DEF CON 33 - The Things know What You Did Last Session - Will Baggett
Source: YouTube · DEFCONConference · published Oct 10, 2025 · 23:28
This talk explores digital forensics in the IoT space through three case studies: a problematic Chinese voting machine, a workplace fraud scheme, and North Korean IT worker infiltration 0:06-0:08.
Key Takeaways:
• The $7,000 Chinese voting machine contained privacy-violating features like voter recording, fingerprint scanning, and driver's license scanning, leading officials to reject it for US precincts 5:24-5:38, 11:01-11:05
• A workplace fraud case involved contractors using hidden, older iPhones to automatically "check in" and "check out" for work they weren't physically doing 12:56-13:00
• North Korean IT workers are identified through anomalies like Pi KVM devices ($800 models) managing multiple jobs simultaneously, multiple connected devices per account, and suspicious 2FA geolocation data 16:48-17:32, 19:21-19:57
• Forensic principles remain constant: proper collection, examination, analysis, and reporting with audit trails, while device technology evolves 1:19-1:38, 21:21-21:24
Digital forensics fundamentals remain critical as IoT devices create new challenges in security and investigations 21:28-21:31.
Sources:
- 0:06-0:08 Introduction to digital forensics in IoT
- 5:24-5:38 Chinese voting machine privacy violations
- 11:01-11:05 Voting officials' rejection of Chinese machine
- 12:56-13:00(https://www.youtube.com/wat
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Hey, thanks for choosing to spend some of your Defcon time coming here today to listen to this talk. It's u digital forensics in the internet of things and the intersection of the two. The talk's called the things know what you did last session just like the slide says. I look like some overcaffeinated stone cold Steve Austin up here swilling to Celsius but here we are. I'm Will Bagot uh former human cyber collection uh for NATO soft cyber trainer for them and actually did the job for CIA for years. Um, now director of digital forensics for Operation Safe Escape. It's a volunteer assistance group for domestic violence victims. And my day job, I'm leads insider threat digital forensics at a Fortune 25 firm. If I say who they are, corporate has to approve it. There have to be meetings. There…