[Music]
everyone
this is my first defcon but i'm not a
youngling so please don't be gentle
i need to touch a frying pan at least
twice to confirm it's hot
the second time to confirm that the
first wasn't a trick or an illusion
i'm gonna be totally blunt about
something right now
there is zero new information in this
talk
none at all killer intro right
well at one point in history clocks were
a very commonplace item
bells were also a very commonplace item
someone eventually
put a bell on a clock and the modern
alarm clock emerged
nothing new suddenly as common folks are
able to wake up on time for our lives
the jury is still out whether that was a
net benefit to humanity or not
but you can't argue that it's an
extremely useful artifact to come
come from combining two household items
but today i want to talk to you about
some creative munching
there are incredibly gnarly see i'm not
young
instances of innovation by combination
throughout history
at one point someone wondered why we
push around pineapples and bags of flour
and grocery store and wheeled buggies
like royalty
but we carry our equally heavy or
heavier suitcases while traveling
and now it's hard to find a suitcase
without wheels recently
really smart people have basically
combined wifi and cellular tech to give
us 5g
going back a lot further in the 1400s a
german hacker
named johannes gutenberg probably
unrelated to our founder leonard coopman
but
we'll just assume the hacking community
in germany is pretty tight so they're
probably descendants or time travel
buddies or something
anyway 600 years ago german hacker
combined a coin punch device with the
concept
of setting type from a winepress machine
and this led to the mechanical printing
press this means humanity went from
printing 40 pages a day by hand copying
exactly only a few pages per day
so now we're capable of 3 600 pages per
day the dawn of the information
age back then when you can print a book
at
speed at scale obviously you print the
bible
the rest of that story is actually
pretty fascinating as well so like any
good
researcher he disclosed his year 1450
zero day mechanical printing press
thought exploit bible churning machine
and his investors took over the company
and nose-dived it
to the ground they even brought him back
on board like halfway through that nose
dive just to make sure he was also
financially wrecked so yeah cool tech
vc's flocked in everyone gets high on
the smell of money
they come down harshly from that high
and now there's no cool tech anymore
clearly this move wasn't invented in the
valley crappy ending for gutenberg but a
cool story either way so we got the
printing press
innovation through confirmation has been
a really cool part of our technical
history
i just said hour and i haven't even
mentioned who i am
hi my name is abe i am in charge of
making sure that everyone has a good
time with greylog after they've joined
the greylog family
in other words i run the training
department i wasn't always just a
meat-based instructional video though
i've actually been in cyber security for
quite a while now
i got my start in the 90s the same way
that most people did
with an internet connection a gross
underestimation of authority and a
misspent youth
i'm always so glad my mom kept newspaper
clippings
you know pixar didn't happen right so as
i grew up those exact character traits
led to a segment of organized crime
a very particular branch of organized
crime where i did some cyber insecurity
things for big brother
really though it's it's canadian big
brother so it's really charming with
above average quality of music
after that i worked in i.t and
operations for another government entity
local government
than in true i.t fashion as we always
plan for our senior engineers and
analysts getting hit by a bus
but in reality they get hit by a better
offer so it was my turn to get hit and
here i am
i'll let the young and hungry keep their
pagers or slack dms or whatever you
carry now for late night operations
calls
i'll build terrible power points like a
proper manager talk me down on the
socials if you have any questions about
my history that you want me to ignore or
to send me memes memes days muse for
games memes for days
led the internet okay i'm off track
again hi i'm abe from graylog i'm the
trainer there
there enough introductions
i've titled this talk log jamming log
jamming means a couple different things
first it's a bunch of logs jammed
together literally
since i work for a software company that
earns revenue
when you send in more logs yep go ahead
and literally send them all until it's
jammed and we'll figure it out and make
it bigger
second it means an impasse or a deadlock
in other words you've encountered a
situation that simply can't be overcome
in the famous words of walt disney it's
kind of fun to do the impossible
well we're not going to do the
impossible today but so we'll walk it
back to another quote this one's from
steve jobs
creativity is just connecting things
in our case we're going to use log
jamming to overcome
our log jamming this talk is breaking
down some of the highlight reel over my
last few years
dealing with security analytics
platforms centralized event management
i'm going to reiterate the challenge of
this talk to show you stuff without
really showing you anything new or
groundbreaking at all
just different uses of old i'll start
with my first tale it's one of my
favorite tales actually
sadly it's a project and the project
kind of fell apart for sort of unrelated
lawyering reasons
and the motivated entities on both sides
parted ways but the good bits are what
i'll focus on
so the backdrop a former employer had a
program called teaching cities
part of a much larger provincial or
federal initiative incurring
encouraging local government bodies to
enable
their local government things to be used
helping academics in the future
generations
in other words the school kids get their
hands dirty great initiative i think
it's super
mega cool engineering students go out
and do their engineers
sorcery on wastewater management or
civil construction projects etc
there's a technical university with a
really solid future leaning reputation
in the same city as
my former employer this particular
school has quite a blossoming security
program
actually set of programs at a variety of
levels associates bachelors masters
whatever
you can go get your degree and hack the
planetology and do your thesis
on on cracking gibsons or you know
nerdery ah
ahs on a loop whatever happens behind
the curtains i haven't gone so
so we have teaching cities encouraging
the use of city resources and a hacker
school across town
this sounds awesome the institution
approached us with the idea of putting
some dirty rusty old
box on the outer edge of our network and
and seeing if if they can come at it
cool concept but a single made dupont
server just sounds boring right
ctf with a single flag come on it was
very little work but had very little
gain i'm a much bigger fan of like the
train like you fight model
so my response was hey university
institution people
why don't you just poke around our
perimeter network use the public ip
space and in exchange for this
program and this relationship staying
alive give me a report on anything you
find
basically it's like using interns in a
bug bounty program
anyone who smashes through a perimeter
during an introductory university level
hacker course
is a person that we should be handing a
job offer to
my first pitch was met with resistance
actually a hilarious amount of
resistance like
bug bound user and established practice
abusing interns is an established
practice
i mean they even get paid in exposure or
whatever we call nothing tokens these
days
bug bounties exist internships exist but
nope we absolutely cannot use interns in
our bug bounty program
so let me get this straight we let
inexperienced
untrained university students build
bridges over water and expand gas lines
and run
full ecological maintenance cycles on
forests and park lands
but letting them poke at a segmented web
server is too risky huh
what because cyber and no one knows what
we do here
fair enough we've all been there so
myself a couple of the profs some of the
teaching cities folks anyway we all
listened to the concerns addressed them
like adults and got underway
the first run of the program went
exactly like this like the point is the
proof of concept my phone rings at my
desk one random afternoon
and i'll i'll put on my prop at prop
okay group one is going to run a basic
vulnerability scan
cool all right i'll watch the logs
oh i see it i see it oh oh no never mind
that's just some
some you know internet wide scanner in
france
oh i see it now i see no nope that's
that shady printer and accounting that
port scans the lan every time it prints
for some reason
hang on
oh there oh no that's that's not it
either
and then i promptly forgot what i was
working on and walked away into a
meeting sorry group one
later on that day phone rings profit oh
i guess we lost you group
two is going to go now ah excellent yeah
let's do this i'm watching the logs oh
group 2 isn't
quite ready yet okay waiting they're
having issues running their 8th and 9th
windows server vm on this refurbished
chromebook
okay i know this time i walked away on
purpose
bone rings again later we'll get it
sorted for group three yeah sorry dude
it's coffee time i'm out
no work on break time you get the idea
from like my crystal clear
acting like crystal clear acting so like
hollywood if you're watching i'll stand
in for the rock or jason mamoa whatever
you need
but uh the summary of this initial
experiment there were technical
limitations on
on mostly on the college student side
with equipment difficulties and
networking difficulties from time to
time
the occasional disinterested student
group and really what
like the ultimate way on the project was
that it turned into a huge time
commitment on my end
for what was largely a pet project so
i had actual things to manage and actual
security stuff to do
so this was not going to keep the higher
ups at the office happy for very long
this needed to improve
i actually kind of you know sitting back
and doing like a problem analysis i saw
two big problems with this
one i was the broker for the actual
information they needed this meant i was
basically stuck
sitting there being a live analyst as i
was the one with the access to the log
data and could interpret it
so i could potentially expose the entire
stream of log data to the classroom or
whatever but that would probably have
some pretty far-reaching and
obvious information concerns second
i need to actually isolate the campus
data you know the from the the public
scanner from france or whatever i need
to i need to
keep those people out and separate in
one way or another so i wasn't doing
analysis on the entire public internet
while trying to give them feedback and
when i say all of this
most of the people watching this video
from defcon there's a ton of noise on an
internet-facing system even at just the
firewall level
and 20 of that noise is probably from
people attending these talks right now
more than half of that being actual
exploitation definitely coming from
people
at this event anyway the uh you all
caused that noise the hackers ruined my
day
at least when i was a fed or a
rent-a-cop version of a fed silly
hackers
so i needed to conjure up the relevant
data
and separate it from the fluff and i
needed to communicate that effectively
and
preferably asynchronously to my own life
and and commitments
in other words i needed to automate that
shiz
the problem one was kind of half solved
with something as easy as a slack
channel so that's halfway through
problem one
easy enough now i can ignore boring
actual work meetings and you know
chat away to cool baby call it hacker
college kids so we're halfway through
problem one with this little slack
channel
cool problem two is a bit trickier the
solution was largely made possible
actually by cleverly abusing
scheduled policies on a firewall or
gates before you ask
most utms have the ability to schedule
policy rules
if they don't cron and ssh can step in
but most do
especially large sized you know
perimeter gear so i used schedule
policies to just
crank up the logging and schedule a
window for the students
i could dial the logging up to 11 i
could narrow it into you know either geo
band or whatever
dial that all up to 11. this meant i
didn't actually have to use any specific
wan ips either
they could simply work from wherever
just do it between 7 and 9 pm or
whatever
so another added benefit was having
specific policy numbers now
so with that new scheduled policy i now
have you know rule number 510
rule number 512 or rule 500 through 600
which makes searching through the noise
data a lot quicker and a lot easier
basically the firewall itself is
tattooing the relevant data for me just
with that policy number
that's fantastic so now i've got policy
numbers it can actually trigger the
logic and eventually at auto
communication so simple alerts based on
hitting those new schedule policies
really cleaned it up it also kind of
helped them see
if if there was internet mess mixed in
there as soon as i was communicating to
the slack channel as well they could see
what they're up against you were trying
something that people are trying
every five minutes think a little wider
than that right
so feeding even the the generic noise
back into the channel during their
scheduled window help them really see
what noise looked like so if they wanted
to either look like noise
or be completely different than the
stuff that's already got a lot of rules
against it
they have that feedback now so this
shiny new scheduled traffic all flowed
through a
totally non-denominational vendor
agnostic
monochromatic blank box product of
course
actually wait no we're a sponsor right
now we're a sponsor okay screw that this
all went through greylock
it all went through gray log super easy
parsing engine
simple and effective event engine and
great output logic like slack
notifications
so after the first run with live ips av
and firewall event data all being dumped
into the slack channel just the utm
rules
adding new logic fine tuning granularity
it blew up
so fast it was crazy within a few more
weekly sessions we had
the spam filter logs for phishing
simulation including a link clicking
sandbox that the students actually built
which is super cool
if i remember right it was some sort of
imap voodoo running into cuckoo
all spun out of containers but i could
easily be screwing that up
anyway they had an auto link clicking
thing that we ran and if they sent in
links it would click on it and we could
see how the rest of it
played out which is cool we actually got
a lot of really good intelligence out of
that
we eventually also had a one-to-one
replica of a production platform that
allowed an authenticated file upload
so all feeding their locks so you know
if they're uploading a whole bunch of
shady.js files or whatever
that php and we could see that putting
all these various layers in the gray log
being parlayed back to the students
themselves as they're trying the
exploits
we could even indeed you know we'd
simulate it at times oh you got the ban
for an hour you got the ban for an hour
great
or 30 days that's a nasty one you
triggered the ips on a critical that's
stop halt and i never did we have any
any issues
so parliament back to the students
as they were trying it i mean the more i
thought about it later and as kind of
times gone by the more we realized we're
basically describing
more or less the automated feedlot back
loop from purple team exercises
except done in a way that i felt most
comfortable myself
in other words it was done completely
unprofessionally and totally hacked
together but it was awesome
lots of fun with the college kids so
that was my first adventure that i
wanted to bring up nothing earth
shattering technique technique-wise
but rather than throwing hands in the
air and giving up at our log jam
see the loopback we methodically
attacked the root of our problems and
blended the solution together
scheduled firewall policies made for
straightforward alert logic
into a chat program for feedback this
actually made for a really fun poc for
baby hackers
no idea where this project is now but
hopefully someone found my shoddy
documentation blew the dust off and
tried again
baby hacker school so i've never before
never seen since
scheduled policies abused that way
outside of maintenance windows or
internet restricted machines or blocking
internet hours because
someone works a late night shift and
likes to abuse the internet anyway
so that was uh that was that was old
tech used in a new way
speaking of internet abuse however story
number two
once upon a time in a land far far away
i worked for an organization that was
building a large equipment
operation depot the building was all
done
but nobody was really working in it yet
we went in and suited up a bunch of
at the time state of the art wi-fi it
was
going to be so exciting these particular
aps had
all kinds of cool tech it was the first
you know walkabout
roaming ap to ap wi-fi uh where you can
go one to the next without dropping
connection that i had been part of
deploying
it was the first one that i'd been on
that had you know heat maps density maps
from estimated foot traffic et cetera it
was cool
and speaking of bells and whistles these
aps had some pretty groovy security tech
baked into them
now caveat i believe this particular
protection has been patched out for a
couple of reasons but
i won't name and blame the vendor do
your googling you'll find it from the
story
anyway there was this really cool
security protection against evil twin
attacks it got our attention
how do you protect against that we
didn't know what it was or how it worked
or anything it was just two check boxes
evil twin attack detection
and evil twin attack protection or
prevention
i think it said even said beta or you
know this feature is incomplete and
dangerous or something anyway
we rolled it out since this building was
kind of far like
geographically far from us we were doing
everything remotely
but it couldn't shake like what does
this actually do out of my head
so we remotely activated some laptop and
a dock and and played with its wi-fi to
broadcast
a network with the same name you know
basically simulating actually
technically doing an evil twin attack
so that's what we're working on
it should have been like like an easy
detection right like
no but nothing like we got nothing
nothing came out of that
there was no cool evil twin protection
no
logs even showing the detection no like
tiny
cannons popping out of the access point
or flamethrowers
no bill murray riding a dinosaur that
shot lasers out of his eyes nothing like
total bomber dad it was just ah we were
so disheartened
anyway most people would let that go but
like i had to know like the checkbox is
here somebody deved this
i want to see what they deved and what
it does so i jumped in a car
we drove down there let's see this thing
in action there's a knob that seems
irrelevant i'm
all for thoroughly testing it on company
time way over scope of the project
so we walked around broadcasting our
wi-fi range nothing not a thing
no idea why maybe it was propagation
time who knows
whatever we did nothing worked oh well
evil twin protection wasn't
actually in the deployment scope as i
kept getting reminded so
i had to give up and walk away we did
packed up went home
exhaustingly we were eventually able to
trigger the detection
pretty much by using a few other
commercial aps and and the evil twin
protection
was simply cranking the antenna power
out of any ap
that detects the malicious ssid to 11 or
whatever max power
is for for a configurable amount of time
so in other words you
you have your wi-fi named super ultimate
hacker
and you set up an ssid called super
ultimate hacker the ap is to detect that
just just
crank their juice to 11 for 3 600
seconds or whatever it is
so that's all it was an hour or two was
the default it was boring
and nothing space space-age at all i
really wanted tiny cannons out of the
access point
anyway as with any test that led us to
complete disappointment
we literally packed up our gear left it
enabled and didn't turn it off who cares
it's boring anyway
well it does do something so a few days
later
our test alarms light up like christmas
tree about an evil twin attack
yes awesome it's not even one of our
test systems
this is a legit real hacker in our
parking lot
yeah the entire security team is feeling
like a
badass level somewhere between hackers
and sons of anarchy right now
someone is going down and we are the
super humans that are causing this
i don't think anyone really stepped back
and thought too deeply
about how much energy we're putting into
an alarm that we couldn't even manually
trigger on the test day
but uh that's not really important right
now we have a live hacker on the hook
we dove into those logs head first with
furious faces
and started looking around we quickly
learned a few key pieces of information
first the mac address was not a
well-known vendor address
it was an actual known vendor just none
of us recognized the name it was in the
thing we're just what is that second
the ap in the parking lot had the
greatest signal strength by far
with the next two being roughly equal in
other words our macgyver
super ultra genius napkin math
triangulation
told us that the hacker should be out in
the parking lot so
it's most likely at this point a nation
state team in a series of black panel
vans
the special forces strike force all
around us in the bushes and along the
neighboring fence line
it's a privacy fence so this is entirely
possible they could just come
tenth mountain over the hill in tanks or
whatever probably north korea russia and
china all charging over the fence at the
same time to attack our parking lot for
some reason at least our wi-fi
we detected an evil twin attack what
other scenarios could there possibly be
we eventually remembered in all of our
excitement that we actually have
security cameras
so we pulled them up and as it's loading
we're all waiting we're all waiting
looking at the parking lot you wouldn't
believe what we saw
you ready nothing
not a single vehicle no black van no
special forces team
literally straight up 100 nothing
completely barebones empty parking lot
an empty stretch of concrete
we actually saw the same protection pop
on and off a few times over the stretch
of an hour or two
that was it never a vehicle showed up
so a small team of security and i.t
operation nerds
put their tails between their legs and
went home that night
with completely broken hearts i'm sure
there was at least one pair
of superhero pajamas worn to bed just to
feel better
well redemption was still possible
about three times three days later the
alert
occurred again this time plot twist
parking lot wasn't empty however
after driving around doing some range
checks some strength testing we
confirmed this evil twin attack
had to happen within the area of the
parking lot at least
within a couple feet of the area of the
parking lot it was empty on the screen
every time
or verifiably not belonging to one of
the vehicles in the parking lot
we were complex totally complexed we did
have one new piece of information though
the mac address was the same vendor id
but a different mac
the same weird vendor well we got that
alarm a day or two later
and then again and then again one more
time
so now we're nowhere near as excited but
we've just kind of you know still
telling all of our friends and family
that we have an ultra patient
you know apt-level mac address spoofing
campaign going on
but these international criminal
supervillain spies
were not going to outsmart us
one of our group had the genius idea of
seeing if we've ever seen this mac
address or vendor before
we actually have that vendor ids popped
up at one or two other sites
occasionally
in these other instances though the mac
address didn't change
same device had a history of
occasionally connecting to our public
wi-fi
now just to remind this is a public
wi-fi network
that spans across one of the larger
cities in canada so it's not a tiny
network
we had no idea what these devices did
and still no idea what it was
the nature of our logging infrastructure
meant we didn't have records of what
traffic these devices were generating
when they connected
none of them were recent enough for that
logging the ips were all long recycled
other devices
another interesting note these devices
the ones that we had previously seen
hadn't connected in months this is
springtime so that actually becomes an
important fact of the story
we enabled some pretty detailed layer 2
logging and filtered it down for that
particular vendor id across our whole
infrastructure
now remember not everyone's from network
operations but remember if you're
running a homogeneous network is in
everything from the same brand and
product line which really
nobody is then it's actually a pretty
big challenge unless you're doing that
then it's actually a pretty big
challenge
to monitor traffic from layer two filter
in other words you know
a specific series of mac addresses
on to what actual traffic they're
they're doing what is what is the actual
traffic
they're generating web traffic or h you
know api whatever else it is
we can do packet capture which is
ungodly expensive resource wise
or we can use a netflow variant which is
spotty at best that's
sampling we wanted to know the traffic
being caused by a specific
brand of network card in the end we
finally had it we tagged
the dhcp logs and added some additional
information so we pulled a lot of stuff
off our wi-fi controller
add a little bit to kind of generate our
own sessions
and then tagging those sessions from the
first level of nat device so as soon as
they go from you know
one brand of wi-fi controller across a
router you've now lost that mac address
information which is what makes this
challenging you've now lost that so we
had to kind of give them a fake session
that carried over to the next set of
logs hey if you've seen this session add
it again
great and uh
so we were able to carry that on so we
now have traffic logs the traffic
from these highly advanced adversaries
when we finally got it when we finally
got it
we couldn't believe it the traffic
was to i don't remember the exact url
but something along the lines of
api.webersmartgrilling.com
our enemy that was gonna roll over in
tanks
was a handful of smart barbecues
our nation-state level threat actor was
a tool used to not
burn chicken given how much we had hyped
up this whole thing in our heads it was
definitely a solid laugh cry moment
followed by days of uncontrollable
giggling like because seriously we had
this hyped up in the office it was
pretty good
we were all pretty convinced we were
going to completely uncover some huge
like like the illuminati at the least
nope
nope completely overpriced hot dog
cooking tech had us baffled for weeks
the rest of the pieces started instantly
making sense other folks
who lived close enough to our facilities
to leach free wi-fi
simply hadn't uh uh simply hadn't
barbecued yet this season
and and now that we had all the we did
have one piece of the mystery left to
solve though
this all started with an evil twin
detection on our access points
that means someone publishing our wi-fi
name on their device
i mean now we're kind of we've narrowed
it down to someone publishing our wi-fi
name on a
freaking barbecue but we actually went
as far as using our security camera
zoomed all the way in to find the right
brand of barbecue in the nearby backyard
because you'd see it from the top of our
building over the fence
so we politely knocked on the door and
explained our situation
the particular barbecue user found the
whole story
side-splitting hilarious we asked them
you know how are they configuring their
barbecue
after assuring them we're not pulling
the plug on your free internet continue
to reach
leech-free wi-fi we barely scratch our
bandwidth capabilities we just wanted to
know what happened
so it turns out some of the variants of
the smart barbecue
act an awful lot like a chromecast they
can both connect to wi-fi
and use cloud services to push your
grill notifications back and forth
or they can be configured kind of
non-cloudy as a local wi-fi ap
so this particular user decided to name
their local barbecue wi-fi
with the same network name as our public
wi-fi
so they didn't have to switch their
phone settings back and forth they could
just sit near the barbecue and it should
work that was the thought in their head
whenever they tried setting that up they
then complained that this actually
screwed up the wi-fi all over their
house
all of their devices went completely
haywire so they would take the
motherboard of their barbecue back to
the hardware store and get a replacement
for another
changing mac addresses so we've now
narrowed down why we had changing mac
addresses and the evil twin attack
tried it several more times until
eventually gave up and just gave it a
proper local name
and and away it went so we never saw
them again
and then some folks from the city
started knocking on their door asking
about their smart barbecue so
ah that was that was the fun one
they're uh their potentially clever way
of of just not having to switch your
phone's wi-fi it didn't
didn't quite work but the moral of the
story is leeching public wi-fi for your
barbecue
might end up with advanced persistent
civil servants knocking on your door
asking questions
so to summarize we combine dhcp logs to
summarize the tech at least
we combine dhcp logs to not device logs
to weapon web traffic and dns logs to
make
uh it took some pretty serious finesse
to get those all talking to each other
but it was it was doable
and eventually were able to filter on
vendor mac ids and uh
and any other aspect of that change is
totally possible
albeit if you wanted to drastically cut
down on some time and effort in doing it
in gray log
you'll want the mongodb lookup table so
if you're small scale check out the
small business or
or or upgrade if you're doing this at
the office so anyway
that was uh that was one that was uh
that was a big case for how
how before i got to greylock i we ended
up on enterprise
on my last tale now this one isn't even
so much as a tail
as an entire category of fun shenanigans
this concept actually came from a
portion of the greylock analyst class
where i asked
guests to just tell me stories like the
ones i've told you now
one of the better ones by far was a
fellow
who really enjoyed playing tricks on his
relatively non-techie family
so this last story is a pretty simple
premise
when you have a security analytics
platform
that can also execute code in other
words one of the event notifications for
greylog is
running a script we have a security
analytics platform that can also execute
code run that script
you now have something that can monitor
for events
then take actions the scripting part
allows you to take any action what this
means
is you actually have a giant if this
than that engine when something happens
do something else the world is your
oyster
and this is how we abuse oysters this
particularly shifty student
had his usual home network monitoring
going on
it was actually just syslog from a
really boring you know commercial
wi-fi router he started parsing the
syslog events at one point and tagging
the dhcp records with the owner of the
devices
we started building up a bit of an
impromptu active asset management system
so when the kids will call them phoenix
and phalanx
or whatever their names were came home
he had a field he added a field to the
log saying
phoenix apple watch or phalanx's xbox
most of this stuff is kind of in there
unless they've renamed it something
silly
at one point or another he was trying to
build a bit of a
digital notification system a vendor
agnostic version
of the zoom attendee announcement kyle
has joined the meeting
but instead being balance has
entered the building that was the end
goal
while testing it out across his you know
sono system or google speaker group
whatever it was i believe his with sonos
he used some sample mp3 files before
working on the text to speak
speech component so you use these
sample mp3s you just kind of grabbed and
used this as part of it instead
it never made it to the text-to-speech
phase
he happened to choose some sample mp3s
that kind of
randomly match the personalities of his
family members
he by total accident using his log
management tool
a python script and some household tech
gave his entire family
wrestling style anthems
[Music]
[Applause]
[Music]
[Applause]
when they walked in the door and their
device is connected to the wi-fi
how perfect is that
no i don't want to simply regurgitate
someone else's story
so i obviously had to set up some poc
for this myself
great scot this was fun
check out my test sample video
my kids are really weird
now unfortunately due to calendar
getting snafus i had to ship this talk
before i could see this
all the way through to my end goal of
every time the word
minecraft was googled in my house
play this sample video on every tv
i did however get the latter part going
without any issue and so
and evil even able to run persistently
through the house
so here it is pleasantly interrupting an
unsuspecting
innocent child who was politely asked to
lower the volume
on their youtube videos several times
now they get some geek dad wrath
movie file set up properly hopefully
that worked it's a one-liner
we're serving it up just python http
server
and behind my lovely face is the folder
so
there we go already set it up let's see
what we got when we run it
quick hijack of the chromecast
[Laughter]
if that isn't modern day parenting at
its finest
i don't know what is i wish i had more
time
and that we could talk about stories
like this all day
one more time i'm abe find me posting
nonsense on twitter linkedin github you
can follow me
at big ab20 follow at greylog for
awesome stuff
big thanks to everyone at blue team
village
more shout outs to everyone at def con
29 you've put on a really awesome show
this year
despite the um learning opportunities
see always a manager and thanks to my
team at greylog for always moving the
finish line and making a great tool
last and most important thanks for
checking out my talk and staying right
to the end i will see you
all around enjoy devcon