Opening Remarks

hi everyone welcome to uh b-sides las vegas camp stay at home for 2021. i hope everyone joining us over the next couple of days is staying healthy and safe as well as your families and friends my name is cindy jones otherwise known as cinders and ashes and i'm lucky enough to be the president of the board of directors for besides lv i'm super happy to be here introducing this our 12th event and i'm going to take a few minutes of your time sharing some of what this conference is brought to the masses and how we do things for you newcomers to the b-sides world just want to give you a brief history lesson back in rsa in 2009

there were just too many submissions and not enough time slots for all these great quality talks to take place in um an idea was born started off over twitter and it grew and grew and grew wouldn't it be great if these talks that didn't get accepted had an opportunity to share with each other and their friends so the house was rented some people hung up some sheets on the walls for screens and a bunch of knowledge was shared it kind of became a thing since this first event the besides movement and it has become a movement has taken hold around the world and ours is just one of over 170 events held since that very first get-together at a

vacation rental back in 2009 in las vegas we've been in a few other venues since that first rental um we spent some time in a lazy river at a mansion we've been we've enjoyed being uh exposed and surrounded by art at the artisan and we've taken over the tuscany growing larger with every single change of space last year oh dear 2020. well we made the decision pretty early on into the pandemic to cancel the event we had talked about a virtual event uh we thought there just wasn't enough time to change formats and provide the community with what they had come to expect from a b-sides event at least for within the las vegas environment uh this year

the board of directors decided we didn't want to take any chances either there just wasn't enough evidence that it would be safe for participants speakers volunteers and staff to travel and seeing as how a large contingency of our staff and volunteers come from outside of the u.s there was no evidence they would even be able to come into the country and remain safe so we switch formats we change to a virtual event so whether it was held at the mansion the artisan the tuscany or in this crazy virtual space one thing has and always will be true every single one of you whether sitting around picking locks or watching a talk speaking to an audience in a track

or in a hallway playing one of the games or contests or hanging out at the amazing pool party we're all participants in this awesome thing that we do everybody contributes everybody gets something out of it and that's always been the goal of b-sides we talk a lot about people being able to start off their careers and we have means of doing that we get the newbies coming in and learning all kinds of cool stuff that they had never considered before we give people opportunities to become involved in that community whether it's for volunteering or speaking for the first time there's a lot of activity that takes place not only as a part of the track

content but outside those doors inside the hallways having those conversations with the pool parties so something to keep in mind you're all a member of a greater community and you should be able you should be proud of being a part of it we have programs for students for vets and for local vegas community members as well we always want to make sure that these folks are taken care of who may either be unable to get someplace or just having a hard time convince their boss they need to be able to donate money just because they live in the local community so this is how we're doing it this year we've got a number of different tracks

for those of you who've been with us in person you're kind of familiar with our setup we've got multiple tracks where talks take place and i'm going to go ahead and give each of those chairs of those tracks a minute to introduce themselves and what the track is about first of all we've got damon phil and they're going to talk about breaking ground good morning i'm jamin and i'm phil in addition to being program chair for security b-sides las vegas i'm also a track chair along with phil for our breaking ground track as the name implies breaking ground is focused on groundbreaking original security research and conversations on the next big thing breaking ground is a track where hackers

knew old and in between can show off their latest and greatest this year's talk topics include things like repo jacking crypto hacking car emulating machine learning and anything else these geniuses can come up with there are no rules or preconceptions for topics or presentation methods and if there were our researchers would probably just break them anyway tune in and see what's news and what's new next up we've got alan he's going to talk about common ground hi i'm alan friedman welcome to the common ground track we're really excited this year to have some great content in common ground common ground isn't just sort of a catch-all for b-sides content it's really the space that the whole family

can plan for information security we're going to talk about important security issues but also fun lifestyle issues uh important things that affect all of us like mental health and public policy as well as a chance to dive into some of the basics that cross-cut and don't fit quite as well as some of the other tracks uh i want to thank david mortman and dt for uh doing the bulk share of the work this year uh we think that there's going to be some great content for you and um if this is your first time think about what you might want to share with us next year

now i'd like to introduce gabriel and urban they're going to be talking ground truth hey welcome to the ground truth track i'm gabriel bassett i've been a security data scientist for eight or nine years now and i'm urban martin uh track co-chair i've been a security data scientist for several years as well and so the ground truth track is a track that brings together academics scientists hackers all to kind of share ideas ask questions and compare notes you know it's about everything scientific when it comes to security not just machine learning and ai but also things like data visualization analysis how to check hypotheses academic research all those things that add the scientific aspect of information security you know

and for us to be able to have these great conversations you know there's a couple things that are important to us first when we're listening to a speaker you know it's always important to kind of take it as the person is trying to express the truth and if you're concerned that you may not understand it ask questions try to figure out and clarify that truth as opposed to trying to prove anything false you know we want to have that good dialogue and for those people being questioned it's always important to kind of receive that as if someone's trying to clarify their understanding because really it's only when we can get together and work together to understand that we come

together and have that great understanding so thank you for coming to our track and enjoy the talks now we have it's kathleen higher ground hi this is yes it's kathleen i'm kathleen smith the track chair for higher ground and it is my honor to bring higher ground to the b-sides lb community because we all know that we could do better at our career search at higher ground we cover various different top on everything from what to do with your resume how do you go through an interview and how do you look at your overall career strategy we bring in speakers who have really interesting topics as far as their own career journey or recruiters who can tell you what

you're doing wrong and what to do right the other things that we do in higher ground is we bring in technical recruiters to provide you resume review and we're doing that virtually this year and we also bring in folks who have more than 10 years information security experience to provide you some career coaching which we are also doing again this year so thank you for joining me for higher ground i'd like to hand it off to beau woods with i am the cavalry hi i'm beau woods welcome to i am the cavalry track at b-sides las vegas we have some really fun and exciting talks for you this year uh i am the cavalry track is essentially

a track supported by i am the cavalry grassroots initiative if you don't know about the initiative you can go to iamthecavalry.org and find out all about it essentially it started with a realization that our dependence on connected technology has grown faster than our ability to secure it in areas impacting human life and public safety so if that sounds interesting to you come and watch the talks that we have for you this year we've got guy mcdude fellow wow that's hard to say he's with proving ground hi everybody i'm guy mcdoudfella one of the co-chairs of the b-sides las vegas proving ground track our track is focused on helping people improve the public speaking skills and present at an international

conference with brand new research for the first time i have been spending my quarantine working on improving my ability to make really good coffee and building stuff out of wood so that i don't have to stare at computers one second longer than i absolutely have to and one of the things i like about this track is not only the way that it helps people prepare to present their research and get their ideas out to communities who need them but also because of the relationships that it helps people form and the career mentoring that it provides to people who really end up benefiting from it so enjoy our talks

and this is babydoll with ground one two three four this is ground1234 and i'm babydoll welcome to the track that's focused on insecurity of passwords and other authentication solutions bringing together security researchers password crackers and experts in password security from around the globe in order to better understand and address the challenges surrounding digital authentication this track explores all facets of authentication security from analysis and education to creating securing cracking and exploiting authentication solutions so how it's going to work is during each of the talks in the stream they're going to be identified by track name and you can join the discussion about the talks in the corresponding track channel in discord that information will be posted in the

stream so you won't miss out on anything in addition to our tracks that are taking place we also have a game show and a couple of really cool contests happening including our pros versus joe's capture the flag of it here's dichotomy to tell you more about that good evening i'm dichotomy i am the founder of the pros versus joe's ctf that has been running for the last many years at several b-sides primarily b-sides lv besides delaware besides dc and others i'm going to give you a quick overview of the game that we run which is an educational game it is all about training our joes and and giving people an opportunity to try and gain the skills they need

for a new career for bettering themselves for contributing to the community at large and the industry that they want to get into and so we'll spend the next several minutes talking about that of note this is going to be our ninth b-sides lv uh we've been at every lb since about 2013 and we're proud and happy to be part of it it is our crown jewels the get best game we have of the year but having said that we started in b-sides of delaware in 2012 and without quad lang and cake froggy we would not be where we are so i've got to give a shout out to them and moreover while i am the founder and the person who tries

to lead this ragtag band of hackers to do this thing uh i gotta say that the people that build and run this the staffers on the pros vego's crew make this happen this game could not exist without them they do countless things from writing code to developing the environment that we run in to running the actual game there are dozens of people in the prose veto staff some of whom have had to step away some of whom are still actively participating and every b sides we pick up a few more staffers of amazing people and i just cannot thank them enough but in any case let's get down to it and talk about the game that we're

going to be playing this year at b-sides lb 2021 during the camp stay at home uh our game has been the same format it's been ever since the beginning it is a competitive combative red versus blue our players are blue joes they defend the assets we give them in against the red team the red team are effectively non-player characters they do not actually compete against the blues the blues are competing against each other so in our game it's not about outrunning the bear it's about outrunning everybody else because as we all know in the real world the adversary is got advantages that the defenders just cannot deal with and so our game is all about teaching the

defenders how to protect themselves how to understand the adversary's tactics and how to deal with the situation they have with the tools that they could have and the skills that they can get so we try and give them a unique opportunity to deal with live professional adversaries who know exactly what they're doing and are able to penetrate and persist and move laterally and perform c2 and do all the things that happen in the real world with nation state adversaries advanced actors and so forth and so our guiding principles to the point of learning are learn number one two have fun and three win if you can we have that sequence because competition is lovely and we

want to see a winner and we want to see the winners proud but again we're a dojo we are about learning and about teaching all the players whether it's the winning team or not so we try and emphasize that stratum that order of operation in order to ensure that the spirit of competition does not get too strong and undermine the core philosophy that we have that we try and bring to every besides every event that we do again our contributions of our staff cannot be understated they've done so much but let's talk about the game itself the blue players spend weeks preparing the joes when they are accepted they get early acceptance weeks and if not

months in advance depending on the game and here at lv it's about two months on average but they are then brought into teams they spend weeks going into team meetings going in slack sessions conference calls getting hands on talking about what they can do in order to prepare for the onslaught of the red team the red team likewise is preparing in advance they have early access to the environment the idea is to emulate the air quotes advanced persistent threat the advanced actors who will be in the environment and have already penetrated and have gotten deep access into the linux the windows systems and in our environment it is effectively emulating an enterprise environment each blue team

has a dedicated environment that is unto themselves a classic enterprise with firewalls dns web mail desktop servers windows linux the whole nine yards uh and this environment is the playground through which we play our game and so the reds have early access they are the advanced actors that get in in pre uh pregame activity and the blue joes and their captains their coaches must then defend against them so they have this early access the red team the joes are preparing in advance and at the start of the game then the pandemonium begins the game is of course scored we have a scoring engine that we've home brewed and we have facilities there to monitor service

activity like in a real enterprise in the day to day the scoring is based upon the service uptime so we look at web we look at dns we look at mail we look at other random services and we monitor the uptime in real time and so the points are largely driven by that service up time red can get into the business and do things like send out signals that they have control of assets and so deduct the points from the blues so while the blues strive to maintain their uptime and gain points through that the reds strive to show that they still have control of assets and are therefore not removed and therefore the blues need

to do a little bit more and so with those beacons they degrade the points of the blue teams there's an additional scoring element in which that the players can use their score to buy advantages and to upgrade services to buy new assets to buy advanced defenses or something like that but at the end of the day it is basically an attempt to try and further emulate real life in terms of bringing the holistic sense of the you know it's not just cyber in an abstract it is in fact a business and you have to deal with the function and the economics of the underlying uh entity in which you are defending uh having said that on

in addition you have an a dynamic aspect to our games we have some automated code that drives new assets come in old assets get pulled out on without warning and so the players may be busy defending an asset field and protecting themselves against red and getting a good grip on things and then suddenly the board moves under their feet and suddenly they have new servers that they didn't expect old servers disappear horribly uh underprotected under hardened and rife with red team and so this is the reality in which the blues live for the duration of the game in this b-sides at home state uh can't stay at home they will be going for 30-some solid hours without a

break normally we do a two-day game with an interval in between but it's remote so we're going to do a marathon like in the real world and so that's what they face for the time ahead and that is what they will do but at the end of the day again with the emphasis on learning at the end all is revealed in the middle of the game we are going to give the red team an opportunity to share a little bit with the blue teams and find and so that the joes can get a bit of a teaser as to what they've been facing a little bit of facetime and then at the very end of the game when all is said

and done the red does a complete and absolute hot wash where they reveal all they explain what happened and there's a lot of interaction between red and blue to explain what they saw what the defenders saw what the offensive side saw talking about technology and about methodologies and adversary behaviors and all those lovely things so it's the it's the best opportunity at the end to bring it all together and to really learn of course there is one last aspect of the game that i should mention that i haven't yet and that is scorched earth after 30 some hours of continuous play uh we give the all the players a chance to kind of blow the

blow a little steam off and the red team is given carte blanche to do whatever they want to do throughout the course of the game in order to maintain some semblance of sanity they have some restrictions they can't lock out blue they can't do bad things too terribly but by the time the last hour of the game red has the opportunity to pull off all the gloves and they get to just go to town as i say smoke them if you got them and so they get to tear down the entire environment burn it all to ashes what they can control which often they don't control the entire thing some blue teams do remarkably well at

evicting the red team and keeping them out but all the same it's a lot of fun at the end of the game after a long and arduous draw uh drag from both sides and a lot of a lot of laughs and a lot of fun are felt but at the end of the day we learn through the crucible you know in pros rejoice we put people into an intense pressure situation that is completely safe uh they can do whatever they want in our game they can blow things up they can things let things go sideways but the opportunity is for them to learn to build themselves up and to make friends and network and to grow in their field and flourish

and so that's what pros vjos is all about and uh we're going to play another game this year and it's going to be amazing thanks to my staff who has done fantastic and i can't wait uh and this is still yet just another milestone there will be amazing games in the future with lb and other b-sides and it's going to be fantastic and thank you very much for your attention i hope you have a good besides also on discord we have our middle ground hangout spot just like we did in the real world in our big area in the center there between all the tracks so be sure to join there stop by say hi

wave at people do the good things going into the some of the technical support stuff we've got going on in case you have a need for any assistance if you're having problems with discord be sure to hit us up on twitter at besides lv and we will respond as quickly as we can we want to make sure that everybody can have a good time while we're talking about having a good time in discord we don't want to squash anybody's creativity or make anybody feel uncomfortable ever one of the ways we're meeting that need is we're going ahead and moderating our channels there are certain words that the staff and board believe should never be spoken

or typed and those are banned words a lot of this is being performed by bots and moderated by moderators within the channels so feel comfortable to express yourself but please do it in good taste we also have channels for info booth and our job board is also up there please be sure to check him out you can find all that information up on discord one of the coolest thing is our pool party that we have every year and we always have such a blast doing it it's how we wrap up our conference year after year and it is an event we've managed to be able to bring part of that onto the discord and it takes place this coming on

saturday after hackerwood squares at 10 pm pacific time please join us so one last thing i have to say and i'm going to try not to get choked up while doing it this these events whether it's this year any other year or any year in the future cannot take place excuse me without our amazing volunteers when i say everybody's participants i truly do mean that but some people step up above and beyond that participant level and they dedicate their time and their energy to making this thing happen we have our standard volunteers and we love them all they come back year after year after year for the abuse of four days in vegas of setting up running the show tearing

things down running gear to a storage unit in the desert heat every single year and we love them all above and beyond that we have our staff i can't say enough about our staff

sorry i'm not dropping names because they know who they are the people who pulled this together are just the end all be all they work on this diligently and tirelessly all i shouldn't say tirelessly because i know that's not true that's very evident of the parties on saturday so please take that in consideration they work on this thing but all year long making this thing happen this year was such a challenge last year was such a challenge we've uh we've all struggled through but the staff across the board has been supportive and loving and caring and made sure that everybody was okay which hasn't always been easy because some of us weren't okay while we

were doing that so nothing but love for all of you guys okay enough of that thank you all for joining us please enjoy your time here check out the tracks check out the contests watch the things see the game show chat with each other continue to build a community one that the besides ethos are built off of and um thank you all for joining us for camp stay at home enjoy the con bye