Every Day Carry (EDC) Showdown

Every Day Carry (EDC) Showdown

Speakers: klipper (Homelabs, MTB, and everything in between., Infosec)

Conference: SAINTCON

YouTube: https://www.youtube.com/watch?v=jQV88-xpLcc

Overview

The SAINTCON talk "Every Day Carry (EDC) Showdown" was a highly engaging and unconventional presentation that transformed a typical security conference session into a live, competitive game show. Hosted by klipper, the event pitted several infosec professionals – BP, Lean, Distinct Mind, and Dark Matter – against a series of real-world IT and security challenges, requiring them to extract solutions from their personal Everyday Carry bags. The premise highlights the often-unseen but critical preparedness of professionals in the field, showcasing the diverse, sometimes eccentric, array of tools they carry to tackle unexpected problems.

This unique format served not only as entertainment but also as a practical demonstration of problem-solving under pressure, emphasizing adaptability and the value of a well-stocked toolkit in an unpredictable environment. The challenges ranged from mundane tech issues like charging multiple devices or accessing data from an old hard drive, to more security-focused scenarios such as serialing into a network device without IPMI or gaining entry to a locked hotel room. The audience actively participated by voting on the most effective or innovative solutions, adding an interactive layer to the educational experience.

The talk underscores a fundamental aspect of the information security and IT professions: the necessity of being prepared for anything. It illuminates the "MacGyver" mentality prevalent among many practitioners, who often find themselves in situations requiring creative, on-the-spot solutions with limited resources. By revealing the contents of these meticulously curated EDC bags, the showdown provided valuable insights into the practical tools and mindset that enable professionals to navigate the complexities and emergencies of their daily work.

Background

▶ Watch: Talk start and contestants' bag weigh-in (0:00)

The concept of an Every Day Carry (EDC) kit is deeply ingrained in the culture of IT and information security professionals. Unlike the typical understanding of EDC (which often refers to personal items like wallets, keys, and phones), the infosec variant expands to include a formidable arsenal of gadgets, cables, adapters, and specialized tools. This practice stems from the inherently unpredictable nature of their work. IT infrastructure can fail at any moment, security incidents can strike without warning, and fieldwork often places professionals in environments where standard tools or readily available resources are scarce.

Historically, IT and security roles have demanded a high degree of self-reliance. From early network administrators troubleshooting coax cables in dimly lit server rooms to modern incident responders grappling with complex digital forensics in remote locations, the ability to improvise and adapt has always been paramount. This "MacGyver" ethos fosters a mindset where professionals anticipate a wide array of potential problems and proactively assemble kits designed to address them. The problem that this talk addresses is the very real scenario where a critical system is down, a network device is misbehaving, or physical access is required, and the standard "office" tools are unavailable.

Prior "work" in this domain isn't academic research but rather a communal sharing of best practices and essential gear within the IT and security communities. Online forums, social media, and conference hallway tracks are replete with discussions about "what's in your bag," specific tool recommendations, and clever hacks for common problems. This talk formalizes that informal exchange, turning it into a competitive showcase. It implicitly acknowledges that while digital tools and remote access are powerful, physical presence and the right hardware can often be the fastest or only way to resolve certain issues, especially when dealing with legacy systems, physical security bypasses, or power failures. The "Every Day Carry Showdown" serves as a public validation and celebration of this preparedness culture, offering both entertainment and practical education by demonstrating real solutions to common challenges.

Key Findings

▶ Watch: First challenge: laptop dead, outlet 12ft away (2:22)

The "Every Day Carry Showdown" revealed several fascinating insights into the practical realities and preparedness culture within the infosec community. The primary finding was the astonishing breadth and depth of tools carried by these professionals. Contestants demonstrated not just an abundance of items, but a carefully curated selection designed for maximum versatility and specific niche problem-solving. This highlighted that while some tools are universal (like USB-C testers or multi-bit screwdrivers), many professionals also carry highly specialized items tailored to their specific roles or anticipated challenges, such as full lock-picking sets or dedicated network diagnostic tools.

Another key discovery was the ingenuity and adaptability displayed in applying these tools. Contestants frequently proposed creative solutions that went beyond the obvious use case, such as using a Raspberry Pi to create a virtual USB-C interface for an A-type flash drive, or clipping a phone to a server rack for hands-free illumination. This underscored that an EDC is not just a collection of gadgets, but a reflection of a problem-solving mindset where existing tools are re-purposed to overcome unforeseen obstacles.

The talk also showcased the prevalence of certain trusted brands and tool categories. Anker power banks, GL.iNet travel routers, and iFixit repair kits were recurring items, indicating their reliability and utility among professionals. Multi-functional tools like Leathermans with bit sets were highly valued, embodying the "do-more-with-less" aspect of efficient EDC. Furthermore, the competitive nature of the showdown brought to light the sheer dedication (and sometimes obsession) of individuals like BP and Dark Matter, who carried multiple instances of critical items (e.g., four 2TB SSDs for a 2TB backup challenge) or vast collections of specialized gear.

Finally, the interactive format with audience voting underscored the communal aspect of knowledge sharing within the infosec world. The audience's appreciation for innovative solutions and their recognition of practical value demonstrated a shared understanding of the challenges faced in the field. The results, while often favoring the most comprehensive kits, also celebrated cleverness and resourcefulness, reinforcing the idea that effective problem-solving isn't just about owning the most gear, but knowing how to use it.

Technical Deep Dive

▶ Watch: Dark Matter's unique AC output power solution (4:40)

The "Every Day Carry Showdown" presented a gauntlet of practical IT and security challenges, each eliciting a range of technical solutions from the contestants' meticulously packed bags. This section delves into some of the most notable challenges and the technical approaches demonstrated.

1. Laptop Power & Extended Reach:

The first challenge involved a dead laptop and a power outlet 12 feet away. Common solutions included high-capacity Anker battery packs, with BP showcasing an upgraded 140-watt version featuring pass-through charging. Crucially, long USB-C to C cables were essential to bridge the 12-foot gap. Dark Matter offered a unique solution: an 84-watt-hour portable power station with an AC inverter output, capable of powering a Mac Mini directly, highlighting the versatility of carrying a small, airplane-compliant inverter.

2. USB-A to USB-C Connectivity:

When handed a USB-A flash drive with a USB-C-only laptop, the immediate response was typically a USB-A to USB-C dongle or adapter cable. Dark Matter, however, demonstrated a more complex but technically robust approach: plugging the USB-A drive into a Raspberry Pi, standing up a network, and using SCP (Secure Copy Protocol) to transfer data. He also mentioned using the Pi's virtual interface over USB-C, showcasing its flexibility as a network and data transfer utility.

3. Crashed Server KVM Access:

Accessing a crashed server without IPMI required physical KVM solutions. BP and Lean both presented compact, portable GLET rocket KVMs or similar "Comet" devices. Lean further surprised with an HDMI video capture card to pipe server video output into his laptop, suggesting the use of OBS (Open Broadcast Software) or VLC for streaming the display. For keyboard input, a USB dongle keyboard (with Bluetooth as a backup) was proposed, acknowledging the potential for 2.4 GHz interference in server environments.

4. Identifying Power-Only USB Cables:

The challenge of identifying and discarding "power-only" USB cables, which pose a security risk when charging devices in untrusted ports, led to the demonstration of USB-C testers. These compact devices can check power draw, data lines, and troubleshoot USB-C power ranges, allowing users to verify if a cable supports data transfer or is purely for charging.

5. Vehicle Lockout:

Beyond traditional lock-picking, modern solutions were highlighted. BP mentioned using a Tesla app on his watch for vehicle access, relying on cellular service. More controversially, the Flipper Zero was brought up, acknowledging its capability with rolling codes for some vehicles (though its effectiveness varies). Distinct Mind impressed the audience by producing actual lock picks, emphasizing basic physical security bypass tools.

6. Server Reinstallation (ISO):

For server reinstallation, several methods for mounting ISOs were shown. BP showcased an IOD (ISO-On-Demand) device, essentially a virtual CD-ROM that can mount unlimited ISOs from a storage device. Dark Matter presented a USB to NVMe enclosure, allowing direct mounting and partitioning of ISOs onto an NVMe drive for faster installation, bypassing traditional boot media. Lean offered the simple, yet effective, solution of burning an ISO to a standard USB drive.

7. Multi-Peripheral Charging:

Charging multiple devices (USB-C, Micro USB, Mini USB, Lightning) simultaneously required a collection of specialized cables and multi-port power bricks. Contestants demonstrated various multi-headed cables and MagSafe adapters for Apple devices. The challenge highlighted the need to carry a comprehensive set of charging solutions for diverse ecosystems.

8. Unracking Lab Gear:

Removing tightly screwed-in rack gear brought out robust toolkits. BP presented an absurdly comprehensive collection of ratchets, interchangeable screw heads, extensions, and even an electric screwdriver. Distinct Mind showcased a Leatherman multi-tool with a full bit set, prized for its compact versatility. Lean and others advocated for the iFixit Pro Tech Toolkit, specifically the older metal versions for durability, which are known for their precision bits and pry tools.

9. Serial Access to Network Device:

Serial console access to a misbehaving switch, especially without IPMI, demanded specialized cabling. BP had a USB-C to serial console cable. Distinct Mind showed a USB-C to Ethernet adapter but acknowledged it wouldn't directly provide serial. The discussion touched on using LLDP (Link Layer Discovery Protocol) with a standard Ethernet connection to identify switch ports, but this wouldn't provide console access.

10. SATA Data Recovery:

Recovering data from a SATA drive prompted a display of various drive adapters. BP presented a comprehensive array of IDE, SATA, Molex power adapters, and USB-A/C to SATA/SAS/M.2 cloners. Dark Matter offered a USB-C to NVMe/SATA enclosure, emphasizing its capability for both form factors and high-speed data transfer.

11. Deploying a Field Router:

For field network deployment, the GL.iNet Slate 7 travel router was a popular choice, praised for its small form factor, app/web configurability, and ability to be powered by a battery pack. Dark Matter proposed using a Raspberry Pi configured as a router with features like Pi-hole for ad blocking and OpenVPN for secure tunneling back to a home server, showcasing a more custom, powerful solution.

12. Backing up 2TB of Data:

This challenge highlighted the need for high-capacity, high-speed storage. BP literally pulled out two Samsung 2TB EVOs (SSDs), and then two more 2TB M.2 NVMe drives, asking if he should RAID them, demonstrating an overkill approach to ensure speed and redundancy. Dark Matter countered with Gen 4 NVMe drives in a USB-C enclosure, boasting 10 gigabits per second transfer speeds.

13. Identifying Switch Port:

To identify which switch port a laptop was plugged into, the Net Tool.IO device was presented, a specialized tool for network diagnostics. Alternatively, using a standard USB-C or USB Ethernet adapter with LLDP (Link Layer Discovery Protocol) was a more common, software-based solution. Humorously, the idea of "ping flooding" a port to see which one blinks (a practice not recommended in production) was also mentioned.

These challenges and solutions underscore the technical versatility and preparedness expected of IT and security professionals, demonstrating how a well-chosen EDC kit can be critical for maintaining uptime and resolving complex issues in diverse environments.

Demo / Proof of Concept

▶ Watch: Dark Matter's unconventional Raspberry Pi flash drive solution (7:00)

The entire "Every Day Carry Showdown" talk was, in essence, a live, interactive demonstration and proof of concept of extreme preparedness within the infosec community. Instead of a traditional presentation with slides detailing technical vulnerabilities or research, the format transformed the stage into a dynamic arena where contestants physically pulled out and showcased their tools in real-time.

For each challenge posed by klipper, the host, contestants would rummage through their bags, often generating comedic chaos and revealing the sheer volume of items they carried. The "demo" aspect came alive as they would hold up their chosen solution – be it a specific cable, a multi-tool, a portable KVM, or even a Flipper Zero – and briefly explain how it would address the problem. For instance, when asked to power a laptop 12 feet from an outlet, BP physically extended a long USB-C cable from his Anker power bank, demonstrating its reach. When a server needed a KVM, Lean held up his HDMI capture card, explaining how he'd stream the output to his laptop.

The proof of concept wasn't just about showing that they had the items, but how they would use them and the rationale behind their choices. The audience played a crucial role, acting as a live voting panel via QR codes and a URL, judging not just the presence of a solution but its elegance, speed, and effectiveness. This immediate feedback loop, combined with the visible act of retrieving and explaining each item, made the entire talk a compelling, practical demonstration of real-world problem-solving skills and the indispensable value of a comprehensive EDC kit. Even when a contestant didn't have the "perfect" solution, their creative improvisation (like Dark Matter's Raspberry Pi for USB-A to C) served as a powerful demo of adaptable thinking.

Defensive Implications

▶ Watch: Third challenge: crashed server, no IPMI, need KVM (8:10)

While the "Every Day Carry Showdown" was primarily an entertaining display of problem-solving and preparedness, it carries significant defensive implications for organizations and security professionals:

• Enhanced Incident Response Capability: The core takeaway is the critical importance of preparedness. Having the right physical tools immediately available can drastically reduce Mean Time To Resolution (MTTR) during an incident. Whether it's serialing into a crashed server, recovering data from a failed drive, or establishing temporary network connectivity, an effective EDC can mean the difference between minutes and hours (or even days) of downtime. Defenders should assess their teams' EDC kits for critical incident response scenarios.
• Physical Security Awareness: Several challenges, notably "Locked out of your vehicle" and "Locked out of your hotel room," highlighted tools like the Flipper Zero and professional lock-picking sets. This implicitly underscores the need for robust physical security measures. Organizations should be aware of the capabilities of these tools and implement appropriate physical controls (e.g., secure doors, advanced lock mechanisms, restricted access to sensitive areas) to prevent unauthorized access. The discussion around "power-only" USB cables also serves as a reminder of supply chain risks and the danger of untrusted peripherals.
• Tool Standardization & Training: The variety of solutions presented suggests that while individual preference plays a role, certain tools (e.g., Anker power banks, GL.iNet routers, iFixit kits, USB-C testers) are widely adopted for their utility. Organizations could benefit from standardizing certain EDC components for their IT and security teams, ensuring everyone has access to a baseline set of effective tools and is trained in their use. This fosters consistency and efficiency in field operations.
• Adaptability and Creative Problem Solving: The talk celebrated improvisation and creative use of tools. Defenders are often faced with novel attack vectors or unexpected system failures. Cultivating a mindset of adaptability and encouraging staff to think outside the box with available resources is a crucial defensive strategy, mirroring the "MacGyver" spirit of the contestants.
• Supply Chain and Trust: The casual mention of "vendor cables of unknown origin" and "power-only" USB cables highlights a subtle but important defensive implication related to supply chain security. Untrusted cables or devices can introduce malware, exfiltrate data, or simply fail at critical moments. Defenders should audit and ensure the trustworthiness of all tools and cables used in sensitive environments.
• Environmental Preparedness: Challenges like "dark server room" or "deploy a field router" emphasize the need for tools that address environmental limitations (e.g., lighting, network access, power). These seemingly minor details can significantly impact a defender's ability to operate effectively in adverse conditions.

In essence, the EDC Showdown serves as a practical blueprint for building resilient, responsive security operations that are prepared for both the anticipated and the utterly unexpected.

Key Takeaways

• Preparedness is Paramount: A well-curated Everyday Carry (EDC) kit is indispensable for IT and information security professionals, enabling rapid response to unforeseen challenges in diverse environments.
• Versatility and Multi-functionality: Tools that serve multiple purposes, such as Leatherman multi-tools with bit sets or Raspberry Pis for various network and data tasks, are highly valued for their efficiency in an EDC.
• Specialized Tools are Essential: Beyond general utility, specific challenges (e.g., serial console access, lock picking, high-speed data backup) necessitate specialized hardware like portable KVMs, USB-C testers, or high-capacity NVMe drives.
• Physical Security Matters: The talk implicitly highlights the importance of physical security awareness, as demonstrated by the use of lock picks and devices like the Flipper Zero for bypassing common security measures.
• Adaptability and Ingenuity: Effective problem-solving often involves creative improvisation and re-purposing existing tools to tackle novel or unexpected situations, a core skill for any defender.
• Community Knowledge Sharing: The event showcased the informal but valuable exchange of practical knowledge and tool recommendations within the infosec community, reinforcing the benefits of collaborative learning.

About the Speaker(s)

The "Every Day Carry (EDC) Showdown" was hosted by klipper, described as being involved in "Homelabs, MTB, and everything in between., Infosec." As the host, klipper expertly guided the competitive game show, presenting challenges, managing audience voting, and providing humorous commentary, ensuring a lively and engaging experience for both contestants and attendees.

The talk featured four main contestants, all infosec professionals, who bravely opened their EDC bags to scrutiny and competition:

• BP: Consistently demonstrated an incredibly comprehensive and often "overkill" kit, frequently winning rounds with multiple, high-capacity, or highly specialized versions of required items (e.g., four 2TB SSDs, multiple screwdrivers, a vast collection of adapters). BP's bag was a testament to extreme preparedness.
• Lean: Showcased a well-organized and practical kit, often providing clever and innovative solutions, such as using an HDMI video capture card for server KVM access. Lean's methodical approach and surprising gadgets made him a strong contender.
• Distinct Mind: Impressed with practical, real-world solutions, including a full set of actual lock picks for physical security challenges, and a Leatherman with a complete bit set. Distinct Mind emphasized multi-use tools and direct solutions.
• Dark Matter: Known for carrying an extensive amount of data (claiming 60 terabytes) and leveraging powerful, sometimes unconventional, solutions like a Raspberry Pi for complex tasks or a portable AC inverter. Dark Matter's approach leaned towards high-performance and custom-configured devices.

OD, who assisted with scoring and AV, also played a crucial supporting role in the smooth execution of the dynamic event. Together, the speakers and contestants created a memorable and informative session that celebrated the resourcefulness and unique gear of the infosec community.