1 00:00:10,180 --> 00:00:11,380 Hey everybody. 2 00:00:12,700 --> 00:00:15,820 Alright, thanks for coming to Not A Google Talk. 3 00:00:20,960 --> 00:00:26,660 And those of you that have seen me speak before know that this is going to drive me absolutely insane. 4 00:00:26,660 --> 00:00:28,280 I cannot stand in one place. 5 00:00:28,360 --> 00:00:31,440 You see me doing a little dance, that's what it's all about. 6 00:00:31,680 --> 00:00:33,160 Alright, let's get started. 7 00:00:33,160 --> 00:00:38,960 Just a show of hands, how many of you have read any of the books in the Stealing the Network series? 8 00:00:38,980 --> 00:00:40,080 Show of hands. 9 00:00:40,080 --> 00:00:40,960 Excellent. 10 00:00:41,340 --> 00:00:45,020 How many of you have Stealing the Identity, the latest in the series? 11 00:00:45,640 --> 00:00:46,360 Excellent. 12 00:00:46,360 --> 00:00:48,560 How many of you are authors in Stealing the Identity? 13 00:00:48,560 --> 00:00:49,820 There we go. 14 00:00:50,780 --> 00:00:52,400 There it is, show of love. 15 00:00:52,540 --> 00:01:05,220 Alright, what we're going to do here is, those of you that aren't familiar with the stealing story, there was some interesting stuff that happened in the book with this psychopath named Newt who happens to be sitting in the front row. 16 00:01:05,680 --> 00:01:10,080 I won't point him out, but you can narrow it down from the hands that went up. 17 00:01:10,540 --> 00:01:14,940 Anyway, this guy Newt was up to absolutely no good. 18 00:01:14,980 --> 00:01:18,620 His whole thing was he didn't want to get caught by the man. 19 00:01:18,620 --> 00:01:27,740 So what he did is he took all his hard drives, took all his CDs, took all his removable media, and melted them down when he was done doing his thing. 20 00:01:28,420 --> 00:01:36,580 Now when Singers came to me and they were like, hey we got this great book series called Stealing, we want you to write on it. 21 00:01:36,580 --> 00:01:38,240 I was like, sweet. 22 00:01:38,320 --> 00:01:40,860 I was like, this is excellent, rock on. 23 00:01:40,940 --> 00:01:44,420 They were like, well you get to catch Newt. 24 00:01:44,640 --> 00:01:46,600 I was like, oh. 25 00:01:47,160 --> 00:01:50,220 Well the bottom line was, it was a tough job. 26 00:01:50,220 --> 00:02:01,760 So what I'm going to try to do is I'm going to try to give you an idea of what it's like to try to catch a guy like this who's ultra paranoid, who does everything in his power to basically keep from getting caught. 27 00:02:02,080 --> 00:02:07,460 And as it turned out, Newt's death was going to be a death by a thousand cuts. 28 00:02:07,460 --> 00:02:13,500 I'm not going to ruin anything and I'm not going to say that Newt died, but you'll have to read the book to find out. 29 00:02:14,640 --> 00:02:19,880 Alright, so anyway, that's basically all that stuff that I said. 30 00:02:19,880 --> 00:02:25,900 We are going to be looking at Newt's place through the eyes of this guy I'm calling Uber Agent. 31 00:02:26,540 --> 00:02:31,260 So for the next half an hour, 40 minutes or so, you get to play Uber Agent. 32 00:02:31,380 --> 00:02:35,440 And we're going to have some interesting games as we go through here. 33 00:02:35,440 --> 00:02:44,720 We're going to be playing some find the evidence games, where you guys as an audience have to try to find the evidence in various places. 34 00:02:45,020 --> 00:02:49,460 I'm going to show you some pictures, we're going to have a little fun with it. 35 00:02:49,900 --> 00:02:56,380 I've got a pile of books up here that I'm going to be giving away to those of you that find the evidence the quickest. 36 00:02:56,800 --> 00:03:00,020 The whole hand-raising thing, it's not going to cut it. 37 00:03:00,660 --> 00:03:11,420 If you want a book, and I'm doing a find the evidence contest here, you have to stand up and scream at the top of your lungs the correct answer. 38 00:03:11,580 --> 00:03:14,080 You've got to commit if you want the books. 39 00:03:15,280 --> 00:03:18,100 Now, we're going to start off pretty lightweight. 40 00:03:18,100 --> 00:03:20,240 This is not for a prize. 41 00:03:20,440 --> 00:03:22,760 Please remain seated. 42 00:03:23,280 --> 00:03:27,360 Help me find the evidence. 43 00:03:30,120 --> 00:03:31,260 Thank you. 44 00:03:31,580 --> 00:03:33,880 We're going to start off pretty easy. 45 00:03:34,080 --> 00:03:37,620 Now, in the stealing book, Newt did not have an iPod. 46 00:03:37,620 --> 00:03:39,040 That wasn't part of the story. 47 00:03:39,040 --> 00:03:43,600 But one of the interesting devices that I'm seeing all over the place are these iPods. 48 00:03:43,600 --> 00:03:47,420 And everybody knows they hold music, they can hold data, the whole nine yards. 49 00:03:47,420 --> 00:03:51,200 But the bottom line is there's a whole lot to it that folks really haven't considered. 50 00:03:51,200 --> 00:03:55,540 So what I'm going to do is sort of take you through what some of that stuff might be. 51 00:03:57,840 --> 00:04:15,040 First of all, this is the standard practice for the man, the Fed, is to grab a device like this and pick it up and sort of flip through it and see what's there, hit that little about menu, get information from the iPod. 52 00:04:15,040 --> 00:04:17,900 Well, the simple fact of the matter is that's bad news. 53 00:04:18,240 --> 00:04:24,740 Picking up any sort of device on a scene and mucking with it is going to potentially destroy evidence. 54 00:04:24,920 --> 00:04:29,600 And if a decent lawyer gets a hold of that in court, that evidence that you discover is going to get tossed. 55 00:04:30,020 --> 00:04:33,180 So doing this is a bad idea. 56 00:04:33,420 --> 00:04:38,480 So let's talk about some of the things that we can do to sort of investigate these things. 57 00:04:38,580 --> 00:04:45,820 I'll be the first to tell you, and no offense to those that do forensics full time, forensics is a little bit dry. 58 00:04:47,900 --> 00:04:49,100 No offense. 59 00:04:49,100 --> 00:04:51,560 I mean, CSI is very cool, right? 60 00:04:52,480 --> 00:05:02,080 The slightly aging but still quite attractive redhead and the not so aging and quite attractive brunette make it interesting. 61 00:05:02,720 --> 00:05:04,700 But that has nothing to do with forensics. 62 00:05:04,700 --> 00:05:07,080 But I'll try to spice it up a little bit. 63 00:05:07,240 --> 00:05:08,000 All right. 64 00:05:08,580 --> 00:05:16,980 As far as an investigative platform for these things, I hate to be the some sort of raving Mac fan. 65 00:05:17,040 --> 00:05:28,380 But the simple fact of the matter is if you've got an iPod that was formatted on a Mac, the best way to actually take apart that iPod forensically is by using a Mac. 66 00:05:29,200 --> 00:05:35,240 One of the best reasons for that, the biggest reasons for that is quite simply the HFS plus support. 67 00:05:35,280 --> 00:05:39,740 The iPod is basically an HFS plus portable file system. 68 00:05:40,320 --> 00:05:43,440 That's a Mac native file system. 69 00:05:43,500 --> 00:05:45,640 That's not to say Linux can't handle it. 70 00:05:45,640 --> 00:05:48,040 Linux can handle HFS plus. 71 00:05:48,260 --> 00:05:50,280 But it's not native on Linux. 72 00:05:50,300 --> 00:05:53,880 And Windows with HFS plus, well, just forget about it. 73 00:05:54,120 --> 00:05:54,720 All right. 74 00:05:54,720 --> 00:05:59,360 The bottom line is most of the time you're going to want to be using a Mac to actually pull these things apart. 75 00:05:59,800 --> 00:06:00,440 All right. 76 00:06:00,440 --> 00:06:11,920 Now, one of the things that a good investigator has to sort of figure out, and this is all part of the big puzzle, is I've got an investigative platform, what do I actually have to do to keep from tampering the evidence that's on this thing? 77 00:06:13,060 --> 00:06:14,860 All right. 78 00:06:14,860 --> 00:06:29,120 And one of the things that needs to be considered is the fact that when you slap an iPod into a Mac, you connect it up, one of the first things that happens is this demon, this disk arbitration demon, actually latches onto the iPod. 79 00:06:29,120 --> 00:06:36,220 This is the demon that actually causes things like iTunes to launch and the contact lists to update and all that stuff to sync. 80 00:06:36,620 --> 00:06:40,080 Well, from an investigative standpoint, that's bad news. 81 00:06:40,340 --> 00:06:40,820 All right? 82 00:06:40,820 --> 00:06:45,980 You don't want your investigation machine tramping all over this iPod and destroying evidence. 83 00:06:45,980 --> 00:06:48,880 So one of the first things you need to do is you need to hammer this demon. 84 00:06:49,100 --> 00:06:53,620 Now, this demon automatically restarts when you kill it. 85 00:06:53,620 --> 00:06:53,900 Okay? 86 00:06:53,900 --> 00:07:04,720 So actually what you have to do is you have to take this demon and you have to change mode it to 0, 0, 0, physically change mode the binary in S bin and then kill it. 87 00:07:05,020 --> 00:07:05,160 Okay? 88 00:07:05,160 --> 00:07:12,840 Now, once you do that, you get to the point where you've got a device that you can actually hook up to a machine and start looking for evidence. 89 00:07:12,860 --> 00:07:13,460 All right. 90 00:07:13,460 --> 00:07:15,420 But we're not exactly there yet. 91 00:07:16,980 --> 00:07:22,460 One of the other things that we need to do is we need to hook this thing up so that it's in sort of a read-only mode. 92 00:07:22,460 --> 00:07:22,920 Okay? 93 00:07:22,920 --> 00:07:24,980 And that takes a little bit of work as well. 94 00:07:24,980 --> 00:07:30,540 Just killing the demon that automatically connects to this thing and launches iTunes isn't going to be enough. 95 00:07:30,580 --> 00:07:33,400 So we need to get it into sort of a USB disk mode. 96 00:07:33,400 --> 00:07:37,460 How many of you have been inside an iPod's diagnostic mode? 97 00:07:37,460 --> 00:07:38,560 Show of hands. 98 00:07:39,160 --> 00:07:39,520 Okay. 99 00:07:39,520 --> 00:07:42,140 How many of you have actually used an iPod? 100 00:07:42,460 --> 00:07:43,260 Okay. 101 00:07:43,260 --> 00:07:44,420 Quite a few. 102 00:07:44,440 --> 00:07:51,500 This diagnostic mode is key to actually pulling stuff off of the iPod without totally hosing yourself in court. 103 00:07:51,640 --> 00:07:54,620 And this is a third generation iPod. 104 00:07:54,620 --> 00:07:57,620 The way this thing works is slightly different. 105 00:07:58,040 --> 00:08:01,440 And I know this looks like a cheat on like a PlayStation or something. 106 00:08:01,480 --> 00:08:01,880 Right? 107 00:08:01,980 --> 00:08:03,980 So you power it off. 108 00:08:03,980 --> 00:08:06,700 You hold down the forward, the backward, and the center button. 109 00:08:06,700 --> 00:08:09,220 Select and release them all at the same time. 110 00:08:09,220 --> 00:08:11,080 If you do that, you get the cheat code. 111 00:08:11,280 --> 00:08:11,800 All right? 112 00:08:11,820 --> 00:08:14,220 And the cheat code is diagnostic mode. 113 00:08:14,540 --> 00:08:16,580 You get a menu that looks something like this. 114 00:08:16,580 --> 00:08:18,320 It's got a bunch of different options. 115 00:08:18,380 --> 00:08:22,900 One of the things that we're going to hit is we're going to hit USB mode inside the iPod. 116 00:08:24,740 --> 00:08:27,500 After we reboot, we get a screen that looks like this. 117 00:08:28,600 --> 00:08:29,020 All right. 118 00:08:29,020 --> 00:08:33,680 At this point, you sort of have a choice between treating this like a fire wire device and a USB device. 119 00:08:34,260 --> 00:08:36,140 I'm going to fly through the boring stuff. 120 00:08:36,180 --> 00:08:40,900 Once you get all that done, you get a screen that looks like this that basically says I'm in disk mode. 121 00:08:40,900 --> 00:08:42,880 So the iPod is no longer an iPod. 122 00:08:42,880 --> 00:08:47,400 It's basically a disk that's about as close to read-only as you can get. 123 00:08:47,680 --> 00:09:00,980 Now, the reason I'm dragging you through all this boring stuff is most people don't realize how difficult it is to actually be an investigator, to be one of the good guys, to actually go through all this stuff to try to catch, well, people like you. 124 00:09:03,240 --> 00:09:07,360 But the bottom line is, you know, the good guys are pretty smart, too. 125 00:09:07,380 --> 00:09:09,120 Not that I'm choosing sides here. 126 00:09:09,120 --> 00:09:11,560 And they're not nearly as dumb as we paint them out to be. 127 00:09:11,560 --> 00:09:17,160 Simple fact of the matter is, they will go through this process to actually get to your stuff that's on the iPod. 128 00:09:17,160 --> 00:09:20,580 So the question becomes, what exactly can be on an iPod? 129 00:09:21,700 --> 00:09:23,880 Here's a file listing. 130 00:09:23,880 --> 00:09:27,060 The iPod actually just shows up as another device on the machine. 131 00:09:27,060 --> 00:09:28,600 So we mount the device. 132 00:09:28,600 --> 00:09:30,020 We do a listing. 133 00:09:30,220 --> 00:09:32,860 Can anybody see anything interesting about this file listing? 134 00:09:32,860 --> 00:09:34,040 Anything that stands out? 135 00:09:41,010 --> 00:09:43,830 Next time, answer slower so I can swallow. 136 00:09:45,750 --> 00:09:46,430 Yeah. 137 00:09:47,950 --> 00:09:48,830 Whew. 138 00:09:49,290 --> 00:09:50,550 Yeah, there's a nopics. 139 00:09:50,550 --> 00:09:52,790 There's a nopics.img file on here. 140 00:09:52,790 --> 00:09:55,710 This is a persistent encrypted nopics home directory. 141 00:09:55,710 --> 00:09:58,570 Those of you that use nopics realize what this thing is. 142 00:09:58,630 --> 00:10:04,170 The bottom line is, yeah, you can absolutely put whatever you want on this iPod as a file. 143 00:10:04,170 --> 00:10:13,190 But one of the things that gets really interesting is when you start using the iPod for other things, for example, booting it, booting from it as a device, okay? 144 00:10:13,190 --> 00:10:17,570 Booting from it with a nopics CD or booting from it absolutely natively. 145 00:10:17,570 --> 00:10:21,550 Actually loading a distribution of nopics on it, booting right from the iPod. 146 00:10:21,550 --> 00:10:24,070 You've got basically a portable platform. 147 00:10:24,070 --> 00:10:25,910 It's got all your attack tools on it. 148 00:10:25,910 --> 00:10:28,490 You can use it just like any other machine. 149 00:10:28,490 --> 00:10:30,350 Hook it up, boot, and you go. 150 00:10:30,690 --> 00:10:31,510 Where's Tyler? 151 00:10:31,510 --> 00:10:32,470 Is Tyler here? 152 00:10:33,570 --> 00:10:34,650 Where's Tyler? 153 00:10:34,650 --> 00:10:35,390 All right, Tyler. 154 00:10:36,750 --> 00:10:37,590 Thank you. 155 00:10:37,590 --> 00:10:41,790 Everybody give our newest goon, Tyler, a big round of applause right there. 156 00:10:45,860 --> 00:10:46,400 All right. 157 00:10:46,400 --> 00:10:49,760 Now that I've absolutely embarrassed her and she's going to hide from all of you. 158 00:10:49,900 --> 00:10:54,560 Tyler actually submitted a talk that had nothing to do, that had everything to do with iPods. 159 00:10:54,560 --> 00:10:57,760 It was just about iPods and all the cool stuff you can do with them. 160 00:10:57,760 --> 00:11:06,840 She's actually got a shuffle that she can boot from that boots nopics but also comes up in iTunes natively so that it can have music running from it, attack tools, the whole nine yards. 161 00:11:06,900 --> 00:11:09,720 Yeah, with a little device the size of a stick of gum. 162 00:11:09,880 --> 00:11:11,240 It's pretty cool stuff. 163 00:11:11,240 --> 00:11:14,200 Show of hands, how many people would have been interested in a talk like that? 164 00:11:15,160 --> 00:11:15,780 Cool. 165 00:11:15,780 --> 00:11:16,580 Thank you. 166 00:11:16,800 --> 00:11:17,040 All right. 167 00:11:17,040 --> 00:11:19,140 Anybody that's on the review board, take note. 168 00:11:19,520 --> 00:11:20,220 All right. 169 00:11:20,740 --> 00:11:22,200 I've done my plug. 170 00:11:23,660 --> 00:11:24,080 Okay. 171 00:11:24,080 --> 00:11:26,660 There's obviously other stuff that's on an iPod. 172 00:11:26,920 --> 00:11:30,760 This shows a screen from an AAC file, just a music file. 173 00:11:31,160 --> 00:11:39,940 Those of you that have messed around in the AAC space know that you can absolutely use these things and lock them down so that you have to authorize them on various machines and all that. 174 00:11:40,120 --> 00:12:00,220 Well, the thing that's interesting from an evidence standpoint, remembering we're supposed to be Uber agent here trying to catch that guy, oh, not going to point at him, that bastard Newt, who's ultra paranoid, is that we need to look in places like music files on an MP3 player in ways that are not necessarily standard. 175 00:12:00,220 --> 00:12:05,260 For example, you can see when I launch this AAC file that the registered e-mail address pops up. 176 00:12:05,380 --> 00:12:08,400 This is the user that actually, you know, purchased this song. 177 00:12:08,400 --> 00:12:10,320 It's the e-mail address that they used. 178 00:12:10,760 --> 00:12:16,620 So, yeah, you can pull out e-mail addresses from the music files as an investigator, use those for more leads. 179 00:12:19,480 --> 00:12:20,220 Okay. 180 00:12:20,260 --> 00:12:26,280 The other thing that's often overlooked, and I know this is old news, but metadata inside the files. 181 00:12:26,280 --> 00:12:29,980 You know, you get a music file, you get any kind of file, there's a potential for metadata. 182 00:12:30,040 --> 00:12:31,840 You can have all sorts of stuff in here. 183 00:12:31,840 --> 00:12:33,900 Anybody see anything odd with this one? 184 00:12:36,390 --> 00:12:38,030 Wow, you guys are good. 185 00:12:38,250 --> 00:12:39,650 Yeah, the comments field. 186 00:12:40,070 --> 00:12:42,810 There's been a lot of work done recently in covert channels. 187 00:12:42,810 --> 00:12:48,990 A good friend of mine, Russ Rogers, is doing the hacking the terror network book, talks about covert channels and things like that. 188 00:12:48,990 --> 00:12:59,410 The simple fact of the matter is, as bad guys, I'm not generalizing, but, yeah, as bad guys, you know perfectly well that you can use covert channels just about anywhere. 189 00:12:59,410 --> 00:13:00,790 Music files are no different. 190 00:13:00,790 --> 00:13:06,470 A really good investigator is going to actually look in those files to see if there's anything that's out of the ordinary. 191 00:13:07,230 --> 00:13:09,290 And this is just one of the spots that he's going to look. 192 00:13:12,560 --> 00:13:13,160 All right. 193 00:13:13,180 --> 00:13:19,140 Also, the normal stuff that would be on an iPod, you can have your contact list, you can have your calendar, you can have all that stuff. 194 00:13:20,680 --> 00:13:26,460 This is just an example, but, yeah, your address book syncs to it, so an investigator is going to pull all that stuff off. 195 00:13:26,660 --> 00:13:27,740 Yada, yada, yada. 196 00:13:28,640 --> 00:13:29,840 All right. 197 00:13:29,840 --> 00:13:38,020 Other things about MP3 files in general is a lot of them use the metadata to store information about last time played and all that kind of stuff. 198 00:13:38,020 --> 00:13:39,660 All that stuff's going to be on there. 199 00:13:39,660 --> 00:13:45,940 Also, if the investigator is really good, one of the things he's going to do is he's going to take all the music files, he's going to run hashes against them. 200 00:13:46,180 --> 00:14:00,580 And if there's peer-to-peer software on the machine, the bad guy's got peer-to-peer software, he's actually in some cases going to check the file hashes of the same songs on a peer-to-peer network to see if the file hashes match. 201 00:14:00,580 --> 00:14:05,480 You know, if you've got somebody that's just pirating music, there's a good chance that these hashes are going to match. 202 00:14:05,500 --> 00:14:17,300 If the investigator finds a song whose MD5, I'm sorry, you don't use MD5 anymore, thanks, Dan, your SHA1 hash doesn't match, it'd be something worth looking at. 203 00:14:18,240 --> 00:14:18,900 All right. 204 00:14:18,900 --> 00:14:20,060 Digital cameras. 205 00:14:21,140 --> 00:14:27,720 Obviously, I'm doing some of the more obvious things first, because, you know, investigators, we're just going to do real obvious stuff. 206 00:14:27,720 --> 00:14:30,080 Digital cameras, absolutely, they're going to be picked up. 207 00:14:30,080 --> 00:14:32,900 What about the images that are actually on these cameras? 208 00:14:33,980 --> 00:14:38,440 Well, first of all, yeah, there are images on digital cameras. 209 00:14:38,440 --> 00:14:39,060 Hello. 210 00:14:39,320 --> 00:14:39,940 You know? 211 00:14:40,160 --> 00:14:47,480 I think a lot of investigators and a lot of the good guys actually forget the fact that they're pictures, they're not just data. 212 00:14:47,620 --> 00:14:54,020 So the simple fact is actually looking at the pictures themselves to try to pull out evidence from the image themselves is a good idea. 213 00:14:54,120 --> 00:14:58,640 For example, here's an image with all sorts of metadata. 214 00:14:59,060 --> 00:15:04,260 I know it's probably very hard to read, but can anybody tell me what's wrong with this picture? 215 00:15:05,460 --> 00:15:06,580 What was it? 216 00:15:07,720 --> 00:15:08,400 Huh? 217 00:15:09,540 --> 00:15:11,520 There's lots of network cables, yeah. 218 00:15:11,640 --> 00:15:14,420 Let me give you a little bit of a hint. 219 00:15:14,420 --> 00:15:20,420 The date time stamp on here shows the time as being approximately 4 in the morning. 220 00:15:23,450 --> 00:15:24,330 Absolutely. 221 00:15:24,370 --> 00:15:25,490 Shouldn't be daylight. 222 00:15:25,490 --> 00:15:25,670 Okay? 223 00:15:25,670 --> 00:15:32,930 The simple fact of the matter is there should not be daylight at 4 o'clock in the morning, and the question is what does that mean? 224 00:15:32,990 --> 00:15:33,530 Okay? 225 00:15:33,530 --> 00:15:34,750 As evidence. 226 00:15:35,670 --> 00:15:36,410 You know? 227 00:15:36,930 --> 00:15:38,190 Could mean a lot of things. 228 00:15:38,190 --> 00:15:40,690 Could mean the date time stamp on the camera is broken. 229 00:15:40,690 --> 00:15:43,130 What if the date time on the camera is right? 230 00:15:45,030 --> 00:15:45,630 That's right. 231 00:15:45,630 --> 00:15:47,790 The picture was taken in a different time zone. 232 00:15:47,790 --> 00:15:49,390 So it's things like that. 233 00:15:49,390 --> 00:15:52,790 The actual time on the digital camera, you can't pull off. 234 00:15:52,790 --> 00:15:57,010 You actually have to look at the digital camera itself and figure out what the time is set to. 235 00:15:57,790 --> 00:16:08,950 This was actually used in one of the books to catch somebody that was, and this was the stealing book, to actually figure out that somebody took the picture in another country. 236 00:16:09,250 --> 00:16:09,430 Okay? 237 00:16:09,430 --> 00:16:13,690 So the investigator actually picked up on that and went, okay, what are my choices? 238 00:16:13,690 --> 00:16:15,370 What countries is this daylight? 239 00:16:15,370 --> 00:16:16,270 Let's narrow it down. 240 00:16:16,270 --> 00:16:17,410 Let's cross-reference it. 241 00:16:17,410 --> 00:16:18,450 Yada, yada, yada. 242 00:16:18,630 --> 00:16:20,010 Another plug for stealing. 243 00:16:20,010 --> 00:16:20,810 Thank you. 244 00:16:22,430 --> 00:16:23,090 All right. 245 00:16:23,090 --> 00:16:25,370 A little bit more about EXIF stuff. 246 00:16:26,190 --> 00:16:29,350 Are the date times consistent with the pictures? 247 00:16:29,550 --> 00:16:33,370 There could be potential for thumbnail inconsistencies. 248 00:16:33,370 --> 00:16:35,750 You look at a picture, you look at the embedded thumbnail. 249 00:16:35,750 --> 00:16:41,510 If it's been processed in some sort of imaging program that didn't update the thumbnail, you can see the inconsistencies there. 250 00:16:41,510 --> 00:16:42,790 All sorts of stuff. 251 00:16:44,210 --> 00:16:44,930 All right. 252 00:16:44,930 --> 00:16:49,170 Now, I know these are very hard to read, but there's two images here. 253 00:16:49,170 --> 00:16:52,230 Can anybody tell me what's different between the two images? 254 00:16:54,110 --> 00:16:55,030 Good. 255 00:16:55,030 --> 00:16:56,030 Sizes. 256 00:16:56,850 --> 00:16:59,990 The create time and dates are different. 257 00:16:59,990 --> 00:17:02,950 The stamp on the camera software has changed. 258 00:17:02,950 --> 00:17:08,370 It's gone from being an actual camera stamp to being a Photoshop stamp. 259 00:17:08,810 --> 00:17:20,570 I know this is old stuff, but the bottom line is the good guys are actually going to be using these techniques to figure out if you've processed an image outside the camera, modified it in any way, et cetera, et cetera. 260 00:17:23,170 --> 00:17:24,290 All right. 261 00:17:25,510 --> 00:17:29,270 Now, this one's easy, so it's not for a book. 262 00:17:30,050 --> 00:17:31,850 Not for a book. 263 00:17:31,850 --> 00:17:32,810 Sorry. 264 00:17:34,010 --> 00:17:34,650 Okay. 265 00:17:35,050 --> 00:17:36,730 No, it's not the USB. 266 00:17:36,730 --> 00:17:37,530 Sit down. 267 00:17:38,150 --> 00:17:40,390 For a book, where's the evidence? 268 00:17:42,050 --> 00:17:45,270 She stood up and was very bold, and you get a book. 269 00:17:45,270 --> 00:17:46,030 Come on up. 270 00:17:54,210 --> 00:17:55,210 All right. 271 00:17:55,350 --> 00:17:56,190 Very nice. 272 00:17:56,190 --> 00:17:58,610 You get the idea how this game works, right? 273 00:17:58,610 --> 00:18:00,390 Yeah, there's a USB there. 274 00:18:00,390 --> 00:18:01,810 There's a PowerBook sitting there. 275 00:18:01,810 --> 00:18:04,230 Yeah, it's real obvious places to look for evidence. 276 00:18:04,230 --> 00:18:06,530 But yeah, there's a phone in the picture, okay? 277 00:18:06,530 --> 00:18:11,470 And it's, you know, just a normal phone that you'd find on the desk in just about any office. 278 00:18:11,670 --> 00:18:19,590 But the simple fact is that there's possible data inside this phone that might not show up in things like call logs. 279 00:18:19,670 --> 00:18:25,050 For example, you dump the PBX logs, there's all sorts of stuff jammed in the redial. 280 00:18:25,050 --> 00:18:28,390 For example, in this, you know, I wasn't gonna show you any real PIN numbers. 281 00:18:28,410 --> 00:18:33,730 I dial up a number, I put in a PIN number, it's actually captured inside that redial info. 282 00:18:33,730 --> 00:18:36,270 By playing with the phone, you can get that information out. 283 00:18:36,270 --> 00:18:38,030 It might be lost in a call log. 284 00:18:39,450 --> 00:18:40,170 All right? 285 00:18:40,290 --> 00:18:45,610 Other things that you can get, you can get park settings, in-dial forwarding, all sorts of information. 286 00:18:45,610 --> 00:18:49,450 Again, this stuff might not necessarily show up anywhere else. 287 00:18:49,470 --> 00:18:56,370 If the desk phone is forwarded to a cell phone, the phone itself might be the only place to actually get that information. 288 00:18:56,370 --> 00:18:59,130 So a good investigator's actually gonna consider this stuff. 289 00:19:01,810 --> 00:19:12,770 Speaking of phones, cell phones, most of you guys know this stuff, but just for completeness, cell phones have cameras in them, obviously, you've got images in them, yadda, yadda, yadda. 290 00:19:12,770 --> 00:19:15,890 A lot of them have SD or mini SD cards inside of them. 291 00:19:15,890 --> 00:19:17,850 Those SD cards should be removed. 292 00:19:18,250 --> 00:19:20,510 It's not necessarily the same as a SIM card. 293 00:19:20,510 --> 00:19:22,370 There could be other stuff that's on there. 294 00:19:22,450 --> 00:19:24,390 How many saw Mudge's talk this morning? 295 00:19:25,010 --> 00:19:25,890 Show of hands. 296 00:19:26,310 --> 00:19:26,790 All right. 297 00:19:26,790 --> 00:19:33,650 One of the things that I found very interesting, a couple things I found interesting about Mudge's talk was he pulled out his sidekick phone. 298 00:19:33,890 --> 00:19:46,010 And one of the things that he revealed was that when he basically lost his phone and got another phone, all his images and all his phone lists were automatically populated back down to his sidekick. 299 00:19:46,010 --> 00:19:48,550 Brand new phone, brand new SIM card. 300 00:19:48,610 --> 00:19:54,310 So the images actually went out to the website and once he re-registered, they came back down to his phone. 301 00:19:54,310 --> 00:19:59,390 Bottom line is this is fairly transient stuff that might be hard to pick up any other way. 302 00:20:00,950 --> 00:20:01,710 All right. 303 00:20:02,110 --> 00:20:02,910 Printers. 304 00:20:03,950 --> 00:20:05,430 Printers are often overlooked. 305 00:20:05,430 --> 00:20:08,990 Let's take a look at some of the ways you can actually pull evidence off of printers. 306 00:20:10,670 --> 00:20:20,370 One of the things an investigator has to consider, especially an investigator of the caliber that's required to catch somebody like Newt, is that every piece of evidence is absolutely critical. 307 00:20:20,370 --> 00:20:23,510 You can't mess around with destroying evidence. 308 00:20:23,510 --> 00:20:31,630 So one of the things that you have to consider is the fact that simply printing a page off of a printer could potentially destroy evidence. 309 00:20:32,230 --> 00:20:40,450 Some of the things that you can do, you can actually pull data off the transfer drums if you're like incredibly paranoid or you have access to electron microscopes. 310 00:20:40,450 --> 00:20:43,210 You can pull data outside of actual semiconductors. 311 00:20:43,210 --> 00:20:45,170 You can do all this scientific stuff. 312 00:20:45,430 --> 00:20:50,530 Okay, but even if you're not that desperate, there's a lot that you can do right from the LCD menu. 313 00:20:50,750 --> 00:20:54,410 So for example, here's the information menu on a laser jet printer. 314 00:20:54,690 --> 00:21:03,410 You can go in there, you can actually print off the event log to see what events actually happened on the printer, when the toner died, when there were paper jams, all that sort of stuff. 315 00:21:03,410 --> 00:21:05,450 Get documents that look like this. 316 00:21:06,010 --> 00:21:10,410 One of the things that you can see is time and date stamps on all the events on the printer. 317 00:21:10,410 --> 00:21:14,710 A lot of those events can't happen unless somebody's actually at the printer. 318 00:21:15,250 --> 00:21:22,390 Okay, so a good agent is going to use this stuff to actually correlate time, you know, to see, okay, was the guy in the office at this point? 319 00:21:22,390 --> 00:21:23,530 Was he at the keyboard? 320 00:21:23,530 --> 00:21:26,470 Does that correlate with forensics logs that we have off the wire? 321 00:21:26,530 --> 00:21:27,630 Et cetera, et cetera. 322 00:21:30,270 --> 00:21:36,110 The other things, there's lots of stuff that you can do, and I'm really skimming, so I'm trying to keep this, you know, fairly interesting. 323 00:21:36,510 --> 00:21:39,550 You can do a lot from the LCD screen itself without printing. 324 00:21:39,550 --> 00:21:43,690 Like, you can actually view the event log from the LCD screen without printing. 325 00:21:43,730 --> 00:21:55,110 So you go through the information menu, and even though it's a little bit cryptic, you know, an agent can use the LCD screen to actually write down the event log itself, and then translate all this information into, you know, real stuff. 326 00:21:56,910 --> 00:21:59,670 The other thing is a lot of printers have web interfaces. 327 00:21:59,890 --> 00:22:04,650 Yes, I ripped this from one of my Google talks, but yeah. 328 00:22:04,910 --> 00:22:08,510 And yeah, there's the Google query in the top that found the example. 329 00:22:09,290 --> 00:22:13,530 And the little oval button that says configuration wizard. 330 00:22:14,930 --> 00:22:16,570 But anyway, that's the Google talk. 331 00:22:16,570 --> 00:22:18,250 I'm doing a different talk now. 332 00:22:18,390 --> 00:22:19,250 Where am I? 333 00:22:19,250 --> 00:22:20,290 Who are you people? 334 00:22:21,990 --> 00:22:24,310 But anyway, yeah, you've got web interfaces on printers. 335 00:22:24,310 --> 00:22:25,070 You can connect to them. 336 00:22:25,070 --> 00:22:27,310 You can get lots of information off of those. 337 00:22:28,090 --> 00:22:37,690 This printer, for example, this Ricoh, it actually queues up print jobs through the web interface, so you can go into the web interface and actually get print jobs off of that. 338 00:22:37,690 --> 00:22:40,510 Again, good evidence from an investigator's standpoint. 339 00:22:43,330 --> 00:22:44,730 A couple more things. 340 00:22:44,730 --> 00:22:50,670 Fax machines are often overlooked because of the fact that most of the time an investigator is going to get call logs. 341 00:22:50,670 --> 00:22:53,650 You know, they'll go to the PBX, they'll actually pull back the call logs. 342 00:22:54,150 --> 00:22:57,610 Fax machines themselves can absolutely contain evidence. 343 00:22:57,770 --> 00:23:04,030 Again, we're at an LCD screen thing where you can actually go in and get time, date, headers, company name. 344 00:23:04,590 --> 00:23:07,650 Again, you can see that bastard, Nooth. 345 00:23:08,190 --> 00:23:10,130 You can see fax functions, phone numbers. 346 00:23:10,130 --> 00:23:13,570 You can see all sorts of stuff, again, just by going through the LCD menu. 347 00:23:13,570 --> 00:23:20,870 A lot of times investigators tend to pass by these devices Investigators these days are getting better and better and even pulling evidence off of these. 348 00:23:22,510 --> 00:23:24,270 All right, some more stuff. 349 00:23:24,590 --> 00:23:32,530 The phone book entry can be pulled off and transmission reports, again, date, time stamps, places that were called, produce reports that look like this. 350 00:23:32,710 --> 00:23:37,990 So you've got the number that was called, the duration of the fax, the number of pages, all sorts of stuff. 351 00:23:40,270 --> 00:23:42,870 All right, faxes and multifunction devices. 352 00:23:44,130 --> 00:23:47,710 Multifunction devices, printers, fax machines, copiers, all that stuff. 353 00:23:47,710 --> 00:23:49,230 They pretty much act the same way. 354 00:23:49,230 --> 00:23:51,290 It's a printer, it's a fax machine, whatever. 355 00:23:51,290 --> 00:24:01,490 The bottom line is that device can contain evidence and this is a talk in and of itself, but everybody pretty much knows that network devices themselves can contain a lot of data. 356 00:24:01,910 --> 00:24:05,270 You got a Cisco, you got a wireless device. 357 00:24:05,270 --> 00:24:07,750 Those devices can contain information. 358 00:24:08,770 --> 00:24:22,610 Network devices actually played a critical role in figuring out exactly what Newt was up to because even though the guy melted down his hard drives, used a belt sander on his CDs and got rid of all his disposable media stuff, the removable media stuff, 359 00:24:22,610 --> 00:24:26,710 he left behind the actual desktop machines and his network gear and his printer. 360 00:24:27,170 --> 00:24:32,670 Okay, so at that point, an investigator has to, you know, frigging catch the guy with just what's left over. 361 00:24:33,330 --> 00:24:36,350 Okay, now this is going to be fun. 362 00:24:38,350 --> 00:24:42,050 Our next slide is for a book, all right? 363 00:24:42,110 --> 00:24:48,150 And I'm going to push the little button here and see if you can find the evidence. 364 00:24:51,710 --> 00:24:53,670 Who said that? 365 00:24:53,710 --> 00:24:54,890 Come on up. 366 00:24:57,390 --> 00:24:58,390 What's that? 367 00:24:59,710 --> 00:25:01,250 Oh, man. 368 00:25:06,580 --> 00:25:07,800 That's excellent. 369 00:25:07,800 --> 00:25:08,500 Yeah. 370 00:25:08,820 --> 00:25:12,320 Fingerprinting model glue from none other than Mudge. 371 00:25:12,320 --> 00:25:12,980 Thank you, sir. 372 00:25:12,980 --> 00:25:13,520 Come on up. 373 00:25:13,520 --> 00:25:14,580 Do you have something to drink? 374 00:25:14,580 --> 00:25:16,340 You should be just sitting up here. 375 00:25:18,120 --> 00:25:19,700 So everybody welcome Mudge. 376 00:25:31,940 --> 00:25:34,280 And no, he hasn't been sniffing model glue. 377 00:25:35,660 --> 00:25:36,720 Yeah, that was excellent. 378 00:25:36,720 --> 00:25:40,100 Whoever jumped out of their freaking seat right there, dude, you are the man. 379 00:25:40,100 --> 00:25:41,600 Yeah, look at all this stuff. 380 00:25:41,640 --> 00:25:48,120 All right, you got USB drives, you got PDAs, you got all this stuff, you got CF cards, you got all this crap all over here. 381 00:25:48,120 --> 00:25:49,660 Well, let's clear the table. 382 00:25:50,460 --> 00:25:51,980 And where's the evidence now? 383 00:25:52,080 --> 00:25:53,540 Yes, those are breath. 384 00:25:53,540 --> 00:25:55,120 No, no, no, that wasn't for a book. 385 00:25:56,120 --> 00:25:57,440 I like this. 386 00:25:57,440 --> 00:25:59,220 We're going to get the wave going. 387 00:25:59,220 --> 00:26:00,420 This is going to be hot. 388 00:26:00,760 --> 00:26:01,400 All right. 389 00:26:01,400 --> 00:26:02,660 Yeah, those are breath strips. 390 00:26:02,660 --> 00:26:03,900 And no, that's not the evidence. 391 00:26:03,900 --> 00:26:06,460 But yes, this happens to be a USB watch. 392 00:26:06,460 --> 00:26:07,940 Hook this puppy up to a machine. 393 00:26:07,940 --> 00:26:09,860 It's actually got USB storage. 394 00:26:09,920 --> 00:26:13,840 A decent agent is not going to overlook something like a watch. 395 00:26:13,840 --> 00:26:15,520 They're actually going to pick this stuff up. 396 00:26:15,520 --> 00:26:17,240 Going to pull the data off of it. 397 00:26:22,220 --> 00:26:23,160 Holy crap. 398 00:26:23,160 --> 00:26:24,780 Come up here and say that. 399 00:26:33,880 --> 00:26:43,540 I just pointed out if it was actually a mechanical watch at any point on the inside, that based upon the spring expansion, you could figure out roughly the date that it was created and be able to go back to figure out when they were sold. 400 00:26:49,030 --> 00:26:49,930 Thank you. 401 00:26:51,210 --> 00:26:51,630 All right. 402 00:26:51,630 --> 00:26:54,130 I've been told that I can talk as long as I want. 403 00:26:56,570 --> 00:26:57,230 No. 404 00:27:08,360 --> 00:27:14,800 Unfortunately, the mob can't speak for my day job, which would absolutely get rid of me if I was on the TCP IP drinking game. 405 00:27:14,920 --> 00:27:16,600 Thank you for the invite. 406 00:27:16,640 --> 00:27:20,720 You can call me a wuss if you want, but I'll be watching safely from the front row. 407 00:27:21,820 --> 00:27:22,880 Thank you. 408 00:27:24,720 --> 00:27:26,620 I'll be cheering for Mudge, though. 409 00:27:26,880 --> 00:27:27,300 All right. 410 00:27:27,300 --> 00:27:27,900 Here we go. 411 00:27:27,900 --> 00:27:29,720 This is for a book. 412 00:27:30,380 --> 00:27:31,900 Yeah, we're okay on books. 413 00:27:31,900 --> 00:27:32,140 All right. 414 00:27:32,140 --> 00:27:33,020 Everybody ready? 415 00:27:35,340 --> 00:27:39,660 What did you say? 416 00:27:39,820 --> 00:27:40,880 Come up here. 417 00:27:42,900 --> 00:27:46,160 He stood up boldly and he proclaimeth. 418 00:27:46,840 --> 00:27:47,720 Pen. 419 00:27:48,220 --> 00:27:49,740 Very nicely done. 420 00:27:49,800 --> 00:27:50,760 Pick a book. 421 00:27:52,380 --> 00:27:54,840 Oh, that is my blockbuster card, isn't it? 422 00:27:56,020 --> 00:27:57,360 And my yo-yo. 423 00:27:57,680 --> 00:27:59,560 I have yo-yo skills. 424 00:28:00,480 --> 00:28:01,060 I do. 425 00:28:01,060 --> 00:28:03,940 Maybe if we're killing time, I'll do some yo-yo kung fu up here. 426 00:28:04,440 --> 00:28:05,920 Yeah, absolutely. 427 00:28:05,920 --> 00:28:08,000 The bottom line is USB pen devices. 428 00:28:08,000 --> 00:28:09,840 They're a lot more common than you think. 429 00:28:09,840 --> 00:28:14,000 You get a drawer filled with junk like this, there's going to be crap that's hiding in the crevices. 430 00:28:14,380 --> 00:28:21,520 If you've got to think geek shop and fool that you're trying to catch down, he's going to have stuff like this. 431 00:28:23,060 --> 00:28:27,300 And you can figure out how much ink is in it and do an analysis to figure out how long he's been. 432 00:28:27,300 --> 00:28:28,880 Where do you come up with this stuff? 433 00:28:30,340 --> 00:28:34,480 This is why I would never be on a TCPIP drinking game against this guy. 434 00:28:36,220 --> 00:28:37,200 That's true. 435 00:28:37,200 --> 00:28:38,140 That's true. 436 00:28:38,720 --> 00:28:39,460 All right. 437 00:28:39,460 --> 00:28:40,340 Yeah, good stuff. 438 00:28:40,340 --> 00:28:40,600 All right. 439 00:28:40,600 --> 00:28:42,260 Let's do another one for a book. 440 00:28:42,260 --> 00:28:43,120 You guys ready? 441 00:28:46,800 --> 00:28:47,600 Nope. 442 00:28:49,860 --> 00:28:51,540 Wait, I heard it. 443 00:28:53,740 --> 00:28:54,220 There 444 00:29:11,620 --> 00:29:12,980 it is. 445 00:29:12,980 --> 00:29:13,800 Right over here. 446 00:29:13,800 --> 00:29:14,980 I heard it. 447 00:29:14,980 --> 00:29:15,220 Yes. 448 00:29:15,220 --> 00:29:20,400 Lo and behold, it is the duck. 449 00:29:22,300 --> 00:29:23,640 Yeah, baby. 450 00:29:30,670 --> 00:29:32,790 That was very nicely done. 451 00:29:33,070 --> 00:29:37,910 Oh, and all you people that were just calling out without standing up, do not think that that will get you a book. 452 00:29:37,910 --> 00:29:40,310 That's not the enthusiasm I'm looking for. 453 00:29:41,930 --> 00:29:48,350 We're down to two books, so I think I might skip this one and make this one a freebie. 454 00:29:48,590 --> 00:29:51,110 Yeah, we're going to skip this one and make it a freebie. 455 00:29:51,110 --> 00:29:51,870 All right. 456 00:29:52,850 --> 00:29:53,890 It's not for a book. 457 00:29:53,890 --> 00:29:55,110 You can stay seated. 458 00:29:56,690 --> 00:29:57,550 Fluoride? 459 00:29:57,550 --> 00:29:58,310 What? 460 00:30:07,900 --> 00:30:11,940 USB Clorox sounds definitely like something Mudge would have said. 461 00:30:16,570 --> 00:30:20,150 It does look like the Unabomber was there. 462 00:30:28,470 --> 00:30:30,130 USB TP. 463 00:30:31,510 --> 00:30:32,670 Here it comes. 464 00:30:32,670 --> 00:30:33,770 You ready for it? 465 00:30:33,770 --> 00:30:34,670 Ready for it? 466 00:30:34,670 --> 00:30:35,830 Here it comes. 467 00:30:37,930 --> 00:30:40,810 What is it? 468 00:30:41,750 --> 00:30:43,050 USB flashlight. 469 00:30:43,050 --> 00:30:47,770 Yes, this is an embedded USB digital camera flashlight combination. 470 00:30:47,910 --> 00:30:48,490 Yeah. 471 00:30:48,630 --> 00:30:50,690 Uber agent is going to pick that stuff up. 472 00:30:50,790 --> 00:30:53,250 Let's take a look at this one. 473 00:30:53,250 --> 00:30:57,910 I really got to spread these books out here, man, because I got a lot more slides. 474 00:30:58,490 --> 00:30:59,070 All right. 475 00:30:59,070 --> 00:31:01,610 This one's not for a book. 476 00:31:01,610 --> 00:31:02,730 It's just kind of fun. 477 00:31:02,730 --> 00:31:04,150 Can anybody find the evidence in this picture? 478 00:31:04,950 --> 00:31:06,690 Oh my goodness. 479 00:31:07,030 --> 00:31:08,490 You are Uber. 480 00:31:08,810 --> 00:31:16,830 Without any hesitation whatsoever and without the benefit of the Zoom, he proclaims TikiTorch. 481 00:31:17,970 --> 00:31:19,070 There it is. 482 00:31:19,070 --> 00:31:25,810 This is a very nice TikiTorch that normally I would tell you to go to a place like ThinkGeek to actually purchase. 483 00:31:26,690 --> 00:31:36,990 But ThinkGeek did not think anything of the DEF CON conference because when I called them and said I was doing this talk and I'd really like to get some pictures of their gear, guess what they said? 484 00:31:38,290 --> 00:31:39,910 They said nothing. 485 00:31:40,170 --> 00:31:41,990 So buy it somewhere else. 486 00:31:43,830 --> 00:31:44,750 Bastards. 487 00:31:47,490 --> 00:31:50,590 I borrowed this from a friend who didn't get it from ThinkGeek. 488 00:31:50,590 --> 00:31:51,770 Okay, you guys are so smart. 489 00:31:51,770 --> 00:31:52,390 Let's do it again. 490 00:31:52,390 --> 00:31:53,470 Where's the evidence? 491 00:31:55,710 --> 00:31:56,390 Nope. 492 00:31:56,550 --> 00:31:57,410 The what? 493 00:31:59,850 --> 00:32:01,810 Not... Ooh, that was nice. 494 00:32:01,810 --> 00:32:05,790 From the front row, we have the digital photo picture frame. 495 00:32:05,790 --> 00:32:09,850 Yes, USB-capable digital photo frames can contain data. 496 00:32:09,850 --> 00:32:12,750 It's an excellent spot to hide stuff. 497 00:32:12,750 --> 00:32:13,870 Good job. 498 00:32:14,950 --> 00:32:15,990 All right. 499 00:32:16,810 --> 00:32:17,990 Let's do this again. 500 00:32:17,990 --> 00:32:19,430 Where's the evidence? 501 00:32:21,310 --> 00:32:23,790 Not the stapler, but he stood. 502 00:32:24,910 --> 00:32:26,550 Not the network card. 503 00:32:26,930 --> 00:32:27,970 Nice. 504 00:32:28,110 --> 00:32:29,170 Right here. 505 00:32:29,270 --> 00:32:30,210 The knife. 506 00:32:31,850 --> 00:32:32,550 We got it. 507 00:32:32,550 --> 00:32:33,790 We got the answer. 508 00:32:34,990 --> 00:32:43,370 No, it's not the Microsoft coaster, which most of you should have just taken one look at and gone, there's something suspicious about that. 509 00:32:45,050 --> 00:32:50,890 No, it's not Kevin Mitnick's business card, which most of you should have gone, there's something suspicious about that. 510 00:32:50,930 --> 00:32:55,830 It is actually... And there it is. 511 00:32:55,830 --> 00:32:56,670 Come get a book. 512 00:32:56,670 --> 00:32:57,890 That was worth it. 513 00:32:58,230 --> 00:33:00,050 USB Swiss Army knife. 514 00:33:03,070 --> 00:33:05,450 Yup, USB Swiss Army knife. 515 00:33:07,070 --> 00:33:09,290 I've never seen a USB stapler. 516 00:33:10,310 --> 00:33:17,870 Oh, that's... He actually said stapler and he was right, but sorry, that wasn't the answer I was looking for. 517 00:33:18,030 --> 00:33:19,510 I'll give you other swag. 518 00:33:19,510 --> 00:33:20,430 We'll do that. 519 00:33:20,430 --> 00:33:21,030 All right. 520 00:33:21,030 --> 00:33:22,130 You guys ready? 521 00:33:22,350 --> 00:33:23,790 This one's for a book. 522 00:33:24,070 --> 00:33:25,370 Find the evidence. 523 00:33:44,690 --> 00:33:46,830 Do not listen to Mudge. 524 00:33:47,650 --> 00:33:49,650 His idea is way too smart. 525 00:33:50,170 --> 00:33:52,010 No, there's no evidence here, people. 526 00:33:52,010 --> 00:33:53,230 It's a bowl of fruit. 527 00:34:01,500 --> 00:34:03,680 You guys are not very good Uber agents. 528 00:34:04,180 --> 00:34:05,300 Oh, 529 00:34:11,280 --> 00:34:13,120 that was kind of cool. 530 00:34:13,120 --> 00:34:16,720 I wanted to pull a Mudge and answer my phone when somebody was calling me while I was on stage. 531 00:34:17,540 --> 00:34:18,580 That would have rocked. 532 00:34:18,880 --> 00:34:19,580 All right, let's see. 533 00:34:19,580 --> 00:34:22,660 I think this might be our last one for a book. 534 00:34:24,500 --> 00:34:26,320 No, we'll do it in the next picture. 535 00:34:26,320 --> 00:34:28,000 This one's just a freebie. 536 00:34:28,000 --> 00:34:29,000 Where's the evidence? 537 00:34:30,900 --> 00:34:32,040 Oh, yes. 538 00:34:32,040 --> 00:34:33,200 You guys are getting the hang of this. 539 00:34:33,200 --> 00:34:34,360 I heard it on the right. 540 00:34:34,440 --> 00:34:35,300 Here it comes. 541 00:34:35,300 --> 00:34:36,300 Wait for it. 542 00:34:36,300 --> 00:34:37,640 Wait for it. 543 00:34:38,340 --> 00:34:39,480 There you go. 544 00:34:40,040 --> 00:34:41,580 USB camera binoculars. 545 00:34:41,580 --> 00:34:43,020 Okay, you guys are getting the hang of this. 546 00:34:43,020 --> 00:34:51,160 Whole point of the talk is that it takes an interesting outlook on various locations like this to find stuff that could potentially be meaningful. 547 00:34:51,300 --> 00:34:57,620 When you've got a world that's filled with digital devices like this, it's going to take a death by a thousand cuts to catch somebody like Newt. 548 00:34:57,640 --> 00:34:59,660 That's what the entire book is about. 549 00:34:59,660 --> 00:35:01,420 I hope you guys will check out the stealing book. 550 00:35:01,420 --> 00:35:03,280 Let's do our last one for the book. 551 00:35:03,280 --> 00:35:05,680 And we need some enthusiasm here. 552 00:35:05,680 --> 00:35:07,980 You've got to stand up or you're not going to win it. 553 00:35:08,460 --> 00:35:09,460 Where's the evidence? 554 00:35:10,500 --> 00:35:11,300 Mudge. 555 00:35:15,850 --> 00:35:16,770 Who was it? 556 00:35:16,770 --> 00:35:18,830 Who was it in the back that said sushi? 557 00:35:18,850 --> 00:35:21,750 Come forward. 558 00:35:23,870 --> 00:35:27,730 No, it wasn't Bruce Sterling's Zenith book. 559 00:35:27,730 --> 00:35:29,730 It was the sushi. 560 00:35:30,390 --> 00:35:32,230 We've got to get the transition work in here. 561 00:35:32,230 --> 00:35:33,490 Go with the flow. 562 00:35:33,510 --> 00:35:34,170 Nice. 563 00:35:34,170 --> 00:35:34,970 Thank you. 564 00:35:34,970 --> 00:35:35,570 All right. 565 00:35:35,570 --> 00:35:38,490 So anyway, USB sushi. 566 00:35:44,770 --> 00:35:45,590 All right. 567 00:35:45,590 --> 00:35:46,990 So you guys got the hang of this. 568 00:35:46,990 --> 00:35:48,050 That's the idea. 569 00:35:48,050 --> 00:35:49,870 Other places evidence can hide. 570 00:35:49,870 --> 00:35:51,510 You guys have probably seen most of this stuff. 571 00:35:51,690 --> 00:35:56,210 I couldn't actually taunt you by putting these into a picture because most of them were too easy. 572 00:35:56,210 --> 00:36:00,090 How many of you have actually seen these Oakley thump glasses like in person? 573 00:36:00,670 --> 00:36:02,130 These things rock. 574 00:36:02,710 --> 00:36:05,550 They also look like freaking Vulcan space goggles. 575 00:36:05,690 --> 00:36:07,530 All right. 576 00:36:07,530 --> 00:36:12,970 So anyway, Newt was an ultra paranoid and did everything right, but in the end was he busted. 577 00:36:12,970 --> 00:36:13,950 I'm not going to spoil it. 578 00:36:13,950 --> 00:36:15,390 You'll have to get the book to find out. 579 00:36:15,390 --> 00:36:18,370 Stealing the network, how to own the identity by Singer's Publishing. 580 00:36:18,370 --> 00:36:21,970 We're going to do a book signing right after this over at the book booth inside. 581 00:36:22,210 --> 00:36:24,430 We've got several of the authors of various books. 582 00:36:24,510 --> 00:36:27,570 Specifically we're going to do ASD, but we'll have lots of folks over there. 583 00:36:27,570 --> 00:36:29,810 So if you have questions, see you over there. 584 00:36:29,810 --> 00:36:30,450 Thanks a lot.