DEF CON, the yearly hacker normal held successful Las Vegas, Nevada, conscionable concluded its 2026 event. Between the convention’s Main Stage talks, vendor floors, and Demo Labs displays, this year’s arena displayed immoderate astonishing feats of anti-surveillance exertion built by open-source and independent developers aliases cybersecurity experts.
There’s a instrumentality that detects adjacent Flock cameras, an encrypted handheld instrumentality for sending texts without relying connected bearer networks aliases the internet, a consequence calculator for third-party web browser extensions, and an precocious spyware detector for smartphones. I spent my play analyzing each of them, going done reams of on-the-floor footage and announcement pages. These are the things that struck maine arsenic astir interesting.
Flock You and OUI-SPY by Colonel Panic
Flock Safety’s automated licence sheet reference (ALPR) cameras person been the attraction of each cybersecurity and surveillance speech successful 2026. They softly scan licence plates to nonstop retired automatic alerts to rule enforcement and national agencies, pinch the advertised extremity of cracking down connected criminal activity. However, that's not ever the case: Reports show rule enforcement has utilized Flock information to way immigrants and people perchance seeking abortions, arsenic good arsenic spy connected partners and romanticist interests.
A very absorbing gadget to travel retired of DEF CON 2026 is this exertion developed by a DIY hardware enthusiast who goes by “Colonel Panic.” It’s a lightweight firmware called Flock-You that tin beryllium installed connected immoderate ESP32 microcontroller. You bargain an ESP32 spot for $10 to $15, load the firmware onto it, and usage it to perceive for wireless signals that alert you erstwhile a surveillance camera for illustration Flock is nearby. If you don’t want to fuss yourself pinch the DIY setup, Colonel Panic besides sells packaged ESP32 boards pinch the Flock-You firmware pre-loaded into them. These are called OUI-SPY detectors, and you tin get them for arsenic small arsenic $85 apiece.
There are a fewer caveats, for illustration really the Flock-You firmware won’t activity connected Arduino aliases Raspberry Pi microcontrollers because they are tuned into the ESP32’s circumstantial wifi and Bluetooth infrastructure. Also, Flock cameras are already being adjusted to evade this discovery technology, truthful it will astir apt only activity connected older aliases unpatched models.
The Biscuit Ultra by Hedge
If location was ever a Swiss Army weapon of anti-surveillance tech, Biscuit Ultra is astir apt it. This is simply a handheld instrumentality designed by a hacker known arsenic Hedge that scans adjacent wireless signals for respective telltale signs of surveillance tech successful your vicinity. Then it will provender you accusation like:
A database of each adjacent wifi networks
Flock aliases Axon cameras successful your range
If the aforesaid instrumentality aliases gadget keeps popping up everyplace you go
Of the 3 features, I deliberation the 3rd 1 is astir apt the astir useful of the bunch. You’ll get automated alerts if the aforesaid smartphone, tracker, aliases GPS instrumentality is pursuing you astir complete time, which is simply a bully parameter of whether you’re being actively tracked without your knowledge. The instrumentality is designed to look inconspicuous, for illustration a mini handheld router pinch 2 swivel antennas. Right now, a azygous portion costs astir $160 connected the Biscuit Shop.
Rayhunter by the Electronic Frontier Foundation (EFF)
Law enforcement officials successful the United States usage devices called IMSI-catchers (nicknamed “Stingrays”) that tin way cellphones by pretending to beryllium a compartment tower. They nonstop retired beardown signals that phones correction for a existent tower, which leads them to disconnect from the section building and link to the catcher instead. Once connected, Stingrays tin way your real-time location and telephone logs without anyone the wiser. It’s a method commonly utilized by section constabulary departments, the FBI, and ICE, for example. Worse still, erstwhile these devices are active, they drawback stray information from each different cellphones successful the vicinity, moreover if their owners weren’t persons of liking successful an investigation.
Federal agents are required to get a hunt warrant earlier deploying these devices isolated from successful "exigent circumstances," but that apt isn't capable to sphere the wide public's privacy. The Electronic Frontier Foundation has developed a caller instrumentality called Rayhunter to observe immoderate suspicious towers that could beryllium Stingrays successful the vicinity. It runs connected immoderate off-the-shelf mobile hotspot, which the EFF says tin costs arsenic small arsenic $20. You simply load the EFF’s free package into the hotspot, and it lights up reddish if there’s immoderate suspicious search behaviour from adjacent towers.
The Hacker Pager by Exploitee.rs
Exploitee.rs is simply a cybersecurity investigation group that specializes successful IoT security, location automation, intermezo devices, and smartphones. They built a power connection instrumentality called The Hacker Pager, which looks for illustration a retro-style handheld smartphone pinch a surface and mechanical keyboard.
Unlike cellphones, The Hacker Pager does not trust connected compartment towers aliases net connectivity. This low-tech gadget uses power waves that transmit from instrumentality to instrumentality instead, based connected an open-source firmware called Meshtastic. With the 2026 firmware update, Exploitee.rs’ instrumentality now supports outer Bluetooth keyboards, multichannel communication, and much customization options for things for illustration notification sounds. While secure, it’s not very long-distance, because the signals only recreation up to 30 miles—assuming that there's a clear statement of show pinch nary obstructions.
Phasmid by Mr. Rabbit
This one’s still a prototype, but it’s worthy a look anyhow for the thought alone. Makoto Sugita, aliases “Mr. Rabbit,” showed disconnected a deniable retention strategy that tin create a clone type of your section record storage. That way, you tin support confidential information hidden from the group astir you.
Phasmid is an open-source Python app that tin beryllium installed connected a instrumentality that splits your section retention into 2 slots—one real, and the different a clone type that you designed pinch your delicate information removed. When personification tries to physically coerce you into handing complete your device, Phasmid pulls up a “safe” type of your section retention that has each the delicate information scrubbed from it, without revealing thing else.
Since it’s only a prototype, Phasmid tin only beryllium installed connected Raspberry Pi devices for now, and a macOS type is presently nether development. It’s much of a impervious of conception arsenic it stands, but an absorbing look astatine a instrumentality that solves a circumstantial problem that not a batch of exertion is designed to unafraid against.
L.A.Y.E.R.S. by Abhinav Khanna and Krishna Chaganti
Fake extensions pinch information issues person been a recurring interest for web browsers. Many of these extensions besides dress to beryllium advertisement blockers aliases coupon finders, softly search your online activity, logging keystrokes, aliases switching connected your mic and webcam. Most group don’t moreover announcement specified a point until they person a ransom email aliases extremity up successful a information breach. L.A.Y.E.R.S., designed by cybersecurity researchers Abhinav Khanna and Krishna Chaganti, scans your presently installed browser extensions to delegate each a consequence people based connected their behaviour patterns.
L.A.Y.E.R.S. is presently disposable arsenic a downloadable package connected GitHub. It runs locally connected your web browser, without sending immoderate information to third-party platforms via API. Every browser hold you person installed gets scanned for suspicious support requests, malicious JavaScript aliases HTML, risky outer endpoint URLs, and different communal patterns among malicious plugins. You extremity up pinch a elemental consequence people that grades each hold betwixt 1 and 100, pinch little scores indicating a higher information risk.
IsMyPhonePwned by Anthony Desnos
IsMyPhonePwned offers an reply to the question: “What should I do if I deliberation my telephone has spyware connected it?” Normally, you’d beryllium forced to employment costly forensic cybersecurity experts aliases salary for an antimalware level for illustration BitDefender aliases Norton. But Anthony Desnos developed IsMyPhonePwned arsenic a free replacement to costly spyware detectors that require you to instal a cumbersome app connected your telephone which would besides springiness distant your suspicions to the attacker.
Desnos’ instrumentality is simply a web exertion you tin tally from your desktop PC. You link to your compromised smartphone complete USB, and IsMyPhonePwned generates a bug study for you. You tin tally this cheque connected some Android and iOS devices. If you fishy a circumstantial app of being spyware, there’s besides a tool here called droid2web that tin scan Android app packages separately.
English (US) · 
Indonesian (ID) · 
