Defcon Organizer Grifter on Hacker Culture, Conference Security and Threat Hunting

Summary

Neil Wyler, known as Grifter, recounts his early hacking, Defcon's evolution, Black Hat network defense and a threat hunt that uncovered recurring financial data transfers to a server in Russia.

Key points

• Wyler described entering a credit card provider's systems as a teenager and fraudulently issuing cards under false names.
• He helped develop Defcon Groups and the conference's village concept, which created spaces for hands-on activities such as lock-picking and hardware hacking.
• Black Hat's network team replaces venue equipment to control the environment and respond to attacks and newly disclosed vulnerabilities.
• The team warns attendees when devices show signs such as known command-and-control traffic, cryptomining or cleartext credentials, while checking whether activity is part of a lab.
• Wyler recalled finding nightly FTP transfers of an unnamed financial organization's transaction and trade records to a server in Russia. Available logs showed six months of transfers, but the full duration was unknown.
• He argued that the financial organization's assumption that FTP was prohibited contributed to its failure to notice the traffic.