1
00:00:08,220 --> 00:00:17,220
And then the other thing is trying to encourage you to do this type of research as you investigate what's going on on your own networks.

2
00:00:17,460 --> 00:00:28,060
So a brief outline, a threat, and we'll look at sort of turning the threat on its head and using it as a resource once you've identified a threat.

3
00:00:28,060 --> 00:00:37,340
And then talk about building a method to do this with vis-a-vis China, maybe the Middle East.

4
00:00:37,360 --> 00:00:39,440
So you can take it in different directions.

5
00:00:39,440 --> 00:00:45,600
And then we'll talk about the law and where international law stands on the subject.

6
00:00:45,800 --> 00:00:49,700
So with Russia, very strong in math and science.

7
00:00:49,700 --> 00:00:57,980
They have a history in the Cold War of looking at America through a certain lens and taking our products apart no matter what they may be.

8
00:00:57,980 --> 00:01:03,180
If you talk to Russians, they have a healthy culture of reverse engineering in general.

9
00:01:03,180 --> 00:01:12,120
They've assured me that when you're growing up in a Russian household and your lamp breaks or your toilet doesn't flush, you don't just pick up the phone and call somebody.

10
00:01:12,120 --> 00:01:14,560
You try to figure out how to fix it yourself first.

11
00:01:14,560 --> 00:01:19,840
And so this lends to a hacker culture that is strong.

12
00:01:20,440 --> 00:01:24,060
The other thing is the economy may not be quite where it needs to be.

13
00:01:24,060 --> 00:01:26,260
This is also true in a country like Egypt.

14
00:01:26,260 --> 00:01:33,060
It has a great university system, good education, but just not nearly enough jobs to fill the graduates that come out.

15
00:01:33,060 --> 00:01:37,820
And so they may move into other areas of the economy.

16
00:01:38,560 --> 00:01:41,660
So if you just look, this is a brief slide.

17
00:01:41,660 --> 00:01:46,100
We think Windows is expensive and we think Microsoft Office is expensive.

18
00:01:46,100 --> 00:01:53,480
But if it cost you your a month's salary, you can kind of imagine your willingness to pay for it at that point.

19
00:01:53,480 --> 00:01:55,160
Probably not too likely.

20
00:01:55,780 --> 00:01:56,360
Cybercrime.

21
00:01:56,360 --> 00:01:59,300
There's a long history of cybercrime from Russia.

22
00:01:59,400 --> 00:02:10,040
Vladimir Levin in the mid-1990s manipulated Citibank's cash management system over 40 times, taking $10 million out of it.

23
00:02:10,040 --> 00:02:16,260
So it's one of the few cases, though, of a successful bilateral joint law enforcement operation.

24
00:02:16,760 --> 00:02:23,200
And what happened was they got most of that money back, but they never did figure out how he did it, how he got in to begin with.

25
00:02:23,200 --> 00:02:26,120
The Microsoft source code hack again went back to St.

26
00:02:26,120 --> 00:02:27,080
Petersburg.

27
00:02:27,080 --> 00:02:31,140
This guy named Joe Lopez in Florida recently, very interesting case.

28
00:02:31,140 --> 00:02:32,240
What happened with him?

29
00:02:32,240 --> 00:02:33,600
Core flood virus.

30
00:02:33,600 --> 00:02:36,120
So he's got a Trojan on his system.

31
00:02:36,280 --> 00:02:45,200
Somebody logs in from a couple of former Soviet Union states and they take about $90,000 out of his account, ship it back to Latvia.

32
00:02:45,200 --> 00:02:53,200
Now the problem with Joe Lopez was that they had his legitimate login and password and he didn't have that much of a case.

33
00:02:53,200 --> 00:02:56,400
Bank of America told him, they said, look, it's not our fault.

34
00:02:56,400 --> 00:02:58,360
It's your computer that was hacked.

35
00:02:58,360 --> 00:03:01,580
Somebody logged in with your password and moved the money.

36
00:03:01,980 --> 00:03:17,360
So he turned around and said, look, I don't know anybody in the former Soviet Union and you should know that malicious code is out there and you should know that large transfers to suspect countries, you should alert the client.

37
00:03:17,360 --> 00:03:24,220
In any case, it's a sticky situation because it's his box that was hacked and not the bank's.

38
00:03:24,220 --> 00:03:31,300
This guy, you may or may not remember, he spoke four years ago in Apollo over here.

39
00:03:31,300 --> 00:03:35,280
And I saw his presentation just before he was arrested by the FBI.

40
00:03:35,280 --> 00:03:48,120
And essentially he was for $99 offering you a program that would remove all copyright, all copy, paste, edit, read restrictions on e-book, Adobe product.

41
00:03:48,340 --> 00:03:51,620
And so he was working for a Chicago firm at the time.

42
00:03:51,620 --> 00:04:10,580
And this got really messy because the EFF got involved and nobody wanted the bad PR, at least of all Adobe, or the United States government whose law enforcement agencies also employed Elcomsoft, which was the company that hired Dimitri and made the product.

43
00:04:10,760 --> 00:04:16,860
So with a lot of these cases, again, it's just a few fish in the sea that get arrested, but usually not too much happens with them.

44
00:04:17,380 --> 00:04:23,520
What I want to suggest here is if you have a true zero-day exploit, you can turn that into cash.

45
00:04:23,520 --> 00:04:26,100
And this is what the Russians are doing now.

46
00:04:26,780 --> 00:04:31,120
They've got a great sort of bag of tricks.

47
00:04:31,120 --> 00:04:40,260
And what they're doing through Internet worms like Bagel and MyDoom, they're compromising your systems.

48
00:04:40,260 --> 00:04:44,900
And what they're doing is just lifting off the financial information.

49
00:04:44,900 --> 00:04:48,080
So related to PayPal, related to eBay.

50
00:04:48,240 --> 00:04:50,800
It's usually not for distributed denial of service.

51
00:04:50,800 --> 00:04:53,220
It's usually not for spam, although it can be.

52
00:04:53,220 --> 00:04:56,080
But what they want is your personal financial information.

53
00:04:56,100 --> 00:05:02,180
And they take advantage of an exploit to increase revenue.

54
00:05:02,480 --> 00:05:04,120
So millions of credit cards.

55
00:05:04,120 --> 00:05:11,740
Last year in England, where there is money, you will see a lot of interesting activity.

56
00:05:11,740 --> 00:05:17,740
So with international gambling, if they're offline for a couple hours, that's a whole lot of money that they're going to be losing.

57
00:05:17,740 --> 00:05:29,280
So with the distributed denial of service attacks versus the international gambling, they typically would hit them with maybe a sin flood.

58
00:05:29,320 --> 00:05:37,000
Followed by a letter which said, look, we can take you offline if you don't pay us, say, $50,000 a week, which is not much for international gambling.

59
00:05:37,000 --> 00:05:48,980
By the way, the Sands Institute estimates that about 7,000 companies at any given time are paying extortion money to some online attacker.

60
00:05:48,980 --> 00:05:52,600
But in this case, again, there were some arrests made.

61
00:05:52,680 --> 00:05:58,320
And one success story from last year.

62
00:05:58,320 --> 00:06:02,640
Here is a case which is really very important for a couple reasons.

63
00:06:02,640 --> 00:06:14,540
One, it was so severe that Microsoft changed its normal patch schedule, which was pretty rigid, and they were willing to come out with patches around their normal schedule.

64
00:06:14,540 --> 00:06:15,700
Two, the U.S.

65
00:06:15,700 --> 00:06:21,420
CERT advised at least the folks who work in the Washington, D.C.

66
00:06:21,420 --> 00:06:28,240
Beltway area in the United States government to not use IE, to use something else, or at the very least disable JavaScript.

67
00:06:28,240 --> 00:06:50,000
But what happens here, again, with the Internet worms out there likely compromising Microsoft IIS, then taking advantage of holes in IE to redirect you invisibly to this IP address in China that would download a key logger onto your system and basically pull off financial information,

68
00:06:50,000 --> 00:06:53,500
credit card and PayPal and eBay and the like.

69
00:06:53,500 --> 00:07:03,880
So Russian malware really falls under every kind of category, you know, from backdoor to downloader to spam tool.

70
00:07:04,060 --> 00:07:06,300
So they fall into every category.

71
00:07:06,300 --> 00:07:11,660
Social engineering, okay, there's a social engineering aspect in any good attack.

72
00:07:11,660 --> 00:07:14,400
And with Russians, they've got a very powerful one.

73
00:07:14,440 --> 00:07:18,880
And a lot of people are looking for girlfriends, they're looking for love, right?

74
00:07:18,880 --> 00:07:29,460
And so Russians taking advantage of this, I'll just tell you a couple of stories, there's a Canadian guy who had his Russian girlfriend and was sending her a lot of money.

75
00:07:29,460 --> 00:07:34,600
And it was the way it transpired, it made it very easy for this man, okay?

76
00:07:34,600 --> 00:07:48,860
He had a virtual girlfriend, Althea Matveeva, I think, so he could go into a virtual store and buy her virtual gifts and get email back from her thanking for all this great attention.

77
00:07:48,880 --> 00:07:52,320
The problem was there was no store, there was no gifts, and there was no girlfriend.

78
00:07:52,320 --> 00:07:56,740
It was just a couple in Russia that had this scam going.

79
00:07:56,740 --> 00:08:03,160
They made about $300,000 on it, and of course they would write emails all day long saying, I love you, thank you very much.

80
00:08:05,680 --> 00:08:17,480
So there was another case in which an Australian man wrote to Vladimir Putin directly, and he said, look, I've been looking for my girlfriend, even went to Russia, couldn't find her, can you help me?

81
00:08:17,480 --> 00:08:19,860
There was an arrest made in that case as well.

82
00:08:20,140 --> 00:08:25,880
But it's a big problem, because it's playing on some of the basic human needs, right?

83
00:08:25,880 --> 00:08:27,320
But the U.S.

84
00:08:27,320 --> 00:08:36,560
Embassy in Moscow gets about 10 calls a day complaining of somebody not being able to find their online girlfriend.

85
00:08:38,340 --> 00:08:43,260
So criminal communication can start in public web forums.

86
00:08:43,260 --> 00:08:46,460
I'll show you one here, and then we'll jump back.

87
00:08:47,060 --> 00:09:00,200
So there's public spaces in which if you own proxies or you're a money launderer, that kind of thing, you can put teasers out there in public web forums.

88
00:09:00,200 --> 00:09:08,380
So then you can contact somebody, and then they become closed, and you need registration, and you need recommendations, and that kind of thing.

89
00:09:08,600 --> 00:09:24,400
And the real communication then is usually, it's the word I'm looking for, not proprietary, but homegrown code, or something that makes it very hard to trace at that point.

90
00:09:24,400 --> 00:09:28,600
However, here's one example, and here's some sites you could check out.

91
00:09:28,780 --> 00:09:40,680
But again, you want to announce your service and eventually make your nickname known through the delivery of goods and services through these sites.

92
00:09:40,860 --> 00:09:44,960
And you might get paid through WebMoney.

93
00:09:45,000 --> 00:09:52,980
We're very familiar with PayPal in this country, but in this case, WebMoney is a service that was started in Russia.

94
00:09:52,980 --> 00:10:02,940
And I talked to a couple of Russian guys about this, and they talked about how as soon as you get on, you want to get on a good site, right?

95
00:10:03,900 --> 00:10:05,860
That's legit, essentially.

96
00:10:06,180 --> 00:10:15,520
But the administrators at that site will check out your goods and services fairly quickly and decide whether they want to keep you on or banish you forever.

97
00:10:15,520 --> 00:10:18,280
Where's seen?

98
00:10:18,460 --> 00:10:21,100
Drink or Die is a really big group.

99
00:10:21,100 --> 00:10:25,760
They started in Russia in 93, moved all over the world.

100
00:10:25,880 --> 00:10:31,520
There was one of the biggest international operations law enforcement revolved around Drink or Die.

101
00:10:31,520 --> 00:10:33,160
It was called Operation Buccaneer.

102
00:10:33,160 --> 00:10:35,780
It was a guy, a bandito, was in Australia.

103
00:10:35,780 --> 00:10:38,640
The saint was in Arizona, not too far from here.

104
00:10:38,800 --> 00:10:42,660
And this guy's server had tens of thousands.

105
00:10:42,660 --> 00:10:45,680
It was so large, it was named the God Complex.

106
00:10:46,500 --> 00:10:49,140
And these guys were arrested.

107
00:10:49,140 --> 00:10:51,940
But again, a very sophisticated group.

108
00:10:51,940 --> 00:10:59,740
They specialize in application software, tens of thousands of cracks, and very good at what they do.

109
00:10:59,740 --> 00:11:12,400
And typically the members only know each other's nicknames, and it's very strictly compartmentalized, the organization, and very difficult to... it's kind of like an al-Qaeda cell, right?

110
00:11:12,400 --> 00:11:14,180
You take out one and you don't really know.

111
00:11:14,180 --> 00:11:20,060
They're not necessarily going to know the other two guys on either side of them in the cell.

112
00:11:20,400 --> 00:11:23,420
A little bit different topic, hacktivism.

113
00:11:23,420 --> 00:11:32,860
When the United States joined the conflict in the Balkans and started bombing Serbia, again, national emotions run very high.

114
00:11:32,860 --> 00:11:44,320
And you'll find that a lot of activity that takes place in cyberspace, particularly involved defacement and denial of service attacks, mirrors what's going on in the real world.

115
00:11:44,320 --> 00:11:49,360
You see this with the EP3 that was downed, our EP3 in China.

116
00:11:49,360 --> 00:11:59,040
There was a whole lot of hacker activity and sort of the aborted US-Chinese hacker war that took place during that time frame, or almost took place.

117
00:11:59,040 --> 00:12:12,840
In the Middle East, you'll see when there's a suicide bombing or when there is an assassination of a Palestinian leader by the Israelis, you'll see a whole lot of web defacements and denial of service activity going on.

118
00:12:12,840 --> 00:12:18,360
In this case, Russians are very upset about our stance because they're very close to the Serbians.

119
00:12:18,520 --> 00:12:23,340
So there was a lot of activity against UK and US sites.

120
00:12:23,340 --> 00:12:28,280
We claim there was no impact and the UK admitted to having lost some military databases.

121
00:12:28,280 --> 00:12:31,820
Espionage is a bit more serious.

122
00:12:32,000 --> 00:12:36,360
Here's the current alphabet soup for the Russians.

123
00:12:36,360 --> 00:12:39,840
The KGB is the old institution.

124
00:12:39,840 --> 00:12:45,400
SVR would equate to CIA, FSB, FBI, and FABSI NSA.

125
00:12:46,180 --> 00:13:11,580
Just point to the case of Robert Hansen, really, because this is already not new news, but this is the kind of spy that if you are responsible for protecting a network or protecting any type of national secret, you want to consider that spies are going to be moving in a vastly different direction than you might be familiar with in the movies.

126
00:13:11,580 --> 00:13:15,200
I know James Bond used to turn one page over at a time and photocopy it.

127
00:13:15,200 --> 00:13:24,840
Well now, of course, you can stick a USB drive in and take literally every document your entire agency is working on out of the office with you.

128
00:13:24,840 --> 00:13:26,120
So it's a big problem.

129
00:13:26,120 --> 00:13:31,820
Robert Hansen, 20 years ago, was already sending encrypted bulletin board messages.

130
00:13:32,020 --> 00:13:34,920
He hacked into the account of his superior.

131
00:13:34,920 --> 00:13:41,040
He was working all the databases at FBI, and there was no real limitations on what he could do.

132
00:13:41,040 --> 00:13:48,140
Searching for his own name, searching on dead drops, searching on Russians, and see if there was any connection that somebody may have suspected him.

133
00:13:48,140 --> 00:13:57,080
So about 15 years, he literally gave away just about every important secret to the Russians that you might think of.

134
00:13:57,080 --> 00:13:59,040
He was ideally placed.

135
00:13:59,040 --> 00:14:05,660
He was the chief of Russian counterintelligence at FBI, which gave him access to just about everything.

136
00:14:05,820 --> 00:14:10,700
But very computer savvy, so kind of the spy potentially of the future.

137
00:14:10,700 --> 00:14:15,740
Information warfare, you might be familiar with the revolution in military affairs.

138
00:14:16,040 --> 00:14:19,700
Essentially, that is electronic command and control.

139
00:14:19,700 --> 00:14:24,300
So it looks a lot more like the video game you're playing, right?

140
00:14:24,660 --> 00:14:29,520
Planes in the future are going to be a lot more pilotless planes.

141
00:14:30,160 --> 00:14:38,900
90% of the avionics, electronics, and protection mechanisms and all that into a fighter jet are for the pilot.

142
00:14:39,020 --> 00:14:41,860
It's crazy now, and people are realizing that.

143
00:14:41,880 --> 00:14:46,780
It's sort of an outdated and romantic notion of the Air Force.

144
00:14:46,780 --> 00:14:49,680
In the future, it's going to be pilotless, I promise you.

145
00:14:50,100 --> 00:14:57,100
Revolutionary military affairs, essentially what that means is everything is going to be cyber and network and database centric.

146
00:14:57,420 --> 00:15:02,940
The great goal of the thinkers is, you know, you want a digital Pearl Harbor.

147
00:15:02,940 --> 00:15:08,060
If you're going to go to war with another nation state, you would like to be able to win it without taking any casualties.

148
00:15:08,060 --> 00:15:09,900
You'd like to be able to turn off the lights.

149
00:15:10,440 --> 00:15:14,160
And, you know, when somebody pulls a trigger, nothing happens.

150
00:15:14,160 --> 00:15:15,640
That's the goal here.

151
00:15:15,640 --> 00:15:19,260
I mentioned electronic Russia.

152
00:15:19,260 --> 00:15:31,560
That is just a project that the FSB is getting underway in order to get the word out to citizens and to the agencies and corporations to start thinking in terms of better computer network defense.

153
00:15:31,620 --> 00:15:41,440
And just for the record, they're getting very little money and attention on this, and it's really worrisome to the Russian employees who actually are involved in this project.

154
00:15:41,440 --> 00:15:43,500
Okay, cyber war in practice.

155
00:15:43,500 --> 00:15:48,880
This is interesting because it's actually something tangible that we can point to.

156
00:15:48,880 --> 00:15:55,280
The war in Chechnya, southern Russia, really ugly.

157
00:15:56,000 --> 00:16:04,100
As it started, the Russians disallowed any media involvement, and that turned out to be really bad PR for them.

158
00:16:04,100 --> 00:16:12,040
Because essentially the Chechens came in and they showed all the media types exactly the story they wanted them to see.

159
00:16:12,040 --> 00:16:17,800
So the word getting out to the international media was not at all what the Russians wanted.

160
00:16:17,800 --> 00:16:20,080
They only showed them Chechen dead bodies.

161
00:16:20,340 --> 00:16:24,800
So the Russians learned after that, but it did take a turn in a different direction.

162
00:16:24,800 --> 00:16:31,800
As the war moved into the 90s, Russia went on the offensive in cyberspace.

163
00:16:31,800 --> 00:16:36,800
And I'll just point to one particular incident to highlight the change.

164
00:16:36,800 --> 00:16:43,380
If you might remember, there was in Moscow the hostages that took over the theater.

165
00:16:44,220 --> 00:16:51,000
Well, that lasted for a number of days, and at the end, Russian commandos stormed the theater.

166
00:16:51,000 --> 00:16:57,040
Right when that happened, several Chechen websites went off the air.

167
00:16:57,420 --> 00:17:05,640
So you can only assume from that that it was a coordinated campaign by the Russians on multiple fronts.

168
00:17:06,120 --> 00:17:09,500
For the record, one of the servers was located in the United States.

169
00:17:09,500 --> 00:17:22,080
So you can assume that the Russians took down a US-based website for what that's worth.

170
00:17:22,080 --> 00:17:22,800
Threat summary.

171
00:17:22,800 --> 00:17:46,100
Okay, post-Soviet Union, as freedoms sort of grow, they're moving toward a market economy and democratization and all that, we've seen a lot of, from the tennis players and all this, coming out of the Soviet Union, we also see a lot of good malicious code and a lot to be worried about potentially on your networks,

172
00:17:46,100 --> 00:17:49,000
particularly as it involves financial crimes.

173
00:17:49,000 --> 00:18:01,480
One of the things about the organized cybercrime is that it does inhibit that part of the market economy that will allow products to be legitimate, to be sold legitimately on the street.

174
00:18:02,140 --> 00:18:08,280
You can buy an office on the street for a couple of dollars, right, that's been cracked and sold.

175
00:18:08,360 --> 00:18:10,440
From one viewpoint, that's a good thing.

176
00:18:10,440 --> 00:18:13,740
From another, it sort of inhibits the market economy growth.

177
00:18:13,740 --> 00:18:20,100
The other thing is a lot of this money is recycled into more nefarious crimes, so you have to be aware of that as well.

178
00:18:20,460 --> 00:18:23,440
Okay, so we've established that Russia is a threat.

179
00:18:23,560 --> 00:18:31,140
Now, you sort of want to turn it on its head and say, okay, now they've got great math and science, great coders, etc., etc., we want to turn that into a resource.

180
00:18:31,140 --> 00:18:35,160
So, hacker sites, there's no end of them.

181
00:18:35,160 --> 00:18:46,680
You can find them very quickly, but I think for a lot of people, the language barrier would be the first thing that would inhibit you from trying to exploit this as a resource.

182
00:18:46,680 --> 00:18:50,100
Here's some sites where you can start looking at them.

183
00:18:50,100 --> 00:18:58,620
Here's one, maybe the Civil Hacker School, it's sort of the analogous to Zahacademie in France that is very well known and in the news.

184
00:18:58,620 --> 00:19:06,800
This site, you'll find everything in English as well as in Russian, so I don't need to help you with that really, but what we will look at is a Russian language site.

185
00:19:06,800 --> 00:19:15,020
So, here I took one with a lot of things that we can sort of dissect and pick apart, but again, it's all in Russian, so if you don't speak Russian, you're like, how am I going to do this?

186
00:19:15,060 --> 00:19:16,500
Well, I'll show you how in a second.

187
00:19:16,500 --> 00:19:28,300
But first of all, I'll just sort of look at the material on the site, and you'll find that it looks a whole lot like a site that your own language wants, you just translate the words.

188
00:19:28,960 --> 00:19:35,560
So, hacker, essentially, you'll find that the Russians have no problem sort of incorporating foreign words into their language.

189
00:19:35,560 --> 00:19:36,640
French hate that, right?

190
00:19:36,640 --> 00:19:40,800
They've outlawed the use of the word email in France, but no problem with that in Russian.

191
00:19:40,800 --> 00:19:42,580
So, hacker is a hacker.

192
00:19:42,880 --> 00:19:51,180
Vzlom is an attack, защита, defense, программирование, исходники, халява, soft, и проги.

193
00:19:51,180 --> 00:19:58,580
So, I won't take you any further in Russian, but so you can hear a little bit of it, and this is the motto of the site.

194
00:19:58,580 --> 00:20:00,620
And here's sort of how it breaks down.

195
00:20:00,940 --> 00:20:05,340
You've got training, a lot of downloads, and some hacker tools.

196
00:20:05,900 --> 00:20:22,740
And so, here's a place you could go, for instance, to find, and once you grab a software translation tool off the internet, you'll find that there might be a lot of stuff here that you could exploit in really just a few minutes that you may never have imagined you could have otherwise.

197
00:20:22,740 --> 00:20:26,140
So, just the top, here you see archive of articles, right?

198
00:20:26,140 --> 00:20:30,300
You can see commentary, how many times it's been read, when it was posted, etc.

199
00:20:30,300 --> 00:20:32,840
The top one, for instance, I'll just translate the top one.

200
00:20:32,840 --> 00:20:38,320
It says, essentially it means how to seize a lame IRC channel.

201
00:20:38,980 --> 00:20:43,760
So, it's been read 10 times, and you just click on it to download or email.

202
00:20:44,120 --> 00:20:55,800
Here's the downloads, and again, it goes into different categories, but in terms of exploits and articles and various tools like scanners.

203
00:20:55,800 --> 00:20:57,200
Here's the top 10 downloads.

204
00:20:57,200 --> 00:21:01,640
I kind of matched them against the insecure.org ones, and it wasn't a very good match.

205
00:21:01,640 --> 00:21:22,820
So, potentially, I don't know that a lot of the names haven't been necessarily changed, but what I'm suggesting here is you may find things here that you may not find in the normal repositories in which you look, and if you're a coder, of course, you might be able to also pick apart things.

206
00:21:22,820 --> 00:21:27,540
You might not be able to read the comments, but I'll show you how to do that.

207
00:21:27,540 --> 00:21:29,920
Here's the discussion forums on the site.

208
00:21:31,080 --> 00:21:33,540
And again, it's not that difficult, and I've done it.

209
00:21:33,540 --> 00:21:42,580
You're all used to having a couple of windows open on your desktop just to translate something in one of the online services and drop that in a chat window.

210
00:21:42,580 --> 00:21:46,080
It just takes a second, really, to go back and forth between the two.

211
00:21:46,080 --> 00:21:49,580
So, here's Hacker Tools, the three main ones on the site.

212
00:21:49,580 --> 00:21:52,340
So, the scanner email, DNS.

213
00:21:52,760 --> 00:21:54,000
So, I just asked it.

214
00:21:54,000 --> 00:21:58,700
I said, hey, why don't you scan the Kremlin for me and tell me what ports are open?

215
00:21:58,880 --> 00:22:10,600
So, it's the kind of thing where you could, again, you're using somebody's tool in their environment or in their milieu, which might be a good idea and offer you some benefits.

216
00:22:11,020 --> 00:22:13,120
So, it even has a word of the day.

217
00:22:13,120 --> 00:22:15,160
In this case, Big Brother is always watching.

218
00:22:15,160 --> 00:22:16,100
Don't forget.

219
00:22:16,580 --> 00:22:18,440
Here's two guys who maintain the site.

220
00:22:18,440 --> 00:22:20,440
You can email them with any questions.

221
00:22:20,780 --> 00:22:26,640
I guess they sure speak enough English to get by.

222
00:22:26,640 --> 00:22:28,900
Okay, now you're like, what am I going to do with all this?

223
00:22:28,940 --> 00:22:31,780
Anyway, so, very easy.

224
00:22:31,780 --> 00:22:38,600
Software translation is not too bad, especially if you know enough words in a particular discipline to get by.

225
00:22:38,700 --> 00:22:51,280
In your case, network security and hacking terminology, you're familiar with so many words that you could essentially look at a machine translation and get by a lot quicker than you think.

226
00:22:51,280 --> 00:22:57,680
So, natural language processing is, again, it's bringing in human languages into software.

227
00:22:57,680 --> 00:23:05,540
And machine translation, which is taking one language and translating it into another, it's much more sophisticated than word for word.

228
00:23:05,540 --> 00:23:08,200
Now, they incorporate a lot of grammatical rules.

229
00:23:08,200 --> 00:23:10,080
They've got idioms in there.

230
00:23:10,080 --> 00:23:23,500
And now they've got this really great feature, part of the development process, what they'll do, because they know that professional translators have already done so much of the work for them, what they'll do is they'll just feed it novels.

231
00:23:23,500 --> 00:23:28,000
I talked to one guy who works for a company, and they fed it like every Tom Clancy novel, right?

232
00:23:28,000 --> 00:23:29,940
They fed their big machine every Tom Clancy.

233
00:23:29,940 --> 00:23:42,940
And what it does is when you ask it to translate something from English to Russian or Russian to English, it already, you know how fat Tom Clancy novels are, it's got about 30 of them in there.

234
00:23:42,940 --> 00:23:44,240
It's got many more than that.

235
00:23:44,240 --> 00:23:49,220
It's actually got millions of, or thousands of books, millions of phrases.

236
00:23:49,220 --> 00:24:00,480
But it's already, what it's doing is it's taking a professionally translated translation and giving you essentially what a person did, who was trained in the discipline.

237
00:24:00,740 --> 00:24:09,280
So, you'll find professional translations on the web, and these are a help if you really want to study the language, and these can be pretty good.

238
00:24:09,280 --> 00:24:17,440
Just for the same reason you'll find War and Peace in every bookstore, you'll also find good articles about hacking, you'll find them as well in other languages.

239
00:24:17,440 --> 00:24:21,400
You know, whether you study Chinese or Arabic, these can be kind of cool to look at.

240
00:24:21,400 --> 00:24:25,940
There's a lot of free services, and these aren't too bad if you don't know about AltaVista.

241
00:24:25,940 --> 00:24:37,320
Just go to AltaVista and click on translation, and they've got a nice long list now, bidirectional of a lot of languages that you can go back and forth in for free.

242
00:24:37,320 --> 00:24:40,680
There's commercial translation that can get quite expensive.

243
00:24:40,940 --> 00:24:44,680
So, we'll just look at translation briefly, translation software.

244
00:24:44,680 --> 00:24:48,980
So, here's Smashing the Stack, which is, admittedly, is a very difficult text.

245
00:24:48,980 --> 00:24:58,500
And what I'm going to do is actually give it a very difficult assignment, is I'm asking this AltaVista, right, Babelfish, to go to Russian and then jump back to English.

246
00:24:58,500 --> 00:25:00,560
Never try this with Shakespeare.

247
00:25:00,560 --> 00:25:02,940
It comes out really, really bad.

248
00:25:02,940 --> 00:25:13,060
But with this, you'll find, especially if it's in a discipline, especially if it's something like the weather, especially if it's something that's relatively has a limited vocabulary, it's quite good.

249
00:25:13,060 --> 00:25:18,180
So, take Smashing the Stack into Russian and then back to English.

250
00:25:18,180 --> 00:25:21,720
So, you'll find it's to break the stack, you know, so that's not really great.

251
00:25:21,720 --> 00:25:25,360
You'll also find that C programming, there's no real C in Russian.

252
00:25:25,540 --> 00:25:28,220
So, C became che, right?

253
00:25:28,480 --> 00:25:34,780
When it comes back, since there's no match up, che, for whatever reason, it said, oh, it must be an H.

254
00:25:34,780 --> 00:25:36,420
So, then you wind up with H programming.

255
00:25:36,420 --> 00:25:37,640
That's not great either.

256
00:25:37,640 --> 00:25:47,220
But overall, I'm telling you, this just took a second to do and you can actually walk your way through it without too much of a problem.

257
00:25:48,500 --> 00:25:58,340
Rustified software, you'll find already, Windows actually is very friendly to Cyrillic now and it's actually quite good.

258
00:25:58,340 --> 00:26:05,720
You just do a left shift and alt and it'll take you back and forth between the two, just about any Windows tool that's out there.

259
00:26:05,720 --> 00:26:06,920
I'm not so sure.

260
00:26:06,920 --> 00:26:15,560
I was told that Mac is, that's not the case for Mac and I'd be surprised if Linux, but, you know, with Windows has it covered.

261
00:26:15,560 --> 00:26:27,600
Okay, now let's try to turn this into a bit of a method so that you can take it in different directions, because you might not be so interested in Russia, but you might be interested in some different topics in which I hope that this may help you.

262
00:26:27,600 --> 00:26:34,440
So, I had to think of some way to bring this together, so I noticed that Ts were one way I could possibly do that.

263
00:26:34,440 --> 00:26:44,940
So, just suggesting that you might want to know something about the country before you invade it, or before you take on its networks.

264
00:26:45,560 --> 00:26:56,780
You know, the more you know about history, culture, etc., language too, it's gonna help you enormously to understand where they're coming from and where you should be going as well.

265
00:26:56,780 --> 00:27:07,000
The terrain, how am I gonna talk about the telecoms and the internet infrastructure in the country, the techniques, you know, hacker groups and tools, that kind of thing.

266
00:27:07,000 --> 00:27:08,340
There's a lot of good resources for that.

267
00:27:08,340 --> 00:27:14,480
And the translation, essentially, I think that's really the key to sort of breaking the barrier here.

268
00:27:14,480 --> 00:27:16,720
Okay, Russia, I'll give you just 30 seconds.

269
00:27:16,780 --> 00:27:19,580
12th century, they kicked out the Mongols.

270
00:27:19,800 --> 00:27:22,180
17th century, they took Siberia.

271
00:27:22,180 --> 00:27:27,740
The communist revolution in 1917, you know, lasted 70 years.

272
00:27:27,740 --> 00:27:29,760
Now they've got kind of three things going on.

273
00:27:29,760 --> 00:27:38,600
They're trying to develop democracy, they're trying to develop their economy, and they're dealing with the war in Chechnya, which is a big deal.

274
00:27:39,440 --> 00:27:51,380
So they've got, they don't have 50 states, they've got 49 obelisks, they've got 21 republics, 10 okrugs, 6 krajs, 2 federal cities, and 1 Jewish autonomous republic.

275
00:27:51,380 --> 00:27:57,200
So it looks a lot different than the country you might be from.

276
00:27:57,400 --> 00:28:05,820
But again, the more you know, and you could just read a couple articles just to kind of get you in the mood to take on the Russians.

277
00:28:05,820 --> 00:28:13,100
Okay, the little thing, that's what you may be used to looking at when you open your atlas, in terms of geography of another country.

278
00:28:13,100 --> 00:28:17,900
But let's look at the big one, which I think is really, it's actually really quite interesting.

279
00:28:17,900 --> 00:28:21,680
Here is the three main fiber-optic lines in Russia.

280
00:28:21,880 --> 00:28:28,300
They're ATM-based, so they're heterogeneous, they've got video, voice, and data.

281
00:28:28,300 --> 00:28:29,620
And they run from St.

282
00:28:29,620 --> 00:28:45,380
Petersburg in the north, runs up into Scandinavia, down to the, you see the cross there, that's Moscow, goes down and toward the Middle East, and then out to the Far East.

283
00:28:45,380 --> 00:28:50,500
And these are the three main lines that data is going to travel across as it goes through Russia.

284
00:28:50,640 --> 00:28:58,120
It goes down to Novorossiysk, and then over here it goes to Khabarovsk, and then to Harbin in China.

285
00:28:58,620 --> 00:29:07,040
And again, here you'll see that in the middle, there's almost no color there, and that says it's almost completely undeveloped.

286
00:29:07,040 --> 00:29:13,740
And what you'll find as you go further into Siberia, there's many more reindeer than there are human beings.

287
00:29:14,020 --> 00:29:19,520
And so what you're going to find up there is satellite communications, and very few landlines.

288
00:29:19,660 --> 00:29:24,940
And part of the problem with Russia now is everybody is moving to Moscow and St.

289
00:29:24,940 --> 00:29:26,400
Petersburg with the market economy.

290
00:29:26,940 --> 00:29:29,880
Nobody's staying on the collective farms anymore.

291
00:29:29,880 --> 00:29:36,040
And they've got freedom, they've got freedom of movement, and they can move to the big city, and that's what everybody's doing.

292
00:29:36,580 --> 00:29:40,740
And so a lot of these outlying areas are in real trouble.

293
00:29:40,740 --> 00:29:43,660
Okay, Russian telecommunications.

294
00:29:43,660 --> 00:29:47,580
RU is the Russian digraph.

295
00:29:47,580 --> 00:29:54,640
SU, which several parties are fighting over still for some reason, but that belongs to the former Soviet Union.

296
00:29:54,640 --> 00:29:59,600
And then you can actually count the number of internet hosts and users and telephones.

297
00:29:59,600 --> 00:30:02,040
I talked about the trunk lines.

298
00:30:02,300 --> 00:30:18,300
But again, a little research will yield quite a lot in terms of the basics of the numbers of people, the numbers in order to get on the right connections and to get into a country.

299
00:30:18,300 --> 00:30:20,060
RUNET is an interesting concept.

300
00:30:20,060 --> 00:30:23,640
It's kind of like Chinanet or AOHEL, right?

301
00:30:23,640 --> 00:30:38,360
It is an intranet, like you might belong in your organization or your university, but it's essentially sort of a cocoon of sorts that's kind of generated by Russians and for Russians and is largely in Russia.

302
00:30:38,360 --> 00:30:45,820
And his guy interviewed, his network security guy, is not only for the smart people, but also largely for the stupid users.

303
00:30:45,880 --> 00:30:48,780
But it's essentially Russian cyberspace.

304
00:30:49,620 --> 00:31:01,840
Internet usage by country, here just quickly, Russia has a relatively small percentage of its population that may be online compared to, say, Scandinavia, but they got a lot more people.

305
00:31:01,840 --> 00:31:13,820
So what that means is actually you could potentially deal with three or four times the number of Russians as you could Scandinavians online, just by the sheer numbers, and so that's something you might forget.

306
00:31:13,820 --> 00:31:18,060
Again, more color to less color means more connections to less connections.

307
00:31:18,060 --> 00:31:19,920
Here's an interesting slide.

308
00:31:20,380 --> 00:31:25,580
You consider that some countries, you probably heard the phrase, all roads lead to Rome.

309
00:31:25,720 --> 00:31:33,200
Well, when I was in England, too, they assured me that even the smallest village has a street that is pointed directly toward London.

310
00:31:33,780 --> 00:31:41,220
So what I want you to see here is essentially the spoke pattern for probably most networks that you would encounter in Russia.

311
00:31:41,220 --> 00:31:44,700
If you want to get from point A to point B, you got to go through Moscow, essentially.

312
00:31:44,700 --> 00:31:55,740
And this is really good to know when you are crossing networks, so that you know if I want to go somewhere, potentially somebody could collect or see me along the way.

313
00:31:56,200 --> 00:31:59,040
Here's the most sophisticated map I could find.

314
00:31:59,040 --> 00:32:07,740
There you see the satellites out that are connecting the more remote parts of the country.

315
00:32:08,880 --> 00:32:15,980
I think I've covered most of the points I wanted to cover here already, so I'll move on.

316
00:32:16,380 --> 00:32:24,700
Now, you can rely on finding things like this on the internet, work that people have already done for you, or you could do it yourself.

317
00:32:24,700 --> 00:32:37,680
One way you could do that that's relatively painless is with traceroutes, and they tell you so much about networks and so much about connectivity issues that it's very worthwhile.

318
00:32:38,720 --> 00:32:49,440
Here is a way you could do it with a program like VisualRoute, but here's a way with traceroutes that you could do it on your own and then build a little map like this.

319
00:32:49,440 --> 00:33:04,340
And you can see, you know, dissecting the words in the resolution and just connecting the dots, essentially, and you can see where the important parts are.

320
00:33:04,340 --> 00:33:14,040
And you can see, for instance, so many things through traceroutes, like if you want to go from here to the Congo, you may have to go through Egypt or through South Africa, and really there's no other way to do it.

321
00:33:14,040 --> 00:33:17,280
And this is the kind of thing that will show you that.

322
00:33:17,360 --> 00:33:22,880
However, with Russia, you can actually build a nice little network map relatively quickly.

323
00:33:22,880 --> 00:33:37,140
Here's some major IP ranges to get you started if you don't already have them, but again, these are the big players in Russia, and they're in charge of the networks, and you'll find, you know, the Russian government and military and everybody will fall in there.

324
00:33:37,140 --> 00:33:59,940
And again, a lot of people are going to do work for you, like if you're interested in tracing spam or you're interested in finding the bad guys in certain contexts, here's some, especially with spam, people have done a lot of the work for you, and they will have lists already put together for China or Russia for IP ranges.

325
00:33:59,940 --> 00:34:13,380
Okay, I had a great class a few years ago on hacking, and what they said was the first place to start may not be entirely obvious to you, but you start with the homepage, right?

326
00:34:13,380 --> 00:34:27,580
So in this case, here's the Russian government portal, and you'd be surprised how much information is here if you dig down into it, but again, part of the problem for a Western user is the language barrier.

327
00:34:27,580 --> 00:34:36,000
Here is about the only page that you'll find with a direct word-for-word translation, and it is the president's page, not surprisingly.

328
00:34:36,560 --> 00:34:39,180
Here is a great site, the Russian cybercrime office.

329
00:34:39,180 --> 00:34:51,440
Again, it's only in Russian, but for some reason the title, so it's a big, there's a whole lot of pages extending out underneath it, but again, cybernetic police, everything below that is in Russian, but there's some great stuff here.

330
00:34:51,440 --> 00:35:04,720
Starting with the spider group, this is back in the mid-90s when Russia wanted to tackle internet crime, and it was still real, you know, it was a secret back then, they called it the spider group, but you can see some leftover vestiges of that here.

331
00:35:07,360 --> 00:35:24,560
Here's some things that fall underneath, and one of the things I want to highlight here is just that if you are in law enforcement, or you wanted to do any type of international investigation, whether it be official or unofficial, you can see here the actual what Russians consider illegal,

332
00:35:24,560 --> 00:35:28,180
and the definitions by which they might prosecute someone.

333
00:35:28,180 --> 00:35:31,780
So here, you know, you've got Carter, Freaker, and Hacker to start with.

334
00:35:31,780 --> 00:35:39,060
They have a site that has cybercrime statistics all the way back to 1982, and I really thought this was quite interesting.

335
00:35:39,060 --> 00:35:46,620
There's a lot to go through here, so I went back to 1982 and was reading, and there was only one case from that year, and they only called her Miss K.

336
00:35:46,620 --> 00:36:03,700
Well, Miss K was a programmer, and she was in an office that was involved in doling out the funds all over the Soviet Union, and what she did was she just went in there and changed, according to this, one number, and she would change it sometimes, and then she would change it back,

337
00:36:03,700 --> 00:36:04,640
and she would sort of flop.

338
00:36:04,640 --> 00:36:17,960
But essentially, what it was doing, it was the old salami technique, and it was slicing, every time she did that, slicing money off of an account and going in a direction where potentially she would gather it up later.

339
00:36:19,300 --> 00:36:27,180
Here's all the offices that had an official website on the cybercrime site, so there's 89 total.

340
00:36:27,180 --> 00:36:31,980
This was the number that actually had websites, so they were really quite cool to look through.

341
00:36:31,980 --> 00:36:40,720
They all had their logos, and a lot of them are called K because cyber would be cyber, so this is cyber police.

342
00:36:42,240 --> 00:36:43,980
This is an interesting story.

343
00:36:43,980 --> 00:36:47,740
I made this slide before I got an email from this guy.

344
00:36:47,740 --> 00:37:05,560
He is the top cyber cop in Russia, and so I read through his bio, and as you might expect, in Russia, he's very well accomplished in terms of academics, and they're really quite good at that in the Soviet Union, and so he appears very bright and really knows what he's doing.

345
00:37:05,560 --> 00:37:07,220
Well, I emailed that cybercrime site.

346
00:37:07,220 --> 00:37:15,180
I said, I'm going to write a presentation, and I want to know if you wanted to give me any word of advice and help me out in any way.

347
00:37:15,180 --> 00:37:21,380
Well, he emails me back, the same guy, and we had a nice little dialogue, and he answered all my questions.

348
00:37:21,380 --> 00:37:24,440
He was really quite friendly, and he seemed like a good guy.

349
00:37:24,440 --> 00:37:26,800
So in here, I'll just highlight some of the things.

350
00:37:26,800 --> 00:37:40,920
He says one of the main things from his perspective is he just wants to make sure we're all on the same page, not surprisingly, in that for international investigation, you're talking about log file formats, you're talking about contact information and all this.

351
00:37:40,920 --> 00:37:49,800
He says that most of his 89 offices actually do get complaints from overseas every day, the majority of them.

352
00:37:49,800 --> 00:37:54,560
At the bottom, he says, well, we're doing our best.

353
00:37:54,560 --> 00:37:59,140
We're actually meeting more and more often with foreign counterparts, especially the FBI.

354
00:38:00,400 --> 00:38:06,000
Now here's some questions that I just put together, and again, I put a lot more together than this, but this is just kind of a start.

355
00:38:06,000 --> 00:38:25,240
I was thinking if we could develop 100, 200, the most important terminology, the most important questions to be asked for international investigations, even if you're just a system administrator or you're the kind of guy who reads through your log files just for fun from your firewall at home,

356
00:38:25,240 --> 00:38:28,460
the kind of things that would be able to take you across borders.

357
00:38:28,460 --> 00:38:36,280
I don't see any reason why we couldn't develop several hundred of these and get them professionally translated and be able to move more quickly across borders.

358
00:38:36,280 --> 00:38:39,740
So here's just some things that I had put together in that regard.

359
00:38:39,740 --> 00:38:53,180
Here's one word to get you started in case you're, I don't know, I've only studied a couple of languages here, but again, you will find a lot of hacker stuff just about in any language on the web.

360
00:38:53,180 --> 00:39:06,560
And the thing is, whether or not you've done this before, it works, and you slap yourself, you've never done it, but if you know, for instance, the word for hacker in Russian or Chinese, just take that and drop it in Google and see what comes up.

361
00:39:06,560 --> 00:39:10,040
I mean, Google knows exactly what you're talking about, right?

362
00:39:10,860 --> 00:39:21,960
So you can take those and you can drop them in foreign newspapers, you can drop them in sites like the spam sites that I showed you in English, they've got the same thing in foreign countries.

363
00:39:21,960 --> 00:39:29,640
And I'll just end this section with Kaspersky, according to Russian hackers, the most hated man in the country.

364
00:39:29,800 --> 00:39:34,320
But this is a real interesting guy, and he just made his entry into the US market.

365
00:39:34,320 --> 00:39:37,100
I'm not sure if you've heard of Kaspersky Labs or not.

366
00:39:37,100 --> 00:39:46,140
But they just incorporated the United States, and in February, they have big plans to move outside Russia.

367
00:39:46,140 --> 00:39:56,200
One of the interesting things about Kaspersky is that the Kaspersky Labs are, according to technical people who look at their products, really very, very good.

368
00:39:56,200 --> 00:39:58,320
Their products worked very well.

369
00:39:58,320 --> 00:40:04,000
They seem to know exactly what they're doing in terms of writing antivirus signatures that work and that are beneficial.

370
00:40:04,940 --> 00:40:16,880
So one of the interesting questions then, especially guys from America's perspective, especially with sort of the legacy of the Cold War and all that, is whether we'll have any inhibition about buying Russian products and putting them in our networks,

371
00:40:16,880 --> 00:40:19,640
especially if they're government in nature.

372
00:40:20,680 --> 00:40:30,000
Okay, I'll finish just talking about the international political scene, and there's some real interesting, juicy things going on to think about.

373
00:40:30,000 --> 00:40:33,440
There's no end to the number of sites that you could start with.

374
00:40:33,440 --> 00:40:43,720
Here are just the UK sites that I found, where if you had anything that fell under these categories, it'd give you a place to start in the United Kingdom.

375
00:40:43,720 --> 00:40:51,600
But in general, international law is real ill-suited to deal with the Internet, and it's just starting to catch up.

376
00:40:51,600 --> 00:40:59,900
I mean, the Internet is borderless, and you can't even hope to sort of interview all the people who cross your borders every day, much less look at all the data packets.

377
00:41:00,680 --> 00:41:03,220
Again, we all know what the I-love-you virus and all that.

378
00:41:03,220 --> 00:41:08,440
In certain countries, they haven't even thought of instituting cybercrimes, and so how are you going to prosecute somebody?

379
00:41:09,980 --> 00:41:11,740
Nobody likes to extradite criminals.

380
00:41:11,740 --> 00:41:14,400
Nobody likes to give up any part of their national sovereignty.

381
00:41:14,400 --> 00:41:17,600
These are all real important issues, and they're all for good reasons.

382
00:41:17,600 --> 00:41:31,880
If you gave up part of your national sovereignty to a foreign country, you're worried about all kinds of things, from the abuse of data to espionage to collecting on your citizens without their consent in a different culture, looking at your political culture,

383
00:41:31,880 --> 00:41:33,140
and all of that.

384
00:41:33,400 --> 00:41:39,860
So what you have is Microsoft and Valve looking at other solutions in order to track down criminals.

385
00:41:39,860 --> 00:41:43,160
Evidently, somebody has taken a Microsoft bounty.

386
00:41:43,260 --> 00:41:46,920
They're not going to publish it, but that's what it appears has taken place.

387
00:41:46,920 --> 00:41:51,700
In the case of Valve, they actually tapped their fan base and they said, can you help us here?

388
00:41:51,700 --> 00:41:56,720
Somebody stole parts of Half-Life 2, and it worked.

389
00:41:57,420 --> 00:42:00,640
So extraterritoriality is a big issue.

390
00:42:01,460 --> 00:42:05,460
In here, I'm primarily going to talk about remote search and seizure.

391
00:42:05,460 --> 00:42:07,580
So we'll talk about the FBI sting.

392
00:42:07,580 --> 00:42:12,080
So the FBI in the year 2000, they saw all this activity coming from Russia.

393
00:42:12,080 --> 00:42:19,040
They weren't getting the help that they wanted from the Russians, and so they said, well, we're going to do our own research and we're going to do this.

394
00:42:19,040 --> 00:42:21,420
And so what they did was they had a couple of suspects.

395
00:42:21,820 --> 00:42:30,900
They went to Russian sites, they pulled down their resumes, and they invited them to Seattle to a fake company for an interview.

396
00:42:30,900 --> 00:42:32,280
And they came.

397
00:42:32,520 --> 00:42:38,980
And it's kind of a sad story in part because they were actually quite excited about getting out of the biz and going legit.

398
00:42:38,980 --> 00:42:47,440
And they went to Seattle, and of course, the FBI guys, they said, why don't you download some stuff to prove your skills to us?

399
00:42:47,440 --> 00:42:55,460
And of course, as soon as they did, they had their logon, username, and password, and they had all this evidence with which to prosecute them.

400
00:42:55,460 --> 00:43:09,540
So remote search and seizure, it's a great topic to debate because whether or not, in this case, the Russians went over there without the consent of the Russians.

401
00:43:09,540 --> 00:43:18,520
So what the Russians did was they sued us back, and they said, you illegally came on our networks, and it was a mess.

402
00:43:18,520 --> 00:43:23,480
The thing is, if you're not getting cooperation from a foreign government, what do you do?

403
00:43:23,480 --> 00:43:25,360
You're kind of between a rock and a hard place.

404
00:43:25,360 --> 00:43:42,080
Is it closer to, do you think, actually sending your law enforcement over there and invading the country, or is it closer to, say, doing open source collection from newspapers or taking satellite pictures, all of which are commonly available and are not really considered espionage?

405
00:43:42,080 --> 00:43:50,200
One of the main things we've got going right now is the European Cybercrime Convention, but a lot of the things I just mentioned are the big issues.

406
00:43:50,200 --> 00:44:09,760
Essentially, people are worried about these national sovereignty issues, and so all we've really got on the table is closer point-of-contact issues, and so that's really all the national governments, I promise you, are going to allow.

407
00:44:09,760 --> 00:44:17,300
There is no way that a national government is going to allow another one to come in and ransack its networks looking for evidence.

408
00:44:17,420 --> 00:44:23,280
So it's about getting on the same page, it's about having the same log file formats and good points of contact.

409
00:44:23,280 --> 00:44:25,780
That's really all that's on the table.

410
00:44:25,780 --> 00:44:28,460
And I'll just leave you with a short story.

411
00:44:28,580 --> 00:44:42,660
Recently in the UK, they wanted to find some malicious guys in China, and so they were calling over there, these UK guys trying to find somebody to talk to about it, and they had extreme difficulty.

412
00:44:42,660 --> 00:44:54,740
They finally found the PRC cert, and they said whether or not this is the case, this is at least exactly how it seemed to them in the UK, they could only find one person to talk to, and that guy only spoke Chinese.

413
00:44:54,740 --> 00:45:05,600
So to make a long story short, they eventually found somebody who spoke Chinese in the UK, and they told this guy that this particular website was causing them problems, and they said it came down in a heartbeat.

414
00:45:05,880 --> 00:45:17,860
But that sort of story highlights the difficulties with which you'll find in crossing international borders in any of this business.

415
00:45:17,880 --> 00:45:20,720
So thank you very much for the talk, I really appreciate it.

416
00:45:20,720 --> 00:45:28,210
If you have any questions, feel free just to raise your hand.

417
00:45:32,350 --> 00:45:34,710
The mob, okay.

418
00:45:36,140 --> 00:45:38,700
Yeah, I tried to find... I'm sorry?

419
00:45:40,120 --> 00:45:57,240
Yeah, I tried to talk about organized crime in the sense of either the Russian bride scams, or the credit card information, the PayPal, the eBay scams, there's so many things to look at.

420
00:45:58,600 --> 00:46:04,520
The online extortion against the gambling rings in the UK.

421
00:46:04,760 --> 00:46:08,180
You know, I tried to bring up a wide variety of things, but really there's almost no end to it.

422
00:46:08,180 --> 00:46:11,260
You have to use your imagination, just like malicious code, right?

423
00:46:11,260 --> 00:46:15,320
I mean, you can do almost anything you can dream up, essentially.

424
00:46:15,320 --> 00:46:19,220
But yeah, it's a big problem in Russia, organized crime.

425
00:46:19,220 --> 00:46:20,540
And they know what they're doing.

426
00:46:20,540 --> 00:46:31,920
And I just read an article from last week, and this Russian law enforcement official just said that it is so hard for them to trace cybercrime back in Russia because they're just using great techniques.

427
00:46:31,920 --> 00:46:39,860
He said they have a three rule in which they use at least three hops to anonymize their contact on the internet.

428
00:46:39,860 --> 00:46:42,420
So he said, you know, they never go below three.

429
00:46:42,420 --> 00:46:50,640
And he said, two maybe is doable, but three, he said, makes it virtually impossible to ID somebody on the internet.

430
00:46:50,640 --> 00:46:53,940
So part of the problem with Russia is very good.

431
00:46:53,940 --> 00:47:10,320
And one of the things I didn't say is that Kaspersky, in an interview recently, he said, you know, five or ten years ago, and this is maybe of interest to the crowd here, hackers in Russia were largely the healthy kind, he said, but it is just moving so rapidly,

432
00:47:10,320 --> 00:47:17,620
he said it's gone from below 50% now to over 90% of malicious code is written by and for criminals.

433
00:47:18,200 --> 00:47:30,800
So he just said that's one thing that has taken place in the past five or ten years for malicious code in Russia is that the criminalization of the internet, you know, regards malicious code.

434
00:47:31,780 --> 00:47:32,980
Yeah.

435
00:47:51,480 --> 00:47:58,260
I don't know, to be honest with you, but I do know what she asked about money laundering.

436
00:47:58,260 --> 00:47:59,460
And right.

437
00:47:59,820 --> 00:48:01,760
They're using euros.

438
00:48:15,420 --> 00:48:17,620
Yeah, it's a big problem.

439
00:48:17,620 --> 00:48:30,820
One of the things with the internet is they get the right logon information for, say, a PayPal account, and it's real tough to... they have a legitimate transaction.

440
00:48:30,820 --> 00:48:34,520
In other words, they've got two legitimate accounts.

441
00:48:34,520 --> 00:48:38,640
They transfer money, you know, from a legitimate account to a legitimate account.

442
00:48:38,640 --> 00:48:42,580
By the time law enforcement gets around to doing something about it, they're gone.

443
00:48:42,580 --> 00:48:48,400
They're gone, and that money has been transferred to places which are safe for the criminals.

444
00:48:48,760 --> 00:48:50,240
So it's a big problem.

445
00:48:52,700 --> 00:48:54,280
Okay, one more question.

446
00:49:05,320 --> 00:49:08,220
Yeah, let's...

447
00:49:08,220 --> 00:49:14,780
He said, are there any good software... he uses translate.ru a fair bit, and I do as well.

448
00:49:16,360 --> 00:49:17,440
Standalone.

449
00:49:17,540 --> 00:49:19,920
Commercial translation software.

450
00:49:20,360 --> 00:49:22,080
You can look through the links.

451
00:49:22,080 --> 00:49:27,700
There are a number... I noticed there are a number that are under $100.

452
00:49:28,000 --> 00:49:40,860
Language Weaver is pretty expensive, but it uses specifically that technique I talk about, and it feeds it literally hundreds of newspapers, articles, and novels to do...

453
00:49:40,860 --> 00:49:44,360
Essentially, it is giving you a professionally translated version.

454
00:49:44,360 --> 00:49:46,000
It can be choppy at times.

455
00:49:46,000 --> 00:49:51,740
It's very expensive, but Language Weaver is one that is highly regarded.

456
00:49:51,740 --> 00:49:53,140
It's won a lot of prizes.

457
00:49:55,500 --> 00:50:05,940
Well, I mean, they claim that I think with Arabic, Chinese, and French, they're already really good, and I think they've included a whole lot of stuff.

458
00:50:05,940 --> 00:50:07,840
Russian is coming out this year.

459
00:50:07,840 --> 00:50:09,160
It's not out yet.

460
00:50:10,740 --> 00:50:11,860
So, thanks a lot.

461
00:50:11,860 --> 00:50:13,600
I really appreciate it, but that's it.