start	end	text
8220	17220	And then the other thing is trying to encourage you to do this type of research as you investigate what's going on on your own networks.
17460	28060	So a brief outline, a threat, and we'll look at sort of turning the threat on its head and using it as a resource once you've identified a threat.
28060	37340	And then talk about building a method to do this with vis-a-vis China, maybe the Middle East.
37360	45600	So you can take it in different directions. And then we'll talk about the law and where international law stands on the subject.
45800	57980	So with Russia, very strong in math and science. They have a history in the Cold War of looking at America through a certain lens and taking our products apart no matter what they may be.
57980	63180	If you talk to Russians, they have a healthy culture of reverse engineering in general.
63180	72120	They've assured me that when you're growing up in a Russian household and your lamp breaks or your toilet doesn't flush, you don't just pick up the phone and call somebody.
72120	79840	You try to figure out how to fix it yourself first. And so this lends to a hacker culture that is strong.
80440	86260	The other thing is the economy may not be quite where it needs to be. This is also true in a country like Egypt.
86260	93060	It has a great university system, good education, but just not nearly enough jobs to fill the graduates that come out.
93060	97820	And so they may move into other areas of the economy.
98560	106100	So if you just look, this is a brief slide. We think Windows is expensive and we think Microsoft Office is expensive.
106100	115160	But if it cost you your a month's salary, you can kind of imagine your willingness to pay for it at that point. Probably not too likely.
115780	119300	Cybercrime. There's a long history of cybercrime from Russia.
119400	130040	Vladimir Levin in the mid-1990s manipulated Citibank's cash management system over 40 times, taking $10 million out of it.
130040	136260	So it's one of the few cases, though, of a successful bilateral joint law enforcement operation.
136760	143200	And what happened was they got most of that money back, but they never did figure out how he did it, how he got in to begin with.
143200	147080	The Microsoft source code hack again went back to St. Petersburg.
147080	151140	This guy named Joe Lopez in Florida recently, very interesting case.
151140	156120	What happened with him? Core flood virus. So he's got a Trojan on his system.
156280	165200	Somebody logs in from a couple of former Soviet Union states and they take about $90,000 out of his account, ship it back to Latvia.
165200	173200	Now the problem with Joe Lopez was that they had his legitimate login and password and he didn't have that much of a case.
173200	178360	Bank of America told him, they said, look, it's not our fault. It's your computer that was hacked.
178360	181580	Somebody logged in with your password and moved the money.
181980	189440	So he turned around and said, look, I don't know anybody in the former Soviet Union and you should know that malicious code is out there
189440	197360	and you should know that large transfers to suspect countries, you should alert the client.
197360	204220	In any case, it's a sticky situation because it's his box that was hacked and not the bank's.
204220	211300	This guy, you may or may not remember, he spoke four years ago in Apollo over here.
211300	215280	And I saw his presentation just before he was arrested by the FBI.
215280	228120	And essentially he was for $99 offering you a program that would remove all copyright, all copy, paste, edit, read restrictions on e-book, Adobe product.
228340	231620	And so he was working for a Chicago firm at the time.
231620	237800	And this got really messy because the EFF got involved and nobody wanted the bad PR, at least of all Adobe,
237800	250580	or the United States government whose law enforcement agencies also employed Elcomsoft, which was the company that hired Dimitri and made the product.
250760	256860	So with a lot of these cases, again, it's just a few fish in the sea that get arrested, but usually not too much happens with them.
257380	263520	What I want to suggest here is if you have a true zero-day exploit, you can turn that into cash.
263520	266100	And this is what the Russians are doing now.
266780	271120	They've got a great sort of bag of tricks.
271120	280260	And what they're doing through Internet worms like Bagel and MyDoom, they're compromising your systems.
280260	284900	And what they're doing is just lifting off the financial information.
284900	288080	So related to PayPal, related to eBay.
288240	290800	It's usually not for distributed denial of service.
290800	293220	It's usually not for spam, although it can be.
293220	296080	But what they want is your personal financial information.
296100	302180	And they take advantage of an exploit to increase revenue.
302480	304120	So millions of credit cards.
304120	311740	Last year in England, where there is money, you will see a lot of interesting activity.
311740	317740	So with international gambling, if they're offline for a couple hours, that's a whole lot of money that they're going to be losing.
317740	329280	So with the distributed denial of service attacks versus the international gambling, they typically would hit them with maybe a sin flood.
329320	337000	Followed by a letter which said, look, we can take you offline if you don't pay us, say, $50,000 a week, which is not much for international gambling.
337000	348980	By the way, the Sands Institute estimates that about 7,000 companies at any given time are paying extortion money to some online attacker.
348980	352600	But in this case, again, there were some arrests made.
352680	358320	And one success story from last year.
358320	362640	Here is a case which is really very important for a couple reasons.
362640	374540	One, it was so severe that Microsoft changed its normal patch schedule, which was pretty rigid, and they were willing to come out with patches around their normal schedule.
374540	388240	Two, the U.S. CERT advised at least the folks who work in the Washington, D.C. Beltway area in the United States government to not use IE, to use something else, or at the very least disable JavaScript.
388240	413500	But what happens here, again, with the Internet worms out there likely compromising Microsoft IIS, then taking advantage of holes in IE to redirect you invisibly to this IP address in China that would download a key logger onto your system and basically pull off financial information, credit card and PayPal and eBay and the like.
413500	423880	So Russian malware really falls under every kind of category, you know, from backdoor to downloader to spam tool.
424060	431660	So they fall into every category. Social engineering, okay, there's a social engineering aspect in any good attack.
431660	438880	And with Russians, they've got a very powerful one. And a lot of people are looking for girlfriends, they're looking for love, right?
438880	449460	And so Russians taking advantage of this, I'll just tell you a couple of stories, there's a Canadian guy who had his Russian girlfriend and was sending her a lot of money.
449460	454600	And it was the way it transpired, it made it very easy for this man, okay?
454600	468860	He had a virtual girlfriend, Althea Matveeva, I think, so he could go into a virtual store and buy her virtual gifts and get email back from her thanking for all this great attention.
468880	476740	The problem was there was no store, there was no gifts, and there was no girlfriend. It was just a couple in Russia that had this scam going.
476740	483160	They made about $300,000 on it, and of course they would write emails all day long saying, I love you, thank you very much.
485680	497480	So there was another case in which an Australian man wrote to Vladimir Putin directly, and he said, look, I've been looking for my girlfriend, even went to Russia, couldn't find her, can you help me?
497480	505880	There was an arrest made in that case as well. But it's a big problem, because it's playing on some of the basic human needs, right?
505880	516560	But the U.S. Embassy in Moscow gets about 10 calls a day complaining of somebody not being able to find their online girlfriend.
518340	526460	So criminal communication can start in public web forums. I'll show you one here, and then we'll jump back.
527060	540200	So there's public spaces in which if you own proxies or you're a money launderer, that kind of thing, you can put teasers out there in public web forums.
540200	548380	So then you can contact somebody, and then they become closed, and you need registration, and you need recommendations, and that kind of thing.
548600	564400	And the real communication then is usually, it's the word I'm looking for, not proprietary, but homegrown code, or something that makes it very hard to trace at that point.
564400	580680	However, here's one example, and here's some sites you could check out. But again, you want to announce your service and eventually make your nickname known through the delivery of goods and services through these sites.
580860	592980	And you might get paid through WebMoney. We're very familiar with PayPal in this country, but in this case, WebMoney is a service that was started in Russia.
592980	602940	And I talked to a couple of Russian guys about this, and they talked about how as soon as you get on, you want to get on a good site, right?
603900	615520	That's legit, essentially. But the administrators at that site will check out your goods and services fairly quickly and decide whether they want to keep you on or banish you forever.
615520	633160	Where's seen? Drink or Die is a really big group. They started in Russia in 93, moved all over the world. There was one of the biggest international operations law enforcement revolved around Drink or Die. It was called Operation Buccaneer.
633160	645680	It was a guy, a bandito, was in Australia. The saint was in Arizona, not too far from here. And this guy's server had tens of thousands. It was so large, it was named the God Complex.
646500	659740	And these guys were arrested. But again, a very sophisticated group. They specialize in application software, tens of thousands of cracks, and very good at what they do.
659740	672400	And typically the members only know each other's nicknames, and it's very strictly compartmentalized, the organization, and very difficult to... it's kind of like an al-Qaeda cell, right?
672400	680060	You take out one and you don't really know. They're not necessarily going to know the other two guys on either side of them in the cell.
680400	692860	A little bit different topic, hacktivism. When the United States joined the conflict in the Balkans and started bombing Serbia, again, national emotions run very high.
692860	704320	And you'll find that a lot of activity that takes place in cyberspace, particularly involved defacement and denial of service attacks, mirrors what's going on in the real world.
704320	719040	You see this with the EP3 that was downed, our EP3 in China. There was a whole lot of hacker activity and sort of the aborted US-Chinese hacker war that took place during that time frame, or almost took place.
719040	732840	In the Middle East, you'll see when there's a suicide bombing or when there is an assassination of a Palestinian leader by the Israelis, you'll see a whole lot of web defacements and denial of service activity going on.
732840	748280	In this case, Russians are very upset about our stance because they're very close to the Serbians. So there was a lot of activity against UK and US sites. We claim there was no impact and the UK admitted to having lost some military databases.
748280	765400	Espionage is a bit more serious. Here's the current alphabet soup for the Russians. The KGB is the old institution. SVR would equate to CIA, FSB, FBI, and FABSI NSA.
766180	791580	Just point to the case of Robert Hansen, really, because this is already not new news, but this is the kind of spy that if you are responsible for protecting a network or protecting any type of national secret, you want to consider that spies are going to be moving in a vastly different direction than you might be familiar with in the movies.
791580	814920	I know James Bond used to turn one page over at a time and photocopy it. Well now, of course, you can stick a USB drive in and take literally every document your entire agency is working on out of the office with you. So it's a big problem. Robert Hansen, 20 years ago, was already sending encrypted bulletin board messages. He hacked into the account of his superior.
814920	837080	He was working all the databases at FBI, and there was no real limitations on what he could do. Searching for his own name, searching on dead drops, searching on Russians, and see if there was any connection that somebody may have suspected him. So about 15 years, he literally gave away just about every important secret to the Russians that you might think of.
837080	859700	He was ideally placed. He was the chief of Russian counterintelligence at FBI, which gave him access to just about everything. But very computer savvy, so kind of the spy potentially of the future. Information warfare, you might be familiar with the revolution in military affairs. Essentially, that is electronic command and control.
859700	889680	So it looks a lot more like the video game you're playing, right? Planes in the future are going to be a lot more pilotless planes. 90% of the avionics, electronics, and protection mechanisms and all that into a fighter jet are for the pilot. It's crazy now, and people are realizing that. It's sort of an outdated and romantic notion of the Air Force. In the future, it's going to be pilotless, I promise you.
890100	915640	Revolutionary military affairs, essentially what that means is everything is going to be cyber and network and database centric. The great goal of the thinkers is, you know, you want a digital Pearl Harbor. If you're going to go to war with another nation state, you would like to be able to win it without taking any casualties. You'd like to be able to turn off the lights. And, you know, when somebody pulls a trigger, nothing happens. That's the goal here.
915640	941440	I mentioned electronic Russia. That is just a project that the FSB is getting underway in order to get the word out to citizens and to the agencies and corporations to start thinking in terms of better computer network defense. And just for the record, they're getting very little money and attention on this, and it's really worrisome to the Russian employees who actually are involved in this project.
941440	964100	Okay, cyber war in practice. This is interesting because it's actually something tangible that we can point to. The war in Chechnya, southern Russia, really ugly. As it started, the Russians disallowed any media involvement, and that turned out to be really bad PR for them.
964100	984800	Because essentially the Chechens came in and they showed all the media types exactly the story they wanted them to see. So the word getting out to the international media was not at all what the Russians wanted. They only showed them Chechen dead bodies. So the Russians learned after that, but it did take a turn in a different direction.
984800	1011000	As the war moved into the 90s, Russia went on the offensive in cyberspace. And I'll just point to one particular incident to highlight the change. If you might remember, there was in Moscow the hostages that took over the theater. Well, that lasted for a number of days, and at the end, Russian commandos stormed the theater.
1011000	1029500	Right when that happened, several Chechen websites went off the air. So you can only assume from that that it was a coordinated campaign by the Russians on multiple fronts. For the record, one of the servers was located in the United States.
1029500	1042080	So you can assume that the Russians took down a US-based website for what that's worth.
1042080	1069000	Threat summary. Okay, post-Soviet Union, as freedoms sort of grow, they're moving toward a market economy and democratization and all that, we've seen a lot of, from the tennis players and all this, coming out of the Soviet Union, we also see a lot of good malicious code and a lot to be worried about potentially on your networks, particularly as it involves financial crimes.
1069000	1093740	One of the things about the organized cybercrime is that it does inhibit that part of the market economy that will allow products to be legitimate, to be sold legitimately on the street. You can buy an office on the street for a couple of dollars, right, that's been cracked and sold. From one viewpoint, that's a good thing. From another, it sort of inhibits the market economy growth.
1093740	1111140	The other thing is a lot of this money is recycled into more nefarious crimes, so you have to be aware of that as well. Okay, so we've established that Russia is a threat. Now, you sort of want to turn it on its head and say, okay, now they've got great math and science, great coders, etc., etc., we want to turn that into a resource.
1111140	1138620	So, hacker sites, there's no end of them. You can find them very quickly, but I think for a lot of people, the language barrier would be the first thing that would inhibit you from trying to exploit this as a resource. Here's some sites where you can start looking at them. Here's one, maybe the Civil Hacker School, it's sort of the analogous to Zahacademie in France that is very well known and in the news.
1138620	1156500	This site, you'll find everything in English as well as in Russian, so I don't need to help you with that really, but what we will look at is a Russian language site. So, here I took one with a lot of things that we can sort of dissect and pick apart, but again, it's all in Russian, so if you don't speak Russian, you're like, how am I going to do this? Well, I'll show you how in a second.
1156500	1180800	But first of all, I'll just sort of look at the material on the site, and you'll find that it looks a whole lot like a site that your own language wants, you just translate the words. So, hacker, essentially, you'll find that the Russians have no problem sort of incorporating foreign words into their language. French hate that, right? They've outlawed the use of the word email in France, but no problem with that in Russian.
1180800	1198580	So, hacker is a hacker. Vzlom is an attack, защита, defense, программирование, исходники, халява, soft, и проги. So, I won't take you any further in Russian, but so you can hear a little bit of it, and this is the motto of the site.
1198580	1222740	And here's sort of how it breaks down. You've got training, a lot of downloads, and some hacker tools. And so, here's a place you could go, for instance, to find, and once you grab a software translation tool off the internet, you'll find that there might be a lot of stuff here that you could exploit in really just a few minutes that you may never have imagined you could have otherwise.
1222740	1238320	So, just the top, here you see archive of articles, right? You can see commentary, how many times it's been read, when it was posted, etc. The top one, for instance, I'll just translate the top one. It says, essentially it means how to seize a lame IRC channel.
1238980	1255800	So, it's been read 10 times, and you just click on it to download or email. Here's the downloads, and again, it goes into different categories, but in terms of exploits and articles and various tools like scanners.
1255800	1282820	Here's the top 10 downloads. I kind of matched them against the insecure.org ones, and it wasn't a very good match. So, potentially, I don't know that a lot of the names haven't been necessarily changed, but what I'm suggesting here is you may find things here that you may not find in the normal repositories in which you look, and if you're a coder, of course, you might be able to also pick apart things.
1282820	1306080	You might not be able to read the comments, but I'll show you how to do that. Here's the discussion forums on the site. And again, it's not that difficult, and I've done it. You're all used to having a couple of windows open on your desktop just to translate something in one of the online services and drop that in a chat window. It just takes a second, really, to go back and forth between the two.
1306080	1330600	So, here's Hacker Tools, the three main ones on the site. So, the scanner email, DNS. So, I just asked it. I said, hey, why don't you scan the Kremlin for me and tell me what ports are open? So, it's the kind of thing where you could, again, you're using somebody's tool in their environment or in their milieu, which might be a good idea and offer you some benefits.
1331020	1346640	So, it even has a word of the day. In this case, Big Brother is always watching. Don't forget. Here's two guys who maintain the site. You can email them with any questions. I guess they sure speak enough English to get by.
1346640	1371280	Okay, now you're like, what am I going to do with all this? Anyway, so, very easy. Software translation is not too bad, especially if you know enough words in a particular discipline to get by. In your case, network security and hacking terminology, you're familiar with so many words that you could essentially look at a machine translation and get by a lot quicker than you think.
1371280	1390080	So, natural language processing is, again, it's bringing in human languages into software. And machine translation, which is taking one language and translating it into another, it's much more sophisticated than word for word. Now, they incorporate a lot of grammatical rules. They've got idioms in there.
1390080	1409940	And now they've got this really great feature, part of the development process, what they'll do, because they know that professional translators have already done so much of the work for them, what they'll do is they'll just feed it novels. I talked to one guy who works for a company, and they fed it like every Tom Clancy novel, right? They fed their big machine every Tom Clancy.
1409940	1429220	And what it does is when you ask it to translate something from English to Russian or Russian to English, it already, you know how fat Tom Clancy novels are, it's got about 30 of them in there. It's got many more than that. It's actually got millions of, or thousands of books, millions of phrases.
1429220	1457440	But it's already, what it's doing is it's taking a professionally translated translation and giving you essentially what a person did, who was trained in the discipline. So, you'll find professional translations on the web, and these are a help if you really want to study the language, and these can be pretty good. Just for the same reason you'll find War and Peace in every bookstore, you'll also find good articles about hacking, you'll find them as well in other languages.
1457440	1477320	You know, whether you study Chinese or Arabic, these can be kind of cool to look at. There's a lot of free services, and these aren't too bad if you don't know about AltaVista. Just go to AltaVista and click on translation, and they've got a nice long list now, bidirectional of a lot of languages that you can go back and forth in for free.
1477320	1498500	There's commercial translation that can get quite expensive. So, we'll just look at translation briefly, translation software. So, here's Smashing the Stack, which is, admittedly, is a very difficult text. And what I'm going to do is actually give it a very difficult assignment, is I'm asking this AltaVista, right, Babelfish, to go to Russian and then jump back to English.
1498500	1521720	Never try this with Shakespeare. It comes out really, really bad. But with this, you'll find, especially if it's in a discipline, especially if it's something like the weather, especially if it's something that's relatively has a limited vocabulary, it's quite good. So, take Smashing the Stack into Russian and then back to English. So, you'll find it's to break the stack, you know, so that's not really great.
1521720	1547220	You'll also find that C programming, there's no real C in Russian. So, C became che, right? When it comes back, since there's no match up, che, for whatever reason, it said, oh, it must be an H. So, then you wind up with H programming. That's not great either. But overall, I'm telling you, this just took a second to do and you can actually walk your way through it without too much of a problem.
1548500	1575560	Rustified software, you'll find already, Windows actually is very friendly to Cyrillic now and it's actually quite good. You just do a left shift and alt and it'll take you back and forth between the two, just about any Windows tool that's out there. I'm not so sure. I was told that Mac is, that's not the case for Mac and I'd be surprised if Linux, but, you know, with Windows has it covered.
1575560	1587600	Okay, now let's try to turn this into a bit of a method so that you can take it in different directions, because you might not be so interested in Russia, but you might be interested in some different topics in which I hope that this may help you.
1587600	1604940	So, I had to think of some way to bring this together, so I noticed that Ts were one way I could possibly do that. So, just suggesting that you might want to know something about the country before you invade it, or before you take on its networks.
1605560	1616780	You know, the more you know about history, culture, etc., language too, it's gonna help you enormously to understand where they're coming from and where you should be going as well.
1616780	1628340	The terrain, how am I gonna talk about the telecoms and the internet infrastructure in the country, the techniques, you know, hacker groups and tools, that kind of thing. There's a lot of good resources for that.
1628340	1634480	And the translation, essentially, I think that's really the key to sort of breaking the barrier here.
1634480	1642180	Okay, Russia, I'll give you just 30 seconds. 12th century, they kicked out the Mongols. 17th century, they took Siberia.
1642180	1658600	The communist revolution in 1917, you know, lasted 70 years. Now they've got kind of three things going on. They're trying to develop democracy, they're trying to develop their economy, and they're dealing with the war in Chechnya, which is a big deal.
1659440	1677200	So they've got, they don't have 50 states, they've got 49 obelisks, they've got 21 republics, 10 okrugs, 6 krajs, 2 federal cities, and 1 Jewish autonomous republic. So it looks a lot different than the country you might be from.
1677400	1685820	But again, the more you know, and you could just read a couple articles just to kind of get you in the mood to take on the Russians.
1685820	1697900	Okay, the little thing, that's what you may be used to looking at when you open your atlas, in terms of geography of another country. But let's look at the big one, which I think is really, it's actually really quite interesting.
1697900	1725380	Here is the three main fiber-optic lines in Russia. They're ATM-based, so they're heterogeneous, they've got video, voice, and data. And they run from St. Petersburg in the north, runs up into Scandinavia, down to the, you see the cross there, that's Moscow, goes down and toward the Middle East, and then out to the Far East.
1725380	1738120	And these are the three main lines that data is going to travel across as it goes through Russia. It goes down to Novorossiysk, and then over here it goes to Khabarovsk, and then to Harbin in China.
1738620	1747040	And again, here you'll see that in the middle, there's almost no color there, and that says it's almost completely undeveloped.
1747040	1759520	And what you'll find as you go further into Siberia, there's many more reindeer than there are human beings. And so what you're going to find up there is satellite communications, and very few landlines.
1759660	1769880	And part of the problem with Russia now is everybody is moving to Moscow and St. Petersburg with the market economy. Nobody's staying on the collective farms anymore.
1769880	1780740	And they've got freedom, they've got freedom of movement, and they can move to the big city, and that's what everybody's doing. And so a lot of these outlying areas are in real trouble.
1780740	1794640	Okay, Russian telecommunications. RU is the Russian digraph. SU, which several parties are fighting over still for some reason, but that belongs to the former Soviet Union.
1794640	1818300	And then you can actually count the number of internet hosts and users and telephones. I talked about the trunk lines. But again, a little research will yield quite a lot in terms of the basics of the numbers of people, the numbers in order to get on the right connections and to get into a country.
1818300	1838360	RUNET is an interesting concept. It's kind of like Chinanet or AOHEL, right? It is an intranet, like you might belong in your organization or your university, but it's essentially sort of a cocoon of sorts that's kind of generated by Russians and for Russians and is largely in Russia.
1838360	1848780	And his guy interviewed, his network security guy, is not only for the smart people, but also largely for the stupid users. But it's essentially Russian cyberspace.
1849620	1861840	Internet usage by country, here just quickly, Russia has a relatively small percentage of its population that may be online compared to, say, Scandinavia, but they got a lot more people.
1861840	1873820	So what that means is actually you could potentially deal with three or four times the number of Russians as you could Scandinavians online, just by the sheer numbers, and so that's something you might forget.
1873820	1878060	Again, more color to less color means more connections to less connections.
1878060	1893200	Here's an interesting slide. You consider that some countries, you probably heard the phrase, all roads lead to Rome. Well, when I was in England, too, they assured me that even the smallest village has a street that is pointed directly toward London.
1893780	1904700	So what I want you to see here is essentially the spoke pattern for probably most networks that you would encounter in Russia. If you want to get from point A to point B, you got to go through Moscow, essentially.
1904700	1915740	And this is really good to know when you are crossing networks, so that you know if I want to go somewhere, potentially somebody could collect or see me along the way.
1916200	1927740	Here's the most sophisticated map I could find. There you see the satellites out that are connecting the more remote parts of the country.
1928880	1935980	I think I've covered most of the points I wanted to cover here already, so I'll move on.
1936380	1944700	Now, you can rely on finding things like this on the internet, work that people have already done for you, or you could do it yourself.
1944700	1957680	One way you could do that that's relatively painless is with traceroutes, and they tell you so much about networks and so much about connectivity issues that it's very worthwhile.
1958720	1969440	Here is a way you could do it with a program like VisualRoute, but here's a way with traceroutes that you could do it on your own and then build a little map like this.
1969440	1984340	And you can see, you know, dissecting the words in the resolution and just connecting the dots, essentially, and you can see where the important parts are.
1984340	1994040	And you can see, for instance, so many things through traceroutes, like if you want to go from here to the Congo, you may have to go through Egypt or through South Africa, and really there's no other way to do it.
1994040	2002880	And this is the kind of thing that will show you that. However, with Russia, you can actually build a nice little network map relatively quickly.
2002880	2017140	Here's some major IP ranges to get you started if you don't already have them, but again, these are the big players in Russia, and they're in charge of the networks, and you'll find, you know, the Russian government and military and everybody will fall in there.
2017140	2039940	And again, a lot of people are going to do work for you, like if you're interested in tracing spam or you're interested in finding the bad guys in certain contexts, here's some, especially with spam, people have done a lot of the work for you, and they will have lists already put together for China or Russia for IP ranges.
2039940	2067580	Okay, I had a great class a few years ago on hacking, and what they said was the first place to start may not be entirely obvious to you, but you start with the homepage, right? So in this case, here's the Russian government portal, and you'd be surprised how much information is here if you dig down into it, but again, part of the problem for a Western user is the language barrier.
2067580	2091440	Here is about the only page that you'll find with a direct word-for-word translation, and it is the president's page, not surprisingly. Here is a great site, the Russian cybercrime office. Again, it's only in Russian, but for some reason the title, so it's a big, there's a whole lot of pages extending out underneath it, but again, cybernetic police, everything below that is in Russian, but there's some great stuff here.
2091440	2104720	Starting with the spider group, this is back in the mid-90s when Russia wanted to tackle internet crime, and it was still real, you know, it was a secret back then, they called it the spider group, but you can see some leftover vestiges of that here.
2107360	2118940	Here's some things that fall underneath, and one of the things I want to highlight here is just that if you are in law enforcement, or you wanted to do any type of international investigation, whether it be official or unofficial,
2118940	2131780	you can see here the actual what Russians consider illegal, and the definitions by which they might prosecute someone. So here, you know, you've got Carter, Freaker, and Hacker to start with.
2131780	2146620	They have a site that has cybercrime statistics all the way back to 1982, and I really thought this was quite interesting. There's a lot to go through here, so I went back to 1982 and was reading, and there was only one case from that year, and they only called her Miss K.
2146620	2164640	Well, Miss K was a programmer, and she was in an office that was involved in doling out the funds all over the Soviet Union, and what she did was she just went in there and changed, according to this, one number, and she would change it sometimes, and then she would change it back, and she would sort of flop.
2164640	2177960	But essentially, what it was doing, it was the old salami technique, and it was slicing, every time she did that, slicing money off of an account and going in a direction where potentially she would gather it up later.
2179300	2200720	Here's all the offices that had an official website on the cybercrime site, so there's 89 total. This was the number that actually had websites, so they were really quite cool to look through. They all had their logos, and a lot of them are called K because cyber would be cyber, so this is cyber police.
2202240	2225560	This is an interesting story. I made this slide before I got an email from this guy. He is the top cyber cop in Russia, and so I read through his bio, and as you might expect, in Russia, he's very well accomplished in terms of academics, and they're really quite good at that in the Soviet Union, and so he appears very bright and really knows what he's doing.
2225560	2244440	Well, I emailed that cybercrime site. I said, I'm going to write a presentation, and I want to know if you wanted to give me any word of advice and help me out in any way. Well, he emails me back, the same guy, and we had a nice little dialogue, and he answered all my questions. He was really quite friendly, and he seemed like a good guy.
2244440	2269800	So in here, I'll just highlight some of the things. He says one of the main things from his perspective is he just wants to make sure we're all on the same page, not surprisingly, in that for international investigation, you're talking about log file formats, you're talking about contact information and all this. He says that most of his 89 offices actually do get complaints from overseas every day, the majority of them.
2269800	2279140	At the bottom, he says, well, we're doing our best. We're actually meeting more and more often with foreign counterparts, especially the FBI.
2280400	2286000	Now here's some questions that I just put together, and again, I put a lot more together than this, but this is just kind of a start.
2286000	2308460	I was thinking if we could develop 100, 200, the most important terminology, the most important questions to be asked for international investigations, even if you're just a system administrator or you're the kind of guy who reads through your log files just for fun from your firewall at home, the kind of things that would be able to take you across borders.
2308460	2319740	I don't see any reason why we couldn't develop several hundred of these and get them professionally translated and be able to move more quickly across borders. So here's just some things that I had put together in that regard.
2319740	2333180	Here's one word to get you started in case you're, I don't know, I've only studied a couple of languages here, but again, you will find a lot of hacker stuff just about in any language on the web.
2333180	2346560	And the thing is, whether or not you've done this before, it works, and you slap yourself, you've never done it, but if you know, for instance, the word for hacker in Russian or Chinese, just take that and drop it in Google and see what comes up.
2346560	2361960	I mean, Google knows exactly what you're talking about, right? So you can take those and you can drop them in foreign newspapers, you can drop them in sites like the spam sites that I showed you in English, they've got the same thing in foreign countries.
2361960	2377100	And I'll just end this section with Kaspersky, according to Russian hackers, the most hated man in the country. But this is a real interesting guy, and he just made his entry into the US market. I'm not sure if you've heard of Kaspersky Labs or not.
2377100	2396200	But they just incorporated the United States, and in February, they have big plans to move outside Russia. One of the interesting things about Kaspersky is that the Kaspersky Labs are, according to technical people who look at their products, really very, very good.
2396200	2419640	Their products worked very well. They seem to know exactly what they're doing in terms of writing antivirus signatures that work and that are beneficial. So one of the interesting questions then, especially guys from America's perspective, especially with sort of the legacy of the Cold War and all that, is whether we'll have any inhibition about buying Russian products and putting them in our networks, especially if they're government in nature.
2420680	2443720	Okay, I'll finish just talking about the international political scene, and there's some real interesting, juicy things going on to think about. There's no end to the number of sites that you could start with. Here are just the UK sites that I found, where if you had anything that fell under these categories, it'd give you a place to start in the United Kingdom.
2443720	2459900	But in general, international law is real ill-suited to deal with the Internet, and it's just starting to catch up. I mean, the Internet is borderless, and you can't even hope to sort of interview all the people who cross your borders every day, much less look at all the data packets.
2460680	2477600	Again, we all know what the I-love-you virus and all that. In certain countries, they haven't even thought of instituting cybercrimes, and so how are you going to prosecute somebody? Nobody likes to extradite criminals. Nobody likes to give up any part of their national sovereignty. These are all real important issues, and they're all for good reasons.
2477600	2499860	If you gave up part of your national sovereignty to a foreign country, you're worried about all kinds of things, from the abuse of data to espionage to collecting on your citizens without their consent in a different culture, looking at your political culture, and all of that. So what you have is Microsoft and Valve looking at other solutions in order to track down criminals.
2499860	2520640	Evidently, somebody has taken a Microsoft bounty. They're not going to publish it, but that's what it appears has taken place. In the case of Valve, they actually tapped their fan base and they said, can you help us here? Somebody stole parts of Half-Life 2, and it worked. So extraterritoriality is a big issue.
2521460	2539040	In here, I'm primarily going to talk about remote search and seizure. So we'll talk about the FBI sting. So the FBI in the year 2000, they saw all this activity coming from Russia. They weren't getting the help that they wanted from the Russians, and so they said, well, we're going to do our own research and we're going to do this.
2539040	2558980	And so what they did was they had a couple of suspects. They went to Russian sites, they pulled down their resumes, and they invited them to Seattle to a fake company for an interview. And they came. And it's kind of a sad story in part because they were actually quite excited about getting out of the biz and going legit.
2558980	2575460	And they went to Seattle, and of course, the FBI guys, they said, why don't you download some stuff to prove your skills to us? And of course, as soon as they did, they had their logon, username, and password, and they had all this evidence with which to prosecute them.
2575460	2598520	So remote search and seizure, it's a great topic to debate because whether or not, in this case, the Russians went over there without the consent of the Russians. So what the Russians did was they sued us back, and they said, you illegally came on our networks, and it was a mess.
2598520	2622080	The thing is, if you're not getting cooperation from a foreign government, what do you do? You're kind of between a rock and a hard place. Is it closer to, do you think, actually sending your law enforcement over there and invading the country, or is it closer to, say, doing open source collection from newspapers or taking satellite pictures, all of which are commonly available and are not really considered espionage?
2622080	2649760	One of the main things we've got going right now is the European Cybercrime Convention, but a lot of the things I just mentioned are the big issues. Essentially, people are worried about these national sovereignty issues, and so all we've really got on the table is closer point-of-contact issues, and so that's really all the national governments, I promise you, are going to allow.
2649760	2665780	There is no way that a national government is going to allow another one to come in and ransack its networks looking for evidence. So it's about getting on the same page, it's about having the same log file formats and good points of contact. That's really all that's on the table.
2665780	2694740	And I'll just leave you with a short story. Recently in the UK, they wanted to find some malicious guys in China, and so they were calling over there, these UK guys trying to find somebody to talk to about it, and they had extreme difficulty. They finally found the PRC cert, and they said whether or not this is the case, this is at least exactly how it seemed to them in the UK, they could only find one person to talk to, and that guy only spoke Chinese.
2694740	2720720	So to make a long story short, they eventually found somebody who spoke Chinese in the UK, and they told this guy that this particular website was causing them problems, and they said it came down in a heartbeat. But that sort of story highlights the difficulties with which you'll find in crossing international borders in any of this business. So thank you very much for the talk, I really appreciate it.
2720720	2728210	If you have any questions, feel free just to raise your hand.
2732350	2734710	The mob, okay.
2736140	2738700	Yeah, I tried to find... I'm sorry?
2740120	2757240	Yeah, I tried to talk about organized crime in the sense of either the Russian bride scams, or the credit card information, the PayPal, the eBay scams, there's so many things to look at.
2758600	2775320	The online extortion against the gambling rings in the UK. You know, I tried to bring up a wide variety of things, but really there's almost no end to it. You have to use your imagination, just like malicious code, right? I mean, you can do almost anything you can dream up, essentially.
2775320	2791920	But yeah, it's a big problem in Russia, organized crime. And they know what they're doing. And I just read an article from last week, and this Russian law enforcement official just said that it is so hard for them to trace cybercrime back in Russia because they're just using great techniques.
2791920	2810640	He said they have a three rule in which they use at least three hops to anonymize their contact on the internet. So he said, you know, they never go below three. And he said, two maybe is doable, but three, he said, makes it virtually impossible to ID somebody on the internet.
2810640	2837620	So part of the problem with Russia is very good. And one of the things I didn't say is that Kaspersky, in an interview recently, he said, you know, five or ten years ago, and this is maybe of interest to the crowd here, hackers in Russia were largely the healthy kind, he said, but it is just moving so rapidly, he said it's gone from below 50% now to over 90% of malicious code is written by and for criminals.
2838200	2850800	So he just said that's one thing that has taken place in the past five or ten years for malicious code in Russia is that the criminalization of the internet, you know, regards malicious code.
2851780	2852980	Yeah.
2871480	2879460	I don't know, to be honest with you, but I do know what she asked about money laundering. And right.
2879820	2881760	They're using euros.
2895420	2897620	Yeah, it's a big problem.
2897620	2910820	One of the things with the internet is they get the right logon information for, say, a PayPal account, and it's real tough to... they have a legitimate transaction.
2910820	2918640	In other words, they've got two legitimate accounts. They transfer money, you know, from a legitimate account to a legitimate account.
2918640	2928400	By the time law enforcement gets around to doing something about it, they're gone. They're gone, and that money has been transferred to places which are safe for the criminals.
2928760	2930240	So it's a big problem.
2932700	2934280	Okay, one more question.
2945320	2948220	Yeah, let's...
2948220	2954780	He said, are there any good software... he uses translate.ru a fair bit, and I do as well.
2956360	2959920	Standalone. Commercial translation software.
2960360	2967700	You can look through the links. There are a number... I noticed there are a number that are under $100.
2968000	2980860	Language Weaver is pretty expensive, but it uses specifically that technique I talk about, and it feeds it literally hundreds of newspapers, articles, and novels to do...
2980860	2993140	Essentially, it is giving you a professionally translated version. It can be choppy at times. It's very expensive, but Language Weaver is one that is highly regarded. It's won a lot of prizes.
2995500	3005940	Well, I mean, they claim that I think with Arabic, Chinese, and French, they're already really good, and I think they've included a whole lot of stuff.
3005940	3009160	Russian is coming out this year. It's not out yet.
3010740	3013600	So, thanks a lot. I really appreciate it, but that's it.