[00:08.220 --> 00:17.220]  And then the other thing is trying to encourage you to do this type of research as you investigate what's going on on your own networks.
[00:17.460 --> 00:28.060]  So a brief outline, a threat, and we'll look at sort of turning the threat on its head and using it as a resource once you've identified a threat.
[00:28.060 --> 00:37.340]  And then talk about building a method to do this with vis-a-vis China, maybe the Middle East.
[00:37.360 --> 00:45.600]  So you can take it in different directions. And then we'll talk about the law and where international law stands on the subject.
[00:45.800 --> 00:57.980]  So with Russia, very strong in math and science. They have a history in the Cold War of looking at America through a certain lens and taking our products apart no matter what they may be.
[00:57.980 --> 01:03.180]  If you talk to Russians, they have a healthy culture of reverse engineering in general.
[01:03.180 --> 01:12.120]  They've assured me that when you're growing up in a Russian household and your lamp breaks or your toilet doesn't flush, you don't just pick up the phone and call somebody.
[01:12.120 --> 01:19.840]  You try to figure out how to fix it yourself first. And so this lends to a hacker culture that is strong.
[01:20.440 --> 01:26.260]  The other thing is the economy may not be quite where it needs to be. This is also true in a country like Egypt.
[01:26.260 --> 01:33.060]  It has a great university system, good education, but just not nearly enough jobs to fill the graduates that come out.
[01:33.060 --> 01:37.820]  And so they may move into other areas of the economy.
[01:38.560 --> 01:46.100]  So if you just look, this is a brief slide. We think Windows is expensive and we think Microsoft Office is expensive.
[01:46.100 --> 01:55.160]  But if it cost you your a month's salary, you can kind of imagine your willingness to pay for it at that point. Probably not too likely.
[01:55.780 --> 01:59.300]  Cybercrime. There's a long history of cybercrime from Russia.
[01:59.400 --> 02:10.040]  Vladimir Levin in the mid-1990s manipulated Citibank's cash management system over 40 times, taking $10 million out of it.
[02:10.040 --> 02:16.260]  So it's one of the few cases, though, of a successful bilateral joint law enforcement operation.
[02:16.760 --> 02:23.200]  And what happened was they got most of that money back, but they never did figure out how he did it, how he got in to begin with.
[02:23.200 --> 02:27.080]  The Microsoft source code hack again went back to St. Petersburg.
[02:27.080 --> 02:31.140]  This guy named Joe Lopez in Florida recently, very interesting case.
[02:31.140 --> 02:36.120]  What happened with him? Core flood virus. So he's got a Trojan on his system.
[02:36.280 --> 02:45.200]  Somebody logs in from a couple of former Soviet Union states and they take about $90,000 out of his account, ship it back to Latvia.
[02:45.200 --> 02:53.200]  Now the problem with Joe Lopez was that they had his legitimate login and password and he didn't have that much of a case.
[02:53.200 --> 02:58.360]  Bank of America told him, they said, look, it's not our fault. It's your computer that was hacked.
[02:58.360 --> 03:01.580]  Somebody logged in with your password and moved the money.
[03:01.980 --> 03:09.440]  So he turned around and said, look, I don't know anybody in the former Soviet Union and you should know that malicious code is out there
[03:09.440 --> 03:17.360]  and you should know that large transfers to suspect countries, you should alert the client.
[03:17.360 --> 03:24.220]  In any case, it's a sticky situation because it's his box that was hacked and not the bank's.
[03:24.220 --> 03:31.300]  This guy, you may or may not remember, he spoke four years ago in Apollo over here.
[03:31.300 --> 03:35.280]  And I saw his presentation just before he was arrested by the FBI.
[03:35.280 --> 03:48.120]  And essentially he was for $99 offering you a program that would remove all copyright, all copy, paste, edit, read restrictions on e-book, Adobe product.
[03:48.340 --> 03:51.620]  And so he was working for a Chicago firm at the time.
[03:51.620 --> 03:57.800]  And this got really messy because the EFF got involved and nobody wanted the bad PR, at least of all Adobe,
[03:57.800 --> 04:10.580]  or the United States government whose law enforcement agencies also employed Elcomsoft, which was the company that hired Dimitri and made the product.
[04:10.760 --> 04:16.860]  So with a lot of these cases, again, it's just a few fish in the sea that get arrested, but usually not too much happens with them.
[04:17.380 --> 04:23.520]  What I want to suggest here is if you have a true zero-day exploit, you can turn that into cash.
[04:23.520 --> 04:26.100]  And this is what the Russians are doing now.
[04:26.780 --> 04:31.120]  They've got a great sort of bag of tricks.
[04:31.120 --> 04:40.260]  And what they're doing through Internet worms like Bagel and MyDoom, they're compromising your systems.
[04:40.260 --> 04:44.900]  And what they're doing is just lifting off the financial information.
[04:44.900 --> 04:48.080]  So related to PayPal, related to eBay.
[04:48.240 --> 04:50.800]  It's usually not for distributed denial of service.
[04:50.800 --> 04:53.220]  It's usually not for spam, although it can be.
[04:53.220 --> 04:56.080]  But what they want is your personal financial information.
[04:56.100 --> 05:02.180]  And they take advantage of an exploit to increase revenue.
[05:02.480 --> 05:04.120]  So millions of credit cards.
[05:04.120 --> 05:11.740]  Last year in England, where there is money, you will see a lot of interesting activity.
[05:11.740 --> 05:17.740]  So with international gambling, if they're offline for a couple hours, that's a whole lot of money that they're going to be losing.
[05:17.740 --> 05:29.280]  So with the distributed denial of service attacks versus the international gambling, they typically would hit them with maybe a sin flood.
[05:29.320 --> 05:37.000]  Followed by a letter which said, look, we can take you offline if you don't pay us, say, $50,000 a week, which is not much for international gambling.
[05:37.000 --> 05:48.980]  By the way, the Sands Institute estimates that about 7,000 companies at any given time are paying extortion money to some online attacker.
[05:48.980 --> 05:52.600]  But in this case, again, there were some arrests made.
[05:52.680 --> 05:58.320]  And one success story from last year.
[05:58.320 --> 06:02.640]  Here is a case which is really very important for a couple reasons.
[06:02.640 --> 06:14.540]  One, it was so severe that Microsoft changed its normal patch schedule, which was pretty rigid, and they were willing to come out with patches around their normal schedule.
[06:14.540 --> 06:28.240]  Two, the U.S. CERT advised at least the folks who work in the Washington, D.C. Beltway area in the United States government to not use IE, to use something else, or at the very least disable JavaScript.
[06:28.240 --> 06:53.500]  But what happens here, again, with the Internet worms out there likely compromising Microsoft IIS, then taking advantage of holes in IE to redirect you invisibly to this IP address in China that would download a key logger onto your system and basically pull off financial information, credit card and PayPal and eBay and the like.
[06:53.500 --> 07:03.880]  So Russian malware really falls under every kind of category, you know, from backdoor to downloader to spam tool.
[07:04.060 --> 07:11.660]  So they fall into every category. Social engineering, okay, there's a social engineering aspect in any good attack.
[07:11.660 --> 07:18.880]  And with Russians, they've got a very powerful one. And a lot of people are looking for girlfriends, they're looking for love, right?
[07:18.880 --> 07:29.460]  And so Russians taking advantage of this, I'll just tell you a couple of stories, there's a Canadian guy who had his Russian girlfriend and was sending her a lot of money.
[07:29.460 --> 07:34.600]  And it was the way it transpired, it made it very easy for this man, okay?
[07:34.600 --> 07:48.860]  He had a virtual girlfriend, Althea Matveeva, I think, so he could go into a virtual store and buy her virtual gifts and get email back from her thanking for all this great attention.
[07:48.880 --> 07:56.740]  The problem was there was no store, there was no gifts, and there was no girlfriend. It was just a couple in Russia that had this scam going.
[07:56.740 --> 08:03.160]  They made about $300,000 on it, and of course they would write emails all day long saying, I love you, thank you very much.
[08:05.680 --> 08:17.480]  So there was another case in which an Australian man wrote to Vladimir Putin directly, and he said, look, I've been looking for my girlfriend, even went to Russia, couldn't find her, can you help me?
[08:17.480 --> 08:25.880]  There was an arrest made in that case as well. But it's a big problem, because it's playing on some of the basic human needs, right?
[08:25.880 --> 08:36.560]  But the U.S. Embassy in Moscow gets about 10 calls a day complaining of somebody not being able to find their online girlfriend.
[08:38.340 --> 08:46.460]  So criminal communication can start in public web forums. I'll show you one here, and then we'll jump back.
[08:47.060 --> 09:00.200]  So there's public spaces in which if you own proxies or you're a money launderer, that kind of thing, you can put teasers out there in public web forums.
[09:00.200 --> 09:08.380]  So then you can contact somebody, and then they become closed, and you need registration, and you need recommendations, and that kind of thing.
[09:08.600 --> 09:24.400]  And the real communication then is usually, it's the word I'm looking for, not proprietary, but homegrown code, or something that makes it very hard to trace at that point.
[09:24.400 --> 09:40.680]  However, here's one example, and here's some sites you could check out. But again, you want to announce your service and eventually make your nickname known through the delivery of goods and services through these sites.
[09:40.860 --> 09:52.980]  And you might get paid through WebMoney. We're very familiar with PayPal in this country, but in this case, WebMoney is a service that was started in Russia.
[09:52.980 --> 10:02.940]  And I talked to a couple of Russian guys about this, and they talked about how as soon as you get on, you want to get on a good site, right?
[10:03.900 --> 10:15.520]  That's legit, essentially. But the administrators at that site will check out your goods and services fairly quickly and decide whether they want to keep you on or banish you forever.
[10:15.520 --> 10:33.160]  Where's seen? Drink or Die is a really big group. They started in Russia in 93, moved all over the world. There was one of the biggest international operations law enforcement revolved around Drink or Die. It was called Operation Buccaneer.
[10:33.160 --> 10:45.680]  It was a guy, a bandito, was in Australia. The saint was in Arizona, not too far from here. And this guy's server had tens of thousands. It was so large, it was named the God Complex.
[10:46.500 --> 10:59.740]  And these guys were arrested. But again, a very sophisticated group. They specialize in application software, tens of thousands of cracks, and very good at what they do.
[10:59.740 --> 11:12.400]  And typically the members only know each other's nicknames, and it's very strictly compartmentalized, the organization, and very difficult to... it's kind of like an al-Qaeda cell, right?
[11:12.400 --> 11:20.060]  You take out one and you don't really know. They're not necessarily going to know the other two guys on either side of them in the cell.
[11:20.400 --> 11:32.860]  A little bit different topic, hacktivism. When the United States joined the conflict in the Balkans and started bombing Serbia, again, national emotions run very high.
[11:32.860 --> 11:44.320]  And you'll find that a lot of activity that takes place in cyberspace, particularly involved defacement and denial of service attacks, mirrors what's going on in the real world.
[11:44.320 --> 11:59.040]  You see this with the EP3 that was downed, our EP3 in China. There was a whole lot of hacker activity and sort of the aborted US-Chinese hacker war that took place during that time frame, or almost took place.
[11:59.040 --> 12:12.840]  In the Middle East, you'll see when there's a suicide bombing or when there is an assassination of a Palestinian leader by the Israelis, you'll see a whole lot of web defacements and denial of service activity going on.
[12:12.840 --> 12:28.280]  In this case, Russians are very upset about our stance because they're very close to the Serbians. So there was a lot of activity against UK and US sites. We claim there was no impact and the UK admitted to having lost some military databases.
[12:28.280 --> 12:45.400]  Espionage is a bit more serious. Here's the current alphabet soup for the Russians. The KGB is the old institution. SVR would equate to CIA, FSB, FBI, and FABSI NSA.
[12:46.180 --> 13:11.580]  Just point to the case of Robert Hansen, really, because this is already not new news, but this is the kind of spy that if you are responsible for protecting a network or protecting any type of national secret, you want to consider that spies are going to be moving in a vastly different direction than you might be familiar with in the movies.
[13:11.580 --> 13:34.920]  I know James Bond used to turn one page over at a time and photocopy it. Well now, of course, you can stick a USB drive in and take literally every document your entire agency is working on out of the office with you. So it's a big problem. Robert Hansen, 20 years ago, was already sending encrypted bulletin board messages. He hacked into the account of his superior.
[13:34.920 --> 13:57.080]  He was working all the databases at FBI, and there was no real limitations on what he could do. Searching for his own name, searching on dead drops, searching on Russians, and see if there was any connection that somebody may have suspected him. So about 15 years, he literally gave away just about every important secret to the Russians that you might think of.
[13:57.080 --> 14:19.700]  He was ideally placed. He was the chief of Russian counterintelligence at FBI, which gave him access to just about everything. But very computer savvy, so kind of the spy potentially of the future. Information warfare, you might be familiar with the revolution in military affairs. Essentially, that is electronic command and control.
[14:19.700 --> 14:49.680]  So it looks a lot more like the video game you're playing, right? Planes in the future are going to be a lot more pilotless planes. 90% of the avionics, electronics, and protection mechanisms and all that into a fighter jet are for the pilot. It's crazy now, and people are realizing that. It's sort of an outdated and romantic notion of the Air Force. In the future, it's going to be pilotless, I promise you.
[14:50.100 --> 15:15.640]  Revolutionary military affairs, essentially what that means is everything is going to be cyber and network and database centric. The great goal of the thinkers is, you know, you want a digital Pearl Harbor. If you're going to go to war with another nation state, you would like to be able to win it without taking any casualties. You'd like to be able to turn off the lights. And, you know, when somebody pulls a trigger, nothing happens. That's the goal here.
[15:15.640 --> 15:41.440]  I mentioned electronic Russia. That is just a project that the FSB is getting underway in order to get the word out to citizens and to the agencies and corporations to start thinking in terms of better computer network defense. And just for the record, they're getting very little money and attention on this, and it's really worrisome to the Russian employees who actually are involved in this project.
[15:41.440 --> 16:04.100]  Okay, cyber war in practice. This is interesting because it's actually something tangible that we can point to. The war in Chechnya, southern Russia, really ugly. As it started, the Russians disallowed any media involvement, and that turned out to be really bad PR for them.
[16:04.100 --> 16:24.800]  Because essentially the Chechens came in and they showed all the media types exactly the story they wanted them to see. So the word getting out to the international media was not at all what the Russians wanted. They only showed them Chechen dead bodies. So the Russians learned after that, but it did take a turn in a different direction.
[16:24.800 --> 16:51.000]  As the war moved into the 90s, Russia went on the offensive in cyberspace. And I'll just point to one particular incident to highlight the change. If you might remember, there was in Moscow the hostages that took over the theater. Well, that lasted for a number of days, and at the end, Russian commandos stormed the theater.
[16:51.000 --> 17:09.500]  Right when that happened, several Chechen websites went off the air. So you can only assume from that that it was a coordinated campaign by the Russians on multiple fronts. For the record, one of the servers was located in the United States.
[17:09.500 --> 17:22.080]  So you can assume that the Russians took down a US-based website for what that's worth.
[17:22.080 --> 17:49.000]  Threat summary. Okay, post-Soviet Union, as freedoms sort of grow, they're moving toward a market economy and democratization and all that, we've seen a lot of, from the tennis players and all this, coming out of the Soviet Union, we also see a lot of good malicious code and a lot to be worried about potentially on your networks, particularly as it involves financial crimes.
[17:49.000 --> 18:13.740]  One of the things about the organized cybercrime is that it does inhibit that part of the market economy that will allow products to be legitimate, to be sold legitimately on the street. You can buy an office on the street for a couple of dollars, right, that's been cracked and sold. From one viewpoint, that's a good thing. From another, it sort of inhibits the market economy growth.
[18:13.740 --> 18:31.140]  The other thing is a lot of this money is recycled into more nefarious crimes, so you have to be aware of that as well. Okay, so we've established that Russia is a threat. Now, you sort of want to turn it on its head and say, okay, now they've got great math and science, great coders, etc., etc., we want to turn that into a resource.
[18:31.140 --> 18:58.620]  So, hacker sites, there's no end of them. You can find them very quickly, but I think for a lot of people, the language barrier would be the first thing that would inhibit you from trying to exploit this as a resource. Here's some sites where you can start looking at them. Here's one, maybe the Civil Hacker School, it's sort of the analogous to Zahacademie in France that is very well known and in the news.
[18:58.620 --> 19:16.500]  This site, you'll find everything in English as well as in Russian, so I don't need to help you with that really, but what we will look at is a Russian language site. So, here I took one with a lot of things that we can sort of dissect and pick apart, but again, it's all in Russian, so if you don't speak Russian, you're like, how am I going to do this? Well, I'll show you how in a second.
[19:16.500 --> 19:40.800]  But first of all, I'll just sort of look at the material on the site, and you'll find that it looks a whole lot like a site that your own language wants, you just translate the words. So, hacker, essentially, you'll find that the Russians have no problem sort of incorporating foreign words into their language. French hate that, right? They've outlawed the use of the word email in France, but no problem with that in Russian.
[19:40.800 --> 19:58.580]  So, hacker is a hacker. Vzlom is an attack, защита, defense, программирование, исходники, халява, soft, и проги. So, I won't take you any further in Russian, but so you can hear a little bit of it, and this is the motto of the site.
[19:58.580 --> 20:22.740]  And here's sort of how it breaks down. You've got training, a lot of downloads, and some hacker tools. And so, here's a place you could go, for instance, to find, and once you grab a software translation tool off the internet, you'll find that there might be a lot of stuff here that you could exploit in really just a few minutes that you may never have imagined you could have otherwise.
[20:22.740 --> 20:38.320]  So, just the top, here you see archive of articles, right? You can see commentary, how many times it's been read, when it was posted, etc. The top one, for instance, I'll just translate the top one. It says, essentially it means how to seize a lame IRC channel.
[20:38.980 --> 20:55.800]  So, it's been read 10 times, and you just click on it to download or email. Here's the downloads, and again, it goes into different categories, but in terms of exploits and articles and various tools like scanners.
[20:55.800 --> 21:22.820]  Here's the top 10 downloads. I kind of matched them against the insecure.org ones, and it wasn't a very good match. So, potentially, I don't know that a lot of the names haven't been necessarily changed, but what I'm suggesting here is you may find things here that you may not find in the normal repositories in which you look, and if you're a coder, of course, you might be able to also pick apart things.
[21:22.820 --> 21:46.080]  You might not be able to read the comments, but I'll show you how to do that. Here's the discussion forums on the site. And again, it's not that difficult, and I've done it. You're all used to having a couple of windows open on your desktop just to translate something in one of the online services and drop that in a chat window. It just takes a second, really, to go back and forth between the two.
[21:46.080 --> 22:10.600]  So, here's Hacker Tools, the three main ones on the site. So, the scanner email, DNS. So, I just asked it. I said, hey, why don't you scan the Kremlin for me and tell me what ports are open? So, it's the kind of thing where you could, again, you're using somebody's tool in their environment or in their milieu, which might be a good idea and offer you some benefits.
[22:11.020 --> 22:26.640]  So, it even has a word of the day. In this case, Big Brother is always watching. Don't forget. Here's two guys who maintain the site. You can email them with any questions. I guess they sure speak enough English to get by.
[22:26.640 --> 22:51.280]  Okay, now you're like, what am I going to do with all this? Anyway, so, very easy. Software translation is not too bad, especially if you know enough words in a particular discipline to get by. In your case, network security and hacking terminology, you're familiar with so many words that you could essentially look at a machine translation and get by a lot quicker than you think.
[22:51.280 --> 23:10.080]  So, natural language processing is, again, it's bringing in human languages into software. And machine translation, which is taking one language and translating it into another, it's much more sophisticated than word for word. Now, they incorporate a lot of grammatical rules. They've got idioms in there.
[23:10.080 --> 23:29.940]  And now they've got this really great feature, part of the development process, what they'll do, because they know that professional translators have already done so much of the work for them, what they'll do is they'll just feed it novels. I talked to one guy who works for a company, and they fed it like every Tom Clancy novel, right? They fed their big machine every Tom Clancy.
[23:29.940 --> 23:49.220]  And what it does is when you ask it to translate something from English to Russian or Russian to English, it already, you know how fat Tom Clancy novels are, it's got about 30 of them in there. It's got many more than that. It's actually got millions of, or thousands of books, millions of phrases.
[23:49.220 --> 24:17.440]  But it's already, what it's doing is it's taking a professionally translated translation and giving you essentially what a person did, who was trained in the discipline. So, you'll find professional translations on the web, and these are a help if you really want to study the language, and these can be pretty good. Just for the same reason you'll find War and Peace in every bookstore, you'll also find good articles about hacking, you'll find them as well in other languages.
[24:17.440 --> 24:37.320]  You know, whether you study Chinese or Arabic, these can be kind of cool to look at. There's a lot of free services, and these aren't too bad if you don't know about AltaVista. Just go to AltaVista and click on translation, and they've got a nice long list now, bidirectional of a lot of languages that you can go back and forth in for free.
[24:37.320 --> 24:58.500]  There's commercial translation that can get quite expensive. So, we'll just look at translation briefly, translation software. So, here's Smashing the Stack, which is, admittedly, is a very difficult text. And what I'm going to do is actually give it a very difficult assignment, is I'm asking this AltaVista, right, Babelfish, to go to Russian and then jump back to English.
[24:58.500 --> 25:21.720]  Never try this with Shakespeare. It comes out really, really bad. But with this, you'll find, especially if it's in a discipline, especially if it's something like the weather, especially if it's something that's relatively has a limited vocabulary, it's quite good. So, take Smashing the Stack into Russian and then back to English. So, you'll find it's to break the stack, you know, so that's not really great.
[25:21.720 --> 25:47.220]  You'll also find that C programming, there's no real C in Russian. So, C became che, right? When it comes back, since there's no match up, che, for whatever reason, it said, oh, it must be an H. So, then you wind up with H programming. That's not great either. But overall, I'm telling you, this just took a second to do and you can actually walk your way through it without too much of a problem.
[25:48.500 --> 26:15.560]  Rustified software, you'll find already, Windows actually is very friendly to Cyrillic now and it's actually quite good. You just do a left shift and alt and it'll take you back and forth between the two, just about any Windows tool that's out there. I'm not so sure. I was told that Mac is, that's not the case for Mac and I'd be surprised if Linux, but, you know, with Windows has it covered.
[26:15.560 --> 26:27.600]  Okay, now let's try to turn this into a bit of a method so that you can take it in different directions, because you might not be so interested in Russia, but you might be interested in some different topics in which I hope that this may help you.
[26:27.600 --> 26:44.940]  So, I had to think of some way to bring this together, so I noticed that Ts were one way I could possibly do that. So, just suggesting that you might want to know something about the country before you invade it, or before you take on its networks.
[26:45.560 --> 26:56.780]  You know, the more you know about history, culture, etc., language too, it's gonna help you enormously to understand where they're coming from and where you should be going as well.
[26:56.780 --> 27:08.340]  The terrain, how am I gonna talk about the telecoms and the internet infrastructure in the country, the techniques, you know, hacker groups and tools, that kind of thing. There's a lot of good resources for that.
[27:08.340 --> 27:14.480]  And the translation, essentially, I think that's really the key to sort of breaking the barrier here.
[27:14.480 --> 27:22.180]  Okay, Russia, I'll give you just 30 seconds. 12th century, they kicked out the Mongols. 17th century, they took Siberia.
[27:22.180 --> 27:38.600]  The communist revolution in 1917, you know, lasted 70 years. Now they've got kind of three things going on. They're trying to develop democracy, they're trying to develop their economy, and they're dealing with the war in Chechnya, which is a big deal.
[27:39.440 --> 27:57.200]  So they've got, they don't have 50 states, they've got 49 obelisks, they've got 21 republics, 10 okrugs, 6 krajs, 2 federal cities, and 1 Jewish autonomous republic. So it looks a lot different than the country you might be from.
[27:57.400 --> 28:05.820]  But again, the more you know, and you could just read a couple articles just to kind of get you in the mood to take on the Russians.
[28:05.820 --> 28:17.900]  Okay, the little thing, that's what you may be used to looking at when you open your atlas, in terms of geography of another country. But let's look at the big one, which I think is really, it's actually really quite interesting.
[28:17.900 --> 28:45.380]  Here is the three main fiber-optic lines in Russia. They're ATM-based, so they're heterogeneous, they've got video, voice, and data. And they run from St. Petersburg in the north, runs up into Scandinavia, down to the, you see the cross there, that's Moscow, goes down and toward the Middle East, and then out to the Far East.
[28:45.380 --> 28:58.120]  And these are the three main lines that data is going to travel across as it goes through Russia. It goes down to Novorossiysk, and then over here it goes to Khabarovsk, and then to Harbin in China.
[28:58.620 --> 29:07.040]  And again, here you'll see that in the middle, there's almost no color there, and that says it's almost completely undeveloped.
[29:07.040 --> 29:19.520]  And what you'll find as you go further into Siberia, there's many more reindeer than there are human beings. And so what you're going to find up there is satellite communications, and very few landlines.
[29:19.660 --> 29:29.880]  And part of the problem with Russia now is everybody is moving to Moscow and St. Petersburg with the market economy. Nobody's staying on the collective farms anymore.
[29:29.880 --> 29:40.740]  And they've got freedom, they've got freedom of movement, and they can move to the big city, and that's what everybody's doing. And so a lot of these outlying areas are in real trouble.
[29:40.740 --> 29:54.640]  Okay, Russian telecommunications. RU is the Russian digraph. SU, which several parties are fighting over still for some reason, but that belongs to the former Soviet Union.
[29:54.640 --> 30:18.300]  And then you can actually count the number of internet hosts and users and telephones. I talked about the trunk lines. But again, a little research will yield quite a lot in terms of the basics of the numbers of people, the numbers in order to get on the right connections and to get into a country.
[30:18.300 --> 30:38.360]  RUNET is an interesting concept. It's kind of like Chinanet or AOHEL, right? It is an intranet, like you might belong in your organization or your university, but it's essentially sort of a cocoon of sorts that's kind of generated by Russians and for Russians and is largely in Russia.
[30:38.360 --> 30:48.780]  And his guy interviewed, his network security guy, is not only for the smart people, but also largely for the stupid users. But it's essentially Russian cyberspace.
[30:49.620 --> 31:01.840]  Internet usage by country, here just quickly, Russia has a relatively small percentage of its population that may be online compared to, say, Scandinavia, but they got a lot more people.
[31:01.840 --> 31:13.820]  So what that means is actually you could potentially deal with three or four times the number of Russians as you could Scandinavians online, just by the sheer numbers, and so that's something you might forget.
[31:13.820 --> 31:18.060]  Again, more color to less color means more connections to less connections.
[31:18.060 --> 31:33.200]  Here's an interesting slide. You consider that some countries, you probably heard the phrase, all roads lead to Rome. Well, when I was in England, too, they assured me that even the smallest village has a street that is pointed directly toward London.
[31:33.780 --> 31:44.700]  So what I want you to see here is essentially the spoke pattern for probably most networks that you would encounter in Russia. If you want to get from point A to point B, you got to go through Moscow, essentially.
[31:44.700 --> 31:55.740]  And this is really good to know when you are crossing networks, so that you know if I want to go somewhere, potentially somebody could collect or see me along the way.
[31:56.200 --> 32:07.740]  Here's the most sophisticated map I could find. There you see the satellites out that are connecting the more remote parts of the country.
[32:08.880 --> 32:15.980]  I think I've covered most of the points I wanted to cover here already, so I'll move on.
[32:16.380 --> 32:24.700]  Now, you can rely on finding things like this on the internet, work that people have already done for you, or you could do it yourself.
[32:24.700 --> 32:37.680]  One way you could do that that's relatively painless is with traceroutes, and they tell you so much about networks and so much about connectivity issues that it's very worthwhile.
[32:38.720 --> 32:49.440]  Here is a way you could do it with a program like VisualRoute, but here's a way with traceroutes that you could do it on your own and then build a little map like this.
[32:49.440 --> 33:04.340]  And you can see, you know, dissecting the words in the resolution and just connecting the dots, essentially, and you can see where the important parts are.
[33:04.340 --> 33:14.040]  And you can see, for instance, so many things through traceroutes, like if you want to go from here to the Congo, you may have to go through Egypt or through South Africa, and really there's no other way to do it.
[33:14.040 --> 33:22.880]  And this is the kind of thing that will show you that. However, with Russia, you can actually build a nice little network map relatively quickly.
[33:22.880 --> 33:37.140]  Here's some major IP ranges to get you started if you don't already have them, but again, these are the big players in Russia, and they're in charge of the networks, and you'll find, you know, the Russian government and military and everybody will fall in there.
[33:37.140 --> 33:59.940]  And again, a lot of people are going to do work for you, like if you're interested in tracing spam or you're interested in finding the bad guys in certain contexts, here's some, especially with spam, people have done a lot of the work for you, and they will have lists already put together for China or Russia for IP ranges.
[33:59.940 --> 34:27.580]  Okay, I had a great class a few years ago on hacking, and what they said was the first place to start may not be entirely obvious to you, but you start with the homepage, right? So in this case, here's the Russian government portal, and you'd be surprised how much information is here if you dig down into it, but again, part of the problem for a Western user is the language barrier.
[34:27.580 --> 34:51.440]  Here is about the only page that you'll find with a direct word-for-word translation, and it is the president's page, not surprisingly. Here is a great site, the Russian cybercrime office. Again, it's only in Russian, but for some reason the title, so it's a big, there's a whole lot of pages extending out underneath it, but again, cybernetic police, everything below that is in Russian, but there's some great stuff here.
[34:51.440 --> 35:04.720]  Starting with the spider group, this is back in the mid-90s when Russia wanted to tackle internet crime, and it was still real, you know, it was a secret back then, they called it the spider group, but you can see some leftover vestiges of that here.
[35:07.360 --> 35:18.940]  Here's some things that fall underneath, and one of the things I want to highlight here is just that if you are in law enforcement, or you wanted to do any type of international investigation, whether it be official or unofficial,
[35:18.940 --> 35:31.780]  you can see here the actual what Russians consider illegal, and the definitions by which they might prosecute someone. So here, you know, you've got Carter, Freaker, and Hacker to start with.
[35:31.780 --> 35:46.620]  They have a site that has cybercrime statistics all the way back to 1982, and I really thought this was quite interesting. There's a lot to go through here, so I went back to 1982 and was reading, and there was only one case from that year, and they only called her Miss K.
[35:46.620 --> 36:04.640]  Well, Miss K was a programmer, and she was in an office that was involved in doling out the funds all over the Soviet Union, and what she did was she just went in there and changed, according to this, one number, and she would change it sometimes, and then she would change it back, and she would sort of flop.
[36:04.640 --> 36:17.960]  But essentially, what it was doing, it was the old salami technique, and it was slicing, every time she did that, slicing money off of an account and going in a direction where potentially she would gather it up later.
[36:19.300 --> 36:40.720]  Here's all the offices that had an official website on the cybercrime site, so there's 89 total. This was the number that actually had websites, so they were really quite cool to look through. They all had their logos, and a lot of them are called K because cyber would be cyber, so this is cyber police.
[36:42.240 --> 37:05.560]  This is an interesting story. I made this slide before I got an email from this guy. He is the top cyber cop in Russia, and so I read through his bio, and as you might expect, in Russia, he's very well accomplished in terms of academics, and they're really quite good at that in the Soviet Union, and so he appears very bright and really knows what he's doing.
[37:05.560 --> 37:24.440]  Well, I emailed that cybercrime site. I said, I'm going to write a presentation, and I want to know if you wanted to give me any word of advice and help me out in any way. Well, he emails me back, the same guy, and we had a nice little dialogue, and he answered all my questions. He was really quite friendly, and he seemed like a good guy.
[37:24.440 --> 37:49.800]  So in here, I'll just highlight some of the things. He says one of the main things from his perspective is he just wants to make sure we're all on the same page, not surprisingly, in that for international investigation, you're talking about log file formats, you're talking about contact information and all this. He says that most of his 89 offices actually do get complaints from overseas every day, the majority of them.
[37:49.800 --> 37:59.140]  At the bottom, he says, well, we're doing our best. We're actually meeting more and more often with foreign counterparts, especially the FBI.
[38:00.400 --> 38:06.000]  Now here's some questions that I just put together, and again, I put a lot more together than this, but this is just kind of a start.
[38:06.000 --> 38:28.460]  I was thinking if we could develop 100, 200, the most important terminology, the most important questions to be asked for international investigations, even if you're just a system administrator or you're the kind of guy who reads through your log files just for fun from your firewall at home, the kind of things that would be able to take you across borders.
[38:28.460 --> 38:39.740]  I don't see any reason why we couldn't develop several hundred of these and get them professionally translated and be able to move more quickly across borders. So here's just some things that I had put together in that regard.
[38:39.740 --> 38:53.180]  Here's one word to get you started in case you're, I don't know, I've only studied a couple of languages here, but again, you will find a lot of hacker stuff just about in any language on the web.
[38:53.180 --> 39:06.560]  And the thing is, whether or not you've done this before, it works, and you slap yourself, you've never done it, but if you know, for instance, the word for hacker in Russian or Chinese, just take that and drop it in Google and see what comes up.
[39:06.560 --> 39:21.960]  I mean, Google knows exactly what you're talking about, right? So you can take those and you can drop them in foreign newspapers, you can drop them in sites like the spam sites that I showed you in English, they've got the same thing in foreign countries.
[39:21.960 --> 39:37.100]  And I'll just end this section with Kaspersky, according to Russian hackers, the most hated man in the country. But this is a real interesting guy, and he just made his entry into the US market. I'm not sure if you've heard of Kaspersky Labs or not.
[39:37.100 --> 39:56.200]  But they just incorporated the United States, and in February, they have big plans to move outside Russia. One of the interesting things about Kaspersky is that the Kaspersky Labs are, according to technical people who look at their products, really very, very good.
[39:56.200 --> 40:19.640]  Their products worked very well. They seem to know exactly what they're doing in terms of writing antivirus signatures that work and that are beneficial. So one of the interesting questions then, especially guys from America's perspective, especially with sort of the legacy of the Cold War and all that, is whether we'll have any inhibition about buying Russian products and putting them in our networks, especially if they're government in nature.
[40:20.680 --> 40:43.720]  Okay, I'll finish just talking about the international political scene, and there's some real interesting, juicy things going on to think about. There's no end to the number of sites that you could start with. Here are just the UK sites that I found, where if you had anything that fell under these categories, it'd give you a place to start in the United Kingdom.
[40:43.720 --> 40:59.900]  But in general, international law is real ill-suited to deal with the Internet, and it's just starting to catch up. I mean, the Internet is borderless, and you can't even hope to sort of interview all the people who cross your borders every day, much less look at all the data packets.
[41:00.680 --> 41:17.600]  Again, we all know what the I-love-you virus and all that. In certain countries, they haven't even thought of instituting cybercrimes, and so how are you going to prosecute somebody? Nobody likes to extradite criminals. Nobody likes to give up any part of their national sovereignty. These are all real important issues, and they're all for good reasons.
[41:17.600 --> 41:39.860]  If you gave up part of your national sovereignty to a foreign country, you're worried about all kinds of things, from the abuse of data to espionage to collecting on your citizens without their consent in a different culture, looking at your political culture, and all of that. So what you have is Microsoft and Valve looking at other solutions in order to track down criminals.
[41:39.860 --> 42:00.640]  Evidently, somebody has taken a Microsoft bounty. They're not going to publish it, but that's what it appears has taken place. In the case of Valve, they actually tapped their fan base and they said, can you help us here? Somebody stole parts of Half-Life 2, and it worked. So extraterritoriality is a big issue.
[42:01.460 --> 42:19.040]  In here, I'm primarily going to talk about remote search and seizure. So we'll talk about the FBI sting. So the FBI in the year 2000, they saw all this activity coming from Russia. They weren't getting the help that they wanted from the Russians, and so they said, well, we're going to do our own research and we're going to do this.
[42:19.040 --> 42:38.980]  And so what they did was they had a couple of suspects. They went to Russian sites, they pulled down their resumes, and they invited them to Seattle to a fake company for an interview. And they came. And it's kind of a sad story in part because they were actually quite excited about getting out of the biz and going legit.
[42:38.980 --> 42:55.460]  And they went to Seattle, and of course, the FBI guys, they said, why don't you download some stuff to prove your skills to us? And of course, as soon as they did, they had their logon, username, and password, and they had all this evidence with which to prosecute them.
[42:55.460 --> 43:18.520]  So remote search and seizure, it's a great topic to debate because whether or not, in this case, the Russians went over there without the consent of the Russians. So what the Russians did was they sued us back, and they said, you illegally came on our networks, and it was a mess.
[43:18.520 --> 43:42.080]  The thing is, if you're not getting cooperation from a foreign government, what do you do? You're kind of between a rock and a hard place. Is it closer to, do you think, actually sending your law enforcement over there and invading the country, or is it closer to, say, doing open source collection from newspapers or taking satellite pictures, all of which are commonly available and are not really considered espionage?
[43:42.080 --> 44:09.760]  One of the main things we've got going right now is the European Cybercrime Convention, but a lot of the things I just mentioned are the big issues. Essentially, people are worried about these national sovereignty issues, and so all we've really got on the table is closer point-of-contact issues, and so that's really all the national governments, I promise you, are going to allow.
[44:09.760 --> 44:25.780]  There is no way that a national government is going to allow another one to come in and ransack its networks looking for evidence. So it's about getting on the same page, it's about having the same log file formats and good points of contact. That's really all that's on the table.
[44:25.780 --> 44:54.740]  And I'll just leave you with a short story. Recently in the UK, they wanted to find some malicious guys in China, and so they were calling over there, these UK guys trying to find somebody to talk to about it, and they had extreme difficulty. They finally found the PRC cert, and they said whether or not this is the case, this is at least exactly how it seemed to them in the UK, they could only find one person to talk to, and that guy only spoke Chinese.
[44:54.740 --> 45:20.720]  So to make a long story short, they eventually found somebody who spoke Chinese in the UK, and they told this guy that this particular website was causing them problems, and they said it came down in a heartbeat. But that sort of story highlights the difficulties with which you'll find in crossing international borders in any of this business. So thank you very much for the talk, I really appreciate it.
[45:20.720 --> 45:28.210]  If you have any questions, feel free just to raise your hand.
[45:32.350 --> 45:34.710]  The mob, okay.
[45:36.140 --> 45:38.700]  Yeah, I tried to find... I'm sorry?
[45:40.120 --> 45:57.240]  Yeah, I tried to talk about organized crime in the sense of either the Russian bride scams, or the credit card information, the PayPal, the eBay scams, there's so many things to look at.
[45:58.600 --> 46:15.320]  The online extortion against the gambling rings in the UK. You know, I tried to bring up a wide variety of things, but really there's almost no end to it. You have to use your imagination, just like malicious code, right? I mean, you can do almost anything you can dream up, essentially.
[46:15.320 --> 46:31.920]  But yeah, it's a big problem in Russia, organized crime. And they know what they're doing. And I just read an article from last week, and this Russian law enforcement official just said that it is so hard for them to trace cybercrime back in Russia because they're just using great techniques.
[46:31.920 --> 46:50.640]  He said they have a three rule in which they use at least three hops to anonymize their contact on the internet. So he said, you know, they never go below three. And he said, two maybe is doable, but three, he said, makes it virtually impossible to ID somebody on the internet.
[46:50.640 --> 47:17.620]  So part of the problem with Russia is very good. And one of the things I didn't say is that Kaspersky, in an interview recently, he said, you know, five or ten years ago, and this is maybe of interest to the crowd here, hackers in Russia were largely the healthy kind, he said, but it is just moving so rapidly, he said it's gone from below 50% now to over 90% of malicious code is written by and for criminals.
[47:18.200 --> 47:30.800]  So he just said that's one thing that has taken place in the past five or ten years for malicious code in Russia is that the criminalization of the internet, you know, regards malicious code.
[47:31.780 --> 47:32.980]  Yeah.
[47:51.480 --> 47:59.460]  I don't know, to be honest with you, but I do know what she asked about money laundering. And right.
[47:59.820 --> 48:01.760]  They're using euros.
[48:15.420 --> 48:17.620]  Yeah, it's a big problem.
[48:17.620 --> 48:30.820]  One of the things with the internet is they get the right logon information for, say, a PayPal account, and it's real tough to... they have a legitimate transaction.
[48:30.820 --> 48:38.640]  In other words, they've got two legitimate accounts. They transfer money, you know, from a legitimate account to a legitimate account.
[48:38.640 --> 48:48.400]  By the time law enforcement gets around to doing something about it, they're gone. They're gone, and that money has been transferred to places which are safe for the criminals.
[48:48.760 --> 48:50.240]  So it's a big problem.
[48:52.700 --> 48:54.280]  Okay, one more question.
[49:05.320 --> 49:08.220]  Yeah, let's...
[49:08.220 --> 49:14.780]  He said, are there any good software... he uses translate.ru a fair bit, and I do as well.
[49:16.360 --> 49:19.920]  Standalone. Commercial translation software.
[49:20.360 --> 49:27.700]  You can look through the links. There are a number... I noticed there are a number that are under $100.
[49:28.000 --> 49:40.860]  Language Weaver is pretty expensive, but it uses specifically that technique I talk about, and it feeds it literally hundreds of newspapers, articles, and novels to do...
[49:40.860 --> 49:53.140]  Essentially, it is giving you a professionally translated version. It can be choppy at times. It's very expensive, but Language Weaver is one that is highly regarded. It's won a lot of prizes.
[49:55.500 --> 50:05.940]  Well, I mean, they claim that I think with Arabic, Chinese, and French, they're already really good, and I think they've included a whole lot of stuff.
[50:05.940 --> 50:09.160]  Russian is coming out this year. It's not out yet.
[50:10.740 --> 50:13.600]  So, thanks a lot. I really appreciate it, but that's it.