Hobocon 2 – Electromotive Boogaloo
KC to CHI on an Amtrak Full of Hackers
This weekend, my buddy Mike Kunz and I drove from Omaha to Kansas City on July 17th to board a train. Not to go anywhere in particular. To attend a conference. A conference on a train!
Hobocon is a cybersecurity conference that runs on an Amtrak train from Kansas City to Chicago with 68 people packed into a single regional car. The groups represented read like a regional hacker map: Iowa (SecDSM), Chicago (Burbsec), Omaha (DEF CON 402), Kansas City (SecKC) and even a group from the Washington DC area! The Chicago crew had the best travel story: they traveled from Chicago to Kansas City, rode the train back to Chicago, slept in their own beds while everyone else was in a hotel, and then rode it back to Kansas City. Four legs of travel to attend a conference that ends where it starts.
They were also, the only people who made the full round trip twice.
The Network
By the time the train pulled out of Union Station, the organizers had already run ethernet through the overhead luggage compartments. Routers, switches, LED strips rigged into the bins above the seats. A full conference network on a moving train.
Every available surface became infrastructure. One table held a stack of routers and switches; another disappeared under power strips, adapters, and cable. It was a local HOBOCON network, courtesy of Calyx.
The network was up and down throughout the trip. That's not a complaint, after all, we were in a huge, old metal tube. Running a con network at speed through rural Missouri and Illinois is an engineering problem that deserves respect. The one thing I'd change for next year: separate the project network from the speaker network. When 68 hackers are all pushing traffic while a talk is trying to run a live demo, somebody loses. Two VLANs would fix most of that.
Projects
In my opinion, this is where Hobocon really stood out. Because the entire community was on the train together using the same LAN, we could pass files, play games, and share projects like a LAN party. Generally, the atmosphere for this exists at conferences, but rarely do I see attendees take full advantage like they did at Hobocon.
Some of the more interesting projects included:
- Someone minted a cryptocurrency on the moving train, complete with formal certificates that read "Proof of Travel. Proof of Vibes. Proof of Rail." The same group also built Hobomarket, a LAN-based prediction market where insider trading was encouraged. It turned into a boon for me, as I won bets on who would pass their ham radio exams, coin flips, and whether we'd see the same conductors on the return trip.
- Multiplayer games. A few rows over, someone was running Mario Kart on Dolphin instances. I put up a multiplayer tanks game; others stood up slot machines and other games.
- The conference also had a murder mystery game where you could navigate a moving train and talk to organizer NPCs to solve a murder. It included challenges that required you to parse logs for information and gather clues.
- Another conference LAN project was perhaps my favorite: MoviesAboard, a dedicated TV-like service that played four or five movies from a tiny onboard host. The creator, streetcredentials, built a very clean app that let you change channels and vote on community videos throughout the trip.
- I was less prepared for the biohacking. Johnny Xmas brought the full kit - gloves, a sterile field, the works—and set up at a four-seat table. He was installing a Dangerous Things NExT v2 implant into Heidi Potter, with Bruce Potter and Jessie Jamieson supporting - a tiny glass-encased RFID and NFC chip with an LED that lights up under the skin when scanned. All while the train moved through rural Illinois. The people on the train just watched like it was normal. To be fair, by that point in the trip, it kind of was.
My Talk
I really wanted to go to Hobocon when I learned about it. Unfortunately for me, they were already on a waitlist by the time I heard about it. Fortunately, they were still accepting CFPs. I sent in three, eager to get a spot on the train, and luckily one of my talks was accepted. When I asked which of my three submissions was accepted, I was told that I could choose, so I replied that I would be speaking about finding an IDOR in a CFP submission platform and gaining access to the entire conference CFP. Excited, I even made a few fun artifacts to promote Hobocon and my talk on social media. While on the train on day one, though, I found out the original reply was from a Clawdbot and they did have a specific submission in mind. I was in their program with a different talk... one I hadn't yet prepared.
Luckily for me, my talk wasn't slotted until day two of Hobocon (or should I say the CHI → KCY leg). While at the hotel in Chicago, I decided to add slides to my deck and cover both talks at once. What came to mind was a Mitch Hedberg joke about 2-in-1 shampoo:
2 in 1 is a bullshit term, because 1 is not big enough to hold 2. That's why 2 was created. If it was 2 in 1 it would overflow.
Mitch Hedberg
So I did my best to cover both topics. With my updated slides, I gave my talk on day two of Hobocon, shortly after the St. Louis stop. It went well. I had a few laughs and questions, but most importantly I didn't stumble with the gentle sway of the Amtrak car.
Slides from my talk are located here.
The CTF
What would a security conference be without a CTF? Hobocon was no exception. We noticed flags in the Murder Aboard train game early on, and by midday on day one the organizers had stood up a CTFd instance and started adding challenges. Mike and I have played in many CTFs together over the last decade, so we decided to participate in earnest on day two, when the bulk of the challenges started dropping.
We host a yearly CTF at Kernelcon, a local conference in Omaha, and this year several teams used AI to hunt and solve challenges. I was impressed by what those teams accomplished in April, and I was curious how challenge writers were adapting. At Hobocon, many of the challenges included prompt injections and other traps that would spin you in circles if you leaned only on GenAI. A few competitors still used Claude anyway; one even named his team Claude and vowed not to touch the prompts himself.
Those anti-AI strategies may have been one reason Mike and I ended up winning. Other teams had their models spinning on challenges we had to solve manually - including one extremely difficult stego problem where I overlaid a bunch of results until I could finally read the flag.
Claude and ChatGPT still helped on a few of the harder challenges. Not going to pretend otherwise. The prize was a major highlight: the organizers took a Lionel Norfolk and Western N-scale box car and graffitied it with Hobocon KCY/CHI details and the dates. An old box car with fresh hacker graffiti, in a beat-up Lionel box. It is genuinely one of the best CTF prizes I have ever received, and a major reason Mike and I will try to repeat next year.
Taking the Scenic Route
The route kept interrupting the conference in the best way. We passed through St. Louis with the Gateway Arch framed in the train window, then crossed paths with Union Pacific Big Boy No. 4014, a steam locomotive so enormous it looked almost unreal from inside a modern Amtrak car. It is hard to stay buried in a laptop when the venue keeps changing the view.
The outbound leg ended among the towers of downtown Chicago. We had enough time to step out into the city before returning to Union Station and doing the whole thing in reverse.
A hotel conference keeps the venue in the background. On a train, the trip is part of the program.
Badge and Swag
When I signed up for Hobocon, I was curious what the ticket actually covered. The train was the venue; lodging in Chicago was on you, and speakers bought into the con like everyone else. That left me wondering where the organizers put their energy instead and the badge and swag bag were the answer.
The badge alone was worth the trip: a railroad crossing signal with the right alternating flash cadence and the slogan "Hacks on Tracks." The rest of the swag kept the bit going. Stickers, snacks, chalk for war-chalking, and the pièce de résistance - a make-your-own hobo bindle kit. The on-theme paper bag came with a bandana and an optional dowel. I skipped the stick; I was already carrying enough, and I could foresee an accidental poke or two. Other attendees made actual bindles and carried them around all weekend.
Final Thoughts
The format is what makes Hobocon work. Twelve hours on a train with no exit option sounds limiting until you notice what distractions are removed. There is no hotel room to retreat to, no urge to go get dinner somewhere else. You are present because the train makes you present. New friendships formed the way they do when the only option is to talk to the person next to you.
I will be back for Hobocon 3.
Links
Thanks to the Hobocon organizers, and to everyone who turned a regional Amtrak car into a LAN party.
Adam (clevernyyyy)
