Hacker Summer Camp brings 30,000+ security minds to Las Vegas, and with them, plenty of ways to become an unintended demo. CovertSwarm's COO shares his field-tested rules for public Wi-Fi, DNS manipulation, rogue Bluetooth prompts, and IMSI catchers, learned across seven or eight DEF CONs.
Seven, or possibly eight, DEF CONs have taught me that good security in Las Vegas mostly comes down to not clicking things, not blindly trusting the internet’s satnav and remembering that beer isn’t water.
Next week, thousands of hackers, researchers, vendors, CISOs and assorted cyber miscreants will descend on Las Vegas for Black Hat, BSidesLV and DEF CON.
This will be my seventh or perhaps eighth DEF CON. I’ve genuinely lost count. At some point the years, electronic badges and aggressively patterned casino carpets begin to merge into one.
Hacker Summer Camp is one of my favorite weeks of the year. It is also possibly the only occasion where security professionals become nervous about joining Wi-Fi while surrounded by 30,000 people capable of explaining exactly how it might have been compromised.
So, in the spirit of helping everyone enjoy the week without becoming an unintended demonstration, here are my completely unofficial tips.
My first rule is simple: don’t join public Wi-Fi.
Not at the hotel. Not at the airport. Not at the coffee shop. Definitely not at DEF CON. I don’t care how convincing the network name looks or whether somebody in a branded polo shirt says it is safe.
The risk isn’t simply that somebody can read all your traffic. Modern applications and websites generally use strong transport encryption.
The more realistic concern is that you connect to something you didn’t intend to: an evil twin, a malicious captive portal or a network deliberately configured to manipulate where your device goes.
My normal setup is deliberately over-engineered:
Sometimes I add another relay or VPN layer because apparently I enjoy creating my own networking problems. This is not a requirement. Two VPN icons do not necessarily mean twice the security.
If you do want to use the DEF CON network for labs or challenges, use a properly isolated burner device containing nothing you care about.
And, for clarity, being at DEF CON does not make every other attendee an authorized target.
“I thought everyone was in scope” remains a fairly weak legal defense.
There is another reason I avoid hostile networks: DNS.
DNS is effectively the internet’s satnav. You ask for a website or service by name, and DNS tells your device where to find it.
When you join a network, it will normally tell your device which DNS resolver to use. If an attacker controls that resolver, they can attempt to send you somewhere other than the destination you requested.
That might mean:
Proper HTTPS should detect a basic redirect because the attacker won’t possess a valid certificate for the legitimate domain. This is precisely why you must never click through a certificate warning.
The warning may be the control preventing DNS manipulation from becoming credential theft. Clicking “continue anyway” is effectively telling the browser:
“Thank you for detecting the attack. I’d still like to proceed.”
Simply setting 1.1.1.1 or The practical advice remains very simple: use cellular data, use a trusted VPN, don’t install certificates or configuration profiles offered by venue networks and never bypass a certificate warning. The attacker may not need to break the encryption if they can persuade your device to go somewhere else. Before traveling, check the saved networks on your phone. Most of us have accumulated years of airport, hotel, Starbucks and “Free Guest Wi-Fi” networks. Some are open networks that your device may automatically reconnect to when it encounters another access point broadcasting the same name. Modern devices are better at protecting their identity while scanning, but retaining a long collection of automatically trusted public networks is still unnecessary risk. Delete the ones you don’t need, particularly anything open or public, and disable automatic connection to unknown networks. The most effective evil twin often isn’t technically sophisticated. It simply looks familiar enough that your device, or you, doesn’t question it. Around DEF CON, I often keep my phone in airplane mode when I don’t need connectivity. However, check what airplane mode has actually switched off. Wi-Fi and Bluetooth can remain enabled or be turned back on independently, and devices may remember those preferences. On an iPhone, switching Bluetooth off from Control Center also doesn’t always mean that the radio has been completely disabled. Go into Settings and check. If I need to be online, I use cellular data through the travel eSIM, manually disable the other radios I don’t need and connect the VPN. AirDrop, NameDrop, Nearby Share and similar discovery features remain off unless I’m deliberately using them. It is only paranoia if nobody is walking around the conference with a custom Bluetooth transmitter in their backpack. History suggests somebody probably is. Fake cell sites, also known as IMSI catchers, impersonate mobile towers and encourage nearby phones to connect. They can collect identifying information, track devices and, in some circumstances, force a phone onto an older, weaker cellular protocol where calls or SMS become easier to intercept. This isn’t a magic box capable of decrypting every 5G phone, but the technology is real and well within the capabilities of people attending DEF CON. Assume plenty of cellular experimentation will be happening around us. I’ve seen a cellular interception attack performed against a close friend first-hand. Thankfully, their bank quickly recognized what was happening and stopped it. That made the threat feel considerably less theoretical. Avoid sensitive conversations over ordinary calls or SMS. Use end-to-end encrypted, app-to-app services such as Signal, WhatsApp or FaceTime, and avoid SMS-based authentication where a passkey or authenticator is available. Vegas is not the time to call your bank manager and start moving significant sums of money around. This doesn’t conflict with using a travel eSIM and 4G/5G data. The cellular network carries the packets, but Signal, WhatsApp and FaceTime encrypt the conversation between the two devices. HTTPS protects properly configured applications, while a VPN provides another encrypted layer for general traffic. Use cellular data. Just place sensitive conversations inside encryption that the mobile network cannot remove. At DEF CON in 2023, attendees began receiving convincing Apple TV, Apple ID and password-sharing prompts on their iPhones. The source turned out to be a researcher walking around with a roughly $70 device broadcasting spoofed Bluetooth Low Energy messages. The experiment itself didn’t steal credentials or bypass 2FA, but it demonstrated how cheaply somebody could generate trusted-looking system prompts on nearby phones. The full story is worth reading. The lesson remains useful well beyond DEF CON: if you didn’t initiate the action, don’t approve the prompt. That includes: Attackers don’t always need an elegant zero-day. Sometimes they just need a tired person to press “Allow”. Black Hat and DEF CON are popular places to disclose new research. Given the pace of vulnerability discovery, and what the latest frontier models can now do to accelerate it, I would be surprised if there weren’t a few interesting vulnerabilities being held back for next week. That doesn’t mean the internet will collapse on Thursday morning. It means this is an especially poor week to travel with six months of deferred updates and a reboot you keep postponing. Update your: Then restart everything and make sure the updates have actually installed. For people who believe they may be specifically targeted, Apple’s Lockdown Mode provides an additional layer of protection, although it deliberately restricts some functionality and should be tested before travel. A corporate laptop is for work. A burner laptop is for experimenting. Don’t sign into corporate services from the burner. Don’t connect random USB devices to the work laptop. Don’t plug in a conference badge simply because it has flashing LEDs and looks friendly. Bring your own mains charger, cables and power bank. Avoid public USB charging ports completely (including at the airport) and use a data blocker if you have one. Physical security matters too. Keep control of your devices, enable strong screen locks, check that disk encryption is active and make sure remote lock or wipe is available before you need it. Vegas is busy, distracting and designed to make you lose track of time. A laptop left behind in a bar is a considerably more likely problem than an exotic baseband exploit. One reason I love DEF CON is that it demonstrates how artificial many security boundaries really are. We separate network security, application security, physical security, social engineering, identity, DNS and AI into different products, teams and conference tracks. An attacker doesn’t. They see one environment and one objective. If attacking the application is difficult, they may manipulate DNS. If the device is patched, they may target the person. If the account uses MFA, they may wait until the owner is tired, distracted and expecting interruptions. The technique is secondary. The intent is what connects it all. That is the mindset we try to bring to our work at CovertSwarm: not simply asking whether an individual control works, but whether an attacker can still achieve the outcome they came for. Hacker Summer Camp is a concentrated reminder of that reality. The cyber risk is manageable. The heat is less interested in your VPN configuration. Las Vegas is currently forecast to reach around 113°F (45°C) at the beginning of the week, with very limited relief overnight and extreme UV levels. The National Weather Service forecast is worth checking before traveling. Bring sunscreen, sunglasses, a hat and a water bottle. Buy water from a supermarket or pharmacy rather than financing the hotel minibar. Drink it regularly. Beer is not water. Frozen margarita is not water. Neither becomes water simply because it contains some. Vegas also distorts distance. A hotel that appears to be next door may require a 30-minute expedition through three casinos, a shopping center and an elevated walkway. In extreme heat, use Uber, Lyft, the monorail or the Loop rather than attempting to prove that Google Maps was technically correct. Compare Uber and Lyft prices, verify the vehicle and registration before getting in and don’t accept rides offered outside the app. DEF CON is far too large to approach with a completionist mindset. Download HackerTracker, choose one or two things you genuinely want to attend each day and leave gaps for everything you haven’t discovered yet. Visit the villages. Try challenges. Ask questions. Talk to strangers. At BSidesLV, look out for Skytalks. They operate under strict off-the-record rules with no photography or recording, so the content really won’t appear online later. Some of the most interesting conversations happen precisely because they are allowed to disappear when the room empties. If you want to practice social engineering, do it in an explicitly participatory village, competition or lab. By all means invent an elaborate story when chatting in the social engineering village. Just don’t test it on casino security, hotel employees or unsuspecting members of the public. CovertSwarm will be out in force this year. Jayson E. Street, Iain Jackson and James Sheppard are delivering social-engineering training at both Black Hat and DEF CON, as well as supporting the Social Engineering Community. Dominika Pietrzak and Ibai Castells will be speaking at Adversary Village about what they have learned from building and using offensive AI agents in the real world. I’ll be wandering around too, most likely holding a bottle of water, checking that my Bluetooth is actually off and trying to remember which DEF CON this is. If you see us, come and say hello. Stay patched. Stay curious. Avoid public Wi-Fi. And drink some actual water.Delete the Wi-Fi networks you forgot you trusted
Airplane mode isn’t always airplane mode
Cellular data is useful. Cellular calls are not private
If you didn’t initiate the prompt, don’t approve it
Patch before you fly
Keep work and play separate
The attacker sees one environment
Vegas is also trying to cook you
Don’t try to see everything
Come and say hello