Canonical List Of Things To Do At A Security Conference During A Boring Presentation

Canonical List Of Things To Do At A Security Conference During A Boring Presentation

You’re sitting there, bored out of you skull. The speakers are just repeating over and over again how important security is, but are presenting no technical content that would help you in any way. Hey, you showed up at a security conference, you already believe security is important. Other wise you would not be there, so they are preaching to the choir. To quote someone else:

“Sounds boring as hell to me. A bunch of managerial types wafting hot air on various pithy, high level statements that are brutally obvious to anyone with half a clue. I would rather subject myself to the tender mercies of the North Korean Police. They should have technical content of which there is none.” ~Alt.don from Security-Forums.com

During those special times what do you do to keep yourself occupied? Here’s my list, tell me what you would add. No, not all of the activities are ethical, but I’ve seen some them done and they do help to amuse a bored listener.

1. Categorize the attendees. Kind of like spot the Fed at Defcon. Sorry, but many times stereotypes hold a lot of truth. Here are a few categories:
a. Manager types who are just there to look like they care about security.
b. Bored techies that are there because their boss wants them to be.
c. Hackers who want to learn more about the subjects and are hoping for some technical content.
d. Play spot the Fed/Whitehat/Blackhat/Greyhat.

2. Play sniffer games. Lots of conferences provide free Wi-Fi for attendees.
a. See what traffic is out on the LAN using Ethereal.
b. Snarf HTTP traffic and see what web pages other attendees are looking at.
c. Sniff other folks passwords with Ettercap/Dsniff/Cain, not to do anything with them, but just for the hell of it. It’s amusing to see all these folks at a security conference using unsecured protocols.

3. Spot others playing “Sniffer Games”. You will see quite a few.
4. Ask them if they found anything cool.
5. Scan the network with Nmap to see what’s out there.
6. Try to “own” the presentation machine.
7. Net message the presenters computer.
8. Death match video games with other attendees.
9. Try not to get kicked out for doing any of the above.

What would you add?

2 d Fire up ethereal or any other sniffer of preference and filter for msn messenger packets. They are flat text with a very small amount of controll chars so its easy to read like that. (filter in ethereal would be msnms). There is software out there that does it specifcily for msn and makes it all easely readeble but i dont bother with that stuff.

10. Take fresh install of windows. dont patch it or anything else. Wait and see what happens.

11. Take other fresh install of windows. Patch up to decent security. Wait and see what happens.

12. Look for people that did 10 or 11.

13. Find ip to proxie/router/watherver that is providing internet. Create an ip conflict.

14. Dont get caught for 13.

I don't do it, but it seems to happen everytime I go to a security conference:

15. Issue wireless disassociate broadcast and then pretend to be the WAP and relay the packets through you for the juicy sniffing sessions.

Don't think I have been to a conference in the last couple of years where someone didn't have to run around with a directional attenae and try to locate the I%&%%# trying to be cute...and then issue veiled threats to the person doing it...

well guys u mentioned most the things i would do
but i want to add the following

i think the most embarrassing thing to do is to hack into the big security guy computer
then fall asleep in front of him as he speaks :P and let him know that it was you

or just tell him in his face what u think

How about:

16. Chain smoke cigarettes outside until they serve lunch.

Every security seminat I have been to has been catered to perfection, definitly one of the highlights of the day. the best was a bar sponsored by cisco!

17. Take your laptop with wireless connection and see how many people just like you try to hack your connection (using something like AirSnare). I get enough kicks out of just doing this at home. I can't imagine what would happen at a security conference.

18, take a dump... but during unusual moments and in places where people usually don't expect to find poop laying around.

Quote:

---

18, take a dump... but during unusual moments and in places where people usually don't expect to find poop laying around.

---

Probably not that practical, but always comical!

How about running a tarpit to see who's doing the hacking. Then take some coutermeasure to let them know you know. ;)

Personally I do the gaming, interrupt gamers, and hack the presenters box, mostly. Spot the fed is boring and I don't care about what your hat is, either.

19, try to convince others that you actually know something about computers.

Quote:

---

Originally posted here by ¤The¤Spe©ialist
19, try to convince others that you actually know something about computers.

---

Bah, I do that all the time! :p ;)

hmmmm. I have a few ideas.

- fall alseep and drool on the table like you did in highschool
- give yourself a wedgie and tell the guy next to you it works better than coffee for waking you up
and of course, we can't forget this one...
- ask the guy lecturing which is better, Windows or Linux :eek:

OH Well,

I suppose that I will have a go:

1. Read a particularly salacious magazine in full view. This really works, and is terribly disruptive, as the fellow delegates are all thinking "how has he got the balls to do that here"......and they cannot take their eyes off the magazine.

2. Read your favourite manual?............mine is "One shot kills at six hundred yards...........the U.S.A.M.C. Manual of Sniping" :eek:

3. Make sure you have the security guys on your side for this one!!!!!!!.............just hand a Cotter Pin on a split ring to the delegate next to you and tell them that they have four and one half seconds to figure out where "the rest of it is" :D

For ordinary internal stuff I generally go for "has anyone considered the tax implications of all this".......that is generally guaranteed to wreck a meeting.

I don't get invited to many meetings........I guess that it must be some sort of racist/ageist/sexist thing?

....and the #1 thing to do at a security conference?

Serve up a webserver on your lappy (with seemingly important infoz on it) and be sure that GOATSE is the only thing on the index page.

This is my personal favorite. You'd be surprised how many dummies who think they're being slick with their Uber toolz suddenly jump back in their seats when they actually open the page. It's like watching them get hit with an invisible hammer.

:)

You only call that #1 because you've had it happen to you ;)

What to do so that the boring speaker lets everyone take a break? Go into the bathroom. Almost all bathrooms at these places have electrical outlets. Gets something like a thick rubber glove, or, use your foot with docs on, and kick a paper clip into the thing. The power should go out for everything in the area unless the electrician didn't cut corners which is not likely.

Then when it's dark, come out of the bathroom and you should be on break while they look for the problem. Oh, if you REALLY want some fun, while it's dark, any laptops the bathroom has are up on the list of grabs. No one is going to chase you out of the bathroom with **** hanging out and their pants down. And if they do, the bathroom doors in these places are great with super glue.

When you get done sell them their laptop ... Most of them at these shows have company data on them, grab a competitor and them, and see who bids the highest. Entertainment man.

And if you're super bored, spike the coffee with LSD. If you're still bored, drink some.

I just KNEW that the BOFMichigan HAD to have a say here :D

Remind me NEVER to take MY laptop with me for a sh1te :eek:

;)

One way to do something like what horse said is to use airpwn. See:

http://www.evilscheme.org/defcon/

Hmm you could follow my lead from the April 2005 San Fran ISSA CISM gathering and get trashed at the open bar and spend dinner getting a hottie sales director from a leading encryption company and the (far, far less attractive) VP of international security at a leading credit card company drunk as well and trying to talk them into a threesome. Then following that up with... yeah, I am amazed I still get invites to their meetings. ;)

cheers,

catch