you ready anyone have a ball they want
to throw at me is it too late you guys
aren't laughing we're just too dark oh
ok so who's come to one of my talks
before and it's after one of them just
show hands show hands up real high okay
you people like to suffer who's never
seen one of my talks before your people
are going to suffer so we're going to
talk about stem is the new stem but
first I do want to thank cypher con this
is the first time I'm ever giving an
opening keynote is very exciting
opportunity for me and I really have a
lot of exciting information to share but
we have about I'm gonna try to leave
some time for questions but we have
about 25 minutes I'm going to go through
the material kind of quick so if you
could please take your questions to the
end of Eric's I'd appreciate it but um
also cypher con I like like Mike said
right it takes a village it takes a
village to put something like this
together volunteers the community it
also takes a village to train future
hackers and an infosec people quick look
into who i am i just don't really do one
particular thing in my life i have
several different hats that I wear in
addition to working at MobileIron in a
senior manager for security and privacy
and that job is actually a lot more
exciting than it sounds I'm also the
president of hack for kids I'm a FIRST
LEGO League coach I'm an assistant
scoutmaster assistant Cubmaster den
leader merit badge counselor for the
list that's up there if you're into
Scouting or a scout or wood badge train
which I just completed I'm a camp
director for a camp that has up to 500
people and i'm also on the northern
north east illinois steering committee
for stem if you want to talk to me about
any one of these things or just say
what's up you can reach me there's my
contact info on the bottom but um it
takes it you know a lot of time a lot of
effort but I can't really do any of
these things in my life that I do
without the support of my family
so we brought him here together today
they're all up there in the front row
this is when we won the Derby combadge
which we also donated to hack for kids
to fund future events and we did a
family photo you can see grandma's in
there and we're having a good time
showing off the badge 1492 okay I 1192
is it okay to share your password with
people I'm sorry would you say yeah
adorable you could meet him he's in the
front row today so when you see somebody
using a mobile device these days and we
know how easy they are to use I think
back then Benny might have been two and
a half of three and yet he didn't really
speak much but whenever he spoke it was
um you know to unlock his tablet and he
would as you could see say the pass code
out loud and it took us about a year to
teach him first and not do that second
to change his pass code so then only he
and I would know it and he would even
tell mommy he can't share it with her
which i think is actually great progress
who do you your customers that you work
with or that you support does this
remind you of them in any way sharing
pass codes when they shouldn't be simple
pass codes on mobile devices well even
the future generation as they're
learning how to protect their privacy
and data and keep themselves from not
becoming a victim there's still a lot of
adults that are victims it really kind
of comes down to awareness or training
however you want to call it whatever
term you prefer but this is the big part
of it it's always the human element the
technology is just a tool it's us we're
the weakness and we have to start
teaching youths and adults and seniors
about the best practices that we all
know and pretty much just do
instinctually nowadays once you've been
drained you know what to do so we have
to teach them
I'm going and playing the long game by
teaching kids so now on to the topic so
show hands who's heard of stem maybe i
should say who's not heard of stem right
science technology engineering and math
it was created back in 1997 by the
National Science Foundation when they
were putting out grants to foster these
types of disciplines and methodologies
within education whether it's university
or high school or middle school so they
were providing a lot of funding to help
this nation catch up with other nations
in the world that are leading us and
then in 2010 somebody came out with a
website that's called steam not stem
because they believe art should also be
included and I'm not saying it shouldn't
but just kind of the whole history of
how the acronym has been changing and
you know there's a valid point to that
but are we really falling behind in art
yes or no we can have that debate later
and then 2014 Rob Berman wrote an
article for The Huffington Post where
he's saying no no it's not steam it's
stream which includes reading so again
another important skill to have Benny
back in that video not able to read but
can definitely get into his tablet to
watch a YouTube video doesn't take much
skill there right but that's the point
we do need to have our youth and adults
reading more you know the only acronym
rtfm we need to do it more but you know
I'm still focusing really on stem and
then there's another one I just heard
about there's a grant now from NSF
called steamed sea which includes
computing and that's also can I guess
technology and engineering but they have
one very specific for computing the
prior administration also felt very
strongly about this because in 2015 he
put out something I'll just read it in
case you can't see it well it's big
enough but science is an approach to the
world a critical way to understand and
explore and engage with the world and
then have the capacity
city to change that world hmm I remind
you of anything where are we at hmm
think about it he went even further and
then authorized 250 million dollars to
be made available for grants for
education with stem and forced them in
addition to what they've already been
doing since 1997 that's pretty cool in
my opinion and today there's still a lot
of grants available and we're going to
talk a little bit more about that in a
bit even the news right there's a CSL
online reported that there's going to be
zero percent cybersecurity employment
and 1 million jobs are unfilled 1
million that's a lot of jobs and then
you know and what are we going to do
about it right so swag or speak with a
geek I don't know if you guys heard it
than they were at these sides Las Vegas
in 2016 going around and interviewing
some folks and asking them what do you
think we should do and there were some
people that essentially were struggling
shrugging their shoulders and they don't
know what we should do and some people
had some interesting ideas and some
people had some cutesy ideas and if you
want to see that video yourself there's
the bit ly there you can take a quick
picture if you like and then check it
out it's actually worth the time you
spend but this is how I know about that
video this is my opinion on it if we
teach them young even if they don't fill
those infosec positions they're going to
be leading with security and whatever
they do and whatever career they choose
I think that's just as important as
having a million infosec jobs if the
people who are in positions to make
decisions about engineering products
whether they're an infosec or not but
they're thinking about security first
we'll solve some of our problems before
we know about them agree or disagree
anytime folks I know it's in the
afternoon so I got one agree thank you
we're going to buy you some ice cream
later so how do we come up with this so
two agrees
I'll get you an ice cream too sir
compact channel chata friend of mine
chris is strong big in ICS and scada we
were kind of just talking in a chat
about this kind of problem and and you
know the real simple version of it was
well how do we integrate hacking into
stem and does it really make sense and
does it belong there does it not and you
know so we're coming up with all these
different like versions of the acronym
and maybe stem dash H would have been
good but we tried you know stem with
like the s and the tea and the H all
mixed around but we also tried one that
was m.i.t HS and we realize that's not
really good so we went with stem then
the H is kind of silent I mean if you
got like upper respiratory problem you
can call it or if you know you're Jewish
like me you could say stem like you got
to clear your throat but you know we
Chris through this in there like what
you're talking about what is this stem
thing so you know Chris and I and our
idea we present to you introducing
hacking into the concept of science
technology engineering and math now stem
with an H or whatever other version you
want to call just don't use mths what
why will we do this well some people
would argue that hacking doesn't belong
there science & mathematics our
disciplines and methodologies used to
solve problems right technology and
engineering apply science and
mathematics to solve problems isn't
hacking the application of all four of
those to solve problems I just got
chills saying that doesn't it belong
there and if you argue and disagree we
could talk about it later because I'd
love to hear your side of it so you know
why do we have hackers nowadays it's
kind of some people might have gone back
you remember this guy this was a Packard
Bell don't even ask me which processor
it was an old one but we started as a
hobbyist right i remember my 286 is like
cool but it's like it's a hobby and then
and then later we kind of like get
curious and we we go into a BBS or
something and we find some cookbooks and
we start reading them and getting ideas
and we kind of start to think about well
you know Mike used an example of what
Zelda and dropping bombs to find a
secret but I know somebody who was going
further than that was actually reverse
engineering diablo 2 in order to create
fake items just to beat the game but you
know i didn't know him back then but
that caused my account to get suspended
to somehow i bought one of those items
in an auction and that was really just a
teenager's incentive to win so
incentives a big part of what we do just
even the mune o to face the webpage back
in the day and now to define that Eau de
that's going to get us a ton of money
but you can see some of these folks have
actually made some pretty nice careers
there's there's Kevin from Mandya now
fire i I'm sorry yeah fire i bought
Manion sorry for moment little brain
fart and then there's Mike where is he
this was actually a little gift to him
so there's a picture of him wearing a
ton of badges at Def Con in one of his
signature Hawaiian shirts but also the
media has been taking up on this I love
the one that's in black and white if you
can't read it says hackers can turn your
home computer into a bomb who's ever
done that all right Aaron I know you
have all right we got 11 confession
right it's kind of ridiculous and then
the next the sub was like and blow your
family to smoother mean it's like so
hilarious and then there's the other one
where it's like those damn hackers you
know they actually hack the dam so that
was justifiable but you know it's always
breaking into these these services like
public services and ICS and then the
media right it seems like they're
finally kind of listening to us and
getting it right with mr. robot who's
not watching that series no public
shaming no public shame and the hands
went down real quick no you got to watch
it and if you're opposed to watching it
for whatever your political views that's
fine but they're really illustrating
kind of the stuff the tools that we use
every day and the thought process grant
that there's some things in there that
are probably not
you know things you want to teach kids
but the idea is it's it's not like
watching the net or some of those other
movies so the media is finally listening
and getting it so education this is
really where it comes down to so there's
all this grant money in this funding but
when you kind of look at the education
so being a parent of having a kid who's
11 9 and five excuse me I only really
get exposure to whatever education level
they're at so like when they're in high
school I'm going to be doing with high
schools when they're in college I'm
probably doing a lot more of a college
excuse me so I'm working with middle
schools of elementary schools now to
bolster their stem even just hey look
let's just have a FIRST LEGO League team
meeting here let's just do a demo get
people interested in robotics and
robotic programming and solving problems
through the mechanical engineering that
comes with robotics just to kind of
foster some of that through hack for
kids but when you think about like okay
well why would kids make good hackers
well first and foremost they question
authority right other ones they're quite
persistent as a parent how many of you
have had you know your kids you they
want something and you say okay maybe
and like they get excited with me
because it's not know but when they my
son just told me that the other day goes
I love it when you say maybe because
it's not know but when it's like you say
like not right now it's very very
persistent and and that's good that's a
good hacker trait to have so we do want
them to be persistent but also
constructive with it they're very
innovative and I've got some fun
examples of that coming up soon because
they want it they want to turn things
upside down look at it from different
angles see what they can do with it
break their toys and see if they can fix
them and make them better and great
social engineers in our house my kids
will come up to me and ask me for
something and I'll say what did your mom
say run off she said to ask you okay
well after a while they learn to just
answer with she said to ask you without
asking mom first little social engineer
right there
so you know we're getting wiser to his
methodologies and he's adapting and
innovating to our countermeasures here's
another great case study so you can say
like they're starting a third grade but
even younger this kid here he was five
years old his dad works in IT they had
an xbox dad was busy working and the kid
wanted to play with the xbox if you can
find the video it's really adorable but
the kids SAT there and he's just mashing
keys at the login prompt until he caused
the buffer overflow five girls don't
know what buffer overflows are but he
did it and it got in and he logged in
and he was playing video games and when
you watch it it's kind of one of those
of the videos like yeah and I was just
hitting the buttons and it logged in so
I could play games yeah the kid was
thrilled and he actually got credit for
Microsoft for finding a vulnerability
that they patched five years old again
there's Benny Benny is very a computer's
as all my kids are but you know we'll
kind of just use many as an example of
the the barrier or the age like age
barrier for computers is going lower and
lower and lower reading is not a comp
like a requirement any more patients
sorta any kind of mass not necessary at
all doesn't really take much two year
olds can log in and start swiping and
tapping icons it's great that it's that
simple to use what problems is that
creating for us and education here's
another fun example so this was from one
that Chris Sistrunk son did I think he
was like ear nine when he did it and who
has ever heard of MIT scratch a lot of
fun it's like Legos for programming it's
really cool even if you're an adult and
you really don't know how to code you
want an add a code this is actually a
pretty good starting point because
things are color-coded they snap
together if they should and you just
kind of drop them almost wherever you
want you don't have to worry too much
about syntax and indentation and stuff
like that or even commenting but um
here's one where Chris's son was going
to make a pong game and you know he
wants to innovate so in this particular
case he's like well every time there's
like the ball is hit by player 1 create
like a random color player 2 random
color
um just kind of making it psychedelic
and then he had it where it was like
growing it feels like just a big
psychedelic blinking light on the
computer he also had like the paddle of
the other plane so every time like he
hit it as player one his paddle got
bigger player to paddle got smaller so
he's just kind of having all these kind
of fun things what do you think a
nine-year-old would name a pong fun pong
program like this I know it's funny and
it's cute but really are we any
different no I don't think so so here's
some case studies kind of backup the
point about education there's there's a
lot going on but I still don't think
it's enough half the kids example you
know is the one I know very closely I'll
spare you folks with you know my
participating about it but we're going
to do an event with Slifer Connor on
Saturday which I'm very thrilled about
it's like pretty much sold out and that
was that was kind of really unexpected
only because you know we didn't really
promote that hard we just growing pains
and one of your prepared but it's going
to be here so if you know anybody who
wants to bring someone from age of 7 to
17 and we're still going to accept some
walk-ins because we expect there'll be a
little attrition but we're going to be
prepared to handle some walk-in so if
you guys want to bring somebody that
that'd be cool roots roots asylum
formerly known as Def Con kid that was
one of the first introductions that I've
ever had two kids go into a hacker
conference and right away my son he was
seven he's like what's the minimum age
I'm like eight and he's like I want to
go to Vegas with you like I don't know
about that buddy what are we going to
tell your mom but there's a lot of other
things out there like cyber boot camp
there's stuff for adults like interrupt
there's also cyber patriot and cyber
Patriot while it I think kind of began
with high school it's all the way down
the middle school and they even have
something for elementary so we're
starting to teach kids red teaming and
blue teaming at a really early age like
almost at the time that they're really
learning how to use a computer which i
think is really really cool there's
another program I just learned about
that I'm going to get involved with
called jen cyber i had a really good
opportunity to speak with somebody from
the National Science Foundation last
week and she was telling me about this
program where it's different ages I want
to get into too much of details because
of the time constraint but if you
thinking of like high school age that's
correct but it all goes all the way down
to middle school and they don't have any
programs in Illinois or Wisconsin here's
a great opportunity for all of us here
from this area to start a program to
file a grant and then to begin some of
this education that's very local to us
one one bit of advice on that if you
decide to do it you have to partner
actually you don't have to it makes it a
lot easier for you if you partner with
an established education entity so like
in like an edu or middle school or high
school and have it as a partnership
rather than hi my name is Bob and I want
some money because i'm going to teach
kids how to hack that doesn't go over
very well you want to actually get
partnered with a school that's going to
have like pedagogy experts who can then
just say okay this is what we're going
to do have rubrics and measure it and
and then report back on you know all
your success so now I'm am i doing on
time that I'm okay good sorry to be
mindful of the next presenter who's
staring at me right now so I want to
tell you a little story because i think
the stories are the real big takeaways
here i'm gonna tell you about Bob and I
met Bob like it was in 2015 at Circle
City con in Indianapolis we did a
village there hack the kids village Bob
like computers Bob's 14 and Bob said
yeah oh this stuff is but I'll learn and
there was a spy math or crypto corner I
think we call it at the time and he sat
down he goes what is this stuff so the
admin or that's what we call our
volunteers was there with Bob and
teaching them how to decode binary and
showed him very like a rotation cipher
their simple Caesar ciphers what
everyone to call them and then even like
other kind of like monoalphabetic
substitution ciphers lie
bionicle is a common one or Pigpen even
base64 and bob was really into cracking
these things like he just did not want
to stop and do anything else we had a
lot of the fun things going on but this
is what bob loved Bob had no idea this
is something that he would be very
interested into doing and that's really
what we're about is is really
introducing all these different types of
methodologies and disciplines that we
kind of take for granted or we use tools
for but I've wanted to sit there and
crack these codes manually he was there
all day and got through I think we had
eight and got to all eight of them
manually which is impressive especially
for a 14 year old that has no prior
experience and what I found also very
interesting is just like when my kids
come home from school and I go how was
your day would you learn no clue what
you do nothing okay you're there all day
and you did nothing what does my tax
dollars going to but with Bob it was the
same thing Bob when his dad said oh I
was hacked for kids I was good would you
learn nothing but I wrote an email to
Bob's dad because we had some other
prior interactions and I let him know
how he impressed all of us and that this
is something that he should really
explore with his son because he really
was starting to develop a proficiency
for it and rather than letting it fall
to the wayside they should definitely go
further and he wrote back and he's like
I had no idea my son told me that it was
just fun and he didn't say what he did
and I'm really appreciative of you guys
you know doing what you do and letting
me know what my son now knows and what
he likes or loves and I'm definitely
going to pursue it further with him that
to me is highly valuable because Bob
could be one of the next people who is
somebody that writes an algorithm right
the next day here L jamel that writes an
algorithm to protect our data on the
Internet we don't know if he is or not
we're not going to keep in touch with
Bob and kind of stock them and see how
he does but we hope that we've made a
difference in his life so someone else's
life that I know we made a difference in
is Alice I want to by the way Bob went
back to two more
the kids after that we saw him in
Chicago and we saw him again in
indianapolis in 2016 so Alice we met her
in Detroit so we did another village
there that besides Detroit and Alice had
a really rough start and this to me is
it makes me feel really good about what
we're doing and the people whose lives
we really are changing Alice was born
into a household with parents that had
chemical addictions one was alcohol and
one was drugs I don't know which is
which it doesn't matter but um so she
was she was growing up without basic
necessities or taking like like my kids
take for granted of sweeping in a warm
bed every night having clothes that fit
eating three meals a day or more take a
look at us we well my moms are great all
the time pipes a great cook their mom so
you know she didn't have these things
are even going to school regularly okay
but then she was adopted by a couple
people and IT and they came to hack for
kids or besides Detroit where he had the
Africans in the basement and she's like
kind of interested in computers but
again like Bob now not very proficient
so one of the things that we did there
was we had a super bot competition right
a lot of fun you get ev3 you start
building it out you want to put like a
nice big wall in front of it and destroy
other BOTS where we do this we has about
12 kids there she was the second one to
go and have her bot compete and she beat
the first person and everybody after
that nobody else beat Alice and because
we had a prize for first place she won a
$25 gift card which you know to us 25
bucks that might be a meal or and I
drinking or something but to somebody
who was brought who he was born into the
world like Alice that's a lot of money
that's a big deal and she was thrilled
but wait it gets better we also do an
online CTF so we had some of those kind
of crypto challenges she got through
just about all of those and her mom was
with her
one of the things that we do is we tell
the parents you know ask your kids if
they look stuck if they want like time
or coaching don't kind of hover over
them or helicopter and enforce them to
do you want them to do it you want them
to make mistakes so they can learn so
she did very well and I would observed
and her mom was very respectful of our
request we had some social engineering
and OSN stuff she was able to get
through that pretty easily lockpicking I
think she popped most of the locks we go
up to 16 I think she got as far as five
so she got a lot of points there we had
some electronic badges that we had
custom built last year so she was the
only one that was able to figure it out
we had three badges and there was three
different codes and she figured out the
code on the first badge so she got
points for that and because of all our
hard work she tied for first place in
the CDF she tied never having done any
of this stuff before with another kid
whose parent works in infosec and may or
may not a coach that I want to kind of
create any kind of controversy but it
was great because now she got to pick a
prize from all the prizes that we head
out she picked a conic hit so now she
got 525 dollars and a cool fun
low-powered hacking platform that was a
great day for us and for her I think
more for us so how do we get out of we
go further we need to engage students we
need to be mentors we need to teach the
kids to be mentors as we're teaching
them and also how to be leaders there's
a lot that they can do you guys know
about raspberry PI's there's crypto
challenges you can go even Python for
kids we've done stuff like that but you
know getting any of these books will
help the kids start to develop some of
these skills hacks for kids always has a
CTF that goes on with an event so after
so saturday if you want to participate
that's fine but if you're the older than
17 and you're not present you don't get
a prize I don't send me an email asking
for one but there's another one that's
like the neverland cts that one's for
middle schoolers that one was great how
coach some kids my son and a couple of
friends get through that one so there's
stuff going on there's activities
but the problem with being a hacker is
the overall public perception so we need
to stop talking about cyber criminals as
hackers hackers are innovators we find
flaws we push technology further without
us we'd still be using a trs-80 model 3
with the 48 k ram that i have in my
garage my wife wants me to throw away so
please stop using the term hacker
synonymous with cyber criminal it's also
funding and like where to go so here's
like Wisconsin's quick nap I found this
so anyone a member of Appleton
makerspace nobody okay are they still
active if you're in the area might want
to give them a call or an email sector
67 Bueller the Milwaukee hackerspace you
see the icon up there so there's a lot
of cool things going on in Wisconsin you
guys just got to go to them so I thought
this would be fun to throw up there and
some of them are pretty kid friendly but
call first and a lot of them are going
to be able to get funding from NSF if
there are 501 C 3 so you can create a
hacker space or join one and help them
out get some funding I'm almost done
also the proximity you know we're not
all so close together I know Wisconsin
the big state and a lot of farmland and
you guys make some awesome cheese so I'm
very happy to be here within the cheese
castle on the way home but when you're
out there in the rural areas there's the
rural technology fund so there's ways
even for people who are farming the land
to get money to teach their kids stem we
need you everybody here is responsible
for this it's all of our futures if you
think it's not think again don't be so
apathetic so in conclusion here's Benny
what could Benny do differently what
could we do differently with Benny what
could you do with the kids and the other
adults or people that you're exposed to
whose lives that you can change and make
a difference one small change one small
change from each of us makes a big
difference and of course you know we
need a theme song so drink all the
kool-aid
all the things oh yeah Thank You cypher
con anybody have questions I'll be
available to speak with you later should
put my shoes back on oh alright thanks
Dave no I'm going to take your laptop so
alright so we try to cut opening
ceremony really short to keep things on
time I want to do a few mentions
tomorrow we have a dedicated wireless
captured a flag starting at 9am at the
23rd floor of the Pfister hotel and it's
going to be a war driving around
Milwaukee looking for wireless signals
it's going to be all sorts of
shenanigans so I hope you can bring your
laptop in and play with some wireless
and we're working on getting the badges
to everybody that gets a digital badge
so bear with us and I want to introduce
blue our puzzle master he he's got all
sorts of tricks up his sleeve and I'll
let him talk about it because I have no
clue so thank you everybody so you can
keep it here good evening I'm speaking
simply because I had stipulated into the
rules that the contest doesn't start
until after I talk so here I've talked
the detailed about my contest it is a
cipher and puzzle challenge it is not
necessarily encryption so you're not
going to be breaking RSA encryption or
learning algorithms it will make you
think outside the box so our keynote
speaker who just spoke he suffered
through my challenge last year it makes
things painful if you refuse to think
outside the box am I correct on that
okay yes it'll be you you did you did it
was
a good challenge of particular note
solving my crypto challenge is one of
three ways to get a lifetime badge so
there are only three ways to get a
lifetime badge solving my crypto
challenge is one of them I will be
downstairs at the crypto village and you
can feel free to contact me and figure
out how you can start my challenge so
thank you again