So there we are again.
And as you can see on the screen.
We're at DEF CON and this is the Monero village.
And today we're talking about the intervillage badge.
We're talking about that thing.
Right. Oh, what happened to.
Did you see that strange pixelation.
Okay, sorry.
Anyway, so my name is Michael, and I'll be your speaking guide through getting started with the badge. Today, we have one hour, and I'm missing some information some content that I can't find so we may have to postpone part of this until tomorrow.
Let me show you what we're doing tomorrow, and the next day. This is Friday, the first day of DEF CON.
And tomorrow, Saturday, Sunday, we have excellent speeches. I think Daniel Kim is coming back for another speech. I really recommend that it's really good speaker.
And so let's check out what we have done so far.
These are very elegant, modern slide deck system. This year DEF CON is on a retro trip. If you've looked at the fonts, colors, and theme.
So, we're going to do some slides on paper. Is that okay with you.
Yeah.
Okay.
So,
we just finished this presentation, which was this year's badge where we talked most about construction, do it yourself, deconstruction, putting it together, assembly.
This one is called
Getting Started
with the InterVillage badge, obviously. So that's what we're focusing on. There's lots of other devices I have. We'll get to that tomorrow in the office hours but things like the Monero Rising is available as well.
And this is maybe useful just for the size comparison.
In any case,
I wanted to keep everything quite clear. Today is Friday, we covered the construction, I think you can review that if it's recorded.
We're going to talk about getting started now. This is the first steps towards using the InterVillage badge in a useful, maybe even productive, hacky, fun way.
Getting some value out of it by using it. That's what we're talking about today, the getting started.
Tomorrow, Saturday, you can find in our schedule which is online, monerovillage.org.
You can find that we have a badge clinic among a number of other very good presentations.
Mine might not be too bad either, right? It's called the badge clinic.
We're going to combine this with a new concept in Discord. We have a channel that's intended for use with office hours.
So if we get lucky and people understand, then we'll have a bit more interaction. Hopefully we'll do some chatting at the same time as visual explanations with a document camera, close range circuit photos.
And that will be tomorrow, Saturday, for the badge clinic, which is one hour long.
During that badge clinic, we're going to do some impersonation, some kind of man-in-the-middle style attacks on our own devices, which is really similar to backing up our own data, right?
If another person who doesn't have permission does these type of impersonation things to your devices and data, then it's called theft.
But if you do it because you're backing up, what, your library card or doing things like that, well, that's just the utility of an NFC device, whatever it is, right?
Your credit cards are NFC devices. Okay, we're not going to do financial. We're not going to copy credit cards.
We probably will get to examine some NDEF records, which is the, it's not a file system, but it's something similar, how the data is organized piece by piece in the radio, the RFID, EEPROM, or erasable, programmable, read-only memory.
So that's what we're going to do tomorrow. That's going to be a bit complex, a bit more advanced.
But I do welcome you because an office hour badge clinic style presentation is for everybody. So if you're a beginner, if you're just getting started, if you have no intention of ever using, owning, having, constructing, holding a device, then maybe you're curious.
Come by and talk about what you're interested in. On Sunday, we have a repeat.
And maybe we'll try something like a free mic. I don't know if we can do that.
On Discord you can, but it doesn't scale proportionately towards the tens of thousands that DEF CON is expecting. So that may work, may not.
So this is our lineup for the different days. And right now we're doing a getting started presentation where we will take one of these badges.
And, and we'll, we'll get familiar with it. We'll learn how to use it and see what its limits are.
And we'll just start using it.
So, I have some extra stuff over here as well.
These are all NFC powered devices. They look like cards, but they're really electronics.
I mean, I don't have to tell you that. Everyone knows that when there's this type of golden connector on a plastic card that there's really an integrated circuit of some kind, some sort inside.
What else do I have. So this is, I maybe want to put my thumb over the, over the phone number.
Right, it's probably too late.
I don't really care but...
So I'm going to keep it turned over.
That was a faux pas.
Anyway, so this is a YubiKey.
And because this YubiKey has this little symbol, which if you can see, it's, it looks like a radio transmission symbol. Right. They don't all have radio transmitters inside them.
In fact, lots of people prefer two factor authentication devices, which are unable to transmit radio, just for security purposes.
This is the same reason someone, some prefer password wallets without Bluetooth connector connections.
But if you want to experiment or if you're trusting of this technology of radio, then you can take a, then you can get a two factor authentication, which, which uses radio for its transmission.
All of these different things are either using the same radio systems but not impersonate-able, or they are, and we'll get to those advanced attacks or uses, use cases and scenarios tomorrow.
Just wanted to kind of introduce what type of devices we can work with.
So let's go back to the badges. They're about the same size as last year's Monero Rising.
There's a simple reason for that is that our robots, machines, and automated tools use up to 14 centimeters of width. So the two together are 14 centimeters.
Small anecdote there.
So we have black badges, we have green ones, we have orange ones, we have about five colors, in case you're wondering what these colors are, it's kind of difficult to see in the light.
That's a green one, that's an orange one.
And the first thing that we can talk about when we're getting started with these badges.
Let me see if what my slide deck is showing me here.
Here's some old stuff.
We're not going to need that.
All right, so because I failed very badly at figuring out screen casting, I'm not going to be able to use the computer which is capturing the video and multiplexing it with audio and everything else.
I'm not going to be able to use that for the web browser.
And for the NFC programmer, so we're going to do this here.
Use a phone. How about that.
Okay, so
I'll give you a very fast demonstration since we're already 10 minutes in, of a typical use.
So, because we go to the manual, we always read the manual first. What is that RTFM.
Then, people who receive a fully loaded badge they get a color manual, and the others, you get a black and white one but they look the same.
And I think they have this section right here, where it says, participate in the DC 28 DEFCON.
That stands for DEFCON DC 28 village network stories.
So we have two URLs there.
I think two is a good number to start with.
And they're in under development so that will be difficult to use but it's your and my responsibility to make this stuff work well. It's open source, it's a distributed use case and development model.
So, so what's not right is to expect well, I'm sure that those other hackers are more competent they'll do the job for me. Now you need to get involved, make these things better than they already are.
But what what can help is to simply recognize these two URLs.
And we will go there right now.
Because I'm not an expert with the rogues village game, which is this thing here for suits game.
We may try it if we get time but I can't explain much, I'm going to have to research that more. And on Sunday, I may as well mention that in between.
When is it.
Before the Sunday badge clinic.
We have a rogues village game slash inner village badge
question answer session I'm not can't remember what the name is.
But it's, it's at noontime on Sunday, noontime UTC minus seven that's Las Vegas time. So if you're interested in this, the, this, the game that they're developing that's what you want to watch is the Sunday presentation, and I even get permission to be a guest speaker.
So, if you want to see me again.
You've got to come back on Sunday.
Let's see. So we're, because, because I'm kind of helping to develop this year. I'm just going to go right to the Bob right now, B.O.B. Bush of being is the code name for that might want to remember that we may have a pop quiz.
So the B.O.B. Do you remember what B.O.B. stands for.
Are you going to put push rewind.
Alright, so
let's open this up to, instead of www we'll go to B.O.B. Can you see that okay.
There we have that.
Not so familiar with this because we're just developing it
at this moment.
So if you go to the B.O.B. which is in the manual.
You get this page.
And that's a good way to get started right that's the name of this presentation getting started.
What eventually we will be able to do with this. We have this working, but it's on a staging site, which doesn't have eye candy or CSS or, you know, styles.
So what this does.
Let me see if I can find it. Where is it.
There it is. So what this does is it helps you onboard your badge device.
Okay, so there's you've got these three buttons on here, you have different IDs and different data on them.
And depending on your, your personal preferences. You may not like red team, you may not like Monero.
You may like the biohacking village though and IOT is the best right so you like those two villages, and you'll be able to select them.
I'm hoping this is working later in the evening. So, you, you can see this site.
You can see, let me see if I point in the right direction. No.
You can see. Right, so you can see this site right now if you go to that URL, it's live.
But you will only be able to onboard your own device, as intended, a little bit later after we get it working.
So I, I'm not going to demonstrate that until tomorrow until we get into the advanced things tomorrow. That's one of the content parts that I will need to postpone.
But in any case, doesn't matter because if you read this, the part that we did get right so far
is in green, you know green is kind of the getting started all okay color.
And it basically says,
you can read that can't you.
It says that
one of the best ways to get started to know that your badge is working to be able to use it in a productive manner
is to use NFC tools. Right, so I'm not sure what happens if I push on that.
Okay, so it goes to the developers website. This is wake dev or something like that.
And this is just documentation, I believe it tells you how to install and where to find the applications.
So you can see that one of the places the typical Google Store.
I don't know about Amazon and these other things. It's also on the Apple iOS catalog, what is it called shop, store, whatever.
And
so that's how do I get back. Right, so that's NFC tools over there.
NFC tools right so I have already installed that I'm just going to run that.
I have the pro version.
And it makes me feel, makes me feel like really pro.
So that's why I got the pro version.
And, but you can get the regular version.
It was, to be honest, jokes aside, it was kind of an experiment, I thought, okay I'm using this thing all the time.
And maybe there's some advanced methods and techniques in the pro version.
And I really haven't found a big difference between the, the one that's not labeled as pro, and this one.
Decide for yourself.
So the quick test. I'm going to do that now.
Do you see this screen that it's empty. Try to memorize what's on there it's almost empty. There's just two lines approach and NFC tag.
Welcome to the you know you see what's on there.
The trouble is that every time I show that the badge device. You can't see the front of the screen.
So that's why this is going to be a bit difficult. Let me get something to drink here.
Okay, so, um, so it's a bit challenging you can't see the front of the screen and the front of the badge at the same time because they must be.
They must be back to back.
That's why the back of the badge is protective leather. Okay, if this was metal like copper traces and jagged parts you put that on your lens, then the lens would get damaged.
Instead, it's a nice synthetic leather finished back. It's called leatherette, I think.
So, feel free to just slide that on there, it won't do any damage, I think.
Unless you have a crystal diamond phone or something, but that's the purpose of the leather.
So the back of the badge must be placed on the back of your phone.
For any of this to work at all.
You have to have
There's probably all kinds of personal secret data coming on the phone, oh no.
So anyway, you may see something there.
You may see, for example, that there is a setting called NFC.
Oh, let me do that again.
There is a setting.
And it's called NFC.
Hello camera, please focus. There.
It's not too well focused, but in any case, you get the point. You can see that Bluetooth is there, that NFC is there, that airplane mode.
So the NFC, that symbol, that's very, very, very important.
In some cases, I'm not going to go through all the screens, but in some cases you can turn on Android Beam and things like that. They're related to NFC.
What you won't find on here is a word RFID, although these are RFID standards.
Okay, so if you're curious about that.
Let me just remove that while all the private information is scrolling.
Okay, so this badge must be placed on the back of this after your NFC circuit is turned on, as I showed.
A normal device, as soon as you do that, would activate the circuit, it would turn it on. Let me show you how that works with my
with my fabrication laboratory key.
Okay, this is my fabrication laboratory key and I'm just holding my thumb over the private data.
And
I will just put this on the back.
See that? You maybe even heard that, because it does make a sound.
So, that's what the data on my key is.
Maybe you'd like to have that data.
Doesn't help much because this is just one of the two factors.
And it's kind of a low value identifier.
So, that's what we get with a classic NFC data transmission.
The non-classic one, like this badge, has a method of defending against opportunistic data theft. So, what does that mean?
So, if I don't have my things here.
If I put this
If I put this card on a table, which I do not control. It's not me that bought, owned, created, built the table.
Then it can be that somebody else manipulated the table. Any table in the world,
you can attach a transmitter and receiver to it, or transceiver, and it can be used to harvest data
in a
in a very bad manner. So, so what we're going to do is protect the data on here by simply requiring
requiring that a human pushes on one of the three buttons before there is any possibility of data exchange.
This isn't a perfect security feature
because
because,
well, because nothing's perfect and simply because what's happening is that unless you push on one of these three buttons, the antenna,
which maybe I can show.
Here it is, the antenna on the back
is not connected
to the EEPROM data storage on the front.
Okay, do you kind of understand that? That without pushing on this button, if you hear that click,
without pushing on this button, if I release and do not push, then this antenna is not connected to any of the data
storage
ICs. And in this moment,
the storage ICs, although they do have transceivers with absolutely no 13 megahertz antenna connected to them,
it's not impossible, but it's likely close to impossible to easily harvest data off of there. Okay, so that's what I call
defense of opportunistic data theft. You put this badge
on most tables in the world in which there is an embedded attack surface and they're somewhat protected against them.
Okay, it still doesn't mean you want to put your birth certificate and images and what are all of these very valuable private data on there. I do not recommend that.
In some cases, these badges can replace or substitute for paper wallets. So if you're ever walking around with a paper wallet, you know very well, any camera in the room can gather, can harvest your secret key.
Consider almost everything in the world that doesn't have a secure element to be less than perfect security.
All right, so we got a bit off topic there. What I was trying to do is push on this and connect it to the phone. That's what I'm going to do right now. We saw an example with a plastic card.
And now I will do it with a badge. So I'm going to push right now.
All right, so we got some data off of the badge. This data belongs to me. So this does not qualify as theft.
So what do we see here? There's just quite a lot of stuff. In fact, sometimes you can scroll.
The first thing that you see, I pushed the star. That's what I did. I pushed this one.
And the star is connected to an EEPROM, which is an ISO 15693 standard. This is an RFID that provides an NDEF, or what does NDEF stand for? It's an NFC data format.
The manufacturer of the EEPROMs, you can see because it's very clearly ST Microelectronics in France.
And then we have technologies available. One of them is NDEF. We have a serial number. Each of the EEPROMs, each of these EEPROMs on each individual badge, so we have very, very many of them, has an individual serial number.
This is not something we decide. You can't buy a telephone or a computer or a badge or any electronic device where there are no serial numbers inside. It's simply
a very common practice in industry that all of these, all of the devices expensive enough, the parts like integrated circuits to, or with a need to be unique, like memory EEPROMs and things, they have serial numbers. Okay.
This can be useful as well. You can use this as a unique identifier, if you like.
Alright, so some of the things here, we can use to understand like this size. That's how much data you can store on there. It's a very small one. There's just 50 bytes for this star. Just 50 bytes. This one is 50 bytes as well.
And they're both ISO
15693. The last one, the sun.
This is a different
IC. So why don't we, why don't we try the sun now, instead of me telling you about it.
Let's put practice into...
Wait a minute. Okay, so now I'm going to push on the sun. Ready for this?
I have to line it up on the antenna.
That is not working.
There it is.
So, now it's no longer showing an ISO 15693 standard, it's showing an ISO 14443.
Okay, so it's not telling us what other manufacturers and service providers call their products.
But if we go back now.
Another thing to notice, please take a look here the size is much larger it's eight kilobytes now. So that's a really big one. Okay, that's really big.
I think that's the largest size I know of.
If we go back here to this, to this fabrication laboratory key.
Let's take a look at it and see if it's this is a 144443 as well.
Okay, and here they even labeled it MyFair, which some of you may have heard of it's a technology brand style word.
Like I think the clam cards which are used on the London Metro subway.
I mean they all have their names clam card and so on. I'm not sure if MyFair is always 14443.
In any case, what this is really just delivering is the serial number.
And this is what I use to operate the laser cutter. Okay, so if you were to, I mean, I'll tell you the truth, you can clone this serial number onto your own card.
And then travel all the way to wherever this machine is that has this reader, whether it's Japan, Greenland, Brazil, or wherever they decide to ship this device.
And then you will be able to use this device and impersonate me if you're willing to break the law. Okay, so don't do that.
This is my card, but I'm not so worried because it's very low value identifier.
Alright, so what have we learned so far. These devices.
These badges work very well with, everybody say it at once,
NFC tools. You can't see it because it's not focused.
So once you start NFC tools you can start using your badge, that's kind of what we're trying to get at.
Flip the phone over, put the badge on top.
The first two buttons are much easier to get a read on. So I'm going to do it this way now and try to listen.
Did you hear that? And then I turn the phone over to show you, and it's got the data on there.
All right, let me do it again with the middle one.
So you probably heard that, and then we have a different standard. I'm sorry, no, it's still the 15693.
Turn it over again for the sun. This one I recommend that you twist it around, it's much more difficult. This is a short range tag. These are both long range. This one's short range. So let's see.
Okay, I got it just simply because I'm doing this all the time.
But it's going to be really difficult. And if your antenna, if the antenna in the phone, in your phone, is not very high up here, but it's lower down there, then you're going to need to put the badge in a different part of the phone.
You understand that? I mean, there is tablets, there are different devices that have NFC inside.
So getting started with any of these computing devices, I've even seen laptops with NFC circuits and antennas. You can try them, it's kind of more common to use a phone. Almost every phone that's been manufactured in the last two or three years has an NFC circuit inside.
I can kind of imagine that there's phones that are made for children or something, or the absolute cheapest ones that don't have them.
But you're going to, you're going to have a phone probably that has NFC on there.
All right, so let's,
let's think about what to do next. We haven't talked about the technology, but it's not, we need a microscope for that.
So it's not going to be possible.
One of the things we could talk about.
Yeah.
I have a couple.
Okay, that could be a question now.
The stream is very choppy I hear.
Why is it choppy we were?
Strange. Okay.
Thanks for telling me.
So, okay, so let's go back to the website. All right, let's, let's figure out what we have covered here.
So we got started on the...
There you can read that better. We got started on the website, which is
what is easy to find. It's on all of the packaging, it's the QR codes.
It's hopefully the go to place.
Right.
You find that you have some short information.
The green tells you how to get to NFC tools.
You need to install that it's an application.
And eventually we will have things here, guiding you to adjust your phone's browser in order to make it capable and compatible with the badge using NFC.
You can kind of read the text is finished, so it's clear enough.
It says there,
platform features, you need to enable the NFC platform features. I'll actually do that now, because it may not be so clear.
But in order to use a web browser like this one, when we're going to type URLs in here and try to interact with one of these badges from a web browser.
That's what we're going to need to do this thing in the blue.
All right, we're going to need to copy this text.
Then we're going to put that up here.
All right.
Let's paste that, shall we.
I'm doing this slowly because Reware said everything's choppy here.
So I'm going to paste.
That didn't work.
So, that worked this time.
All right, so what do we see here. This is where everything turns red, you get warnings.
Experimental web features is what I have enabled there. That's why it's the very first one, it's at the top. You will probably have to scroll down.
Okay, there's all kinds of things here, you can enable, disable, there's web RTC multichannel, you get the idea.
But if you do not have this experimental web platform features enabled.
That just means that you will be limited to using an application like NFC tools.
You can use NFC tools, whenever
whenever your NFC circuit is turned on. That's when you can use NFC tools.
All right, but if you want to use a web browser to access your badge. That's when you need to go to the Chrome double colon flags.
And that's when you need I apologize for this actually it's very uncomfortable, right, this is what most people don't like to do is adjust and configure their phones.
There is a long story to this, I will tell you the short version.
Some manufacturers like Google lock down certain features, they force you to enable them. We were able to until the 29th of July, we had a special key from the, what was it the Google Chrome department that issued us a key as developers.
And on the 29th that key expired. So this is what we have to do since the 29th.
Is this still very choppy RERAR, you want to tell me if it's improved or not.
In any case, this is documented in many places.
Like we saw before, documented here.
And we even put a URL here I believe if you click on that, that it goes to a kind of a explanation about what this is all about experimental API's if you want to read this.
This is kind of for hackers. So if you're not comfortable adjusting and configuring your phone, then you can still use your badge by either waiting for the Chrome origin program for developers to kick in again, because I assume after the 29th it finished
then we will get another key someday.
You can either wait for that or you can use NFC tools, which works out of the box, immediately.
Right.
So, those are the options.
And I'll just emphasize once again that our website up here.
The Bob website.
This will be a method for you to onboard your device.
According to your personal preferences, whether you like the biohacking village more than the red team or the red team more than Monero or maybe you want a combination, which will be possible as well to combine the different village profiles.
All right, so...
See what Rewire says. It will be choppy unless you turn down the quality. All right.
Do I really want to do that? Re-adjust and configure OBS mid-speech?
Oh, God.
I don't think so.
But we've got 10 more minutes.
Okay. Okay. Okay, Justin, I'm going to try this, but I will definitely blame you if this goes badly.
Okay, so let me see if I can do this quickly. There's I've got the video already there.
Okay, Justin, new problem. I mean, I can't adjust anything while I'm streaming.
Right, so I'm not going to do it because turning streaming off and then to get it back on again is going to be three minutes of dead air.
I think you agree that would be a bad idea. So, can't change any settings on OBS while you're streaming.
I will have to change it for tomorrow. Hopefully tomorrow will be less choppy.
All right.
So in, in sense, in a sense, that was the getting started speech.
We covered the first of the two URLs.
And the second, you can hear just read that I mean you can you can go to the second on your own.
It would make no sense to try that now because I'm not an expert.
It's actually kind of hard to read.
Foursuit's game.
So, yeah, if you're feeling creative and you're interested in, in knowing what else the batch can do and how the rogues village is using it, then either wait until Sunday when they explain it in a presentation, or just go to the URL right now download the manual,
free of charge, go to the go there, you know, pretend like you have a badge in your hand if you don't have one.
And that's how you can research and hack a hack around a bit, because after all this is DEF CON.
Isn't that a nice manual, one of the best illustrators and graphic artists in the world made that for us.
And he even she or he even wrote. Thanks for hacking.
Right. Okay, so this was meant to be a very slow and gentle introduction.
And it was the getting started with the village badge.
Tomorrow we will do some impersonation some attacks on our own devices, things like identity cards and two factor authentication devices.
Yeah, there is 10 more minutes. So, if the, if the video was not too choppy.
That you couldn't understand anything.
Then it's now time to ask your question.
You can ask questions on the traditional the official DEF CON channels. Those are all on discord.
Just like you cannot participate in a normal DEF CON year by going to
Canada. You also can't fully participate on a virtual DEF CON year without going to discord. All right.
You can kind of watch these videos on Twitch and YouTube, but really participating, you want to check out those channels on discord. Okay, so maybe there's questions there now.
Let me just take a look.
I don't see any.
On the right channel.
Don't see any questions.
So, I'm going to assume that that we are done. But before I check out for the day.
Going to explain something in case you do have questions later.
So if you have questions later.
About these nifty devices.
Then we have a help desk.
Has nothing to do with DEF CON.
We have a help desk. It's a Monero devices help desk, so it's not manned by staffed employees, right, we're all just volunteers, and it's kind of a community, anyone can join, and everyone is encouraged to provide as many questions with many answers as questions.
Right. Here's a help desk location.
I'm not even going to write the HTTP.
It's calm, it's not org. Okay, just try to remember that.
So you can get it, you can launch questions there.
What else do we have. There's another.
There's this as well.
Since we finished early I'll just run through a few
reused slides. All right, so you want to get a badge, you can find them. There's three places in fact.
There's three places. So maybe
with all the extra time we have.
I maybe failed to mention that if you look there.
You go to the menu see how that works.
On the, on the badge on the, on the Bob site.
So go to the menu.
You've got your shops there. Most of this is working properly.
So let's imagine you'd really like to have have one of these badges you want. You want a full featured.
You want a full featured.
One of the best of the best badges, you go to Cypher Market or Hack 5.
Let's see which one should I choose.
I'm sorry Hack 5 I haven't even.
See if that works. Yeah. Okay, so that's, that's how that works.
Here is Cypher Market.
Hello. Okay.
See how that works. So Cypher Market has more colors.
And if you prefer a, if you prefer a do it yourself model.
Then unfortunately, I couldn't convince the others to list all these different models.
So, couldn't get that done. So the only place where you can get a do it yourself model, that's going to be here on the factory shop.
All right, so those are kind of your rundown of your choices.
The other thing is that this thing here.
This stands for source code management. So this is where all of our open source archives repositories are.
That's very useful as well.
All right, so we're finishing five minutes early which is refreshing. We usually go over time.
This drives AJ and SGP and all of the administrators, drives them crazy. This time we're finishing early.
One more.
One more look at the discord channel, and there's nothing there, which means that we just finished
the getting started with this year's village badge, intervillage badge.
Okay, don't forget that if you're interested, and you have time tomorrow, Saturday, that we have what, not two but only one badge clinic, during which we can talk about some more advanced things
like impersonation, things like that, backing up your data.
And then Sunday we have the same thing. Sunday we'll talk about the game, the rogues village game as well, but that's not on the Monero village. That presentation is happening on the rogues village.
Big surprise.
All right, that's all for today folks and I think we're, you're in luck if you're still watching because if you're not bored to death, because there is still a very important very intriguing speech coming up I'm sure the moderator will tell you but I think Rerar
in fact the famous Rerar is going to give a speech now is that right, or did I get that wrong.
Let me just check quickly.
I know that he's closing the village on Sunday.
And for today.
In fact, Rerar is speaking next, and it should be a good one.