The two biggest hacker conferences in the world take place during the same week every year in Las Vegas.
Referred to as “hacker summer camp,” Black Hat USA and Def Con last week brought together hackers, information security professionals, and government agents.
This year, more than 22,000 people showed up to see talks, buy tools and t-shirts, and enjoy Sin City. They also crammed into various villages at Def Con to compete or learn things like lock-picking and safekeeping their online privacy.
Here’s what went down.
My time in Vegas started at the Black Hat USA security conference, which was held at the Mandalay Bay Convention Center.
Black Hat and Def Con are closely related, since they were both founded by Jeff Moss (aka The Dark Tangent). DC was his first conference, which began in 1993. He started Black Hat in 1997.
Attended by about 15,000 people this year, Black Hat features briefings, training, and networking opportunities for those in the information security community.
It draws a mostly professional crowd. There were plenty of 'white hat' hackers on hand, who help companies keep out the bad guys, as well as those who work for the government.
But there are plenty of worthwhile talks to check out. I especially enjoyed a talk on the cyberwar aspects of the war in Ukraine, the science behind email phishing attacks, and whether it works for hackers to USB drives for some unwitting person to pick up and plug (it does).
There was also a great talk by researchers at NCR Corporation, who revealed major vulnerabilities within the new chip credit cards, also known as EMV.
And there were hundreds of vendors there trying to hawk products to companies who worry about being hacked.
On my first day in town, that was Alice in Chains playing at the House of Blues. There were hundreds of Black Hat attendees there enjoying a free (and awesome) concert courtesy of Cylance.
The party's free booze meant a different ending than what I had in mind. The new friend I met before the concert got blackout drunk and I had to carry him around Vegas to get him back to his room. You know who you are, and you owe me.
After 3 days of Black Hat, it was time to move over to Def Con 24, a very different conference. 'Def Con is like a juggalo carnival,' one grey hat hacker told me before I went. (A 'grey hat' hacker plays both sides of the hacking world -- sometimes they help companies and people protect themselves, sometimes they cause mischief or do illegal things.)
Unlike Black Hat, there's no prior registration at Def Con. You have to just show up and get in line with $240 cash on hand. Press, vendors, and speakers go in a different line than paying attendees.
With tens of thousands of people showing up, many attendees wait for hours in line to get their badges. They even call it 'LineCon' since it's a great opportunity to get to know a fellow hacker and ask what they like to do.
The big event on Thursday night was historic. DARPA sponsored its Cyber Grand Challenge, where 7 autonomous supercomputers went head-to-head in a hacking tournament.
The computers found bugs in software without any human control, while also trying to hack their counterparts. 'If we were to talk about something like this 15 years ago, we would have been talking about science fiction,' said Visi, a hacker who was giving the play-by-play.
The winning team was ForAllSecure with its system, Mayhem. For their efforts in developing computers that find bugs faster than some humans can even open a file, they took away $2 million.
Once Def Con officially kicked off, it was a race for some to get to talks, the contest areas, villages, or -- the swag line. Some people waited for 3+ hours just for an official t-shirt, since many of the sizes would sell out in the coming days.
And most -- if they were smart -- turned off WiFi and Bluetooth, or at a minimum used a VPN while surfing the net. Otherwise they might have ended up on the 'Wall of Sheep' featuring unencrypted web traffic being sniffed in real time, such as usernames, passwords, and other info.
I attended quite a few talks while I was there, including one by Ladar Levinson, the founder of the Lavabit encrypted email service. He talked about his case -- in which the government demanded he turn over encryption keys so it could read Edward Snowden's emails. He shut down the service and fought on.
There was also some somewhat frightening research about how one could defeat Tesla's various sensors. 'Normally the car will move. However, we jam the sensor and it moves,' Chen Yan said. 'It hit me,' he added, to audience laughter.
One talk claiming to expose 'critical flaws' in airline navigational aides, radar, and the Traffic Collision Avoidance System (TCAS) was mysteriously cancelled at the last minute. The (unconfirmed) rumour going around was the government hit the speaker, Sebastian Westerhold, with a cease-and-desist. Neither Def Con or Westerhold responded to an email for comment.
(video provider='youtube' id='IMx62E4-hcM' size='xlarge' align='center')
Many attendees skip the talks, since they will show up online later. The big draw of Def Con is the stuff you don't see at other conferences, like hacking tournaments, scavenger hunts, and villages that teach lock-picking or social engineering.
But attending the talks is great for meeting some of the world's smartest people. 'The vast majority of attendees are feds and white-hat hackers. If you're a criminal, you don't go where all the feds and good guys are going,' Moss told InformationWeek in 2007. During the closing ceremonies for example, I sat across from ...
This guy. That's Rob Joyce, the chief of NSA's Tailored Access Operations -- the top hacker unit of the US government. Unfortunately he left the room before I could grab a photo with him and tell everyone 'I spotted the Fed' -- another contest Def Con runs as a fun game of cat and mouse between government agents and hackers attending.
Over in the lock-pick village, experts from The Open Organisation of Lockpickers (TOOOL) were teaching amateurs like me the basics of defeating locks.
The social engineering village was also a big hit, as usual. Unfortunately they do not allow recording or photos of any kind, but here's what happens: They put a hacker in a soundproof room as the audience watches them capture 'flags' of information from people over the phone, like the operating system they use, or whether they use antivirus software. The SE Village is just a game at Def Con, but the method is a common one hackers use.
At the Internet of Things (IoT) village, hackers were busy testing a slew of 'smart' devices for vulnerabilities. The organisers said at the end of it all they had uncovered more than 40 issues that would be disclosed to the device manufacturers.
Beyond all that, Def Con was also a vibrant marketplace where people could buy t-shirts, books, and hacker tools.
And just like Black Hat, Def Con had plenty of party opportunities, like one featuring a performance from hip-hop group Dual Core. One of their songs featured the lyric 'drink all the booze, hack all the things' -- an unofficial motto of attendees here.
I also attended 'Hacker Jeopardy,' where teams win points not only for getting questions right, but also for the amount of beer they can drink. The scantily-clad women serving the beer and racy categories caused some controversy this year, with some complaining the event was overtly sexist.
The conference is overwhelmingly male, though this year it hosted its first ever 'TiaraCon,' a conference within the conference to help women advance in cybersecurity. Still, some women attendees complained of harassment that was ignored by Def Con volunteers (called 'Goons'), which founder Jeff Moss said was 'unacceptable.'
Though it wrapped up last week, the conference organisers have already said next year's event -- which will be the 25th anniversary -- is leaving the Paris and Bally's hotels for the larger Caesar's Palace.
Business Insider Emails & Alerts
Site highlights each day to your inbox.