Let me welcome everybody. Welcome to the Future Trends Forum. I'm delighted to see you here today We have a terrific guest on a great subject and we have all kinds of things to talk about now I'm absolutely delighted to host this week's guest for two reasons One is that we've been looking at gaming and education for years in the Future Trends Forum We have we have front-loaded all kinds of game platforms game designers game schools of thought We've explored deeply the many ways that gaming can enhance education So we have now this is the other reason a person whom I think of as an exemplar of this field Michael Townsend has created one of my favorite narrative games called a dark room But he also just this month published with Google and how to game how to game an educational game that explains How the hardware of quantum computing works? You can play it easily if you look in the bottom left of your screen You'll see a little box says the cubic game press that and you can dive right in so I'd like to do with Michael Townsend is to have him talk about all the different ways He designs these games what he has in mind, and I'd like him to be able to answer your questions So hello Michael greetings. Hey, how's it going? All right? How's Toronto? It's actually kind of nice today It's lovely I did lovely little walk down to my local cafe and got a good coffee, so I'm in good spirits nice Nice very nice. Well welcome to the forum and thank you for joining us. Thanks for having me We have a traditional we ask guests to introduce themselves in a particular way Not what you've been working on but what you're looking forward to working on for the next year So what are the big projects or the big idea is there top of mind for you? Damn? I have no idea like I just I just finished a thing and so I'm in sort of that artist assumption absorption mode where I'm just doing whatever and and seeing what ideas pop up I've got a couple sort of concepts on the go, but I have absolutely no idea what I'm gonna be doing for the next little while I mean the summer is gonna be crazy like it is, but you know, I Don't know the answers. I don't know That's an honest answer and I appreciate it But that absorptions a key part that sounds like a key part of your process Absolutely. Yeah, you can't create without spending a good amount of time just absorbing everything around you We have to do it. Otherwise, you don't have any raw materials Good point good point Friends if you're new to the forum, I've got a couple of quick questions to put to Michael And he's gonna grapple with them as best he can but what I'd like to do is I'd like to share all the different Questions you have so today as he starts answering my interrogation Please start thinking about the questions you'd like to put to him And and if he can't answer them, he won't and if he can he'll go after them So the first question I'd like to ask is one that I I asked you or my students asked you I think Looking at the cubic game. Can you tell us a little bit about your thinking that went into it? You're trying to translate a very very complicated Set of information how quantum computers work and you're trying to translate that into a game What was your mental process for doing that or was your design process for doing that? So first I got to say that I don't speak for Google at all. I just have to have to say that right away I don't speak for all this is all me and then I can answer the question so When I approach anything The first thing that I do is again absorption and then break the problem down once I feel like I understand it break the problem down into a few pieces so with the cubic game I looked at The actual structure for the hardware layers of a quantum computer So how these things work on a broad level on a very general level and I broke it down into what I saw is sort of its main component parts and Then I tackled each of those main component parts from a game mechanics perspective How can I sort of represent? this idea this one piece of quantum computing in a gaming metaphor that that translates well and Just sort of keep doing that until it's done So in in individual sections of the idea of are the are the knowledge that you're trying to share that map Onto individual loops or mini games or sections within the game. Yeah, exactly. Exactly. So like diving a little bit down into more When when making a game We're in designing a game mechanic to try and explain an underlying metaphor and and you're always doing that right like whether you're underlying metaphor is a game of tennis like impong or a quantum computer like the game when you're looking at Mechanics that you can use as metaphors for those things Applied a spark from sort of reality So in the concept of quantum computer the three broad layers that I broke it down into was sort of the quantum layer Which is the base layer of quantum computing is the fancy weird qubits that are doing their quantum magic And that's sort of the smallest most basic component of the computer But it's only a very small piece of a quantum computer on top of that They've got the analog layer which is necessary to communicate with your qubits from the outside world And then on top of that you've got a digital layer that controls the analog layer and makes it accessible Like a normal computer would be and so I broke it into those three pieces and then found mechanics that sort of represented the major challenges that engineers face in each of those layers and and tried to sort of gamify them Mm-hmm. It's it's fascinating. Of course, there's a fun recursive idea friends If you if you haven't played the game yet I don't want to spoil your fun because I think it's delightful, but I love the idea and it's not it's not unique to this game But still it's always cool when you when you're using a computer to play a game to use a computer You know, there's a there's a I love that recursion to it. I love interface games interface games are some of my favorite Is there is there any interface game that you haven't made that you're especially fond of that you recommend? Oh Oh damn. I mean there are a ton. There. There are a few in the sort of same genre as a dark room that I'm a big fan of One of them would be space plan I think is is really really great There's a game called TS what is it TS 500 TS I don't know Off on it. It's it's another interface game. That's really really great electronics There's so many that products make a lot of really really like cool interface games that TS 100 TIS 100 is is one of the most extreme examples of that kind of meta self-referential that you that you're talking about Oh, nice. Thank you. Thank you Rends me of there is a space game where you actually had the command line interface was in the game to command robots as they moved around Yeah, yeah, I know that one and like the view is like a granny surveillance camera or something, right? Yeah Yeah, my my son who's never used a CLI was into it and so I was telling him now next step Fortran So let me let me ask a follow-up question before I date myself even worse So that gives us a sense of your of your mental process and where metaphor is key and then linking up You know breaking the main big task into smaller bits and then Kepting that to game loops. I guess the second one to ask is you know, you are doing this I know you're not speaking for Google, but you do this as a contractor working for Google What was that relationship like? I mean, how did they what did they provide you with? I what constraints do they impose on you? What was that like? Well, we all sort of came into it not really knowing how the relationship was gonna work They were they were building an experiment and I'd never done work like that for a company before and so we kind of figured it out as we went But the relationship was very very casual and very very flexible it was it was really great I had a lot of flexibility and build Building is a big part of my creative process when when it comes to design. So I kind of just sort of made the game and and Engaged in constant communication and feedback with with them and with the quantum team there to make sure that I was staying on track And that everything was good and we did a lot of play testing that they helped me with I had designers on staff there that did a lot of the graphical work It was it was great. It felt a lot like building my own game supported by a team. Oh Nice nice. Yeah, I'm very lucky And and just just to be clear when you say that you for you a key part of design is building My senses you mean building right away and fast to get things right Yeah, especially with games That's really important because the interaction is 90% of what you're building and you can have a lot of ideas in your brain about how the interaction is going to feel and like What's gonna work and what's not gonna work? But you're not actually gonna know until you have it in front of you and you're playing it And so you need to get to that place as fast as you can because the time that you spend before you get there is We're very likely going to be wasted time This is interesting You know in higher education that is often this partnership between a faculty member and instructional designer where they Collaborate on doing certain digital projects for our class. I think you just outlined one really interesting way from the to collaborate We have a quick question that came up from our wonderful friend Stephen Airman, which I should have asked myself But I was too excited. He asks what is an interface game? Can you define that? Oh, I mean, that's I don't know that that's a term that anybody uses other than me But an interface game as I designed as I define it is a game where The game literally is an interface So like a lot of video games, you know, you're from a camera That's over the shoulder of a guy carrying a big gun or something, right? Like or whatever But interface games the game itself is like an interface to an application that doesn't look like a game per se It looks like a web app and I just love those things because it's it's it boils games down really to their root component Which is here's a box play with it figure out how it works How can you change it? How can you master it interface games or just little puzzles? I just love playing with them Excellent Stephen. Thank you for asking and Michael if you've invented the term we I think we've not coined it It works for me friends If you're new to the forum you can see that we are very happy with all your questions So as we proceed if we jump over a term too quickly, please throw out a question. We're happy to handle it And and even as I say that more questions have come in. Here's one from John Hollenbeck who asked a deep question What makes a game educational? I sense as a builder you can constraints choices which directs learning like a lecture Yeah so I Think that all games are educational first of all and and I can explain why for it Pretty quickly is that play itself is Educational right like the earliest examples of games the early exact examples of play those things exist to teach concepts and You look at the animal kingdom they play to learn you look at children. They're playing to learn play is Fundamentally educational and games are the aesthetic expression of play just as you know movies are the expert at the aesthetic expression of I don't know drama like human interaction and and Paintings or the aesthetic expression of pictures Games of the aesthetic expression of play and so by nature they are educational. They're teaching you something It's just that we as game designers, especially designing for entertainment Don't usually think about what the game is teaching in most games all they're teaching you is how to play the game And that's not useful really I mean it is there there's transferable skills and a lot of things that are that are broad that you can learn but like What differentiates an educational game from an entertainment game would be that you Intentionally use the mechanics of the game to teach something that that you want to see you're thinking more about what the game is actually teaching the players There are lots of ways to do it. I Don't think most people do it well Then what what role does the In the chat John said he follows up by saying no different from how to get a degree Which is another game? But I'm curious about one part of John's question, which was about constraints now and And he compared them really interestingly to to a lecture, you know lectures limited by time and other things How what role the constraints play in designing educational games? hmm, I Mean when it comes to design I find constraints are more around the technology that you're using The time that you have to build Constraints like I didn't really have a lot of constraints from Google In so far other than that they wanted something very similar to a dark room. That was really my constraint They're like we wanted an experience like this Which I probably would have done anyway because I think that that kind of format is very good for education when When I'm thinking about how to use a game to teach the constraints around Education I think are are more around sort of cognitive limits of People that are engaging with it. So if you If you draw, you know a grab bag of 50 different game mechanics on somebody right away They're gonna get overloaded. Yeah, and so with games you can pace the delivery and You can actively integrate the sort of lecture with the test, right? The lecture will be repeated until you pass the test and it doesn't feel like that Because you're playing a game, but it's true And so a really really good example is from the very first level of the very first Mario game A really really good example of sort of integrating a lesson with a lecture or with a test very beginning Mario's there you run you learn that you need to run forward So you've learned that you can't proceed until you've learned that then Immediately you're faced with a little goomba and you have to learn that you can jump over him And if you don't learn that you die and you keep dying until you learn that and they won't give you anything harder until you get past that And that's really really core to game design in general Is that you need to introduce your challenges one at a time and repeat those challenges until the player can pass them? And then you can build on that and make it more complex and more difficult and exactly the same thing for education My students were keen on identifying that as scaffolding, which is a term of art in pedagogy you know you think You think for example of a foreign language where you only Introduce so many new vocabulary words at a time because if you give some of the dictionary they drown And then you give them one verb and they have to keep working at it until they get to work So that's just that's just how games work, right? Like yeah Well, let's get harder right and as game designers like we've known that for ever since we started designing games But it's exactly the same as education because games are education In in the chat Rebecca Frazi adds another classic term From a century ago actually by a really really powerful one called the zone of proximal development Which a Russian theoretician came up with that's just that there's that zone where you know where you're the game It's a little tougher and so you've got to be a bit more challenged But it's not going to destroy your your life immediately It's gonna be enough for you to go and it can't be too boring. It can't be too easy You know can't just keep jumping the goomba over and over again. You have to add to them or make And game design we would call that the challenge curve. Yes James Paul G has a terrific book about this where he really really brings these together and he agrees with you The idea that every game teaches you something It might not be a great thing or might just be how to play the game But they do have to teach John wants to join us up on stage.  I can make some room Hello, John. Hello. Hello. Hello My son's in Toronto at York, he's just graduated up there and he's gonna try to figure out how to live so Not here That's what I tell him this This conversation I go back a long ways in education But I just want to bring up something from the Horry Pass and that's Seymour Papert's Mindstorms I don't know if you're aware of that book. Oh Yes Yeah, we drug this. Yeah, see this is this goes back to what I was doing back then but Essentially the argument is that Papert makes is do we want the computer to program the student or the student to program the computer? and I still say that that Mindstorms is The only book of creative use of computing as an educational device And I guess what I'm trying to get out of my questions is that when you design an environment like a game you're in charge of right and wrong and To a to a degree But like if you give somebody a trombone There's a lot of possibilities that they could they could take this. It's a it's a different experience than a close form game and so I guess I mean you just find the success criteria. Okay, but some games don't even have success criteria, right? Like look at Minecraft, right? You just play that you play it to play it.  Yep We need we need a course in in in all of this and what yeah, because it's easy You know, it's easy to shuffle by all of this stuff But you know, there are some there's some phenomenal writing in the 70s 80s and 90s about what computers should be Based on what people were seeing then it's not to say that we old farts had all the ideas But it was just a different perspective available that But anyway, I mean that's just the one comment.  Yeah, like like I said, you can't you can't create without consumption and By consuming media and consuming culture and consuming ideas you The the creative seeds Appear and whether or not you decide you're gonna follow them and actually make stuff and do things as is up to you But games can help with that too because games absolutely help develop a sense of agency Yeah Thanks, I mean this agency I just wanted to pick your brain on something that I feel better about my son's path right now then Well, you should and John congratulations. That's great to hear. Yeah, thank you. Yes He's yeah, he's in danger of a double major in writing. So I wish him all the best in life. Yes indeed indeed And if you haven't I put a link to an early PDF of Papert's book It's it's a terrific book. I've been trying to exit it for one of my classes. I really recommend it It's also He's also the mind behind the logo language, which is where teaching kids how to have a program Well, that's a that's a video question by the way So if any of you want to join us and you can tell that Michael and I are both very kind to you please We'll clip the raised hand and we have more questions coming in We have the excellent Roxanne risk him and Roxanne asks What are your thoughts and have you seen more attention to game design on? Accessibility meaning for students who have cognitive physical mental challenges Yeah So the answer to that is absolutely yes The this is actually a really really big topic in game design circles right now If you were to jump on dig, you know game design Twitter, it's it's a really really big concept and it's a really big specifically because of a recent game that's been released called Elden Ring Hmm and I could talk forever just about that, but the This game for whatever reasons for various reasons has really brought up this debate about accessibility and gaming and and where How much responsibility game designers have? for accessibility and like whether or not accessibility impacts a creative vision and all of these things is is a very much in The game design sphere of consciousness right now My thoughts my opinion on it is that accessibility can never ever hurt a product and as An artist as a game designer you want as many people to be able to enjoy and play your game as possible and Accessibility is absolutely a part of that I Am ashamed to admit that the games that I make are not accessible because I'm one dude I would love I intend to do better at that because I Should do better at that But yeah, it's it's really big right now. Very very big. There are lots of things that you can do in game design to The aid with accessibility, but I'm absolutely not the right person to talk to that to speak to that there's there's a really great a Really great guy Grant Stoner, I believe his name is who is himself a disabled gamer and he speaks very very very well and eloquently on this stuff And I would strongly recommend that you follow him Michael if you can is it Grant Stoner? Yep Grant Stoner. Okay. Thank you That's really helpful. Oh, yeah on the Twitter. You super crib 1994 Very good very good As always Roxanne, it's a great question by the way Roxanne risk and has just as almost pretty your natural gift For doing screen grabs that make everybody look great. I Just I just gave up. I just let her do it. She's just remarkable that but she's thank you. That's a great question And Michael, thank you for that very candid answer. This is this is definitely a huge topic And I think we'll be doing more and more of this We have more questions coming in all over the map So let me bring these up. This is from Lee Nichols and Lee comes back to one of John's points Games are interactive and great agency to the player some educational models do not Do you think that's a major factor in the attractiveness of using games in education or are there bigger factors? Yeah short answer. Yes longer longer answer is that Going back to an earlier point that I made in that play is sort of the fundamental building block of education I would say that the fact that most educational models don't include sort of an interactive Component is to their great detriment because the interactivity is what builds curiosity and builds confidence and builds all of these connections that Strongly strongly aid in learning like I I don't remember where I read this but I strongly believe it to be true that that the single most important thing when it comes to whether or not you're going to learn something is curiosity and Games interactivity build that like nothing else like a textbook can't do that. You already have to be interested I'm thinking about your example of Mario Where well you have to go someplace and you it's not working. Well, why not you want to solve that? Yep Absolutely, there's a wonderful more recent game I'll kind of post nuclear game Fallout 3 and it begins with the main character as a baby And the tutorial is your first 16 years of life And so, you know, all you care so puts you in their shoes like how do I get out of this crib or who is this person? Then it drives you through very very nicely. That is a really really good example of something called leudo narrative cohesion Yeah, so Narrative I'm sure that that word is familiar to people but ludic Ludo is sort of the the the fancy word that we use in game design to represent the interactive component of a game And you know narrative cohesion or dissonance is how well your mechanics your interactive component Dovetail with your narrative component to to strengthen your point and and that's like that's what Game is really really shine when your mechanics and whatever metaphor like whatever you're trying to get across your point your narrative You're whatever and those things dive when they resonate your game is good and So when you look at the beginning of Fallout 3 In a tutorial situation, you have to limit player agency so that you're keeping that cognitive window small, right? Like you have to drip feed stuff But why would the character in a narrative sense be limited? Well, he's a kid kids have limited agency. It's perfect, right? Like that's a very very good example It's that's a great game as a whole which I recommend But it's but yeah, I think that's a great great tutorial There are people who've been throwing in a bunch of questions now and I need to I need to get up Stop asking my own because these guys are good We have Nathan Kelber from Ithaca. Hello, Nathan Who asked I completed a PhD focused in games and play recently? I became a programming teacher your games have inspired me to try to create games for fun. How would you get started? Just do it So Consume Play lots of games until you feel inspired and then build it The trick there the real strong difficult trick is limiting your scope As a first-time game designer or developer your you're gonna want to think huge your your inspiration is going to be huge It's gonna be far too big try and make it really small My game a dark room is a good example. I was able to build that in two weeks Which is small enough for one person to do before burning out and feeling tired And you can get bigger after you're comfortable and after you've got your sea legs and stuff But like think of something small build it if it's really your first game Copy somebody else find a game that you like that's small that seems easy make your own version What though if I can't Nathan if my question is off-base, please What RPG maker There are lots of different game engines and lots of different tools out there From like RPG maker or specifically focused on building a very specific style of game Others like say unity are large engines that can do complicated 3d games You know at triple a stuff built in unity So depending on what you need to do You put your engine I just want to drop a little bit of a sort of self-promotion my stuff at least everything That isn't really new is all open source the source code is available on github You want to like go look at how a dark room is built? Maybe copy it jeans it. That's a really good way to get started That's fantastic Thank you. I didn't know they were open source. That's terrific. Yep. Double speak is on github and yeah, look so like I Learned to build stuff and learn to work on the web by tearing apart other people's stuff, right like and so If I didn't have all of that stuff that I could tear apart to learn I wouldn't be where I am and so it's my responsibility to make sure that the next generation has stuff to tear apart That's really forward-looking as a futurist. I approve and I'm glad to hear that In the chat, there's one more recommendation, which is to make tabletop board games as well. I second that yep Pen and pen and paper and cardboard is a really good way of prototyping even if you intend to build a digital game in the long run prototyping on paper There's a way to get to your interactive state faster, right? Do you build it in cardboard? You can play it with your friends and see how it works before you even start to code Very very smart So I think everybody here is like cracking their knuckles now and getting ready to start setting things up But we have questions we have one from our dear friend Tom Ames Who asks can you compare the curiosity learning effects of open-ended games like Dungeons and Dragons versus closed games of the fixed end? Well, I think that open-ended stuff like D&D Yeah, it teaches very different things right like Dungeons and Dragons From a game design perspective is an extremely open game, right? Like the the system the set of rules requires a human involved to Improvise and make decisions. So not all the rules of the system are codified in the rules of the system. Yeah Games like that those those are teaching you Very different things like D&D builds social skills more than anything like yeah It builds math because you got to roll dice into a lot of math, but mostly it builds social skills your like social and Empathetic skills right yeah, like you're learning to put yourself in a different person's place You're learning to look at emotions and perspectives from maybe different angles. You're learning to improvise and deal with things on on a You know that you made on a predicted problem-solving skills all of those things are developed by games like Dungeons and Dragons Whereas a closed game like say the qubit game is a significantly more linear Where we have designed, you know the path that we want you to take the things that we want you to learn and when We can tailor that very specifically to target very specific skills that you probably couldn't teach in D&D That's an interesting way of putting it You could think of some professional games for the workplace You know designed to teach you how to repair a drill or something that'd be that narrow and with the rise of VR and AR I believe that all education will be gaming at some point in the future who knows when but like I Just I hate the term game I really do because like it says as soon as we add interactivity to anything we call a game and That's dumb Yeah, but I hope you're right The there's the claim the 21st century will be the ludic century which I have hopes for I mean and you can already see it starting right like gamification as a buzzword Got pretty popular like 10 and 10 years ago What is time now? I'm not sure how many years ago things are but I think it was around 10 years ago Where where everybody started to realize that you could very strongly shape human behavior by adding a point system and and it's been used for good and evil but like that that's the beginning of this sort of ludic Immersion this like blurt blurring of the line between games and reality Abby Johnson in the chat points out that there are other negative Senses of game the word game like gaming the system and in my work for the past 25 years when I introduced games to academics they often think game being something just for children or yeah a game is a psychological manipulation so it's there there is Yeah, then they often mean the nation is this like is this like a logical manipulation Yes, it was speech Tom, thank you for that fantastic question. Tom has a real gift for asking very deep questions Speaking of which Sarah Stolberg Berkowitz. Sarah. I hope I didn't get this wrong professor Berkowitz asks this question I'm interested in using games and student assessment not just learning I mean assessment is really tricky, right like And Like I have a lot of opinions on grading but it's a it's a necessity and a truth of our academic system and our education system I think that it would be very difficult to design a game that Works as both an education game and an assessment game that could actually give you like a grade point or some like this The students are 70% on this test or something That would be tricky I Don't know how to do that. That would be a very interesting problem if you want to work on it. Hit me up Sarah um, what a great question And we'll see what can come from this Just an infold disclosure, I'm starting my gaming and education seminar again in a couple of weeks So Sarah, I may put that before my students to see what they think of as well good question good question and Lee Lee Nichols has a follow-up question, which is really really good. How does a game designer think about player failure? Do you think that is similar or different from how education handles failure? Well Game designers think about player failure a lot because Players will fail. I think if you're you're not well, not all games have failure states But if they do have failure states and most games have failure states That's got to be a really big part of your design. I Another thing that I have strong opinions on I think that player failure is Almost a necessary evil in a lot of situations, right like because without states a game loses a lot of its teeth But player failure is inherently frustrating, right?  It's not a fun feeling Yeah, and so as a game designer you either have to really limit player failure or make it fun and There are lots of ways to do that and different games have different approaches There are games like the from software games like Dark Souls Elden Ring those games their take on player failure is sucks to be you you deserve it and It it hurts and it's intended to hurt right like they've designed it so that player failure is Bad like you really don't want to fail and that generates stress and tension and they use that well other games Let's use an example like Super Meat Boy Super Meat Boy is like Pretty fast-paced platforming. Oh, yeah.  There's no time Try again. Try again. Try again.  It's just ah, I'm gonna do it and After you find you succeed It shows you a little video of all of your attempts Played on top of each other and you see like thousands of these little meat boys diving into saw spikes and like Oh, it is so cool And so that way they've turned that frustrating thing of player failure into just something that's kind of fun and hilarious Wow, so I I've only played a little bit I haven't I haven't gotten that far but and then there are games that just don't do failure like You can't really fail at the qubit game. You can't really fail at a dark room Mike. My games don't tend to have failure Yeah, it's it's always positive. You're always accomplishing something The failure state is just now you're accomplishing things slower Well, that's a that's a good point or some games though if you're actually the villain then the failure state might be good for humanity you know the There's one game where you where you play at oil company trying to ruin the world It's from Moly Industries and so if you fail, you know, that's a good good for everyone But here we have we have a guest who I want to be up on stage because he's a person from a wonderful company This is Jeff Fisk from Muzzi Lane software and he has all kinds of thoughts all kinds of thoughts Hello Jeff. Well, Michael. I your I've got the gray hair. You you don't back in the 90s. I was making games and Did commercial games for about 15 years and I know here's games and now Muzzi Lane We are trying to do what you know, the impossible right turn education turn games in education and our take You know so much of what the reality is and some of the things you touched on is who is your consumer? Yeah, how is it actually gonna get consumed? So like when you say a RVR is coming? We all know it is but how many of us The God or the PC to move it forward, right? So It actually as you make it it's accessible, but our take is role-playing Let's put the student in it and have them practice. So we work heavily with McGraw Their take was teach something some teach someone something like for a piece of marketing then have them run a scenario where they run the food truck and They actually apply it and what's what's fun about it is that they experience the same cognitive in their brain You're just doing the same thing. I was trained as a professional pilot. You're in the simulator You know, it's an analog, right? So our challenge and when our design approach is how can we make an analog for training, right? And you can argue it's more simulation than game. I I We do kind of lament that we can't really use the same types of key challenges in game mechanics Because students would actually get really angry if they failed frequently when they're doing a homework assignment Right. So love the I Agree with everything you've been saying you're more up-to-date on what's been happening You know, I could give my real world references go back a long time But yeah, it's it's an exciting field obviously Brian's trying to bring us all together to Try and crack this not I will mention that SUNY Buffalo for example has an instructional design program in gaming and they use our tool They used to use unity too complex. So when you're trying like you said you want to start with that quick analog So our platform is no scripting just boom you're going there what you see is what you get We can launch it play for free. We don't charge until you start making money. So That's an incredible platform you've got I Don't but please Michael have a what do you think of this of everything that Jeff has just been saying? No, he's absolutely right right like the way if you want to teach a particular sort of skill or So where I want to looking for you return to teach a particular kind of Punk of stuff like a a food truck or whatever. Why if you can put the player Into a context where they're doing that thing even if it's even if it's not actually that thing if it's if it's like a Simplification of that thing or like a metaphor of that thing That's transferable right like it's transferable because They if you could either it's an emotional state You're trying to put them in you put them in an emotional state That is similar to the emotional state that they'll be in when they're actually doing the real thing and if they're in that same state You're going to be developing confidence you're going to be developing connections You're going to be developing all of this stuff and that is exactly how I built the Cuba game Yeah, that that meditative deep state so the first game ever made was a Civil War game It was an analog for a paper and pencil blew up the paper and pencil rules so the restrictions to turn take advantage of the computer, but yeah, you You you think about it and you ingest it and you you regurgitate it out into a different form To so that as a user is playing it They they don't realize that things have happened in their subconscious. Yes, like you are describing Your your favorite tutorial the fallout three well similarly if you really want a crash course in game design Portal has got a great breakdown in there They actually have a design breakdown afterwards is if you have the gold edition You probably can find it online where they actually show you how they designed it and the entire game actually The first few levels are actually all the tutorial and that that used to be like all part of one scenario And as Michael was saying that the cognitive overload is real you can only have the person either consume The game or consume the UI you can't have them do the same thing at the same time Hmm, so you have and importantly described that process and sure enough you cut yourself on the back for Figuring these complex puzzles out But in fact the designers show you how they introduced you and taught you how to do those things a level earlier They just didn't call it that So it's very it's a very interesting Yeah, and like When you do it like that you can teach people things They don't even know it right like it's inception and that's what makes It's so effective if people would come off testing the cubic game and go it was fun But I don't think I learned anything about quantum computing and then I'd be like oh really well Then tell me like what's quantum computer built up and they're like oh, it's this that did you know that before and they go? No, right like And I was gonna say that that right there is the promise of game-based learning right is that you can teach people things Even though they don't realize it there was There's one book on this which is titled the don't bother me mom. I'm learning Which I love and as soon as you as soon as someone thinks that you're trying to teach them something they shut off Yeah, unfortunately, that's that's a that's a legacy of schooling Jeff Thank you and if Jeff if you can't just just throw a link to a Muzzy Lane in the chat So ever the few people who don't know of you all can can click there and learn more So I also just dropped a link in the chat to extra credits design club And don't don't be thrown off by like the silly animation and the like chipmunks style voice stuff these guys know their shit And they cover some really really great topics that the entire series is good But design club is particularly interesting They deep dive on design choices in popular games and why they've done things the way they've done. It's really really informative Terrific. Thank you. Thank you See what we're hoping to do is we hope that this Hour of conversation has been stimulating enough that people don't run away and start playing games. It's kind of perverse, right? If we succeed in this or if we fail everyone's happier We have a great question from Sarah Sanguario who is going to have to be a hired by numerous universities really soon Because she is amazing and Sarah asks are the mechanics that you utilize for people who are completionists? Along the lines of accomplishments So I'm not exactly sure what that what that question is getting at but it does Make me think a little bit about the aesthetics of play This is something that game design academia sort of has broken games down into I think it's like seven Main aesthetics of play And one of one of them is like completion. Yeah, there are definitely some players Who are motivated by completion by ticking off boxes by like finishing everything? and If you if you want to design a game that's going to have mass appeal You're going to try and include mechanics That sort of hit on all of the different aesthetics of play so that there's something for everybody Typically a game will focus on one or two main aesthetics that are their primary aesthetics, but it's definitely useful for all games to include some aesthetics of For everybody and achievements Accomplishments are an excellent example ready like even games that don't actually have completionism in their core mechanical loops Most of them have an achievement system on Xbox live or on steam or whatever Certain way you get a little achievement and the completionists can hunt all of those achievements It makes your game more compelling and more engaging And Sarah just confessed she just outed herself as a completionist And and Jeff added some some good Muzzy Lane info including how to find him For completionists if if you're looking for this by the way, I just found a new little game I mean like ten minutes to play tops It's from the the Financial Times and it's a game which puts you in charge of the world for the next 50 years as you try to solve climate change And it I'll just put a link to it here It's an interesting one to think about in part because it has a completionist mechanism of as you were just saying Michael awards And you get a little trophy case which they bring up every so often Yep, and that just that's just there to drive engagement right like There's no mechanical purpose for that to be there, but it's it's there because people like it It gives you dopamine it hooks you into the system. It keeps you engaged But it doesn't have a little narrative coherence you're talking about before right There's right like most of these achievement systems are very um fourth wall. You're right like they're outside of the game The diet diagetic non non diagetic non diagetic. Yeah Yes, and everyone gets that that's a tricky one. Um, well We're coming close to the end of our hour. Um, which is ridiculous But uh, I have one question before anybody else gets a chance to put one in, uh, which is to ask you Where where do you see educational gaming design? Headed over like say the the next five years. Are we gonna move completely into a virtual reality? Do you see more narrative or crafting games? Do you think there's a big bubble of gaming about to burst or where do you see this all headed? Well, I think so I mean there's a lot to cover there. Um, I think vr is about is a dead end I think ar is going to change the world Uh, I think that Just by nature of progress and Sort of the marketplace of ideas I think that games and education are definitely going to continue to grow because they are so effective right like An educational system that includes interactive components will always outperform one that doesn't And so yeah, I think that that gaming and education is going to continue to grow I think the gaming as a part of our life is just going to continue to grow And we may eventually we may we may have to abandon that term game Pretty soon because I do think that it's going to completely infuse into all parts of our life Just because life is more fun with games So it's one of those ways in which something becomes Ubiquitous that we stop referring to it. Uh, we stop naming it as something. Yeah, um, that's that's a fascinating idea. Um, I love uh geno bondo Her ears perked up and so did sarah's they said wait, what what about ar and vr? Why is vr a dead end? So I mean this is this is definitely just an opinion of mine, but I do think that vr is a niche product I don't think that it's it's ever going to be something that everybody has right like you're not going to see people walking around the street with vr goggles strapped to their heads because it is fundamentally isolating vr is a fundamentally isolating experience and humanity is a fundamentally social creature so Like yeah vr is fun and like I enjoy dropping into my vr headset and playing beat saber sometimes and it's kind of cool and it can be used in very targeted situations But it's not going to become a ubiquitous part of everyday life Whereas augmented reality absolutely will um once the technology gets down to a point where it's And easy everybody will have ar instead of a cell phone And once that install base is down everything's going to be different right like Things will change in ways that I can't predict uh, this is uh the science fiction writer neil stefanson. I asked him what the next uh Uh handset or the next hardware would be and he said it would be spectacles That that was the uh, of course not just spectacles, but spectacles with audio and you control them with it with gesture and so on Stevenson has been very good at predicting the future. He's very good one of one of the sci-fi writers that I mean A significant portion of today's current hot technology is 100 inspired by works of deal stefanson right like like metaverse, right Facebook renamed to meta because of neil stefanson exactly exactly um people want people blew this up michael on the chat Tom hams thinks vr is going to be something you visit like a movie theater like a holodeck abby johnson says that vr is expensive and also gives a lot folks motion sickness That's that's a problem that will be solved right like motion sickness and in vr design is absolutely something that is a big part of Being a vr designer is trying to design experiences that don't trigger motion sickness and finding ways to mitigate um And like cost of headset that'll come down. That's a technology problem more is law will solve that um But the the fundamentally isolating experience will never never stop Um, and if you do get rid of the isolating experience it's no longer vr. It's ar Uh quick question for everybody, uh, who has been using the chat. Uh, I would love I've gotten requests to blog up the chat record I'd love to do that. Uh, I'll anonymize you all just remove your names If anyone has any objections to that, please, uh, say so in the chat If you're not using the chat, well, then move on. Um, but, uh, um, that's a michael That's a fascinating phrase that vr becomes ar once it becomes social. That's uh, It's a very very interesting idea. Um, we've had a whole bunch of other comments Abbey johnson made me happy by mentioning alternate reality games and larping So that's a whole other field which doesn't even require digital technology. Uh, nathan kelber That's a very very good point. There's a history of games breaking off into art forms Theater or music or notable examples We continue to use the words play with each but don't want to call them games A very very good point. Um, and uh, unfortunately if this is bringing us to the end of our time Um, michael, uh, it seems like the best way to keep up with you is basically to run really fast Behind you, but um, but besides that is uh, is twitter where you where you mostly Update the world on your work or should we just follow doublespeak games? Yeah, I mean usually I don't Um, I've I've developed a little bit of a an air of mystery as a reclusive artist But that's just because I don't like engaging with social media if people ask me to come talk. I do as you can tell um Yeah, I mean if you follow doublespeak on any of the social platforms I've got a presence. Um, if there are new new things that doublespeak has released I update there, but it's very very infrequent um Only only when I actually do stuff I understand understand. Well, I'm glad that you came out of your reclusive shell in far off toronto No, you just asked me to talk. That's all it takes Sometimes that is sometimes that is yeah, but no, I like all the socials Follow me on socials and I'll an email if you want to talk. I'm michael at doublespeakgames.com. Um I'm I'm always around very good. Well if there's uh We'd love to uh bring you back perhaps next year when we learn about your next project, which will probably take over the planet Uh in the meantime, michael, thank you so much. This has been a fantastic hour I really appreciate it and I look forward to what all of your absorption and thinking of media now Brings out of you next for your next game. Yeah, we'll see. I'm I'm also interested to see what happens I never know Take care and enjoy spring as it comes to canada. Yeah, thank you you too Now don't don't leave everybody. Uh, I've got to let you know what we're up to over the next few weeks I do want to thank you all for your uh for your great questions and comments Um, if you're if you'd like to keep talking about this, um, I'm happy to keep talking about this on twitter Just use at brian alexander or of course at shindig events Or just go to my blog brian alexander.org because uh on all those places I get things stirred up about gaming and of course Use the hashtag f tte If you'd like to dive into the past of our previous sessions on gaming, we have a whole bunch Just go to tinyurl.com slash f t f archive If you'd like to keep thinking about gaming and all the other issues around the future of higher ed Remember forum that future of education that us will show you what's coming up next And if you're proud of something that you'd like to share if it's game related or otherwise Just let me know email me and I'd be glad to share with everybody else. You guys are wonderful I'm happy to celebrate you And thank you again for thinking with a really exciting topic today Uh, I hope all of you are safe and sound and doing well in the meantime Take care be well get ready for summer or winter depending on which side of the planet you're on And we'll see you next time online Bye bye


Hello everyone, welcome to Locked by Past Village and welcome to my talk all about alarms and access control systems and how to hack them. This talk is going to be fairly high level, so we'll talk about the full range of hardware that is common to experience in the wild, as well as the general attack methodologies that we can use against them. We won't go too much into the weeds about specific makes and manufacturers and specific attacks that can be used, but that is generally quite inferrable from what we'll be talking about today. So let's start by considering a simple door, purely mechanical, and this is what all of the rest of Locked by Past Village is about, various ways that we can get through this door if it is locked. So you might be able to pick the lock, use an under-the-door tool on the handle, you might be able to remove the hinges, etc. What happens if we want to make this an access control door? At the bare minimum, we'll need to add some sort of credential reader and some sort of electronically controlled actuator that will lock and unlock the door, and some sort of controller that will determine is the credential valid, and if so, go ahead and unlock that door. At this point, it's very easy to add a little bit of sensing to sense anomalies, such as brute force entry or bypassing being done, and that can be done quite cheaply by adding a magnetic reed switch. So this bottom unit here is a simple magnet, and in the top, there is a wire that's going to be balanced within a magnetic field, and if the field becomes too strong or too weak, it will break or make an electrical contact, letting the controller know that the magnet has moved. The purpose of this is to detect when the door has opened. So one problem with doing that is if someone's trying to exit the door. If they're trying to enter, they're going to swipe the credential, the controller will unlock the door, it detects an open, that's okay. If they're trying to exit, it's now going to trip this type of sensor here, which is a request to exit sensor, is the general term, and very frequently what we see with these is passive infrared technology being used. So it will detect the black body emission spectrum of the human body on the secure side of the door, meaning someone's trying to exit. And if that's the case, if it detects that, and then it detects the door opens, that is okay. That's a valid exit sequence of events. If, however, it detects that the door has opened, there was no valid credential swiped, and no one was standing on the secure side of the door waiting to exit, that is an alarm condition, and that indicates that the door might have been forced open, might have been bypassed open, et cetera. But it will send that alarm to the access controller. We're missing one more component that we need, if that happens, which is that the access controller needs some way to communicate to the outside world that there's an alarm that needs to be investigated. So there's going to be some line out from the access controller to do that. There's usually going to be a line in as well. So this way we can say set what the public building hours are so that the door will be open. This way we can set who is allowed to access it. We can revoke credentials as necessary, et cetera. So let's look at some of the technologies that are available for these various parts of the system. For the credential reader itself, we have RFID-based, which is the most modern and generally the most secure. We have MagStripe, so cards that are encoded with a number in magnetic polarities along the card. We can use a biometric reader, such as a fingerprint scanner here, a key code entry system, so instead of being something that the user has or something that the user is, it's something the user knows, so the code. And we can also have a camera where some human on the other end of that line is going to look at the camera, see who it is, and make the go or no-go decision of is this person authorized to enter this facility. In terms of technologies available for the actuator, so this one that is the most common by far is a MagStrike or magnetic door strike. This plate here is going to be loose and allowed to swing open when the door is supposed to be unlocked, and it will seize up and not move and prevent the door from opening when the door is supposed to be locked. Over here we have a MagLock, so this larger unit will be mounted to the frame and the smaller one onto the door. These will magnetically couple and hold very very tightly with generally 2,000 pounds or more of holding force when the door is supposed to be locked and then the system will let them separate when the door is supposed to be unlocked. We might have an electronically controlled set of handle hardware, so just like how the key can be used to lock and unlock the door, we just have an electronic actuator inside that does the same. In higher security applications, we might see a turn-style based system here, so very good system to prevent piggybacking in after someone. It only lets one person in at a time, and we might also see various vehicle control systems as well. In terms of the sensor, ultimately the goal of this as it attacks is the door open or not. Most commonly we see magnetic based sensors, so these two are mounted on the frame of the door, on the inside or outside of the frame. They should be mounted on the secure side. If they're mounted in the insecure side, that then opens up a whole host of attacks that we can use. We also have magnetic sensors that are mounted within the frame, so drilling a hole in the frame and at the top of the door to mount both the sensor and the magnet that goes with it. We can use optical based sensors, so detecting light or dark where the door is supposed to be. Some hinges are capable of sensing what their position is and reporting that back, and as well we have some mechanical based sensors, so this arm getting tripped when the door is in the current position. In terms of the request to exit sensor, that is often done with a passive infrared sensor like these two here. Sometimes it's a button that the user pushes to cause that door to unlock and allow egress. It might also be the exit hardware itself, so pushing a push bar there that will mechanically unlatch will also tell the controller that someone is trying to exit and this is not an alarm situation. And finally, in very high-security environments, we might see another credential reader.  In an emergency situation, there of course do need to be overrides, but that could cause an alarm. So this is what these tend to look like in the field. You'll see your request to exit sensor mounted here, and then at the bottom we have our in-frame type magnetic contact sensor. On the door side, here's the magnet that goes along with it. So this is the general setup that we need at a bare minimum for an access control and alarm system. We can add a few peripherals such as there might be a mechanical key switch that can be used to turn the door on and off, so to lock the door or unlock it, say for public building access hours. This might be used by a security guard. It allows someone with much less training and much less complexity of integration to the network controller to actually lock and unlock the system. We might also see accessibility features such as buttons that will trigger an automatic door opener. Generally, the button on the outside or the unsecured side of the door will only open this door if a credential has been swiped validly or if the door is supposed to be unlocked such as during building public open hours. On the inside, that's generally not required and the mere act of pressing this button will cause the mag strike to unlock and the door to then automatically open. And finally, we also see it tied into the fire system in a lot of cases because if we're using a mag lock, there is no mechanical override to cause that to unlock. If it's a mag lock, the access controller must unlock it for us. If it doesn't do that, that door will stay locked. That can be a fire hazard if someone needs to exit in an emergency situation.  And if the fire alarm is triggered, that mag lock is then going to open and allow egress from the building. Because of that, there needs to be a tie in from the fire alarm system. All of these aspects require power. So sometimes there's separate power required for credential readers. There always is for the access controller and the fire controller and large power draw components such as a door opener here. We can disable the alarm or breach the door entirely causing it to open by attacking any of the hardware power or comms lines in this relatively complicated system. So let's talk about how we can do that. Starting with the power, we can cut power to the access controller. And when that happens by code, things like mag locks need to fail open.  But it will also cause the mag lock to open because if the fire controller goes offline, then there's no way to effectively cause egress if that because it's not necessary in an emergency. Incidentally, it is very, very difficult to kill power for this. It has all sorts of backups available.  We can attack the door contact sensor. So if it doesn't sense that that door opens, it will not trigger an alarm. And we'll talk about a number of ways to do that. We can attack the request to exit sensor. So if it thinks someone's trying to exit, then even if it does detect the door opens, it will not trigger an alarm. We can attack the mag strike, so to cause the door to open up. We can attack the credential reader to cause it to think that a valid credential has been swiped or to clone a credential, etc. We can attack the inside, the secure side accessibility button. So if that gets pressed or the controller thinks it's been pressed, it's going to unlock the door, open the door, and disable any alarm that might come along with that otherwise. We can attack this key switch, make the controller think that the door is supposed to be open. We can attack the fire system, make it think that we are in an alarm state, and so the mag locks need to open. We can attack the line out. So, most simply, by blocking any attempted communication of an alarm from getting out to an external control center, we can attack the line in. So by telling the controller that my credential is a valid one and you should let it in, or by, say, telling the controller that the building public hours are nine to five, as well as two to two one a.m. on Friday nights, and then we can come back at that specific time and it will just let us in. We can attack the controller itself, so it is, of course, a fairly complicated piece of ICS equipment and is vulnerable to all sorts of cyber attacks that are the subject of all the other DEFCON villages. We can also attack all of the comms lines everywhere throughout this, and that's something that we'll talk about fairly extensively in the rest of this talk. And there's one more attack factor that we can take in this overall system. Take a stare at it and see if you can figure out what it is. The answer is the door itself. If we can cause some way to mechanically get ourselves through this door without interacting with all of this other equipment, then we've effectively disabled the alarm. So, one very brute force way is to saw a hole in the middle of the door. There are other options as well. So, many doors have these vent looms in them. Frequently, we see these with the screws facing the outside, which is a terrible security decision. You can just unscrew that and then slide on through. Doors with windows in them as well can be attacked, and so you can go through the window to achieve a similar effect. And this is something that is seen on occasion. So, here's an example of a residential burglary. These burglars have seen the contact sensors on the doors. They know that they can't actually cause these doors to open. So, what they're going to do instead is break the window and rather than reaching through and depressing the handle, they're just going to climb through these wide open windows. And so, we see them doing that now. Incidentally, those very wide open windows make this particular house more vulnerable to burglars because they can see all of the valuables that are inside, where they are, what the alarm system is like, etc. It's a much less risky endeavor for them. And so, the burglars are just reaming that out and we'll see them crawl through in a minute. And just like that, they are in bypassing the alarm system. So, let's talk about the communications lines. Every aspect on this system has communications lines going into it or coming out saying, should I be enabled or not? And we can attack those. We'll focus on the magnetic contact sensor because it's the one that's sort of most readily attackable, but this applies to all the others as well. So, in the case of the contact sensor, we have a normally closed situation. That's normally what we see for security alarms. And that is that in the secure state, the door is closed. That means that the circuit is closed as well. So, it's a short circuit. We have power flowing. And if that gets interrupted, we know it's an alarm state. So, if the switch opens up, that becomes an alarm. And what we can do is jumper the line from one to the other. And that way, if that switch opens up, it will not send an alarm. In the normally open state, we have the line is broken. So, the switch is open and there's no power flowing. And that's the normal situation. When we open the door, the switch closes. And then the controller sees low impedance and sends an alarm. We can just then cut that line. And at that point, it simulates the switch being open and the door being closed no matter what we do at the switch ends. What can we do to defend against these? Most commonly, what we see is having end of line resistors. So, the effect as seen by the controller is the door switches between two different resistances. The way we accomplish this in practice, rather than having a three-lead switch, usually is having a series resistor that runs on one of the lines in series with it and a shunt resistor that crosses across those two lines. So, we always have some power flowing through the shunt resistor, even when that switch is closed. And when the switch is open, it must flow through that series resistor as well. There are ways to defeat that and we'll talk about those in a minute. But the absolute best that we can do is an encrypted digital line that has denial of service detection heartbeats, and we'll talk a little bit more about digital lines shortly. What we'll look at first is a game that we're actually releasing this year for DEFCON Safe Mode with Locked Bypass Village that will let you practice rewiring alarms to disable the actual alarm on the end of them. So, this is mirroring a physical demonstration that we were planning to do at DEFCON in real life, but of course that can't happen. So, this is the best that we can do as a surrogate. What we have here is a simulated door with this contact sensor and an alarm controller here. We'll talk about what a zone is in a minute, but it means for the sake of this demonstration, a single door. We have a supply current of 25 milliamps and zero volts that are coming across that system. That tells us that there is a short circuit here. And an equivalent resistance of zero. So, a short circuit and that is an alarm status of OK. If we open this door, we now have an open circuit. So, the circuit has been broken. The line voltage becomes indeterminate because there's no current going through and this is an alarm state. So, it's simply looking for short circuit or open circuit. In order to defeat this system, what we can do is cut the line and strip it and then take a jumper cable and hardwire those two wires together. And so now we have an OK state. We see a short circuit on the controller end and the door is totally disconnected. So, we can open and close that door all we want and the alarm or the controller will have no idea. You'll notice that when I initially cut that line to strip those wires that did trigger the alarm. We wouldn't generally want to do that in the field. The way to get around that is using this tap piece of hardware. So, we would actually strip just the outer sheath and then tap the inner wires and bridge those taps together. So, that's something that you can practice for yourselves using this game. In the next situation of a normally open switch, so we have an open circuit when the door is closed when we open the door that's then going to complete this circuit and we now see zero ohms, so a short circuit situation. The way that we defeat this is very simple, cut the line and now we have an open circuit no matter what happens because the line is cut. The most secure situation is where we have these end of line resistors. So, we have a series resistor here and a shunt resistor connecting these two lines there. And that happens right at the end of the line right before the sensor exists. And so, what happens now is if I have an equivalent resistance of 45 ohms when the door is closed, it jumps up to 500 when the door is open. So, we have our okay state and our alarm state. If I were to cut the line, it's going to detect an open circuit which is different than those other two states. And that indicates tampering has happened on the line. Likewise, if I go through and actually bridge that connection, it's going to detect a short circuit which it also normally would never see because of these end of line resistors. So, that also indicates tampering along that line and that would send a different alarm that hopefully would be responded to with greater severity. The way that we can defeat that is by adding our own resistances along the line. And so, there's a number of ways that you can play around with doing that in these games such as adding potentiometers that you can then control as well as a whole slew of resistors. And you can play around with that to get a situation where you can both disable an alarm once as well as go through the whole situation of disabling an alarm where it never actually sent an alarm while you were tampering with those wires. So, that's something that you can play with as well in the lock bypass village this year. So, let's talk a little bit about digital communications lines and the various attacks and defenses that exist on those. So, a digital communication line is going to be sending a zero or a one. So, here's an example of<PHONE_NUMBER> being sent in the ideal case. Communications lines have some parasitic capacitance. So, because those lines are two plates close together effectively, just very long, it acts like a capacitor. And that causes some capacitive effects here. So, we see the line getting charged up and then charged back down. It also has some parasitic inductance. So, that line is going to induce a magnetic field around it as the electric current and it changes. And so, as a result, we see this higher order Fourier effect that happens on the line. And so, the combination of those two is this pattern that we see down here, a slightly distorted digital signal. There's also noise. So, there's noise in the environment. There's magnetic and electric noise and that's going to inductively couple with the line. And there's noise in the sender and the receiver electronics as well. All of that contributes. And so, we're going to take this slightly distorted signal from our non-linear line and we're going to add on to it this noise and we get a further distorted electrical signal. This, as you can see, would still be relatively easy for the receiver to decode and determine what bits were being sent at what time. Noise, though, is a somewhat powerful phenomenon. As the amplitude of the noise relative to the amplitude of the signal increases, the noise starts to overtake the signal until the signal is no longer decipherable. And that's the situation where we have a breakdown of communications. That's something that is often the case just naturally, but it can also be used by an attacker to cause a denial of service. And mathematically, what we see is the zero bit is going to form some normal distribution, normal because the noise usually is gaussian, and the one as well is going to do that. As the noise increases, these distributions widen until determining which one is which becomes very difficult because this overlap becomes huge. So how can the red team attack a digital communication line knowing bad information? So to attack confidentiality on the line, they can tap that wire. That can be with a physical tap, like the one that we looked at when we were attacking the analog alarm wire lines. It can also be with an inductive-based tap, so just listening for RF frequency generated by what that line is communicating on. To attack integrity, they can introduce packets on the line, so tapping into it and then sending data down. And to attack availability, this is the easiest they can introduce noise. The defenses against this is you want to physically shield the line, and that's going to help both stop tapping as well as sending power down the line, sending rogue signals down the line. You can encrypt the digital signal, so that will then prevent both confidentiality and integrity attacks. And to protect availability, you want to send heartbeats so that the line can at least detect if it's being denied service. And that will then let you respond appropriately. So a denial of service attack in a very secure environment is the same as an alarm it needs to be responded to as if it were an alarm because it could be an attacker doing this on purpose. In the wireless world, what we have is a slightly varied situation. So we can't put a DC current across empty space. That's because of the laws of physics and the laws of the land further constrain what we can do. We must act within a certain frequency band so we don't interfere with all the other frequency bands. And so there's a number of ways that we can use what's called a carrier frequency to send a digital signal along through the air in the wireless world. There's frequency modulation or frequency shift keying that you're familiar with from radios where we change the frequency depending on if it's a zero or a one. We can change the amplitude in an AM digital situation or we can phase shift based on if it's a zero or a one. Those are the three main ones that we see. The red team attacks there is for confidentiality, we just sniff because these are being broadcast for anyone to intercept. And we can then read what's being sent without any wiretapping required and read that data. For integrity we can transmit new and we can transmit to overwrite the data that's being sent out. And for availability of course we can jam that signal. So again for a wireless alarm if jamming happens that's something that we want to treat as an alarm situation in a high security environment. One interesting aside about FM versus AM is FM is easier to jam and easier to hijack the signal by sending your own data because whichever signal in a frequency modulated situation is stronger by even a small amount the receiver is going to pick up that signal and only that signal. With AM it's going to pick up a mixture of the two. So you can actually try this with your radio if you put it halfway between channels on the FM band it's going to flip from one to the other. If you put it halfway between channels on the AM band you're going to hear both channels blended in with one another. But in a security situation with sending signals across the empty space that means that FM is easier to jam and to take over with integrity based attacks. The blue team defense of course is encrypt as well that is the only way to protect confidentiality. For integrity encrypting works for that as well. We also have the added option of locating where this transmitter is that's trying to take over our communication and trilaterate their position and take them out by various means. We can of course also increase the signal strength to avoid their ability to drown us out. And for availability it's very similar we can locate and take out the jammer we can increase our power and we can also use heartbeats to detect if availability has been compromised. So that's sort of a very high level overview of how we can attack digital communications lines. We'll take a step back to the physical systems that we see on these doors and what can we do about them. So for these magnetic read switches one very sort of brute force-ish attack is we can literally unscrew the magnet and hold it in place relative to where it was beside the door frame and then open the door with the magnet staying where it is. Of course that's only possible with sensors that are mounted on the outside of the frame on the unsecured side of the door but it's a very low tech attack that if it's possible is virtually undetectable by the controller. We can use a surrogate magnet to maintain the magnetic field while the door opens and the real magnet moves out of place and so we actually have another game that we're releasing with Bypass Village that you can practice this on. So here is our door and we can swing it open and closed and we can see this magnet along the top and we can see the magnetic field that's measured by our sensor up here and then we can move a little stick with a magnet on it in and out and around that sensor and we can try to use that to make the door or make the controller think that the door is closed when it's actually open and so if we get it to the right place here it now thinks that that's the case and as we close the door we can now open and close it without actually triggering that alarm. So that's something that you can play around with yourselves in this game that we are releasing in terms of the defenses available to the blue team using an in-frame magnetic sensor helps a lot and putting it on the secure side also helps to avoid these attacks being mechanically possible and we can make them more difficult by using what's called a balanced magnetic switch so it doesn't just look for the presence of a magnetic field above a certain intensity it looks for the presence of a magnetic field above a certain intensity but below another one so if the field is too strong it's also going to set off that alarm and it makes it a whole lot harder to actually use this surrogate magnet attack and that's something that you can also practice how to defeat those systems with the game that we are releasing in terms of the request to exit systems if it's a passive infrared you can send hot or opaque gas or aerosol or something through that door near to the sensor and cause it to think that someone's on the other side so there's a fairly well-known attack with taking a can of compressed air turning it upside down and squirting it and then that condensation that's created is enough to trigger many low-security PIR sensors if it's a push to exit button or a handle, an egress handle you can manipulate it from the other side so for instance if this is a request to exit sensor and we did an under-the-door tool attack that would give us two for one it would also defeat this request to exit sensor and from the blue team's perspective using a hybrid PIR and radar sensor is going to help immensely with avoiding people faking a human signature on the other side and using a token reader for egress is incredibly powerful it effectively means that we cannot use request to exit sensor based attacks we may as well just attack the credential reader on the unsecured side itself and so that does increase significantly the difficulty of attacking this particular system so using a PIR or a token reader on the exit side as well is sort of the electronic equivalent of a Euro-style double-barreled debt bolt very good design for security purposes of course at the cost of user convenience in terms of PIR sensors we can set them to have high security settings so that it will only trigger if a person is in the very specific right area and not this giant large range here long range is really meant for convenience and accessibility so it'll open the door as someone's walking towards it it's not meant for security at all in terms of attacking these actuators we can separate the electromagnet slightly so if you ever catch the door open that's equipped with a mag lock you can take a piece of gaffer tape or something fairly thin and put that onto the surface of it and that's going to separate those components just enough that it will reduce the holding force from 2,000 pounds down to say 50 at which point the door feels secure but it can be forced open and that's something that you can then come back and do and attacks like that attacking the magnetic-based retaining system are possible with some designs of mag strikes we can attack the comms line and the power so in the case of mag locks they fail unlocked if there's power that's gone and we can of course attack the comms line to any of these to make the hardware think that the controller is telling it to open up and we can use physical bypasses as well so mag strikes are often poorly sized the dead latch is going to fall into that hole and we can loy that latch if you don't know what that means check out our bypass 101 talk and the blue team what they can do to help against these attacks is of course shield their communications lines and use hardware that fails at a locked state that might not be allowed due to fire code but wherever possible you should try to do that so here's an example of where we can read that actually there is a mag lock on the other side of the door that's what these two bolts are telling us as well as this conduit coming through here what's interesting though is this conduit is of course the power that's going to that mag lock that is telling it to stay locked in this case turning power on and off is the communications line and so we can just unscrew any of these junction boxes here and break that wire cut that connection somehow and this mag lock is going to then fail in an unlocked state and we can open this door fairly simple attack there in the case of this type of hardware where we have a key switch we can of course pick the lock or do weather attacks like that we can unscrew the enclosure casing and then jump her out those lines and make it think that the key has been turned and of course we can perform an attack like that anywhere along the comms line where it's accessible to us what the blue team can do to defend against this is put the key switch on the secure side of the door I really don't know why this isn't seen more often possibly so that the guards can do it when they come on to shift to open up for the first time but they really should be given a key or some other better credential to get in if that's the case and that will avoid this this threat entirely because if you're on the secure side then you're already in you can use a lock of equal or higher security as the facilities front door so too often we see crappy weaver locks on these key switches where the front door might be a high security medico and installing a tamper switch within this box so if the controller sees that this box has been opened it will not honor that if the key switches turn no matter what happens as a bit of a defense with that of course that can be bypassed as well there's loads of ways to bypass tamper switches let's talk a little bit about the communications protocols that are used by the credential readers so we have the vegans protocol is sort of the original most well known one and it is based off of magnetically charged wires in the card that are going to be placed in either a zero or a one position and as we swipe that card it's going to then have sensors that detect that and give us the data from there we can have magnetically encoded information on a mag stripe which is similar and then we can have RFID technologies as well down the line though for backwards compatibility almost every reader and almost every controller still supports the vegans protocol and that's just to make sure that we can mix and match any reader with any controller and there's something they can fall back on that will work and so that vegan protocol looks like if this is the data that we're sending so the zero one zero one oh oh one one oh one that we saw before we have our data zero line and our data one line and they're normally a one and we pull either the zero or the one down to a zero when we want to send a zero or a one respectively so here we send zero then a one zero one zero zero etc because we have that vegan protocol in use for backwards compatibility if we can access excuse me if we can access those lines we can then read the vegan encoded data that's being sent as well as replay or send our own reconstructed packet in that same format and that's what the BLE key does which was released at Black Hat 15 by two very smart individuals they designed a piece of hardware that would clip on to the alarm wires so we see here the green and the white vegan wires as well as our black ground it clips onto that and it listens to every credential that gets swiped and it can communicate with your phone via bluetooth and that phone can then get the raw credential data as well as replay any valid credentials and cause that door to open on demand so that's one particular attack against that communication line a good remediation for this is OSDP it's one of the well it's really the only encrypted communication protocol that we see in somewhat widespread use it's still not very widespread and there are some proprietary systems that will use other encrypted forms as well and hook up your damn tamper wires so when you remove that credential reader from the wall to get access to the wires behind it almost all of them the good ones at least are equipped with a tamper switch that will send the controller a signal saying hey this reader has been removed from the wall if that happens the controller should respond appropriately set up the appropriate alarms etc all too often we see that not even hooked up so here is a quick example we can take a look at we have our reader here and we can assume that there's some sort of actuator on the other side very likely a mag lock as well as we have an accessibility door here with a visible magnetic strike system and that will be opened by some other situation so there's a couple items that we can notice in the wild one thing to note about all of this hardware we've been talking about is it is blazingly expensive here is some of the standard retail costs for what a new construction building might pay for these pieces of hardware so things like not hooking up your tamper wires putting poor quality locks on the unsecured side that can disable the system not shielding your communication lines and letting those be accessible from the public etc all of those are really simple fixes and very cheap in comparison to the cost of this hardware and something that really should be looked at if you have a facility that cares about security enough to pay this kind of money for these systems but anytime you see a door that's equipped with this equipment these are the kinds of costs that are involved in actually setting that up so we've talked a lot about access controllers determining or giving the go or no go decision on a door based on a credential swipe and sending an alarm if there's an unauthorized access we can also talk about alarm systems and they are more state based so on a very high level we have three states an armed state disarmed and an alarm state and we can enter the arming and disarming sequence to move between these top two if a sensor is tricked when it's armed it's going to alarm and then the reset sequence will move us back to disarmed in order to attack these systems our starting state is armed we're assuming that since it needs to be attacked and the two routes that we can take is we can cause the disarming sequence to be entered or cause the controller to think it has been and move it to a disarmed state or we can prevent these sensors from being tripped and prevent it from going into an alarm state so to give one example of the first type of attack this is a typical timeline that happens in older less well designed systems we have our controller here the sensor gets tripped as time moves along in a normal situation a normal entry the disarmed code is entered the panel enters a disarmed state and then the timeout happens but because the code has been entered in time nothing happens at that point the police are never contacted if however a valid code is not entered in time then when the timeout happens the panel will then contact the police and they will be dispatched to see what's happening with this alarm this allows for what's called a crash and smash attack which is that if at any point between the sensor being tripped and the timeout the panel is rendered inoperable the communications lines are rendered inoperable etc it will then prevent it from sending that call for help out when the timeout happens because the panel no longer operates this of course assumes that your keypad panel is the same as the controller which in many systems it's not but many good burglars know which ones are and which ones are vulnerable to this and so that's something that you do see on occasion a better way to handle this is to have an intermediary server that's off-site as soon as that sensor is tripped the server is notified when the disarmed code is entered that server is notified as well if the disarmed code is not entered then when timeout occurs the server then will dispatch the police without requiring any more communication from the local facility that way if there's a crash and smash attack and that panel is rendered inoperable an alarm will still go out so that's the disarming sequence or at least sort of a pseudo situation to move us to a disarmed state we can also prevent the sensor from being tripped and there's a load of ways to do that depending on what type of sensor exists so we have a number of different types we have cameras that are usually human operated but increasingly we have computer vision systems that are going to look for motion where there shouldn't be we have these door open sensors as well as a glass break sensors are common so to prevent that through the window attack we have passive infrared sensors that we looked at for request to exit those ones we did want to trip to make the door think someone was exiting these ones as a red team we don't want to trip because that will tell the alarm system someone's here and there shouldn't be so they detect the presence of a human body infrared spectrum and then we have various underground seismic based systems to detect someone walking on ground as well as fence climb sensors that we see on the outside both of these by the way are incredibly prone to false positives so they're only usually seen in very high security applications in terms of how the controller combines all of these we have what's known as alarm zones so zones are the individual circuits that one or more of these sensors is put on so in this case we have a normally closed zone that has two magnetic read sensors on it a second normally closed zone that has only one on it and for normally closed we need to wire them in series and then a normally open zone that has two wired in parallel for security systems you usually have them wired in series if not only a single one on a zone which is generally better and then for fire systems you're going to wire in parallel and have normally open systems there so that is how all of these devices get handled by the controller and what that means is if multiple different sensors are on the same zone the controller cannot tell which one was tripped just that one of them was and so the idea is they generally tend to be aligned in space so the controller can identify where physically in the facility this alarm is coming from so there's a number of specific defeats for each of these one that we'll talk about for passive infrared sensors is to block the infrared signature from your body actually reaching the sensor so you can use these space blankets that will then reflect the ambient ambient thermal signature back onto the sensor and cause it to not see you you have to be very careful with those because if you touch it with your hand then your hand is now going to it won't radiate but it will conduct through because you're touching it and that's going to defeat your efforts there we've actually found anecdotally that for many of the commercial PIR sensors their yoga mats work incredibly well a lot better than these do to block your IR signature you can move very slowly because these things have to get a sense of what the environment is and so if you move slowly it might think that you were just part of the ambient environment you can move out of its focus range so many of these in facilities that might have animals walking around which is usually a residential setting will be set to only focus on above two or three feet on the ground that's the default setting in many cases and in some cases that is just a physical limitation of the device that's being shipped out if that happens you can then effectively get down to that level away from the focus range and avoid these entirely and as well passive infrared sensors are much more sensitive to motion across them moving towards and away from them they're less sensitive towards so if you can make your motion in that direction it will help you avoid being detected so here is another example that we see that is no longer available so taking a look at one particular hypothetical layout of passive infrared sensors this is a bad layout take a stare at it and see if you can figure out why the reasons are number one way at the edge of the range is a large part of the room that is accessible by one of the doors and so we can now get around and access large parts of this room through that as well as this particular door here gives us access to the back of two of the sensors and so by doing that we can then place an IR shield in front of it from behind and effectively blind them to almost all of the room and finally the way that these are laid out it allows motion in a towards and away from direction to help avoid it detecting on its more sensitive perpendicular axes the last thing I'll actually mention about this particular layout is someone who's entering this room and seeing that this layout is the case will wonder well why are they clustered along this particular wall one potential reason might be this shaft here that x indicates a shaft in the wall that's likely a pipe riser shaft through which comms lines run as well so if someone can infer from that that the comms lines for these are running through this shaft they can enter that instead where there are no sensors and cut them off along the comms lines instead a better layout surrounds the room and makes sure that all doors are firmly in the coverage range and there's no way to get in any of these doors without moving entirely perpendicular to these sensors in their sensitivity direction as well there's no way to get behind any of the sensors let alone all of them and there's no way to get anywhere appreciable within this room without setting off at least one of our motion sensors so this is a much better layout the last thing that we can look at and this is getting a little bit more into social engineering so we'll only touch on it briefly is attacking the response that happens when alarm gets sent out so when the responding forces are distracted they might be sleeping they may be on other calls etc it might just be a human factors problem in the control room which we see very very frequently they will not respond effectively to an alarm and so that can be induced as well or you can choose to attack at the times that you know they're most likely to be in a state like that response fatigue is the term that we use to describe when an alarm has too many false alarms and security decides they're going to stop responding to it is probably just a raccoon climbing the fence or jumping up against the fence or whatever kind of like the boy who cried wolf so by setting off one alarm many many times making security think it's a false alarm you can cause them to stop responding to that they might have higher priority calls that come along so you can set off more critical alarms than where you actually want to go security is going to go to that higher priority location and you now have a lack of response for where you are setting off whatever alarms you want to they're often just plain old slow so if there's not on-site security if it's either an off-site security service or police that are called they can take upwards of 30 minutes maybe more to get to the site and actually do a sweep and see if anything is amiss there that is way too long the vast majority of criminals are in and out well within that period of time so just being fast enough that you outrun the response is usually sufficient as well in terms of dealing with the response in an ethical hacking situation so most commonly we see this with physical pen testing there are a number of considerations to keep in mind we don't want to diminish the ability of the facility to respond to a real threat that could do real damage so that could happen both if we disable alarms but also if we cause security to say have response fatigue on a particular alarm or if we cause them to be one place where there's a real incident and another so that's something to consider and we also don't want them to especially if it's the police to have responding to us as ethical hackers at their expense of other potential calls so fairly famously now within this community is the Iowa courthouse pen test case where two individuals were hired to penetration test a courthouse and they ended up getting arrested and charged as a result of it a lot of people made a lot of mistakes in that particular case but one mistake that in my humble opinion the red team made is it was irresponsible of them to have those police officers called to the site without prior notice to the force at the possible expense of other higher priority calls someone could possibly have died as a result of that if there had been a higher priority life or death call that was averted as a result of responding to this so that is a number of considerations for attacking the response and for dealing with any of these alarm situations we want to make sure that we do it responsibly and in a way that does no harm or does no unreasonable harm as determined by the client and external stakeholders so I encourage you to try it out we've released a couple of little games that let you practice these aspects that we've talked about throughout this talk it has been a lot so feel free to ask me questions feel free to give suggestions for something that you'd like to see at a future bypass village that you can practice hands-on hopefully in person at DEF CON 29 but for now you can practice rewiring alarms and using magnets to disable read switches and with that I would be happy to take any questions that you might have