5 ms·
I thought it was SOP to not bring your phones to DEFCON
by steveplace 9y ago
I thought it was SOP to not bring your phones to DEFCON
- kafkaesq 9y agoRight - there's that, too. Maybe next time, Salesforce should think twice about sending its executives to DEFCON. Without some basic introduction as to what it's actually about.
- mortenjorck 9y agoFrom what I’ve read, all you really need to do is turn off wi-fi, which is already fairly paranoid given that no one is realistically going to burn a serious chipset zero-day on random people at a conference. Fake cell towers do occasionally happen but rapidly lead to arrests.
- lawnchair_larry 9y agoYou just made that up. There are fake cell stations every year, and there has never been an arrest.
- mortenjorck 9y agoI might be wrong, but I most certainly did not make it up. Will Strafach and Dan Tentler would at least appear to disagree with you: https://twitter.com/chronic/status/884434768380776448 https://twitter.com/chronic/status/884434768380776448
- lawnchair_larry 9y agoYou just pasted a conversation full of people saying that there are rogue base stations. And I don't see anyone reporting arrests!
- chinathrow 9y agoI do, if you scroll down a bit: https://twitter.com/Viss/status/884477320949506048 https://twitter.com/Viss/status/884477320949506048
- floatingatoll 9y agoThere are no arrests listed for cellular activities at Wikipedia’s “Notable Incidents” list for DEFCON, so if you have direct confirmation of any such arrests, you should add them to the page at https://en.m.wikipedia.org/wiki/DEF_CON https://en.m.wikipedia.org/wiki/DEF_CON
- deleted 9y ago[deleted]
- anonymousjunior 9y ago"random people" who with high probability may have undisclosed 0day exploits stockpiled on other devices.... yeah if I'm an APT author DEFCON attendees are (the hardest to exploit and most paranoid [read: likely to get caught by]) the ideal target for any nation-state. not to mention that the conference is often attended by multiple state agencies which makes the target even juicer. yes it's an extremely hard and dangerous group of people to attempt to exploit, but that doesn't detract from the potential value and payoff of a successful APT exploit on said group of people
- Godel_unicode 9y agoThat's not how Nation State actors work. One of the things that makes Nation State actors dangerous is they have the patience and resources to attack a high value target at the most likely to succeed point. Backing that up, they generally have the intelligence to know when that best time is. And they for sure know that it's not at defcon when everyone is, as you say, paranoid and on the alert. They're going to get you at home, at happy hour with your non-security friends, in that bar with the great but insecure wifi and no 4g.
- TallGuyShort 9y agoOr they'll get you while you're in the security line at the airport on your way home.
- Godel_unicode 9y agoI guess it depends which State we're talking about, but yes.
- floatingatoll 9y agoWhy wouldn’t they burn a chipset 0-day? It’s unlikely that only one exploit has been and will ever be uncovered. Imagine the shitstorm if you phoned all of DEFCON with a recording to attend your talk, on their radio “off” devices, because you powered them back on at the right time. Imagine the respect. That would be worth a 0-day.
- dkersten 9y ago> all you really need to do is turn off wi-fi, which is already fairly paranoid given that no one is realistically going to burn a serious chipset zero-day on random people at a conferenc I know very little about security or defcon, but I was under the illusion that stuff like running Wifi Pineapple to trick people to connect to their hotspots was common and doesn't require any 0-days.
- willstrafach 9y agoThere are more advanved tricks which are less overt, but you are correct, none require zero days.
- willstrafach 9y ago> chipset zero-day The concern is man-in-the-middle attacks. Easy, no user interaction required, and works very well. No chipset zero days involved.
- zitterbewegung 9y agoI used burners at DEFCON 2016. Eventually moved back to my actual phones. But, I talked with other people and according to them there were cell sites that were suspect. Never found out if it was true or not. But, as others have stated I turned off my WiFi.
- tuxxy 9y agoI was at this past DEFCON, we had cell sites named "Arnold's Biggest Scam" and "AT&T Totally 1337 Tower". There are others, but those two were prominent because I could access them in my room lol.
- X-Istence 9y agoBefore DEF CON there are about 20 cell towers in the area, during DEF CON there were almost 130 (rumour I heard, while gooning in the contest area)... Pretty sure some of those are FBI and other agencies ;-)
- willstrafach 9y agoNot really. Folks usually switch between LTE-only and airplane mode if they're trying to be cautious.