LosT - Welcome and Making of the Badges
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
N. N.
LosT welcomes everyone to the conference and discusses the making of the DEF CON Badges.
 So welcome DEF CON 21. Last year was DEF CON 20. This is 21. Welcome. We thought about calling it DEF CON 20 plus plus. So last year, surrounding the badges, there's always this little bit of panic here. So you guys aren't getting any audio, are you? So this is me saying basically this is my empty lanyard. This was Wednesday afternoon last year right before the conference started and me holding up the lanyards and saying, yeah, where's my badges? Where are they? That's the kind of stress and panic that usually surrounds the creation process with the DEF CON badges. We try and keep pretty tight security because every year we have people that try and figure out where we're going to fabricate. We've had people contact the PCB fab houses that we've used before and actually social engineered them into making a set of badges for themselves, pre-CON. We've had people contact the PCB houses post-CON and get Uber badges fabricated. So it's been quite an adventure trying to maintain security just around the badges themselves and with a security conference it's kind of, you know, it's not really malicious per se. It's more of a trophy and a demonstration of skill. But it's fun stuff. So this year I've had quite a few discussions with Jeff, dark tangent. For those of you who are not familiar with some of the traditions and things surrounding DEF CON, how many of you have been to DEF CON for more than five years? So the noobs out number the seasoned vets here by quite a number based on the hands that you guys have been raising. So one of the things that you'll notice with the DEF CON iconography is we've traditionally had a series of three what I call PIPs associated with us which are the rotary dial. Those of you in high school you know what that is, right? So if you see the goon badge is the rotary dial actually is a brass knuckle. So hello. So the rotary, are you getting this? It sounds like when I talk it cuts out. The rotary dial was part of our culture because back in the day when we didn't have yield internets we were all using BBS and phone lines and as a poor kid on a Commodore 64 with a 300-baud modem the only way you could connect to anybody else was to dial up. And so it suddenly became valuable to get these sprint and MCI codes to be able to reach out and touch your friends on Fido net and all these other BBSs. So it became a really big part of hacker culture to be able to get free long distance. The smiley face with the skull and crossbones has become kind of ubiquitous with DEF CON as well and kind of our traditional symbol kind of ties into the whole piracy security aspect. And then of course the floppy disk and again all you high school guys out there you know what that is, right? And then it's a later cousin, the click, click, click, click disk. Oh wait, I mean zip disk. You guys don't remember those, right? How many of you have a pile of somewhere in like a back closet? Anybody still using one? I'm sorry. So I talked to ‑‑ I was talking to Jeff and I said we've got these symbols that are on our lanyards, on our programs, on everything and half of them haven't really kept up with the time. It's more just a tradition. We need a fourth. We need to round out the trifecta here. And so I asked Jeff's permission to introduce a new symbol that will become part of the DEF CON iconography. And I did this pre‑all of the Snowden garbage that's going on right now which is really scary that it happened on the timing. And so I've introduced the keyhole. Now when I went to Jeff with the keyhole I said I think it's timeless. And it fits in several different aspects of our hacker culture. I said first of all we've got physical security. We do the lock picking stuff. The lock is indicative of that. Locks and keys and keyholes are also usually represented to represent cryptography. So I think that we've got the crypto aspect. And I said there are also surreptitious observation a lot of times peeking through the keyhole, listening at the keyhole. A lot of mystery novels you'll see will have the magnifying glass and then a keyhole and the guy up there or you'll see the eyeball peeking through. So I thought that it was appropriate to introduce. And so from this point forward when we do all of our designs and everything else instead of the three circle symbols we will have the fourth. So you guys are really quiet. So another tradition that I'm going to break. Oh, side tangent. So I kind of pictured this year as you know those magicians famous secrets revealed where the dude wore the stupid hockey mask and told how all the magic tricks were done on like a cable show. And he did that so the same magicians couldn't keep reusing the old crap over and over again. This year with this breaking of traditions was kind of my foray into, okay, I've been doing a lot of this stuff for many, many years for DEF CON now. But my personal challenge is to try and best myself every year with badge design, crypto, game design and all the things that I touch. And one of the ways I'm motivating myself to do some really good things moving forward is to do this is kind of my DEF CON's greatest secrets revealed so that I can't keep pulling the same old stuff out and keep retreading because I think it's a cop out. So one of the things that we also never do every year is we always hold the Uber badge and information regarding the Uber badge back until the last day of the conference on Sunday when they're awarded. How many of you have no concept of what the Uber badge is at DEF CON? Okay, so when you attend DEF CON, you get badges that basically say I paid for the conference. They say what level you are and you'll hear us say human and inhuman. That's because the general attendance or general populace are referred to as humans and everyone else are inhumans. That would be vendors, the press, the speakers, I'm getting there with the press, just wait. And so you have the human and inhuman but you also have a very special badge every year that is known as the Uber badge. Now we like DEF CON to be a very interactive conference. It's a put up or shut up place. It's like everybody talks about a big game. Everybody is hacked to gibson. Everyone has trained with Bruce Lee that does martial arts. So we like to have audience participation. We have more contests than I believe any conference. Some of them are incredibly difficult and challenging. Some are just for fun. And you'll see them going on as we go. You may have noticed some of the crypto that's involved on the graphics on the floor out and in the program and in your lanyards. So if you come to DEF CON and you compete in what we call a black badge competition, which means a competition that warrants enough effort and skill, you are awarded a black Uber badge. And that is free entrance into DEF CON for the rest of your life. To give you an idea how rare they are, last year we had roughly 15,000 people attend and we gave out about 15 Uber badges. So it's a very elite club to have a black Uber badge. It's more bragging rights in the community than anything. But it's kind of a token of appreciation for people who share or demonstrate skill. But the Uber badge, because it's awarded at the end of the conference, usually don't get to see them or know anything about them until Sunday at the closing ceremonies. And you'll see people that have Uber badges will often wear them from that point forward. So you'll see some folks that have badges that look like they don't match within the theme of a year. That's probably an Uber badge from previous years. Excuse me, I'm going to grab some water. So breaking with another tradition, I said, hey, Jeff, I want to show the Uber badge on Thursday. He's like, man, what are you doing to me, Ryan? You're adding key holes. You're going to want to show the Uber badge. You didn't dye your hair this year. You're not wearing a hat. You know, he's like, the world is changing, I guess. So if you've noticed on your map, there is a room listed as 1057. That is the room that I will be in and I will have Uber badges on display for people to handle and look at. And we'll get more into what they are later on. Before I move forward in that, the final interest ‑‑ I'm getting feedback here. So the last thing that I asked Jeff, and this is a doozy and I just thought, man, there's no way in hell he's going to go for this. So those of you who came here expecting an electronic badge this year, this is kind of my ‑‑ it's electronic but not electronic. I wanted to do a tick‑tock cycle on badge design where I do a year electronic and a year non‑electronic. So this one is kind of faux electronic in some ways. It is a PCB. But the reason I want to do that is it becomes passe. You go to other conferences now and everybody's got a damn electronic badge. We started with the Blinky LEDs and we moved up from there all the way to last year where we had a processor with 832 bit cores on a single die with a propeller chip. So I don't want it to get people come expecting, oh, where's my electronic badge? Because for my competitions, if you know what to expect, it gives you an unfair advantage to those who are new. And ironically, the year that I did the titanium badges that were non‑electronic, I had far greater participation by the attendees in the competition than I did last year with the electronic badges. And I asked people that and it appears as though people just don't want to mess with the electronics at the conference. It's a very small subset, about 10 percent. Because if you're not familiar with an architecture or the language or the tool chain for a new chip, you don't want to come to DEF CON and use up your three days here, you know, sitting at a laptop trying to figure that out. So I went to DEF CON and said, you know, one of the really iconic parts of DEF CON is the badge. And we keep it secret every single year until the conference starts. And I go, I want to tell them about DEF CON 22's badge at DEF CON 21 so that they have a year to prepare. And he didn't get back to me for a while. He said he had to think about it. And he said, you know what, let's give them partial information. Let's give them a little bit of information because next year's badge will be an electronic badge. The games will be every bit as intense as they are this year and as they were last year and the year before. But we want people to be able to get exposure to the tool chain and the chip and the architecture. So we're also going to release a monthly blog that's kind of a mini how to on how to develop or program for those of you who are just straight coders for what the badge will be next year. We won't give you the details and specs on what it does. I had prepared to announce what that architecture was today. However, I was told and it was actually pretty exciting because it's a processor that is not yet released. And I was going to be able to say, hey, we're going to be one of the first groups to get our hands on this new architecture. I've just been told that based on their last engineering run, they're not quite sure they will be able to deliver chips to me in time to get next year's badge produced. That being said, I've got to wait to tell you what that architecture is because if they can't get me that architecture before next year, then obviously I can't do it. So I can neither confirm nor deny that. So I've actually kind of set a deadline that by December this year, if that information hasn't been really ‑‑ if they haven't told me that they can source that chip for me by December, then I'm just going to pick a different architecture. And I can tell you that my fallback architecture will most likely be an MSP430 or something in that series from TI. So anyway, secret information, you're already seeing where it's kind of like my dock dump you guys have hacked into my system and you're getting all my secrets and my information. So I'm going to have to go back and rethink my security cycle like us. So here on the screen you'll see some of the CAD work that was done for the Uber badge this year. And I normally use Altium for my design stuff, for those of you who are familiar with the tool chain. But I wanted to use software that would be able to be accessible for free to everyone. So all of the badges this year were actually designed on the free version of Eagle. And for those of you who do design work, that you know that's like Simon your nuts in a door over and over again. It wasn't fun. And I found some really cool errors in Eagle. Like there's an error that comes up occasionally. This says too many pixels in the Y direction. What the hell does that mean? It's like a PC load letter. And being a hacker, and oh, and it was also in German underneath. So being a hacker, I took obviously my work and I rotated it because I wanted to see if there was too many pixels in the opposite direction. There's not. I still don't know why I got that error because I couldn't reproduce it just by. Because then of course you start reducing at a time to find out where that extreme is, right? So this year's badge, the Uber badge specifically, is an homage to my grandfather. My grandfather was a watchmaker. He told me that when he was in watchmaking school they would basically can them raw metal stock and they had to make a watch. That included making the screws, the springs, the case, everything. Since this is something I just started doing since last DEF CON, I didn't have that level of skill or the equipment to do that. So I ordered some of the parts preassembled but then assembled those parts for those of you familiar with watchmaking. I couldn't possibly do the hair spring to the balance wheel myself. So those came assembled. But when you, if you look at the graphic that's on the bottom there, most mechanical watch movements only have five main components. And I had this whole cool spiel prepared to show how we could map security and hacking as a, and using the watch to move that forward. But then I decided I can't share that with you yet because it will ruin some of the badge challenge that is happening this year. But if you go across the bottom, you've got basically a main spring and then your gears to transfer the energy from the main string, then you've got your balance wheel and your escapement which control how that energy is released. So that's kind of like your firewall. And then at the end, the five and a six are displayed to show you the time. So all of the glass that's on the Uber badge is an actual, they're actual watch crystals on them on the front and the back. I don't know, can you hear this? So it's really hard to sleep when you have 30 of these ticking in your room. And I'm getting to the point now where I've just started blocking the noise out because I've been working on these for so many months. I just tick, tick, tick, tick, tick all the time. So there's some of the movements out with the PCB on top. I'm one of my guests. Thank you. It's somebody, Claude. Yeah, they were just a little bit of work. So all of them were hand assembled by myself for the Ubers. And that's why I can only do the Ubers like this because there's no way I could possibly get 15,000 badges done for all you guys. Sorry. There's a few more pictures and I'm going to leave that one up there for a minute in case anybody is participating in the badge challenge because I thought they might want to get a picture of the code that's on the back there. Geez, you guys are quiet. This is DEF CON. You know, the people that are new here, you're supposed to make noise and yell at me and throw things. Yeah, thank you. This is not blackhead. I mean, this is not an infomercial or a trade show. What's that? Are you done? No? Yes, ten seconds. Yes, I can't, I can't, but anything can go wrong. I'm not so up to By the way, the copper that's underneath the solder mass doesn't quite show up in the picture. Just FYI. Some of you may have noticed that on your own badges. There's some ‑‑ we'll get to that in a minute. So one of the other things we did this year, more variations on the badge than ever. So up until the time I started doing the badge design, we always did here's your human badge, here's your press badge, here's your speaker badge, and there was only one human badge. So I started because I'm a masochist, I guess, doing multiple human variant designs to give you guys some variety and flavor, and it gave me more of a palette space for the crypto challenges that I was creating for you guys. So this year, there are more ‑‑ I won't tell you how many because that's part of the game is for you to figure that out. There are more human variations than we have ever had. In addition to that, there's us doing some of the sorting of badges to make sure that when we distribute them. There was a mixture because one year last year, actually, we ‑‑ the registration desk, we're taking the boxes as they came in, and of course, even though there were multiple designs, they came grouped together. So all of a particular badge were going out like on Thursday and all on Friday, and it prevented people from moving forward in the game because they couldn't find the other variant. So we actually hand mixed up all of the badges this year. Yeah. So like I mentioned before, we have these things we call non‑human badges. You will notice that all of the non‑human badges this year are in fact face cards with the exception of one. That would be the press badge. The press badge is a deuce. And for the slow kids in the audience, that is my fuck you to the press. So, we have a badge. Oh, deuce, I get it. It's spelled differently. So the one on your left is the vendor badge. That's why he has the Bitcoin. The one in the middle, you have to kind of figure it out, but the base behind him is a G and L base. So I added two new card types because no poker game would be complete without the ability to get the hack hand. So I introduced the hacker card and the crypto card in place of the two jokers. So now if you get the hacker, the crypto and ace and a king, you have the hack hand in your playing hand. So the intent there was to add some variation to other card games and things like that. By the way, those of you who have purchased some of those decks, they came with two hackers in them because they did a misprint because everything I do seems to get screwed up in production somehow. We actually got the crypto cards printed and overnighted and we have them. I'm going to have them in my 1057 room. So if you bought one of those decks, bring it in there, show me the deck and I will give you one of those crypto cards. So there's your hack hand. So, yeah, limited number. I think we made like 2000 or something like that. So there's not very many. In fact, if you guys like them, we may just do a blank run for next year or whatever. So, big things in store for next year. So I've already been talking with Neil and we've been talking with DT. We think we've got a theme picked out. I won't release what the theme is, but I was very excited that Jeff actually gave me permission to tell you guys that we're going to release information about the badges and it feels kind of wrong and kind of dirty to be breaking tradition like that that we've been doing this for so long. But I also think it's time to move forward on some things. And just like in the security field, if we don't continue to innovate and move forward, we'll stagnate. And I think that's starting to happen in some areas. So I really think we need to push the envelope and I hope that's what we do here at DEF CON and I hope that's what all of you do when you go back to your respective schools and places of business. So, thanks. People are finally clapping. Yeah, come on. Innovate. Aren't you going to start a shit being broken? Come on. So if you take a look at your badges, some of them, not very many, but some of them are four-layer boards, not two. And I won't tell you which ones they are. But they are, the ones generally, the general populous badges are a two-layer PCB with exposed copper and a solder mask. And we're designed in EGLE. The artwork could be done as vector art in free program like Inkscape. So technically the entire process of fabricating your own creation, which is what I'm hoping to inspire you to do, those of you who've never even thought of it, you can go download free tools and basically crank out a circuit board like the one you have around your neck. A circuit board, which is what they are. They're printed circuit boards, PCBs. Maybe. There may be other things. It's copper. You can solder to it. Just because it doesn't look like a pad doesn't mean it might not be. So anyway, you guys like them? You enjoy the badges this year? You guys make the cotton for me. You do. I put a crap ton of work into the stuff that I do. It's a unique challenge to design cryptography puzzles that are designed to be broken with the temporal space of about three days. Four smart people like you because you're all smarter than I am. And you are. I'm just like this retard in my closet with a soldering iron and coating. And I slap stupid crap together and I come here to DEF CON and I barf it out onto you guys and you actually solve this stupid crap that I put out there every year. And I'm amazed every single year somebody solves a piece of the puzzle in a way that I had not even thought of. And that's why this is a hack hunt. That's why these are my people. That's why I can come here and do stupid crap like that and not have to justify myself. This is my one time a year ‑‑ This is my one time a year I can go in a large group like this and not feel like that odd duck or like I have to explain my t-shirt or I have to explain why I did what I did. And I hope you all feel that way too. And for you guys that are new to DEF CON, everything that I do in these contests is designed to make you interact with each other because I know most of us tend to be introverted based on personality types that gravitate towards certain fields. And I have a background in mathematics. I'm not ‑‑ you know, I'm used to looking at my own shoes. I encourage you to talk to each other. You have an ice breaker around your neck. You have an excuse to say I haven't seen that bad yet. Can I see that? In order to see that, you have to be close to someone you have to interact. I encourage you to do that. I also encourage you to do that because it makes solving the puzzles easier. And it's actually impossible to solve the puzzles this year without looking at other people's badges. The same thing was true last year and the year before that. Because to me, the most important thing that comes out of DEF CON are the relationships that are built here that then produce other fruits that might not otherwise be out in the world because I think there's too much wrong with what's going on. There's too much wrong in security. We've seen a lot of bad stuff coming out in the news lately. And you all understand, we're odd. We're the odd folks in this ‑‑ if you go out and you think about the average IQ of somebody on the planet, it's kind of frightening. So anyway, I'm glad you're all here. Welcome to DEF CON 21. You're going to have to be more lively than this for your other speakers. This is just the opening ceremonies. But the speakers here enjoy it. You'll have speakers up here that will be drinking while they present. They're going to want to talk to you. And if somebody starts talking bullshit in one of their speeches, call them on it. That's why we're here at DEF CON. Okay? So welcome. Have a great time. Applause Do I release the hounds now? What do I do? You guys want to hear the TSA security story? So I hand carried the Ubers in several of the badges and I had them in a box wrapped up in duct tape shut with black duct tape. Probably not the best choice. And I took it in my carry‑on because I was like, there's no way in hell that I'm going to check this because this is real glass. These will break. So I checked the box. It's going through the X‑ray machine and the lady is looking at me. And she looks at the screen. She looks back at me and I see her eye kind of raised. And she looks back at the screen and then they do the whole thing. Call someone else over. According to Bruce, the security theater began. Curtain rose and X‑1 started. So the TSA had another gal come over and look at the screen and of course then they pull it out the other side of the X‑ray. Sir, is this your bag? Yes, it is. Would you mind ‑‑ because it was in a box inside of my carry‑on. So she goes, I'm going to take it out and I was like, go ahead, please be careful. It's fragile. So don't ever tell TSA something is fragile. Because they take that to mean explosive, I guess. I don't know. So they open up my bag and once you open the bag, then you can start to hear the ticking noise that's going on. TSA doesn't like little boxes wrapped in black duct tape that tick. That show up with extreme amounts of metal in the X‑ray. Not good. Especially when there's a big fucking skull on it. It was fun and I'm glad I made my flight. How's that? Consequently, that's not the first time this has happened to me coming to DEF CON. I've had the mystery boxes declared as bombs at least four separate times. Coming to DEF CON. And we've had hotel security here as people competing in the mystery college. Carrying these metal boxes with mercury tilt sensors on them. So they're balancing them very precariously. Because if they tilt them, the box begins to go, wail, wail, wail, because I'm a jerk. I'll give you this one and then I'll let you go. I had these thick steel boxes that were made out of a tube. And they had locks on the top and bottom. And I put the switch inside so they couldn't tilt the box. But they had to pick the bottom lock first. So they've got these big‑ass heavy boxes that they can't tilt and they have to go up through the bottom. So you've got people holding these boxes that weigh like 50 pounds over the head of some guy who's underneath trying to pick the lock from the underside. And so here's security walks by and here's these guys like ‑‑ holding the box and you've got these guys on the ground. And there were blinking lines on the outside. Looked like a bomb. So anyway, yeah, those are the kinds of stories that I will never forget about DEF CON. Anyway, thank you very much. Have a great conference. Thank you.
 So welcome DEF CON 21. Last year was DEF CON 20. This is 21. Welcome. We thought about calling  it DEF CON 20 plus plus. So last year, surrounding the badges, there's always this little bit  of panic here. So you guys aren't getting any audio, are you? So this is me saying basically  this is my empty lanyard. This was Wednesday afternoon last year right before the conference  started and me holding up the lanyards and saying, yeah, where's my badges? Where are  they? That's the kind of stress and panic that usually surrounds the creation process  with the DEF CON badges. We try and keep pretty tight security because every year we have  people that try and figure out where we're going to fabricate. We've had people contact  the PCB fab houses that we've used before and actually social engineered them into making  a set of badges for themselves, pre-CON. We've had people contact the PCB houses post-CON  and get Uber badges fabricated. So it's been quite an adventure trying to maintain security  just around the badges themselves and with a security conference it's kind of, you know,  it's not really malicious per se. It's more of a trophy and a demonstration of skill.  But it's fun stuff. So this year I've had quite a few discussions with Jeff, dark tangent.  For those of you who are not familiar with some of the traditions and things surrounding  DEF CON, how many of you have been to DEF CON for more than five years? So the noobs out  number the seasoned vets here by quite a number based on the hands that you guys have been  raising. So one of the things that you'll notice with the DEF CON iconography is we've  traditionally had a series of three what I call PIPs associated with us which are the  rotary dial. Those of you in high school you know what that is, right? So if you see the  goon badge is the rotary dial actually is a brass knuckle. So hello. So the rotary,  are you getting this? It sounds like when I talk it cuts out. The rotary dial was part  of our culture because back in the day when we didn't have yield internets we were all  using BBS and phone lines and as a poor kid on a Commodore 64 with a 300-baud modem the  only way you could connect to anybody else was to dial up. And so it suddenly became  valuable to get these sprint and MCI codes to be able to reach out and touch your friends  on Fido net and all these other BBSs. So it became a really big part of hacker culture  to be able to get free long distance. The smiley face with the skull and crossbones  has become kind of ubiquitous with DEF CON as well and kind of our traditional symbol  kind of ties into the whole piracy security aspect. And then of course the floppy disk  and again all you high school guys out there you know what that is, right? And then it's  a later cousin, the click, click, click, click disk. Oh wait, I mean zip disk. You guys  don't remember those, right? How many of you have a pile of somewhere in like a back closet?  Anybody still using one? I'm sorry. So I talked to ‑‑ I was talking to Jeff and  I said we've got these symbols that are on our lanyards, on our programs, on everything  and half of them haven't really kept up with the time. It's more just a tradition. We need  a fourth. We need to round out the trifecta here. And so I asked Jeff's permission to  introduce a new symbol that will become part of the DEF CON iconography. And I did this  pre‑all of the Snowden garbage that's going on right now which is really scary that it  happened on the timing. And so I've introduced the keyhole. Now when I went to Jeff with  the keyhole I said I think it's timeless. And it fits in several different aspects of  our hacker culture. I said first of all we've got physical security. We do the lock picking  stuff. The lock is indicative of that. Locks and keys and keyholes are also usually represented  to represent cryptography. So I think that we've got the crypto aspect. And I said there  are also surreptitious observation a lot of times peeking through the keyhole, listening  at the keyhole. A lot of mystery novels you'll see will have the magnifying glass and then  a keyhole and the guy up there or you'll see the eyeball peeking through. So I thought  that it was appropriate to introduce. And so from this point forward when we do all of  our designs and everything else instead of the three circle symbols we will have the  fourth. So you guys are really quiet.  So another tradition that I'm going to break. Oh, side tangent. So I kind of pictured this  year as you know those magicians famous secrets revealed where the dude wore the stupid hockey  mask and told how all the magic tricks were done on like a cable show. And he did that  so the same magicians couldn't keep reusing the old crap over and over again. This year  with this breaking of traditions was kind of my foray into, okay, I've been doing a  lot of this stuff for many, many years for DEF CON now. But my personal challenge is  to try and best myself every year with badge design, crypto, game design and all the things  that I touch. And one of the ways I'm motivating myself to do some really good things moving  forward is to do this is kind of my DEF CON's greatest secrets revealed so that I can't  keep pulling the same old stuff out and keep retreading because I think it's a cop out.  So one of the things that we also never do every year is we always hold the Uber badge  and information regarding the Uber badge back until the last day of the conference on Sunday  when they're awarded. How many of you have no concept of what the Uber badge is at DEF CON?  Okay, so when you attend DEF CON, you get badges that basically say I paid for the conference.  They say what level you are and you'll hear us say human and inhuman. That's because the  general attendance or general populace are referred to as humans and everyone else are  inhumans. That would be vendors, the press, the speakers, I'm getting there with the  press, just wait. And so you have the human and inhuman but you also have a very special  badge every year that is known as the Uber badge. Now we like DEF CON to be a very interactive  conference. It's a put up or shut up place. It's like everybody talks about a big game.  Everybody is hacked to gibson. Everyone has trained with Bruce Lee that does martial arts.  So we like to have audience participation. We have more contests than I believe any conference.  Some of them are incredibly difficult and challenging. Some are just for fun. And you'll  see them going on as we go. You may have noticed some of the crypto that's involved on the  graphics on the floor out and in the program and in your lanyards. So if you come to DEF  CON and you compete in what we call a black badge competition, which means a competition  that warrants enough effort and skill, you are awarded a black Uber badge. And that is  free entrance into DEF CON for the rest of your life. To give you an idea how rare they  are, last year we had roughly 15,000 people attend and we gave out about 15 Uber badges.  So it's a very elite club to have a black Uber badge. It's more bragging rights in the  community than anything. But it's kind of a token of appreciation for people who share  or demonstrate skill. But the Uber badge, because it's awarded at the end of the conference,  usually don't get to see them or know anything about them until Sunday at the closing ceremonies.  And you'll see people that have Uber badges will often wear them from that point forward.  So you'll see some folks that have badges that look like they don't match within the  theme of a year. That's probably an Uber badge from previous years. Excuse me, I'm  going to grab some water. So breaking with another tradition, I said, hey, Jeff, I want  to show the Uber badge on Thursday. He's like, man, what are you doing to me, Ryan? You're  adding key holes. You're going to want to show the Uber badge. You didn't dye your hair this  year. You're not wearing a hat. You know, he's like, the world is changing, I guess.  So if you've noticed on your map, there is a room listed as 1057. That is the room that  I will be in and I will have Uber badges on display for people to handle and look at.  And we'll get more into what they are later on. Before I move forward in that, the final  interest ‑‑ I'm getting feedback here. So the last thing that I asked Jeff, and this  is a doozy and I just thought, man, there's no way in hell he's going to go for this.  So those of you who came here expecting an electronic badge this year, this is kind of  my ‑‑ it's electronic but not electronic. I wanted to do a tick‑tock cycle on badge  design where I do a year electronic and a year non‑electronic. So this one is kind  of faux electronic in some ways. It is a PCB. But the reason I want to do that is it becomes  passe. You go to other conferences now and everybody's got a damn electronic badge. We  started with the Blinky LEDs and we moved up from there all the way to last year where  we had a processor with 832 bit cores on a single die with a propeller chip. So I don't  want it to get people come expecting, oh, where's my electronic badge? Because for my  competitions, if you know what to expect, it gives you an unfair advantage to those  who are new. And ironically, the year that I did the titanium badges that were non‑electronic,  I had far greater participation by the attendees in the competition than I did last year with  the electronic badges. And I asked people that and it appears as though people just don't  want to mess with the electronics at the conference. It's a very small subset, about 10 percent.  Because if you're not familiar with an architecture or the language or the tool chain for a new  chip, you don't want to come to DEF CON and use up your three days here, you know, sitting  at a laptop trying to figure that out. So I went to DEF CON and said, you know, one  of the really iconic parts of DEF CON is the badge. And we keep it secret every single  year until the conference starts. And I go, I want to tell them about DEF CON 22's badge  at DEF CON 21 so that they have a year to prepare. And he didn't get back to me for  a while. He said he had to think about it. And he said, you know what, let's give them  partial information. Let's give them a little bit of information because next year's badge  will be an electronic badge. The games will be every bit as intense as they are this year  and as they were last year and the year before. But we want people to be able to get exposure  to the tool chain and the chip and the architecture. So we're also going to release a monthly blog  that's kind of a mini how to on how to develop or program for those of you who are just straight  coders for what the badge will be next year. We won't give you the details and specs on  what it does. I had prepared to announce what that architecture was today. However, I was  told and it was actually pretty exciting because it's a processor that is not yet released.  And I was going to be able to say, hey, we're going to be one of the first groups to get  our hands on this new architecture. I've just been told that based on their last engineering  run, they're not quite sure they will be able to deliver chips to me in time to get next  year's badge produced. That being said, I've got to wait to tell you what that architecture  is because if they can't get me that architecture before next year, then obviously I can't do  it. So I can neither confirm nor deny that. So I've actually kind of set a deadline that  by December this year, if that information hasn't been really ‑‑ if they haven't  told me that they can source that chip for me by December, then I'm just going to pick  a different architecture. And I can tell you that my fallback architecture will most likely  be an MSP430 or something in that series from TI. So anyway, secret information, you're  already seeing where it's kind of like my dock dump you guys have hacked into my system  and you're getting all my secrets and my information. So I'm going to have to go back and rethink  my security cycle like us. So here on the screen you'll see some of the CAD work that  was done for the Uber badge this year. And I normally use Altium for my design stuff,  for those of you who are familiar with the tool chain. But I wanted to use software that  would be able to be accessible for free to everyone. So all of the badges this year were  actually designed on the free version of Eagle. And for those of you who do design work, that  you know that's like Simon your nuts in a door over and over again. It wasn't fun. And  I found some really cool errors in Eagle. Like there's an error that comes up occasionally.  This says too many pixels in the Y direction. What the hell does that mean? It's like a  PC load letter. And being a hacker, and oh, and it was also in German underneath. So being  a hacker, I took obviously my work and I rotated it because I wanted to see if there was too  many pixels in the opposite direction. There's not. I still don't know why I got that error  because I couldn't reproduce it just by. Because then of course you start reducing at a time  to find out where that extreme is, right? So this year's badge, the Uber badge specifically,  is an homage to my grandfather. My grandfather was a watchmaker. He told me that when he  was in watchmaking school they would basically can them raw metal stock and they had to make  a watch. That included making the screws, the springs, the case, everything. Since this  is something I just started doing since last DEF CON, I didn't have that level of skill  or the equipment to do that. So I ordered some of the parts preassembled but then assembled  those parts for those of you familiar with watchmaking. I couldn't possibly do the hair  spring to the balance wheel myself. So those came assembled. But when you, if you look  at the graphic that's on the bottom there, most mechanical watch movements only have  five main components. And I had this whole cool spiel prepared to show how we could map  security and hacking as a, and using the watch to move that forward. But then I decided I  can't share that with you yet because it will ruin some of the badge challenge that is happening  this year. But if you go across the bottom, you've got basically a main spring and then  your gears to transfer the energy from the main string, then you've got your balance  wheel and your escapement which control how that energy is released. So that's kind of  like your firewall. And then at the end, the five and a six are displayed to show you the  time. So all of the glass that's on the Uber badge is an actual, they're actual watch  crystals on them on the front and the back. I don't know, can you hear this? So it's  really hard to sleep when you have 30 of these ticking in your room. And I'm getting to the  point now where I've just started blocking the noise out because I've been working on  these for so many months. I just tick, tick, tick, tick, tick all the time. So there's  some of the movements out with the PCB on top. I'm one of my guests. Thank you. It's  somebody, Claude. Yeah, they were just a little bit of work. So all of them were hand  assembled by myself for the Ubers. And that's why I can only do the Ubers like this because  there's no way I could possibly get 15,000 badges done for all you guys. Sorry.  There's a few more pictures and I'm going to leave that one up there for a minute in  case anybody is participating in the badge challenge because I thought they might want  to get a picture of the code that's on the back there.  Geez, you guys are quiet. This is DEF CON. You know, the people that are new here, you're  supposed to make noise and yell at me and throw things. Yeah, thank you. This is not  blackhead. I mean, this is not an infomercial or a trade show. What's that? Are you done?  No? Yes, ten seconds. Yes, I can't, I can't, but anything can go wrong. I'm not so up to  By the way, the copper that's underneath the solder mass doesn't quite show up in the picture.  Just FYI. Some of you may have noticed that on your  own badges. There's some ‑‑ we'll get to that in a minute.  So one of the other things we did this year, more variations on the badge than ever. So  up until the time I started doing the badge design, we always did here's your human badge,  here's your press badge, here's your speaker badge, and there was only one human badge.  So I started because I'm a masochist, I guess, doing multiple human variant designs to give  you guys some variety and flavor, and it gave me more of a palette space for the crypto  challenges that I was creating for you guys. So this year, there are more ‑‑ I won't  tell you how many because that's part of the game is for you to figure that out. There  are more human variations than we have ever had. In addition to that, there's us doing  some of the sorting of badges to make sure that when we distribute them.  There was a mixture because one year last year, actually, we ‑‑ the registration  desk, we're taking the boxes as they came in, and of course, even though there were  multiple designs, they came grouped together. So all of a particular badge were going out  like on Thursday and all on Friday, and it prevented people from moving forward in the  game because they couldn't find the other variant. So we actually hand mixed up all  of the badges this year. Yeah.  So like I mentioned before, we have these things we call non‑human badges. You will  notice that all of the non‑human badges this year are in fact face cards with the exception  of one. That would be the press badge. The press badge is a deuce. And for the slow kids in the audience, that is my fuck you to the press. So, we have a  badge. Oh, deuce, I get it. It's spelled differently. So the one on your left is the vendor badge.  That's why he has the Bitcoin. The one in the middle, you have to kind of figure it out,  but the base behind him is a G and L base. So I added two new card types because no poker  game would be complete without the ability to get the hack hand. So I introduced the  hacker card and the crypto card in place of the two jokers. So now if you get the hacker,  the crypto and ace and a king, you have the hack hand in your playing hand. So the intent  there was to add some variation to other card games and things like that. By the way, those  of you who have purchased some of those decks, they came with two hackers in them because  they did a misprint because everything I do seems to get screwed up in production somehow.  We actually got the crypto cards printed and overnighted and we have them. I'm going to  have them in my 1057 room. So if you bought one of those decks, bring it in there, show  me the deck and I will give you one of those crypto cards. So there's your hack hand.  So, yeah, limited number. I think we made like 2000 or something like that. So there's not  very many. In fact, if you guys like them, we may just do a blank run for next year or  whatever. So, big things in store for next year. So I've already been talking with Neil  and we've been talking with DT. We think we've got a theme picked out. I won't release what  the theme is, but I was very excited that Jeff actually gave me permission to tell you  guys that we're going to release information about the badges and it feels kind of wrong  and kind of dirty to be breaking tradition like that that we've been doing this for so  long. But I also think it's time to move forward on some things. And just like in the security  field, if we don't continue to innovate and move forward, we'll stagnate. And I think that's  starting to happen in some areas. So I really think we need to push the envelope and I hope  that's what we do here at DEF CON and I hope that's what all of you do when you go back  to your respective schools and places of business. So, thanks. People are finally clapping. Yeah,  come on. Innovate. Aren't you going to start a shit being broken? Come on. So if you take a look  at your badges, some of them, not very many, but some of them are four-layer boards, not two. And  I won't tell you which ones they are. But they are, the ones generally, the general populous  badges are a two-layer PCB with exposed copper and a solder mask. And we're designed in EGLE. The  artwork could be done as vector art in free program like Inkscape. So technically the  entire process of fabricating your own creation, which is what I'm hoping to inspire you to do,  those of you who've never even thought of it, you can go download free tools and basically crank  out a circuit board like the one you have around your neck. A circuit board, which is what they  are. They're printed circuit boards, PCBs. Maybe. There may be other things. It's copper. You  can solder to it. Just because it doesn't look like a pad doesn't mean it might not be. So  anyway, you guys like them? You enjoy the badges this year? You guys make the cotton for me. You  do. I put a crap ton of work into the stuff that I do. It's a unique challenge to design  cryptography puzzles that are designed to be broken with the temporal space of about three  days. Four smart people like you because you're all smarter than I am. And you are. I'm just  like this retard in my closet with a soldering iron and coating. And I slap stupid crap together  and I come here to DEF CON and I barf it out onto you guys and you actually solve this  stupid crap that I put out there every year. And I'm amazed every single year somebody  solves a piece of the puzzle in a way that I had not even thought of. And that's why this is a  hack hunt. That's why these are my people. That's why I can come here and do stupid crap like  that and not have to justify myself. This is my one time a year ‑‑  This is my one time a year I can go in a large group like this and not feel like that odd duck  or like I have to explain my t-shirt or I have to explain why I did what I did. And I hope you  all feel that way too. And for you guys that are new to DEF CON, everything that I do in these  contests is designed to make you interact with each other because I know most of us tend to be  introverted based on personality types that gravitate towards certain fields. And I have a  background in mathematics. I'm not ‑‑ you know, I'm used to looking at my own shoes. I  encourage you to talk to each other. You have an ice breaker around your neck. You have an excuse to  say I haven't seen that bad yet. Can I see that? In order to see that, you have to be close to  someone you have to interact. I encourage you to do that. I also encourage you to do that because  it makes solving the puzzles easier. And it's actually impossible to solve the puzzles this year  without looking at other people's badges. The same thing was true last year and the year before  that. Because to me, the most important thing that comes out of DEF CON are the relationships  that are built here that then produce other fruits that might not otherwise be out in the world  because I think there's too much wrong with what's going on. There's too much wrong in security.  We've seen a lot of bad stuff coming out in the news lately. And you all understand, we're  odd. We're the odd folks in this ‑‑ if you go out and you think about the average IQ of  somebody on the planet, it's kind of frightening. So anyway, I'm glad you're all here. Welcome to  DEF CON 21.  You're going to have to be more lively than this for your other speakers. This is just the opening  ceremonies. But the speakers here enjoy it. You'll have speakers up here that will be drinking while  they present. They're going to want to talk to you. And if somebody starts talking bullshit in one  of their speeches, call them on it. That's why we're here at DEF CON. Okay? So welcome. Have a  great time.  Applause  Do I release the hounds now? What do I do?  You guys want to hear the TSA security story? So I hand carried the Ubers in several of the  badges and I had them in a box wrapped up in duct tape shut with black duct tape. Probably not the  best choice. And I took it in my carry‑on because I was like, there's no way in hell that I'm  going to check this because this is real glass. These will break. So I checked the box. It's going  through the X‑ray machine and the lady is looking at me. And she looks at the screen. She looks back  at me and I see her eye kind of raised. And she looks back at the screen and then they do the whole  thing. Call someone else over. According to Bruce, the security theater began. Curtain rose and  X‑1 started. So the TSA had another gal come over and look at the screen and of course then they  pull it out the other side of the X‑ray. Sir, is this your bag? Yes, it is. Would you mind ‑‑  because it was in a box inside of my carry‑on. So she goes, I'm going to take it out and I was  like, go ahead, please be careful. It's fragile. So don't ever tell TSA something is fragile. Because  they take that to mean explosive, I guess. I don't know. So they open up my bag and once you  open the bag, then you can start to hear the ticking noise that's going on. TSA doesn't like  little boxes wrapped in black duct tape that tick. That show up with extreme amounts of metal in  the X‑ray. Not good. Especially when there's a big fucking skull on it. It was fun and I'm  glad I made my flight. How's that? Consequently, that's not the first time this has happened to  me coming to DEF CON. I've had the mystery boxes declared as bombs at least four separate  times. Coming to DEF CON. And we've had hotel security here as people competing in the mystery  college. Carrying these metal boxes with mercury tilt sensors on them. So they're balancing  them very precariously. Because if they tilt them, the box begins to go, wail, wail, wail,  because I'm a jerk. I'll give you this one and then I'll let you go. I had these thick steel  boxes that were made out of a tube. And they had locks on the top and bottom. And I put the  switch inside so they couldn't tilt the box. But they had to pick the bottom lock first. So  they've got these big‑ass heavy boxes that they can't tilt and they have to go up through the  bottom. So you've got people holding these boxes that weigh like 50 pounds over the head of  some guy who's underneath trying to pick the lock from the underside. And so here's security  walks by and here's these guys like ‑‑ holding the box and you've got these guys on the  ground. And there were blinking lines on the outside. Looked like a bomb. So anyway, yeah,  those are the kinds of stories that I will never forget about DEF CON. Anyway, thank you very  much. Have a great conference.  Thank you.
DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_0_347.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_348_491.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_492_539.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_540_587.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_588_635.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_636_683.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_684_731.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_732_779.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_780_827.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_828_875.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_876_923.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_924_2075.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_2076_2795.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_2796_5939.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_5940_7583.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_7584_13571.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_13572_21215.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_21216_23411.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_23412_24119.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_24120_24239.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_24240_24287.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_24288_24431.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_24432_24527.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_24528_24575.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_24576_24623.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_24624_24683.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_24684_24779.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_24780_24827.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_24828_24875.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_24876_24923.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_24924_24971.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_24972_25067.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_25068_26087.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_26088_26231.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_26232_26915.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_26916_27935.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_27936_28967.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_28968_30347.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_30348_31607.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_31608_31859.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_31860_32159.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_32160_35471.png DEF_CON_21_-_LosT_-_Welcome_and_Making_of_the_Badges_yS_KiWKLS2c_35472_45608.png