues (laptop computer, cellphone, and so on.).

Packing

Look, it’s Las Vegas in August. You don’t must test a climate forecast to
know that it’s going to be sizzling. Reaching 45℃ (110℉) will not be out
of the query. There’s not prone to be a lot rain, however I’ve seen it a time
or two. Windy is a particular chance although. Costume accordingly.

Within the casinos and the convention areas, the air-con is usually on full
blast. I’m personally comfy in a T-Shirt and denims or shorts, but when
you’re vulnerable to being chilly below such situations, a light-weight hoodie or jacket
won’t be a foul thought.

I’ve two faculties of thought on carrying issues with me. Some years, I’ve
deliberately used a smaller backpack to keep away from
lugging a lot stuff round with me for days on finish. This does work out, however
then I find yourself wishing I had sure different objects. The opposite excessive is carrying
my EDC backpack full of substances and a sore again after a
couple of days. Carrying the smaller backpack might be the higher choice,
however I can’t say I’m at all times identified for making the perfect selections.

It could appear a bit anachronistic, however I additionally recommend carrying a small
pocket book (I’m fairly keen on Area Notes with
Dot-Graph paper) and pen. To this present day, I nonetheless discover
it simpler to make fast notes on pen and paper than on my cellphone, particularly if I
want a diagram or drawing of any type. (It additionally requires no recharging.)

Security

Keep Wholesome

Addressing the elephant within the room, there’s nonetheless a pandemic occurring, and new
variants on a regular basis. Everybody has already made up their thoughts on vaccinations,
so I’m not going to attempt to push anybody on that, however I’ll strongly recommend
bringing some checks with you to Las Vegas. Should you check optimistic, please don’t
come to the conferences and infect others. Sure, lacking out on a part of con will
suck, however it’s nonetheless the suitable factor to do. DEF CON and BSidesLV are each
requiring masking always (think about ear savers),
besides when consuming, ingesting, or presenting. Neither is requiring proof of
vaccination.

Even previous to the pandemic, Hacker Summer season Camp posed its personal well being challenges.
Insufficient sleep is sort of common, and ingesting, warmth, and dry air can
shortly result in dehydration. Ingesting water is completely vital. I strongly
suggest bringing an insulated water bottle, and also you
can refill from water fountains within the convention area. Bottled water within the
inns is extraordinarily costly (I consider most individuals would name it a “rip-off”)
however if you wish to get bottled water, I recommend going to CVS, or the ABC
comfort shops on the Strip. (Enjoyable truth, these
shops additionally promote alcohol at fairly affordable costs if you wish to have a drink
in your room. Resort guidelines would positively preclude carrying a
flask within the convention area, so no hackers would
ever do this.)

I significantly hate the warmth, so I additionally carry a few “cooling
towels” – you dampen them, and the evaporating water
causes them to chill off, consequently cooling you off. Additionally they make an amazing
primary towel for wiping sweat away or another fast use. I used to be skeptical when
I first heard of them, however they actually work to make you are feeling cooler.

Bodily Security

Las Vegas is a little bit of a singular metropolis in that it’s constructed fully across the
tourism business. That is much more true on or close to “The Strip”, the part of
Las Vegas Boulevard from The STRAT to Mandalay Bay (simply north of Reid Airport).
Each rip-off you’ll be able to think about is being performed right here in addition to many you received’t even
have considered. Your Social Engineering instincts ought to be on excessive alert.

Pickpocketing and theft of something unattended are each commonplace on the
strip, however theft much less so on the strip. It’s extra your belongings than you
your self which can be in danger. Keep in a gaggle in the event you can.

Know that the road performers have an expectation of getting paid in the event you
take a photograph with them. This ranges from a man in a poor Mickey Mouse costume
to ladies dressed up as Las Vegas showgirls. It could get confrontational in the event you
take a photograph and take a look at to not tip them in any respect, but in addition don’t allow them to rip you off
in the event you resolve to do that.

Digital Security

When you have totally up-to-date (patched) gadgets, I don’t consider the danger of
compromise to be particularly excessive. Think about the worth of 0-day exploits in
fashionable platforms together with the variety of reverse engineers and malware analysts
current who would possibly get a replica, ensuing within the 0-day being “burned”. To the
better of my data, no gadget I’ve ever taken has been compromised. (And sure,
I used to take “burner” gadgets, my views on this have advanced over time.)

When you have a tool that can’t run the most recent accessible OS (i.e., not
receives Android or iOS Updates), I strongly suggest upgrading, whether or not or not
you propose to carry it to DEF CON. Sadly there are sufficient browser and
comparable bugs that have an effect on older OSs that they’re mainly unsafe on any public
community, not simply those at these conferences.

At DEF CON, they supply each an “open” community (on which there are many
shenanigans, however not fashionable OS 0-day so far as I’m conscious) and a “safe” community
that makes use of 802.1x authentication with certificates (be sure you confirm the
community certificates) and in addition prevents client-to-client visitors.

I do suggest not bringing any significantly delicate knowledge, and having a
thorough backup earlier than your journey.

VPNs are a little bit of a controversial subject within the safety area proper now. Too
many suppliers fake they will provide issues they will. At a easy degree, your
visitors is ultimately egressing onto the general public web, and it’s not
end-to-end encryption. Should you’re within the safety area and never acquainted with
how industrial VPNs work, now may be a good time to look extra into it. I do
assume they’ve worth on open wi-fi networks as a result of the chance for
meddler-in-the-middle assaults is much less on a VPN than on the open WiFi. I
personally use Non-public Web
Entry
however there are lots of choices on the market.

FAQs

What’s a Goon?

DEF CON Goons are the volunteer
military that assist be sure DEF CON happens as efficiently and safely as potential.
Whereas they’ve a little bit of a fame for his or her loudness and directness, their
objective is to maintain issues shifting and achieve this safely. They are often recognized by their
purple DEF CON badges.

The place can I study extra in regards to the historical past of DEF CON?

I’m hardly a historian, however I can suggest trying out the DEF CON
documentary produced by Jason
Scott at DEF CON 20 in 2012.

What’s Badgelife?

The official DEF CON badges ultimately impressed different creators to get into the
area of creating badges as properly. These could also be digital, laser lower, hand
crafted, and extra. Some might be bought publicly, others are given out to associates,
and nonetheless others could also be related to an exercise in one of many villages.
These are sometimes referred to as “unofficial badges” since they aren’t related to
the DEF CON organizers they usually don’t achieve you entry to the convention.
(Some could achieve you entry to events and occasions run by their creators, nonetheless.)

The digital part scarcity related to the pandemic has slowed issues
down a bit, however this area seems poised to make a come again this 12 months or so.
On the finish of the day, Badgelife is only a significantly nerdy type of artwork.
(I’ve been a small-volume badgelife creator for a couple of years, so I really feel properly
positioned to acknowledge the nerdiness.)

The place Can I See Previous Talks?

The DEF CON Media Server has all of the media from
each DEF CON held, however not each DEF CON had talks recorded. Most of the
movies have additionally been uploaded to
YouTube.

Black Hat posts a number of the movies from their conferences to their YouTube
web page. Likewise,
BSidesLV has a YouTube web page
with their talks. Lastly, The Diana
Initiative has additionally uploaded
their movies from 2021. (Although apparently none from earlier than that point, not less than
that I might find.)

What’s the Rule on Images?

Till about 10 years in the past, the rule was no pictures allowed however now that
mainly everybody carries a digicam with them wherever they go (my cellphone
truly has 4 separate cameras), it’s been up to date a bit:

Everybody within the photograph should consent to having their photograph taken at each DEF CON
and BSidesLV. (And, fairly frankly, that is good recommendation for all times typically.)
This contains people within the background, and so on. There may additionally be areas
(Skytalks, Mohawkcon) that completely prohibit pictures. I’ve personally
witnessed people faraway from occasions for violating this rule.

At DEF CON 15, an undercover reporter was chased from the
occasion. Whereas the occasions do
permit press, they’re required to register as such (which earns them a
specially-colored badge) and the insurance policies require they determine themselves as
press to members.

A reporter coming “undercover” hoping to catch people brazenly discussing
criming within the hallways is prone to be very disenchanted. You’re much more
prone to catch folks mocking the safety business itself.

I Don’t Know Anybody – How Do I Meet Individuals?!

I battle with this myself, however the Lonely Hackers
Membership has an amazing
information.

Closing

I hope a few of these ideas have been useful to not less than a few of you. 🙂 Really feel
free to achieve me on Twitter with any suggestions you
might need. If you wish to get into the suitable mindset, I extremely suggest
trying out the music CDs or stay recordings from previous
DEFCONs or trying out Twin Core
Music.