BSides Tampa 2024 Closing Ceremony

thanks everyone for coming out today we appreciate the support I wanted to uh give a kind of you know here can't talk all of a sudden Round of Applause to you you know we wouldn't be here without you we need a this is a we had you know though we've seen people working on this the different challenges on the floor seen people uh packing up rooms so kudos to everyone networking and and making this a great event um who had a great time all right so definitely did a a lot of big wins today I know uh it was a little bit busier than we expected so great turnout if you weren't here in this morning um

you know we we definitely uh we definitely went up in numbers today for sure I know we had some parking challenges so thanks everyone for your patience there um but yeah huge turnout today so thanks everyone so also want to just again thanks for everyone for going through and visiting sponsors today we received a lot of really good feedback from the sponsors they want a lot of them are looking at coming back next year uh so without them we can't be in in a bigger building like this um and scale up like this so thanks for you know going out talking with sponsors and enabling them to support our community we know a lot of people in the group here are part of

getting sponsors to come out and uh sponsor besides Tampa so it it takes the whole team here right we're all one big team one big family so thank you for spreading the word talking with different companies that you work at or even uh vendors and teams that you work

with all right so I know we're well Don't Close Your Eyes Amed and afum um so we have couple big uh you know special awards that we wanted to give out to a couple of our crew it's it's really hard because everyone does such a good job and we had a lot of team members really working hard today throughout the week this week we were actually on site multiple days this week getting set up before the conference too so thanks Clint if you're here for helping out there too um but yeah so we're gonna do um a couple special Awards the first one we're going to start off with Ahmed so as you guys saw

uh the sponsorship venue a lot of a lot of great sponsors here that starts tomorrow so hey hey amen um it's seriously an all year event uh the team reached out to hundreds of sponsors Ahmed really kind of took the reins this year um I know previously I took it from Lori um where we had uh it's just crazy to see how the process matures and how people can do it better right so just handing it off to somebody else and then um it's like oh wow I guess I thought thought it was better than that but uh ahed completely uh completely evolved the way we do and Lookout sponsors so thanks

amen oh

oh yeah

photo oh

my one more thank

you are you want to announce you want me to get AUM okay and then um I guess I should have did the awesome animation so afim didn't know she was next I'll work on that we'll work on that next time but um but if you haven't met AFM she's been doing awesome interviews today um non-stop throughout the year helps like boost uh visibility with the conference um non-stop even um coming out after uh you know but she's always coming out and going above and beyond and a huge part of the community and enabling us to really Network and and make this a successful event so thanks afterm thank you wow this is so nice pretty thank you guys

all right so we have a couple leads over here um so uh if we could have the team come up on stage we're gonna we have some special lead gifts this year um so apum and Amed please come back um um Ariana um we got shant Jamie um I don't know if Christina's in here uh Devin Ford James BWI uh p p if he's in here uh Kate AJ David Maria and Chris

so um so thanks every all the leads here uh really behind the scenes throughout the year that really put this together so we wouldn't be able to do it with such a big strong without a big such a big strong team um but yeah thanks to all the leads here

oh thanks oh we got a picture okay oh

good yeah we'll we'll plan the picture part next time

yeah so just want to reiterate you know this is a there's a lot of other crew members that were out here that you guys saw us supporting today you know jumping in and running rooms all day not going to talks it's a hard part to run besides because a lot of us love it so much that's why we're helping organize it but then you kind of end up not being able to see the talks and be part of it sometimes so I know some of the the crew you know ran um the crew room for example right um some some of them ran different talks uh so definitely appreciate the crew kind of like registration for example the team

doesn't really get to go out and see many talks but we appreciate the crew behind the scenes keeping it all together and and making the successful so just another uh big round of applause for the crew

so I'm going to pass it over how many try well actually I don't want to steal Josh's thunder so I'll let him go thank you so how many people tried the badge challenge that's a record so awesome okay thank you for trying it um no that's cool how many people didn't know there was a bad challenge okay all right so we'll work on that we'll work on that um so yeah so as get we always try to level up stuff every year with bsides we want to make it better it's all about the experience and everything and so part of that is like I said with these badges uh so there's there was puzzles and there's

Clues on here and like I said early this morning I said the cold brew and I like I primarily cold brew when we made these Badges and there's a whole badge Challenge and I'm about to give it to cold brew and he's going to kind of give a quick overview of what the badge challenge was also um I don't remember exactly remember who the name was I think it was a group of people but I know 12:22 p.m. is when I got the first email so you sent me an email asking hey are we the first or what rank did we get and you were the first but I will I haven't responded yet so I've been too

busy but I'm going to hand it off to cold brew and he's going to you know give the overview sure so I uh I had to write it down because I had to remember all the steps that I actually put in this thing so you probably noticed on the front of your badge there is some text down there hidden in uh in the tracing on it and so that text is actually just hex we tried to make it kind of ramp up in difficulty or at least do the best we could to try and make it ramp so so that is just hex and that will tell you an SSID and a password so the idea was once you get

those you can kind of walk around the con and try to find where that network is and it was there in the sponsor area and we had a little Raspberry Pi blasting out a network there so once you connect to that Network I think this tripped up a lot of people I think I probably shouldn't have done this but I purposely did not put a DHCP server on there so it you're going to connect within aipa address so if anybody body here has had to use a before you know there's no default gateway there's no simple way around it you have to scan the network so once you scan the network you're going to find a host that had

Port 80 open if you go to Port 80 there's a little website running there and it's going to ask you for an authentication code um there is nothing that gives you any kind of hints of what that code's going to be so what you have to do is you have to inspect the page and dig through the JavaScript down there and you'll see that it's just doing a simple string comparison and it says if the authentication code is this string right here then download this file so you copy that in dump it in and it downloads a file it's just a zip file once you open it up there's a JPEG inside if you open up the jpeg you can

see kind of some obvious corruption in the file so if you open it up in a hex editor and start digging through the hex of that you'll eventually find a string in there that tells you that the next flag or no it gives you a URL and the URL which is going to be up for another probably about a year so if you want to go home and start doing it from this point you can the URL is lost in. codes so if you go to Lost in. codes it's uh let's see here it's going to give you a string and then show you some kind of spaces so you know that it's going to be part of a URL and the string

on there is let's see it's rot 47 which I don't know if any of you guys have heard of that before it's kind of like rot 13 but with the entire asy character set so you're going to get some symbols and get some other random stuff in there if you rot 47 that back you get a string and you punch that into the URL now you're lost in. codes that string uh that takes you to a page with just a single Rune on it and then four little segments that shows you it's going to be you know slash slash slash for each of these uh the Rune is actually the monk Cipher and so that's going to give you a

four-digit number once you have that four-digit number you can punch those in so you're going to Lost in. codes SL first number SLC number so on and that takes you to a page with another string that you need to decode and that one is actually very simple but yet it causes a lot of problems because it's rot 13 and then reversed so if you do the rot 13 on it and then you reverse the string that you get it will give you the final page which is just a giant block of text with that one there's no hints whatsoever with that one you need to inspect the page once you open it up an inspector

you'll see that HTML element has uh let's see here there was a couple of extra non-html stuff written in there one of them was row equals five and offset equals two anybody here who's ever dealt with a rail fence Cipher you know that that's all you need to be able to decode a rail fence Cipher so you put it into a rail fence Cipher decoder put that it has five rows and an offset of two and it gives you the full block of text which SS you to email Josh so nice easy challenge right so you can do that when you go home if you want to run through it yourself and check it out and

see what it's all about we're going to try and level it up next year we're going to try and make the badge even better try and do another CTF like that so if any of that sounds interesting come next year thank

you no thank you again cold brew because yeah I mean yeah he put that all together and I do want actually do want to mention so is there a Jacob Hammer Gren here Jacob where's Jacob so you were the first or what your group I guess you you you said we so but yeah that was the first so you so I'd say after this so congrats so round of applause for Jacob yeah excellent job very very well done I do also got honorable mentions uh coming in about two and a half hours behind you was faquin was it pakan something like I don't know yeah okay sweet yeah so that then Ross then Ross oh Ross Edwards and last

person that actually so was Nevin oh man Nevin you just you know who you are South mang or something so yeah so yeah so that's also so that's one two three so we had four people well at least four people emailed me at the right address uh so congratul and Round of Applause for everybody trying it and for everybody completing

it yeah I hope you had it fun with it and one like you said we'll level it up next year and uh uh if one thing if you weren't familiar with a lot of those things it kind of at least intended to be you know we start out relatively simple with different concepts different core things I mean some of you might have really high expectations but we're trying to be accessible so next year we've got a lot of other ideas but again we try to make it Progressive so you know get mean some people have never scaned Network before and like that's exciting or you know different where we want to meet you wherever you're at so

um but yeah that's our best challenge so congrats yeah but Jacob was it Jacob right the first person just make sure you see me afterwards okay yeah Jacob thank

you all right so who's ready for raffle [Applause] time you know yeah I wish we could jump in the raffle here with all the great work that Chris does it hurts every time to see it but yeah we'll we'll have Chris come up here and raffle up some of his stuff oh yeah I'll say a couple thanks first um so how was it how was [Music] bsides just curious who was it their first time here at bides wow I thought so it felt like I talked to all 1900 of you my cheeks hurt um out of curiosity has anybody was anybody at the very first 2014 two wow shut up were you so my point is is um those of you

that are here for the first time um if you're anything like me maybe a little introverted um getting out to an event like this can be tough but it's so worth it um I remember I was at an event with by Ken Evans and joy randles and Tracy Ingram called bar camp and I met Derek Thomas there for the first time and they just happened to be looking for some artwork for besides 2019 and then uh six years later I've been lucky enough to come back and do some of that so um keep coming out to the events meetups and um okay let's raffle off some stuff can somebody help me want pick one or um so not there's probably going to

be a lot of Nosh shows so I'm just going to read a bunch off and if you win come up and you can pick anyone that you

want 100 one z0 last three yeah Green last three

338 333 046 079 086 1 hey 086

green tickets you should have just soci your engineered your way up here um they can pick whatever they want yeah 110 117 did you guys come to my table hey 117 congratulations

364 yeah okay two in a row we're heating up 054 yes can Pi anything yeah first pick there you go that's a good one can we take a picture real quick thank you 053 are you serious I promise that's not uh By Design uh just take your pick um each of these are three of each or you've got the CTF or oh one

but I knew it I'm sorry I'm sorry can we get a picture real quick yeah thank you thank you I'm sorry man I'm sorry you're awesome yeah he runs the neon temple with John so that would have been perfect for him U I know 287

287 yes or is he just leaving yes sweet okay 514 514 going once 201 one 454 oh 2011 okay 454 wow three in a row let's go here we go four in a row four 79 oh take your pick can I get a picture with you thank

you let just let's double time it oh that's fine thank you thanks yeah congratulations awesome you didn't even want your ref ticket I remember yeah yeah yeah I remember 223 00 five Danny I promise that's a wow okay I get a pick no you can't do that okay thanks thanks thank you Josh what's up man 242

485 uh potentially check under Danny's

robe sorry

480 hey yeah you can take any one you want also just so you know uh there's a shirt up here it's kind of like that just little bit special uh they're both large we have the burp site cookbook by our very own Dr Sunny wear and she will personally sign it for you and then we've got some stranger things socks so sorry I kind of bent that Dr

Sunny you change your mind yeah that's fine uh 501

488 thank you appreciate it Kelly like the odds on this is like improbable 103 uh not quite yet 337 508 8 482 Joey really hey Joey Kelly took the last speaker one just so you know thanks 498 498 yeah

sweet

1475 119 can I get a picture with you Joey thank you

also you got yeah the live painting by Lulu she did that during the event it's fantastic thank you uh three more wow the the sponsor one that was actually one of my favorite nobody likes that nobody likes the sponsors 183 183 183 30

1 301 183 come on up

099 is that no uh

030 366 030 great so you see Dr Sunny wear she's in the white shirt there she just gave that guy high five because she's awesome yeah yeah she'll go sign up for you I don't know why you're taking the picture with me take a picture with her she she's the keynote I'm nothing yeah yeah thank you she's you can go yeah whatever uh 436 congratulations 436 that we're getting down there I get a picture with you awesome thank you 037

nice so that's it except for the shirts

442 442 was that a yes somebody coming thanks man

all right so these are only larges so if if you know somebody that's a large um 199

199 okay just jump down yeah 442

442 342

458 067 wow 140 198 hey cool yeah thanks man congratulations you get the socks too yeah thanks everybody

set what color are the tickets Mi yeah beautiful yep two Blues all right so we're GNA have Ahmed come up and help um raffle off some of the sponsorship stuff so we do like sponsors christas just kidding and anyone in the audience if you're a sponsor he was just kidding all

right what are we gonna do first let's pick something or you pick pick what you want all right so meno security gave us a really nice Beats Studio headset yeah I told you guys you need sponsors need more hugs I don't yeah it's the blue tickets I think that's what you were saying I was trying to figure that out it's uh 62542 all right see and how many how many people were here the one year where we uh people picked the raffle tickets out there and we just ended up pulling tickets all night that was a that was a fun one that's why we're hand we hand out a lot in

here oh 542 y

all right what's the next

one the back the back in the back too all right so this is a bag just kidding just kidding I have really good jokes some people know that I see you Martinez um so we got an extra extra hop it's hop right I'm not messing that up I don't want to push so this is a Bose headset yeah it's real I think so this is this is 66006

oh tanium whes what is it Whiskey glasses oh whiskey glasses all right the next one is whiskey glasses from

tanium oh looks like it's my number so uh 162

574 can I get your idea just kidding right yeah

sure yeah congrats

all right JBL speaker uh for Orca so this is 162 579

so we have a a Halon Yeti cup it's pretty big what's that did I say it wrong yeah

yep my bad 66097 all right no they're

coming all right $50 Amazon gift card for from isaka West Florida 162 639 all right [Music] wait he he can choose to give it up if he wants but no but he doesn't have to hey some of us are just lucky right all right and it's not a scam I promise it's not pinky promise or I would have those whiskey things um this is a cover instruments Lockpick Set so I know afm's in here so shout out to Optive um and this is 162 467

that's

just so this one was is a little suspicious I'm just want to make sure it's not a bag that was left behind no there's a bunch of stuff in here there's a sh and a and a what is this a water bottle so this is from the Tampa devs 162

528 all

right don't know all right so CTF winner time no I think coachi should so we'll have coaches come up I don't know if you guys noticed these guys today they don't stand out at all can we get one more

mic hang on are you bringing not he doesn't want to oh Al I tried I don't want to force him to well I was going to come up here all gracious and full of gratitude but I lost machowski rifles so I'm just in a bad mood so first off wow that's that's all I've got to say is wow I woke up this morning fully expecting this thing to flop and I'm I'm serious because we we this is never been done before I I've never seen a CTF before like this in my time in the industry or in my life and all I've got to say is wow this thing has been in the works since November of last year and I could

not have done it without my right-hand man I've been mentoring him for quite some time now Sam furio Geon if you watch if you watch The Sopranos you'll see why we call him furio so so Sam Decker um you want to talk we'll go back and forth a little bit about uh you know how we built this thing yeah the process how we built this thing uh we've been up since about one o'clock in the morning uh getting this thing prepped that yeah that sucked couple hours of sleep yeah so uh take it off how how do we build this thing what do we do yeah I mean I we took it back in like November the idea came around to

to build a CTF that you know is not traditional something more accessible to everybody and you know fitting the theme of this year Dungeons and Dragons um you know obviously that's not a very common ctfd platform idea so I remember having you and Alex our other developer who is extremely shy who's like in the corner there right now shout out Alex Alex shout out to Alex uh so yeah give give Alex some love everybody right yeah uh yeah King introvert um and I remember December telling them my idea and both Sam was more receptive to it than Alex Alex had some Choice words for the idea but we got it done can't believe it yeah

so uh there was a point at like two in the morning I think on on Wednesday where I was like there's no way this is gonna this is gonna be operating on on Saturday morning um so we had more people playing this CTF then I think the last three years combined we've had we had a line L out the door and that's the first time I've ever seen that for this CTF usually it for every bside CTF we've designed it's just 20 people yeah 20 or 30 people just hunkered down in a room on their laptops not saying a word um it's smelling like flop sweat in there and still did today it still did kind of smell like flops

but that's that's your average D andd player um I do want to invite on our chief dungeon master and the reason we're bringing him on is I'm sure a lot of you have played D and D for the first time ever today and you're now asking okay I like D and D now what and he's goingon to tell you so this guy's been dungeon mastering for the better half of about 30 years and I'm G to pass the mic to tell you what to do with your D new D and D career to Lord drir Lord Dr the dragon Sovine and Tyrant of the Skies all right so if you're looking to get into these games obviously bringing

your friends together you can choose someone to run games for you and kind of go that way and take it off yourself if you're looking for people online start playing. games you can actually hire professional dungeon Masters roll20.net um fantasy grounds all of these things the old school like Joey out there um this is around there's people everywhere ask up there's game groups at every single game store there's game groups normally at the libraries you can find lots of people the neon Temple um get a group together or ask some friends and run with it that's the way it works so I want to say thank you to our chief dungeon master now if you just want to get started go

on Amazon and buy a player's handbook it just starts just like that go on Amazon buy a player's handbook buy a dungeon master guide buy a monster manual and just get some friends together you can get a PF of the players handbook distribute it to your friends and get started so we're going to discuss the prizes and how this is going to work and then afterwards we're going to give some thank yous we'll give the prizes out and I'll give you all your time back uh right before we let on or OB yeah right before we let on the ever venerable amazing perfect better than you at web apps Dr Sunny wear and she's somewhere

around here so third place is going to get a player's handbook and a copy of Dr Sunny's burp sweet cookbook and if you I I hear Legend says if you go up to her and ask her to sign it and your name's not coaches uh she'll sign it for you uh Second Place gets a copy of the core books so like I said that would be the player's handbook the dungeon Master's guide and the monster manual you need those three at a bare minimum to play um or maybe you don't really just like a lot of the rules today were just kind of pigeonholed and bastardized from a whole bunch of different games until we had

something that worked so at the end of the day use your imagination get some dice uh but yeah and then also a copy of the burp sweet cookbook first place we went all out for and we got every single Dungeons and Dragons book we could find on Amazon and the core books as well and a copy of burk sweet cookbook and a hot plate so before we oh I'm hearing whistling like somebody's wanting me to do something okay so real quick I want to thank my dungeon Masters who without this none of this could have been possible you if you played a game today you got a chance to know them you got a chance to interact

with them um go up to them go up to them and befriend them you know without them this would have been nothing um and you know may maybe they'll build a D and D group with you who knows so I want to give a massive thank you to Binary Badger spy Master Lord of Secrets and the poison blade of Hashem right over there and next up is his roommate Lord warmaster radar The anarch Harbinger burner of bridges and killer of [Applause] Kings then after that is the honorable Judge madori Warden of the despairing prisons oh he's over there he's sitting down because he's lazy then is my coworker Jim B Keeper of the heaviest of metal soldier of Sabaton and

Digger of [Applause] holes and then another person who this could not have been possible without um who actually helped me come up with a lot of the rules St discordant Melody of the horrible [Applause] deep and if you survived to so how many T how many total party kills did you get today so yeah all of them but two they most people drowned to death in his dungeon that was the uh yeah the Tomb of the Sphinx and our little baby DM uh Faraday The Wanderer of Wii

waji uh I also want to thank our throlls who if you died uh un iously took your character sheet away from you ripped it in half gave you the other half and smiled at you and said have a nice day and that would be high priestess Pebbles high priest malus the high priest cyber Barista and his amazing wife the Countess Broadwater high priest or high priestess secure things and Miss Frizzle who is unfortunately not here but she's with us in spirit so you got anything you want to say no let's do this okay so in third place and the way we set this up we only have your handle and your email address so whenever you come up we'll uh validate

you're going to tell me the email address that you used to uh um register and yeah we'll uh get you your prize yep okay so uh if your name is Foxy Ben you got third place and I'm going to be checking to see if you're actually foxy so come on up don't have a name youa foxy oh there's foxy Ben oh man so really it should have been gray foxy Ben but I'm here for it come on up oh what email did you use foxy Bennett Gmail can confirm it is him can confirm so Mr Foxy Ben here are your prizes use them oh my God the seminal really dude he gets to pick the books

[Applause] too got to give him the books too have fun getting your Square kicked in in the SEC Bud oh we're doing a picture we got screwed this year uh uhuh what's oh yeah oh yeah that's right hang on hang on hang on hang on there's also a special rule real quick um actually you know we did this backwards we'll have you come up how about that uh so there's extra prizes but we did it backwards because I'm a giant idiot so we'll have you come up so the way we're going to do this also is there is a huge stack of no starched books here first place is going to pick two of these books they get first place second

place is going to pick four of these books and then foxy Ben gets whatever's left which like you get the Lion Share of the book so that's not bad so okay so yeah just come on up after everybody picks and just take your books easy thanks foxy Ben he really lives up to his name okay so after I've been foxed by Ben the next up is second place mystery come on

up I think he is mysterious ly taking his time getting up here it's not a guy of anywhere remember what email you registered yep okay we got him so now you have now let me ask you this have you ever played D andd before this yes but like one session in high school okay so now you have everything that you need to play D and D no you know my friend my friends from high school actually want us my friends from my high school actually want to start playing so that's help I think this is a sign here you go and if you want to hang off on the side once first place takes his uh takes

their two books okay do a picture of all them yeah we'll do a picture of all them okay so now has everything they need to play D and D and first place [Applause] Arctic now the one rule Arctic is you have to carry this with one hand uh okay right on validated come on up you got it yep take your crap so you have a whole bunch of dice everything you could possibly need to play D and D and more now have youever before you picked this up have you ever played before this my you gotta be kidding me you've never played d& before and you won two of the two of the rounds um I won one I got killed every other

oh yeah so how many times did you die twice twice I played all four you played all four and you only died twice yeah but the last one D I got a ton of so like which one oh so you were one of the survivors of the Sphinx uh okay so for those of you who died in the Sphinx Temple because you drowned what is what is the uh what what is the answer to that first riddle it was the' literally the word the' you can kick his ass after this so first off if you want to pick which one of these two books you want and then stack them on top of there and

then we are going to watch you awkward carry them off stage also you only have five seconds also I'm going to sit here and judge you and see what books you pick's right answers in there

so trust me you're not there

bud black hat python okay so that's one what else we got what else we got I think black Python's a good choice I've never met a college student for USF who knows how to go so heting EDR you know what dude I hope you I hope I don't see you on CNN because you poned something with python and invaded EDR I hope you seriously seriously though thank you so much for playing enjoy those books get some games going there the Temple's always with you uh up your strength on caring goes home [Applause] and picture Okay step on this way well can we get a B fan here to pass out seal fan I'm

sorry all he is try that's weird okay coarer

coook get four books you get four books that's right okay let's judge this guy yeah let's see what we got here oh oh we flipped him around okay that's interesting okay taking all bets what do we think he's going to go with oceans you think he's going to go with oceans how much money okay cyber security for small networks okay okay okay so we got someing stuff extrem oh wow that's a good you're you're JY you really think you're getting off the

grid okay so noan what are you hoping that he doesn't

okay and what else that's one two 3 okay at that okay culture we got it for the culture okay Round of Applause for second place and third [Applause] place so how you can help us if you had fun for this CTF all because we need feedback we need metrics we data we need to know what you liked what you didn't like I know the5 hash sucked I don't know sorry uh I already know that open AI whenever you tell it to generate an uncommon Club will generate a club which and the pants were all jeans all Jers genus and they were like propaganda yeah we had a bunch of yeah we had a bunch of

like PE play characters running around like an H&M well so tell them give them feedback and if we if if you all are allowed enough we can do this again next year so if you guys had a good time thank you uh we're going to go home and sleep for like two weeks but different

[Music]

[Music]