[00:08.700 --> 00:13.500]  Okay, this is going to be silly. We're about 10 people here, so...
[00:13.500 --> 00:16.160]  Come to me, my children.
[00:19.240 --> 00:20.520]  Or not.
[00:25.320 --> 00:26.640]  Yeah, it's cool.
[00:30.500 --> 00:31.860]  Three, five.
[00:32.940 --> 00:35.720]  One, two. Minus one.
[00:38.080 --> 00:39.940]  Okay, I'm not funny, okay?
[00:42.140 --> 00:42.580]  Um...
[00:55.920 --> 00:56.800]  Okay.
[00:58.860 --> 01:02.360]  I'll start by introducing myself, which is always a good thing.
[01:02.360 --> 01:06.040]  I guess. But before that, I need to ask, was anybody here
[01:06.040 --> 01:08.640]  at my previous lecture a couple of days ago?
[01:10.000 --> 01:13.980]  No. Cool, I can use the same jokes again. No, seriously.
[01:13.980 --> 01:16.820]  I don't have that many jokes. And they're usually bad.
[01:20.780 --> 01:22.780]  What you're going to hear about right now,
[01:22.780 --> 01:25.980]  I'm not really sure what lecture you came to, because...
[01:25.980 --> 01:30.220]  If you know what lecture you came to, because I was just inserted
[01:30.220 --> 01:34.560]  into the schedule. There are some scheduling problems.
[01:36.080 --> 01:39.280]  I'm going to lecture about the survivability of the internet.
[01:40.380 --> 01:41.540]  Woohoo, fun.
[01:41.900 --> 01:44.360]  And I'm going to make some bad jokes.
[01:44.360 --> 01:47.420]  And I'm going to speak about some serious issues.
[01:48.240 --> 01:52.500]  And since there are not that many people here, I'll allow myself to say
[01:52.620 --> 01:53.720]  a lot of shit and fuck.
[01:55.100 --> 01:59.700]  Now, my name.
[02:01.860 --> 02:06.800]  My name is Gadi Evron, and some of you may know me from the internet as an asshole.
[02:07.980 --> 02:10.540]  Others might know me as a nice guy, but not that many.
[02:10.580 --> 02:14.520]  I mean, there are not that many people here, okay? And that's basically it.
[02:15.320 --> 02:18.140]  What is DA? DA is a mailing list.
[02:18.360 --> 02:22.180]  What is MWP? MWP is also a mailing list.
[02:24.760 --> 02:27.420]  Now, we'll start with the boring stuff.
[02:28.780 --> 02:31.040]  Is there actually a threat
[02:31.600 --> 02:34.940]  to the survivability, big word, of the internet today?
[02:35.720 --> 02:37.560]  Now, I don't really expect you to answer me,
[02:37.560 --> 02:42.440]  1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12...
[02:42.440 --> 02:46.000]  There are not that many people, but seriously,
[02:46.000 --> 02:49.760]  does anybody here think there is a problem today with the internet?
[02:52.280 --> 02:56.260]  Cisco gate, okay, cool. Yes, I'll answer it.
[02:56.260 --> 02:59.280]  Yes, there is a problem. Is it called botnets?
[03:00.720 --> 03:03.960]  No. Well, kind of, but no.
[03:03.960 --> 03:07.800]  We'll get to that. Now, I'm jumping
[03:07.800 --> 03:12.140]  right in, skipping a few slides,
[03:12.140 --> 03:16.360]  and what I basically want to talk about, which I'm not going to, is botnets.
[03:17.500 --> 03:20.440]  But, essentially, when you look at the problems
[03:20.440 --> 03:23.660]  of the internet, and you see spyware, you see spam, you see viruses,
[03:23.660 --> 03:27.000]  you see all that shit going around.
[03:27.780 --> 03:31.840]  Why? I mean, seriously, people used to blame everything on hackers,
[03:31.840 --> 03:36.420]  or the bad guys, and that doesn't make any sense
[03:36.420 --> 03:38.440]  to me, really.
[03:41.620 --> 03:43.220]  Boring stuff is,
[03:43.220 --> 03:46.980]  for example, like in any social structure, that's my belief,
[03:46.980 --> 03:50.920]  there are many different kinds of people, duh, and it's not just
[03:50.920 --> 03:54.140]  the bad hacker, the bored employee going back home and
[03:54.840 --> 03:59.400]  doing whatever malicious stuff he wants to do, or she wants to do.
[04:00.020 --> 04:03.880]  There are the kiddies, there's the military,
[04:03.880 --> 04:06.640]  there are the criminals, everybody.
[04:06.640 --> 04:10.600]  Different people. But still, to sustain such a huge amount
[04:10.600 --> 04:14.840]  of bad stuff on the internet, somebody has to get something out of it.
[04:14.960 --> 04:18.440]  I mean, seriously, so much stuff just going out of boredom?
[04:18.680 --> 04:21.760]  I don't think so, and I'll try and prove that.
[04:22.400 --> 04:27.120]  Even though it's not really the point of the presentation. So where is the ROI?
[04:27.120 --> 04:30.680]  Where is the management talk? Return of investment.
[04:31.000 --> 04:34.840]  On investment, sorry. Like I said,
[04:34.840 --> 04:38.940]  social structure. Let's start with the kiddies. Are there any kiddies here?
[04:39.700 --> 04:41.400]  Ah, cool. Hey, kiddy.
[04:42.540 --> 04:47.460]  Kiddy front. Some of you may have read it a couple months ago
[04:47.460 --> 04:51.000]  on Suns maybe, or heard it from a guy called Dan Hubbard.
[04:51.260 --> 04:54.860]  Iframe dollars.biz. Now, generally, whenever
[04:54.860 --> 04:59.500]  I see a .biz domain, I start crying, or scratching, or whatever.
[04:59.560 --> 05:03.180]  Seriously, biz domains are bad. Nearly as bad as CX or WS
[05:03.180 --> 05:07.100]  or whatever else. Seriously, I just see .biz domain and I start crying.
[05:08.240 --> 05:09.380]  Iframe dollars.biz
[05:10.840 --> 05:15.300]  was a business, plain and simple. Some guy said, hey, let's make money
[05:15.300 --> 05:19.720]  off the internet. And you're coming up here, you do know that.
[05:20.760 --> 05:24.320]  Yeah. Dan fucking Kaminsky, people.
[05:24.540 --> 05:25.980]  Dan fucking Kaminsky.
[05:27.920 --> 05:31.360]  Now, oh shit, these are people that actually heard my lecture
[05:31.360 --> 05:34.100]  before. I can't use the same jokes again.
[05:37.180 --> 05:39.300]  Now, iframe dollars.biz basically
[05:39.300 --> 05:42.940]  said, okay, come into my website, take this code
[05:43.620 --> 05:48.060]  iframe, I think it was, and put it on your website.
[05:49.000 --> 05:51.360]  Now, for every first click, every user that goes into
[05:51.360 --> 05:55.180]  your website and installs our spyware, or whatever it was,
[05:55.180 --> 05:59.740]  you'll get money. You won't get a lot of money, you'll get 0.06
[05:59.740 --> 06:02.660]  dollars. Now, they claimed
[06:04.060 --> 06:07.700]  you're eating. Bitch. Okay.
[06:07.700 --> 06:13.840]  They claimed, if I have one more bad pizza,
[06:13.840 --> 06:15.180]  I swear I'll puke.
[06:17.280 --> 06:21.820]  They basically said, look, take this code, put it on your webpage,
[06:21.820 --> 06:25.930]  whenever somebody comes inside, into your webpage, you'll get 0.06
[06:26.660 --> 06:29.820]  dollars, which is cool. Now,
[06:29.820 --> 06:32.880]  they claimed to pay, the week before we saw them,
[06:32.880 --> 06:37.860]  $11,000 for that. Now, that
[06:37.860 --> 06:41.300]  amounts to about 220,000 clicks.
[06:41.680 --> 06:44.960]  Again, they claimed. Now, we actually found
[06:45.820 --> 06:49.940]  their statistics page, and yes, apparently they did pay
[06:51.060 --> 06:53.460]  220,000 people did get
[06:53.460 --> 06:57.800]  firstly installed software on their computers, and they
[06:57.800 --> 07:01.580]  did pay $11,000 to people. Now,
[07:01.580 --> 07:05.820]  11k is a lot of sum, but it's not that much money.
[07:07.640 --> 07:09.840]  Now, there is another guy, I would like
[07:09.840 --> 07:14.260]  to give you as an example, and I don't know how to pronounce his name, or nickname,
[07:14.260 --> 07:17.700]  or whatever we chose to call him. It could be Flowby, it could be Flowby,
[07:17.700 --> 07:22.120]  depending on where you're from. Now, this guy is a botnet controller.
[07:22.420 --> 07:25.640]  Just so we are clear, I'll explain in a couple of lines
[07:25.640 --> 07:29.860]  what I believe a botnet is, and if you think I'm wrong, tough.
[07:31.540 --> 07:32.920]  Trojan horses.
[07:33.420 --> 07:37.720]  We all know what Trojan horses are, I'll repeat anyway, and again, you can argue
[07:37.720 --> 07:41.740]  with me all you like, I don't care. Shut up,
[07:41.740 --> 07:42.400]  Dan.
[07:45.160 --> 07:48.280]  You can't speak if you're not drunk, that's it.
[07:58.280 --> 08:00.020]  Is that beer?
[08:00.720 --> 08:05.620]  No, it's not that.
[08:06.480 --> 08:11.300]  Okay, Flowby was a botnet controller, and again, Trojan horses,
[08:11.300 --> 08:14.960]  let's say it's some sort of software or hardware or whatever,
[08:14.960 --> 08:19.500]  some sort of thingy, that if a user knew what it would do,
[08:19.500 --> 08:23.560]  it would not be so pleased about it, let's put it that way,
[08:23.560 --> 08:26.920]  and it's usually a remotely controlled device or whatever
[08:26.920 --> 08:30.460]  installed on your machine. That was the worst
[08:31.280 --> 08:34.760]  explanation of what a Trojan horse ever gave, or heard,
[08:34.760 --> 08:38.320]  for that matter. Now, you can do whatever you like
[08:38.320 --> 08:43.300]  on a machine where a Trojan horse has been installed. You control that machine.
[08:43.480 --> 08:47.540]  Now, imagine if you had 10 such machines, where you installed Trojan horses.
[08:47.920 --> 08:50.460]  Imagine you had 100, and they were
[08:50.460 --> 08:54.480]  on broadband, of course. Imagine you had 200,
[08:54.480 --> 08:58.540]  1,000, 10,000, 100,000, a million machines,
[08:58.540 --> 09:00.360]  all completely at your control.
[09:01.880 --> 09:06.000]  Well, you would have to control them somehow, and that's basically a botnet,
[09:06.400 --> 09:10.260]  because these drones, bots, whatever,
[09:10.260 --> 09:14.360]  will be reporting to a center point, which is the
[09:14.360 --> 09:18.260]  command and control server. Now, this guy owns
[09:18.260 --> 09:22.320]  many botnets, and on one of the
[09:22.320 --> 09:25.700]  botnets, we can't really prove that, we've seen it happening with many different cases,
[09:25.700 --> 09:27.940]  and it's just very easy for me to give you an example.
[09:30.280 --> 09:33.780]  On one of his botnets, which was 35k large,
[09:33.780 --> 09:37.700]  35,000 bots large,
[09:38.560 --> 09:41.840]  he decided, hey, DDoS is not good enough for me. I don't want
[09:41.840 --> 09:46.140]  to spam, I don't want DDoS, there is a lot of downtime for my bots,
[09:46.140 --> 09:49.220]  and I want to use that downtime. So, basically, what he
[09:49.700 --> 09:53.620]  supposedly did is install a lot of spyware on every single machine.
[09:53.620 --> 09:57.560]  Now, a legal calculation of a page we believe he took the spyware from
[09:57.560 --> 10:01.000]  would mean that he gained about 8k a day
[10:01.500 --> 10:06.020]  from his small botnets. So, that's a kiddie front. 8k, 11k,
[10:06.020 --> 10:09.700]  whatever. Now, the big picture.
[10:10.560 --> 10:13.500]  We don't really know what the big picture is.
[10:13.700 --> 10:17.020]  Seriously. We do not see what's happening.
[10:17.700 --> 10:21.460]  And this is DEF CON, I don't need to explain it to you, because half the lectures here were about
[10:21.460 --> 10:26.080]  conspiracy theories and how the government is spying on us and all that.
[10:27.000 --> 10:29.420]  But we can see some of that.
[10:29.840 --> 10:32.940]  It's in plain sight, it's public.
[10:33.740 --> 10:36.940]  And between a lot of beers, you might actually notice it.
[10:37.820 --> 10:40.540]  I was just looking at you, I didn't mean anything by that.
[10:40.640 --> 10:45.380]  There's plain sight spying by government? Yes. Now, when you see
[10:45.380 --> 10:49.220]  phishing, which is in plain sight, he's a little bit drunk,
[10:49.220 --> 10:52.640]  or I'm just not very well understood, which is possible.
[10:53.200 --> 10:54.180]  Or likely.
[10:56.100 --> 11:01.140]  You're not implying governments are running legitimate botnets by putting spyware
[11:01.140 --> 11:04.900]  on people's machines? You're on to me. I work for the government, you know.
[11:05.880 --> 11:09.040]  Okay. Now, phishing, seriously, phishing gives us
[11:09.260 --> 11:13.020]  a very, very good picture of what's going on. Phishing is public,
[11:13.020 --> 11:17.660]  you get it in your inbox, you can go to the sites, you see what's going on, which is great.
[11:17.660 --> 11:21.700]  And we can actually see the amounts of money that goes into it, and I'll show you
[11:21.700 --> 11:25.540]  in a minute. And then there are a few minor
[11:25.540 --> 11:29.920]  details, such as, for example, the Trojan Horse industrial espionage case,
[11:29.920 --> 11:33.760]  where there were some private investigation companies and some
[11:34.560 --> 11:38.380]  very rich companies that wanted to spy on their competition.
[11:39.420 --> 11:41.680]  So basically, as far as I understand,
[11:41.680 --> 11:45.800]  they paid 17k UK pounds, or 13k
[11:45.800 --> 11:50.520]  UK pounds a month, per computer. Which is a lot of money.
[11:50.580 --> 11:53.880]  So there are things going on behind the scenes. Some of them we can actually
[11:53.880 --> 11:57.760]  prove because we hear about one or two every year. But let's actually look
[11:57.760 --> 12:01.840]  at what we can see day-to-day. The APWG,
[12:01.840 --> 12:05.480]  the Anti-Phishing Working Group, says they saw over
[12:06.460 --> 12:10.540]  13k unique phishing emails in March 2005 alone.
[12:10.540 --> 12:13.640]  And thousands of phishing sites. Woohoo!
[12:13.640 --> 12:17.640]  Now, people usually say, and I'm going to be kind of...
[12:18.400 --> 12:21.620]  Okay, we all know this. These guys, they sent
[12:21.620 --> 12:25.480]  so many millions of spam messages out. And then just
[12:25.480 --> 12:28.440]  one person clicks on it and fills the details in.
[12:29.400 --> 12:33.680]  Well, one person clicking and filling in the details is a clear cut
[12:33.680 --> 12:37.280]  return on investment because email doesn't cost money.
[12:37.580 --> 12:41.400]  We all know that, but it's very important to reiterate
[12:41.400 --> 12:45.300]  that issue. Now, let's give some statistics.
[12:45.440 --> 12:48.680]  In Germany, for example, every phishing attempt
[12:49.340 --> 12:53.540]  2,000 people fill in their details. Now, that
[12:53.540 --> 12:56.960]  number keeps rising. It's not just one stupid guy.
[12:57.180 --> 13:01.420]  There's a lot of stupid people out there. Now, of them,
[13:01.420 --> 13:05.040]  about six do not get their money back. And that's because the banks are very good
[13:05.040 --> 13:09.420]  at moving money around. Money is stolen, no problem.
[13:09.420 --> 13:14.080]  But six do not get their money back. Or rather, the banks have to cover it.
[13:14.680 --> 13:17.160]  Now, on average, that amounts to about
[13:17.800 --> 13:21.400]  6K euro lost per person.
[13:22.040 --> 13:25.680]  36K euro for every attack. Now, per year,
[13:25.680 --> 13:30.100]  that's 1.2 million euros. And that's just for one group.
[13:30.100 --> 13:33.540]  Each group's attacks are used to attack once every eight days. Now, they do
[13:33.540 --> 13:37.320]  it a lot more often. Quite a few groups out there.
[13:37.320 --> 13:41.040]  Can anybody see the ROI yet? The return on investment?
[13:41.840 --> 13:45.240]  There is a lot of money going into this. Now, the Russian mob,
[13:45.240 --> 13:49.460]  and I have to say this again, I always say it in my lectures, I have nothing against
[13:49.460 --> 13:53.480]  Russians. Seriously. I had a girlfriend who was
[13:53.480 --> 13:57.720]  Russian. But really, nothing against Russians.
[13:58.360 --> 14:01.520]  But most of this stuff, there are a lot of small operators
[14:01.520 --> 14:05.140]  out there in Eastern Europe, in Brazil, all around the world.
[14:05.140 --> 14:10.220]  But most of this stuff comes from the Russian mob. Clearly, from the Russian mob.
[14:10.300 --> 14:13.860]  I'll say it again. Hold on.
[14:14.920 --> 14:17.160]  Hold on. I'll answer
[14:17.160 --> 14:20.660]  every question, and if not, hey, I'm on tape.
[14:22.100 --> 14:25.180]  The Russian mob sees the return on investment.
[14:25.860 --> 14:28.880]  Okay? Cool.
[14:29.140 --> 14:33.280]  And they actually invest in the technological and operational
[14:33.280 --> 14:37.340]  capabilities over time. There are people sitting here who actually
[14:37.340 --> 14:41.400]  watch the binaries and the samples, and can tell you how they evolve over
[14:41.400 --> 14:45.260]  time. Now, many of these kitties just, like I said,
[14:45.260 --> 14:48.540]  it's social structure. It's not all the Russian mob.
[14:49.120 --> 14:51.880]  Many of these kitties just trade it like candies.
[14:52.300 --> 14:57.340]  And most of these trojan horses, or bots, or whatever,
[14:57.340 --> 15:01.460]  are just the same code, ripped from one another over and over
[15:01.460 --> 15:05.460]  and over again. But still, it's important
[15:05.460 --> 15:09.960]  to note that, and I'll give you an example. Here in the States,
[15:10.500 --> 15:13.240]  this just came out a few months ago,
[15:13.240 --> 15:17.900]  here in the States, there was a phishing attempt. It's a phishing attack, actually.
[15:20.440 --> 15:21.560]  And somebody's account
[15:21.560 --> 15:26.300]  got emptied in a branch of the bank on the West Coast.
[15:27.780 --> 15:29.960]  Now, a week later,
[15:30.060 --> 15:33.640]  a FedEx box came in, carrying a fake check,
[15:33.640 --> 15:37.140]  which is what actually got people to look into it,
[15:37.140 --> 15:40.080]  to refill their account so they can empty it again.
[15:41.240 --> 15:45.780]  Shut up! So basically, you'll get to lecture in a minute,
[15:45.780 --> 15:49.340]  so don't disturb. You're not allowed.
[15:49.340 --> 15:50.340]  You're not drunk.
[15:57.050 --> 15:58.910]  I'm very happy that you came.
[16:03.380 --> 16:05.660]  Now, I really am happy
[16:05.660 --> 16:09.980]  that you came. Basically,
[16:09.980 --> 16:12.980]  what that means, people, this is not cyberspace anymore.
[16:13.600 --> 16:18.020]  This is meatspace. This is happening right here, right now,
[16:18.020 --> 16:20.660]  with real people, and real money.
[16:21.760 --> 16:23.980]  That's critical to what I'm going to talk about.
[16:25.080 --> 16:29.960]  Now, in the UK, for the last example, the losses are also significant.
[16:31.420 --> 16:34.320]  1.4... 1 to 4, I'm sorry, million pounds a month
[16:34.320 --> 16:37.420]  in losses, just at the beginning of this year.
[16:37.660 --> 16:40.220]  And it jumped by 1 million every month.
[16:41.060 --> 16:45.540]  December, January, February, March, it got to 4 million pounds lost.
[16:45.540 --> 16:48.640]  Now, don't take my word on these numbers. You won't find them anywhere.
[16:48.760 --> 16:52.820]  As far as you're concerned, I'm lying, because I'm not going to prove it to you.
[16:52.820 --> 16:56.700]  And anything I'm not going to prove, just believe I'm lying. But these numbers are true.
[16:57.160 --> 17:01.260]  Now, this is by... I'm lying. No, this is by phishing alone.
[17:02.920 --> 17:05.040]  There is a lot of money in this. I'm saying it again.
[17:05.040 --> 17:07.500]  I'm repeating myself, and there is a reason for that.
[17:08.580 --> 17:11.260]  In the US, the story is a bit different.
[17:11.920 --> 17:17.080]  One bank, they say they used to see about 200 victims per scam.
[17:17.240 --> 17:19.280]  Today they say they see about 5.
[17:20.040 --> 17:24.600]  But come on, people. Banks, at least in the United States,
[17:24.600 --> 17:26.720]  in the UK, they can't, as far as I know.
[17:26.860 --> 17:31.040]  They have a legitimate reason to actually try and underplay the problem.
[17:32.140 --> 17:35.200]  I mean, do you have any idea? I don't have any idea, by the way.
[17:35.200 --> 17:39.800]  Do you have any idea how much of all their business goes online?
[17:41.500 --> 17:44.240]  How much of any business today goes online?
[17:45.120 --> 17:47.540]  Depending on the bank, it could be 50-60%.
[17:52.050 --> 17:52.850]  Everything.
[17:52.850 --> 17:53.910]  Everything.
[17:56.670 --> 18:00.390]  Again, I don't have hard numbers, and it changes drastically from bank to bank.
[18:00.390 --> 18:01.950]  I don't want to talk about it.
[18:05.030 --> 18:15.340]  What? I really want to answer that. I honestly don't have time.
[18:15.940 --> 18:19.800]  I know I'm kind of weeny for saying that, but I honestly don't have time.
[18:19.920 --> 18:20.660]  Sorry.
[18:21.820 --> 18:26.880]  Other banks are actually reporting losses of around $10-20 million.
[18:26.880 --> 18:31.000]  Again, don't take my word for it. The Germany numbers, I can sign on.
[18:31.880 --> 18:33.800]  And they're not anywhere you can find.
[18:34.460 --> 18:38.500]  Now, the problem is not botnets. Again, I didn't really want to make this a botnet lecture,
[18:38.500 --> 18:41.780]  although I can't speak about botnets for hours on end.
[18:42.560 --> 18:45.940]  Botnets is a very serious symptom.
[18:47.220 --> 18:49.440]  A very, very serious symptom. It's a problem.
[18:49.440 --> 18:53.340]  Actually, I keep using the same jokes. You were in my last lecture, you bitch.
[18:53.340 --> 18:56.280]  Why were you in my last lecture? I can't reuse jokes.
[18:57.800 --> 18:59.640]  You were hoping it would be funnier.
[19:03.200 --> 19:04.980]  I know where you live.
[19:06.500 --> 19:10.380]  Okay, I don't. I can find out.
[19:13.320 --> 19:14.200]  Dan?
[19:18.440 --> 19:20.620]  The Mossad! The Mossad!
[19:22.720 --> 19:24.840]  I was just at Cisco the other day,
[19:24.840 --> 19:28.120]  and they gave, like, name tags that stick on your shirt.
[19:28.560 --> 19:32.920]  Now, I don't know who told them and what the fuck they thought they were doing,
[19:32.920 --> 19:36.200]  but I don't work in Israeli government security.
[19:36.220 --> 19:41.040]  But I said, Israeli government security. I immediately photocopied it.
[19:42.080 --> 19:45.220]  Asked for another one. Put it in my pocket.
[19:45.220 --> 19:48.680]  That's so great. I'm for the Mossad. Watch out.
[19:48.680 --> 19:50.200]  I'll send people after you.
[19:50.720 --> 19:56.360]  Okay, I don't have time. The problem is not botnets.
[19:56.360 --> 20:01.580]  Botnets are a very serious symptom. What I'm trying to say is botnets are a serious problem.
[20:01.580 --> 20:04.800]  I can tell you that from our limited view,
[20:04.800 --> 20:07.860]  and we see quite a bit, but again, we don't see everything.
[20:09.180 --> 20:12.240]  We have 4,000...
[20:14.040 --> 20:16.520]  4K botnets out there.
[20:16.520 --> 20:18.100]  Since the beginning of this year.
[20:18.280 --> 20:21.360]  And that's just a little bit.
[20:21.820 --> 20:24.860]  I mean, people keep looking at the bot itself.
[20:27.380 --> 20:31.240]  And they keep asking me, how many bots are out there?
[20:32.260 --> 20:34.180]  And you know what? I don't give a shit.
[20:34.180 --> 20:36.440]  Seriously, I don't care how many bots are out there.
[20:36.580 --> 20:41.960]  Some people might have to care, but I don't, and I'll explain why in a few minutes.
[20:43.140 --> 20:47.080]  Now, okay, I'll explain why now, actually.
[20:47.240 --> 20:48.660]  And waste some time.
[20:52.880 --> 20:56.220]  Why... you people who live in the United States, or most of you do,
[20:56.560 --> 21:00.680]  you know about this thingy of asking,
[21:00.680 --> 21:04.940]  why be able to destroy the world a thousand times over when once is more than enough?
[21:05.360 --> 21:08.100]  Right? Well, botnets on the internet are
[21:08.100 --> 21:12.360]  strategic warfare. They are nuclear weapons.
[21:12.360 --> 21:16.380]  And the amounts and numbers out there
[21:16.380 --> 21:20.360]  are unbelievable. And I can tell you that we've actually seen
[21:22.520 --> 21:23.840]  a 350k botnet.
[21:24.760 --> 21:27.940]  And it wasn't the only one. It's just the best example I have.
[21:28.280 --> 21:32.400]  A few months ago. Now, when you have
[21:33.220 --> 21:36.200]  that big of a botnet at your control,
[21:36.200 --> 21:38.380]  you can do pretty much anything on the internet.
[21:40.100 --> 21:42.940]  Now, I'll continue with that in a minute,
[21:42.940 --> 21:46.380]  but really, looking at the botnet as a problem, a botnet itself,
[21:46.920 --> 21:50.940]  the network, install some bots separately,
[21:50.940 --> 21:54.520]  is what I'm talking about. Now, the philosophy of the problem,
[21:54.520 --> 21:58.020]  why I'm looking at botnets as a symptom... okay, I can't say problem, seriously.
[21:58.020 --> 22:01.560]  This is a joke I must reuse. I'm sorry. It's not really a joke.
[22:01.760 --> 22:05.380]  I was sitting with a guy from Adobe, or my boss was, I don't really remember.
[22:05.380 --> 22:09.760]  I reuse jokes all the time. And the guy would refuse for two hours
[22:09.760 --> 22:13.660]  to say the word problem. He would say challenges.
[22:13.880 --> 22:17.240]  For two whole hours, I just heard, or he heard,
[22:17.240 --> 22:21.640]  challenges, challenges. And now they changed it. You're supposed to say
[22:21.640 --> 22:25.660]  opportunity, opportunity. Anyway, so there are several challenges.
[22:26.360 --> 22:27.780]  Let me get to the point.
[22:29.280 --> 22:33.620]  If I'm saying botnets are strategic warfare on the internet,
[22:33.620 --> 22:35.940]  I mean, everybody knows what DDoS is.
[22:38.960 --> 22:41.000]  Why say they're just a symptom?
[22:41.880 --> 22:45.220]  Let's start a bit about our philosophy of the problem.
[22:45.660 --> 22:48.620]  The internet. Photon monoculture.
[22:49.620 --> 22:53.060]  We all, I mean, whether we like it or not, most of us use Windows.
[22:53.060 --> 22:57.100]  And I'm not talking about the home computer. At work, most of us use Windows.
[22:57.200 --> 23:01.520]  Everywhere, it's Windows. And that makes us extremely susceptible
[23:01.520 --> 23:02.900]  to attacks.
[23:04.780 --> 23:09.820]  And I don't have time to talk about that anymore, but just think about it. I'll waste some time later.
[23:12.000 --> 23:13.080]  Now,
[23:13.080 --> 23:16.920]  one bug, or one patch, can bring us down.
[23:17.640 --> 23:21.820]  Repeating past mistakes. When we left the
[23:21.820 --> 23:25.520]  world of the mainframes,
[23:26.120 --> 23:30.060]  OS development somehow sinked down to a new level.
[23:30.060 --> 23:33.440]  And just now we are starting to reach the level of where we were
[23:34.060 --> 23:37.380]  with the mainframe in OS development.
[23:37.800 --> 23:42.820]  And I can actually see it as a pattern of things actually repeating themselves non-stop.
[23:43.840 --> 23:46.060]  The PC wasn't the end of it.
[23:46.060 --> 23:49.700]  For example, cell phones. Everything is in default.
[23:50.140 --> 23:54.140]  You can't disable anything. Everything is in automatic. Java, browsers,
[23:54.140 --> 23:57.980]  whatever. Unbelievable. We keep repeating the same mistakes
[23:57.980 --> 24:02.320]  over and over again. And that brings me to Killing Fires.
[24:03.620 --> 24:05.900]  And before I reach Killing Fires, I would like to discuss
[24:05.900 --> 24:10.280]  the problems of the internet. We'll get to KC and who she is
[24:10.280 --> 24:13.960]  in a minute, but everybody keeps saying at the end of the year
[24:13.960 --> 24:17.960]  companies like Symantec, they do a great job, but they come out and say something like
[24:18.440 --> 24:22.200]  look, these are the problems that we are going to face in the year of 2005.
[24:23.200 --> 24:26.080]  Okay, great. How do you know that?
[24:26.080 --> 24:29.700]  Well, we have looked at our past agendas and logs and histories
[24:29.700 --> 24:33.020]  and we can tell you what we believe the issues are going to be.
[24:33.700 --> 24:36.280]  Okay, so basically F of that is what happened last year.
[24:37.220 --> 24:40.460]  Almost another F is what you believe is going to happen, therefore you're
[24:41.440 --> 24:46.020]  self-prophesying or whatever you call it, that it will happen and some of it will happen.
[24:46.020 --> 24:49.680]  And some of this stuff will actually surprise you, because you can't know
[24:49.680 --> 24:52.500]  what everything that's going to surprise you is going to be.
[24:52.500 --> 24:56.500]  And I'm saying something different. The problems are out there
[24:56.500 --> 25:01.060]  and we know about them for many years now. Many years.
[25:01.520 --> 25:05.080]  Let's take for example spam. Are you interested in my talk at all?
[25:05.080 --> 25:08.540]  I am. You are? I believe you.
[25:08.540 --> 25:11.560]  Okay, David fucking Kaminski everybody.
[25:13.380 --> 25:16.200]  Not drunk for the first time on video.
[25:19.320 --> 25:19.820]  Now...
[25:23.080 --> 25:23.960]  Yeah.
[25:24.780 --> 25:27.200]  I'm trying to remember what the fuck I was talking about.
[25:27.300 --> 25:30.400]  Predictions. Thank you, bitch.
[25:33.100 --> 25:34.600]  I love this guy.
[25:35.940 --> 25:39.660]  But he gave me such hell when I asked him to come and help me in my lecture.
[25:41.040 --> 25:43.160]  Yeah, but I don't need you now.
[25:44.320 --> 25:46.580]  Yeah, I'm going to talk now.
[25:52.270 --> 25:54.490]  Yeah, I'll tell you about the superbugs in a minute.
[25:56.130 --> 25:57.830]  I'm still wasting time.
[26:00.570 --> 26:02.490]  What was I talking about? No, seriously.
[26:03.110 --> 26:07.950]  Predictions. So basically, the problems have been around for many, many years now.
[26:07.950 --> 26:11.310]  Let's take spam as an example. Yes, tell them we love them.
[26:12.390 --> 26:15.210]  I want that phone later on. It's mine now.
[26:16.290 --> 26:19.470]  The problems of the internet have been around for many years now. Let's take spam.
[26:19.470 --> 26:23.610]  I'm going to completely ruin the history of spam. In the last lecture I met, there was a guy
[26:23.610 --> 26:26.910]  from SpamHouse here and he wanted to kill me, but it's cool.
[26:28.330 --> 26:31.490]  First, we didn't really care about spam. Seriously.
[26:32.350 --> 26:35.630]  It's just some emails you get eventually, here and there,
[26:35.630 --> 26:39.130]  once a day, and you found a good solution for it too.
[26:39.230 --> 26:43.770]  JHD. Just hit delete. And it worked. And then it got a little bit more annoying
[26:43.770 --> 26:47.750]  as somebody started working on it, but nobody really cared. Nobody wanted to put the money
[26:47.750 --> 26:51.250]  into it to get rid of the business, or at least try to.
[26:51.570 --> 26:55.850]  And then it got to be a problem. Then everybody started caring about it.
[26:57.750 --> 26:59.830]  And then I started finding solutions.
[27:00.590 --> 27:03.800]  And like any human society, anywhere,
[27:04.330 --> 27:07.710]  they said, I have to be elected into office. I mean, this is not really it,
[27:07.710 --> 27:11.070]  but seriously, long-term solutions are not part of the business here.
[27:11.230 --> 27:15.950]  It's part of our culture. We have to kill this fire called spam right now.
[27:17.430 --> 27:19.830]  So we will invest some money,
[27:19.830 --> 27:22.930]  and come up with a solution that will kill the fire right now.
[27:23.110 --> 27:26.790]  That solution was, for example, Bayesian filters,
[27:26.790 --> 27:31.630]  or F-ass Bayesian filters. And if we see, for example,
[27:31.630 --> 27:35.890]  Viagra in one instead of an I,
[27:35.890 --> 27:39.850]  all these evasion techniques that bad guys came up with, that's cool.
[27:40.130 --> 27:43.330]  I mean, seriously, use some F-ass Bayesian filters
[27:43.330 --> 27:46.310]  that bad guys learned and started using one instead of I.
[27:46.910 --> 27:51.290]  Then I started using mail relays. Again, it could have been the other way,
[27:51.290 --> 27:55.730]  but I don't really care right now. And we started using blacklists, like maps.
[27:57.070 --> 27:58.890]  And then I started using zombies,
[27:58.890 --> 28:03.170]  and they can email from all over the world. Anytime we actually kill the fire
[28:03.170 --> 28:07.390]  right now, get rid of this problem right now, what we actually accomplished
[28:07.390 --> 28:11.050]  was, hey, we are teaching the bad guys.
[28:11.050 --> 28:15.130]  We are educating them. We are throwing them into
[28:15.130 --> 28:18.930]  an evolutionary route that we are not choosing. We are making things worse.
[28:19.310 --> 28:22.890]  And I can tell you it's the same with botnets. It's the same everywhere, and that's what
[28:22.890 --> 28:27.130]  brings me to the superbugs theory. Now, superbugs is not a new
[28:27.130 --> 28:30.390]  theory. I mean, doctors really liked antibiotics.
[28:31.350 --> 28:35.670]  You had a flu? The flu, they gave you antibiotics. You had a cold?
[28:36.050 --> 28:39.150]  They gave you antibiotics. And what they actually
[28:39.150 --> 28:40.570]  did was create some sort of
[28:46.870 --> 28:47.270]  stronger
[28:47.270 --> 28:50.630]  bugs that could resist antibiotics.
[28:51.110 --> 28:55.150]  And they kept doing it. And that brings me back
[28:55.150 --> 28:59.010]  to monoculture. Everything is windows. And we keep just
[28:59.010 --> 29:03.370]  ignoring the problems that are out there for years, and I can give you a list of problems
[29:03.370 --> 29:07.010]  and I'll get to that in a second. And I've been out there and it's getting worse.
[29:07.010 --> 29:10.990]  And eventually they get so bad that we have to kill them right now. And every time we do something like that,
[29:10.990 --> 29:15.170]  no matter if it's terrorism, no matter if it's botnets, no matter if it's spam,
[29:15.170 --> 29:18.990]  we just kill the problem right now. I'm repeating myself, I know, but it's important
[29:18.990 --> 29:22.270]  to me. And make it worse. Educate the bad guy.
[29:23.650 --> 29:27.430]  So the superbugs theory is where I wanted to get to.
[29:27.770 --> 29:30.010]  And that's why botnets are not really the problem now.
[29:30.910 --> 29:34.890]  Who is the enemy? I keep speaking of
[29:34.890 --> 29:39.810]  there are bad guys out there. FUD, I'm not giving any facts.
[29:40.030 --> 29:43.350]  Well, it used to be a rival or an opponent
[29:43.350 --> 29:46.970]  really, not really an enemy. Because, I'll give you an example
[29:46.970 --> 29:51.030]  from the dynamic DNS providers. Dynamic DNS providers
[29:51.030 --> 29:55.150]  are really, really good for the bad guys. They can run
[29:55.150 --> 29:59.090]  botnets using DNS really easily. They tell all the bad
[29:59.090 --> 30:02.910]  bots, connect that address. Then when somebody
[30:02.910 --> 30:07.150]  kills the server, because that's how you deal with the botnet, you kill the command and control server
[30:07.150 --> 30:10.970]  which is bad, because then the bad guy just moves up to another server
[30:10.970 --> 30:15.110]  and starts investigating and educating themselves and getting to be better at it.
[30:15.110 --> 30:18.390]  Again, superbugs. But basically, when
[30:19.050 --> 30:22.990]  dynamic DNS providers are perfect for them. They go online, they open a new
[30:22.990 --> 30:25.410]  account, they get some free DNS
[30:27.030 --> 30:30.190]  free domains, free whatever, and
[30:30.190 --> 30:34.270]  just point the botnet over there. That's
[30:34.270 --> 30:37.270]  basically how it works. The dynamic DNS providers
[30:39.090 --> 30:42.230]  really suffer. Because imagine
[30:42.230 --> 30:45.590]  100,000 bots, and bots are not very nice
[30:45.590 --> 30:49.670]  internet users
[30:50.590 --> 30:54.230]  losers. They just keep asking the same question. How do I
[30:54.230 --> 30:56.950]  connect over there? Where is that A record?
[30:57.850 --> 31:01.270]  And they really weigh down on the dynamic DNS providers.
[31:01.530 --> 31:04.950]  The dynamic DNS provider says, okay, this is the botnet, it's in breach of my
[31:04.950 --> 31:08.890]  acceptable use policy. I will map this botnet
[31:08.890 --> 31:12.490]  address to 1918 addresses, localhost, whatever.
[31:12.970 --> 31:17.370]  And that's acceptable to the bad guy, because it says, hey, I abused the service, but I need it again.
[31:17.390 --> 31:20.930]  They found me out, I'll just use it again,
[31:20.930 --> 31:24.830]  re-register. Now what if the dynamic DNS provider says, I'm sick of it.
[31:24.830 --> 31:29.650]  I mean, so far they've been contesting for the same resources, they live in the same realm,
[31:29.650 --> 31:33.370]  but don't really come to combat, open combat.
[31:33.430 --> 31:37.490]  But what if the dynamic DNS provider says, I'll sinkhole the botnet.
[31:37.630 --> 31:40.910]  I'll kill the botnet, I'll take the botnet away from the bad guy.
[31:41.070 --> 31:44.510]  The bad guy gets pissed. And then it's open warfare.
[31:44.910 --> 31:48.810]  You will DDoS the dynamic DNS provider to hell, and that makes it an enemy.
[31:49.490 --> 31:52.830]  And why I wanted to stick to this point for a minute, which is not really
[31:52.830 --> 31:56.390]  related to the lecture, is because this is an enemy to the infrastructure.
[31:56.390 --> 32:00.450]  And when I try to think about who the hell owns the internet,
[32:00.450 --> 32:04.470]  and I'm not talking about owning the internet as in who runs the internet,
[32:04.470 --> 32:09.510]  but who are the stakeholders? Seriously, who cares if the infrastructure survives?
[32:10.210 --> 32:13.770]  And I try a lot, and I can't really find the people yet,
[32:13.770 --> 32:16.510]  but the infrastructure
[32:16.510 --> 32:20.970]  is at a serious risk. I don't care if somebody is a black hat, if somebody is a white hat,
[32:20.970 --> 32:24.990]  if somebody is a grey hat. Whatever you do at home, whatever you
[32:24.990 --> 32:28.930]  have fun with, that's cool. But when you go out and
[32:28.930 --> 32:33.010]  take money from Granny Jane, or when you go out
[32:33.010 --> 32:37.330]  and try to DDoS the internet to hell, you're not a nice netizen,
[32:37.330 --> 32:41.370]  and over more, you're pretty much, you're not a black hat, you're an idiot.
[32:42.570 --> 32:44.430]  And your idiocy is pretty much
[32:44.900 --> 32:48.970]  what's going to cause the internet to go to hell. And that's FUD.
[32:48.970 --> 32:53.090]  That's fear, uncertainty, and doubt. And I didn't want to say that
[32:53.090 --> 32:54.710]  until I could give you some facts.
[32:57.030 --> 32:59.190]  What do we do about it today?
[33:06.330 --> 33:09.530]  It could be tens of thousands of dollars a week, it could be millions,
[33:09.530 --> 33:10.770]  it depends on who you are.
[33:18.980 --> 33:22.900]  The question was, why are you relying on DynDNS for something that is critical to your
[33:22.900 --> 33:26.900]  infrastructure when you make millions? You don't rely only on DynDNS,
[33:26.900 --> 33:30.060]  but I don't have time to cover it right now, but just think about
[33:30.840 --> 33:35.600]  why do botnets use IRC? Seriously, why use IRC?
[33:35.680 --> 33:37.160]  It's perfect for them.
[33:38.060 --> 33:41.420]  I mean, I don't have time to cover it because this is not a botnet lecture right now,
[33:41.420 --> 33:45.540]  but something does not have to be extremely complicated to be good.
[33:47.810 --> 33:50.710]  Although, damn, fucking Kaminsky is not drunk to answer that.
[33:52.130 --> 33:54.010]  Ignore everything I just said, please.
[33:54.010 --> 33:58.030]  There needs to be legitimate services that are using
[33:58.030 --> 34:02.090]  that particular host that it would be a problem if you just killed
[34:02.090 --> 34:05.790]  it entirely. If you go ahead and you put a colo somewhere and it's the
[34:05.790 --> 34:10.030]  CNC and it's the DNS and so on, pull the plug on it and you've just
[34:10.030 --> 34:14.150]  killed illegitimate services. The idea is to mix the illegitimate
[34:14.150 --> 34:18.070]  botnet with the legitimate dynamic DNS and that's why they do it.
[34:18.330 --> 34:21.910]  Amen to that. Next issue. And thank you to Dan Kaminsky.
[34:21.910 --> 34:24.610]  He's not drunk. I'm sorry, Dan fucking Kaminsky.
[34:25.330 --> 34:32.760]  He calls me God, he fucking Ron. Come on. Hold on, we'll get to that.
[34:34.500 --> 34:36.300]  Now, what
[34:36.300 --> 34:38.100]  do we actually do about it today?
[34:39.700 --> 34:45.240]  First of all, there are vendors. Anti-virus vendors, anti-spam vendors,
[34:45.240 --> 34:47.980]  let's even say ISPs. Vendors.
[34:47.980 --> 34:51.680]  A lot of vendors who try to give you solutions. Then there are more vendors
[34:51.680 --> 34:55.780]  who try to sell you stuff. Some of them do good shit. Seriously,
[34:55.780 --> 34:59.700]  there are companies such as Message Labs, Maps, Spam House. Companies
[34:59.700 --> 35:03.200]  that really do good for the internet. They're still vendors.
[35:03.780 --> 35:07.880]  And they look at their small way of making money and if they can do good with it,
[35:07.880 --> 35:11.780]  that's cool. Then we have research funds. Research in general
[35:11.780 --> 35:15.820]  such as the NSF, Army, Navy, DARPA, whatever.
[35:16.700 --> 35:20.100]  Then there is symptom-based response. For example,
[35:20.100 --> 35:23.580]  hand-spam. The FTC recently came up with
[35:24.100 --> 35:28.500]  something that they claim will report to every ISP.
[35:28.980 --> 35:32.240]  It will report to ISP the bots. Again, the bots are not the problem
[35:32.240 --> 35:36.140]  as far as I'm concerned. And any infected machine will have 10 more
[35:36.140 --> 35:40.500]  bots on it, at least. The botnets are the problem.
[35:40.500 --> 35:44.140]  But say they will report the bots. So what they
[35:44.140 --> 35:47.720]  do is look at emails, spam emails, and find the zombies
[35:47.720 --> 35:51.360]  that send them. Now, out of all the numbers
[35:51.360 --> 35:55.320]  of all the drones and bots out there, how many of them send spam?
[35:56.360 --> 35:59.140]  A lot, but not quite that many from the whole
[35:59.700 --> 36:03.180]  of the entire botnet population.
[36:03.760 --> 36:07.760]  Now here I have to discuss the botnet population. How many bots are actually out there?
[36:08.160 --> 36:11.960]  Because that's what people keep asking me. So I'll make this quick.
[36:11.960 --> 36:15.800]  I don't really give a shit. As I said, if you can destroy the world a thousand
[36:15.800 --> 36:20.280]  times over, why the hell would you care if you can do it just once?
[36:21.080 --> 36:23.920]  And that's what botnets are. But if I have to answer
[36:23.920 --> 36:27.480]  the question, I'll discuss research that has been happening
[36:27.480 --> 36:30.240]  unrelated for quite some time now.
[36:31.540 --> 36:35.480]  How often, or how soon, when you start scanning the internet
[36:35.480 --> 36:38.900]  when you put the machine on the internet, will it get scanned?
[36:39.440 --> 36:43.920]  A few years ago, to put the machine on the internet, it got scanned 36 hours
[36:43.920 --> 36:47.960]  after that. A couple of years ago, I checked, and depending
[36:47.960 --> 36:51.780]  on the ISP I checked on, I got scanned once every two seconds
[36:51.780 --> 36:55.840]  to once every 20 minutes. Kevin Mitnick, I believe,
[36:55.840 --> 37:00.560]  made some check and got around the same conclusions. On the site in SANS,
[37:00.560 --> 37:03.460]  internet survivability time is about 20 minutes or something like that. It keeps
[37:03.460 --> 37:07.860]  coming up and down. So basically, say it's not every two seconds
[37:07.860 --> 37:11.820]  like in my house. Say you actually get scanned for
[37:11.820 --> 37:15.760]  the easy vulnerabilities automatically by viruses, worms,
[37:15.760 --> 37:20.040]  whatever you want to call them right now, hacking tools, every 20 minutes
[37:20.040 --> 37:23.740]  once. Now, on broadband
[37:25.800 --> 37:28.700]  providers, out of all their clients,
[37:28.700 --> 37:31.720]  how many would be easily exploitable?
[37:33.000 --> 37:35.940]  Now, when you get to the potential population of that,
[37:36.540 --> 37:39.820]  and how many bots you can get installed on one machine,
[37:41.000 --> 37:43.820]  because basically I count the bots as how many
[37:43.820 --> 37:47.860]  samples are installed or working on each machine per IP address
[37:47.860 --> 37:51.040]  per machine, you get a huge number.
[37:52.740 --> 37:55.740]  Now, if you wanted to count it
[37:55.740 --> 38:00.300]  in another way, say you sync all the botnets, and that's not my research, that's somebody else's.
[38:00.400 --> 38:03.900]  Say you found botnets and you followed them, and you checked and saw
[38:03.900 --> 38:07.800]  that several botnets have the same IP addresses coming back
[38:07.800 --> 38:11.520]  again, there are time of day issues, DHCP issues,
[38:11.520 --> 38:15.640]  sometimes you see a Linux machine and then it's a Windows machine, but
[38:15.640 --> 38:19.600]  you actually see IP addresses returning.
[38:19.880 --> 38:23.780]  If you take that cut between the different groups,
[38:23.780 --> 38:27.900]  you may try and get to the point where you see the entire omega.
[38:27.900 --> 38:30.700]  This is David Duggan's research at Georgia Tech.
[38:32.500 --> 38:35.880]  He says, by the limited research
[38:35.880 --> 38:38.560]  he has done, he has seen about 20 million bots.
[38:40.020 --> 38:43.880]  That's nothing. If I had to give a number or just
[38:43.880 --> 38:47.920]  say 40 million, but that's nothing, people. Seriously.
[38:48.080 --> 38:51.660]  And why would I care about the number?
[38:53.680 --> 38:55.960]  Now, sorry, I had to give
[38:56.220 --> 39:00.000]  a terrible response to this if I didn't explain myself
[39:00.000 --> 39:02.000]  correctly, because it's critical.
[39:02.560 --> 39:05.900]  Now, another issue, and symptom-based response
[39:05.900 --> 39:09.540]  for the FTC came up with this issue and said, we'll report bots to the
[39:09.540 --> 39:13.280]  ISPs, not botnets bots, and they're reporting spam bots.
[39:13.280 --> 39:17.320]  They're reporting a symptom of the symptom, which is the zombies that send out spam.
[39:18.200 --> 39:21.880]  Great. A for effort, that's about it. I'm glad they're
[39:21.880 --> 39:25.880]  doing it, but it's nothing. Shoot the customer.
[39:26.300 --> 39:29.100]  I really like that. I want to shoot the customer, seriously.
[39:29.100 --> 39:33.020]  Blocking port 25 is one of the best things out there that can be done
[39:33.020 --> 39:36.060]  to stop spam. I hope Larry
[39:37.040 --> 39:41.020]  from Spamels will be here again to explain that, but basically
[39:42.020 --> 39:45.260]  lots of end-to-end, blocking port 25,
[39:45.260 --> 39:49.160]  blocking all these ports, no matter why now, if it's a good or bad
[39:49.160 --> 39:51.280]  idea, you're shooting the customer.
[39:52.700 --> 39:56.960]  That's how ISPs are dealing with it. I'm not saying it's bad, I'm not saying it's good. I actually like it.
[39:56.960 --> 40:01.100]  But it's shooting the customer. That's how we deal with it currently.
[40:02.200 --> 40:04.760]  Now to business. Why DA? And as we said,
[40:04.760 --> 40:08.860]  DA is a mailing list. Well, it gives community
[40:08.860 --> 40:13.040]  and industry involvement, basically. I'll discuss what it is exactly as I go.
[40:13.860 --> 40:18.100]  You see the anti-virus industry, academia,
[40:18.100 --> 40:21.540]  dynamic DNS providers, law enforcement, ISPs.
[40:22.100 --> 40:25.040]  There are other groups out there that work on the problem,
[40:25.040 --> 40:29.220]  and I'll discuss them in a minute, but none of them have the scope.
[40:29.600 --> 40:33.600]  I'll continue in a second. Long-term study and research.
[40:33.760 --> 40:36.680]  Killing viruses is bad. Guacamole
[40:36.680 --> 40:41.200]  was bad. Today when you actually kill a button, it not just jumps
[40:41.200 --> 40:45.100]  to the next IP address, the next compromised host,
[40:45.100 --> 40:48.920]  they actually learn from it, they become better at what they do. It's bad for us.
[40:48.960 --> 40:53.220]  Long-term research and study is critical. R&D, ways and
[40:53.220 --> 40:56.740]  means. Finding new solutions. Following technological
[40:56.740 --> 41:01.300]  operational evolution by the other side. Doing all
[41:01.300 --> 41:05.180]  that and still maintaining the vetting. And vetting does not mean secret
[41:05.180 --> 41:09.000]  entry club where nobody can enter. Hey, I'm lecturing in DEF CON for
[41:09.000 --> 41:13.280]  very few people, but still, lecture in DEF CON. The point is getting as many
[41:13.280 --> 41:16.960]  people involved as possible who care about the infrastructure and actually
[41:16.960 --> 41:21.100]  having the internet around. Now, this is not
[41:21.100 --> 41:25.700]  easy, but it's critical. Now, what does that mean?
[41:26.040 --> 41:29.760]  What can we do that a closed group of ISPs can't?
[41:29.900 --> 41:33.180]  Or a closed group of antivirus gods can't? Antiviruses care about
[41:33.180 --> 41:37.440]  signatures, libraries, which is great, that's their business plan,
[41:37.440 --> 41:41.240]  model, whatever. ISPs care to get their networks back online
[41:41.240 --> 41:45.420]  without problems, maintaining their networks. So they kill botnets.
[41:45.700 --> 41:48.740]  What do we do? First of all, we can do traceback.
[41:49.240 --> 41:52.640]  Tracking down the botnet, authors, controllers, whatever.
[41:53.000 --> 41:55.680]  Creating an intelligence database on who they are.
[41:56.880 --> 42:01.080]  Actionable intelligence, law enforcement cooperation. Get the intelligence,
[42:01.080 --> 42:05.180]  give it to law enforcement. Law enforcement does not care. What do I mean by that?
[42:05.180 --> 42:09.080]  I don't give a shit. And not because they're bad people.
[42:09.940 --> 42:12.740]  Actually, it's the opposite. Law enforcement cares.
[42:13.220 --> 42:16.920]  They can't do squat. We see a
[42:16.920 --> 42:20.700]  very large increase in their caring in the recent year,
[42:20.700 --> 42:25.100]  especially. They want to do good, but they care a lot more
[42:25.100 --> 42:28.700]  about the murderers out there, as they should.
[42:28.800 --> 42:32.780]  They do not have the resources to invest in this.
[42:33.380 --> 42:36.920]  Plain and simple. And it's not
[42:36.920 --> 42:40.660]  really their fault, it's policy. Policy from upstairs
[42:40.660 --> 42:44.500]  that dictates this. And I can tell you we have somebody
[42:44.500 --> 42:49.400]  who actually knows from his hard work who the bagel author is.
[42:49.960 --> 42:52.900]  And he gave them information, he gave them pictures of the guy.
[42:54.080 --> 42:56.960]  And they didn't do squat. Shit.
[42:56.960 --> 42:57.720]  Nothing.
[43:00.480 --> 43:04.540]  Again, I love the guys in law enforcement, and they're trying, but they can't because
[43:04.540 --> 43:08.300]  their hands are tied. So we can't count on them.
[43:08.700 --> 43:12.620]  Sorry, but that's the way it is. Now, reverse engineering,
[43:12.620 --> 43:15.800]  working actually on the samples rather than just the networks,
[43:15.800 --> 43:20.640]  IDSs, flows, whatever, shows us where they are technologically, what they can do.
[43:21.320 --> 43:24.920]  We can find the botnets better, we can see what they're doing, it's cool.
[43:26.000 --> 43:28.540]  Financial trace back. If you work with law enforcement
[43:28.540 --> 43:32.740]  or the financial industry, you see phishing, you can actually trace back
[43:32.740 --> 43:36.680]  from all ways. Not just on the network, not just
[43:36.680 --> 43:40.080]  on the sample level, financial trace back. See where the money is going.
[43:40.080 --> 43:44.420]  Which is basically the only thing the Fed knew how to do with phishing until very recently.
[43:45.560 --> 43:47.720]  Cooperation. That's the critical part, and that's
[43:47.720 --> 43:51.940]  where I was going with this lecture, basically. Working together
[43:51.940 --> 43:55.520]  to see the big picture, because everybody is an expert.
[43:57.480 --> 44:00.060]  But nobody, except if you work together, can see the
[44:00.060 --> 44:04.020]  macro level image. I mean, seriously, we'll talk about Casey in a minute,
[44:04.020 --> 44:07.920]  but she says, for example, the research community is looking for ideas
[44:07.920 --> 44:12.820]  on what to research. The industry needs solutions, and nobody is talking to one another.
[44:14.340 --> 44:15.960]  Now, DA and DA
[44:15.960 --> 44:19.660]  related projects, again, DA is a mailing list, because
[44:19.660 --> 44:23.880]  we had to start somewhere, and that's where we started. Carsnet, that's David Dagan
[44:23.880 --> 44:27.860]  from GA Tech, he does amazing work to study botnets, and he
[44:27.860 --> 44:32.000]  can't find funding. The bad guys have millions,
[44:32.000 --> 44:36.120]  and he can't find funding. But,
[44:36.120 --> 44:40.420]  that's a database, basically, for us to follow everything,
[44:40.420 --> 44:44.160]  gather information, pretty cool. Snort for
[44:44.160 --> 44:48.280]  ISPs, rather dead project right now, but we're working on it.
[44:48.680 --> 44:51.980]  Getting signatures out to detect botnets easier.
[44:52.340 --> 44:56.820]  Botnets, not bots. Passive DNS replication is critical,
[44:56.820 --> 44:59.920]  I do not have time to talk about it, I'm sorry, but it's critical.
[45:00.040 --> 45:04.160]  If you want, Google it. AS-based reporting, getting
[45:04.160 --> 45:08.060]  the reports out to ISPs. Monthly shaming,
[45:08.060 --> 45:12.060]  some ISPs do not give a shit. We need to shame them,
[45:12.060 --> 45:16.400]  and we are actually managing to change the map of the internet every month.
[45:17.000 --> 45:19.960]  Basically, it's, okay, we managed to get that ISP
[45:19.960 --> 45:24.480]  to work with us, which means, okay, the botnet controls are going to run to another ISP now.
[45:24.700 --> 45:27.700]  But we change the map, every month.
[45:27.840 --> 45:32.260]  Some ISPs don't give a shit, we're not sure how to handle that yet.
[45:32.260 --> 45:35.580]  There's some parts of the world we can't reach, but we're working on it.
[45:35.580 --> 45:40.060]  And I'll get to that in a second. Then there's Granix. You'll hear about that in the future,
[45:40.060 --> 45:41.660]  I'm not going to talk about it.
[45:43.940 --> 45:47.000]  Drone armies, at least I think so, I have no idea.
[45:48.060 --> 45:52.280]  I call it Dumbledore's army, I'm not sure if there are any Harry Potter fans here.
[45:52.900 --> 45:55.520]  No? You guys suck.
[45:56.100 --> 46:00.060]  Now, MWP is another mailing list. We had a lot of off-topic
[46:00.060 --> 46:04.020]  posts. There's nearly no noise, only signal on the mailing list
[46:04.020 --> 46:07.540]  until I decide, okay, this is too much signal and I just send some shit in.
[46:07.960 --> 46:12.700]  But it's a community, it's not completely operational. There are other lists that are operational.
[46:15.280 --> 46:16.840]  Spammed malware sites.
[46:17.440 --> 46:20.260]  You spam it via email, it's malware,
[46:20.260 --> 46:24.120]  we'll take it down. Captures, okay, there are many
[46:24.120 --> 46:28.000]  other companies that see these files online, we'll find them and we'll take them down.
[46:28.000 --> 46:31.780]  Now, I'm not supposed to say kill the site, but that's what we do.
[46:31.780 --> 46:35.920]  We do it legally, which means in lawyer talk I would have preferred to say something like
[46:35.920 --> 46:39.900]  we find the data, collect it, give it to the
[46:39.900 --> 46:42.500]  respectable authority to review and
[46:44.300 --> 46:45.340]  investigate and
[46:47.700 --> 46:51.860]  validate or whatever themselves, and then proceed according
[46:51.860 --> 46:56.040]  to their acceptable legal policy or whatever. Basically we kill the sites.
[46:56.040 --> 47:00.080]  Now, worm propagation sites take it down. For example, if there is
[47:00.220 --> 47:04.040]  a worm and you download samples, updates, whatever from some site,
[47:04.040 --> 47:08.000]  we'll take it down, we'll stop the worm from spreading. Phishing sites take
[47:08.000 --> 47:11.820]  it down. We don't do that anymore right now, I'll explain why later, but
[47:11.820 --> 47:15.860]  we still follow it very, very closely. Global law enforcement
[47:15.860 --> 47:20.000]  coordination and tracking of phishing groups. Law enforcement can work together very
[47:20.000 --> 47:24.540]  good, they have their own ways to communicate,
[47:24.540 --> 47:27.600]  but they suck on the small things. Seriously.
[47:28.180 --> 47:32.300]  And we have managed by giving them the actionable
[47:32.300 --> 47:36.660]  intelligence that they don't have, we managed to get several law enforcement
[47:36.660 --> 47:40.460]  agencies around the world working on taking these guys down, because they
[47:40.460 --> 47:44.520]  make money. And the only way that we can stop them from moving their botnet
[47:44.520 --> 47:48.360]  or their phishing or whatever to just another server is by changing their economics
[47:48.360 --> 47:52.460]  and make it not worth their while. That's basically it.
[47:52.460 --> 47:56.360]  And phishing on the net. We want to gather all these
[47:56.360 --> 48:00.560]  phishers, companies such as MessageLabs, Panels, all these guys, send us
[48:00.560 --> 48:04.460]  the phishers, we'll report them to ISPs, we'll get the shelf life
[48:04.460 --> 48:08.440]  of a phishing server down to two
[48:08.440 --> 48:14.690]  hours instead of six days. Ask Dan later.
[48:14.690 --> 48:18.650]  Sorry, I got five minutes. I'm serious, I'm sorry.
[48:19.870 --> 48:22.370]  Other projects. There are other lists
[48:22.370 --> 48:26.970]  out there, other projects, for example, NSP Sec for ISPs to work, you can Google it.
[48:27.210 --> 48:30.530]  The Aninet project, they don't want to work with law enforcement,
[48:30.530 --> 48:34.490]  they're pure researchers. APWG, Anti-Phishing Working Groups
[48:34.490 --> 48:38.410]  in the United States and Apex in the UK. UNISOC, Digital Finish Net,
[48:38.410 --> 48:42.370]  which is the FBI, which is just now starting to get some things done, they basically
[48:42.370 --> 48:46.350]  suck so far, I have high hopes. Microsoft.
[48:46.450 --> 48:49.730]  People, Microsoft is doing a lot.
[48:50.450 --> 48:53.930]  I believe their motives are more like, we want
[48:53.930 --> 48:57.670]  to prove to everyone we do good security, and we want to fucking take over
[48:57.670 --> 49:01.590]  the industry. That's what I believe their motives are, they're hiring
[49:01.830 --> 49:05.730]  a lot of people, but whatever their motives are,
[49:06.550 --> 49:10.210]  they're not really hiding as far as I see it. They do a lot of good.
[49:10.850 --> 49:12.610]  They actually do something.
[49:13.790 --> 49:17.190]  Now as far as I see it, the stakeholders so far
[49:17.190 --> 49:21.690]  I've been able to find... I'll get to Casey first, I'm sorry.
[49:23.910 --> 49:25.250]  Internet Governance. You might have
[49:25.250 --> 49:28.650]  heard Paul Vix's lecture. It's a lot of
[49:29.190 --> 49:33.310]  shit and crap and whatever, and the point
[49:33.310 --> 49:37.190]  is, we can go lower than that, it's trust. For example,
[49:37.190 --> 49:41.150]  nothing prevents me from going to dine right now with a 5 kilo hammer, or kick him in the nuts,
[49:41.150 --> 49:45.090]  or kill him, basically. In real life...
[49:45.090 --> 49:49.530]  Okay, Dan, my glock is at home.
[49:49.870 --> 49:52.430]  No, seriously, you guys are watching me.
[49:52.850 --> 49:57.310]  There are laws, there is fear. I don't know what's stopping me from doing that right now,
[49:57.310 --> 50:01.070]  but that's meatspace. On the internet, nothing stops me
[50:01.070 --> 50:04.990]  from doing that. For example, when people threaten sites
[50:04.990 --> 50:09.010]  for takedown. Pay me 10k right now, I'll take you down.
[50:09.370 --> 50:12.990]  In real life, especially in the States as far as I understand it,
[50:12.990 --> 50:17.230]  from movies in Hollywood, protection money is really good.
[50:17.570 --> 50:18.850]  Works really good.
[50:20.830 --> 50:25.070]  Somebody might come to you and say, look, you pay me right now, or I'll burn
[50:25.070 --> 50:29.350]  down your store, set it on fire. And you might pay him.
[50:29.690 --> 50:33.310]  Or he'll set your store on fire. Now once you've paid,
[50:33.310 --> 50:36.910]  it is likely that the guy won't set your store on fire.
[50:37.270 --> 50:41.030]  Further, if anybody else comes to you and says, hey, pay me or I'll set
[50:41.030 --> 50:44.930]  your store on fire, this guy will protect you. On the internet, they say,
[50:44.930 --> 50:49.190]  okay, pay me 10k right now, I'll set your store on fire.
[50:51.710 --> 50:53.390]  How do you know he won't?
[50:53.410 --> 50:56.610]  First off, it's the internet.
[50:57.570 --> 51:00.750]  Second, he can't stop anybody else from doing it anyway.
[51:01.690 --> 51:05.030]  And the point is, if I meet somebody online,
[51:05.030 --> 51:09.470]  say from Korea or Japan, he doesn't know me, I don't know him, why would he trust me?
[51:09.470 --> 51:12.290]  Why would she trust me? No reason.
[51:13.470 --> 51:17.790]  They may be the bad guy that's trying to trick me down. Would I share information with them?
[51:18.170 --> 51:21.950]  The bad guys are sharing information, making money, everything.
[51:22.290 --> 51:24.170]  We do not share information.
[51:25.230 --> 51:28.650]  We do not get things done. Now, if we don't get a way to cooperate
[51:29.530 --> 51:33.490]  and get things done, somebody else will find a way to do it for us.
[51:33.950 --> 51:38.330]  According to Casey again, I'm misrepresenting your ideas, that's to be clear.
[51:38.330 --> 51:41.210]  But as far as I understand their ideas,
[51:41.210 --> 51:46.770]  every network in the world ever built, whether it's communication network, transportation network,
[51:46.770 --> 51:50.090]  whatever, somebody came and made some order.
[51:50.090 --> 51:54.150]  That somebody was usually or always the government. Do we want the government,
[51:54.150 --> 51:58.990]  your government, my government, to come in and try and make the internet fall in place?
[51:59.570 --> 52:02.490]  They're already trying, especially in Canada and Australia, as far as I can see.
[52:02.490 --> 52:05.430]  Here in the States, everywhere. I doubt they'll succeed.
[52:05.430 --> 52:09.130]  What I see, basically, I'm not worried as Casey is.
[52:09.250 --> 52:13.030]  I believe it will either be Microsoft or the Russian mob.
[52:13.430 --> 52:16.610]  Now, you can quote me, God, he said the Russian mob and Microsoft, whoo!
[52:16.610 --> 52:21.290]  But seriously, these are the stakeholders right now.
[52:21.290 --> 52:22.490]  They make money.
[52:25.150 --> 52:29.470]  Microsoft and the Russian mob. Which one do I prefer?
[52:29.470 --> 52:32.130]  Exactly! Thank you for asking that question.
[52:32.130 --> 52:35.210]  Now, I love Microsoft. Seriously, they're doing a good job out there.
[52:36.230 --> 52:40.790]  I don't know why they care. They may have their own ideas, but they're doing a good job.
[52:41.110 --> 52:42.370]  They're the only ones.
[52:44.250 --> 52:48.090]  Now, cooperation, trust, just getting things done.
[52:49.990 --> 52:50.790]  Basically.
[52:51.830 --> 52:53.730]  We need to solve these problems.
[52:55.310 --> 52:59.130]  And usually, like I said last time, I would have expected a full hole when I said,
[52:59.130 --> 53:00.810]  get involved, people!
[53:01.390 --> 53:04.270]  We have many projects, maybe you have some ideas, too.
[53:04.830 --> 53:08.510]  But seriously, you're just like 20 people or something like that, but still, get involved.
[53:08.510 --> 53:12.930]  If you believe this is important, I do. We need help.
[53:13.230 --> 53:17.350]  Yes, I'm coming to DEF CON, and I'm saying we need help.
[53:18.750 --> 53:21.510]  In about two minutes, so I'll let Dan come up here with me,
[53:21.510 --> 53:23.890]  because it was very nice to come here anyway.
[53:23.890 --> 53:24.870]  Dan!
[53:26.030 --> 53:27.070]  Go!
[53:34.700 --> 53:36.580]  Farming. What about farming?
[53:38.940 --> 53:41.100]  Okay, the ITF sucks.
[53:41.100 --> 53:44.360]  They're good guys, the ITF, but they suck.
[53:44.360 --> 53:48.220]  Seriously, how long have they been dragging their feet on DNSSEC right now?
[53:48.760 --> 53:52.840]  15 years? 11 years? You answer that.
[53:53.780 --> 53:57.640]  DNSSEC is an interesting scene.
[53:57.640 --> 54:02.400]  Farming basically gets into the idea of attacking the infrastructure.
[54:02.740 --> 54:05.080]  Really, though, we're already talking about
[54:05.080 --> 54:08.940]  botnets of the size of a quarter million to eventually
[54:08.940 --> 54:12.620]  multi-million infected hosts.
[54:13.060 --> 54:16.660]  The endpoints are getting owned, en masse.
[54:17.080 --> 54:20.760]  There's a thing called the Byzantine problem. You're a Byzantine general,
[54:20.760 --> 54:24.980]  and how do you control your troops when a fairly large portion
[54:24.980 --> 54:28.440]  of them want to turn on you? And there's ways of organizing
[54:28.440 --> 54:32.960]  the networks so that you can go and kill the generals that turn against you and such.
[54:33.160 --> 54:36.600]  There's a critical mass of hosts that if they're
[54:36.600 --> 54:38.940]  on your network and they're bad, you die.
[54:39.380 --> 54:45.540]  I don't know, is it 250,000? Is it a couple million? Is it 50% of your customer base?
[54:45.540 --> 54:48.560]  Eventually, online banking is really going to have to start
[54:49.320 --> 54:52.420]  accepting the possibility that too many of its customers
[54:52.420 --> 54:56.480]  are actually not its customers, but are coming from corrupted hosts.
[54:56.480 --> 55:00.620]  Already, if you go to Kinko's, you will see. They say, please do not use online
[55:00.620 --> 55:04.460]  banking. Or at least they say, please do not use anything with personally sensitive
[55:04.460 --> 55:08.320]  information. This is a result of a case in New York where a Chinese immigrant
[55:08.320 --> 55:12.580]  actually put botnet, or Trojan code, on all of the
[55:12.580 --> 55:16.760]  publicly available hosts. So, there's a couple things that I wanted to say
[55:16.760 --> 55:21.220]  because it's going to be on film and I'm going to be able to say, hey, I totally predicted that.
[55:22.640 --> 55:24.800]  Last year, like I said, the botnet
[55:24.800 --> 55:28.640]  control data, right now, DNS directs you to command and control servers.
[55:28.800 --> 55:32.400]  Eventually, they're just going to put commands in the command and control servers.
[55:32.500 --> 55:36.100]  At the scale of when you have all these machines, they can
[55:36.920 --> 55:40.760]  stop saying, okay, I want you to take everyone on this bank
[55:40.760 --> 55:44.520]  and send money, send all the money. They're going to start doing really intelligent
[55:44.520 --> 55:49.140]  things. When you have multi-million nodes broken into, you can say,
[55:49.140 --> 55:52.600]  huh, let's find everyone who's sending money to everyone
[55:52.600 --> 55:56.540]  else. Let's build a graph and let's find out who are the people who are receiving money from
[55:56.540 --> 56:00.740]  anyone. In other words, all the stuff the bank does to find
[56:00.740 --> 56:04.820]  fraud, the fraud people can use to find targets.
[56:05.560 --> 56:08.800]  So, I want to have your baby. I want to have your baby.
[56:09.360 --> 56:12.260]  So, no, I mean, the canonical
[56:12.260 --> 56:16.220]  attack becomes, okay, I find one guy who receives money from
[56:16.220 --> 56:20.440]  10,000 different people. I put a tax on every transaction
[56:20.440 --> 56:24.240]  of, say, 1%, 10%. I hide the
[56:24.240 --> 56:28.540]  fact that the tax was applied because I control the interface
[56:28.540 --> 56:32.260]  on everyone. The money moves over to the guy. The bank thinks
[56:32.260 --> 56:36.500]  it's normal because the bank's always seeing money move. And the guy never actually
[56:36.500 --> 56:40.320]  gets any extra money because he gets his account drained of the extra
[56:40.320 --> 56:44.280]  money. These are the kind of threats that really happen
[56:44.280 --> 56:48.160]  when every single, you know, when large numbers of endpoints are broken
[56:48.160 --> 56:51.600]  into. And it stops being about a couple thousand here or there.
[56:52.680 --> 56:56.360]  This kind of stuff is going to happen. And, you know, I don't know if you
[56:56.360 --> 56:59.980]  guys know this. The financial network is kind of converging on sending money
[57:01.060 --> 57:04.240]  instantaneously when all of the security stuff is really saying,
[57:04.240 --> 57:08.280]  hey, slow down. We need to check. We need to go back. So, it's a
[57:08.280 --> 57:12.060]  real question. What is going to happen to the speeding up of the
[57:12.060 --> 57:16.260]  financial system? And it's a real, real question. Are we going
[57:16.260 --> 57:19.940]  to be able to do online banking with personal computers in a year and a half?
[57:19.980 --> 57:24.160]  This botnet stuff that Gadi is doing, every day he does what he does
[57:24.160 --> 57:27.440]  is another day we can use online banking. Okay, that's enough.
[57:28.260 --> 57:32.240]  Online banking is one issue, basically. We need to work together. We need
[57:32.240 --> 57:36.120]  to find solutions. We need to get things done. Because we
[57:36.120 --> 57:40.060]  use the internet, no matter who we are. I mean, this sounds like, I want to cure
[57:40.060 --> 57:44.820]  world anger and cancer and all that, but seriously, come on!
[57:45.380 --> 57:48.120]  And with that, I'll take another question and finish because...
[57:53.400 --> 57:55.780]  Yes, I am with the Mossad and I'm going to send quads
[57:55.780 --> 57:59.780]  after you. I do send the quads
[57:59.780 --> 58:03.580]  after them. If you watch the MI6 site, by the way, I just heard it last week,
[58:03.580 --> 58:08.060]  you will actually see that they say, mess with us and we'll mess with you.
[58:08.060 --> 58:14.200]  MI6 people, they're cool. It's not just a newsletter,
[58:14.200 --> 58:17.640]  it's a whole effort of trying to get things done.
[58:17.800 --> 58:20.200]  So, contact me. You have my email address.
[58:20.840 --> 58:26.180]  gadi.sert.gov.il or ge.linuxbox.org. Contact me.
[58:26.180 --> 58:30.020]  Talk to me. We need help. That's it.
[58:30.020 --> 58:33.240]  Thank you. And... fucking Dan Kaminsky!