Author: Baab

I took advantage of a spontaneous opportunity to get a NExT implant at summer camp. NExT = 125KHz T5577 RFID and 13.56MHz NFC NTAG combined into one bioglass cylinder.

I was able to put the DC540 website URL into the NFC tag and read and share it right away, but I had to wait until I got home to my RFID readers to test the T5577 in its natural habitat. I confirmed that the Proxmark 3 RDV4 was able to write to it as well as read it, but having a door reader read it is another thing.

I was a bit disappointed when my readers wouldn’t read it. I reached out on the forums and posited my theory, that inflammation from the implant might be blocking it, and that perhaps waiting would resolve it. A response immediately came back from another forum user agreeing that in some cases two weeks was a good amount of time to wait for internal swelling to go down and make it more readable.

And here I am at two weeks and three days from implant day, confirming that the T5577 side of the implant is actually working with a standard HID door reader (mine is connected to an Arduino Uno and an SSD1306 for this demo).

By the way, sample code and instructions for using an Arduino Uno with a reader like this can be found here: https://github.com/dc540/arduinohidprox

As usual, we came back from DefCon inspired, energized, and diseased. Yes, some of us came home with Covid this year. But we’re recovering, and it hasn’t stolen our Big STEM Energy.

We decided to take what we’ve learned over two years of designing and manufacturing badges, and offer a course. This takes us a step closer toward fulfilling our mission as a non-profit, and teaching strengthens everyone all around. Students learn something, and teachers become better teachers.

This class will be in two phases. The first half will be an intro to MicroPython using the Raspberry Pi Pico microcontroller with breadboards and some basic electronic circuit elements (LEDs, a display, buttons, etc). culminating in cobbling together your own MicroPython game!

The second half will be taking what you’ve learned from the first half and turning it into a standalone PCB (printed circuit board) project, using all the elements and code you’ve mastered in phase 1, culminating in sending it off to a fab house to be manufactured. You’ll end up with a permanent keepsake of what you’ve learned, and hey — it might even WORK!

We’re looking to start this in October. The class will be virtual, so don’t worry if you’re not local. We’re trying to avoid requiring soldering skills until the very end, so don’t worry if you’re not skilled. The class fee will be nominal, and supports a nonprofit doing good things. If you’re interested, make sure to follow us on twitter @dc540_nova and Join our Discord — an invite link should be in the right column of this website somewhere. We’re going to cap the class at around 25 or so. The class will likely be held in a moderated Discord voice channel. There will be a parts list published in the coming days — actually two parts lists — one for those who have soldering capabilities already, and one for those who don’t. Once you’re in the Discord, request in the main welcome channel to be added to the MicroPython PCB class list — that will get you into the discussion channel, where we’re planning and staging the class. Once the class begins, those who sign up for it will be added to another group and will be able to join us one evening a week for live classes. We may record the lessons as well for those who miss a lesson or can’t meet the consensus-decided class evening.

If you get lost in the code and can’t keep up, don’t worry, we’ll provide some basics at each stage to make sure you have something that works. One of the great things about microcontrollers is that once you prove all your circuit elements work, you can go ahead and build it, and worry about the software later. It’s easy to apply new code to a device that has working access to all of its components.

We created a dilemma for ourselves last year. If you saw our badge from last year, the Tree of Life badge, you’ll notice that we took a simplistic approach when mounting our OLED display. We used the version of the display with a backing PCB, and just mounted the PCB to the top board. It’s not innovative, it’s not beautiful, but it’s fully functional.

In #badgelife tradition, we wanted to do a little bit better this year. My goal was for the display to be flush with the top board, for a clean, flat appearance. At the very least, this would likely mean mounting the display on the bottom board. This creates a dilemma:

1. If mounted via header pins and therefore removable/replaceable, the backing PCB of the display ends up at the same height of the top board. This is undesirable, because the backing PCB is larger than the display and inelegant. The goal is to have just the display itself rise into a cutout in the top board.
2. I could certainly have soldered the display directly to the bottom board, but since I made the design decision of mounting the display overtop and perpendicular to the Raspberry Pi Pico, , this would prevent access to the Pico in case a solder joint needed to be corrected. It would also prevent easy replacement of a broken or faulty screen.

So we looked at the problem and found several options available to us. I think the ideal solution would have been low profile female headers on the bottom board for the screens. In practice, however, we found these to be akin to Unobtainium. The only place sizes were properly defined was on Mouser and DigiKey, and no, I’m not paying a dollar each for freaking headers. I did find a writeup by someone who had done the research and found some reasonable low profile headers in China, but we were on a time crunch, so those remain on the to-be-explored list.

The solution that found us was to remove the “pin carrier” from the display after the pins had been soldered. The pin carrier is the extra bit of plastic that holds the row of pins together. This allows the pin to sink a bit lower into the receptacle header. Then we noticed it was bottoming out and not ending up completely flush at the top, so we ended up trimming about 1-1.5mm from the end of the pins on the display.

This solution allows the display’s backing PCB to sit just below the front board, and the display itself to sit flush, while still able to be removed for troubleshooting or inspection.

Here’s a before and after of the display modification, hopefully it helps to visualize. Note that the “before” model is actually a different model because I’m all out of unmodified stock.

So the group is home. Some of us are recovering from winning the C19 CTF this year, so obviously this coming Monday’s meeting will be virtual. Please join the discord.

We hashed out some changes before and during Con. The Executive Committee met in secret at the Jersey Eats food truck at 3AM and made the following decisions, which you all will just have to live with until someone creates consensus for better ones.

1. BadgeDev meetings for any potential badge to be released in conjunction with DC31 will be separate from the regular group meetings. Very limited in scope at this time, we will bring others in as needed.
2. We will be launching a class for members who wish to learn to do PCB design. If this is you, join the PCB class channel in the Discord. We’ll plan a schedule and dates. The syllabus will come soon, and the objective of the class is for each attendee to send something off to be fabbed and have something useful and/or blinky to cherish, lament or scoff at forever.
3. We will also hold separate meetings outside the normal group meetings to deal with the administrative tasks of keeping this group functional. Some things will trickle out of these meetings into the general membership meetings. There are soft, unspecified growth goals that will emerge and define themselves better as we move forward.

I have a funny little story to share. A few of us were hanging in the Forum outdoor area. Some were smoking, some were accompanying smokers. We were shooting the shit. Dude rolls up with one of those big badges with the speakers, we got to chatting about that, and Display recognizes him as the Strange Parts guy. He acknowledges, gives us cards & trinkets, and we’re still shooting the shit I guess. At some point DeadAddict rolls up and participates in the shit-shooting. Someone asks how the con is going, and I give my usual, “you get out of it what you put into it,” and DA responds, “oh no” and we all laugh. Some of the folks around are less attuned to DefCon history and don’t recognize DA. I think he’s got one of the most recognizable faces at the con. That’s fine, I didn’t recognize the Strange Parts guy. And nobody recognizes me unless they’ve interacted with us about badges and shit.

I wanted to provide some follow-up on that. My first instinct was that it was an unsalvageable error, which lead to adding the anti-metal NFC sticker to make it “work” while bypassing the onboard circuit. Not that it matters, nobody at Defcon in their right mind is going to scan your NFC badge. “Sure, I’ll take your malware!”

I’ll dive into an explanation with lots of pictures, to make it easier for folks maybe newer to Kicad to see the issue.

Here is the back copper layer. You can see that there is the antenna, which is the tight loops in a rounded rectangle, and that there is a copper keepout zone defined inside the antenna. This side, we believe to be correct.

And for reference, here’s that same area with the silkscreen showing, so that you can see where the antenna lives on the backside.

With me so far?

Ok, here’s where my attention to detail failed me. Here’s the front side copper layer in the same area. I’ve left the back copper layer visible but dimmed, so you can see how they interact/compare.

You see what I did there? I was in such a hurry to do this that I didn’t think it through. I just copied the keepout zone from the back to the front, thinking they needed to be the same. They absolutely don’t need to be the same. The purpose of the keepout zone is to allow radio waves to travel THROUGH the antenna, energizing it. The back is correct, because you don’t want a keepout zone where you actually want copper (the antenna). The front side, well, the keepout zone should have extended just outside the antenna on the back. I hope that’s clear. The front copper fill (which isn’t even tied to a net, not even ground — it only exists for the unmasked areas to be shiny!) actually overlaps the antenna itself, preventing the thing this circuit needs to the most — radio waves flowing through the antenna.

So here’s a shot with all of it showing, so you can see what part of the copper would need to be removed for the circuit to work (hint: All of the copper on the FRONT side that covers up the antenna).

So I assumed it was a lost cause. That copper is INSIDE the board, or at least under layers of mask and silk. Surely that can’t be repaired, or isn’t WORTH being repaired.

But this is DefCon, of course, and Syntax, who I met in either LineCon or MohawkCon or both at my first DefCon in 2017, speculated that perhaps if one wet-sanded the silk, mask and copper out of that area blocking the antenna (basically the red area highlighted above — while being careful not to destroy the trace between the inside and outside of the antenna across the two vias) it could still work. It would look a little janky, but I might try it when I get home just for the experience. And then BradanLane suggested removing it with a laser and acid etch, which might be a little cleaner.

Idunno. I’m going to try it, because dammit, I really want to see my eye light up when I scan it. If any of you lunatics goes home and tries it as well, I’ll mail you the TSSOP-8 NFC chip if you don’t already have one, and you can install it yourself. It goes here:

Sorry I didn’t bring the NFC chips with to Defcon, but you would have lost them in your sticker bags anyway. I naively thought it was a lost cause, and I mean, it’s not like hackers enjoy the recovery of a lost cause by any means necessary, LOL. It’s not like a point of pride or something to overcome by applying brute force, stimulants, ADHD and procrastination on actual money-making projects, simply for the glory of having WON.

So in the rush to get this done, apparently I mixed up power and ground between the top and bottom boards. So we’re going to disable them by removing those pins from the headers between the two boards. Power and ground on the front board ONLY provides power to the SAO header.

If you want to bodge it, you’re welcome to bodge it, just desolder the 4-pin header on the right and resolder a 6-pin header after cutting and rerouting the traces appropriately. If you want to add a SAO connector to mount an SAO without power, you’re welcome to do so. Just keep in mind it’s disabled for a reason. If you re-enable it without rerouting, it will burn out your SAOs and make your room smell funny.

This will be resolved in official batch #2 later this summer.

I could have retconned this as a “we deliberately disabled power on the SAO header for the Tarot badge so that it could connect to the Tree of Life Badge without concern for power in a future release of the firmware” but then we’d have to follow through on that promise.

The First Official Trailer: https://www.youtube.com/watch?v=l6vM9SNLcsQ&t=11s

First, a little bit of background. We had the idea for a Tarot badge last year, while walking around DefCon and getting so much love for our Kabbalah (Tree of Life) badge. That badge started so many interesting conversations and opened so many doors that we just felt it made sense to keep going down that path. When we started digging in to complete last year’s badge, I decided to commit to learning more about Kabbalah for a year and then to evaluate. I sorta mostly kinda did that, off and on. Once you start going deep on Kabbalah, you start to see it’s complete interconnectedness with Tarot. What happened was we started wishing last year that we had built last year’s badge bigger to include more about the tarot correspondences. The natural answer to badge insufficiency regret is “maybe next year.” So here we are.

The Badge: Technical

We did not stray too far from the technical features of last year’s badge. At the core level, this is still an RP2040-based Pico, some LEDs, an NRF radio and a display. But here’s why we were struggling until just this week to get it out. We lost a lot of time to decision paralysis – there are a lot of screens available. Which ones work with the Pico? Which ones will work with MicroPython? Which ones will work at our power level. A lot of research goes into these decisions. A lot of parts bought that end up never being used. I’m going to quote a prominent member of the badge-making community who recently said “Why do I do this to myself?” The answer has to be a feeling that you’re putting something useful, interesting and/or beautiful into the world. And we kind of hope we did.

We settled on the 2.2″ ILI9341 with integrated SD card. It seems to be the smallest profile screen available with 240×320 resolution, which is critical for displaying tarot cards. Any less resolution would have looked shitty. And it’s sad, but that’s one of the more expensive screens out there, which reflects in the final price of our badge.

Kevin, our developer, like to scoff at those who consider MicroPython as some sort of lesser language. Some still linger in the world of perceptions where led animations are slow, there are blockers everywhere, and too many Python libraries haven’t made it over yet. We’re here to tell you, MicroPython is thriving. Our LED animations are proof that there’s nothing slow about either the RP2040 or MicroPython. We make generous use of the dual core architecture. And Kevin managed to squeeze three SPI devices onto a two SPI bus system. And nobody knows why, but apparently we’ve implemented AES encryption into the badge.

Next year we’re thinking of bypassing the fully-built Pico and working with the RP2040 directly.

Please remember that none of us do this professionally. We’re all learning. This is a labor of learning, and a labor of love. Last year’s badge was the first “big thing” I ever designed in KiCad. After Defcon, this year we plan to develop some PCBs as a group in a group class series, so that more people can be part of the development effort, and we’ll teach each other some group workflow lessons.

The Badge: Features

It wouldn’t have taken much to make a badge that does a Tarot reading. We didn’t want to stop there. What I envisioned last year, and I told at least a few of you this in Vegas, was this. I wanted a badge that could do Tarot readings, but I wanted it to be OPEN. Meaning I wanted to provide at least one deck. In my naive early imaginations, I thought we’d actually find an artist to do a deck specifically for the badge. But Crowley and Harris we are not. They had time and money to pursue their project. We all have day jobs. Then we realized there are public-domain and open-licensed decks available. So we included (at time of writing) three decks on the badge to choose from. The Rider-Waite-Smith deck, a version of the Tarot de Marseille (unfortunately not the Jodorowsky version — I really want to turn more people on to Jodorowsky and the story of that deck), and what we call the Shitty Deck, one that we hand drew over DC540 meetups. Trust me when I tell you that this deck is absolutely shitty.

We’re including instructions on how to add your own decks to the SD card to make them available for display. It’s slightly convoluted, they have to be resized and converted to raw format, and a naming convention is enforced. But think about it — once you do this process once, you have that deck for use on the badge. We could populate the SD card with the hundreds of copyrighted decks out there that can be found on various file-sharing platforms, but that would be violating copyrights, and that would be wrong. So maybe scan the decks you have. Maybe make your own deck.

So you can choose a deck, you can do a reading. What else? We have badge pairing, of course. We have a challenge game, like last year, but unlike last year when all we had to give as a prize was Defcoin, this year we’re offering a badge as the prize. Either an additional Tarot badge, or last year’s Tree of Life badge. Because of quantity issues, there won’t be many badges to go around at the con itself, so that complicates the game a bit. We’ll see how that works out. Maybe we’ll separate out part of the game so that non-badgeholders can play.

Everyone seemed to like the illumination scheme we went with last year. I’m not a fan of surface LEDs beaming photons into my faceholes, so I chose a more subdued look by strategically removing solder mask on both sides of the board and illuminating from a board below. I pushed to expand on that this year, but instead of just beaming through shapes and symbols, I put the shapes and symbols on the surface and opened up an entire wheel for shine-through. As you can see, the color of the FR4 itself tends to adulterate the LED colors a bit when illuminating large areas like that, but not excessively. I found it difficult to get a good blue to shine through, for example. As delivered, there is a lot of bleed between the different segments of the wheel, but in the demo Kevin posted last night, what you see is the result of gluing a light separation wheel to the underside of the top board. There are 24 LEDs on the bottom board this year, each illuminating half a wedge on the the top board. The separator wheel shown in the video only has 12 divisions, but still provides a nice sharp difference between the wedges. We will be providing an STL file for 3d-printing your own separator wheel, and the STL file has the inner ring defined as well, for full separation of all 24 segments. To be fair, I think beauty is in the eye of the beholder. The spinny animation in the first public demo, when run without a separator wheel, tends to lead to some interesting effects that evoke searchlight patterns at times, which is its own meaningful thing.

Searchlight casting for faults in the clouds of delusion

Anyhow, here’s what the beta version of the wheel separator looks like. It’s about 60mm in diameter. Thanks to BradánLane Studio for creating the STL.

Not Many Copies at Defcon

We are so sorry, but because we got finished so late, we were too timid to drop coin on large quantities of the badge before knowing if it would work, so we won’t have many at Defcon at all. We should have enough to show everyone, and a VERY limited few to sell or trade, but literally don’t get your hopes up. We made 25 in the first batch. There are 10 of us going. We lost a few to testing. So we might have maybe 10 extras if we’re lucky. The good news is, boards and parts have been ordered, so we’ll be able to make more when we get back home.

We haven’t had the deep communications required to figure out how we’re going to distribute such a limited number of badges. We had such a good time distributing badges last year, we wish we could have done the same thing this year. We’ll try to have those discussions by the time the con starts. But seriously, temper your expectations of getting one onsite.

Some Thought About Tarot in General

A lot of people have a lot of thoughts about Tarot. On the ends of the spectrum, there are some pretty heavy expectations people lay on Tarot. As a lifelong rationalist, I see it, much like Kabbalah, as a framework in which to view the world and life events. A structure to be superimposed, for examination and rumination. Sometimes the results can be profound, but I like to believe the results are directly correlated to how much the reader and/or readee are able to open and stretch their minds. I will quote Lon Milo Duquette:

It's all in your head. You just have no idea how big your head is.

DC540’s Status and Mission

Last year, DC540 Nova cemented our status as a 501(c)(3) nonprofit. We have banking, we’re on AmazonSmile, and we have plans to to support people both in and out of the infosec community with our skills, talents, passions and green energy. So when you’re forking over your hard-earned pay to covet one or more of our badges, please keep in mind that it’s going to a good cause. If you’d like to contribute some of that green energy directly to DC540 to support our efforts, you can do so by sending money via Paypal to [email protected]. This will help recoup dev and prototype expenses, and support our mission. Now we’re not saying that making a healthy donation might lead you to receive a badge at Defcon, but we can absolutely be bought. And donations are tax-deductible.

Future Thoughts on this badge

We don’t know if it’s possible yet, but what if a new firmware could be developed for this year’s and last year’s badge that expanded the functionality a little bit, so that when a card is displayed on this year’s badge, the corresponding sphere(s) or path could be illuminated on last year’s badge? We exposed two GPIO pins on both badges via the SAO header, so maybe… Food for thought…

Engage with us. Join our Discord. Talk with us on Twitter.

Yesterday I wrote about the mystery Waldorf Astoria Park City room keys that didn’t respond to either 13.56MHz or 125KHz probes. Mystery solved. They use NFC. On a whim, I hit them with NFC-tools on my phone, and the world makes sense again.