Free tools Windows power users keep installed
One-click scans. No signup required.
ShmooCon’s 2023 gathering brought more than 1,600 people to Washington, D.C., for a hacker conference that mixed security discussions with contests, jokes and community traditions. CyberScoop’s January 24, 2023, recap ranged from state hacking laws and railway cybersecurity to China’s online underground and a Flipper Zero presentation about how intent can turn a tool or connected service toward harm.
What happened at ShmooCon 2023?
ShmooCon, an annual hacker conference that CyberScoop said had drawn technologists, academics, lawyers and policy researchers since 2005, met at the Washington Hilton in Washington, D.C. The publication reported more than 1,600 attendees for the 2023 edition; it did not identify an underlying attendance dataset.
The conference’s professional program sat alongside the social rituals that give the gathering its personality. CyberScoop described volunteers, attendee contests, a book swap and ShmooBalls thrown at presenters. It also mentioned a giant rock-paper-scissors contest and an anecdote about 1989 Batman cereal. The mix made the event’s community as visible as its technical subject matter.
Why community was the recap’s central theme
For co-founder Bruce Potter, ShmooCon offered more than career development: “This isn’t just about professional growth, it’s networking, it’s a time to be with friends and fellowship.” Co-founder Heidi Potter credited the people who make the gathering possible: “[ShmooCon] absolutely does not happen without the amazing ShmooCon staff … and of course support from the community at large.”
Those remarks frame the conference as both a professional meeting place and a social one. The contests, book swap and shared traditions were not side notes to the recap; they illustrated how the event built connections among people working across security and technology.
What the conference discussed about security
State laws and legitimate security research
Lawyer Harley Geiger, whom CyberScoop described as focusing on data privacy and cybersecurity at Venable LLP, discussed U.S. hacking laws and recent changes. The 2023 recap reported his view that federal authorities were less focused on prosecuting legitimate research, while state laws varied. It contrasted explicit protections in Washington with broad Maryland laws that, according to the article, did not consider a researcher’s intent.
This is a record of a conference discussion reported in 2023, not a guide to current law or legal advice. The recap’s comparison illustrates why researchers cannot assume the same legal protections apply across state lines.
Railway cybersecurity and slow-moving infrastructure
Presenter Brian Butterly described a gap between railway engineers, whose work centers on physical safety, and cybersecurity professionals focused on digital defenses. Railway software and systems can be difficult to update, while increasing digitization brings more connectivity and potential exposure. CyberScoop also reported that the Transportation Security Administration released railway cybersecurity regulations late in 2022.
One social post embedded in the story, by Jake Williams (@MalwareJake), described a train’s development cycle as “~10 years”—longer than the support lifetime of many operating systems—and pointed to useful-life and certification issues. That is a quoted observation, not a universal statistic for railway projects.
Butterly summarized the challenge this way: “[Railway operators have] learned about safety the hard way. So now the challenge is for them to understand security without learning it the hard way.” The point is not that safety and security are interchangeable, but that adding cyber protections to long-lived, safety-critical systems requires coordination across disciplines and time horizons.
China’s online underground under internet controls
Analyst Mao Sui’s presentation addressed online underground markets operating within a heavily controlled internet. As CyberScoop described the talk, operators used coded language to evade censors, and illicit storefronts could appear on the clearnet as ordinary marketplaces. This account characterizes the specific underground activity discussed in the presentation; it should not be generalized to all Chinese online activity.
Flipper Zero, connected apps and the role of intent
Security researcher Christopher Forte presented on gamification of the popular Flipper Zero hacking tool and used a jukebox app at restaurants and bars to illustrate potential harm. CyberScoop’s account says Forte and associates overplayed songs and sent messages through the app.
Recommended Free Tools
Best Value
Forte’s broader point was about application rather than a claim that a device is inherently malicious: “It’s the mindset. It’s how it can be applied. It’s how you can take something and turn it very malicious very quickly if you had the right intention.” The anecdote highlighted how misuse can involve a connected service as well as a physical tool. The recap was not a product test and did not establish the Flipper Zero’s full capabilities.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the 2023 recap says about ShmooCon
CyberScoop’s account presented ShmooCon as a conference where community rituals and serious security questions shared the stage. Its reported discussions connected legal variation for researchers with the practical difficulty of securing critical infrastructure, while the Flipper Zero anecdote underscored how intent shapes the consequences of using technology. These are takeaways from the 2023 event as reported at the time, not updates on current law, railway regulations or product capabilities.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
