Author: rvasadmin

RV4sec 2015 Badge Build

Paul Bruggeman from HackRVA provided us with an update on the badges!

Badge Design

Badge2015-1

 

The printed circuit board, or PCB, is the backbone of any circuit board. It supplies the physical strength and fundamental wiring for the board. It also determines the minimum size.

 

The circuit design artwork is Badge2015-2drawn, usually with special software but hobbyists sometimes just draw them by hand. The gEDA software suite has a component called “pcb” that was used to draw the badge.

 

Badge Etching

Badge2015-3

 

 

The PCB board is fiberglass-reinforced epoxy laminated with a thin copper sheet which is etched away using ferric chloride to recreate the artwork.

 

 

 

 

One goal of this year’s badge was to use a professional process to cover the Badge2015-4boards with the acid resist. Attempts last year worked but were not consistent.

 

 

 

 

Badge Cutting

Badge2015-5

 

 

Once the boards are etched they have to be cut down to final size. PCBs are tough material to cut.

 

 

 

The addition of a sheet metal cutter this year has made it much easier to do.Badge2015-6 The steel blade is 1/2″ thick and the whole thing weighs 60 lbs!

 

 

 

 

 

 

Badge Parts

Badge2015-7

 

With the boards cut down, the next process is to put the surface mount parts on. Most of the 50+ parts are surface mount. This means they have no wires to solder, because they have metals pads that melt and attach when heated to 510F degrees.

 

The process of installing the parts is called “pick and place.” Not very Badge2015-8complicated, but it can be tedious to do, especially 350 times!

 

 

 

 

 

 

Badge pick+place

Badge2015-9First a solder paste containing thousands of beads of tin is drawn across a stencil that leaves the sticky grey paste where the parts will be placed. This stencil is etched copper foil. Stencils can also be plastic or steel.

 

The board then makes its way down the volunteer assembly line where parts Badge2015-10are carefully placed on the solder paste. We have had the help of over a dozen HackRVA people so far this year.

 

 

Badge Cooking

Badge2015-11The solder paste has to be melted or “re-flowed” to electrically connect the parts to the PCB. This currently is not very hi-tech: $20 donated ovens.  A volunteer last year built a micro- controlled unit but the heating element died on it.

 

The manual ovens require attention. Failures are usually of the distracted Badge2015-12human type. We had a board last year survive a 5-hour session underneath the oven, and it worked fine–though it looked like burnt toast!

 

 

Badge Wrap-up

Badge2015-13

 

The last things to go on are the hand- soldered parts: infrared transmitter and receiver, piezo buzzer, USB connector, USB detection wire, and the LCD panel.

 

 

 

 

If you plan on doing any software development we recommend the reset Badge2015-14button option (red in picture) which can be soldered across the middle and far right pin on the lower center 5-pin programming header.

 

 

 

 

Design: Paul, Morgan

Electronics: Paul

Coordinator: Morgan

Etch: Paul, Jon, Aaron

Pick+place: Jon, John, Bill, John, Yijie, Sidney,

Thad, Tony (so far)


CTF: Know A Local RVA Company That Needs Security Help?

Do you know any local RVA companies that need security help?  Whether they can’t afford to hire help, are a Non-Profit organization or something else, the RV4sec CTF team is here to help!

This year we are working with Bugcrowd to allow CTF participants the ability to give back to the community. The live bug hunting aspect will provide real organizations security testing so they can better understand and improve the security posture of their online presence.

Please help us spread the work that an organization can receive free security testing by signing up for the BugCrowd platform here:
https://tracker.bugcrowd.com/organizations/programs/new

Once you signup please email us so we can help you through the next steps.

The testing will provide real world feedback on what an attacker would be able to see from the Internet, allowing you to understand what needs to be fixed.

If you have any questions please contact us to discuss!

This year’s CTF is being sponsored and brought to you by United Network for Organ Sharing (UNOS), a non-profit 501(c)(3) organization.

 

UNOS

 


RV4sec After Party Sponsored By Rapid7, Guidepoint and nVisium!

We are pleased to announce that Rapid7, GuidePoint and nVisium have all come together to sponsor the RV4sec after party!

The after party will be held at Pearl on Thursday, June 4th at 6:30pm!

The event takes place shortly after day one of the conference ends–and it is a quick ride over so you can head right from VCU for some cocktails and food!

Event Details:

Thursday June 5th 6:30pm-8:30PM (maybe longer!)
2229 West Main Street, Richmond, VA 23220

804-353-2424

Google Maps Link

Thanks again to our sponsors for making sure RVAsec attendees will be well taken care of this year!

 rapid7_logo_orange-840px

Guide Point Security

nvisium_logo


Get Your Hotel Room By 5/13!

Just a reminder that if you need a hotel room for RVAsec, you should book it before our block at the Crowne Plaza ends on 5/13.

RVAsec has reserved a block of rooms at the Crowne Plaza for out of town guests. The rate is $113/night (which includes parking).

You can either book online or call the hotel.

When you call (855-472-7802) the hotel please tell mention the block “RVAsec” to get the special rate.

Crowne Plaza Richmond Downtown
555 East Canal Street, Richmond VA 23219

800-2CROWNE



View Larger Map
 

If for any reason you are unable to get the RVAsec rate or the block of rooms has been filled, please let us know so we can contact the hotel!

Once the block is full or expires we are not able to have it extended.

Make sure you check out information on getting to the conference.

Also you can check out things “ToDo” in RVA!


RV4sec Schedule Posted!

schedule_clipartThe full schedule for the RV4sec 2015 conference is now published!

Registration & breakfast start at 8 AM on Thursday, June 4th and end at 6 PM (followed by the after party).

Registration and breakfast start again at 8 AM Friday, June 5th and end at 4 PM, followed immediately by the closing reception at VCU.

For the full details and times for specific talks, please see the schedule page.


RV4sec Speaker Lineup!

There was a lot of competition in the CFP, but we’ve managed to whittle it down to another great lineup for RV4sec. So here are the speakers for the 2015 RV4sec conference!

Jennifer Steffens G Mark Hardy
David J. Bianco Caleb “chill” Crable
Adam Crosby Chris Eng
Pete Herzog / Dave Lauer Allen Householder
Barry Kouns David Lodge
Kizz MyAnthia Mark Painter
Elissa Shevinsky Michelle Schaffer / Tim Wilson
Jason Scott Jason Smith
Schuyler Towne Robert Stratton
Boris Sverdlik Bill Weinberg
Governor Terry McAuliffe

 

For detailed information about the speakers and their talks please see rvasec.com/speakers/

Thank you to everyone who submitted a proposal to the CFP–the review team had to make some tough decisions and appreciate all the time and hard work that went into submitting.


Hacker Warehouse Will Be At RV4sec!

We are pleased to announce that Hacker Warehouse will be at RV4sec!  This will be the first year attendees will be able to see HackerWarehouse_Banner-1500x750amazing security products that are available and be able to purchase them at the conference.

You can check out the Hacker Warehouse website and get a feel for some of their products. If you want something specific available at RV4sec be sure to let them know!

HackerWarehouse.com strives to be your one-stop shop for all your computer security needs from defense to offense. T understand the importance of tools and gear which is why we strive to carry only the highest quality gear from the best brands in the industry.

We’re dedicated to serving you—our customer—with the highest level of service. Don’t hesitate to contact them should you need anything.

 


CTF: New Hybrid Challenge Includes Live Bug Hunting!

ctfThe RV4sec CTF dev team has been hard at work for the last few months cooking up some great new challenges for this year’s Capture the Flag (CTF) event. We’re sticking with the tiered approach in an effort to bring a healthy mix of educational challenges, along with more difficult “hack the Gibson” challenges.

However, this year’s CTF has a new twist! We are combining the CTF you know and love with live bug hunting with the help of Bugcrowd!  Bugcrowd has run Bug Bashes at conferences before, but we are taking it to the next level at RV4sec: we’ll be incorporating aspects of the live Bugcrowd bug bounty system into the CTF scoring.  This means you can get involved in finding real live bugs on systems and they will count for points in the CTF. Isn’t that excellent?!

BugcrowdThe CTF has been a big success the last few years, and we are working hard to ensure that it continues to educate and provide a fun, safe environment to learn many aspects of IT, IT security, hacking and defending.

We are also working with Bugcrowd to allow CTF participants the ability to give back to the community. We are working on a process to allow local companies and not-for-profit organizations the ability to sign up to have their security tested as part of the CTF.  The live bug hunting aspect will provide real organizations security testing so they can better understand and improve the security posture of their online presence. In the end, isn’t that what IT security should be about?  We hope to provide more information on this very soon!

The CTF team is a mix of folks from many different facets of IT: we’ve got incident responders, hacker trackers, IT directors, pentesters, IT managers and everything in between. These folks have a passion for technology, enjoy exploratory dives into interesting problems, and want to share the joy, fun, frustration, learning, and general shenanigans that make the RV4sec CTF so much fun!

Our hope is that a healthy mix of folks will also come to participate in the free CTF hosted at RV4sec. We want everyone to come out and play, whether you’re new to tech, or you remember putting your first program on punch cards. Come out, plug in (well it’ll be wireless, but…) and get hacking, teaching, and learning.

Also, feel free to tweet us things you’d like to see in the CTF. It’s getting close but there may be time to get the ideas into a challenge. Use hashtag #rv4secctf and tweet to @pipefish_@mpbailey1911, or even @RVAsec with ideas and we’ll see what we can do.

Come out to the RV4sec conference and enjoy the training, the talks, and plan to stop by the CTF for some hackery!

Thanks again to UNOS for sponsoring the CTF, as well as the other organizations donating prizes.

We’ll see you there, and keep your eyes peeled for more information soon!

UNOS


Jennifer Steffens (@SecureSun) To Keynote RV4sec!

We are pleased to announce that Jennifer Steffens will be keynoting RV4sec 2015!

As its CEO, Jennifer Steffens spearheads all aspects of IOActive’s global IOActiveCEO_JenniferSteffens_2013_02business operations and drives the company’s strategic vision. Jennifer brings a wealth of industry and business experience to the company, having been an early member of several successful startups.

Earlier in her career, Jennifer was a Director at Sourcefire, where she helped build and grow its run rate from $250K to over $35M in just four years. She helped commercialize the Snort open source intrusion detection and prevention technology and built several service offerings around research initiatives. Prior to joining IOActive, Jennifer came to Seattle to help startup GraniteEdge reinvent itself. While there, she led initiatives to restructure the company and developed a product strategy that ultimately secured two additional rounds of funding. With over ten years of industry experience, Jennifer has held senior management positions at Ubizen, NFR Security, and StillSecure.

Jennifer is a well-respected media source, appearing in InfoSecurity Magazine, SC Magazine, Good Morning America, BBC, Reuters, The Guardian, and CBS News. She has been invited to give keynote presentations at a variety of conferences such as HackInTheBox. Jennifer is a member of EWF, ISSA, and OWASP.

You can follow Jennifer on Twitter at @SecureSun.


Training: Vendor Risk Management and Trust Analysis

We are pleased to announce that Pete Herzog will be joining us this year to teach a class!

Vendor Risk Management and Trust Analysis

Get a grip on the risk caused by your vendors, cloud, software providers, partners, and other third parties you need to work with. Manage it in an orderly way that doesn’t overwhelm you or become the paperwork that sucks the life out of your job. Master it so you can make sure the people in charge of those relationships can also help you manage the security of those 3rd parties. This provides you with the means and the toolkit you need to do it in a practical, responsible, and secure method.

Training classes are held on Thursday, June 3rd, before the conference.

For more information on the class and the instructor, or to register, please see:

http://rvasec.com/training/