1
00:00:01,420 --> 00:00:08,740
Hey, everyone. Thanks for coming to the party. Show of hands, who here is this year's first

2
00:00:08,740 --> 00:00:19,540
DEF CON? Okay. So we had a DEF CON 101 panel yesterday for newbies. This isn't that. But

3
00:00:19,540 --> 00:00:24,960
what I'm going to do is cover a lot of some of the same stuff. So you'll hear a little bit

4
00:00:24,960 --> 00:00:29,560
of DEF CON history. You'll hear a little bit about what's been going on this year. So with

5
00:00:29,560 --> 00:00:32,780
that said, welcome to DEF CON 31.

6
00:00:38,380 --> 00:00:46,540
So this started as a sort of a party 31 years ago. And the original origin story was

7
00:00:47,240 --> 00:00:52,400
essentially there's a lot of bullshit going around online. Well, in the bulletin board days.

8
00:00:52,720 --> 00:00:54,540
And people would say the most ridiculous

9
00:00:55,480 --> 00:01:00,060
stuff. Like phone phreaking was a thing back then because calling long distance was really

10
00:01:00,060 --> 00:01:05,360
expensive. So people would come up with all these ways to try to make free phone calls. And so

11
00:01:05,360 --> 00:01:12,020
that involved fraud. And so then people would be concerned that maybe they would get traced. Or

12
00:01:12,020 --> 00:01:16,040
the telco would figure out their home phone number. And so there's all this nonsensical

13
00:01:16,040 --> 00:01:21,960
stuff. Like if you run the jammer program, it dials these magical phone numbers and then

14
00:01:21,960 --> 00:01:24,940
nobody can trace you. You're fine. You can do whatever you want. You don't have to worry about

15
00:01:24,940 --> 00:01:28,840
what you want on your home phone. And you'd be like, that doesn't, like, I don't think phone

16
00:01:28,840 --> 00:01:34,920
switching works that way. So when we were trying to figure out the conference, like what are we

17
00:01:34,920 --> 00:01:39,020
going to do at a conference that was originally supposed to be a party but we should, I

18
00:01:39,020 --> 00:01:43,760
really want to dispel a lot of this nonsense. Okay. So we need to find somebody who can

19
00:01:43,760 --> 00:01:50,340
explain to the audience, to the other hackers, why the jammer is not working. And then

20
00:01:50,340 --> 00:01:53,980
people would say stuff like, well, on my bulletin board if I have my home screen and it says,

21
00:01:53,980 --> 00:02:02,940
no law enforcement allowed. And they then connect. That's entrapment. Like, I don't think it

22
00:02:02,940 --> 00:02:08,260
works that way. I think there's probably a way around that for law enforcement. So okay, so we

23
00:02:08,260 --> 00:02:14,960
got Gail Thackery who was the prosecutor at the time who just prosecuted the first cybercrime

24
00:02:15,740 --> 00:02:22,960
case, Operation Sun Devil in Maricopa County, Arizona. So Gail Thackery comes. And then the

25
00:02:22,960 --> 00:02:26,800
internet's a thing. And we're like, gosh, you know, what's going on there? We should get

26
00:02:26,800 --> 00:02:31,660
somebody who really understands that. And so we got Dan Farmer who was the person everybody

27
00:02:31,660 --> 00:02:36,700
wanted to be, the original hacking rock star. He looked like a rock star. He was in charge of

28
00:02:36,700 --> 00:02:43,060
security for Sun Microsystems when Sun was the internet. And he gives a talk about how

29
00:02:43,060 --> 00:02:48,380
problematic it is. As Sun was growing, there's so many computers on their network, he couldn't

30
00:02:48,380 --> 00:02:52,820
spend time on all of them, securing them. So what he's going to do, he's going to try to

31
00:02:52,820 --> 00:02:58,700
write scripts to scan his Sun network to find security vulnerabilities. And it'll be like

32
00:02:58,700 --> 00:03:05,680
the security automation network tool. And it gets him on the front page of Time Magazine. And

33
00:03:05,680 --> 00:03:12,180
that was the first scanning tool called Satan. And so the whole purpose is to try to get you in

34
00:03:12,180 --> 00:03:21,300
front of the people that are doing the thing and trying to dispel the nonsense. And it wasn't a

35
00:03:21,300 --> 00:03:22,800
master plan of mine. It just was a tool. And so we got Dan Farmer, who was the chief security

36
00:03:22,800 --> 00:03:26,600
director. And he's been sort of worked out that way and I've just been smart enough to steer

37
00:03:26,600 --> 00:03:32,020
clear, not mess with it too much. And so that's essentially how we've turned in today,

38
00:03:32,200 --> 00:03:38,900
balancing the partying and the social with trying to get you the technical. The other thing is

39
00:03:38,900 --> 00:03:43,380
we try to do is as we've grown, we've realized that we've turned into like a conference of

40
00:03:43,380 --> 00:03:49,440
conferences. We're like a meta conference. And so Def Con, the main Def Con, we spend a lot of

41
00:03:49,440 --> 00:03:52,780
time trying to figure out who to give space to. Who to give space to. And so we've gotten a lot of

42
00:03:52,780 --> 00:03:59,560
stage time, who to platform, literally put you on the platform. And so that's why you'll see

43
00:03:59,560 --> 00:04:04,220
churn. You'll see a contest come and go. You'll see a village try something for a few years and

44
00:04:04,220 --> 00:04:09,280
go. And if you do well, we'll give you more space. And if you don't do well, you get less

45
00:04:09,280 --> 00:04:19,480
space. And it just organically grows and morphs over the years. So all of this is possible

46
00:04:19,480 --> 00:04:26,520
because of goons. We have over the people in the red shirts, we have over 500 goons that make

47
00:04:26,880 --> 00:04:38,320
the onsite operations possible. So yay, goons. Give it up. It's pretty fantastic because,

48
00:04:38,460 --> 00:04:43,120
you know, once you're in the goon brotherhood, you're sort of like one of us. But we don't

49
00:04:43,120 --> 00:04:49,100
give a shit who you are in the real world. Right? And so you'll have, like, CSOs of billion

50
00:04:49,100 --> 00:04:49,460
dollars a year. You'll have, like, a million dollars a year. You'll have a million dollars a year.

51
00:04:49,460 --> 00:04:52,860
You'll have a lot of companies crawling around pulling network cable. You'll have head of

52
00:04:52,860 --> 00:04:57,840
procurement for the Department of Defense for a while was pulling cable for years. And they just

53
00:04:57,840 --> 00:05:03,380
want to hang out and kind of be with their peeps. And so that's what's also pretty cool, is you

54
00:05:03,380 --> 00:05:11,200
never know who you're talking to. And that's part of the fear and excitement of who's next to

55
00:05:11,200 --> 00:05:18,920
you. The other thing is it takes over probably 1,500, about maybe 1,500 or more, maybe 2,000

56
00:05:18,920 --> 00:05:27,400
people, the people creating the content. Right? The creators. There's almost 2,000. They run

57
00:05:27,400 --> 00:05:34,540
contests and events and villages. They run stuff online. They build art. They play music. They

58
00:05:34,540 --> 00:05:43,300
design infrastructure. They build this podium, a great art collective. So there's tons of people

59
00:05:43,940 --> 00:05:48,720
that give so much of themselves to make this happen. And if you notice, you know,

60
00:05:48,920 --> 00:05:54,260
we're not super slick. We don't spend a lot of money on a whole lot of what I consider sort of

61
00:05:55,100 --> 00:06:02,620
unimportant sort of puffery. We try to keep the price as low as possible. I can't control the

62
00:06:02,620 --> 00:06:09,300
economy. I'm really sorry about the price increase this year. But we try to focus on the things

63
00:06:09,300 --> 00:06:15,400
that we think matter. And that's supporting content creators, supporting goons, and trying to,

64
00:06:15,690 --> 00:06:18,900
you know, fund our legal defense. Paying sure that we don't have to pay for the

65
00:06:18,920 --> 00:06:28,000
insurance companies. So we can keep this going. And because of that model, we had enough money

66
00:06:28,000 --> 00:06:34,200
saved in the bank to survive COVID, which is fantastic. I'm just a compulsively worrier on a lot

67
00:06:34,200 --> 00:06:39,720
of things. But that allowed us to do the DEFCON 28 for free online. It allowed us to survive to

68
00:06:39,720 --> 00:06:46,900
DEFCON 29. And here we are again, back up to full speed. And that's because we just try to focus on

69
00:06:46,900 --> 00:06:48,900
our core. And the community is really important. And I think that's why we're here today. We're

70
00:06:48,920 --> 00:06:54,500
here because it's really our core. And if you think about it a little bit, our community, this

71
00:06:54,500 --> 00:07:00,280
community right here in the room, we've become more, I would say, relevant and more important

72
00:07:01,540 --> 00:07:08,180
over the last probably five or ten years. And it's, I feel a little uncomfortable saying that,

73
00:07:08,360 --> 00:07:15,720
but it's true. After this talk, I'm having a conversation with the Secretary of Homeland Security.

74
00:07:16,440 --> 00:07:18,900
Like, he's not coming here because he wants to. He's not coming here because he wants to. He's not

75
00:07:18,920 --> 00:07:23,160
going to. He's not leaving because it's unimportant to the department. Right? It's, like, what

76
00:07:23,160 --> 00:07:29,260
we're doing is relevant not to just our country but to countries around the world. And I think

77
00:07:29,260 --> 00:07:36,500
that's because Internet problems are really global problems. And now we're seeing AI problems are

78
00:07:36,500 --> 00:07:43,280
going to be global problems. And we sort of are acting as this sort of third

79
00:07:49,200 --> 00:07:54,580
the lock manufacturer is not going to tell you that their lock is a piece of shit. Right?

80
00:07:54,740 --> 00:07:59,400
Like every master lock, you read that master lock thing and it's like this is the best thing

81
00:07:59,400 --> 00:08:03,820
in the world. It will keep the pink panther out. And then you go to the lock picking

82
00:08:03,820 --> 00:08:08,760
village and it's like boop, done. No, no, wait. There's more to it than that. You're like

83
00:08:08,760 --> 00:08:16,340
a professional. No, I just sat down five minutes ago. See, look. It's open. Well, who's

84
00:08:16,340 --> 00:08:20,540
talking about this? Well, the government doesn't regulate locks and the lock manufacturer

85
00:08:20,540 --> 00:08:26,420
doesn't and they have a marketing budget. Locksmiths are very protective of their

86
00:08:26,420 --> 00:08:32,040
territory. Right? So who talks about locks? Well, it's us. It's our community started

87
00:08:32,040 --> 00:08:37,400
talking about picking locks and safes. Access control. Who was talking about access control

88
00:08:37,400 --> 00:08:45,220
systems? Implanted medical devices? That was DEFCON. Right? Insulin pump talks. Automotive,

89
00:08:46,000 --> 00:08:46,320
aerosols. I don't know. I don't know. I don't know. I don't know. I don't know. I don't know. I

90
00:08:46,320 --> 00:08:49,320
don't know. I don't know. There's a lot of space, right? And so what's happening is the

91
00:08:49,320 --> 00:08:54,580
dynamic is companies don't have a financial incentive to reveal their problems. Organized

92
00:08:54,580 --> 00:08:59,260
criminals taking advantage of those problems definitely don't have an incentive to tell the

93
00:08:59,260 --> 00:09:03,440
world how they're using the technology to steal money or commit crimes or espionage.

94
00:09:04,360 --> 00:09:08,120
Government agencies half the time might be using those exploits for law enforcement

95
00:09:08,120 --> 00:09:14,200
purposes, but that's fine. Pursue your law enforcement objectives, but I just want to be

96
00:09:14,200 --> 00:09:16,300
able to buy a better lock. You know what I mean?

97
00:09:16,300 --> 00:09:22,720
know i want things to get better in my lifetime and so it's up to us hackers researchers academics

98
00:09:23,460 --> 00:09:31,020
we're the ones that are speaking truth to power and telling the world what works and what doesn't

99
00:09:31,020 --> 00:09:38,480
work and why and i think that function has only gotten more important as the technologies become

100
00:09:38,480 --> 00:09:45,240
more embedded and now with ai we're going to become more relevant space right so yeah have

101
00:09:45,240 --> 00:09:51,000
a party and hang out and meet people but remember also what you're trying to do is you're trying to

102
00:09:51,000 --> 00:09:57,520
help make society a little bit better by speaking truth to power and it's not easy right we had a

103
00:09:57,520 --> 00:10:02,820
couple talks pulled this year intimidation from giant corporation lawyers involved people

104
00:10:02,820 --> 00:10:08,460
threatening to quit get fired i mean every year there is a tension between companies trying to

105
00:10:08,460 --> 00:10:14,680
protect themselves and researchers trying to reveal information and that's why we have friends

106
00:10:14,680 --> 00:10:15,220
like the like the like the like the like the like the like the like the like the like the like

107
00:10:15,240 --> 00:10:21,400
electronic frontier foundation in coders rights where they are the experts right if you have a

108
00:10:21,400 --> 00:10:24,680
question or you're feeling intimidated or you're not quite sure if you should do something

109
00:10:25,240 --> 00:10:32,020
the eff has been with us for decades and they're there to fulfill their role in our community to

110
00:10:32,020 --> 00:10:37,960
help be the legal protectors so also want to give a shout out eff yay good job guys

111
00:10:45,240 --> 00:10:50,260
so um a couple operational things for the show this year um every year since the very first one

112
00:10:50,260 --> 00:10:57,380
we always try to make things better and sometimes it works and sometimes it doesn't um and so for

113
00:10:57,380 --> 00:11:04,680
example this year there's a lot of questions right the badges are still arriving and our plan

114
00:11:04,680 --> 00:11:10,060
is to as we get more real badges from the manufacturer we'll be doing swap outs and

115
00:11:10,060 --> 00:11:15,060
normally what a swap out entails is goons walking around with big bags of badges and if they see you

116
00:11:15,240 --> 00:11:21,100
with a the wrong kind of older paper badge or plastic badge temporary badge they'll swap it out

117
00:11:21,920 --> 00:11:28,200
or we'll put them at the info booths but our plan is as we get more in we'll be doing swap outs

118
00:11:28,200 --> 00:11:32,600
we even have somebody we're trying to figure out how to fly them on an airplane

119
00:11:33,300 --> 00:11:39,180
on on a sunday morning to fly back here from the facility with boxes to try i mean we're

120
00:11:39,180 --> 00:11:44,780
doing everything we can to untangle it but when it's all said and done if you go to the

121
00:11:44,780 --> 00:11:50,780
badge um talk you can hear the see the pictures and hear the gory details if you kind of are like

122
00:11:50,780 --> 00:11:58,040
a you know into accident porn um but uh so i hope that doesn't you know start your vibe off wrong

123
00:11:58,040 --> 00:12:04,500
but every year we alternate between an electronic badge and a physical badge and the reason is

124
00:12:04,500 --> 00:12:11,340
electronic badges are expensive and complicated and physical badges are generally less expensive

125
00:12:11,880 --> 00:12:14,640
also complicated and it's a way of us trying to balance our

126
00:12:14,780 --> 00:12:22,720
budget um over the long run but um defcon 29 it was an electronic year defcon 30

127
00:12:24,540 --> 00:12:28,880
it's an anniversary year of course we have to do electronic badges so we did two years of

128
00:12:28,880 --> 00:12:33,340
electronic badges and so now the new tick tock cycle of going between electronic and physical

129
00:12:33,340 --> 00:12:38,020
electronic is starting again so next year it'll be an electronic badge and the problem with that

130
00:12:39,200 --> 00:12:43,140
since we originated and invented the electronic kind of badge joe grand

131
00:12:44,780 --> 00:12:49,720
you guys the community have totally outclassed us on some of the electronic badges because we

132
00:12:49,720 --> 00:12:54,620
have to produce like 26 000 of them or something and a lot of these cooler badges they'll produce

133
00:12:54,620 --> 00:13:00,280
like 200 and you just can't compete with that so we're always trying to do instead

134
00:13:00,280 --> 00:13:08,340
something new aluminum one time we did flexible badges we always try to add something that we can

135
00:13:08,340 --> 00:13:13,760
get our hands on quantity 26 000 that you can't get your hands on it you know quantity 200. so

136
00:13:14,780 --> 00:13:20,000
that's a very exciting give and take in the badge space and that kicked off the hardware hacking

137
00:13:20,000 --> 00:13:27,120
village and a lot of other stuff and it it okay i'll just dig i have five minutes left but i

138
00:13:27,120 --> 00:13:31,880
really want to tell the story because it might be instrumental in our future battles with ai

139
00:13:32,720 --> 00:13:38,040
i was thinking all the movies and books you read the hackers the people fighting against

140
00:13:38,040 --> 00:13:42,360
the evil intelligence or whatever they always seem to know how to like fight back

141
00:13:44,900 --> 00:13:51,160
nobody knows how to really hack hardware. So if we need to incubate the next generation to be

142
00:13:51,160 --> 00:13:56,580
able to fight the terminator, how are we going to do that? And we're like, oh, an electronic

143
00:13:56,580 --> 00:14:00,500
badge. And then we'll get people to hack on the electronic badge and it will be very simple and

144
00:14:00,500 --> 00:14:05,500
over time it will get more complicated. And it worked. It totally worked like that. Everybody

145
00:14:05,500 --> 00:14:09,480
was messing around with LEDs one year and five years later they're making drone badges that fly

146
00:14:09,480 --> 00:14:16,560
around. It was amazing. And so again, we can plant seeds and see what the community does with

147
00:14:16,560 --> 00:14:24,780
them and also hopefully prepare to defeat our overlords. There's a lot of things going on here

148
00:14:24,780 --> 00:14:33,460
and info.defcon.org is the main repository for like all the schedule updates. The data from

149
00:14:33,460 --> 00:14:39,460
info.defcon.org feeds hacker tracker app on your phone. So if you're using hacker tracker it's

150
00:14:39,480 --> 00:14:44,580
all the same data. One is more in a web presentation, the other is mobile. If you're in

151
00:14:44,580 --> 00:14:49,140
your hotel room, we have DEF CON TV. You're just hungover or broke your foot walking too

152
00:14:49,140 --> 00:14:56,980
many feet. TV channels, we stream to all the con properties, all the five tracks. So if you

153
00:14:56,980 --> 00:15:01,660
feel like it's too crowded, you can just chill in your room, have a room party. DEF CON TV

154
00:15:01,660 --> 00:15:06,840
also, we're streaming certain tracks based on bandwidth out to everybody to Internet for

155
00:15:06,840 --> 00:15:11,860
free. That's another big thing we do with DEF CON is I try to release all the talks,

156
00:15:12,020 --> 00:15:22,420
everything is free. And the origin of that was because I got lazy. I recorded DEF CON 1 on

157
00:15:22,420 --> 00:15:27,320
audio tape and I was selling the audio tapes to help make money and after a couple of years,

158
00:15:27,400 --> 00:15:32,720
I just didn't want to do that anymore. And so we used real networks and we just released the

159
00:15:32,720 --> 00:15:36,820
content for free. But in doing that, and then when you bring the data into the media, you

160
00:15:36,820 --> 00:15:41,700
when I started Black Hat and we released the Black Hat content for free, accidentally what

161
00:15:41,700 --> 00:15:47,320
we're doing is we're creating a culture of sharing information for free. And that culture

162
00:15:48,040 --> 00:15:54,140
started, what, 30 years ago. And that's why, like, nobody thinks twice about, well, of

163
00:15:54,140 --> 00:15:59,200
course I give away the content. Again, I would like to think that that was a master plan. It

164
00:15:59,200 --> 00:16:06,080
was not. I was being lazy. Right? But now we get all this stuff for free. It's great. So

165
00:16:06,820 --> 00:16:12,220
feel free to share and feel free to use our online resources. We've been running the DEF CON

166
00:16:12,220 --> 00:16:17,280
forums for over 25 years. And online activity has come and gone over the years. Now it's more

167
00:16:17,280 --> 00:16:24,400
like on our DEF CON discord. You'll see in your bag we started a mastodon server, DEF CON dot

168
00:16:24,400 --> 00:16:31,620
social. Once the Musk started wrecking Twitter, we needed an escape hatch. So that's DEF CON dot

169
00:16:31,620 --> 00:16:36,160
social. And if that takes off and people like it, we might do, you know, there's a distributed

170
00:16:36,160 --> 00:16:43,380
version for, like, a Reddit replacement and a pixel fed for Instagram. Well, think about do we

171
00:16:43,380 --> 00:16:53,360
want to run more services to support the community. And let me see. Final thoughts. We were one

172
00:16:53,360 --> 00:16:57,920
of the first, I guess, in information security conferences to have a code of conduct and a

173
00:16:57,920 --> 00:17:05,100
transparency report. And I'll just briefly touch on those. The idea with our code of conduct is as we

174
00:17:05,100 --> 00:17:11,820
grew and people got a little bit more sophisticated in sort of evading appropriate behavior, we

175
00:17:11,820 --> 00:17:15,900
really needed to say, hey, this is what we stand for. This is our code of conduct. We spent money

176
00:17:15,900 --> 00:17:20,820
on lawyers. We got it reviewed. And we tried to create it as a model that other conferences

177
00:17:20,820 --> 00:17:27,600
could take, take what they liked out of our code of conduct, make it their own. But that's half of

178
00:17:27,600 --> 00:17:32,560
the problem, right? We have a way of you identifying that there's a problem, reporting a code of

179
00:17:32,560 --> 00:17:35,080
conduct violation, say, through our hotline or a talk show. We have a way of you identifying that there's a problem, reporting a code of conduct violation, say, through our hotline or talk

180
00:17:35,100 --> 00:17:45,680
into security goons. But if we don't hold ourselves accountable publicly, then you might not trust anything we're saying. So our transparency report was

181
00:17:45,680 --> 00:17:54,580
launched where we started in a sort of sanitized way saying this is how many people we kicked out, this is how many drunk accidents, this is how many allegations of just

182
00:17:55,100 --> 00:18:04,840
nobody knew in the conference world, like, is it prevalent or not? Is there a lot of abuse or very little abuse? Nobody knew. And we figured being data geeks,

183
00:18:05,100 --> 00:18:13,780
we gotta collect the data. And if we collect the data, we gotta share the data. And so that's where the transparency report comes on. You'll see every once in a while we kick out

184
00:18:13,780 --> 00:18:26,080
goons, code of conduct applies to goons and creators just as it applies to attendees. I see you there. And so what I want you to think about is, you

185
00:18:26,080 --> 00:18:34,780
know, we're not perfect, but if you see something, please report it. If you're feeling like you're under stress or having troubles, you know, it's too overwhelming,

186
00:18:35,100 --> 00:18:41,400
we have a hotline of trained professionals to help you deal with issues. So please take

187
00:18:41,400 --> 00:18:45,620
advantage of this. And if you look at it from the big picture, all we're trying to do is

188
00:18:45,620 --> 00:18:50,580
we're trying to build a bigger, safer community so we can all hack on shit. Right? And

189
00:18:50,580 --> 00:18:55,060
that's what it's about. So thank you for coming to 31. I hope you have a great time.