start	end	text
8700	13500	Okay, this is going to be silly. We're about 10 people here, so...
13500	16160	Come to me, my children.
19240	20520	Or not.
25320	26640	Yeah, it's cool.
30500	31860	Three, five.
32940	35720	One, two. Minus one.
38080	39940	Okay, I'm not funny, okay?
42140	42580	Um...
55920	56800	Okay.
58860	62360	I'll start by introducing myself, which is always a good thing.
62360	66040	I guess. But before that, I need to ask, was anybody here
66040	68640	at my previous lecture a couple of days ago?
70000	73980	No. Cool, I can use the same jokes again. No, seriously.
73980	76820	I don't have that many jokes. And they're usually bad.
80780	82780	What you're going to hear about right now,
82780	85980	I'm not really sure what lecture you came to, because...
85980	90220	If you know what lecture you came to, because I was just inserted
90220	94560	into the schedule. There are some scheduling problems.
96080	99280	I'm going to lecture about the survivability of the internet.
100380	101540	Woohoo, fun.
101900	104360	And I'm going to make some bad jokes.
104360	107420	And I'm going to speak about some serious issues.
108240	112500	And since there are not that many people here, I'll allow myself to say
112620	113720	a lot of shit and fuck.
115100	119700	Now, my name.
121860	126800	My name is Gadi Evron, and some of you may know me from the internet as an asshole.
127980	130540	Others might know me as a nice guy, but not that many.
130580	134520	I mean, there are not that many people here, okay? And that's basically it.
135320	138140	What is DA? DA is a mailing list.
138360	142180	What is MWP? MWP is also a mailing list.
144760	147420	Now, we'll start with the boring stuff.
148780	151040	Is there actually a threat
151600	154940	to the survivability, big word, of the internet today?
155720	157560	Now, I don't really expect you to answer me,
157560	162440	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12...
162440	166000	There are not that many people, but seriously,
166000	169760	does anybody here think there is a problem today with the internet?
172280	176260	Cisco gate, okay, cool. Yes, I'll answer it.
176260	179280	Yes, there is a problem. Is it called botnets?
180720	183960	No. Well, kind of, but no.
183960	187800	We'll get to that. Now, I'm jumping
187800	192140	right in, skipping a few slides,
192140	196360	and what I basically want to talk about, which I'm not going to, is botnets.
197500	200440	But, essentially, when you look at the problems
200440	203660	of the internet, and you see spyware, you see spam, you see viruses,
203660	207000	you see all that shit going around.
207780	211840	Why? I mean, seriously, people used to blame everything on hackers,
211840	216420	or the bad guys, and that doesn't make any sense
216420	218440	to me, really.
221620	223220	Boring stuff is,
223220	226980	for example, like in any social structure, that's my belief,
226980	230920	there are many different kinds of people, duh, and it's not just
230920	234140	the bad hacker, the bored employee going back home and
234840	239400	doing whatever malicious stuff he wants to do, or she wants to do.
240020	243880	There are the kiddies, there's the military,
243880	246640	there are the criminals, everybody.
246640	250600	Different people. But still, to sustain such a huge amount
250600	254840	of bad stuff on the internet, somebody has to get something out of it.
254960	258440	I mean, seriously, so much stuff just going out of boredom?
258680	261760	I don't think so, and I'll try and prove that.
262400	267120	Even though it's not really the point of the presentation. So where is the ROI?
267120	270680	Where is the management talk? Return of investment.
271000	274840	On investment, sorry. Like I said,
274840	278940	social structure. Let's start with the kiddies. Are there any kiddies here?
279700	281400	Ah, cool. Hey, kiddy.
282540	287460	Kiddy front. Some of you may have read it a couple months ago
287460	291000	on Suns maybe, or heard it from a guy called Dan Hubbard.
291260	294860	Iframe dollars.biz. Now, generally, whenever
294860	299500	I see a .biz domain, I start crying, or scratching, or whatever.
299560	303180	Seriously, biz domains are bad. Nearly as bad as CX or WS
303180	307100	or whatever else. Seriously, I just see .biz domain and I start crying.
308240	309380	Iframe dollars.biz
310840	315300	was a business, plain and simple. Some guy said, hey, let's make money
315300	319720	off the internet. And you're coming up here, you do know that.
320760	324320	Yeah. Dan fucking Kaminsky, people.
324540	325980	Dan fucking Kaminsky.
327920	331360	Now, oh shit, these are people that actually heard my lecture
331360	334100	before. I can't use the same jokes again.
337180	339300	Now, iframe dollars.biz basically
339300	342940	said, okay, come into my website, take this code
343620	348060	iframe, I think it was, and put it on your website.
349000	351360	Now, for every first click, every user that goes into
351360	355180	your website and installs our spyware, or whatever it was,
355180	359740	you'll get money. You won't get a lot of money, you'll get 0.06
359740	362660	dollars. Now, they claimed
364060	367700	you're eating. Bitch. Okay.
367700	373840	They claimed, if I have one more bad pizza,
373840	375180	I swear I'll puke.
377280	381820	They basically said, look, take this code, put it on your webpage,
381820	385930	whenever somebody comes inside, into your webpage, you'll get 0.06
386660	389820	dollars, which is cool. Now,
389820	392880	they claimed to pay, the week before we saw them,
392880	397860	$11,000 for that. Now, that
397860	401300	amounts to about 220,000 clicks.
401680	404960	Again, they claimed. Now, we actually found
405820	409940	their statistics page, and yes, apparently they did pay
411060	413460	220,000 people did get
413460	417800	firstly installed software on their computers, and they
417800	421580	did pay $11,000 to people. Now,
421580	425820	11k is a lot of sum, but it's not that much money.
427640	429840	Now, there is another guy, I would like
429840	434260	to give you as an example, and I don't know how to pronounce his name, or nickname,
434260	437700	or whatever we chose to call him. It could be Flowby, it could be Flowby,
437700	442120	depending on where you're from. Now, this guy is a botnet controller.
442420	445640	Just so we are clear, I'll explain in a couple of lines
445640	449860	what I believe a botnet is, and if you think I'm wrong, tough.
451540	452920	Trojan horses.
453420	457720	We all know what Trojan horses are, I'll repeat anyway, and again, you can argue
457720	461740	with me all you like, I don't care. Shut up,
461740	462400	Dan.
465160	468280	You can't speak if you're not drunk, that's it.
478280	480020	Is that beer?
480720	485620	No, it's not that.
486480	491300	Okay, Flowby was a botnet controller, and again, Trojan horses,
491300	494960	let's say it's some sort of software or hardware or whatever,
494960	499500	some sort of thingy, that if a user knew what it would do,
499500	503560	it would not be so pleased about it, let's put it that way,
503560	506920	and it's usually a remotely controlled device or whatever
506920	510460	installed on your machine. That was the worst
511280	514760	explanation of what a Trojan horse ever gave, or heard,
514760	518320	for that matter. Now, you can do whatever you like
518320	523300	on a machine where a Trojan horse has been installed. You control that machine.
523480	527540	Now, imagine if you had 10 such machines, where you installed Trojan horses.
527920	530460	Imagine you had 100, and they were
530460	534480	on broadband, of course. Imagine you had 200,
534480	538540	1,000, 10,000, 100,000, a million machines,
538540	540360	all completely at your control.
541880	546000	Well, you would have to control them somehow, and that's basically a botnet,
546400	550260	because these drones, bots, whatever,
550260	554360	will be reporting to a center point, which is the
554360	558260	command and control server. Now, this guy owns
558260	562320	many botnets, and on one of the
562320	565700	botnets, we can't really prove that, we've seen it happening with many different cases,
565700	567940	and it's just very easy for me to give you an example.
570280	573780	On one of his botnets, which was 35k large,
573780	577700	35,000 bots large,
578560	581840	he decided, hey, DDoS is not good enough for me. I don't want
581840	586140	to spam, I don't want DDoS, there is a lot of downtime for my bots,
586140	589220	and I want to use that downtime. So, basically, what he
589700	593620	supposedly did is install a lot of spyware on every single machine.
593620	597560	Now, a legal calculation of a page we believe he took the spyware from
597560	601000	would mean that he gained about 8k a day
601500	606020	from his small botnets. So, that's a kiddie front. 8k, 11k,
606020	609700	whatever. Now, the big picture.
610560	613500	We don't really know what the big picture is.
613700	617020	Seriously. We do not see what's happening.
617700	621460	And this is DEF CON, I don't need to explain it to you, because half the lectures here were about
621460	626080	conspiracy theories and how the government is spying on us and all that.
627000	629420	But we can see some of that.
629840	632940	It's in plain sight, it's public.
633740	636940	And between a lot of beers, you might actually notice it.
637820	640540	I was just looking at you, I didn't mean anything by that.
640640	645380	There's plain sight spying by government? Yes. Now, when you see
645380	649220	phishing, which is in plain sight, he's a little bit drunk,
649220	652640	or I'm just not very well understood, which is possible.
653200	654180	Or likely.
656100	661140	You're not implying governments are running legitimate botnets by putting spyware
661140	664900	on people's machines? You're on to me. I work for the government, you know.
665880	669040	Okay. Now, phishing, seriously, phishing gives us
669260	673020	a very, very good picture of what's going on. Phishing is public,
673020	677660	you get it in your inbox, you can go to the sites, you see what's going on, which is great.
677660	681700	And we can actually see the amounts of money that goes into it, and I'll show you
681700	685540	in a minute. And then there are a few minor
685540	689920	details, such as, for example, the Trojan Horse industrial espionage case,
689920	693760	where there were some private investigation companies and some
694560	698380	very rich companies that wanted to spy on their competition.
699420	701680	So basically, as far as I understand,
701680	705800	they paid 17k UK pounds, or 13k
705800	710520	UK pounds a month, per computer. Which is a lot of money.
710580	713880	So there are things going on behind the scenes. Some of them we can actually
713880	717760	prove because we hear about one or two every year. But let's actually look
717760	721840	at what we can see day-to-day. The APWG,
721840	725480	the Anti-Phishing Working Group, says they saw over
726460	730540	13k unique phishing emails in March 2005 alone.
730540	733640	And thousands of phishing sites. Woohoo!
733640	737640	Now, people usually say, and I'm going to be kind of...
738400	741620	Okay, we all know this. These guys, they sent
741620	745480	so many millions of spam messages out. And then just
745480	748440	one person clicks on it and fills the details in.
749400	753680	Well, one person clicking and filling in the details is a clear cut
753680	757280	return on investment because email doesn't cost money.
757580	761400	We all know that, but it's very important to reiterate
761400	765300	that issue. Now, let's give some statistics.
765440	768680	In Germany, for example, every phishing attempt
769340	773540	2,000 people fill in their details. Now, that
773540	776960	number keeps rising. It's not just one stupid guy.
777180	781420	There's a lot of stupid people out there. Now, of them,
781420	785040	about six do not get their money back. And that's because the banks are very good
785040	789420	at moving money around. Money is stolen, no problem.
789420	794080	But six do not get their money back. Or rather, the banks have to cover it.
794680	797160	Now, on average, that amounts to about
797800	801400	6K euro lost per person.
802040	805680	36K euro for every attack. Now, per year,
805680	810100	that's 1.2 million euros. And that's just for one group.
810100	813540	Each group's attacks are used to attack once every eight days. Now, they do
813540	817320	it a lot more often. Quite a few groups out there.
817320	821040	Can anybody see the ROI yet? The return on investment?
821840	825240	There is a lot of money going into this. Now, the Russian mob,
825240	829460	and I have to say this again, I always say it in my lectures, I have nothing against
829460	833480	Russians. Seriously. I had a girlfriend who was
833480	837720	Russian. But really, nothing against Russians.
838360	841520	But most of this stuff, there are a lot of small operators
841520	845140	out there in Eastern Europe, in Brazil, all around the world.
845140	850220	But most of this stuff comes from the Russian mob. Clearly, from the Russian mob.
850300	853860	I'll say it again. Hold on.
854920	857160	Hold on. I'll answer
857160	860660	every question, and if not, hey, I'm on tape.
862100	865180	The Russian mob sees the return on investment.
865860	868880	Okay? Cool.
869140	873280	And they actually invest in the technological and operational
873280	877340	capabilities over time. There are people sitting here who actually
877340	881400	watch the binaries and the samples, and can tell you how they evolve over
881400	885260	time. Now, many of these kitties just, like I said,
885260	888540	it's social structure. It's not all the Russian mob.
889120	891880	Many of these kitties just trade it like candies.
892300	897340	And most of these trojan horses, or bots, or whatever,
897340	901460	are just the same code, ripped from one another over and over
901460	905460	and over again. But still, it's important
905460	909960	to note that, and I'll give you an example. Here in the States,
910500	913240	this just came out a few months ago,
913240	917900	here in the States, there was a phishing attempt. It's a phishing attack, actually.
920440	921560	And somebody's account
921560	926300	got emptied in a branch of the bank on the West Coast.
927780	929960	Now, a week later,
930060	933640	a FedEx box came in, carrying a fake check,
933640	937140	which is what actually got people to look into it,
937140	940080	to refill their account so they can empty it again.
941240	945780	Shut up! So basically, you'll get to lecture in a minute,
945780	949340	so don't disturb. You're not allowed.
949340	950340	You're not drunk.
957050	958910	I'm very happy that you came.
963380	965660	Now, I really am happy
965660	969980	that you came. Basically,
969980	972980	what that means, people, this is not cyberspace anymore.
973600	978020	This is meatspace. This is happening right here, right now,
978020	980660	with real people, and real money.
981760	983980	That's critical to what I'm going to talk about.
985080	989960	Now, in the UK, for the last example, the losses are also significant.
991420	994320	1.4... 1 to 4, I'm sorry, million pounds a month
994320	997420	in losses, just at the beginning of this year.
997660	1000220	And it jumped by 1 million every month.
1001060	1005540	December, January, February, March, it got to 4 million pounds lost.
1005540	1008640	Now, don't take my word on these numbers. You won't find them anywhere.
1008760	1012820	As far as you're concerned, I'm lying, because I'm not going to prove it to you.
1012820	1016700	And anything I'm not going to prove, just believe I'm lying. But these numbers are true.
1017160	1021260	Now, this is by... I'm lying. No, this is by phishing alone.
1022920	1025040	There is a lot of money in this. I'm saying it again.
1025040	1027500	I'm repeating myself, and there is a reason for that.
1028580	1031260	In the US, the story is a bit different.
1031920	1037080	One bank, they say they used to see about 200 victims per scam.
1037240	1039280	Today they say they see about 5.
1040040	1044600	But come on, people. Banks, at least in the United States,
1044600	1046720	in the UK, they can't, as far as I know.
1046860	1051040	They have a legitimate reason to actually try and underplay the problem.
1052140	1055200	I mean, do you have any idea? I don't have any idea, by the way.
1055200	1059800	Do you have any idea how much of all their business goes online?
1061500	1064240	How much of any business today goes online?
1065120	1067540	Depending on the bank, it could be 50-60%.
1072050	1072850	Everything.
1072850	1073910	Everything.
1076670	1080390	Again, I don't have hard numbers, and it changes drastically from bank to bank.
1080390	1081950	I don't want to talk about it.
1085030	1095340	What? I really want to answer that. I honestly don't have time.
1095940	1099800	I know I'm kind of weeny for saying that, but I honestly don't have time.
1099920	1100660	Sorry.
1101820	1106880	Other banks are actually reporting losses of around $10-20 million.
1106880	1111000	Again, don't take my word for it. The Germany numbers, I can sign on.
1111880	1113800	And they're not anywhere you can find.
1114460	1118500	Now, the problem is not botnets. Again, I didn't really want to make this a botnet lecture,
1118500	1121780	although I can't speak about botnets for hours on end.
1122560	1125940	Botnets is a very serious symptom.
1127220	1129440	A very, very serious symptom. It's a problem.
1129440	1133340	Actually, I keep using the same jokes. You were in my last lecture, you bitch.
1133340	1136280	Why were you in my last lecture? I can't reuse jokes.
1137800	1139640	You were hoping it would be funnier.
1143200	1144980	I know where you live.
1146500	1150380	Okay, I don't. I can find out.
1153320	1154200	Dan?
1158440	1160620	The Mossad! The Mossad!
1162720	1164840	I was just at Cisco the other day,
1164840	1168120	and they gave, like, name tags that stick on your shirt.
1168560	1172920	Now, I don't know who told them and what the fuck they thought they were doing,
1172920	1176200	but I don't work in Israeli government security.
1176220	1181040	But I said, Israeli government security. I immediately photocopied it.
1182080	1185220	Asked for another one. Put it in my pocket.
1185220	1188680	That's so great. I'm for the Mossad. Watch out.
1188680	1190200	I'll send people after you.
1190720	1196360	Okay, I don't have time. The problem is not botnets.
1196360	1201580	Botnets are a very serious symptom. What I'm trying to say is botnets are a serious problem.
1201580	1204800	I can tell you that from our limited view,
1204800	1207860	and we see quite a bit, but again, we don't see everything.
1209180	1212240	We have 4,000...
1214040	1216520	4K botnets out there.
1216520	1218100	Since the beginning of this year.
1218280	1221360	And that's just a little bit.
1221820	1224860	I mean, people keep looking at the bot itself.
1227380	1231240	And they keep asking me, how many bots are out there?
1232260	1234180	And you know what? I don't give a shit.
1234180	1236440	Seriously, I don't care how many bots are out there.
1236580	1241960	Some people might have to care, but I don't, and I'll explain why in a few minutes.
1243140	1247080	Now, okay, I'll explain why now, actually.
1247240	1248660	And waste some time.
1252880	1256220	Why... you people who live in the United States, or most of you do,
1256560	1260680	you know about this thingy of asking,
1260680	1264940	why be able to destroy the world a thousand times over when once is more than enough?
1265360	1268100	Right? Well, botnets on the internet are
1268100	1272360	strategic warfare. They are nuclear weapons.
1272360	1276380	And the amounts and numbers out there
1276380	1280360	are unbelievable. And I can tell you that we've actually seen
1282520	1283840	a 350k botnet.
1284760	1287940	And it wasn't the only one. It's just the best example I have.
1288280	1292400	A few months ago. Now, when you have
1293220	1296200	that big of a botnet at your control,
1296200	1298380	you can do pretty much anything on the internet.
1300100	1302940	Now, I'll continue with that in a minute,
1302940	1306380	but really, looking at the botnet as a problem, a botnet itself,
1306920	1310940	the network, install some bots separately,
1310940	1314520	is what I'm talking about. Now, the philosophy of the problem,
1314520	1318020	why I'm looking at botnets as a symptom... okay, I can't say problem, seriously.
1318020	1321560	This is a joke I must reuse. I'm sorry. It's not really a joke.
1321760	1325380	I was sitting with a guy from Adobe, or my boss was, I don't really remember.
1325380	1329760	I reuse jokes all the time. And the guy would refuse for two hours
1329760	1333660	to say the word problem. He would say challenges.
1333880	1337240	For two whole hours, I just heard, or he heard,
1337240	1341640	challenges, challenges. And now they changed it. You're supposed to say
1341640	1345660	opportunity, opportunity. Anyway, so there are several challenges.
1346360	1347780	Let me get to the point.
1349280	1353620	If I'm saying botnets are strategic warfare on the internet,
1353620	1355940	I mean, everybody knows what DDoS is.
1358960	1361000	Why say they're just a symptom?
1361880	1365220	Let's start a bit about our philosophy of the problem.
1365660	1368620	The internet. Photon monoculture.
1369620	1373060	We all, I mean, whether we like it or not, most of us use Windows.
1373060	1377100	And I'm not talking about the home computer. At work, most of us use Windows.
1377200	1381520	Everywhere, it's Windows. And that makes us extremely susceptible
1381520	1382900	to attacks.
1384780	1389820	And I don't have time to talk about that anymore, but just think about it. I'll waste some time later.
1392000	1393080	Now,
1393080	1396920	one bug, or one patch, can bring us down.
1397640	1401820	Repeating past mistakes. When we left the
1401820	1405520	world of the mainframes,
1406120	1410060	OS development somehow sinked down to a new level.
1410060	1413440	And just now we are starting to reach the level of where we were
1414060	1417380	with the mainframe in OS development.
1417800	1422820	And I can actually see it as a pattern of things actually repeating themselves non-stop.
1423840	1426060	The PC wasn't the end of it.
1426060	1429700	For example, cell phones. Everything is in default.
1430140	1434140	You can't disable anything. Everything is in automatic. Java, browsers,
1434140	1437980	whatever. Unbelievable. We keep repeating the same mistakes
1437980	1442320	over and over again. And that brings me to Killing Fires.
1443620	1445900	And before I reach Killing Fires, I would like to discuss
1445900	1450280	the problems of the internet. We'll get to KC and who she is
1450280	1453960	in a minute, but everybody keeps saying at the end of the year
1453960	1457960	companies like Symantec, they do a great job, but they come out and say something like
1458440	1462200	look, these are the problems that we are going to face in the year of 2005.
1463200	1466080	Okay, great. How do you know that?
1466080	1469700	Well, we have looked at our past agendas and logs and histories
1469700	1473020	and we can tell you what we believe the issues are going to be.
1473700	1476280	Okay, so basically F of that is what happened last year.
1477220	1480460	Almost another F is what you believe is going to happen, therefore you're
1481440	1486020	self-prophesying or whatever you call it, that it will happen and some of it will happen.
1486020	1489680	And some of this stuff will actually surprise you, because you can't know
1489680	1492500	what everything that's going to surprise you is going to be.
1492500	1496500	And I'm saying something different. The problems are out there
1496500	1501060	and we know about them for many years now. Many years.
1501520	1505080	Let's take for example spam. Are you interested in my talk at all?
1505080	1508540	I am. You are? I believe you.
1508540	1511560	Okay, David fucking Kaminski everybody.
1513380	1516200	Not drunk for the first time on video.
1519320	1519820	Now...
1523080	1523960	Yeah.
1524780	1527200	I'm trying to remember what the fuck I was talking about.
1527300	1530400	Predictions. Thank you, bitch.
1533100	1534600	I love this guy.
1535940	1539660	But he gave me such hell when I asked him to come and help me in my lecture.
1541040	1543160	Yeah, but I don't need you now.
1544320	1546580	Yeah, I'm going to talk now.
1552270	1554490	Yeah, I'll tell you about the superbugs in a minute.
1556130	1557830	I'm still wasting time.
1560570	1562490	What was I talking about? No, seriously.
1563110	1567950	Predictions. So basically, the problems have been around for many, many years now.
1567950	1571310	Let's take spam as an example. Yes, tell them we love them.
1572390	1575210	I want that phone later on. It's mine now.
1576290	1579470	The problems of the internet have been around for many years now. Let's take spam.
1579470	1583610	I'm going to completely ruin the history of spam. In the last lecture I met, there was a guy
1583610	1586910	from SpamHouse here and he wanted to kill me, but it's cool.
1588330	1591490	First, we didn't really care about spam. Seriously.
1592350	1595630	It's just some emails you get eventually, here and there,
1595630	1599130	once a day, and you found a good solution for it too.
1599230	1603770	JHD. Just hit delete. And it worked. And then it got a little bit more annoying
1603770	1607750	as somebody started working on it, but nobody really cared. Nobody wanted to put the money
1607750	1611250	into it to get rid of the business, or at least try to.
1611570	1615850	And then it got to be a problem. Then everybody started caring about it.
1617750	1619830	And then I started finding solutions.
1620590	1623800	And like any human society, anywhere,
1624330	1627710	they said, I have to be elected into office. I mean, this is not really it,
1627710	1631070	but seriously, long-term solutions are not part of the business here.
1631230	1635950	It's part of our culture. We have to kill this fire called spam right now.
1637430	1639830	So we will invest some money,
1639830	1642930	and come up with a solution that will kill the fire right now.
1643110	1646790	That solution was, for example, Bayesian filters,
1646790	1651630	or F-ass Bayesian filters. And if we see, for example,
1651630	1655890	Viagra in one instead of an I,
1655890	1659850	all these evasion techniques that bad guys came up with, that's cool.
1660130	1663330	I mean, seriously, use some F-ass Bayesian filters
1663330	1666310	that bad guys learned and started using one instead of I.
1666910	1671290	Then I started using mail relays. Again, it could have been the other way,
1671290	1675730	but I don't really care right now. And we started using blacklists, like maps.
1677070	1678890	And then I started using zombies,
1678890	1683170	and they can email from all over the world. Anytime we actually kill the fire
1683170	1687390	right now, get rid of this problem right now, what we actually accomplished
1687390	1691050	was, hey, we are teaching the bad guys.
1691050	1695130	We are educating them. We are throwing them into
1695130	1698930	an evolutionary route that we are not choosing. We are making things worse.
1699310	1702890	And I can tell you it's the same with botnets. It's the same everywhere, and that's what
1702890	1707130	brings me to the superbugs theory. Now, superbugs is not a new
1707130	1710390	theory. I mean, doctors really liked antibiotics.
1711350	1715670	You had a flu? The flu, they gave you antibiotics. You had a cold?
1716050	1719150	They gave you antibiotics. And what they actually
1719150	1720570	did was create some sort of
1726870	1727270	stronger
1727270	1730630	bugs that could resist antibiotics.
1731110	1735150	And they kept doing it. And that brings me back
1735150	1739010	to monoculture. Everything is windows. And we keep just
1739010	1743370	ignoring the problems that are out there for years, and I can give you a list of problems
1743370	1747010	and I'll get to that in a second. And I've been out there and it's getting worse.
1747010	1750990	And eventually they get so bad that we have to kill them right now. And every time we do something like that,
1750990	1755170	no matter if it's terrorism, no matter if it's botnets, no matter if it's spam,
1755170	1758990	we just kill the problem right now. I'm repeating myself, I know, but it's important
1758990	1762270	to me. And make it worse. Educate the bad guy.
1763650	1767430	So the superbugs theory is where I wanted to get to.
1767770	1770010	And that's why botnets are not really the problem now.
1770910	1774890	Who is the enemy? I keep speaking of
1774890	1779810	there are bad guys out there. FUD, I'm not giving any facts.
1780030	1783350	Well, it used to be a rival or an opponent
1783350	1786970	really, not really an enemy. Because, I'll give you an example
1786970	1791030	from the dynamic DNS providers. Dynamic DNS providers
1791030	1795150	are really, really good for the bad guys. They can run
1795150	1799090	botnets using DNS really easily. They tell all the bad
1799090	1802910	bots, connect that address. Then when somebody
1802910	1807150	kills the server, because that's how you deal with the botnet, you kill the command and control server
1807150	1810970	which is bad, because then the bad guy just moves up to another server
1810970	1815110	and starts investigating and educating themselves and getting to be better at it.
1815110	1818390	Again, superbugs. But basically, when
1819050	1822990	dynamic DNS providers are perfect for them. They go online, they open a new
1822990	1825410	account, they get some free DNS
1827030	1830190	free domains, free whatever, and
1830190	1834270	just point the botnet over there. That's
1834270	1837270	basically how it works. The dynamic DNS providers
1839090	1842230	really suffer. Because imagine
1842230	1845590	100,000 bots, and bots are not very nice
1845590	1849670	internet users
1850590	1854230	losers. They just keep asking the same question. How do I
1854230	1856950	connect over there? Where is that A record?
1857850	1861270	And they really weigh down on the dynamic DNS providers.
1861530	1864950	The dynamic DNS provider says, okay, this is the botnet, it's in breach of my
1864950	1868890	acceptable use policy. I will map this botnet
1868890	1872490	address to 1918 addresses, localhost, whatever.
1872970	1877370	And that's acceptable to the bad guy, because it says, hey, I abused the service, but I need it again.
1877390	1880930	They found me out, I'll just use it again,
1880930	1884830	re-register. Now what if the dynamic DNS provider says, I'm sick of it.
1884830	1889650	I mean, so far they've been contesting for the same resources, they live in the same realm,
1889650	1893370	but don't really come to combat, open combat.
1893430	1897490	But what if the dynamic DNS provider says, I'll sinkhole the botnet.
1897630	1900910	I'll kill the botnet, I'll take the botnet away from the bad guy.
1901070	1904510	The bad guy gets pissed. And then it's open warfare.
1904910	1908810	You will DDoS the dynamic DNS provider to hell, and that makes it an enemy.
1909490	1912830	And why I wanted to stick to this point for a minute, which is not really
1912830	1916390	related to the lecture, is because this is an enemy to the infrastructure.
1916390	1920450	And when I try to think about who the hell owns the internet,
1920450	1924470	and I'm not talking about owning the internet as in who runs the internet,
1924470	1929510	but who are the stakeholders? Seriously, who cares if the infrastructure survives?
1930210	1933770	And I try a lot, and I can't really find the people yet,
1933770	1936510	but the infrastructure
1936510	1940970	is at a serious risk. I don't care if somebody is a black hat, if somebody is a white hat,
1940970	1944990	if somebody is a grey hat. Whatever you do at home, whatever you
1944990	1948930	have fun with, that's cool. But when you go out and
1948930	1953010	take money from Granny Jane, or when you go out
1953010	1957330	and try to DDoS the internet to hell, you're not a nice netizen,
1957330	1961370	and over more, you're pretty much, you're not a black hat, you're an idiot.
1962570	1964430	And your idiocy is pretty much
1964900	1968970	what's going to cause the internet to go to hell. And that's FUD.
1968970	1973090	That's fear, uncertainty, and doubt. And I didn't want to say that
1973090	1974710	until I could give you some facts.
1977030	1979190	What do we do about it today?
1986330	1989530	It could be tens of thousands of dollars a week, it could be millions,
1989530	1990770	it depends on who you are.
1998980	2002900	The question was, why are you relying on DynDNS for something that is critical to your
2002900	2006900	infrastructure when you make millions? You don't rely only on DynDNS,
2006900	2010060	but I don't have time to cover it right now, but just think about
2010840	2015600	why do botnets use IRC? Seriously, why use IRC?
2015680	2017160	It's perfect for them.
2018060	2021420	I mean, I don't have time to cover it because this is not a botnet lecture right now,
2021420	2025540	but something does not have to be extremely complicated to be good.
2027810	2030710	Although, damn, fucking Kaminsky is not drunk to answer that.
2032130	2034010	Ignore everything I just said, please.
2034010	2038030	There needs to be legitimate services that are using
2038030	2042090	that particular host that it would be a problem if you just killed
2042090	2045790	it entirely. If you go ahead and you put a colo somewhere and it's the
2045790	2050030	CNC and it's the DNS and so on, pull the plug on it and you've just
2050030	2054150	killed illegitimate services. The idea is to mix the illegitimate
2054150	2058070	botnet with the legitimate dynamic DNS and that's why they do it.
2058330	2061910	Amen to that. Next issue. And thank you to Dan Kaminsky.
2061910	2064610	He's not drunk. I'm sorry, Dan fucking Kaminsky.
2065330	2072760	He calls me God, he fucking Ron. Come on. Hold on, we'll get to that.
2074500	2076300	Now, what
2076300	2078100	do we actually do about it today?
2079700	2085240	First of all, there are vendors. Anti-virus vendors, anti-spam vendors,
2085240	2087980	let's even say ISPs. Vendors.
2087980	2091680	A lot of vendors who try to give you solutions. Then there are more vendors
2091680	2095780	who try to sell you stuff. Some of them do good shit. Seriously,
2095780	2099700	there are companies such as Message Labs, Maps, Spam House. Companies
2099700	2103200	that really do good for the internet. They're still vendors.
2103780	2107880	And they look at their small way of making money and if they can do good with it,
2107880	2111780	that's cool. Then we have research funds. Research in general
2111780	2115820	such as the NSF, Army, Navy, DARPA, whatever.
2116700	2120100	Then there is symptom-based response. For example,
2120100	2123580	hand-spam. The FTC recently came up with
2124100	2128500	something that they claim will report to every ISP.
2128980	2132240	It will report to ISP the bots. Again, the bots are not the problem
2132240	2136140	as far as I'm concerned. And any infected machine will have 10 more
2136140	2140500	bots on it, at least. The botnets are the problem.
2140500	2144140	But say they will report the bots. So what they
2144140	2147720	do is look at emails, spam emails, and find the zombies
2147720	2151360	that send them. Now, out of all the numbers
2151360	2155320	of all the drones and bots out there, how many of them send spam?
2156360	2159140	A lot, but not quite that many from the whole
2159700	2163180	of the entire botnet population.
2163760	2167760	Now here I have to discuss the botnet population. How many bots are actually out there?
2168160	2171960	Because that's what people keep asking me. So I'll make this quick.
2171960	2175800	I don't really give a shit. As I said, if you can destroy the world a thousand
2175800	2180280	times over, why the hell would you care if you can do it just once?
2181080	2183920	And that's what botnets are. But if I have to answer
2183920	2187480	the question, I'll discuss research that has been happening
2187480	2190240	unrelated for quite some time now.
2191540	2195480	How often, or how soon, when you start scanning the internet
2195480	2198900	when you put the machine on the internet, will it get scanned?
2199440	2203920	A few years ago, to put the machine on the internet, it got scanned 36 hours
2203920	2207960	after that. A couple of years ago, I checked, and depending
2207960	2211780	on the ISP I checked on, I got scanned once every two seconds
2211780	2215840	to once every 20 minutes. Kevin Mitnick, I believe,
2215840	2220560	made some check and got around the same conclusions. On the site in SANS,
2220560	2223460	internet survivability time is about 20 minutes or something like that. It keeps
2223460	2227860	coming up and down. So basically, say it's not every two seconds
2227860	2231820	like in my house. Say you actually get scanned for
2231820	2235760	the easy vulnerabilities automatically by viruses, worms,
2235760	2240040	whatever you want to call them right now, hacking tools, every 20 minutes
2240040	2243740	once. Now, on broadband
2245800	2248700	providers, out of all their clients,
2248700	2251720	how many would be easily exploitable?
2253000	2255940	Now, when you get to the potential population of that,
2256540	2259820	and how many bots you can get installed on one machine,
2261000	2263820	because basically I count the bots as how many
2263820	2267860	samples are installed or working on each machine per IP address
2267860	2271040	per machine, you get a huge number.
2272740	2275740	Now, if you wanted to count it
2275740	2280300	in another way, say you sync all the botnets, and that's not my research, that's somebody else's.
2280400	2283900	Say you found botnets and you followed them, and you checked and saw
2283900	2287800	that several botnets have the same IP addresses coming back
2287800	2291520	again, there are time of day issues, DHCP issues,
2291520	2295640	sometimes you see a Linux machine and then it's a Windows machine, but
2295640	2299600	you actually see IP addresses returning.
2299880	2303780	If you take that cut between the different groups,
2303780	2307900	you may try and get to the point where you see the entire omega.
2307900	2310700	This is David Duggan's research at Georgia Tech.
2312500	2315880	He says, by the limited research
2315880	2318560	he has done, he has seen about 20 million bots.
2320020	2323880	That's nothing. If I had to give a number or just
2323880	2327920	say 40 million, but that's nothing, people. Seriously.
2328080	2331660	And why would I care about the number?
2333680	2335960	Now, sorry, I had to give
2336220	2340000	a terrible response to this if I didn't explain myself
2340000	2342000	correctly, because it's critical.
2342560	2345900	Now, another issue, and symptom-based response
2345900	2349540	for the FTC came up with this issue and said, we'll report bots to the
2349540	2353280	ISPs, not botnets bots, and they're reporting spam bots.
2353280	2357320	They're reporting a symptom of the symptom, which is the zombies that send out spam.
2358200	2361880	Great. A for effort, that's about it. I'm glad they're
2361880	2365880	doing it, but it's nothing. Shoot the customer.
2366300	2369100	I really like that. I want to shoot the customer, seriously.
2369100	2373020	Blocking port 25 is one of the best things out there that can be done
2373020	2376060	to stop spam. I hope Larry
2377040	2381020	from Spamels will be here again to explain that, but basically
2382020	2385260	lots of end-to-end, blocking port 25,
2385260	2389160	blocking all these ports, no matter why now, if it's a good or bad
2389160	2391280	idea, you're shooting the customer.
2392700	2396960	That's how ISPs are dealing with it. I'm not saying it's bad, I'm not saying it's good. I actually like it.
2396960	2401100	But it's shooting the customer. That's how we deal with it currently.
2402200	2404760	Now to business. Why DA? And as we said,
2404760	2408860	DA is a mailing list. Well, it gives community
2408860	2413040	and industry involvement, basically. I'll discuss what it is exactly as I go.
2413860	2418100	You see the anti-virus industry, academia,
2418100	2421540	dynamic DNS providers, law enforcement, ISPs.
2422100	2425040	There are other groups out there that work on the problem,
2425040	2429220	and I'll discuss them in a minute, but none of them have the scope.
2429600	2433600	I'll continue in a second. Long-term study and research.
2433760	2436680	Killing viruses is bad. Guacamole
2436680	2441200	was bad. Today when you actually kill a button, it not just jumps
2441200	2445100	to the next IP address, the next compromised host,
2445100	2448920	they actually learn from it, they become better at what they do. It's bad for us.
2448960	2453220	Long-term research and study is critical. R&D, ways and
2453220	2456740	means. Finding new solutions. Following technological
2456740	2461300	operational evolution by the other side. Doing all
2461300	2465180	that and still maintaining the vetting. And vetting does not mean secret
2465180	2469000	entry club where nobody can enter. Hey, I'm lecturing in DEF CON for
2469000	2473280	very few people, but still, lecture in DEF CON. The point is getting as many
2473280	2476960	people involved as possible who care about the infrastructure and actually
2476960	2481100	having the internet around. Now, this is not
2481100	2485700	easy, but it's critical. Now, what does that mean?
2486040	2489760	What can we do that a closed group of ISPs can't?
2489900	2493180	Or a closed group of antivirus gods can't? Antiviruses care about
2493180	2497440	signatures, libraries, which is great, that's their business plan,
2497440	2501240	model, whatever. ISPs care to get their networks back online
2501240	2505420	without problems, maintaining their networks. So they kill botnets.
2505700	2508740	What do we do? First of all, we can do traceback.
2509240	2512640	Tracking down the botnet, authors, controllers, whatever.
2513000	2515680	Creating an intelligence database on who they are.
2516880	2521080	Actionable intelligence, law enforcement cooperation. Get the intelligence,
2521080	2525180	give it to law enforcement. Law enforcement does not care. What do I mean by that?
2525180	2529080	I don't give a shit. And not because they're bad people.
2529940	2532740	Actually, it's the opposite. Law enforcement cares.
2533220	2536920	They can't do squat. We see a
2536920	2540700	very large increase in their caring in the recent year,
2540700	2545100	especially. They want to do good, but they care a lot more
2545100	2548700	about the murderers out there, as they should.
2548800	2552780	They do not have the resources to invest in this.
2553380	2556920	Plain and simple. And it's not
2556920	2560660	really their fault, it's policy. Policy from upstairs
2560660	2564500	that dictates this. And I can tell you we have somebody
2564500	2569400	who actually knows from his hard work who the bagel author is.
2569960	2572900	And he gave them information, he gave them pictures of the guy.
2574080	2576960	And they didn't do squat. Shit.
2576960	2577720	Nothing.
2580480	2584540	Again, I love the guys in law enforcement, and they're trying, but they can't because
2584540	2588300	their hands are tied. So we can't count on them.
2588700	2592620	Sorry, but that's the way it is. Now, reverse engineering,
2592620	2595800	working actually on the samples rather than just the networks,
2595800	2600640	IDSs, flows, whatever, shows us where they are technologically, what they can do.
2601320	2604920	We can find the botnets better, we can see what they're doing, it's cool.
2606000	2608540	Financial trace back. If you work with law enforcement
2608540	2612740	or the financial industry, you see phishing, you can actually trace back
2612740	2616680	from all ways. Not just on the network, not just
2616680	2620080	on the sample level, financial trace back. See where the money is going.
2620080	2624420	Which is basically the only thing the Fed knew how to do with phishing until very recently.
2625560	2627720	Cooperation. That's the critical part, and that's
2627720	2631940	where I was going with this lecture, basically. Working together
2631940	2635520	to see the big picture, because everybody is an expert.
2637480	2640060	But nobody, except if you work together, can see the
2640060	2644020	macro level image. I mean, seriously, we'll talk about Casey in a minute,
2644020	2647920	but she says, for example, the research community is looking for ideas
2647920	2652820	on what to research. The industry needs solutions, and nobody is talking to one another.
2654340	2655960	Now, DA and DA
2655960	2659660	related projects, again, DA is a mailing list, because
2659660	2663880	we had to start somewhere, and that's where we started. Carsnet, that's David Dagan
2663880	2667860	from GA Tech, he does amazing work to study botnets, and he
2667860	2672000	can't find funding. The bad guys have millions,
2672000	2676120	and he can't find funding. But,
2676120	2680420	that's a database, basically, for us to follow everything,
2680420	2684160	gather information, pretty cool. Snort for
2684160	2688280	ISPs, rather dead project right now, but we're working on it.
2688680	2691980	Getting signatures out to detect botnets easier.
2692340	2696820	Botnets, not bots. Passive DNS replication is critical,
2696820	2699920	I do not have time to talk about it, I'm sorry, but it's critical.
2700040	2704160	If you want, Google it. AS-based reporting, getting
2704160	2708060	the reports out to ISPs. Monthly shaming,
2708060	2712060	some ISPs do not give a shit. We need to shame them,
2712060	2716400	and we are actually managing to change the map of the internet every month.
2717000	2719960	Basically, it's, okay, we managed to get that ISP
2719960	2724480	to work with us, which means, okay, the botnet controls are going to run to another ISP now.
2724700	2727700	But we change the map, every month.
2727840	2732260	Some ISPs don't give a shit, we're not sure how to handle that yet.
2732260	2735580	There's some parts of the world we can't reach, but we're working on it.
2735580	2740060	And I'll get to that in a second. Then there's Granix. You'll hear about that in the future,
2740060	2741660	I'm not going to talk about it.
2743940	2747000	Drone armies, at least I think so, I have no idea.
2748060	2752280	I call it Dumbledore's army, I'm not sure if there are any Harry Potter fans here.
2752900	2755520	No? You guys suck.
2756100	2760060	Now, MWP is another mailing list. We had a lot of off-topic
2760060	2764020	posts. There's nearly no noise, only signal on the mailing list
2764020	2767540	until I decide, okay, this is too much signal and I just send some shit in.
2767960	2772700	But it's a community, it's not completely operational. There are other lists that are operational.
2775280	2776840	Spammed malware sites.
2777440	2780260	You spam it via email, it's malware,
2780260	2784120	we'll take it down. Captures, okay, there are many
2784120	2788000	other companies that see these files online, we'll find them and we'll take them down.
2788000	2791780	Now, I'm not supposed to say kill the site, but that's what we do.
2791780	2795920	We do it legally, which means in lawyer talk I would have preferred to say something like
2795920	2799900	we find the data, collect it, give it to the
2799900	2802500	respectable authority to review and
2804300	2805340	investigate and
2807700	2811860	validate or whatever themselves, and then proceed according
2811860	2816040	to their acceptable legal policy or whatever. Basically we kill the sites.
2816040	2820080	Now, worm propagation sites take it down. For example, if there is
2820220	2824040	a worm and you download samples, updates, whatever from some site,
2824040	2828000	we'll take it down, we'll stop the worm from spreading. Phishing sites take
2828000	2831820	it down. We don't do that anymore right now, I'll explain why later, but
2831820	2835860	we still follow it very, very closely. Global law enforcement
2835860	2840000	coordination and tracking of phishing groups. Law enforcement can work together very
2840000	2844540	good, they have their own ways to communicate,
2844540	2847600	but they suck on the small things. Seriously.
2848180	2852300	And we have managed by giving them the actionable
2852300	2856660	intelligence that they don't have, we managed to get several law enforcement
2856660	2860460	agencies around the world working on taking these guys down, because they
2860460	2864520	make money. And the only way that we can stop them from moving their botnet
2864520	2868360	or their phishing or whatever to just another server is by changing their economics
2868360	2872460	and make it not worth their while. That's basically it.
2872460	2876360	And phishing on the net. We want to gather all these
2876360	2880560	phishers, companies such as MessageLabs, Panels, all these guys, send us
2880560	2884460	the phishers, we'll report them to ISPs, we'll get the shelf life
2884460	2888440	of a phishing server down to two
2888440	2894690	hours instead of six days. Ask Dan later.
2894690	2898650	Sorry, I got five minutes. I'm serious, I'm sorry.
2899870	2902370	Other projects. There are other lists
2902370	2906970	out there, other projects, for example, NSP Sec for ISPs to work, you can Google it.
2907210	2910530	The Aninet project, they don't want to work with law enforcement,
2910530	2914490	they're pure researchers. APWG, Anti-Phishing Working Groups
2914490	2918410	in the United States and Apex in the UK. UNISOC, Digital Finish Net,
2918410	2922370	which is the FBI, which is just now starting to get some things done, they basically
2922370	2926350	suck so far, I have high hopes. Microsoft.
2926450	2929730	People, Microsoft is doing a lot.
2930450	2933930	I believe their motives are more like, we want
2933930	2937670	to prove to everyone we do good security, and we want to fucking take over
2937670	2941590	the industry. That's what I believe their motives are, they're hiring
2941830	2945730	a lot of people, but whatever their motives are,
2946550	2950210	they're not really hiding as far as I see it. They do a lot of good.
2950850	2952610	They actually do something.
2953790	2957190	Now as far as I see it, the stakeholders so far
2957190	2961690	I've been able to find... I'll get to Casey first, I'm sorry.
2963910	2965250	Internet Governance. You might have
2965250	2968650	heard Paul Vix's lecture. It's a lot of
2969190	2973310	shit and crap and whatever, and the point
2973310	2977190	is, we can go lower than that, it's trust. For example,
2977190	2981150	nothing prevents me from going to dine right now with a 5 kilo hammer, or kick him in the nuts,
2981150	2985090	or kill him, basically. In real life...
2985090	2989530	Okay, Dan, my glock is at home.
2989870	2992430	No, seriously, you guys are watching me.
2992850	2997310	There are laws, there is fear. I don't know what's stopping me from doing that right now,
2997310	3001070	but that's meatspace. On the internet, nothing stops me
3001070	3004990	from doing that. For example, when people threaten sites
3004990	3009010	for takedown. Pay me 10k right now, I'll take you down.
3009370	3012990	In real life, especially in the States as far as I understand it,
3012990	3017230	from movies in Hollywood, protection money is really good.
3017570	3018850	Works really good.
3020830	3025070	Somebody might come to you and say, look, you pay me right now, or I'll burn
3025070	3029350	down your store, set it on fire. And you might pay him.
3029690	3033310	Or he'll set your store on fire. Now once you've paid,
3033310	3036910	it is likely that the guy won't set your store on fire.
3037270	3041030	Further, if anybody else comes to you and says, hey, pay me or I'll set
3041030	3044930	your store on fire, this guy will protect you. On the internet, they say,
3044930	3049190	okay, pay me 10k right now, I'll set your store on fire.
3051710	3053390	How do you know he won't?
3053410	3056610	First off, it's the internet.
3057570	3060750	Second, he can't stop anybody else from doing it anyway.
3061690	3065030	And the point is, if I meet somebody online,
3065030	3069470	say from Korea or Japan, he doesn't know me, I don't know him, why would he trust me?
3069470	3072290	Why would she trust me? No reason.
3073470	3077790	They may be the bad guy that's trying to trick me down. Would I share information with them?
3078170	3081950	The bad guys are sharing information, making money, everything.
3082290	3084170	We do not share information.
3085230	3088650	We do not get things done. Now, if we don't get a way to cooperate
3089530	3093490	and get things done, somebody else will find a way to do it for us.
3093950	3098330	According to Casey again, I'm misrepresenting your ideas, that's to be clear.
3098330	3101210	But as far as I understand their ideas,
3101210	3106770	every network in the world ever built, whether it's communication network, transportation network,
3106770	3110090	whatever, somebody came and made some order.
3110090	3114150	That somebody was usually or always the government. Do we want the government,
3114150	3118990	your government, my government, to come in and try and make the internet fall in place?
3119570	3122490	They're already trying, especially in Canada and Australia, as far as I can see.
3122490	3125430	Here in the States, everywhere. I doubt they'll succeed.
3125430	3129130	What I see, basically, I'm not worried as Casey is.
3129250	3133030	I believe it will either be Microsoft or the Russian mob.
3133430	3136610	Now, you can quote me, God, he said the Russian mob and Microsoft, whoo!
3136610	3141290	But seriously, these are the stakeholders right now.
3141290	3142490	They make money.
3145150	3149470	Microsoft and the Russian mob. Which one do I prefer?
3149470	3152130	Exactly! Thank you for asking that question.
3152130	3155210	Now, I love Microsoft. Seriously, they're doing a good job out there.
3156230	3160790	I don't know why they care. They may have their own ideas, but they're doing a good job.
3161110	3162370	They're the only ones.
3164250	3168090	Now, cooperation, trust, just getting things done.
3169990	3170790	Basically.
3171830	3173730	We need to solve these problems.
3175310	3179130	And usually, like I said last time, I would have expected a full hole when I said,
3179130	3180810	get involved, people!
3181390	3184270	We have many projects, maybe you have some ideas, too.
3184830	3188510	But seriously, you're just like 20 people or something like that, but still, get involved.
3188510	3192930	If you believe this is important, I do. We need help.
3193230	3197350	Yes, I'm coming to DEF CON, and I'm saying we need help.
3198750	3201510	In about two minutes, so I'll let Dan come up here with me,
3201510	3203890	because it was very nice to come here anyway.
3203890	3204870	Dan!
3206030	3207070	Go!
3214700	3216580	Farming. What about farming?
3218940	3221100	Okay, the ITF sucks.
3221100	3224360	They're good guys, the ITF, but they suck.
3224360	3228220	Seriously, how long have they been dragging their feet on DNSSEC right now?
3228760	3232840	15 years? 11 years? You answer that.
3233780	3237640	DNSSEC is an interesting scene.
3237640	3242400	Farming basically gets into the idea of attacking the infrastructure.
3242740	3245080	Really, though, we're already talking about
3245080	3248940	botnets of the size of a quarter million to eventually
3248940	3252620	multi-million infected hosts.
3253060	3256660	The endpoints are getting owned, en masse.
3257080	3260760	There's a thing called the Byzantine problem. You're a Byzantine general,
3260760	3264980	and how do you control your troops when a fairly large portion
3264980	3268440	of them want to turn on you? And there's ways of organizing
3268440	3272960	the networks so that you can go and kill the generals that turn against you and such.
3273160	3276600	There's a critical mass of hosts that if they're
3276600	3278940	on your network and they're bad, you die.
3279380	3285540	I don't know, is it 250,000? Is it a couple million? Is it 50% of your customer base?
3285540	3288560	Eventually, online banking is really going to have to start
3289320	3292420	accepting the possibility that too many of its customers
3292420	3296480	are actually not its customers, but are coming from corrupted hosts.
3296480	3300620	Already, if you go to Kinko's, you will see. They say, please do not use online
3300620	3304460	banking. Or at least they say, please do not use anything with personally sensitive
3304460	3308320	information. This is a result of a case in New York where a Chinese immigrant
3308320	3312580	actually put botnet, or Trojan code, on all of the
3312580	3316760	publicly available hosts. So, there's a couple things that I wanted to say
3316760	3321220	because it's going to be on film and I'm going to be able to say, hey, I totally predicted that.
3322640	3324800	Last year, like I said, the botnet
3324800	3328640	control data, right now, DNS directs you to command and control servers.
3328800	3332400	Eventually, they're just going to put commands in the command and control servers.
3332500	3336100	At the scale of when you have all these machines, they can
3336920	3340760	stop saying, okay, I want you to take everyone on this bank
3340760	3344520	and send money, send all the money. They're going to start doing really intelligent
3344520	3349140	things. When you have multi-million nodes broken into, you can say,
3349140	3352600	huh, let's find everyone who's sending money to everyone
3352600	3356540	else. Let's build a graph and let's find out who are the people who are receiving money from
3356540	3360740	anyone. In other words, all the stuff the bank does to find
3360740	3364820	fraud, the fraud people can use to find targets.
3365560	3368800	So, I want to have your baby. I want to have your baby.
3369360	3372260	So, no, I mean, the canonical
3372260	3376220	attack becomes, okay, I find one guy who receives money from
3376220	3380440	10,000 different people. I put a tax on every transaction
3380440	3384240	of, say, 1%, 10%. I hide the
3384240	3388540	fact that the tax was applied because I control the interface
3388540	3392260	on everyone. The money moves over to the guy. The bank thinks
3392260	3396500	it's normal because the bank's always seeing money move. And the guy never actually
3396500	3400320	gets any extra money because he gets his account drained of the extra
3400320	3404280	money. These are the kind of threats that really happen
3404280	3408160	when every single, you know, when large numbers of endpoints are broken
3408160	3411600	into. And it stops being about a couple thousand here or there.
3412680	3416360	This kind of stuff is going to happen. And, you know, I don't know if you
3416360	3419980	guys know this. The financial network is kind of converging on sending money
3421060	3424240	instantaneously when all of the security stuff is really saying,
3424240	3428280	hey, slow down. We need to check. We need to go back. So, it's a
3428280	3432060	real question. What is going to happen to the speeding up of the
3432060	3436260	financial system? And it's a real, real question. Are we going
3436260	3439940	to be able to do online banking with personal computers in a year and a half?
3439980	3444160	This botnet stuff that Gadi is doing, every day he does what he does
3444160	3447440	is another day we can use online banking. Okay, that's enough.
3448260	3452240	Online banking is one issue, basically. We need to work together. We need
3452240	3456120	to find solutions. We need to get things done. Because we
3456120	3460060	use the internet, no matter who we are. I mean, this sounds like, I want to cure
3460060	3464820	world anger and cancer and all that, but seriously, come on!
3465380	3468120	And with that, I'll take another question and finish because...
3473400	3475780	Yes, I am with the Mossad and I'm going to send quads
3475780	3479780	after you. I do send the quads
3479780	3483580	after them. If you watch the MI6 site, by the way, I just heard it last week,
3483580	3488060	you will actually see that they say, mess with us and we'll mess with you.
3488060	3494200	MI6 people, they're cool. It's not just a newsletter,
3494200	3497640	it's a whole effort of trying to get things done.
3497800	3500200	So, contact me. You have my email address.
3500840	3506180	gadi.sert.gov.il or ge.linuxbox.org. Contact me.
3506180	3510020	Talk to me. We need help. That's it.
3510020	3513240	Thank you. And... fucking Dan Kaminsky!