I'm God-Minus-One. I'm the point of contact and organizer for the DC groups in Baltimore, Maryland.
I'm Mad Hat from Dallas. I'm on the DC-214 group, and I want to say that I think we're the first official group to have a scene whore.
I'm Grifter. I organize the DC-801 group out of Salt Lake City.
And I'm Dr. Chaos. I organize the DC-404 group out of Atlanta.
So these are five of the best groups we've got, and I think at last count we were at like 88 or something like that.
Yeah, 88, and we have DEFCON groups as far away as Tehran, Iran, Ankara, Turkey, Penang, Malaysia, and Tokyo, and I think we just got one in Brisbane, Australia.
So we've got them all over the world.
Oh, and Saudi Arabia. We got one in Jeddah, Saudi Arabia.
Yeah, if you've got a DEFCON group in Iran, you know you're pretty good, right?
Alright, so I'm going to start with Noid. What goals did you have in mind when you wanted to start a DEFCON group?
When you started this, what was it that you were trying to accomplish?
Well, I think initially for me on a personal level, it was to alleviate boredom.
I used to run the Los Angeles 2600 group, and then after I moved to Washington, I sort of fell out of things for a bit and found myself with a lot of free time on my hands.
And I'd been to some of the different meetings, some of the LUGs, some of the Unix user groups, the local 2600, and decided that, you know, we should do a DC206, keep it small, and just strictly focus not on talking about tech, but focus specifically on doing things.
Because, as we all know, if you get more than four or five hackers involved in a project, nothing gets done.
So if we keep the group really small, we could pick a project each month and build stuff.
And that was the plan, was to actually build functional equipment.
Which we've been somewhat successful at.
Alright, this one goes out to all the groups. What kind of projects, cool projects, has your group worked on so far?
So what are some of the coolest ones you've seen?
Well, we built a GPS jammer.
We actually have a radio and TV jammer we're building, provided the guy here with the kit finds me at some point during the convention.
What else? We built something else that was really cool.
We reverse-engineered an IDS appliance we'd come across.
Found out that the processor was actually designed to support keyboard and video out.
They just hadn't put the stuff in, so we had to sit down and do some micro-drilling and were able to turn the thing into a fully functional computer that's this big and can get mounted so we have a portable hotspot.
Oh, that's cool.
Anyone else?
We set up Silk Network that a lot of people have been using. It's like IRC, but actually secure.
Lots of different projects. The spa thing that we presented on at Black Hat and mentioned here was all based on discussions we had there.
Okay.
We bring content to DEF CON.
We haven't been very project-based in Atlanta yet. We've talked a lot about projects, but we've been kind of more thematically oriented.
We do presentations. We have folks come talk about pertinent security topics, pertinent hacking topics.
Of course, we do our meetings at a tequila bar, so unless we get a consensus really early on, we don't really know what projects are going to come about the next meeting.
But we've had discussion around projects, building components, building devices.
We've talked about modifying wireless devices, and we've gone into detail on the process of doing so, but we haven't actually done any projects as part of the meetings yet.
Right.
DC410, it started out as a close group of friends. It started growing larger and larger. We do presentations every week.
We started organizing a CTF, and basically from the ground up, we're starting with basic tools and going all the way up, teaching everyone how to use it, showing them how to use it, which has really been cool.
We have speakers. Chris Hurley comes a lot, a couple times. Jack Holleran's been there. So we get some people that know their stuff coming and doing talks.
So who are some of the cooler speakers that you guys have had there? Have you had any speakers at yours?
We have talks every meeting, so we meet once a month at a bar, and we're lucky to have SimpleNomad, so anytime we're searching for something, SimpleNomad normally steps up and says, I'll do a talk.
But we've also had some great other talks by other people like from CAU and other people from NMRC, so we've been really lucky to have some of the people in the Dallas area.
Very cool. Are there any questions out here yet? None? Alright. Where would you like to see your group, technically, in a year? What are your goals for the future for your group?
I personally, for the DC206, we're one of the groups that isn't doing focused talks with some guest speakers, and that's something I'd like to see a little bit more of.
Because particularly up in the Seattle area, we've got some really bright people like the GhettoHackers, and then some other people that just don't really pop up on radar, and some folks down in Portland.
I know we've got a guy who wants to come up and talk about Asterix, and we have another friend of ours who worked for SourceForge.
He knows Snort inside and out, so we want to have him come up and talk about it.
It just seems that logistics have been a problem for us. The Snort guy's got cancer, so he's getting chemo right now, and the Portland guy's availability is scattered because he's all over the place.
But a year from now, I'd like to see us having each meeting with a focused speaker at the beginning, and then a technical portion at the end of the meeting where we can apply what we've been taught.
Like if the Snort guy comes in and talks for an hour, we can then sit down with some Snort boxes and practice writing filters and things like that, making our own signatures.
Because we've got a pretty wide group of people that show up. We've got some people that work in the industry.
We've got some people that are just not in the industry, but really smart technical people.
And we've got a lot of people that show up that just want to learn new stuff, so it's a chance for all of us to pick up something new.
Very cool. Guys?
The one thing I would like to do is expand a little more, maybe get some more people with deeper knowledge.
One of the things, we hold our meeting at a college campus, which is great because we have computers for everyone to use, we have projectors, what not.
The college actually buys our pizza for our meetings, figuring that the professor that works there is getting all this knowledge by going to this group.
So I'll throw in $40 to feed these guys, hoping that he's going to get more knowledge every month.
So basically, the only downside with that is the fact that they advertise it there and we get people that show up once in a while and have absolutely no interest in computers whatsoever.
Kind of like the scene whore he was talking about earlier.
They just want the pizza?
Pretty much.
She, in theory, has interest in computers. That's just the secondary interest.
Vibrators don't count.
I'd like to see DC214 get some more organized projects for the entire group.
Spa was cool, but it was more of... we had several discussions about it, and then Nomad and I actually did a lot of the work on it, as well as Druid helping out.
But I'd like to see us... in the front row, I've got seven of my guys right here.
But we're not really... unfortunately, we haven't really done anything with any of the contests that are going on.
But I'd love to see us get involved in the contest so that next year we have one or two projects in there.
Yeah, I'm pretty much in the same boat. I think it'd be nice to get a little bit more direction as far as projects go.
Also, nailing down a specific location where we'll meet.
Currently, we'll just meet whenever we can. We'll get the most people together.
We have an IRC channel that everybody pretty much idles in, and when the topic changes to DC801 meeting here, it's like sending up the bat signal and everybody comes running to wherever.
We spend a lot of time at IHOP at midnight, one in the morning, with printouts of all different things and a pen, running over papers and stuff.
And then the next time we'll meet, we'll meet at somebody's house and have a bunch of food.
We'll work on little DEF CON projects that we're working on.
We do the DEF CON movie channel, so we'll have all the filler running on the TV in the background so we can watch it and see what's jacked and what's not.
Just start to put things together, the things that we've worked on, those nights eating pancakes.
But basically I think that's the direction on projects and being able to focus on something and then release that to the community.
Getting people to be able to get together all at once.
I'm sure those of you in DC groups know how hard it is to have everyone who is working on a project be able to get together at the same time.
We have jobs, lives, wives, whatever.
So I think just more focus and you can never have too much organization as far as getting your projects out there.
Yeah, I'd have to echo Alana the same regarding organization.
I've actually been really proud of our group.
We have really good attendance and we've got a really good body of knowledge between all the folks who come to the meetings.
We've probably got an average of 25 to 35 people who come to the meetings each month.
Lately we've had kind of a waning attendance because I've been a little bit slack on sending out meeting notices and meeting updates.
But overall we probably have a core of 15 who are guaranteed not going to miss a meeting.
And then we've got another 15 who generally always show up.
We've got a lot of smart people in the community in Atlanta.
It's truly an IT hub there.
So echoing what Noid said, we've got a lot of security professionals.
We've got a lot of tech geeks.
We've got a lot of aspiring security professionals and aspiring hackers.
And that's been very good because everybody's hungry for knowledge.
Everybody's got ideas about what they want to talk about and what they want to do.
And I think really my goal would be to kind of just funnel that energy and follow in the same path that we've gone so far.
I think we've seen a lot of good growth and development across the past year plus that we've been holding meetings.
We're very lucky with our venue.
The exception being that we're about to run out of space.
I kind of kid... I'm not kidding in that we actually have our meetings at a tequila bar,
but they're closed on the one day during the month when we're doing our meetings.
So we have complete run of the place.
We've got ceiling-mounted projectors.
We've got free Wi-Fi.
And of course we have a bar for everybody to imbibe while they're there.
So we generally have a good time.
We've got the age range and our attendees varies from...
I think the youngest attendee we've got is 15.
The oldest probably being 45.
So pretty much across the spectrum.
And again, people come from everywhere.
I would like to increase attendance.
Of course the problem with that is that we're going to hit the walls on how many people we can contain in our existing venue.
And we're going to have to find somewhere else that's as friendly and as hospitable with a big group of drunken hackers.
So do you see a big desire?
Do you see a lot of people looking for something like this?
I do. I guess to go back a step,
one of the things that I would like to see more is a lot of the folks in our group,
I think they're very smart, they've got great ideas, but they have a lot of hesitation to speaking.
They don't want to get up and do the presentations.
We've got a guy in the group who could probably do things with a wireless access point,
modifications to a WRT-54G that I couldn't dream of.
But he doesn't want to talk about it.
He'd rather write a presentation and give it for somebody else to get up and talk about the project.
So I'd like to see the people in our group becoming more participatory.
I mean, I think people do, they are looking for it.
They're looking for this opportunity to come and geek out with everybody else and talk security, talk shop, talk tech.
I'm hoping that more folks will get up and kind of take part in the presentation process.
We've probably had five different speakers across the past year,
but it's a lot of the same people coming back up and doing presentations.
Right, right.
Just out of curiosity, how many out of the five groups here have that problem?
Absolutely. We do.
We will have someone, like one of our guys, oh, I'm going to write a presentation on this.
I'm like, great. Call him up. Oh, yeah, I'm on my way there. I'm on my way there.
Never showed up and did the presentation.
And you know, a lot of people, we have people there that are, oh, I'm a government contractor, I'm doing this, blah, blah, blah.
I'm talking about all this cool shit that they're doing.
And then by the time, you're like, you know, why don't you step forward and do a presentation and benefit your knowledge of the rest of us?
So it's really, it's the only really problem that my group is having right now is to get the others motivated.
I think part of the thing that I've seen the difference between our DC meeting and our 2600 group is when we meet for 2600 and we give presentations,
somebody stands up in front of the whole group and they just talk to everybody.
They present like they were presenting, you know, in a small forum where with the DC groups, it's a little, I know I just got done ranting on organized,
but it's a little more organized in the fact of like, I don't know, that they can feel comfortable that they're not going to be ridiculed.
They're not, it's more of an informal setting.
So like I said, if somebody's house or at IHOP or whatever like that, it's easier to talk around a table while you're eating, you know, breakfast with friends
than it is to get up and rant to an entire group of people.
So, I don't know, some of those guys who can't talk in front of the big groups can sit there and talk, you know, over, you know, eggs or something like that.
Or I'm sure once they get shit-faced, they're willing to talk about whatever it is that they're talking.
You actually bring up a good point. We've heard the question over and over. Can you run a DCG in a 2600? Is there a huge difference and what is it? Does it matter?
I mean, what are your issues with running both? Because several of these people run both at the same time, right?
We try to work really hard to bring the folks from the local 2600 chapter to our meetings.
I think there's a significantly different focus and it's probably almost the direct contrast of what Grifter said.
At least in Atlanta, the 2600 group, it's very informal. It's held at a food court in the local mall. There's no real presentations.
It's not always topically oriented, so it's more of just a get-together, hangout, talk about whatever's on everybody's minds.
Whereas with DC groups, we've tried to really focus on kind of keeping what brings everybody to Vegas every year for Black Hat,
which is, hey, we've got 30 people who come to a meeting, 25 of them would love to see a topic on the latest attacks on EAP, the latest attacks on WPA.
Just tools for improving or for attacking common hardware, common software.
So by keeping kind of the presentation focused, I think we've brought a really big group to the meetings.
And I think we've got a lot of camaraderie with the folks that are doing 2600 meetings in Atlanta.
In fact, the folks that pseudo-organize the 2600 meetings commonly show up at our meetings.
I can't say that I'm always at the 2600 meetings, but it's more of a scheduling issue for me.
Okay, you got a question?
Then you're lucky.
He said every 2600 meeting he's been to in San Francisco sounds identical to what we're describing in the DC groups.
And my comment was, then he's lucky. I've only been to a couple of 2600 meetings in Dallas, and I have nothing positive to say, so I'm not going to say anything.
There's a guy in the back.
I hear comments. Who's got...
It's Humperdinck.
I have to agree. I think if you've got a well-organized 2600 chapter, that's awesome.
And I think that's been kind of one of the goals with a lot of the DC groups has been to kind of fill a gap.
You know, the 2600 meetings, I think, in general, like I said, I speak only for Atlanta, but they tend to be more of just a social gathering.
Agreed?
You know, there's a difference. At least there's an apparent difference in Salt Lake City.
And that's at the 2600 meetings, there are a lot more people who are beginners, who are new to it, and they... what's that?
Right. That's right. As there should be. I'm not saying that there shouldn't be.
There's some younger individuals. It's a little less mature of a setting where we have the stand-up-and-talk thing.
It's because if you don't, they'll see something shiny, and they'll go running off into a wall.
Where... yeah.
Where the DC groups that we have tend to be the guys that know stuff.
And they come, and they want to work on projects, and they are project-oriented.
They can sit down, and I mean, that's one of the best things that's come out of these groups.
For us, it's like, I'm an idiot. I don't know everything.
So, if I don't know something, but I get a great idea, I can turn to a group of guys and say, hey, make the magic happen.
And they're like, alright, well, what are we going to do?
And we sit down, hash it out, and then, boom, there's a new tool or something.
And that's awesome, but that's the thing.
At a 2600 meeting, we don't have that... we just haven't seen that project-oriented attitude.
It's a little bite-sized information, and then they go.
Where, with the DC groups, it's more of long-term projects, where people work on something for 6, 8, 10 months.
So, I don't know. That's just how it is in Utah. I don't know about San Francisco.
One of the things about Seattle I like is the fact that it's not a difference in focus, per se, between the Seattle 2600 and the DC-206.
It's just a difference in size.
We find that, since our group is smaller, it's easier to actually get projects done, because people have tasks and there's not a lot of chatter.
The signal, the noise, kind of dials in a little bit more.
Because, mostly, I'd say 99% of the people at the DC-206 are regular attendees of the Seattle 2600.
So...
Yeah, yes.
Well, no, okay. Yes and no.
The DCGs have a very primary goal of continuing to learn about technology.
I mean, we don't give a damn about politics, right? We don't talk about it.
We're there to talk protocols and servers, applications, vulnerabilities, whatever else.
Well, and that's fine. He said, everybody's different and everybody's got their own ideas. I totally agree with that.
The forum for DCGs is, we're focusing it on technology.
Not every 2600, though.
For us, we were just trying to...
Have you read the magazine lately?
We were just trying to fill a gap.
Have you ever read, you know...
You may have a very special 2600. Congratulations.
We don't have 30 people who come to the local 2600 meetings.
So what we were looking for was building camaraderie amongst a group of people who didn't come out to the 2600 meetings.
A lot of the folks that are in the professional security community in Atlanta wouldn't go hang out at the food court at the mall.
So there was no participation from people that have professional experience out doing penetration testing.
Or, you know, doing product reviews with security products.
What we were looking for was building that camaraderie.
Bringing together the same kids and the same folks that go to 2600 meetings.
But with the suits that want to come out and hang out and see a presentation or do a presentation.
And focus more on some of the how-to's.
The understanding behind the scenes that you don't get at the food court or the mall in a lot of the 2600 meetings.
Not every place has a 2600 meeting, too.
So, it is unfortunate.
Well, it depends.
If you've been to some of the 2600 meetings I've been to, I'd rather not have one.
I mean, quite honestly.
Alright? So that's the goal.
This poor guy in the back has had his arm up to the point where it's going to fall off.
You're going to have to yell, though, because I'm way up here.
Scavenger hunt.
Gritcher, I hate you.
Okay, kids. Stay in school.
It's a good thing you made him wait.
Actually, yes.
I don't remember how many points that's worth. Sorry, guys.
Yeah, we're not saying that you don't have a great group.
What we're saying is we have had such experiences that we're not getting what we need to out of that.
And that's why we created the DCGs.
I mean, some of the 2600 groups are really dialed in.
Like, the LA 2600 is tight.
San Francisco, in fact, there's actually a lot of crossover between the two.
Kind of, you know, we made flyers.
They said, oh, we should make flyers, too.
And, you know, setting mailing lists up and stuff.
And there's a lot of crossover there.
But there are some places that have 2600 meetings and DEF CON meetings.
That suck.
So this is an attempt to...
Every once in a while, I've been to a couple of places where there's a 2600 group.
But nobody goes to it anymore because it's run by four or five guys that have known each other since high school.
And it's kind of a click and nobody's really welcome at it.
So they say, you know, we'll just go start our own thing.
And this is their own thing they can start.
Or vice versa. They could say, you know, our local DEF CON group sucks.
We're going to start a 2600 meeting.
For us, to be honest, it wasn't really... it's not a matter of competition.
We just wanted to do something that wasn't being done in Atlanta.
And I think we've achieved that with the DC group.
All right. You know what? You got good points. Let's have that discussion offline.
That's a beer conversation.
We should give him a microphone.
Yeah.
What are the hardest things they had to deal with?
Probably find a suitable meeting location.
Our first two meetings were at a mall food court.
And, you know, no presenters come, but there's no, you know, projectors or anything.
It's loud. You can't hear it.
Security walked around us about four or five times asking us what the hell we were doing there.
So now we got our meeting location at the local college.
And, you know, we have pretty much everything we need to.
The whole school is closed.
We normally have them Saturday nights.
School's closed. You know, people...
Highways drives down from Philadelphia.
We have people coming from out of state.
We got a couple of guys that drive two, three hours to come to the meetings.
We have computers for everybody.
We have, you know, a segmented network that we can do everything we want to with removable hard drives.
The possibilities are...
That would be the place that I would recommend if there's one in your area, like a local community college or whatever.
Try and get in there.
And they'll frequently let you have the rooms for free or for a small donation.
Or sometimes the person who reserves the room needs to be a student.
But at the same time, you know, it's not terribly hard to find computer science students at the local university that want to hang out with like-minded people.
Some of the biggest problems we had were the location thing.
We had trouble finding a location initially, so we kept moving around.
Which caused a lot of people to go, eh, I don't know where it's going to be this month.
I don't want to bother tracking it down.
Finding the time to organize where it was going to be, what we were going to talk about.
As well as updating the website so people knew that it was current.
And then we had a little bit of issue, too, where making friends with the different lugs, the different Unix groups.
We actually have like a Unix user group, a bunch of Linux user groups, BSD group, the 2600.
And letting them know that we weren't in competition with them.
We weren't trying to pull people away from, oh, you can't hang out with them anymore because you're with us.
And that we were actually more of a supplemental group.
Where, hey, if you like what they talked about at the Seattle wireless meeting, but want to hang out with four or five guys, we can spend some time going more in depth with it.
And that's what we're here for.
And I think one of the biggest ways we overcame that was getting the mailing list set up, getting the website set up, advertising it.
So once people in their various lugs and things like that started seeing, oh, no, I went to that, it was cool.
They realized, okay, the meetings exist, it's valid, you're not going to waste your Sunday.
Tracking down a location like you're trying to find a rave, you know, only to find nothing.
So that was one of the biggest problems we faced.
So in Dallas, the biggest thing, of course, was getting the word out that it was going on.
We were really lucky and had an excellent location right off.
Unfortunately, it's fallen apart lately, but that's a whole different story.
But the other problem we had in the beginning was I was trying to give these guys too much control about what we did.
You give too many people too many options and everybody goes nuts.
So I finally ended up saying, no, this is the day we're meeting on, this is where we're going to meet.
Be there or don't, it's up to you.
Trying to give them, okay, so we want to meet on Wednesdays or Thursdays?
We want to meet on this day, we want to meet here, we want to meet there.
It didn't work.
It was basically sitting down and just saying, okay, this is where we're going to meet, this is when we're going to meet.
This is who's presenting. If you want to present, great.
If not, at least show up.
It's really worked really well.
We have 100 people on our mailing list and we usually have between 30 and 40 people show up every month.
I'll go back to it.
Like I said earlier, Salt Lake City or DC801 was one of the pilot DC groups along with the Colorado Springs guys.
Russ called me up one day and said, hey, I just got off the phone with DT and we want to try doing this thing.
And we're going to do it in Colorado Springs and we want to know if Salt Lake's interested.
And we said, sure. We didn't want to do it in a food court like 2600 is.
Like I said, we bounce around to different restaurants and things and we got laptops up on the tables and we get stuff done.
I agree as well. Someone has to take ownership of it.
Like the too many chiefs just doesn't work out because everybody wants to say, well, my schedule doesn't work with that.
This doesn't work with that. It's like, okay, well...
So the impromptu meetings have worked really well for us, whether it be a couple weeks in advance or a couple hours.
And then whoever can be there can be there and we can fill in the other guys on the progress when they get there.
But somebody has to be able to say, okay, this is what we're doing and this is when we're meeting and where.
And then round everybody else up.
And a lot of us, through not only our local 2600 meeting, but through DC groups as well, have become really good friends.
And that's nice. I mean, you get to meet people who...
Like generally, I don't like people, but...
But yet you love gatherings.
Because I'm an asshole, but I like other assholes.
Or really smart people.
So it's nice to get a bunch of smart people together and know that, all right, these guys are intelligent, you can have an intelligent conversation.
So you're not just going to go to a barbecue and watch your friends set themselves on fire.
Well, you might watch your friends set themselves on fire.
You haven't been to our meetings yet.
Yeah, but at the same time, you might get something coded too.
For us, I think it was entirely attendance.
You know, venue was initially a little bit of a challenge, but not much.
I think the biggest challenge we had initially was turning 5 people into 10, into 15.
And to be completely honest, it was almost all word of mouth with us.
I basically harassed everybody I knew who was in the community until they came.
And I would call them relentlessly and say, dude, why aren't you at the meetings? Please come out.
And once people would come out, they'd come out, they'd have a good time, they'd see a presentation.
I'd say, bring somebody else.
And eventually, that caught on.
By the time we hit 20 people, we were 30 overnight.
And it's been pretty consistent since as long as I send out reminder emails.
So how many members was it until you hit critical mass?
Until it started growing on its own?
Because that's the problem we have with a lot of the groups is they can't get past that critical mass.
They don't know how to get there.
Three or four meetings, we were probably only like five or six people.
And it was people that were, you know, mostly close friends of mine and folks that I knew.
And I'd say after the third or fourth meeting, we kind of did an email blast.
We, you know, sent some stuff out to everybody that had signed up at the website.
We pretty much just kind of talked to everybody we knew.
We said, hey, come out, come to a meeting.
I think we, that was one of the first times we had like multiple presenters was our fourth, fifth meeting.
And by that time, we had a few other people catch on.
And again, to be honest, I was really kind of an annoying prick to everybody.
I just wouldn't leave them alone until they came to the meetings.
I guess eventually they just wanted me to shut up, so they came.
Alright, so if you had one word to describe the personality of your DCG, what would it be?
Drunk.
But it's fun!
Alcoholics.
Alcoholics?
All of the above.
That's not one word.
All.
Thirsty.
And I mean that in multiple regards.
Everybody's thirsty.
We're at a tequila bar, but everybody's thirsty for knowledge, too.
Everybody wants something out of the meetings, and I think at least 60% of the time, they get it.
Right, right.
And Grifter, yours is Mormon.
Actually, ours is pretty dedicated.
We don't have a lot of people, but the people that show up are consistent.
They come every month.
Something we talked about last month, for example.
They'll come back and be, hey, we talked about that last month and left off on it.
Where were we?
So they're pretty dedicated and persistent about it.
Very cool.
Grifter, what is your descriptive word?
I don't really have one.
I'm actually out of the...
What? Yes.
No.
But the...
Actually, I'm only one of, like, two Mormons out there.
So there's two of us out of, like, the other group.
We keep it gangsta.
Have any of you had any problems with law enforcement with the group?
Other than mall security? No.
I've actually been doing my best to bring out a lot of the local law enforcement.
We've got a pretty big IT security law enforcement community in Atlanta.
We've got, you know, the FBI, the GBI.
We've got high-tech crime units with a lot of the local federal state agencies.
And I've really been trying to encourage them to come partake in the process.
To be honest, out of 30 people in our group,
I can guarantee that 20 of them would be absolutely...
They would die to have, like, you know, a two-sided presentation.
Have some, you know, local law enforcement come out and talk about the forensic process.
And, you know, maybe the same thing from somebody who's unwilling to give their name at the beginning or end of their presentation.
So I'm working really hard to kind of make sure that there's no discrimination, law enforcement or otherwise.
You know, we want hacker kids, we want security professionals, we want cops, we want feds.
Yeah, we've actually tried... I've been trying to get a couple of field agents to come down and talk about forensics.
And, yeah, because we haven't had... But then again, we meet in an office.
One of our members owns a business, so we actually have our own...
We use their boardroom, which is sometimes a ping-pong table.
And, you know, so there's no interaction with law enforcement unless we're throwing things out the window, which doesn't happen.
So, but yeah, I wouldn't mind having them come down and talk to us.
Okay. All right.
As far as I know, we haven't had any show up, but, you know, I don't ask for IDs. Huh?
It would beat the feds.
Yeah, I can either confirm or deny any accusations at this particular point in time.
So, Chaos, when the feds come out and the law enforcement stuff, do you have any conflicts or any issues with the other attendees?
I don't think so. And I've asked on multiple occasions.
And to be honest, I honestly think that the significant majority of our group would really prefer that we do have some local law enforcement come out.
Again, I think most of the people that come to our meetings are, if they're not in the InfoSec community, they'd like to be.
You know, they're really trying to get into security, you know, from one angle or another.
But the bottom line is, I think everybody would like that involvement.
They'd like that perspective in the meetings as well, you know.
We talk about security as much as insecurity, if not more.
But, you know, there's no real... there's no difference between the two, so...
What did you say?
I said, because it's sexy. Information security is so sexy.
Grifter, that's just you, buddy.
No, but, thanks.
I honestly believe that, I know, I haven't like taken a poll of the members or anything, but I honestly believe there would be a lot less discussion if there was an openly fed at the meetings, you know.
There would be a lot less discussion about some of the things we talk about.
Whereas I'd be happy to see a little bit of it.
Partially because I'd like to see the group exposed, both sides being exposed to one another.
Because where a lot of the problems with law enforcement seem to stem from is, all of a sudden, whatever agency, or state, local, federal, whatever, suddenly says, oh my god, there's this hacker group that just popped up on radar in our backyard.
Who are these guys? What are they doing? We need to get in there.
Whereas if we invite them down, that's an easy way of saying, look, we're not up to anything.
You're welcome to come hang out at the meetings.
See, look, real live hackers, they're not scary, they're not plotting violent overthrow of the government.
And on top of that, it also shows some of the guys that show up that, see, law enforcement, they put their pants on one leg at a time, just like the rest of us.
In fact, last time I talked to an FBI agent, we sat around commiserating about our bosses.
The only difference is when he gets into work in the morning, he puts his badge and his gun in his desk.
And I don't.
So kind of the same lifestyles.
Don't get me wrong. I mean, I think it would be really interesting.
I just, I feel that a lot of the discussion we do have would be, we either wouldn't have the same discussions or the discussions wouldn't be as complete as they are now.
I wouldn't recommend it every meeting, you know.
I mean, I think the bottom line is, hey, what would this conference be if we didn't have Feds here? You know what I mean?
It does something to the energy and the atmosphere and I think it also encourages...
But we play spot the Fed because they're not out in the open.
Inviting them in and saying, hey, here's your local Fed, let's talk about all this stuff, it's a completely different atmosphere.
We play spot the Fed because they don't want us to know they're here.
Yes, we know because we're not stupid, but they're too stupid to realize that.
Yes, ma'am.
Me?
Oh, no, no, I completely understand that.
And like I said, it would be very interesting to have them there.
Okay, so what she said was that it would be good if a Fed came and presented and then have basically a counter-argument presented, working like the opposite...
Did I understand that correctly?
Right, so what she's saying is, you know, you have a Fed come in, do a presentation, and then the next meeting, you discuss in the meeting, you know, what was talked about.
So that it's less pressure on those people. And I agree, on a one-off basis, I think it would be great to have, you know, somebody from law enforcement come in, do a presentation.
But if they're there and they're out all the time, the overall discussion, meeting to meeting, I think would be a lot different than what it is now.
And I think that would hinder a lot of the discussions that we have.
Don't get me wrong, I think it would be really cool, just not on a regular basis, not like every single month.
Yeah, no, on a regular basis, you know, because, I mean, it's kind of getting scary.
You know, things like the DMCA, Patriot Act, or Patriot 2 now, you know.
The whole reverse engineering thing with the...
Yeah, exactly, the fact that things that really, frankly, shouldn't be illegal, have become, such as reverse engineering.
Yeah, I could see it stifling innovation a little bit, where it's like, okay, this guy's friendly enough, but do I really want to show him how I hacked the firmware on this particular piece of software?
Because he might just turn around and bring a hammer down on me.
You know, so, yeah, I definitely wouldn't recommend having them on a regular basis, but it's always good to have them come in, maybe for a one-off type thing.
Because it's interesting to see, you know, what are they doing?
You know, we'll show them what we're doing, if they'll show us what they're doing.
And, you know, like I said, I have 30, 40 people show up every month.
I don't know if any one of them is a Fed or not.
My group makes fun of me, because I do a standard disclaimer at the beginning of every meeting, saying, everything we're talking about is hypothetical.
Everything we're showing here are things that we do on our own networks.
This is not anything where we're not taking out anyone else, we're not doing anything illegal.
All of this is just for our own entertainment.
And I say that, you know, and everybody makes fun of me, but it's like, you know, I don't know who these people are.
I mean, I don't ask for IDs, I don't ask where they work.
Some of them I know, some of them I don't.
So, you know, it's...
Okay, well, this leads us into a fairly good discussion of, we're not just a US-based organization anymore.
I mean, like Noit said, we've got... how many outside of the country do we have, Michelle?
Like 15, 20 groups all over the world, including Iran and Saudi Arabia.
I mean, to hold groups there, you know, you're under a lot of pressure and a lot of legal and political pressure.
Do you guys ever consider yourselves lucky?
Does your group ever talk about things like that?
And do you utilize that freedom?
Ours does, and we do consider ourselves lucky.
In fact, I correspond with a guy in Tehran from time to time, just because I'm sort of fascinated with the, you know,
wow, what's it like running a hacker meeting in Tehran?
I mean, this is a place that's, you know, we complain about things getting repressive here.
There are a hundred times further down the road than we are at the moment, you know, where, I mean,
being a hacker in Iran can still get you executed.
So it's kind of got a different edge to it, you know?
And, you know, I like interacting with the... I talk to the Malaysia guys all the time.
And it's interesting to see the different backgrounds, because, like, for example,
a lot of these places that are hosting these meetings aren't first world countries.
So it's interesting to see these guys have to do some sort of real, real hardcore hacking
when they're working on projects, because these dudes got to hustle.
They don't just whip out the credit card and buy the parts kit.
They got to go dig through the junkyard and find the old abandoned APC
to get the big piece of metal off that they wanted and, you know,
happen to stumble across the satellite receiver while they're at it and, you know.
So it's actually kind of almost more hardcore, because these guys have really got to hustle
to get their projects together.
They don't have a radio shack on the corner they can go down to and get gear at or fries.
So, you know, I think we're pretty lucky.
Well, I'd say, you know, everybody sitting in this room is lucky,
because they get to come to DEF CON, the actual conference.
There are emails that come across the different DEF CON lists
that are always like, you know, when is DEF CON coming to Australia?
When is DEF CON coming to Singapore?
When is DEF CON coming here, there or the other place?
DEF CON is in Las Vegas and you're all here in Las Vegas.
So these guys connect to DEF CON through these groups.
And it's like if DEF CON can bring a little bit of that to them,
then, I mean, we're not doing too bad.
Anything else, guys?
I'll be honest. I think we probably take it for granted most of the time.
And I think you've got some excellent points.
You know, I think it's something we all have to consider, like you said.
We're lucky to be here and be able to do this.
And I think, you know, one of the things that I would like to see,
especially from our own local group, from the Atlanta group,
is more interaction with the other D.C. groups.
Not just in the U.S., but worldwide.
I think there's probably a lot that we could do and organize
by working with one another.
What that is, I don't really have any idea.
But it seems like there'd be a lot.
So I'd like to see some of that communication between D.C. groups
because I think we would all benefit from it.
And, you know, then regardless of whether we're the D.C. group
that's got five regular members or 30 regular members,
everybody would feel like they're part of a bigger regular meeting
when you're interacting with, you know, the 303 group
and the 206 group, you know, on a regular basis.
Right. All right.
Are there any other questions out from the audience yet?
All right.
So what's the most impressive thing you've ever learned at one of your meetings?
Corfidio is great tequila.
Wow.
That my friends are smarter than I am.
You know, that's pretty impressive.
That I have friends.
Actually, I think one of the most impressive things I've learned is,
I think one of the most impressive things I've learned is
we have a guy who, Crash, who is constantly messing with the WRT54G
Linksys wireless router firmware.
And I've seen that guy just do some pretty amazing stuff
where first he was building nodes.
Now he's got them, like, meshed.
So that's pretty impressive because I don't do a lot of firmware stuff.
So I'm kind of fascinated by that.
Very cool.
You know, I say in jest that, you know,
the most interesting thing I learned was that my friends are smarter than I am.
But I honestly mean that.
I think that, I don't know, it's just kind of nice to know that there are people out there who are brilliant,
who will sit down and listen to one another and, you know, get some things done.
So, I mean, that's the most interesting thing to me,
is that people will come together and just throw out an idea and can make that happen.
That their brains are capable of just taking somebody's whim and making it a reality.
Yeah, likewise, I think the most impressive thing I've learned is that there are 29 other people
who want to come out once a month and talk about security and watch presentations
and talk about hacking links as routers.
That's kind of cool to me.
Very cool.
Well, thanks for coming to the talk.
These guys will be around for the rest of the weekend.
Thanks for your questions.
I've got two books to give away.
Also, I've got two copies of Aggressive Network Self-Defense,
a book that, again, my friends are smarter than I am,
put together a group of friends that we all put together this book on strikeback technology.
Some of us will be signing it right after this at the Breakpoint Books table.
Johnny Long, who's standing over here about to come up on stage,
will be over there shortly after his talk to do it.
I don't know how I want to give these away.
Does someone have a weird accent?
Yeah, I guess we can give it to this guy here who's as cool as his hat is.
That's the best hat, man.
Thanks, man.
See you later. Thanks a lot.