WEBVTT 00:08.700 --> 00:10.580 Okay, this is going to be silly. 00:10.580 --> 00:13.500 We're about 10 people here, so... 00:13.500 --> 00:16.160 Come to me, my children. 00:19.240 --> 00:20.520 Or not. 00:25.320 --> 00:26.640 Yeah, it's cool. 00:30.500 --> 00:31.860 Three, five. 00:32.940 --> 00:33.960 One, two. 00:34.680 --> 00:35.720 Minus one. 00:38.080 --> 00:39.940 Okay, I'm not funny, okay? 00:42.140 --> 00:42.580 Um... 00:55.920 --> 00:56.800 Okay. 00:58.860 --> 01:02.360 I'll start by introducing myself, which is always a good thing. 01:02.360 --> 01:03.220 I guess. 01:03.560 --> 01:08.640 But before that, I need to ask, was anybody here at my previous lecture a couple of days ago? 01:10.000 --> 01:10.780 No. 01:10.780 --> 01:12.720 Cool, I can use the same jokes again. 01:12.960 --> 01:13.980 No, seriously. 01:13.980 --> 01:15.400 I don't have that many jokes. 01:15.480 --> 01:16.820 And they're usually bad. 01:20.780 --> 01:25.980 What you're going to hear about right now, I'm not really sure what lecture you came to, because... 01:25.980 --> 01:31.620 If you know what lecture you came to, because I was just inserted into the schedule. 01:32.500 --> 01:34.560 There are some scheduling problems. 01:36.080 --> 01:39.280 I'm going to lecture about the survivability of the internet. 01:40.380 --> 01:41.540 Woohoo, fun. 01:41.900 --> 01:44.360 And I'm going to make some bad jokes. 01:44.360 --> 01:47.420 And I'm going to speak about some serious issues. 01:48.240 --> 01:53.720 And since there are not that many people here, I'll allow myself to say a lot of shit and fuck. 01:55.100 --> 01:59.700 Now, my name. 02:01.860 --> 02:06.800 My name is Gadi Evron, and some of you may know me from the internet as an asshole. 02:07.980 --> 02:10.540 Others might know me as a nice guy, but not that many. 02:10.580 --> 02:12.660 I mean, there are not that many people here, okay? 02:13.040 --> 02:14.520 And that's basically it. 02:15.320 --> 02:16.700 What is DA? 02:16.700 --> 02:18.140 DA is a mailing list. 02:18.360 --> 02:19.860 What is MWP? 02:20.060 --> 02:22.180 MWP is also a mailing list. 02:24.760 --> 02:27.420 Now, we'll start with the boring stuff. 02:28.780 --> 02:34.940 Is there actually a threat to the survivability, big word, of the internet today? 02:35.720 --> 02:42.440 Now, I don't really expect you to answer me, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12... 02:42.440 --> 02:49.760 There are not that many people, but seriously, does anybody here think there is a problem today with the internet? 02:52.280 --> 02:54.020 Cisco gate, okay, cool. 02:54.400 --> 02:56.260 Yes, I'll answer it. 02:56.260 --> 02:57.620 Yes, there is a problem. 02:57.620 --> 02:59.280 Is it called botnets? 03:00.720 --> 03:01.680 No. 03:02.540 --> 03:03.960 Well, kind of, but no. 03:03.960 --> 03:05.060 We'll get to that. 03:05.860 --> 03:16.360 Now, I'm jumping right in, skipping a few slides, and what I basically want to talk about, which I'm not going to, is botnets. 03:17.500 --> 03:27.000 But, essentially, when you look at the problems of the internet, and you see spyware, you see spam, you see viruses, you see all that shit going around. 03:27.780 --> 03:28.660 Why? 03:29.280 --> 03:38.440 I mean, seriously, people used to blame everything on hackers, or the bad guys, and that doesn't make any sense to me, really. 03:41.620 --> 03:59.400 Boring stuff is, for example, like in any social structure, that's my belief, there are many different kinds of people, duh, and it's not just the bad hacker, the bored employee going back home and doing whatever malicious stuff he wants to do, or she wants to do. 04:00.020 --> 04:06.640 There are the kiddies, there's the military, there are the criminals, everybody. 04:06.640 --> 04:07.620 Different people. 04:07.760 --> 04:14.840 But still, to sustain such a huge amount of bad stuff on the internet, somebody has to get something out of it. 04:14.960 --> 04:18.440 I mean, seriously, so much stuff just going out of boredom? 04:18.680 --> 04:21.760 I don't think so, and I'll try and prove that. 04:22.400 --> 04:24.700 Even though it's not really the point of the presentation. 04:25.520 --> 04:27.120 So where is the ROI? 04:27.120 --> 04:29.380 Where is the management talk? 04:29.380 --> 04:30.680 Return of investment. 04:31.000 --> 04:32.940 On investment, sorry. 04:33.900 --> 04:35.820 Like I said, social structure. 04:35.820 --> 04:37.340 Let's start with the kiddies. 04:37.400 --> 04:38.940 Are there any kiddies here? 04:39.700 --> 04:40.500 Ah, cool. 04:40.500 --> 04:41.400 Hey, kiddy. 04:42.540 --> 04:43.740 Kiddy front. 04:43.840 --> 04:51.000 Some of you may have read it a couple months ago on Suns maybe, or heard it from a guy called Dan Hubbard. 04:51.260 --> 04:53.060 Iframe dollars.biz. 04:53.180 --> 04:59.500 Now, generally, whenever I see a .biz domain, I start crying, or scratching, or whatever. 04:59.560 --> 05:01.400 Seriously, biz domains are bad. 05:01.400 --> 05:04.100 Nearly as bad as CX or WS or whatever else. 05:04.100 --> 05:07.100 Seriously, I just see .biz domain and I start crying. 05:08.240 --> 05:13.200 Iframe dollars.biz was a business, plain and simple. 05:13.380 --> 05:16.320 Some guy said, hey, let's make money off the internet. 05:16.980 --> 05:19.720 And you're coming up here, you do know that. 05:20.760 --> 05:21.460 Yeah. 05:22.280 --> 05:24.320 Dan fucking Kaminsky, people. 05:24.540 --> 05:25.980 Dan fucking Kaminsky. 05:27.920 --> 05:32.040 Now, oh shit, these are people that actually heard my lecture before. 05:32.420 --> 05:34.100 I can't use the same jokes again. 05:37.180 --> 05:48.060 Now, iframe dollars.biz basically said, okay, come into my website, take this code iframe, I think it was, and put it on your website. 05:49.000 --> 05:56.560 Now, for every first click, every user that goes into your website and installs our spyware, or whatever it was, you'll get money. 05:56.920 --> 06:00.520 You won't get a lot of money, you'll get 0.06 dollars. 06:01.560 --> 06:05.360 Now, they claimed you're eating. 06:06.420 --> 06:07.320 Bitch. 06:07.320 --> 06:07.700 Okay. 06:07.700 --> 06:15.180 They claimed, if I have one more bad pizza, I swear I'll puke. 06:17.280 --> 06:28.280 They basically said, look, take this code, put it on your webpage, whenever somebody comes inside, into your webpage, you'll get 0.06 dollars, which is cool. 06:29.460 --> 06:37.200 Now, they claimed to pay, the week before we saw them, $11,000 for that. 06:37.380 --> 06:41.300 Now, that amounts to about 220,000 clicks. 06:41.680 --> 06:43.400 Again, they claimed. 06:43.400 --> 07:00.200 Now, we actually found their statistics page, and yes, apparently they did pay 220,000 people did get firstly installed software on their computers, and they did pay $11,000 to people. 07:01.200 --> 07:05.820 Now, 11k is a lot of sum, but it's not that much money. 07:07.640 --> 07:16.120 Now, there is another guy, I would like to give you as an example, and I don't know how to pronounce his name, or nickname, or whatever we chose to call him. 07:16.260 --> 07:19.180 It could be Flowby, it could be Flowby, depending on where you're from. 07:20.060 --> 07:22.120 Now, this guy is a botnet controller. 07:22.420 --> 07:29.860 Just so we are clear, I'll explain in a couple of lines what I believe a botnet is, and if you think I'm wrong, tough. 07:31.540 --> 07:32.920 Trojan horses. 07:33.420 --> 07:40.220 We all know what Trojan horses are, I'll repeat anyway, and again, you can argue with me all you like, I don't care. 07:40.980 --> 07:42.400 Shut up, Dan. 07:45.160 --> 07:48.280 You can't speak if you're not drunk, that's it. 07:58.280 --> 08:00.020 Is that beer? 08:00.720 --> 08:05.620 No, it's not that. 08:06.480 --> 08:28.820 Okay, Flowby was a botnet controller, and again, Trojan horses, let's say it's some sort of software or hardware or whatever, some sort of thingy, that if a user knew what it would do, it would not be so pleased about it, let's put it that way, and it's usually a remotely controlled device or whatever installed on your machine. 08:29.220 --> 08:35.500 That was the worst explanation of what a Trojan horse ever gave, or heard, for that matter. 08:35.500 --> 08:41.680 Now, you can do whatever you like on a machine where a Trojan horse has been installed. 08:41.680 --> 08:43.300 You control that machine. 08:43.480 --> 08:47.540 Now, imagine if you had 10 such machines, where you installed Trojan horses. 08:47.920 --> 08:52.960 Imagine you had 100, and they were on broadband, of course. 08:53.000 --> 09:00.360 Imagine you had 200, 1,000, 10,000, 100,000, a million machines, all completely at your control. 09:01.880 --> 09:15.960 Well, you would have to control them somehow, and that's basically a botnet, because these drones, bots, whatever, will be reporting to a center point, which is the command and control server. 09:17.040 --> 09:27.940 Now, this guy owns many botnets, and on one of the botnets, we can't really prove that, we've seen it happening with many different cases, and it's just very easy for me to give you an example. 09:30.280 --> 09:40.940 On one of his botnets, which was 35k large, 35,000 bots large, he decided, hey, DDoS is not good enough for me. 09:41.360 --> 09:47.900 I don't want to spam, I don't want DDoS, there is a lot of downtime for my bots, and I want to use that downtime. 09:48.420 --> 09:53.620 So, basically, what he supposedly did is install a lot of spyware on every single machine. 09:53.620 --> 10:03.040 Now, a legal calculation of a page we believe he took the spyware from would mean that he gained about 8k a day from his small botnets. 10:03.320 --> 10:04.740 So, that's a kiddie front. 10:04.740 --> 10:06.880 8k, 11k, whatever. 10:08.100 --> 10:09.700 Now, the big picture. 10:10.560 --> 10:13.500 We don't really know what the big picture is. 10:13.700 --> 10:14.520 Seriously. 10:14.700 --> 10:17.020 We do not see what's happening. 10:17.700 --> 10:26.080 And this is DEF CON, I don't need to explain it to you, because half the lectures here were about conspiracy theories and how the government is spying on us and all that. 10:27.000 --> 10:29.420 But we can see some of that. 10:29.840 --> 10:32.940 It's in plain sight, it's public. 10:33.740 --> 10:36.940 And between a lot of beers, you might actually notice it. 10:37.820 --> 10:40.540 I was just looking at you, I didn't mean anything by that. 10:40.640 --> 10:43.480 There's plain sight spying by government? 10:43.480 --> 10:44.100 Yes. 10:44.100 --> 10:52.640 Now, when you see phishing, which is in plain sight, he's a little bit drunk, or I'm just not very well understood, which is possible. 10:53.200 --> 10:54.180 Or likely. 10:56.100 --> 11:01.980 You're not implying governments are running legitimate botnets by putting spyware on people's machines? 11:01.980 --> 11:02.980 You're on to me. 11:03.160 --> 11:04.900 I work for the government, you know. 11:05.880 --> 11:06.500 Okay. 11:06.920 --> 11:11.440 Now, phishing, seriously, phishing gives us a very, very good picture of what's going on. 11:11.960 --> 11:17.660 Phishing is public, you get it in your inbox, you can go to the sites, you see what's going on, which is great. 11:17.660 --> 11:22.500 And we can actually see the amounts of money that goes into it, and I'll show you in a minute. 11:23.520 --> 11:38.380 And then there are a few minor details, such as, for example, the Trojan Horse industrial espionage case, where there were some private investigation companies and some very rich companies that wanted to spy on their competition. 11:39.420 --> 11:48.320 So basically, as far as I understand, they paid 17k UK pounds, or 13k UK pounds a month, per computer. 11:49.080 --> 11:50.520 Which is a lot of money. 11:50.580 --> 11:52.980 So there are things going on behind the scenes. 11:53.040 --> 11:56.500 Some of them we can actually prove because we hear about one or two every year. 11:56.780 --> 12:00.100 But let's actually look at what we can see day-to-day. 12:00.800 --> 12:10.540 The APWG, the Anti-Phishing Working Group, says they saw over 13k unique phishing emails in March 2005 alone. 12:10.540 --> 12:12.960 And thousands of phishing sites. 12:12.960 --> 12:13.640 Woohoo! 12:13.640 --> 12:17.640 Now, people usually say, and I'm going to be kind of... 12:18.400 --> 12:19.900 Okay, we all know this. 12:20.380 --> 12:24.640 These guys, they sent so many millions of spam messages out. 12:25.040 --> 12:28.440 And then just one person clicks on it and fills the details in. 12:29.400 --> 12:37.280 Well, one person clicking and filling in the details is a clear cut return on investment because email doesn't cost money. 12:37.580 --> 12:42.700 We all know that, but it's very important to reiterate that issue. 12:43.340 --> 12:45.300 Now, let's give some statistics. 12:45.440 --> 12:52.060 In Germany, for example, every phishing attempt 2,000 people fill in their details. 12:52.880 --> 12:54.740 Now, that number keeps rising. 12:54.740 --> 12:56.960 It's not just one stupid guy. 12:57.180 --> 13:00.080 There's a lot of stupid people out there. 13:00.080 --> 13:03.420 Now, of them, about six do not get their money back. 13:03.420 --> 13:07.760 And that's because the banks are very good at moving money around. 13:07.760 --> 13:09.420 Money is stolen, no problem. 13:09.420 --> 13:11.560 But six do not get their money back. 13:11.780 --> 13:14.080 Or rather, the banks have to cover it. 13:14.680 --> 13:21.400 Now, on average, that amounts to about 6K euro lost per person. 13:22.040 --> 13:24.340 36K euro for every attack. 13:24.340 --> 13:27.920 Now, per year, that's 1.2 million euros. 13:28.300 --> 13:30.100 And that's just for one group. 13:30.100 --> 13:33.120 Each group's attacks are used to attack once every eight days. 13:33.120 --> 13:34.720 Now, they do it a lot more often. 13:35.440 --> 13:37.320 Quite a few groups out there. 13:37.320 --> 13:39.900 Can anybody see the ROI yet? 13:39.900 --> 13:41.040 The return on investment? 13:41.840 --> 13:43.860 There is a lot of money going into this. 13:43.860 --> 13:50.320 Now, the Russian mob, and I have to say this again, I always say it in my lectures, I have nothing against Russians. 13:51.060 --> 13:51.940 Seriously. 13:52.320 --> 13:54.260 I had a girlfriend who was Russian. 13:55.800 --> 13:57.720 But really, nothing against Russians. 13:58.360 --> 14:05.140 But most of this stuff, there are a lot of small operators out there in Eastern Europe, in Brazil, all around the world. 14:05.140 --> 14:07.800 But most of this stuff comes from the Russian mob. 14:08.340 --> 14:10.220 Clearly, from the Russian mob. 14:10.300 --> 14:11.580 I'll say it again. 14:12.540 --> 14:13.860 Hold on. 14:14.920 --> 14:16.180 Hold on. 14:16.620 --> 14:20.660 I'll answer every question, and if not, hey, I'm on tape. 14:22.100 --> 14:25.180 The Russian mob sees the return on investment. 14:25.860 --> 14:26.660 Okay? 14:27.800 --> 14:28.880 Cool. 14:29.140 --> 14:35.540 And they actually invest in the technological and operational capabilities over time. 14:35.880 --> 14:42.260 There are people sitting here who actually watch the binaries and the samples, and can tell you how they evolve over time. 14:43.120 --> 14:46.260 Now, many of these kitties just, like I said, it's social structure. 14:46.260 --> 14:48.540 It's not all the Russian mob. 14:49.120 --> 14:51.880 Many of these kitties just trade it like candies. 14:52.300 --> 15:02.540 And most of these trojan horses, or bots, or whatever, are just the same code, ripped from one another over and over and over again. 15:03.960 --> 15:07.480 But still, it's important to note that, and I'll give you an example. 15:08.420 --> 15:15.860 Here in the States, this just came out a few months ago, here in the States, there was a phishing attempt. 15:16.080 --> 15:17.900 It's a phishing attack, actually. 15:20.440 --> 15:26.300 And somebody's account got emptied in a branch of the bank on the West Coast. 15:27.780 --> 15:40.080 Now, a week later, a FedEx box came in, carrying a fake check, which is what actually got people to look into it, to refill their account so they can empty it again. 15:41.240 --> 15:42.380 Shut up! 15:42.540 --> 15:47.180 So basically, you'll get to lecture in a minute, so don't disturb. 15:48.260 --> 15:49.340 You're not allowed. 15:49.340 --> 15:50.340 You're not drunk. 15:57.050 --> 15:58.910 I'm very happy that you came. 16:03.380 --> 16:06.560 Now, I really am happy that you came. 16:09.420 --> 16:12.980 Basically, what that means, people, this is not cyberspace anymore. 16:13.600 --> 16:14.880 This is meatspace. 16:15.740 --> 16:20.660 This is happening right here, right now, with real people, and real money. 16:21.760 --> 16:23.980 That's critical to what I'm going to talk about. 16:25.080 --> 16:29.960 Now, in the UK, for the last example, the losses are also significant. 16:31.420 --> 16:37.420 1.4... 1 to 4, I'm sorry, million pounds a month in losses, just at the beginning of this year. 16:37.660 --> 16:40.220 And it jumped by 1 million every month. 16:41.060 --> 16:45.540 December, January, February, March, it got to 4 million pounds lost. 16:45.540 --> 16:47.360 Now, don't take my word on these numbers. 16:47.360 --> 16:48.640 You won't find them anywhere. 16:48.760 --> 16:52.820 As far as you're concerned, I'm lying, because I'm not going to prove it to you. 16:52.820 --> 16:55.260 And anything I'm not going to prove, just believe I'm lying. 16:55.260 --> 16:56.700 But these numbers are true. 16:57.160 --> 16:59.540 Now, this is by... I'm lying. 16:59.700 --> 17:01.260 No, this is by phishing alone. 17:02.920 --> 17:04.320 There is a lot of money in this. 17:04.320 --> 17:05.040 I'm saying it again. 17:05.040 --> 17:07.500 I'm repeating myself, and there is a reason for that. 17:08.580 --> 17:11.260 In the US, the story is a bit different. 17:11.920 --> 17:17.080 One bank, they say they used to see about 200 victims per scam. 17:17.240 --> 17:19.280 Today they say they see about 5. 17:20.040 --> 17:21.420 But come on, people. 17:21.420 --> 17:26.720 Banks, at least in the United States, in the UK, they can't, as far as I know. 17:26.860 --> 17:31.040 They have a legitimate reason to actually try and underplay the problem. 17:32.140 --> 17:33.560 I mean, do you have any idea? 17:33.560 --> 17:35.200 I don't have any idea, by the way. 17:35.200 --> 17:39.800 Do you have any idea how much of all their business goes online? 17:41.500 --> 17:44.240 How much of any business today goes online? 17:45.120 --> 17:47.540 Depending on the bank, it could be 50-60%. 17:52.050 --> 17:52.850 Everything. 17:52.850 --> 17:53.910 Everything. 17:56.670 --> 18:00.390 Again, I don't have hard numbers, and it changes drastically from bank to bank. 18:00.390 --> 18:01.950 I don't want to talk about it. 18:05.030 --> 18:05.910 What? 18:11.980 --> 18:13.500 I really want to answer that. 18:13.500 --> 18:15.340 I honestly don't have time. 18:15.940 --> 18:19.800 I know I'm kind of weeny for saying that, but I honestly don't have time. 18:19.920 --> 18:20.660 Sorry. 18:21.820 --> 18:26.880 Other banks are actually reporting losses of around $10-20 million. 18:26.880 --> 18:28.840 Again, don't take my word for it. 18:28.840 --> 18:31.000 The Germany numbers, I can sign on. 18:31.880 --> 18:33.800 And they're not anywhere you can find. 18:34.460 --> 18:36.200 Now, the problem is not botnets. 18:36.200 --> 18:41.780 Again, I didn't really want to make this a botnet lecture, although I can't speak about botnets for hours on end. 18:42.560 --> 18:45.940 Botnets is a very serious symptom. 18:47.220 --> 18:48.740 A very, very serious symptom. 18:48.740 --> 18:49.440 It's a problem. 18:49.440 --> 18:51.480 Actually, I keep using the same jokes. 18:51.480 --> 18:53.340 You were in my last lecture, you bitch. 18:53.340 --> 18:54.700 Why were you in my last lecture? 18:54.700 --> 18:56.280 I can't reuse jokes. 18:57.800 --> 18:59.640 You were hoping it would be funnier. 19:03.200 --> 19:04.980 I know where you live. 19:06.500 --> 19:07.500 Okay, I don't. 19:08.180 --> 19:10.380 I can find out. 19:13.320 --> 19:14.200 Dan? 19:18.440 --> 19:19.480 The Mossad! 19:19.480 --> 19:20.620 The Mossad! 19:22.720 --> 19:28.120 I was just at Cisco the other day, and they gave, like, name tags that stick on your shirt. 19:28.560 --> 19:36.200 Now, I don't know who told them and what the fuck they thought they were doing, but I don't work in Israeli government security. 19:36.220 --> 19:38.580 But I said, Israeli government security. 19:38.860 --> 19:41.040 I immediately photocopied it. 19:42.080 --> 19:43.780 Asked for another one. 19:43.880 --> 19:45.220 Put it in my pocket. 19:45.220 --> 19:46.380 That's so great. 19:47.260 --> 19:48.200 I'm for the Mossad. 19:48.200 --> 19:48.680 Watch out. 19:48.680 --> 19:50.200 I'll send people after you. 19:50.720 --> 19:54.080 Okay, I don't have time. 19:54.600 --> 19:56.360 The problem is not botnets. 19:56.360 --> 19:58.300 Botnets are a very serious symptom. 19:58.700 --> 20:01.580 What I'm trying to say is botnets are a serious problem. 20:01.580 --> 20:07.860 I can tell you that from our limited view, and we see quite a bit, but again, we don't see everything. 20:09.180 --> 20:12.240 We have 4,000... 20:14.040 --> 20:16.520 4K botnets out there. 20:16.520 --> 20:18.100 Since the beginning of this year. 20:18.280 --> 20:21.360 And that's just a little bit. 20:21.820 --> 20:24.860 I mean, people keep looking at the bot itself. 20:27.380 --> 20:31.240 And they keep asking me, how many bots are out there? 20:32.260 --> 20:32.840 And you know what? 20:32.840 --> 20:34.180 I don't give a shit. 20:34.180 --> 20:36.440 Seriously, I don't care how many bots are out there. 20:36.580 --> 20:41.960 Some people might have to care, but I don't, and I'll explain why in a few minutes. 20:43.140 --> 20:47.080 Now, okay, I'll explain why now, actually. 20:47.240 --> 20:48.660 And waste some time. 20:52.880 --> 21:04.940 Why... you people who live in the United States, or most of you do, you know about this thingy of asking, why be able to destroy the world a thousand times over when once is more than enough? 21:05.360 --> 21:06.060 Right? 21:06.560 --> 21:10.380 Well, botnets on the internet are strategic warfare. 21:10.980 --> 21:12.360 They are nuclear weapons. 21:12.360 --> 21:17.480 And the amounts and numbers out there are unbelievable. 21:18.380 --> 21:23.840 And I can tell you that we've actually seen a 350k botnet. 21:24.760 --> 21:26.240 And it wasn't the only one. 21:26.240 --> 21:27.940 It's just the best example I have. 21:28.280 --> 21:29.380 A few months ago. 21:30.640 --> 21:38.380 Now, when you have that big of a botnet at your control, you can do pretty much anything on the internet. 21:40.100 --> 21:52.440 Now, I'll continue with that in a minute, but really, looking at the botnet as a problem, a botnet itself, the network, install some bots separately, is what I'm talking about. 21:53.040 --> 21:58.020 Now, the philosophy of the problem, why I'm looking at botnets as a symptom... okay, I can't say problem, seriously. 21:58.020 --> 21:59.300 This is a joke I must reuse. 21:59.300 --> 22:00.100 I'm sorry. 22:00.320 --> 22:01.560 It's not really a joke. 22:01.760 --> 22:05.380 I was sitting with a guy from Adobe, or my boss was, I don't really remember. 22:05.380 --> 22:07.640 I reuse jokes all the time. 22:07.820 --> 22:11.280 And the guy would refuse for two hours to say the word problem. 22:11.880 --> 22:13.660 He would say challenges. 22:13.880 --> 22:19.820 For two whole hours, I just heard, or he heard, challenges, challenges. 22:20.000 --> 22:21.100 And now they changed it. 22:21.100 --> 22:23.460 You're supposed to say opportunity, opportunity. 22:23.640 --> 22:25.660 Anyway, so there are several challenges. 22:26.360 --> 22:27.780 Let me get to the point. 22:29.280 --> 22:35.940 If I'm saying botnets are strategic warfare on the internet, I mean, everybody knows what DDoS is. 22:38.960 --> 22:41.000 Why say they're just a symptom? 22:41.880 --> 22:45.220 Let's start a bit about our philosophy of the problem. 22:45.660 --> 22:46.660 The internet. 22:47.280 --> 22:48.620 Photon monoculture. 22:49.620 --> 22:53.060 We all, I mean, whether we like it or not, most of us use Windows. 22:53.060 --> 22:54.940 And I'm not talking about the home computer. 22:55.020 --> 22:57.100 At work, most of us use Windows. 22:57.200 --> 22:58.860 Everywhere, it's Windows. 22:59.560 --> 23:02.900 And that makes us extremely susceptible to attacks. 23:04.780 --> 23:08.460 And I don't have time to talk about that anymore, but just think about it. 23:08.460 --> 23:09.820 I'll waste some time later. 23:12.000 --> 23:16.920 Now, one bug, or one patch, can bring us down. 23:17.640 --> 23:19.340 Repeating past mistakes. 23:20.400 --> 23:30.060 When we left the world of the mainframes, OS development somehow sinked down to a new level. 23:30.060 --> 23:37.380 And just now we are starting to reach the level of where we were with the mainframe in OS development. 23:37.800 --> 23:42.820 And I can actually see it as a pattern of things actually repeating themselves non-stop. 23:43.840 --> 23:46.060 The PC wasn't the end of it. 23:46.060 --> 23:48.100 For example, cell phones. 23:48.100 --> 23:49.700 Everything is in default. 23:50.140 --> 23:52.060 You can't disable anything. 23:52.060 --> 23:53.100 Everything is in automatic. 23:53.100 --> 23:55.080 Java, browsers, whatever. 23:55.380 --> 23:56.420 Unbelievable. 23:56.520 --> 23:59.280 We keep repeating the same mistakes over and over again. 24:00.440 --> 24:02.320 And that brings me to Killing Fires. 24:03.620 --> 24:07.340 And before I reach Killing Fires, I would like to discuss the problems of the internet. 24:08.340 --> 24:22.200 We'll get to KC and who she is in a minute, but everybody keeps saying at the end of the year companies like Symantec, they do a great job, but they come out and say something like look, these are the problems that we are going to face in the year of 2005. 24:23.200 --> 24:24.380 Okay, great. 24:24.940 --> 24:26.080 How do you know that? 24:26.080 --> 24:33.020 Well, we have looked at our past agendas and logs and histories and we can tell you what we believe the issues are going to be. 24:33.700 --> 24:36.280 Okay, so basically F of that is what happened last year. 24:37.220 --> 24:46.020 Almost another F is what you believe is going to happen, therefore you're self-prophesying or whatever you call it, that it will happen and some of it will happen. 24:46.020 --> 24:52.500 And some of this stuff will actually surprise you, because you can't know what everything that's going to surprise you is going to be. 24:52.500 --> 24:54.920 And I'm saying something different. 24:55.460 --> 24:58.920 The problems are out there and we know about them for many years now. 24:59.640 --> 25:01.060 Many years. 25:01.520 --> 25:02.860 Let's take for example spam. 25:02.860 --> 25:05.080 Are you interested in my talk at all? 25:05.080 --> 25:05.780 I am. 25:05.780 --> 25:06.540 You are? 25:07.040 --> 25:08.540 I believe you. 25:08.540 --> 25:11.560 Okay, David fucking Kaminski everybody. 25:13.380 --> 25:16.200 Not drunk for the first time on video. 25:19.320 --> 25:19.820 Now... 25:23.080 --> 25:23.960 Yeah. 25:24.780 --> 25:27.200 I'm trying to remember what the fuck I was talking about. 25:27.300 --> 25:28.180 Predictions. 25:28.820 --> 25:30.400 Thank you, bitch. 25:33.100 --> 25:34.600 I love this guy. 25:35.940 --> 25:39.660 But he gave me such hell when I asked him to come and help me in my lecture. 25:41.040 --> 25:43.160 Yeah, but I don't need you now. 25:44.320 --> 25:46.580 Yeah, I'm going to talk now. 25:52.270 --> 25:54.490 Yeah, I'll tell you about the superbugs in a minute. 25:56.130 --> 25:57.830 I'm still wasting time. 26:00.570 --> 26:01.910 What was I talking about? 26:01.910 --> 26:02.490 No, seriously. 26:03.110 --> 26:03.710 Predictions. 26:04.010 --> 26:07.950 So basically, the problems have been around for many, many years now. 26:07.950 --> 26:09.270 Let's take spam as an example. 26:09.270 --> 26:11.310 Yes, tell them we love them. 26:12.390 --> 26:14.130 I want that phone later on. 26:14.210 --> 26:15.210 It's mine now. 26:16.290 --> 26:18.470 The problems of the internet have been around for many years now. 26:18.470 --> 26:19.470 Let's take spam. 26:19.470 --> 26:21.990 I'm going to completely ruin the history of spam. 26:21.990 --> 26:26.910 In the last lecture I met, there was a guy from SpamHouse here and he wanted to kill me, but it's cool. 26:28.330 --> 26:30.750 First, we didn't really care about spam. 26:30.750 --> 26:31.490 Seriously. 26:32.350 --> 26:39.130 It's just some emails you get eventually, here and there, once a day, and you found a good solution for it too. 26:39.230 --> 26:39.810 JHD. 26:39.810 --> 26:40.910 Just hit delete. 26:41.130 --> 26:42.090 And it worked. 26:42.370 --> 26:46.350 And then it got a little bit more annoying as somebody started working on it, but nobody really cared. 26:46.670 --> 26:51.250 Nobody wanted to put the money into it to get rid of the business, or at least try to. 26:51.570 --> 26:53.370 And then it got to be a problem. 26:53.590 --> 26:55.850 Then everybody started caring about it. 26:57.750 --> 26:59.830 And then I started finding solutions. 27:00.590 --> 27:06.710 And like any human society, anywhere, they said, I have to be elected into office. 27:06.710 --> 27:11.070 I mean, this is not really it, but seriously, long-term solutions are not part of the business here. 27:11.230 --> 27:12.630 It's part of our culture. 27:12.630 --> 27:15.950 We have to kill this fire called spam right now. 27:17.430 --> 27:22.930 So we will invest some money, and come up with a solution that will kill the fire right now. 27:23.110 --> 27:29.070 That solution was, for example, Bayesian filters, or F-ass Bayesian filters. 27:29.410 --> 27:39.850 And if we see, for example, Viagra in one instead of an I, all these evasion techniques that bad guys came up with, that's cool. 27:40.130 --> 27:46.310 I mean, seriously, use some F-ass Bayesian filters that bad guys learned and started using one instead of I. 27:46.910 --> 27:48.950 Then I started using mail relays. 27:50.010 --> 27:52.850 Again, it could have been the other way, but I don't really care right now. 27:52.850 --> 27:55.730 And we started using blacklists, like maps. 27:57.070 --> 28:00.950 And then I started using zombies, and they can email from all over the world. 28:01.350 --> 28:11.050 Anytime we actually kill the fire right now, get rid of this problem right now, what we actually accomplished was, hey, we are teaching the bad guys. 28:11.050 --> 28:13.290 We are educating them. 28:13.870 --> 28:17.330 We are throwing them into an evolutionary route that we are not choosing. 28:17.330 --> 28:18.930 We are making things worse. 28:19.310 --> 28:21.290 And I can tell you it's the same with botnets. 28:21.330 --> 28:25.150 It's the same everywhere, and that's what brings me to the superbugs theory. 28:25.930 --> 28:27.710 Now, superbugs is not a new theory. 28:27.710 --> 28:30.390 I mean, doctors really liked antibiotics. 28:31.350 --> 28:32.490 You had a flu? 28:32.830 --> 28:34.550 The flu, they gave you antibiotics. 28:34.670 --> 28:35.670 You had a cold? 28:36.050 --> 28:37.550 They gave you antibiotics. 28:38.270 --> 28:40.570 And what they actually did was create some sort of 28:46.870 --> 28:50.630 stronger bugs that could resist antibiotics. 28:51.110 --> 28:52.810 And they kept doing it. 28:53.790 --> 28:56.070 And that brings me back to monoculture. 28:56.070 --> 28:57.330 Everything is windows. 28:58.290 --> 29:05.250 And we keep just ignoring the problems that are out there for years, and I can give you a list of problems and I'll get to that in a second. 29:05.250 --> 29:07.010 And I've been out there and it's getting worse. 29:07.010 --> 29:09.650 And eventually they get so bad that we have to kill them right now. 29:09.650 --> 29:17.110 And every time we do something like that, no matter if it's terrorism, no matter if it's botnets, no matter if it's spam, we just kill the problem right now. 29:17.370 --> 29:19.650 I'm repeating myself, I know, but it's important to me. 29:19.950 --> 29:21.010 And make it worse. 29:21.010 --> 29:22.270 Educate the bad guy. 29:23.650 --> 29:27.430 So the superbugs theory is where I wanted to get to. 29:27.770 --> 29:30.010 And that's why botnets are not really the problem now. 29:30.910 --> 29:32.210 Who is the enemy? 29:32.590 --> 29:37.690 I keep speaking of there are bad guys out there. 29:37.690 --> 29:39.810 FUD, I'm not giving any facts. 29:40.030 --> 29:45.290 Well, it used to be a rival or an opponent really, not really an enemy. 29:45.530 --> 29:48.930 Because, I'll give you an example from the dynamic DNS providers. 29:49.950 --> 29:53.990 Dynamic DNS providers are really, really good for the bad guys. 29:54.670 --> 29:58.050 They can run botnets using DNS really easily. 29:58.130 --> 30:01.430 They tell all the bad bots, connect that address. 30:01.810 --> 30:15.110 Then when somebody kills the server, because that's how you deal with the botnet, you kill the command and control server which is bad, because then the bad guy just moves up to another server and starts investigating and educating themselves and getting to be better at it. 30:15.110 --> 30:16.470 Again, superbugs. 30:17.310 --> 30:21.410 But basically, when dynamic DNS providers are perfect for them. 30:21.410 --> 30:33.330 They go online, they open a new account, they get some free DNS free domains, free whatever, and just point the botnet over there. 30:33.870 --> 30:35.670 That's basically how it works. 30:35.950 --> 30:40.750 The dynamic DNS providers really suffer. 30:41.530 --> 30:51.730 Because imagine 100,000 bots, and bots are not very nice internet users losers. 30:51.730 --> 30:53.870 They just keep asking the same question. 30:53.870 --> 30:55.190 How do I connect over there? 30:55.190 --> 30:56.950 Where is that A record? 30:57.850 --> 31:01.270 And they really weigh down on the dynamic DNS providers. 31:01.530 --> 31:06.770 The dynamic DNS provider says, okay, this is the botnet, it's in breach of my acceptable use policy. 31:07.430 --> 31:12.490 I will map this botnet address to 1918 addresses, localhost, whatever. 31:12.970 --> 31:17.370 And that's acceptable to the bad guy, because it says, hey, I abused the service, but I need it again. 31:17.390 --> 31:21.910 They found me out, I'll just use it again, re-register. 31:22.130 --> 31:24.830 Now what if the dynamic DNS provider says, I'm sick of it. 31:24.830 --> 31:33.370 I mean, so far they've been contesting for the same resources, they live in the same realm, but don't really come to combat, open combat. 31:33.430 --> 31:37.490 But what if the dynamic DNS provider says, I'll sinkhole the botnet. 31:37.630 --> 31:40.910 I'll kill the botnet, I'll take the botnet away from the bad guy. 31:41.070 --> 31:42.650 The bad guy gets pissed. 31:43.210 --> 31:44.510 And then it's open warfare. 31:44.910 --> 31:48.810 You will DDoS the dynamic DNS provider to hell, and that makes it an enemy. 31:49.490 --> 31:56.390 And why I wanted to stick to this point for a minute, which is not really related to the lecture, is because this is an enemy to the infrastructure. 31:56.390 --> 32:05.930 And when I try to think about who the hell owns the internet, and I'm not talking about owning the internet as in who runs the internet, but who are the stakeholders? 32:06.630 --> 32:09.510 Seriously, who cares if the infrastructure survives? 32:10.210 --> 32:18.250 And I try a lot, and I can't really find the people yet, but the infrastructure is at a serious risk. 32:18.610 --> 32:22.490 I don't care if somebody is a black hat, if somebody is a white hat, if somebody is a grey hat. 32:22.970 --> 32:26.770 Whatever you do at home, whatever you have fun with, that's cool. 32:27.870 --> 32:41.370 But when you go out and take money from Granny Jane, or when you go out and try to DDoS the internet to hell, you're not a nice netizen, and over more, you're pretty much, you're not a black hat, you're an idiot. 32:42.570 --> 32:47.350 And your idiocy is pretty much what's going to cause the internet to go to hell. 32:47.630 --> 32:48.970 And that's FUD. 32:48.970 --> 32:51.730 That's fear, uncertainty, and doubt. 32:52.010 --> 32:54.710 And I didn't want to say that until I could give you some facts. 32:57.030 --> 32:59.190 What do we do about it today? 33:06.330 --> 33:10.770 It could be tens of thousands of dollars a week, it could be millions, it depends on who you are. 33:18.980 --> 33:24.760 The question was, why are you relying on DynDNS for something that is critical to your infrastructure when you make millions? 33:24.780 --> 33:32.920 You don't rely only on DynDNS, but I don't have time to cover it right now, but just think about why do botnets use IRC? 33:33.660 --> 33:35.600 Seriously, why use IRC? 33:35.680 --> 33:37.160 It's perfect for them. 33:38.060 --> 33:45.540 I mean, I don't have time to cover it because this is not a botnet lecture right now, but something does not have to be extremely complicated to be good. 33:47.810 --> 33:50.710 Although, damn, fucking Kaminsky is not drunk to answer that. 33:52.130 --> 33:54.010 Ignore everything I just said, please. 33:54.010 --> 34:02.930 There needs to be legitimate services that are using that particular host that it would be a problem if you just killed it entirely. 34:02.930 --> 34:11.870 If you go ahead and you put a colo somewhere and it's the CNC and it's the DNS and so on, pull the plug on it and you've just killed illegitimate services. 34:11.870 --> 34:18.070 The idea is to mix the illegitimate botnet with the legitimate dynamic DNS and that's why they do it. 34:18.330 --> 34:19.210 Amen to that. 34:19.210 --> 34:20.270 Next issue. 34:20.270 --> 34:21.910 And thank you to Dan Kaminsky. 34:21.910 --> 34:22.950 He's not drunk. 34:22.950 --> 34:24.610 I'm sorry, Dan fucking Kaminsky. 34:25.330 --> 34:27.350 He calls me God, he fucking Ron. 34:27.350 --> 34:30.740 Come on. 34:31.160 --> 34:32.760 Hold on, we'll get to that. 34:34.500 --> 34:38.100 Now, what do we actually do about it today? 34:39.700 --> 34:41.520 First of all, there are vendors. 34:41.860 --> 34:46.940 Anti-virus vendors, anti-spam vendors, let's even say ISPs. 34:47.360 --> 34:47.980 Vendors. 34:47.980 --> 34:50.300 A lot of vendors who try to give you solutions. 34:50.660 --> 34:53.940 Then there are more vendors who try to sell you stuff. 34:53.940 --> 34:55.360 Some of them do good shit. 34:55.360 --> 34:59.440 Seriously, there are companies such as Message Labs, Maps, Spam House. 34:59.440 --> 35:01.940 Companies that really do good for the internet. 35:02.000 --> 35:03.200 They're still vendors. 35:03.780 --> 35:08.780 And they look at their small way of making money and if they can do good with it, that's cool. 35:09.120 --> 35:10.720 Then we have research funds. 35:10.760 --> 35:15.820 Research in general such as the NSF, Army, Navy, DARPA, whatever. 35:16.700 --> 35:18.700 Then there is symptom-based response. 35:18.700 --> 35:21.220 For example, hand-spam. 35:21.780 --> 35:28.500 The FTC recently came up with something that they claim will report to every ISP. 35:28.980 --> 35:31.180 It will report to ISP the bots. 35:31.180 --> 35:33.560 Again, the bots are not the problem as far as I'm concerned. 35:33.980 --> 35:37.860 And any infected machine will have 10 more bots on it, at least. 35:38.800 --> 35:40.500 The botnets are the problem. 35:40.500 --> 35:42.800 But say they will report the bots. 35:43.700 --> 35:49.680 So what they do is look at emails, spam emails, and find the zombies that send them. 35:49.760 --> 35:55.320 Now, out of all the numbers of all the drones and bots out there, how many of them send spam? 35:56.360 --> 36:03.180 A lot, but not quite that many from the whole of the entire botnet population. 36:03.760 --> 36:06.020 Now here I have to discuss the botnet population. 36:06.020 --> 36:07.760 How many bots are actually out there? 36:08.160 --> 36:10.520 Because that's what people keep asking me. 36:10.960 --> 36:11.960 So I'll make this quick. 36:11.960 --> 36:13.460 I don't really give a shit. 36:13.580 --> 36:20.280 As I said, if you can destroy the world a thousand times over, why the hell would you care if you can do it just once? 36:21.080 --> 36:22.800 And that's what botnets are. 36:22.800 --> 36:30.240 But if I have to answer the question, I'll discuss research that has been happening unrelated for quite some time now. 36:31.540 --> 36:38.900 How often, or how soon, when you start scanning the internet when you put the machine on the internet, will it get scanned? 36:39.440 --> 36:45.080 A few years ago, to put the machine on the internet, it got scanned 36 hours after that. 36:45.620 --> 36:53.480 A couple of years ago, I checked, and depending on the ISP I checked on, I got scanned once every two seconds to once every 20 minutes. 36:54.100 --> 36:58.880 Kevin Mitnick, I believe, made some check and got around the same conclusions. 36:58.980 --> 37:03.160 On the site in SANS, internet survivability time is about 20 minutes or something like that. 37:03.160 --> 37:05.040 It keeps coming up and down. 37:05.420 --> 37:09.540 So basically, say it's not every two seconds like in my house. 37:09.760 --> 37:20.980 Say you actually get scanned for the easy vulnerabilities automatically by viruses, worms, whatever you want to call them right now, hacking tools, every 20 minutes once. 37:21.940 --> 37:31.720 Now, on broadband providers, out of all their clients, how many would be easily exploitable? 37:33.000 --> 37:51.040 Now, when you get to the potential population of that, and how many bots you can get installed on one machine, because basically I count the bots as how many samples are installed or working on each machine per IP address per machine, you get a huge number. 37:52.740 --> 38:00.300 Now, if you wanted to count it in another way, say you sync all the botnets, and that's not my research, that's somebody else's. 38:00.400 --> 38:19.600 Say you found botnets and you followed them, and you checked and saw that several botnets have the same IP addresses coming back again, there are time of day issues, DHCP issues, sometimes you see a Linux machine and then it's a Windows machine, but you actually see IP addresses returning. 38:19.880 --> 38:27.900 If you take that cut between the different groups, you may try and get to the point where you see the entire omega. 38:27.900 --> 38:30.700 This is David Duggan's research at Georgia Tech. 38:32.500 --> 38:38.560 He says, by the limited research he has done, he has seen about 20 million bots. 38:40.020 --> 38:41.260 That's nothing. 38:42.120 --> 38:46.360 If I had to give a number or just say 40 million, but that's nothing, people. 38:46.960 --> 38:47.920 Seriously. 38:48.080 --> 38:51.660 And why would I care about the number? 38:53.680 --> 39:02.000 Now, sorry, I had to give a terrible response to this if I didn't explain myself correctly, because it's critical. 39:02.560 --> 39:13.280 Now, another issue, and symptom-based response for the FTC came up with this issue and said, we'll report bots to the ISPs, not botnets bots, and they're reporting spam bots. 39:13.280 --> 39:17.320 They're reporting a symptom of the symptom, which is the zombies that send out spam. 39:18.200 --> 39:18.780 Great. 39:19.200 --> 39:21.420 A for effort, that's about it. 39:21.420 --> 39:23.420 I'm glad they're doing it, but it's nothing. 39:24.800 --> 39:25.880 Shoot the customer. 39:26.300 --> 39:27.120 I really like that. 39:27.120 --> 39:29.100 I want to shoot the customer, seriously. 39:29.100 --> 39:34.440 Blocking port 25 is one of the best things out there that can be done to stop spam. 39:34.640 --> 39:51.280 I hope Larry from Spamels will be here again to explain that, but basically lots of end-to-end, blocking port 25, blocking all these ports, no matter why now, if it's a good or bad idea, you're shooting the customer. 39:52.700 --> 39:54.460 That's how ISPs are dealing with it. 39:54.460 --> 39:55.820 I'm not saying it's bad, I'm not saying it's good. 39:55.820 --> 39:56.960 I actually like it. 39:56.960 --> 39:59.080 But it's shooting the customer. 39:59.340 --> 40:01.100 That's how we deal with it currently. 40:02.200 --> 40:03.320 Now to business. 40:03.320 --> 40:03.960 Why DA? 40:03.960 --> 40:06.580 And as we said, DA is a mailing list. 40:07.460 --> 40:10.620 Well, it gives community and industry involvement, basically. 40:10.620 --> 40:13.040 I'll discuss what it is exactly as I go. 40:13.860 --> 40:21.540 You see the anti-virus industry, academia, dynamic DNS providers, law enforcement, ISPs. 40:22.100 --> 40:29.220 There are other groups out there that work on the problem, and I'll discuss them in a minute, but none of them have the scope. 40:29.600 --> 40:31.320 I'll continue in a second. 40:31.700 --> 40:33.600 Long-term study and research. 40:33.760 --> 40:35.500 Killing viruses is bad. 40:36.200 --> 40:38.220 Guacamole was bad. 40:38.220 --> 40:47.700 Today when you actually kill a button, it not just jumps to the next IP address, the next compromised host, they actually learn from it, they become better at what they do. 40:47.700 --> 40:48.920 It's bad for us. 40:48.960 --> 40:51.680 Long-term research and study is critical. 40:51.800 --> 40:53.660 R&D, ways and means. 40:53.660 --> 40:55.240 Finding new solutions. 40:55.380 --> 41:00.360 Following technological operational evolution by the other side. 41:00.660 --> 41:03.560 Doing all that and still maintaining the vetting. 41:03.820 --> 41:06.900 And vetting does not mean secret entry club where nobody can enter. 41:06.900 --> 41:11.700 Hey, I'm lecturing in DEF CON for very few people, but still, lecture in DEF CON. 41:12.260 --> 41:18.360 The point is getting as many people involved as possible who care about the infrastructure and actually having the internet around. 41:20.080 --> 41:22.560 Now, this is not easy, but it's critical. 41:23.780 --> 41:25.700 Now, what does that mean? 41:26.040 --> 41:29.760 What can we do that a closed group of ISPs can't? 41:29.900 --> 41:31.940 Or a closed group of antivirus gods can't? 41:32.120 --> 41:38.760 Antiviruses care about signatures, libraries, which is great, that's their business plan, model, whatever. 41:39.000 --> 41:44.060 ISPs care to get their networks back online without problems, maintaining their networks. 41:44.060 --> 41:45.420 So they kill botnets. 41:45.700 --> 41:46.840 What do we do? 41:46.840 --> 41:48.740 First of all, we can do traceback. 41:49.240 --> 41:52.640 Tracking down the botnet, authors, controllers, whatever. 41:53.000 --> 41:55.680 Creating an intelligence database on who they are. 41:56.880 --> 41:59.720 Actionable intelligence, law enforcement cooperation. 42:00.120 --> 42:01.960 Get the intelligence, give it to law enforcement. 42:01.960 --> 42:03.660 Law enforcement does not care. 42:04.220 --> 42:05.180 What do I mean by that? 42:05.180 --> 42:06.880 I don't give a shit. 42:07.580 --> 42:09.080 And not because they're bad people. 42:09.940 --> 42:11.160 Actually, it's the opposite. 42:11.160 --> 42:12.740 Law enforcement cares. 42:13.220 --> 42:14.860 They can't do squat. 42:15.940 --> 42:21.640 We see a very large increase in their caring in the recent year, especially. 42:21.800 --> 42:28.700 They want to do good, but they care a lot more about the murderers out there, as they should. 42:28.800 --> 42:32.780 They do not have the resources to invest in this. 42:33.380 --> 42:34.760 Plain and simple. 42:35.680 --> 42:38.780 And it's not really their fault, it's policy. 42:39.380 --> 42:42.680 Policy from upstairs that dictates this. 42:43.140 --> 42:49.400 And I can tell you we have somebody who actually knows from his hard work who the bagel author is. 42:49.960 --> 42:52.900 And he gave them information, he gave them pictures of the guy. 42:54.080 --> 42:56.040 And they didn't do squat. 42:56.120 --> 42:56.960 Shit. 42:56.960 --> 42:57.720 Nothing. 43:00.480 --> 43:06.160 Again, I love the guys in law enforcement, and they're trying, but they can't because their hands are tied. 43:06.660 --> 43:08.300 So we can't count on them. 43:08.700 --> 43:10.300 Sorry, but that's the way it is. 43:10.880 --> 43:20.640 Now, reverse engineering, working actually on the samples rather than just the networks, IDSs, flows, whatever, shows us where they are technologically, what they can do. 43:21.320 --> 43:24.920 We can find the botnets better, we can see what they're doing, it's cool. 43:26.000 --> 43:27.380 Financial trace back. 43:27.380 --> 43:34.860 If you work with law enforcement or the financial industry, you see phishing, you can actually trace back from all ways. 43:34.920 --> 43:38.660 Not just on the network, not just on the sample level, financial trace back. 43:38.660 --> 43:40.080 See where the money is going. 43:40.080 --> 43:44.420 Which is basically the only thing the Fed knew how to do with phishing until very recently. 43:45.560 --> 43:46.400 Cooperation. 43:46.400 --> 43:50.620 That's the critical part, and that's where I was going with this lecture, basically. 43:51.060 --> 43:55.520 Working together to see the big picture, because everybody is an expert. 43:57.480 --> 44:01.580 But nobody, except if you work together, can see the macro level image. 44:01.580 --> 44:09.240 I mean, seriously, we'll talk about Casey in a minute, but she says, for example, the research community is looking for ideas on what to research. 44:09.460 --> 44:12.820 The industry needs solutions, and nobody is talking to one another. 44:14.340 --> 44:22.120 Now, DA and DA related projects, again, DA is a mailing list, because we had to start somewhere, and that's where we started. 44:22.480 --> 44:29.500 Carsnet, that's David Dagan from GA Tech, he does amazing work to study botnets, and he can't find funding. 44:30.580 --> 44:33.500 The bad guys have millions, and he can't find funding. 44:34.140 --> 44:43.140 But, that's a database, basically, for us to follow everything, gather information, pretty cool. 44:43.760 --> 44:48.280 Snort for ISPs, rather dead project right now, but we're working on it. 44:48.680 --> 44:51.980 Getting signatures out to detect botnets easier. 44:52.340 --> 44:53.840 Botnets, not bots. 44:54.640 --> 44:59.920 Passive DNS replication is critical, I do not have time to talk about it, I'm sorry, but it's critical. 45:00.040 --> 45:01.680 If you want, Google it. 45:02.740 --> 45:06.140 AS-based reporting, getting the reports out to ISPs. 45:07.080 --> 45:10.000 Monthly shaming, some ISPs do not give a shit. 45:10.440 --> 45:16.400 We need to shame them, and we are actually managing to change the map of the internet every month. 45:17.000 --> 45:24.480 Basically, it's, okay, we managed to get that ISP to work with us, which means, okay, the botnet controls are going to run to another ISP now. 45:24.700 --> 45:27.700 But we change the map, every month. 45:27.840 --> 45:32.260 Some ISPs don't give a shit, we're not sure how to handle that yet. 45:32.260 --> 45:35.580 There's some parts of the world we can't reach, but we're working on it. 45:35.580 --> 45:37.020 And I'll get to that in a second. 45:37.600 --> 45:38.680 Then there's Granix. 45:38.680 --> 45:41.660 You'll hear about that in the future, I'm not going to talk about it. 45:43.940 --> 45:47.000 Drone armies, at least I think so, I have no idea. 45:48.060 --> 45:52.280 I call it Dumbledore's army, I'm not sure if there are any Harry Potter fans here. 45:52.900 --> 45:53.460 No? 45:54.140 --> 45:55.520 You guys suck. 45:56.100 --> 45:58.420 Now, MWP is another mailing list. 45:58.420 --> 46:00.700 We had a lot of off-topic posts. 46:01.640 --> 46:07.540 There's nearly no noise, only signal on the mailing list until I decide, okay, this is too much signal and I just send some shit in. 46:07.960 --> 46:10.780 But it's a community, it's not completely operational. 46:10.940 --> 46:12.700 There are other lists that are operational. 46:15.280 --> 46:16.840 Spammed malware sites. 46:17.440 --> 46:21.480 You spam it via email, it's malware, we'll take it down. 46:22.520 --> 46:28.000 Captures, okay, there are many other companies that see these files online, we'll find them and we'll take them down. 46:28.000 --> 46:31.780 Now, I'm not supposed to say kill the site, but that's what we do. 46:31.780 --> 46:54.380 We do it legally, which means in lawyer talk I would have preferred to say something like we find the data, collect it, give it to the respectable authority to review and investigate and validate or whatever themselves, and then proceed according to their acceptable legal policy or whatever. 46:54.500 --> 46:56.040 Basically we kill the sites. 46:56.040 --> 46:58.440 Now, worm propagation sites take it down. 46:58.440 --> 47:06.260 For example, if there is a worm and you download samples, updates, whatever from some site, we'll take it down, we'll stop the worm from spreading. 47:07.160 --> 47:08.280 Phishing sites take it down. 47:08.280 --> 47:14.080 We don't do that anymore right now, I'll explain why later, but we still follow it very, very closely. 47:14.860 --> 47:17.860 Global law enforcement coordination and tracking of phishing groups. 47:18.340 --> 47:26.580 Law enforcement can work together very good, they have their own ways to communicate, but they suck on the small things. 47:26.720 --> 47:27.600 Seriously. 47:28.180 --> 47:41.560 And we have managed by giving them the actionable intelligence that they don't have, we managed to get several law enforcement agencies around the world working on taking these guys down, because they make money. 47:41.760 --> 47:50.400 And the only way that we can stop them from moving their botnet or their phishing or whatever to just another server is by changing their economics and make it not worth their while. 47:51.080 --> 47:52.460 That's basically it. 47:52.460 --> 47:54.380 And phishing on the net. 47:54.800 --> 48:12.970 We want to gather all these phishers, companies such as MessageLabs, Panels, all these guys, send us the phishers, we'll report them to ISPs, we'll get the shelf life of a phishing server down to two hours instead of six days. 48:13.370 --> 48:14.690 Ask Dan later. 48:14.690 --> 48:16.350 Sorry, I got five minutes. 48:17.150 --> 48:18.650 I'm serious, I'm sorry. 48:19.870 --> 48:21.290 Other projects. 48:21.350 --> 48:26.970 There are other lists out there, other projects, for example, NSP Sec for ISPs to work, you can Google it. 48:27.210 --> 48:32.070 The Aninet project, they don't want to work with law enforcement, they're pure researchers. 48:32.890 --> 48:36.850 APWG, Anti-Phishing Working Groups in the United States and Apex in the UK. 48:37.070 --> 48:45.070 UNISOC, Digital Finish Net, which is the FBI, which is just now starting to get some things done, they basically suck so far, I have high hopes. 48:45.470 --> 48:46.350 Microsoft. 48:46.450 --> 48:49.730 People, Microsoft is doing a lot. 48:50.450 --> 48:58.530 I believe their motives are more like, we want to prove to everyone we do good security, and we want to fucking take over the industry. 48:59.030 --> 49:08.870 That's what I believe their motives are, they're hiring a lot of people, but whatever their motives are, they're not really hiding as far as I see it. 49:08.870 --> 49:10.210 They do a lot of good. 49:10.850 --> 49:12.610 They actually do something. 49:13.790 --> 49:21.690 Now as far as I see it, the stakeholders so far I've been able to find... I'll get to Casey first, I'm sorry. 49:23.910 --> 49:24.790 Internet Governance. 49:24.790 --> 49:26.690 You might have heard Paul Vix's lecture. 49:27.890 --> 49:36.690 It's a lot of shit and crap and whatever, and the point is, we can go lower than that, it's trust. 49:36.690 --> 49:42.370 For example, nothing prevents me from going to dine right now with a 5 kilo hammer, or kick him in the nuts, or kill him, basically. 49:43.370 --> 49:45.090 In real life... 49:45.090 --> 49:49.530 Okay, Dan, my glock is at home. 49:49.870 --> 49:52.430 No, seriously, you guys are watching me. 49:52.850 --> 49:54.750 There are laws, there is fear. 49:54.750 --> 49:59.050 I don't know what's stopping me from doing that right now, but that's meatspace. 49:59.230 --> 50:02.510 On the internet, nothing stops me from doing that. 50:02.570 --> 50:06.410 For example, when people threaten sites for takedown. 50:06.450 --> 50:09.010 Pay me 10k right now, I'll take you down. 50:09.370 --> 50:17.230 In real life, especially in the States as far as I understand it, from movies in Hollywood, protection money is really good. 50:17.570 --> 50:18.850 Works really good. 50:20.830 --> 50:27.070 Somebody might come to you and say, look, you pay me right now, or I'll burn down your store, set it on fire. 50:27.850 --> 50:29.350 And you might pay him. 50:29.690 --> 50:31.650 Or he'll set your store on fire. 50:32.110 --> 50:36.910 Now once you've paid, it is likely that the guy won't set your store on fire. 50:37.270 --> 50:43.170 Further, if anybody else comes to you and says, hey, pay me or I'll set your store on fire, this guy will protect you. 50:43.650 --> 50:49.190 On the internet, they say, okay, pay me 10k right now, I'll set your store on fire. 50:51.710 --> 50:53.390 How do you know he won't? 50:53.410 --> 50:56.610 First off, it's the internet. 50:57.570 --> 51:00.750 Second, he can't stop anybody else from doing it anyway. 51:01.690 --> 51:09.470 And the point is, if I meet somebody online, say from Korea or Japan, he doesn't know me, I don't know him, why would he trust me? 51:09.470 --> 51:10.990 Why would she trust me? 51:11.310 --> 51:12.290 No reason. 51:13.470 --> 51:16.070 They may be the bad guy that's trying to trick me down. 51:16.070 --> 51:17.790 Would I share information with them? 51:18.170 --> 51:21.950 The bad guys are sharing information, making money, everything. 51:22.290 --> 51:24.170 We do not share information. 51:25.230 --> 51:27.030 We do not get things done. 51:27.070 --> 51:33.490 Now, if we don't get a way to cooperate and get things done, somebody else will find a way to do it for us. 51:33.950 --> 51:38.330 According to Casey again, I'm misrepresenting your ideas, that's to be clear. 51:38.330 --> 51:50.090 But as far as I understand their ideas, every network in the world ever built, whether it's communication network, transportation network, whatever, somebody came and made some order. 51:50.090 --> 51:53.050 That somebody was usually or always the government. 51:53.090 --> 51:58.990 Do we want the government, your government, my government, to come in and try and make the internet fall in place? 51:59.570 --> 52:02.490 They're already trying, especially in Canada and Australia, as far as I can see. 52:02.490 --> 52:04.030 Here in the States, everywhere. 52:04.430 --> 52:05.430 I doubt they'll succeed. 52:05.430 --> 52:09.130 What I see, basically, I'm not worried as Casey is. 52:09.250 --> 52:13.030 I believe it will either be Microsoft or the Russian mob. 52:13.430 --> 52:16.610 Now, you can quote me, God, he said the Russian mob and Microsoft, whoo! 52:16.610 --> 52:21.290 But seriously, these are the stakeholders right now. 52:21.290 --> 52:22.490 They make money. 52:25.150 --> 52:27.090 Microsoft and the Russian mob. 52:28.310 --> 52:29.470 Which one do I prefer? 52:29.470 --> 52:30.110 Exactly! 52:30.110 --> 52:32.130 Thank you for asking that question. 52:32.130 --> 52:33.190 Now, I love Microsoft. 52:33.190 --> 52:35.210 Seriously, they're doing a good job out there. 52:36.230 --> 52:37.770 I don't know why they care. 52:37.770 --> 52:40.790 They may have their own ideas, but they're doing a good job. 52:41.110 --> 52:42.370 They're the only ones. 52:44.250 --> 52:48.090 Now, cooperation, trust, just getting things done. 52:49.990 --> 52:50.790 Basically. 52:51.830 --> 52:53.730 We need to solve these problems. 52:55.310 --> 53:00.810 And usually, like I said last time, I would have expected a full hole when I said, get involved, people! 53:01.390 --> 53:04.270 We have many projects, maybe you have some ideas, too. 53:04.830 --> 53:08.510 But seriously, you're just like 20 people or something like that, but still, get involved. 53:08.510 --> 53:11.690 If you believe this is important, I do. 53:11.690 --> 53:12.930 We need help. 53:13.230 --> 53:17.350 Yes, I'm coming to DEF CON, and I'm saying we need help. 53:18.750 --> 53:23.890 In about two minutes, so I'll let Dan come up here with me, because it was very nice to come here anyway. 53:23.890 --> 53:24.870 Dan! 53:26.030 --> 53:27.070 Go! 53:34.700 --> 53:35.420 Farming. 53:35.420 --> 53:36.580 What about farming? 53:38.940 --> 53:41.100 Okay, the ITF sucks. 53:41.100 --> 53:44.360 They're good guys, the ITF, but they suck. 53:44.360 --> 53:48.220 Seriously, how long have they been dragging their feet on DNSSEC right now? 53:48.760 --> 53:49.660 15 years? 53:49.660 --> 53:50.740 11 years? 53:51.340 --> 53:52.840 You answer that. 53:53.780 --> 53:57.640 DNSSEC is an interesting scene. 53:57.640 --> 54:02.400 Farming basically gets into the idea of attacking the infrastructure. 54:02.740 --> 54:12.620 Really, though, we're already talking about botnets of the size of a quarter million to eventually multi-million infected hosts. 54:13.060 --> 54:16.660 The endpoints are getting owned, en masse. 54:17.080 --> 54:19.320 There's a thing called the Byzantine problem. 54:19.320 --> 54:27.040 You're a Byzantine general, and how do you control your troops when a fairly large portion of them want to turn on you? 54:27.040 --> 54:32.960 And there's ways of organizing the networks so that you can go and kill the generals that turn against you and such. 54:33.160 --> 54:38.940 There's a critical mass of hosts that if they're on your network and they're bad, you die. 54:39.380 --> 54:42.300 I don't know, is it 250,000? 54:42.300 --> 54:43.280 Is it a couple million? 54:43.280 --> 54:45.540 Is it 50% of your customer base? 54:45.540 --> 54:56.480 Eventually, online banking is really going to have to start accepting the possibility that too many of its customers are actually not its customers, but are coming from corrupted hosts. 54:56.480 --> 54:59.000 Already, if you go to Kinko's, you will see. 54:59.000 --> 55:01.240 They say, please do not use online banking. 55:01.240 --> 55:05.400 Or at least they say, please do not use anything with personally sensitive information. 55:05.400 --> 55:14.220 This is a result of a case in New York where a Chinese immigrant actually put botnet, or Trojan code, on all of the publicly available hosts. 55:14.720 --> 55:21.220 So, there's a couple things that I wanted to say because it's going to be on film and I'm going to be able to say, hey, I totally predicted that. 55:22.640 --> 55:28.640 Last year, like I said, the botnet control data, right now, DNS directs you to command and control servers. 55:28.800 --> 55:32.400 Eventually, they're just going to put commands in the command and control servers. 55:32.500 --> 55:42.400 At the scale of when you have all these machines, they can stop saying, okay, I want you to take everyone on this bank and send money, send all the money. 55:42.400 --> 55:45.140 They're going to start doing really intelligent things. 55:45.140 --> 55:53.020 When you have multi-million nodes broken into, you can say, huh, let's find everyone who's sending money to everyone else. 55:53.020 --> 55:57.340 Let's build a graph and let's find out who are the people who are receiving money from anyone. 55:57.340 --> 56:04.820 In other words, all the stuff the bank does to find fraud, the fraud people can use to find targets. 56:05.560 --> 56:07.480 So, I want to have your baby. 56:07.480 --> 56:08.800 I want to have your baby. 56:09.360 --> 56:18.360 So, no, I mean, the canonical attack becomes, okay, I find one guy who receives money from 10,000 different people. 56:18.360 --> 56:23.100 I put a tax on every transaction of, say, 1%, 10%. 56:23.100 --> 56:29.840 I hide the fact that the tax was applied because I control the interface on everyone. 56:30.020 --> 56:31.640 The money moves over to the guy. 56:31.640 --> 56:35.000 The bank thinks it's normal because the bank's always seeing money move. 56:35.000 --> 56:40.900 And the guy never actually gets any extra money because he gets his account drained of the extra money. 56:41.160 --> 56:48.580 These are the kind of threats that really happen when every single, you know, when large numbers of endpoints are broken into. 56:48.580 --> 56:51.600 And it stops being about a couple thousand here or there. 56:52.680 --> 56:54.760 This kind of stuff is going to happen. 56:55.040 --> 56:56.920 And, you know, I don't know if you guys know this. 56:56.920 --> 57:05.280 The financial network is kind of converging on sending money instantaneously when all of the security stuff is really saying, hey, slow down. 57:05.280 --> 57:06.080 We need to check. 57:06.080 --> 57:07.280 We need to go back. 57:07.280 --> 57:09.100 So, it's a real question. 57:09.100 --> 57:13.160 What is going to happen to the speeding up of the financial system? 57:13.160 --> 57:15.620 And it's a real, real question. 57:15.620 --> 57:19.940 Are we going to be able to do online banking with personal computers in a year and a half? 57:19.980 --> 57:26.220 This botnet stuff that Gadi is doing, every day he does what he does is another day we can use online banking. 57:26.220 --> 57:27.440 Okay, that's enough. 57:28.260 --> 57:30.580 Online banking is one issue, basically. 57:30.660 --> 57:31.840 We need to work together. 57:31.840 --> 57:33.460 We need to find solutions. 57:33.620 --> 57:35.280 We need to get things done. 57:35.440 --> 57:38.280 Because we use the internet, no matter who we are. 57:38.460 --> 57:44.820 I mean, this sounds like, I want to cure world anger and cancer and all that, but seriously, come on! 57:45.380 --> 57:48.120 And with that, I'll take another question and finish because... 57:53.400 --> 57:56.600 Yes, I am with the Mossad and I'm going to send quads after you. 57:58.540 --> 58:00.320 I do send the quads after them. 58:00.320 --> 58:08.060 If you watch the MI6 site, by the way, I just heard it last week, you will actually see that they say, mess with us and we'll mess with you. 58:08.060 --> 58:10.040 MI6 people, they're cool. 58:12.880 --> 58:17.640 It's not just a newsletter, it's a whole effort of trying to get things done. 58:17.800 --> 58:18.680 So, contact me. 58:18.680 --> 58:20.200 You have my email address. 58:20.840 --> 58:24.900 gadi.sert.gov.il or ge.linuxbox.org. 58:25.200 --> 58:26.180 Contact me. 58:26.180 --> 58:27.220 Talk to me. 58:27.600 --> 58:29.140 We need help. 58:29.340 --> 58:30.020 That's it. 58:30.020 --> 58:30.720 Thank you. 58:31.180 --> 58:33.240 And... fucking Dan Kaminsky!