7 ms·

DEF CON and Stack Overflow: What Our Traffic Says About Cybersecurity

147 points by susam 7y ago

logronoide 7y ago
I would like to see that traffic series from Las Vegas starting in July when the Microsoft Ready & Inspire happens just to compare...
jcims 7y ago
That's a bold strategy cotton...I think I would have waited till after DEF CON to run this article haha.
albertzeyer 7y ago
> DEF CON 27, arguably the world’s best known hacker convention. I would say that the CCC hacker conventions (esp the CCC congress always in December) are somewhat more famous (but that probably depends on cultural background), of a similar size, and "better" (depending on what aspects you want to compare it). But it's not really a competition anyway. Related to that, there is the CCC camp 2019 (https://events.ccc.de/camp/2019/ https://events.ccc.de/camp/2019/) (in Berlin) starting very soon. Probably there will be live streams. And btw, a while ago, you could buy a combi-ticket for both DEFCON and CCC camp, including the flight ticket, for either 1337$ or 1337€. If you have never been to such an event, I can really recommend to go to it. Actually I can only speak for the CCC and the Dutch events; I heard that the community and mood is much more friendly and open on CCC-like events, compared to DEFCON, and also the focus is much more widespread, e.g. it's also kind of an art event, similar to Burning Man. That trends shown in the traffic graphics are really interesting. It seems JavaScript are less interesting to hackers, and Python is more. What hackers are using today is often what the remaining technical world will use tomorrow. In a similar way, I observed that around 10 years ago, Apple hardware became very dominant on such hacker events (I feel like maybe 80% of the computers (of course I don't have exact numbers on that)). But in the recent years, that totally vanished. It's very clearly the minority now. Apple does not produce the preferred hardware for hackers anymore.
- drawnwren 7y ago
  I'm curious what the dominant hardware at these events is now.
  - gbrown 7y ago
    I'm betting many flavors of Linux running on many flavors of laptop.
  - albertzeyer 7y ago
    I don't really observed some dominant hardware anymore. From the software side, Linux of course is very much dominant now. Otherwise you see a bit MacOSX, and also OpenBSD, FreeBSD, or more exotic things. Windows is rare, and people even feel ashamed to show that they use Windows. But that was more extreme earlier, and slowly becomes more accepted. Maybe more now with Windows Subsystem for Linux.
    - crankylinuxuser 7y ago
      Not at all. Running Windows is a sign that you're willing to run a substandard OS with no good toolchains and low/no privacy. And none of the Linux attacks that rely on hardware/firmware stuff works on Windows system for Linux. I can load up instances of Linux catered to specific ideas (Tails, Buscador, RadioInstigator, etc) and they will just work. Now we also know how to handle windows, especially when we break into machines and networks with Windows clients and/or AD. Most orgs don't understand even how windows runs, so they get it wrong unsurprisingly.
  - hackandtrip 7y ago
    Speaking about the CCC, I'd say the MacBook remains in the top-2, but the Thinkpads are clearly prominent.
  - arianvanp 7y ago
    Thinkpad T or X series
- enneff 7y ago
raesene2 7y ago
Shame they didn’t include traffic to security.stackexchange.com . I would have thought that would show a more noticeable change. Also would be interesting to see what tags there show the biggest increases
jedberg 7y ago
Like the author I too am shocked at how few people were using VPNs.
- raesene9 7y ago
  I think there's a bit of mystique about how dangerous the Defcon network is, and it doesn't really reflect the current reality. To quote the defcon27 FAQ https://www.defcon.org/html/defcon-27/dc-27-faq.html https://www.defcon.org/html/defcon-27/dc-27-faq.html "Why yes, DEF CON is FULLY network-enabled. Now that we've perfected the art of a stable hacker con network, we're ascending to a higher level - we're providing you a network that you feel SAFE in using! Since DEF CON 18 we're WPA2 encrypted over-the-air, with a direct trunk out to the Internet. No peer-to-peer, no sniffing, just straight to the net (and internal servers). We'll provide login credentials at Registration. We know the 3G airwaves will be saturated so we're putting our own cred on the line to give you a net that even we would put our own mobile phones on." They do also provide a free-for-all network, but no-one has to use that...
- ShakataGaNai 7y ago
  I think the author is making a big ASSumption here. Why is it that an IP that geolocates to Las Vegas isn't using a VPN? Would you say the same about San Francisco or LA? Of course not. There are VPN end points in Las Vegas. I'm writing this from Defcon, over a VPN, to an endpoint in Las Vegas. All the benefits of a VPN without a huge latency penalty.
  - alasdair_ 7y ago
    >I think the author is making a big ASSumption here. Why is it that an IP that geolocates to Las Vegas isn't using a VPN? Good point. I'm typing this while at DEFCON and my VPN provider (Private Internet Access) defaulted to the Las Vegas endpoint.
gcbw2 7y ago
Java didn't change one yota during the convention. Guess there are not many enterprisey hackers out there.

147 points by susam 7y ago

I would like to see that traffic series from Las Vegas starting in July when the Microsoft Ready & Inspire happens just to compare...

jcims 7y ago

That's a bold strategy cotton...I think I would have waited till after DEF CON to run this article haha.

albertzeyer 7y ago

> DEF CON 27, arguably the world’s best known hacker convention. I would say that the CCC hacker conventions (esp the CCC congress always in December) are somewhat more famous (but that probably depends on cultural background), of a similar size, and "better" (depending on what aspects you want to compare it). But it's not really a competition anyway. Related to that, there is the CCC camp 2019 (https://events.ccc.de/camp/2019/ https://events.ccc.de/camp/2019/) (in Berlin) starting very soon. Probably there will be live streams. And btw, a while ago, you could buy a combi-ticket for both DEFCON and CCC camp, including the flight ticket, for either 1337$ or 1337€. If you have never been to such an event, I can really recommend to go to it. Actually I can only speak for the CCC and the Dutch events; I heard that the community and mood is much more friendly and open on CCC-like events, compared to DEFCON, and also the focus is much more widespread, e.g. it's also kind of an art event, similar to Burning Man. That trends shown in the traffic graphics are really interesting. It seems JavaScript are less interesting to hackers, and Python is more. What hackers are using today is often what the remaining technical world will use tomorrow. In a similar way, I observed that around 10 years ago, Apple hardware became very dominant on such hacker events (I feel like maybe 80% of the computers (of course I don't have exact numbers on that)). But in the recent years, that totally vanished. It's very clearly the minority now. Apple does not produce the preferred hardware for hackers anymore.

drawnwren 7y ago
I'm curious what the dominant hardware at these events is now.
- gbrown 7y ago
  I'm betting many flavors of Linux running on many flavors of laptop.
- albertzeyer 7y ago
  I don't really observed some dominant hardware anymore. From the software side, Linux of course is very much dominant now. Otherwise you see a bit MacOSX, and also OpenBSD, FreeBSD, or more exotic things. Windows is rare, and people even feel ashamed to show that they use Windows. But that was more extreme earlier, and slowly becomes more accepted. Maybe more now with Windows Subsystem for Linux.
  - crankylinuxuser 7y ago
    Not at all. Running Windows is a sign that you're willing to run a substandard OS with no good toolchains and low/no privacy. And none of the Linux attacks that rely on hardware/firmware stuff works on Windows system for Linux. I can load up instances of Linux catered to specific ideas (Tails, Buscador, RadioInstigator, etc) and they will just work. Now we also know how to handle windows, especially when we break into machines and networks with Windows clients and/or AD. Most orgs don't understand even how windows runs, so they get it wrong unsurprisingly.
- hackandtrip 7y ago
  Speaking about the CCC, I'd say the MacBook remains in the top-2, but the Thinkpads are clearly prominent.
- arianvanp 7y ago
  Thinkpad T or X series
enneff 7y ago

raesene2 7y ago

Shame they didn’t include traffic to security.stackexchange.com . I would have thought that would show a more noticeable change. Also would be interesting to see what tags there show the biggest increases

jedberg 7y ago

Like the author I too am shocked at how few people were using VPNs.

raesene9 7y ago
I think there's a bit of mystique about how dangerous the Defcon network is, and it doesn't really reflect the current reality. To quote the defcon27 FAQ https://www.defcon.org/html/defcon-27/dc-27-faq.html https://www.defcon.org/html/defcon-27/dc-27-faq.html "Why yes, DEF CON is FULLY network-enabled. Now that we've perfected the art of a stable hacker con network, we're ascending to a higher level - we're providing you a network that you feel SAFE in using! Since DEF CON 18 we're WPA2 encrypted over-the-air, with a direct trunk out to the Internet. No peer-to-peer, no sniffing, just straight to the net (and internal servers). We'll provide login credentials at Registration. We know the 3G airwaves will be saturated so we're putting our own cred on the line to give you a net that even we would put our own mobile phones on." They do also provide a free-for-all network, but no-one has to use that...
ShakataGaNai 7y ago
I think the author is making a big ASSumption here. Why is it that an IP that geolocates to Las Vegas isn't using a VPN? Would you say the same about San Francisco or LA? Of course not. There are VPN end points in Las Vegas. I'm writing this from Defcon, over a VPN, to an endpoint in Las Vegas. All the benefits of a VPN without a huge latency penalty.
- alasdair_ 7y ago
  >I think the author is making a big ASSumption here. Why is it that an IP that geolocates to Las Vegas isn't using a VPN? Good point. I'm typing this while at DEFCON and my VPN provider (Private Internet Access) defaulted to the Las Vegas endpoint.

gcbw2 7y ago

Java didn't change one yota during the convention. Guess there are not many enterprisey hackers out there.