1
00:00:08,700 --> 00:00:10,580
Okay, this is going to be silly.

2
00:00:10,580 --> 00:00:13,500
We're about 10 people here, so...

3
00:00:13,500 --> 00:00:16,160
Come to me, my children.

4
00:00:19,240 --> 00:00:20,520
Or not.

5
00:00:25,320 --> 00:00:26,640
Yeah, it's cool.

6
00:00:30,500 --> 00:00:31,860
Three, five.

7
00:00:32,940 --> 00:00:33,960
One, two.

8
00:00:34,680 --> 00:00:35,720
Minus one.

9
00:00:38,080 --> 00:00:39,940
Okay, I'm not funny, okay?

10
00:00:42,140 --> 00:00:42,580
Um...

11
00:00:55,920 --> 00:00:56,800
Okay.

12
00:00:58,860 --> 00:01:02,360
I'll start by introducing myself, which is always a good thing.

13
00:01:02,360 --> 00:01:03,220
I guess.

14
00:01:03,560 --> 00:01:08,640
But before that, I need to ask, was anybody here at my previous lecture a couple of days ago?

15
00:01:10,000 --> 00:01:10,780
No.

16
00:01:10,780 --> 00:01:12,720
Cool, I can use the same jokes again.

17
00:01:12,960 --> 00:01:13,980
No, seriously.

18
00:01:13,980 --> 00:01:15,400
I don't have that many jokes.

19
00:01:15,480 --> 00:01:16,820
And they're usually bad.

20
00:01:20,780 --> 00:01:25,980
What you're going to hear about right now, I'm not really sure what lecture you came to, because...

21
00:01:25,980 --> 00:01:31,620
If you know what lecture you came to, because I was just inserted into the schedule.

22
00:01:32,500 --> 00:01:34,560
There are some scheduling problems.

23
00:01:36,080 --> 00:01:39,280
I'm going to lecture about the survivability of the internet.

24
00:01:40,380 --> 00:01:41,540
Woohoo, fun.

25
00:01:41,900 --> 00:01:44,360
And I'm going to make some bad jokes.

26
00:01:44,360 --> 00:01:47,420
And I'm going to speak about some serious issues.

27
00:01:48,240 --> 00:01:53,720
And since there are not that many people here, I'll allow myself to say a lot of shit and fuck.

28
00:01:55,100 --> 00:01:59,700
Now, my name.

29
00:02:01,860 --> 00:02:06,800
My name is Gadi Evron, and some of you may know me from the internet as an asshole.

30
00:02:07,980 --> 00:02:10,540
Others might know me as a nice guy, but not that many.

31
00:02:10,580 --> 00:02:12,660
I mean, there are not that many people here, okay?

32
00:02:13,040 --> 00:02:14,520
And that's basically it.

33
00:02:15,320 --> 00:02:16,700
What is DA?

34
00:02:16,700 --> 00:02:18,140
DA is a mailing list.

35
00:02:18,360 --> 00:02:19,860
What is MWP?

36
00:02:20,060 --> 00:02:22,180
MWP is also a mailing list.

37
00:02:24,760 --> 00:02:27,420
Now, we'll start with the boring stuff.

38
00:02:28,780 --> 00:02:34,940
Is there actually a threat to the survivability, big word, of the internet today?

39
00:02:35,720 --> 00:02:42,440
Now, I don't really expect you to answer me, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12...

40
00:02:42,440 --> 00:02:49,760
There are not that many people, but seriously, does anybody here think there is a problem today with the internet?

41
00:02:52,280 --> 00:02:54,020
Cisco gate, okay, cool.

42
00:02:54,400 --> 00:02:56,260
Yes, I'll answer it.

43
00:02:56,260 --> 00:02:57,620
Yes, there is a problem.

44
00:02:57,620 --> 00:02:59,280
Is it called botnets?

45
00:03:00,720 --> 00:03:01,680
No.

46
00:03:02,540 --> 00:03:03,960
Well, kind of, but no.

47
00:03:03,960 --> 00:03:05,060
We'll get to that.

48
00:03:05,860 --> 00:03:16,360
Now, I'm jumping right in, skipping a few slides, and what I basically want to talk about, which I'm not going to, is botnets.

49
00:03:17,500 --> 00:03:27,000
But, essentially, when you look at the problems of the internet, and you see spyware, you see spam, you see viruses, you see all that shit going around.

50
00:03:27,780 --> 00:03:28,660
Why?

51
00:03:29,280 --> 00:03:38,440
I mean, seriously, people used to blame everything on hackers, or the bad guys, and that doesn't make any sense to me, really.

52
00:03:41,620 --> 00:03:59,400
Boring stuff is, for example, like in any social structure, that's my belief, there are many different kinds of people, duh, and it's not just the bad hacker, the bored employee going back home and doing whatever malicious stuff he wants to do, or she wants to do.

53
00:04:00,020 --> 00:04:06,640
There are the kiddies, there's the military, there are the criminals, everybody.

54
00:04:06,640 --> 00:04:07,620
Different people.

55
00:04:07,760 --> 00:04:14,840
But still, to sustain such a huge amount of bad stuff on the internet, somebody has to get something out of it.

56
00:04:14,960 --> 00:04:18,440
I mean, seriously, so much stuff just going out of boredom?

57
00:04:18,680 --> 00:04:21,760
I don't think so, and I'll try and prove that.

58
00:04:22,400 --> 00:04:24,700
Even though it's not really the point of the presentation.

59
00:04:25,520 --> 00:04:27,120
So where is the ROI?

60
00:04:27,120 --> 00:04:29,380
Where is the management talk?

61
00:04:29,380 --> 00:04:30,680
Return of investment.

62
00:04:31,000 --> 00:04:32,940
On investment, sorry.

63
00:04:33,900 --> 00:04:35,820
Like I said, social structure.

64
00:04:35,820 --> 00:04:37,340
Let's start with the kiddies.

65
00:04:37,400 --> 00:04:38,940
Are there any kiddies here?

66
00:04:39,700 --> 00:04:40,500
Ah, cool.

67
00:04:40,500 --> 00:04:41,400
Hey, kiddy.

68
00:04:42,540 --> 00:04:43,740
Kiddy front.

69
00:04:43,840 --> 00:04:51,000
Some of you may have read it a couple months ago on Suns maybe, or heard it from a guy called Dan Hubbard.

70
00:04:51,260 --> 00:04:53,060
Iframe dollars.biz.

71
00:04:53,180 --> 00:04:59,500
Now, generally, whenever I see a .biz domain, I start crying, or scratching, or whatever.

72
00:04:59,560 --> 00:05:01,400
Seriously, biz domains are bad.

73
00:05:01,400 --> 00:05:04,100
Nearly as bad as CX or WS or whatever else.

74
00:05:04,100 --> 00:05:07,100
Seriously, I just see .biz domain and I start crying.

75
00:05:08,240 --> 00:05:13,200
Iframe dollars.biz was a business, plain and simple.

76
00:05:13,380 --> 00:05:16,320
Some guy said, hey, let's make money off the internet.

77
00:05:16,980 --> 00:05:19,720
And you're coming up here, you do know that.

78
00:05:20,760 --> 00:05:21,460
Yeah.

79
00:05:22,280 --> 00:05:24,320
Dan fucking Kaminsky, people.

80
00:05:24,540 --> 00:05:25,980
Dan fucking Kaminsky.

81
00:05:27,920 --> 00:05:32,040
Now, oh shit, these are people that actually heard my lecture before.

82
00:05:32,420 --> 00:05:34,100
I can't use the same jokes again.

83
00:05:37,180 --> 00:05:48,060
Now, iframe dollars.biz basically said, okay, come into my website, take this code iframe, I think it was, and put it on your website.

84
00:05:49,000 --> 00:05:56,560
Now, for every first click, every user that goes into your website and installs our spyware, or whatever it was, you'll get money.

85
00:05:56,920 --> 00:06:00,520
You won't get a lot of money, you'll get 0.06 dollars.

86
00:06:01,560 --> 00:06:05,360
Now, they claimed you're eating.

87
00:06:06,420 --> 00:06:07,320
Bitch.

88
00:06:07,320 --> 00:06:07,700
Okay.

89
00:06:07,700 --> 00:06:15,180
They claimed, if I have one more bad pizza, I swear I'll puke.

90
00:06:17,280 --> 00:06:28,280
They basically said, look, take this code, put it on your webpage, whenever somebody comes inside, into your webpage, you'll get 0.06 dollars, which is cool.

91
00:06:29,460 --> 00:06:37,200
Now, they claimed to pay, the week before we saw them, $11,000 for that.

92
00:06:37,380 --> 00:06:41,300
Now, that amounts to about 220,000 clicks.

93
00:06:41,680 --> 00:06:43,400
Again, they claimed.

94
00:06:43,400 --> 00:07:00,200
Now, we actually found their statistics page, and yes, apparently they did pay 220,000 people did get firstly installed software on their computers, and they did pay $11,000 to people.

95
00:07:01,200 --> 00:07:05,820
Now, 11k is a lot of sum, but it's not that much money.

96
00:07:07,640 --> 00:07:16,120
Now, there is another guy, I would like to give you as an example, and I don't know how to pronounce his name, or nickname, or whatever we chose to call him.

97
00:07:16,260 --> 00:07:19,180
It could be Flowby, it could be Flowby, depending on where you're from.

98
00:07:20,060 --> 00:07:22,120
Now, this guy is a botnet controller.

99
00:07:22,420 --> 00:07:29,860
Just so we are clear, I'll explain in a couple of lines what I believe a botnet is, and if you think I'm wrong, tough.

100
00:07:31,540 --> 00:07:32,920
Trojan horses.

101
00:07:33,420 --> 00:07:40,220
We all know what Trojan horses are, I'll repeat anyway, and again, you can argue with me all you like, I don't care.

102
00:07:40,980 --> 00:07:42,400
Shut up, Dan.

103
00:07:45,160 --> 00:07:48,280
You can't speak if you're not drunk, that's it.

104
00:07:58,280 --> 00:08:00,020
Is that beer?

105
00:08:00,720 --> 00:08:05,620
No, it's not that.

106
00:08:06,480 --> 00:08:28,820
Okay, Flowby was a botnet controller, and again, Trojan horses, let's say it's some sort of software or hardware or whatever, some sort of thingy, that if a user knew what it would do, it would not be so pleased about it, let's put it that way, and it's usually a remotely controlled device or whatever installed on your machine.

107
00:08:29,220 --> 00:08:35,500
That was the worst explanation of what a Trojan horse ever gave, or heard, for that matter.

108
00:08:35,500 --> 00:08:41,680
Now, you can do whatever you like on a machine where a Trojan horse has been installed.

109
00:08:41,680 --> 00:08:43,300
You control that machine.

110
00:08:43,480 --> 00:08:47,540
Now, imagine if you had 10 such machines, where you installed Trojan horses.

111
00:08:47,920 --> 00:08:52,960
Imagine you had 100, and they were on broadband, of course.

112
00:08:53,000 --> 00:09:00,360
Imagine you had 200, 1,000, 10,000, 100,000, a million machines, all completely at your control.

113
00:09:01,880 --> 00:09:15,960
Well, you would have to control them somehow, and that's basically a botnet, because these drones, bots, whatever, will be reporting to a center point, which is the command and control server.

114
00:09:17,040 --> 00:09:27,940
Now, this guy owns many botnets, and on one of the botnets, we can't really prove that, we've seen it happening with many different cases, and it's just very easy for me to give you an example.

115
00:09:30,280 --> 00:09:40,940
On one of his botnets, which was 35k large, 35,000 bots large, he decided, hey, DDoS is not good enough for me.

116
00:09:41,360 --> 00:09:47,900
I don't want to spam, I don't want DDoS, there is a lot of downtime for my bots, and I want to use that downtime.

117
00:09:48,420 --> 00:09:53,620
So, basically, what he supposedly did is install a lot of spyware on every single machine.

118
00:09:53,620 --> 00:10:03,040
Now, a legal calculation of a page we believe he took the spyware from would mean that he gained about 8k a day from his small botnets.

119
00:10:03,320 --> 00:10:04,740
So, that's a kiddie front.

120
00:10:04,740 --> 00:10:06,880
8k, 11k, whatever.

121
00:10:08,100 --> 00:10:09,700
Now, the big picture.

122
00:10:10,560 --> 00:10:13,500
We don't really know what the big picture is.

123
00:10:13,700 --> 00:10:14,520
Seriously.

124
00:10:14,700 --> 00:10:17,020
We do not see what's happening.

125
00:10:17,700 --> 00:10:26,080
And this is DEF CON, I don't need to explain it to you, because half the lectures here were about conspiracy theories and how the government is spying on us and all that.

126
00:10:27,000 --> 00:10:29,420
But we can see some of that.

127
00:10:29,840 --> 00:10:32,940
It's in plain sight, it's public.

128
00:10:33,740 --> 00:10:36,940
And between a lot of beers, you might actually notice it.

129
00:10:37,820 --> 00:10:40,540
I was just looking at you, I didn't mean anything by that.

130
00:10:40,640 --> 00:10:43,480
There's plain sight spying by government?

131
00:10:43,480 --> 00:10:44,100
Yes.

132
00:10:44,100 --> 00:10:52,640
Now, when you see phishing, which is in plain sight, he's a little bit drunk, or I'm just not very well understood, which is possible.

133
00:10:53,200 --> 00:10:54,180
Or likely.

134
00:10:56,100 --> 00:11:01,980
You're not implying governments are running legitimate botnets by putting spyware on people's machines?

135
00:11:01,980 --> 00:11:02,980
You're on to me.

136
00:11:03,160 --> 00:11:04,900
I work for the government, you know.

137
00:11:05,880 --> 00:11:06,500
Okay.

138
00:11:06,920 --> 00:11:11,440
Now, phishing, seriously, phishing gives us a very, very good picture of what's going on.

139
00:11:11,960 --> 00:11:17,660
Phishing is public, you get it in your inbox, you can go to the sites, you see what's going on, which is great.

140
00:11:17,660 --> 00:11:22,500
And we can actually see the amounts of money that goes into it, and I'll show you in a minute.

141
00:11:23,520 --> 00:11:38,380
And then there are a few minor details, such as, for example, the Trojan Horse industrial espionage case, where there were some private investigation companies and some very rich companies that wanted to spy on their competition.

142
00:11:39,420 --> 00:11:48,320
So basically, as far as I understand, they paid 17k UK pounds, or 13k UK pounds a month, per computer.

143
00:11:49,080 --> 00:11:50,520
Which is a lot of money.

144
00:11:50,580 --> 00:11:52,980
So there are things going on behind the scenes.

145
00:11:53,040 --> 00:11:56,500
Some of them we can actually prove because we hear about one or two every year.

146
00:11:56,780 --> 00:12:00,100
But let's actually look at what we can see day-to-day.

147
00:12:00,800 --> 00:12:10,540
The APWG, the Anti-Phishing Working Group, says they saw over 13k unique phishing emails in March 2005 alone.

148
00:12:10,540 --> 00:12:12,960
And thousands of phishing sites.

149
00:12:12,960 --> 00:12:13,640
Woohoo!

150
00:12:13,640 --> 00:12:17,640
Now, people usually say, and I'm going to be kind of...

151
00:12:18,400 --> 00:12:19,900
Okay, we all know this.

152
00:12:20,380 --> 00:12:24,640
These guys, they sent so many millions of spam messages out.

153
00:12:25,040 --> 00:12:28,440
And then just one person clicks on it and fills the details in.

154
00:12:29,400 --> 00:12:37,280
Well, one person clicking and filling in the details is a clear cut return on investment because email doesn't cost money.

155
00:12:37,580 --> 00:12:42,700
We all know that, but it's very important to reiterate that issue.

156
00:12:43,340 --> 00:12:45,300
Now, let's give some statistics.

157
00:12:45,440 --> 00:12:52,060
In Germany, for example, every phishing attempt 2,000 people fill in their details.

158
00:12:52,880 --> 00:12:54,740
Now, that number keeps rising.

159
00:12:54,740 --> 00:12:56,960
It's not just one stupid guy.

160
00:12:57,180 --> 00:13:00,080
There's a lot of stupid people out there.

161
00:13:00,080 --> 00:13:03,420
Now, of them, about six do not get their money back.

162
00:13:03,420 --> 00:13:07,760
And that's because the banks are very good at moving money around.

163
00:13:07,760 --> 00:13:09,420
Money is stolen, no problem.

164
00:13:09,420 --> 00:13:11,560
But six do not get their money back.

165
00:13:11,780 --> 00:13:14,080
Or rather, the banks have to cover it.

166
00:13:14,680 --> 00:13:21,400
Now, on average, that amounts to about 6K euro lost per person.

167
00:13:22,040 --> 00:13:24,340
36K euro for every attack.

168
00:13:24,340 --> 00:13:27,920
Now, per year, that's 1.2 million euros.

169
00:13:28,300 --> 00:13:30,100
And that's just for one group.

170
00:13:30,100 --> 00:13:33,120
Each group's attacks are used to attack once every eight days.

171
00:13:33,120 --> 00:13:34,720
Now, they do it a lot more often.

172
00:13:35,440 --> 00:13:37,320
Quite a few groups out there.

173
00:13:37,320 --> 00:13:39,900
Can anybody see the ROI yet?

174
00:13:39,900 --> 00:13:41,040
The return on investment?

175
00:13:41,840 --> 00:13:43,860
There is a lot of money going into this.

176
00:13:43,860 --> 00:13:50,320
Now, the Russian mob, and I have to say this again, I always say it in my lectures, I have nothing against Russians.

177
00:13:51,060 --> 00:13:51,940
Seriously.

178
00:13:52,320 --> 00:13:54,260
I had a girlfriend who was Russian.

179
00:13:55,800 --> 00:13:57,720
But really, nothing against Russians.

180
00:13:58,360 --> 00:14:05,140
But most of this stuff, there are a lot of small operators out there in Eastern Europe, in Brazil, all around the world.

181
00:14:05,140 --> 00:14:07,800
But most of this stuff comes from the Russian mob.

182
00:14:08,340 --> 00:14:10,220
Clearly, from the Russian mob.

183
00:14:10,300 --> 00:14:11,580
I'll say it again.

184
00:14:12,540 --> 00:14:13,860
Hold on.

185
00:14:14,920 --> 00:14:16,180
Hold on.

186
00:14:16,620 --> 00:14:20,660
I'll answer every question, and if not, hey, I'm on tape.

187
00:14:22,100 --> 00:14:25,180
The Russian mob sees the return on investment.

188
00:14:25,860 --> 00:14:26,660
Okay?

189
00:14:27,800 --> 00:14:28,880
Cool.

190
00:14:29,140 --> 00:14:35,540
And they actually invest in the technological and operational capabilities over time.

191
00:14:35,880 --> 00:14:42,260
There are people sitting here who actually watch the binaries and the samples, and can tell you how they evolve over time.

192
00:14:43,120 --> 00:14:46,260
Now, many of these kitties just, like I said, it's social structure.

193
00:14:46,260 --> 00:14:48,540
It's not all the Russian mob.

194
00:14:49,120 --> 00:14:51,880
Many of these kitties just trade it like candies.

195
00:14:52,300 --> 00:15:02,540
And most of these trojan horses, or bots, or whatever, are just the same code, ripped from one another over and over and over again.

196
00:15:03,960 --> 00:15:07,480
But still, it's important to note that, and I'll give you an example.

197
00:15:08,420 --> 00:15:15,860
Here in the States, this just came out a few months ago, here in the States, there was a phishing attempt.

198
00:15:16,080 --> 00:15:17,900
It's a phishing attack, actually.

199
00:15:20,440 --> 00:15:26,300
And somebody's account got emptied in a branch of the bank on the West Coast.

200
00:15:27,780 --> 00:15:40,080
Now, a week later, a FedEx box came in, carrying a fake check, which is what actually got people to look into it, to refill their account so they can empty it again.

201
00:15:41,240 --> 00:15:42,380
Shut up!

202
00:15:42,540 --> 00:15:47,180
So basically, you'll get to lecture in a minute, so don't disturb.

203
00:15:48,260 --> 00:15:49,340
You're not allowed.

204
00:15:49,340 --> 00:15:50,340
You're not drunk.

205
00:15:57,050 --> 00:15:58,910
I'm very happy that you came.

206
00:16:03,380 --> 00:16:06,560
Now, I really am happy that you came.

207
00:16:09,420 --> 00:16:12,980
Basically, what that means, people, this is not cyberspace anymore.

208
00:16:13,600 --> 00:16:14,880
This is meatspace.

209
00:16:15,740 --> 00:16:20,660
This is happening right here, right now, with real people, and real money.

210
00:16:21,760 --> 00:16:23,980
That's critical to what I'm going to talk about.

211
00:16:25,080 --> 00:16:29,960
Now, in the UK, for the last example, the losses are also significant.

212
00:16:31,420 --> 00:16:37,420
1.4... 1 to 4, I'm sorry, million pounds a month in losses, just at the beginning of this year.

213
00:16:37,660 --> 00:16:40,220
And it jumped by 1 million every month.

214
00:16:41,060 --> 00:16:45,540
December, January, February, March, it got to 4 million pounds lost.

215
00:16:45,540 --> 00:16:47,360
Now, don't take my word on these numbers.

216
00:16:47,360 --> 00:16:48,640
You won't find them anywhere.

217
00:16:48,760 --> 00:16:52,820
As far as you're concerned, I'm lying, because I'm not going to prove it to you.

218
00:16:52,820 --> 00:16:55,260
And anything I'm not going to prove, just believe I'm lying.

219
00:16:55,260 --> 00:16:56,700
But these numbers are true.

220
00:16:57,160 --> 00:16:59,540
Now, this is by... I'm lying.

221
00:16:59,700 --> 00:17:01,260
No, this is by phishing alone.

222
00:17:02,920 --> 00:17:04,320
There is a lot of money in this.

223
00:17:04,320 --> 00:17:05,040
I'm saying it again.

224
00:17:05,040 --> 00:17:07,500
I'm repeating myself, and there is a reason for that.

225
00:17:08,580 --> 00:17:11,260
In the US, the story is a bit different.

226
00:17:11,920 --> 00:17:17,080
One bank, they say they used to see about 200 victims per scam.

227
00:17:17,240 --> 00:17:19,280
Today they say they see about 5.

228
00:17:20,040 --> 00:17:21,420
But come on, people.

229
00:17:21,420 --> 00:17:26,720
Banks, at least in the United States, in the UK, they can't, as far as I know.

230
00:17:26,860 --> 00:17:31,040
They have a legitimate reason to actually try and underplay the problem.

231
00:17:32,140 --> 00:17:33,560
I mean, do you have any idea?

232
00:17:33,560 --> 00:17:35,200
I don't have any idea, by the way.

233
00:17:35,200 --> 00:17:39,800
Do you have any idea how much of all their business goes online?

234
00:17:41,500 --> 00:17:44,240
How much of any business today goes online?

235
00:17:45,120 --> 00:17:47,540
Depending on the bank, it could be 50-60%.

236
00:17:52,050 --> 00:17:52,850
Everything.

237
00:17:52,850 --> 00:17:53,910
Everything.

238
00:17:56,670 --> 00:18:00,390
Again, I don't have hard numbers, and it changes drastically from bank to bank.

239
00:18:00,390 --> 00:18:01,950
I don't want to talk about it.

240
00:18:05,030 --> 00:18:05,910
What?

241
00:18:11,980 --> 00:18:13,500
I really want to answer that.

242
00:18:13,500 --> 00:18:15,340
I honestly don't have time.

243
00:18:15,940 --> 00:18:19,800
I know I'm kind of weeny for saying that, but I honestly don't have time.

244
00:18:19,920 --> 00:18:20,660
Sorry.

245
00:18:21,820 --> 00:18:26,880
Other banks are actually reporting losses of around $10-20 million.

246
00:18:26,880 --> 00:18:28,840
Again, don't take my word for it.

247
00:18:28,840 --> 00:18:31,000
The Germany numbers, I can sign on.

248
00:18:31,880 --> 00:18:33,800
And they're not anywhere you can find.

249
00:18:34,460 --> 00:18:36,200
Now, the problem is not botnets.

250
00:18:36,200 --> 00:18:41,780
Again, I didn't really want to make this a botnet lecture, although I can't speak about botnets for hours on end.

251
00:18:42,560 --> 00:18:45,940
Botnets is a very serious symptom.

252
00:18:47,220 --> 00:18:48,740
A very, very serious symptom.

253
00:18:48,740 --> 00:18:49,440
It's a problem.

254
00:18:49,440 --> 00:18:51,480
Actually, I keep using the same jokes.

255
00:18:51,480 --> 00:18:53,340
You were in my last lecture, you bitch.

256
00:18:53,340 --> 00:18:54,700
Why were you in my last lecture?

257
00:18:54,700 --> 00:18:56,280
I can't reuse jokes.

258
00:18:57,800 --> 00:18:59,640
You were hoping it would be funnier.

259
00:19:03,200 --> 00:19:04,980
I know where you live.

260
00:19:06,500 --> 00:19:07,500
Okay, I don't.

261
00:19:08,180 --> 00:19:10,380
I can find out.

262
00:19:13,320 --> 00:19:14,200
Dan?

263
00:19:18,440 --> 00:19:19,480
The Mossad!

264
00:19:19,480 --> 00:19:20,620
The Mossad!

265
00:19:22,720 --> 00:19:28,120
I was just at Cisco the other day, and they gave, like, name tags that stick on your shirt.

266
00:19:28,560 --> 00:19:36,200
Now, I don't know who told them and what the fuck they thought they were doing, but I don't work in Israeli government security.

267
00:19:36,220 --> 00:19:38,580
But I said, Israeli government security.

268
00:19:38,860 --> 00:19:41,040
I immediately photocopied it.

269
00:19:42,080 --> 00:19:43,780
Asked for another one.

270
00:19:43,880 --> 00:19:45,220
Put it in my pocket.

271
00:19:45,220 --> 00:19:46,380
That's so great.

272
00:19:47,260 --> 00:19:48,200
I'm for the Mossad.

273
00:19:48,200 --> 00:19:48,680
Watch out.

274
00:19:48,680 --> 00:19:50,200
I'll send people after you.

275
00:19:50,720 --> 00:19:54,080
Okay, I don't have time.

276
00:19:54,600 --> 00:19:56,360
The problem is not botnets.

277
00:19:56,360 --> 00:19:58,300
Botnets are a very serious symptom.

278
00:19:58,700 --> 00:20:01,580
What I'm trying to say is botnets are a serious problem.

279
00:20:01,580 --> 00:20:07,860
I can tell you that from our limited view, and we see quite a bit, but again, we don't see everything.

280
00:20:09,180 --> 00:20:12,240
We have 4,000...

281
00:20:14,040 --> 00:20:16,520
4K botnets out there.

282
00:20:16,520 --> 00:20:18,100
Since the beginning of this year.

283
00:20:18,280 --> 00:20:21,360
And that's just a little bit.

284
00:20:21,820 --> 00:20:24,860
I mean, people keep looking at the bot itself.

285
00:20:27,380 --> 00:20:31,240
And they keep asking me, how many bots are out there?

286
00:20:32,260 --> 00:20:32,840
And you know what?

287
00:20:32,840 --> 00:20:34,180
I don't give a shit.

288
00:20:34,180 --> 00:20:36,440
Seriously, I don't care how many bots are out there.

289
00:20:36,580 --> 00:20:41,960
Some people might have to care, but I don't, and I'll explain why in a few minutes.

290
00:20:43,140 --> 00:20:47,080
Now, okay, I'll explain why now, actually.

291
00:20:47,240 --> 00:20:48,660
And waste some time.

292
00:20:52,880 --> 00:21:04,940
Why... you people who live in the United States, or most of you do, you know about this thingy of asking, why be able to destroy the world a thousand times over when once is more than enough?

293
00:21:05,360 --> 00:21:06,060
Right?

294
00:21:06,560 --> 00:21:10,380
Well, botnets on the internet are strategic warfare.

295
00:21:10,980 --> 00:21:12,360
They are nuclear weapons.

296
00:21:12,360 --> 00:21:17,480
And the amounts and numbers out there are unbelievable.

297
00:21:18,380 --> 00:21:23,840
And I can tell you that we've actually seen a 350k botnet.

298
00:21:24,760 --> 00:21:26,240
And it wasn't the only one.

299
00:21:26,240 --> 00:21:27,940
It's just the best example I have.

300
00:21:28,280 --> 00:21:29,380
A few months ago.

301
00:21:30,640 --> 00:21:38,380
Now, when you have that big of a botnet at your control, you can do pretty much anything on the internet.

302
00:21:40,100 --> 00:21:52,440
Now, I'll continue with that in a minute, but really, looking at the botnet as a problem, a botnet itself, the network, install some bots separately, is what I'm talking about.

303
00:21:53,040 --> 00:21:58,020
Now, the philosophy of the problem, why I'm looking at botnets as a symptom... okay, I can't say problem, seriously.

304
00:21:58,020 --> 00:21:59,300
This is a joke I must reuse.

305
00:21:59,300 --> 00:22:00,100
I'm sorry.

306
00:22:00,320 --> 00:22:01,560
It's not really a joke.

307
00:22:01,760 --> 00:22:05,380
I was sitting with a guy from Adobe, or my boss was, I don't really remember.

308
00:22:05,380 --> 00:22:07,640
I reuse jokes all the time.

309
00:22:07,820 --> 00:22:11,280
And the guy would refuse for two hours to say the word problem.

310
00:22:11,880 --> 00:22:13,660
He would say challenges.

311
00:22:13,880 --> 00:22:19,820
For two whole hours, I just heard, or he heard, challenges, challenges.

312
00:22:20,000 --> 00:22:21,100
And now they changed it.

313
00:22:21,100 --> 00:22:23,460
You're supposed to say opportunity, opportunity.

314
00:22:23,640 --> 00:22:25,660
Anyway, so there are several challenges.

315
00:22:26,360 --> 00:22:27,780
Let me get to the point.

316
00:22:29,280 --> 00:22:35,940
If I'm saying botnets are strategic warfare on the internet, I mean, everybody knows what DDoS is.

317
00:22:38,960 --> 00:22:41,000
Why say they're just a symptom?

318
00:22:41,880 --> 00:22:45,220
Let's start a bit about our philosophy of the problem.

319
00:22:45,660 --> 00:22:46,660
The internet.

320
00:22:47,280 --> 00:22:48,620
Photon monoculture.

321
00:22:49,620 --> 00:22:53,060
We all, I mean, whether we like it or not, most of us use Windows.

322
00:22:53,060 --> 00:22:54,940
And I'm not talking about the home computer.

323
00:22:55,020 --> 00:22:57,100
At work, most of us use Windows.

324
00:22:57,200 --> 00:22:58,860
Everywhere, it's Windows.

325
00:22:59,560 --> 00:23:02,900
And that makes us extremely susceptible to attacks.

326
00:23:04,780 --> 00:23:08,460
And I don't have time to talk about that anymore, but just think about it.

327
00:23:08,460 --> 00:23:09,820
I'll waste some time later.

328
00:23:12,000 --> 00:23:16,920
Now, one bug, or one patch, can bring us down.

329
00:23:17,640 --> 00:23:19,340
Repeating past mistakes.

330
00:23:20,400 --> 00:23:30,060
When we left the world of the mainframes, OS development somehow sinked down to a new level.

331
00:23:30,060 --> 00:23:37,380
And just now we are starting to reach the level of where we were with the mainframe in OS development.

332
00:23:37,800 --> 00:23:42,820
And I can actually see it as a pattern of things actually repeating themselves non-stop.

333
00:23:43,840 --> 00:23:46,060
The PC wasn't the end of it.

334
00:23:46,060 --> 00:23:48,100
For example, cell phones.

335
00:23:48,100 --> 00:23:49,700
Everything is in default.

336
00:23:50,140 --> 00:23:52,060
You can't disable anything.

337
00:23:52,060 --> 00:23:53,100
Everything is in automatic.

338
00:23:53,100 --> 00:23:55,080
Java, browsers, whatever.

339
00:23:55,380 --> 00:23:56,420
Unbelievable.

340
00:23:56,520 --> 00:23:59,280
We keep repeating the same mistakes over and over again.

341
00:24:00,440 --> 00:24:02,320
And that brings me to Killing Fires.

342
00:24:03,620 --> 00:24:07,340
And before I reach Killing Fires, I would like to discuss the problems of the internet.

343
00:24:08,340 --> 00:24:22,200
We'll get to KC and who she is in a minute, but everybody keeps saying at the end of the year companies like Symantec, they do a great job, but they come out and say something like look, these are the problems that we are going to face in the year of 2005.

344
00:24:23,200 --> 00:24:24,380
Okay, great.

345
00:24:24,940 --> 00:24:26,080
How do you know that?

346
00:24:26,080 --> 00:24:33,020
Well, we have looked at our past agendas and logs and histories and we can tell you what we believe the issues are going to be.

347
00:24:33,700 --> 00:24:36,280
Okay, so basically F of that is what happened last year.

348
00:24:37,220 --> 00:24:46,020
Almost another F is what you believe is going to happen, therefore you're self-prophesying or whatever you call it, that it will happen and some of it will happen.

349
00:24:46,020 --> 00:24:52,500
And some of this stuff will actually surprise you, because you can't know what everything that's going to surprise you is going to be.

350
00:24:52,500 --> 00:24:54,920
And I'm saying something different.

351
00:24:55,460 --> 00:24:58,920
The problems are out there and we know about them for many years now.

352
00:24:59,640 --> 00:25:01,060
Many years.

353
00:25:01,520 --> 00:25:02,860
Let's take for example spam.

354
00:25:02,860 --> 00:25:05,080
Are you interested in my talk at all?

355
00:25:05,080 --> 00:25:05,780
I am.

356
00:25:05,780 --> 00:25:06,540
You are?

357
00:25:07,040 --> 00:25:08,540
I believe you.

358
00:25:08,540 --> 00:25:11,560
Okay, David fucking Kaminski everybody.

359
00:25:13,380 --> 00:25:16,200
Not drunk for the first time on video.

360
00:25:19,320 --> 00:25:19,820
Now...

361
00:25:23,080 --> 00:25:23,960
Yeah.

362
00:25:24,780 --> 00:25:27,200
I'm trying to remember what the fuck I was talking about.

363
00:25:27,300 --> 00:25:28,180
Predictions.

364
00:25:28,820 --> 00:25:30,400
Thank you, bitch.

365
00:25:33,100 --> 00:25:34,600
I love this guy.

366
00:25:35,940 --> 00:25:39,660
But he gave me such hell when I asked him to come and help me in my lecture.

367
00:25:41,040 --> 00:25:43,160
Yeah, but I don't need you now.

368
00:25:44,320 --> 00:25:46,580
Yeah, I'm going to talk now.

369
00:25:52,270 --> 00:25:54,490
Yeah, I'll tell you about the superbugs in a minute.

370
00:25:56,130 --> 00:25:57,830
I'm still wasting time.

371
00:26:00,570 --> 00:26:01,910
What was I talking about?

372
00:26:01,910 --> 00:26:02,490
No, seriously.

373
00:26:03,110 --> 00:26:03,710
Predictions.

374
00:26:04,010 --> 00:26:07,950
So basically, the problems have been around for many, many years now.

375
00:26:07,950 --> 00:26:09,270
Let's take spam as an example.

376
00:26:09,270 --> 00:26:11,310
Yes, tell them we love them.

377
00:26:12,390 --> 00:26:14,130
I want that phone later on.

378
00:26:14,210 --> 00:26:15,210
It's mine now.

379
00:26:16,290 --> 00:26:18,470
The problems of the internet have been around for many years now.

380
00:26:18,470 --> 00:26:19,470
Let's take spam.

381
00:26:19,470 --> 00:26:21,990
I'm going to completely ruin the history of spam.

382
00:26:21,990 --> 00:26:26,910
In the last lecture I met, there was a guy from SpamHouse here and he wanted to kill me, but it's cool.

383
00:26:28,330 --> 00:26:30,750
First, we didn't really care about spam.

384
00:26:30,750 --> 00:26:31,490
Seriously.

385
00:26:32,350 --> 00:26:39,130
It's just some emails you get eventually, here and there, once a day, and you found a good solution for it too.

386
00:26:39,230 --> 00:26:39,810
JHD.

387
00:26:39,810 --> 00:26:40,910
Just hit delete.

388
00:26:41,130 --> 00:26:42,090
And it worked.

389
00:26:42,370 --> 00:26:46,350
And then it got a little bit more annoying as somebody started working on it, but nobody really cared.

390
00:26:46,670 --> 00:26:51,250
Nobody wanted to put the money into it to get rid of the business, or at least try to.

391
00:26:51,570 --> 00:26:53,370
And then it got to be a problem.

392
00:26:53,590 --> 00:26:55,850
Then everybody started caring about it.

393
00:26:57,750 --> 00:26:59,830
And then I started finding solutions.

394
00:27:00,590 --> 00:27:06,710
And like any human society, anywhere, they said, I have to be elected into office.

395
00:27:06,710 --> 00:27:11,070
I mean, this is not really it, but seriously, long-term solutions are not part of the business here.

396
00:27:11,230 --> 00:27:12,630
It's part of our culture.

397
00:27:12,630 --> 00:27:15,950
We have to kill this fire called spam right now.

398
00:27:17,430 --> 00:27:22,930
So we will invest some money, and come up with a solution that will kill the fire right now.

399
00:27:23,110 --> 00:27:29,070
That solution was, for example, Bayesian filters, or F-ass Bayesian filters.

400
00:27:29,410 --> 00:27:39,850
And if we see, for example, Viagra in one instead of an I, all these evasion techniques that bad guys came up with, that's cool.

401
00:27:40,130 --> 00:27:46,310
I mean, seriously, use some F-ass Bayesian filters that bad guys learned and started using one instead of I.

402
00:27:46,910 --> 00:27:48,950
Then I started using mail relays.

403
00:27:50,010 --> 00:27:52,850
Again, it could have been the other way, but I don't really care right now.

404
00:27:52,850 --> 00:27:55,730
And we started using blacklists, like maps.

405
00:27:57,070 --> 00:28:00,950
And then I started using zombies, and they can email from all over the world.

406
00:28:01,350 --> 00:28:11,050
Anytime we actually kill the fire right now, get rid of this problem right now, what we actually accomplished was, hey, we are teaching the bad guys.

407
00:28:11,050 --> 00:28:13,290
We are educating them.

408
00:28:13,870 --> 00:28:17,330
We are throwing them into an evolutionary route that we are not choosing.

409
00:28:17,330 --> 00:28:18,930
We are making things worse.

410
00:28:19,310 --> 00:28:21,290
And I can tell you it's the same with botnets.

411
00:28:21,330 --> 00:28:25,150
It's the same everywhere, and that's what brings me to the superbugs theory.

412
00:28:25,930 --> 00:28:27,710
Now, superbugs is not a new theory.

413
00:28:27,710 --> 00:28:30,390
I mean, doctors really liked antibiotics.

414
00:28:31,350 --> 00:28:32,490
You had a flu?

415
00:28:32,830 --> 00:28:34,550
The flu, they gave you antibiotics.

416
00:28:34,670 --> 00:28:35,670
You had a cold?

417
00:28:36,050 --> 00:28:37,550
They gave you antibiotics.

418
00:28:38,270 --> 00:28:40,570
And what they actually did was create some sort of

419
00:28:46,870 --> 00:28:50,630
stronger bugs that could resist antibiotics.

420
00:28:51,110 --> 00:28:52,810
And they kept doing it.

421
00:28:53,790 --> 00:28:56,070
And that brings me back to monoculture.

422
00:28:56,070 --> 00:28:57,330
Everything is windows.

423
00:28:58,290 --> 00:29:05,250
And we keep just ignoring the problems that are out there for years, and I can give you a list of problems and I'll get to that in a second.

424
00:29:05,250 --> 00:29:07,010
And I've been out there and it's getting worse.

425
00:29:07,010 --> 00:29:09,650
And eventually they get so bad that we have to kill them right now.

426
00:29:09,650 --> 00:29:17,110
And every time we do something like that, no matter if it's terrorism, no matter if it's botnets, no matter if it's spam, we just kill the problem right now.

427
00:29:17,370 --> 00:29:19,650
I'm repeating myself, I know, but it's important to me.

428
00:29:19,950 --> 00:29:21,010
And make it worse.

429
00:29:21,010 --> 00:29:22,270
Educate the bad guy.

430
00:29:23,650 --> 00:29:27,430
So the superbugs theory is where I wanted to get to.

431
00:29:27,770 --> 00:29:30,010
And that's why botnets are not really the problem now.

432
00:29:30,910 --> 00:29:32,210
Who is the enemy?

433
00:29:32,590 --> 00:29:37,690
I keep speaking of there are bad guys out there.

434
00:29:37,690 --> 00:29:39,810
FUD, I'm not giving any facts.

435
00:29:40,030 --> 00:29:45,290
Well, it used to be a rival or an opponent really, not really an enemy.

436
00:29:45,530 --> 00:29:48,930
Because, I'll give you an example from the dynamic DNS providers.

437
00:29:49,950 --> 00:29:53,990
Dynamic DNS providers are really, really good for the bad guys.

438
00:29:54,670 --> 00:29:58,050
They can run botnets using DNS really easily.

439
00:29:58,130 --> 00:30:01,430
They tell all the bad bots, connect that address.

440
00:30:01,810 --> 00:30:15,110
Then when somebody kills the server, because that's how you deal with the botnet, you kill the command and control server which is bad, because then the bad guy just moves up to another server and starts investigating and educating themselves and getting to be better at it.

441
00:30:15,110 --> 00:30:16,470
Again, superbugs.

442
00:30:17,310 --> 00:30:21,410
But basically, when dynamic DNS providers are perfect for them.

443
00:30:21,410 --> 00:30:33,330
They go online, they open a new account, they get some free DNS free domains, free whatever, and just point the botnet over there.

444
00:30:33,870 --> 00:30:35,670
That's basically how it works.

445
00:30:35,950 --> 00:30:40,750
The dynamic DNS providers really suffer.

446
00:30:41,530 --> 00:30:51,730
Because imagine 100,000 bots, and bots are not very nice internet users losers.

447
00:30:51,730 --> 00:30:53,870
They just keep asking the same question.

448
00:30:53,870 --> 00:30:55,190
How do I connect over there?

449
00:30:55,190 --> 00:30:56,950
Where is that A record?

450
00:30:57,850 --> 00:31:01,270
And they really weigh down on the dynamic DNS providers.

451
00:31:01,530 --> 00:31:06,770
The dynamic DNS provider says, okay, this is the botnet, it's in breach of my acceptable use policy.

452
00:31:07,430 --> 00:31:12,490
I will map this botnet address to 1918 addresses, localhost, whatever.

453
00:31:12,970 --> 00:31:17,370
And that's acceptable to the bad guy, because it says, hey, I abused the service, but I need it again.

454
00:31:17,390 --> 00:31:21,910
They found me out, I'll just use it again, re-register.

455
00:31:22,130 --> 00:31:24,830
Now what if the dynamic DNS provider says, I'm sick of it.

456
00:31:24,830 --> 00:31:33,370
I mean, so far they've been contesting for the same resources, they live in the same realm, but don't really come to combat, open combat.

457
00:31:33,430 --> 00:31:37,490
But what if the dynamic DNS provider says, I'll sinkhole the botnet.

458
00:31:37,630 --> 00:31:40,910
I'll kill the botnet, I'll take the botnet away from the bad guy.

459
00:31:41,070 --> 00:31:42,650
The bad guy gets pissed.

460
00:31:43,210 --> 00:31:44,510
And then it's open warfare.

461
00:31:44,910 --> 00:31:48,810
You will DDoS the dynamic DNS provider to hell, and that makes it an enemy.

462
00:31:49,490 --> 00:31:56,390
And why I wanted to stick to this point for a minute, which is not really related to the lecture, is because this is an enemy to the infrastructure.

463
00:31:56,390 --> 00:32:05,930
And when I try to think about who the hell owns the internet, and I'm not talking about owning the internet as in who runs the internet, but who are the stakeholders?

464
00:32:06,630 --> 00:32:09,510
Seriously, who cares if the infrastructure survives?

465
00:32:10,210 --> 00:32:18,250
And I try a lot, and I can't really find the people yet, but the infrastructure is at a serious risk.

466
00:32:18,610 --> 00:32:22,490
I don't care if somebody is a black hat, if somebody is a white hat, if somebody is a grey hat.

467
00:32:22,970 --> 00:32:26,770
Whatever you do at home, whatever you have fun with, that's cool.

468
00:32:27,870 --> 00:32:41,370
But when you go out and take money from Granny Jane, or when you go out and try to DDoS the internet to hell, you're not a nice netizen, and over more, you're pretty much, you're not a black hat, you're an idiot.

469
00:32:42,570 --> 00:32:47,350
And your idiocy is pretty much what's going to cause the internet to go to hell.

470
00:32:47,630 --> 00:32:48,970
And that's FUD.

471
00:32:48,970 --> 00:32:51,730
That's fear, uncertainty, and doubt.

472
00:32:52,010 --> 00:32:54,710
And I didn't want to say that until I could give you some facts.

473
00:32:57,030 --> 00:32:59,190
What do we do about it today?

474
00:33:06,330 --> 00:33:10,770
It could be tens of thousands of dollars a week, it could be millions, it depends on who you are.

475
00:33:18,980 --> 00:33:24,760
The question was, why are you relying on DynDNS for something that is critical to your infrastructure when you make millions?

476
00:33:24,780 --> 00:33:32,920
You don't rely only on DynDNS, but I don't have time to cover it right now, but just think about why do botnets use IRC?

477
00:33:33,660 --> 00:33:35,600
Seriously, why use IRC?

478
00:33:35,680 --> 00:33:37,160
It's perfect for them.

479
00:33:38,060 --> 00:33:45,540
I mean, I don't have time to cover it because this is not a botnet lecture right now, but something does not have to be extremely complicated to be good.

480
00:33:47,810 --> 00:33:50,710
Although, damn, fucking Kaminsky is not drunk to answer that.

481
00:33:52,130 --> 00:33:54,010
Ignore everything I just said, please.

482
00:33:54,010 --> 00:34:02,930
There needs to be legitimate services that are using that particular host that it would be a problem if you just killed it entirely.

483
00:34:02,930 --> 00:34:11,870
If you go ahead and you put a colo somewhere and it's the CNC and it's the DNS and so on, pull the plug on it and you've just killed illegitimate services.

484
00:34:11,870 --> 00:34:18,070
The idea is to mix the illegitimate botnet with the legitimate dynamic DNS and that's why they do it.

485
00:34:18,330 --> 00:34:19,210
Amen to that.

486
00:34:19,210 --> 00:34:20,270
Next issue.

487
00:34:20,270 --> 00:34:21,910
And thank you to Dan Kaminsky.

488
00:34:21,910 --> 00:34:22,950
He's not drunk.

489
00:34:22,950 --> 00:34:24,610
I'm sorry, Dan fucking Kaminsky.

490
00:34:25,330 --> 00:34:27,350
He calls me God, he fucking Ron.

491
00:34:27,350 --> 00:34:30,740
Come on.

492
00:34:31,160 --> 00:34:32,760
Hold on, we'll get to that.

493
00:34:34,500 --> 00:34:38,100
Now, what do we actually do about it today?

494
00:34:39,700 --> 00:34:41,520
First of all, there are vendors.

495
00:34:41,860 --> 00:34:46,940
Anti-virus vendors, anti-spam vendors, let's even say ISPs.

496
00:34:47,360 --> 00:34:47,980
Vendors.

497
00:34:47,980 --> 00:34:50,300
A lot of vendors who try to give you solutions.

498
00:34:50,660 --> 00:34:53,940
Then there are more vendors who try to sell you stuff.

499
00:34:53,940 --> 00:34:55,360
Some of them do good shit.

500
00:34:55,360 --> 00:34:59,440
Seriously, there are companies such as Message Labs, Maps, Spam House.

501
00:34:59,440 --> 00:35:01,940
Companies that really do good for the internet.

502
00:35:02,000 --> 00:35:03,200
They're still vendors.

503
00:35:03,780 --> 00:35:08,780
And they look at their small way of making money and if they can do good with it, that's cool.

504
00:35:09,120 --> 00:35:10,720
Then we have research funds.

505
00:35:10,760 --> 00:35:15,820
Research in general such as the NSF, Army, Navy, DARPA, whatever.

506
00:35:16,700 --> 00:35:18,700
Then there is symptom-based response.

507
00:35:18,700 --> 00:35:21,220
For example, hand-spam.

508
00:35:21,780 --> 00:35:28,500
The FTC recently came up with something that they claim will report to every ISP.

509
00:35:28,980 --> 00:35:31,180
It will report to ISP the bots.

510
00:35:31,180 --> 00:35:33,560
Again, the bots are not the problem as far as I'm concerned.

511
00:35:33,980 --> 00:35:37,860
And any infected machine will have 10 more bots on it, at least.

512
00:35:38,800 --> 00:35:40,500
The botnets are the problem.

513
00:35:40,500 --> 00:35:42,800
But say they will report the bots.

514
00:35:43,700 --> 00:35:49,680
So what they do is look at emails, spam emails, and find the zombies that send them.

515
00:35:49,760 --> 00:35:55,320
Now, out of all the numbers of all the drones and bots out there, how many of them send spam?

516
00:35:56,360 --> 00:36:03,180
A lot, but not quite that many from the whole of the entire botnet population.

517
00:36:03,760 --> 00:36:06,020
Now here I have to discuss the botnet population.

518
00:36:06,020 --> 00:36:07,760
How many bots are actually out there?

519
00:36:08,160 --> 00:36:10,520
Because that's what people keep asking me.

520
00:36:10,960 --> 00:36:11,960
So I'll make this quick.

521
00:36:11,960 --> 00:36:13,460
I don't really give a shit.

522
00:36:13,580 --> 00:36:20,280
As I said, if you can destroy the world a thousand times over, why the hell would you care if you can do it just once?

523
00:36:21,080 --> 00:36:22,800
And that's what botnets are.

524
00:36:22,800 --> 00:36:30,240
But if I have to answer the question, I'll discuss research that has been happening unrelated for quite some time now.

525
00:36:31,540 --> 00:36:38,900
How often, or how soon, when you start scanning the internet when you put the machine on the internet, will it get scanned?

526
00:36:39,440 --> 00:36:45,080
A few years ago, to put the machine on the internet, it got scanned 36 hours after that.

527
00:36:45,620 --> 00:36:53,480
A couple of years ago, I checked, and depending on the ISP I checked on, I got scanned once every two seconds to once every 20 minutes.

528
00:36:54,100 --> 00:36:58,880
Kevin Mitnick, I believe, made some check and got around the same conclusions.

529
00:36:58,980 --> 00:37:03,160
On the site in SANS, internet survivability time is about 20 minutes or something like that.

530
00:37:03,160 --> 00:37:05,040
It keeps coming up and down.

531
00:37:05,420 --> 00:37:09,540
So basically, say it's not every two seconds like in my house.

532
00:37:09,760 --> 00:37:20,980
Say you actually get scanned for the easy vulnerabilities automatically by viruses, worms, whatever you want to call them right now, hacking tools, every 20 minutes once.

533
00:37:21,940 --> 00:37:31,720
Now, on broadband providers, out of all their clients, how many would be easily exploitable?

534
00:37:33,000 --> 00:37:51,040
Now, when you get to the potential population of that, and how many bots you can get installed on one machine, because basically I count the bots as how many samples are installed or working on each machine per IP address per machine, you get a huge number.

535
00:37:52,740 --> 00:38:00,300
Now, if you wanted to count it in another way, say you sync all the botnets, and that's not my research, that's somebody else's.

536
00:38:00,400 --> 00:38:19,600
Say you found botnets and you followed them, and you checked and saw that several botnets have the same IP addresses coming back again, there are time of day issues, DHCP issues, sometimes you see a Linux machine and then it's a Windows machine, but you actually see IP addresses returning.

537
00:38:19,880 --> 00:38:27,900
If you take that cut between the different groups, you may try and get to the point where you see the entire omega.

538
00:38:27,900 --> 00:38:30,700
This is David Duggan's research at Georgia Tech.

539
00:38:32,500 --> 00:38:38,560
He says, by the limited research he has done, he has seen about 20 million bots.

540
00:38:40,020 --> 00:38:41,260
That's nothing.

541
00:38:42,120 --> 00:38:46,360
If I had to give a number or just say 40 million, but that's nothing, people.

542
00:38:46,960 --> 00:38:47,920
Seriously.

543
00:38:48,080 --> 00:38:51,660
And why would I care about the number?

544
00:38:53,680 --> 00:39:02,000
Now, sorry, I had to give a terrible response to this if I didn't explain myself correctly, because it's critical.

545
00:39:02,560 --> 00:39:13,280
Now, another issue, and symptom-based response for the FTC came up with this issue and said, we'll report bots to the ISPs, not botnets bots, and they're reporting spam bots.

546
00:39:13,280 --> 00:39:17,320
They're reporting a symptom of the symptom, which is the zombies that send out spam.

547
00:39:18,200 --> 00:39:18,780
Great.

548
00:39:19,200 --> 00:39:21,420
A for effort, that's about it.

549
00:39:21,420 --> 00:39:23,420
I'm glad they're doing it, but it's nothing.

550
00:39:24,800 --> 00:39:25,880
Shoot the customer.

551
00:39:26,300 --> 00:39:27,120
I really like that.

552
00:39:27,120 --> 00:39:29,100
I want to shoot the customer, seriously.

553
00:39:29,100 --> 00:39:34,440
Blocking port 25 is one of the best things out there that can be done to stop spam.

554
00:39:34,640 --> 00:39:51,280
I hope Larry from Spamels will be here again to explain that, but basically lots of end-to-end, blocking port 25, blocking all these ports, no matter why now, if it's a good or bad idea, you're shooting the customer.

555
00:39:52,700 --> 00:39:54,460
That's how ISPs are dealing with it.

556
00:39:54,460 --> 00:39:55,820
I'm not saying it's bad, I'm not saying it's good.

557
00:39:55,820 --> 00:39:56,960
I actually like it.

558
00:39:56,960 --> 00:39:59,080
But it's shooting the customer.

559
00:39:59,340 --> 00:40:01,100
That's how we deal with it currently.

560
00:40:02,200 --> 00:40:03,320
Now to business.

561
00:40:03,320 --> 00:40:03,960
Why DA?

562
00:40:03,960 --> 00:40:06,580
And as we said, DA is a mailing list.

563
00:40:07,460 --> 00:40:10,620
Well, it gives community and industry involvement, basically.

564
00:40:10,620 --> 00:40:13,040
I'll discuss what it is exactly as I go.

565
00:40:13,860 --> 00:40:21,540
You see the anti-virus industry, academia, dynamic DNS providers, law enforcement, ISPs.

566
00:40:22,100 --> 00:40:29,220
There are other groups out there that work on the problem, and I'll discuss them in a minute, but none of them have the scope.

567
00:40:29,600 --> 00:40:31,320
I'll continue in a second.

568
00:40:31,700 --> 00:40:33,600
Long-term study and research.

569
00:40:33,760 --> 00:40:35,500
Killing viruses is bad.

570
00:40:36,200 --> 00:40:38,220
Guacamole was bad.

571
00:40:38,220 --> 00:40:47,700
Today when you actually kill a button, it not just jumps to the next IP address, the next compromised host, they actually learn from it, they become better at what they do.

572
00:40:47,700 --> 00:40:48,920
It's bad for us.

573
00:40:48,960 --> 00:40:51,680
Long-term research and study is critical.

574
00:40:51,800 --> 00:40:53,660
R&D, ways and means.

575
00:40:53,660 --> 00:40:55,240
Finding new solutions.

576
00:40:55,380 --> 00:41:00,360
Following technological operational evolution by the other side.

577
00:41:00,660 --> 00:41:03,560
Doing all that and still maintaining the vetting.

578
00:41:03,820 --> 00:41:06,900
And vetting does not mean secret entry club where nobody can enter.

579
00:41:06,900 --> 00:41:11,700
Hey, I'm lecturing in DEF CON for very few people, but still, lecture in DEF CON.

580
00:41:12,260 --> 00:41:18,360
The point is getting as many people involved as possible who care about the infrastructure and actually having the internet around.

581
00:41:20,080 --> 00:41:22,560
Now, this is not easy, but it's critical.

582
00:41:23,780 --> 00:41:25,700
Now, what does that mean?

583
00:41:26,040 --> 00:41:29,760
What can we do that a closed group of ISPs can't?

584
00:41:29,900 --> 00:41:31,940
Or a closed group of antivirus gods can't?

585
00:41:32,120 --> 00:41:38,760
Antiviruses care about signatures, libraries, which is great, that's their business plan, model, whatever.

586
00:41:39,000 --> 00:41:44,060
ISPs care to get their networks back online without problems, maintaining their networks.

587
00:41:44,060 --> 00:41:45,420
So they kill botnets.

588
00:41:45,700 --> 00:41:46,840
What do we do?

589
00:41:46,840 --> 00:41:48,740
First of all, we can do traceback.

590
00:41:49,240 --> 00:41:52,640
Tracking down the botnet, authors, controllers, whatever.

591
00:41:53,000 --> 00:41:55,680
Creating an intelligence database on who they are.

592
00:41:56,880 --> 00:41:59,720
Actionable intelligence, law enforcement cooperation.

593
00:42:00,120 --> 00:42:01,960
Get the intelligence, give it to law enforcement.

594
00:42:01,960 --> 00:42:03,660
Law enforcement does not care.

595
00:42:04,220 --> 00:42:05,180
What do I mean by that?

596
00:42:05,180 --> 00:42:06,880
I don't give a shit.

597
00:42:07,580 --> 00:42:09,080
And not because they're bad people.

598
00:42:09,940 --> 00:42:11,160
Actually, it's the opposite.

599
00:42:11,160 --> 00:42:12,740
Law enforcement cares.

600
00:42:13,220 --> 00:42:14,860
They can't do squat.

601
00:42:15,940 --> 00:42:21,640
We see a very large increase in their caring in the recent year, especially.

602
00:42:21,800 --> 00:42:28,700
They want to do good, but they care a lot more about the murderers out there, as they should.

603
00:42:28,800 --> 00:42:32,780
They do not have the resources to invest in this.

604
00:42:33,380 --> 00:42:34,760
Plain and simple.

605
00:42:35,680 --> 00:42:38,780
And it's not really their fault, it's policy.

606
00:42:39,380 --> 00:42:42,680
Policy from upstairs that dictates this.

607
00:42:43,140 --> 00:42:49,400
And I can tell you we have somebody who actually knows from his hard work who the bagel author is.

608
00:42:49,960 --> 00:42:52,900
And he gave them information, he gave them pictures of the guy.

609
00:42:54,080 --> 00:42:56,040
And they didn't do squat.

610
00:42:56,120 --> 00:42:56,960
Shit.

611
00:42:56,960 --> 00:42:57,720
Nothing.

612
00:43:00,480 --> 00:43:06,160
Again, I love the guys in law enforcement, and they're trying, but they can't because their hands are tied.

613
00:43:06,660 --> 00:43:08,300
So we can't count on them.

614
00:43:08,700 --> 00:43:10,300
Sorry, but that's the way it is.

615
00:43:10,880 --> 00:43:20,640
Now, reverse engineering, working actually on the samples rather than just the networks, IDSs, flows, whatever, shows us where they are technologically, what they can do.

616
00:43:21,320 --> 00:43:24,920
We can find the botnets better, we can see what they're doing, it's cool.

617
00:43:26,000 --> 00:43:27,380
Financial trace back.

618
00:43:27,380 --> 00:43:34,860
If you work with law enforcement or the financial industry, you see phishing, you can actually trace back from all ways.

619
00:43:34,920 --> 00:43:38,660
Not just on the network, not just on the sample level, financial trace back.

620
00:43:38,660 --> 00:43:40,080
See where the money is going.

621
00:43:40,080 --> 00:43:44,420
Which is basically the only thing the Fed knew how to do with phishing until very recently.

622
00:43:45,560 --> 00:43:46,400
Cooperation.

623
00:43:46,400 --> 00:43:50,620
That's the critical part, and that's where I was going with this lecture, basically.

624
00:43:51,060 --> 00:43:55,520
Working together to see the big picture, because everybody is an expert.

625
00:43:57,480 --> 00:44:01,580
But nobody, except if you work together, can see the macro level image.

626
00:44:01,580 --> 00:44:09,240
I mean, seriously, we'll talk about Casey in a minute, but she says, for example, the research community is looking for ideas on what to research.

627
00:44:09,460 --> 00:44:12,820
The industry needs solutions, and nobody is talking to one another.

628
00:44:14,340 --> 00:44:22,120
Now, DA and DA related projects, again, DA is a mailing list, because we had to start somewhere, and that's where we started.

629
00:44:22,480 --> 00:44:29,500
Carsnet, that's David Dagan from GA Tech, he does amazing work to study botnets, and he can't find funding.

630
00:44:30,580 --> 00:44:33,500
The bad guys have millions, and he can't find funding.

631
00:44:34,140 --> 00:44:43,140
But, that's a database, basically, for us to follow everything, gather information, pretty cool.

632
00:44:43,760 --> 00:44:48,280
Snort for ISPs, rather dead project right now, but we're working on it.

633
00:44:48,680 --> 00:44:51,980
Getting signatures out to detect botnets easier.

634
00:44:52,340 --> 00:44:53,840
Botnets, not bots.

635
00:44:54,640 --> 00:44:59,920
Passive DNS replication is critical, I do not have time to talk about it, I'm sorry, but it's critical.

636
00:45:00,040 --> 00:45:01,680
If you want, Google it.

637
00:45:02,740 --> 00:45:06,140
AS-based reporting, getting the reports out to ISPs.

638
00:45:07,080 --> 00:45:10,000
Monthly shaming, some ISPs do not give a shit.

639
00:45:10,440 --> 00:45:16,400
We need to shame them, and we are actually managing to change the map of the internet every month.

640
00:45:17,000 --> 00:45:24,480
Basically, it's, okay, we managed to get that ISP to work with us, which means, okay, the botnet controls are going to run to another ISP now.

641
00:45:24,700 --> 00:45:27,700
But we change the map, every month.

642
00:45:27,840 --> 00:45:32,260
Some ISPs don't give a shit, we're not sure how to handle that yet.

643
00:45:32,260 --> 00:45:35,580
There's some parts of the world we can't reach, but we're working on it.

644
00:45:35,580 --> 00:45:37,020
And I'll get to that in a second.

645
00:45:37,600 --> 00:45:38,680
Then there's Granix.

646
00:45:38,680 --> 00:45:41,660
You'll hear about that in the future, I'm not going to talk about it.

647
00:45:43,940 --> 00:45:47,000
Drone armies, at least I think so, I have no idea.

648
00:45:48,060 --> 00:45:52,280
I call it Dumbledore's army, I'm not sure if there are any Harry Potter fans here.

649
00:45:52,900 --> 00:45:53,460
No?

650
00:45:54,140 --> 00:45:55,520
You guys suck.

651
00:45:56,100 --> 00:45:58,420
Now, MWP is another mailing list.

652
00:45:58,420 --> 00:46:00,700
We had a lot of off-topic posts.

653
00:46:01,640 --> 00:46:07,540
There's nearly no noise, only signal on the mailing list until I decide, okay, this is too much signal and I just send some shit in.

654
00:46:07,960 --> 00:46:10,780
But it's a community, it's not completely operational.

655
00:46:10,940 --> 00:46:12,700
There are other lists that are operational.

656
00:46:15,280 --> 00:46:16,840
Spammed malware sites.

657
00:46:17,440 --> 00:46:21,480
You spam it via email, it's malware, we'll take it down.

658
00:46:22,520 --> 00:46:28,000
Captures, okay, there are many other companies that see these files online, we'll find them and we'll take them down.

659
00:46:28,000 --> 00:46:31,780
Now, I'm not supposed to say kill the site, but that's what we do.

660
00:46:31,780 --> 00:46:54,380
We do it legally, which means in lawyer talk I would have preferred to say something like we find the data, collect it, give it to the respectable authority to review and investigate and validate or whatever themselves, and then proceed according to their acceptable legal policy or whatever.

661
00:46:54,500 --> 00:46:56,040
Basically we kill the sites.

662
00:46:56,040 --> 00:46:58,440
Now, worm propagation sites take it down.

663
00:46:58,440 --> 00:47:06,260
For example, if there is a worm and you download samples, updates, whatever from some site, we'll take it down, we'll stop the worm from spreading.

664
00:47:07,160 --> 00:47:08,280
Phishing sites take it down.

665
00:47:08,280 --> 00:47:14,080
We don't do that anymore right now, I'll explain why later, but we still follow it very, very closely.

666
00:47:14,860 --> 00:47:17,860
Global law enforcement coordination and tracking of phishing groups.

667
00:47:18,340 --> 00:47:26,580
Law enforcement can work together very good, they have their own ways to communicate, but they suck on the small things.

668
00:47:26,720 --> 00:47:27,600
Seriously.

669
00:47:28,180 --> 00:47:41,560
And we have managed by giving them the actionable intelligence that they don't have, we managed to get several law enforcement agencies around the world working on taking these guys down, because they make money.

670
00:47:41,760 --> 00:47:50,400
And the only way that we can stop them from moving their botnet or their phishing or whatever to just another server is by changing their economics and make it not worth their while.

671
00:47:51,080 --> 00:47:52,460
That's basically it.

672
00:47:52,460 --> 00:47:54,380
And phishing on the net.

673
00:47:54,800 --> 00:48:12,970
We want to gather all these phishers, companies such as MessageLabs, Panels, all these guys, send us the phishers, we'll report them to ISPs, we'll get the shelf life of a phishing server down to two hours instead of six days.

674
00:48:13,370 --> 00:48:14,690
Ask Dan later.

675
00:48:14,690 --> 00:48:16,350
Sorry, I got five minutes.

676
00:48:17,150 --> 00:48:18,650
I'm serious, I'm sorry.

677
00:48:19,870 --> 00:48:21,290
Other projects.

678
00:48:21,350 --> 00:48:26,970
There are other lists out there, other projects, for example, NSP Sec for ISPs to work, you can Google it.

679
00:48:27,210 --> 00:48:32,070
The Aninet project, they don't want to work with law enforcement, they're pure researchers.

680
00:48:32,890 --> 00:48:36,850
APWG, Anti-Phishing Working Groups in the United States and Apex in the UK.

681
00:48:37,070 --> 00:48:45,070
UNISOC, Digital Finish Net, which is the FBI, which is just now starting to get some things done, they basically suck so far, I have high hopes.

682
00:48:45,470 --> 00:48:46,350
Microsoft.

683
00:48:46,450 --> 00:48:49,730
People, Microsoft is doing a lot.

684
00:48:50,450 --> 00:48:58,530
I believe their motives are more like, we want to prove to everyone we do good security, and we want to fucking take over the industry.

685
00:48:59,030 --> 00:49:08,870
That's what I believe their motives are, they're hiring a lot of people, but whatever their motives are, they're not really hiding as far as I see it.

686
00:49:08,870 --> 00:49:10,210
They do a lot of good.

687
00:49:10,850 --> 00:49:12,610
They actually do something.

688
00:49:13,790 --> 00:49:21,690
Now as far as I see it, the stakeholders so far I've been able to find... I'll get to Casey first, I'm sorry.

689
00:49:23,910 --> 00:49:24,790
Internet Governance.

690
00:49:24,790 --> 00:49:26,690
You might have heard Paul Vix's lecture.

691
00:49:27,890 --> 00:49:36,690
It's a lot of shit and crap and whatever, and the point is, we can go lower than that, it's trust.

692
00:49:36,690 --> 00:49:42,370
For example, nothing prevents me from going to dine right now with a 5 kilo hammer, or kick him in the nuts, or kill him, basically.

693
00:49:43,370 --> 00:49:45,090
In real life...

694
00:49:45,090 --> 00:49:49,530
Okay, Dan, my glock is at home.

695
00:49:49,870 --> 00:49:52,430
No, seriously, you guys are watching me.

696
00:49:52,850 --> 00:49:54,750
There are laws, there is fear.

697
00:49:54,750 --> 00:49:59,050
I don't know what's stopping me from doing that right now, but that's meatspace.

698
00:49:59,230 --> 00:50:02,510
On the internet, nothing stops me from doing that.

699
00:50:02,570 --> 00:50:06,410
For example, when people threaten sites for takedown.

700
00:50:06,450 --> 00:50:09,010
Pay me 10k right now, I'll take you down.

701
00:50:09,370 --> 00:50:17,230
In real life, especially in the States as far as I understand it, from movies in Hollywood, protection money is really good.

702
00:50:17,570 --> 00:50:18,850
Works really good.

703
00:50:20,830 --> 00:50:27,070
Somebody might come to you and say, look, you pay me right now, or I'll burn down your store, set it on fire.

704
00:50:27,850 --> 00:50:29,350
And you might pay him.

705
00:50:29,690 --> 00:50:31,650
Or he'll set your store on fire.

706
00:50:32,110 --> 00:50:36,910
Now once you've paid, it is likely that the guy won't set your store on fire.

707
00:50:37,270 --> 00:50:43,170
Further, if anybody else comes to you and says, hey, pay me or I'll set your store on fire, this guy will protect you.

708
00:50:43,650 --> 00:50:49,190
On the internet, they say, okay, pay me 10k right now, I'll set your store on fire.

709
00:50:51,710 --> 00:50:53,390
How do you know he won't?

710
00:50:53,410 --> 00:50:56,610
First off, it's the internet.

711
00:50:57,570 --> 00:51:00,750
Second, he can't stop anybody else from doing it anyway.

712
00:51:01,690 --> 00:51:09,470
And the point is, if I meet somebody online, say from Korea or Japan, he doesn't know me, I don't know him, why would he trust me?

713
00:51:09,470 --> 00:51:10,990
Why would she trust me?

714
00:51:11,310 --> 00:51:12,290
No reason.

715
00:51:13,470 --> 00:51:16,070
They may be the bad guy that's trying to trick me down.

716
00:51:16,070 --> 00:51:17,790
Would I share information with them?

717
00:51:18,170 --> 00:51:21,950
The bad guys are sharing information, making money, everything.

718
00:51:22,290 --> 00:51:24,170
We do not share information.

719
00:51:25,230 --> 00:51:27,030
We do not get things done.

720
00:51:27,070 --> 00:51:33,490
Now, if we don't get a way to cooperate and get things done, somebody else will find a way to do it for us.

721
00:51:33,950 --> 00:51:38,330
According to Casey again, I'm misrepresenting your ideas, that's to be clear.

722
00:51:38,330 --> 00:51:50,090
But as far as I understand their ideas, every network in the world ever built, whether it's communication network, transportation network, whatever, somebody came and made some order.

723
00:51:50,090 --> 00:51:53,050
That somebody was usually or always the government.

724
00:51:53,090 --> 00:51:58,990
Do we want the government, your government, my government, to come in and try and make the internet fall in place?

725
00:51:59,570 --> 00:52:02,490
They're already trying, especially in Canada and Australia, as far as I can see.

726
00:52:02,490 --> 00:52:04,030
Here in the States, everywhere.

727
00:52:04,430 --> 00:52:05,430
I doubt they'll succeed.

728
00:52:05,430 --> 00:52:09,130
What I see, basically, I'm not worried as Casey is.

729
00:52:09,250 --> 00:52:13,030
I believe it will either be Microsoft or the Russian mob.

730
00:52:13,430 --> 00:52:16,610
Now, you can quote me, God, he said the Russian mob and Microsoft, whoo!

731
00:52:16,610 --> 00:52:21,290
But seriously, these are the stakeholders right now.

732
00:52:21,290 --> 00:52:22,490
They make money.

733
00:52:25,150 --> 00:52:27,090
Microsoft and the Russian mob.

734
00:52:28,310 --> 00:52:29,470
Which one do I prefer?

735
00:52:29,470 --> 00:52:30,110
Exactly!

736
00:52:30,110 --> 00:52:32,130
Thank you for asking that question.

737
00:52:32,130 --> 00:52:33,190
Now, I love Microsoft.

738
00:52:33,190 --> 00:52:35,210
Seriously, they're doing a good job out there.

739
00:52:36,230 --> 00:52:37,770
I don't know why they care.

740
00:52:37,770 --> 00:52:40,790
They may have their own ideas, but they're doing a good job.

741
00:52:41,110 --> 00:52:42,370
They're the only ones.

742
00:52:44,250 --> 00:52:48,090
Now, cooperation, trust, just getting things done.

743
00:52:49,990 --> 00:52:50,790
Basically.

744
00:52:51,830 --> 00:52:53,730
We need to solve these problems.

745
00:52:55,310 --> 00:53:00,810
And usually, like I said last time, I would have expected a full hole when I said, get involved, people!

746
00:53:01,390 --> 00:53:04,270
We have many projects, maybe you have some ideas, too.

747
00:53:04,830 --> 00:53:08,510
But seriously, you're just like 20 people or something like that, but still, get involved.

748
00:53:08,510 --> 00:53:11,690
If you believe this is important, I do.

749
00:53:11,690 --> 00:53:12,930
We need help.

750
00:53:13,230 --> 00:53:17,350
Yes, I'm coming to DEF CON, and I'm saying we need help.

751
00:53:18,750 --> 00:53:23,890
In about two minutes, so I'll let Dan come up here with me, because it was very nice to come here anyway.

752
00:53:23,890 --> 00:53:24,870
Dan!

753
00:53:26,030 --> 00:53:27,070
Go!

754
00:53:34,700 --> 00:53:35,420
Farming.

755
00:53:35,420 --> 00:53:36,580
What about farming?

756
00:53:38,940 --> 00:53:41,100
Okay, the ITF sucks.

757
00:53:41,100 --> 00:53:44,360
They're good guys, the ITF, but they suck.

758
00:53:44,360 --> 00:53:48,220
Seriously, how long have they been dragging their feet on DNSSEC right now?

759
00:53:48,760 --> 00:53:49,660
15 years?

760
00:53:49,660 --> 00:53:50,740
11 years?

761
00:53:51,340 --> 00:53:52,840
You answer that.

762
00:53:53,780 --> 00:53:57,640
DNSSEC is an interesting scene.

763
00:53:57,640 --> 00:54:02,400
Farming basically gets into the idea of attacking the infrastructure.

764
00:54:02,740 --> 00:54:12,620
Really, though, we're already talking about botnets of the size of a quarter million to eventually multi-million infected hosts.

765
00:54:13,060 --> 00:54:16,660
The endpoints are getting owned, en masse.

766
00:54:17,080 --> 00:54:19,320
There's a thing called the Byzantine problem.

767
00:54:19,320 --> 00:54:27,040
You're a Byzantine general, and how do you control your troops when a fairly large portion of them want to turn on you?

768
00:54:27,040 --> 00:54:32,960
And there's ways of organizing the networks so that you can go and kill the generals that turn against you and such.

769
00:54:33,160 --> 00:54:38,940
There's a critical mass of hosts that if they're on your network and they're bad, you die.

770
00:54:39,380 --> 00:54:42,300
I don't know, is it 250,000?

771
00:54:42,300 --> 00:54:43,280
Is it a couple million?

772
00:54:43,280 --> 00:54:45,540
Is it 50% of your customer base?

773
00:54:45,540 --> 00:54:56,480
Eventually, online banking is really going to have to start accepting the possibility that too many of its customers are actually not its customers, but are coming from corrupted hosts.

774
00:54:56,480 --> 00:54:59,000
Already, if you go to Kinko's, you will see.

775
00:54:59,000 --> 00:55:01,240
They say, please do not use online banking.

776
00:55:01,240 --> 00:55:05,400
Or at least they say, please do not use anything with personally sensitive information.

777
00:55:05,400 --> 00:55:14,220
This is a result of a case in New York where a Chinese immigrant actually put botnet, or Trojan code, on all of the publicly available hosts.

778
00:55:14,720 --> 00:55:21,220
So, there's a couple things that I wanted to say because it's going to be on film and I'm going to be able to say, hey, I totally predicted that.

779
00:55:22,640 --> 00:55:28,640
Last year, like I said, the botnet control data, right now, DNS directs you to command and control servers.

780
00:55:28,800 --> 00:55:32,400
Eventually, they're just going to put commands in the command and control servers.

781
00:55:32,500 --> 00:55:42,400
At the scale of when you have all these machines, they can stop saying, okay, I want you to take everyone on this bank and send money, send all the money.

782
00:55:42,400 --> 00:55:45,140
They're going to start doing really intelligent things.

783
00:55:45,140 --> 00:55:53,020
When you have multi-million nodes broken into, you can say, huh, let's find everyone who's sending money to everyone else.

784
00:55:53,020 --> 00:55:57,340
Let's build a graph and let's find out who are the people who are receiving money from anyone.

785
00:55:57,340 --> 00:56:04,820
In other words, all the stuff the bank does to find fraud, the fraud people can use to find targets.

786
00:56:05,560 --> 00:56:07,480
So, I want to have your baby.

787
00:56:07,480 --> 00:56:08,800
I want to have your baby.

788
00:56:09,360 --> 00:56:18,360
So, no, I mean, the canonical attack becomes, okay, I find one guy who receives money from 10,000 different people.

789
00:56:18,360 --> 00:56:23,100
I put a tax on every transaction of, say, 1%, 10%.

790
00:56:23,100 --> 00:56:29,840
I hide the fact that the tax was applied because I control the interface on everyone.

791
00:56:30,020 --> 00:56:31,640
The money moves over to the guy.

792
00:56:31,640 --> 00:56:35,000
The bank thinks it's normal because the bank's always seeing money move.

793
00:56:35,000 --> 00:56:40,900
And the guy never actually gets any extra money because he gets his account drained of the extra money.

794
00:56:41,160 --> 00:56:48,580
These are the kind of threats that really happen when every single, you know, when large numbers of endpoints are broken into.

795
00:56:48,580 --> 00:56:51,600
And it stops being about a couple thousand here or there.

796
00:56:52,680 --> 00:56:54,760
This kind of stuff is going to happen.

797
00:56:55,040 --> 00:56:56,920
And, you know, I don't know if you guys know this.

798
00:56:56,920 --> 00:57:05,280
The financial network is kind of converging on sending money instantaneously when all of the security stuff is really saying, hey, slow down.

799
00:57:05,280 --> 00:57:06,080
We need to check.

800
00:57:06,080 --> 00:57:07,280
We need to go back.

801
00:57:07,280 --> 00:57:09,100
So, it's a real question.

802
00:57:09,100 --> 00:57:13,160
What is going to happen to the speeding up of the financial system?

803
00:57:13,160 --> 00:57:15,620
And it's a real, real question.

804
00:57:15,620 --> 00:57:19,940
Are we going to be able to do online banking with personal computers in a year and a half?

805
00:57:19,980 --> 00:57:26,220
This botnet stuff that Gadi is doing, every day he does what he does is another day we can use online banking.

806
00:57:26,220 --> 00:57:27,440
Okay, that's enough.

807
00:57:28,260 --> 00:57:30,580
Online banking is one issue, basically.

808
00:57:30,660 --> 00:57:31,840
We need to work together.

809
00:57:31,840 --> 00:57:33,460
We need to find solutions.

810
00:57:33,620 --> 00:57:35,280
We need to get things done.

811
00:57:35,440 --> 00:57:38,280
Because we use the internet, no matter who we are.

812
00:57:38,460 --> 00:57:44,820
I mean, this sounds like, I want to cure world anger and cancer and all that, but seriously, come on!

813
00:57:45,380 --> 00:57:48,120
And with that, I'll take another question and finish because...

814
00:57:53,400 --> 00:57:56,600
Yes, I am with the Mossad and I'm going to send quads after you.

815
00:57:58,540 --> 00:58:00,320
I do send the quads after them.

816
00:58:00,320 --> 00:58:08,060
If you watch the MI6 site, by the way, I just heard it last week, you will actually see that they say, mess with us and we'll mess with you.

817
00:58:08,060 --> 00:58:10,040
MI6 people, they're cool.

818
00:58:12,880 --> 00:58:17,640
It's not just a newsletter, it's a whole effort of trying to get things done.

819
00:58:17,800 --> 00:58:18,680
So, contact me.

820
00:58:18,680 --> 00:58:20,200
You have my email address.

821
00:58:20,840 --> 00:58:24,900
gadi.sert.gov.il or ge.linuxbox.org.

822
00:58:25,200 --> 00:58:26,180
Contact me.

823
00:58:26,180 --> 00:58:27,220
Talk to me.

824
00:58:27,600 --> 00:58:29,140
We need help.

825
00:58:29,340 --> 00:58:30,020
That's it.

826
00:58:30,020 --> 00:58:30,720
Thank you.

827
00:58:31,180 --> 00:58:33,240
And... fucking Dan Kaminsky!