Last Updated 01.19.00
DEF CON 6.0 Logo

Please email DT with any DEF CON related links, articles, pictures, etc. Thanks!
12-31-1999SPEECHES NOW ONLINE!

A ninja-thanks to Goodnet for the T-1 access this year.  They came through in tough times! 
A special thanks to NetNevada for providing network connectivity at DEF CON 6.0
A special thanks to the London Pirate Radio crew for Video & Audio feeds 
BEFORE
  • DEF CON 6.0 pre-convention announcement with HTML links.
  • The Voice of Mercury car caravan wrap up and review page. Very cool.
  • Check out all the excellent graphics and logos people made for DEF CON 6.0.
  • There were some Polls done before hand on where to stay.
  • A .WAV file recording of Pacific Bell's paranoia regarding DefCon.
  • AT&T went on alert and sent out this SE announcement before the convention alerting all their offices.
DURING
  • Pictures - Other peoples home pages with images they took at the con.
  • Speakers Friday:
    • Gurney Halleck & *hobbit*- Lockpicking demonstration.  This talk includes a discussion of the different kinds of locks, and an indepth look at the pin-tumbler type.  *Hobbit* has disected a lock with power tools, and will show visually each stage necessary to open up a lock.  Also there is a lock demonstration board with several locks from easy to hard.  Pick the hard one and win a free beer!
    Gurney's Homepage! *Hobbits* Homepage!
     
  • Speakers Saturday:
    • Richard Thieme - Thiemeworks, Inc. - The More Things Change The More They Don't: Soft Destruction and the Ancient Wisdom of Hacking.  What works? What does it take to be an expert? To know how to see desirable goal states just before they become visible?  Instead of hoping the doors you blow open have something inside besides a smiling Fed? DefCon has everything you need, right here right now, if you know how to use it. The ancient wisdom lives here but you have to know what it looks like. Hacking is the serious exploration of complex systems. It's not about using somebody else's tools or the latest equipment. Hacking is about knowing how to know how to hack. This talk gives you meta-rules, not rules. It's the truth about why the ancient wisdom of real hacking still applies.

    Richard Thieme is a business consultant, writer, and professional speaker focused on the human dimension of technology and the work place. His creative use of the Internet to reach global markets has earned accolades around the world.  "Thieme knows whereof he speaks," wrote the Honolulu Advertiser. He is "a prominent American techno-philosopher" according to LAN Magazine (Australia), "a keen observer of hacker attitudes and behaviors" according to Le Monde (Paris), "one of the most creative minds of the digital generation" according to the editors of Digital Delirium, and "an online pundit of hacker culture" according to the L A Times.

    Thieme's articles are published around the world and translated into German, Chinese, Japanese and Indonesian. His weekly column, "Islands in the Clickstream," is published by the Business Times of Singapore, Convergence (Toronto), and South Africa Computer Magazine as well as distributed to subscribers in 52 countries.  Recent clients include:  Arthur Andersen; Strong Capital Management; System Planning Corporation; UOP; Wisconsin Power and Light; Firstar Bank; Northwestern Mutual Life Insurance Co.; W. H. Brady Company; Allstate Insurance; Intelligent Marketing; and the FBI.
    Their Homepage! Hear it! Real Audio (28k-isdn surestream)  See It! Real Media 7 (surestream)
     

    Bruce Schneier - Author of Applied Cryptography - Tradecraft on Public Networks.  Dead drops, semaphores, cut outs, telltales...the tools of spying.  In a world of continuous communications and ubiquitous eavesdropping, is there any hope for covert communications?  Learn about some old tricks of the trade, and some new ones.

    Bruce Schneier is president of Counterpane Systems, the author of Applied Cryptography, and the inventor the Blowfish algorithm.  He serves on the board of the International Association for Cryptologic Research and the Electronic Privacy Information Center.  He is a contributing editor to Dr. Dobb's Journal, and a frequent writer and lecturer on cryptography.
    Their Homepage! Hear it! Real Audio (surestream)  See It! Real Media 7 (surestream)
     

    Ian Goldberg - ISAAC Research Group, UC Berkeley - Cryptanalysis of the GSM Identification Algorithm.
    About 80 million digital cell phones worldwide implement the Global System for Mobile communications (GSM) protocols. Recently it was announced that COMP128, the cryptographic algorithm that protects the "identity key" in the majority of these phones, was extremely weak, thus allowing GSM phones to be "cloned".  In this talk, we will examine how COMP128 is used in the GSM protocol, describe the algorithm itself, and demonstrate how to break it.  We will also discuss the implications this result has for the security of of the voice privacy features of GSM.

    Ian Goldberg is a Graduate Student Researcher and founding member of the Internet Security, Applications, Authentication and Cryptography (ISAAC) research group at UC Berkeley.  His research areas include cryptography, security, privacy systems, and digital cash.
    Their Homepage! Hear it! Real Audio 7 (surestream) See It! Real Media 7 (surestream)
     

    Jennifer Grannick - Attorney at Law - A review of several major computer crime cases from the past year or two.  [Salgado AKA Smak, Kashpureff and one other]  This review will describe the hack (in relatively non-technical terms), what laws applied to criminalize the hack, how the hacker got caught, the prosecution that ensued, and the result of that prosecution.  Through these case studies, audience members should be able learn what not to do, and why.

    Jennifer Stisa Granick is a criminal defense attorney in San Francisco, California.  She defends people charged with computer-related crimes, as well as other offenses.  Jennifer has been published in Wired and the magazine for the National Association of Criminal Defense Lawyers.
    Their Homepage! Hear it! Real Audio (28k-isdn surestream)
     

    Lorenzo Valeri - Why are we talking about Information Warfare?  Lorenzo will try to assess the reasons of the growing fame of information warfare subject. The world is changing but not that much. He will speak at continuity and changes in information warfare in relation to military and strategic thinking. Most of the ideas developed in relation to information warfare have been thought at the beginning of this century. Moreover, there is the problem of intelligence requirements for performing information warfare. The main argument of his speech can be that what has changed is the TIME and SPEED factors but not the strategic and military thinking behind.

    Mr. Valeri is a researcher in the information warfare programme of the International Centre for Security Analysis, which is part of the Department of War Studies, King's College London. He is also a PhD candidate at the Department of War Studies at King's College. His research interests are information security policies, the impact of the Internet and other online services on military and strategic thinking and, in general, non-military threats to national and international security and stability.
     

    Ira Winkler - Author of Corporate Espionage - As I have often said, most hackers display skills that can be picked up by a monkey in a few hours.  Hacking is mindless the way the clear majority of hackers seem to be practicing it.  In this presentation, you will learn tasks that require real technical skills and abilities.  Not only will this provide you with more of a challenge, it will provide you with real marketable skills.  If you "really" want to challenge your abilities and stay out of jail, you won't want to miss this session.  Otherwise go play with the other Tools Kiddies.
    Their Homepage! Hear it! Real Audio (28k-isdn surestream) 
     

    Cult of the Dead Cow - The announcement of Back Orfice, DirectXploit, and the modular ButtPlugins for BO.  Last year it was an anniversary world domination party with the divinity of the bovinity + drinks from Lady Carolyn.  What will it be this time?!?!  The release of the Microsoft their Back Orfice Tool!  Read their announcement here, and cow-er in their presence!@#  Since the announcement, check out all of their media coverage here, here, here, here, and here.
    Their Homepage! Hear it! Real Audio (28k-isdn surestream)
     

    Mike Peros - Principle of Privacy Electronics - Massive illegal wiretapping exposed.  View the evidence from over 65,000 illegal wiretaps from local, state and federal agents, and the ensuing coverup by prosecurits, judges, and even the FBI's Louis Freech!  Scanned original documents soon!
    Their Homepage!Hear it! Real Audio (28k-isdn surestream)
     

    Winn Schwartau -President of Interpac, Inc. - Introducing the Time Based Security model and applying military strategies to network and infrastructural securitues.

    As president of The Security Experts, Inc & Interpact, Inc., he provides valuable consultation services to industry and governments on Information Warfare, enterprise information security, policy, hackers, US and International policies and standards, electronic privacy and related issues. His work and clients span three continents. He created and still manages the two most popular www sites on the subject: www.Infowar.Com and www.Info-Sec.Com.

    Mr. Schwartau is also the author of "Terminal Compromise" which details a fictionalized account of an information war waged on the United States. This prophetic book predicted a number of cyber-events, including the Clipper Chip, chipping, magnetic weapons' assaults, data and hardware viruses, to name a few. He other popular writings include "CyberChrist Meets Lady Luck" and "CyberChrist Bites the Big Apple," which cover underground hacker events, "Firewalls 101" for DPI Press, Information Warfare, Mehrwert Information (Schaffer/Poeschel, Germany), for "Introduction to Internet Security" for DGI and MecklerMedia, several chapters for Auerbach's Internet and Internetworking Security Handbook and Ethical Conundra of Information Warfare for AFCEA Press. He is currently writing two more books (to appear by the end of 1997) and is working on two major movie projects about Information Warfare and privacy..
    Their Homepage!Hear it! Real Audio (28k-isdn surestream)
     

    Paul Kocher - Designer of the EPIC DES cracker - The designing and production of the first dedicated DES cracker.
    Their Homepage!Hear it! Real Audio (28k-isdn surestream)
     

    Austin Hill-President of Zero-Knowledge Systems Inc., and Ian Goldberg - ISAAC Research Group, UC Berkeley.  Zero-Knowledge Systems will release the first complete Internet privacy utility for consumers in September 1998.   Using full strength, fully exportable encryption technology developed by some of the worlds leading cryptographers this product allows Internet users to become completely anonymous on the Internet, using digital pseudonyms and public key cryptography to establish and authenticate digital identities.  The Zero-Knowledge Systems development team includes Ian Goldberg who achieved international recognition for his part in breaking the Netscape encryption scheme as well as the development team of the Archie Internet protocol.  Forrester Research has estimated that 9 million people will have purchased an Internet privacy solution by the year 2000.   There are currently very few Internet privacy tools on the market making this one of the highest growth areas of Internet business.

    Previous to starting Zero-Knowledge Systems, Mr. Hill was the Chief Technology Officer for TotalNet Inc., which was one of the 3 largest Internet Providers in Canada.  This company was sold in March 1997 to MPACT Immedia which is Canada's largest E-Commerce company.
    Their Homepage!Hear it! Real Audio (28k-isdn surestream)
     

    John Q. Newman - Author of many papertripping books - The lastest in paper tripping, false identity, and how to REALLY not be found.
    Their Homepage! Hear it! Real Audio (28k-isdn surestream)
     
    • Speakers Sunday:
        •  
        Dan Veeneman -  Writer & communications consultant - Several low earth orbiting satellite systems are already in orbit, and commercial service is just around the corner.  Global wireless voice and data services will be available from handheld terminals. Dan Veeneman will bring us up to date on existing and future systems and answer questions from the audience.
    Dan Veeneman has served in various management and technical positions in the computer industry since 1980. He has developed financial programs for the banking, investment and real estate industries, as well as software for a variety of companies including A.C. Nielsen, McDonalds, Reuters and Baxter-Travenol. Dan has installed and supported many local and wide area networks, including a nation-wide data delivery network. He also has experience supporting Internet connectivity, including Motorola's world-wide Network Information Center. Dan has provided data security and encryption services for a number of government and civilian clients, encompassing video and data delivered over telephone, satellite and the Internet. He also edits a quarterly newsletter concerning cryptography. Dan holds an engineering degree from Northwestern University. Dan also writes a monthly column for Monitoring Times magazine called PCS Front Line.
    Their Homepage! Their Notes!
    Hear it! Real Audio (surestream) See It! Real Media 7 (surestream)
     

    Dr. Byte - Dr. Byte will give a technical presentation on The security of wireless technology.  Included in this talk include overviews of:* wireless networks, protocols, systems, and access mediums such as AMPS, GSM, FDMA, TDMA, CDMA, CDPD, 802.11, Mobile-IP, and Ad-Hoc Networks * current IP security technology (IPSEC) in IPv4 and IPv6* overview of areas of research and exploration of security in wireless technologies.

    Dr. Byte is a Ph.D. candidate in Computer Engineering and an instructor of Computer Engineering at a major university.  He received his B.S. and M.S. in Computer Engineering in 1994 and 1997 respectively.  For his M.S.,  he worked with a real time bit error rate simulator, and developed a next generation real time hardware system for bit error rate simulations.  He has developed a 16 bit RISC microprocessor in VHDL in a Field Programmable Gate Array (FPGA) able to run compiled 'C' code.   His research interests include security over wireless networks, in particular ad-hoc networks using IPv6.  He has co-authored 3 papers on IEEE 802.11 and IPv6.
     

    Peter Shipley - An overview of a 2 year effort in massive multi-modem wardialing.
    Security problems occur when obvious security problems are overlooked.  One commonly overlooked problem is alternative access methods to a corporate Intranet from an external machine. Many if not most companies are overlooking their secondary vulnerabilities surrounding alternate methods of  network access.

    Mr. Shipley will present research covering an overview of a 2 year effort in massive multi-modem wardialing.  His findings will include some personal observations and the results obtained from scanning the San Francisco bay area.  When Mr. Shipley started this project he noted that there were no published research references to wardialing or documented statistical results of the types of equipment and computer networks commonly found on the POTS (Plain old telephone system) network.  Mr. Shipley decided to change that through his research.

    Mr. Shipley Is an independent consultant in the San Francisco Bay Area with nearly thir***** years experience in the Computer Security field. Mr. Shipley is one of the few individuals who is well known and respected in the professional world as well as the underground and hacker community. He has extensive experience in system and network security as well as programming and project design. Past and current clients include TRW, DHL, Claris, USPS, Wells Fargo, and KPMG.  In the past Mr. Shipley has designed Intranet banking applications for Wells Fargo, Firewall design and testing for WWW server configuration and design for DHL.  Mr. Shipley's specialties are third party penetration testing and firewall review, computer risk assessment, and security training.  Mr. Shipley also performs post intrusion analysis as well as expert witness testimony.   Mr. Shipley is currently concentrating his efforts on completing several research projects.
    Their Homepage! Hear it! Real Audio (28k-isdn surestream)
     

    Prof. Feedlebom - If you have ever been slightly interested in operating your own micropower radio station, this is it.  Why to, How to, and how to not get caught. Will also discuss the potential of _legal_ micropower radio in the future.  Kind-of a how-to, kind-of a demo, kind-of a "let's make the FCC real nervous" kind a thing.

    Prof. Feedlebom and Technopagan have operated The Voice of Mercury and the Desert Crossing Radio broadcasts for the last four years.  They are also responsible for strange radio emissions that have been heard in the Los Angeles area on 104.7 MHz.

    Trask - Hacking the Big Iron - Security Issues in Large Unix Environments. I will be using the Sun Ultra Enterprise 10000 and IBM SP/2 as examples of how some of the newer, bigger unix systems (which are increasingly being used for jobs previously performed by mainframes) present some interesting challenges in the area of system security.  As you may know, the Ultra Enterprise 10000 is a SMP system that can be configured with up to 64 processors, which may then be partitioned into a maximum of 8 independent partitions. The SP/2, on the other hand, is an MPP architecture that can be configured with up to 64 8-way SMP nodes.  These two architectures are different in almost every way, however both are extremely fast, and both have some security concerns not present in more traditional unix systems. What I have found is that the security problems are surprisingly similar between the two types of machines.

    By failing to consider all aspects of security when implementing the system management tools provided with these computers, the vendors are selling million-dollar-plus products that are less secure than typical end-user workstations. I contend that as unix offerings start providing mainframe class computing power, they need to also look towards providing mainframe class security.

    Trask dropped out of high school about a month prior to graduation. After working at Wendy's, Wal-Mart and Texaco for a few months each, he decided that he would rather be a Unix sysadmin. He lives in 602 with his beautiful fiancé (mgd) and is currently employed by American Express, where he gets to play with all sorts of expensive toys.
     

    Panel Discussion - Securing Distributed Systems.
    Members include Brian Martin, Gale Katz, Route, Ejovi Nuwere, Mudge, Alhambra, *hobbit*, and Anthony Eufemio. ?? Check this.  Q&A on intrusion detection (ID) system, NOS, protocol and security utilities.
    Hear it! Real Audio (28k-isdn surestream)
     

    Super Dave -of the DoC - Copyright vs. Freedom of Speech. As policy and the economics of a world wide economy force us to attempt an information based economy, the manufactured concept of Intellectual Property becomes paramount.  Our preeminent corporations have shifted from GM and Ford to Disney and Microsoft; our government struggles to develop and globally enforce laws to protect the profitability of IP.  These laws are intrinsically at odds with the free and unfettered exchange of ideas which is central to the validity of democracy.  But IP law is built on a weak legal and moral foundation, and it is far from clear that an IP based economy is viable.

    David Gessel spent his *****hood hammering steel in front of a coal-fired forge as a blacksmith's apprentice for seven years. He then went to MIT to get a degree in physics where he focused on robotics and precision engineering. Switching coasts, David joined Apple's Advanced Technology Group and worked on various things including pen-based computers, LCD technology, and digital cameras.  After ATG, David worked at Interval Research Corp, researching rapid design/prototyping technologies for mechanical systems.  David is now CTO of Spinner, Inc., a startup developing QTVR technology; VP of Engineering for Nebucon, Inc., a startup developing secure Internet services for small businesses; and contracts mechanical design services bicostally.
    Hear it! Real Audio (surestream)  See It! Real Media 7 (surestream)
     
     

    Gregory Gilliss (of the DoC) - Gregory survived growing up in New York City where he learned how to program computers using punch cards and paper tape.  After graduating from Clemson University with a Computer Science degree, he developed an extensive consulting business.  Greg currently is VP of Software Development at Energy Interactive of Berkeley.
     

    Marc Briceno- Director of the Smartcard Developer Association - Smartcard Hacking for Beginners. Smartcards are a marvelous tool for the security software developer. Their small form factor and tamper resistant, though not tamper proof, packaging allows for numerous applications, such as secure key storage and encryption. Unfortunately, many software developers still consider smartcards difficult to work with. No doubt largely due to the fact that vendors have so far failed to provide sufficient information and development tools.  We will introduce SCARD, a free, cross-platform smartcard development, analysis, and integration tool. No longer does the smartcard-curious individual have to learn obscure low level smartcard commands. If you know how to use a UNIX shell or Windows NT, you can use smartcards.There will be a demonstration of several cryptographic, electronic cash, and GSM cards. The audience is encouraged to submit any smartcards in their possession for analysis.

    Marc Briceno is the Director of the Smartcard Developer Association <https://www.scard.org>, the only vendor-independent smartcard industry association. The SDA's member base is comprised of smartcard and security experts in Europe, Asia, the Americas, and Australia. The SDA distributes universal smartcard analysis and integration tools to software developers worldwide.

    Mr. Briceno coordinated the efforts leading to the discovery and break of COMP128 <https://www.scard.org/press/19980413-01/>, the GSM digital cellular telephony authentication cipher. Mr. Briceno is a senior advisor on digital telephony issues to an international development effort engaged in designing low cost phone encryption devices and a consultant to memory chip forensic data analysis teams at several major universities.
    AFTER
    • The DEFCON 6 Program
    • Reviews by attendees
        Krusty's review is done.
        Tananda has a review and blow by blow page set up.  Pictures soon!
        The LA Hackers (714)scene has a Top Ten list put together by Professor Feedlebom.
        TJ has written up an excellent and extensive bit of coverage.  It's in word '97format, and plain text.
        Boogah 187 wrote up this long review of his experiences at the convention.
        The TOP 14 Things Prof. Feedlebom learned at DEF CON 6.0.. many in jokes.
    • Polls
    • Media Coverage

    It's old, but still true.