BSidesSLC 2017 -- Jason Reverri -- Green Eggs and Hacks

[Music] whatever buddy this is a green edit eggs and hacks so if you're in the wrong spot I might want to go find the other session but I'm nibble and yes this was my experience taking my daughter to DEFCON so really quick who's been to Def Con okay so we got a couple of people who has kids okay so everybody at least has kids okay I said this is an OK session for them because if you haven't done either of those things then yeah that would this might not be terribly interesting so quick formality my real name Jason Rivera aka nibble a security engineer for comping at fantastic place to work they see a lot of value in this

sort of community involvement and I really appreciate all that they do for for the community and letting us kind of do crazy stuff like this so if you want to follow me on twitter that's up there nibble dot tech is the website I've been involved with DC 801 now for quite some time was one of the early members of the Edwin labs I'm also a father of two lovely young ladies who are currently seven and five so it's not going to go well for my clicker okay so uh hacker summer camp right this is actually at these sides blackhat parties you know definitely not seen a lot of kids here DC 801 party Saturday night not seeing

all the kids area there so who in their right mind would want to take children to this sort of event right who you know and and I struggled with this for a long time because they have Def Con kids right they have activities for the kids there um and I didn't want to be that bad right hopefully everybody knows who that is but you know why is it important that that kids are exposed to this culture so I didn't want to be that guy on but it was two years ago I was waiting for the Tuscany bus from B sides to the DEF CON venue and I was chatting with somebody there and he happens to be the guy who's

organized besides Austin and he's like man you gotta bring your kid this is this is the environment for kids I'm like you know tell me more you know I'm curious I want to know he's like they they need to see this sort of thing they're naturally curious they want to do these things that we as a community we as hackers do right and and one of the other key things is we're not the bad guys despite what you see on TV despite what you read in the news this community and hackers are not the bad people those are criminals we're hackers and our kids need to know the difference very important and of course as any parent knows our kids

that's what we're investing with right they're our future so how can we this this community this this this environment this way of thinking that is hacking right as hackers how can we empower our children to understand or understand this properly and then you know take up the rain and run with it for the future so that was important to me um so kind of get down to the logistics here what when you decide okay I'm going to try this I'm going to take take my kid to DEFCON what is that what do I need what do I need to take I wish I had known this um cash cash at the DEF CON venue is

extremely important when you have your kid there on most of the concessions at Def Con on they're not taking credit cards there's no there's no such thing as credit cards at Def Con right you need cash so when when your seven-year-old is hungry and cranky and you forgot to bring snacks and drinks you need to be able to pay for those sorts of things and not rely on the kindness of strangers for cash so patience is huge right remember when you're when you're there with your kids on understand that this is new to them as well right and and I mean as parents we know patience is is a core value of parenting but just just know that this

is this is a very unique experience for you as a parent so be patient with yourself know that maybe you're not going to be perfect who is right but but then also with your kids and and try to look at defcon through their eyes right not just because they're lower than us but you know maybe avoid certain areas that you know are not appropriate for kids like hacker jeopardy for instance any of the late-night activities probably not a good spot for the kids um and and going back to the patients that I mean this is this is you're dedicating your experience to them if you've been to DEFCON without your kids in the past that was for you right or that was for

your your community that you're involved with this is is a different experience

um and and in that in that mindset have proper expectations so that's the DEFCON party's shirt my five-year-old grabbed it when I received it last year so um take your time and wear a parent's hat don't let your kid run around crazy you know at and again go to these sorts of events that maybe are inappropriate uh so so remember it's parenting time it's not time to just goof off with your friends which is what DEFCON is when you're not are no I'm sorry it's a very serious security conference so a break are extremely important take breaks leave the conference area go to the pool if you have access to a pool where you're staying down in Vegas that that's

huge right and and you know just remember what it's like to be a kid in these sorts of new environments excuse me so what what is there for kids to do there on well there's roots asylum roots asylum is this magical conference within a conference right it's also known as DEFCON kids is what it used to be known as they rebranded it as roots asylum of route a few years ago what sorta activities are the kids doing in there well what's key is as an adult you're stopped at the door if you don't have child supervision going into routes con you're not allowed in you need your kid with you so so going back to you know

years past I was like wow I really want to check this out but they're like yeah no dude you're not allowed in there because that's kind of creepy and weird um so so yeah you need a kid with you but they're going to be into crypto puzzles what I like to call tabletop cryptography so pen and paper cryptography type stuff um there's hardware hacking in there so it's you know soldering and and and and you know fun fun activities around that and it's the cool thing is is that there's there's adult volunteers that are kind of paired up with each of these these exercises kind of you know giving instruction to the kids that haven't done that sort of thing

before you know helping out with the activities they have a CTF in there and the talks are top-notch I mean you know if you like getting the perspective from some of the bigger names in the security field they'll come in and they'll give those sorts of talks to the kids so and they're extremely entertaining right given for adults so and you know it really starts to spawn those great ideas if you remember like your first talks at DEFCON you know there they can be extremely interesting and exciting and hopefully invigorating you for the next year to to inspire any activities that you're you're interested in so so the other thing that's interesting there is the social engineering village does a

CTF on Saturday just for the kids so social engineering village is a sub village within within the the Kahn and if the guy there is Chris Hackney and Michelle who's the last time I'm forgetting they are the organizers the main people that do like social engineer org the the podcast an amazing amazing group of people they've got a bunch of volunteers that are helping and these are all the kids that wanted to do the CTF Saturday morning so it's Saturday morning first thing so no partying Friday night dad right you had to be there bright and early and the age range for it for so I should mention this roots the age range is kind

of recommended six to sixteen seventeen and up they can pretty much go to DEFCON right but but roots six to sixteen the SC CTF for kids is is six to thirteen is the cutoff so if you're thirteen you can't you can't do this right so they team up kids that you know maybe can mentor the younger kids so my seven year olds here in the in the right corner in the pink and her teammates behind her and her teammate had done this two other times so this is her third time doing the CTF and my daughter was the youngest one there no so she she had no idea you know what she was getting into but her

partner was this amazing mentor she came out she you know knew what kinda to expect but you know really was was pivotal to being successful for my daughter and I'll dive into a little bit of more of what they were doing but but the CTF is essentially it I don't want say at least this this year and I having not done it before I'm assuming it's pretty similar on they it's almost like a treasure hunt right they start with an initial clue they give the kids instructions um you know kind of general idea on resources that they might need on paper so they don't need a smartphone or anything right they don't need internet access

they give them anything that they might need to complete any of the challenges and they give it to them this backpack they get a t-shirt you know it's just it's wonderful good time and then they line everybody up when they're still happy first thing in the morning and and everybody smiles and they and then they then they set them off to go do stuff so what was involved right the first challenge was a a passphrase Caesar cipher so tabletop crypto again what I open and paper crypto and it was it was I'm going to give away some of the secrets so that you guys kind of know what what as an adult I'm like oh I love

this which can't help right so I'm just watching and I'm like oh this is great yay but um so you know that Michelle when she led them out she said something like working for a Chris agony is is a bit of a is a bit of a mind trick or something like that there's one word at the end like mind trick it was was really weird so the instructions that they got which they were reviewing there talked about she ciphers and passphrase Caesar ciphers specifically and it watching two kids reverse-engineer a crypto code is you know watching your seven-year-old as a mind-blowing right I mean it is amazing experience but so they they went through

they figured that part out but did the volunteers are there to kind of give them a little bit of guidance right so they didn't just come do reverse engineering on their own they they had to go and they had to ask for help from the volunteers every once in a while and they wouldn't give them the answers would they be like hey you might want to try this like the letter e tends to come up a lot when you're looking at you know a sentence right so maybe if you look at this code this long string of characters you know the letter J you know appears a lot in there well what if you thought

that was an e you know and and so kind of helping them through the first step and then they have to take it and run um lock-picking is another huge element there and it's a great thing that kids can can you know kind of pick up and and get started on and work on ahead of time as well um we've got some amazing lock-picking resources here in the community Lonnie bakes you know who's running the lockpick village out here is very involved in the community um you know and and he's been he's been to so many events great resource if you want to ask and he's got two kids right so he knows exactly you know what works with the

little ones and they they all are very good at picking locks so I've met it's kid it's amazing so I'm one of the other things social engineering right so imagine your kid walking up to a big burly goon at DEFCON and asking him to sing row row row the row row row your boat right and then while you film it so that you can provide it as evidence so that they can get on to the next challenge those sorts of things right interacting with people that are I mean they're kind of staged to know that okay well you know kids are going to come up to you and ask you to do some things and some of the goons are

just like nope you know and they're they're out right but then you know every once in a while you find somebody who's maybe off off-duty or whatever and they're just they're a little bit happier right if anybody knows the goons of Def Con they're not known as being a friendly group lots of logic puzzles word puzzles things like that example would be they had to choose a list they had to list off like I think was 13 words and then they had to make six sentences out of those words and that was the challenge to unlock the clue to go to the next challenge right and cutting out shapes different different shapes and having to form them into I

can't remember what the puzzle type is called but form it in I've got a picture but they form it into a larger shape but they have to figure out the geo shapes how they fit together kind of like a puzzle I guess but but yeah and the other thing you can't help which again especially what the crypto stuff was really hard um so this is this is them working on that first cipher I've got a video and what I want to point out here is I mean there's not a designated area where you're doing this right you're in the middle of Def Con the the foot traffic right behind there now the hope is that ad Caesars the

conference area is going to be a lot better because I'll be honest commissary a kind of blue at Bally's and there was just lots of small hallways and people work you know between the sessions it was really really crowded and then there's nobody there and you're trying to set up to find spaces to work was not the easiest you know here they're working on the the another cipher challenge there's the the cutout puzzles you can see there's kind of a helicopter and you know the one on the left we're still in the hall they're just at a table the one on the right that's the chill-out room at Khanh so you know I mean there's there

in the middle of the conference so that I guess one of the things that I really liked about this is they feel like they can see part of the conference but it's it you know you're there you're supervising them you know you can help guide if need be but you know it's a very it's a very interactive experience with the rest of the conference we're better or worse I guess you know this this one on the left is the lockpick village they had to pick a lock and inside the the case was some twine and some cups and then they used those cups to communicate with a hidden volunteer and give a code word to get more of the

puzzle you know the old telephone type thing that was in the the lockpick Village area I just happened to be there when Lonnie picked his lock the famous like what less than two second lock that he picked it up then they had to do a ASL American Sign Language which which my daughter took on herself I can do this and so they had again kind of a crypto challenge but it was all ASL stuff on the on the right we're back out in kind of a hallway area and that was a that was the logic puzzle where they talked about like okay if Bob bought you know the yellow crayons and you know you know there was another person who bought

five pink crayons and just you know go through that logic process of elimination you know where you've got five different examples that they all bought different you have to identify who bought how many crayons and what color right or it was candy or something right but it's one of those logic puzzles and that gives them you know once they solve that they can present that and then they're presented you know then they're given the next clue right the next the next thing to do this was this was the breaking moment right so we started at 9:00 a.m. about three o'clock they got to the Visionnaire Visionnaire is a an old crypto puzzle but it involves using a what's called a tabular

recta so you can kind of see it there on the right-hand side under the paper but it's it's it's tough to to figure out and they had instructions you know they had kind of what it was and when you see the tabular record you kind of know what you're dealing with but you use a code word and you repeat the code word over and over over on the cipher and you correspond the the the cipher text and the code letter and it gives you the corresponding clear text right I'm paraphrasing it but on they the problem is is if you if you if you move your paper while you're working on it you end up with the wrong letters and

this this was tough I saw I saw a couple other kids and other groups crying okay I'm saying this was tough I called it my wife I'm like I don't know what to do you know we haven't eaten yet it's three o'clock she's like how have them get up and do jumping jacks and and I mean because we were so focused on this this mental thing that the physical contrast oh I was a preschool teacher right so she is the physical contrast getting these kids up and just doing jumping jacks right in the middle of the of the this was near the tamper evidence village so you can see tamper-evident people in the background there um you

know it was I didn't care at that point right I was hungry too I was kind of it's like huh it was it was good but it got him focused again right and I got through it and nobody cried on our team it's a big deal um then they moved on to some some manipulative challenges and in the theme of of Def Con last year which was rise of the machines the end was creating a robot so they have bought these really cool snap-on robot sets that the kids would would build and then they had to run the robot through a challenge you can see on the left there like a robotic Oh control challenge and I'll come back

to that that image on the right because that was a really cool moment here's my daughter making a thinking to try at the robot so they had to go through without hitting anything so she has to reset now but I mean you know at this point it's it's six o'clock at night and the kids are there really really they had fun but they're tired they're hungry come back to this because my daughter's teammate really really wanted a Nessie challenge coin that was her goal was to get a challenge coin she got one in one of the years passed and the poor thing they traveled and it was in it a bit in her luggage and her luggage got lost and she

lost her challenge coin which anybody knows getting a challenge coin is a huge trophy right a huge takeaway but then losing it is even worse right so so that was a big thing for her and she went back she's like I'm going to go back I'm going to ask Chris because they weren't the first team to finish an only the first team to finish got the trophy she's like I'm gonna go back and ask I don't care so they went back and they asked and and Michelle who was helping run the the kids CTF came up and she's like these girls you got you got the youngest girl here they didn't cry they worked as a team the whole time they

really they deserve a challenge so it got a challenge so so yeah so that's my daughter has a challenge coin getting her picture with her partner and Chris so so what can you do to get your kid ready alright so you listen to me talk you're like you know that guy nibble gone to something here let's do this um tabletop crypto definitely a big thing crypto challenges are some great books that are crypto challenges geared towards kids you know we can chat after I can make some recommendations on that but Caesar ciphers Visionnaire I've got that's a picture of the paper in nigma if you want with that I've got that which was developed by this amazing guy

Mike costs MIT graduate works for Google now I'm lock-picking another great way to get your kid ready it's an awesome way if you have a lot picking set and you've been thinking about buying a new one because you want like those new wavy wavy rakes from tool or something buy them give your kids your old lockpick set get a generational lock pick you know lock set that you know with a single pin double pin triple pin those sorts of things games and puzzles these are a great way to kind of get kids thinking outside the box critically one that I always bring up that people are like really you know is a fun easy game to pick up but if you

read beyond just the the regular directions of uno cheating is encouraged in uno I mean what's more hacker mentality than that right in my mind so I love you know and and if you have friends that are interested do it with friends encourage each other right and if you want to meet more like-minded kids we have hacker camp kids so last year was our first year doing hacker camp kids if anybody doesn't know hacker camp is being the idea of the guy on the Left closest to the camera so--but he had this idea I want to do a CTF in the middle of the woods on a generator and I was like you know what

that's a great idea let's do it that sounds you know so much fun so we've done it for years now no three years now excuse me this will be the fourth year but last year I was like you know what I want to do a kid's track because we were having all the people come up that we thought we could because we've got families and coming out on the weekend without your families going camping not always not always the easiest right so we did a kid's track we had games we had lock-picking we had all those things and we're doing it again this year so so definitely if you want a good good way to meet some like

minded people and have your kids get involved in these sorts of exercises that's a great way to do it so it's up by strawberry so yeah hacker camp dot net loser but yeah I'd talk to me after I can get you the the info on hacker camp so it's uh it's the third Saturday in June third Friday and Saturday in June so the 23rd 24th we're doing it this year so right and I hope to see a Def Con [Applause]