NDH2K12 - Interviews NoWatch

### Overview Recorded at the Hotel New York Convention Center near Disneyland for the 10th anniversary edition of Nuit Du Hack (NDH 2012), this special NoWatch coverage hosted by Florent, Corben, and Manu captures the atmosphere, technical talks, and interactive workshops of the 24-hour event. The event combined day conferences, hands-on maker workshops, lockpicking, and an overnight attack/defense Capture The Flag (CTF) competition whose top finisher earned pre-qualification for the DEF CON CTF in Las Vegas.

### Key Topics - **NDH 10th Anniversary and Organization**: Freeman, one of the event organizers and technical director at Sysdream/Hackerzvoice, discussed the history, infrastructure rebuilding, and a tribute room (the Crash Party) dedicated to founder Crash Polo. - **Paris Metro Ticket Security**: Damien (Virtuallabs) detailed research into the magnetic stripe data on Paris region transit tickets, showing that magnetic data could be analyzed, erased, and reset. - **Social Engineering and Psychology**: Chris (author of *Social Engineering: The Human Hacking* and founder of social-engineer.org) discussed how social engineers penetrate corporate environments via psychological manipulation and influence rather than purely technical exploits. - **Quantum and Algorithmic Cryptography**: Roberta, research professor and scientific director at ESIEA, evaluated the realities and physical constraints of quantum computing versus classical computing, algorithmic complexity, and denial-of-service attack costs. - **Mobile Security and Hygiene**: Tris shared personal anecdotes on iPhone data recovery, risks related to Wi-Fi/Bluetooth scanning, geolocation metadata in photos, and improper data wiping on resold devices. - **SCADA and Industrial Control Systems**: Arthur Gervet discussed supervisory control and data acquisition (SCADA) systems and programmable logic controllers (PLCs), addressing vulnerabilities, misconceptions about system isolation, and bug bounty/security consulting. - **OpenBTS and Cellular Interception**: Youssef presented a workshop demonstrating a DIY GSM base transceiver station (mini BTS) using OpenBTS, showing how a rogue station can intercept cellular calls, eavesdrop on audio, and clone SIM cards. - **Cyber Warfare and Recruiting**: Winn Schwartau, author of *Information Warfare*, addressed government talent shortages in cybersecurity, state-sponsored cyber warfare (including references to China, Russia, Stuxnet, and Flame), and espionage between allied nations.

### Technical Details - **CTF Architecture**: Each participating international team defended an assigned server behind a firewall while attacking rivals to capture flags across networking, system administration, reverse engineering, and penetration testing. - **Transit Ticketing**: Reading and decoding magnetic stripe tracks using techniques previously published by the Chaos Computer Club (CCC) showed the potential to rewrite magnetic data without modifying back-end systems. - **Mobile Base Station (OpenBTS)**: A software-defined radio mini BTS configured with custom software forced nearby handsets to connect automatically to the strongest signal, enabling call rerouting, wiretapping, SMS spoofing, and SIM card duplication using PIC microcontrollers. - **Algorithmic Complexity & Denial-of-Service**: Flaws in scripting environments like PHP or hash complexity handling could allow minimal computing power to crash large numbers of servers cheaply.

### Takeaways The interviews emphasize that security transcends purely virtual barriers, spanning physical infrastructure (SCADA), human behavior (social engineering), wireless protocols (GSM, Wi-Fi, Bluetooth), and strategic national policy. Additionally, defense requires moving past obsolete assumptions like air-gapping, rethinking rigid hiring filters for security talent, and maintaining rigorous personal data hygiene.