8 Winn Schwartau "I began hacking in 1958 and then survived Rock 'n' Roll"

### Overview In this presentation delivered at CornCon, cybersecurity author and speaker Winn Schwartau recounts his early life as a self-taught hardware hacker, phone phreak, and audio engineer, demonstrating how lessons learned from surviving high-pressure live production translate directly into modern cybersecurity and incident response. Drawing on his non-traditional path into tech—from childhood electronics repairs in the 1950s to sound engineering for live broadcasts and iconic music tours—Schwartau argues that understanding complex systems, thinking creatively, and planning for Murphy's Law are foundational skills for cyber professionals.

### Key Topics - **Early Hacking and Phone Phreaking:** Early experiences building circuits, repairing vacuum-tube televisions, tapping rotary phone stepper relays by tapping the switchhook, and using card strips and pennies in payphones to bypass billing systems. - **Repurposing Telecom Infrastructure:** Utilizing discarded AT&T equipment from dumpsters ("midnight hustle") and vintage stepper relays to engineer studio routing networks and avoid prohibitive telecom transmission line costs. - **Live Production Incident Response:** The unforgiving mandate of live entertainment ("The show must go on"), where zero downtime is tolerated and catastrophic failures must be addressed in real time. - **Power, Synchronization, and Cascading Failures:** Managing power limits, grid fluctuation, generator testing failures, and audio/video sync drift. - **Architectural Resilience:** Emphasizing graceful degradation, avoiding unnecessary tech stack bloat, and conducting aggressive stress testing.

### Technical Details Schwartau shares several historical and technical case studies illustrating systemic vulnerability and recovery: - **Stepper Relays and Payphones:** Manipulating rotary pulse stepping by manually clicking switchhooks 10 times to reach operators, as well as exploiting coin chute dimensions using cardboard strips and pennies in payphone coin mechanisms. - **Utility Billing Exploits:** Modifying Hollerith punch cards with NYU computer lab equipment by punching a negative sign into blank fields, turning utility balances into refunds. - **Power Grid Collapse and Incident Response:** At a concert in Kingston, Jamaica, with Stevie Wonder and Bob Marley, an overloaded pole transformer was kept functional by a roadie discharging CO2 fire extinguishers directly onto it. In New York during the 1977 blackout, frequency drift off the standard 60 Hz line signaled impending grid collapse. - **Synchronization and Automation:** Synchronizing multi-track tape machines using 60 Hz pilotone signals via manual adjustments of synchronous hysteresis motors when phase lock loops were not yet standard. - **Ground Loops and Crosstalk:** Addressing severe ground loop interference during a live 40-track Charlie Daniels recording session at Madison Square Garden through aggressive EQ and dynamic compression. - **Failsafe Workarounds and Tape Loops:** Bypassing a burning console power supply during an advertising recording session using eight chained 4-input submixers, and instantly recovering from an abandoned live radio broadcast by rewinding and replaying the first half of a backup two-track tape.

### Takeaways - **Power is Foundational:** Power cannot be assumed to be continuous. Organizations must not only procure backup generators and batteries but rigorously test them under load (e.g., ensuring generators have oil and operational fluids). - **Design for Graceful Degradation:** Rather than reflexively shutting down entire environments during an outage or breach, design architectures that isolate failed components while preserving core mission-critical functionality. - **Complexity Breeds Failure:** Indiscriminately adding security products can introduce network congestion and latency, worsening performance rather than enhancing protection. - **Stress-Test Unconventional Scenarios:** Hardware and software must be tested at both minimum and maximum limits, as well as edge-case configurations that seem counterintuitive, because real-world operations will inevitably trigger unexpected conditions. - **Interdisciplinary Systems Thinking:** Deep specialization in individual protocols (like TCP/IP) is insufficient without a holistic understanding of how interconnected systems fail.