BSides Des Moines 2026 · United States · 2026

BSides Des Moines 2026 Badge

Iowa CH585 RISC-V NFC badge with village-collection CTF

An official BSides Des Moines 2026 badge documented by the iot-pwn bsidesdsm26 repository as a WCH CH585 RISC-V board with an integrated ISO 14443A NFC reader, four SK6812 RGBW LEDs, a main control button, audio, and a three-layer CTF with two static flags, an eight-tag village-collection challenge, and a hash-based unlock, for the June 13, 2026 edition in Ankeny, Iowa.

BSides Des Moines United States Iowa Ankeny CH585 RISC-V NFC ISO 14443A SK6812 CTF GPL-2.0 North America

EventBSides Des Moines 2026

SeriesBSides Des Moines

LocationAnkeny, Iowa

CountryUnited States

People

Authors & Credits

badge firmware developer

dbisu

Recognized BSides badge developer credited in the bsidesdsm26 commit history for the initial badge firmware and the conference consolidation merge.

Source

badge firmware repository publisher

iot-pwn

Publisher of the GPL-2.0 bsidesdsm26 badge firmware repository with the conference-day development trail and flash station provisioning tooling.

Source

event publisher

BSides Des Moines

Official publisher of the 2026 Des Moines Security BSides edition in Ankeny, Iowa.

Source

Why It Mattered

It adds the Des Moines Security BSides lineage to the North American badge map with a GPL-2.0 firmware repository and a richly documented NFC-driven CTF, while keeping the physical form factor, power source, and image withheld because the repository is firmware-only and carries no image assets.

Hardware

The GPL-2.0 firmware source documents a WCH CH585 RISC-V microcontroller with an integrated ISO 14443A NFC reader, four SK6812 addressable RGBW LEDs on PB6, a main control button on PB23 with tap and hold gestures, an optional boot or recovery button on PB22, a square-wave audio tone generator on PB0, and a USB-CDC serial console. No hardware design files, PCB layout, power source, or physical form factor are present in the firmware-only repository.

Software & Apps

The firmware implements a three-layer CTF: two static flags (a plaintext constant and a Ghidra-disassembleable byte-assembled string), an eight-tag NFC village-collection challenge that maps scanned UIDs to eight village and event markers and lights all four LEDs blue when all eight are collected, and a hash-based unlock that celebrates a specific UID-derived combination. A BOOTSEL USB-CDC command jumps into the WCH ISP bootloader for reflashing, and the firmware encodes eight village markers matching a con floorplan.

Lore

BSides Des Moines is the Iowa Security BSides chapter, and the 2026 edition ran June 13 in Ankeny, Iowa. The badge firmware was developed by iot-pwn with conference-day commits and a bulk badge-provisioning flash station, and the repository credits dbisu, Aask42, and wrickert among the commit authors. The event site itself does not publish badge specifications, so the badge record leans on the public repository and its conference-day development trail.

Lifecycle

Add-ons & Upgrades

badge challenge officially documented

Eight-tag village-collection CTF

Eight hardcoded 4-byte UIDs map to village and event markers (HW Village, Talks1, Talks2, Solder Village, Blue Team, Vendor, CTF, Check-In); scanning a matching tag collects it and lighting all four LEDs blue requires all eight.

Compatibility: BSides Des Moines 2026 Badge

Source

badge challenge officially documented

Static flags and hash unlock

The firmware encodes two static flags (a plaintext constant and a Ghidra-disassembleable byte-assembled string) plus a hash-based unlock that celebrates a specific UID-derived LED combination.

Compatibility: BSides Des Moines 2026 Badge

Source

badge networking officially documented

Integrated ISO 14443A NFC reader

The WCH CH585 integrates an ISO 14443A NFC reader supporting REQA, WUPA, anticollision, RATS, APDU relay, NTAG215 dump, and low-power card detect over the CH585 NFC peripheral.

Compatibility: BSides Des Moines 2026 Badge

Source

badge programming path officially documented

BOOTSEL bootloader backdoor

Sending BOOTSEL over the USB-CDC serial console jumps into the WCH ISP bootloader for reflashing, complementing the flash station bulk-provisioning tooling.

Compatibility: BSides Des Moines 2026 Badge

Source

Operational history

Issues & Camp Impact

hardware-form-factor gap note

The repository documents the CH585, NFC, SK6812 LEDs, buttons, and audio in firmware but contains no PCB gerbers, KiCad or schematic files, board layout, power source, or physical form factor.

The catalogue records the verified firmware and challenge surface without inventing physical-form-factor, power, or hardware-design details.

Confidence: firmware-only repository
Status: needs hardware archive recovery
Timeframe: 2026 badge archive pass
Source note: iot-pwn/bsidesdsm26 repository file tree.

missing rights-cleared image note

No BSides Des Moines 2026 badge image is published because the firmware-only repository contains no image assets and no reusable original badge photo or official upstream raster render with source URL, license or permission basis, attribution, and processing notes has been recovered.

The United States record remains source-backed and image-free rather than copying repository diagrams, screenshots, social media, placeholders, or generated approximations.

Confidence: local project policy
Status: needs licensed original replacement
Timeframe: current catalogue build
Source note: badge.gallery image policy and iot-pwn/bsidesdsm26 repository.

Resources

BSides Des Moines 2026 official site official event page · Official BSides Des Moines source for the June 13, 2026 edition in Ankeny, Iowa, United States. bsidesdsm26 LICENSE license · Repository license source confirming GPL-2.0 terms for the badge firmware. bsidesdsm26 repository source repository · iot-pwn repository for the BSides Des Moines 2026 badge firmware, published under GPL-2.0, documenting the CH585 RISC-V NFC badge, the flash station provisioning tooling, and the three-layer CTF.

Sources

BSides Des Moines: BSides Des Moines 2026 Retrieved 2026-05-15 · Primary official source for the June 13, 2026 Ankeny, Iowa edition and United States Security BSides context. GitHub / iot-pwn: bsidesdsm26 Retrieved 2026-05-15 · Primary repository source for the WCH CH585 RISC-V microcontroller with integrated ISO 14443A NFC reader, four SK6812 RGBW LEDs, main and boot buttons, audio tone generator, USB-CDC console, the eight-tag village-collection CTF, two static flags, the hash unlock, and the BOOTSEL bootloader backdoor, published under GPL-2.0. GitHub / iot-pwn: bsidesdsm26 LICENSE Retrieved 2026-05-15 · Primary license source confirming GPL-2.0 terms for the badge firmware.