Custom, cheap, easy, and safe badges without starting from scratch

Custom, cheap, easy, and safe badges without starting from scratch

Speakers: securelyfitz

Conference: DEF CON 32

YouTube: https://www.youtube.com/watch?v=Z6Wq1iqTyWg

Overview

In this DEF CON 32 talk, hardware hacking and reverse engineering instructor securelyfitz (Joe) introduces an open hardware badge design aimed at simplifying the creation of custom, functional, and engaging electronic badges for conferences. The core premise of his work is born from a desire for efficiency and reusability, reflecting the engineering principle of "laziness" – why reinvent the wheel when a robust, tested platform can be adapted? The talk addresses common frustrations with conference badges, such as non-functionality or the high barrier to entry for organizers and enthusiasts looking to design their own.

securelyfitz's vision is to provide a solid foundation that eliminates the need for creators to "start from scratch." His design has been rigorously tested across multiple conferences, proving its reliability and adaptability. By making the hardware open source, he empowers other conference organizers, community groups, and individual enthusiasts to easily customize the badge's artwork, integrate unique software features, or simply update the conference name, thereby fostering a more vibrant and accessible ecosystem for electronic badge development. This initiative not only democratizes badge creation but also aims to enhance the overall conference experience through interactive, hackable hardware.

The talk underscores the multifaceted importance of electronic badges in the security conference landscape. Beyond their primary function as access credentials, badges serve as powerful tools for fostering social interaction, promoting a "cool factor" that drives engagement and social media buzz, and acting as an accessible entry point into the world of hardware hacking and embedded microcontroller programming. securelyfitz champions a future where every attendee can confidently engage with a well-designed, functional badge, transforming it from a mere identifier into an educational and interactive device.

Background

▶ Watch: Open hardware badge design: avoiding starting from scratch (1:10)

The tradition of electronic badges at security conferences has evolved significantly over the years, transforming from simple identifiers into complex, interactive, and often highly collectible pieces of hardware. securelyfitz, with over a decade of experience designing such badges, highlights their critical roles: fundamental access control, a "cool factor" that generates excitement and social media presence, a catalyst for social interaction among attendees, and a tangible hardware hacking opportunity for enthusiasts of all skill levels. He recounts his early designs, such as a Bus Pirate re-shaped as a Nyan Cat for B-sides Portland ten years prior, complete with rainbow ribbon cables, and other creations for 44con and TRcon, demonstrating a long-standing commitment to innovative badge design.

Despite the proliferation of open-source badge designs, securelyfitz identifies a persistent challenge: the effort required to initiate a new badge project. Many existing open-source projects, while valuable, may still present a steep learning curve or require significant modification to fit specific conference needs, effectively forcing designers to "start from scratch" in many practical aspects. This often leads to badges that either fail to work as intended, are overly complex, or are simply not adopted due to the perceived overhead. The speaker emphasizes that a common complaint among attendees is receiving a badge that doesn't function, leading to frustration and disengagement.

His motivation stems from a personal philosophy of efficiency, articulated as "the chief virtue of an engineer is laziness." Rather than repeatedly designing new badges from the ground up, securelyfitz sought to create a foundational, reusable open hardware platform that could be easily adapted. The goal was to lower the barrier to entry for conference organizers and badge teams, allowing them to focus on unique artistic elements and interactive challenges rather than the underlying hardware reliability and basic functionality. This approach aims to address the common pitfalls of badge development, such as inadequate scheduling, manufacturing issues, and insufficient testing, by providing a proven, stable base that minimizes these risks.

Key Findings

▶ Watch: Badges' primary function: access control for conferences (2:15)

The central contribution of securelyfitz's talk is the introduction of a robust, open hardware badge design that has undergone extensive real-world testing. This design distinguishes itself by prioritizing reusability, cost-effectiveness, and ease of customization, directly addressing the challenges faced by conference organizers and badge developers. The speaker confirms that his badge platform has been successfully deployed and tested at "two conferences already" and is "going on track for a third one," providing empirical validation of its stability and functionality.

A primary finding is that a thoughtfully designed open hardware platform can drastically reduce the effort and risk associated with badge creation. By providing a proven base, creators are liberated from foundational engineering tasks, allowing them to channel their resources into unique artistic expression and interactive programming. This means conferences can differentiate their badges through custom artwork (e.g., PCB shape and silkscreen designs), implement novel software features for games or interactions, or simply rebrand the existing design with a new conference name, all without needing to re-engineer the core electronics. This modularity and ease of adaptation are critical for encouraging broader adoption and innovation within the badge community.

Furthermore, the design implicitly supports the broader goals of electronic badges: fostering social interaction and providing hardware hacking opportunities. The speaker references successful interactive badge designs like Joe Grand's previous DEF CON badge, which used near field communication (NFC) or inductive communication to facilitate attendee interaction, as an example of the desired social outcome. By providing a reliable and accessible hardware platform, securelyfitz's design encourages the development of such interactive elements, promoting networking and engagement. Crucially, it offers a tangible piece of embedded microcontroller hardware that attendees can "get their hands on," serving as an educational tool for those interested in PCB design or embedded coding. The emphasis on reliability ensures that these educational and interactive experiences are not hampered by non-functional hardware, a common frustration the speaker aims to mitigate.

Technical Deep Dive

▶ Watch: The "cool factor": showcasing past badge designs (2:45)

The technical foundation of securelyfitz's open hardware badge design centers around the RP2040 microcontroller, a choice that reflects a deliberate strategy for accessibility, performance, and cost-effectiveness. The RP2040, a dual-core ARM Cortex-M0+ processor developed by Raspberry Pi, offers a compelling balance of processing power, ample GPIO pins, and robust documentation, making it an ideal candidate for embedded projects like conference badges. Its low cost and wide availability further align with the speaker's goal of creating a "cheap, easy" solution. The dual-core architecture provides sufficient computational headroom for complex badge games, interactive displays, and various communication protocols without significant performance bottlenecks.

Beyond the core microcontroller, the design incorporates essential peripherals to enhance functionality and expandability. Flash memory is included for storing firmware, custom user data, and potentially assets for interactive badge games or challenges. This onboard storage ensures that the badge can host a wide array of applications and retain user progress or settings across power cycles.

A key feature for extensibility is the inclusion of an I2C connector. The Inter-Integrated Circuit (I2C) serial bus is a widely adopted standard for connecting low-speed peripheral devices to microcontrollers. By providing an accessible I2C port, securelyfitz's design opens up a vast ecosystem of compatible sensors, displays, real-time clocks, and other modules that can be easily integrated. This modularity allows badge designers to add specific functionalities tailored to their conference theme or badge game without needing to redesign the entire PCB. For instance, an I2C-connected OLED display could show custom messages, while an I2C accelerometer could enable motion-controlled interactions, or an I2C EEPROM could store additional persistent data. This foresight significantly enhances the reusability and adaptability of the base hardware.

The talk also mentions the incorporation of IR circuits. While specific applications are not detailed in the transcript, infrared (IR) communication is a common and versatile method for short-range wireless interaction. In a badge context, IR circuits could enable various interactive elements:

• Badge-to-badge communication: Allowing attendees to "trade" data, points, or unlock features by pointing their badges at each other.
• Environmental interaction: Badges could interact with IR beacons placed around the conference venue, triggering events, providing clues for games, or recording attendance at specific talks.
• Remote control functionality: Potentially allowing badges to control certain conference installations or displays.

The inclusion of IR adds another layer of potential for engaging and unique interactive experiences, fostering the social and game-oriented aspects that define many electronic badges.

The overarching technical philosophy is open hardware and modularity. securelyfitz explicitly states his desire for others to "just take this open hardware, change it how you want, however you want to do, just change the artwork, you can change software, you could keep it exactly the same, just like change the conference name." This implies that the design files (schematics, PCB layouts) and source code are made publicly available, enabling full transparency and community-driven development. The speaker's past experience, exemplified by the Nyan Cat Bus Pirate, showcases how a base hardware platform (the Bus Pirate) can be creatively re-imagined through custom PCB shaping and aesthetic modifications, a principle directly applicable to this new open hardware badge framework. The use of widely understood components like the RP2040 and standard interfaces like I2C further ensures that the platform is approachable for a broad audience, from seasoned hardware hackers to newcomers.

Demo / Proof of Concept

▶ Watch: Electronic badges foster interaction and community building (3:20)

While the speaker indicated that the session evolved into a talk/demo format and that he intended to "show you some software and hardware," the provided transcript primarily focuses on the conceptual and motivational aspects of the badge design. The specific details of any live demonstration, the software features showcased, or the hardware's interactive capabilities in action are not described within the transcript. The speaker did mention briefly showing the RP2040, flash memory, I2C connector, and IR circuits as components of the design, but the actual demonstration of these elements in a functional badge context is not transcribed. Therefore, specific elements of the demo or proof of concept cannot be detailed from the provided text.

Defensive Implications

▶ Watch: Badges as an opportunity for hardware hacking (3:45)

While securelyfitz's talk primarily focuses on the creation and distribution of electronic badges, rather than traditional cybersecurity defenses, it carries significant "defensive implications" for conference organizers and the broader hardware hacking community. These implications revolve around ensuring the reliability, integrity, and educational value of the badges.

Firstly, the emphasis on a tested, reusable open hardware design directly addresses the "badges that don't work" problem frequently lamented by attendees. A non-functional badge can lead to frustration, dampen attendee engagement, and reflect poorly on conference organization. By adopting a proven design like the one proposed, organizers significantly reduce the risk of hardware failures, thereby "defending" against a poor attendee experience. This reliability ensures that the badge can consistently fulfill its primary roles of access control and interactive engagement.

Secondly, the talk implicitly touches upon the integrity of badge-based games or challenges. securelyfitz mentions the importance of preventing participants from "mess[ing] with your game by giving out fake clues, which could screw everything up." This highlights the need for robust design choices that secure the badge's internal logic and communication channels. While the talk doesn't detail specific security mechanisms, the use of components like the RP2040, which supports secure boot and cryptographic features, could be leveraged to implement measures against tampering or the injection of fraudulent data in badge-to-badge interactions or interactions with venue infrastructure. For instance, challenges might require cryptographic signatures from official badge components or secure communication protocols using the IR or potential NFC capabilities, thereby "defending" the fairness and integrity of the conference experience.

From an educational standpoint, providing an accessible and hackable badge "defends" against the intimidation factor often associated with hardware hacking. By offering a platform for attendees to "get their hands on some hardware that you might not have otherwise done," the badge acts as a gateway to learning PCB design and embedded microcontroller code. This fosters a community of hardware enthusiasts and helps cultivate the next generation of security researchers who understand physical systems. The open hardware nature encourages transparency and collaborative improvement, allowing the community to collectively identify and address potential vulnerabilities in the design or its software, functioning as a form of collective defense-in-depth for the badge ecosystem itself.

Finally, the critical advice on scheduling and resource allocation ("Give yourself more time than you need. Once you've done that, give yourself even more time. Add some buffer for... manufacturing issues... an extra prototype run... testing and software and flashing") is a defensive strategy against project failure. Many badge projects face delays or compromises due to insufficient planning. By emphasizing generous buffer times, securelyfitz provides a crucial guideline for organizers to "defend" their project timeline and budget, ensuring a successful and stress-free badge rollout. This pragmatic advice is essential for translating a good technical design into a successful conference reality.

Key Takeaways

• Embrace Open Hardware for Badges: Utilize pre-existing, tested open hardware designs to streamline development and reduce the "starting from scratch" burden for conference badge creation.
• Prioritize Reusability and Customization: Design badges with modularity in mind, allowing easy modification of artwork, software, and conference branding on a stable hardware platform.
• Leverage Accessible, Powerful Microcontrollers: The RP2040 offers a cost-effective, high-performance, and well-documented core for robust and versatile badge functionalities, complemented by flash memory for storage.
• Enhance Expandability with Standard Interfaces: Incorporate common connectors like I2C to enable easy integration of diverse peripherals (sensors, displays) and IR circuits for interactive badge-to-badge or environment communication.
• Crucial Role of Badges in Conference Experience: Electronic badges are vital for access, foster social interaction, provide a "cool factor," and serve as an accessible entry point into hardware hacking and embedded programming.
• Rigorous Planning is Essential: Allocate significant buffer time for manufacturing, prototyping, testing, and software flashing to ensure project success and mitigate common pitfalls.

About the Speaker(s)

securelyfitz, known by his given name Joe, is an experienced instructor specializing in hardware hacking and reverse engineering. His passion for hardware is evident in his extensive history of designing electronic badges for various conferences, including B-sides Portland, 44con, TRcon (which evolved into the Dan initiative), and 503 party badges. His work includes notable designs like a Bus Pirate re-imagined as a Nyan Cat. Joe is a seasoned presence in the security community, frequently engaging in educational activities; prior to his DEF CON 32 talk, he had spent a week in Las Vegas conducting training sessions at Black Hat.