Defcon 2026

Got a question or comment? Message us here!

A recap of DEFCON 2026 featuring the Latest in cybersecurity, hacking, AI, and digital defense. Don't miss the highlights from one of the world's most influential security conferences. 

Support the show

Watch full episodes at youtube.com/@aliascybersecurity.
Listen on Apple Podcasts, Spotify and anywhere you get your podcasts.

Episode Transcript

SPEAKER_00 (00:03):
You are now listening to the Secure AF
Podcast.

SPEAKER_03 (00:11):
Hello everybody and welcome to the Secure AF
Podcast.
I'll be your host for the daywith my co-host here.
I'm Tanner Shin.
This is Andrew Hickman.
Howdy.
You've uh if you a regularwatcher, you've probably met us
before.
Uh we just got back from DEF CONand we thought we'd kind of
recap and go over things.
And and yeah, so uh what is thisyour uh third DEF CON?

(00:34):
Third DEF CON.
Yeah.
Yeah.
How'd you feel about this year?

SPEAKER_04 (00:37):
I think I think this year was probably out of the the
three years, the best one allaround.
I think the uh Las VegasConvention Center has definitely
grown on me.
Um just because you knoweverything's all in one location
now.
Uh there's a lot of space.
Um and then staying close to itto where you know you can walk

(00:58):
walk to it and not have to, youknow, ride a bus or a tram or an
Uber there.

SPEAKER_03 (01:03):
Yeah, we got we got the the good hotel this time,
yeah.

SPEAKER_04 (01:07):
So it's like a what five-minute walk at most from
from door to door?
Uh from hotel door to hoteldoor.

SPEAKER_03 (01:13):
Yeah, or from hotel to convention, yeah.
Yeah, you still gotta walk 15minutes through the 1500s.
Yeah.

SPEAKER_01 (01:20):
Yeah.

SPEAKER_03 (01:20):
Um but yeah, it's much better than being outside.
Uh yeah, you yeah, that's that'sone of the the the nice things.
Um I mean, beforehand, you knowyou could just stay in the
hotel.
But for sure.
Um it is nice that you can uhyou can grab I mean Fountain
Blue is um godly expensive.
Yeah, but it's uh it's very niceand it's right there.
But then you also have like youknow the Marriott right across

(01:41):
the street.
And like there's look at theirnext year too.

SPEAKER_02 (01:44):
Yeah, yeah, it's uh it's worth considering, I think.
It was it was pretty nice.
I found myself sneaking in therefor a for a quick meal.

SPEAKER_04 (01:50):
Yeah, yeah, they're and you know, there's not bad
hotels, you know, in the area.
It really varies.
They fill up quick though.
Um I feel like people probablyknow they're going to DEF CON
and book well in advance, and Ithink this has kind of been like
a continual thing for DEF CON.
Like, you know when it's gonnabe.
You gotta book your hotels inFebruary, you know.

SPEAKER_01 (02:10):
Yep.

SPEAKER_03 (02:11):
Yeah, I'm still I'm still iffy on the convention
center, I think.
Um I think overall it's betterfor the convention.
But uh there was kind of thisthing beforehand where it was
like you had uh the conventionwas spread across you know these
three enormous casinos, and youif you wanted to go to a talk in
one in you know in Flamingo andyou're all the way down like you
know by ballet's and you want togo to that one, you're not

(02:32):
making it.
Yeah, yeah.
It's like like 35, 40 minutes ofwalking, like you're not making
it to that talk.
Yeah, and that's why the roomswere smaller, typically, most of
them, and they uh you know theyfit less people and it's harder.
So all that's much, much better.
The biggest problem is a weirdproblem that I you can I don't I
don't know how you solve.
All along the way, there's allthese little bars and

(02:53):
restaurants and things, andthey're just kind of full of DEF
CON people, and you can justkind of come up and sit with
anybody and just like hang outand meet people and stuff like
that.
And now that's pretty much justlike I guess the boot court,
it's just a very different vibe.
It's uh for sure.
It's not circle bar.
Yeah, yeah, circle bar's gone.
Circle Bar's gone for sure.
But I guess some people werethere this year, but uh yeah,

(03:15):
it's I know there were peopletrying to bring it back, but
it's so far.

SPEAKER_04 (03:18):
It's such a distance now.

SPEAKER_03 (03:19):
Yeah, it's so far.

SPEAKER_04 (03:20):
And that's like the you know, like you said, that's
kind of one of the issues.
It seems like the the conferenceitself is all in one place now,
which is cool, but it seems likeeveryone else just scatters and
goes to different locations tomeet up afterwards or whatever
they're doing, which Yeah.

SPEAKER_03 (03:39):
You gotta know like where you're going or know
people or something like that.
So I always wonder about likethe new people there, like how
are they just gonna like stumbleupon yeah?
What do they do?
These these enclaves of peopleand stuff.
Well, I mean, I know it's alwayspeople are friendly, you know.
People you say, Oh, it's myfirst DEF CON, and it's like,
oh, you know, I got some someswag to give you, I got some
come come check this thing out,or hey, let me introduce you to

(04:00):
this guy.
And you know, community isalways great for that.
Yeah.

SPEAKER_04 (04:03):
And that's a cool thing about it too, is just you
know, meeting new people.
I always, you know, I say I'mgonna tag along because I'm just
kind of there, you know, I'lltalk to people.

SPEAKER_03 (04:11):
Um you you were working a village.

SPEAKER_04 (04:13):
I yeah, I did work.
I did work at Policy Village.
I did volunteer time there,which was uh I was in uh Policy
Village Attache, which wasactually pretty fun.

SPEAKER_03 (04:22):
Yeah, the fancy colored badge.

SPEAKER_04 (04:23):
Yeah, I got a I got uh the village badge, which was
really cool.
Um I gotta meet some really coolpeople in the policy village,
uh, you know, kind of get myname out there.
And uh I don't know, might maybedo it next year.
We'll see if I I go next year.
Um Las Vegas is such a sillyplace.
But um but that was really cool,like uh getting to just kind of

(04:43):
help out volunteer time thereand just uh give back to you
know the the group that kind ofhelped be my motivation to get
to DEF CON in first place.
Um that's kind of I don't know,that sounds kind of silly.
Like I I enjoy policy, like ithas such a close relationship
with what I do on the blue teamside of things and uh all that

(05:04):
red team stuff is just like I Iget it, like I try to be
familiar with it and I want tobe familiar with it because it's
also a big part of what I do,but um like my interest, I had
to do I don't want to go standin line at Red Team Village for
anything.

SPEAKER_03 (05:18):
I didn't go to a single talk at Red Team Village.
Um well, I think I went to oneand it was like not what we
thought it was.

SPEAKER_01 (05:27):
Yeah.

SPEAKER_03 (05:27):
Uh yeah, I'm just I'm not into you know the big
lines, especially.
That's one of the only placesthat still is gonna have you
know a big line.

SPEAKER_04 (05:34):
Yeah, was that Thin Client guy we talked to?
Was that not Red Team Village?

SPEAKER_03 (05:37):
No, it was a main stage talk.
Oh, okay.
Yeah, fantastic talk, very goodtalk.
Um I figured that would havebeen Red Team.

SPEAKER_04 (05:45):
Because I know some some of the like the policy or
the the villages had their ownlike rooms for talks, but then
they had different people fromtheir village talking on main
stage and stuff.

SPEAKER_03 (05:56):
Yeah, there was some of that.
I don't think he was associatedwith the village.
He said it was his first DEF CONuh talking.
Um talk.
Yeah, very cool talk.

SPEAKER_01 (06:04):
Yeah.

SPEAKER_03 (06:04):
Guy found uh he tore apart a whole bunch of thin
clients, and uh he ended upfinding that basically all of
them were able to bypass secureboot with uh a USB driver.

SPEAKER_04 (06:17):
Even TPMS.

SPEAKER_03 (06:18):
Yeah.
Yeah, he was uh yeah, he wasbypassing TPM.
Yeah, he was bypassing um God,there's there's a bunch of
different ones, and they're alldifferent too.
He just like every single timehe would he'd grab one, he'd be
like, Oh, yep, here's a problem,here's a problem, and uh you
hearing all the major ones,yeah.
Ranking all the vendors on youknow responses and things like
that.
Very good talk.
Very good talk.

(06:39):
Yeah, I always appreciate itwhenever people are dropping
some O days and talks.

SPEAKER_04 (06:42):
Yeah, dude, it was it was it was really
interesting.
I'm glad I I sat in on that onebecause thinking about it, it's
like oh I've got TPM on this,we're we're good.
And then really all you need isuh Ubuntu bootable USB, and you
can hey, give me the key, andhere you go.
Yeah, that was pretty wild,yeah.

SPEAKER_03 (06:58):
Yeah, there were some of the exploits were like
silly, and just like, are youfor real?
This is this is how this works.

SPEAKER_04 (07:03):
Yeah.
But you know, again, the the thevendor's response or the
manufacturer's response to thatis is critical, right?
Because you go from like, oh,thank you so much for you know
pointing this out, we're gonnawork on fixing this, we can work
with you, or you know, a ceaseand desist.

SPEAKER_03 (07:21):
You know, there's yeah, I don't think you got any
cease and desist, so that'sgood.
That's better than a lot of thelike you know, OT manufacturers
and hardware manufacturers andIoT stuff.
Yeah.
A lot of the times those like,yeah, they do not um they do not
foster a good environment forresponsible disclosure.

SPEAKER_04 (07:40):
No, and we see that um even in like the bug bounty
stuff, right?
Like uh you would think that wewould you would have the the
reverse response that wetypically see where like, hey,
uh we found this critical bug inyour infrastructure, like um,
and instead of being like, oh,thank you so much, let's fix
that.

(08:00):
How did you find that?
It turns into a don't ever dothat again, don't ever talk to
the to us, don't talk aboutthat.
Yep.
Um and I I find that especiallystrange because you know,
motivations of people wild, youknow, range wildly.
So would you rather have like awhite hat, maybe white hat, even
maybe even a gray hat person whomaybe they're doing this because

(08:22):
they are motivated by money, butyou know, they're not gonna
ransom you or attack you, um,versus just having you know a
threat actor finding it.

SPEAKER_03 (08:32):
Yeah, well, it's like um one of our friends who
was working on trafficcontrollers.

SPEAKER_01 (08:37):
Yeah.

SPEAKER_03 (08:37):
Um, one of the biggest, biggest vendors that
there is for the trafficcontrollers.
I mean, he bought one off eBay,found some some pretty major
exploits, did responsibledisclosure, got cease and
desist, and they wanted to dragit out into a court case and
say, well, you were hackingtraffic lights.
And he's like, actually, here'smy eBay receipt and photos of it
on my desk.
I bought one.
Like, yeah, it's they they justwant to be combative about it.

SPEAKER_04 (08:59):
Yeah, and I that's that's the response I don't
understand, especially in thisday and age.
Like when you have people whoare just out there doing the
security research and giving youthis information for free.

SPEAKER_03 (09:11):
Yeah, here I just gave you an eighty thousand
dollar pen test for free.

SPEAKER_04 (09:14):
Yeah, and then and then to treat, you know,
arguably like you're you know,you're doing a society a good
thing, you know.
Uh like, hey, this is criticalinfrastructure, I identified
these vulnerabilities orweaknesses.
Here's a report for free.

SPEAKER_03 (09:30):
Yeah.

SPEAKER_04 (09:30):
Like you would figure like the response would
be the exact opposite of whathappens in most cases.

SPEAKER_03 (09:37):
So um I that on the same note though, I was happy to
see uh biohacking village wasjust full of vendors.

SPEAKER_02 (09:43):
Yeah.

SPEAKER_03 (09:43):
And it was vendors who brought their equipment and
they would just sit down andhack it.
Yeah, that's pretty cool.
And we found uh our guy Sean,Device Recon Labs.
He he found some some stuff.
Um I go into too much detailsjust for you know respect of the
vendor.
Yeah, yeah, yeah.
Um but he found some stuff thefirst day.
They fixed it overnight.

SPEAKER_04 (10:01):
That's pretty cool.

SPEAKER_03 (10:02):
So they fixed it overnight.
We came back the next day, weplugged in, started going
deeper, found a few more things,and you know, it was like all
things that they're like, heckyeah, let's get this fixed.
You know, they're this.
Those are the people you want towork with.
Yeah, yeah.
Yeah, you know, they want tokeep in touch and they want to
know about you know how they canprevent this in the future and
things like that.
And it's like, yeah, that's whatyou want to see out of your

(10:24):
vendors.

SPEAKER_04 (10:24):
And so it's good to see, at least in the um, you
know, the the biohacking kind ofthe uh the medical space, yeah,
that that's the and as aconsumer, those are the
companies that I that I'll givemoney to that I because I know
if they're taking that securityseriously, especially with
medical devices, like like youknow, there's something to be

(10:46):
said about someone who willtake, I mean, it's for for lack
of a better term, constructivecriticism almost, right?
Like, hey, you know, you do havethis piece of hardware, it could
be better, and then going, hey,thanks, we'll do something about
that, and then doing somethingabout it.
Yep.
Yeah, that's that's the companythat I want to do business with.
So what other cool things do wesee?

(11:07):
Uh oh, the uh uh the the thebomb squad robot.
Yeah, that's cool.
That was pretty fun.
It was more of a reverseengineer, I feel like, not as
much as a hack.

SPEAKER_03 (11:18):
It was not what I expected as far as how they went
about finding the exploits andeverything.
Um, but they did find some somevalid stuff.
Um, you know, it was it wasdefinitely still cool to see.
It's anytime you're hackingsomething that's cool, it's
gonna be cool, right?
Yeah, they're like, yeah, thisis an EOD robot.
Like, yeah, I'm interestedimmediately.
Like, I don't even care what youdo for sure.
And then, you know, they had abunch of them out there on the

(11:39):
floor.
That was cool.
They were part of a car hackingvillage.
Yeah.
So yeah.
I didn't hear too much about uhpeople that got cool hacks on
the Volkswagen this year thathad an electric Volkswagen out
there.

SPEAKER_04 (11:48):
Yeah, I saw that one.
Yeah.
I don't I didn't spend a wholelot of time in car hacking
village.
Yeah.
The lines were long everywhere.

SPEAKER_03 (11:59):
Uh I mean, Line Con for badges is still that's
fixed.
That's that's true.
Yeah.
Yeah.
So if you want to, I guess theyopened it beforehand.
It's like they opened theyopened Line Con to have Line Con
this year.
They did.
Like the day before the nightbefore.

SPEAKER_04 (12:13):
And I think that's what they that they had done
last year as well, was they ifif you wanted to sit in line all
night, here you go.
Have fun.

SPEAKER_03 (12:20):
People like it.
People they're you know, they'rethey always they always talk
about oh, you meet people andlike, yeah, you do.
Whenever you're standing next tosomebody for four hours, you end
up meeting them.
Yeah.

SPEAKER_04 (12:29):
Yeah.
Especially if you're stayingthere overnight.
Because I think that's what theywere doing.
They were lining up overnight.
And then people would do linecon.
But it's weird, like that firstday, like that Thursday when
merch is opening, like the lineto merch is astronomical.
Oh, yeah.
People get their badge thatnight or that morning and they

(12:50):
go straight to the merch line.
And it's it's to a point wherelike I'm not, I don't even, I
don't even buy DEF CON.
No.

SPEAKER_03 (12:56):
No, I'll go to the vendor area and maybe find
something that, you know, shoutout Snake Reaper homies.
You know yeah, for sure.
They had a had a good shirt thisyear.
Yeah, you know, shout out.
Shout out, shout out to it.

SPEAKER_04 (13:07):
It's probably available on their website
still.

SPEAKER_03 (13:09):
So yeah, yeah, that was uh Solaris that he he came
up with that one, and I waslike, hell yeah, dude.
It's uh it's got their uhthey're kind of they got like a
skeleton mascot guy.
And uh he's holding a sawzalland it says go flock yourself.
It's yeah, it's pretty good.
It's pretty good.
I like that.
Yeah, it's a solid shirt.
Almost wore it today.
A lot of flock talk.
A lot of uh, you know.

(13:29):
Saw some uh guys running aroundwith flock cameras chained up to
a necklace.
That was pretty funny.

SPEAKER_04 (13:34):
There may have been more of them.

SPEAKER_03 (13:36):
Yeah, I got a uh I got a selfie with that with the
flock camera.

SPEAKER_04 (13:40):
That's funny, yeah.
A lot of debate about that rightnow.
Uh always uh a point ofinterest.
I don't know.
Was there any talks regardinglike going around flock cameras?
I didn't see any.

SPEAKER_03 (13:50):
Probably.
I don't know.
There's so many talks.
That's always the hard part,right?
Is you you scroll through.
They've got an app for those whohaven't been the hacker tracker
and it's got the schedule on it.
You can go bookmark the things,and it'll be like, this talk is
starting in 30 minutes orwhatever.
And uh yeah, it's impossible tosee all the things you you want
to see.

SPEAKER_04 (14:10):
Um yeah, I think I bookmarked like five or six
different talks each day that Iwanted to go to, and I think I
only made it to like maybe threeeach day.
At most, yeah.
Yeah, yeah.

SPEAKER_03 (14:22):
Normally I just like, hey, this one has some
space.
Let me jump in here.
Oh, they started doingheadphones.
I don't really care for thatpersonally.

SPEAKER_04 (14:27):
I get why they did it.
It seems very dystopian to mefor some reason.
Yeah.
Yeah, it's a it's a very it'svery weird.
I mean, again, from from pastDEF CON experience where like,
yeah, they had, you know, awhole bunch of t different talks
going on in the the main bigroom and there's stages
everywhere, and people, youknow, I it can be loud.

(14:48):
But there was something verystrange about going into an
environment where there was, youknow, there's like six or seven
people talking all havingdifferent talks at the same time
and hearing nothing.

SPEAKER_03 (15:00):
Yeah.

SPEAKER_04 (15:00):
And then people are just sitting there with
headphones in and then randomlyclapping because you know,
they're hearing something toclap for, and it's like, oh,
that's kind of weird.

SPEAKER_03 (15:09):
It was a little strange.
Yeah.
Um, I I personally always likeI'll show up to a talk after it
starts because you know, I don'tlike lines.
Yeah.
And I'll just kind of slink in,and you know, within five
minutes, if it's something Ifeel like I'm interested in,
I'll I'll, you know, maybe maybefind a seat if I can, or or just
hang out and listen.
Um, can't really do that.
You kind of have to like prepareand get a seat and all that, and

(15:31):
it's you know, limited headsets.
And yeah, it's just kind of adifferent thing.
I wasn't a huge fan of it, but Iget it.
Like they're trying to do howcan we do all these talks in
this big shared room andeverything.

SPEAKER_04 (15:42):
So that and having the I mean, they had like
sanitation stuff for theheadphones.

SPEAKER_00 (15:46):
Yeah.

SPEAKER_04 (15:47):
But me, like, I don't I don't want to like I was
sitting there with like, youknow, two alcohol pads, like
just scrubbing, like uh just youknow, I don't know who wore
those for me.

SPEAKER_03 (15:59):
You know, I didn't get headlights, but I also don't
have hair, so that's fair.
I didn't get headlines.
Um the villages were stillnormal.
Yeah.
I think most of them were.

SPEAKER_02 (16:10):
Not all of them.
Some of the main stage villagesstill had the headsets.
Actually, a lot of them did.
But all the upstairs villageswere still normal.

SPEAKER_04 (16:16):
Yeah, all of the it seemed like the headphones was
just for like the main stagestuff.
Yeah.
Um, because you know, I went toseveral policy talks and a blue
team talk, and um there were,you know, it was just a a room
of people that weren'theadphones or anything, so
that's probably accurate.

SPEAKER_03 (16:33):
I don't remember seeing headphones anywhere else.
Yep, yep.
Ham Radio Village, I feel likethey did a lot this year.
It was very cool.

SPEAKER_04 (16:41):
Yeah.
Yeah.
Uh Peters and I went went inthere several times because
there was um there was aMastastic talk that we were
trying to catch.
Um and it's weird because theyhave, you know, the room was a
their room was a lot smallerthan all the other villages.
It was pretty small.
And so it was constantly packed,and they do their talks in that
same small room.

(17:02):
And there were like maybe 20chairs at most.
Yeah, everybody's standingthere.
People were just staying, youknow, standing listening to the
talks, so it got to a pointwhere I was like, they just need
a bigger room at this point.

SPEAKER_03 (17:11):
Like, yeah, a lot of people ham radio village, do
you?
Ham radio's grown huge.
Um and I mean it's not even justham, though, it's also all kinds
of RF stuff.

SPEAKER_04 (17:19):
Yeah, the mesh task stuff.

SPEAKER_03 (17:20):
There's a lot of mesh task people in there.
They had um like an oldlocalized TV broadcast.
Yeah, that was really cool.
They had all kinds of coolstuff.
They had uh slow scan TVrunning, they had um uh a couple
of different mesh tastics wherethey had mesh core and mesh
tastic, and you know I guess umon like mesh task long fast,

(17:43):
there was like a CTF running orsomething.
Was there?
Yeah, and so that was such adifferent thing.
That was why that was why it wasso jank and messed up.
Well, I'm not even talking aboutthe DEF CON firmware, just in
general.
Yeah.
And so like it was it wasn'tworking super well, and it was
because there were peoplehacking on it all week.

SPEAKER_04 (17:58):
Yeah, and they always do the fox hunt every
year too.
Yeah, the fox hunt's cool.
Me and Peters have always talkedabout doing the fox hunt, but I
figured that like takes anentire day at the at the least
for the I don't know, just howdoes it work?
So there's like a you basicallyI I see guys carry around
directional antennas that aredoing the fox hunt.
But basically there's justdifferent devices that are you

(18:21):
know broadcasting, you justgotta go find them, and it's
kind of like a scavenger huntjust from the ham radio village.
So they just give you like someclues or uh I I imagine so.
I haven't gotten that in depthwith it.
Peters might know more about it.
Gotcha.
But it's kind of just like anit's like another CTF.
It's just they call it the foxhunt.

(18:41):
You gotta go hunt down thesignals, and you know, you might
get a clue once you get toanother signal and blah blah
blah blah blah.
But I think I'm I'm pretty sureit works like that, but I might
be wrong, so don't hold me toit.

SPEAKER_03 (18:54):
Yeah, I didn't do any CTFs, but I typically don't.
Um I heard Spy vs Spy was reallycool.
Yeah, I would love to do youknow a CTF sometime, but it's
kind of like do I want to spendmy DEF CON doing this CTF, or do
I want to go meet people and seeall these different things and
catch talks?
Yeah, you kind of have tochoose.

SPEAKER_04 (19:13):
It definitely uh takes it that is the challenge
of DEF CON.
There is so much happening allat the same time.
So, like if you want to do aCTF, you're dedicating a portion
of that day, maybe all day, todo that CTF.
Yep.
And so um that's like um I got asneak reaper badge that came

(19:37):
with a CTF.
Yep.
I didn't even start on it untilI got home from DEF CON because
I knew that if I got involved inthat CTF, I was just gonna sit
in my hotel room doing this CTF.
Yep.
Um and so that's what I've beendoing at home since I've got you
know back from DEF CON is doingthis Sneak Creeper badge CTF and
driving myself crazy, but it'sbeen really fun.

(19:57):
So, but if you enjoy those kindof things, like that you know,
you're not gonna you know bedisappointed that you did it,
right?
Like it's it's a puzzle or youknow, a scavenger hunt.
Um, so and then again, that'sthe the thing about DEF CON is
like there's something there foreveryone.
Yeah, like if you have aninterest in the cybersecurity
space, um whether that's redteam, blue team, you know uh IoT

(20:22):
hacking, car hacking, whateverthe policy, like there'll be
stuff for you to do there.

SPEAKER_02 (20:28):
Yep.

SPEAKER_04 (20:28):
Uh and if you're like, well, I don't have like a
great interest in just any onetopic, but I really enjoy doing
CTFs, there's plenty of CTFsfrom every single village.

SPEAKER_01 (20:37):
Yep.

SPEAKER_04 (20:38):
And if you're like, well, I just kind of enjoy the
hardware part of it.
Well, there's hardware specificstuff, there's hardware hacking
village, there's the badge lifestuff.
Like if you like, you know,sovereign get hands-on stuff.
I mean, it's there's no shortageof things to do.

SPEAKER_03 (20:53):
Yeah.
Yeah, I mean, that's just one ofthe good things about the
community, right?
Is everybody's got these theseniches and and things like that.
I mean, we uh met a guy at ouruh our tech on tap event
yesterday who was installing uhCali Nethunter on a uh car head
unit.
It was kind of like like us.
This is one of the main thingshe was doing.

(21:14):
And um I was immediately like,oh yeah, but like are you
getting like steering controlsto work?
He's like, actually, I had a lotof problems.
I was like, oh yeah, yeah,you're gonna have to like can
bus, and like Sean comes overand we're talking about like
he's in like canalyzer and likehow you could possibly what
chips are aboard on this on thishead unit, and could we get it
to recognize the CAN bus systemdirectly from it, or does it
need a secondary module to readCAN bus and like you know, like

(21:36):
we're diving straight in?
That's like just like one of thethe cool things about the uh the
the people in the space issomebody's like, Hey, I'm doing
this really weird thing, andwe're like, oh yeah.
We love it, let's do it.

SPEAKER_04 (21:47):
Yeah.
Give me your thoughts.
How do you feel about this?
Yeah, what can I do different?
Yeah, and for the most part,like a lot of those people are
just super receptive to oh yeah,they want that.
You know, it's you know, none ofthat's like unwelcome or it's
not like a challenge.
People want that.
Like that's one of the reasonswhy they bring that stuff, you

(22:08):
know.

SPEAKER_03 (22:09):
Yeah, yeah.
The there was some coolBluetooth stuff that released.
Um, there's one, I think it'sBLE Exploit.
It's a mobile app for Androidand iPhone, and it is by far the
best Bluetooth recon andexploitation tool that I've seen
for a mobile app.
It's so good.
Yeah, it's it was sitting there,I was able to connect to random

(22:30):
stuff and pull data and be ableto interrogate it and
everything.
Really?
Just like sitting in theMarriott lobby having a drink.
Yeah.
Just like just getting all kindsof wild stuff.
Just like, what is this?
What is this?
Yeah.
Pretty sure I connected to avibrator.
Oh.

(22:50):
Let me let me let me make themistake of Googling this.
Yeah.
Whoops.

SPEAKER_04 (22:55):
Yeah.

SPEAKER_03 (22:57):
But uh, you know, that goes in.
We did it, I did a podcast onetime on um uh hacking sex toys.
That's uh that's uh space thathas a lot of security problems.
It's a weird space, but yeah.
We have a lot of securityproblems.
Yeah, yeah.
I don't think there's any uh anyadult toy villages.

SPEAKER_04 (23:15):
It kind of surprises me though, to be honest.
I mean, knowing knowing the thepeople in the location, I mean,
it would it would fit right in.
It wouldn't be out of place atall.

SPEAKER_03 (23:26):
Uh it wouldn't it wouldn't come off that weird.
Yeah, it would it would makesense.
It would make sense.

SPEAKER_04 (23:31):
I guess just you know, what's really the threat
there, you know?

SPEAKER_03 (23:36):
So what would you say the best talk you saw was?

SPEAKER_04 (23:40):
I'm kind of biased.
Um we had an Oklahoma umrepresentative uh who did a talk
at um in Policy Village aboutlike um just kind of how the
Oklahoma government is workingto strengthen our cybersecurity

(24:01):
program here and had call-outsspecifically towards like how we
help strengthen like rural youknow infrastructure in areas,
like specifically likehospitals, um, and how they're
pushing like grants and thingsto try to help these
organizations that areabsolutely critical uh for these
you know rural regions uh whoone don't have a lot of

(24:25):
resources, two, don't have a agreat talent pool.
Um and I'm missing where I wasgoing with three, but I'll leave
it at that.
Um so but it was reallyinteresting just to like it
seems like that cybersecuritymindset is more on the for you

(24:48):
know forethought.
Like people are thinking aboutit more.

SPEAKER_03 (24:52):
They're being forced to.

SPEAKER_04 (24:53):
Yeah, yeah.
They're being forced to.
Um, but it and that just seemslike it's been within the last,
I don't know, maybe three years,two or three years, where um,
you know, security used to bekind of an afterthought where
it's like, hey, we have thesethings, it's up, it's working.
Um, and then you know, you starthaving these municipalities and

(25:14):
these, you know, rural hospitalswho get taken offline because of
ransomware.
And what do people in those youknow, regions who, you know, you
have this is your hospital.
Like it's ours to get tosomewhere else.
And if you're someone who's likehad a stroke or you know, a
heart attack, like those hoursare absolutely critical.

(25:35):
Yeah.
And so kind of like seeing likehow the state is changing their
policies and procedures and anduh how they're trying to push
that to m municipalities andhelp them, especially like these
rural areas, which we got a lotof them in Oklahoma, um, it was
was really interesting.

SPEAKER_03 (25:52):
Uh was that uh Mr.
Hendricks?
It was Craig.
Craig.
Oh, okay, okay, cool.

SPEAKER_04 (25:56):
No, I did catch Shout out Craig.
Yeah, yeah.
I did um I did catch one atAnthony's I did catch Anthony's
talk.
Okay.
Which is always funny.

SPEAKER_01 (26:04):
Yeah.

SPEAKER_04 (26:04):
Um he was on one of the creator stages just talking
about um um, you know, legalthings.
He's a lawyer, cybersecuritylawyer, but um that was that was
a good talk too.

SPEAKER_03 (26:15):
Yeah, anytime you're a lawyer and a bunch of hackers
like you, you're doing somethingwell.

SPEAKER_04 (26:18):
Yeah, he is legit.
I mean, we've talked to a lot oflawyers.
Like he's one like I don't mindgetting on the phone with.
Yeah.

SPEAKER_03 (26:25):
We're we're typically natural enemies.
Yeah, typically unfortunately.

SPEAKER_04 (26:29):
And not like because we want to be.
It's just we, you know, we findstuff that they don't they don't
like.
Yeah.

SPEAKER_03 (26:35):
They gotta they've got we we we try to help and
they start asking usuncomfortable questions.

SPEAKER_04 (26:39):
Yeah, they've got they've got legal things that
they have to do now.
I know there was one there wasone talk I wanted to go to um
talking about threat actorsspecifically and like just how
they've changed.
That was in the blue teamvillage.
It was the first talk that Iwanted to go to.
I got in line, I sat in line for30 minutes, and then I realized

(27:00):
I was in the wrong line becausethe blue team village was right
next door to like the fishingvillage, or I don't know, some
some other village.
And then they were like, oh,that line's over here, and it
was already wrapped aroundbecause I had been sending the
wrong line for 30 minutes, so Isaid, Guess I'm not going to
that talk.
Uh but you know, it's fine, it'sDEF CON.

SPEAKER_03 (27:22):
I think Blue Team Talks are recorded.

SPEAKER_04 (27:25):
I could probably go find them.
I think so.
I thought only like the the likethe main stage in Crater Village
talks.

SPEAKER_03 (27:31):
Those are guaranteed to be recorded.
Okay.
The rest of it is just like onthe villages.
It's like Recon Village, like wewe know they're do they all have
their own YouTube channels?

SPEAKER_04 (27:41):
A lot of them.
Okay.
I might have to search for thatbecause I there was a couple
talks that I went to go try tofind on like the DEF CON, you
know, DEF CON YouTube channel.
Yeah, those won't be up yet.

SPEAKER_03 (27:51):
No, those won't be up yet.
They usually put them up a fewmonths later, okay, and then
they'll kind of trickle them outand and stuff like that.

SPEAKER_04 (27:57):
Or have to go there because there were several Blue
Team talks that I didn't get touh I didn't get to make.
So I'll have to go try to findthose because I definitely want
to see them still.

SPEAKER_03 (28:06):
Yeah, and I imagine with the headphone situation,
the talks will probably be wellrecorded as well.

SPEAKER_04 (28:11):
Oh, yeah, that's true.

SPEAKER_03 (28:12):
Because they all had them hooked up on mics.
Yeah, so it'd be like directaudio instead of just like a
microphone.
Oh, that's a that's an addedbenefit.
I imagine.
I guess we'll find out.

SPEAKER_04 (28:20):
Yeah, that's true.

SPEAKER_03 (28:21):
But I would guess so.
Never know.
Yeah.

SPEAKER_04 (28:23):
What did you think of the DEF CON badge this year?

SPEAKER_03 (28:26):
Um it was cool.
I felt like um it was very coolas a as a concept.
They had some like new hardwarethat has uh like specially made
for the badge or maybe used inother things and things like
that.
I mean it was essentially a FIDOtoken.

SPEAKER_01 (28:39):
Yeah.

SPEAKER_03 (28:39):
Um so I mean it was a make a QR code and you could
have somebody else had a littlecamera on it that could scan
your QR code.

SPEAKER_04 (28:46):
Umes kind of thing, because you had different you
had a different pattern oflights, and so you could you
could exchange light patternsand get new light patterns and
stuff with the code.

SPEAKER_03 (28:57):
Mutations and things, and yeah.
And somebody did hack it by theend of con.
Yeah.
Good.
Um and they didn't release theexploit until like the very last
day or something like that.
It was like Sunday when theyreleased it.
Um but it was it was still cool.
Uh they pulled a key out.
I don't remember the exact hack.
It was it was reasonablyinvolved.

SPEAKER_04 (29:17):
I know there were guys trying to install Doom on
it.
Yeah.
That would have been cool.
I'm curious if that everhappened.

SPEAKER_03 (29:23):
That would have been very cool.
I heard some like controversyabout people were upset that I
had a camera.
You know, DEF CON people arethinking about cameras, even
though there's like somebodytaking a picture with a cell
phone every five seconds.
Yeah.
Um they were like, yeah, we needto talk about the the camera
code and the fact that this hada camera on it, and they were
like, you know, if you hack thebadge, you can actually make the

(29:45):
camera be viable and things likethat.
And just like I don't know aboutthem, apples.
I just, I don't know.
I've I I know people still careabout the the camera thing, and
I'm just like, man, there's abillion cameras in this casino.
Every everybody's walking up.
Holding a cell phone.
They banned they bannedmetaglasses.

SPEAKER_01 (30:04):
Yeah.

SPEAKER_03 (30:05):
Um which like I get it.
Like they don't, you know, walkup to somebody who's just
recording your face, like it'sthat's very uncomfortable.
Um, I don't I don't hate that,but at the same time, it does
feel like a fruitless effort tome where it's like, you know,
there's a million other waysthey could record.

SPEAKER_04 (30:19):
Yeah, there was different media teams running
around just recording the spaceand taking pictures and like
like again to to be upset aboutthe camera on the badge, which
was you know, 99% of people arejust gonna utilize for scanning
the other badge's QR code.
Right.
You know, like who's reallygonna go that in-depth, that def
column?
Like, I don't know.

(30:39):
I don't I don't know.
I would have figured that the uhthe SAO uh connections being
upside down would have been thebiggest uh I can we can we
tinfoil hat time?
Alright.
Alright.
I almost feel like they do it atpurp on purpose at this point.

SPEAKER_03 (30:56):
They mess something up on purpose?

SPEAKER_04 (30:58):
Yeah, like the last three years that I've gone,
there has been something wrongwith the badge.

SPEAKER_03 (31:02):
There's pretty much always something.
Yeah.

SPEAKER_04 (31:04):
And I feel like it's almost intentional at this
point.
Like whether it's to like driveI don't know, you know, like uh
uh online engagement.
I don't know if it's onlineengagement or like uh what's the
saying like uh uh like um no nono publicity is bad publicity

(31:26):
kind of thing.
Yeah.
Because like it's just kind ofsilly, like, oh the SAOs are
upside down, but it's coolbecause we already have these
adapters to fix it.
So they knew it was a problemand you know, probably paid more
to have these little fixes for abunch of people.

SPEAKER_03 (31:39):
It is kind of wild that that didn't get tested and
they made you know 30, 40,000badges and yeah, I mean it had
to be on the on the diagram,like you know, the blueprint
that they knew.
Or just a test unit, you know,you would think.

SPEAKER_04 (31:52):
I guess.
I don't know.
Um, yeah, yeah.
I don't know, but that's thekind of stuff that makes me feel
like because the year before thebadges, it was the
non-electronic badge.
They're just falling.
They were exploding.
They were just yeah, they hadthose little pins.
I had a fun scavenger hunt andutilized that to my advantage,
though.
So you did.
Um and then the not I didn't gothe previous year, but that was

(32:14):
the the Game Boy year, right?

SPEAKER_03 (32:16):
Yes.

SPEAKER_04 (32:17):
And there was a controversy around that too.

SPEAKER_03 (32:19):
Yes, a big one.
Yeah, there was a uh the personwho I'm gonna script all the
details, originally wrote itlike they felt like they were
slided or something, and theyhid some stuff into where like
it would bring up a hidden menuthat DEF CON people didn't know
was there, and it would be like,I'm the actual creator of the
badge, feel free to send memoney.

(32:41):
Yeah.
And uh, you know, they they werevery upset by that.
And I guess he stood up on a ata at a main talk or something
and gave like a monologue on howmessed up things were, and they
like re escorted him from theconvention.

SPEAKER_04 (32:53):
See, that all I look, it could have been
organic.
It just seems awfully scripted.

SPEAKER_03 (33:00):
It's your DEF CON conspiracy.

SPEAKER_04 (33:02):
That's my DEF CON conspiracy.

SPEAKER_03 (33:03):
Yeah, yeah.
Yeah.
So next year we'll see what thehow the badge is messed up.
Um yeah.

SPEAKER_04 (33:07):
We'll see.
Yeah, because next year's thenon-electronic we're supposed to
be.
So unless they do something.
What is next year is next yearthir 35?
Yeah.
So I don't know if they doanything special for 35 or I
doubt it.
Um, but yeah, I mean, it's kindof silly, and it I mean, it
didn't ruin anything.
It's you know, it's just kind offunny at this point to me that

(33:29):
Yeah, it's always somethingsmall.
That you know, we have thismassive conference and there's
you know, what, 30,000 peopleplus there.
And like anyways, it's just kindof funny to me.

SPEAKER_03 (33:42):
That's how it goes.
That's how it goes.
Um, so what would you tellpeople who are wanting to go to
DEF CON for the first time?

SPEAKER_04 (33:51):
Oh man.
Uh you know, I should they go?
On yeah, I think so.
If you're interested in thecybersecurity space, hack like
if you just have a if you'repassionate about it, if you have
an interest in it, like that'sthat's your thing, is like if if
your favorite movie is hackersor you know, Johnny Mnemonic, or
you know, Swordfish or whatever,whatever, enter Hacking Movie,

(34:13):
and like you like the hackerculture, and um, you know, it's
a it's a fun conference.
Um I you know, I I wasn't Iwasn't in this workspace when
you know DEF CON started.
And so I only hear like how muchit's changed from like what it
was originally, like thisgrassroots where like there

(34:34):
seems to be less hacking stuffand more like not maybe not
corporate but morebusiness-oriented stuff
happening.
Um and so I can't like speak tothat.
Uh, but as a whole, like, isthere a lot of interesting and
cool things to see?
Absolutely.
Are there cool people to meetand good connections to make?

(34:56):
Absolutely.
Um, I kind of think it's sillythat it's in Las Vegas in the
hottest part of the summer.
Um, that's my biggest critique.
Yeah.
Um that's one of the we were Iwas when we were flying in, uh,
there was a guy from um, I won'tsay the company name, but there
was a guy flying in who was on acybersecurity team for XYZ

(35:19):
Company, and this was his firstDEF CON ever.
He was super excited about it.
And um my main pointer, my maintip to him um was um if it looks
like you can walk there, don't.
That was my main point.
Just Las Vegas advice.
Yeah, yeah, just Las Vegasadvice.
I mean, because really DEF CON,like it's really not hard to go,

(35:41):
even if you're by yourself, it'snot hard to go to DEF CON and
find people.
Like you can find your people atDEF CON.
Yeah.
Um I mean, we you know, DEFCON's a huge place, and how many
times did we run into like, youknow, friends or people we work
with from Oklahoma uh that wenever planned uh planned on
meeting?
Yep.

(36:02):
We just hey there's our people,you know, like um, and even if
you don't know people, you know,it's pretty easy like uh meeting
Luigi in line for pizza that oneday.
Yeah.
Uh because those guys were like,are you hackers?

SPEAKER_03 (36:15):
I ran into him at Tellefreak.
Yeah, yeah, you were sayingthat.
Yeah, yeah.
I can't believe he made it,yeah.
Shout out Luigi.
I can't believe they uh made itto Telefreak their first year at
DEF CON.

SPEAKER_04 (36:24):
That's actually crazy.
It's it's hilarious.
Um, but yeah, but that's whatI'm saying.
That was his first year at DEFCON, and he made it to a party
that it's like very hush-hush,like hard to get into.
Yeah, like you, it's who youknow.
Exactly.
So you can, you know, you canfigure it out.
There, there are there arethings to do.
So um I think like again, Ithink most of my advice I give

(36:45):
to people about it is justregarding Vegas in general.
Uh DEF CON is just kind of youyou'll figure it out.
It's not it's not that complex.
Yep.
Um, the other piece of advicewas like, hey, find talks you
want to go to, um, but don'tplan on making all of them.

SPEAKER_03 (37:03):
Like don't marry yourself to any cloud.

SPEAKER_04 (37:05):
If you have like, I would, I would pick maybe one a
day that you're saying I'm goingto make it to this talk.
And then everything else is justup in the air.
Because as you're walkingaround, you're gonna be like,
oh, I want to go check this out,and then all of a sudden you've
missed two other talks, youknow.
Um, so that'd be my advice.

(37:26):
How about you?

SPEAKER_03 (37:28):
Um, I always have the same advice.
Uh wear comfortable shoes.
Yeah.
Uh you're gonna be doing a tonof walking, uh, stay hydrated.
Yeah.
Bring some electrolytes, youknow, bring some snacks.
For sure.
These are these are my practicaladvice for for people.
Um, it always helps to have anicebreaker.
So if you're uh, you know, youlike making stickers or you got

(37:50):
some, you know, you're hardwarehacking like SAOs, something
like that.

SPEAKER_01 (37:53):
Yeah.

SPEAKER_03 (37:53):
Anytime you can have an icebreaker to hand somebody
me, I like to carry aroundbeers, you know, just give
somebody a beer.
People appreciate that.
Uh anything like that alwayshelps if you're uh you're not
super type A, you don't want tojust go extrovert talk to
everybody.

SPEAKER_04 (38:09):
Like, yeah, it definitely helps helps that
definitely it definitely drainsthe social battery being out
there because everyone wants totalk.

SPEAKER_03 (38:16):
Yes.

SPEAKER_04 (38:17):
Yeah.
Uh and then when people find outwhat you do, they want to talk
to you more.
Yes.
And that's if you're not like alike an extrovert, if you're not
like it can be absolutelydraining.

SPEAKER_03 (38:30):
So yeah, yeah, you'll be talking to a lot of
people, and you know, you'd betalking about hacking stuff, and
they'll be like, what do youwhat do you do for a living?
Like, this.
This is what I do.
And then all of a sudden it likechanges, you know.
It's like, can we go back to theconversation about hacking
stuff?
Yeah.
Yeah.
Tell me more about that.
Yeah.
It but I mean, yeah, I just wantto hear about the cool things

(38:51):
people are doing.
Right.
Like, oh, you spent like fourmonths fuzzing registers on some
obscure device.
Like, tell me about that.
Like, I want to hear about this,you know, the the weird projects
you have going on.

SPEAKER_04 (39:00):
Yeah, I get that way.
Like it's kind of funny.
Like, I I work a lot of incidentresponse, and um people have a
big interest in that.
Like, oh, tell me, you know,blah, blah, blah.
But then on the opposite side,like when I if I know someone
else does incident response, I'mjust like, I know how that goes.
Like, I don't have to cool.

(39:21):
I get it.

SPEAKER_03 (39:21):
I don't have any questions.
Uh well, whenever you talk toother red teamers, it's kind of
funny.
I feel like they always try tokind of like vet you.

unknown (39:28):
Yeah.

SPEAKER_04 (39:29):
Like as soon as you know you manage it.
I totally, yeah, I see that.
I s and that I'm on the blueteam side of things, so like I
find it funny, but you'reabsolutely right.
Like running into other redteamers, it's it's like a what
kind of red teamer are you?

SPEAKER_03 (39:46):
Yeah, exactly.
Exactly.
Yeah, what C2 do you use?
What's your what's your favoritemethod for initial access?
Like, yeah, it's always it'salways something.

SPEAKER_04 (39:54):
Are you really a red teamer?
Yeah.
But I think that's fair.
It is fair.
That's like at at again, everyyear that I've gone, Red Team
Village has been crammed packed.
It's like the cool, like, it'swhere like when people think of
hackers, they think red team.
Like that, that is it.
So people want to be in redteam.
Like that is the space thatpeople want to get into.

(40:15):
They want to be the hacker.
Yeah.
Um, and so like there's just somany, I don't.
Not not that they're just liketag-alongs, but it's like, oh,
we hang out at Red Team Villagebecause Red Team is cool.
You know, well, you know, theywant to learn it, and that's a
good way to do it.
But I think it I think there'speople there that don't want to
learn it and they just think redteam's cool.

SPEAKER_03 (40:36):
You know, probably, yeah.
There's probably some of that.
There's probably some of that.

SPEAKER_04 (40:40):
You don't see that at Policy Village, is what I'm
saying.

SPEAKER_03 (40:43):
Everybody in Policy Village loves policy.
That is for sure.
That is for sure.
Um I didn't make it to anyPolicy Village talks this year.

SPEAKER_04 (40:52):
There was yeah, there were there were good ones.
It was it was a much nicer spacethis year, too.
Really?
Like last year we kind of gotrelegated into this corner and
it was just this kind of onesmall room.
And you might be surprised, butthere's a lot of people
interested in policy.

SPEAKER_03 (41:07):
There were people Well, you run into a lot of
people there that are like, I'min GRC, I'm a CISO, I'm not
sure.
I'm in legal.
You you run into a lot of peoplelike that at DEF CON.

SPEAKER_04 (41:16):
Well, and when I was working the door uh for one of
the talks, um I so Iunintentionally signed up to be
the door guy for a closed doortalk.
And so on that Thursday, I had abunch of people coming up, like,
oh, what's going on, you know,in this talk today.
And I'd be like, nothing foryou, come back to tomorrow, you
know.
Uh that's when we officiallyopened.

(41:37):
These are, you know, invite-onlyclosed door talks because they
talked about legitimatelyserious things that, you know,
they're playing.
Um, but I had so many guys thatwalk up and be like, oh, is
Policy Village is are theregonna be GRC talks?
And I'd be like, download hackertracker, let's go through this,
let me show you.
Like, let's go, you know, PolicyVillage, let's find some GRC

(41:58):
talks if you want to go to.
But I had more questions aboutGRC than anything else at Policy
Village.

SPEAKER_03 (42:04):
Well, a lot of people do it.
Yeah.
And it's not uh it's not thesexy stuff.

SPEAKER_04 (42:08):
No, but that's what that's what's kind of it's kind
of strange to me.
It seems to like it's blown upjust in this last year.

SPEAKER_03 (42:15):
Really?

SPEAKER_04 (42:15):
Yeah.
Uh because I don't remember, youknow, there there may have been
like a GRC talk or two.
Maybe there were more last year,and I just wasn't in them.
But like it seemed like a lot ofpeople were super interested in
the GRC stuff.
And um uh again, like I didn'thave people coming up and asking
me about like, oh, what kind ofhippie policy talks are going

(42:38):
on?
It was all like, hey, where'sthe GRC talks?
And guys were like, Oh, I workin GRC, so I want to come to
policy talks.
And it's like, well, you know,go pull them up, look for them,
see, see what's there, seewhat's interesting, bookmark it,
make sure you're there.
Yeah.
Uh so that was kind of yeah,something for everybody.

SPEAKER_03 (42:55):
Yeah, for sure.
I think for me, it'll always bethe people I meet in the
conversations that I have at twoin the morning at a bar.
That is that is kind of alwaysmy my main reason at DEF CON.
Like I ran to a guy, veryinteresting character named uh
Johnny Christmas, and he runs aconvention that goes from I

(43:16):
don't remember where he said itstarts, I think he said it ends
in Chicago.
It's like an 11-hour train ride,and they call it Hobocon, and
they do the convention on atrain and they rent out like a
full train, uh like a train car,and I guess they're trying to
rent out like a secondary carthis year, and like we talked
for like two hours about thelogistics of doing a convention
on a train.
And like, like how do you needinternet connection?

(43:38):
Like, how do you guarantee thatyou have internet connection
whenever you're in the middle ofnowhere on a train?
Like, you can't you can't justset up an antenna and pass
through the the metal barrier ofthe train very well.

SPEAKER_04 (43:46):
Yeah, you've got to have a Starlink mounted on the
Yeah, like and then is theconductor gonna be cool with
that?
Yeah, like and we And then we'regonna go through a tunnel.

SPEAKER_03 (43:53):
Yeah, and how much equipment are you?
Is it gonna clear the tunnel towheel in?
And then whenever you get offthe train, you're gonna have to
be able to to dolly that stuff.
Stuff off and figure out what todo with all your equipment when
you land in Chicago downtown.
Just all kinds of interestingthings.

SPEAKER_04 (44:07):
That's actually awesome, and I want to do that.

SPEAKER_03 (44:09):
I am going to try to go.
So I hit him up.
He actually is down to come onthe podcast.
Oh, so that'd be right.
Stay tuned for a JohnnyChristmas episode.
Really interesting character.
Yeah, I like I like him.
He's fun to talk to.
He'll be a cool podcast.

SPEAKER_04 (44:24):
That'd be really interesting.
Yeah, I would love that.
Yeah, that sounds I mean, that'sthe cool stuff.
Like yeah, DEF CON's cool.
It's massive.
There's a lot of stuff.
Everyone's there.
It's international.
But there's a lot of reallycool, just like grassroots small
conferences all over the placethat are really fun too.
So don't sleep on like small,like local conferences either.
SECON?

(44:44):
Yeah.
Come to SetCon.
SECCON, yeah, we do them inOklahoma.

SPEAKER_03 (44:47):
Coming up.
Yeah.
Coming up.
Yep.
Yeah.
No, there's some goodconferences in Oklahoma.
I mean, we've got, you know,we've got, of course, SECCON.
We're biased because, you know,we we help, we help, we help put
it on and we we volunteer a lotfor it and stuff like that.
Um, but we do uh in Oklahoma,you have Oklahoma B sides,
pretty much everywhere has a Bsides.
Yeah.
Um there's Information WarfareSummit, another really good one.

(45:08):
Uh and then there's all thesmall stuff too.
There's always the small groups,right?
We've got 2600, we've got we'vegot the DEF CON group, the DC
405.
Um so there's always there'salways something in in any space
that you're in, pretty much.
There's always gonna be yourlocal groups, and a lot of them
end up meeting up at DEF CON.

SPEAKER_04 (45:24):
Yeah, that's that's another thing that you could,
you know, if you've never beento DEF CON before, if you have
an interest in this, go findlocal groups.
Because almost guaranteedthere's a local DEF CON group or
there's some kind of localcybersecurity group, and almost
certainly people there go to DEFCON.

SPEAKER_02 (45:39):
Yep.

SPEAKER_04 (45:40):
And so you could definitely like find your people
there and then go to DEF CON.
So that's an option too.

SPEAKER_03 (45:45):
Yep.
If you're one of our uhOklahomies listening and you
want to come, uh there is anOklahoma meetup every year with
the Oklahoma Cyber Discord.
So uh just reach out to one ofus if you want to join that
Discord or Jonathan Kemet if youknow him.
Yeah.
Um, and we'll we'll get you uhinto that into that meetup next
year.
It's growing every year.

(46:06):
We have uh we're gonna we'regonna run out of tables in the
food court.

SPEAKER_04 (46:09):
Yeah, I think last year we had a pool two date
tables together, and I thinkthis year we had like four or
five tables.

SPEAKER_03 (46:14):
We had like like five or six tables together, and
then like people around andstanding around.

SPEAKER_04 (46:19):
Yeah, people had a move to actually talk to each
other.

SPEAKER_03 (46:21):
We probably had what, like 40 plus people.
Like 45.
Yeah, yeah.

SPEAKER_04 (46:26):
So I think we we doubled in size from last year
easily.
Yeah.
Just that just that Oklahomameetup.
And we had SAOs that were wewere you know handing out or
selling.
And uh I know Kimmet had a bunchof stickers that we were giving
out.
So we you know, we like to havefun too, you know.
Uh especially making connectionswith local people.
That's really important to us.

SPEAKER_03 (46:47):
Uh we travel halfway across the country, that way we
can meet up with the people wholive here.
Yeah, yeah.
Not the whole conference, butsometimes it's the only time I
see some of them, you know.
That's true.
Yeah.
So you you're gonna go back,you're gonna do it again?

SPEAKER_04 (47:00):
Uh DEF CON?
Yeah.
Uh probably.
I don't know about next year.
I think I'm okay with doing likeevery other year.
Take a year off because Vegas itis a silly place.

SPEAKER_03 (47:11):
It is a silly place.

SPEAKER_04 (47:12):
That city uh should not exist.
I don't know how it does.
Um, but you know, just have aconference there.

SPEAKER_03 (47:20):
I got a drink and a sandwich and spent$30.
I dude.

SPEAKER_04 (47:24):
I know, man.
I know.
Like you can't like even tryeven like going to the 7-Eleven,
you know, down the street, likeeverything was expensive there.
Like a bottle of water was stillfive dollars, you know, at the
7-Eleven.
So it's like Yeah.
It's uh it's an expensive place.
So be ready.
If you're going, budget for it.

SPEAKER_03 (47:46):
And feel free to bring stuff.

SPEAKER_04 (47:47):
Yeah, bring bring your own food.
Yeah, you having that uh proteinbar saved my butt that one day.

SPEAKER_03 (47:52):
So a whole bag.
Yeah.
That's a that's a a third of mybag is just like food.
Like I'm not I'm not paying$25 ameal.
Like, I mean, just bring bringprotein bars in the back.
I should definitely do betterabout that.

SPEAKER_04 (48:02):
That's one thing me and Kimmet did was we Kimmet
when got, you know, lunch meat,cheese, and bread.
Yeah.
So that uh, you know, we didn'thave to go spend thirty dollars,
forty dollars.

SPEAKER_03 (48:12):
Yeah, it's like even if you make really good money
and you it's not a problem toyou, it just almost feels
insulting paying$20 for asandwich.
It does.

SPEAKER_04 (48:21):
Yeah.

SPEAKER_03 (48:22):
It's not it's not okay.

SPEAKER_04 (48:24):
I mean, two there were two cans of, you know, the
nicotine pouches were$25 outthere.
That's absurd.
That's a$7-11.

SPEAKER_03 (48:32):
And they had the Zen vendor there.

SPEAKER_04 (48:33):
Yeah, the Zen vendor was there.

SPEAKER_03 (48:34):
Yeah, yeah.
It was$3 a can.

SPEAKER_04 (48:36):
So you've talked about vendors.
Three feet.
We never talked about vendors.
Vendors is cool this year.
Yeah, there's always some goodvendors.
The Zen vendor was there.
That was funny.
I thought I thought that'spretty good marketing.
Yeah, I mean, going to acybersecurity conference
selling, you know.
Um, anyways.

SPEAKER_03 (48:52):
Yeah, yeah, yeah.
They I'm pretty sure theycleaned up.
Yeah.
I'm pretty sure they cleaned up.

SPEAKER_04 (48:56):
I bet they did.

SPEAKER_03 (48:57):
Yep.
Yeah, there was um you got acool mesh tastic device.

SPEAKER_04 (49:01):
Yeah, I did.
Uh this was their DEF CONexclusive one.
Um, and I think it's just DEFCON exclusive because the color,
I don't, it might glow in thedark.
It's uh injected molded,injection molded instead of uh
3D printed, so it's got uh someuh waterproofing.
Yeah, okay.
And so for my for my usage whenyou know going camping and

(49:23):
stuff, um it's nice that it'sgonna be a little more rugged
than just your your traditionalold uh version.
Sneak Reaper had cool stuff asalways.
Always yeah, shout out to SneakReaper, the best vendor Solaris.
Um the Yeah, the shirts are theyhave the best shirts, Dean.

SPEAKER_03 (49:40):
They do, they do, yeah.
Yeah, good quality too.
Yeah.
You know, it's not just junk,it's always good quality.
Um the Calix or Calyx, I don'tknow how to say it, Institute.

SPEAKER_04 (49:49):
That one's really interesting to me.

SPEAKER_03 (49:51):
So they sell um prepaid SIM cards and hotspots
and things like that.
And so you can go buy a prepaidSIM card with full data plan for
$500 for a year, and there's noquestions asked.
Do you pay it in cash?
Yeah.
That is probably the best way toget an actual burner device in

(50:15):
current day and age.
Yeah.
As long as you don't come on apodcast and talk about it, talk
about it, yeah.

SPEAKER_04 (50:20):
The uh the prepaid hotspots are really cool too.
I I have an interest in that.

SPEAKER_03 (50:24):
Well, you can also just get the sim card.
So that was pretty much whatthey told me is they were like,
you know, I was like, well, I'mtrying to decide if I really
want to get, you know, the 5G orif I just want to get the
cheaper one.
Because like a$250 differencebetween like having LTE and 5G.
Um and they were like, I mean,do you have a hotspot?
And I was like, Yeah, we got ahotspot around.
And they were like, you just geta SIM card, ask 5G.
I was like, oh, cool.
Like save yourself 250 bucks andjust get a SIM card.

(50:46):
Right.
Yeah, that's a good idea.

SPEAKER_04 (50:47):
Yeah.
Did Hack5 have anything coolthis year?

SPEAKER_03 (50:50):
Um, I mean, they always have cool stuff.
I'm just, I don't know, I didn'teven really go by because I
already know everything thatthey have because you know they
they post it all online.
But no, they always make lots ofcool stuff.
I mean, you know, last year theydropped the the pineapple pager.
Pineapple pager, yeah.
I don't know if they droppedanything new this year.
Um some morons were using saidpager on an airplane.
Allegedly.
Allegedly.
Yeah.

(51:11):
Delta, was it Delta?
Mm-hmm.
Yeah, so on a Delta flight backfrom from DEF CON.
If you guys didn't hear, somepeople knocked out the Wi-Fi and
they set up a Rogue S a rogueSSID to get people to connect
to.
Yeah.
And uh they were like, I guess,allegedly harvesting credentials
or something from that.
Um, so that's stupid.

(51:32):
Don't do that.
Yeah, they thought they werebeing cool, and they're they're
really not.
Like, you're not you're notdoing anything impressive.
You're just you're just doingscript case shit.
Yeah.
Like I just nobody you're justhurting.
You're embarrassing us.
Please stop.
That's all I have to say.

SPEAKER_04 (51:51):
True.
That falls in line with the didyou see the sign that uh I can't
remember if it's the FBI or DAsplit up on the horseshoe about
stopping hackers.
Yeah.
It's like come on, guys.

SPEAKER_03 (52:04):
Yeah, that would they probably probably uh were
not aware of exactly what thisconference was.

SPEAKER_04 (52:09):
Oh, they absolutely were aware of the conference.
I absolutely they yeah, theyhave people at the conference.

SPEAKER_03 (52:14):
That's true.

SPEAKER_04 (52:15):
Like there's a lot of different things.
Yeah, but do they talk to allover the conference?

SPEAKER_03 (52:18):
Yeah, there's a lot of feds.
There's a lot of feds.

SPEAKER_02 (52:20):
Yeah.

SPEAKER_03 (52:20):
Yeah.
Yeah, we ought to have uh haveSean come on someday and talk
about the old the old DEF CONdays of uh spot the fed and the
Alexis Park days.

SPEAKER_04 (52:29):
See, that's what that's I wish I had got to
experience that because thatsounds super fun to me.

SPEAKER_03 (52:34):
Yes, yeah.
I think I am also um you know,just seeing the culture shift
over the last like you know sixyears or whatever, like seeing
that shift is is kind of likeyeah, I really wish I would have
been there to be a good thing.
Yeah, it's becoming much moremainstream.

SPEAKER_04 (52:49):
Yeah, which is under I mean, I understand why.
Disappointing maybe, but uh youknow, cybersecurity, it's a big
umbrella now, you know.
Um people are talking about iton the news more, it's not just
a movie from you know the 90s,so um I get it, but uh again,

(53:10):
that's kind of one of my pointswith like if you're gonna go to
DEF CON, go to some local, youknow, grassroots conferences
first, meet some people, kind ofget an idea of like what would
this be like if it was athousand times bigger, you know,
and kind of give you an idea ofwhat to expect from DEF CON.

SPEAKER_03 (53:29):
Yeah, and I can almost guarantee you wherever
you're at, you have a localgroup, even if you don't know
what you do.

SPEAKER_04 (53:33):
For sure.
I mean, there's conferences inSouth Dakota, dude.
Yeah, like you can find aconference, you can find a
group, you know.
If you've never been, you wantto go, go do that stuff first.

SPEAKER_03 (53:45):
There's a North Dakota DEF CON group.
Yeah.

SPEAKER_04 (53:47):
I mean, yeah, that's I mean, out in the middle of
nowhere, yeah, there you'regonna have a group.
So don't be like, ah, surelythere's you know, no one in my
area, because most certainlythere is.

SPEAKER_03 (53:55):
Yep.
Search around for it.
Yep.
Well, yeah, have you been ableto do that?
If you do go, if you do go, comefind us.

SPEAKER_04 (54:02):
Yeah.

SPEAKER_03 (54:03):
Come find us.

SPEAKER_04 (54:04):
You'll be there in some some form.
Maybe not me, but you'll bethere.
I'll certainly be there.

SPEAKER_03 (54:07):
I'm always there.

SPEAKER_04 (54:08):
Yeah.

SPEAKER_03 (54:09):
Yeah.
All right.
Well, thank you guys for uhhanging out on another episode
of the Secure AF Podcast.
If you have any comments orquestions, feel free to comment
them below.
Hit us up on LinkedIn, hit us upon Discord, whatever.
We're always happy to chat, andwe will catch you in the next
time.

SPEAKER_00 (54:23):
Bye.
The Secure AF Podcast is aproduction of Alias
Cybersecurity.
Visit us online ataliascybersecurity.com.
All rights reserved.