This is the final article in an eight article series about getting to speak at DEFCON 22.
The moment had finally arrived; it was time for my talk.
Then, the second speaker and I were asked if we wanted to get the ‘first speaker’ special. The only problem, is it eats up so much time, especially when I had spent so much time making it a 20 minute talk. So what we figured was it would happen in between talks, while we were switching speakers, we could do the first time speaker treat.
After this light talk and practice we were escorted to the room. Even typing this out now I’m stressing out reliving the memory. It was amazing, nerve racking and crazy.
As I said earlier, the stage was up a little, in front of some crazy lights. While I was getting setup and making sure the audio and visual were working right I realized I couldn’t see the audience past the first 4 rows. Great, I thought, I had prepared some ‘show of hand', questions, and now I couldn’t see the audience. Oh well, too late now.
Historically, my talks about hacking mainframes haven’t really been heavily attended. The first talk I gave had 30 people, the Shmoocon talk? Maybe 300. Thotcon, SEC-T, etc, 200 MAX. But normally there were lots of empty seats available.
Not so this time. The proctor for the room even came up on stage asking people to put their hand up if they had seats open beside them because there were still people lined up outside.
This is where it gets kinda hazy. I don’t actually remember giving my talk. I was so stressed and so nervous (this was the first time I actually got nervous since Shmoocon) that I can only remember bits and pieces of the experience.
I remember my hand shaking so bad that I was worried I was going to accidentally hit the next slide (I didn’t).
My knees kept going on, never both at the same time, but I kept having to shift my weight, worrying I would fall over (I didn't).
I was on autopilot. I’m glad I rehearsed it as many times as I had because I was operating from muscle memory at that point.
One thing I distinctly remember, however, is the total fail of my demos. Not my fault though. One of the weird things of the room I was in is there was one screen on each side of the hall. On the left, the screen was pinched smaller to make room for the closed captioning. I’ll be honest, I love that feature, but it make the screen look weird, but at least it showed my full screen. On the second monitor was the full screen except for one problem: It cut off the bottom 15% of the screen. No big deal for slides, but a HUGE deal for full screen demos. Especially since those demos were all Unix command line demos where the action was happening at the bottom of the screen!
But luckily I had loaded my demo’s in Chrome before hand! So all it took was tabbing over to Chrome and using the mac zoom feature to show the demo’s on the screen properly! *phew*
Then, before I knew it, I was done. The twenty minutes flew the fuck by. I was amazed I had made it through and now I was an official DEFCON speaker! I got my first time speaker prize and drank for the rest of the weekend.
One person I haven't mentioned much, if at all, throughout this whole thing is my wife. I'm not keen on mixing this with personal life but I need to give her some serious credit. She stood behind me the whole two years with the frustration of rolling in to bed at 2am working on some stupid tool. Or taking screenshot for demos, preparing slides or white papers, going overseas, or to Chicago, D.C. Vegas. Eating in to Vacation time, etc. Without her I wouldn't be where I'm at today. She kept the fort while I was away. She even recognized I was at my wits end by the end of 2013, I had given too many talks and helped talk me in to limiting how many talks to give in a year so I wouldn't burn out. If anything I owe her just as much thanks for the DEFCON talk as anyone else.
What's next? I'm speaking at Hacktivity, ISACA and SHARE conferences. I'm submitting a talk to RSA with the person from my BSides talk and working on advancing research and awareness of this platform.
This is the seventh article in an eight article series about getting to speak at DEFCON 22.
I submitted the CFP on March 11th. I knew the process by now, I had been doing it for 2 years already. I completed the CFP for what I thought was a solid, 20 minute talk about hacking mainframes and hoped against hope it would get accepted.
I knew what I was getting in to, 20 minutes isn’t a lot of time to talk about hacking a mainframe, something that’s been around for 50+ years. I wanted to make sure I was able to communicate all the cool stuff about hacking a mainframe and what it would take, and I knew I couldn’t do that at DEFCON in 20 minutes. So I submitted an hour long, ALL DEMO talk to BSidesLV and luckily got accepted.
So, I submitted March 11th, and somehow got the most amazing email, on April 1st. My talk had been accepted!
I'm so happy to announce that my talk was accepted to @_defcon_ 22! FUCK YEAH!
— Soldier of Fortran (@mainframed767)
April 2, 2014
Then the reality sunk in. I would be speaking at DEFCON, in a room full of people. But I thought, no big deal, the 20 minute talks are usually in the small room with no space, max 300 people. I did that at BlackHat in a slightly larger room, easy peasy.
I would spend the next 4 months making slides, working on special DEFCON 22 branded tools, work on the talk, and put together some awesome slides and content on the CD. Seriously, check out the README on the CD for my talk, that ASCII art is bad ass!
I spent about 3 months putting the slides together, researching new attack vectors and what to do post breach to maintain access. I even wrote a tool to automate a lot of post exploit tasks but didn’t feel comfortable releasing it, given the critically of these systems, I had to make it a little harder on the skiddies.
With my slides, scripts and ASCII art submitted I could finally relax... if only. Now I had to take my DEFCON content, make it different/new and put together an entire talk for BSides. The BSides talk was a little easier to put together, mostly because it was going to use a lot of what I was talking about at DEFCON, just more detailed and straight from the machine instead of animated GIFs.
Come BSides, I gave, what I felt, was a pretty okay talk. It wasn’t great, there were some technical difficulties, like the lights being too bright and some of the live demo’s didn’t actually work too well, but I had prepared backups just in case.
With BSides out of the way I started rehearsing the shit out of my DEFCON talk. By this point I had developed a ‘method’. In the hotel, alone, I would setup my laptop, standup, and rehearse my talk, no less than three time, timing it, making minor changes to the slides, etc. This is where the benefit of a 20 minute talk comes in. I can rehearse it three times in an hour instead of the three hours it usually takes for a 50 minute talk. But instead of just doing it three times, I must have rehearsed it 5-6 times.
After rehearsing a bunch, my roommate (@az2600 from my first BSides!) and I headed over to DEFCON. I had never actually gone to DEFCON on opening day to get a badge. I had either used the BSides/BlackHat DEFCON badge program or had a friend do it. So imagine my surprise seeing that huge ass line. To which I said ‘fuck that’, walked up to the front and asked were the speaker line was and was pointed to a short, two person lineup. One of the speaker perks!
Whenever I give a talk I like to scope out the room ahead of time. It gives me a nice view of what to expect, the sound (handheld mic, pinned or podium) and the size of the room. This normally gives me a great idea and puts me in the right mind. In this case it was a HUGE mistake. I had assumed I’d be speaking in one of the ‘smaller’ rooms but instead I was in a MASSIVE room. Not only that but it was a massive room with spotlights on the speaker.
The night before my talk I couldn’t sleep. I tossed and turned all night, rehearsing the slides in my head all night. I was exhausted from all the previous partying I had done (Vegas BABY) but couldn’t sleep.
The next day I showed up an hour early to DEFCON and hung out in the ‘Green Room’. Rehearsed my talk and tested out the projector. One thing I did, which I've never done, was bring up my pre-recorded demo’s in a browser. I had the smart idea of making all my demo’s animated GIFs. The key to animated GIFs is that they start automatically in the presentation, they’re easy to move, manipulate, etc. But the only thing I couldn’t do was zoom in with them. So I decided to open a bunch of tabs in Chrome in case I needed to show of the demo’s in more detail.
And now I waited for an hour until the time came to give my talk.
