WEBVTT 00:10.180 --> 00:11.380 Hey everybody. 00:12.700 --> 00:15.820 Alright, thanks for coming to Not A Google Talk. 00:20.960 --> 00:26.660 And those of you that have seen me speak before know that this is going to drive me absolutely insane. 00:26.660 --> 00:28.280 I cannot stand in one place. 00:28.360 --> 00:31.440 You see me doing a little dance, that's what it's all about. 00:31.680 --> 00:33.160 Alright, let's get started. 00:33.160 --> 00:38.960 Just a show of hands, how many of you have read any of the books in the Stealing the Network series? 00:38.980 --> 00:40.080 Show of hands. 00:40.080 --> 00:40.960 Excellent. 00:41.340 --> 00:45.020 How many of you have Stealing the Identity, the latest in the series? 00:45.640 --> 00:46.360 Excellent. 00:46.360 --> 00:48.560 How many of you are authors in Stealing the Identity? 00:48.560 --> 00:49.820 There we go. 00:50.780 --> 00:52.400 There it is, show of love. 00:52.540 --> 01:05.220 Alright, what we're going to do here is, those of you that aren't familiar with the stealing story, there was some interesting stuff that happened in the book with this psychopath named Newt who happens to be sitting in the front row. 01:05.680 --> 01:10.080 I won't point him out, but you can narrow it down from the hands that went up. 01:10.540 --> 01:14.940 Anyway, this guy Newt was up to absolutely no good. 01:14.980 --> 01:18.620 His whole thing was he didn't want to get caught by the man. 01:18.620 --> 01:27.740 So what he did is he took all his hard drives, took all his CDs, took all his removable media, and melted them down when he was done doing his thing. 01:28.420 --> 01:36.580 Now when Singers came to me and they were like, hey we got this great book series called Stealing, we want you to write on it. 01:36.580 --> 01:38.240 I was like, sweet. 01:38.320 --> 01:40.860 I was like, this is excellent, rock on. 01:40.940 --> 01:44.420 They were like, well you get to catch Newt. 01:44.640 --> 01:46.600 I was like, oh. 01:47.160 --> 01:50.220 Well the bottom line was, it was a tough job. 01:50.220 --> 02:01.760 So what I'm going to try to do is I'm going to try to give you an idea of what it's like to try to catch a guy like this who's ultra paranoid, who does everything in his power to basically keep from getting caught. 02:02.080 --> 02:07.460 And as it turned out, Newt's death was going to be a death by a thousand cuts. 02:07.460 --> 02:13.500 I'm not going to ruin anything and I'm not going to say that Newt died, but you'll have to read the book to find out. 02:14.640 --> 02:19.880 Alright, so anyway, that's basically all that stuff that I said. 02:19.880 --> 02:25.900 We are going to be looking at Newt's place through the eyes of this guy I'm calling Uber Agent. 02:26.540 --> 02:31.260 So for the next half an hour, 40 minutes or so, you get to play Uber Agent. 02:31.380 --> 02:35.440 And we're going to have some interesting games as we go through here. 02:35.440 --> 02:44.720 We're going to be playing some find the evidence games, where you guys as an audience have to try to find the evidence in various places. 02:45.020 --> 02:49.460 I'm going to show you some pictures, we're going to have a little fun with it. 02:49.900 --> 02:56.380 I've got a pile of books up here that I'm going to be giving away to those of you that find the evidence the quickest. 02:56.800 --> 03:00.020 The whole hand-raising thing, it's not going to cut it. 03:00.660 --> 03:11.420 If you want a book, and I'm doing a find the evidence contest here, you have to stand up and scream at the top of your lungs the correct answer. 03:11.580 --> 03:14.080 You've got to commit if you want the books. 03:15.280 --> 03:18.100 Now, we're going to start off pretty lightweight. 03:18.100 --> 03:20.240 This is not for a prize. 03:20.440 --> 03:22.760 Please remain seated. 03:23.280 --> 03:27.360 Help me find the evidence. 03:30.120 --> 03:31.260 Thank you. 03:31.580 --> 03:33.880 We're going to start off pretty easy. 03:34.080 --> 03:37.620 Now, in the stealing book, Newt did not have an iPod. 03:37.620 --> 03:39.040 That wasn't part of the story. 03:39.040 --> 03:43.600 But one of the interesting devices that I'm seeing all over the place are these iPods. 03:43.600 --> 03:47.420 And everybody knows they hold music, they can hold data, the whole nine yards. 03:47.420 --> 03:51.200 But the bottom line is there's a whole lot to it that folks really haven't considered. 03:51.200 --> 03:55.540 So what I'm going to do is sort of take you through what some of that stuff might be. 03:57.840 --> 04:15.040 First of all, this is the standard practice for the man, the Fed, is to grab a device like this and pick it up and sort of flip through it and see what's there, hit that little about menu, get information from the iPod. 04:15.040 --> 04:17.900 Well, the simple fact of the matter is that's bad news. 04:18.240 --> 04:24.740 Picking up any sort of device on a scene and mucking with it is going to potentially destroy evidence. 04:24.920 --> 04:29.600 And if a decent lawyer gets a hold of that in court, that evidence that you discover is going to get tossed. 04:30.020 --> 04:33.180 So doing this is a bad idea. 04:33.420 --> 04:38.480 So let's talk about some of the things that we can do to sort of investigate these things. 04:38.580 --> 04:45.820 I'll be the first to tell you, and no offense to those that do forensics full time, forensics is a little bit dry. 04:47.900 --> 04:49.100 No offense. 04:49.100 --> 04:51.560 I mean, CSI is very cool, right? 04:52.480 --> 05:02.080 The slightly aging but still quite attractive redhead and the not so aging and quite attractive brunette make it interesting. 05:02.720 --> 05:04.700 But that has nothing to do with forensics. 05:04.700 --> 05:07.080 But I'll try to spice it up a little bit. 05:07.240 --> 05:08.000 All right. 05:08.580 --> 05:16.980 As far as an investigative platform for these things, I hate to be the some sort of raving Mac fan. 05:17.040 --> 05:28.380 But the simple fact of the matter is if you've got an iPod that was formatted on a Mac, the best way to actually take apart that iPod forensically is by using a Mac. 05:29.200 --> 05:35.240 One of the best reasons for that, the biggest reasons for that is quite simply the HFS plus support. 05:35.280 --> 05:39.740 The iPod is basically an HFS plus portable file system. 05:40.320 --> 05:43.440 That's a Mac native file system. 05:43.500 --> 05:45.640 That's not to say Linux can't handle it. 05:45.640 --> 05:48.040 Linux can handle HFS plus. 05:48.260 --> 05:50.280 But it's not native on Linux. 05:50.300 --> 05:53.880 And Windows with HFS plus, well, just forget about it. 05:54.120 --> 05:54.720 All right. 05:54.720 --> 05:59.360 The bottom line is most of the time you're going to want to be using a Mac to actually pull these things apart. 05:59.800 --> 06:00.440 All right. 06:00.440 --> 06:11.920 Now, one of the things that a good investigator has to sort of figure out, and this is all part of the big puzzle, is I've got an investigative platform, what do I actually have to do to keep from tampering the evidence that's on this thing? 06:13.060 --> 06:14.860 All right. 06:14.860 --> 06:29.120 And one of the things that needs to be considered is the fact that when you slap an iPod into a Mac, you connect it up, one of the first things that happens is this demon, this disk arbitration demon, actually latches onto the iPod. 06:29.120 --> 06:36.220 This is the demon that actually causes things like iTunes to launch and the contact lists to update and all that stuff to sync. 06:36.620 --> 06:40.080 Well, from an investigative standpoint, that's bad news. 06:40.340 --> 06:40.820 All right? 06:40.820 --> 06:45.980 You don't want your investigation machine tramping all over this iPod and destroying evidence. 06:45.980 --> 06:48.880 So one of the first things you need to do is you need to hammer this demon. 06:49.100 --> 06:53.620 Now, this demon automatically restarts when you kill it. 06:53.620 --> 06:53.900 Okay? 06:53.900 --> 07:04.720 So actually what you have to do is you have to take this demon and you have to change mode it to 0, 0, 0, physically change mode the binary in S bin and then kill it. 07:05.020 --> 07:05.160 Okay? 07:05.160 --> 07:12.840 Now, once you do that, you get to the point where you've got a device that you can actually hook up to a machine and start looking for evidence. 07:12.860 --> 07:13.460 All right. 07:13.460 --> 07:15.420 But we're not exactly there yet. 07:16.980 --> 07:22.460 One of the other things that we need to do is we need to hook this thing up so that it's in sort of a read-only mode. 07:22.460 --> 07:22.920 Okay? 07:22.920 --> 07:24.980 And that takes a little bit of work as well. 07:24.980 --> 07:30.540 Just killing the demon that automatically connects to this thing and launches iTunes isn't going to be enough. 07:30.580 --> 07:33.400 So we need to get it into sort of a USB disk mode. 07:33.400 --> 07:37.460 How many of you have been inside an iPod's diagnostic mode? 07:37.460 --> 07:38.560 Show of hands. 07:39.160 --> 07:39.520 Okay. 07:39.520 --> 07:42.140 How many of you have actually used an iPod? 07:42.460 --> 07:43.260 Okay. 07:43.260 --> 07:44.420 Quite a few. 07:44.440 --> 07:51.500 This diagnostic mode is key to actually pulling stuff off of the iPod without totally hosing yourself in court. 07:51.640 --> 07:54.620 And this is a third generation iPod. 07:54.620 --> 07:57.620 The way this thing works is slightly different. 07:58.040 --> 08:01.440 And I know this looks like a cheat on like a PlayStation or something. 08:01.480 --> 08:01.880 Right? 08:01.980 --> 08:03.980 So you power it off. 08:03.980 --> 08:06.700 You hold down the forward, the backward, and the center button. 08:06.700 --> 08:09.220 Select and release them all at the same time. 08:09.220 --> 08:11.080 If you do that, you get the cheat code. 08:11.280 --> 08:11.800 All right? 08:11.820 --> 08:14.220 And the cheat code is diagnostic mode. 08:14.540 --> 08:16.580 You get a menu that looks something like this. 08:16.580 --> 08:18.320 It's got a bunch of different options. 08:18.380 --> 08:22.900 One of the things that we're going to hit is we're going to hit USB mode inside the iPod. 08:24.740 --> 08:27.500 After we reboot, we get a screen that looks like this. 08:28.600 --> 08:29.020 All right. 08:29.020 --> 08:33.680 At this point, you sort of have a choice between treating this like a fire wire device and a USB device. 08:34.260 --> 08:36.140 I'm going to fly through the boring stuff. 08:36.180 --> 08:40.900 Once you get all that done, you get a screen that looks like this that basically says I'm in disk mode. 08:40.900 --> 08:42.880 So the iPod is no longer an iPod. 08:42.880 --> 08:47.400 It's basically a disk that's about as close to read-only as you can get. 08:47.680 --> 09:00.980 Now, the reason I'm dragging you through all this boring stuff is most people don't realize how difficult it is to actually be an investigator, to be one of the good guys, to actually go through all this stuff to try to catch, well, people like you. 09:03.240 --> 09:07.360 But the bottom line is, you know, the good guys are pretty smart, too. 09:07.380 --> 09:09.120 Not that I'm choosing sides here. 09:09.120 --> 09:11.560 And they're not nearly as dumb as we paint them out to be. 09:11.560 --> 09:17.160 Simple fact of the matter is, they will go through this process to actually get to your stuff that's on the iPod. 09:17.160 --> 09:20.580 So the question becomes, what exactly can be on an iPod? 09:21.700 --> 09:23.880 Here's a file listing. 09:23.880 --> 09:27.060 The iPod actually just shows up as another device on the machine. 09:27.060 --> 09:28.600 So we mount the device. 09:28.600 --> 09:30.020 We do a listing. 09:30.220 --> 09:32.860 Can anybody see anything interesting about this file listing? 09:32.860 --> 09:34.040 Anything that stands out? 09:41.010 --> 09:43.830 Next time, answer slower so I can swallow. 09:45.750 --> 09:46.430 Yeah. 09:47.950 --> 09:48.830 Whew. 09:49.290 --> 09:50.550 Yeah, there's a nopics. 09:50.550 --> 09:52.790 There's a nopics.img file on here. 09:52.790 --> 09:55.710 This is a persistent encrypted nopics home directory. 09:55.710 --> 09:58.570 Those of you that use nopics realize what this thing is. 09:58.630 --> 10:04.170 The bottom line is, yeah, you can absolutely put whatever you want on this iPod as a file. 10:04.170 --> 10:13.190 But one of the things that gets really interesting is when you start using the iPod for other things, for example, booting it, booting from it as a device, okay? 10:13.190 --> 10:17.570 Booting from it with a nopics CD or booting from it absolutely natively. 10:17.570 --> 10:21.550 Actually loading a distribution of nopics on it, booting right from the iPod. 10:21.550 --> 10:24.070 You've got basically a portable platform. 10:24.070 --> 10:25.910 It's got all your attack tools on it. 10:25.910 --> 10:28.490 You can use it just like any other machine. 10:28.490 --> 10:30.350 Hook it up, boot, and you go. 10:30.690 --> 10:31.510 Where's Tyler? 10:31.510 --> 10:32.470 Is Tyler here? 10:33.570 --> 10:34.650 Where's Tyler? 10:34.650 --> 10:35.390 All right, Tyler. 10:36.750 --> 10:37.590 Thank you. 10:37.590 --> 10:41.790 Everybody give our newest goon, Tyler, a big round of applause right there. 10:45.860 --> 10:46.400 All right. 10:46.400 --> 10:49.760 Now that I've absolutely embarrassed her and she's going to hide from all of you. 10:49.900 --> 10:54.560 Tyler actually submitted a talk that had nothing to do, that had everything to do with iPods. 10:54.560 --> 10:57.760 It was just about iPods and all the cool stuff you can do with them. 10:57.760 --> 11:06.840 She's actually got a shuffle that she can boot from that boots nopics but also comes up in iTunes natively so that it can have music running from it, attack tools, the whole nine yards. 11:06.900 --> 11:09.720 Yeah, with a little device the size of a stick of gum. 11:09.880 --> 11:11.240 It's pretty cool stuff. 11:11.240 --> 11:14.200 Show of hands, how many people would have been interested in a talk like that? 11:15.160 --> 11:15.780 Cool. 11:15.780 --> 11:16.580 Thank you. 11:16.800 --> 11:17.040 All right. 11:17.040 --> 11:19.140 Anybody that's on the review board, take note. 11:19.520 --> 11:20.220 All right. 11:20.740 --> 11:22.200 I've done my plug. 11:23.660 --> 11:24.080 Okay. 11:24.080 --> 11:26.660 There's obviously other stuff that's on an iPod. 11:26.920 --> 11:30.760 This shows a screen from an AAC file, just a music file. 11:31.160 --> 11:39.940 Those of you that have messed around in the AAC space know that you can absolutely use these things and lock them down so that you have to authorize them on various machines and all that. 11:40.120 --> 12:00.220 Well, the thing that's interesting from an evidence standpoint, remembering we're supposed to be Uber agent here trying to catch that guy, oh, not going to point at him, that bastard Newt, who's ultra paranoid, is that we need to look in places like music files on an MP3 player in ways that are not necessarily standard. 12:00.220 --> 12:05.260 For example, you can see when I launch this AAC file that the registered e-mail address pops up. 12:05.380 --> 12:08.400 This is the user that actually, you know, purchased this song. 12:08.400 --> 12:10.320 It's the e-mail address that they used. 12:10.760 --> 12:16.620 So, yeah, you can pull out e-mail addresses from the music files as an investigator, use those for more leads. 12:19.480 --> 12:20.220 Okay. 12:20.260 --> 12:26.280 The other thing that's often overlooked, and I know this is old news, but metadata inside the files. 12:26.280 --> 12:29.980 You know, you get a music file, you get any kind of file, there's a potential for metadata. 12:30.040 --> 12:31.840 You can have all sorts of stuff in here. 12:31.840 --> 12:33.900 Anybody see anything odd with this one? 12:36.390 --> 12:38.030 Wow, you guys are good. 12:38.250 --> 12:39.650 Yeah, the comments field. 12:40.070 --> 12:42.810 There's been a lot of work done recently in covert channels. 12:42.810 --> 12:48.990 A good friend of mine, Russ Rogers, is doing the hacking the terror network book, talks about covert channels and things like that. 12:48.990 --> 12:59.410 The simple fact of the matter is, as bad guys, I'm not generalizing, but, yeah, as bad guys, you know perfectly well that you can use covert channels just about anywhere. 12:59.410 --> 13:00.790 Music files are no different. 13:00.790 --> 13:06.470 A really good investigator is going to actually look in those files to see if there's anything that's out of the ordinary. 13:07.230 --> 13:09.290 And this is just one of the spots that he's going to look. 13:12.560 --> 13:13.160 All right. 13:13.180 --> 13:19.140 Also, the normal stuff that would be on an iPod, you can have your contact list, you can have your calendar, you can have all that stuff. 13:20.680 --> 13:26.460 This is just an example, but, yeah, your address book syncs to it, so an investigator is going to pull all that stuff off. 13:26.660 --> 13:27.740 Yada, yada, yada. 13:28.640 --> 13:29.840 All right. 13:29.840 --> 13:38.020 Other things about MP3 files in general is a lot of them use the metadata to store information about last time played and all that kind of stuff. 13:38.020 --> 13:39.660 All that stuff's going to be on there. 13:39.660 --> 13:45.940 Also, if the investigator is really good, one of the things he's going to do is he's going to take all the music files, he's going to run hashes against them. 13:46.180 --> 14:00.580 And if there's peer-to-peer software on the machine, the bad guy's got peer-to-peer software, he's actually in some cases going to check the file hashes of the same songs on a peer-to-peer network to see if the file hashes match. 14:00.580 --> 14:05.480 You know, if you've got somebody that's just pirating music, there's a good chance that these hashes are going to match. 14:05.500 --> 14:17.300 If the investigator finds a song whose MD5, I'm sorry, you don't use MD5 anymore, thanks, Dan, your SHA1 hash doesn't match, it'd be something worth looking at. 14:18.240 --> 14:18.900 All right. 14:18.900 --> 14:20.060 Digital cameras. 14:21.140 --> 14:27.720 Obviously, I'm doing some of the more obvious things first, because, you know, investigators, we're just going to do real obvious stuff. 14:27.720 --> 14:30.080 Digital cameras, absolutely, they're going to be picked up. 14:30.080 --> 14:32.900 What about the images that are actually on these cameras? 14:33.980 --> 14:38.440 Well, first of all, yeah, there are images on digital cameras. 14:38.440 --> 14:39.060 Hello. 14:39.320 --> 14:39.940 You know? 14:40.160 --> 14:47.480 I think a lot of investigators and a lot of the good guys actually forget the fact that they're pictures, they're not just data. 14:47.620 --> 14:54.020 So the simple fact is actually looking at the pictures themselves to try to pull out evidence from the image themselves is a good idea. 14:54.120 --> 14:58.640 For example, here's an image with all sorts of metadata. 14:59.060 --> 15:04.260 I know it's probably very hard to read, but can anybody tell me what's wrong with this picture? 15:05.460 --> 15:06.580 What was it? 15:07.720 --> 15:08.400 Huh? 15:09.540 --> 15:11.520 There's lots of network cables, yeah. 15:11.640 --> 15:14.420 Let me give you a little bit of a hint. 15:14.420 --> 15:20.420 The date time stamp on here shows the time as being approximately 4 in the morning. 15:23.450 --> 15:24.330 Absolutely. 15:24.370 --> 15:25.490 Shouldn't be daylight. 15:25.490 --> 15:25.670 Okay? 15:25.670 --> 15:32.930 The simple fact of the matter is there should not be daylight at 4 o'clock in the morning, and the question is what does that mean? 15:32.990 --> 15:33.530 Okay? 15:33.530 --> 15:34.750 As evidence. 15:35.670 --> 15:36.410 You know? 15:36.930 --> 15:38.190 Could mean a lot of things. 15:38.190 --> 15:40.690 Could mean the date time stamp on the camera is broken. 15:40.690 --> 15:43.130 What if the date time on the camera is right? 15:45.030 --> 15:45.630 That's right. 15:45.630 --> 15:47.790 The picture was taken in a different time zone. 15:47.790 --> 15:49.390 So it's things like that. 15:49.390 --> 15:52.790 The actual time on the digital camera, you can't pull off. 15:52.790 --> 15:57.010 You actually have to look at the digital camera itself and figure out what the time is set to. 15:57.790 --> 16:08.950 This was actually used in one of the books to catch somebody that was, and this was the stealing book, to actually figure out that somebody took the picture in another country. 16:09.250 --> 16:09.430 Okay? 16:09.430 --> 16:13.690 So the investigator actually picked up on that and went, okay, what are my choices? 16:13.690 --> 16:15.370 What countries is this daylight? 16:15.370 --> 16:16.270 Let's narrow it down. 16:16.270 --> 16:17.410 Let's cross-reference it. 16:17.410 --> 16:18.450 Yada, yada, yada. 16:18.630 --> 16:20.010 Another plug for stealing. 16:20.010 --> 16:20.810 Thank you. 16:22.430 --> 16:23.090 All right. 16:23.090 --> 16:25.370 A little bit more about EXIF stuff. 16:26.190 --> 16:29.350 Are the date times consistent with the pictures? 16:29.550 --> 16:33.370 There could be potential for thumbnail inconsistencies. 16:33.370 --> 16:35.750 You look at a picture, you look at the embedded thumbnail. 16:35.750 --> 16:41.510 If it's been processed in some sort of imaging program that didn't update the thumbnail, you can see the inconsistencies there. 16:41.510 --> 16:42.790 All sorts of stuff. 16:44.210 --> 16:44.930 All right. 16:44.930 --> 16:49.170 Now, I know these are very hard to read, but there's two images here. 16:49.170 --> 16:52.230 Can anybody tell me what's different between the two images? 16:54.110 --> 16:55.030 Good. 16:55.030 --> 16:56.030 Sizes. 16:56.850 --> 16:59.990 The create time and dates are different. 16:59.990 --> 17:02.950 The stamp on the camera software has changed. 17:02.950 --> 17:08.370 It's gone from being an actual camera stamp to being a Photoshop stamp. 17:08.810 --> 17:20.570 I know this is old stuff, but the bottom line is the good guys are actually going to be using these techniques to figure out if you've processed an image outside the camera, modified it in any way, et cetera, et cetera. 17:23.170 --> 17:24.290 All right. 17:25.510 --> 17:29.270 Now, this one's easy, so it's not for a book. 17:30.050 --> 17:31.850 Not for a book. 17:31.850 --> 17:32.810 Sorry. 17:34.010 --> 17:34.650 Okay. 17:35.050 --> 17:36.730 No, it's not the USB. 17:36.730 --> 17:37.530 Sit down. 17:38.150 --> 17:40.390 For a book, where's the evidence? 17:42.050 --> 17:45.270 She stood up and was very bold, and you get a book. 17:45.270 --> 17:46.030 Come on up. 17:54.210 --> 17:55.210 All right. 17:55.350 --> 17:56.190 Very nice. 17:56.190 --> 17:58.610 You get the idea how this game works, right? 17:58.610 --> 18:00.390 Yeah, there's a USB there. 18:00.390 --> 18:01.810 There's a PowerBook sitting there. 18:01.810 --> 18:04.230 Yeah, it's real obvious places to look for evidence. 18:04.230 --> 18:06.530 But yeah, there's a phone in the picture, okay? 18:06.530 --> 18:11.470 And it's, you know, just a normal phone that you'd find on the desk in just about any office. 18:11.670 --> 18:19.590 But the simple fact is that there's possible data inside this phone that might not show up in things like call logs. 18:19.670 --> 18:25.050 For example, you dump the PBX logs, there's all sorts of stuff jammed in the redial. 18:25.050 --> 18:28.390 For example, in this, you know, I wasn't gonna show you any real PIN numbers. 18:28.410 --> 18:33.730 I dial up a number, I put in a PIN number, it's actually captured inside that redial info. 18:33.730 --> 18:36.270 By playing with the phone, you can get that information out. 18:36.270 --> 18:38.030 It might be lost in a call log. 18:39.450 --> 18:40.170 All right? 18:40.290 --> 18:45.610 Other things that you can get, you can get park settings, in-dial forwarding, all sorts of information. 18:45.610 --> 18:49.450 Again, this stuff might not necessarily show up anywhere else. 18:49.470 --> 18:56.370 If the desk phone is forwarded to a cell phone, the phone itself might be the only place to actually get that information. 18:56.370 --> 18:59.130 So a good investigator's actually gonna consider this stuff. 19:01.810 --> 19:12.770 Speaking of phones, cell phones, most of you guys know this stuff, but just for completeness, cell phones have cameras in them, obviously, you've got images in them, yadda, yadda, yadda. 19:12.770 --> 19:15.890 A lot of them have SD or mini SD cards inside of them. 19:15.890 --> 19:17.850 Those SD cards should be removed. 19:18.250 --> 19:20.510 It's not necessarily the same as a SIM card. 19:20.510 --> 19:22.370 There could be other stuff that's on there. 19:22.450 --> 19:24.390 How many saw Mudge's talk this morning? 19:25.010 --> 19:25.890 Show of hands. 19:26.310 --> 19:26.790 All right. 19:26.790 --> 19:33.650 One of the things that I found very interesting, a couple things I found interesting about Mudge's talk was he pulled out his sidekick phone. 19:33.890 --> 19:46.010 And one of the things that he revealed was that when he basically lost his phone and got another phone, all his images and all his phone lists were automatically populated back down to his sidekick. 19:46.010 --> 19:48.550 Brand new phone, brand new SIM card. 19:48.610 --> 19:54.310 So the images actually went out to the website and once he re-registered, they came back down to his phone. 19:54.310 --> 19:59.390 Bottom line is this is fairly transient stuff that might be hard to pick up any other way. 20:00.950 --> 20:01.710 All right. 20:02.110 --> 20:02.910 Printers. 20:03.950 --> 20:05.430 Printers are often overlooked. 20:05.430 --> 20:08.990 Let's take a look at some of the ways you can actually pull evidence off of printers. 20:10.670 --> 20:20.370 One of the things an investigator has to consider, especially an investigator of the caliber that's required to catch somebody like Newt, is that every piece of evidence is absolutely critical. 20:20.370 --> 20:23.510 You can't mess around with destroying evidence. 20:23.510 --> 20:31.630 So one of the things that you have to consider is the fact that simply printing a page off of a printer could potentially destroy evidence. 20:32.230 --> 20:40.450 Some of the things that you can do, you can actually pull data off the transfer drums if you're like incredibly paranoid or you have access to electron microscopes. 20:40.450 --> 20:43.210 You can pull data outside of actual semiconductors. 20:43.210 --> 20:45.170 You can do all this scientific stuff. 20:45.430 --> 20:50.530 Okay, but even if you're not that desperate, there's a lot that you can do right from the LCD menu. 20:50.750 --> 20:54.410 So for example, here's the information menu on a laser jet printer. 20:54.690 --> 21:03.410 You can go in there, you can actually print off the event log to see what events actually happened on the printer, when the toner died, when there were paper jams, all that sort of stuff. 21:03.410 --> 21:05.450 Get documents that look like this. 21:06.010 --> 21:10.410 One of the things that you can see is time and date stamps on all the events on the printer. 21:10.410 --> 21:14.710 A lot of those events can't happen unless somebody's actually at the printer. 21:15.250 --> 21:22.390 Okay, so a good agent is going to use this stuff to actually correlate time, you know, to see, okay, was the guy in the office at this point? 21:22.390 --> 21:23.530 Was he at the keyboard? 21:23.530 --> 21:26.470 Does that correlate with forensics logs that we have off the wire? 21:26.530 --> 21:27.630 Et cetera, et cetera. 21:30.270 --> 21:36.110 The other things, there's lots of stuff that you can do, and I'm really skimming, so I'm trying to keep this, you know, fairly interesting. 21:36.510 --> 21:39.550 You can do a lot from the LCD screen itself without printing. 21:39.550 --> 21:43.690 Like, you can actually view the event log from the LCD screen without printing. 21:43.730 --> 21:55.110 So you go through the information menu, and even though it's a little bit cryptic, you know, an agent can use the LCD screen to actually write down the event log itself, and then translate all this information into, you know, real stuff. 21:56.910 --> 21:59.670 The other thing is a lot of printers have web interfaces. 21:59.890 --> 22:04.650 Yes, I ripped this from one of my Google talks, but yeah. 22:04.910 --> 22:08.510 And yeah, there's the Google query in the top that found the example. 22:09.290 --> 22:13.530 And the little oval button that says configuration wizard. 22:14.930 --> 22:16.570 But anyway, that's the Google talk. 22:16.570 --> 22:18.250 I'm doing a different talk now. 22:18.390 --> 22:19.250 Where am I? 22:19.250 --> 22:20.290 Who are you people? 22:21.990 --> 22:24.310 But anyway, yeah, you've got web interfaces on printers. 22:24.310 --> 22:25.070 You can connect to them. 22:25.070 --> 22:27.310 You can get lots of information off of those. 22:28.090 --> 22:37.690 This printer, for example, this Ricoh, it actually queues up print jobs through the web interface, so you can go into the web interface and actually get print jobs off of that. 22:37.690 --> 22:40.510 Again, good evidence from an investigator's standpoint. 22:43.330 --> 22:44.730 A couple more things. 22:44.730 --> 22:50.670 Fax machines are often overlooked because of the fact that most of the time an investigator is going to get call logs. 22:50.670 --> 22:53.650 You know, they'll go to the PBX, they'll actually pull back the call logs. 22:54.150 --> 22:57.610 Fax machines themselves can absolutely contain evidence. 22:57.770 --> 23:04.030 Again, we're at an LCD screen thing where you can actually go in and get time, date, headers, company name. 23:04.590 --> 23:07.650 Again, you can see that bastard, Nooth. 23:08.190 --> 23:10.130 You can see fax functions, phone numbers. 23:10.130 --> 23:13.570 You can see all sorts of stuff, again, just by going through the LCD menu. 23:13.570 --> 23:20.870 A lot of times investigators tend to pass by these devices Investigators these days are getting better and better and even pulling evidence off of these. 23:22.510 --> 23:24.270 All right, some more stuff. 23:24.590 --> 23:32.530 The phone book entry can be pulled off and transmission reports, again, date, time stamps, places that were called, produce reports that look like this. 23:32.710 --> 23:37.990 So you've got the number that was called, the duration of the fax, the number of pages, all sorts of stuff. 23:40.270 --> 23:42.870 All right, faxes and multifunction devices. 23:44.130 --> 23:47.710 Multifunction devices, printers, fax machines, copiers, all that stuff. 23:47.710 --> 23:49.230 They pretty much act the same way. 23:49.230 --> 23:51.290 It's a printer, it's a fax machine, whatever. 23:51.290 --> 24:01.490 The bottom line is that device can contain evidence and this is a talk in and of itself, but everybody pretty much knows that network devices themselves can contain a lot of data. 24:01.910 --> 24:05.270 You got a Cisco, you got a wireless device. 24:05.270 --> 24:07.750 Those devices can contain information. 24:08.770 --> 24:22.610 Network devices actually played a critical role in figuring out exactly what Newt was up to because even though the guy melted down his hard drives, used a belt sander on his CDs and got rid of all his disposable media stuff, the removable media stuff, 24:22.610 --> 24:26.710 he left behind the actual desktop machines and his network gear and his printer. 24:27.170 --> 24:32.670 Okay, so at that point, an investigator has to, you know, frigging catch the guy with just what's left over. 24:33.330 --> 24:36.350 Okay, now this is going to be fun. 24:38.350 --> 24:42.050 Our next slide is for a book, all right? 24:42.110 --> 24:48.150 And I'm going to push the little button here and see if you can find the evidence. 24:51.710 --> 24:53.670 Who said that? 24:53.710 --> 24:54.890 Come on up. 24:57.390 --> 24:58.390 What's that? 24:59.710 --> 25:01.250 Oh, man. 25:06.580 --> 25:07.800 That's excellent. 25:07.800 --> 25:08.500 Yeah. 25:08.820 --> 25:12.320 Fingerprinting model glue from none other than Mudge. 25:12.320 --> 25:12.980 Thank you, sir. 25:12.980 --> 25:13.520 Come on up. 25:13.520 --> 25:14.580 Do you have something to drink? 25:14.580 --> 25:16.340 You should be just sitting up here. 25:18.120 --> 25:19.700 So everybody welcome Mudge. 25:31.940 --> 25:34.280 And no, he hasn't been sniffing model glue. 25:35.660 --> 25:36.720 Yeah, that was excellent. 25:36.720 --> 25:40.100 Whoever jumped out of their freaking seat right there, dude, you are the man. 25:40.100 --> 25:41.600 Yeah, look at all this stuff. 25:41.640 --> 25:48.120 All right, you got USB drives, you got PDAs, you got all this stuff, you got CF cards, you got all this crap all over here. 25:48.120 --> 25:49.660 Well, let's clear the table. 25:50.460 --> 25:51.980 And where's the evidence now? 25:52.080 --> 25:53.540 Yes, those are breath. 25:53.540 --> 25:55.120 No, no, no, that wasn't for a book. 25:56.120 --> 25:57.440 I like this. 25:57.440 --> 25:59.220 We're going to get the wave going. 25:59.220 --> 26:00.420 This is going to be hot. 26:00.760 --> 26:01.400 All right. 26:01.400 --> 26:02.660 Yeah, those are breath strips. 26:02.660 --> 26:03.900 And no, that's not the evidence. 26:03.900 --> 26:06.460 But yes, this happens to be a USB watch. 26:06.460 --> 26:07.940 Hook this puppy up to a machine. 26:07.940 --> 26:09.860 It's actually got USB storage. 26:09.920 --> 26:13.840 A decent agent is not going to overlook something like a watch. 26:13.840 --> 26:15.520 They're actually going to pick this stuff up. 26:15.520 --> 26:17.240 Going to pull the data off of it. 26:22.220 --> 26:23.160 Holy crap. 26:23.160 --> 26:24.780 Come up here and say that. 26:33.880 --> 26:43.540 I just pointed out if it was actually a mechanical watch at any point on the inside, that based upon the spring expansion, you could figure out roughly the date that it was created and be able to go back to figure out when they were sold. 26:49.030 --> 26:49.930 Thank you. 26:51.210 --> 26:51.630 All right. 26:51.630 --> 26:54.130 I've been told that I can talk as long as I want. 26:56.570 --> 26:57.230 No. 27:08.360 --> 27:14.800 Unfortunately, the mob can't speak for my day job, which would absolutely get rid of me if I was on the TCP IP drinking game. 27:14.920 --> 27:16.600 Thank you for the invite. 27:16.640 --> 27:20.720 You can call me a wuss if you want, but I'll be watching safely from the front row. 27:21.820 --> 27:22.880 Thank you. 27:24.720 --> 27:26.620 I'll be cheering for Mudge, though. 27:26.880 --> 27:27.300 All right. 27:27.300 --> 27:27.900 Here we go. 27:27.900 --> 27:29.720 This is for a book. 27:30.380 --> 27:31.900 Yeah, we're okay on books. 27:31.900 --> 27:32.140 All right. 27:32.140 --> 27:33.020 Everybody ready? 27:35.340 --> 27:39.660 What did you say? 27:39.820 --> 27:40.880 Come up here. 27:42.900 --> 27:46.160 He stood up boldly and he proclaimeth. 27:46.840 --> 27:47.720 Pen. 27:48.220 --> 27:49.740 Very nicely done. 27:49.800 --> 27:50.760 Pick a book. 27:52.380 --> 27:54.840 Oh, that is my blockbuster card, isn't it? 27:56.020 --> 27:57.360 And my yo-yo. 27:57.680 --> 27:59.560 I have yo-yo skills. 28:00.480 --> 28:01.060 I do. 28:01.060 --> 28:03.940 Maybe if we're killing time, I'll do some yo-yo kung fu up here. 28:04.440 --> 28:05.920 Yeah, absolutely. 28:05.920 --> 28:08.000 The bottom line is USB pen devices. 28:08.000 --> 28:09.840 They're a lot more common than you think. 28:09.840 --> 28:14.000 You get a drawer filled with junk like this, there's going to be crap that's hiding in the crevices. 28:14.380 --> 28:21.520 If you've got to think geek shop and fool that you're trying to catch down, he's going to have stuff like this. 28:23.060 --> 28:27.300 And you can figure out how much ink is in it and do an analysis to figure out how long he's been. 28:27.300 --> 28:28.880 Where do you come up with this stuff? 28:30.340 --> 28:34.480 This is why I would never be on a TCPIP drinking game against this guy. 28:36.220 --> 28:37.200 That's true. 28:37.200 --> 28:38.140 That's true. 28:38.720 --> 28:39.460 All right. 28:39.460 --> 28:40.340 Yeah, good stuff. 28:40.340 --> 28:40.600 All right. 28:40.600 --> 28:42.260 Let's do another one for a book. 28:42.260 --> 28:43.120 You guys ready? 28:46.800 --> 28:47.600 Nope. 28:49.860 --> 28:51.540 Wait, I heard it. 28:53.740 --> 28:54.220 There 29:11.620 --> 29:12.980 it is. 29:12.980 --> 29:13.800 Right over here. 29:13.800 --> 29:14.980 I heard it. 29:14.980 --> 29:15.220 Yes. 29:15.220 --> 29:20.400 Lo and behold, it is the duck. 29:22.300 --> 29:23.640 Yeah, baby. 29:30.670 --> 29:32.790 That was very nicely done. 29:33.070 --> 29:37.910 Oh, and all you people that were just calling out without standing up, do not think that that will get you a book. 29:37.910 --> 29:40.310 That's not the enthusiasm I'm looking for. 29:41.930 --> 29:48.350 We're down to two books, so I think I might skip this one and make this one a freebie. 29:48.590 --> 29:51.110 Yeah, we're going to skip this one and make it a freebie. 29:51.110 --> 29:51.870 All right. 29:52.850 --> 29:53.890 It's not for a book. 29:53.890 --> 29:55.110 You can stay seated. 29:56.690 --> 29:57.550 Fluoride? 29:57.550 --> 29:58.310 What? 30:07.900 --> 30:11.940 USB Clorox sounds definitely like something Mudge would have said. 30:16.570 --> 30:20.150 It does look like the Unabomber was there. 30:28.470 --> 30:30.130 USB TP. 30:31.510 --> 30:32.670 Here it comes. 30:32.670 --> 30:33.770 You ready for it? 30:33.770 --> 30:34.670 Ready for it? 30:34.670 --> 30:35.830 Here it comes. 30:37.930 --> 30:40.810 What is it? 30:41.750 --> 30:43.050 USB flashlight. 30:43.050 --> 30:47.770 Yes, this is an embedded USB digital camera flashlight combination. 30:47.910 --> 30:48.490 Yeah. 30:48.630 --> 30:50.690 Uber agent is going to pick that stuff up. 30:50.790 --> 30:53.250 Let's take a look at this one. 30:53.250 --> 30:57.910 I really got to spread these books out here, man, because I got a lot more slides. 30:58.490 --> 30:59.070 All right. 30:59.070 --> 31:01.610 This one's not for a book. 31:01.610 --> 31:02.730 It's just kind of fun. 31:02.730 --> 31:04.150 Can anybody find the evidence in this picture? 31:04.950 --> 31:06.690 Oh my goodness. 31:07.030 --> 31:08.490 You are Uber. 31:08.810 --> 31:16.830 Without any hesitation whatsoever and without the benefit of the Zoom, he proclaims TikiTorch. 31:17.970 --> 31:19.070 There it is. 31:19.070 --> 31:25.810 This is a very nice TikiTorch that normally I would tell you to go to a place like ThinkGeek to actually purchase. 31:26.690 --> 31:36.990 But ThinkGeek did not think anything of the DEF CON conference because when I called them and said I was doing this talk and I'd really like to get some pictures of their gear, guess what they said? 31:38.290 --> 31:39.910 They said nothing. 31:40.170 --> 31:41.990 So buy it somewhere else. 31:43.830 --> 31:44.750 Bastards. 31:47.490 --> 31:50.590 I borrowed this from a friend who didn't get it from ThinkGeek. 31:50.590 --> 31:51.770 Okay, you guys are so smart. 31:51.770 --> 31:52.390 Let's do it again. 31:52.390 --> 31:53.470 Where's the evidence? 31:55.710 --> 31:56.390 Nope. 31:56.550 --> 31:57.410 The what? 31:59.850 --> 32:01.810 Not... Ooh, that was nice. 32:01.810 --> 32:05.790 From the front row, we have the digital photo picture frame. 32:05.790 --> 32:09.850 Yes, USB-capable digital photo frames can contain data. 32:09.850 --> 32:12.750 It's an excellent spot to hide stuff. 32:12.750 --> 32:13.870 Good job. 32:14.950 --> 32:15.990 All right. 32:16.810 --> 32:17.990 Let's do this again. 32:17.990 --> 32:19.430 Where's the evidence? 32:21.310 --> 32:23.790 Not the stapler, but he stood. 32:24.910 --> 32:26.550 Not the network card. 32:26.930 --> 32:27.970 Nice. 32:28.110 --> 32:29.170 Right here. 32:29.270 --> 32:30.210 The knife. 32:31.850 --> 32:32.550 We got it. 32:32.550 --> 32:33.790 We got the answer. 32:34.990 --> 32:43.370 No, it's not the Microsoft coaster, which most of you should have just taken one look at and gone, there's something suspicious about that. 32:45.050 --> 32:50.890 No, it's not Kevin Mitnick's business card, which most of you should have gone, there's something suspicious about that. 32:50.930 --> 32:55.830 It is actually... And there it is. 32:55.830 --> 32:56.670 Come get a book. 32:56.670 --> 32:57.890 That was worth it. 32:58.230 --> 33:00.050 USB Swiss Army knife. 33:03.070 --> 33:05.450 Yup, USB Swiss Army knife. 33:07.070 --> 33:09.290 I've never seen a USB stapler. 33:10.310 --> 33:17.870 Oh, that's... He actually said stapler and he was right, but sorry, that wasn't the answer I was looking for. 33:18.030 --> 33:19.510 I'll give you other swag. 33:19.510 --> 33:20.430 We'll do that. 33:20.430 --> 33:21.030 All right. 33:21.030 --> 33:22.130 You guys ready? 33:22.350 --> 33:23.790 This one's for a book. 33:24.070 --> 33:25.370 Find the evidence. 33:44.690 --> 33:46.830 Do not listen to Mudge. 33:47.650 --> 33:49.650 His idea is way too smart. 33:50.170 --> 33:52.010 No, there's no evidence here, people. 33:52.010 --> 33:53.230 It's a bowl of fruit. 34:01.500 --> 34:03.680 You guys are not very good Uber agents. 34:04.180 --> 34:05.300 Oh, 34:11.280 --> 34:13.120 that was kind of cool. 34:13.120 --> 34:16.720 I wanted to pull a Mudge and answer my phone when somebody was calling me while I was on stage. 34:17.540 --> 34:18.580 That would have rocked. 34:18.880 --> 34:19.580 All right, let's see. 34:19.580 --> 34:22.660 I think this might be our last one for a book. 34:24.500 --> 34:26.320 No, we'll do it in the next picture. 34:26.320 --> 34:28.000 This one's just a freebie. 34:28.000 --> 34:29.000 Where's the evidence? 34:30.900 --> 34:32.040 Oh, yes. 34:32.040 --> 34:33.200 You guys are getting the hang of this. 34:33.200 --> 34:34.360 I heard it on the right. 34:34.440 --> 34:35.300 Here it comes. 34:35.300 --> 34:36.300 Wait for it. 34:36.300 --> 34:37.640 Wait for it. 34:38.340 --> 34:39.480 There you go. 34:40.040 --> 34:41.580 USB camera binoculars. 34:41.580 --> 34:43.020 Okay, you guys are getting the hang of this. 34:43.020 --> 34:51.160 Whole point of the talk is that it takes an interesting outlook on various locations like this to find stuff that could potentially be meaningful. 34:51.300 --> 34:57.620 When you've got a world that's filled with digital devices like this, it's going to take a death by a thousand cuts to catch somebody like Newt. 34:57.640 --> 34:59.660 That's what the entire book is about. 34:59.660 --> 35:01.420 I hope you guys will check out the stealing book. 35:01.420 --> 35:03.280 Let's do our last one for the book. 35:03.280 --> 35:05.680 And we need some enthusiasm here. 35:05.680 --> 35:07.980 You've got to stand up or you're not going to win it. 35:08.460 --> 35:09.460 Where's the evidence? 35:10.500 --> 35:11.300 Mudge. 35:15.850 --> 35:16.770 Who was it? 35:16.770 --> 35:18.830 Who was it in the back that said sushi? 35:18.850 --> 35:21.750 Come forward. 35:23.870 --> 35:27.730 No, it wasn't Bruce Sterling's Zenith book. 35:27.730 --> 35:29.730 It was the sushi. 35:30.390 --> 35:32.230 We've got to get the transition work in here. 35:32.230 --> 35:33.490 Go with the flow. 35:33.510 --> 35:34.170 Nice. 35:34.170 --> 35:34.970 Thank you. 35:34.970 --> 35:35.570 All right. 35:35.570 --> 35:38.490 So anyway, USB sushi. 35:44.770 --> 35:45.590 All right. 35:45.590 --> 35:46.990 So you guys got the hang of this. 35:46.990 --> 35:48.050 That's the idea. 35:48.050 --> 35:49.870 Other places evidence can hide. 35:49.870 --> 35:51.510 You guys have probably seen most of this stuff. 35:51.690 --> 35:56.210 I couldn't actually taunt you by putting these into a picture because most of them were too easy. 35:56.210 --> 36:00.090 How many of you have actually seen these Oakley thump glasses like in person? 36:00.670 --> 36:02.130 These things rock. 36:02.710 --> 36:05.550 They also look like freaking Vulcan space goggles. 36:05.690 --> 36:07.530 All right. 36:07.530 --> 36:12.970 So anyway, Newt was an ultra paranoid and did everything right, but in the end was he busted. 36:12.970 --> 36:13.950 I'm not going to spoil it. 36:13.950 --> 36:15.390 You'll have to get the book to find out. 36:15.390 --> 36:18.370 Stealing the network, how to own the identity by Singer's Publishing. 36:18.370 --> 36:21.970 We're going to do a book signing right after this over at the book booth inside. 36:22.210 --> 36:24.430 We've got several of the authors of various books. 36:24.510 --> 36:27.570 Specifically we're going to do ASD, but we'll have lots of folks over there. 36:27.570 --> 36:29.810 So if you have questions, see you over there. 36:29.810 --> 36:30.450 Thanks a lot.