-
- _NSAKEY
- Alex Berta
- Amy Flatt
- Ben Hicks
- Ben White
- Beth Smith
- Blake Yerkes
- Brimstone
- Chris Scott
- Elonka Dunin
- George Starcher
- ItWasn'tMe
- James Church
- James Powell
- Jason Smith
- John Liu
- Mick Pletcher
- Mog
- Nicholas Evancich
- poiupoiu
- Robert Mccurdy
- Ron Foster
- SA Hale
- Scott Augenbaum
- Shae Erisson
- Steve Esposito
- Steve Mallard
- Terry Hale
- Tim Heath
- Tyler Welton
- Victor Rodriguez
- Xavier Ashe
-
- The State of the Nashville2600
- Nothing but NETKOTH
- PhreakNIC's PXE LAN and History
- Drone building and the legal ramifications
- Applied Detection and Analysis Using Flow Data: Tools of the Trade
- An FBI view into network security and where the failures are
- Protecting SCADA, PLCs and automation controls
- I2P and the Dark Web
- Lateral Movement: How attackers quietly traverse your Network
- Hacking 101
- Exploring Man-in-the-Middle Attacks on Software Defined Radars Software defined radios
- Hacking and Scriptfoo
- Persistence Pays Off - "A Brief History of APTs and their Lifecycle"
- Maintaining Jedi order after Jar Jar Binks was left in command
- A deep dive into the inner workings of Stuxnet
- Making machine data accessible with Splunk
- Winning Management Buy-In to Security
- Lightning Talks
- My Journey
- PhreakNIC Closing Ceremonies
-
- Death March and Back Again: A Grinder's Tale
- Diceware: how not to become a statistic
- Fun and hacking on the Amazon Echo
- FFmpeg (I didn't know it could do that!)
- Building a Shipping Container House
- Agile Development 101
- You are being manipulated!
- What's the deal with Palo Alto Firewalls, anyway?
- Panel on Video and Audio recording
- Communicating Your Tech Excitement with Improv
- Continuous Integration and new ways to hack the planet
- Freedom Rant
A pdf copy of PhreakNIC 20's Program
Welcome to PhreakNIC / The state of the Nashville2600 - Elonka Dunin (@ElonkaDunin)
Elonka Dunin and the other officers of the Nashville2600 will greet everyone and briefly discuss the activities
and options at PhreakNIC this year.
Agile Development 101 - Elonka Dunin (@ElonkaDunin)
Elonka Dunin, along with cracking codes and making games, is also a certified Agile coach. Just what is Agile Development? What do all those terms
mean, such as Scrum Master, Product Owner, Sprint Review, self-organizing cross-functional teams, etc? This is a general talk where she goes over the
history and principles of Agile, which is both a mindset, and a growing type of project management methodology. Agile has been revolutionizing many
organizations over the last few decades. Some companies have embraced it, while others have tried to implement it but have failed. If you are already
familiar with Agile, feel free to bring your own war stories about whether Agile has or hasn't worked in your own organization, and we can also discuss
the reasons why!
Elonka's Journey - Elonka Dunin (@ElonkaDunin)
So many questions! What is Kryptos? Who is Elonka? Wasn't she a game developer? How did she go from games to cryptography? How did she meet Dan Brown? How did she get a character named after her in one of Brown's novels? And how did she end up as chair of Nashville 2600? All these stories are intertwined together. Come here the grand story of how it all came to pass at this session.
Elonka Dunin is a professional game developer, writer, and cryptographer. She serves as chair on the board of the Nashville2600. She is webmistress of two popular crypto-related websites which contain
information about the world's most famous unsolved codes. As of 2015, her elonka.com website has had over five
million page views. In 2000 she was awarded a prize for being the first person to crack the 1999 PhreakNIC v3.0 Code. In 2003 she led the team that
cracked the famous Cyrillic Projector cipher, which turned out to contain extracts of classified KGB documents. In 2006 she authored "The Mammoth Book of Secret Codes and
Cryptograms", which has been published internationally with multiple re-printings. Bestselling author Dan Brown honored Elonka by naming one of
the characters in his Da Vinci Code sequel The Lost Symbol after her: "Nola Kaye" is an anagrammed form of "Elonka".
She has also been featured by the popular webcomic Penny Arcade, where she created a
cipher that dovetailed with the daily comic. In other hobbies, Dunin is an avid Wikipedia editor, was elected as an administrator in 2007, and
has been a significant contributor to over 500 articles, especially in topics related to the Crusades and medieval history.
When not in front a computer, she's probably out geocaching.
Lateral Movement: How attackers quietly traverse your Network - Xavier Ashe
(@xavierashe)
After successfully attacking an endpoint and gaining a foothold there, sophisticated attackers know that to get to the valuable data within an
organization they must quietly pivot. From reconnaissance to escalation of privileges to stealing credentials, learn about the tactics and tools that
attackers are using today.
Xavier Ashe is the Vice President of Client Success for Drawbridge Networks. He has over 20 years of
experience with IT architecture and information security and is a Georgia Institute of Technology alumni. Formerly a Sr. Manager at Bit9 and a Sr.
Managing Consultant for IBM Security, he sat on the IBM Security Architecture Board and has published several papers. Blending his technical,
management and sales experience, Xavier Ashe is leading all customer facing efforts at Drawbridge Networks. Mr. Ashe holds many industry
certifications, including CISM, CISSP, ITIL, SOA, and others.
Death March and Back Again: A Grinder's Tale - James Powell
(@_grayraven_)
Even the best jobs can become a burden. During high-stress times, typically exciting work can devolve into a grind session as the hours drag on.
Long hours wear away at our mental health and focus. This constant pressure drives to an increase in mistakes, which leads to another cycle of trudging
through long hours. Most of us still have another 30+ years left in our careers. Do we just grind day after day until sanity leaves us? Can we survive
even another year let alone till the end of our career? I’m glad you asked. This talk discusses techniques that we can use to improve our mental
health, help prevent burnout, and enhance our day-to-day life. Because unless you wake up one morning independently wealthy, you have to survive in the
grind.
You are being manipulated! - James Powell
(@_grayraven_)
You Are Being Manipulated You are being manipulated. There is constant pressure coming from companies, people, and attackers. Millions are spent
researching and studying your weaknesses. The attack vectors are subtle. Most times we don’t realize that manipulation has occurred until it is too
late. Fear not, we can harden our defenses. We can put safeguards in place to help avoid being the victim. For me, the answer came from an unlikely
source: my daughter. Small children are fantastic. Society has not yet influenced their development; therefore, children are relentless in pursuing
their aims. Since they are naive to right and wrong, they will use any tool available to get their goal. How does this help? My daughter became my
trainer, and this talk discusses how interacting with her has improved my defenses. Comparing her strategies to real world examples will show how to
build a training framework of your own. Access to small children is not needed.
James Powell is a product security analyst at Cisco Systems. He has been fascinated with manipulation since his childhood. Despite receiving a
degree in psychology, he spent 18 years as a professional in the Information Technology space. James spent the first seven years of his career as a
system and network administrator before moving to the dark art of programming. Two years ago he stopped dabbling and tumbled down the security rabbit
hole. This journey makes him believe that he is finally using his degree professionally. During his downtime, James can be found practicing martial
arts, brewing beer and mead, or writing.
Protecting SCADA, PLCs and automation controls - Steve Mallard
Live Demo of SCADA/PLC intrusion. Threats,Vulnerabilities and Mitigation of infrastructure and manufacturing controls. Information includes the
vulnerabilities found in the Internet of Things and how home automation is becoming an attack surface for malicious users.
25+ years in Information Technology - Private security consultant for Business, Industry and Government Master Instructor of Information
Technology and Information Management with the Tennessee Colleges of Applied Technology-Shelbyville.
Awards - 2001 Instructor of the Year 2005
Computer Forensics Award - TTC Shining Star 2011
Computerworld Laureate 2012
TechTarget Mid-Market Leadership Award 2012
TCAT Shining Star - Learning Management System 2014
CTE Excellence in Action 2015
White House "Celebrating Innovations in Career and Technical Education" 2016
"State Leadership Playbook" NRCCTE 2016
Dean's List: EdTech’s 50 Must-Read Higher Ed IT Blogs
Applied Detection and Analysis Using Flow Data: Tools of the Trade - Jason Smith
(@automayt)
While network flow data isn’t a new concept, it is easily one of the most powerful data types you can have in your arsenal as a network defender. It
has incredibly low overhead, is easy to setup and maintain, and it provides tremendously flexible capabilities for network security monitoring (NSM)
detection and analysis. In this presentation we will take a look at flow data from the perspective of the NSM analyst, discussing what flows actually
are, what you can do with them, and what it takes to start generating them on your own. Better yet, we'll talk about the tools of the trade that are
used to generate and analyze flows so you can go back to work with an idea of how to deploy a full flow solution at little to no cost, and in minutes.
The concepts I discuss in this presentation will be demonstrated with practical, real-world scenarios complete with real data using the SiLK toolset
and explained using tools like FlowBAT and FlowPlotter. You will leave this talk with techniques you can apply to your network immediately with
incredibly low overhead and high impact.
Jason Smith has a background in physics and has built everything from particle accelerators to explosive neutralizing robots used by the military.
He has worked in multiple US Department of Defense SOCs and was the lead security monitoring architect for the Commonwealth of Kentucky. Jason
co-wrote Applied Network Security Monitoring and maintains the open source project FlowBAT, a graphical flow data analysis tool. Jason works remotely
from his home in Bowling Green, KY and has been with FireEye since late 2013.
Exploring Man-in-the-Middle Attacks on Software Defined Radars Software defined radios - Blake Yerkes
Software Defined Radars Software defined radios (SDRs) are powerful tools for implementing re-configurable wireless systems and for exploring the
wireless domain. USRPs are currently used to eavesdrop on home automation systems, to communicate with satellites, and to even build functional radars.
Multiple SDRs can also be linked together over the network to share information and act as a collective. In this talk we explore exactly how USRPs
communicate over the network to create a functioning radar. We will answer questions such as: "What happens if an attacker carefully alters the data
packets in real time?" and "What kinds of mischief can be wrought against a radar built using this technology?" We will also dive into the USRP source
code to laugh at the offbeat humor of the engineers, including pirate-based comments and ridiculous variable names.
Drone building and the legal ramifications - Ron Foster
(@vektek)
Introduction to drone building, as well as all the legal stuff; from both a hobbyist and commercial standpoint.
With over 15 years of it experience with various platforms and technologies, i have tested both large and small enterprise applications. cutting
my teeth as a unix instructor for sun microsystems. i then went on to make a career out of breaking things, and i have been doing it ever since. when
not running security assessment’s for hp’s fortify on demand service. you can find me refurbishing an old ww1/ww2 rifle, doing some photography,
meddling with drones, or heading out to the woods for some dirt time.
Communicating Your Tech Excitement with Improv - Beth Smith
(@bethbrod)
What are you tech people saying? Is it even our language? This interactive workshop will change how you communicate (in real life) the cool things
about what you do. Improv is a means of storytelling and alt media. Depending on what the group that shows up wants to cover topic-wise, there will be
theatrically-based exercises as well as conversation and question-sharing to reflect on the exercises we do. All levels welcome, no previous
performance experience necessary.
Beth's done improv for 13 years in LA, NYC, BOS, MIA, and ATL, but not at the same time. She's taught improv workshops for 8 of those years. She
started hanging out in a maker space and realized the only thing people were able to communicate to her about coding was "Do you want to date me?"
No, no she wants to learn how to code. Beth has a BS in TV and movies from Boston University's College of Communication. She needs metaphors and plot
twists to learn how to computer. Someone please accept this challenge and teach her in real life.
FFmpeg (I didn't know it could do that!) - poiupoiu
(@poiupoiu)
FFmpeg is called the “swiss army knife of video tools.” Come and find out why. If you are interested in videos at all, this talk is for you. If
you’ve never used FFmpeg before, you are welcome to come and learn about this great tool! If you've used FFmpeg in the past, come anyway - you will
probably learn a new trick or two!
FFmpeg Workshop - poiupoiu
(@poiupoiu)
Having seen his talk now get hands on experience with FFmpeg!
Diceware: how not to become a statistic - poiupoiu
(@poiupoiu)
When are more characters more better? When creating a password. So why use a password when you can use a passphrase? Come and learn about Diceware and how to use it, complete with an attack via hashcat.
Poiupoiu is a daddy, a husband, an engineer, and a geek from Huntsville, AL. He enjoys encoding videos, photography, playing video games, and
puns. He has spent countless hours learning about video encoding, and loves him some SSH, rsync, and btrfs. He has been a great friend to PhreakNIC
and serves as our Audio/Visual Director this year.
Recording Audio and Video Panel - Steve Esposito (@AustrianAnarchy) and poiupoiu(@poiupoiu)
Let's talk tools and software that can used to accomplish audio and video recording tasks. What are the pitfalls and the surprises? Talk to these guys and listen to them interview each other about their experiences.
Steve Esposito is an Environmental Specialist for the
Knox County Department of Air Quality Management. He is a
US Army veteran (Aviation, former Major) with a background
in financial information systems (no, not the ones your
bank uses). Besides his time in uniform, he was a defense
contractor supporting the US Navy, US Army, Missile Defense
Agency, and the Defense Information Systems Agency for over
15 years.
On the civilian side of things, Steve has written for
the Reason Foundation, The Foundation for Economic
Education, and the occasional online column here and there.
You can find links to most of that at Austrian
Anarchy.
What's the deal with Palo Alto Firewalls, anyway? - Ben White
What's the deal with Palo Alto Firewalls, anyway? Currently making up 15% of the firewall market place, Palo Alto Networks has made a big splash in
the security marketplace and is coming off two years of tremendous growth. This talk will include an overview their products, services, and whatever
the heck Unit 42 is. Input from non-rabid audience members is welcome so please share your experiences with this company/equipment!
HalfJack is a Associate Professor of Information Technology at a State college in Georgia that prefers to remain anonymous. For the past 20 years
most of his teaching has resembled 19th century Russian poetry (there's a lot of talk but everybody still freezes to death). Only a smattering of
outstanding students and taking summers off has (mostly) preserved his sanity. He believes you can't have too many wheelbarrows and the best piece of
advice he ever gave at an con talk was "Don't point the sharp end of the tool towards your body"
I2P and the Dark Web - John Liu
(@guard0g)
The Invisible Internet Project (I2P) is a fully decentralized, self-organizing network layer that provides secure and anonymous communications. As
an emerging darknet, I2P addresses much of the surveillance dragnet concerns and flaws of Tor. With a growing list of supported applications (including
integration with blockchain crypto-platforms), I2P is poised for mainstream adoption.
Dr. John Liu is a philomath and frequent speaker with expertise in machine learning, behavioral finance and probability theory. He is an avid
programmer who sold his first program at the age of 13 and holds an Amateur Extra radio license and a CFA Charter. He served as co-organizer for the
Nashville Machine Learning Meetup and was last year's Finalist for NTC Data Scientist of the Year. John earned his BSE, MSE, and PhD in EE from the
University of Pennsylvania and worked in quantitative investment management for too long. In his spare time, he enjoys experimenting with hypervisors
and coaching MathCounts, judging debate tournaments, and supporting the Middle Tennessee Science and Engineering Fair.
Fun and hacking on the Amazon Echo - James Church
(@jcchurch)
Have you ever wanted your own programmable personal assistant? With the Amazon Echo, this is now possible. Unlike Google Now and Apple's Siri,
Amazon is actively encouraging development of applications using their voice interface. The Amazon Alexa SDK is voice interface protocol that is
versatile enough to allow for conversations with the device. This talk explores the SDK and uses the Echo to give a voice to the Internet of Things.
Within a month of owning the Echo, your speaker wrote a game titled "Hunt the Yeti". The game has been played over 1000 times by Echo customers and was
featured on the front page of the Amazon skill page. The game is rated 4.8 out of 5 stars with 11 reviews.
James Church earned his PhD in Computer Science from the University of Mississippi. His PhD dissertation is titled "Solid Geometry Approximation
of Unorganized Point Cloud Data". He's the author of "Learning Haskell Data Analysis" as well as a series of online videos on data analysis
algorithms in the language of Haskell (both by PackT Publishers). James loves teaching, math, and programming and his dream job is Assistant
Professor of Computer Science at Austin Peay State University (which is what he's doing now). The last time he spoke at Phreaknic was Phreaknic
14.
Freedom Rant - mog
(@mogactually)
FREEEEEEEEEEEEDOM. Mog is a huge fsf hippie and will talk your ear off about freedom if you give him the chance. He is a long time attendee and
speaker at PhreakNIC. He is also long standing member of Makers Local 256 where he works on various electronics projects. He also has a birthday around
PhreakNIC... so that sort of makes him our mascot. sort of.
Persistence Pays Off – “A Brief History of APTs and their Lifecycle” - Alex Berta
(@Critical24)
This session will be talking about the history of APT attacks and the lifecycle and steps an APT takes. As technology continues to grow Advance
Persistent Threats become more of a problem. Attendees will learn about APT attacks starting with the first APT attack ever recorded to some of the
more popular attacks that have happened. This talk will give them insight onto how the attacks were formed, what effect they had on the target and
globally, and who was behind the attacks. With this kind of information it will give security professionals a chance to see a different perspective on
how cyber-attacks take place.
Alexander Berta is a Director of Threat Intelligence and Innovation with a local Nashville, TN company. Alexander provides cyber security and
threat intelligence services to Asylas clients. He assists in investigations involving identification, analysis, and presentation of data. He spent
his teen years studying the methodologies of hacking collectives around the world and gained rare insight into how they operate. Alexander has been
mentioned in books such as “Art of Intrusion” by Kevin Mitnick, and “2600 The Hackers Quarterly” by Emmanuel Goldstein. Alexander has devoted his
life work to help thwart network intrusion efforts and expose methodologies of various threat actors.
An FBI view into network security and where the failures are - Scott Augenbaum and Victor Rodriguez
Scott will talk about his experience with the threats and concerns that he sees. Learn some takeaways that organizations need to understand about security in the real world.
After joining the Federal Bureau of Investigation (FBI) in the New York Field Office in 1988 as a support employee, I became a Special Agent in
1994 and was assigned to the Syracuse, New York Office, where I worked domestic terrorism, white collar and hate crimes, and all computer crime
investigations.
In October 2003, I was promoted to Supervisory Special Agent at FBI Headquarters, Washington D.C in the Cyber Division, Cyber Crime Fraud Unit and
was responsible for managing the FBI's Cyber Task Force Program and Intellectual Property Rights Program. In 2006, I transferred to Nashville, TN and
managed the FBI Memphis Division Computer Intrusion/Counterintelligence Squad in Nashville, TN.
Over the past ten years, I've had the opportunity to provide hundreds of computer intrusion threat briefings with the goal of educating the
community on emerging computer intrusion threats and how to not to be the victim of a data breach. Earned an MBA at American Sentinel University in
Information Technology and a Masters Certificate in Information Security Management from Villanova University and hold numerous General Information
Assurance Certifications.
Making machine data accessible with Splunk- George Starcher
(@georgestarcher)
In this session we will get a run down on Splunk. What is it? What use cases can you leverage it for? How can you scale it and get the most from your data? And what are the gotchas that you can run into on the data processing platform that is Splunk?
George Starcher is a security industry veteran. He is a member of the SplunkTrust MVP program that uses Splunk daily in support of security operations. He has experience using Splunk in deployments from 50B/day up to 8TB/day.
He has even used Splunk to trend the laundry room usage at his apartment building using a Raspberry Pi.
Getting Started with Power Shell - Mick Pletcher
(@mick_pletcher)
PowerShell has become and essential tool to windows sysadmins. Its time to stop making excuses and learn how to use it from one of the founders of the Nashville PowerShell User Group!
Maker Achievement Unlocked! Building a Shipping Container House - Mick Pletcher
(@mick_pletcher)
In this session we will talk about how I am building my shipping container house. The pitfalls and gotchas that come along with the experience and
... welding... lots of welding...
Mick Pletcher is a SCCM Administrator with Waller Lansden Dortch & Davis, LLP, a Nashville-based law firm with more than 200 attorneys in four offices. In this role he deploys software to more than 500 users across the Southeast and is responsible for automating tasks via the use of PowerShell, administering group policies, deploying Windows updates, and the PC build process. Prior to joining Waller, Mick implemented alternate system design approaches and managed software and Operating Systems using SCCM 2012, along with SMS Installer, PowerShell, and VBScript at one of the nation.s largest architecture and engineering design firms. In 2013, Mick co-founded the Nashville PowerShell User Group. Mick is a relentless world traveler who has climbed Mount Kilimanjaro. Other hobbies include astronomy, welding and fabrication, river boarding, sport bikes, cycling and mountaineering. Mick.s IT blogs are available at http://mickitblog.blogspot.com/.
Winning Management Buy-In to Security - SA Hale and Terry Hale
An analysis of how security professionals plead their case to vice presidents, senior management, and stakeholders that security issues are real and
imminent dangers - "convincing the king that he is not invisible to dragons." This presentation would make use of real world examples from senior
management decisions and we will reinforce these examples with Cognitive Biases, Problem-Solving, and Conflict Resolution.
Mr. Hale is a Computer Scientist with a substantial depth and breadth of experiences totaling 30 years in Cognitive System Engineering, Security
Engineering, Cyber Warfare, Information Assurance, Testing, System Administration, and Software Engineering. Predominantly utilizing an inter
disciplinary approach that brings the human side to technology by combining Cognitive and Behavioral Science, with Computer and Security
Engineering.
Examples where Mr. Hale has uses the human centric computing approach include system security management, security architecture, vulnerability and
penetration testing, social engineering, information assurance, software engineering, and network security.
Mr. Hale’s duties include cyber technical lead and Information System Security Officer (ISSO) for 9 classified Information Systems (IS). In
addition, he has provided engineering and analysis support for numerous projects for MDA, GMD, SMDC, USMC, US Navy, Homeland Security, State of
Alabama, National Guard Bureau, and others.
Furthermore, Mr. Hale is an Adjunct Professor of Computer Science at Athens State University where he teaches courses in System Security
Management, Digital Forensics, Cyber Ethics, Javascripts, and C++.
Terry Hale has been fascinated with the decision making process since she
began dealing with customers in her family.s business when she was a young
teen. Throughout her adult life, she has studied social engineering while
working in a career that includes sales, teaching, corporate training, and NASA
and Department of Defense technical support.
Currently, Terry is a full-time glass artist and jewelry designer. Her designs can be found in fine art
galleries and shows throughout the southeast US. In addition to teaching in her studio, Terry regularly
teaches at John C. Campbell Folk School in Brasstown NC, Appalachian Center for Craft (Tennessee Tech)
in Smithville TN, and at Essence of Mulranny, County Mayo, Ireland. She depends on her study of
You contact Terry at terry@halefireglass.com
A deep dive into the inner workings of Stuxnet - Dr. Nicholas Evancich
Most Industry Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) systems lack security in their design. Designers of ICS and SCADA systems believed that an air gap, or not having an Internet connection, was the panacea for security (Lee & Seshia, 2011). The Stuxnet malware example detailed later in this presentation highlights the fallacy of this argument. This presentation will provide a "deep drive" into the inner workings of Stuxnet including: infection vectors, exploited attack surfaces, and resultant effects.
Dr. Nicholas Evancich's research interests are: networks and security, computer based defense, virtualization technology, and software systems. Dr. Evancich worked as a principle engineer designing exploits at Fort Meade, where he developed technical exploits via reverse engineering and data-based exploits. Dr. Evancich worked at DARPA supporting TIGR and TransApps in I2O. While working in I2O, he helped design search optimization improvements to TIGR and aided in the deployment of a major upgrade to TIGR. He wrote several of the canonical example apps for the DARPA Transformative Applications project and worked on the design and implementation of the security version of .droid. Prior to his DARPA work, Dr. Evancich was the chief engineer for the BAT program. He started his career at JHU/APL where he designed and implemented submarine detection systems.
Maintaining Jedi order after Jar Jar Binks was left in command - Chris Scott (@Cyb3r_Assassin)
Avoid Storm trooper camp by joining the rebellion. Get your midichlorians at the door because Jedi boot camp starts with preserving effective pentesting by offloading, consolidating, and fruitful targeting. Understand how and when the client, scope, or management is screwing your deliverable and how you can take initiative that will deliver useful and positive results, regardless of the droids you're looking for. As a bonus BB-8 will be rolling some free code!
Chris Scott is a pentester and long time security professional. He helped cofound the local DC615 and recently spoke at SkyDogCon 6.
Continuous Integration and new ways to hack the planet - Tyler Welton (@spaceb0xx)
The attack surface of a network shapes the strategy that a hacker or pen tester may take to gain entry or exploit the system. Naturally, standard strategies and solid tooling has been created to help with these attacks. Although traditional networks are definitely not going anywhere soon, the movement toward cloud hosted services and cloud based infrastructure is quickly bringing in a new attack surface (or already has). With the adoption of Continuous Integration environments where code is deployed multiple times a day and automated systems are helping infrastructure grow and shrink with scale, a new landscape of continual pwnage emerges. It's a beautiful new world.
NMAP Workshop - Brimstone (@brimston3)
"Nmap (“Network Mapper”) is an open source tool for network exploration and security auditing. It is often the first tool for which pentesters reach. This workshop is designed to get absolute beginners off the ground and running with one of the best tools in information security."
Hacking and scripting!
(operat0r)
Robert is a hacker, maker, tinkerer, and collector of interesting scripts for various uses. He is a Jack-Of-All-Trades in many technology areas and is a favorite of our staff because so. 5 Years ago he showed us some of the collection of interesting scripts that he had found and written. This year he will go into what he has been up to since, and also might mention a project BenTheMeek has been pestering about; his RFID reader cat door!
HACKING 101
Elonka, _NSAKEY, Robert Mccurdy, and other speakers will sit in a panel and talk about how they got into their areas of interest. Whether you have a question about Crypto, the Dark Web, or hacking phones they will take questions from the audience and talk about the basics and sometimes the not so basic!
Nothing but NETKOTH!
(@_NSAKEY)
NETKOTH. What are the rules? What is out of bounds? How are things set up this year? Ben Hicks will also be speaking about the origins and evolution of the laptop pxe rig that PhreakNIC employs. We will field questions about PhreakNIC and the setup
Kids Track: I can Linux and so can you!- ItWasn'tMe
We will make USB install sticks and try several different distros. This session is to show how to write Linux to a usb and boot to it. We will play with the console and learn some tricks around getting started with Linux.
Kids Track: Writing MadLibs in Python - Ben Hicks and Amy Flatt
We are back this year in our effort to learn more Python! This year we will start with a working Python example of a Madlib. Each of us add to it and in so doing learn about more about variables and user input!
Kids Track: Makey Makey the Invention Kit for Everyone! - Amy Flatt (@AmyFlatt1)
MaKey MaKey is an invention kit for the 21st century. Turn everyday objects into touchpads and combine them with the internet. It's a simple Invention Kit for Beginners and Experts doing art, engineering, and everything inbetween
Amy Flatt is the Founder of EDGE-ucational
Consultants, LLC and a public school teacher in Metro
Nashville Public Schools. She specializes in scaffolding
children's academic success and creativity in STEM
related subjects, to hone their unique gifts. She strongly
believes STEM learning opens many opportunities people
could miss without training. She also knows, if STEM is
taught correctly can increase levels of engagement for this
generation of students.
Amy has been published in TREND magazine and Edueto
Magazine and blogs for TeachersandCompany.blogspot.com. She
loves to teach robotics, micro-controllers, coding,
Mathematics and other STEM subjects. She also is pleased to
speak on a wide range of Teaching and Educational Policy
issues. Amy has been a guest speaker for PyOhio and The
Southern Association of Colleges and Schools. You can reach
her at AmyFlatt@edge-ucationalconsultants.com, follow her
on twitter @amyflatt1 or fund her goal to get a 3D printer
and other useful tech tech teaching tools by supporting her
on Patreon under Amy Flatt.
Kids Track: Soldering and LED kit building - (Brought to you by Tim Heath and the Makers256)
Tim Heath of the Makers256 will show the children the:
St:eak: Solder Trainer: Entropy Approximator Kit
There will be limited numbers of soldering irons and safety glasses, so the children will take turns learning how to solder, whilst doing other activities with Amy and Ben.
Lightning Talks - (Brought to you by Shae Erisson (@Shapr)
Have something you think is interesting? Stand up and give a 5 min talk about it. This event was organized last year by Shae and was a huge hit with our attendees. Its informal and fun! Bring your curiosity and encouragement for your fellow attendees!
Getting started with Python Workshop - Shae Erisson (@Shapr)
We will have 20 computers set up and ready to go for those who want to learn some Python! No experience necessary!
Closing Ceremonies
We will wrap up the con: Talk about what went right, thank the speakers and attendees, and present the prizes for NETKOTH.
Welcome to PhreakNIC / The state of the Nashville2600 - Elonka Dunin (@ElonkaDunin)
Elonka Dunin and the other officers of the Nashville2600 will greet everyone and briefly discuss the activities and options at PhreakNIC this year.
Agile Development 101 - Elonka Dunin (@ElonkaDunin)
Elonka Dunin, along with cracking codes and making games, is also a certified Agile coach. Just what is Agile Development? What do all those terms mean, such as Scrum Master, Product Owner, Sprint Review, self-organizing cross-functional teams, etc? This is a general talk where she goes over the history and principles of Agile, which is both a mindset, and a growing type of project management methodology. Agile has been revolutionizing many organizations over the last few decades. Some companies have embraced it, while others have tried to implement it but have failed. If you are already familiar with Agile, feel free to bring your own war stories about whether Agile has or hasn't worked in your own organization, and we can also discuss the reasons why!
Elonka's Journey - Elonka Dunin (@ElonkaDunin)
So many questions! What is Kryptos? Who is Elonka? Wasn't she a game developer? How did she go from games to cryptography? How did she meet Dan Brown? How did she get a character named after her in one of Brown's novels? And how did she end up as chair of Nashville 2600? All these stories are intertwined together. Come here the grand story of how it all came to pass at this session.
Elonka Dunin is a professional game developer, writer, and cryptographer. She serves as chair on the board of the Nashville2600. She is webmistress of two popular crypto-related websites which contain information about the world's most famous unsolved codes. As of 2015, her elonka.com website has had over five million page views. In 2000 she was awarded a prize for being the first person to crack the 1999 PhreakNIC v3.0 Code. In 2003 she led the team that cracked the famous Cyrillic Projector cipher, which turned out to contain extracts of classified KGB documents. In 2006 she authored "The Mammoth Book of Secret Codes and Cryptograms", which has been published internationally with multiple re-printings. Bestselling author Dan Brown honored Elonka by naming one of the characters in his Da Vinci Code sequel The Lost Symbol after her: "Nola Kaye" is an anagrammed form of "Elonka".
She has also been featured by the popular webcomic Penny Arcade, where she created a cipher that dovetailed with the daily comic. In other hobbies, Dunin is an avid Wikipedia editor, was elected as an administrator in 2007, and has been a significant contributor to over 500 articles, especially in topics related to the Crusades and medieval history.
When not in front a computer, she's probably out geocaching.
Lateral Movement: How attackers quietly traverse your Network - Xavier Ashe (@xavierashe)
After successfully attacking an endpoint and gaining a foothold there, sophisticated attackers know that to get to the valuable data within an organization they must quietly pivot. From reconnaissance to escalation of privileges to stealing credentials, learn about the tactics and tools that attackers are using today.
Xavier Ashe is the Vice President of Client Success for Drawbridge Networks. He has over 20 years of experience with IT architecture and information security and is a Georgia Institute of Technology alumni. Formerly a Sr. Manager at Bit9 and a Sr. Managing Consultant for IBM Security, he sat on the IBM Security Architecture Board and has published several papers. Blending his technical, management and sales experience, Xavier Ashe is leading all customer facing efforts at Drawbridge Networks. Mr. Ashe holds many industry certifications, including CISM, CISSP, ITIL, SOA, and others.
Death March and Back Again: A Grinder's Tale - James Powell (@_grayraven_)
Even the best jobs can become a burden. During high-stress times, typically exciting work can devolve into a grind session as the hours drag on. Long hours wear away at our mental health and focus. This constant pressure drives to an increase in mistakes, which leads to another cycle of trudging through long hours. Most of us still have another 30+ years left in our careers. Do we just grind day after day until sanity leaves us? Can we survive even another year let alone till the end of our career? I’m glad you asked. This talk discusses techniques that we can use to improve our mental health, help prevent burnout, and enhance our day-to-day life. Because unless you wake up one morning independently wealthy, you have to survive in the grind.
You are being manipulated! - James Powell (@_grayraven_)
You Are Being Manipulated You are being manipulated. There is constant pressure coming from companies, people, and attackers. Millions are spent researching and studying your weaknesses. The attack vectors are subtle. Most times we don’t realize that manipulation has occurred until it is too late. Fear not, we can harden our defenses. We can put safeguards in place to help avoid being the victim. For me, the answer came from an unlikely source: my daughter. Small children are fantastic. Society has not yet influenced their development; therefore, children are relentless in pursuing their aims. Since they are naive to right and wrong, they will use any tool available to get their goal. How does this help? My daughter became my trainer, and this talk discusses how interacting with her has improved my defenses. Comparing her strategies to real world examples will show how to build a training framework of your own. Access to small children is not needed.
James Powell is a product security analyst at Cisco Systems. He has been fascinated with manipulation since his childhood. Despite receiving a degree in psychology, he spent 18 years as a professional in the Information Technology space. James spent the first seven years of his career as a system and network administrator before moving to the dark art of programming. Two years ago he stopped dabbling and tumbled down the security rabbit hole. This journey makes him believe that he is finally using his degree professionally. During his downtime, James can be found practicing martial arts, brewing beer and mead, or writing.
Protecting SCADA, PLCs and automation controls - Steve Mallard
Live Demo of SCADA/PLC intrusion. Threats,Vulnerabilities and Mitigation of infrastructure and manufacturing controls. Information includes the vulnerabilities found in the Internet of Things and how home automation is becoming an attack surface for malicious users.
25+ years in Information Technology - Private security consultant for Business, Industry and Government Master Instructor of Information
Technology and Information Management with the Tennessee Colleges of Applied Technology-Shelbyville.
Awards - 2001 Instructor of the Year 2005
Computer Forensics Award - TTC Shining Star 2011
Computerworld Laureate 2012
TechTarget Mid-Market Leadership Award 2012
TCAT Shining Star - Learning Management System 2014
CTE Excellence in Action 2015
White House "Celebrating Innovations in Career and Technical Education" 2016
"State Leadership Playbook" NRCCTE 2016
Dean's List: EdTech’s 50 Must-Read Higher Ed IT Blogs
Applied Detection and Analysis Using Flow Data: Tools of the Trade - Jason Smith (@automayt)
While network flow data isn’t a new concept, it is easily one of the most powerful data types you can have in your arsenal as a network defender. It has incredibly low overhead, is easy to setup and maintain, and it provides tremendously flexible capabilities for network security monitoring (NSM) detection and analysis. In this presentation we will take a look at flow data from the perspective of the NSM analyst, discussing what flows actually are, what you can do with them, and what it takes to start generating them on your own. Better yet, we'll talk about the tools of the trade that are used to generate and analyze flows so you can go back to work with an idea of how to deploy a full flow solution at little to no cost, and in minutes. The concepts I discuss in this presentation will be demonstrated with practical, real-world scenarios complete with real data using the SiLK toolset and explained using tools like FlowBAT and FlowPlotter. You will leave this talk with techniques you can apply to your network immediately with incredibly low overhead and high impact.
Jason Smith has a background in physics and has built everything from particle accelerators to explosive neutralizing robots used by the military. He has worked in multiple US Department of Defense SOCs and was the lead security monitoring architect for the Commonwealth of Kentucky. Jason co-wrote Applied Network Security Monitoring and maintains the open source project FlowBAT, a graphical flow data analysis tool. Jason works remotely from his home in Bowling Green, KY and has been with FireEye since late 2013.
Exploring Man-in-the-Middle Attacks on Software Defined Radars Software defined radios - Blake Yerkes
Software Defined Radars Software defined radios (SDRs) are powerful tools for implementing re-configurable wireless systems and for exploring the wireless domain. USRPs are currently used to eavesdrop on home automation systems, to communicate with satellites, and to even build functional radars. Multiple SDRs can also be linked together over the network to share information and act as a collective. In this talk we explore exactly how USRPs communicate over the network to create a functioning radar. We will answer questions such as: "What happens if an attacker carefully alters the data packets in real time?" and "What kinds of mischief can be wrought against a radar built using this technology?" We will also dive into the USRP source code to laugh at the offbeat humor of the engineers, including pirate-based comments and ridiculous variable names.
Drone building and the legal ramifications - Ron Foster (@vektek)
Introduction to drone building, as well as all the legal stuff; from both a hobbyist and commercial standpoint.
With over 15 years of it experience with various platforms and technologies, i have tested both large and small enterprise applications. cutting my teeth as a unix instructor for sun microsystems. i then went on to make a career out of breaking things, and i have been doing it ever since. when not running security assessment’s for hp’s fortify on demand service. you can find me refurbishing an old ww1/ww2 rifle, doing some photography, meddling with drones, or heading out to the woods for some dirt time.
Communicating Your Tech Excitement with Improv - Beth Smith (@bethbrod)
What are you tech people saying? Is it even our language? This interactive workshop will change how you communicate (in real life) the cool things about what you do. Improv is a means of storytelling and alt media. Depending on what the group that shows up wants to cover topic-wise, there will be theatrically-based exercises as well as conversation and question-sharing to reflect on the exercises we do. All levels welcome, no previous performance experience necessary.
Beth's done improv for 13 years in LA, NYC, BOS, MIA, and ATL, but not at the same time. She's taught improv workshops for 8 of those years. She started hanging out in a maker space and realized the only thing people were able to communicate to her about coding was "Do you want to date me?" No, no she wants to learn how to code. Beth has a BS in TV and movies from Boston University's College of Communication. She needs metaphors and plot twists to learn how to computer. Someone please accept this challenge and teach her in real life.
FFmpeg (I didn't know it could do that!) - poiupoiu (@poiupoiu)
FFmpeg is called the “swiss army knife of video tools.” Come and find out why. If you are interested in videos at all, this talk is for you. If you’ve never used FFmpeg before, you are welcome to come and learn about this great tool! If you've used FFmpeg in the past, come anyway - you will probably learn a new trick or two!
FFmpeg Workshop - poiupoiu (@poiupoiu)
Having seen his talk now get hands on experience with FFmpeg!
Diceware: how not to become a statistic - poiupoiu (@poiupoiu)
When are more characters more better? When creating a password. So why use a password when you can use a passphrase? Come and learn about Diceware and how to use it, complete with an attack via hashcat.
Poiupoiu is a daddy, a husband, an engineer, and a geek from Huntsville, AL. He enjoys encoding videos, photography, playing video games, and puns. He has spent countless hours learning about video encoding, and loves him some SSH, rsync, and btrfs. He has been a great friend to PhreakNIC and serves as our Audio/Visual Director this year.
Recording Audio and Video Panel - Steve Esposito (@AustrianAnarchy) and poiupoiu(@poiupoiu)
Let's talk tools and software that can used to accomplish audio and video recording tasks. What are the pitfalls and the surprises? Talk to these guys and listen to them interview each other about their experiences.
Steve Esposito is an Environmental Specialist for the Knox County Department of Air Quality Management. He is a US Army veteran (Aviation, former Major) with a background in financial information systems (no, not the ones your bank uses). Besides his time in uniform, he was a defense contractor supporting the US Navy, US Army, Missile Defense Agency, and the Defense Information Systems Agency for over 15 years.
On the civilian side of things, Steve has written for the Reason Foundation, The Foundation for Economic Education, and the occasional online column here and there. You can find links to most of that at Austrian Anarchy.
What's the deal with Palo Alto Firewalls, anyway? - Ben White
What's the deal with Palo Alto Firewalls, anyway? Currently making up 15% of the firewall market place, Palo Alto Networks has made a big splash in the security marketplace and is coming off two years of tremendous growth. This talk will include an overview their products, services, and whatever the heck Unit 42 is. Input from non-rabid audience members is welcome so please share your experiences with this company/equipment!
HalfJack is a Associate Professor of Information Technology at a State college in Georgia that prefers to remain anonymous. For the past 20 years most of his teaching has resembled 19th century Russian poetry (there's a lot of talk but everybody still freezes to death). Only a smattering of outstanding students and taking summers off has (mostly) preserved his sanity. He believes you can't have too many wheelbarrows and the best piece of advice he ever gave at an con talk was "Don't point the sharp end of the tool towards your body"
I2P and the Dark Web - John Liu (@guard0g)
The Invisible Internet Project (I2P) is a fully decentralized, self-organizing network layer that provides secure and anonymous communications. As an emerging darknet, I2P addresses much of the surveillance dragnet concerns and flaws of Tor. With a growing list of supported applications (including integration with blockchain crypto-platforms), I2P is poised for mainstream adoption.
Dr. John Liu is a philomath and frequent speaker with expertise in machine learning, behavioral finance and probability theory. He is an avid programmer who sold his first program at the age of 13 and holds an Amateur Extra radio license and a CFA Charter. He served as co-organizer for the Nashville Machine Learning Meetup and was last year's Finalist for NTC Data Scientist of the Year. John earned his BSE, MSE, and PhD in EE from the University of Pennsylvania and worked in quantitative investment management for too long. In his spare time, he enjoys experimenting with hypervisors and coaching MathCounts, judging debate tournaments, and supporting the Middle Tennessee Science and Engineering Fair.
Fun and hacking on the Amazon Echo - James Church (@jcchurch)
Have you ever wanted your own programmable personal assistant? With the Amazon Echo, this is now possible. Unlike Google Now and Apple's Siri, Amazon is actively encouraging development of applications using their voice interface. The Amazon Alexa SDK is voice interface protocol that is versatile enough to allow for conversations with the device. This talk explores the SDK and uses the Echo to give a voice to the Internet of Things. Within a month of owning the Echo, your speaker wrote a game titled "Hunt the Yeti". The game has been played over 1000 times by Echo customers and was featured on the front page of the Amazon skill page. The game is rated 4.8 out of 5 stars with 11 reviews.
James Church earned his PhD in Computer Science from the University of Mississippi. His PhD dissertation is titled "Solid Geometry Approximation of Unorganized Point Cloud Data". He's the author of "Learning Haskell Data Analysis" as well as a series of online videos on data analysis algorithms in the language of Haskell (both by PackT Publishers). James loves teaching, math, and programming and his dream job is Assistant Professor of Computer Science at Austin Peay State University (which is what he's doing now). The last time he spoke at Phreaknic was Phreaknic 14.
Freedom Rant - mog (@mogactually)
FREEEEEEEEEEEEDOM. Mog is a huge fsf hippie and will talk your ear off about freedom if you give him the chance. He is a long time attendee and speaker at PhreakNIC. He is also long standing member of Makers Local 256 where he works on various electronics projects. He also has a birthday around PhreakNIC... so that sort of makes him our mascot. sort of.
Persistence Pays Off – “A Brief History of APTs and their Lifecycle” - Alex Berta (@Critical24)
This session will be talking about the history of APT attacks and the lifecycle and steps an APT takes. As technology continues to grow Advance Persistent Threats become more of a problem. Attendees will learn about APT attacks starting with the first APT attack ever recorded to some of the more popular attacks that have happened. This talk will give them insight onto how the attacks were formed, what effect they had on the target and globally, and who was behind the attacks. With this kind of information it will give security professionals a chance to see a different perspective on how cyber-attacks take place.
Alexander Berta is a Director of Threat Intelligence and Innovation with a local Nashville, TN company. Alexander provides cyber security and threat intelligence services to Asylas clients. He assists in investigations involving identification, analysis, and presentation of data. He spent his teen years studying the methodologies of hacking collectives around the world and gained rare insight into how they operate. Alexander has been mentioned in books such as “Art of Intrusion” by Kevin Mitnick, and “2600 The Hackers Quarterly” by Emmanuel Goldstein. Alexander has devoted his life work to help thwart network intrusion efforts and expose methodologies of various threat actors.
An FBI view into network security and where the failures are - Scott Augenbaum and Victor Rodriguez
Scott will talk about his experience with the threats and concerns that he sees. Learn some takeaways that organizations need to understand about security in the real world.
After joining the Federal Bureau of Investigation (FBI) in the New York Field Office in 1988 as a support employee, I became a Special Agent in 1994 and was assigned to the Syracuse, New York Office, where I worked domestic terrorism, white collar and hate crimes, and all computer crime investigations.
In October 2003, I was promoted to Supervisory Special Agent at FBI Headquarters, Washington D.C in the Cyber Division, Cyber Crime Fraud Unit and was responsible for managing the FBI's Cyber Task Force Program and Intellectual Property Rights Program. In 2006, I transferred to Nashville, TN and managed the FBI Memphis Division Computer Intrusion/Counterintelligence Squad in Nashville, TN.
Over the past ten years, I've had the opportunity to provide hundreds of computer intrusion threat briefings with the goal of educating the community on emerging computer intrusion threats and how to not to be the victim of a data breach. Earned an MBA at American Sentinel University in Information Technology and a Masters Certificate in Information Security Management from Villanova University and hold numerous General Information Assurance Certifications.
Making machine data accessible with Splunk- George Starcher (@georgestarcher)
In this session we will get a run down on Splunk. What is it? What use cases can you leverage it for? How can you scale it and get the most from your data? And what are the gotchas that you can run into on the data processing platform that is Splunk?
George Starcher is a security industry veteran. He is a member of the SplunkTrust MVP program that uses Splunk daily in support of security operations. He has experience using Splunk in deployments from 50B/day up to 8TB/day. He has even used Splunk to trend the laundry room usage at his apartment building using a Raspberry Pi.
Getting Started with Power Shell - Mick Pletcher (@mick_pletcher)
PowerShell has become and essential tool to windows sysadmins. Its time to stop making excuses and learn how to use it from one of the founders of the Nashville PowerShell User Group!
Maker Achievement Unlocked! Building a Shipping Container House - Mick Pletcher (@mick_pletcher)
In this session we will talk about how I am building my shipping container house. The pitfalls and gotchas that come along with the experience and ... welding... lots of welding...
Mick Pletcher is a SCCM Administrator with Waller Lansden Dortch & Davis, LLP, a Nashville-based law firm with more than 200 attorneys in four offices. In this role he deploys software to more than 500 users across the Southeast and is responsible for automating tasks via the use of PowerShell, administering group policies, deploying Windows updates, and the PC build process. Prior to joining Waller, Mick implemented alternate system design approaches and managed software and Operating Systems using SCCM 2012, along with SMS Installer, PowerShell, and VBScript at one of the nation.s largest architecture and engineering design firms. In 2013, Mick co-founded the Nashville PowerShell User Group. Mick is a relentless world traveler who has climbed Mount Kilimanjaro. Other hobbies include astronomy, welding and fabrication, river boarding, sport bikes, cycling and mountaineering. Mick.s IT blogs are available at http://mickitblog.blogspot.com/.
Winning Management Buy-In to Security - SA Hale and Terry Hale
An analysis of how security professionals plead their case to vice presidents, senior management, and stakeholders that security issues are real and imminent dangers - "convincing the king that he is not invisible to dragons." This presentation would make use of real world examples from senior management decisions and we will reinforce these examples with Cognitive Biases, Problem-Solving, and Conflict Resolution.
Mr. Hale is a Computer Scientist with a substantial depth and breadth of experiences totaling 30 years in Cognitive System Engineering, Security Engineering, Cyber Warfare, Information Assurance, Testing, System Administration, and Software Engineering. Predominantly utilizing an inter disciplinary approach that brings the human side to technology by combining Cognitive and Behavioral Science, with Computer and Security Engineering.
Examples where Mr. Hale has uses the human centric computing approach include system security management, security architecture, vulnerability and penetration testing, social engineering, information assurance, software engineering, and network security.
Mr. Hale’s duties include cyber technical lead and Information System Security Officer (ISSO) for 9 classified Information Systems (IS). In addition, he has provided engineering and analysis support for numerous projects for MDA, GMD, SMDC, USMC, US Navy, Homeland Security, State of Alabama, National Guard Bureau, and others.
Furthermore, Mr. Hale is an Adjunct Professor of Computer Science at Athens State University where he teaches courses in System Security Management, Digital Forensics, Cyber Ethics, Javascripts, and C++.
Terry Hale has been fascinated with the decision making process since she began dealing with customers in her family.s business when she was a young teen. Throughout her adult life, she has studied social engineering while working in a career that includes sales, teaching, corporate training, and NASA and Department of Defense technical support.
Currently, Terry is a full-time glass artist and jewelry designer. Her designs can be found in fine art galleries and shows throughout the southeast US. In addition to teaching in her studio, Terry regularly teaches at John C. Campbell Folk School in Brasstown NC, Appalachian Center for Craft (Tennessee Tech) in Smithville TN, and at Essence of Mulranny, County Mayo, Ireland. She depends on her study of
You contact Terry at terry@halefireglass.com
A deep dive into the inner workings of Stuxnet - Dr. Nicholas Evancich
Most Industry Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) systems lack security in their design. Designers of ICS and SCADA systems believed that an air gap, or not having an Internet connection, was the panacea for security (Lee & Seshia, 2011). The Stuxnet malware example detailed later in this presentation highlights the fallacy of this argument. This presentation will provide a "deep drive" into the inner workings of Stuxnet including: infection vectors, exploited attack surfaces, and resultant effects.
Dr. Nicholas Evancich's research interests are: networks and security, computer based defense, virtualization technology, and software systems. Dr. Evancich worked as a principle engineer designing exploits at Fort Meade, where he developed technical exploits via reverse engineering and data-based exploits. Dr. Evancich worked at DARPA supporting TIGR and TransApps in I2O. While working in I2O, he helped design search optimization improvements to TIGR and aided in the deployment of a major upgrade to TIGR. He wrote several of the canonical example apps for the DARPA Transformative Applications project and worked on the design and implementation of the security version of .droid. Prior to his DARPA work, Dr. Evancich was the chief engineer for the BAT program. He started his career at JHU/APL where he designed and implemented submarine detection systems.
Maintaining Jedi order after Jar Jar Binks was left in command - Chris Scott (@Cyb3r_Assassin)
Avoid Storm trooper camp by joining the rebellion. Get your midichlorians at the door because Jedi boot camp starts with preserving effective pentesting by offloading, consolidating, and fruitful targeting. Understand how and when the client, scope, or management is screwing your deliverable and how you can take initiative that will deliver useful and positive results, regardless of the droids you're looking for. As a bonus BB-8 will be rolling some free code!
Chris Scott is a pentester and long time security professional. He helped cofound the local DC615 and recently spoke at SkyDogCon 6.
Continuous Integration and new ways to hack the planet - Tyler Welton (@spaceb0xx)
The attack surface of a network shapes the strategy that a hacker or pen tester may take to gain entry or exploit the system. Naturally, standard strategies and solid tooling has been created to help with these attacks. Although traditional networks are definitely not going anywhere soon, the movement toward cloud hosted services and cloud based infrastructure is quickly bringing in a new attack surface (or already has). With the adoption of Continuous Integration environments where code is deployed multiple times a day and automated systems are helping infrastructure grow and shrink with scale, a new landscape of continual pwnage emerges. It's a beautiful new world.
NMAP Workshop - Brimstone (@brimston3)
"Nmap (“Network Mapper”) is an open source tool for network exploration and security auditing. It is often the first tool for which pentesters reach. This workshop is designed to get absolute beginners off the ground and running with one of the best tools in information security."
Hacking and scripting! (operat0r)
Robert is a hacker, maker, tinkerer, and collector of interesting scripts for various uses. He is a Jack-Of-All-Trades in many technology areas and is a favorite of our staff because so. 5 Years ago he showed us some of the collection of interesting scripts that he had found and written. This year he will go into what he has been up to since, and also might mention a project BenTheMeek has been pestering about; his RFID reader cat door!
HACKING 101
Elonka, _NSAKEY, Robert Mccurdy, and other speakers will sit in a panel and talk about how they got into their areas of interest. Whether you have a question about Crypto, the Dark Web, or hacking phones they will take questions from the audience and talk about the basics and sometimes the not so basic!
Nothing but NETKOTH! (@_NSAKEY)
NETKOTH. What are the rules? What is out of bounds? How are things set up this year? Ben Hicks will also be speaking about the origins and evolution of the laptop pxe rig that PhreakNIC employs. We will field questions about PhreakNIC and the setup
Kids Track: I can Linux and so can you!- ItWasn'tMe
We will make USB install sticks and try several different distros. This session is to show how to write Linux to a usb and boot to it. We will play with the console and learn some tricks around getting started with Linux.
Kids Track: Writing MadLibs in Python - Ben Hicks and Amy Flatt
We are back this year in our effort to learn more Python! This year we will start with a working Python example of a Madlib. Each of us add to it and in so doing learn about more about variables and user input!
Kids Track: Makey Makey the Invention Kit for Everyone! - Amy Flatt (@AmyFlatt1)
MaKey MaKey is an invention kit for the 21st century. Turn everyday objects into touchpads and combine them with the internet. It's a simple Invention Kit for Beginners and Experts doing art, engineering, and everything inbetween
Amy Flatt is the Founder of EDGE-ucational Consultants, LLC and a public school teacher in Metro Nashville Public Schools. She specializes in scaffolding children's academic success and creativity in STEM related subjects, to hone their unique gifts. She strongly believes STEM learning opens many opportunities people could miss without training. She also knows, if STEM is taught correctly can increase levels of engagement for this generation of students.
Amy has been published in TREND magazine and Edueto Magazine and blogs for TeachersandCompany.blogspot.com. She loves to teach robotics, micro-controllers, coding, Mathematics and other STEM subjects. She also is pleased to speak on a wide range of Teaching and Educational Policy issues. Amy has been a guest speaker for PyOhio and The Southern Association of Colleges and Schools. You can reach her at AmyFlatt@edge-ucationalconsultants.com, follow her on twitter @amyflatt1 or fund her goal to get a 3D printer and other useful tech tech teaching tools by supporting her on Patreon under Amy Flatt.
Kids Track: Soldering and LED kit building - (Brought to you by Tim Heath and the Makers256)
Tim Heath of the Makers256 will show the children the: St:eak: Solder Trainer: Entropy Approximator Kit
There will be limited numbers of soldering irons and safety glasses, so the children will take turns learning how to solder, whilst doing other activities with Amy and Ben.
Lightning Talks - (Brought to you by Shae Erisson (@Shapr)
Have something you think is interesting? Stand up and give a 5 min talk about it. This event was organized last year by Shae and was a huge hit with our attendees. Its informal and fun! Bring your curiosity and encouragement for your fellow attendees!
Getting started with Python Workshop - Shae Erisson (@Shapr)
We will have 20 computers set up and ready to go for those who want to learn some Python! No experience necessary!
Closing Ceremonies
We will wrap up the con: Talk about what went right, thank the speakers and attendees, and present the prizes for NETKOTH.