[00:10.180 --> 00:15.820] Hey everybody. Alright, thanks for coming to Not A Google Talk. [00:20.960 --> 00:25.520] And those of you that have seen me speak before know that this is going to drive me absolutely [00:25.520 --> 00:30.580] insane. I cannot stand in one place. You see me doing a little dance, that's what it's [00:30.580 --> 00:36.120] all about. Alright, let's get started. Just a show of hands, how many of you have read [00:36.120 --> 00:41.600] any of the books in the Stealing the Network series? Show of hands. Excellent. How many [00:41.600 --> 00:46.780] of you have Stealing the Identity, the latest in the series? Excellent. How many of you [00:46.780 --> 00:52.980] are authors in Stealing the Identity? There we go. There it is, show of love. Alright, [00:52.980 --> 00:56.980] what we're going to do here is, those of you that aren't familiar with the stealing story, [00:56.980 --> 01:02.400] there was some interesting stuff that happened in the book with this psychopath named Newt [01:02.830 --> 01:08.040] who happens to be sitting in the front row. I won't point him out, but you can narrow [01:08.040 --> 01:14.940] it down from the hands that went up. Anyway, this guy Newt was up to absolutely no good. [01:14.980 --> 01:19.700] His whole thing was he didn't want to get caught by the man. So what he did is he took [01:19.700 --> 01:25.560] all his hard drives, took all his CDs, took all his removable media, and melted them down [01:25.560 --> 01:31.840] when he was done doing his thing. Now when Singers came to me and they were like, hey [01:31.840 --> 01:38.240] we got this great book series called Stealing, we want you to write on it. I was like, sweet. [01:38.320 --> 01:45.200] I was like, this is excellent, rock on. They were like, well you get to catch Newt. I was [01:45.200 --> 01:51.200] like, oh. Well the bottom line was, it was a tough job. So what I'm going to try to do [01:51.200 --> 01:55.340] is I'm going to try to give you an idea of what it's like to try to catch a guy like [01:55.340 --> 02:00.940] this who's ultra paranoid, who does everything in his power to basically keep from getting [02:00.940 --> 02:07.460] caught. And as it turned out, Newt's death was going to be a death by a thousand cuts. [02:07.460 --> 02:11.860] I'm not going to ruin anything and I'm not going to say that Newt died, but you'll have [02:11.860 --> 02:19.380] to read the book to find out. Alright, so anyway, that's basically all that stuff that [02:19.380 --> 02:24.560] I said. We are going to be looking at Newt's place through the eyes of this guy I'm calling [02:24.560 --> 02:31.260] Uber Agent. So for the next half an hour, 40 minutes or so, you get to play Uber Agent. [02:31.380 --> 02:37.080] And we're going to have some interesting games as we go through here. We're going to be playing [02:37.080 --> 02:43.180] some find the evidence games, where you guys as an audience have to try to find the evidence [02:43.180 --> 02:48.680] in various places. I'm going to show you some pictures, we're going to have a little fun [02:48.680 --> 02:53.300] with it. I've got a pile of books up here that I'm going to be giving away to those [02:53.300 --> 02:59.020] of you that find the evidence the quickest. The whole hand-raising thing, it's not going [02:59.020 --> 03:06.860] to cut it. If you want a book, and I'm doing a find the evidence contest here, you have [03:06.860 --> 03:12.620] to stand up and scream at the top of your lungs the correct answer. You've got to commit [03:12.620 --> 03:18.940] if you want the books. Now, we're going to start off pretty lightweight. This is not [03:18.940 --> 03:32.220] for a prize. Please remain seated. Help me find the evidence. Thank you. We're going [03:32.220 --> 03:38.100] to start off pretty easy. Now, in the stealing book, Newt did not have an iPod. That wasn't [03:38.100 --> 03:42.400] part of the story. But one of the interesting devices that I'm seeing all over the place [03:42.400 --> 03:46.580] are these iPods. And everybody knows they hold music, they can hold data, the whole [03:46.580 --> 03:50.640] nine yards. But the bottom line is there's a whole lot to it that folks really haven't [03:50.640 --> 03:54.620] considered. So what I'm going to do is sort of take you through what some of that stuff [03:54.620 --> 04:06.400] might be. First of all, this is the standard practice for the man, the Fed, is to grab [04:06.540 --> 04:10.620] a device like this and pick it up and sort of flip through it and see what's there, hit [04:10.620 --> 04:16.220] that little about menu, get information from the iPod. Well, the simple fact of the matter [04:16.220 --> 04:22.200] is that's bad news. Picking up any sort of device on a scene and mucking with it is going [04:22.200 --> 04:27.040] to potentially destroy evidence. And if a decent lawyer gets a hold of that in court, [04:27.040 --> 04:33.700] that evidence that you discover is going to get tossed. So doing this is a bad idea. So [04:33.700 --> 04:38.480] let's talk about some of the things that we can do to sort of investigate these things. [04:38.580 --> 04:44.280] I'll be the first to tell you, and no offense to those that do forensics full time, forensics [04:44.280 --> 04:55.960] is a little bit dry. No offense. I mean, CSI is very cool, right? The slightly aging but [04:55.960 --> 05:01.040] still quite attractive redhead and the not so aging and quite attractive brunette make [05:01.040 --> 05:06.140] it interesting. But that has nothing to do with forensics. But I'll try to spice it up [05:06.260 --> 05:14.260] a little bit. All right. As far as an investigative platform for these things, I hate to be the [05:14.280 --> 05:21.260] some sort of raving Mac fan. But the simple fact of the matter is if you've got an iPod [05:21.260 --> 05:26.340] that was formatted on a Mac, the best way to actually take apart that iPod forensically [05:26.340 --> 05:32.500] is by using a Mac. One of the best reasons for that, the biggest reasons for that is [05:32.500 --> 05:39.740] quite simply the HFS plus support. The iPod is basically an HFS plus portable file system. [05:40.320 --> 05:46.620] That's a Mac native file system. That's not to say Linux can't handle it. Linux can handle [05:46.620 --> 05:53.220] HFS plus. But it's not native on Linux. And Windows with HFS plus, well, just forget about [05:53.220 --> 05:57.280] it. All right. The bottom line is most of the time you're going to want to be using [05:57.440 --> 06:01.500] a Mac to actually pull these things apart. All right. Now, one of the things that a good [06:01.500 --> 06:06.120] investigator has to sort of figure out, and this is all part of the big puzzle, is I've [06:06.120 --> 06:10.120] got an investigative platform, what do I actually have to do to keep from tampering [06:10.120 --> 06:16.760] the evidence that's on this thing? All right. And one of the things that needs to be considered [06:17.360 --> 06:22.760] is the fact that when you slap an iPod into a Mac, you connect it up, one of the first [06:22.760 --> 06:28.140] things that happens is this demon, this disk arbitration demon, actually latches onto the [06:28.140 --> 06:33.780] iPod. This is the demon that actually causes things like iTunes to launch and the contact [06:33.780 --> 06:38.980] lists to update and all that stuff to sync. Well, from an investigative standpoint, that's [06:38.980 --> 06:45.300] bad news. All right? You don't want your investigation machine tramping all over this iPod and destroying [06:45.300 --> 06:49.860] evidence. So one of the first things you need to do is you need to hammer this demon. Now, [06:50.500 --> 06:55.740] this demon automatically restarts when you kill it. Okay? So actually what you have to [06:55.740 --> 07:01.160] do is you have to take this demon and you have to change mode it to 0, 0, 0, physically [07:01.160 --> 07:06.880] change mode the binary in S bin and then kill it. Okay? Now, once you do that, you [07:06.880 --> 07:11.160] get to the point where you've got a device that you can actually hook up to a machine [07:11.160 --> 07:17.560] and start looking for evidence. All right. But we're not exactly there yet. One of the [07:17.560 --> 07:20.940] other things that we need to do is we need to hook this thing up so that it's in sort [07:20.940 --> 07:25.560] of a read-only mode. Okay? And that takes a little bit of work as well. Just killing [07:25.560 --> 07:29.840] the demon that automatically connects to this thing and launches iTunes isn't going to be [07:29.840 --> 07:34.380] enough. So we need to get it into sort of a USB disk mode. How many of you have been [07:34.380 --> 07:40.720] inside an iPod's diagnostic mode? Show of hands. Okay. How many of you have actually [07:40.720 --> 07:47.900] used an iPod? Okay. Quite a few. This diagnostic mode is key to actually pulling stuff off [07:47.900 --> 07:54.620] of the iPod without totally hosing yourself in court. And this is a third generation iPod. [07:54.620 --> 07:59.940] The way this thing works is slightly different. And I know this looks like a cheat on like [08:00.060 --> 08:05.260] a PlayStation or something. Right? So you power it off. You hold down the forward, the [08:05.260 --> 08:09.720] backward, and the center button. Select and release them all at the same time. If you do [08:09.720 --> 08:15.200] that, you get the cheat code. All right? And the cheat code is diagnostic mode. You get a [08:15.200 --> 08:18.740] menu that looks something like this. It's got a bunch of different options. One of the [08:18.740 --> 08:25.300] things that we're going to hit is we're going to hit USB mode inside the iPod. After we [08:25.300 --> 08:30.500] reboot, we get a screen that looks like this. All right. At this point, you sort of have a [08:30.500 --> 08:35.060] choice between treating this like a fire wire device and a USB device. I'm going to fly [08:35.060 --> 08:38.840] through the boring stuff. Once you get all that done, you get a screen that looks like this [08:38.840 --> 08:43.700] that basically says I'm in disk mode. So the iPod is no longer an iPod. It's basically a [08:43.700 --> 08:48.880] disk that's about as close to read-only as you can get. Now, the reason I'm dragging you [08:48.880 --> 08:53.700] through all this boring stuff is most people don't realize how difficult it is to actually be [08:53.700 --> 08:57.860] an investigator, to be one of the good guys, to actually go through all this stuff to try to [08:57.860 --> 09:06.240] catch, well, people like you. But the bottom line is, you know, the good guys are pretty [09:06.240 --> 09:10.720] smart, too. Not that I'm choosing sides here. And they're not nearly as dumb as we paint [09:10.720 --> 09:14.800] them out to be. Simple fact of the matter is, they will go through this process to actually [09:14.800 --> 09:19.660] get to your stuff that's on the iPod. So the question becomes, what exactly can be on an [09:19.660 --> 09:26.600] iPod? Here's a file listing. The iPod actually just shows up as another device on the [09:26.600 --> 09:31.720] machine. So we mount the device. We do a listing. Can anybody see anything interesting [09:31.720 --> 09:43.070] about this file listing? Anything that stands out? Next time, answer slower so I can [09:43.070 --> 09:53.670] swallow. Yeah. Whew. Yeah, there's a nopics. There's a nopics.img file on here. This is a [09:53.670 --> 09:57.910] persistent encrypted nopics home directory. Those of you that use nopics realize what this [09:57.910 --> 10:02.850] thing is. The bottom line is, yeah, you can absolutely put whatever you want on this [10:02.850 --> 10:07.210] iPod as a file. But one of the things that gets really interesting is when you start using the [10:07.210 --> 10:13.390] iPod for other things, for example, booting it, booting from it as a device, okay? Booting [10:13.390 --> 10:18.810] from it with a nopics CD or booting from it absolutely natively. Actually loading a [10:18.810 --> 10:22.930] distribution of nopics on it, booting right from the iPod. You've got basically a [10:22.930 --> 10:27.730] portable platform. It's got all your attack tools on it. You can use it just like any [10:27.730 --> 10:34.650] other machine. Hook it up, boot, and you go. Where's Tyler? Is Tyler here? Where's Tyler? [10:34.650 --> 10:40.790] All right, Tyler. Thank you. Everybody give our newest goon, Tyler, a big round of applause [10:40.790 --> 10:48.740] right there. All right. Now that I've absolutely embarrassed her and she's going to hide [10:48.740 --> 10:53.620] from all of you. Tyler actually submitted a talk that had nothing to do, that had everything [10:53.620 --> 10:57.760] to do with iPods. It was just about iPods and all the cool stuff you can do with them. [10:57.760 --> 11:02.500] She's actually got a shuffle that she can boot from that boots nopics but also comes up in [11:02.500 --> 11:06.220] iTunes natively so that it can have music running from it, attack tools, the whole nine [11:06.220 --> 11:11.240] yards. Yeah, with a little device the size of a stick of gum. It's pretty cool stuff. [11:11.240 --> 11:15.780] Show of hands, how many people would have been interested in a talk like that? Cool. [11:15.780 --> 11:21.300] Thank you. All right. Anybody that's on the review board, take note. All right. I've done [11:21.300 --> 11:28.300] my plug. Okay. There's obviously other stuff that's on an iPod. This shows a screen from [11:28.300 --> 11:33.800] an AAC file, just a music file. Those of you that have messed around in the AAC space know [11:33.800 --> 11:37.920] that you can absolutely use these things and lock them down so that you have to authorize [11:37.920 --> 11:41.880] them on various machines and all that. Well, the thing that's interesting from an evidence [11:41.880 --> 11:45.340] standpoint, remembering we're supposed to be Uber agent here trying to catch that guy, [11:45.340 --> 11:51.680] oh, not going to point at him, that bastard Newt, who's ultra paranoid, is that we need [11:51.680 --> 12:00.220] to look in places like music files on an MP3 player in ways that are not necessarily standard. [12:00.220 --> 12:04.280] For example, you can see when I launch this AAC file that the registered e-mail address [12:04.280 --> 12:08.880] pops up. This is the user that actually, you know, purchased this song. It's the e-mail [12:08.880 --> 12:14.060] address that they used. So, yeah, you can pull out e-mail addresses from the music files [12:14.060 --> 12:22.300] as an investigator, use those for more leads. Okay. The other thing that's often overlooked, [12:22.300 --> 12:26.900] and I know this is old news, but metadata inside the files. You know, you get a music [12:26.900 --> 12:30.840] file, you get any kind of file, there's a potential for metadata. You can have all sorts [12:30.840 --> 12:38.470] of stuff in here. Anybody see anything odd with this one? Wow, you guys are good. Yeah, [12:38.470 --> 12:43.110] the comments field. There's been a lot of work done recently in covert channels. A good [12:43.110 --> 12:46.910] friend of mine, Russ Rogers, is doing the hacking the terror network book, talks about [12:46.910 --> 12:51.970] covert channels and things like that. The simple fact of the matter is, as bad guys, [12:51.970 --> 12:58.030] I'm not generalizing, but, yeah, as bad guys, you know perfectly well that you can use covert [12:58.030 --> 13:01.950] channels just about anywhere. Music files are no different. A really good investigator [13:01.950 --> 13:05.770] is going to actually look in those files to see if there's anything that's out of the [13:05.770 --> 13:13.720] ordinary. And this is just one of the spots that he's going to look. All right. Also, [13:13.720 --> 13:17.220] the normal stuff that would be on an iPod, you can have your contact list, you can have [13:17.220 --> 13:23.040] your calendar, you can have all that stuff. This is just an example, but, yeah, your address [13:23.040 --> 13:27.740] book syncs to it, so an investigator is going to pull all that stuff off. Yada, yada, yada. [13:28.640 --> 13:35.020] All right. Other things about MP3 files in general is a lot of them use the metadata [13:35.020 --> 13:38.760] to store information about last time played and all that kind of stuff. All that stuff's [13:38.760 --> 13:42.380] going to be on there. Also, if the investigator is really good, one of the things he's going [13:42.380 --> 13:45.940] to do is he's going to take all the music files, he's going to run hashes against them. [13:46.180 --> 13:51.660] And if there's peer-to-peer software on the machine, the bad guy's got peer-to-peer software, [13:51.660 --> 13:57.520] he's actually in some cases going to check the file hashes of the same songs on a peer-to-peer [13:57.520 --> 14:01.660] network to see if the file hashes match. You know, if you've got somebody that's just [14:01.660 --> 14:06.020] pirating music, there's a good chance that these hashes are going to match. If the investigator [14:06.020 --> 14:14.540] finds a song whose MD5, I'm sorry, you don't use MD5 anymore, thanks, Dan, your SHA1 hash [14:14.540 --> 14:21.880] doesn't match, it'd be something worth looking at. All right. Digital cameras. Obviously, [14:21.880 --> 14:25.940] I'm doing some of the more obvious things first, because, you know, investigators, we're [14:25.940 --> 14:29.620] just going to do real obvious stuff. Digital cameras, absolutely, they're going to be picked [14:29.620 --> 14:35.900] up. What about the images that are actually on these cameras? Well, first of all, yeah, [14:35.900 --> 14:42.660] there are images on digital cameras. Hello. You know? I think a lot of investigators and [14:43.220 --> 14:46.700] a lot of the good guys actually forget the fact that they're pictures, they're not just [14:46.700 --> 14:51.380] data. So the simple fact is actually looking at the pictures themselves to try to pull [14:51.380 --> 14:57.120] out evidence from the image themselves is a good idea. For example, here's an image [14:57.120 --> 15:02.600] with all sorts of metadata. I know it's probably very hard to read, but can anybody tell me [15:02.600 --> 15:11.520] what's wrong with this picture? What was it? Huh? There's lots of network cables, yeah. [15:11.640 --> 15:17.080] Let me give you a little bit of a hint. The date time stamp on here shows the time as [15:17.080 --> 15:26.250] being approximately 4 in the morning. Absolutely. Shouldn't be daylight. Okay? The simple fact [15:26.250 --> 15:31.370] of the matter is there should not be daylight at 4 o'clock in the morning, and the question [15:31.370 --> 15:38.350] is what does that mean? Okay? As evidence. You know? Could mean a lot of things. Could [15:38.350 --> 15:42.230] mean the date time stamp on the camera is broken. What if the date time on the camera [15:42.230 --> 15:48.670] is right? That's right. The picture was taken in a different time zone. So it's things [15:48.670 --> 15:53.410] like that. The actual time on the digital camera, you can't pull off. You actually have [15:53.410 --> 15:59.250] to look at the digital camera itself and figure out what the time is set to. This was actually [15:59.250 --> 16:05.610] used in one of the books to catch somebody that was, and this was the stealing book, [16:05.610 --> 16:09.830] to actually figure out that somebody took the picture in another country. Okay? So the [16:09.830 --> 16:14.350] investigator actually picked up on that and went, okay, what are my choices? What countries [16:14.350 --> 16:19.070] is this daylight? Let's narrow it down. Let's cross-reference it. Yada, yada, yada. Another [16:19.070 --> 16:27.270] plug for stealing. Thank you. All right. A little bit more about EXIF stuff. Are the [16:27.270 --> 16:33.370] date times consistent with the pictures? There could be potential for thumbnail inconsistencies. [16:33.370 --> 16:37.030] You look at a picture, you look at the embedded thumbnail. If it's been processed in some [16:37.030 --> 16:41.070] sort of imaging program that didn't update the thumbnail, you can see the inconsistencies [16:41.070 --> 16:48.310] there. All sorts of stuff. All right. Now, I know these are very hard to read, but there's [16:48.310 --> 16:56.030] two images here. Can anybody tell me what's different between the two images? Good. Sizes. [16:56.850 --> 17:02.950] The create time and dates are different. The stamp on the camera software has changed. [17:02.950 --> 17:10.410] It's gone from being an actual camera stamp to being a Photoshop stamp. I know this is [17:10.410 --> 17:14.350] old stuff, but the bottom line is the good guys are actually going to be using these [17:14.350 --> 17:18.990] techniques to figure out if you've processed an image outside the camera, modified it in [17:18.990 --> 17:29.270] any way, et cetera, et cetera. All right. Now, this one's easy, so it's not for a book. [17:30.050 --> 17:39.550] Not for a book. Sorry. Okay. No, it's not the USB. Sit down. For a book, where's the [17:39.550 --> 17:55.210] evidence? She stood up and was very bold, and you get a book. Come on up. All right. [17:55.350 --> 18:00.550] Very nice. You get the idea how this game works, right? Yeah, there's a USB there. There's [18:00.670 --> 18:04.730] a PowerBook sitting there. Yeah, it's real obvious places to look for evidence. But yeah, [18:04.730 --> 18:09.470] there's a phone in the picture, okay? And it's, you know, just a normal phone that you'd [18:09.470 --> 18:14.910] find on the desk in just about any office. But the simple fact is that there's possible [18:14.910 --> 18:20.470] data inside this phone that might not show up in things like call logs. For example, [18:20.470 --> 18:25.890] you dump the PBX logs, there's all sorts of stuff jammed in the redial. For example, in [18:25.890 --> 18:29.770] this, you know, I wasn't gonna show you any real PIN numbers. I dial up a number, I put [18:29.770 --> 18:34.850] in a PIN number, it's actually captured inside that redial info. By playing with the phone, [18:34.850 --> 18:40.970] you can get that information out. It might be lost in a call log. All right? Other things [18:40.970 --> 18:45.610] that you can get, you can get park settings, in-dial forwarding, all sorts of information. [18:45.610 --> 18:51.010] Again, this stuff might not necessarily show up anywhere else. If the desk phone is forwarded [18:51.010 --> 18:56.370] to a cell phone, the phone itself might be the only place to actually get that information. [18:56.370 --> 19:04.170] So a good investigator's actually gonna consider this stuff. Speaking of phones, cell phones, [19:04.170 --> 19:10.030] most of you guys know this stuff, but just for completeness, cell phones have cameras [19:10.030 --> 19:13.970] in them, obviously, you've got images in them, yadda, yadda, yadda. A lot of them have SD [19:13.970 --> 19:19.170] or mini SD cards inside of them. Those SD cards should be removed. It's not necessarily [19:19.170 --> 19:23.330] the same as a SIM card. There could be other stuff that's on there. How many saw Mudge's [19:23.330 --> 19:28.630] talk this morning? Show of hands. All right. One of the things that I found very interesting, [19:29.030 --> 19:32.870] a couple things I found interesting about Mudge's talk was he pulled out his sidekick [19:32.870 --> 19:38.190] phone. And one of the things that he revealed was that when he basically lost his phone [19:38.190 --> 19:44.190] and got another phone, all his images and all his phone lists were automatically populated [19:44.190 --> 19:50.030] back down to his sidekick. Brand new phone, brand new SIM card. So the images actually [19:50.030 --> 19:54.890] went out to the website and once he re-registered, they came back down to his phone. Bottom line [19:54.890 --> 20:01.710] is this is fairly transient stuff that might be hard to pick up any other way. All right. [20:02.110 --> 20:07.030] Printers. Printers are often overlooked. Let's take a look at some of the ways you can actually [20:07.030 --> 20:13.530] pull evidence off of printers. One of the things an investigator has to consider, especially [20:13.530 --> 20:17.850] an investigator of the caliber that's required to catch somebody like Newt, is that every [20:17.850 --> 20:23.510] piece of evidence is absolutely critical. You can't mess around with destroying evidence. [20:23.510 --> 20:28.050] So one of the things that you have to consider is the fact that simply printing a page off [20:28.050 --> 20:33.830] of a printer could potentially destroy evidence. Some of the things that you can do, you can [20:33.830 --> 20:38.410] actually pull data off the transfer drums if you're like incredibly paranoid or you [20:38.410 --> 20:43.210] have access to electron microscopes. You can pull data outside of actual semiconductors. [20:43.210 --> 20:48.170] You can do all this scientific stuff. Okay, but even if you're not that desperate, there's [20:48.270 --> 20:52.810] a lot that you can do right from the LCD menu. So for example, here's the information menu [20:52.810 --> 20:57.510] on a laser jet printer. You can go in there, you can actually print off the event log to [20:57.510 --> 21:01.530] see what events actually happened on the printer, when the toner died, when there were paper [21:01.530 --> 21:06.790] jams, all that sort of stuff. Get documents that look like this. One of the things that [21:06.790 --> 21:11.270] you can see is time and date stamps on all the events on the printer. A lot of those [21:11.270 --> 21:16.610] events can't happen unless somebody's actually at the printer. Okay, so a good agent is going [21:16.610 --> 21:21.550] to use this stuff to actually correlate time, you know, to see, okay, was the guy in the [21:21.550 --> 21:25.250] office at this point? Was he at the keyboard? Does that correlate with forensics logs that [21:25.250 --> 21:32.110] we have off the wire? Et cetera, et cetera. The other things, there's lots of stuff that [21:32.110 --> 21:36.110] you can do, and I'm really skimming, so I'm trying to keep this, you know, fairly interesting. [21:36.510 --> 21:40.710] You can do a lot from the LCD screen itself without printing. Like, you can actually view [21:40.710 --> 21:44.830] the event log from the LCD screen without printing. So you go through the information [21:44.830 --> 21:48.870] menu, and even though it's a little bit cryptic, you know, an agent can use the LCD screen [21:48.870 --> 21:53.930] to actually write down the event log itself, and then translate all this information into, [21:53.930 --> 22:00.190] you know, real stuff. The other thing is a lot of printers have web interfaces. Yes, [22:00.190 --> 22:06.530] I ripped this from one of my Google talks, but yeah. And yeah, there's the Google query [22:06.530 --> 22:12.370] in the top that found the example. And the little oval button that says configuration [22:12.870 --> 22:19.250] wizard. But anyway, that's the Google talk. I'm doing a different talk now. Where am I? [22:19.250 --> 22:24.710] Who are you people? But anyway, yeah, you've got web interfaces on printers. You can connect [22:24.710 --> 22:30.590] to them. You can get lots of information off of those. This printer, for example, this [22:30.590 --> 22:35.230] Ricoh, it actually queues up print jobs through the web interface, so you can go into the [22:35.230 --> 22:39.230] web interface and actually get print jobs off of that. Again, good evidence from an [22:39.230 --> 22:46.830] investigator's standpoint. A couple more things. Fax machines are often overlooked because [22:46.830 --> 22:50.910] of the fact that most of the time an investigator is going to get call logs. You know, they'll [22:50.910 --> 22:55.670] go to the PBX, they'll actually pull back the call logs. Fax machines themselves can [22:55.670 --> 23:00.730] absolutely contain evidence. Again, we're at an LCD screen thing where you can actually [23:00.730 --> 23:07.650] go in and get time, date, headers, company name. Again, you can see that bastard, Nooth. [23:08.190 --> 23:11.770] You can see fax functions, phone numbers. You can see all sorts of stuff, again, just [23:11.770 --> 23:16.710] by going through the LCD menu. A lot of times investigators tend to pass by these devices [23:17.170 --> 23:20.210] Investigators these days are getting better and better and even pulling evidence off of [23:20.210 --> 23:27.330] these. All right, some more stuff. The phone book entry can be pulled off and transmission [23:27.330 --> 23:31.590] reports, again, date, time stamps, places that were called, produce reports that look [23:31.590 --> 23:35.970] like this. So you've got the number that was called, the duration of the fax, the number [23:35.970 --> 23:45.310] of pages, all sorts of stuff. All right, faxes and multifunction devices. Multifunction devices, [23:45.310 --> 23:49.230] printers, fax machines, copiers, all that stuff. They pretty much act the same way. [23:49.230 --> 23:53.250] It's a printer, it's a fax machine, whatever. The bottom line is that device can contain [23:53.250 --> 23:58.970] evidence and this is a talk in and of itself, but everybody pretty much knows that network [23:58.970 --> 24:05.270] devices themselves can contain a lot of data. You got a Cisco, you got a wireless device. [24:05.270 --> 24:11.270] Those devices can contain information. Network devices actually played a critical role in [24:11.270 --> 24:16.470] figuring out exactly what Newt was up to because even though the guy melted down his [24:16.470 --> 24:21.310] hard drives, used a belt sander on his CDs and got rid of all his disposable media stuff, [24:21.310 --> 24:25.450] the removable media stuff, he left behind the actual desktop machines and his network [24:25.450 --> 24:30.270] gear and his printer. Okay, so at that point, an investigator has to, you know, frigging [24:30.270 --> 24:39.230] catch the guy with just what's left over. Okay, now this is going to be fun. Our next [24:39.230 --> 24:46.450] slide is for a book, all right? And I'm going to push the little button here and see if [24:46.450 --> 25:07.800] you can find the evidence. Who said that? Come on up. What's that? Oh, man. That's excellent. [25:07.800 --> 25:13.300] Yeah. Fingerprinting model glue from none other than Mudge. Thank you, sir. Come on [25:13.300 --> 25:19.020] up. Do you have something to drink? You should be just sitting up here. So everybody welcome [25:19.020 --> 25:37.420] Mudge. And no, he hasn't been sniffing model glue. Yeah, that was excellent. Whoever jumped [25:37.420 --> 25:41.600] out of their freaking seat right there, dude, you are the man. Yeah, look at all this stuff. [25:41.640 --> 25:45.980] All right, you got USB drives, you got PDAs, you got all this stuff, you got CF cards, [25:45.980 --> 25:51.320] you got all this crap all over here. Well, let's clear the table. And where's the evidence [25:51.320 --> 25:57.880] now? Yes, those are breath. No, no, no, that wasn't for a book. I like this. We're going [25:57.880 --> 26:02.660] to get the wave going. This is going to be hot. All right. Yeah, those are breath strips. [26:02.660 --> 26:06.880] And no, that's not the evidence. But yes, this happens to be a USB watch. Hook this [26:06.880 --> 26:12.460] puppy up to a machine. It's actually got USB storage. A decent agent is not going to overlook [26:12.460 --> 26:16.240] something like a watch. They're actually going to pick this stuff up. Going to pull the data [26:16.240 --> 26:35.160] off of it. Holy crap. Come up here and say that. I just pointed out if it was actually [26:35.280 --> 26:38.760] a mechanical watch at any point on the inside, that based upon the spring expansion, you [26:38.760 --> 26:42.320] could figure out roughly the date that it was created and be able to go back to figure [26:42.320 --> 26:53.230] out when they were sold. Thank you. All right. I've been told that I can talk as long as [26:53.230 --> 27:11.940] I want. No. Unfortunately, the mob can't speak for my day job, which would absolutely [27:11.940 --> 27:17.000] get rid of me if I was on the TCP IP drinking game. Thank you for the invite. You can call [27:17.000 --> 27:25.160] me a wuss if you want, but I'll be watching safely from the front row. Thank you. I'll [27:25.160 --> 27:31.000] be cheering for Mudge, though. All right. Here we go. This is for a book. Yeah, we're [27:31.000 --> 27:43.620] okay on books. All right. Everybody ready? What did you say? Come up here. He stood up [27:43.620 --> 27:53.680] boldly and he proclaimeth. Pen. Very nicely done. Pick a book. Oh, that is my blockbuster [27:53.680 --> 28:02.040] card, isn't it? And my yo-yo. I have yo-yo skills. I do. Maybe if we're killing time, [28:02.040 --> 28:08.000] I'll do some yo-yo kung fu up here. Yeah, absolutely. The bottom line is USB pen devices. [28:08.000 --> 28:11.620] They're a lot more common than you think. You get a drawer filled with junk like this, [28:11.620 --> 28:17.120] there's going to be crap that's hiding in the crevices. If you've got to think geek [28:17.120 --> 28:21.520] shop and fool that you're trying to catch down, he's going to have stuff like this. [28:23.060 --> 28:26.960] And you can figure out how much ink is in it and do an analysis to figure out how long [28:26.960 --> 28:32.900] he's been. Where do you come up with this stuff? This is why I would never be on a TCPIP [28:32.900 --> 28:40.340] drinking game against this guy. That's true. That's true. All right. Yeah, good stuff. [28:40.340 --> 28:51.540] All right. Let's do another one for a book. You guys ready? Nope. Wait, I heard it. [28:53.740 --> 29:23.640] There it is. Right over here. I heard it. Yes. Lo and behold, it is the duck. Yeah, baby. [29:30.670 --> 29:35.090] That was very nicely done. Oh, and all you people that were just calling out without [29:35.090 --> 29:39.330] standing up, do not think that that will get you a book. That's not the enthusiasm I'm [29:39.330 --> 29:46.950] looking for. We're down to two books, so I think I might skip this one and make this [29:46.950 --> 29:53.090] one a freebie. Yeah, we're going to skip this one and make it a freebie. All right. It's [29:53.090 --> 30:10.420] not for a book. You can stay seated. Fluoride? What? USB Clorox sounds definitely like something [30:10.420 --> 30:32.670] Mudge would have said. It does look like the Unabomber was there. USB TP. Here it comes. [30:32.670 --> 30:43.730] You ready for it? Ready for it? Here it comes. What is it? USB flashlight. Yes, this is an [30:43.730 --> 30:50.310] embedded USB digital camera flashlight combination. Yeah. Uber agent is going to pick that stuff [30:50.310 --> 30:55.970] up. Let's take a look at this one. I really got to spread these books out here, man, because [30:55.970 --> 31:02.810] I got a lot more slides. All right. This one's not for a book. It's just kind of fun. Can [31:02.810 --> 31:09.850] anybody find the evidence in this picture? Oh my goodness. You are Uber. Without any [31:10.490 --> 31:18.490] hesitation whatsoever and without the benefit of the Zoom, he proclaims TikiTorch. There [31:18.490 --> 31:23.510] it is. This is a very nice TikiTorch that normally I would tell you to go to a place [31:23.510 --> 31:31.190] like ThinkGeek to actually purchase. But ThinkGeek did not think anything of the DEF CON conference [31:31.190 --> 31:34.070] because when I called them and said I was doing this talk and I'd really like to get [31:34.070 --> 31:41.150] some pictures of their gear, guess what they said? They said nothing. So buy it somewhere [31:41.150 --> 31:50.970] else. Bastards. I borrowed this from a friend who didn't get it from ThinkGeek. Okay, you [31:50.970 --> 32:01.010] guys are so smart. Let's do it again. Where's the evidence? Nope. The what? Not... Ooh, [32:01.010 --> 32:07.090] that was nice. From the front row, we have the digital photo picture frame. Yes, USB-capable [32:07.090 --> 32:13.870] digital photo frames can contain data. It's an excellent spot to hide stuff. Good job. [32:14.950 --> 32:25.210] All right. Let's do this again. Where's the evidence? Not the stapler, but he stood. Not [32:25.210 --> 32:37.330] the network card. Nice. Right here. The knife. We got it. We got the answer. No, it's not [32:37.330 --> 32:41.450] the Microsoft coaster, which most of you should have just taken one look at and gone, there's [32:41.450 --> 32:47.910] something suspicious about that. No, it's not Kevin Mitnick's business card, which most [32:47.910 --> 32:55.190] of you should have gone, there's something suspicious about that. It is actually... And [32:55.210 --> 33:04.590] there it is. Come get a book. That was worth it. USB Swiss Army knife. Yup, USB Swiss Army [33:04.590 --> 33:14.270] knife. I've never seen a USB stapler. Oh, that's... He actually said stapler and he [33:14.270 --> 33:19.510] was right, but sorry, that wasn't the answer I was looking for. I'll give you other swag. [33:19.510 --> 33:25.370] We'll do that. All right. You guys ready? This one's for a book. Find the evidence. [33:44.690 --> 33:52.010] Do not listen to Mudge. His idea is way too smart. No, there's no evidence here, people. [33:52.010 --> 34:13.120] It's a bowl of fruit. You guys are not very good Uber agents. Oh, that was kind of cool. [34:13.120 --> 34:16.000] I wanted to pull a Mudge and answer my phone when somebody was calling me while I was on [34:16.000 --> 34:21.420] stage. That would have rocked. All right, let's see. I think this might be our last [34:21.420 --> 34:28.200] one for a book. No, we'll do it in the next picture. This one's just a freebie. Where's [34:28.200 --> 34:34.360] the evidence? Oh, yes. You guys are getting the hang of this. I heard it on the right. [34:34.440 --> 34:42.000] Here it comes. Wait for it. Wait for it. There you go. USB camera binoculars. Okay, you guys [34:42.000 --> 34:45.660] are getting the hang of this. Whole point of the talk is that it takes an interesting [34:45.660 --> 34:51.160] outlook on various locations like this to find stuff that could potentially be meaningful. [34:51.300 --> 34:55.200] When you've got a world that's filled with digital devices like this, it's going to take [34:55.320 --> 34:59.280] a death by a thousand cuts to catch somebody like Newt. That's what the entire book is [34:59.280 --> 35:02.920] about. I hope you guys will check out the stealing book. Let's do our last one for the [35:02.920 --> 35:07.400] book. And we need some enthusiasm here. You've got to stand up or you're not going to win [35:07.400 --> 35:18.830] it. Where's the evidence? Mudge. Who was it? Who was it in the back that said sushi? [35:18.850 --> 35:30.950] Come forward. No, it wasn't Bruce Sterling's Zenith book. It was the sushi. We've got to [35:30.950 --> 35:37.390] get the transition work in here. Go with the flow. Nice. Thank you. All right. So anyway, [35:37.390 --> 35:48.890] USB sushi. All right. So you guys got the hang of this. That's the idea. Other places [35:48.890 --> 35:52.810] evidence can hide. You guys have probably seen most of this stuff. I couldn't actually [35:52.810 --> 35:56.450] taunt you by putting these into a picture because most of them were too easy. How many [35:56.450 --> 36:02.130] of you have actually seen these Oakley thump glasses like in person? These things rock. [36:02.710 --> 36:09.390] They also look like freaking Vulcan space goggles. All right. So anyway, Newt was an [36:09.390 --> 36:13.410] ultra paranoid and did everything right, but in the end was he busted. I'm not going to [36:13.410 --> 36:16.630] spoil it. You'll have to get the book to find out. Stealing the network, how to own the [36:16.630 --> 36:20.310] identity by Singer's Publishing. We're going to do a book signing right after this over [36:20.310 --> 36:24.870] at the book booth inside. We've got several of the authors of various books. Specifically [36:24.870 --> 36:29.050] we're going to do ASD, but we'll have lots of folks over there. So if you have questions, [36:29.050 --> 36:30.450] see you over there. Thanks a lot.