DefCon 23: The Writeup

Well, I'm back from DefCon in sunny and hot Las Vegas, Nevada and more or less reinserted back into my everyday life. I'm just about caught up on everything that happened at work and finally finished the notes that are going to comprise this article. I'll type up the notes I took during the talks at DefCon in a couple of days; they've voluminous and I want to get the experience out of my head and into external storage before the memories fade much more. Unfortunately, I didn't make it to any of the villages so I don't have anything from those. I'm told that at least a few of the village talks were recorded and will be posted to the DefCon Media Server in a month or two. My flight to DefCon was pretty standard, I caught my first flight to Los Angeles and got to my connecting flight just as it started boarding. An hour later I was on the ground at McKarren, found my luggage on the carrol, took the 104 degree Fahrenheit sledgehammer to the face that is Las Vegas in the afternoon, and caught a shuttle bus to the hotel. Unfortunately I'd arrived too late for DefCon's opening ceremonies or Thursday's presentations so my plans consisted of meeting up with everybody and figuring out what to do next. I wasn't able to check into my hotel because Genetik was at dinner with the keycards and Seele hadn't landed yet. Rather than get stuck in a pickle I caught the Vegas Monorail to Bally's and then stumbled around for most of an hour in the thing-that-pretends-to-be-the-city-of-Paris trying to find the restaurant everybody was at. Even enlisting help from other congoers didn't help because we were all equally lost. It was a stroke of luck that I found everybody when I did, though I'll admit that low blood sugar didn't help. The late afternoon was spent catching up with Vlad, Sam, and Genetik, whom I haven't seen in quite a few years. Seele joined up with us later after her flight touched down. Dinner out of the way we headed for DefCon proper to pay admission on the theory that the line was still unreasonably long. Last year, I stood in line for several hours before finally getting a badge but this year a combination of new attendee badging tactics and the late hour resulted in getting into DefCon in less than ten minutes, most of that walking from the restaurant to the front desk. I then received a phone call from some of my cow-orkers who were attending DefCon with me - they ran into problems checking in, and was there anything I could do to help? As it turned out there was a mixup with the length of the room reservation and some coaxing of the front desk (coupled with the judicious use of a fax machine (surprisingly, people still use those)) got them their room keys and into their room with a minimum of trouble. Some time was spent on hold and a little explanation later, and all appeared to be well with the world. All of us met up once again for a late night snack because most of us were still not quite ready for bed (or fueled up from the flight) and then turned in for the evening.The three of us were up bright and early on Friday morning because we were unusually well rested after our travels. After the usual routine of showering, dressing, and packing (or unpacking, really, because at DefCon you should carry as little as you possibly can for the sake of your health if nothing else) we made the block-and-change hike down the Vegas strip to Bally's and the Paris, the two conjoined hotels that DefCon took over this year. The theme of DefCon 23 was a combination of Discordian illuminism, the 23 Enigma, and film noir. Needless to say there were conspiratorial references all over the place. I didn't make it to any of the villages this year, and only to a fraction of the talks, which is only to be expected. With several dozen talks in the lineup it's not physically possible to attend every last one. In this part of the writeup I won't touch very much on the actual meat of the talks, but on their broader context as experiences. The talk by Michael Schrenk was basically an introduction to OSINT, or open source intelligence. While collecting OSINT for various purposes is pretty straightforward, and its analysis something of an art I found the talk somewhat helpful when put into a corporate context (analyzing the bits your competitors leak a