Panel

### Evolution of the DEF CON Fail Panel Moderated by Larry Pesce, this session resurrects the tradition of the DEF CON "Fail Panel" under the moniker of the DEF CON Comedy Inception. Bringing together security practitioners Dan Tentler, Amanda Berlin, Chris Sistrunk, Chris Blow, and Bill Genovese ("Ill Will"), the panel uses satire, humor, and real-world penetration testing anecdotes to critique systemic vulnerabilities, sloppy enterprise deployments, and the security industry's penchant for hype. Rather than demonstrating polished zero-day exploits, the panelists highlight the absurd realities discovered during day-to-day assessments and mass internet scans.

### Exposing the Internet of Unauthenticated Things Dan Tentler details extensive findings from Shodan and automated banner-grabbing scans, illustrating the sheer volume of high-risk enterprise and consumer systems left completely exposed to the public internet without authentication: - **Direct VNC and RDP Desktops:** Open remote desktop instances allowing anyone on the internet to view active workstations, day-trading screens, and internal management consoles in real time. - **Industrial and Commercial Monitoring:** Webcams, digital hotel lobby directories, internet-connected digital signage, and building HVAC interfaces operating with default or nonexistent credentials. - **Unsecured Diagnostic Tools:** Online bandwidth load testers and network performance probes configured in ways that allow arbitrary remote users to initiate denial-of-service floods against third parties.

### Industrial Control and Infrastructure Oddities Chris Sistrunk and panelists explore cyber-physical security failures in critical infrastructure and SCADA operations: - **Internet-Facing Dairy and Agricultural Automation:** Real-world examples of automated cattle milking facilities, manure separators, and processing plants directly connected to public IP addresses with default admin passwords. - **Elevator and Traffic Controls:** Exposed elevator management software and municipal traffic management consoles left reachable from web browsers, highlighting the dangerous disconnect between operational technology (OT) reliability requirements and basic internet hygiene. - **Honeypot Shenanigans:** Leaving open VNC sessions with interactive Notepad windows running on honeypot servers, observing script kiddies paste entire shell commands and pre-scripted exploit payloads blindly into text editors without verifying host architectures.

### Physical Security and Social Engineering Misadventures Amanda Berlin, Chris Blow, and Ill Will recount field experiences in red team social engineering, physical bypasses, and security awareness testing: - **Phishing Simulation Collateral:** The unpredictable psychological impact of realistic corporate phishing tests, including an incident where a simulated retail phishing email prompted an employee to cancel personal PayPal and department store credit cards out of panic. - **Physical Access Oversights:** Bypassing supposedly hardened physical security perimeters via unsecured secondary doors, unlatched loading docks, and social engineering pretexting. - **Absurd Corporate Reactions:** Management responses that prioritize public relations over remediation, opting to disguise systemic architecture flaws behind legal disclaimers rather than enforcing multi-factor authentication or network segmentation.

### Industry Absurdities and Hard Lessons The panel concludes by underscoring the serious lessons underpinning the comedy: - **Security Basics Outweigh Hype:** While conferences frequently focus on nation-state cyber capabilities and cutting-edge hardware reverse-engineering, the vast majority of real-world compromises occur through default passwords, exposed management interfaces, and missing patches. - **Empathy in Assessment:** Penetration testers must balance finding hilarious blunders with the reality that operational teams are often underfunded, undertrained, and managing legacy architectures never designed for public IP exposure.

(AI summary — Gemini 3.8 Flash)