#bsideslv

The BSidesLV Underground track is one of my favorite things. It’s an entire conference track without any coverage, no recordings and talking about topics you wouldn’t be comfortable talking about publicly. During my readings of the Logica breach I found my email address. Just chillin’ on my couch and I see my emails address and I lose my shit until I see the date of the FBI requests were from a year before I had even started speaking publicly. Not only that but they already had a suspect in custody so I guess I was cleared at some point. But, people were contacting me with other behind the scenes information about the case, etc. I wasn’t comfortable talking about the breach publicly, not until someone was convicted. But I wanted to share, so I gave a talk in the Underground track which was a great experience.

Now, when I submitted to BlackHat I figured it was a super long shot. It was about hacking and securing the platform (z/OS) and I had assumed I was waaaaay too amateur hour for BlackHat. I had never written a white paper before either. Sure I’d written articles but nothing with a company letterhead or anything that was of a professional caliber. At this point I’d spoken at multiple conferences ( Bsides, Thotcon, Shmoocon etc) but to me BlackHat was the big leagues. I assumed you needed to do something amazing and I always thought the work I was doing was small-fry. But I submitted anyway because frankly this platform is too critical to get caught up in my insecurities. The world needs to know about the platform, and security experts need to be taking this platform seriously, not avoiding it because "it’s legacy” is not really an option anymore.

So, here’s where I was mentally at the time when it came to Hacker Summer Camp 2013:

BSidesLV: Sure Thing

DEFCON: Sure Thing

BlackHat: Long Shot

 So imagine my surprise when this happened:

But then the obvious happened:

Here’s the full rejection email.

This time around I got great feedback from the DEFCON folks about why it was denied. I was heartbroken, but I was talking at both BSides and BlackHat so I didn't feel that bad.

One interesting thing I learned about this process is that if you’ve been accepted to give a talk at BlackHat you might not be able to speak at DEFCON:

This is accepted at Black Hat and considering the content embargo it is an issue in acceptance or not. We are only allowed a small amount of duplicate talks that they will agree to allow their speakers to present at DEF CON.

With the decision made for me, I decided to dedicate myself to the best I could do at BlackHat and BSides, and truth be told, I had a great time giving these two talks.

At my BlackHat talk I asked a straw poll about how many people audit/test mainframes vs who many have actually configured one and the answer was less that 1% of the people in the room. There’s a cool article about it on Dark Reading! This was also the first time I was talking to a packed room, I mean standing room only. By the end of my talk it was full of people and I only released a few new tools (most notably Catso, pSikOTik and TShOcker.py) 

After my BlackHat talk I wasn’t really feeling BSides. I was coming down from a high of talking at BlackHat, I felt like my slides weren’t really that great and that the talk was going to be shit. A story I tell is I was feeling so down I went to the casino floor to just kill time at the penny slots. I bought a diet coke for $5 (yes, in Vegas, on the Casino floor I paid for a non-alcoholic drink) and then went to the first penny slot I saw. Put in my $20, made a low bet and won $30. I was feeling so sorry for myself I couldn’t even gamble right. I took my $50 and now $3.50 worth of diet coke, went back to my room, grabbed my laptop and went to BSides.

At BSides it was one of the last talks of the conference. So I spent the afternoon drinking free booze and waiting to give my talk with Chris and other friends.

By the time my talk slot came up I was feeling a hundred times better and gave a seriously awesome talk. Something’s a little freeing about not having to worry about a camera filming you. My talk also dealt with area’s I’d never talked about before and the audience was super engaged, to the point where people were helping with translation of slides live (you see, a bunch of the stuff I was dealing with was Swedish, like Kuku.rx to me means nothing, but apparently it means cock). 

My first slides, the ones I sent to DEFCON, were, in a word, shit. I don’t even know what I was thinking including those in my CFP. Luckily my mentor and I worked on better slides, culminating in the talk I gave at BSides:

During that time one thing I realized was that the TSO logon screen allows for user enumeration. I had planned on talking about it in my BSidesLV talk but she suggested a demo would be better. I spent a little bit of time working on a script (a weekend or so) and now had not just a (boring) John the Ripper demo but also a way to enumerate users.

Another thing she helped me out with was all the ancillary things I never even thought about. When speaking internally you don’t have to put your email, or twitter, or whatever. I didn’t even have a slide showing my contact information in case someone wanted to know something after my talk. Nor did I have a website with links to further research, or a blog, or anything. Stupid newbie stuff I never would’ve caught without her help.

The first day of BSides she introduced me to @az2600. We hit it off and basically partied every night that week. We've partied now every year and even shared a suite this year. This is one of the tangible items you need to take advantage of in the mentor program, the networking opportunities. 

On the day of my talk Nicolle was there, in the standing room only (30 people MAX) ‘conference hall’. I was so nervous I barely slept the night before, I had rehearsed till I knew the slides cold, and I had even given the talk internally. But what I wasn’t ready for were the nerves that come with talking to an audience of strangers plus a camera.

Because I was nervous I said ‘OK’ after the first 10 slides. I kept trying to make crappy jokes and wasn’t as ready as I thought I was. But I made it through and was hooked. I loved the experience and couldn’t wait to speak again.

One of the side effects of the BSidesLV Mentor Program is your mentor introducing you to new people. I’ve made some lasting friends based on being introduced to people at my first talk at BSides.  

To Nicolle (and the BSidesLV mentor program) thank you. Without your help, guidance and support I wouldn’t be where I’m at today. 

 At this point I was stuck so I emailed the community. I tried Paul Dot Com (http://mail.pauldotcom.com/pipermail/pauldotcom/2012-February/008387.html) and John the Ripper:

And got one reply. One. From Dhiru Kholia. But together we still couldn't figure it out. In an email to Dhiru I said:

So either RACF has a funky implementation of DES or I misunderstood how they're creating the key. Any help would be appreciated. My ultimate goal is to make auditing RACF passwords as easy as other passwords and not having to rely on having a test mainframe system around to run costly tools like PWCHECK.

Basically, when I created a user ‘AAAAAAAA’ with the password of AAAAAAAA I was getting a funky password that I couldn’t recreate with DES in python. So I wrote a brute force script that would add one bit do each letter and let it go for days. And after about 5 days the hash in RACF and the script matched. I was elated because we finally had something to work with.

 Then, Nigel Pentland emailed Dhiru and I with the obfuscation algorithm and then, literally that day, Dhiru emailed me a patch to test and that week John the Ripper supported RACF hashes.

 And that was that. I took the algorithm, my knowledge of z/OS as a platform and made an hours’ worth of slides. Then I filled out the DEFCON 20 CFP and started preparing for giving a talk at DEFCON.

 I was super excited about talking at DEFCON, little did I know it wasn’t going to happen for three years. A few months later I get an email. And excitedly open the acceptance letter:

  Oh.