Post-mortem: Call Center Village @ BSides CLE 2025

Jay and I recently attended BSides CLE at Ingenuity in Cleveland, Ohio. It was a really unique venue and we had a blast. This was our first full-run of the village since our DEFCON 33 pivot to focus on AI agents and social-engineering.

Before we start, I have to tell you something: I dropped the phone booth. Yep; off the back of the lift-gate. The truck I rented wasn't tall enough so as I was attempting to load it upright, the top caught the door-frame and toppled off the hand-truck about 4ft onto my driveway; landing on it's side.

Surprisingly, we only lost two glass side-panels and added a few scrapes and scratches. Battle-scars are more my aesthetic, anyhow.

Big shout-out to the sturdy-craftsmanship of The King's Bay.

Call Center Village Format Improvements

The single-day format update for BSides CLE worked roughly the same as the DEFCON33 pivot, with the following changes:

1. We reduced the number of total challenges from 16 to 9
2. We reduced the number of Capstone challenges from 2 to 1. The only Capstone challenge is now The Live Operator (unlocked after beating the other 8 AI-based agent challenges)
3. Winner is solely determined by total number of points (tie-breaker being the number of challenge first-solves)
4. We had a trophy.

I think this format worked nicely and expect to continue using this configuration at Queen City Conference in November.

They Went Off Script

One of the teams working on the CTF (Capture The Flag) successfully worked out how to submit account updates to the answering service that was handling The Live Operator challenge.

With this knowledge, they registered a domain that used Answer Target in it's branding and then attempted to email in changes that would allow them to then convince the live operator they were authentic enough to give out info.

Luckily, this effort failed – a win for the call center process in verifying contacts who are allowed to make changes.

It wasn't something I had expected, but I applauded them for their ingenuity (at Ingenuity, get it?) and then promptly asked them to stop their efforts!

My worry is that this could escalate to sending links/phishing to get direct computer access, which is way out of scope and highly discouraged.

They did not get so far as to be a problem, but it's something we're going to explicitly add as being against the rules for future runs. Our intention is for the challenge to be primarily voice-driven so switching channels is out [until I can figure out a safe way to enable it.]

After all, anyone can send a phishing link, right?

The Live Operator Has Fallen

This was the first time I saw conference attendees organically excited to learn about and try the challenges just from watching other people attempt it. For example, someone was attempting a challenge from their cell-phone while at the lunch table, and everyone was listening in.

It was described as "a blast", "fun", and "super cool."

This seemingly resulted in a lot more attempts at The Live Operator challenge, and so we'll share some takeaways that are likely too-limited to extrapolate for use anywhere else.

The live operator broke (gave out the info) after:

• The attacker established a friendly repertoire w/ the operator over multiple calls.
• The attacker established a convincing sense-of-urgency w/ information unlocked during the challenge.

While these were the two primary reasons, another big part of the equation that goes unnoticed in the results is the pressure experienced by a live operator during the course of their shift.

Higher than normal call-volume?

A particularly frustrating caller?

Or perhaps a client who berates someone for no reason?

These are the problems that interweave your operators call-taking every day and can have a meaningful impact on their mental health. This is one of the reasons that I'm so excited about building our own platform – we can use AI to help protect agents from these types of circumstances (versus you know, replacing them.)

When every call you take is the equivalent of a pop-quiz, you're bound to make a mistake every now-and-then.

The Winner: Vapidrabbit

Congratulations to the efforts by Vapidrabbit who successfully beat the live operator, earned the most points, and won the Golden Phone Booth trophy.

The full leaderboard is available from the BSides CLE link at callcentervillage.com/schedule

Conference Photos

The badges for BSides CLE were cassette-tapes on a lanyard. A hidden message was hidden/encoded onto the tapes that must be decoded using something Jay was familiar with, but that I had no clue about.

Apparently it was similar in scope to the Kansas City Standard.

I did learn that there are actual USB-C enabled cassette-tape players!? Who would have thought.

Anyways, enjoy some photos – they really don't give the place justice.

Next Up: Queen City Conference

Our next Call Center Village (and final run for the 2025 calendar year) is in Cincinnati, Ohio at Queen City Conference in a couple of weeks.

Queen City Conference - Home

Queen City Conference is a 3 day cyber security conference that is held in Cincinnati Ohio between November 7th - November 9th

Great American Insurance Group

We've got a dedicated room at the 3-day conference, so we're bringing the full-force of our training and security arsenal:

• The Escalation Desk
• The Learning Line
• The Demarcation Demo

The Escalation Desk is the CTF contest described throughout this post, and includes updated challenges and new (smarter) AI agents to trick.

The Learning Line is a multi-step learning station where attendees will learn how to use open-source and commercial tools to clone and manipulate their own voice.

The Demarcation Demo is a set of cyber-security tools (physical, digital, and electrical) that are often used for troubleshooting general security and IT systems that you might see in a typical call center – things like RFID scanners, lock picks, sipvicious, FlipperZero, HAK5 Rubber Ducky/USB Unblocker, punch-down tools, 66-blocks, and other fun devices to play with.

We've even got another Golden Phone Booth trophy in the works, along with 3" key-chains badges and holographic stickers.

See you in Cincinnati in a few weeks!

Remind me why?

If you're reading this and can't figure out how it related to my business, it's pretty simple:

1. We needed to learn how to work with AI agents to better support our customers.
2. We needed to learn how to break those AI agents to better support our customers.

Call Center Village, while initially built with a different vision, has vastly increased our knowledge and understanding of working with and against AI in telecom/voice scenarios.

We aren't doing this to make money, but hopefully it will contribute to our ability to make money in the future.

Want to help? Head over to our contact page to start the conversation:

Contact Call Center Village - Call Center Village

Get in touch about the AI vs Human call center security challenge

Call Center Village

• Sponsor Call Center Village! We offer digital and physical marketing opportunities on a one-time or recurring basis.
• Own a call center? We are always looking for more call centers to use in our Live Operator challenge.
• Send a suggestion! How can we make the village the best it can be for attendees?

Thanks as always for reading this far!