ShmooCon 2008 was great. Since I'm not a security professional, I felt a bit guilty about taking up one of a limited number of attendee slots, but not
too guilty.
The badges looked like variations on
this, evoking classic
punchcards and comprising a puzzle that—as it was explained to us at the end of the con—evokes the phrase "too clever by half".
I attended all of the opening-day talks on Friday, from h1kari's presentation on interception of
GSM traffic (a.k.a., "more cool stuff you can do with a bunch of
FPGAs") to a talk on
Forensic Image Analysis for Password Recovery (okay) to a guy's description of an unauthorized "phishing awareness exercise" he executed at a former employer... I should have skipped out for dinner during the web portal vulnerability talk, but I stuck it out and sustained myself on some nutritious
conversation hearts.
Hacking the Samurai Spirit didn't have much new information for me; I think it would have benefited from more specifics, but the speaker did have to cut down an hour-long talk to fit a half-hour slot. When the videos become available later this year, I'll (try to remember to) point everyone toward
New Countermeasures to the Bump Key Attack for lock advice. Grad student
Alex Halderman filled in for slated keynote speaker
Ed Felten, who was too ill to come. Their research group has worked out a way for electronic voting to enhance election security rather than obliterate it (as Diebold has helped to do). Sandy Clark commented from the audience that her group had found a problem with it that they'd be explaining in their talk the next morning. Afterward, my walk up Connecticut Avenue to
Dino was rewarded with the discovery of their delicious-beyond-deliciousness three-cheese polenta with grilled mushrooms.
The next morning I overslept and missed that e-voting talk alluded to the previous night. Did any of you readers attend it? I'd be interested to hear about it. Instead, I made it in time to see a talk on ISP port-blocking. The speakers, former ISP employees, have changed their stance since their block-happy corporate days. Since port-blocking is so variable based on telecom company, region, and other factors, I'm wondering whether there's some online database out there where people can research and enter information about the port-blocking they're experiencing. I stayed in the "Bring It On" room for G. Mark Hardy's
A Hacker Looks Past 50, which was less entertaining to me than it seemed to be to the rest of the audience. He did give away a lot of swag.
Lunch was the largest-to-date meeting of
DC LinuxChix at
Tono Sushi. In total I think there were around 20 of us there. I didn't even meet all the 'chix who showed up, many of them con attendees. When calypso (of Lockpick Village) commented that she'd seen hardly any other women at the con, I had to express my surprise. It's not as though women even approached half of the con population, but they were a definite presence. Which made it especially weird when a staffer was giving away swag before one of the talks: he pulled a women's-style t-shirt out of his box and asked the audience, "Anyone have a wife who could use another t-shirt?" WTF.
Anyway, after the LinuxChix lunch, I came to Jason's Scott's talk previewing his
GET LAMP documentary on text adventure games, particularly
Colossal Cave Adventure, a favorite from my youth that was based on an actual cave. This was my favorite talk of ShmooCon 2008.
I stayed to catch
You Must Be This Tall to Ride the Security Ride, but it was disappointing, so even though I was sitting in the front row, I made a brusque exit and headed to
TOOOL's Lockpick Village. I learned some things and witnessed several hilarious rounds of their Gringo Warrior challenge.
After dinner at Trattoria Italiana with
thewronghands,
kyra_ojosverdes, and
secretsoflife, I skipped the nightlife to commute back home.
I slept in again on Sunday morning, arriving in time to catch
renderman's
How do I Pwn Thee? Let Me Count the Ways? I don't own any
Bluetooth devices, but if I ever do I'll be changing the default PIN right away and keeping it turned off when I'm not using it. For an example of what can happen otherwise, see
carwhisperer.
The subsequent panel discussion
On the Social Responsibility of Hackers was a frustrating re-hash of debates like what it means to be a 'hacker', how the hacker community can benefit the 'greater good', whatever that is... not a productive discussion, to my thinking. But things picked up again with the con's closing remarks, to the point that I was sad it was over already.