[00:00.520 --> 00:01.640]  First off, who am I?
[00:01.760 --> 00:02.940]  My name is Kody Kinzie.
[00:03.120 --> 00:04.060]  I am a security researcher.
[00:04.300 --> 00:12.320]  I work at a company called Varonis, and most of what I do is live streams, education, and outreach to beginners.
[00:12.700 --> 00:24.960]  So I started a long time at a YouTube channel called Nullbyte, and I've learned a lot since then about doing outreach events and even getting funding for some of these things when I really want to meet new people or do an event that I'm really proud of.
[00:26.500 --> 00:27.160]  Let's see.
[00:27.920 --> 00:28.700]  What do I do?
[00:29.160 --> 00:31.000]  I am a Wi-Fi security researcher.
[00:31.280 --> 00:35.800]  I really like microcontrollers, and I also am the designer of some ethical hacking hardware tools.
[00:36.080 --> 00:39.020]  So if you're interested in all those things, that's kind of what I'm going to talk about.
[00:39.260 --> 00:44.680]  And also, if you're interested in learning more, I have a village here called Script Kitty Village.
[00:44.880 --> 00:49.320]  And you can learn everything to go from a Script Kitty to a fallen hacker at the conference.
[00:52.280 --> 00:56.020]  So what exactly can we unlock with microcontrollers in education?
[00:56.420 --> 01:03.740]  Well, one of the first things is obviously ethical hacking lessons and getting people to understand their first steps into either programming or cybersecurity.
[01:04.460 --> 01:06.640]  Another one of them is programming in general.
[01:06.880 --> 01:09.180]  So Python is one of my favorite languages to program in.
[01:09.320 --> 01:11.260]  I am not so great at math.
[01:11.260 --> 01:21.360]  So as a result, I prefer languages that are interpreted rather than compiled.
[01:21.740 --> 01:26.140]  And I've taught both types of programming, and I really, really prefer Python-based.
[01:26.300 --> 01:30.460]  So we're going to talk about how I've managed to pull that off on a very, very small budget.
[01:33.140 --> 01:35.940]  All right, so... sorry, still catching my breath.
[01:36.660 --> 01:40.980]  We're also going to talk about some of the case studies that I've done over the last year.
[01:41.280 --> 01:46.300]  So these are times that I've taken either grant funding or very, very slim funding.
[01:46.460 --> 01:51.320]  And I've stretched it to do engaging and exciting events for a number of different partners.
[01:51.320 --> 01:54.320]  So we just finished up Tour Camp 2024.
[01:54.960 --> 01:55.860]  That was stressful.
[01:56.140 --> 01:59.080]  We had a lot of kids for not the first time, but the second time.
[01:59.220 --> 02:05.360]  And I think we did a good job of learning what kids really like to do and how you can make engaging projects for them for a very, very cheap cost.
[02:05.800 --> 02:07.480]  We did CyberCat Academy.
[02:07.480 --> 02:08.440]  That was in Montana.
[02:08.640 --> 02:16.100]  And this was with grant funding that allowed us to meet with a bunch of really smart kids at the expense of the state, which is really wonderful.
[02:16.140 --> 02:20.020]  So it was completely free and teach them cybersecurity over the course of five days.
[02:20.020 --> 02:21.280]  It was really awesome.
[02:21.440 --> 02:22.020]  We got great results.
[02:22.160 --> 02:24.860]  And we'll even redo some of the feedback that we got from the kids directly.
[02:25.840 --> 02:30.820]  So I also in Montana reached out to our local makerspace and started doing classes there.
[02:31.020 --> 02:38.620]  If you've ever wanted to build a community at your local makerspace, you probably know that the best way to meet other cool people in your area is to just host a class.
[02:38.800 --> 02:49.580]  But often it can be really difficult to find subjects where you can teach a whole bunch of people without just making it cost a ton of money or having to make a lot of assumptions about the infrastructure or the knowledge of the attendees.
[02:49.960 --> 02:59.880]  I've managed to come up with a couple of projects that eliminate most of these assumptions and make it so you can go and teach at your local hackerspace, meet other people who are interested in this sort of thing, and maybe even make some money on
[02:59.880 --> 03:01.540]  the way, or at least not lose it.
[03:04.400 --> 03:07.680]  Oh, and the last one is, we also worked with Nullspace Labs.
[03:07.840 --> 03:17.000]  So if you have a local hackerspace who needs money, often they are trying to teach classes in order to get people to attend their space, to pay the rent.
[03:17.880 --> 03:28.600]  We try to use the goodwill that these hackerspaces have in the community to host classes that they can afford in terms of hardware, because often they are also on a shoestring budget, to raise money.
[03:28.600 --> 03:35.700]  So if you are running a hackerspace, a makerspace, and you're looking for outreach projects to help, you know, pay your rent, I've got some good ideas here.
[03:35.840 --> 03:38.460]  So I know that's constantly a problem amongst hackerspaces.
[03:40.620 --> 03:55.340]  So last year, we did about twelve workshops in Los Angeles, seven workshops at the C3 conference in Germany, we did seven workshops at the Missoula makerspace and the Kalispell Public Library, and we also did a week-long cyber camp.
[03:55.340 --> 03:59.720]  So that was about 75 hours of instruction time between all of my team.
[03:59.980 --> 04:05.140]  We do a lot of online videos, but we also do these in-person engagements, and 75 hours is a lot of instruction.
[04:05.580 --> 04:07.640]  Some of it was repeat, but a lot of it was original.
[04:07.680 --> 04:13.360]  So we worked on creating a lot of teaching material to make sure we could get a lot of action.
[04:14.640 --> 04:15.340]  Quiet, moo.
[04:16.380 --> 04:20.420]  To make sure we could get a lot of action out of a small amount of material.
[04:21.900 --> 04:25.720]  So you might also recognize some people here from Nullbyte.
[04:25.880 --> 04:37.640]  So I created a YouTube channel a while ago with my friends, and I also signed up for a YouTube channel called Hack5, where I contributed videos on both with many of my friends for a number of years.
[04:37.640 --> 04:44.260]  In fact, one of them, who happens to have one of the most watched videos on all of Hack5, happens to be sitting somewhere in this room.
[04:44.440 --> 04:45.120]  And it's not me.
[04:45.800 --> 04:53.020]  But anyway, aside from doing that, we really focus on making online content and making it so...
[04:53.020 --> 04:54.060]  Oh, there's actually two.
[04:54.320 --> 04:56.300]  Now that I look at it, there's two Nullbyte people in the room.
[04:56.420 --> 04:56.900]  That's so funny.
[04:57.800 --> 04:59.500]  Strange to have us all back together again.
[04:59.760 --> 05:00.760]  But this was years ago.
[05:00.840 --> 05:03.280]  This was one of my first fortes into education.
[05:03.280 --> 05:05.940]  Making this YouTube channel really attracted a lot of attention.
[05:06.120 --> 05:11.760]  If you look up Nullbyte now, it has 800,000 subscribers, even though I haven't put a video on it for like two or three years.
[05:12.220 --> 05:13.660]  So, this reached a lot of people.
[05:13.800 --> 05:19.180]  And some people actually reached out to me at the conference and told me that this meant something to them, that they discovered these videos that had helped them learn.
[05:19.480 --> 05:26.440]  And my number one inspiration for these videos from the start was, I am poor and I want to learn as much as I can with what little resources I have.
[05:27.320 --> 05:33.860]  So, the Raspberry Pi was one of the first things that I started doing videos on because I assumed everybody had about $35 to contribute to a project.
[05:34.200 --> 05:36.300]  This is no longer necessarily true.
[05:36.460 --> 05:38.120]  Raspberry Pis have become a lot more expensive.
[05:38.420 --> 05:48.380]  And nowadays, you expect to pay maybe like $150 for a Raspberry Pi kit because the most recent Raspberry Pis are so powerful that if you really start using them, they start to overheat and then they require accessories.
[05:48.620 --> 05:50.960]  And then they're basically just a little, you know, desk computer.
[05:51.400 --> 05:58.020]  So, Raspberry Pis used to be the way that you could get into doing some cool ethical hacking stuff for, you know, $35.
[05:58.580 --> 06:05.480]  Nowadays, it's much harder to hit that price point unless you're using maybe kind of sketchy Raspberry Pi 3B pluses off of like AliExpress.
[06:06.160 --> 06:09.100]  So, the reason why I love them so much was you could do Python.
[06:09.420 --> 06:12.800]  You could do a lot of Linux things that people understood that were great for basic lessons.
[06:12.980 --> 06:15.820]  But the economy of this... is it fighting... who's fighting back?
[06:16.240 --> 06:19.300]  The economy of this has started getting worse and worse over time.
[06:19.700 --> 06:24.020]  As Raspberry Pis have started getting more expensive, it's become harder to teach big workshops with them.
[06:24.040 --> 06:27.220]  And my fellow instructors at Cyber Montana really struggled to source these.
[06:27.220 --> 06:29.660]  So, they started working with LePotato.
[06:29.920 --> 06:35.460]  And the feedback for LePotato was mediocre just because it wasn't as well supported.
[06:35.800 --> 06:39.840]  And the kids ended up having some problems that didn't have good answers online.
[06:40.460 --> 06:45.600]  So, Raspberry Pi kind of is the gold standard, but a lot of instructors have been forced to go to these kind of third-party alternatives.
[06:45.840 --> 06:46.960]  I tried LePotato.
[06:46.960 --> 06:48.280]  I did not use it in my workshop.
[06:48.500 --> 06:50.080]  Instead, I switched to microcontrollers.
[06:50.080 --> 06:51.040]  And I had a pretty good experience.
[06:51.300 --> 06:59.780]  So, I want to share why I think that now is the moment where, if you're teaching, microcontrollers might be your best bet for getting some of these really great workshops out at a budget you can afford.
[07:00.940 --> 07:08.880]  So, I got my introduction to microcontrollers at the School of Worf, as it's commonly known, because the actor who plays Worf actually went there.
[07:08.880 --> 07:11.220]  I went to Pasadena City College.
[07:12.160 --> 07:14.360]  Any applause for people that...
[07:14.360 --> 07:15.000]  Yeah!
[07:15.540 --> 07:15.700]  Okay.
[07:16.240 --> 07:17.660]  You went to school with me.
[07:17.800 --> 07:18.080]  Come on.
[07:18.680 --> 07:18.940]  Anyway.
[07:20.020 --> 07:23.700]  So, Pasadena City College is where I went to school and learned about microcontrollers.
[07:23.800 --> 07:25.320]  They have an excellent class there.
[07:25.440 --> 07:32.740]  They got me started in understanding how these cheap little microcontrollers could be used for one-off projects that proved a point, that showed a concept.
[07:33.160 --> 07:38.520]  I also started working with people in the community who are making open-source projects that I really admired.
[07:38.700 --> 07:46.840]  And I started doing these capture-the-flag events and other school-related activities where I would bring in students who were interested, and we would do workshops.
[07:46.840 --> 07:49.880]  We would try to use these microcontrollers, and it sucked.
[07:50.240 --> 07:51.620]  I had a terrible time.
[07:51.780 --> 07:53.260]  The students also had a terrible time.
[07:53.420 --> 07:54.800]  It was discouraging for beginners.
[07:55.040 --> 07:56.460]  It was hard on the instructors.
[07:56.680 --> 08:05.060]  We learned more about the people's biosystems and all these other weird problems when trying to get them to compile stuff for these microcontrollers, and I did not like it.
[08:05.060 --> 08:06.220]  I stuck with it, though.
[08:06.480 --> 08:15.060]  So I started teaching microcontrollers about four years ago, and in the beginning, every operating system has a different software for serial programming and flashing.
[08:15.280 --> 08:17.740]  So this was often something students would have to download.
[08:18.040 --> 08:24.020]  So instructors would have to know the solution to a problem in three separate operating systems for every step of the way.
[08:24.300 --> 08:24.820]  Horrible.
[08:25.080 --> 08:25.480]  Awful.
[08:26.280 --> 08:29.580]  It would kill the class momentum every time students would have random errors.
[08:30.400 --> 08:33.540]  One solution we would find would only work for a particular operating system.
[08:33.860 --> 08:37.020]  So, you know, we would solve a problem, and it would only apply to maybe a couple students.
[08:37.380 --> 08:46.840]  And then more assumptions on the students' part, like having to assume that they tick all these boxes before they're qualified to take our class disqualified most students from actually learning.
[08:47.160 --> 08:50.000]  So we designed some workshops.
[08:50.260 --> 08:51.220]  This was one of our workshops.
[08:51.220 --> 08:52.620]  It was called the Chicken Man Game.
[08:52.620 --> 09:00.980]  And this was a Wi-Fi hacking game where we had a bunch of microcontrollers creating Wi-Fi handshakes that students were able to capture and crack.
[09:01.280 --> 09:03.880]  Now, we did that because we weren't allowed to do de-authentication at our school.
[09:04.000 --> 09:04.900]  They said they would kick us out.
[09:05.020 --> 09:09.340]  So we designed a microcontroller solution, and we taught people how to do this, but it was rough.
[09:10.640 --> 09:12.940]  So why are microcontroller classes so hard?
[09:13.120 --> 09:14.200]  Well, the setups are complicated.
[09:14.440 --> 09:15.620]  They use compiled languages.
[09:15.900 --> 09:17.920]  The classroom hardware struggles to keep up.
[09:17.920 --> 09:26.980]  BIOS settings will lock students out of being able to interact with a device that's maybe on loan to them from work or maybe a Chromebook from school, which is often the case when we're teaching these low-cost classes.
[09:27.520 --> 09:29.440]  Serial Terminal was also difficult to use.
[09:29.640 --> 09:33.400]  Every computer needed a different type of software to interact with a device over serial.
[09:33.580 --> 09:36.640]  So how do we get people to the point that they're ready to take our class?
[09:36.780 --> 09:42.480]  Well, these are the list of assumptions that we used to have to have for every student who was going to succeed at a microcontroller-based class.
[09:42.880 --> 09:44.260]  They can access their serial ports.
[09:44.400 --> 09:45.180]  That was the number one issue.
[09:45.360 --> 09:47.260]  If that was off, we couldn't teach them a thing.
[09:47.260 --> 09:49.060]  Because they couldn't communicate with the device anymore.
[09:49.360 --> 09:51.800]  That knocked them completely out of the class until we fixed their problem.
[09:52.720 --> 09:54.300]  Second, they can work with a command-line interface.
[09:54.460 --> 09:55.940]  A lot of people are not comfortable with that.
[09:56.080 --> 09:58.580]  And if they aren't, then it makes it really difficult to teach them.
[09:59.040 --> 10:00.540]  Next, can they get a compiler working?
[10:00.720 --> 10:04.960]  Maybe there's some random library installed in an incorrect way on their computer that prevents compilation.
[10:05.160 --> 10:07.660]  Now, our instructors have to chase down compilation errors.
[10:07.780 --> 10:09.280]  That means they have to be an expert in compiling.
[10:09.440 --> 10:11.960]  That just adds so much to who can teach this class now.
[10:12.440 --> 10:14.420]  Next, we have to be able to flash to the microcontroller.
[10:14.420 --> 10:15.300]  This isn't always true.
[10:15.420 --> 10:20.380]  Maybe there's steps involved that the students don't understand, and they are not holding down the right button in order to get it to flash.
[10:20.520 --> 10:21.240]  That's very common.
[10:21.820 --> 10:27.720]  Then we have to assume that they can install Arduino, import libraries and boards, which is its own series of steps that can be done very wrong with the typo.
[10:27.960 --> 10:30.560]  And then we also have to assume we have a good USB cable.
[10:30.720 --> 10:37.480]  You would think that that's not a big deal, but if students bring their own, One, this brings the class to a grinding halt while we try to assess a problem that doesn't exist.
[10:37.680 --> 10:42.320]  The person insists that it's the best, most favorite USB cable that they just got yesterday.
[10:42.620 --> 10:44.580]  And yet, when we swap it out, it fixes the whole thing.
[10:45.800 --> 10:48.580]  Seven, we have to assume that this person enjoys doing all these things.
[10:48.640 --> 10:50.880]  If they don't, then this kind of ruins the class for them.
[10:50.960 --> 10:55.340]  We might drag them through it, but it might be kicking and streaming if all of these things are unpleasant.
[10:55.340 --> 11:00.520]  I taught a class to the Norwegian Institute of Journalism, which is a, you know, mid-career training program.
[11:00.660 --> 11:04.160]  And I taught these people how to do all this stuff, and they hated it.
[11:04.280 --> 11:05.320]  They really did not like it.
[11:05.420 --> 11:08.840]  I think they learned, but if these were kids, I think that they would have rebelled.
[11:09.460 --> 11:14.100]  But as the state of Norway was paying for their education, like, they were cool with it.
[11:14.360 --> 11:16.040]  But it's a lot to ask from a student.
[11:16.580 --> 11:18.220]  So let's talk about the game changers.
[11:18.500 --> 11:19.700]  First off is web serial.
[11:19.880 --> 11:23.700]  This is something we've been using all day doing workshops in our Script Kitty village.
[11:23.700 --> 11:31.760]  You can connect over a Chrome-based browser to the microcontroller and control it, flash it, do all sorts of interesting things to it.
[11:31.820 --> 11:34.700]  So we teach a lot of our classes completely through a Chrome browser.
[11:34.940 --> 11:36.460]  We have the students install nothing.
[11:36.680 --> 11:36.940]  Oops.
[11:37.340 --> 11:39.700]  And it does not matter what operating system they're on.
[11:40.020 --> 11:40.500]  Amazing.
[11:40.780 --> 11:42.720]  You wouldn't believe how much of a problem that eliminates.
[11:43.140 --> 11:44.320]  The second is CircuitPython.
[11:44.540 --> 11:49.000]  With a language that is actually interpreted rather than compiled, we don't need to compile anymore.
[11:49.220 --> 11:52.820]  And students can make changes immediately on the fly and see the results of their actions.
[11:52.820 --> 11:57.220]  That shortens the feedback loop of them learning and it makes them more interested in actually making prototypes.
[11:58.380 --> 12:02.680]  So, something I love about CircuitPython is that you flash once and then you never compile.
[12:03.020 --> 12:07.380]  Once you flash the CircuitPython program to the disk, then you just drag and drop text files.
[12:07.600 --> 12:10.080]  This could be from a mobile device, from your phone, from an iPad.
[12:10.340 --> 12:12.800]  It gives you a tremendous flexibility to change things on the fly.
[12:12.960 --> 12:13.760]  Let me give you an example.
[12:13.860 --> 12:16.880]  I had a program that was running that had a NeoPixel that was very bright.
[12:16.880 --> 12:21.320]  And I was trying to see... I was trying to control a flash way off in the distance and the NeoPixel was blinding me.
[12:21.480 --> 12:27.260]  So I plugged in my phone, opened the text file that was controlling it, changed the pin definition on the NeoPixel and it turned off.
[12:27.580 --> 12:32.360]  That's how simple it is to go through and change a program that's running on a microcontroller that is running CircuitPython.
[12:32.500 --> 12:37.700]  And that's super useful to me because it means students can change their designs incredibly rapidly and learn from their mistakes.
[12:37.700 --> 12:39.460]  And not feel discouraged while doing it.
[12:39.600 --> 12:40.660]  The experience is super smooth.
[12:41.220 --> 12:46.440]  And some limitations are going to frustrate advanced users, but I typically am not teaching super advanced users.
[12:46.580 --> 12:49.920]  If I am, maybe they're against Python people that are first-time to hardware.
[12:50.360 --> 12:50.740]  So it's okay.
[12:52.160 --> 12:54.240]  So web serial, again, is pretty incredible.
[12:55.220 --> 13:00.780]  Random Nerd Tutorials is one of my favorite sources on this and they have a lot of really great tutorials that got me into microcontrollers.
[13:01.040 --> 13:04.780]  And I have to say, the impact on programming has been tremendous.
[13:05.000 --> 13:07.300]  We can do all these things now completely from a browser.
[13:07.300 --> 13:12.500]  Flashing the microcontroller with the bin file we compiled to be perfectly ready for the lesson we want to teach.
[13:13.100 --> 13:15.060]  Communicating with the microcontroller over serial.
[13:15.840 --> 13:16.720]  Project organization.
[13:16.720 --> 13:20.860]  So we can organize things and tell people to flash the correct thing when it's the right time.
[13:21.220 --> 13:23.080]  And flashing and learning on the same website.
[13:23.220 --> 13:32.540]  So we can basically have a single website people are going to and both flashing the necessary program to follow along and then also learning and going through the material on that page at the same time.
[13:32.780 --> 13:33.100]  Incredible.
[13:33.580 --> 13:35.280]  So we can now make fewer assumptions.
[13:35.520 --> 13:37.140]  This is what we're now assuming about our students.
[13:37.680 --> 13:38.520]  Every student has Chrome.
[13:38.980 --> 13:41.340]  Every student has a data supporting USB cable.
[13:41.520 --> 13:43.360]  And everybody has access to their serial ports.
[13:43.920 --> 13:45.640]  That, to me, made an incredible difference.
[13:45.780 --> 13:50.420]  It took this class from being horrible to teach to something that I actually advocate for other people to teach.
[13:50.420 --> 13:52.220]  Because that is a short list of assumptions.
[13:52.460 --> 13:56.060]  And in most cases you can meet that and then the lessons that you teach are up to you.
[13:56.200 --> 13:59.600]  Whether you keep them super basic for absolute beginners or get really advanced.
[13:59.780 --> 14:06.360]  This first step is designed to be as short as possible and to get people who are late to the class or have a problem caught up to the others in a matter of minutes.
[14:09.560 --> 14:13.980]  So let's talk about some of the microcontrollers that I feel like are leading the way into this educational space.
[14:14.200 --> 14:19.020]  We use a lot of them at our village and I'm going to recommend some of these based on a heavy user of them.
[14:19.320 --> 14:29.100]  And somebody who might not be like a designer of microcontrollers, but somebody who as an educator focuses on trying to make these fundamental building blocks as useful for beginners as possible.
[14:29.100 --> 14:32.000]  And I'll also talk a little bit about the price of each of these.
[14:32.460 --> 14:34.520]  So first we have the ESP8266.
[14:34.680 --> 14:39.700]  No native USB and sometimes people have to install a serial driver in order to connect to this over Windows.
[14:39.900 --> 14:41.780]  Disrupts the class a tiny bit, but not too bad.
[14:42.040 --> 14:49.420]  It has Wi-Fi support and for Wi-Fi hackers supports packet injection that allows me to teach not one, not two, but three separate classes on Wi-Fi hacking.
[14:49.740 --> 14:51.880]  Some of which are being taught here at this conference.
[14:52.040 --> 14:58.180]  Wi-Fi self-defense, Wi-Fi hacker hunting, and then also fox hunting for suspicious devices.
[14:58.180 --> 15:00.680]  All can be done on this cool little microcontroller.
[15:01.040 --> 15:01.840]  That's a lot of content.
[15:02.000 --> 15:02.720]  That's a lot of curriculum.
[15:03.160 --> 15:06.080]  It supports Arduino and MicroPython, but not CircuitPython.
[15:06.200 --> 15:09.980]  And the reason is because it doesn't support native USB, CircuitPython doesn't want to mess with it.
[15:10.060 --> 15:14.240]  It thinks it's too complicated of an experience to set up and it doesn't want to attach the CircuitPython name to that.
[15:15.040 --> 15:20.360]  One, another limitation to this that hackers have to keep in mind is it only sees metadata of packets it receives.
[15:20.600 --> 15:25.920]  So if you're trying to do advanced Wi-Fi hacking stuff like capture a handshake and teach how to crack it, this isn't going to be able to do that.
[15:25.920 --> 15:29.600]  But it will be able to do a number of other active attacks which are quite dramatic.
[15:30.100 --> 15:32.720]  And those are absolutely worth investing in if you're teaching cybersecurity.
[15:33.500 --> 15:35.280]  Next up we have my current favorite.
[15:36.620 --> 15:40.500]  Possibly getting interested in a new one, but this is my current favorite.
[15:40.620 --> 15:44.340]  The ESP32 S2 has native USB and it mounts itself as a flash drive.
[15:44.460 --> 15:45.780]  So when you plug it in, it pops up.
[15:45.900 --> 15:46.280]  That's it.
[15:46.760 --> 15:49.060]  That's as complicated as something needs to be for a student.
[15:49.340 --> 15:51.400]  It really doesn't need to be any more complicated than that.
[15:51.680 --> 15:54.600]  It supports CircuitPython, Arduino, and MicroPython.
[15:54.760 --> 15:57.180]  It does not do packet injection, but it does have Wi-Fi.
[15:57.340 --> 16:02.440]  So it's able to do IoT things, it's able to connect to Wi-Fi, it's able to scan and do presence sensing as well.
[16:03.440 --> 16:05.260]  It also has a single core.
[16:05.400 --> 16:09.840]  So if you're trying to run intensive things that maybe need two different cores, this might not be for you.
[16:09.960 --> 16:14.700]  But I feel like right now you can find this for about maybe like between three and five dollars.
[16:15.100 --> 16:18.940]  And that in and of itself makes it an excellent core for many, many different projects.
[16:19.060 --> 16:21.500]  And going back to price, you can get these for a buck eighty.
[16:24.380 --> 16:30.360]  Alright, my new favorite darling, one that we're starting to use in our prototypes, is the ESP32-S3.
[16:30.560 --> 16:39.060]  Now the reason I like this is it has all the benefits of the ESP32-S2, but it also has Bluetooth, meaning you can use a mobile application to control it.
[16:39.100 --> 16:41.920]  You can flash a lot of popular projects that rely on Bluetooth.
[16:42.180 --> 16:46.720]  We used one of these to flash Mesh-tastic to one of our devices and connect the LoRa radio.
[16:46.720 --> 16:49.380]  And we were able to send encrypted radio chats with it.
[16:49.540 --> 16:52.620]  So super capable microcontroller, has two cores.
[16:52.800 --> 16:53.540]  So more powerful.
[16:53.700 --> 16:55.240]  And you can get this for about five bucks.
[16:55.700 --> 17:00.580]  So on a five dollar budget, like Wi-Fi, Bluetooth, all these interesting projects supported.
[17:01.360 --> 17:03.140]  This is really an incredible deal.
[17:03.520 --> 17:08.040]  And the fact that you can then build this into other projects that have inputs-outputs.
[17:08.060 --> 17:13.060]  You can make prototypes based on like a mobile application or something that allows you to connect in three separate ways.
[17:13.060 --> 17:14.420]  As well as over serial.
[17:14.540 --> 17:15.560]  So I guess that's four separate ways.
[17:15.740 --> 17:20.680]  This really gives you a tremendous amount of inputs and outputs to consider when working with different students.
[17:21.240 --> 17:22.440]  The next step, the Pi Pico.
[17:22.840 --> 17:24.060]  I am a Wi-Fi person.
[17:24.240 --> 17:26.520]  So because this doesn't have Wi-Fi, I ignored it initially.
[17:26.740 --> 17:28.380]  But Raspberry Pi has a fantastic brand.
[17:28.480 --> 17:29.260]  They have great support.
[17:29.400 --> 17:35.100]  And they've made it really, really great to be able to use this microcontroller for all sorts of hardware-based projects.
[17:35.100 --> 17:41.120]  I also find RP2040 clones on AliExpress little postage stamp size for like 90 cents.
[17:41.360 --> 17:43.160]  So I sprinkle these projects on anything.
[17:43.440 --> 17:50.380]  Like they are so easy to use and they have so much great support that they're absolutely worth buying in bulk on AliExpress if you can find them.
[17:50.760 --> 17:57.000]  And SparkFun makes a particularly good breakout board for them that's often incredibly cheap online.
[17:59.540 --> 18:03.120]  So to sum that up, there's also the Pi Pico W.
[18:03.300 --> 18:06.160]  And that kind of deals with my concerns about this doesn't have Wi-Fi.
[18:06.300 --> 18:11.380]  It can't do some of these really interesting attacks or data-driven projects or IoT projects that I want to do.
[18:12.180 --> 18:14.740]  The Pi Pico W addresses a lot of those concerns.
[18:14.780 --> 18:17.800]  So if I was going to endorse any one of the two, it would be the Pi Pico W.
[18:17.940 --> 18:21.660]  Although it doesn't do a lot of the Wi-Fi hacking stuff that the Espressif chips do.
[18:23.240 --> 18:25.900]  Alright, so these are some of the partners that I worked with this year.
[18:25.900 --> 18:30.620]  We work with Cyber Montana, which is an organization in Montana, where I'm from, the Treasure State.
[18:31.100 --> 18:43.460]  And they are an organization that puts out money to attempt to get kids engaged in cybersecurity and get more people aware of cybersecurity threats and concerns.
[18:43.680 --> 18:48.100]  So a lot of the other instructors in the area were doing awareness-only training.
[18:48.220 --> 18:52.620]  Kind of just kind of scare kids into being aware of different threats and concepts.
[18:52.620 --> 18:55.400]  And we were the only camp who was proposing hands-on training.
[18:55.620 --> 18:57.660]  And they were like, there was a lot of barriers to that.
[18:57.820 --> 19:01.580]  But we managed to get a lot of grant funding from them the first year that we did this camp.
[19:01.820 --> 19:05.780]  Which was incredible because it allowed us to do some really amazing things for the kids.
[19:05.820 --> 19:09.140]  And it was offered completely for free to parents in the area.
[19:09.140 --> 19:18.700]  We worked with the Missoula Public Library Makerspace, who have, according to the International Association of Libraries, the nicest makerspace slash library in the world.
[19:18.880 --> 19:20.020]  Which is actually real.
[19:20.100 --> 19:20.700]  You can look that up.
[19:21.180 --> 19:25.760]  We worked with Null Space Labs in Los Angeles, who is kind of our home-based hackerspace.
[19:25.820 --> 19:30.000]  So if you've been to Null Space Labs, we got a Null Space Labs Enjoyer with a Null Space Labs shirt in the front row.
[19:30.840 --> 19:39.520]  And then we also worked with Flathead Valley Community College and San Francisco State University on student projects to present a number of different cybersecurity workshops.
[19:41.560 --> 19:43.520]  Alright, so I want to talk about the kids camp first.
[19:43.700 --> 19:45.220]  This is the one where we had to have the most creativity.
[19:45.220 --> 19:48.180]  And we designed a printed circuit board specifically for this.
[19:48.300 --> 19:48.880]  And you see this here.
[19:48.960 --> 19:50.080]  This is the Meow Mixer.
[19:50.080 --> 19:54.020]  And it is a cat-shaped board that students solder together.
[19:54.080 --> 19:58.340]  And when you twist the knobs, it actually changes the color of the cat's eyes.
[19:58.460 --> 19:59.340]  So it's red, green, and blue.
[19:59.500 --> 20:01.460]  It teaches about potentiometers, about LEDs.
[20:01.700 --> 20:08.440]  And it's a simple soldering project that kids can do in about like 30 minutes if they're a little older and probably about an hour if they're younger.
[20:09.300 --> 20:13.880]  So this was funded by a $15,000 Cyber Montana grant.
[20:13.880 --> 20:26.040]  They offer these to various STEAM summer camps and we were approached randomly out of the blue with this offer for a grant after doing a number of classes at the Missoula Public Library.
[20:26.740 --> 20:28.880]  So how did I get this grant?
[20:29.140 --> 20:32.820]  Well, step one, I did multiple free classes at the Missoula Public Library.
[20:33.160 --> 20:38.380]  Step two, I invited the entire board of Cyber Montana repeatedly to those classes via email.
[20:38.380 --> 20:46.780]  And step three, I repeated that over and over and over until enough of those people came to my classes and saw that what I was teaching was something they wanted to include, that they offered me the grant.
[20:46.940 --> 20:52.620]  They made a direct introduction to my local college and they said, we're giving this guy the money, we want you to help set him up.
[20:53.240 --> 20:55.800]  Me trying to do this by myself would have been an incredible task.
[20:55.880 --> 20:58.740]  And I wouldn't have even, frankly, wanted to do it because it would have been too much work.
[20:58.840 --> 21:03.280]  But with $15,000 in my pocket and a direct introduction to a venue, I was like, alright, let's do it.
[21:04.700 --> 21:06.000]  So, what was the schedule?
[21:06.560 --> 21:06.960]  Insanity.
[21:07.520 --> 21:09.760]  We really did it to ourselves.
[21:09.960 --> 21:20.180]  We had a friend who was in town who had no idea what was going on, but volunteered to be a helper after the college that we were working with gave us a number of excellent helpers and then one really weird one.
[21:20.360 --> 21:24.260]  So we turned down the weird helper and we had our other friend jump in, but he had zero experience.
[21:24.400 --> 21:31.500]  So we had to select projects that were simple enough that even somebody who didn't really have a lot of experience with this was able to step in and help kids when they got stuck.
[21:32.160 --> 21:38.160]  So, I'll let you look at these slides later if you'd like to see the level of insanity for the subjects we did, but we basically did blocks of different subjects.
[21:38.300 --> 21:41.400]  And one of the biggest things we had to cover right off the bat was ethics.
[21:42.120 --> 21:44.780]  We got a lot of... sorry, I'll show those later.
[21:45.040 --> 21:52.880]  We got a lot of feedback from both Cyber Montana and the instructors at the university saying, hey, are you actually going to teach these kids to hack?
[21:53.040 --> 21:55.520]  And we said yes, and they were like, we really don't want you to do that.
[21:55.520 --> 22:01.300]  So everybody else was doing kind of, you know, like kind of labs and things to kind of get you aware of general things.
[22:01.400 --> 22:05.480]  They really did not want us handing kids an object that they potentially could hack something with.
[22:05.640 --> 22:08.340]  We had to convince them that that was something that we understood the risks on.
[22:08.460 --> 22:11.620]  And we had to present to the kids and get them to understand the concept of consent.
[22:11.880 --> 22:17.380]  The concept of making sure that if you're doing something to someone's computer, you have explicit consent to do that.
[22:17.380 --> 22:20.120]  And that if you don't, that could be something really bad.
[22:20.240 --> 22:25.020]  And by the end of the camp, kids were calling out each other if they tried to do something that violated those principles.
[22:25.180 --> 22:32.840]  And I feel very strongly that we taught them the difference between right and wrong when it came to the principles that we taught them and the cybersecurity concept that we covered.
[22:33.140 --> 22:35.600]  I think that you need to anticipate this.
[22:35.600 --> 22:44.880]  If you're going to be working with any sort of venue and doing actual hands-on learning, there's always going to be concerns from burns with soldering irons to the fact that they could de-off the school network and cause havoc.
[22:44.880 --> 22:47.060]  That's something that you just have to keep in mind.
[22:47.600 --> 22:50.280]  But with a lot of back and forth, we got through it.
[22:50.420 --> 22:58.620]  And by demonstrating that we had already thought of that problem and had a solution for it, I think that that was the number one reason that they decided to let us go forward with it in spite of their concerns.
[22:59.000 --> 23:03.560]  So come up with a plan before meeting with the venue about how to address ethics.
[23:04.120 --> 23:05.280]  That's my little piece of advice.
[23:06.000 --> 23:07.920]  So next up, I had an idea.
[23:08.260 --> 23:12.920]  I was like, most of the places that I work with have 3D printers and sometimes a lot of 3D printers.
[23:12.920 --> 23:16.980]  What is the cheapest pit that I can build to do a huge class?
[23:17.120 --> 23:22.400]  Because frankly, the Missoula library doesn't pay that much and doesn't prevent hotels in Missoula from being really expensive.
[23:22.820 --> 23:29.320]  So as a result, I had to be like, how can I go to Missoula with like a hundred bucks max and teach a class of 25 to 30 people?
[23:29.420 --> 23:29.960]  Maybe more.
[23:30.360 --> 23:31.200]  That's really hard.
[23:31.600 --> 23:35.900]  So I created a class that was an IOT 3D printed light box.
[23:36.020 --> 23:40.200]  So the kids would 3D print these boxes or the venue would 3D print these boxes ahead of time.
[23:40.200 --> 23:44.020]  And I was able to make the electronics inside this box cost about three dollars.
[23:44.960 --> 23:48.260]  Five dollars if you also include the cost of the 3D printed plastic.
[23:48.620 --> 23:50.380]  That's a price point most people can get behind.
[23:50.560 --> 23:53.180]  And this project is really cool and it's evolved in various ways.
[23:53.720 --> 23:53.880]  Oops.
[23:53.880 --> 23:58.620]  So this project is a open-source project I found on Thingiverse.
[23:58.880 --> 24:05.260]  It's something that has a lot of different iterations and we kept modifying it in subtle ways based on the ways that previous people had messed it up.
[24:05.420 --> 24:06.320]  We would fix it a little bit.
[24:06.560 --> 24:13.040]  And finally, we also spun it into another concept, which is IOT, sorry, which is hex leaf kits.
[24:13.420 --> 24:14.600]  So which I'll go into in a second.
[24:14.960 --> 24:19.180]  But these initial boxes, which I still highly recommend, they worked incredibly well for us.
[24:19.180 --> 24:23.240]  And because they're Wi-Fi controlled, they support WLED, the kids can take these things home.
[24:23.360 --> 24:25.940]  They can connect them to their home network and remotely control them all day.
[24:26.040 --> 24:28.700]  They can do cool things with them and they can 3D print new tops to them.
[24:28.900 --> 24:31.060]  They can learn how to modify the existing ones.
[24:31.180 --> 24:38.800]  It sparks a lot of excitement and joy with kids and other people who want to create something beautiful, something lit and something that they feel like they have control over.
[24:39.580 --> 24:41.800]  This is about six soldering joints.
[24:41.800 --> 24:49.080]  So you can have shaky people, like at the Missoula Public Library, sometimes people who would just come in off the street and be like, I'm cold, what is this?
[24:49.200 --> 24:50.580]  Like, and they would sit down and they would solder something.
[24:50.920 --> 24:57.180]  So this was a project that was simple enough, cheap enough and engaging enough that you can do over and over and over if you have a partner with 3D printers.
[24:57.320 --> 24:58.880]  If you don't, this might not be for you.
[24:59.020 --> 25:03.020]  But most people either have access to 3D printers or the venues they're going to work with will.
[25:03.280 --> 25:04.840]  And that's why this project is a particular win.
[25:04.940 --> 25:06.580]  And you can iterate on it in various ways.
[25:06.580 --> 25:11.480]  So the winning strategy is, again, use the printers at the makerspace, the college, wherever you're going to go.
[25:11.680 --> 25:15.580]  Use low cost parts to make simple IoT devices that have a high impact.
[25:16.300 --> 25:20.680]  Something that's joyful, something that's fun, and gives kids the feeling of control and ownership over their work.
[25:20.800 --> 25:27.420]  Something that's short, but has a finite end, but is still something that's exciting enough to be interesting.
[25:27.700 --> 25:31.940]  And, you know, we also use this as some candy for finding their lost device on the network.
[25:32.080 --> 25:34.900]  When we were teaching networking, this was the task.
[25:34.900 --> 25:40.440]  They had to find their lightbox on the network, connect to it, and then log in in order to control it.
[25:40.580 --> 25:47.520]  And by adding a little carrot at the end of the, here's how a network scan works, we actually got the kids to participate and find their lightboxes.
[25:48.060 --> 25:52.060]  Oh, also, if you're going to print this, use warm white for diffusers, not cold white.
[25:52.160 --> 25:56.320]  I did it at the Missoula Public Library one time, and it was cold white, and the light barely went through.
[25:56.460 --> 25:58.500]  And they were like, eh, it's nice, cool, free class.
[25:59.040 --> 26:00.440]  But fortunately, it was a free class.
[26:00.440 --> 26:01.780]  So the expectations were pretty low.
[26:01.780 --> 26:05.740]  We learned our lessons, and now we only use white, or warm white plastic.
[26:08.180 --> 26:09.500]  Okay, so we modified this.
[26:09.580 --> 26:17.560]  So we went on and we did a project that I think is even more engaging, more exciting, and again relies on the concept of, I have cheap access to printers well in advance.
[26:17.740 --> 26:22.000]  So this is, let's say you talk to a makerspace a month ahead of time, you tell them, hey, can you print out a bunch of these?
[26:22.000 --> 26:27.320]  We started taking the same concept, and instead of that LED ring, which costs like, what, like a dollar or something?
[26:27.480 --> 26:28.800]  We started using LED strips.
[26:28.940 --> 26:32.280]  How can we bring the cost down to like $3, $2 instead?
[26:32.720 --> 26:34.420]  Because, you know, $5 is too much for me.
[26:34.780 --> 26:45.620]  So we instead started 3D printing these hex leaf kits and letting students kind of do a path in them, flashing LED the same way we did with the lightbox, and adhering them to foam tape and cutting it out.
[26:45.620 --> 26:51.620]  It looks just like those expensive hex leaf kits you can buy online that are like $100, but it costs literally $3.
[26:52.400 --> 26:53.200]  Pretty incredible.
[26:53.660 --> 27:02.360]  So I highly recommend these sorts of projects for short, simple, effective soldering classes to get IoT devices in people's hands, and then, honestly, we can use them as ethical hacking targets.
[27:02.660 --> 27:08.480]  Because they're Wi-Fi devices, we own and control them, and they have the basic necessities to teach a lot of these lessons.
[27:09.200 --> 27:11.140]  So today, where has this project evolved?
[27:11.140 --> 27:14.480]  Well, now I have become obsessed with these small Pusheen's.
[27:14.580 --> 27:22.020]  A legally distinct Pusheen similar character that glows from within and is a perfect diffuser.
[27:22.200 --> 27:26.720]  Now, we brought these to our classes a number of times, and I found these silicone diffusers on AliExpress.
[27:26.840 --> 27:31.040]  And while I love the 3D printed model, my own 3D printers are in complete disrepair.
[27:31.140 --> 27:38.440]  So in a pinch, I can get these for like $5 or so if I'm willing to wait a very long time on AliExpress in bulk.
[27:38.440 --> 27:41.180]  But I can take the base of it and do the same thing I did before.
[27:41.380 --> 27:46.800]  I can take a strip of cheap LEDs, run them around the middle, and then take the original diffuser and pop it back down on the top.
[27:46.980 --> 27:49.420]  And that upgrades these to being smart Pusheens.
[27:49.820 --> 27:53.500]  I can flash them with WLED and do all the same lessons that I did before with the box.
[27:53.620 --> 27:58.760]  But these are a lot cuter, and I can buy them in bulk if I need to, if I don't have access to a 3D printer.
[27:58.760 --> 28:08.960]  So if you like this project, but maybe your partner that you're thinking of working with at the venue doesn't have a 3D printer, this brings up the cost a little bit, but they're so cute that generally people don't care, and they're willing to pay a little bit extra for their Pusheens because they're squishy as well.
[28:12.660 --> 28:16.300]  Alright, so the next thing I want to cover is beginner-focused microcontroller development boards.
[28:16.300 --> 28:27.200]  So this is an open-source project that you might have seen at ScriptKitty Village or DevKitty, and they both come from the same open-source project and the same idea of taking these microcontrollers and breaking them out specifically for beginners to make prototyping easy and comfortable.
[28:29.240 --> 28:43.060]  So the things that we decided to add to this microcontroller was a built-in screen, an RGB LED, four D-pad style buttons, the Wi-Fi based microcontroller, plug and play GPIO, general purpose input output pins on the back, and the ability to just plug in and begin coding.
[28:44.540 --> 28:47.760]  Now, the inspiration for this board was my own cat.
[28:48.020 --> 28:49.320]  He is often called the Nugget.
[28:49.420 --> 28:50.440]  That is his nickname.
[28:50.760 --> 28:54.540]  Well, when he started, he was like a chicken wing, and now he's a Nugget.
[28:54.780 --> 28:56.620]  At this point, he's basically a rotisserie chicken.
[28:56.780 --> 29:05.080]  But the time that we picked this name, we decided to make a short little animation of his choppy tail on the back.
[29:05.200 --> 29:10.700]  And if you want to see if you have a genuine Nugget, you can look on the back, and all real ones have the stubby tail of the original.
[29:10.700 --> 29:21.020]  So, aside from the cat inspiration, the reason that we picked these microcontrollers was we realized they were powerful, they were great for teaching, but they were just these black boxes.
[29:21.300 --> 29:26.540]  They really didn't have any personality, and a lot of the tools that had been built around them were kind of like weapons.
[29:26.780 --> 29:29.660]  They were designed to be like weapons, or to be thought of like weapons.
[29:29.660 --> 29:36.140]  And I don't mean to knock Hack5, because I was on their YouTube channel and I use a lot of their products, but a lot of their stuff feels very offensive.
[29:36.240 --> 29:38.600]  And that's not necessarily always the case when we're teaching these.
[29:38.680 --> 29:42.720]  I teach Wi-Fi self-defense classes as well, where these are auditing tools for testing your own stuff.
[29:43.800 --> 29:45.320]  So, what is this tool designed to do?
[29:45.420 --> 29:49.000]  Well, it's designed to, first of all, use its native USB to teach bad USB attacks.
[29:49.140 --> 29:49.960]  And why do I love those?
[29:50.100 --> 29:51.580]  Because kids really respond to them.
[29:51.580 --> 30:00.780]  And anybody that hasn't programmed before, this is the perfect way to get them to think about scripting, by thinking about keyboard actions they could do to do something on the computer, and then making that into a script.
[30:00.940 --> 30:02.580]  That's why I love things like DuckyScript.
[30:02.800 --> 30:04.660]  But we wanted this to be a little bit more useful.
[30:05.220 --> 30:10.980]  So we made this as easy as possible to practice bad USB attacks, because it was a particular focus for us when designing this.
[30:11.160 --> 30:13.640]  It also supports CircuitPython, MicroPython, and Arduino.
[30:13.940 --> 30:15.300]  It can control hardware and sensors.
[30:15.780 --> 30:21.220]  And of course, anytime there's an interesting community project that runs on the same microcontroller, it's super easy for us to port things over.
[30:21.220 --> 30:25.080]  So for example, there's a drone ID spoofer that runs on our hardware.
[30:25.680 --> 30:36.580]  Somebody else made it, we ported it over, and if you plug it in, it creates like 16 fake drones that are flying around, according to OpenDrone, the new protocol for drones to identify themselves.
[30:37.040 --> 30:41.800]  So there's a lot of community projects you can flash over to this hardware, and I wanted to make that as easy as possible.
[30:42.740 --> 30:44.820]  So the USB Nugget OS is what I mentioned before.
[30:45.020 --> 30:48.220]  This is the bad USB program that I use to teach beginners.
[30:48.220 --> 30:54.020]  And one thing that's really nice is in the event that our people do not have the proper materials to do this.
[30:54.120 --> 30:56.120]  A lot of people will come to a class and they say, I forgot my laptop.
[30:56.460 --> 31:05.380]  Well, one thing they can do is they can plug this into their own phone, and then over Wi... sorry, and over Wi-Fi connect to a web interface and run bad USB attacks on their own phone.
[31:05.600 --> 31:14.720]  So actually, with a smartphone, you can execute bad USB attacks, because a lot of iOS and Android both accept keyboards, so you can run keystroke injection attacks on a phone.
[31:14.720 --> 31:17.980]  So I can teach a bad USB class basically with a smartphone.
[31:18.680 --> 31:22.860]  And they're connecting over Wi-Fi, they're sending commands over Wi-Fi, and the device is executing it.
[31:23.000 --> 31:23.580]  Pretty incredible.
[31:24.500 --> 31:27.660]  The other thing that's particularly effective about this tool is it has built-in demos.
[31:27.900 --> 31:36.320]  So if I give this to someone and there's already five or ten examples they can take and modify to try something for the first time, I'll show you why that was a really good idea when I talk about the camp.
[31:36.440 --> 31:38.460]  And again, we wanted to make something that didn't look like a weapon.
[31:38.460 --> 31:50.340]  So we created something that was cat-shaped, that was cute, that was accessible, and we found it attracted women, beginners, kids, people who might feel excluded from a Hack High project that's branded to look very tough, offensive, and like it's for, you know, killing a computer.
[31:52.160 --> 31:52.680]  Which is cool.
[31:52.860 --> 31:53.720]  I like killing computers.
[31:53.920 --> 31:54.940]  But not all the time.
[31:56.020 --> 31:58.240]  So what was one of my main design inspirations?
[31:58.380 --> 31:59.240]  The de-author wristwatch.
[31:59.400 --> 32:03.560]  I think one of the first form factors that got it really right with these microcontrollers was the de-author.
[32:03.780 --> 32:14.660]  And I used to work with Space Hoon on various projects when I would teach something and be like, Hey, I really want this to run better, or I really want to focus on this thing I know the microcontroller can do, but can't do right now.
[32:15.000 --> 32:19.020]  And the de-author wristwatch, it was an everyday object that was useful.
[32:19.020 --> 32:23.700]  It had most of the functions that you wanted available without connecting into a computer.
[32:23.960 --> 32:26.920]  And it was able to be used by a beginner and also explained away.
[32:27.160 --> 32:28.240]  I was like, that's amazing.
[32:28.380 --> 32:30.300]  I really, really want to create something like this.
[32:30.440 --> 32:34.200]  And this was also before the flipper, which I should probably address as well.
[32:34.780 --> 32:37.420]  Although I think the price part of that kind of rules it out of this presentation.
[32:38.580 --> 32:41.360]  So the other thing that was really important was we integrated web serial.
[32:41.560 --> 32:42.640]  So we created nugget.dev.
[32:42.780 --> 32:50.800]  And when people connect to nugget.dev, it automatically detects which version they have based on the microcontroller that it's running, and it offers projects that are supported immediately.
[32:51.180 --> 32:53.920]  They can flash them from the same interface, and we're off to the races.
[32:54.120 --> 32:57.200]  So no matter what class that we're teaching, it always starts with nugget.dev.
[32:57.340 --> 32:59.080]  They select the proper lesson, and then we go.
[32:59.500 --> 33:03.480]  We have people who come to our classes incredibly late, and we can catch them up in three minutes.
[33:03.640 --> 33:05.140]  And that's a statistic I'm really proud of.
[33:05.140 --> 33:09.220]  Because it used to take us 20, 30, or sometimes people would not get caught up at all.
[33:09.660 --> 33:16.280]  So three minutes from sitting down with your laptop off to caught up with the rest of the class is an incredible achievement.
[33:16.300 --> 33:24.020]  And it's only possible because of web serial and some of these community projects that have been ported over to be really accessible and really easy for people to learn from.
[33:25.220 --> 33:30.620]  So our bad USB scripting class was the breakout star of our Montana cyber camp.
[33:30.780 --> 33:36.960]  And the reason for that was the kids found the examples, they figured out it could do a brick roll, and they immediately inserted their own memes.
[33:37.100 --> 33:42.580]  And we learned a lot about Skibbity Toilet over the course of the next 12 to 16 hours.
[33:43.360 --> 33:44.200]  And it was fine.
[33:44.640 --> 33:53.060]  What I didn't expect was the kids took the devices home, and they wrote scripts, and they brought them the next day, and they presented them, unprompted, for the rest of the class.
[33:53.560 --> 34:03.920]  This was something that was really incredible because it meant that they were so interested in this that they took their free time after class, plugged this into their personal computer, and tried over and over and over before getting something they were really proud of.
[34:04.720 --> 34:12.600]  They felt like there was enough potential there, enough of themselves they could insert into this, that they could create something meaningful and cool and come back and show it to everyone else.
[34:12.820 --> 34:14.640]  This was not homework, but it should have been.
[34:14.900 --> 34:18.400]  And the fact that they did it for me was just a powerful moment to just be like, wow, okay.
[34:18.400 --> 34:23.320]  They went and found the stuff without me even really going too far into teaching it and showed me something cool.
[34:23.500 --> 34:28.560]  So I got to see the computer cooler 3000, which just shut down the computer really really hard.
[34:29.080 --> 34:32.940]  And then the computer heater 10,000, which opened infinite Chrome windows.
[34:33.160 --> 34:34.800]  The kid was just like, does it support looping?
[34:34.920 --> 34:35.980]  I'm like, alright, we got him.
[34:36.240 --> 34:44.540]  Like, you know, if he cares about this, then, you know, he's figured out how to do, how to become annoying on a level that he's about to, you know, really learn some computer science.
[34:44.540 --> 34:47.980]  So kids learn the serial terminal to run Parrot.live.
[34:48.060 --> 34:50.840]  If you curl Parrot.live, it creates this dancing Parrot.
[34:50.920 --> 34:53.300]  And as you can see, it was a particular favorite.
[34:53.420 --> 34:54.920]  This was one of the scripts that the kids wrote.
[34:55.000 --> 34:56.380]  And I want you to see how simple this is.
[34:56.760 --> 34:57.440]  Ctrl-Alt-T.
[34:57.600 --> 34:59.040]  We taught them about hotkeys.
[34:59.880 --> 35:00.620]  Wait 1000.
[35:00.880 --> 35:01.880]  So wait one second.
[35:02.320 --> 35:04.480]  Type, curl Parrot.live.
[35:05.020 --> 35:06.160]  Wait two seconds.
[35:06.380 --> 35:06.780]  Press enter.
[35:07.020 --> 35:08.040]  That's the entire script.
[35:08.240 --> 35:11.560]  And this girl was spamming Parrot.live windows over and over and over.
[35:12.120 --> 35:13.020]  This really worked.
[35:13.020 --> 35:16.500]  So, I highly recommend this as a class.
[35:16.700 --> 35:18.880]  I thought the BadUSB class brought out the best in the beginners.
[35:19.080 --> 35:20.320]  Let me tell you what brought out the worst.
[35:20.840 --> 35:22.500]  The kids did not like CircuitPython.
[35:22.780 --> 35:28.840]  Um, we were using Raspberry Pis and there was two options available when opening the zip file that we gave them.
[35:29.160 --> 35:30.460]  Half of them clicked on one.
[35:30.820 --> 35:32.100]  Half of them clicked on the other.
[35:32.520 --> 35:33.280]  One of them was wrong.
[35:33.720 --> 35:37.360]  Now 50% of our class was behind and upset and losing interest rapidly.
[35:37.360 --> 35:46.680]  And even though we were able to bring them back on creating an auto clicker to get the highest ranked score in cookie clicker, we still weren't able to get most of the material across that we wanted to talk about.
[35:46.980 --> 35:49.760]  So, we also made a kid cry.
[35:49.760 --> 35:55.600]  And I want to mention that when you flash a microcontroller, it erases all the stuff that was on it before.
[35:56.140 --> 36:01.020]  Including the bad USB scripts the kids had spent all last night writing.
[36:01.580 --> 36:02.660]  And they had not saved.
[36:03.000 --> 36:04.220]  We didn't tell them to save it.
[36:04.320 --> 36:07.560]  And we forgot to tell them that they were about to erase it when they tried this new project.
[36:07.760 --> 36:13.760]  So, not only did they not like CircuitPython, one of them cried because his favorite script he'd worked all night on was now erased.
[36:13.760 --> 36:16.140]  And I had to tell them that's just how computers work.
[36:16.940 --> 36:17.820]  Preparing them for reality.
[36:19.260 --> 36:23.620]  So, again, we managed to get them back by creating an auto clicker to win at something they cared about, cookie clicker.
[36:23.740 --> 36:24.620]  And this was really good for that.
[36:24.700 --> 36:28.220]  We were able to get their own speed and frequency and whatnot and that they cared about.
[36:28.400 --> 36:31.740]  But I would say this class was kind of a bust and we learned a lot from it.
[36:32.060 --> 36:33.220]  So, how we got it working.
[36:33.400 --> 36:35.140]  Now we prepare a bin file.
[36:35.300 --> 36:40.720]  So we basically get one of these working 100% and we prepare the examples just the way that we did on the bad USB class.
[36:40.720 --> 36:41.460]  Because I'm not stupid.
[36:41.600 --> 36:42.320]  I put two and two together.
[36:42.840 --> 36:46.320]  And then we just let them flash that one bin file and they're ready to go.
[36:46.480 --> 36:50.420]  They can try the examples at their leisure and there's no trying to get the students set up themselves.
[36:50.600 --> 36:51.740]  We just stopped doing that.
[36:52.040 --> 36:55.480]  CircuitPython is a lovely language and it's almost easy enough for anybody to get set up.
[36:55.580 --> 36:58.740]  But we just need to get them a little bit closer there and this class still works.
[36:59.940 --> 37:09.220]  So one unexpected win was we got in CircuitPython the ability for somebody to draw a picture on the whiteboard and then put that image onto their device.
[37:09.220 --> 37:12.700]  We didn't think that would be a lesson or anything people cared about, but it stopped the show.
[37:12.980 --> 37:15.820]  And the kids wanted to draw their own art and learn how to put it on their screen.
[37:15.960 --> 37:18.320]  Maybe even do them in a sequence to do an animation.
[37:18.580 --> 37:19.500]  There was something there.
[37:19.720 --> 37:30.360]  I haven't gone back, but if you're an educator and you're looking for something that kids instantly gravitate towards, making a piece of art and putting it on a screen and maybe even making an animation of a couple things, that seemed to be an outstanding idea that I just don't have time to use right now.
[37:33.280 --> 37:37.180]  But I had to sit there and teach the kids how to do it because they wouldn't let me go on until we did this.
[37:37.180 --> 37:40.900]  And this is, I believe, a wiggly rat that one of them did.
[37:42.160 --> 37:44.440]  So another thing we had to do was generate friendly competition.
[37:44.640 --> 37:46.680]  This is where AI ended up helping us a little bit.
[37:46.840 --> 37:51.600]  We had a $200 grant for prizes and we had 30 kids.
[37:52.100 --> 37:56.680]  How do you use $200 to make prizes that people will compete over in order to get?
[37:56.680 --> 38:04.260]  We decided to make these AI-generated cats, which you can see on our banner on Script Kitty Village, and we made a ton of them.
[38:04.500 --> 38:05.380]  The stickers are really nice.
[38:05.500 --> 38:10.940]  They're a little expensive to create, but we made enough of them that the students were ferocious over competing for these stickers.
[38:11.300 --> 38:22.020]  So using a little bit of a stretch in art to get kids to compete over some of the things that are a little bit more boring, giving them out for people who are doing particularly well, this created an economy that actually made the girls in the glass who had bonded turn on each other for the stickers when one of them was going too slow.
[38:26.680 --> 38:28.960]  So the competition is quite fierce for these stickers.
[38:29.140 --> 38:38.560]  And if you're looking for a low cost way of getting kids through a lesson that might be a little dry, these AI-generated stickers don't take much to fill and kids really seem to like them, especially if they're hacker and cat themed.
[38:39.560 --> 38:40.680]  So total injuries.
[38:40.920 --> 38:42.020]  One mild soldering burn.
[38:42.180 --> 38:47.640]  The mom came into the class the next morning and she was just like, how did my kid get burned learning cybersecurity?
[38:48.260 --> 38:52.240]  I was like, well, you know, he was soldering and she's like, okay, you know, he, he doesn't care.
[38:52.380 --> 38:53.920]  He wants to be, he's been talking about it nonstop.
[38:54.060 --> 38:54.560]  I'm just curious.
[38:54.740 --> 38:55.320]  How did it happen?
[38:55.320 --> 38:57.220]  So I showed her and she's like, okay, fine.
[38:57.560 --> 38:58.040]  And she left.
[38:58.340 --> 38:59.760]  But the kid loved it.
[38:59.980 --> 39:06.120]  And he ironically is one of the ones in this safety demonstration, talking about, you know, like, how will you get burned?
[39:06.240 --> 39:07.960]  Who's raising his hand the absolute highest.
[39:08.320 --> 39:09.860]  So you never know who's going to get burned.
[39:09.960 --> 39:12.120]  That kid seemed to be particularly enthusiastic about safety.
[39:12.240 --> 39:14.860]  But in the moment, you know, he lost focus and got a little bit of a burn.
[39:14.960 --> 39:16.520]  But aside from that, we were able to do these classes.
[39:16.520 --> 39:20.280]  And these kids were between eight and 12 to 13 years old.
[39:20.620 --> 39:23.860]  So some of these kids were quite young and they were still soldering.
[39:23.960 --> 39:26.060]  They were still able to get this done and they still really enjoyed it.
[39:26.460 --> 39:28.000]  So what kind of feedback did we get?
[39:28.580 --> 39:33.460]  So the kids college did an evaluation where all the kids give us feedback at the end of the class.
[39:33.460 --> 39:36.400]  And all of them said that they liked the kids class.
[39:36.540 --> 39:38.160]  They like they learned something new and the teacher was nice.
[39:38.680 --> 39:42.220]  This one just says hack, which I thought was great.
[39:43.640 --> 39:46.880]  We also say what was the best part of the class and also the nugs.
[39:47.120 --> 39:51.560]  To me, that is further validation that the bad USB class was something that they really enjoyed.
[39:53.620 --> 39:54.020]  What?
[39:54.020 --> 39:54.580]  Let's see.
[39:55.020 --> 39:56.600]  What other classes do you want to take?
[39:56.840 --> 39:58.660]  What do you want to learn more about hacking?
[39:59.000 --> 39:59.540]  There we go.
[39:59.640 --> 40:00.020]  We got one.
[40:00.520 --> 40:01.780]  What did you like best about the class?
[40:01.900 --> 40:03.220]  The fact that there's cats.
[40:03.220 --> 40:03.780]  Okay.
[40:04.100 --> 40:07.420]  Maybe making it not a cyber gun actually was a good idea after all.
[40:07.900 --> 40:09.320]  What other classes do you want to take?
[40:09.540 --> 40:10.760]  What do you want to learn more about?
[40:10.920 --> 40:11.580]  Cyber security.
[40:11.860 --> 40:12.220]  Okay.
[40:12.360 --> 40:14.760]  The grant people are going to be super happy about this one, right?
[40:14.880 --> 40:16.560]  That's exactly the kind of feedback we want to see.
[40:16.680 --> 40:17.820]  I didn't tell them to fill this out.
[40:17.960 --> 40:18.740]  They, you know, they filled it.
[40:18.780 --> 40:19.760]  They mailed it to them or whatever.
[40:21.240 --> 40:22.580]  And then we got some cards.
[40:22.860 --> 40:24.780]  A couple of the kids really connected with the material.
[40:24.980 --> 40:31.580]  And the kid who actually cried when I accidentally erased his stuff forgave me eventually and made these cards for our instructors.
[40:32.300 --> 40:33.740]  I'm going to read one at random.
[40:34.220 --> 40:36.660]  Thank you so much for teaching CyberCat Academy.
[40:37.200 --> 40:43.520]  I had a fun time suddenly and in soldering and inhaling fumes of lead, I think.
[40:44.020 --> 40:45.700]  Seriously, best class of my life.
[40:45.920 --> 40:46.060]  Price.
[40:46.780 --> 40:47.180]  One more.
[40:47.560 --> 40:50.440]  Thank you so much for teaching CyberCat Academy.
[40:50.700 --> 40:52.020]  Really getting a lot of mileage out of that one.
[40:52.020 --> 40:56.540]  Seriously, this is the best class I have ever slash will ever attend.
[40:57.040 --> 40:59.020]  Not just here, but everywhere.
[40:59.440 --> 41:01.140]  I will...
[41:02.000 --> 41:04.540]  Oh, not just at Flathead Valley Community College, but everywhere, sorry.
[41:05.360 --> 41:08.380]  I will beg FBCC for a sequel.
[41:08.620 --> 41:10.620]  I will be coming next year.
[41:10.940 --> 41:11.100]  Price.
[41:11.860 --> 41:13.120]  The kids really liked this.
[41:13.200 --> 41:14.240]  The feedback we got was great.
[41:14.360 --> 41:16.300]  The parents brought us chocolate on the last day.
[41:16.300 --> 41:22.100]  Like, I can't overstate how well this camp went for how crazy the schedule we tried to put together was.
[41:22.820 --> 41:25.580]  So, we took this and we went to the Missoula Public Library.
[41:25.760 --> 41:28.640]  And we took a lot of the curriculum that we developed for the CyberCamp.
[41:28.740 --> 41:32.220]  And we started doing, for example, the beginning soldering now mixer class at the Missoula Library.
[41:32.340 --> 41:33.580]  And we got a lot of really great feedback.
[41:33.800 --> 41:36.900]  It got us in the room for a lot of future grant funding.
[41:36.940 --> 41:41.820]  And it also got us in front of a lot of cool people in our community and helped prop up an institution that we really, really like.
[41:41.960 --> 41:46.340]  Because the Missoula Public Library has a fantastic makerspace that can deserve more attention.
[41:47.360 --> 41:51.340]  So, we did a couple of different microcontroller workshops in Missoula.
[41:52.280 --> 41:56.280]  And, in particular, they told us to tone it down on the attack stuff.
[41:56.420 --> 42:02.060]  So, this was the first time that we were told, like, we love your cybersecurity stuff, but the Wi-Fi hacking, cool it, we're not interested.
[42:02.300 --> 42:05.780]  So, that's when I came out with Wi-Fi Hacking Self-Defense.
[42:05.900 --> 42:09.040]  The exact same class, but from a defensive perspective.
[42:09.220 --> 42:10.100]  And it was actually great.
[42:10.280 --> 42:11.260]  It was better than the original.
[42:11.660 --> 42:17.360]  More people are actually interested in how it applies to them than they are in hacking some theoretical computer.
[42:17.540 --> 42:18.160]  It turns out.
[42:18.320 --> 42:28.260]  So, if you do an offensive class as a defensive class, and you use your device or the person's device as the learning tool, where they're auditing their device, they're making it better, they're improving their cybersecurity, it actually does a fantastic job.
[42:29.020 --> 42:30.940]  And it invites people who are not interested in hacking.
[42:31.100 --> 42:32.500]  They're interested in securing themselves.
[42:32.980 --> 42:35.120]  That is a much, much larger market.
[42:35.140 --> 42:36.560]  And it allows you to reach more people.
[42:36.680 --> 42:43.980]  So, I have to say, these classes taught us a lot about how to address people who might not be as interested in cybersecurity, but they do give a shit about their own personal privacy.
[42:43.980 --> 42:47.300]  or maybe just keeping themselves more secure because they're in a position that demands that.
[42:49.040 --> 42:50.840]  So we got grant funding for this.
[42:51.000 --> 42:54.980]  We reached out to the Friends of the Missoula Library, we wrote proposals, and it was very slow.
[42:55.040 --> 42:56.380]  There's a lot of communication, but we got it.
[42:56.500 --> 42:59.120]  And all of our classes at the Missoula Library are now paid.
[42:59.380 --> 43:05.680]  We lose money every time a little bit because it might not be a lot, but it allows us to reach the community and it's won far more for us than it's ever cost.
[43:05.800 --> 43:09.020]  And it allows us to do free classes that people are able to attend without paying a cent.
[43:09.380 --> 43:11.040]  Most of the classes we do are free.
[43:11.480 --> 43:18.520]  And that's why, you know, when we do our paid classes, we do them at hacker conferences where, you know, it's not kids, you know, it's people that expect this kind of curriculum.
[43:18.640 --> 43:21.580]  But often when we're introducing this for the first time, we want it to be free.
[43:21.720 --> 43:23.100]  And that's why it has to be so cheap.
[43:23.180 --> 43:26.980]  And sometimes we have to convince people who have grant funding to give us more.
[43:27.080 --> 43:31.860]  And by the way, if you teach a great class, take pictures of it and send it to the next person you're asking for money.
[43:32.120 --> 43:34.380]  It improves your chances by literally 80%.
[43:34.380 --> 43:35.480]  I cannot overstate that.
[43:36.940 --> 43:37.340]  All right.
[43:37.440 --> 43:41.700]  So we did the IoT light boxes again, same formula, like they were able to produce a lot of stuff.
[43:41.940 --> 43:43.080]  Those classes were sold out.
[43:43.240 --> 43:44.060]  People loved what they got.
[43:44.160 --> 43:46.260]  And even when the result wasn't amazing, it was a free class.
[43:47.220 --> 43:47.900]  Nullspace Labs.
[43:48.020 --> 43:52.480]  So again, we have a lot of hackerspaces with 3D printers and people who are in their mailing lists.
[43:52.640 --> 44:00.200]  In order to get one of these started, I can usually rely on the meetup groups or other things that hackerspaces have already invested in to bring in enough students to fill a room.
[44:00.320 --> 44:04.760]  And really, one of the hardest things about this is making sure you're able to fill a room when you're doing one of these presentations.
[44:05.100 --> 44:13.760]  Of all the venues you can pick, a hackerspace has a 3D printer, a number of spaces, and even if you don't use their physical space, you can use their online presence to reach a lot of students.
[44:14.080 --> 44:23.100]  Frequently, if you give them a cut of the tickets, they're so thankful that they can pay their bills a little bit that it really makes a lot of sense for getting people involved in these kinds of community spaces.
[44:24.600 --> 44:27.180]  So last up, our last example is Tour Camp.
[44:27.320 --> 44:28.140]  We just got back from this.
[44:28.300 --> 44:30.160]  It is a week-long... well, I'm sorry.
[44:30.360 --> 44:32.620]  Slightly less than week-long hacker camp in the San Juan Islands.
[44:32.620 --> 44:34.360]  It is fantastically cool.
[44:34.500 --> 44:41.460]  And we got to, again, reach out and have a lot of kids interested in our stuff that we kind of weren't expecting, but ended up doing really well.
[44:41.760 --> 44:47.780]  So some of our developments at Tour Camp was we did our first Pusheen workshop, and that's why we're doing it again here.
[44:47.920 --> 44:53.200]  And we also used an unexpected diffuser to create a really dramatic effect for a very low cost.
[44:53.360 --> 44:58.820]  You can use an LED strip and white pool noodles to create this incredible kind of diffused effect.
[44:58.840 --> 45:12.640]  And we created the Space Noodle, which was a giant 26-foot-tall noodle that people used for navigation in the dark at the camp, which was both delightful and incredibly cheap to put together for a visual spectacle and a demonstration of kind of the final evolution of what you can do with this WLED project and some cheap LEDs.
[45:16.940 --> 45:20.900]  So as a conclusion, microcontrollers used to be too complex to do these sorts of classes.
[45:20.900 --> 45:29.760]  Now you have a huge palette of art projects, cybersecurity projects, or just beginner programming projects that people can get involved with for next to nothing.
[45:29.980 --> 45:36.540]  There's grant funding out there that's available for the levels of materials you would need to do these sorts of outreach projects at scale.
[45:36.580 --> 45:47.500]  And if you're considering getting into doing this, you shouldn't hesitate because the projects are impactful, they cost next to nothing, the documentation is great, and getting students involved or even caught up in troubleshooting them has become manageable, even for a small team.
[45:49.680 --> 45:56.920]  We have put our money where our mouth is, and sorry, let me show our schedule, and this is our schedule for this conference.
[45:56.920 --> 46:00.380]  We're doing seven microcontroller and soldering based workshops.
[46:00.520 --> 46:08.360]  If I didn't feel confident that they were both good and also possible for a small team to manage, then I would not be stressing myself out by doing all seven of these.
[46:08.440 --> 46:15.080]  So if you want to see some of these workshops I've talked about or work with some of these microcontrollers, we're going to be presenting them all week at the ScriptKitty Village.
[46:15.240 --> 46:16.640]  You'll be able to see some of them yourself.
[46:16.840 --> 46:18.420]  And if you're an educator, come talk to us.
[46:18.540 --> 46:24.580]  We offer discounts for anybody who's doing educational outreach, for anybody who might be on a budget but is trying to do a class.
[46:24.720 --> 46:26.720]  And a lot of these projects are also open-source.
[46:26.780 --> 46:34.880]  So if you're willing to source your own materials, we're happy to help you run a workshop or try to do some outreach somewhere, or even partner with an organization when you might not have experience.
[46:35.420 --> 46:45.920]  So also, if you are an educator or if you are somebody who wants to see more cybersecurity education out there, we have a team that specializes in this and we really enjoy it.
[46:45.920 --> 46:47.320]  So come see us.
[46:47.440 --> 46:50.140]  Let us know if you have a grant, if you have a project or something that you're interested in.
[46:50.620 --> 46:54.120]  We've created these custom PCBs for our last year's kids camp.
[46:54.300 --> 46:55.500]  We like making custom stuff.
[46:55.660 --> 46:59.500]  So for example, we're making a custom MeshTastic board for DEF CON this year.
[46:59.660 --> 47:07.300]  We've got a lot of new add-ons that we're featuring that are a direct result of us teaching new curriculum and wanting to build hardware to support it and make it easier.
[47:07.540 --> 47:14.200]  So come talk to us, check us out, and we will tell you some more of the lessons that we've learned along the way of teaching these classes.
[47:14.440 --> 47:17.340]  And if you want to try it out yourself, you can always go to Redia.io.
[47:17.340 --> 47:19.000]  That's where we sell our stuff online.
[47:19.000 --> 47:19.940]  You can find it anywhere.
[47:20.160 --> 47:22.240]  There's plenty of videos you can also see our stuff in.
[47:23.060 --> 47:28.460]  We also present on the Redia, Security Forward, and very soon the Nullbyte channel.
[47:28.580 --> 47:29.700]  I'll put those slides up in a second.
[47:29.900 --> 47:35.580]  So you can actually talk to me twice a week, every week, on the Security Forward channel where I do a live stream.
[47:36.520 --> 47:47.360]  And if you saw this talk, if you had a question and it haunts you weeks from now, you can always go to the Security Forward channel or the Redia channel, catch me in a live stream, and send me your question, and I will answer live on the air, provided it is appropriate.
[47:49.580 --> 47:50.560]  And that's just about it.
[47:50.700 --> 47:56.280]  So if you want to keep in touch, you can find me on my personal website, hack.gay, which is one of my favorite domains I've ever got.
[47:56.480 --> 48:06.820]  Our web store is Redia.io, and if you want to check out some of the web serial things my team has developed to make these sorts of educational concepts possible, check out the nugget.dev website.
[48:07.000 --> 48:13.700]  That contains the flasher, the serial connector, and most of the programs that we ported over for our projects in order to make them more accessible to beginners.
[48:13.980 --> 48:19.100]  You can also check out our live stream on Security Forward, and with that, that's the MyTalk.