First of all, welcome. Thank you for taking time out of your busy schedule to listen to my rant. Hopefully, it will be a fun session. I titled it Safe and Signed Git Commits with PGP. Like our wordplay on Safe and Sound. You get it, right? So this is something we started. I was working for a large telecom provider in Norway. They wanted us to explore signing of the Git Commits because consultants were coming and going from the project all the time, and they were like, well, we'd really like to be sure that the commits are from people that are actually on the project. And I thought, well, GitHub will surely make sure that the person is correct, but it turns out it's pretty easy to fake that. So, well, we went looking for solutions and we found that PGP was easily supported, so we went in with air. So first of all, a little bit about me. I'm Thomas. Hi. I work for Tietoevery. It's a consultancy in the Nordics and we're spread out over, I guess, 20 countries. So I become quite a grumpy old man, frequently yelling at the clouds and frequently sticking my nose where it doesn't belong. So that's why I made this call, this talk, sorry. So I work at Tietoevery, as I said. We are 27,000 people, I think, so we're spread out all over and everyone is basically doing their own things. It's not a lot of cooperation between the different projects, but that's okay. So they have graciously sponsored me to go to this conference and other conferences this fall. And also I shouldn't mention we're hiring, of course. So I love all things open source and I'm an eager advocate for open source. So this is kind of my 10% project that I do besides being a mobile developer during the day. I'm trying to raise awareness about how we should sustainably consume and contribute back to open source and also how we should create our own open source and inner source. So I basically love everything that runs on electricity. So that makes me purchase stuff from time to time that I probably shouldn't have. So I just want to gouge like the audience here. Who owns no Raspberry Pi? Who don't know what a Raspberry Pi is and how none of them? There are no hands up. Who has one Raspberry Pi? There are some hands. Who has two and three? There we go. Four? Okay. Five then? No one with five. I think I'm at three or something right now, so right in the middle there. Raspberry Pi's are beautiful. I don't really use them for anything, but they're so cool, so I just need to have them around. So that's fun. Well, enough about me. Well, you can contact me. I should mention that if you like. If you have any questions after this, we'll of course do a Q&A at the end if I have time. I haven't really practiced or rehearsed the timing here, so we'll see how much time I spend. But I will get queues from the back when it's over. It's time out. So we'll see. So this is the thing I want to talk about. We'll do a very light version about cryptography, because I guess not everyone are hardcore developers, but might need to know something about how cryptography works. So we'll do just no deep dive at all, just over the covers, above the covers. Look at a little bit about how pretty good privacy, which is PGP, how it came to be, and also later the GNU Privacy Guard. There are some fun with acronyms. The open source communities love their acronyms. And we'll look at a little bit how you can publish your keys and have other people sign them and vouch for your identity. And also, we could be using GPG for encrypting files and stuff like that, but I have left that part out since I'm not sure that we'll get through everything. If we have time, I'll briefly pop by that. Let's see. So very, very, very short version of how cryptography works. You have a, let's see if I have a pointer here. There is a pointer, a laser pointer. You can see that? You can see that, yeah. So you have a plain text that you want to encrypt. You use a key and you pass it through some algorithm, black box, don't know what it is, and out comes the ciphertext. So that's basically how it works. The reverse is the exact the same. You take the ciphertext and the same key and you pass it through the same algorithm and out comes the plain text. There we go. So this, we can use this for a lot of things, as you know. So we'll go through some of the concepts that make out, make up cryptography. And this is like, this is the symmetric one. So we'll do the asymmetric one and compare them. So symmetric encryption, one of the standards are called AES. Not really important here. The other is asymmetric. So the comparison would be that the symmetric encryption uses the same key for both encryption and decryption, and we can combine these. Asymmetric encryption uses two keys. While you keep one private, you can publish the other one, and we can do some things with that. And comparatively, you use shorter keys for symmetric encryption because it's stronger. It's not really, I can't really say that, but I'll do anyway for comparison. So with the RSA, the asymmetric encryption, you use longer keys then. And as symmetric encryption is less computationally intensive, you will use that for larger batches of data. And you will use asymmetric encryption and signing for smaller batches of data, like encrypting asymmetric key, like we'll see. So in common for this, it's like key management is the hard part for symmetric encryption. It's hard to distribute the key safely to someone you don't know because, well, you don't know them. With asymmetric encryption, it's you have your private key and you should keep that private forever, but if you don't, well, you're kind of screwed. So if someone gets hold of your private key, they can use it to decrypt stuff that you have encrypted before. Not good. So then a very, very short version of how public key cryptography works. You generate a key pair on your computer, preferably. The private key should never leave it. There's the point. The private key should never leave your computer. You don't copy it. You don't move it anywhere, but you keep it safe. Then you can post your public key on your website or public key server for everyone to download. Again, your friends can verify and you can verify that it's really your key and then they can download it and sign it. How you verify that is part of the distribution problem. Yeah, you can just call someone and say, hey, this is my key. Can you please verify it? And if they do, they're, well, they could be... They don't really know who they're talking to, right? There's a little bit of a problem there, but usually it works out well because you can usually verify someone. If there's someone you don't know, then it's not as easy. But with friends, it's easier. So that's the scope of this thing, is that we are using it inside of a team. So when you're working on a software project, you're using it inside of a team, so that makes it a whole lot easier because, well, you know the people on the team. So you can also make a certificate with that key and it holds your name and other details and by signing that using your private key, it's provable that the certificate is authentic because, well, you signed it, so you're the only one who can do that. So that's a good thing about this. It's very easy to do. It requires no infrastructure at all. And then if someone wants to send you a message, they'll download your public key. They can see it's been signed by other people because, well, you're forming a web of trust as I'm signing Marno's key, and Marno is signing someone else's key. I can implicitly trust them because I trust Marno, right? Marno is my friend right here. Hi. I'll be using you a lot. So, well, if you encrypt the message, only your private key can decrypt it, basically. So as I said, for larger datasets, you can... There's something wrong with the font there. I don't know. Something is skewed. It doesn't show up here. Okay, well, you can use the symmetric key to encrypt your data. So if you follow this schematic, you have a piece of data that you'd like to encrypt, and it's a big piece of data, so you then generate a random key, and you use a good pseudo-number... pseudo-number random... pseudo-random number generator. PRNG, yeah. To do that, so you're sure that it doesn't contain any patterns, and it's not easily forged or breakable. So by using that random key, you encrypt the data with this key, and then you also encrypt the key with your private... I mean, the receiver's public key. You don't have their private key, right? But you can encrypt this symmetric key with their public key, and then you can send the encrypted data and the encrypted key to them in an encrypted message. So the other side of the thing is that they take the encrypted message, they apply their private key to the encrypted symmetric key, and thereby they're getting the symmetric key decrypted, and then they can apply that using the symmetric key algorithm to the message, and they get the plaintext. So this is kind of best of both worlds where you get the lighter encryption, symmetric encryption for the large dataset, and you also solve the problem of distributing the keys. So... Any more points there? No, we are done. Okay, I was supposed to click through this as well. It just says the same thing that I've been saying now. Good. So there's another concept that we could talk about for a little while. It's a concept of a hash function. It's a one-way function. So as you can see, in this example I'm doing... Echoing a hello world into a short 256-sum tool. It returns a hash, and I do the same thing with almost the same message, but if you notice that the w is now a small one, it returns a completely different message. So any small change will completely change the hash, so it's impossible to guess what it is. Well, theoretically impossible. So what you can... Okay, let's see. Return the same ciphertext for any... Anytime you do this, you will get the same hash, right? Anytime you send the same message to the hash function, you will get the same hash back. So changing a single character completely changes it. And there's no really any conventional way to return this, so reversing it doesn't really apply. But if you use a weak hash function, like what's it called, a 40-bit DES? No, not DES. Anyway, a weak hash will of course be susceptible to a brute force attack where you can try every single possible value and guess the original message from that. But the cool thing is a matching hash value. If you calculate the hash value again and it matches, it's proof that this message has not been altered. So that's what we're using for signing. Right. Quickly again, signing is how you do this, is that you want to enable other people to verify that message really came from you. So what you do is that you write a message and you calculate its hash value. Then you can, with your private key, you can encrypt that hash value. And if it's possible to decrypt it with your public key, then they know that it came from you. If the hash doesn't match, it's been changed and it wasn't the original match hash, so it's not from you. And then it can't be trusted. So yeah, again, going through this a little bit quickly. But I guess it's something most people know, but maybe don't think about. So I guess it's okay to have a little repeating of it. So let's see. Yes, that's the last point. So this is what a public key looked like. I guess you have seen it before. My public key is placed on the Keybase. It's an online platform. It's open source, of course. And well, it's just a nice way to publish your keys. And it also has a lot of other functions. So you can go to Keybase.io and slash angunis, which is, yes, it's a game character I made once upon a time. So that's just a name. But that's me, and you'll find it there and you'll see the exact same key that I listed here, I think. Yeah, probably not. But this is how I show the key. The command is on top there. Use GPG and export it. And it's connected to the mail address. You can have many, but yeah, that's not going there. Pretty good privacy. It's a fun acronym. And it was made in the 90s by a guy called Phil Zimmerman, leveraging, well, cryptography and assigning, hashing algorithms to encrypt and decrypt text in email and file and whole disks and whatever. And this software was made, or the protocol and how it works, it was made into an open PGP standard. So it's the RFC4880. If anyone's interested in that, you'll find it on the internet. And I mentioned before, it's a web of trust model other than the hierarchical models of certificates like we know from SSL or TLS certificates. This is more based on I'm signing your key and you're signing my key and we're doing the web of trust. So then later, the Free Software Foundation created GPG. Also based on the same thing because the original package was, I guess, proprietary software by Symantec. So the Free Software Foundation wanted to have an open source version, so they did this. And Werner Koch was the guy who did that. Same thing, it's used for encrypting and decrypting. And I found that poor Werner almost went bankrupt doing this because he had no funding and it was like doing it in a spare time but the popularity exploded and, yeah, we know these sad stories, they're all over the internet. So support your local open source guy. Quickly about GPG, installing it, it's not hard. Whether your favorite package manager is, yeah, any of them, I guess GPG has been ported to every known platform known to man. So you just install it. I go brew, install GPG and I'm done. It generates a key ring for you and all the keys that you later generate there will be put into a database and it's quite transparent once it's set up. You can export it, of course, and move it to your new computer if you like and you can download other people's keys and you can sign and do all that thing. So instead of now showing how it's done, I'm just going to skip that. So I hope it's okay. So this part about signing other people's keys, right? You need a way to verify that they are really who they say they are. So people have been arranging key signing parties. So the top photo is basically what you think a key signing party looks like and the bottom one is what it actually looks like. A bunch of guys with paper and this is my key, can you verify that and here's my key, yeah. So it works, I guess. It doesn't really scale globally, but I met a guy a few months back. His claim to fame, as he said, was that he had a PGP key from the 90s somewhere signed by the original author of GPG. So that was like, yes, this is my thing. Just keeping your keys for that many years is kind of good, I think. So yes, again, mentioning the Web of Trust because you can accumulate a lot of signatures over time and the more people who have signed your key, the more likely it's trustable. And so, well, again, the Web of Trust, it's like I tried to explain earlier, if you're Ingo and you trust Eva, then you can also trust Manuel Stranger because Eva trusts him. You can trust that he is who he says he is, but you can't really trust that he has good intentions, right? But the Web of Trust is built like that. So, oh, it's just a key signing party again. I thought we were done with that, my problem. Well, within a team, like we did in the client software, in the software team that we were working, we just signed each other's keys and we uploaded them to these key servers. There are several of them on the internet. You can choose which one you want to trust and you can upload your keys there. And I have a quick example also how another team did this. It's CalSight, I guess. I don't know who they are, but we can trust them to at least let's see now if we can just pick that up. Oh, I got a new version. That's nice. Yes, I would like to join. No, you can see this. Okay, so I'll try to, for a moment, just stop the presentation. And we're back and we have issues to decode. And this file isn't formatted. It's not highlighted as it should be, so never mind the coloring. But this team has, like, gathered all their keys. You can just list them up here in one file. They upload that to their website, and anyone who needs to verify all the keys for all the people in the team can download that file and see their thumbprints and the full keys as well. And this can, of course, be machine read, and you can import this into your key ring and you can sign everyone's keys once you verify them. And so on. It works pretty well, I guess. So when people leave the team, they remove their key, and basically everything they've signed before will still be signed by them, but the key will still be there, but it won't be one part of the team. So going back to the presentation, I bet it's going to reset. Let's see. No, it didn't. Excellent. So there we are. Is this making sense, by the way? Yeah, good. There's at least one node. You got my back mono. So that's good. So it turns out there's no safety check when GitHub... Well, if you upload your... You push your commits to GitHub, there's no safety check that the SSH key that you're pushing with actually is any kind of match to your user on the GitHub account. So if I wrote another name and email address, I could easily forge a commit like that. And in GitHub, it would be that person's profile image if he's known or not. Her is known, she is known. So it would look like them, and their name would be right on the commit. So that's a kind of... Well, it's not really like a security breach, but it's confusing, and it could be leveraged, I guess, for malicious purposes. That's the point I was making. So, and there it is, and that one. We tested it on GitHub Enterprise. So, well, there are some issues about this. On the internet, you can go and find and read about. So it's a real thing. But then, we can also... With the GitHub Enterprise, you can enforce signed commits and branch protection. So you're not allowed to commit directly to the main branch, and also you have to sign all the commits. So if you try to push an unsigned commit, it will just say, no way. This makes it a little harder because you can't go in the web UI and just merge things. You have to pull it down and merge it locally because that commit also has to be signed, of course. And again, every team member, public keys, shared, signing. How many of these are there? There we go. Yeah, that's the last point there. Minor inconvenience. Well, it's not a big deal, and you should also not just merge things quickly, so you should really pay attention to what you're doing and download it and actually check where all the things are changed. So, and one point is, yeah, once you set this up, you can start it because Git will just sign it for you and as a user, you're just doing the exact same commit as before. There is a parameter like dash big S where you can, capital S, where you can force it to sign a single commit, but you can also use that setup in the configuration that it should always commit. I mean always sign the commit. So that's nothing you have to think about. So enforcing this on the server side, unfortunately the ordinary GitHub will not have the enforcement. It's only enterprise and protein plans that have that. GitLab does it right, so everything can be signed. You can force signing and I also check the GITI. I don't know GitT. I don't know if anyone uses that, but it will also do the same signing like force the signing to be possible. So that's good, right? But I guess you could, even if you just have an ordinary GitHub account, you can make it like a list of those public keys like I showed before and you can have the build process break if there's unsigned commits or there are commits that don't belong there because the public key is not in the list. So I haven't actually tried that, but I guess it should be an easy scripting problem to solve. And possibly there is already GitHub actions that can do this for you. There are a lot of those I see around the world. There we have the pros and the cons. GPG has a reputation of not being very user friendly, but it's like any other CLI once you start using it. I think it works great. It's quite okay, but it's got some bad reps. Some people don't like it. I was at a talk yesterday. He was talking about Git sign, which is another way to sign your Git commits with using ephemeral keys and you don't really have the key locally either. So you're just generating the key through a process. So that looked good and cool, but there was the login issue. Like login to generate new keys and stuff like that. So there's some give and take, some good and some bad about that as well, I guess. But yeah, other things, it's a little more work to complete a PR because you have to download and merge locally. Key management, still the weakest link because if your computer gets stolen or broken into and all your keys are in the slash SSH directory, then well, that's a problem.  I set up that with a question mark because while there are no guarantees in software, you can be pretty sure that it's legit, but well, there's always something and you still don't know the code. It's bug free, of course. So there's that. But on the other hand, you can't really fake the commits anymore because once you demand signing of them and once you have a list of people you trust within your team and you do that, well, I don't see how that could be faked then because it would show up that you're trying to be someone you're not. All of this is, of course, completely free and open source and transparent. So it works pretty well, I think. We never had any issues with it and we used it quite extensively. So well, that's that. So I included at the end here a little bit more about the advanced key usage because if you're really serious about this, you will make your master key and you will write it on paper and you'll lock it in a safe for different keys for different usage, for code signing, for email, for disk encryption and they can all be linked to your main key. So that's hardening it even better and disarming or locking your master keys. You disarm it so that it doesn't contain the private key anymore. So even if someone stole your computer, they couldn't get your master private key. You can also create revocation certificates. I'm not sure how you would distribute those, but possibly within your team. That's doable if you can just, you can commit it to your Git repo, I guess. And then there's the moving of your GPG installation. You can take everything with you, of course, move to a new computer. So that's also a little more advanced topic. I don't have time for that to go into that now. And then it's when you start using this and you start using it and for a while you've been using it and then you realize that, no, we have to stop and we have to go back. So you may have to rethink the solution once you really understand how it works. But it should be possible to then just remove the keys that you already had and generate new ones and do it right instead of having the one key.  How many keys do you want? And also the issue of offline key safety, there's one thing to keep it private, but the other thing is if you drop your computer and the hard disk dies, then you have to throw no fault of your own. You don't have the private key anymore. There have been some Bitcoin wallets, I think, that have had some issues around that, people searching in the junkyard for lost hard drives. Well, I think using a vault tool like HashiCorp Vault or Azure Key Vault or something like that, that should take care of that. You can store keys in there and they're pretty safe. So if that's not safe enough, of course, integrate a hardware security module like an HSM and really go to town on that. But I guess that really is so secure that we have so many other problems to solve that. That's okay. So that's... I want to do some Q&A on the end here, so that's all I had time for. Thank you for listening. If there are any questions, we can take those now. And if you want to reach out to me, it's also the email address at the front, but I'm on Twitter, my last name on Twitter. And I'm a signal user. I don't know if you use Signal. It's a great messaging app. I made a group there. So if you scan that QR code, you should pop right into the group. It's like a lobby where I can vet people and take them further into my domain of people I know. You can verify identity, right? Trust, but verify. So any comments? Yes, in the back. Oh, yes. The question is how does it really work with Git? Git has already support for GPG. There's a configuration command you write and just say this is the program. Point to the program. GPG and Git understand each other, so it just uses it. You also add the key that you want to sign that particular repo with in the config, so it will use that. So it's pretty easy to set up and pretty transparent. Good. Any other comments or questions? Yes, Marno. Yes, so the question is with the team that we were on and the throughput of people coming in and leaving the team, how do they manage that? Yes. I think it was like someone had an idea. We should sign commits and then they threw it all over to us and we said, okay, we can do it like this and they said, okay, good, let's go, let's move. So everything was done in Microsoft Azure, so the Active Directory identity thing was not connected to this, but people coming and leaving were controlled by their access to the Azure. So when we are signing commits as well, then we are like doubling up on the security, so I guess they thought it just a good thing to do. That answers your question. Good, thank you. Anyone else? Can't really see? No questions? Okay then. Then I think we're done with six minutes to go. Thank you.


So just to introduce myself, I'm Cabe's, I have full disclosure, I just found out that I'm responsible for this whole room when I walked into it. So don't do anything I wouldn't do. Also, I hope that, you know, this is everyone's first year here and you don't know that I was involved in scavenger hunt for the last 10 years. So that just really leaves everything wide open for all the trouble you guys could get into. This is going to be a very, very unorthodox closing ceremony because, because I'm figuring it out just right now. So thank you everyone and we're going to drink about it later. So, alright, I just give my thumbs up now. Oh, I'm good. Alright. So even though I went through the trouble of collecting the scores and the stats for everyone's contest or event, I definitely did not have time to put any of it on here because I'm making it up as I go.  If you're here, come on up. You're going to talk to people about it. And then we will be awarding prizes to the first place contestants. Thank you. I'm so excited that this horrible moment for me is going to be immortalized in DEF CON history. This is great. It's fine. Alright. So first of all, thank you to all of the C&E organizers. Even though we look incredibly disorganized right now, so much work goes into this. We all have day jobs and this is all just, you know, our love of the con. This is all of our, all of our time and energy. So thanks so much to all of the organizers. My goons are saving my life right now. So please give it up for my goons. And since we're getting real deep and you're learning a lot about me right now, I just came into this role about a month ago. So they just met me and they were very receptive to all of the bossing around that I've been doing while I try to, you know, get my sea legs with this.  Alright, beverage cooling contraption contest. Please come up and save me from this. So the beverage cooling contraption contest is the most fun you'll ever have. We had a blast. We had a whole bunch of teams sign up. Basically, you cool a beer as fast as you can. So we have two different competitions. One where you can bring anything you want in the entire universe. Just don't tell us what it is and you'll get it past security. It's fine. So you can bring air conditioning units, whatever you want, and you cool a beer as fast as possible. So we had that competition and then we have the other one where you can only build your contraption with stuff you get from the Las Vegas Strip. So you cool a beer down as fast as possible. So we got piles of dry ice, isopropyl alcohol. If you don't know, those two together is negative 140 degrees Fahrenheit. Negative 90 Celsius. So you can cool really fast. It also hurts your hands like crazy. So basically, we had those two competitions. I conveniently got the scores on my cool burner phone. So we had two competitions. We had one. So Casey, are you here? He's not. Okay. Casey won the unlimited competition. He brought a chiller plate. He cooled 70 degrees in seven seconds. It's 105 to roughly like 40 degrees in seven seconds. The thing was amazing. He was sitting there siphoning it with his mouth for like an hour. And then HD Smitty, are you here? I don't know if he is. Look like it. Neither of them are here. But he won for the hack competition. He built a, he got a bunch of air compressor canisters and blue air compressor canisters into a dry ice isopropyl solution. Also hurting his hands and built a cool spinny thingy out of stuff he found in the trash can in the contest hall. And he did really, really well. I think it was like two minutes down to like 40 degrees from 105. So it's also really, really cool. I think you guys need gloves. It sounds like there's a lot. Oh, there were lots of gloves. Nobody was using them. Not my job. We had safety goggles too. None of them were opened. So that's pretty much it. None of them are here. So we'll figure that out later too. Yeah, cool. Thank you. Absolutely a perfect example of safety third. All right, biohacking village. Do I have anyone from biohacking village here? That's a bummer. All right. I'll get there one day. That's actually somewhere I've really been trying to get to. Moving on. Creative writing short story contest. Do I have anyone from there? No. Okay. Oh, hey. Yay. It was a lot of fun. I'm serum. I actually won the contest with war dreamers. So thank you everybody. It was a lot of fun. A lot of hard work. Love the competition. It is Fox here. I did being in multiple places at once. I knew you could do it. I knew you would build the technology. Hi, I'm Fox. We did the fox hunt challenge for hunting down little foxes that we hid. There were three of them in total.  We hid one at the defcon sign under the chair. We had one which was really mean behind a projector. And I forget where the third one was at this point, but yeah. Super awesome. Yeah, there he is rich. But yeah, thanks. All right. No pressure to everybody else, but this one is very near and dear to my heart. Scavenger hunt. Come on up. It's so weird being on this side of this. I don't, it's all wrong. It's not meant to be this way. These are, this is my contest. We're supposed, I'm supposed to be with them, but. You are over there now. Okay. Go sit over there. Hello, everybody. I am one of the judges with the defcon scavenger hunt. If you do not know about us, then I don't know how you don't. We are the shenanigan razors here at defcon. We have been doing this for 25 years now. We typically have teams joined from all over the world. Typically people who come and play in our contest actually end up being in these positions. They exit, end up being goons speakers and they get really involved with defcon because we kind of force you to do that. You may be remembered for good things you may not be. That's not my problem. So we also had a side project join us this year from the national upcycle puny collective. And what's the, the, your institute. Oh, yes. So I'm going to get handed over to him to talk about our little side project that joined us with scavenger hunt this year. Sure thing. So the shell on demand appliance, which you saw is that lovely soda machine hanging out next to the scavenger hunt table was providing shells to defcon attendees anonymously using cash donations. We do have some stats from it that we would be happy to share with you. We have we sold 483 virtual machines. Unfortunately based off of the traffic stats off of each virtual machine only 41 of them were used. Only five of them had their passwords changed. Does nobody hack a defcon anymore? What is this? But nonetheless, it was a great service and we hope we can bring it back next year. Thank you guys. I fill in the blanks of that seat. This is what happens when I'm not with them anymore. The winners will actually be announced at closing ceremonies. The big ones. The big ones. So if you want to hear who won, you can join us over there. Okay. So hacker runway. This, I know that the person that ran it is not here. She ended up losing her voice. Kind of like me. This is not what I usually sound like. And so she's been running the contest for four years now. And this is one that I've kind of become really attached to because one of my favorite things about it is that it's incredibly accessible to people who are, you know, just getting started in the con. Like I did one of my favorite things when I first got here 15 years ago was playing around in hardware hacking village learning how to solder and, you know, trying to stick these on like all my stuff so that it looks really cool. Which is exactly what you get to do with hacker runway.  The winners of this contest were actually announced yesterday live on the stage. We had a, and I actually don't remember the name of the contestant because this isn't my contest. She had an interactive backpack. I don't know if you guys saw her going around con. But it was an actual hackable backpack. So I definitely encourage you guys to maybe look up this contest because the biggest regret I heard this year is that a lot of folks didn't know that this was a project they could be working on all year and just bring it out at Def Con and show off your stuff. It was so much fun. So we'll figure that out later too. Hack Fortress. It's Hack Fortress here. It's okay. Recon Village. Thank you. Hello. Good afternoon, Def Con. So we are Recon Village. We were hosting the CDF capture the flag event. It was a 38-hour grueling competition where we had about, let me check the stats quickly. Don't remember the numbers. All right. So we had about 134 teams all across the globe signing up with 240 registered users. Being a hybrid system, we kept it for everyone to sign up wherever they were. We had teams from India, Japan, France, everywhere across the globe playing. It's basically based on finding information on the internet reconnaissance and finding information on social media. So all those 38-hours teams spent smashing their head against the wall. I mean, people came up to me for figuring out who were the creators so that they can grab my neck. Thankfully, I remain discreet. But then we had about 50 or teams gathering points. We have three winners. Top three winners here. We had the team Alligator Hunters. Anyone here from Alligator Hunters? Oh, yeah. They are here. Cool. They came in number one. They came in number one with 2760 points. Good job, guys. Also, we have cool prizes to give away. If you don't mind, can we do that here? Perfect. Right. These guys are winners for Microsoft Surface Pro 2. And yeah, good job. Would you like to share your experience? If you don't mind? They got to know me now. They're going to kick me in the other room out there. Congrats, guys. Perfect. Cool. The second team was Team Pinja. I think we have, yeah. Come on on stage. Yeah. Awesome. These guys win Nintendo Switch. Yeah, you have been playing games with us. So you've been a gaming console. Unfortunately, the third team is not here. They were playing somewhere from France, Team Delaware. They are winners of RGB keyboard that we have. So I think we're going to share it with them. All right. So yeah, it was pretty fun. It was our sixth year doing this thing. And we'll be back probably next year again and make it a fun event again. So I'll hand it over to Shubham. No, I'm good. Thank you. We'll just see you next year. Have fun, guys. So these guys didn't know this, but DEF CON is throwing in a free pass for the winning team for next year as well. Did someone forget their mask up here? Anyone that came up with a mask that is no longer wearing one? Apology, sorry. All right. Wow. Damn, I'm short. Red Alert CTF, are you here? Maybe. It's such a sweet setup. And that is one of my biggest regrets about not knowing that I had to put up these slides, is that you guys can't see how awesome it looked. So you have got to come back to my contest room next year and see a lot of the awesome things that were happening. Thank you. Hey, guys. We are the Red Alert ICS CTF. We've come from South Korea. We've had, like she was just saying, we've come with a couple of good toys. Nice looking toys if you've come to the contest area, if you've seen a lot of lights. Most of it is us. And we had 61 teams. I hope they had a good time. We've got our first place winners right here. I'll not take much time. First prize was Team XX with 20-50 points. Seconds was Screaming Fist with 1-3-5-5. And rank 3 was Tain with 12-55 points. So that's a couple of Korean hats and Korean fans for the first team. Another contest that makes me look good. Thank you. Do I have anyone here from America's Next Top Threat Model? Thank you so much. Hi, I'm Noz. This is DEF CON's Next Top Threat Model. We put together a contest where we built a design and a fake company. And basically had contestants go through the design and look for threats and report those back to the dev teams. This is our third year. We were a first year. We were here at DEF CON 27. And it was the Threat Modeling Challenge. I was not very creative with the name and Grifter pointed that out. So hopefully we did a better job this year. We had two winners. We had, sorry, Conjector. Yeah, so they found a lot of good threats. And one of the best things during our challenge we actually produced a JSON format that we had people provide. And one of his best threats was use of JSON in the Threat Model is a breach of human rights. This may lead to excessive alcohol consumption, griping, and extreme cases, hurling of items to organizers. So when I emailed him, he already left. I sent a congratulatory email all in JSON. Yeah, so thanks very much for everything. We plan to be back here next year. This is like the third year. The company we put together was Drone Online. It was a company that was in military and warehouse supply chain logistics. They've decided to get into the food delivery space for last-mile delivery. What could go wrong with consumers ordering drones mixed with military drones in a mesh network? So thank you very much. The Goldbug Crypt and Privacy Village Puzzle. Do I have Goldbug here? Yay! I feel like this is coming together, guys. Thanks for sticking around. Hey, everybody. So I am Kevin with the Goldbug Puzzle. The Goldbug Puzzle is a series of crypto puzzles, not really your modern crypto, but more your stego. Here's a picture.  So this year we had a really good showing. We had 230 teams participate from around the world. We did a hybrid contest this year. Of those 230 teams, 29 actually scored points. We had 1,573 wrong answers submitted and 77 correct answers submitted. And if you're interested, there are still two puzzles that remain unsolved. So congratulations to Team Psychoholics for taking first place. By the way, they spent their entire con doing this, and I think they violated the three hours of sleep rule. Thanks, everybody. All right, tinfoil hat contest. Anybody? Hey, Krax, you want to come back up here? Nope. Don't go too far. Oh, am I going?  So love these guys.  Hello, everybody. So yeah, this is our fifth year doing tinfoil hat. This started as, you know, it's a total labor of love. It started because we wanted to put a contest in that had zero entry barriers, depending on your skill level, your physical ability level, your age level. Everybody can play. And I see we got some tinfoil hats in the audience over here. So let's see. I got to go back to my Twitter here to check everybody out. But I believe that stay skulls right here, correct? Yep, so that's our first place winner. Get up here. So this was a tough choice. We have winners for, this is a classic tinfoil hat. This is all tinfoil. There's no other elements to this. This won our substance award. This attenuated the signal the best. We also had Yogoth. Now I got to look at my Twitter here. But who won the unlimited category? So their hat contained tinfoil and other items for structure and style. And then we also had, oh I mispronounced that, Yagoth. So Yagoth, are you here anywhere? Oh, okay. I'll reach out to him on Twitter. And then we also have Melissa Miko. Are you here for style category or style winner? No. Well, and the style, this was second place in our style category. Our winner's style was this huge, you check out our Twitter, but it was this huge, elaborate flamingo with a flamingo tinfoil hat and braids and it was extravagant. So hopefully we can get you back next year, but congratulations to our winners. And we'll see you again. Alright, wireless CTF. Anyone want to come up here and talk about it? No, alright. Moving on. IoT Village. I'm Tivo from IoT Village. We had two contests running in our village this year. The first is the IoT CTF, which I think you're all familiar with. We had awesome turnout this year. We had over 100 teams that were competing. This was the biggest CTF that we've ever put on in IoT Village this year with over 48 challenges. We expanded beyond the typical SOHO devices that you've seen at previous DEFCON IoT CTFs. We had things like the emergency alert broadcast systems that you could exploit and pop a message on our screen. We had BLE, we had Glowcom satellite units. So it was an awesome CTF. The top three teams were only separated by a couple of challenges. In third place was Leet the Hardway. In second place was Colonel Panic. And in first place was Team Emojis. And then the second contest that we run, there's a ton of great talented researchers out there that work on IoT devices. We wanted to recognize some of their work, but also putting together an IoT CTF is hard and we just really wanted to crowdsource some of their work to bring it into our CTF. So we came up with the CTF Creators Contest. So you could submit devices that would become part of the CTF and we'd grade those devices based on difficulty and CVSS and discretionary modifier based on other factors such as the rarity of the device, the difficulty of the exploit, stuff like that. So the winner of that contest, NOAA, submitted a video doorbell. It had an off bypass that allowed you to trigger a relay that was meant to unlock the electronic deadbolt that's attached to that device. So a pretty awesome exploit that would get you into somebody's house. But it really triggered the max on the discretionary multiplier. Something that I think a lot of us researchers can relate to is the issues he had when trying to responsibly disclose to the vendor his findings and the fact that he had to go out and get a lawyer to cover himself when the vendor tried to sue him for responsibly disclosing his findings. So that triggered the max multiplier on our score. So congratulations, NOAA. I hope that that doesn't prevent you from responsibly disclosing in the future. So thank you very much. That's it. That's it. That's just a plug for the EFF. Thanks. Thank you. All right. Another crew that I love a whole lot. So I hope they're here. Carhacking Village CTF. Can I just add a plug? No. That's all right. If you want it. Do you mind? Would that be weird? Is that weird if I just unplug you? Do something. It's going to work.   Look at this. Always works. It worked. No? Really? Why didn't that work? It just did. Okay. Anybody got no? Really? There it is. All right. Yeah. Live demos. All right. I've always wanted to do this. I've got a board that's saying everything I want. I've got everybody writing it.  It does a real good job. Okay. All right. So I'm going to continue. Okay. So we had a few teams join our CTF this year. A little over 92. So yeah, like IOT, we had a ton of teams join us this year. So we're going to bring up our first place. If you don't mind coming up Xerovone, the GM cybersecurity team joined us. So these gentlemen did a great job. They finally got first. So they're excited. So as you can see, our teams are really small. They did a great job. They spent the entire time working on a host of challenges that we did. We even made a full virtual 3D car. So yeah, coming up behind me. I've already given them their award. It was some Go-Kart, some Segway Go-Kart scooters. So they're pretty excited about them. One of them may have been damaged in a car accident. So we apologize. They're pre-used. So thank you very much for joining us and come check out the village next year. Thank you. Thank you. Thank you. It occurred to me after that the design is usually that you come up one side and down the other. But I forgot to do that. Eddie. Oh no. Hold please. Wow, buddy. No. Perfect. You know what? Oh, it is. It's back. Perfect. Wait, no, I can't see it though, bud. What is happening? So do I just go? Let's see. Oh, another contest near and dear to my heart. This is family, guys. I love this. Well, thank you for the introduction. Hello to all of the doers of Darknet, of DEF CON. But I mean, Darknet's great too. So Darknet is many things. We can't really sum it all up in one small little thing. We're an in-person online role-playing game. We're a contest that's accessible to beginners and challenging for experts. We're one of the most prolific badge producers and kind of a thorn in the contest goonside for all of our lines. I mean, we get 500 people lined up every morning. We try. We'll do it again next year. And we're a year-round community of teaching and learning and fun. This is our 11th year, and it was another highly successful year for Darknet. For our homecoming, we went back to basics, teaching circuit design and expanding badge life to a record 1,300 unique designs. We also had over 200 players in our online CTF. The standings will come out at closing. So first, thank you to all the Darknet operatives who made this happen. It's definitely a labor of love throughout the year and many thousands of dollars in circuit components that we put together to produce all of those badges. So thank you to the contest goons for giving us the opportunity to put 500 people in line in the morning and helping us manage all of that. And thank you to all of our fellow contests for your patience as we flood the contest area. And finally, and last but not least, thank you to all of our players. You are absolutely the reason we are here, and we look forward to doing more of this for another 10 years. Thank you. All right. Do I have EFF Tech Trivia around? How's it going, everyone? I'm the Cyber Tiger from EFF Tech Trivia. How many of you all are familiar with EFF? Awesome. If any of you are not, we are a non-profit that defends digital civil liberties, your rights online, and hackers at DEF CON. We've been doing it since about one year before DEF CON started. So we've been around for 31 years now and we love the CON and we come every year. EFF Tech Trivia this year. We ran, we had 15 teams, all participating in what somebody called Hacker Jeopardy for kindergarteners. We had 15 wonderful teams and I have the winners here. One second. The third place team was the defending champions, Ballards as a service. Also the runners of the beverage cooling contest. So they were a little too drunk to win. The second team, EFF the system, and the first place team, Fnordlandia. So thanks to everybody who played. It's a lot of fun and it's a way for us to give back to the DEF CON community which does so much to support EFF. So thank you all. Come check it out again next year. We want to make it bigger and bigger. We want to be bigger than Hacker Jeopardy. Damn. That was like, you're going to throw down with them now. Sounds intense. All right. Last but not least, we have command control. No? All right. That works for me because it's very important. Oh, yes. All right. So of course, Gryfftr forgot us but that's all right. Everyone forgets who we are. For those who don't know, I'm Evil Mog. We run the DEF CON mud. We partnered with Nodexor with Snacky, the vending machine. I'm not commanding control. I am Evil Mog. Yeah, sorry. There's no slides because we're not that cool. Sorry. Anyways, so who here had a chance to go play with Snacky, the vending machine? Excellent. So we combined in with the DEF CON mud and we ran a whole whackload of challenges. He had to hack a Raspberry Pi that was in there. We were dispensing badges. Now there's a little bug in the game in that people couldn't actually win some of our challenges unless they cheated and hacked the game. Like the DEF CON mud had crippling bugs. It was fantastic. But we do actually have a winner. So we told Gryfftr we didn't, but we do now. So Chargent, are you here? Jonathan, come on up.  It was absolutely beautiful. So they definitely did a wicked job. They must have spent easily two full days in the contest area. We met the Onnotixer guys at about three in the morning at DEF CON 27 and bonded over a mutual love of Matt Damon. And ever since then, we've been following them and we knew we heard we would get a picture taken with them if we won this. So we devoted our entire conference to winning, which we did. So waiting for that picture. All right.  There are several slides I don't have. So I'm just going to be bringing up more contests that have winners to announce. Bear with me a second. Good afternoon, everyone. We are PTFS Presents Mayhem Industries. PTFS is a CTF team. We decided after a couple of years of doing quite well, let's say that we wanted to run something. Can we get our winning representative or our winning teams up here? If you all were in contests and you saw the oil rig flashing away and maybe something flashing under a sheet, that was us. We had over 80 teams with points on the board by the end of the weekend. Very exciting. And a lot of people starting things out. Top three teams. Do we have a representative of Team Autofill here? Can we have Autofill come up, please? In third place, Team Autofill. Congratulations. Giving you a set of bunk keys here. Second place, Team Oil Rig. Come on up, please. We've got a fresh set of tubular lock picks for you. Now during the course of our competition, people got a chance to hack an oil rig, open an alien vault, and discover what was inside. In this case, this wonderful alien artifact here. And this is going home with our first place winner, Alban Wifi. Congratulations. Well done. Thank you so much. I hope we'll be back here next year. Thank you for coming. We're the Red Team CTF. We just want to say thank you for all the players that we had playing this year. We had over 200 teams playing. So, you know, one of my favorite parts here is just kind of getting to meet all the different players. Helping them through the challenges. And that's kind of, I think, why we do it. We just love the kind of building that relationships, kind of meeting all the players and all the hard work that they do. So with that, you know, there's a lot of great competition this year. We saw a lot of movement on the board. And we'll talk a little bit about the players here in a second. But, you know, we had 85 challenges spread out over two days. And there's just, you know, a lot of teams working hard on them each and every day. So it was really great to see that. We had, you know, roughly over like 10,000 flag submissions. So a lot of competition, a lot of things going on. It was great to see everything. And with that, I'm now a researcher and I'll turn over Pony of A. Hey, I'm Pony of A. Just want to introduce the top three teams. They're coming up right now. Third place. We have international players. They came all the way down here. They focused. We did in person only this year. And they were down in the contest area. So CTF Singapore, third place. Then in second place, we had the Poner Puff Girls. I believe you're from all over, right? Planet Earth. Thank you. Thank you. We had a, we are very fortunate to have over $70,000 in prizes. We split that up amongst the top 10 teams and taken home gold for the Red Team CTF. All the way from Norway is Team E.P.T. And as they're coming up, I just want to say thank you to DEFCON organizers for having us here. This is our third year. It's great, every experience that we have. Thank you for the goons. They ensured that our contest was very smooth. We had no issues. Thank you so much.  They keep us motivated to work on the challenges throughout the year and put in all this effort because it's just great to hang out. And this is the meeting place every year. Thank you. All right. I think I'm forgetting someone else, right? Hey, DEFCON. Dave here. We're running the, been running the Maritime Hacking CTF. So it's SEATF, which works better when there's a slide. But it's an opportunity for teams to come in and hack real maritime equipment. We brought about half a million dollars worth of equipment for folks to hack on. Most people don't get to attack a ship. So we had all the bridge equipment, propulsion, and steering systems and ballast systems running the actual OT protocols. Had a 23, 22 teams. Hold on. I actually took notes. Give me a second. We had 22 teams participating. They captured 186 flags throughout the weekend and spent a total of 1,871 minutes actually connected to the hardware. And so the first place team, if they would come on up, it is the emoji team, ship wolf, fire, fire, fire. And so this team actually spent the entire con sitting in our spaces over in the ICS Village. So it was a great opportunity and a lot of fun here and want to give them a good round of applause. And thank you for letting us run this great competition. Sorry about that. I was complimenting someone wearing our merch because it really is all about me. We are Trace Labs. We were here for our fifth year running our search party CTF. This is a CTF that gamifies the collection of open source intelligence around actual missing persons cases. The end result is that data being turned back over to law enforcement, hopefully aiding in the investigation of that missing person. We made some really big changes to our contest right before DEF CON because that makes sense. It went great. The quality of the intel submitted was better than 80 CTF we've ever run. We saw 650 contestants form 250 teams investigating eight real missing persons cases submitting almost 4,000 pieces of intelligence. Just a mind blowing experience. We found missing persons that were no longer missing. Hopefully law enforcement will be able to take those missing people off their books. So really just a great experience. We have an amazing community. Personally to me the points and the winners are secondary to the mission but is a CTF so someone is going to win. Alex who won? Yeah so the winner, so we have winners based on point values and we have our highest winner is the one that submits the most valuable OSINT so the most valuable piece of intelligence. So in our third place we had people of OSINT land. Second place we had B Berlin. First place we had the FSBs. For our MVO we had received a photo taken of the missing person stating they had been found safe. So while many contestants had found this flag they had articulated the flag and across referenced it to validate the source of truth. And with this this is the type of significant advancement to the timeline and the type of submission and results that align heavily with our mission. Our winning team was OXFORCO squad. All right so I feel like I have to introduce this crew. They came here not really knowing where they were going to land because kind of like this making it up as we go and by the time we got them set up even though they didn't have a sign even though initially they didn't have a projector, very very big crowd draw because they've been working on this stuff all year. You know what I'm just going to let them tell you. What's up DevCon? We're an atomic security team. This is our first time running an open CTF at DevCon Contest Area. Like Cape said we want to give her an awesome shout out because she's been super helpful this whole time. We showed up with nothing. We started on the ground and then as the time progressed we got a table and then we got a projector and then we got a screen. It was awesome. So we did a- You didn't even have a slide. Next year we might have a sign she says it'll be artistic. So we ran a jeopardy style CTF with 16 challenges. We had different types of challenges. We had web challenges. We had crypto challenges. We had programming challenges and backend server challenges. We gave around 200 PCB challenge coins. We had 60 shirts giveaway. We were about to give hundreds of dollars away at Amazon gift cards to the top 10 teams and I'll let Jiva here announce the stats. Hey everybody, just a few stats. We had 200 flags captured across 42 teams. First place winner was Hubert. They solved almost all the challenges except for one. Second place was Coco. Third place was Buzz. We want to give a special shout out to the fourth place contestant, Percent S. This person was a single player high schooler that dominated for most of the majority of the competition. So shout out to wherever you are. The final leaderboard is available at ctf.atomic.financial. Top three teams wherever you are, please meet us over there somewhere. We'll give you some hats, shirts. Thank you to the goons. Thank you to Caves once again for hooking us up. Thank you DEF CON. Hopefully we'll be here next year. See ya. The telechallenge is one of the hardest contests at DEF CON.  Come on up on stage, guys. These guys gave up 1489 minutes to become the winners of the telechallenge this year. We spend pretty much all year building it and part of the puzzle is learning that you're in a puzzle. We showed up as Red Sea Cruises this year so if you got a, you may have won a free cruise flyer that was us. That's actually a sequel of our 2018 game where we also showed up as Red Sea Cruises. Just a couple of stats. 3,940 calls came into our systems across the 20 registered teams that played with 294 unique callers. Total time spent on hold was 955 minutes and one person sat on hold for 90 minutes. There were 4,402 attacks on voicemail boxes and we built a casino inside the game if you played. The total telecoin casino slot machine polls were 6,163. Red box, red box, red box. We'd like to invite everybody to look for us next year. Keep in mind we never show up as the telechallenge. We show up as something else. You need to be prepared to play and you must play in a team if you want to win. So I'm so proud of Foxbox Styling Services. They've been trying to play and win for five years and this year they finally got it. Congratulations. We are Crash Compile which is we create programming challenges, make you do them live on stage. Well, we try to feed you a lot of beer and try to distract you in any other way possible. We had 70 teams register to do qualifications and then we did the top nine teams on the main contest floor. If you were there last night there was a lot of chaos. For the first time ever, every team competing both scored points and scored points on the final challenge which means despite all the beers, all the distraction, all the chaos, every team was still there and competing till the end. For our final problem this year teams were competing with each other in a multiplayer arena. They had to write a program that could explore, take over and maintain their sake of the arena for the entire duration of the competition. Team Jam was our winner this year with 406 points and took home the custom fabricated Crash Compile trophy. Our giant metal D10 covered in programming language for Crash Compile history. Second place with 368, pro gamer moves, and third place at 258 was advanced persistence sweats.  Hey guys, my name is Jeff. I go by the handle Morpher. If anyone is in the room who is competing in the king of the hill challenge for tamper evident can you start making your way up to the stage please?  So tamper evident, I'm going to try to keep this quick. Tamper evident is right next to lock picking. We tamper seals is what a seal looks like. These guys have been competing in five separate categories over the course of the weekend to open these seals that are locked in a one-way manner, right? They're not supposed to be unlocked. There is no picking here. This is a one-way seal. These guys have been devising defeats through the entire weekend cutting each other down second by second trying to get the fastest possible open without leaving any detectable trace. Guys, start making your way up here. So we had five different categories of entry. These different categories were a red and black little zip seal. We have a yellow padlock seal. We have a red zip tie, which looks a little bit like this.  And of these different categories, these guys started by opening them in a couple minutes, right? People were bleeding all over the seals. Not quite evident, you might say. Yeah. Yes. Yes. By the end of it, some of these guys were opening these seals in less than 20 seconds at speed, leaving absolutely no trace left behind with homemade tools MacGyvered at the competition. So to announce our winners, Eliezer opening the red and black seal in 12.97 seconds. Zeb, if you're out there or up here, opening the yellow padlock at a 9.5. Damn near perfect to open. Let's go with Cardinal, if you're here. Right here. One of our number one guys beating down everyone you see here in every category slowly at a 23 second open on this particular seal. And finally, Ian, with a white plunger open. Again, these things are used to lock weapons in the military. They're used to do your meters at home for electricity and water, that type of thing. These guys were able to open these in seconds with homemade tools and do so in a way that leaves no trace whatsoever. Guys, thank you so much for competing, Tamper Evident. Shout out. And lastly, we also allegedly were maybe the guys involved with the counterfeit badge contest. So you might have seen some of these floating around. There's also a few out there right now.  Shout out to the CJR for a perfect replica of a goon badge. Good job getting into the knock, impressive. So yeah, that's Tamper Evident Village for you guys. Thank you very much and congratulations to our winners. Thank you. All right. I think I got it right this time. I think that covers all of the contests and events that, well, they put on great contests. Sorry. Really stress in here. But something that I really wanted to say, even though I know I have to wrap up here, is my reminder every year, if there was a contest that you didn't see, that's a place for you to become a part of this community. Everyone here wanted to create something new, so they made it happen. I don't have contests and events without you guys. So, you know, for every time a contest thanks me, I'm just doing my job, sometimes not even that well. But thank you so much, everybody.  Here there's another closing ceremony. I don't know. This is the good one.