rene_mobile’s avatarrene_mobile’s Twitter Archive—№ 4,347

                      1. Thread: So, for my first time, I went to #BHUSA2018 (@BlackHatEvents) and #DEFCON26. I took my main phone and laptop, and on conference day 1 went completely non-anonymous with an Android platform security team T-shirt on. Let me tell you what happened. 1/n
                    1. …in reply to @rene_mobile
                      For context, prior to the first main conference day, I did 2 days training with @colinoflynn on power analysis and clock glitching with #ChipWhisperer and learned a ton. This has shown me how easy such hardware attacks can be today. 2/n
                  1. …in reply to @rene_mobile
                    For those 2 days, I brought an old loaner laptop to work with the provided #VirtualBox images (which is not supported on ChromeOS at this time). Yes, I did plug in @colinoflynn's USB stick into this loaner laptop (without configured accounts). 3/n
                1. …in reply to @rene_mobile
                  On the other days, I simply brought my main Pixel 2 and Pixelbook, both with my personal accounts as well as @Google corporate accounts configured (on Android using work profile to keep personal and work lives apart - I really like that feature!). 4/n
              1. …in reply to @rene_mobile
                And yes, against common advice, I did log into all my mail and many other accounts while there, call my family, etc. Stupid, I know, but usability wins over paranoia even for security geeks while traveling.... 5/n
            1. …in reply to @rene_mobile
              In the spirit of full disclosure, I did break my normal pattern on one account: on the Pixel 2, I disabled WiFi and Bluetooth (which, on most days, I simply leave on all the time). 6/n
          1. …in reply to @rene_mobile
            The main reason was battery usage (I wanted to get through loooong days with high screen time), but I admit that I am not yet fully happy with the radio-side attack surface (working on more fuzzing and mitigations on that side, so stay tuned for next year's experiment ;) ). 7/n
        1. …in reply to @rene_mobile
          Now, finally, after all that intro/context, the list of all the bad things that happened to my devices and accounts: . . . . . . . . 1. I got 2 spam calls (well, normal in the US). 2. I got more spam emails (well, the hotel now has my address). 8/n
      1. …in reply to @rene_mobile
        3. My Twitter account took way too much time to read (thanks to #BHUSA2018 craziness). 4. So far, nothing else. Thanks for staying with me for that long for a complete anti-climax. I will keep watching my personal servers, and Google will certainly watch my corp account. 9/n
    1. …in reply to @rene_mobile
      Why wasn't I concerned going there? Because I consider the network (outside my very own LAN) untrusted anyways, use TLS or VPN for everything including server verification, 2FA where possible, and have a reasonable device lock screen (and keep an eye on my physical devices). 10/n
  1. …in reply to @rene_mobile
    Doing that only during time spent at security conferences but not otherwise would be foolish. Attacks can happen anywhere, especially when you are a potentially exposed target. Just use proper IT security hygiene, and you don't have to be afraid of #BHUSA2018/#DEFCON26. 11/11