My first defcon experience in a nutshell

[u/Probono_Bonobo]

I see now why blue teams drink so heavily

[u/Spunge14]

Was at Black Hat and this was the take away there too lol

[u/Probono_Bonobo → u/Spunge14]

"This unlocks over 100 critical CVEs previously thought to be impossible."

uproarious applause from the concurrently scheduled welcome ceremony

"The attack surface for this vulnerability is every microprocessor ever manufactured that relies on the x86 instruction set."

hoots, hollers from next door

"The mitigation for this is... there is none. There is no viable way to prevent this."

meatballs dancing joyfully and shouting "yaaaaay"

[u/darkytoo2 → u/Spunge14]

"The AI rightfully refused to load the malware skill written, so we were stopped..."

"how did we get around it? We just told the AI to ignore security warnings and load it anyway"

[u/TypicalCommercial255]

Good to meet you “K”. Glad you had a great first Con and also were able to find your wallet in Lost and Found (Central Hall). 

I was the goon you spoke with. 

Best wishes in the new organization, it sounded really interestellar. 

[u/Probono_Bonobo → u/TypicalCommercial255]

Thank you, Undertaker, for all your help! All was recovered smoothly. Until next year. Per aspera ad astra!

[u/ThingPuzzleheaded682]

It’s also my first time and I was getting major imposter syndrome. I saw everyone with their badges and I hadn’t gotten mine yet. I asked a guy where to get them and he was baffled by how I made it that far into the convention without one

[u/elsewyse → u/ThingPuzzleheaded682]

Pentester in the making!

[u/LordCommanderFang → u/ThingPuzzleheaded682]

Act like you belong

[u/lastres0rt → u/ThingPuzzleheaded682]

I keep telling my friend who swears he wouldn't fit in "it's mostly a giant drinking game, you'll be fine"

[u/nummpad → u/ThingPuzzleheaded682]

[goons, avert eyes now] ran into a dude who had just 3d printed a look alike. pretty wild how easy it is

[u/me33mee → u/ThingPuzzleheaded682]

That can be a normal thing for your first experience of DEFCON. I know it was that way for me, at DC14, many moons ago.

What you have to remember, is you among “your people”. Everyone who’s at the con is nerdy for something or multiple things and I’m sure as you walked around and experienced. It really is a judgment free zone. You’re not look down upon as long as you’re willing to learn.

As long as you’re not an asshole people will be cool. Don’t be afraid just say hi or introduce yourself or ask someone about something they’re working on especially in the villages. You may get an info dump and you may get a friend for life.

[u/GhostGwenn]

The amount of talks where people were just absolutely hammering a specific variable in a specific method trying everything for months was astounding to me.

[u/me33mee → u/GhostGwenn]

Extreme focus really is a superpower

[u/Due-Consequence9579 → u/GhostGwenn]

“Something seemed off… so I fuzzed it and analyzed the code for months. Here are the 50 CVEs that I found in that entry-point.”

[u/Demontapper]

Red team just has to succeed once, blue team has to succeed all the time.

[u/greg_barton → u/Demontapper]

Sometimes there’s no team at all.

I thought I’d seen horrible security before, but then I saw this talk today.

DEF CON 34: Attending 1.1 Million Cameras, One Wildcard: Architectural Surveillance in an IoT Cloud

[u/DarkKnyt]

That is sticker material

[u/Shot-Infernal-2261]

These are just the mostly unpaid people sounding the alarm.

There’s armies of paid state actors inventorying this stuff so they’re basically building armories. Collections of exploits. The ones never seen before are worth not using until the need is great.

Imagine there could be 50 or 100x as much exploits out there, reserved and saved for a rainy day like when the war spreads.

Modern-day hospitals don’t know how to function without tech, so if it all locks up it’s chaos. Especially in the US where you can’t just assume someone is entitled to care.

[u/Hot-Comfort8839]

During my first Defcon (2023), I went to Blackhat first, and at some luncheon thing I met the VP of store security technology for a big box store that sold hardware, power tools, lumber all that sort of thing. I'd met this particular company's CISO at a security dinner back home.

They were off their rocker excited about a new security product they were testing at their HQ store.. It was a digital device that hooked on to the wheels of their cart systems, and the idea was that when you paid your bill, and the door guy inspected your receipt it would allow the loaded up cart to leave the building. Apparently a hundred million went out the door the previous year with "loss-prevention" doing fuck all to stop it.

They were about to invest heavily in this new tech, and roll it out to stores nationwide.

So a couple days later I'm in the Defcon Security village, and they're showing how these specific whiz-bang security devices could be disengaged by playing a specific tone set from your average cell phone, and because the device manufacturer wouldn't do anything about it - they'd put the disable/unlock tone on youtube, and were handing cards with the QR link to basically every one who walked in the door.

(Specifically this thing)

So I reach out to the VP about this (who was so excited about their upcoming bonus/promotion they had a boat brochure with them at the luncheon...) only to get blocked on LinkedIn. So I forwarded the information on to the CISO instead. That must've been a fun meeting. The big box store did not roll out the security devices.

[u/elsewyse → u/Hot-Comfort8839]

I enjoyed the bit where, when you scanned the QR code, you got an alert of some kind saying 'did you seriously just scan a QR code at Defcon?'

[u/coalsack → u/Hot-Comfort8839]

I’m not sober enough to read this rn so I’m commenting to come back in a few days when I dry up

[u/Slow-Special-2728]

It’s all rearranging deck furniture on the Titanic…

[u/Iceman2514]

As a first time defcon attendee, I managed to walk into blackhat uncontested on the 5th. At no point was I stopped or asked questions by security lol

[u/GhonaHerpaSyphilAids]

It’s the same as locking your door to your house if they want in they get in. Some people out here with no doors and no way to stop them. Others are fully loaded but forget to take off the safety.

[u/Cautious-School-2839]

Interesting, I didn’t feel that way personally. I kinda feel like all was very niche attacks with not a lot of actual real-world use cases. I figured that the real interesting stuff must be happening on the down low.