Picking Locks and Hacking Servers at Defcon

LAS VEGAS — They sat at tables along the perimeter of a ballroom in the Rio Hotel. Lights were low. Laptops burned like campfires. Men and women hunched over the machines, their backs curved like question marks. Their fingers clicked away furiously.

I had no idea what this was all about. I asked a gentleman who looked like he may have been among the oldest in the room.

“This is a spelling bee for hackers,” Giovanni Vigna, 42, a professor of computer science from the University of Santa Barbara, explained. “It’s a way to prove your hacking skills.”

Each team, he said, was given the same type of virtual server, each with the same strengths and weaknesses. Each team was charged with defending their servers and attacking those of others. Each time a weak spot was attacked, a flag was awarded. The one with the most flags wins. Hence, the name of the contest: Capture the Flag. This is the final round.

This year’s game came with one nasty little surprise. It was conducted in what is considered the next language of the Internet, called IPv6. If you came prepared to compete in a spelling bee in English, suddenly the spelling bee was being conducted in Finnish.

Contests are a big deal at Defcon, the somewhat circus-like hacker convention that takes place every year amid the circus of Las Vegas. There are workshops to hone computer security skills and panel discussions on topics that range from cerebral (“the art and science of security research”) to obtuse (“speaking with cryptographic oracles”).

It’s not all computers. Defcon is about celebrating the art and science of tinkering.

There was a “lockpicking village” where interested parties do exactly that: pick locks. “Most of us see locks as puzzles,” Babak Javadi, 26, one of the organizers, explained. “A mechanical piece with lots of cool bits inside.” He has been taking apart locks since he was a kid, he said, and now runs a security business, specializing in high-security locks.

There was a barber offering mohawks. There were vendors selling “advanced gaming eyewear,” which were basically glasses that sell for up to $189 a pair, designed to reduce the glare of a computer screen and ease eye fatigue. There were vendors selling luggage tags that said “Geek on Board” and books with titles like “Snip, Burn, Solder, Shred: Seriously Geeky Stuff to Make With your Kids.” Hackers, in other words, are old enough to make babies. At one stand in the vendors hall, I heard a man say, “I’m considering buying one of these for my son.” I looked over his shoulder. He was pointing to a onesie with the slogan “Born to Hack.”

In another hall, a competition was underway to invent a beer-cooling contraption. In still another, teams were competing to see who could most deftly tamper with so-called tamper-resistant materials: strip tamper-resistant tape and put it back, remove tamper-resistant seals and put them back, manipulate tamper-resistant chains and restore them to their original state.

“You’re doing something you’re not meant to do: That’s the essence of hacking,” said Chris Kuivenhoven, 34, a security engineer from Atlanta. “People can use it for good or bad.”

To win at Defcon is to earn the respect of the tribe. It’s refreshing: conventional power and money take a back seat to skill and tenacity. It’s also extremely intense.

Capture the Flag began around midday on Friday and was scheduled to wrap 48 hours later. A team came from Japan, called Stutegoma2, after a tactic in the chess-like game called Shoge; they made it to the finals after six attempts and came prepared with a variety of Japanese savories and sweets, all spread out like flowers on their tables. A team made up of Belgians, French and Swiss was distinguished by the packs of cigarettes on their table and a sign that read “No photos please” (oh, that privacy bugaboo that Europeans have).

Mr. Vigna said his team, like most of the others, would work through the night, up in their hotel room, once the ballroom shut for the night. Fifteen men in one room, I wondered aloud. Showers are mandatory, he said. He was sort of the team captain. The rest of his team were his graduate students. They had stocked up on bottled water, Diet Coke and pretzels. Red Bull was rejected. “Red Bull crashes you, and this is a 2 ½ day competition,” he said.

Defcon wouldn’t be Defcon without a degree of public humiliation. As a first-time, un-tech-savvy journalist at the event, I was advised by organizers to not use the Internet at all. I turned off the data service on my alleged smartphone and lapped up the thrill of being analog, with nothing but a notebook and a pen.

Related Articles

Posted in: