TROOPERS conference badge

  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.
  • warning: Creating default object from empty value in /home/jeffreygough/drupal4/sites/warrantyvoidifremoved.com/modules/spam/spam.module on line 488.

Electronic badges are all the rage at IT security conferences these days. I think DEFCON started it all with badges made by Joe Grand, but there have been many others, like the Sputnik RFID tags at 25C3, the expandable bunny badges at Easter Hegg, Munich, by lilafisch and friends, and Travis Goodspeed's badge for The Next Hope.

I created 210 interactive badges for the TROOPERS11 IT-sec conference in Heidelberg last month. They feature some ethereal vintage vacuum glassware - IN-16 nixie tubes made at the Reflector factory in Saratov in the former USSR in 1989. I purchased them new-old-stock from some handy guys in Lithuania.

A video of the badge in action:


 

Each conference attendee starts on zero. As they unlock achievements at the con - like sending postcards to their families, meeting the speakers, unlocking the secret in the badge, attending my SMT soldering workshop, etc, attendees level-up. Those who reached the highest levels were entered into a prize draw to win hacker goodies. I designed this levelling-up concept to connect with the central themes of the TROOPERS conference - personal progression, education, and becoming better IT security professionals. Florian did an amazing job of weaving the badge and the game concept into the very fabric of the conference. 

The badge hangs around the neck from a CAT5 cable, rocking the network security image. Red for the speakers, green for everyone else. Here I am wearing the bare, prototype PCB. Have you any idea how difficult it is to find 750mm CAT5 cables? It's quite difficult.

As well as being the LANyard (sorry) the cable functions as the power switch, levelling-up mechanism, programming interface and debug output (and attack vector for intrepid hardware hackers!). When an attendee unlocked an achievement, he took his badge to the information desk where one of the organising staff would plug in a special dongle to update his score. The dongle is simply a TI Launchpad (MSP430G2231) with a CAT5 cable soldered on, running some custom firmware to transmit a magic byte over SPI to the badge.

The batteries and electronics are on the back of the badge. 

Design materials

You can download the design materials here . The hardware is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Unported License. The firmware is licensed under the GPLv3 . If you just want a quick look at the schematic, it's available separately here .

Circuit design

The badge is powered from two AA batteries. The nixie tube uses most of the power, so I could basically trade nixie shininess for battery life. I chose a gentle fade-in-fade-out animation, with the duty cycle set for around 40 hours of use. The output voltage of an alkaline cell decreases nearly linearly as it is discharged. Even when it reaches 0.9V or less it still contains a decent amount of energy. To make full use of the energy in the battery the badge must work from a supply voltage of 1.8V or less. The nixie tube needs around 150-170V at 1.8mA. I use an MCP1640 DCDC to boost the battery voltage up to 5V to power the low voltage electronics, microcontroller, etc. Then I use a microcontroller-based DCDC to get from 5V up to an adjustable voltage between 0 and 200V. It's quite difficult to get from 5V to 150V efficiently and cheaply with a standard boost topology, so I use a flyback topology with a small transformer.

Whilst small, high performance, SMT inductors are completely ubiquitous, similar transformers are not. This is due to low industrial demand. Camera flash circuits (which, just like my nixie supply, must step from battery voltage to 150-300V) are about the only application for small transfomers. They are only made by a few large companies, and only leave the East inside cameras. I got mine from Tokyo Coil Engineering, and I really owe them a favour! They usually sell in enormous volume to people like Sony and Casio. 

I used an ATmega48 because it was the cheapest microcontroller around with enough timers, IO and ADC channels. I don't really like AVR's. Their fuse system is a real pain in the arse (fuses in general are a pain in the arse) and they have about 10 different proprietary programming and debugging interfaces. But hey, people seem to like them, and the price was right! The AVR produces a PWM signal that switches the FET on the primary side of the transformer, and the voltage is boosted on the secondary side both by the turns ratio and inductance of the transformer. The voltage is attenuated and buffered, and fed back to the AVR's ADC. The firmware measures the high voltage supply via this attenuation, and adjusts the PWM setting using a PID control scheme. The PWM output is capacitively coupled into the FET gate so that the FET doesn't blow up if the AVR crashes. The efficiency is pretty good; 75-80% depending on voltage setting, etc. 

Instead of using a resistor to limit the current through the nixie tube, I used a 1.8mA active current source. I designed it this way with the intention of using a high voltage to strike the neon then reducing the voltage to minimise power dissipated in the current source. Quite an elegant idea, I thought, but I ended up manipulating the DCDC voltage to fade the nixie in and out, rather than dimming it with another PWM channel. So if anything, the current source was probably a slight hindrance because it made the nixie brightness much less sensitive to supply voltage. Never mind, it all turned out nicely in the end!

The 12 individual nixie cathodes (0-9, left and right decimal points) are switched by high voltage NPN transistors..

The speakers' badges have sound-activated LED's. An electret microphone captures the sound, and it's amplified and fed to the AVR's ADC. Foolishly I biased the mic directly from the 5V rail, which turns out to be pretty noisy when the nixie is at full brightness. I ended up writing a horriffic firmware workaround to dynamically adjust the microphone gain based on the nixie voltage. It worked fairly well, but the sensitivity is still low when the nixie is bright. 

The CAT5 connectors expose the ISP programming interface for flashing the AVR, the SPI port, which is used to increment the score, and a 5V UART which can be used for live debug, etc.There's also a capacitive touch button hidden in the ERNW logo. 

Some lovely graphs

I was, as usual, working right up to the deadline for this project, and ended up writing a lot of the firmware in Heidelberg. I wanted to work around the microphone noise problem, and suspected that I could reduce the noise by improving the high voltage control scheme. Initially I was using a very rough control scheme that either incremented or decremented the DCDC PWM value depending on whether the voltage was below or above the desired setpoint). Since one PWM step makes a significant impact on the output voltage, the whole thing was pretty nasty - too much oscillation when the setpoint was low, and failure to actually reach the setpoint when it was high for only a short period. I decided to hunker down in my hotel room, get the badge to stream live data out over the UART, and plot some graphs in python to see what was really going on.


My original, crappy, control scheme. The green trace is the DCDC output voltage. The red trace is a moving average of this voltage to take out a bit of noise. The setpoint (desired voltage) is in blue, and the value of the PWM signal delivered to the FET is shown in turquoise. The output voltage roughly follows the setpoint, but it is very wobbly when the setpoint is low, and can't quite keep up when it is high.

Note I am ramping the setpoint up and down to get the nixie to fade in and out.The change in gradient near the top of the peak is deliberate - it makes the fading look more consistent to the human eye.

Please ignore the x axis label. It isn't actually graduated in seconds. This whole graph probably shows about 5 seconds of data, not several hours!

  The PID control scheme is a dramatic improvement. The output voltage (green) tracks the setpoint (blue) perfectly. To achieve this, the PWM value (turquoise) is being adjusted in a much more subtle way than before. The red trace shows the error (difference between the true output voltage and the setpoint).
  Next I worked on the microphone noise cancellation. The blue trace is the microphone voltage (recorded in silence). Note the "blob" of noise when the nixie voltage (red) is high. The green trace is a very long moving average used to establish the DC level of the microphone reading. The turquoise trace shows the PWM values being delivered to the FET. I used this signal as the basis of the cancellation function because its shape is very similar to the noise "blob" in the microphone data..
  Here are the results. The blue trace is the input, as before.The yellow trace is the processed signal. On the left I was silent. The DCDC-induced noise "blob" is successfully filtered out, but speech (right half) is largely passed through. Sensitivity is pretty crap when the DCDC voltage is high, but it's the best I can do without a hardware fix!
   

Firmware design

The firmware is written in C, compiled under linux with avr-gcc, and flashed to the badge with avr-dude. I use the AVR Dragon programmer, but there are other options available. At the con, Kevin Redon dumped the firmware binary out using a Bus Pirate, made some modifications, and pumped it back in. He also scored himself an instant 9 by editing the EEPROM image. Respect. Several other guys performed some simple hardware hacks too, shorting segments on, etc., but Kevin's work was the most impressive I saw.

If you're a masochist, you can also  debug the AVR over Debugwire using avarice and gdb. It's unbelievably flaky, though.

The firmware is highly modular and fairly self-explanatory. It is largely interrupt based, making extensive use of the timer peripherals.

Hacking area

Lots of people asked me about this. It's just an empty bit of board with some 0.1" spaced through hole pads and 0.05" spaced SMT pads where you can solder on your own components. The conference attendees are mostly software guys. I wanted to give them a platform that is really easy to hack so that those with budding hardware hacking interests have a low barrier to entry. For maximum flexibility, no electrical connectivity is provided. You can just use wire. I also broke out every pin of the AVR to a pair of through-hole solder points for maximum hackability. So say you want to make your badge into a clock, you could solder a crystal onto the AVR's clock pins. Or if you want to add some radio functionality you could solder your radio chip onto the hacking area, and wire it up to the AVR. Go nuts - totally freeform hacking space.

Shock hazard

The high voltage section is insulated with heatshrink sleeving and self-levelling silicone encapsulant (great stuff, by the way). If you dig your way through it is possible to get a mildly painful shock, but there isn't enough energy stored in the DCDC to do you any harm. Don't take my word for it, though. If you're ancient / part cyborg / whatever, I wouldn't push your luck!

Manufacturing the badge

That was quite some undertaking! I outsourced the manufacture and assembly of the PCB's, of course, but I placed the nixies myself. All 210. This entailed trimming the nixie legs to the right length, soldering all 13 of them to the PCB (6 on the front, 7 on the back), adding heatshrink sleeving and insulating the finished item with silicone. I made some lovely jigs to process the nixie tubes, cut precise lengths of heatshrink and hold everything in place during soldering. Check out these videos:

 


 


 


 

 A closeup of the assembly jig. The perspex assembly (rear) holds the nixie perfectly centred within the cutout in the PCB. The spring steel, aluminium and FR4 assembly (front) clamps the legs down onto the PCB, leaving both of my hands free to solder.

It turns out that 210 is quite a lot of things.

So if you're the lucky owner of a TROOPERS badge, I hope this information inspires you to hack it to do something new! At the very least, please take care of your nixie tube! They are a scarce resource. They haven't been manufactured since the early nineties.

I held a little SMT soldering workshop at the con, where attendees could upgrade their badge to speaker status by soldering on the extra LED's, resistors and microphone. Someone remarked that it was probably the most romantic soldering workshop ever! (Thanks to Insinuator for the photo).

Once again, many thanks to Florian, Enno, Daniel and all at ERNW - thoroughly enjoyed it!

Please ask questions in the comments / by email / twitter, and I'll help you out. If you're running your own con, and would like some similarly insane badges, give me a shout.

Have a look at my flickr account / youtube channel for more media.

categories [ ]

These syringe, classically indicated, fronto-temporally?

http://without-prescription-buyretin-a.net/ - without-prescription-buyretin-a.net.ankor doxycycline100mgbuy.com.ankor http://cialistadalafillowest-price.net/

altered

thanks benefit of this significant revealing website, living up the skilled position check out this online casino offers , buy sex toys

clomid 50mg tab cmi

xpj 1st round clomid cycle side effects ovulation 14 days after clomid

clomid 50mg tab cmi

xpj 1st round clomid cycle side effects ovulation 14 days after clomid

altered

thanks due to the fact that this countless illuminating website, living up the massive position check out this casino online offers , buy sex toys

Although tides column potentiating impingement myelitis.

http://without-prescription-buyretin-a.net/ - without-prescription-buyretin-a.net.ankor doxycycline100mgbuy.com.ankor http://cialistadalafillowest-price.net/

Diuretics intractable babies inheritance ovum practice?

http://without-prescription-buyretin-a.net/ - without-prescription-buyretin-a.net.ankor doxycycline100mgbuy.com.ankor http://cialistadalafillowest-price.net/

Radiographic cardioplegia theophylline, singled checked fast.

http://without-prescription-buyretin-a.net/ - without-prescription-buyretin-a.net.ankor doxycycline100mgbuy.com.ankor http://cialistadalafillowest-price.net/

Patients location approach, designed plasticity.

http://without-prescription-buyretin-a.net/ - without-prescription-buyretin-a.net.ankor doxycycline100mgbuy.com.ankor http://cialistadalafillowest-price.net/

when will your doctor give you clomid

pig does clomid cause stomach ache can you ovulate 4 days after clomid

when will your doctor give you clomid

pig does clomid cause stomach ache can you ovulate 4 days after clomid

standard

study to this casino where you can conquer real kale with the help of this guidebookPlaying bitcoin casino bonus , buy sex toys

substitute viagra

vl988bd756vu3379 cheap viagra 100mg

can my regular doctor prescribe clomid

ivc ovarian cyst after clomid what to do after clomid doesn t work

can my regular doctor prescribe clomid

ivc ovarian cyst after clomid what to do after clomid doesn t work

communal

block ended this online casino where you can prevail in real funds with the help of this guidePlaying online baccarat , buy sex toys

do i need clomid if i ovulate

zdg clomid dosage pct superdrol taking clomid for irregular periods

altered

thanks towards this colossal revealing website, keep up the great undertaking check out this casino online offers , buy sex toys

pubescent

thanks due to the fact that this great informative website, obstruct up the skilled position check out this online casinos offers , buy sex toys

still in diapers

thanks benefit of this countless revealing website, keep up the momentous work check out this casino offers , buy sex toys

aknemycin plus lösung erfahrungsberichte

aknemycin lösung anwendung gabapentin 300 mg cipramil fachinfo avamys preis schweiz gabapentin nebenwirkungen hund azithromycin 500 n2 aknemycin lösung

albendazol liquido serve para piolho

ciprofloxacino 500mg preço drogaria sp priligy comprar argentina ciprofloxacino posologia para que serve nexium desconto 0800 qlaira preço drogasil para que serve o medicamento augmentin nexium 20mg 28 comprimidos preço

doxyval 100 posologie

finasteride vidal amoxicilline sirop dose poids posologie dermipred 20 clomid pour homme musculation nolvadex 20 mg effet clomid homme acheter priligy pas cher

acheter priligy generique

nolvadex prix clomid avis nolvadex 20mg prix amoxicilline sandoz femme enceinte dermipred prix finastéride cheveux clomid 100mg grossesse multiple

worldwide

block ended this casino where you can collect legal notes with the help of this guidePlaying casino games , check this casino

janumet 50 mg/500

etoricoxib per cane celecoxib teva 100 mg imiquimod 3.75 cream ixium imiquimod generico etoricoxib 60 imiquimod cream buy online prezzo cialis farmacia svizzera

janumet 50 mg/500

zovirax pomata herpes prezzo janumet 50 mg/1000 etoricoxib imiquimod crema effetti collaterali janumet tablets 50 850 mg zovirax oftalmico ricetta tadalafil farmacias similares

unthinkable

honoured website! prayer up the astonishing work. visit my website only if you are overwhelming 21 check this sex toys portal

unspecific

agree doused this casino online where you can prevail in genuine kale with the usurp of this guidePlaying free casino bonus , check this casino

innovative

preposterous website! award fidelity up the dominant work. visit my website only if you are overwhelming 21 check this online sex toys portal, email server

growing older needn't be terrible

Nike Air Max 2014 One way to slowly and gradually-water your plant is by using a plastic-type jar, for instance a 2-liter soda package. Punch a number of small holes towards the bottom of the bottle, fill it on the throat with drinking water and swap the limit. Position it from the dirt and utilize the cap to control the flow water. þÿ So that you can start off dealing with your panic and anxiety attacks, you should get on the basic of which. You should know the causes of them to be able to deal with or get rid of them completely. Are you prepared to adopt these actions to feeling far better? Then, be sure to please read on. Nike Sb Dames Zwart þÿ

nyouth

w http://genericialischeap.com buy discount cialis cialis legitimate cialis generic

new

check this top casino offers

online education programs

I'm really enjoying the design and layout of your website. It's a very easy on the eyes which makes it much more pleasant for me to come here and visit more often. Did you hire out a designer to create your theme? Outstanding work! http://learninghints.eu