Hacker Summer Camp is a community term for the variety of conferences and mini-conferences that take place in late July and early August on the iconic Las Vegas Strip in the Nevada desert. This year, Datadog employees from across the organization will be making appearances to share their expertise and research across a host of topics with conference-goers—as well as welcoming smiles. For the purpose of this article, Datadog includes the following events in our definition of Hacker Summer Camp:
- BlackHat USA (including BlackHat Arsenal), where new industry research is showcased for the global security community
- BSides Las Vegas, your standard community BSides event for security practitioners to share knowledge and peer insights (highly recommended for first-time attendees and anyone on a budget)
- The Diana Initiative, an inclusive-by-design conference focused on underrepresented groups in security
- DEF CON + DEF CON Villages, a massive conference spanning a variety of offensive and defensive domains over four days (includes everything from hacking cars to securing the cloud)
Regardless of whether you’re a newcomer or veteran attendee, showing up to Hacker Summer Camp each year can be intimidating. The travel, sheer size of the crowd, or fear of having your personal operation security breached can lead to some anxiety. Once you get on site, simply deciding which event to attend and where to be can also be problematic. Datadog is here to help, and we’ve put together a helpful guide to ensure you’re thoroughly prepared and ready to make the most out of Hacker Summer Camp.
Plan, plan, plan
Given the high number of concurrent events during the week, we highly recommend that you know which venue you will spend the day at ahead of time. It takes a long time to get between venues in Las Vegas; Tuscany Suites, for example, is an approximately 15-minute cab ride—or a 1-hour+ walk from the main Strip, in the August heat. In order to minimize time spent in transit, try not to visit more than two venues during the day.
Several hotels run free shuttles to get between venues. Many of these have changed a bit since the pandemic, so don’t assume that you will be able to ride the same shuttle that has been available for years.
Packing for Hacker Summer Camp
Veterans of DEF CON know that every year, their packing list gets some new items and a few things from previous years come out of the bag. You’ll be walking a lot during the event itself, so it’s best to optimize for essentials and items that are going to help you have some truly unique experiences.
Essentials:
- Mask (N95 recommended): All conferences this year are requiring attendees to mask up, regardless of Nevada law at the time.
- Your proof of vaccination: Proof of vaccination is not required at every venue, but it’s better to be safe than not able to attend.
- Comfortable shoes: You’re going to walk, and walk, and walk. Bring your best footwear for comfort and hot sidewalks.
- Water bottle: Temperatures range from 80–107°F in August, so you’ll be hydrating almost as much as you’re walking.
- Sunscreen: The sun feels a lot closer to you in the desert. A post conference sunburn is not the memory you’re looking for.
Optional:
- Black shirts of your choice: In spite of the heat, this crowd tends to like #blackshirtcon. You can, of course, be contrarian and wear anything and everything.
- Small tool kit with screwdrivers, pliers, and lock picks: Should you decide to participate in a contest, this can come in really handy.
- Inexpensive soldering iron: There have been many Hacker Summer Camp workshops where it was advantageous to have just one more iron for everyone. Having tools you’re willing to share is a great way to network and make friends.
- USD, a.k.a. cash: Given the anonymous nature of these events, many vendors and conferences don’t commonly accept credit cards.
- JTAG or UART USB connector: In case of badge hacking, these are amazing for your first hardware challenge.
Electronics and you—Stay safe
Two items were glaringly missing from the above list: your laptop and cell phone. These events have a reputation for being a hostile environment for all kinds of devices. You may have heard horror stories about password sniffing on open Wi-Fi or even had a friend that fell victim to a Wi-Fi pineapple.
Maximum-impact incidents during previous years led people to extremes when it came to device management. It was commonplace to travel with a laptop that was expected to be wiped at the end of the event and sometimes even a disposable cellular phone. This was largely due to the nature of unencrypted open wireless networks (802.11). Security conference networks are considered a hostile environment, and your usual devices leak all kinds of information about you when you join. If you don’t practice good security hygiene, your credentials could end up on the “Wall of Sheep” in the infamous Packet Hacking Village.
In more recent years, these events rolled out secure Wi-Fi, which mitigated much of the risk. Using only secure wireless with a VPN of some kind for 100 percent of your devices really makes using your regular devices practical. Much of your device’s traffic is likely https, but sometimes apps prefer intelligence data over unencrypted channels that may reveal your online identities. At Hacker Summer Camp (and anywhere, for that matter), you should always practice good security hygiene like:
- Using a password manager
- Ensuring that 2FA is enabled on all of your accounts that support it
- Applying observability tools to monitor your accounts during the event and after
- Connecting only devices from trusted vendors to your laptop
Datadog’s Sessions—Talks we’re excited about
Over the last several years, Datadog has increased its security portfolio to include offerings like the Cloud Security Platform and Application Security Monitoring (ASM). Our security practitioners are excited to share just some of their great work with you.
We’ll open the week at BSides Las Vegas and The Diana Initiative with two members of the Software Integrity and Trust team, Trupti Shiralkar and Hossein Siadat, giving talks titled “SBOM Challenges and how to fix them!” and “Leveraging SBOM to foster open source software security”. Since Executive Order 14028, which President Biden signed in 2021 to foster stronger national cybersecurity and more agile threat response, companies of every size and industry have been thinking about SBOMs, or “Software Bill of Materials”. Just like a Food and Drug Administration ingredient label, SBOMs are a list of ingredients for what makes up your software. Instead of listing vitamins, minerals, and chemicals, they list software package dependencies like artifacts you may get from NPM or PyPi. Datadog has heavily invested in the supply chain ecosystem and our practitioners have created projects like The Update Framework (TUF).
At BlackHat USA, Guillaume (Will) Fournier will present volume two of his talk,
“Return to Sender—Detecting Kernel Exploits with eBPF”. This talk will build on content from last year’s “With friends like eBPF, who needs enemies?”. eBPF and eBPF security are critical to Datadog’s Cloud Workload Security product, so don’t miss Will’s session if you are interested in hearing more about the engineering challenges associated with detection. In parallel, Christophe Tefani-Dereeper will showcase Stratus Red Team at BlackHat Arsenal. Stratus Red Team is the first automated adversary emulation tool born in the cloud and purpose-built for the cloud, and it supports a variety of automated tactics, techniques, and procedures across AWS, Azure, and Kubernetes. Will’s talks in the past have always included an open source tool release. Don’t miss this session to see what he releases this year.
Meanwhile, at BSides Las Vegas, Vladimir de Turckheim (a.k.a., “Vlad”), one of Datadog’s engineers working on ASM, will present “Everything I know about prototype pollutions: how to react when confronted to a brand new vulnerability”. Prototype pollution occurs in JavaScript applications, where attackers leverage built-in features in the language to modify objects in the JavaScript runtime on the fly.
During the middle of the week with The Diana Initiative, Karishma Asthana from the ASM Product Marketing team will present on "’Hacking’ Your Career: How to Successfully Pivot to Your Next Professional Role”. Security can be a tough job to do on a daily basis, and regardless of where you enter the field, mobility inside of the industry provides a steady stream of new challenges to solve.
Wrapping up the week is DEF CON and DEF CON Villages, and you’ll be able to catch a few more Datadog talks across different villages. Check the DEF CON schedule to find out when and where as the events approach. Nathan Case from the Security Advocacy team will be keynoting the Biohacking Village. Case brings nearly a decade of cloud incident response experience and many years of familiarity with biotechnology. This will be an engaging session for those interested in the intersection of medicine and cloud-scale technology.
Kevin Lai from the Software Design and Guidance team will make an appearance in the Crypto Village to discuss “Finding Crypto: Inventorying Cryptographic Operations.” Lai will share how he uses open source tooling to find non-compliant cipher suites in incredibly large bodies of code.
Finally, Christophe Tafani-Dereeper will make one final appearance for the week at the Cloud Village to again showcase Stratus Red Team and give a more deep-dive session on how you can leverage the tool for end-to-end testing. Stay tuned for updates to Security Labs on a new open source tool he will be releasing for the first time at Cloud Village. He will be joined in the Cloud Village by Darwin Salazar from our Detection Engineering team, who will teach an Azure Cloud–focused workshop on KQL and how to leverage it for offensive and defensive security via the Azure Resource Graph.
Check out the complete schedule for updates on where to find Datadog sessions by downloading a printable PDF of these fantastic talks and where to find them.
See you at the conferences!
Regardless of which of these events you’ll be attending, we hope that you take some time to find us and say hello. We would love to hear from you about your conference experience, your challenges in cloud security, and what’s exciting this year.
