Shmoocon 2016: The Best Conference Booth You’ll Ever See

Shmoocon is here, and that means a dozen or so security companies have bought a booth and are out to promote themselves. Some are giving out shot glasses. One is giving out quadcopters. It is exceedingly difficult to stand out in the crowd.

At least one company figured it out. They’ve built a game so perfect for the computer literate crowd, so novel, and so interesting it guarantees a line in front of their booth. Who are they? Fortego, but that’s not important right now. The game they’ve created, BattleBits, is the perfect conference booth.

The game play for BattleBits is as simple as counting to two. You’re presented with an eight-bit hexidecimal number, and the goal is to key them into a controller with eight buttons for 1, 2, 4, 8, 16, 32, 64, and 128. The answer for 0x56 is 01010110, and the answer for 0xFF is mashing all the buttons.

BattleBits Screenshot

To anyone not familiar with hex, there’s actually a rather handy trick to the game: you only need to memorize 16 different numbers. Hexadecimal numbers are easily broken up into nibbles, or groups of four bits. All you need to do is solve one hexadecimal digit at a time.

The controllers, or ‘decks’ as they’re, are built around a BeagleBone and a custom cape running a mishmash of Javascript and Python. When the game starts the player or players are presented with random bytes in hexadecimal format. Input the right bits in the shortest amount of time and you’ll work your way up the leader board.

This is by far the best conference booth I’ve ever seen. The creator of the BattleBits hardware, [Riley Porter], says he’ll be releasing the design files and code for this game so anyone can make one, something we really look forward to.

[Riley] also got a video of someone entering nibbles super, super fast.

Shmoocon 2016: Phishing for the Phishers

After years of ignoring the emails it’s finally time to get into a conversation with that Nigerian prince you keep hearing from. Robbie Gallagher — an Application Security Engineer with Atlassian in Austin, TX — wanted to find out where perpetrators of phishing emails actually live. Of course you can’t count on the headers of the emails they send you. A better way to track them down is to actually draw them into a conversations, and this means making yourself a juicy target.

Robbie gave an excellent talk on his project Honey-Phish at this year’s Shmoocon. Part of what made it stand out is his narrative on each step of exploring the social engineering technique. For instance, there is already a vibrant community that specializes in forming relationships with scammers. Those who frequent 419 Eater have literally made it into a sport called Scambaiting. The ultimate goal is to prove you’ve baited a scammer is to get the person to take a picture of themselves balancing something on their head. Now the image a the top of this post makes sense, right?

Writing personal emails to your scammer is a great system if you have a lot of time and only want to track down one scammer at a time. Robbie wants to catalog geographic locations for as many as possible and this means automation. Amusingly, the solution is to Phish for Phishers. By automating responses to phishing emails, and enticing the people originating those phishing scams to click on a link, you can ascertain their physical location.

Continue reading “Shmoocon 2016: Phishing for the Phishers”

Shmoocon 2016: Computing In A Post Quantum World

There’s nothing more dangerous, so the cryptoheads say, than quantum computing. Instead of using the state of a transistor to hold the value of a bit as in traditional computers, quantum computers use qubits, or quantum information like the polarization of a photon. According to people who know nothing about quantum computers, they are the beginning of the end, the breaking of all cryptography, and the Rise of the Machines. Lucky for us, [Jean-Philippe Aumasson] actually knows a thing or two about quantum computers and was able to teach us a few things at his Shmoocon talk this weekend, “Crypto and Quantum and Post Quantum”

This talk is the continuation of [Jean-Philippe]’s DEF CON 23 talk that covered the basics of quantum computing (PDF) In short, quantum computers are not fast – they’re just coprocessors for very, very specialized algorithms. Quantum computers do not say P=NP, and can not be used on NP-hard problems, anyway. The only thing quantum computers have going for them is the ability to completely destroy public key cryptography. Any form of cryptography that uses RSA, Diffie-Hellman, Elliptic curves is completely and totally broken. With quantum computers, we’re doomed. That’s okay, according to the DEF CON talk – true quantum computers may never be built.

The astute reader would question the fact that quantum computers may never be built. After all, D-Wave is selling quantum computers to Google, Lockheed, and NASA. These are not true quantum computers. Even if they’re 100 Million times faster than a PC, they’re only faster for one very specific algorithm. These computers cannot simulate a universal quantum computer. They cannot execute Shor’s algorithm, an algorithm that finds the prime factors of an integer. They are not scalable, they are not fault-tolerant, and they are not universal quantum computers.

As far as true quantum computers go, the largest that has every been manufactured only contain a handful of qubits. To crack RSA and the rest of cryptography, millions of qubits are needed. Some algorithms require quantum RAM, which nobody knows how to build. Why then is quantum computing so scary? RSA, ECC, Diffie-Hellman, PGP, SSH and Bitcoin would die overnight if quantum computers existed. That’s a far scarier proposition to someone hijacking your self-driving car or changing the display on a smart, Internet-connected thermostat from Fahrenheit to Celsius.

What is the verdict on quantum computers? Not too great, if you ask [Jean-Philippe]. In his opinion, it will be 100 years until we have a quantum computer. Until then, crypto is safe, and the NSA isn’t going to break your codez if you use a long-enough key.

Shmoocon 2016: Z-Wave Protocol Hacked with SDR

The first talk at 2016 Shmoocon was a great one. Joseph Hall and Ben Ramsey presented their work hacking Z-Wave, a network that has been gaining a huge market share in both consumer and industrial connected devices. EZ-Wave uses commodity Software Defined Radio to exploit Z-Wave networks. This is not limited to sniffing, but also used for control with the potential for mayhem.

Continue reading “Shmoocon 2016: Z-Wave Protocol Hacked with SDR”

Donuts of ShmooCon

This weekend is ShmooCon, a hacker convention held in Washington DC. Brian Benchoff and I will be there, both of us for the first time. We’d love your input on what talks look the most interesting. Check out the schedule of speakers, then leave a comment below to let us know which talks you think we should cover.

It’s great hearing the big presentations, but I find a lot of times great hacks can be found in smaller venues, or just by walking around. Two examples from 2015 DEF CON: the best talk I sat in on had about 10 people spectating in the IoT village, and I had a great time trying to track down everyone who had an unofficial hardware badge. If you’re at ShmooCon and have something to show off, please find us (@szczys, @bbenchoff)!

On Saturday join us for a Hackaday meetup in the lobby of the Washington Hilton. ShmooCon is well-regarded for the quality of its “lobby-con”, what better place to gather? Look for the Hackaday crowd starting Saturday 1/16 at 8:45am. We’ll bring the donuts, and some swag like Hackaday Omnibus Vol. 02 and of course, some Jolly Wrencher stickers.

32C3: 20 Oscillators in 20 Minutes

In terms of implausible stand-up comedy, [Darsha]’s “20 Oscillators in 20 Minutes” is pretty far out there. First of all, she’s sitting down, with googly eyes on her multimeter, and five breadboards and a mess of 9V batteries laid out in front of her. “Has anybody built electronics before? Has anybody built electronics in front of this many people before? Yeah, so you’d better f**king be nice.” And she’s off!

twenty_oscillators-shot0012“Square waves are really good for your speakers.” And a few seconds later, a lub-dub beat-frequency oscillator filled the hall. And then there’s the stand-up clichés: “Anyone in the audience from Norway?!” And “Anyone know what chip I’m using here?” (The 555.) A heckler, or participant, shouts up “What are you doing?” She responds “Building this!” and shows a sketch of the basic layout.

She baits the audience — “Do you want to ask me about duty cycles?” — and tells stories: “And then one time the solder fell in my lap and burned through my crappy jeggings. Who knows what jeggings are? Whooo!!” All the while the clicking gets louder and more complicated.

Then there’s the suspense. “11 minutes left? Shit, I dunno if I’m going to make it this time!” She’s visibly panicked. A question: “How do you protect the outputs from overvoltage?” “I don’t. (pause, laughter) I use some filter caps and just, well, hope that you guys have good insurance.”

Nearing the home stretch, there’s this quasi-rhythmic ticking and pulsing slowly building up in the background. She plugs in another capacitor, and the crowd spontaneously applauds. A little bit later, she shouts “Is it loud enough?” over the din and turns it down. At the end, the timing’s getting really tight, and she calls up someone to help from the audience.

We won’t spoil it, naturally. You’ll just have to watch it run to the end. We laughed, we cried. It was better than Schroedinger’s cats.

(We’d use hex inverters.)

32C3: 3D Printing on the Moon

How do you resist this talk title? You can’t! [Karsten Becker]’s talk about what kinds of 3D printers you’d use on the moon is a must-see.

[Part-Time Scientists] was a group of 35 people working on a mission to the moon. Then they won the qualifying round in the Google Lunar XPRIZE, got a bunch of money, and partnered with some heavy corporate sponsors, among which is Audi. Now they’ve added eleven full-time employees and updated the name to [PT Scientists]. (They’re taking applications if you’re interested in helping out!)

3d_printing_on_moon-shot0026A really neat part of their planned mission is to land near the Apollo 17 landing site, which will let them check up on the old lunar rover that NASA left up there last time. The science here is that, 45 years on, they hope to learn how all of the various materials that make up the rover have held up over time.

But the main attraction of their mission is experimental 3D printing using in-situ materials. As [Karsten] says, “3D printing is hard…but we want to do it on the moon anyway.”

3d_printing_on_moon-shot0027One idea is to essentially microwave the lunar regolith (and melt it) . This should work because there’s a decent iron component in the regolith, so if they can heat it up it should fuse. The catch with microwaving is directivity — it’s hard to make fine details. On the plus side, it should be easy to make structures similar to paved roads out of melted regolith. Microwave parts are robust and should hold up to launch, and microwaving is relatively energy efficient, so that’s what they’re going to go for.

But there are other alternatives. The European Space Agency is planning to bring some epoxy-like binder along, and glue regolith together in layers like a terrestrial cement printer. The problem is, of course, schlepping all of the binder to the moon in the first place.

And then there are lasers. [Karsten] talked lasers down a little bit, because they’re not very energy efficient and the optics are fidgety — not something you’d like to be supporting remotely from earth.

The final option that [Karsten] mentioned was the possibility of using locally-generated thermite to fuse regolith. This has been tested out on earth, and should work. [Karsten] thought it was an interesting option, but balls of hot thermite are potentially tough on rovers, and the cost of mistakes are so high that they’re going to put that off for a future mission.

In the end, the presentation ran only thirty minutes long, so there’s a great Q&A session after that. Don’t go home once you hear the audience clapping!