Seccon: 2026

SECCON may be over, but the conversations are just getting started. Join us as we recap this year's conference, share key takeaways, favorite moments, and the cybersecurity trends that had everyone talking. Tune in now! 🔐

#SECCON #Cybersecurity #Podcast #InfoSec

Transcript

Copy Transcript Copied

SPEAKER_01 0:03

You are now listening to the Secure AF Podcast.

SPEAKER_02 0:11

Hello, everybody, and thank you for joining us in another episode of the Secure AF Podcast. I'm your host, today Tanner, and I've got with me here the one and only Sean Satterley. Thank you. We are here to talk about mostly our convention that just happened, uh, went down pretty successfully. It was seccon. And we had how many people?

SPEAKER_00 0:31

Oh a hundred and eighty plus actually show up. It was a ticketed event, but we had some people show up like on site and just purchase tickets as at like right there. Throw them a badge. The badges this year, Anthony Lee did the badges. How about those?

SPEAKER_02 0:48

Oh, we're gonna have to splice in photos of badges.

SPEAKER_00 0:50

Yes.

SPEAKER_02 0:51

Photos of badges. Photos of badges. Sorry, Terrence, it has to be done. I forgot to bring the badge to show. Um but but yeah, I think uh the badges were super sick. There was a uh a big CTF with the badges. Ooh, there was. And it involved a whole lot of there was like Well, our producer Terence actually did some of them.

SPEAKER_00 1:10

That's true. That's true. He got a little bit into it. I'm sorry, I cut you off. You were saying, how far did it go?

SPEAKER_02 1:15

I don't want to give too many details quite. Because there's still people doing it. No cheats. I can tell you it involves multiple types of digital communication as well as several different soldering challenges inside of the badge. Um we can probably get uh Anthony to do like maybe a breakdown once it's completely.

SPEAKER_00 1:34

Yeah, once we give it time, then we can actually probably do a whole app talking about that.

SPEAKER_02 1:38

Yeah, but there's still people grinding it out, I know for a fact. Oh, nice. Okay.

SPEAKER_00 1:42

So I don't want to Yeah, that we should just leave it be then.

SPEAKER_02 1:44

Yeah, I don't want to run it for him too much.

SPEAKER_00 1:46

Well let's talk SAOs. Was there anything embedded in the SAOs or it was just just cool graphics this year?

SPEAKER_02 1:52

Um I'm not totally sure. I know there was he had one that runs Arch, which I thought was interesting. Um you got Arch to run it on SAO. Um Yeah, he had Oh he did. I think one of the challenges was involving an SAO, probably.

SPEAKER_00 2:07

Aaron Ross Powell Okay, nice, because we had the the theme for ZetCon this last year was Back to the Future. So we had the the self-lacing Nike Nikes, that a character, a cartoonish rendition of that.

SPEAKER_02 2:20

Um Yeah, I think that has something to do with something.

SPEAKER_00 2:23

Well the DR Labs one was awesome. It had the syringe with the the four LEDs, so I was super proud of ours, which I every time I got one, someone would be like, oh, that's so cool. Like, oh hey, here you can have it. And I kept giving mine away. Yeah. We had some awesome speakers. Ooh, yeah. Do you want to run through that? Like, like, well, there was guys who hosted, like, first of all, let's talk villages. The guys who ran the villages. We had our team doing you did FizzSec this year. You and Peters and I. Yeah, you and Peters did did that. Dylan and uh and Hickman were running the uh running lockpick, and then we had Anthony Lee and a lot of the hack NWA guys uh backing up on the uh actual hardware village. But in the RFIT village, we had Bo Schwabi with that uh selling that coil this year and talking people through that kit build, and that was a lot of fun. Um this year we didn't do, you know, there was no talks going on during the village time, and vice versa. So it was like that's what you did for that part of the day was you do you did village time, and that was I think that really, really benefited the entire crowd. Like everybody because you know you never want to go spend time in the village because you might be missing a talk, and or you don't want to go to the village because you know, and vice versa. Sorry, speakers now.

SPEAKER_02 3:43

Yeah.

SPEAKER_00 3:44

What who who did we have that that where did you go?

SPEAKER_02 3:48

I got to go see uh Patrick Quirk's uh talk or Ringmaster, it was very good, very good talk. He um he stumbled onto a whole lot of data from the Mexico government. Um he said he went to sleep and he woke up to 147 news articles from mostly major outlets um talking about the Mexico government being hacked and all this data that was exfiltrated and everything. He just pulled data from an open API. Anything as far as you know, he didn't download it. He didn't illegally log into anything or anything. He just uh walked up to an open door and took a look at something that was open. Yeah, that was all he did. Um and that was that was a really interesting talk. Uh all the the different things that he's found, the reaction and the response and the way that all went down.

SPEAKER_00 4:40

Well, it's funny how they immediately say, Well, we were hacked. Were you though? Were you or did you just leave something hanging out on the internet? Yeah. Yeah.

SPEAKER_02 4:48

It kind of goes down like that.

SPEAKER_00 4:50

So fail Mexico.

SPEAKER_02 4:51

We had your Therak Talk.

SPEAKER_00 4:53

Yeah. That was that was fun. It was fun doing that Therak Talk because I got to like I got to dig into the history part a little bit, and then I got to dig into like the actual buffer underrun. And like it was cool because Vince Wynne was out in the in the in the crowd. Straight up, I just straight up called on him. I was like, hey Vince. So and I was explaining how the FDA now does certain like in the in they call it deficiencies when for a finding and like how long you had to respond to those and to fix them. And we went through some of the timetables of that. Because a lot of guys were curious, like, how does the FDA mandate that now? Like, what is the framework? And I I got to dig through that and explain a lot of that. So that was fun.

SPEAKER_02 5:36

Has that changed much since like you know, Ferrac happened in Show?

SPEAKER_00 5:41

Oh, there was no there was nothing before. Right. There was the FDA, but like there was no like real oversight over medical devices.

SPEAKER_02 5:49

Uh so is that really what spurred that to happen?

SPEAKER_00 5:51

Yeah, it was. I think so. It was one of the like one of the main pivotal points.

SPEAKER_02 5:57

We've talked a lot about it, and for anybody watching, we haven't said what it is.

SPEAKER_00 6:00

Oh, yeah. It's a uh Give us a TLDR. It was a radiological device used to do X-rays or radiological therapy that was a two-in-one device. And we know how two-in-one devices work, they're usually crap. Uh, but it was made by a company called AECL out of Canada. And uh they claimed to the FDA that they had 2,700 hours of testing. Fast forward almost a decade. Well, that wasn't exactly true. That the 2,700 hours, that number came from development time, uh install installation and commissioning time and burn-in of the of the equipment. Because you remember, you used to have to burn in computers. That's still not a bad practice, if you ask me. Yeah, true. But the the bad practice is removing your hardware interlocks and running everything off software. And then said software is written in PDP 11 by one dude with no regression testing. It's just uh it's just just a big uh recipe for disaster. And that's what happened. So a lot of us learned a lot of things from it. And so what was the danger that came out of that? Oh, mass r mass radiation overdoses. Like the the the largest radiation dosage in in written human written history.

SPEAKER_02 7:12

So that came from uh I don't want to say exploitation necessarily.

SPEAKER_00 7:17

No, that's it wasn't exploitation. It was an integer overflow and a race condition that happened at the same time, thus causing two doses of upwards of 24,000 RAS into one human being.

SPEAKER_02 7:32

Yeah. So but it's something you would have tested for had you had your hands on it beforehand.

SPEAKER_00 7:36

Oh, we would have found it, yeah. Oh, you absolutely had there had had there have been validation and verification, the testing that happens before penetration testing, during the threat modeling phase, this would have been uncovered during that, during verification and validation. Because they would have performed more than 250 iterations of the of the feature or therapy. But the the integer overflow was every 256th patient. Just got a massive dose of radiation. That's crazy.

SPEAKER_02 8:12

That's actually wild.

SPEAKER_00 8:13

Yeah, yeah, and and and you and I I'm not sure, because I don't have like code samples, uh, if that that counter was only for radiation therapy or x-rays, or it was the two numbers combined. But like the patient counter was the integer overflow.

SPEAKER_02 8:29

Right.

SPEAKER_00 8:30

So bad. That's crazy.

SPEAKER_02 8:31

That's actually wild.

SPEAKER_00 8:32

Yeah, and the the the the race condition was the the the phased array statement in um p it in PDP that would count as the as the motor moved, and it was just a sensor telling you what position it was currently in, much like an elevator works today as it moves, it can't it's constantly reporting back, I'm at this marker, I'm at this marker, I'm at this marker. Uh think of them as as highway mile markers, if you will, for inches and use can bus. Uh they do on the back end, and we can dig into that. Yeah, we've got the tools for that.

SPEAKER_02 9:08

Yeah, yeah, I thought they did.

SPEAKER_00 9:09

Yeah. So uh it was this was working off that, but instead of real time, it was an eight-second delay. So in that eight-second delay, if anything changed, it would just start blart dumping uh the well, it would open the aperture on the 270-degree double pass and the whole double pass design, so you don't have to have a room-sized device when you expose U235. It does crazy things. Well, it does predictable things, but it's very good.

SPEAKER_02 9:38

But it's undesirable.

SPEAKER_00 9:39

Yes. Undesirable we'll say. Yeah. You know, you tend to glow blue and just flash and then die horribly within three days.

SPEAKER_02 9:48

Yeah, yeah, we should avoid that. Yeah. Um well, what uh what other talks did you see that you liked? We did a panel, that was cool.

SPEAKER_00 9:57

Okay, before we get into our panel, because that thing went off the rails and it was hilarious and amazing. Uh, Philip Wiley gave a great talk. Shout out Philip Wiley. He always does. Yeah, Philip Wiley Show and Cybersec Media, all those guys, hearts at you guys. We love you a whole lot. Thank you for your support. Um, Philip came and talked. And oh, and Suzu Labs, uh, that's our Philip's employer. Um, who else did you see that you that you really got to tick a lot of?

SPEAKER_02 10:24

I didn't get to watch as many talks because I kept getting pulled around. Yeah, we kept having to wrangle all day.

SPEAKER_00 10:30

You were the DJ for the day, actually. Like you you it was your Soma FM that was that was streaming.

SPEAKER_02 10:36

I did have to I had to make sure we had some ambiance going. Yeah, yeah, yeah. That's something a lot of cons lack, you know. They they don't get the ambiance. Oh no, no, no.

SPEAKER_00 10:44

They a lot of people missed that. DEF CON nailed it. It's where we s it's where we cribbed the idea, yeah. Um sorry, let's go back to the panel. Well okay, so the panel was moderated by our own Jonathan Kemet.

SPEAKER_02 10:55

And he didn't tell us any of the questions or a topic ahead of time.

SPEAKER_00 10:58

Correct. We just walked in, and it was me, you, and Andrew Hickman. And um Jonathan pointed out it was you and I were the only red teamers, and then it was him that the other two guys, uh, you know, Kemet and Hickman are both blue team. So that was interesting. Um what do you what were your thoughts on that? Like some of the questions were like, Can you ever really blow your hair back?

SPEAKER_02 11:22

Or like Usually whenever I'm giving a panel, I'm kind of like, uh I mean, yeah, I don't know, sometimes there's you know difficult questions or whatever, but I'm usually like kind of I don't know, it's just I'm just saying my thoughts. And I'm usually not very, very impressed unless somebody else on the panel has some really cool stuff. But we got, I got like everybody stopped me that was there. I was like, oh my god, that was so great. Okay. So I guess the panels are the way to go. Um but it seemed like everybody liked it. And I thought it was fun. That's uh that's I mean, I just I think I had fun doing it. I mean we were we were laughing and you know.

SPEAKER_00 11:54

I I think maybe we ought to try to do the same thing next year, but with some of the speakers, whether they want to or not. Just put them on panels and let all of us like mediate them and just see what happens.

SPEAKER_02 12:07

Yeah. Yeah, I think so. I mean, we we covered um all kinds of topics, such as, you know, uh how many how cyber attacks can, you know, cause mass casualty events. And you know, we we covered all kinds of stuff that was a lot less dark and much more goofy, and you know that it went all over the place.

SPEAKER_00 12:27

It wasn't it wasn't purely like macabre or anything. No. But uh that's what the crowd like like it was almost like the crowd was like vibing for it. They were like, well, wait, what can happen? What's the worst case scenario? Like, say more about things catching on fire. Like people get a kick out of that. Uh especially when it's not theirs. Everyone wants to know the nitty-gritty when it's not their system.

SPEAKER_02 12:52

Well, everybody in cybersecurity is always trying to think of what's the worst thing, you know.

SPEAKER_00 12:56

Yeah.

SPEAKER_02 12:56

What's the and then that's what makes you essentially good at it, right? Is you you have to always be thinking, well, if the worst thing goes wrong, what's the worst thing that could happen because of it?

SPEAKER_00 13:06

Yeah, how bad is the fallout from that? Yeah. That's one of them that that the I want to say the rest of the world doesn't think about, as opposed to like, it's our second nature. Yes. You know, like when we're working on like a vehicle or something, you're like, oh, it's fine, I can get down the road. Just give me some bale and wire, I can tie in that steering rod. You know, like we were making jokes about it the other day. No, I just drove it home, dude. It's cool. Yeah, yeah. You know, like, oh, I totally crushed the entire hydraulic linkage uh for the steering. Nah, I just made it home because we know, because we think, well, we spin the risk on pretty much our whole lives of everything. And that's how we look at it risk mitigation. Yeah. And um to us it's nonchalant because we know, oh, you're only going 25 worst case, you're in the ditch. Of a wreck, you're you put your rec truck back in the ditch.

SPEAKER_02 13:57

Yeah, it's fine. Yeah, whereas I reinforced your twisted-up drive shaft by welding spare wrenches to it. Exactly. It's fine.

SPEAKER_00 14:05

Yeah, just don't go 80. I welded off the batteries, it's fine. Yeah, exactly. I use the batteries as a welder, it will be fine. Yeah. And these are the things about growing up in Hoke in Oklahoma that make you true story, by the way. No, I know, and that that's why I'm like, I I truly think that that level of ingenuity is what makes some of the really unique hackers that come from the Oklahoma, Texas, like our region. Because it's not the South, you know, there are those guys are over there. And it's not the Midwest, because apparently that's above us. Apparently, Midwest is not in reference to latitude. I don't know. So I yeah, I guess that's the the beauty of us is you grow up with these these ingenuity of like, no, I can totally weld a wrench onto the vanadium wrench onto that drive shaft because it's a little weird. And we we banged it out and straightened it on rocks of a riverbed. Yeah, it'll be fine.

SPEAKER_02 15:02

It's fine, it's fine.

SPEAKER_00 15:04

And that is very much an Oklahoma thing.

SPEAKER_02 15:07

And that's what you get when you come to Setcon. It's a conference, except it's kind of like uh halfway welded driveshaft. No, I'm kidding.

SPEAKER_00 15:14

It's actually great. Yeah, it was really well great. No, it was actually really well planned. Uh the badges, the signage this year was super good. Um Miss Sophia took care of all that stuff. Um, the graphics were amazing. Um, the the setcon boy, that was fun. I'm I'm curious to see what we're gonna do next year. I'm interested to see the theme for next year, so I can so yeah.

SPEAKER_02 15:37

If anybody has any ideas for the theme, feel free to hit us up, reach out.

SPEAKER_00 15:42

If we end up choosing it, I'll buy your ticket. Or it'll be we'll comp a ticket. It will be free.

SPEAKER_02 15:49

Are you opening up a a challenge?

SPEAKER_00 15:51

Oh always. Always. So yeah, if you can come up with a good idea or a good title, if we end up using it, um, you get in for free.

unknown 16:00

Yeah.

SPEAKER_00 16:00

So let's talk about volunteers. So the volunteers we had, thank you guys so, so much. Could not have done it without them. No, those guys just absolutely amazing. Some of the runners, they just went so much work got done. Um thank you to the volunteers. And then the after party.

SPEAKER_02 16:16

So the after party was at Yeah, the Big Friendly, yeah, the brewery. Yeah, that was good. That was good.

SPEAKER_00 16:22

Shout out to them, yeah, to the Big Friendly for taking care of us and hosting our after party on that. Um great venue. There was a farmer's market going on. Sure was, yeah. And uh there was a the uh a band playing outside, and immediately all of us uh started like digging in our bags, trying to find SDRs and things to attack the guys that were doing performing live music. Allegedly. But unfortunately, they were they were strong, they were wired in, so it was all wired calms, so we couldn't really man in the middle of that.

SPEAKER_02 16:55

There was some impromptu talks given at the uh at the after party. Yeah, man. That's good.

SPEAKER_00 17:00

Well, and and Patrick got to spit more uh to the crowd, and and like a bunch of people, like it was really, really good. And actually, that was where we decided that this year we're gonna do not this year, we're gonna start doing um I don't want to call it 2600, I don't want to call it 405, I don't want to call it 572, I don't know what to call it yet. Random hacker meetup, random hacker meetup uh this month, uh so wait validating, verifying with our producer that this episode will be out before, but if it makes it out before, October 2nd, Myriad Gardens Amphitheater at sundown. That's October 2nd, Myriad Gardens Amphitheater at sundown. No real plan, BYOB, uh you're in a public place, behave as such, uh adhere to all your municipal municipal regulations. Um not a sponsored event, it's just a bunch of bunch of people that work in our industry, just hanging out, throwing ideas, just throwing ideas out, challenging ideas, and just having interesting conversations with some like-minded folks. We'll probably all end up somewhere else after that for dinner or to eat or whatever, but the initial meeting point will be at that place. Um so after that, what there was an after after party that I knew you guys went to that I didn't go to.

SPEAKER_02 18:25

Yeah.

SPEAKER_00 18:26

Um I had to I had to get back south. Uh but you guys end up going to like the arcade? How was it how was that?

SPEAKER_02 18:33

The arcade bar, yeah, the updown.

SPEAKER_00 18:35

That was that was good. That was good. Yeah, just uh watch people. Hang on, I don't want to turn this into a plug for the the the the the arcade bar, but is it all 8-bit game or is it like 80s, nine is it by by decade? How what is it?

SPEAKER_02 18:50

It's just uh really all over the place, but they have a whole bunch of classic games, pretty much everything you can think of. I mean not not obscure stuff, but like all the all the main stays. All the main titles. And definitely some some of the lesser common you know, the lesser stuff. I mean, they've got all the spy hunter games and all kinds of Oh really? Yeah, all the Defender games. Oh wow. Defender and Defender 2 and all the all the cool stuff. Lots of pinball. Ooh, claw games? I don't know if they really have any claw games. Retones.

SPEAKER_00 19:16

It's okay. I don't know. Um but you there was a bar there, yeah.

SPEAKER_02 19:20

Yes. Oh, yeah. And do they have is there food there? There is a pizza joint there.

SPEAKER_00 19:24

Attached or is it it's part of it. It's part of it? Yeah.

unknown 19:27

Nice.

SPEAKER_00 19:28

See, I had never been in that.

SPEAKER_02 19:29

Oh yeah. Yeah. This place is solid, man. Yeah, it's a good place. And what's it called again? The updown. Yeah, or up or just up down, I don't know.

SPEAKER_00 19:36

But what part of town is it in?

SPEAKER_02 19:38

It's in the plaza.

SPEAKER_00 19:39

Okay, so if you're in the plaza district, Oklahoma City metro area, go to the up down. And it's well, we were just I don't know why I was reiterating what I just said. Anyway, I'm sorry.

SPEAKER_02 19:50

Yeah, yeah, it was good. It it um we didn't have a ton of people there. You know, we probably had uh maybe maybe 10 of us.

SPEAKER_00 19:55

Yeah, I was gonna say like it seemed like about 10 people. Because like, yeah, once once we once we closed the tab at the big friend there, and we're like, okay, well, I'm leaving. And so everybody went on to the the up down. Yeah. Um well overall I think it was a successful event. Oh yeah, it was great. Absolutely. Uh like I said, over 180, uh 180 uh attendees and and um growing every year?

SPEAKER_02 20:18

Yes. We'll have more next year.

SPEAKER_00 20:20

Yes, the up, the upcoming uh students. Uh we' we'll we're just in more reach out uh outreach to some of the unis. Yeah. Because Cameron, uh Langston, uh OU, O O State, uh OSU O K C U had a had a little bit of a presence there. Rose, obviously, those crowd, that crowd killed it. Because I mean that was just chock full of Rose.

SPEAKER_02 20:43

A few of our volunteers are from Oklahoma Christian.

SPEAKER_00 20:46

Okay, that's right. Because yes, we had yes, Chris Coleman's folks. Yes, uh, Mr. Coleman's staff uh or or students. Uh yeah, he he sent a couple over. So yeah, I think I think we we should be reaching out to more unis and and and bringing those guys in. And uh but yeah, we're looking for that next year.

SPEAKER_02 21:02

Or if you're a cool hacker doing cool hacker stuff, come talk about it with cool hacker people.

SPEAKER_00 21:07

That's true. And if you think that like no one cares, we do. Even if like you think it's cool, like I have a different flavor of autism than other people. Like obviously mine's differs, differs from Tanner's. Call me autistic. Just um, but but however, we got guys on our teams that can you know that can tell you they make a model of an airplane just by listening to it.

SPEAKER_02 21:31

That's actually true.

SPEAKER_00 21:33

Yeah, I know. You know who you are. Um but like yeah, I I I really think it's like share yourself with us. Uh and and and the world would be better hearing hearing some of your guys' opinions and some of your guys' thoughts on technology. And uh to quote Ted Kaczynski, there's no such thing as good. You can't separate the bad from the good in technology.

SPEAKER_02 21:56

Okay. That's how we'll that's how we'll close it with a lot of things. Just want to throw the unibomber quote. Close it out with that. All right. Well, thank you for everybody who came, and uh we look forward to seeing you all again next year, as well as hopefully a whole lot more new faces. And uh a little short, just a brief episode. We just kind of want to hop on here and say, you know, thanks and mention how uh we had fun and we were excited, and if you didn't come, uh you should be jealous. Yes, they on you. All right. Well, thank you, everybody. This is another episode of the Secure AF Podcast.

SPEAKER_01 22:27

Thanks again. The Secure AF Podcast is a production of alias Cybersecurity. Visit us online at aliascybersecurity.com. All rights reserved.