The Hackers Apprentice | SANS@MIC Talk

Key Takeaways

tonight so tonight we are going to be doing a webcast on the hackers apprentice which is an escape room built in the house lots of internet of things and things like that but before we get going I've got a couple things to show you one of them is I've got a game so I'm curious you guys should have in your go to training console you should have a chat and you should have a questions I think we're going to be using the questions window for you to respond back to me to a bunch of questions as we go through that and we'll also be using this to play the game this evening so go ahead and look through go to training you might have to click on a little orange X and then scroll down through there and you'll see the questions you'll see chat we're gonna use questions well necessary there's a little pop-out window that you can pop that out and move it over to a second screen or move it to someplace where it's not in the middle of screen so that you can see the screen and the wit box is mystical let me just ask before yes exactly right there I got a question here yes before we go through and do this let me ask how many people in the room have seen my pre-show of songs written in Python if you've seen that send me a message and let me know that you've seen it you you you no one has seen my pre-show four songs written in Python okay since no one has seen my pre-show four songs written in Python then that is where we will start out we'll start out with songs written in Python and then after we go through the songs written in Python then and we're a little bit closer to the start of the event then I'll go through the new pre-show of movies written in Python alright so here we go this is this is songs written in Python the idea is well I've written I've written some Python code that is intended to uniquely represent or give you idea of a song either a lyric from a song or a title of a song so I'm going to show you the Python code I want you to read the Python code and tell me what mood or what song I'm talking about okay all right so your first song written in Python is this go ahead and type the name of song into the questions window for this what is the name of this song written in Python bonus points for the within the artist that goes along with it you you in fact /n has special meaning in Python and well most complete Peter burger anyway because a backslash n is a character that has special meaning in Python and other language so in the questions window type this like what is this song that we're talking about here it is the newline character the newline character also known as pressing a certain key on your keyboard will generate that so what song title enter enters a claw song title enter enter is half the song title what is the other half of the song title represented by this slide no no no I can't sing it great all right the name of this song is Enter Sandman Enter Sandman by Metallica enter the Sandman by Metallica okay all right we're gonna try another one here another song written in Python what is the name of this song written in Python you we've got a while loop here and the while loop says while true which means it's going to stay in this loop and it's going to print the word young to the screen what is the name of this song I need some guesses I can't I can't advance the slide until someone gets this one maybe we just don't have enough people here maybe there's maybe there's actually nobody in the room there's six people we went from ten to six you're not able see the code or hear the song you're not able to oh my goodness well that's that explains it the slides are not advancing on here oh I meant let me click a button thank you so much for the question all right can you see that now all right so this this first one is gonna be easier now okay okay let's try this again what is the following song written in Python any guesses - this one I went back to the beginning all right so now in turn Sandman yeah Enter Sandman makes sense now yes okay it does help if you can see the slides I will concede that it is a much easier mode of the game if you can actually see what I'm presenting to you all right that one is enter the Sandman by Metallica this one what is this one what song is represented by the Python code on the screen while true print young knocking down older song okay this is uh this is a 1980s maybe 1980s which of course is the best year decade it is for every young forever young well done and Brad it got that when Brad got this one forever young well done Brad okay the next one can you identify this song written in Python there we go Brad got it Brian got it it's what it is don't stop believing by journey excellent job alright so that you get the idea is you're gonna get a little bit harder a little bit harder how about this one it's a pretty recent let's say pop rock song in Python if you have a dictionary or a JSON object you can use the get method to retrieve a value from the dictionary in this case I'm trying to retrieve the value in the dictionary with a key of my and it returns back hash tag pipe don't don't don't don't don't don't don't do any ideas any guesses excellent job this one is excellent job Ally got that one this one is by Weezer I got my hash Pike all right - Mike get hash Mike all right about this one in the random module chooses a random number between 0 & 1 floating-point numbers of point-to-point so a loading point real number between 0 & 1 and if it's greater than 0.5 this will call a function there's only a 50% chance so excellent job Bryan Bryan got call me maybe call me maybe by Carly Rae Jepsen well done okay I want this one oh this is 1980s again the date time function in Python is well how you can generate a date and time you can pass to it the Year month and day for the item that you want to create and in this case we're using the date time now function to retrieve a date retrieve the year current year and subtract one from it so what this little print is what what song are we dealing with here Brad got that one well done Brad Wham's last Christmas right so we take the current year we subtract 1 and then December 25th of last year this was last Christmas by Wham excellent job well done Brad all right so this one is a bit harder so I'm giving you the genre and the year this is pop-music 2010 pop music 2010 this one's really hard it's rare that someone gets this one so I'll begin explain it and look for an answer so in here we have in Python what we call a list comprehension all this comprehension is where we dynamically build a list based upon well other values that are in the list so here we're building a list that contains I for each I in this list called world but we're only going to put I in the list if the gender is female then we're going to take a length of the list of all of those all of the eyes and the world that have a gender of female and it's equal to one equal to one returns true so any guesses on this one you woman of the world that's good guess this one is this one's Rihanna the only girl in the world the length of the list of all of the people in the world is that our females equal to one so it is the only girl in the world all right this one right in Python objects also known as classes you would like to see what's in them you can do a dir called a dir function and it'll show you all of the things that are in that class here we are asking it for a list of all of the things that are in class today where we see these items this one is Pearl Jam Jeremy spoke in class today Pearl Jam's Jeremy all right let's see how about this one this will be the last one we do and then we're going to switch over we're gonna switch over to our movies written in Python after this at this one we import the time method and we import the random method we then say we have a list of destinations Staten Island Manhattan Brooklyn and Queens this is a Python list here so then while true or forever here we're going to look to see if when we choose one of the random items out of this list of destinations we're going to choose one random item out of this list and then we're going to take the item that we've chosen we're going to look to see if it starts with the letter B excellent job Brian if it starts with the letter B we're going to call the time dot sleep method so this is no sleep until Brooklyn no sleep till Brooklyn by the Beastie Boys so we're choosing a random value we're gonna stay in that loop forever not doing anything until the random item is is Brooklyn at which point we will sleep yeah excellent job right all right so let's let's stop with this one I'm gonna switch over now cuz we got 12 minutes left and I want to pull up my new pre-show the movies written in Python okay so this I will give you the year for the movie you have to tell me the complete title this first one I need the complete title of this movie what is the complete title of this movie where we build a Python list that has items in it the name of this list is Avengers then we call Avengers dot pop pop will return one of the items from the list taking it off the list it does return as bright as indicated it does return the word Captain America but there's more of that title and is relevant to the code you see here because Captain America is the first adventure excellent Brian Brad this one is Captain America the First Avenger all right how about this 1952 song 1952 song excellent Brad singing in the rain got that one pretty quickly this one is singing in the rain here we build a string X that contains the rain then we we have Wow and that is the word singing but this : : it's the word singing backwards but : : negative one will reverse a string so we singing forwards and then we take the rain-x and we insert Y right into the middle of it so we get singin in the rain all right about this 1975 movie 1975 movie here we import the SIS function which lets us check the version of Python we got the request module which lets us interact with web pages in our e which lets us do regular expressions we then print sis that version info dot major which prints the version of python and Brad got this one that is Monty Python in the holy grail so the version of Python we're running is Monty we go on a quest by retrieving a text from King Arthur's Court and then we search for the Grail inside the quest and we do find you can see here the results of the Grail are found in position 956 in the results so this is the Monty Python and the quest for the Holy Grail all right about this 2011 movie 2011 movie 2011 movie we are using the uncompelled program we're passing it well some byte compiled code from our Python so this when you have a Python program you imported it is as a module or you run it through a byte compiler it ends up creating a dot pyc which if you were to look at it's just binary it's a binary interpretation of the Python code that has been created to optimize and optimize for the interpreter so here we are running this Python program through the onion compile program which gives us back the program and here we can see the program says task equals Jake Gyllenhaal Michelle Monaghan and vera farming any ideas it is source code excellent it gives you back the source code we compiled the bike program to get back the source code very well done Brad and Olli all right how about this movie from 1999 99 was it that old all right there we go we've got a list of items then we try and slice out one of those items but it actually doesn't exist in the list so we get back an error list of items is important what kind of items are those what do you think of this one well I got some answers here Brian got it it is the sixth sense the list of the list there is sight hearing smell taste and touch and when we slice out something or when we pull an item from a list in Python this is position zero this is position one two three and four so of our five senses the last sense is in position four so this would actually be pulling the sixth sense from that list which in this case doesn't exist so we get an error but this is the sixth sense with Bruce Willis excellent job well done Brian all right a but this one 1991 movie once again the context of the list and what it means is important here we got a fine we got time out you've got electric chair you got imprisonment then we're going to map the function pick a string and convert it to all uppercase across this list of items and generate a new list of items so what do we have here you any guesses on this movie written in Python it's not drive it's not the Green Mile this is our Oh capital punishment those are all punishments in the list and we've converted them to all uppercase making all capital punishments okay now with this movie written in 1993 released in 93 oh no three is the name of this movie in 1993 Brad got this one well done Brad The Last Action Hero so here we have a list action here is containing all the great Sylvester Stallone Chuck Norris and all notes Watson Haga and we take the last item position negative one with ring slice out the last item from this list of action heroes giving us the last action hero all right well done Brad all right how about this movie 2002 which what is the name of this movie released in 2002 they have some complex Python code here here we create a custom error type a custom exception that is can be raised by this program the name of this exception is you can and what it's doing is it's going to raise an error if it's gonna raise an error with a message of identity incorrect Ali you got this one this one is catch me if you can so when we handle errors in Python we do what's called a try except block and the purpose of the try accept block is to catch errors and handle them and so here we have a try accept block that is trying to capture if an exception occurs when it calls this me function up here which looks at the identity of this thing looks for the identity being pilot and if the identity is not equal to Frank it always raises this error called you can and that will catch this try except block will catch the me you can error so catch me if you can catch me if you can all right Leonardo DiCaprio and Tom banks well done Ally all right 1990 what was this we released in 1992 lists then we map this joining function across the two lists we create a list with the two things combined what is this movie is this movie written in Python you are just join us your tech can type your answers into the questions window type your answers into the questions window it is not Teen Wolf if you're just joining us you can type the name of this movie into the questions window it is well done Brad Brad got that one it is dances this is the list of dances the hustle the twist the Charleston renegade and salsa and this is a great wolf a werewolf a Teen Wolf boy who cried wolf big bag well this is a list of wolves so this is when we join them together we get Dances with Wolves Dances with Wolves yes it is Dances with Wolves yes there is going to be tough Steven alright Dances with Wolves by Kevin Costner alright our next movie written in Python released in 1999 is we import the numpy module which allows us to create will call them Briggs arrays of arrays here we create a 10 by 10 array of arrays and then in position 1 we put the 1 in position 3 comma 1 we put Father Son Holy Spirit in position 5 if we put Smith and in position 4 comma 2 we could well some crypto what is this movie written in Python it's not John Smith another name for an array of arrays there you go thank you James this is the matrix right we create a 10 by 10 array of a race otherwise known as a matrix and we put neo who is the one in position 1 we put Trinity who is 3 and 1 in position 3 1 we put 5 5 Agent Smith is dead in the middle and we also put cipher we put cipher in the matrix so well done James this one is the matrix right this 2010 movie what is this 2010 movie you're just joining us so you type the name of the to this movie that has been written in Python into the questions window this is the pre-show our show will be starting in just a minute all right it is the a-team here we have a dictionary a Python dictionary dictionaries are made up of keys and their associated values so here we have the key of seat Cowboys to keep our Redskins you a Astros QB Vikings and then we do a team's yet to retrieve the a team retrieves the a team so there's our 18th out of this 2017 movie 2017 movie excellent Steven Steven got this one is this is ghost in the shell' here we open up a copy of bin bash the shell for our Linux operating system we read it in as a binary file putting it into a big byte string and then we look to see if the byte string Casper which is a ghost is in our Linux shell that comes back true there is a ghost in the shell well done 2004 what is this 2004 movie I believe this is our last one last one 2004 movie but it import a couple of modules date time and random I'm then going to create a function called get first which takes in these two things and that returns the minimum one of those two things excellent Brad comes in with the win so we this is going to return the first of these two things and then for range for I and range 50 so 50 times we will choose a random date for X a random date for y and then we will print what happens when we call get first which this will print 50 first dates 50 first dates excellent well done alright I think that was it that's that's all of our movies written in Python alright so I hope you enjoyed that pre-show thanks for coming out this evening my name is mark Baggett and you didn't come to to see movies written in Python came to talk about the escape room that I built in my house so welcome to the main part of the this evening's event we're gonna be talking about the hackers apprentice and the hackers apprentices well it's a theme for an escape room that I built inside my house a little bit about me my name is Bart Baggett I'm senior striking force and the course author for Sands SEC 573 which is automating information security with I do have master's degree in Croatian security engineering it was 15th person to get my GSE through sans for mercy so for many years and most recently for the last 10 years or so I've been working with the Department of Defense and standing up many of their training programs oh my very very thank you to the community my name does appear in the source code for mostly seven times even though I've never actually contribute a module just that other people have written modules based upon different tools techniques and things that I presented at conferences and they were kind enough to give me credit for those for those TTP's so thank you to the community for well put my name in medically tonight we're gonna be talking about an escape room that I build my house and it's a combination of well different IOT devices I've got em Python code and it builds nice a nice escape room out of this process so at this point I've built this escape room probably a year and a half ago almost two years maybe and I took me about five hours to put it together initially and I just had hundreds of hours of fun with it at this point we have many different teams different information security people who come to Augusta Georgia where I live come by and down the escape room it's well it's been a lot of fun for me with all of us well many of us still sequestered in our homes I wanted to talk about how you could take some Python code and have some fun and games within within your own house so why did I do this well and so this is the root of all evil right so I went to Derby con and I saw Ed's awesome keynote talk there on the internet of things boys control AI and office automation building your very own Jarvis and in this he talks about all this home automation that he does where he controls just about everything in his house from their voice automation through custom Python code and looking at the custom Python code I'm thinking list this looks pretty cool I should probably actually spend some time playing with this and then I did and then the next year I come back to Derby con and Edie gives an update further adventures in smart home automation honey please don't burn down your office and it does this awesome keynote and both these keynotes are still available on YouTube you want to check them out there it does a great job in explaining out what he did in his house so I I saw the second print presentation like alright that's it I'm gonna I'm gonna go home and I'm gonna learn some of this home automation stuff so I go home and I'm sitting at my kitchen table I'm reading about how to undo home automation and I'm reading about this new module called home assistant and really most of this talk we're going to be talking about home assistant and how I tied use home assistant tied together all these things because it does all of the heavy lifting for you so I was reading about home assistant I got really excited about all right I ain't going to I'm gonna do some cool home automation all these ideas that come through my head my wife comes in she says mark so we're gonna have some friends from church over on Friday night I need you to come up with a game or something for us to do on Friday night and this is on a Wednesday okay I'd really like to do this home automation thing and not come up with a game or something like that wait a minute maybe I can put the two together and so the escape room was boring I had two days 48 hours and took about five hours of time to put together well most of the stuff that you're going to see tonight because home home assistant really makes this thing easy it pulls together all of the different components for you it's a free module that you can download it's got a home page it's got graphical user interfaces it's got command-line interfaces it's can talk to different types of home automation that you got inside your system it talks to all the different light switches thermostats and other things you might have in your house there anything they can talk on a wireless network you can probably you can you can integrate into home assistant and most likely someone else has already done all the heavy lifting for you the key to understanding how the system is to understand this architecture ever here on the on the right so it's got built into it a state machine which tracks the current every electronic device so it notices this light switches this light is on this switches up right this this particular sensor is set in this way the Sun is up the Sun is down so it's got all these different sensors and tracks in the state machine it's got an event bus where if there's any changes to the states of any of those lights or any of those devices it always puts a message on to the event bus and then all of the different devices that you've got in your house light switches and so forth they all subscribe to the end bus so they they are told when different things happen these different components can also publish services so like a light bulb can say hey I can be turned on and I can be turned off and so with that we can write code that says all right when you see the event that says the switch has been turned on now go over to the light bulb and call its turn on service so that it can turn on and all this is done with well either some very simple code or even without it through through web interface so you can do many of these things without coding so I downloaded home assistant put on my network and I let it discover all the devices that I had on my network and there were there were lots of things that I expected it to find like you know alexa google syrian type of home automation device or smart device I had on my network I expected it to find that well I expected to find my Apple TV's IP light bulbs I can able thermostats cameras that you have any network or IP enabled locks in your house I I expected to find all those things but when I ran the discovery house well a little surprised I'm ashamed to say as an InfoSec professional all of the different things that I discovered on my network it found and made available for automation all of my networking gear that I have an advice through plug-and-play why would you want to use networking gear it turns out that that's actually really useful it finds all the services that were running on all of my computers so like if a machine in the house had an iTunes library I could consume the videos and the songs that were in that iTunes library part on the system do things with it broadcast them - well the televisions that I have in your house so any I can able tell it discovers those and it'll interface with those discovered blu-ray and DVD players in my house that have no networking capabilities so there's no Bluetooth on them there's no network interface on them they are just devices that have HDMI out that plugs into my television I'm like what how in the world did it find my blu-ray players that aren't on the network turns out that it well it discovered my harmony remote control which is on the network and it read its configuration and because it can interface with the remote control they can use the remote control to turn off and on the different devices that the remote control knows how to use that well aren't even on the network it found my Sleep Number beds and it knows well whether I'm in bed whether I'm out of bed it knows my sleep numbers right knows way too much information about it by my security system they turn off and on my alarms which is a little scary we'll talk about that a minute and all this stuff after it finds always think it provides you with an awesome pre-built web interface that you can go in and can control all of these different devices so here you can see in this web interface it knows when the Sun is up or down it knows when these people are home this is actually based upon many different services that you can have in air but one of the ways that can know is your homes you can inspect your art cache right it can walk use that remember I said it discovered my networking devices I can tell if this is the MAC address for my for my phone and if that MAC address ever appears in the art cache on my wireless numb network then it knows that I'm home it can use that as a tracking mechanism to well do things based on back on them maybe notice the humidity temperatures if you got any of those types of devices so all these get some components that are appear up here to give you information and then you can control them with switches on the main page and that's system bhogle interface there's also but really the power of comb assistant is look at the numbers inside these boxes there's 30 different alarm systems and talks talk to 12 different cars when they're sitting in your garage climate control systems environmental systems health webpages things like that it's insane with this thing talks to it well just go out to their web page there you go to integrations or you can see all kinds of things that it talks to so let's just come down to I don't know fans all right here's all of the different types of fans that it can talk to on your network we go to help right we can see things like there's like the Sleep Number beds it'll talk to Kovac 19 database so it'll monitor online Kovac 19's and it can take automation them have automations that happen when it sees certain devices right we got transportation where it can talk to it can talk to different well train service you know the stranger you can call yourself a lyft or an uber when certain events happen within your house so it is it's got extensive integration into all kinds of online services as well as just about every type of device that you want all right I just saw this posted recently this is the component that they're about to commit to it which will track the status of your oral-b toothbrush you know your oral-b toothbrushes are now wireless enabled or Mac bluetooth enabled and it will know your your toothbrushes state as to whether or not it's idle running whether or not you've had a daily cleaning tongue whitening whatever those different settings are the brush mode in your while so it is well extensive to say the least in the different types of devices you can integrate into this thing all right so all kinds of integrations of this thing and with each of the integrations it's got pre-built widgets that will appear on websites that you can use to well track the state to change the state so here's a thermometer I can come up here and slide this around to change the temperatures in my house and all of this is designed with zero coding right the idea is that the average consumer can stand up a home assistant well either raspberry pie or run it on a docker or put it on any laptop they have on their system that can run Python modules and then they can begin using this to do home automation it also includes a really cool logging right so I'm here if I just go into logs here I can see downstairs thermostat occupancy so this is it detecting the Greenes are when someone was in the downstairs and well the Reds are when nobody was in the downstairs here's tracking based upon individuals so I can see when mark was home or away home or way so I can go back historically and see when people were either in rooms or home the things that it doesn't set right it's it's got hundreds and hundreds of integrations but if it doesn't have what you need you can create custom integrations so I have this weird intercom system that came built into my house where I've got little audio panels that are intercoms that are inside the different rooms and it's by Legrand plug right on cue and there was no Legrand on cue integration with home assistant out of the box but they cried easy use templates that you can download on their their sample code and then with a couple of modifications to get here you can see I create a little program called media player that interfaces with my Grammie system it's two hundred lines of code of those two hundred lines of code I probably wrote thirty of the lines and the rest of it was all template ID and now this thing supports custom components that I have in my in my house that will just aren't common elsewhere now the way you configure this is through Yam all right yet another markup language and you can see over here on the left an example of some ml code that is creating these switches over here on the right so these are all switches that I can use to turn off and on different states than the house over here I can see an input input boolean which is the tag for each of these switches I can see I have a switch named automation lights which the value of it is automation lights the name is light automation which appears here and its initial state is on that I can define the icon that is associate with it so by just creating each of these all of these little switches now appear in my web interface and I can go in there I can click the switch and we'll toggle back and forth now when it toggles back and forth what it does is it puts a message on the event bus that something else can then consume and take actions on but by itself just creating these switches really has no action other than well creates some some things that happen on the event bus now you see this one that says some password right that I have a switch there's name is a password we'll come back to that and you'll see where I use that later in the challenge now I've got all this switches right there just on there then I can go into the web page and I can toggle them but for an escaping I don't want people to go to a web page and start clicking on button that's right I want them to just be able to do things well those switches are all controllable through Alexa or through Siri or Google Voice whatever your system is through this thing that they call the Philips hue emulator Philips hue is a Philips he makes all the light bulbs the IOT light bulbs you have in your house and it has this Philip Q hub that you have in your house that controls all these lights well Alexa Google and Siri they all integrate in with Philips use because it's a widely used product well home assistant will appear on the network as a Philips hue bridge which means that will Alexa Siri all these other devices they can well they see it as if they see every one of these switches that Homa system provides as a light bulb that it can give a voice command turn on turn on the escape game and this will this will tell I say that to say lxr Siri it then sees a light bulb that it turns on flicking this switch so when it does if I was to say that it would then flick the switch on and the switch would move from the left to the right when that happens it then puts an event on the event bus that I can consume and react to now the way you react to those is through triggers can dish and actions so the trigger is going to be the thing that well we're looking for an event bus conditions are going to say only execute for this of that if that event curves and these other things are true then the actions what you want to do I know it's really small zoom in each lens so this is the trigger right in this case I've got a trigger that says look for in my downstairs thermostat and check the occupancy and when that changes when the state changes from unoccupied to uh naki or from unoccupied to occupied then I want to well check some condition conditions and then take an action here's my condition I only want this thumb the action occur if that triggers and device tracker for mark right the thing that says Oh marks MAC addresses on the network says that mark is home if those two conditions happen and the Sun it's before sunset and after sunrise so the Sun is up then call a service called a media extractor service to cut up the place of media and it will play media on well my Sony television so to turn on the television if the phone is off it turns it on if it's on some other channel it stops it flips it over to this service and then it'll play this YouTube video on the television so if I walk into the home if I if somebody's in the kitchen and I am home or in the living room and I'm home then it will play this video would be one example of a script that well I wouldn't leave on because it was annoying but it was just a it's just a demonstration of the kind of thing you can do now some and also call this and execute this other script called escape walk so in addition to configuring through the web interface you can also configure this stuff through ya Mille so I could create a script here and you can see an automation the name of this this automation is called goodnight and what this one does is the trigger is when there is a when my Sleep Number trim changes in state two on the Sleep Number on state is triggered when well when I rely in bed right so when I lie in bed then the Sleep Number state goes to on I have some conditions set around it and it says if all of the devices in my house so my wife's phone is home my phone is own my children are home then if all of the devices are home and it's after 9 o'clock then turn off all the lights in the house turn all the lights off and go into my alarm panel and arm the alarm panel so it'll armed the security system in the house if it's after 9 o'clock and all the devices are on all right so that's my goodnight script this is my great night script if we're in bed and the kids are not home then set the lights in the bedroom to 50% until Alexa to play the romantic playlist in the bedroom yes ok this is not this is not a good idea this is actually not very effective because as it turns out the effectiveness of a romantic gesture is inversely proportional to the amount of automation that's being used sorry up here at the top is writing poetry no automation whatsoever then scheduling your gifts like your anniversary gifts automatically and based on your mercy and robots for dinner and way down here on the bottom of this is having Alexa tell your significant other that it's time for look right it just it just doesn't work out for you in the past so so that's not necessarily good script but it's a cool little strip to write ok alright so now I've got these scripts I can I can and this was with no code everything you saw so far all that automation was no code whatsoever so I can say Alexa turn on the escape game and it will flip the switch and then I can have automation that will well take action in that house automatically based upon me telling you to do this alright so I'm gonna show you my automation that happens when I say this if I was to try and play this video here in inside of the inside of this goat training session it just wouldn't work out so here I'm going to give you I'm going to copy and paste this URL into the chat session okay so I'm go back into go to training then I'm gonna go chitchat and I'm going to paste this into chat troll be pitch will be boom alright so that link I post traces it twice let's try this one more time alright so if you watch that link I'm gonna give you a minute or two for everybody to click that link and watch the YouTube video what happens when I say Alexa start the escape game you'll see a couple things happen one is this light bulb all the lights in the house are going to turn off this light bulb above the television will turn blue the front door will lock and then the television which is currently off will turn on and then play a video all right so I'll give you a minute to watch okay I don't I guess you didn't see the link all right here went give me one second oh so Jessica I don't have sent to entire audience on my checklist can you copy and paste that into the window for me I can do it over on this other computer here ah thank you thank you very much Jessica all right I was just a second behind you here you know okay so there's that video go ahead and click that link that's not work and I'll remove these greater than enough son you you you you you you um video is not restricted good you might have to type it in manually you yes all right so it's it's a little much right but I got to tell you if you're going to build an escape room in your house there is no way that you are going to convince your friends and family that you are not a nerd so you might as well own it okay all right I think some of you were having some some trouble with that video I'll give you another second to watch it there's another link there if you'd like you can type it in manually you you all right so everything that you saw in that video could be done 100% with zero coding right that was just going to a web interface I created the animal for the switches I think we go into the yamo and say all right when this we also have the Philips hue emulator so you can control with your voice and then we have the action since when this trigger occurs play this video throughout the house no coding required for any of that stuff all right but if you want to build a game you're gonna have to get into some coding and you have to do some operations now when you download home assistant you will see this thing that says python scripts Oh python scripts I really want to do Python scripts that sounds like exactly what Mark with you know Python scripts are a huge disappointment inside the Python scripts you can pretty much only do the same things you can do in a Yambol script so you can't import files you can't do anything other than well the same thing you can do with just the animal configuration so don't be sucked in by the allure of Python scripts in there it's probably not what you want to do what you really want is what's called the app demon and the app demon is not installed by default when you install home assistant it is well a second module that you download install written by the same folks at that write that written home assistant and it gives you full control of doing full Python scripts where you can import you can do anything you can do in Python you can do in and in the abdomen you can either do it an asynchronous Python mode or just standard procedural code the same thing that you doing in the most basic Python programs because you fold if-then-else logic because you can do whatever you want okay so this is what the code looks like in my estate game in order to define a app demon application you have to define a class escape game this is standard that you're going to have in every module you are gonna have to have an initializer function and then this is the this line inside the initializer this is what says what we're listening for on the event so here I've got this thing that I say I want to run the program called a function called a function called start game when the input boolean escape game switch changes its state from old to new from its old state to its new state to from off to on I think is when move yes from off to on WebEx was in a little bit I couldn't see it so when changes were off to on then call this start game function and down here in the start game function I'm going to recording the logs as the game started I'm gonna record the time because you only got 45 minutes to get out of the out of the room I'm gonna turn back off that escape game switch in the webpage so it's ready to go for the next time and then I'm gonna start checking the state of other switches so yeah I've got I got all these switches that I can have enabled for the different challenges so that in theory I could turn off and on certain challenges and and have it be a different type of game when you go through each time in practice I just leave them all on throughout the entire game and so I got a different switch for each and B different challenges and if that switch is turned on then I call a function that is associated for that lift a challenge so the way it works is you'll have a video very similar to what you saw before the video will then tell you that where to go and find something in the house such as a puzzle right that puzzle might give you a combination or something that might let you unlock a combination to an ammo box that I've got lying around the house they have these different combination locks on very much the same kind of thing that you might see in a traditional state room these combo boxes might let you find keys that unlock other boxes and things like that you do things that then trigger some IOT device to take action which then would turn on the television and play the next clip which will then walk you through the different challenges so I kind of have this cycle of going through each of these different steps so here's one of my puzzles right so this one says excellent job you show promise my young apprentice a hacker must be able to control computers using only their voice recreate the pattern at the bottom of this clue then things will start to look up for you start this challenge to start this challenge you must first say Alexa turn on hacking beats Alexa understands lots of commands like turn on downstairs lights turn on top so what happens here is when they say Alexa turn on hacking beats two things happens it calls the function that starts this puzzle and at the start of it it turns it plays dual cores hack all the things turns on all the speakers in the house and plays dual core hack all the things at a very loud volume throughout the house which means they're trying to talk to the Alexa and the music is playing really loud and they're trying to scream over the Alexa and what they're trying to do is get all the complaints in the house to be configured a certain way okay and once they get the lights configured such that they meet these patterns with certain things being off certain things being on and one light bulb being set to a specific color then it advances to the next challenge so here's the code to do that right so the thing that monitors the light pad and I got a function called light pattern inside I've got a sub function called lights right and our lights are right the lights are right this will return true when the lights are configured correctly it's going to look at my center light bulb and it's going to see if the living room center is turned it on its going to look at the top light bulb which is the leader on top and see that's set on if the right is set to off the left is set to off the hallway one is set to OFF Paulie two is set on and the hallway or living room Center is set to a certain RGB color red then each of these variables will be true the all function is used to look to make sure that all of the items in that list are true and if they are then this function returns true if all the lights aren't exactly right it returns false so while the lights are not right it's since Harriet logs the legs are not right it waits two seconds checks the light again weights two seconds check the light again and what's this various loop until the lights are correct when the lights are correct it'll come down to the next line or it'll say play use the media extractor to play on the Sony television this following mp4 and so you saw earlier where I used a youtube link these are video as well that I thought to myself I'll never put this video of me looking this stupid on the Internet so on these are all stored on a local server in my house where it plays the videos off on the television thank you so that's one of challenges but this is the hackers of princess right so all of the the challenges are have a hacker theme and so I also tell that hackers are Masters of Deception you remember in spider-man that Ned was the guy in the chair right the hacker and he was a master of deception he had to create a distraction for spider-man so there's well be dancing in the backyard challenge where you have to create a distraction so in this challenge I tell look you know I've got all these motion camp cameras with motion detection in the in the house I'm going to set the motion detection to low right then I need you to go into my backyard and I need you to have a dance party and then but it's got to be you got to be moving around enough to trigger the motion sensors with the with the motion sensors set below so I then tell it to you play Billy Joel's pressure everywhere so this begins playing on Billy Joel in the backyard throughout the house I get that the count on the number of camera alerts that I have and then why that's my start count and the current count and then while the start count is equal to the current count I'm going to update the current count so if the count doesn't change then it'll sit here in this loop again recording the camera count and sleep for two seconds when it finally does record a change it will log that dancing was detected dancing finished and then I'll make an announcement in the house alright so the announcement function again turns on the speakers and then uses a text-to-speech function to make announcements in the house that says warning bad dancing detected next clue will play in 60 seconds and then it sleeps 60 seconds and then it plays the next clue in the house I had this idea of using these little Bluetooth buttons so these little Bluetooth buttons by flick you can see on the screen I got one my hand here these are really cool they're their little Bluetooth buttons that you can like stick on your refrigerator or anywhere you want to when you push the bluetooth button you can have a Bluetooth receiver that knows the button was push and they can all send devices and triggers onto home assistant so I had this idea of using these buttons as an anchor challenge right then you would an anchor challenge you can think of that as you go into an escape room and it gives you a puzzle where you only got you've only got like one piece of the puzzle you have to collect all the other pieces of puzzle throughout the entire game and put them together and once you solve that big puzzle then well it lets you out so my idea was I would have these buttons that will be hidden in ammo boxes and scattered throughout the challenges and ultimately as you have to collect all the buttons to play a game of Simon right where lights would blink a certain color and you have to repeat that pattern in the light bulbs and so you know initially I have two of these buttons and you play something for a little by Wow and then it would get to a color that you don't have and you know I got to go and solve more puzzles to get more buttons that was the idea but as it turns out there I haven't implemented this for a couple reasons one reason is because what's Bluetooth and so I have the Bluetooth receiver there to receive these buttons and it worked okay but the problem was that well people who carry the buttons with them and go elsewhere in the house and then they would start pushing the buttons when they were out of range of the Bluetooth and I got some ideas of having a place they mount the buttons or something then bring them back into range and the Bluetooth receiver but it just fell by the wayside so at the moment all I got to this button is here's my button if I push my button at the moment and I push and push my button yeah what's this doing okay here we go oops hold on it we gotta sit up on my phone alright and the moment it's not doing anything right come on at the moment it's not working so I can't show it to you what what isn't this work and we start this over and we restart the the Bluetooth app you you you oh yeah okay all right seeing that isn't that exciting so at the moment this $50 Bluetooth button is yeah it's an electronic whoopee cushion where I push the button and makes fart noises okay now I know what you're thinking you're like wow we waited all that time for that we'll see here's the thing the immaturity of flatulence is actually inversely proportional to the amount of automation you so it's exactly the opposite of the whole romantic gestures actually you know if you you know it's really immature if you have no automation involved in something but you know the more automation you add you know bluetooth-enabled fart noises that's pretty good of course medically medical devices for the flatulent Lee challenge would be you know it's not even sure at all all right so it's inversely proportional to those things all right so other challenges I've got in there I've got actual hacking they do some actual hacking so I have the video points into a red page in the house and they go to the web page and on the URL it says some IP address question mark numb ghosts equals six and I go that web page again presented with pac-man and there are six ghosts impact man and so I figure you all they'll make the connection that there's six ghosts and they went to a URL no ghosts equals six and somebody will think to change these things from six to three but I did mention that this was a non-technical audience right I am I am surprised every single time that I do this with with non-technical folks and even even some technical folks even some people that well I consider to be really smart that would come over and not think to change the number of ghosts to something other than six well I think oftentimes people are just too distracted by the awesomeness of pac-man that they want to play pac-man as they do this but another challenge hackers are OSINT experts so I tell the hackers I say hey Aaron tell the players hey there's a switch inside my house remember I told that switch that's got some password in there there's a which in my house that is named after marks high school mascot and his wife's record-breaking time in 1988 so she had she had held a record in 1988 so I have them do some ascent on us to figure out what those times were and then they have to say turn on mascot name time and when they get both those items they will they can turn on the switch with their voice when they do that triggers the next clue the thing is in my house now because well everything it can see right it sees it knows what the volume is on the television knows what channel your televisions are on it knows the well the temperature on your thermostats it knows the number in your sleep numbers it knows which channel you put what buttons you're pushing on your remote control I just see combination locks everywhere right everything in my house is now a potential combination that I can have people discover and then type and then move forward on the next challenge there's different ways I can communicate challenges like I could well I could change the television to a specific channel and that channel be a combination that they have to type on the system and then or toggle back and forth between two channels and then those two channels somehow represent these combinations or I could set the temperature in the house to a specific number which is a combination in the house everything is now I see either ways to communicate or collect combinations from people to unlock these boxes there are some lesson learned right don't don't do the thing the things that I did so remember it's still your house right so some of these some of these challenges that I created may have been bad ideas I'm having people go into my backyard and do the backyard dancing thing in the rain and then bringing all that mud back into the house that one didn't work out well for me so that's when we have those switches in to turn off and on certain challenge so if it's raining now I want to have people go into the backyard and and do things outside maybe maybe it was a bad idea to ask people to do some open source intelligence gathering on my wife I don't know maybe that's a bad idea it didn't work out well for me you know either let's see oh I had a challenge once we're in order for people to advance they had to actually go and lie in my bed and that one didn't work out for me either so just just keep in mind that you've got people in your house that are gonna live there that well may not want people climbing into your bed at night and things like that so let me just some challenges that I've had to eliminate so what do you need to get started right so well you need some Python coding experience it well to do a game right mostly automations I mean think about think about this with just downloading the software and doing configurations through me Amal but you can completely do an automation that will knows when you come into the house based upon your MAC address right showing up in the wireless or it will also enter feet interface with apples where's my iPhone or where's this thing so it can know where you are you can have it well set the temperature in the house when you come within range IMT device if you just have well a television set that is on your wireless network or plugged into a wire note if your television is on the wireless network if that's the only IOT device you have you can have it set up where when you come home right it detects that your phone is now on your wireless network and it turns down the television to a certain channel or time-based events if the Sun is up and certain things happen it can go and monitor websites right and monitor websites and so look at the cove 819 infections and if the Kovac 19 infections drop below 14 a day which here in the state of Georgia we just drop below 14 add a new infection we some milestone was for us today might be 14 um that you know it sends out an alert that says it's safe to go outside of your house maybe by bleed lights in your house or suddenly the the ideas of what you can come up with right there's no end it's the end of this really all you need to get this going as home automation home assistant dot IO you can download that module you can put it on a laptop and it will find your devices and let you configure them through a Landry interface you might be surprised by the amount of IT that you have in your house already alright so that's my dog if you if you'd like a copy of the code right that I have for you skate game or most of it I put it all out there for four reasons okay but you make a copy and I'll share most of the code with you you can even reach out to me on Twitter on at mark Baggett my direct messages are open so you don't have to follow me you can just send me a message and I will respond back with a copy of the code if you'd like that and with that we have about well about ten minutes left that I can take questions so if you have any questions for me I'm going to type those into the question box and I will try and answer this if there aren't any questions just do me one favor before you take off I think Jessica is going to drop an eval link or probably already did drop an eval link into the chat window if you wouldn't mind clicking that and filling that out into anything stands before you'll know how important those artists and so appreciate it very much we take just a minute to fill it out and with that I'll answer some questions have you done any testing on how much of the information it collects is sent outside of your network excellent question so it is one of the design goals of home assistant right you of course I've got my perimeter in the firewall I'll get my firewall lockdown where every device that my inside my network that wants to talk to something on the Internet I have to open up those destination IP addresses right and every time I bring in a new device it always wants the phone home to this callback service so they can subscribe to these things but one of the goals of home assistant is to replace all of those web pages on the internet they've got a service that what happens is these different devices will anything that they can either through man in the middle or spoofing different services and appear to be those surfaces they will have keep all that stuff on your local Internet and then you can stand up inside of a cloud service this thing it's called Casa something I skipped over the slide it is called let me find it Nabu Casa okay you can either use namu Casa which is a paid service where you stand up the small home assistant agent inside your network and then one on the cloud the thing on it in the cloud talks to everything that's out there and all of these devices talk to the home assistant something internally so it's like one connection outbound or it minimizes those it hasn't been one in my experience but it has reduced the number of connections that I have to have outbound and it's through a specific API so I can see exactly what's going on so it actually improves that if you have these IOT devices anyway let's see let's see there are some other questions let me scroll back up a little bit awesome friends from church must have been like we thought we were just gonna yeah they weren't really expecting the game how do you find a wife to accept that yeah my wife is awesome do you hate it when live demos don't work I do I do hate that let's say look how you think about the challenges have you done any tips okay when can you get cheaper or where can get so there are cheaper IOT devices I've seen some cheap lightbulbs and I found some cheap switches that I can use to you know just it's just like an IOT plug that sits in between the electrical outlet and these things that you can turn off and on and there by smart home and they are they're relatively cheap it's like a five-dollar thing but I am sure well I'm not sure but and it's all got changed firmware on it and stuff like that so you know what are you taking a chances I guess um let's see great webcast thank you for kind of thank you for coming out I don't know if you've answered this already but I only got here can you call home assistant as a platform to manage off yeah so home assistant they've got they've got it as a Raspberry Pi operating system so I think they call it raspy no raspy home assistant raspy or something like that it's it's you can just install it on a Raspberry Pi you can install it as a docker on the system or you can download it as a Python module so they've got lots of installation options you can see it at home assistant do it is intended to be a platform to manage everything that's on your network how many devices more or less can have the system I don't know that there's a limit to the number but there I'm sure there is but I haven't even come close to it well they're recording be available yes how much of your IOT traffic is in the house is encrypted at TLS and things like that um well I think it's about internally on the network I think all of the external services that go on the internet I believe are encrypted the one thing that I know is not encrypted on my internal house is that custom a custom IOT device that I found because the Legrand HQ but that never leaves my network it stays internal I I know that doesn't make it ok let's see thank you Mark you're welcome ok I think that's all my questions that I've got there if there aren't any anything any other questions we'll wrap it up thanks for coming out actually we got eight more minutes eight more minutes if you join late I'm gonna use my last eight minutes to show you once again my movies written in Python okay so there's a lot more people here than they're worth pre-show I'll go through the movies written in Python one more time give you guys a chance if you already I'm sorry well I guess you can't see the answers to this so I'll just go through them all right let's say in this movie written in Python this is you I got another question how do you protect your MAC address in each event this one is Captain America the First Avenger let me answer is your MAC addresses aren't going to go out on the internet they're going to stay locally on the internal network but on its when it connects to the Wi-Fi here in the house but that MAC address shows up on the kam table on my internal network this one is Captain America the First Avenger about this length say 1955 movie movie 1955 take your answers into the questions if you know singing in the rain very good singing in the rain out of this one 1975 movie released in 1975 here we input the SIS model we look persist at version info and the version of Python is Monty then it is it is Monty Python and a search for the Holy Grail here we use the regular expression search function to look for guerre Grail in the quest and we find it right here's the results it's in the 95th position in the results our 2011 movie 2011 let me compile we pass it some Python bytecode and it gives us back something that says cast contain is Jake Gyllenhaal Michelle Monaghan and then it prints the cast no it's not transformers so what is this thing giving me back what is this one I give it some bytecode what is uncle going to give me back beat it bytecode and want to get back to him here's the actual program itself also known as it is source code the source code was a Jake Gyllenhaal movie yes excellent job 1999 movie movie 1999 it is the sixth sense right we got a list here of senses when you pull things out of a list you give it a position this is position 0 1 2 3 4 so the 5th position 5 is the 6th sense what is the name of the conference or event you host annually again I'm one of the organizers of b-sides Augusto besides Augusta in Augusta Georgia thanks Thomas all right that is the 6th sense by Bruce Lewis 1991 movie oh I don't like that one ok 1993 movie 1993 movie who's gonna take it first and the winner is James James wins The Last Action Hero so we got list of action heroes so that's just a little Chuck Norris and Arnold Schwarzenegger who is in position negative one which pulls out the last action hero ok 2002 there this is some advanced Python code we're creating a special type of error or exception right called the you can exception we have a function called me the checks on identity and if the identity is not right it raises the you can error very good James this one is catch me if you can write the error is that you can arrow right we wrap the me function inside a try except block if an error occurs this little catch the you can error on function me this is catch me if you can catch me if you can 1990 you 1990 we got to lists the map function is used to well join together the items from each of the lists by zipping them so it does a zip where it takes the first item in the list put some them together second items the list puts them together and so forth so what do we get as a result of this you get a new list it contains three to one it contains dances the Hustle the twists the Charleston the renegade and salsa with wolves the grey wolf the werewolf the Teen Wolf the boy who cried wolf and a big bad wolf this is Dances with Wolves alright 1999 this is going to create but numpy is used to create arrays of arrays or grids also known by another name so it's going to create a 10 by 10 array of arrays in position 1 comma 1 it puts the 1 it is the matrix excellent sir Addison well done ok position 3 comma 1 is Trinity position fives agent Smith and 4 2 is cipher each of those are in the matrix alright 2010 2010 we have a dictionary called teams that the key of C we have Cowboys Kia par we have Redskins key baby I'm Astros TV we have Vikings then we do a get to retrieve the a-team very good Shane Shane got that one first the 18 2017 what movie is this you you excellent dan this is Dan got that one first it is ghost in the shell' we're opening up a copy of bin Bosch which is the linux shell we're reading it in as a binary byte string then we're going to look to see is Casper a ghost in the shell' we get back true there is a ghost in the shell' 2004 that's our last one we import the date time function as a date or import date/time date we import the random function we then have we then have a function called get first which takes in d1 and d2 and returns the minimal one the minimum one of b1 b2 we then have a for loop which says for I in range 50 we choose a random date assigned to X we choose a random date Santa Y and Wade comes up with 50 first dates so it's going to choose two random dates call get first pick you figure out which one is first and print that so this is 50 first dates 50 first day so okay all right it is 931 and this is repeating back then so thanks again I appreciate your time I hope you guys are staying safe hope you're enjoying sans free at night talks and one thing that to point out look for a free workshop that I'll be doing I think it's on May 19 we're gonna be doing a free workshop where we're going to be using Python to geolocate IP addresses and wireless networks it's gonna be a two and a half hour workshop where the intention is really to teach you some teaching some geolocation techniques so keep an eye out for that coming up soon and that's it for me thanks thanks again for everybody if you didn't fill out an email to do so and have a nice night