 So, I've got another cool story about this guy here. Ryan mentioned that I teach a class and, you know, we have people sign up for the class and we kind of have this policy, you know, if you try to cancel too soon, that's like a no refund policy because we're paying the hotels and all the stuff and all that. Well, this guy signed up for a class seven years ago, the very first class I ever taught. So over eight years ago, and then he called me or emailed me about three days before with some story that he was going into the hospital for surgery, but it was just something about his message that I was like, you know what, I don't think this guy's trying to scam me because he didn't say to me, hey, can I get a refund? He said, I paid out of pocket to come to your class. Can I just come to another one? And I was like, you know what, sure, we'll make it happen. And I have not regretted that decision ever since because meeting this guy has been amazing. Now, that wasn't a lie about surgery. Billy has had 180 surgeries since I met you or your whole time, whole time. So in his life, 180 surgeries. So he could be standing here before us today. The man doesn't let anything stop him. He works out how many times a week? Six times a week. Okay. He single handedly, and this is not even a lie, he's too humble to admit it. If it wasn't for Billy, Essie Village really probably wouldn't happen because we use his garage as a storage unit between him and his wife, they're saints. And if we couldn't do that, paying caesars to ship stuff like this in, I wouldn't be able to afford it. So Billy single handedly is one of the also kindest and most generous people I know. So I want you to join me in welcoming Billy Boatwright to the stage. Before I get started, I want to thank Ryan for his talk. That was awesome. The title of my talk is In-N-Out. That's what it's all about. I'm Billy. That's my Twitter handle. That's where you can find me on Instagram. And also the hashtag social operator. For anybody that was here last year, I gave my surgeon top billing. This year I thought I'd give a shout out to the ER nurses and the OR nurses that helped keep me alive too. That was before surgery 179. The late nine weeks ago are the sparks that led to preparing this talk. So if you don't immediately recognize these Twitter handles, take a picture of this slide right now and follow them. You'll learn so much about social engineering from them. So I'll wait. I'll reference some of them later in my talk as well. Now the title's a little misleading. This has nothing to do with the delicious burger chain. So I'd be lying if no talk prep happened while devouring In-N-Out. I am a so-called kid even though I live in Vegas now. So I love the place. So what this talk is about is during a physical engagement, you need to get tools in and out of the environment. And the better you can get them in and out undetected, the more functional they are. If you get stopped with them, and they get taken away, then they're no good to you. First disclaimer, if I give a specific story in this talk, it was before I was a professional. It was just me going through life. So nothing illegal, but I was testing things on my own. And it allowed me to get insight into the policies and procedures that security uses to deal with people with disabilities, which eventually gave me great experience for work. So it all started back in 2008. The second time I got to riding an ambulance, I was conscious so I didn't get to hear the sirens, which was a little disappointing. I started having trouble breathing at work while I worked at Treasure Island, when the hospital spent a few days there, they let me go. When I got back to work, my manager said, what can we do to avoid this ever happening again? And I thought, well, I can bring a nebulizer to work, you know, and do a breathing treatment if I ever have a problem. She said, yes, that's what you will do every day you work. Okay. Then I was bummed because the casino has a clear backpack policy, or a clear bag policy. And I didn't want to go buy a clear backpack. So I asked one of my waitresses, I said, how do you get around that? She brings out this giant clear bag with a slightly less giant coach bag inside it. And I said, well, how do you get away with that? She says, I tell them I don't want the world to see my tampons. And the male security guards go, yeah, I don't want to see them. And the female security guards go, I totally understand. Thank you, Lisa. And I was 13. Carrying a backpack became an everyday essential for me. Just like your ID, your phone, or clean underwear. I have to carry oxygen when I leave the house. And after taking this picture for this talk, I realize that I need more color in my collection. So the first place that got tested was the Guns N' Roses concert. I walk up, it's a big sign, and I was breaking two of the policies. No backpacks, no weapons. I carry a knife, just like a lot of people do. Well, my backpack had oxygen, so I had to have that. The knife, obviously, I didn't. But I didn't want to walk back out to my car. So I buried it under the medical supplies in my bag. Walk up to the preliminary security. She goes, no backpacks, anything else? It's oxygen. Okay, go ahead. Walk up to the main security, right by the metal detectors. My wife goes through it. My wife's 5'5", a buck on five. Metal detector goes off, she gets wanded in. I walk up to the table, the security guy goes, no backpacks. I lift up my bandana to show him my trach, and he says, just walk around. You ever seen the movie Braveheart? I felt just like that guy. I'm not going to do the scene because I don't want to butcher an Irish accent. So after attending other events with similar policies and equal results, and G&R, Molly can do a death leopard, I'm old. I began to think about how this could be used in an engagement. First, I looked at my interactions with security. I was quite obviously violating their policies. And I was immediately able to fuse the situation because of my condition. Also, I knew that at any point I could play the ADA card that they had to make reasonable combinations for me. You know, the whole, look, I'm just here to enjoy the show like everybody else. So I would continue to test these wherever I went that had a no backpack policy, which is pretty much any show in Vegas. And only twice did they ever get passed just looking at the pocket in my backpack that held my oxygen tank. And as most of you know, backpacks have more than one pocket. This was a fun one. So my buddy was in the last year of law school. He said, hey, can you come down to the courthouse for a mock trial? I said, yeah, I'm going to test something. So how many of you guys carry leatherments? Okay, most of them have knives. Courthouses have clear, no weapons policies. So I put my backpack down on the X-ray machine and he stopped me. What's in the bag? It's my oxygen tank. Well, take the oxygen out of the bag. It's in the back. So I walked through the metal detector holding my tank. And he goes, okay, let me want you to make sure that it was just a tank that set it off. The bag goes through and they say, can we search your bag because we found something. Absolutely. Clearly I knew what they had found. So they pulled up a leatherman and they go, you can't bring this in here. And I said, so I had two planned written, like, I'm just going to try this. It's just a test for me. I said, look, it helps regulate the tank. And because a normal oxygen cannula goes to your nose and mine doesn't, I need to cut that off so that I can use it. And they're like, and I said, look, I know you're just doing your job. But what's quicker? Me handling it myself with a tool, if there's an emergency, or trying to find one of you guys to bring me essentially the same tool in an emergency. And they let me go. Granted, if they'd still said no, I'd love to keep it. Not that big a deal. So these sorts of signs are all over Vegas. No backpacks. It's a very clear policy. So the policy is very clear, except what I've experienced is the procedures to enforce it are woefully lacking. And that's what allows me to get past it. And like I said earlier, no private venue with a policy like this has ever thoroughly searched my backpack. So having a clear set of procedures on how to enforce it would shut me down if I'm doing anything nefarious. But besides the lack of clear policies, I thought there's got to be something more to it, or clear procedures. And I'm just not that charming. So I did some research. And I found this, the arousal cost reward model. Anybody ever seen Boondock Saints where they talk about the kiddie genophase and murder? This group did some research on that. And it's basically when you're aroused whether positive or negative, you see somebody in need. You go through a cost-benefit analysis of helping them, the cost of helping them, the benefit of helping, and the cost of not helping. So are you going to feel bad if you don't do anything? Now, obviously, as social engineers, there are many things we can do to trigger this arousal and others to get them to help us. I know a lot of the ladies have worn pregnancy belts to conceal tools or just to, hey, help me. Mobility, things like crutches or wheelchairs, or simply having your hands full of coffee or treats will easily get somebody to open a door for you. OK, I love this one. So how many of you think that the loss of your voice would be detrimental to your social engineering career? Nobody? OK, a few people. Laryngitis, that's adorable. No shade, no shade. I love, snow is awesome. Well, after one of my surgeries a couple years ago, I couldn't speak anymore. After two weeks, I still couldn't speak. After six months, I still couldn't speak. And then I decided I'm going to go out into the world and see what it's like without a voice. You know, see if you can do, see how much harder it is to do things without a voice. These dropkick Murphy lyrics got me through a lot of that so that I didn't get down on myself. So what I would do is I would take a pen and paper or notes on my phone and try to go get a haircut or order things at a restaurant or get stuff at the grocery store. Takes a couple extra steps, but it's completely possible. And one funny story, I went to a Pennywise concert. I didn't want to be on the floor because I'm not 22 anymore. So I go to the box office and I type out of my phone. I'd like ADA seating. And I hand it to the guy. He takes it from me and starts typing back. So one thing I've learned is that when I present that I can't speak, what's the number one assumption people make about me? And I was like, oh, sorry, sorry. I made the assumption that, wait, why would a deaf person be going to a concert? I made a erroneous assumption about deaf people. So the tactical pen is one that I carry most days because I'm a dork and I need a fourth glass break tool on me. Whatever. But more and more people were starting to take notice of it because it looks like a weapon. So I said, OK, well, what if I just add a regular simple ballpoint pen? Well, what can I do with it? And then I had this light bulb moment. I heard a talk last year by Squirrels in a Barrel about the extra space inside everyday objects. And I thought, could you get a lockpick set in that? Yes, you can. Anybody want this? So that is just what I came up with. Simple one pick, one wrench. There's room for maybe one more pick. Maybe some Kevlar thread, you get the idea. And that looks nothing like a tactical pen. And when I'm using that to write notes of security in a notepad, they're not going to take it away from me because it's essential to my communication with them. So the advantages of social engineering without a voice, you're able to appear selfless and polite. If I walk up to a receptionist or security, and I'm typing on a note or writing on a note, and I notice somebody comes up behind me because that will allow security to give me their attention again. And I'll alleviate any frustration on their part because I understand I require more time. One thing you guys heard a lot probably after the calls, people were nervous trying to come up with the right words to say. Well, if you can't say any words, don't have to worry about that. Another is forcing the client to adapt to alternative channels of communication and operate out of their comfort zone. So there are so many places, here's our contact number, call it, I can't talk. Give me an email address, give me a chat channel. Now I've got more information about your company. OK, second disclaimer, this is what I have to read. Well, the concept of the following concealment technology is truly mind-boggling. It is inappropriate to use in a standard security assessment. The use of these concealment technologies and concepts should be evaluated legally and for impact. And for impact before their use should be considered. It does not provide your client with accurate depiction of their security program. It is no different than clearing out a business by pulling the fire alarm. Yes, it clears out the building for your pillaging purposes, but what does it actually measure? Is it not a legal disclaimer? This is a check yourself before you wreck yourself. If you use this next one, you can hurt yourself and your reputation, because it is wholly unfair. Best quarterback in the NFL. And you tell me with absolute certainty which of those oxygen tanks is legit. They're both green. No? Anybody else want to give a certain answer? As I'm sure some of you guessed, the one that was painted on the bottom was the Trojan Tank. This current, the way I have it set up now, that's a pie with a network cable. You can also fit a battery in there for the pie. It will connect a Wi-Fi while it's in the tank. And I brought it with me if anybody wants to see it afterwards. OK, but if used appropriately, the tanks and other consumer technologies can be used to monitor and measure search policies and procedures to help measure the safety, health, and the evolution of your security guards as well as your security programs. As for the legality, several controls are already built in place, which is why we feel safe releasing this. For example, tears aren't going to use this to conceal something to take down a plane because TSA won't let these through, because an oxygen tank is compressed. It's a ball. So the thing is, no oxygen. Here's an alternative. You can get a portable oxygen concentrate. So what are some defenses against this? Because it seems like at this point, I can get in and out without anybody stopping me. One thing, be courteous, not nice. The nice person isn't going to want to offend me by questioning whether I'm sick, whether that's a real oxygen tank, but a courteous person is going to go, well, here's my procedure. This is how I need to do it. Let's see something, say something. If I'm in your building with my bandana, my tattoos, my giant backpack, I'd probably look out of place. Ask me where I'm going. Ask if you can help me to get to where I'm going. One thing I've noticed is once I'm in somewhere, no one ever asked me about it again. They just assumed that person did their job already. Continue to train your staff. Like I've said, nobody's ever stopped me once I'm inside. And then adjusting your policies and procedures. Now that you know that this is a potential attack vector, talk about it with your companies. Figure out a way to search people if you're going to let them break the backpack policy because of a disability. Figure out a way to, OK, is it legit? There's a right way to do that. I mean, if you asked me to turn it on, the fake one clearly doesn't work. And once again, just remember why you're doing this. You're showing and demonstrating the impact of proper security and proper security controls in an effort to improve security. And I will not accept any limitations in my efforts to secure it. I will do everything within the scope of the contract to make my clients better. Once again, that's where you can find me. I'd like to thank these three people, Flippy, for helping me cut the tanks. It's right here, Vache, for telling me to use a paper clip, or something, and for my awesome slide designs. Does anybody have any questions? That's when we would help with the whole procedure thing. So if you went in a wheelchair and ran through the place, you would go, OK, you guys don't have the proper procedures in place to, you know, is it just a wheelchair? Is it a wheelchair and a backpack? You know, like, are you smuggling things in the wheelchair? You know, there's a right way to figure out what will work for them procedure-wise, which is why I handed the take to my boss and said, I'll never use that. It's completely unfair. I mean, when I've used it, I have to carry two tanks, one that works and the fake one. But if you took them out, you would see two different tanks and go, what's going on here? Anybody else? Definitely there should be ethics. To me, it's all about the scope of the contract. You know, it's, yeah, if I'm not allowed to do something, if the company doesn't want me to test that, I don't test it. I don't need my ego stroked that much without a voice. I get lots of silly discounts without asking for them. I get remembered a lot more. Like, if I go to the same places and they know I can't speak or I decide I don't want to speak and they know that I've not had a voice at times, I get remembered a lot more places, I get better surveys now. Well, I talked a lot about last year was I got my start in Social Interaction as a bartender. So it's taken that eight hours a day, constant social interaction and realize and learning how to talk to people. And now that I sometimes can't speak, one of the reasons why I have surgery so often is after three weeks I lose my voice, can't speak for about a week, going for surgery and get it back. So every four weeks I have surgery. So knowing, learning how to type it out so that it's concise, so that I'm not frustrating them is really important. Because if I'm frustrating the person I'm trying to communicate with, they're not going to want to do what I need them to do. I appreciate you. Thank you very much. Broke anything? One minute. The courthouse, I got a weapon into the courthouse. I got a Leatherman that's got a blade. Into a courthouse. I don't want to talk about work stuff. So the pen I gave out, I brought 50 of them. If anybody wants one, I'll be in the back. Come talk to me. Thank you, everybody.