Being able to present your research at DEFCON is the dream of many cybersecurity professionals and security researchers. You can present your discoveries, researchs and exploits. Not only in DEFCON, but also in many other hacking and cyber security events. But attending events such as DEFCON and BLACKHAT, which are famous all over the world and that have a different meaning with its environment and community, besides its reputation, is something that many people want to do. Not only as a speaker but also as a participant.

DEFCON, which I hear since the first days of learning cyber security, is an event that I not only want to attend as a participant, but also set my mind to be a speaker in it. I’m sure many white and black hats around the world have imagined at speaking on the DEFCON stage. Some of them have succeeded once, while some others have made it a habit. Some of them decided to take place as organizers in the “village” sections, and some as “goons”.

I was very surprised that there was very little information on the internet about some (perhaps a lot) topics about the event, which had such a large and dense audience. The blogs, vlogs or experiences on the internet were not enough to satisfy me. Even more funny, I was very surprised to see that people who can be called well-known global cyber security influencers in the industry, could find so little information about this subject on the internet and ask their followers to find out about creterias and process. I was planning to apply for my research that I have been working on for a while this year, and when I saw this information gap, I said that I should definitely pitch in at this point.

You may have seen the people around you or the people you follow making presentations at DEFCON. It wasn’t really a difficult thing anyway, but if you are wondering what kind of an application process awaits you, what awaits you according to their criteria before applying and how the application is made, you are right to wonder. I was wondering too, global influencers were also wondering too. After all, our thing is to obtain information. When hackers wanto to access information, they usually achieve this. If the information exists.

I wasn’t sure if my research was ready for DEFCON, which is being held for the 31st time. But how would I know if it was ready or what they wanted. Searchin the internet yielded no results. Unlike people who had presented or attended the event before, I had no idea. The thing to do, of course, was to apply and see with my own eyes.

Like hacking something, it was necessary to gather information first. I could not find satisfactory information on the Internet, fortunately the information on the DEFCON site was well written in a clear and directive manner. For those wondering, you dont need to develop an special exploit or discover a 0day for your research to be accepted.

The first critical point for DEFCON applications, is the application date. Follow the DEFCON site and communication channels regularly. On the DEFCON site you can find a list of questions to be answered for the general application. On the site, they usually update some pages after the event until the next event. As a hacker in situations like this you can take advantage of your Googling skills and Wayback Machine. If you have time, you can prepare information about personal information and research, which takes a short time and prepare for the opening of applications. At least that’s how I did it.

The longest part of application is writing the outline of the research. They don’t want your full stage-ready presentation at the moment you make the application. It wouldn’t make sense to prepare and send the full presentation months in advance, because they don’t need to watch/read the whole presentation to evaluate the research, and because the researcher might change something during this time. Of course, this does not mean that the presentation should not be ready, it just does not have to be completely “finished” at the time of application.

DEFCON officials, wants your “outline” to understand your research and the sources you used while doing this research. Going back to Outline, if you’ve never written a thesis or a scientific research in your life, a question mark may arise in your mind for a moment. You’ve probably seen an outline before, it’s not a difficult thing anyway. If you know what and how to present your research, this is the time to put it on paper. We can say outline is the most important part after your name in the application phase, maybe it is more important than your name. Because that’s where the authorities will first evaluate your research. We can say that it is the first stage on the way to the stage at DEFCON.

DEFCON site explained very well on how to write the outline. Therefore, the reader who reads this article with the planning of applying in mind, Let’s see what you’ve got, champ, no one can hold you.

Preparing the application is not a thing that takes days, we can say that the longest part is to write the outline. But when you have time, I recommend making small preparations on it. besides DEFCON says on its site that the sooner you submit your application, the better.

They want you to send the application as a txt file. They have explained on their related pages that there is an option to send it in an encrypted form if you wish. You can also use a nickname if you want, maybe you want your face to be in the shadow of your hat. You can also make the application as a team, but if I dont remember wrong they want you to specify someone as a keynote speaker or lead for communication process.

Technology is indispensable in an event like DEFCON, when I look at the criteria and guidelines, I feel like they are smoothing their workload by getting help from automation, which is exactly what I expect from such an event.

After preparing your application txt file, only thing that remains is to send it when the applications start. They also stated that they may want to see your presentation (before the final date) if there are two very similar applications, or they may contact you depending on the situation.

You can find out more about what awaits you in the next stages of the application process for a speaker by visiting DEFCON’s website. The part I am going to tell ends here for now, as you can naturally understand from the title.

So How Was My Adventure?

Thanks to my Googling skills and wayback machine, I read all the pages that were normally published and the ones in the process of being edited at the time I was searching and. I took notes in a file for myself and of the important information on their site.

I was very excited every time I sat in front of the computer with this dream. Especially when I was writing my application, I was too excited to stay still on the computer. I wrote most of my application months ago and set it aside. When the application time approached, I completed my outline and finished preparing my application.

One night, when I could not sleep, around 02.00 AM, I saw the post on Instagram announcing that applications were opened. I jumped with excitement and sit in front of my computer, with almost lightning speed. I was almost ready to the last dot. I submitted my application that night. As they say, arriving on time is being late, arriving early is arriving on time.

I don’t remember the exact time, but I received an e-mail in a short time saying that my application was received. All that was left was to wait for some time (perhaps months?). At this time, whenever I thought of DEFCON or saw the word DEFCON somewhere, I got excited.

Once upon a time

A second e-mail came after a time that I can’t remember. It was like 2 weeks after the application as ı remember, but I’m not sure. They wanted me to elaborate and clarify some parts of my research. Due to the time difference, this e-mail came at night, again at a time when I could not sleep. I immediately jumped up and started pressing the keys on the keyboard.

Spoiler Alert

When I applied, I already felt that I might not be selected. Not because of the content of the research, but the research wasn’t as detailed as I wanted it to be, it didn’t reach the point where I would say “that’s it”. There is a fmous saying that also Steve Jobs loves too, “Great minds think alike.”. If I think this way, what do you think the people who reviewed my application thought? Of course thought alike.

As hackers, we all have two things we absolutely love and dislike, which are knowing and not knowing. There were two things I didn’t know about my dream of making a DEFCON presentation, when would my research reach the level of “that’s it” and the process of being selection for DEFCON. Thanks to the flow that brought me to write this article, the things I don’t know about this goal have decreased by one.

Aftermath

When the e-mail informing me of my result came, first I was upset for 1-2 seconds, then the sadness went away because nothing I had not expected had actually happened. 

Then I was surprised, because DEFCON officials wrote such a nice e-mail, it was like you can reject me like that every month. There was a very good feedback about my application in the mail, it was even written that they could give more detailed feedback if I wanted to. I saw no need for it, as they already written very satisfactory. The feedback they gave explained in a very good way, their ideas about the status of my application and what I should detail on. I wish every organization could manage their processes so well.

When the Curtains are Closing and the Lights Are Going Out

This is how my experience was. Nothing I had not expected happened. Life is not one day, DEFCON is not the only event, and DEFCON doesn’t happen just once. I say to myself “365 days left”.

If you’ve ever seen people that presented in DEFCON around you, you’ve probably noticed that you don’t have to turn the world upside down for this awesomely cool event to welcome you. DEFCON aims that the research it accepts, should fit into the culture of “hacking” and teach people something.

Until the moment when I publish this article comes, it will probably remain 364 days.

Hack The Planet

https://www.linkedin.com/pulse/how-did-i-got-rejected-from-defcon-mert-kurtulmus