#bsideslv

[alcyjones]

#blackhat2019 Let’s go!!! Hoje ainda tem #BSIDESLV e dia 08 começa a #DEFCON (at Mandalay Bay Resort and Casino) https://www.instagram.com/p/B03prJbHD68/?igshid=14mao4kohdl05

[shesareb3l]

Two statelines crossed so far. Viva las #BHUSA #BSidesLV #defcon. #adventure

[mainframed767]

Speaking at DEFCON 22 – So close!

This is the fifth article in an eight article series about getting to speak at DEFCON 22. 

So I had just completed submitting to DEFCON 21. At the same time, I had submitted talks to BlackHat and the BSidesLV Underground track.

The BSidesLV Underground track is one of my favorite things. It’s an entire conference track without any coverage, no recordings and talking about topics you wouldn’t be comfortable talking about publicly. During my readings of the Logica breach I found my email address. Just chillin’ on my couch and I see my emails address and I lose my shit until I see the date of the FBI requests were from a year before I had even started speaking publicly. Not only that but they already had a suspect in custody so I guess I was cleared at some point. But, people were contacting me with other behind the scenes information about the case, etc. I wasn’t comfortable talking about the breach publicly, not until someone was convicted. But I wanted to share, so I gave a talk in the Underground track which was a great experience.

Now, when I submitted to BlackHat I figured it was a super long shot. It was about hacking and securing the platform (z/OS) and I had assumed I was waaaaay too amateur hour for BlackHat. I had never written a white paper before either. Sure I’d written articles but nothing with a company letterhead or anything that was of a professional caliber. At this point I’d spoken at multiple conferences ( Bsides, Thotcon, Shmoocon etc) but to me BlackHat was the big leagues. I assumed you needed to do something amazing and I always thought the work I was doing was small-fry. But I submitted anyway because frankly this platform is too critical to get caught up in my insecurities. The world needs to know about the platform, and security experts need to be taking this platform seriously, not avoiding it because "it’s legacy” is not really an option anymore.

So, here’s where I was mentally at the time when it came to Hacker Summer Camp 2013:

BSidesLV: Sure Thing

DEFCON: Sure Thing

BlackHat: Long Shot

 So imagine my surprise when this happened:

But then the obvious happened:

Here’s the full rejection email.

This time around I got great feedback from the DEFCON folks about why it was denied. I was heartbroken, but I was talking at both BSides and BlackHat so I didn't feel that bad.

One interesting thing I learned about this process is that if you’ve been accepted to give a talk at BlackHat you might not be able to speak at DEFCON:

This is accepted at Black Hat and considering the content embargo it is an issue in acceptance or not. We are only allowed a small amount of duplicate talks that they will agree to allow their speakers to present at DEF CON.

With the decision made for me, I decided to dedicate myself to the best I could do at BlackHat and BSides, and truth be told, I had a great time giving these two talks.

At my BlackHat talk I asked a straw poll about how many people audit/test mainframes vs who many have actually configured one and the answer was less that 1% of the people in the room. There’s a cool article about it on Dark Reading! This was also the first time I was talking to a packed room, I mean standing room only. By the end of my talk it was full of people and I only released a few new tools (most notably Catso, pSikOTik and TShOcker.py) 

After my BlackHat talk I wasn’t really feeling BSides. I was coming down from a high of talking at BlackHat, I felt like my slides weren’t really that great and that the talk was going to be shit. A story I tell is I was feeling so down I went to the casino floor to just kill time at the penny slots. I bought a diet coke for $5 (yes, in Vegas, on the Casino floor I paid for a non-alcoholic drink) and then went to the first penny slot I saw. Put in my $20, made a low bet and won $30. I was feeling so sorry for myself I couldn’t even gamble right. I took my $50 and now $3.50 worth of diet coke, went back to my room, grabbed my laptop and went to BSides.

At BSides it was one of the last talks of the conference. So I spent the afternoon drinking free booze and waiting to give my talk with Chris and other friends.

By the time my talk slot came up I was feeling a hundred times better and gave a seriously awesome talk. Something’s a little freeing about not having to worry about a camera filming you. My talk also dealt with area’s I’d never talked about before and the audience was super engaged, to the point where people were helping with translation of slides live (you see, a bunch of the stuff I was dealing with was Swedish, like Kuku.rx to me means nothing, but apparently it means cock). 

After Hacker Summer Camp 2013 I was pumped, I had met a bunch of people, had some articles about me published and released a bunch of new tools. I was also starting to get through the remainder of the Logica breach file fragments, starting to piece some of the exploits together and understand what was going on. Which was good because I was going to be speaking at a conference in Sweden where little did I know I would be drinking with the very people who had put me under investigation in 2012. 

[mainframed767]

Speaking at DEFCON 22 – BSidesLV and an Awesome Mentor

This is the third article in an eight article series about getting to speak at DEFCON 22. 

I submitted the talk I wanted to give at DEFCON to the BSidesLV Mentor Program. The Mentor program is a really amazing thing and I can’t sing enough praise for it. I was paired with Nicolle (aka Rogue Clown: https://twitter.com/rogueclown) who was a really amazing mentor. Giving me the information I needed and emotional support I didn’t even know I needed to give a talk publicly.

My first slides, the ones I sent to DEFCON, were, in a word, shit. I don’t even know what I was thinking including those in my CFP. Luckily my mentor and I worked on better slides, culminating in the talk I gave at BSides:

During that time one thing I realized was that the TSO logon screen allows for user enumeration. I had planned on talking about it in my BSidesLV talk but she suggested a demo would be better. I spent a little bit of time working on a script (a weekend or so) and now had not just a (boring) John the Ripper demo but also a way to enumerate users.

Another thing she helped me out with was all the ancillary things I never even thought about. When speaking internally you don’t have to put your email, or twitter, or whatever. I didn’t even have a slide showing my contact information in case someone wanted to know something after my talk. Nor did I have a website with links to further research, or a blog, or anything. Stupid newbie stuff I never would’ve caught without her help.

The first day of BSides she introduced me to @az2600. We hit it off and basically partied every night that week. We've partied now every year and even shared a suite this year. This is one of the tangible items you need to take advantage of in the mentor program, the networking opportunities. 

On the day of my talk Nicolle was there, in the standing room only (30 people MAX) ‘conference hall’. I was so nervous I barely slept the night before, I had rehearsed till I knew the slides cold, and I had even given the talk internally. But what I wasn’t ready for were the nerves that come with talking to an audience of strangers plus a camera.

Because I was nervous I said ‘OK’ after the first 10 slides. I kept trying to make crappy jokes and wasn’t as ready as I thought I was. But I made it through and was hooked. I loved the experience and couldn’t wait to speak again.

One of the side effects of the BSidesLV Mentor Program is your mentor introducing you to new people. I’ve made some lasting friends based on being introduced to people at my first talk at BSides.  

To Nicolle (and the BSidesLV mentor program) thank you. Without your help, guidance and support I wouldn’t be where I’m at today. 

After this, I was far from done, now I had had the bug and wanted to talk at all the cool conferences I'd heard of, and only dreamed of attending!

[mainframed767]

Speaking at DEFCON 22 – I Need a Wow Moment

This is the second article in an eight article series about getting to speak at DEFCON 22. 

So I got all my shit together and was ready to present but I needed a WOW moment. Something that hasn’t been done to show how un-unbreakable the platform was.

 At this point I was stuck so I emailed the community. I tried Paul Dot Com (http://mail.pauldotcom.com/pipermail/pauldotcom/2012-February/008387.html) and John the Ripper:

And got one reply. One. From Dhiru Kholia. But together we still couldn't figure it out. In an email to Dhiru I said:

So either RACF has a funky implementation of DES or I misunderstood how they're creating the key. Any help would be appreciated. My ultimate goal is to make auditing RACF passwords as easy as other passwords and not having to rely on having a test mainframe system around to run costly tools like PWCHECK.

Basically, when I created a user ‘AAAAAAAA’ with the password of AAAAAAAA I was getting a funky password that I couldn’t recreate with DES in python. So I wrote a brute force script that would add one bit do each letter and let it go for days. And after about 5 days the hash in RACF and the script matched. I was elated because we finally had something to work with.

 Then, Nigel Pentland emailed Dhiru and I with the obfuscation algorithm and then, literally that day, Dhiru emailed me a patch to test and that week John the Ripper supported RACF hashes.

 And that was that. I took the algorithm, my knowledge of z/OS as a platform and made an hours’ worth of slides. Then I filled out the DEFCON 20 CFP and started preparing for giving a talk at DEFCON.

 I was super excited about talking at DEFCON, little did I know it wasn’t going to happen for three years. A few months later I get an email. And excitedly open the acceptance letter:

  Oh. 

I was disappointed and shocked (but I shouldn’t have been). However, I was lucky enough to still have time to submit to BSidesLV. 

[mainframed767]

Pictures of me giving my talk at @BSidesLV. Thanks to @az2600 for the mad camera skillz

Video available here of the talk in question: http://www.irongeek.com/i.php?page=videos/bsideslasvegas2014/bg13-we-hacked-the-gibson-now-what-philip-young

[mainframed767]

Notes I made on what I wanted to talk about in my #DEFCON talk. Most of it didn't end up in the talk (damn you 20 minute time limit!) but the important stuff did. Most everything else ended up in my #BSidesLV talk: http://www.irongeek.com/i.php?page=videos/bsideslasvegas2014/bg13-we-hacked-the-gibson-now-what-philip-young

[mainframed767]

Please Don't Let Me Be The Only One

This is for @BsidesLV 2014. If you know legacy system security inside and out, or maybe you have an interest in how to go about profiling legacy apps, or perhaps a study in the proliferation of these systems in the enterprise, etc ,etc, etc it would be awesome if you could give a talk at BSidesLV 2014 this summer in Las Vegas. 

But I've never talked publicly!

Neither had I until I gave my first talk at BSidesLV 2012. BSides is THE BEST place to give your first talk. The room is not a monster conference hall but still large enough to accommodate a good amount of people. But besides that it's really the only conference that has a mentor/mentee track (called Proving Ground). It's how I got my start and was the best thing to ever happen. My Mentor (@rogueclown) was amazing, supportive and very helpful. 

Well I have some interesting things but not a talk!

That's cool too! The mentor program is there to help you take your rough cut diamond and make it a jewel (ugh, that's a terrible metaphor but at least it's not one based on cars). The worst thing you can do is not submit a talk because then you'd never know if it was any good in the first place. Your mentor will be there to help get you away from '3 bullets per slide' and 'spend a minute on each slide' to 'amazingly dynamic and interesting talk'.

That sounds good but I hate public speaking >:-(

So does everyone else. No one really likes doing it, even if they look like they do or tell you they do, they don't really like it until after the talk is over. But you won't have to go it alone! Your mentor attends the talk, will help get you ready and psych you up so you give the best talk you can give!

Hrmm, well could you give an example?

Here's my favorite example. Sixteen Colors is a site that has stored and shares the ANSI art packages from the past. The person who runs the site and I had talked on twitter and I convinced him to submit a talk (which you can watch here) to Proving Ground. It was accepted and was a really great talk. Lord Scarlet (the guy who runs Sixteen Colors) needed a little more convincing to submit but was glad he did. And even though the talk had nothing to really do with security it was still a very interesting and all around great talk. 

Okay, I'm in!

Great! The process is really easy. Go to the BSidesLV mentor CFP page and submit a talk! That's it. But do it before May 15! Then, if your talk is accepted, you'll get assigned a mentor and they'll work with you to work the slides, help you rehearse your talk and get you ready for your very first public speaking engagement. Afterward they'll help you drink. 

-=-=-=-=-=-=-=-=-=-=-=-

Okay, enough about me fawning over the program, here's the details from BSidesLV itself:

We at BSidesLV are again providing a unique opportunity for first time speakers.  Our “Proving Ground” tracks’ main acceptance criteria is being a first time national conference speaker and as we all know how hard it can be to find your voice, or even to just translate data into talking points that won't lose your audience, we are looking to pair each of the Proving Ground candidates up with a mid to high profile mentor, with a solid track record of conference speaking, who will work with them from CFP to podium.

The process works like this: the Proving Ground CFP is now out, potential speakers are asked to submit an abstract for a 20 minute talk that they would like help preparing for presentation. Once they have made it past our CFP review team, they will be passed on to the Mentor List, where the potential mentors will be able to choose who they want to work with, based on area(s) of expertise and experience. The mentor will then work with their Proving Ground candidate, answering questions and otherwise collaborating by email as needed. Once the candidate’s presentation outline is ready, the Mentor will coach them through their full presentation, working on timing, inflection and body language. The mentor will assist with translating data into talking points and assuring their talk will be understood. Not just by their peers in their area of interest, but by the majority of the people listening in the audience. The day of the presentation, the mentor will attend their candidate’s talk, to boost morale and assist with Q&A, if needed.

Do not let this unique opportunity to pass you up.

More information on how to submit at http://bsideslv.com/

The CFP closes MAY 15th, 2014 but don’t wait...get your good ideas in now!!