The BSides Bristol Baiting Bonanza.

[Wayne]

Let's start this story way back at BSides Cheltenham. My previous talk had been accepted and I was going to be doing it there for the last time. After that I figured I'd take a break and attend a few events as a spectator rather than a speaker. However, that didn't happen. Before I'd even entered the building I was asked if I'd put forward a talk for Bristol. Well then, time to write another talk I guess. This time it was going to be about how to bait. My very first talk was at the Cymru one and it was a 10 minute "The 10 commandments of scambaiting" one. I'd always wanted to expand on that, so decided it'd be perfect. I put forward my talk and even offered to do a workshop where we'd call up scammers live. The talk was accepted, the workshop declined. However, just a few days later they got back to me and asked if I'd be willing to do the workshop too. Now, talks are usually 30-40 minutes long and workshops are several hours long. The Cymru one was different as they had everyone do a 10 minute/10 slides talk there, which was a fun challenge. So that's the background covered. I was to do a 40 minute talk on day 1 and a 2.5 hour workshop on day 2.

As I'd bought tickets ready, but as a speaker you get a free ticket, I had a spare ticket. I called up a friend and asked if any of her sons would like to come along. One of them practically bit my hand off. My partner in crime for lad calling, The Lovely Jill was also coming along and we were going to do the workshop together.

We arrived a bit late due to the traffic and managing to go to the wrong car park. The keynote talk was already in session, so my traveling companion who we'll call "Liam" and I stood at the back. TLJ was already there and frantically sending me messages asking where I was as my talk was next on the agenda. As usual the talks were already running late, so when it was my turn they asked if I could help them out by keeping it short. Not a problem as I'd timed my talk to be 30 minutes. I'd already figured I'd cut the Q+A part as we had the session the next day where we could answer any questions anyway. That meant we had something to do if the scammers didn't answer the phone, which was a definite possibility as there was a big football match on at the time and the scammers love their football.

Last year we had technical problems and this year was no different. We couldn't get the laptop to connect to the projector. While we were trying to figure it out TLJ gave me a lovely introduction and we answered a few questions before deciding to plow on without the screen. No big deal as it was just text right up until the very end where I show some of my photo trophies and play some clips of scammer calls. Spoiler alert - they fixed the issue before we got to that part.

Now, I was really worried about this talk as it ends with clips of calls we made to a scammer where I shoot and kill my "wife". I had a whole disclaimer slide explaining how we didn't want to offend anyone, but wanted to show how far you could push a scammer. I explained the situation and thankfully everyone laughed, at which point I could feel the tension lift from my shoulders. Technical issues aside, the talk went really well. Around halfway through someone approached the desk, clicked a button or two and the presentation was up on the big screens. Even more tension released. At the very last slide it says "ANY QUESTIONS?" and I looked across at the guy holding up the time left cards with a panicked look on his face frantically shaking his head. "Any questions, we'll be around all day and also have a workshop tomorrow where we'll be calling up scammers live. Feel free to ask us anything then. With that, thank you so much for listening and enjoy the rest of the day." Now they were pretty much back on time, which I think earned me some serious brownie points.

I'd love to say I really enjoyed the other talks, but the truth is I never managed to go to any. I spent the entire day talking to people. We'd go out one door for a quick vape, talk to people there, go back in, talk to a bunch of people in the building, go to the other door, have another vape, talk to even more people, rinse and repeat. I took Liam around the vendor stalls and he got to talk to them there as well as pick up a bunch of freebies. I have to say the vendors were great as well. When they were explaining stuff to him they could see he was struggling to understand so would simplify it for him and bring it to a level he could understand. He now knows all about pen testing and reverse engineering.

End of day 1 and it's time for the charity auction. I'd bought us a strip each. They go around asking people to pull out tickets and I manage to pull out my own number! That's not fair so I pull out another one. However, the next person pulled out my ticket and I selected a bag that was full of swag. One of the selling points I made to Liam's mother is that he'd get a bunch of swag there and I figured there'd be a bunch of stuff he could have in it. A bit later they pull out another of our tickets and I send Liam up this time. What does he pick? One of my books that I'd given for it!! We make it home with 2 full bags of swag and a Liam that is absolutely bouncing. We decide we'll go later the next day, so I arrange to pick him up at about 10am.

9:55am he's calling me to make sure I'm picking him up. We both agreed we'd wear the BSides t shirts we bought there for day 2 and there he is waiting by his gate wearing it when I get there 5 minutes later. Today is all about the workshop. We set up everything, I realize I've forgotten my extension cable so we send him on a hunt to find one for us and pretty soon it's all ready. Big Al is going to feed me scammer numbers so I don't have to worry about that part. However, SKype decides it's not going to play ball and crashes every time we try to add a scammer into the group call. While we're working out this kink, TLJ starts answering questions. Pretty soon we work out that adding more than one person into the call is the issue so BA sends me the numbers via text chat instead and that fixes the problem. First 2 calls, no joy. Call 3 however not only gives us a lad willing to talk to us but one who even gets his wife to sing to us. It's an excellent call and I'll put links to the ones we did at the end of this.

We have a whiteboard that we use to explain what we're doing to the audience as well as write ideas up as we're doing the calls. We even tell the audience they can join in on writing ideas. More questions, then we ask the audience who'd like to have a go at calling up the scammers. 2 volunteers, who play father and son to talk to the scammer. That call is amazing, bonkers and showcase some of the best fake crying we've ever heard. Unfortunately the next volunteer strikes out as we can't get anyone to answer and time is running out. I want to end the workshop by playing one of our calls from before where we have "The Pope" pray for the safe return of our talking hamster and explain along the way the tricks we're using and the reasoning behind some of the decisions. Everyone seemed to love it. We finally call time on the workshop about 10 minutes early, but spend the next 10 minutes talking to even more people.

Deciding to skip the wrap up and leave early, we say our goodbyes and make our way home, exhausted but really happy. One of the people we talk to is the organizer of the event and he tells me one of the staff attended the workshop and told him it was the best thing of the day they'd seen.

We'd already agreed to do the workshop at the next BSides in Newcastle, but about 2 hours after the talk on day 1 I receive the email saying my talk had also been accepted. When I got home on day 1 I had a few Linkedin requests, including one asking if I'd be willing to give the talk at (what TLJ tells me) one of the really good universities. I also made a fair few new contacts along with people wanting to not only try baiting themselves but help with the site. I make no secret of the fact my programming skills are limited at best, so this is absolutely brilliant for us. All in all it was a hugely productive few days as well as a whole lot of fun. Next up is BSides Newcastle, where we have an entire day to do the workshop. That's going to be an absolute blast, and from what I was told about some of the things they have planned there, completely unmissable.

In closing I'd like to thank TLJ, Big Al, Liam and everyone at BSides. I can safely say I loved every moment of it, even the technical gremlins. Liam told his mother that it was "the best 2 days of my life", which makes it all the better. He's already wanting to come to more, and I'm more than happy to bring him along. He's also going to do his own write up on the event that I'm going to post here under the title "Uncle Wayne goes to BSides". Keep an eye out for it as it'll show you what it's like to attend your first BSides event.

Calls made can be found at https://scamsurvivors.com/rockofagesmono.mp3 and https://scamsurvivors.com/hithimmono.mp3