1
00:00:03,800 --> 00:00:05,640
Actually, we are back to DEF CON.

2
00:00:13,570 --> 00:00:16,050
After two years, we are back to DEF CON.

3
00:00:16,050 --> 00:00:19,730
And this year, we wanted to talk about something new.

4
00:00:19,730 --> 00:00:22,450
Actually, also two years ago, we were talking about something new.

5
00:00:24,950 --> 00:00:27,890
We will talk about asymmetric digital warfare.

6
00:00:28,710 --> 00:00:29,890
What is it?

7
00:00:29,890 --> 00:00:32,550
What is the point today?

8
00:00:33,430 --> 00:00:35,030
What will happen in the future?

9
00:00:35,030 --> 00:00:45,430
And we will take a very good example, which is the Department of Defense FCS program, which stands for Future Combat System.

10
00:00:46,870 --> 00:01:02,410
Before starting, I want to tell you that you will not get all the information you need out from this speech directly, because the speech comes together with the release of the second episode of our comics.

11
00:01:02,550 --> 00:01:20,030
If you go on zoneh.org website, we already published, one month ago, the first sample, actually, of Hacker Comics ever, which was quite successful, and I suggest you to go there and download it.

12
00:01:20,030 --> 00:01:21,290
It's for free, of course.

13
00:01:22,570 --> 00:01:28,830
And the second episode, it is complementary to the speech we are going to have today.

14
00:01:28,830 --> 00:01:47,330
If you want to understand everything what we are going to talk, and if you want to get even more deep examples, you definitely have to go, either to download the comic from our website, or we will distribute later, to all of you, a CD, which is actually,

15
00:01:47,330 --> 00:01:49,290
was signed originally also by us.

16
00:01:49,290 --> 00:01:51,970
We are the authors of the comic.

17
00:01:51,970 --> 00:01:57,050
And this is the PDF file containing the comic book.

18
00:01:58,370 --> 00:02:02,930
There will not be any questions and answers section.

19
00:02:02,930 --> 00:02:06,230
We don't have the time, but we will ask you a couple of questions.

20
00:02:06,230 --> 00:02:18,070
To those who are capable to answer, we will give a nice T-shirt, with the cover of our comic book, which is that one.

21
00:02:19,210 --> 00:02:21,570
Anyway, my name is Roberto Preatoni.

22
00:02:21,570 --> 00:02:30,230
I am the founder of zonedge.org, which is the last mirror, the defacement mirror archive.

23
00:02:30,230 --> 00:02:31,490
All of the others, they closed.

24
00:02:31,490 --> 00:02:32,610
It's a hell of a job to do it.

25
00:02:32,610 --> 00:02:44,010
Maybe the next year in DEF CON, I will try to explain to the people what is a mirror archive, the reason of existing of such thing, and the efforts which are behind.

26
00:02:44,250 --> 00:02:45,790
But not today.

27
00:02:46,230 --> 00:02:47,250
First of all, the credits.

28
00:02:47,250 --> 00:02:48,950
I have to give two credits.

29
00:02:48,950 --> 00:02:52,570
The first credit goes to the MIT Technology Magazine.

30
00:02:52,570 --> 00:02:54,890
I was on vacation the last year.

31
00:02:54,890 --> 00:02:58,630
I was reading a very good article on the MIT Technology Magazine.

32
00:02:58,670 --> 00:03:08,950
And this article brought to my attention the problem that the American army had during the Second Gulf War.

33
00:03:09,450 --> 00:03:11,530
We will see what kind of problems.

34
00:03:11,770 --> 00:03:16,850
And the second credit, I want to credit globalsecurity.org.

35
00:03:16,850 --> 00:03:18,670
It is a very nice website.

36
00:03:18,670 --> 00:03:22,790
You can get any kind of possible information about military system.

37
00:03:22,950 --> 00:03:27,690
You can spend years downloading material and watching stuff.

38
00:03:27,690 --> 00:03:30,810
Of course, most of the things are traditionally military weapons.

39
00:03:30,810 --> 00:03:41,810
But due to the fact that the FCS, Future Combat System, it is a known program under development, you can find also references on globalsecurity.org.

40
00:03:43,570 --> 00:03:52,010
Another thing I want to say before starting, it is all the material you will find here, and on the slide which you have on your CD, I guess.

41
00:03:52,070 --> 00:03:53,310
It's public.

42
00:03:53,330 --> 00:03:54,870
We didn't hack anything.

43
00:03:54,870 --> 00:03:56,370
So you can get it by yourself.

44
00:03:56,370 --> 00:04:04,410
If Johnny Lang is around, he can teach you how to use Google in the proper way to download such material and to find it.

45
00:04:04,770 --> 00:04:16,170
First of all, there are several good reasons to download Zone H comic beside the fact that it is necessary to understand our speech.

46
00:04:16,850 --> 00:04:25,350
We have the Dark Tangent, DEFCON's mastermind, himself playing as a guest star in the comic.

47
00:04:25,350 --> 00:04:30,010
And the second reason, you can see my ass, basically.

48
00:04:31,750 --> 00:04:36,450
Which, I don't want to tell you it's even better than the first reason, but up to you.

49
00:04:36,450 --> 00:04:39,350
Actually, I don't have it so flat, it's a little bit more rounded.

50
00:04:43,130 --> 00:04:58,970
My friend here is Fabio Ghioni, and he is one of the best experts in asymmetric warfare, anti-terrorism.

51
00:04:58,970 --> 00:05:01,890
If you read his CV, it's very long.

52
00:05:02,530 --> 00:05:06,170
You can get it actually from the DEFCON website.

53
00:05:06,710 --> 00:05:08,410
Actually, it's your turn.

54
00:05:08,410 --> 00:05:11,070
We will talk a little bit me, a little bit him.

55
00:05:11,990 --> 00:05:13,790
Now it's a little bit me.

56
00:05:14,590 --> 00:05:16,450
So, asymmetric warfare.

57
00:05:16,450 --> 00:05:22,870
I don't want to bore anybody with conventional things, but some things must be said before.

58
00:05:23,550 --> 00:05:27,490
And there are a lot of things which are misunderstood.

59
00:05:27,490 --> 00:05:33,110
For example, the definition of asymmetric warfare and the definition of unconventional.

60
00:05:33,650 --> 00:05:37,110
For unconventional, so you understand the rest of the speech, of course.

61
00:05:37,110 --> 00:05:43,330
For unconventional weapons, or unconventional means, I give you an example.

62
00:05:43,330 --> 00:05:44,490
You have a fork.

63
00:05:44,870 --> 00:05:47,770
A fork you use it to eat, of course, a steak or whatever.

64
00:05:47,770 --> 00:05:51,710
Then an unconventional use of this fork is to stick it in the eye of this guy over here.

65
00:05:52,150 --> 00:05:54,190
So, that's a thing.

66
00:05:55,050 --> 00:06:05,810
Then there is another thing, an image, a very good drawing that I saw in a newspaper a few years back, where there was a big marine soldier and a small, I would say, Iraqi guy.

67
00:06:05,810 --> 00:06:08,290
You know, these drawers on newspapers.

68
00:06:08,590 --> 00:06:17,490
And the small Iraqi guy said, you know, huge marine soldier with full of weapons everywhere and millions of dollars of research.

69
00:06:17,490 --> 00:06:22,830
And the small Iraqi guy with some sand in his hand, threw the sand in the eyes of the big soldier.

70
00:06:22,830 --> 00:06:25,470
And he said, ah, that's not fair, that's unconventional.

71
00:06:25,770 --> 00:06:27,770
So, that's unconventional.

72
00:06:27,770 --> 00:06:28,850
And then asymmetric.

73
00:06:28,850 --> 00:06:31,890
For asymmetric, there is a thing very interesting.

74
00:06:31,930 --> 00:06:37,410
When I was in Cuba about a year ago to see Ramiro Valdez.

75
00:06:37,410 --> 00:06:40,630
Ramiro Valdez is one of the heroes of the revolution in Cuba.

76
00:06:41,490 --> 00:06:42,970
Hero in Cuba.

77
00:06:42,970 --> 00:06:44,990
Not everywhere else, of course.

78
00:06:44,990 --> 00:06:56,510
And I remember that he said among other things, he said, ah, Americans, they invented the term asymmetric because they want to invade us and they say that we are preparing for asymmetric warfare.

79
00:06:56,510 --> 00:07:02,250
Actually, they are not because they don't have even lines, phone lines to get connection on the internet.

80
00:07:02,250 --> 00:07:04,890
But that's one thing.

81
00:07:04,970 --> 00:07:06,950
And what does that mean?

82
00:07:06,950 --> 00:07:20,210
That a country, it means that a country that doesn't have the means to combat the war, which is systemic, which is a huge expensive war, uses whatever it has unconventional means.

83
00:07:20,210 --> 00:07:22,310
That is one of the meanings of asymmetric.

84
00:07:22,310 --> 00:07:29,110
The other thing is for example, Islam and a nation, like for example the USA or another nation.

85
00:07:29,110 --> 00:07:32,070
So if you have France against Germany, it's symmetric.

86
00:07:32,070 --> 00:07:36,570
You have territory, you have people, you have whatever, a nation against another nation.

87
00:07:36,570 --> 00:07:39,290
If you have Islam, Islam is scattered everywhere.

88
00:07:39,290 --> 00:07:42,610
You can have people working in your country.

89
00:07:42,730 --> 00:07:45,530
You can have people everywhere.

90
00:07:45,530 --> 00:07:46,910
That's asymmetric.

91
00:07:46,910 --> 00:07:49,810
Religious matters and everything like that.

92
00:07:50,830 --> 00:07:51,430
So...

93
00:07:53,570 --> 00:07:55,950
when it is used, this is...

94
00:07:55,950 --> 00:07:57,830
I just basically explained it.

95
00:07:58,570 --> 00:08:15,770
When you are invading a country or you are combating an enemy which has means which are too big to be compared to, like for example, the United States right now is the only country which can fight a systemic war, which is a war where you have like bombs,

96
00:08:15,770 --> 00:08:16,790
intelligent bombs.

97
00:08:16,790 --> 00:08:23,290
Hit the third window on the left on the 20th floor and kill the man who is taking a pee in that moment.

98
00:08:23,290 --> 00:08:25,670
But don't kill the cat that is in the room.

99
00:08:25,790 --> 00:08:29,130
So that's intelligent bomb.

100
00:08:29,130 --> 00:08:32,930
Then if you kill the cat, it says, shit, it didn't work, so we didn't spend that much money.

101
00:08:33,390 --> 00:08:44,310
And the country where this man is and he is taking a pee and the cat was killed but he didn't have to be killed, etc, etc, they don't have the money to fight this war, so they use whatever they have.

102
00:08:44,830 --> 00:08:47,110
So it's called asymmetric.

103
00:08:47,110 --> 00:08:48,250
It's also called dirty war.

104
00:08:48,250 --> 00:08:49,630
It's called it in many ways.

105
00:08:54,760 --> 00:08:59,040
So, for example, did everybody see the Black Hawk Down movie?

106
00:08:59,680 --> 00:09:10,040
So whoever didn't see it, I mean that's a very famous or very important example of asymmetry in a war.

107
00:09:10,540 --> 00:09:11,000
Okay ?

108
00:09:11,000 --> 00:09:12,720
And the use of unconventional means.

109
00:09:12,720 --> 00:09:23,780
So you have this big Sikorsky helicopter, which is very expensive and it costs a lot of money in research and development.

110
00:09:23,880 --> 00:09:27,480
You have soldiers, you have weapons, you have maintenance.

111
00:09:27,820 --> 00:09:33,860
I mean, you would never believe how much it costs to maintain an helicopter after 100 hours of flight.

112
00:09:33,860 --> 00:09:37,180
It must be maintained for a lot of million dollars again.

113
00:09:37,200 --> 00:09:45,500
So you have all this thing and then you had a little boy with, you know, a watch and a cell phone.

114
00:09:45,500 --> 00:09:47,860
Actually it was a satellite phone.

115
00:09:47,880 --> 00:09:51,980
And he saw the helicopters coming and he called the guys on the base and he said, they are coming.

116
00:09:52,280 --> 00:09:57,100
And the whole thing went, you know, went like that.

117
00:09:57,100 --> 00:10:01,380
The Black Hawk went down and that battle was lost.

118
00:10:01,560 --> 00:10:13,160
So the big expense, the Delta Force and all the millions of dollars spent on satellite recognition and everything, all was spent for nothing because this little guy, which I mean, how much does it cost, this little guy?

119
00:10:13,160 --> 00:10:19,660
You only have to feed him something and a satellite phone, so you have to pay the phone bill and that's it.

120
00:10:19,660 --> 00:10:21,180
And he destroyed everything.

121
00:10:23,260 --> 00:10:27,760
This is, you know, I mean, everybody nowadays does the example of the Twin Towers.

122
00:10:27,760 --> 00:10:32,240
So you have the 19 men, 19 cutters and then you have the 11th September thing.

123
00:10:32,240 --> 00:10:40,260
All the intelligence expenses that have been done in the years before didn't prevent this episode like many other episodes.

124
00:10:40,260 --> 00:10:44,460
Of course, there are a lot of things that have been prevented, but we will never know what they are.

125
00:10:46,560 --> 00:10:49,160
So, why are we saying this?

126
00:10:49,160 --> 00:11:00,900
Because in this years, the electronic warfare, the electronic men is the best way to hit the countries which are technologically developed.

127
00:11:00,900 --> 00:11:04,560
So we have, for example, all the western bloc countries.

128
00:11:04,580 --> 00:11:13,260
These countries depend almost totally on digital systems, on telematic systems, on electronic systems.

129
00:11:13,260 --> 00:11:25,060
So the critical infrastructures, telecommunication infrastructures, food supply, banking systems, military systems, even for example in the United States, missiles, I think they have IP addresses.

130
00:11:25,060 --> 00:11:28,940
So everything depends on electronic and telematic systems.

131
00:11:29,280 --> 00:11:32,620
So, what do you need to do to hit such a country?

132
00:11:32,620 --> 00:11:36,540
You might use electronic means if you know where to hit, of course.

133
00:11:36,540 --> 00:11:39,300
So you need to do some research before, some intelligence.

134
00:11:39,440 --> 00:11:46,240
But both the intelligence and the fighting, you do it using a computer like this one.

135
00:11:46,240 --> 00:11:58,800
You connect to the network and if you are good to search or to find things and you are good also on exploiting them, then you might hit a critical infrastructure and create a blackout.

136
00:11:59,860 --> 00:12:03,660
You know that in the past years there have been several blackouts around the western countries.

137
00:12:03,660 --> 00:12:09,120
For example in Italy, where I come from, there was a huge blackout about two years ago where all the country went black.

138
00:12:09,120 --> 00:12:09,800
Totally.

139
00:12:10,820 --> 00:12:15,700
The government said that it was a tree, some tree that fell over some type of wire.

140
00:12:15,700 --> 00:12:17,860
It was a totally impossible explanation.

141
00:12:18,000 --> 00:12:20,040
So who will ever know what happened?

142
00:12:20,400 --> 00:12:21,060
Nobody.

143
00:12:21,140 --> 00:12:23,620
And the same thing happened also in the United States.

144
00:12:24,740 --> 00:12:26,120
Three years ago, I think.

145
00:12:26,120 --> 00:12:27,640
Or a couple of years ago too.

146
00:12:27,760 --> 00:12:29,200
And in other countries.

147
00:12:29,360 --> 00:12:30,720
So they said it was Switzerland.

148
00:12:31,040 --> 00:12:32,620
In Italy they said it was Switzerland.

149
00:12:32,620 --> 00:12:36,320
The tree fell over some kind of wire and then everything went blackout.

150
00:12:36,320 --> 00:12:38,040
The whole country was incredible.

151
00:12:38,040 --> 00:12:40,020
I was there at night.

152
00:12:40,020 --> 00:12:41,960
I was out tapping at night actually.

153
00:12:41,960 --> 00:12:44,500
I never saw this type of darkness.

154
00:12:44,540 --> 00:12:45,960
It was totally scary.

155
00:12:46,280 --> 00:12:56,540
So you can hit these critical infrastructures and the thing is that you can create more damage doing this than doing a lot of other things.

156
00:12:56,720 --> 00:13:01,620
So for example, the bombings that were in London last week or two weeks ago.

157
00:13:01,620 --> 00:13:02,400
What did they do?

158
00:13:02,400 --> 00:13:03,280
They killed people.

159
00:13:03,280 --> 00:13:04,900
Fifty people died.

160
00:13:05,360 --> 00:13:11,680
But after these fifty people died the country what did it suffer?

161
00:13:11,680 --> 00:13:13,460
Okay, there was a human life.

162
00:13:14,720 --> 00:13:18,120
Nobody can contest the fact that it is valuable.

163
00:13:18,120 --> 00:13:20,340
But nothing changed.

164
00:13:20,400 --> 00:13:22,820
The structures were totally there.

165
00:13:22,820 --> 00:13:23,980
It was psychological.

166
00:13:23,980 --> 00:13:25,120
It was mediatic.

167
00:13:25,120 --> 00:13:27,280
It was public opinion.

168
00:13:27,280 --> 00:13:28,400
It was all these kind of things.

169
00:13:28,400 --> 00:13:31,560
So that's what terrorists want to hit at that moment.

170
00:13:31,560 --> 00:13:35,940
But if they really wanted to create damage, they didn't have to kill those fifty people.

171
00:13:35,940 --> 00:13:41,540
They could just stop a nuclear power reactor or damage it somehow.

172
00:13:41,540 --> 00:13:45,960
You don't need to do very sophisticated things to exploit critical infrastructures.

173
00:13:45,960 --> 00:13:50,640
You just need to do a little thing that just creates havoc.

174
00:13:51,100 --> 00:13:51,780
Okay?

175
00:13:51,800 --> 00:13:53,260
So this is the thing.

176
00:13:53,260 --> 00:13:57,680
Then I will go on later and I give the microphone back to this guy.

177
00:14:01,320 --> 00:14:09,280
It might sound strange, but the main difference between the first and the second Gulf War was a bandwidth difference.

178
00:14:10,740 --> 00:14:19,700
In the next ten years the US has developed a way to distribute information, to collect information.

179
00:14:20,720 --> 00:14:30,420
And basically, in the second Gulf War, the US troops were enjoying forty-two times more bandwidth than in the first Gulf War.

180
00:14:30,420 --> 00:14:34,220
How this bandwidth was actually used?

181
00:14:35,420 --> 00:14:55,010
Well, the picture on the center is a typical command center, command and control center, which collects a lot of data, which could be data and voice interception or data coming from spies deployed on the territory.

182
00:14:55,010 --> 00:14:58,490
They are going to be fed, actually, into the system.

183
00:14:59,290 --> 00:15:18,770
From stealth planes, which are actually flying over the territory and watching the situation, taking pictures, spy drones, unmanned vehicles, from satellites, and also from the Blue Force Tracker, which is a very important system for the American Army.

184
00:15:18,770 --> 00:15:34,510
It is the system, if you see in the movie, when they are, I don't know, on the enemy territory, and they open the laptop, and the laptop is showing some red triangles on the map, which is, this is the enemy, and some blue triangles, this is us.

185
00:15:34,510 --> 00:15:36,870
Actually, this system is not science fiction.

186
00:15:36,870 --> 00:15:41,070
It is existing, and they are already using it successfully.

187
00:15:41,930 --> 00:15:44,390
Well, I want to tell you one thing.

188
00:15:45,050 --> 00:16:04,010
If you open Google Maps, or if you ever used downloading the trial version, not cracked, of course, of Keyhole, the software which was used by CNN to show you, basically, the toilet in which the guy was pissing, and beside it was the cat from the satellite.

189
00:16:04,510 --> 00:16:14,510
Do you have any idea how many megabytes, gigs, it's actually taking a picture taken from a satellite?

190
00:16:14,630 --> 00:16:16,130
Huge amount.

191
00:16:16,130 --> 00:16:25,830
Now, if you have a satellite which is taking picture on the territory, on the enemy territory, and you have to download to give this picture to the troops, then you need bandwidth.

192
00:16:25,910 --> 00:16:29,290
You can't do the 800 x 600 JPEG picture.

193
00:16:29,290 --> 00:16:35,230
This is good for browsing Britney Spears' website, but not to go at war.

194
00:16:35,230 --> 00:16:36,810
This is the reason why U.S.

195
00:16:36,810 --> 00:16:40,770
Army developed such a large bandwidth network.

196
00:16:41,210 --> 00:16:42,620
Was it working?

197
00:16:42,970 --> 00:16:43,910
No.

198
00:16:44,470 --> 00:16:45,530
When U.S.

199
00:16:45,530 --> 00:16:53,650
troops entered into the territory, they started to experience a lot of troubles.

200
00:16:53,970 --> 00:16:56,290
Now, focus your attention.

201
00:16:56,290 --> 00:17:01,630
Do you remember exactly the day when they started to invade Iraq?

202
00:17:01,630 --> 00:17:07,110
The guy was sitting, the CNN guy, was sitting on the top of a U.S.

203
00:17:07,110 --> 00:17:11,890
tank which was running 120 kilometers per hour.

204
00:17:11,890 --> 00:17:12,810
I don't know it in miles.

205
00:17:12,810 --> 00:17:14,530
You can do calculations by yourself.

206
00:17:15,070 --> 00:17:16,810
And it was 75.

207
00:17:17,210 --> 00:17:19,610
And it was running and running and running.

208
00:17:19,610 --> 00:17:23,830
And the journalist was saying, there is nobody nobody is facing us.

209
00:17:23,830 --> 00:17:25,610
We don't see the enemy.

210
00:17:25,610 --> 00:17:26,950
And that was the problem.

211
00:17:26,950 --> 00:17:30,570
Because they were running too fast.

212
00:17:30,630 --> 00:17:32,410
And they were losing connectivity.

213
00:17:32,410 --> 00:17:39,490
Try to hook yourself into a Wi -Fi network while you are on your car and you are driving fast.

214
00:17:39,490 --> 00:17:40,550
You can't.

215
00:17:41,770 --> 00:17:45,350
And basically the Humvees which were in front of the U.S.

216
00:17:45,350 --> 00:17:52,350
troops, they had to stop even for 12 hours to download the tactical data.

217
00:17:52,350 --> 00:17:57,510
Now, do you know the difference between strategical and tactical data?

218
00:17:57,510 --> 00:18:01,790
Tactical data are the data which are necessary to survive in the next 5 minutes.

219
00:18:01,970 --> 00:18:04,890
Because it's telling you where the enemy is.

220
00:18:05,250 --> 00:18:09,110
From which point you should expect to be attacked.

221
00:18:09,110 --> 00:18:11,250
Where should you go not to be attacked.

222
00:18:11,250 --> 00:18:12,690
What you should do.

223
00:18:12,770 --> 00:18:17,290
Because the command and control center is telling you to do this, this and that.

224
00:18:17,950 --> 00:18:24,770
And if you rely on connectivity for having such service, it's good as long as you have connectivity.

225
00:18:24,770 --> 00:18:27,170
But if you don't have any more connectivity, what is happening?

226
00:18:27,170 --> 00:18:31,490
You don't know where your enemy is while your enemy knows very well where you are.

227
00:18:31,490 --> 00:18:34,250
Because you are stopped in the middle of the desert.

228
00:18:36,970 --> 00:18:43,190
And how was organized the system for the second Gulf War?

229
00:18:43,190 --> 00:18:46,870
Basically we had two command and control centers.

230
00:18:46,870 --> 00:18:48,430
One was located in Qatar.

231
00:18:48,430 --> 00:18:50,390
The second was located in Kuwait.

232
00:18:50,390 --> 00:19:01,610
And all the data gathered by the probes was actually fed into a system which was producing too much of intelligence.

233
00:19:02,590 --> 00:19:17,370
It is like if you enable all of your IDS messaging or if you are using zone alarm and you tell to zone alarm to pop up the window each time you are receiving a strange packet.

234
00:19:17,370 --> 00:19:19,710
It will pop up every five seconds.

235
00:19:19,730 --> 00:19:21,410
And what will be the end?

236
00:19:21,410 --> 00:19:24,230
You will switch off the pop up thing.

237
00:19:24,230 --> 00:19:27,470
Too much of information equals no information.

238
00:19:28,230 --> 00:19:29,810
And this was a problem.

239
00:19:30,030 --> 00:19:34,590
The second problem was that the information was fed into a satellite system.

240
00:19:34,590 --> 00:20:04,750
The satellite system was downloading sending, sorry, through a traditional radio streaming to a vehicle which was located back of the US troops and from the vehicle which was actually supposed to act as a router to distribute the information the data were sent using an eye of sight microwave beam.

241
00:20:04,750 --> 00:20:26,790
I guess for security reason they didn't want to have the high technology enemy which is the Iraqi troops intercepting the data of the US troops but this system is working as long as you can see the vehicle which is on your back.

242
00:20:26,790 --> 00:20:35,110
But if you are running 75 miles per hour because you don't face the enemy, then you are losing this link and you are not capable to get any data.

243
00:20:35,110 --> 00:20:39,870
This was the reason why they had to stop and wait 12 hours to get the data.

244
00:20:39,870 --> 00:20:42,230
And they were killed, actually.

245
00:20:42,230 --> 00:20:43,050
Sorry.

246
00:20:44,390 --> 00:20:48,050
US soldiers lost life also due to this.

247
00:20:48,050 --> 00:20:52,770
Because they didn't have the backup of the intelligence telling them where the enemy is.

248
00:20:52,770 --> 00:20:56,890
They were facing the enemy in the same moment they realized it was existing.

249
00:20:56,950 --> 00:21:02,450
And at the same time the bullets, they were flying over their head.

250
00:21:04,870 --> 00:21:12,490
Now, the blue force tracking system, it's the system who tells you where the enemy is.

251
00:21:12,830 --> 00:21:24,450
Luckily, when they developed it, they assigned a certain amount of bandwidth to the BFT, which is actually working using the satellites.

252
00:21:24,450 --> 00:21:29,190
It doesn't work using direct microwave beams.

253
00:21:29,470 --> 00:21:36,070
It means you can always receive it actually the same system you are using on your car for your GPS system.

254
00:21:36,070 --> 00:21:37,610
Very similar.

255
00:21:39,090 --> 00:21:50,010
Luckily, the amount of bandwidth developed from the very beginning to supply information through the BFT system was more than it was actually needed.

256
00:21:50,010 --> 00:21:57,130
So, the developers having such extra bandwidth, they were thinking, what are we going to do?

257
00:21:57,130 --> 00:21:59,230
Are we going to use this bandwidth or not?

258
00:21:59,230 --> 00:21:59,770
Yes.

259
00:21:59,770 --> 00:22:00,470
What do we do?

260
00:22:00,530 --> 00:22:03,270
Let's build an email system.

261
00:22:03,930 --> 00:22:05,330
You never know.

262
00:22:05,330 --> 00:22:06,610
It might come in handy.

263
00:22:06,610 --> 00:22:16,570
It actually came in handy because the whole Iraqi invasion having the first system not working was actually organized through emails.

264
00:22:17,430 --> 00:22:27,450
USA was at war in the sense that through the email coming from the BFT system, they were capable to finally coordinate their own action.

265
00:22:29,570 --> 00:22:31,570
This was the past.

266
00:22:32,090 --> 00:22:33,310
Now, a question for you.

267
00:22:33,310 --> 00:22:37,210
To the one who is going to answer to me, I'm going to give a T-shirt.

268
00:22:37,210 --> 00:22:38,130
What is this?

269
00:22:39,090 --> 00:22:40,530
Can you tell me what is this?

270
00:22:43,650 --> 00:22:44,490
Excuse me?

271
00:22:45,690 --> 00:22:46,650
What is it?

272
00:22:47,890 --> 00:22:48,510
A trigger.

273
00:22:48,510 --> 00:22:49,250
No, no, no, no, no, no.

274
00:22:49,250 --> 00:22:49,910
Not a landmine.

275
00:22:49,910 --> 00:22:50,770
No, no, no, no, no.

276
00:22:53,390 --> 00:22:53,930
No?

277
00:22:55,550 --> 00:22:56,570
No, diesel pump?

278
00:22:56,570 --> 00:22:57,290
No, no, no, no?

279
00:22:57,730 --> 00:22:59,050
You have it in your kitchen.

280
00:22:59,050 --> 00:23:00,530
You have diesel pumps in your kitchen.

281
00:23:00,530 --> 00:23:01,310
What are you doing?

282
00:23:03,970 --> 00:23:05,030
What, what?

283
00:23:06,610 --> 00:23:07,530
Microwave?

284
00:23:09,410 --> 00:23:10,330
Magnetron.

285
00:23:11,670 --> 00:23:13,690
Please, it's a magnetron.

286
00:23:13,690 --> 00:23:17,530
And you have it in your microwave oven.

287
00:23:17,570 --> 00:23:28,670
And it's a system that can be used actually to disrupt direct microwave beams as it was used in the Iraq invasion.

288
00:23:28,670 --> 00:23:33,090
We will see later some other examples how to use such thing.

289
00:23:33,090 --> 00:23:35,970
Anyway, this was the past.

290
00:23:35,970 --> 00:23:41,150
And US Army actually didn't want to experience anymore such problem.

291
00:23:41,150 --> 00:23:46,110
No bandwidth, no connectivity, no tactical data, equal death.

292
00:23:46,170 --> 00:23:55,370
So they decided to develop a new system which is called FCS, which stands for Future Combat System.

293
00:23:55,370 --> 00:24:01,490
And it is a 21 billion dollar program but it is going to be upgraded already.

294
00:24:01,490 --> 00:24:04,930
It's exactly in the middle of its own development.

295
00:24:04,930 --> 00:24:06,710
It's not science fiction.

296
00:24:06,710 --> 00:24:09,270
Some prototypes have been already developed.

297
00:24:09,610 --> 00:24:19,470
And this is the system which is meant to totally substitute the way the US is doing the war in the future.

298
00:24:21,490 --> 00:24:22,970
In which way?

299
00:24:23,610 --> 00:24:26,570
We will come to the hacking part later, don't worry.

300
00:24:28,150 --> 00:24:33,330
The old war concept was that you should have heavy war equipment.

301
00:24:33,330 --> 00:24:38,270
The big Abram tank with having massive fire powers.

302
00:24:38,270 --> 00:24:41,490
I want to shoot once and I want to kill them all.

303
00:24:43,250 --> 00:24:45,170
Large battlefronts.

304
00:24:45,170 --> 00:24:48,050
Full division deployed on the territory.

305
00:24:48,230 --> 00:24:50,950
Let's occupy, hit, destroy.

306
00:24:52,350 --> 00:24:58,450
Having low tech infantry because high tech infantry cost a lot.

307
00:24:58,770 --> 00:25:05,330
And of course having vehicles which were driven by real people.

308
00:25:05,330 --> 00:25:09,590
Now, under the FCS program things are going to be changed.

309
00:25:09,990 --> 00:25:14,390
Not anymore heavy war equipment, but light war equipment.

310
00:25:14,390 --> 00:25:20,170
Instead of the big Abram tank, they are going to develop small, lighter tank.

311
00:25:21,790 --> 00:25:24,850
Faster than the Abram one.

312
00:25:24,890 --> 00:25:29,330
Having not a massive fire power, but having a minimal fire power.

313
00:25:29,550 --> 00:25:36,390
But they are so fast that they can shoot you and then move and shoot you again and then move and shoot again and again and again.

314
00:25:36,390 --> 00:25:39,990
Like if you are surrounded by a lot of bees.

315
00:25:39,990 --> 00:25:41,230
Basically you don't know.

316
00:25:41,670 --> 00:25:47,630
You are going to get hit from a lot of different directions .

317
00:25:48,070 --> 00:25:58,010
Instead of a large division of soldiers deployed on the territory, they are going to deploy small families, called families of soldiers.

318
00:25:58,010 --> 00:26:04,110
Typically in 12 12 people unit.

319
00:26:04,930 --> 00:26:09,090
So I put 12 people here, 12 people there, 12 people there.

320
00:26:09,190 --> 00:26:12,830
If you know where they are, they are very much vulnerable.

321
00:26:13,110 --> 00:26:14,670
You can kill them very easily.

322
00:26:14,670 --> 00:26:16,050
But there is a trick.

323
00:26:16,350 --> 00:26:18,570
We have a large use of intelligence.

324
00:26:18,570 --> 00:26:20,170
What does it mean?

325
00:26:20,170 --> 00:26:37,150
It means that I must be capable to supply through the FCS system information, immediate information, to the people, to the troops deployed on the battlefield, so that even if they are small families of soldiers, they will be constantly aware about what is going on.

326
00:26:37,270 --> 00:26:49,530
And the trick is that when the enemy thinks that they identified our troops, we are already capable to understand it, we move the troops somewhere else, and we hit the enemy.

327
00:26:49,530 --> 00:26:52,690
And then we are going to move them and again and again and again.

328
00:26:53,570 --> 00:26:57,210
And finally, having a large use of automatic vehicles.

329
00:26:59,030 --> 00:27:00,730
We have some examples here.

330
00:27:00,730 --> 00:27:03,390
Public data from globalsecurity.org.

331
00:27:03,390 --> 00:27:11,690
Some of them, especially the one in the box, you already saw the drones, the spy drones, they are already in force.

332
00:27:11,770 --> 00:27:13,810
Some other are prototypes.

333
00:27:13,810 --> 00:27:18,290
You can see also the size of the vehicle compared to the human being.

334
00:27:18,290 --> 00:27:22,170
They are much smaller than what we were used to see a long time ago.

335
00:27:23,290 --> 00:27:26,910
And these are the working prototypes of combat drones.

336
00:27:27,190 --> 00:27:41,910
In our comic, our heroes, they have to actually get rid of one of these combat drones which gets hijacked by an enemy's hacker, and it's used against its own troops.

337
00:27:43,830 --> 00:28:00,930
Now, always from public data, we can see that this is the timing, the Gantt diagram, basically, on how the FCS is meant to be deployed in the following years, when they developed this in 2001.

338
00:28:01,010 --> 00:28:11,570
And one thing you can note, it is that it's saying that the problem, actual problem, is that there is a lack of artificial intelligence.

339
00:28:11,570 --> 00:28:17,150
So they are drones, but they have limited capability of understanding the surroundings.

340
00:28:17,150 --> 00:28:29,970
Which means they can drive around by themselves, but in combat situations, if you have the risk to kill one of your own soldiers, better not to take such risk.

341
00:28:29,970 --> 00:28:33,230
Such vehicles will be taken over by a U.S.

342
00:28:33,230 --> 00:28:44,110
Army soldier, and they will be remotely controlled by him, which will actually tell to the drone where to shoot and how to shoot.

343
00:28:45,150 --> 00:28:58,390
Now, the question is, from the hacker point of view, to receive the signal, the control signal, it must be hooked to a network, and there is a network, we will see later.

344
00:28:58,750 --> 00:29:05,030
If there is a network, it means such thing is permanently connected and authenticated to the network.

345
00:29:05,490 --> 00:29:06,150
Good.

346
00:29:07,070 --> 00:29:17,850
But it can get, for example, it can get stuck into a hole or the wheels can blow up and the thing, the whole thing will be stopped in the middle of somewhere.

347
00:29:17,910 --> 00:29:21,290
So what if the enemy is going to put its own hands over it?

348
00:29:21,290 --> 00:29:25,130
It is dangerous to have a thing which is permanently connected to your network.

349
00:29:25,130 --> 00:29:28,030
Because the enemy can put the hands over the network.

350
00:29:28,070 --> 00:29:39,770
So I guess, I didn't find any reference, but I expect there are some, there might be some system to protect in such situation, like self-destroying system.

351
00:29:39,770 --> 00:29:43,090
Self-destroying, it doesn't mean it is going to be blown up.

352
00:29:43,110 --> 00:29:44,430
Because it might be dangerous.

353
00:29:44,430 --> 00:29:47,170
Because it might be close to your own soldiers.

354
00:29:47,290 --> 00:29:53,630
Self-destroying means that you will destroy the digital contents of the drones, leaving just basically a piece of art.

355
00:29:53,630 --> 00:30:00,130
You remember this, the American spy plane, which was landing on the Chinese island a few years ago?

356
00:30:01,170 --> 00:30:05,630
The American soldiers, before landing on the Chinese island, it was a spy plane.

357
00:30:05,630 --> 00:30:07,950
Basically, it was connected to the US Army network.

358
00:30:07,950 --> 00:30:12,670
They destroyed, not physically, but logically, all the content in the airplane.

359
00:30:13,030 --> 00:30:18,710
The Chinese authorities, they were capable to put their hands over a piece of hardware without the software.

360
00:30:18,710 --> 00:30:25,210
And you know better than me that if you have the hardware without the software, it's basically a little bit more than nothing.

361
00:30:26,990 --> 00:30:44,090
Now, then, if it has really such auto-destruction system, the smart hacker employed by the enemy might think ways to trigger the system of the self-destruction.

362
00:30:44,090 --> 00:30:50,010
Not doing it today, but doing it the day you need it and this thing is deployed on the battlefield.

363
00:30:50,090 --> 00:31:00,390
You are relying on its usage, but the hacker will actually destroy the content, triggering the self-destruction mechanism.

364
00:31:00,390 --> 00:31:03,810
Now , how this thing works?

365
00:31:03,810 --> 00:31:16,230
The FCS system, it is managed by a huge network, the largest network after Internet, actually, if I think, which is called Mosaic.

366
00:31:16,290 --> 00:31:24,550
Mosaic network, it is meant to manage the whole war infrastructure of US Army.

367
00:31:26,750 --> 00:31:36,070
Ships, submarines, airplanes, infantry, drones, everything will be connected somehow to this network.

368
00:31:36,170 --> 00:31:49,790
The network, the Mosaic network, it is meant to have a kind of quality of service feature based on the importance of the packet.

369
00:31:49,790 --> 00:32:00,970
If the packet is coming from the command and control center, this packet has priority in the mesh network because it is a mesh network.

370
00:32:01,310 --> 00:32:18,970
It means even if the network is congested, blocked somehow, overloaded, the packets coming from the high priority centers will be routed correctly to the end, having the other packets waiting for that.

371
00:32:18,970 --> 00:32:25,670
And in our comic, we can't say it here, but we can say it on the comic because the comic is science fiction.

372
00:32:25,670 --> 00:32:38,450
We actually imagine the way to exploit such a system just flooding it by high priority packets, by replicating them and saturating the network.

373
00:32:39,350 --> 00:32:40,130
Now,

374
00:32:43,370 --> 00:32:47,630
the FCS system, it is a system, a daring system.

375
00:32:47,630 --> 00:33:06,350
They already tried some of the pieces, some of the equipment and the network, it is TCP IP based and it's basically using traditional network equipment and several of the drones are actually Linux based.

376
00:33:06,350 --> 00:33:16,690
A miniaturized version of Linux of course, with harder stacks, maybe less holes, you never know.

377
00:33:17,630 --> 00:33:24,010
But it's still something which is public and based on public networking system.

378
00:33:24,970 --> 00:33:27,370
And now comes the problem.

379
00:33:27,710 --> 00:33:31,910
What I call the Apollo 13 effect.

380
00:33:31,910 --> 00:33:39,670
Do you actually know what was the real reason why the Apollo 13 had the problem?

381
00:33:39,670 --> 00:33:42,670
You remember that the oxygen tank exploded.

382
00:33:43,070 --> 00:33:46,070
If you know the reason, you can get a second T-shirt.

383
00:33:46,070 --> 00:33:51,370
Which was the real reason why the oxygen tank of the Apollo 13 exploded.

384
00:33:52,510 --> 00:33:54,890
Not communication problems.

385
00:33:55,390 --> 00:33:56,470
Wiring?

386
00:33:56,470 --> 00:33:57,210
Almost.

387
00:34:01,810 --> 00:34:02,770
Excuse me?

388
00:34:03,670 --> 00:34:06,790
A short in the oxygen center, but why?

389
00:34:10,360 --> 00:34:11,220
Electrical?

390
00:34:11,220 --> 00:34:12,340
Yes, almost.

391
00:34:12,340 --> 00:34:13,480
We are close.

392
00:34:20,380 --> 00:34:22,020
No, no, no, no.

393
00:34:22,020 --> 00:34:23,460
Well, if nobody is...

394
00:34:23,820 --> 00:34:24,820
You?

395
00:34:27,790 --> 00:34:29,150
No?

396
00:34:29,150 --> 00:34:31,070
No?

397
00:34:31,070 --> 00:34:32,390
Voltage.

398
00:34:32,750 --> 00:34:34,270
Voltage.

399
00:34:35,270 --> 00:34:39,310
The Apollo 13 project was a huge project.

400
00:34:40,010 --> 00:34:45,390
A lot of suppliers Rockwell, Boeing, and so on.

401
00:34:45,390 --> 00:34:48,430
They were helping NASA to develop the systems.

402
00:34:49,070 --> 00:35:03,350
From Apollo 12 to Apollo 13, the difference is that they decided to increase the voltage which was used to run the systems in the Apollo 13.

403
00:35:04,070 --> 00:35:10,890
So all the developers, all the subcontractors, they were informed, of course, except one.

404
00:35:11,190 --> 00:35:12,230
Rockwell.

405
00:35:13,270 --> 00:35:19,290
And, which is by the way, one of the subcontractors of the SCS system, but anyway.

406
00:35:19,570 --> 00:35:26,770
Not being informed about such increase in the voltage, they were supplying the oxygen tank and it blown up.

407
00:35:26,770 --> 00:35:29,530
Because it was overloaded by voltage.

408
00:35:30,230 --> 00:35:32,030
You can get the T-shirt anyway.

409
00:35:33,470 --> 00:35:35,590
Now, why it happened?

410
00:35:35,590 --> 00:35:36,630
It's actually normal.

411
00:35:36,630 --> 00:35:43,110
In my experience, when I work besides Zone H, I do penetration tests with my own company.

412
00:35:43,130 --> 00:35:55,750
And one of the things I noticed is when you have complex systems made up, for example, by different subcontractors, the implementation of such systems it is introducing more vulnerabilities.

413
00:35:55,750 --> 00:36:01,430
Rockwell was one of a new vulnerability for the Apollo 13 program.

414
00:36:02,030 --> 00:36:15,110
Now, I expect given the fact that we have FCS being a consortium much bigger than the Apollo 13 one of company, mostly American company.

415
00:36:15,230 --> 00:36:17,550
The leader of the consortium is Boeing.

416
00:36:17,550 --> 00:36:27,290
You can see actually advertising on CNN in these days, not specifically related to the FCS system, but the images they are showing are belonging to the FCS system.

417
00:36:27,770 --> 00:36:32,730
So the general public start to be aware about such system.

418
00:36:33,830 --> 00:36:47,510
The Apollo 13 sorry, the FCS system, it is led by Boeing, having also a large consortium of company to be actually managed as a project manager.

419
00:36:47,830 --> 00:36:55,490
We can say actually Boeing is the FCS project manager on behalf of the Department of Defense.

420
00:36:57,350 --> 00:37:01,750
Now, how does it work?

421
00:37:01,750 --> 00:37:02,310
The U.S.

422
00:37:02,310 --> 00:37:03,810
Congress tell to U.S.

423
00:37:03,810 --> 00:37:05,910
Army, yes, you have to develop a new system.

424
00:37:05,910 --> 00:37:10,810
They assign a budget and then they name a project leader, Boeing.

425
00:37:11,310 --> 00:37:16,030
Then the system are divided in subsystems and in consortium.

426
00:37:16,030 --> 00:37:22,270
There is the consortium of companies which are developing robotics, artificial intelligence.

427
00:37:22,270 --> 00:37:27,130
Then there is a consortium of companies which is developing unmanned vehicles.

428
00:37:27,130 --> 00:37:31,790
Another consortium of companies which is developing weaponry, and so on.

429
00:37:31,790 --> 00:37:36,050
Each company has to report to Boeing how things are going on.

430
00:37:36,710 --> 00:37:41,470
And of course, each consortium itself has a consortium leader.

431
00:37:41,470 --> 00:37:49,530
The consortium leader has to act as a sub project manager to the rest of the companies belonging to the same consortium.

432
00:37:50,530 --> 00:38:07,810
Each consortium and each company in the consortium has its own project manager, internal company project manager, who has to lead the activity of the programmers, for example, which are developing within the company a particular piece of the SES system.

433
00:38:08,010 --> 00:38:22,370
Now, you can imagine, if you add all the programmers, each programmer developing the system, by the way, FCS system, it is 31 millions of code, the software, 31 millions of lines of code.

434
00:38:22,370 --> 00:38:31,790
You can imagine how many conceptual and practical vulnerabilities there might be introduced by people who never developed, for example, such software, because nobody did it before.

435
00:38:31,790 --> 00:38:34,330
It is a totally new thing.

436
00:38:34,330 --> 00:38:49,630
And when a lot of programmers belonging to a company, which is put together with a lot of other different companies which are belonging to a consortium, which are put together with several other consortiums, are going, finally, to integrate what they produced,

437
00:38:49,630 --> 00:38:54,810
the software, you can imagine the huge amount of shit that can come out.

438
00:38:58,190 --> 00:39:14,250
Now, as a personal experience, and also analyzing the data coming from Zone H, we have one million of cyber crimes web defacement, let's call it web defacement, filed in our archives.

439
00:39:14,250 --> 00:39:19,790
For each, we know how it happened and the reason of the attacks.

440
00:39:20,930 --> 00:39:29,950
We can say, today, most of the hacks which we see every day, two and a half thousand servers hacked per day.

441
00:39:29,950 --> 00:39:33,130
This is the amount of data we are receiving at zoneh.org.

442
00:39:33,690 --> 00:39:38,910
80% of the time, the system is hacked through the application layer.

443
00:39:38,910 --> 00:39:41,730
And FCS system is mostly application.

444
00:39:42,230 --> 00:39:46,110
Now, I want to say they are better than the average.

445
00:39:46,110 --> 00:40:08,430
It will be vulnerable, maybe 40% on the application level, but still there are possible vulnerabilities to be introduced by the system integration, for example, the protocol might be bugged, the transmission protocol might be bugged, the hardware integration might introduce vulnerabilities and also,

446
00:40:08,430 --> 00:40:11,450
of course, information leakage.

447
00:40:11,730 --> 00:40:17,770
Hackers are actively looking to get information about the FCS.

448
00:40:17,770 --> 00:40:28,710
I met, personally, a guy in Rome which was representing US Navi and he was investigating on leaks.

449
00:40:28,710 --> 00:40:32,290
He didn't name to me the FCS system itself.

450
00:40:32,290 --> 00:40:47,010
He told me we are looking for information about hackers coming from the East Europe, stealing a piece of information about military software or military programs under development.

451
00:40:47,390 --> 00:40:52,110
Well, the only military program under development so far, big, is the FCS system.

452
00:40:52,110 --> 00:40:54,810
And no need to name it, actually.

453
00:40:54,810 --> 00:40:58,170
It was clear to me that they are having such problem already.

454
00:40:58,170 --> 00:41:06,770
There are spies who are actually using hacker means to get information about this new system.

455
00:41:15,140 --> 00:41:16,300
Now,

456
00:41:19,590 --> 00:41:31,830
if there are software problems, that might be software problems, again, read the comic and you will get a very good hint on how to hack the mosaic network.

457
00:41:33,130 --> 00:41:34,810
There are also other problems.

458
00:41:34,810 --> 00:41:43,310
First of all, the FCS system is organized following the lobbying standard procedure in the American way.

459
00:41:43,310 --> 00:41:49,390
So, the president got a lot of money for his campaign from Boeing.

460
00:41:49,390 --> 00:41:55,470
Therefore, Boeing, for example, doing some science fiction.

461
00:41:55,490 --> 00:42:04,430
Boeing is named as a project leader, but then also other people, they were sustaining the campaign, then they also have to have a little piece.

462
00:42:04,430 --> 00:42:10,170
So, it is not always distributed as it should be, the work.

463
00:42:10,850 --> 00:42:16,710
Lobbyism has a big part in the decision to which company assign a project or not.

464
00:42:16,970 --> 00:42:20,850
Then, the military software is not open sourced, of course.

465
00:42:20,850 --> 00:42:24,290
You know, Linux is the most audited code ever.

466
00:42:24,290 --> 00:42:26,890
Still, we are finding vulnerabilities.

467
00:42:26,910 --> 00:42:27,930
Still.

468
00:42:28,230 --> 00:42:29,470
Firefox.

469
00:42:30,550 --> 00:42:34,550
Everybody using Firefox because it was open sourced two years ago.

470
00:42:36,130 --> 00:42:42,670
I don't know anybody who was actually reading the source, but they were saying, oh, it's open sourced, so I can use it.

471
00:42:42,670 --> 00:42:43,770
It's safe.

472
00:42:43,770 --> 00:42:46,810
But still, are coming out new vulnerabilities.

473
00:42:47,110 --> 00:42:48,670
Because it's open sourced.

474
00:42:48,670 --> 00:42:53,690
A closed source platform, basically it is a never audited platform.

475
00:42:53,710 --> 00:42:56,530
Because who is going to audit the FCS system?

476
00:42:56,530 --> 00:42:58,430
The same people who are developing it.

477
00:42:58,430 --> 00:43:02,570
And you know better than me that you can't audit your own job.

478
00:43:03,170 --> 00:43:09,430
The job should be outsourced by somebody else, but because it's military, you can't do it.

479
00:43:09,430 --> 00:43:17,450
Therefore, I expect, by my experience, to find a lot of vulnerability in the application level and within the lines.

480
00:43:19,170 --> 00:43:33,230
Then, if the FCS system is leading your troops on the battlefield, losing somehow connectivity, or being hacked, leads to a lot of trouble.

481
00:43:33,230 --> 00:43:37,270
Because you don't have anymore a large battlefront which is capable to defend itself.

482
00:43:37,270 --> 00:43:41,370
Now you have small families of soldiers, 12 soldiers, dispersed in the territory.

483
00:43:41,370 --> 00:43:44,190
They don't get shit from the satellite or information.

484
00:43:44,190 --> 00:43:45,110
They don't know where they are.

485
00:43:45,110 --> 00:43:46,490
They don't know where the enemy is.

486
00:43:46,490 --> 00:43:50,350
They don't get the command from the command and control center.

487
00:43:50,350 --> 00:43:51,550
They don't know what to do.

488
00:43:51,550 --> 00:43:52,690
They are blind, basically.

489
00:43:52,690 --> 00:43:56,770
They are slow, because they are without heavy equipment.

490
00:43:56,770 --> 00:44:00,470
And they are a very vulnerable target.

491
00:44:01,070 --> 00:44:16,730
Now, if I am an enemy of the United States today, definitely I would start a program for collecting as much information as I can about such FCS system.

492
00:44:16,730 --> 00:44:25,730
Because nobody can fight against the United States using the same system, because you need a lot of money.

493
00:44:25,730 --> 00:44:30,890
There is no symmetric power as an enemy for the United States.

494
00:44:30,890 --> 00:44:39,190
The only way you can fight the United States, if the United States is adopting such a system, is to use asymmetric ways.

495
00:44:39,190 --> 00:44:49,790
And one of the ways is to hack the servers of the companies which today are going to develop such a system, and to try to steal information.

496
00:44:49,790 --> 00:45:11,370
And one of the things which we did, we were imagining to be I don't know, hackers coming from North Korea, or hackers coming from Iran, and to see how much of information we could find on the Internet to hack the system.

497
00:45:14,300 --> 00:45:15,820
It's not done.

498
00:45:19,280 --> 00:45:20,000
So...

499
00:45:20,820 --> 00:45:26,940
This is a question I put there, just a little forward to the question.

500
00:45:26,960 --> 00:45:32,680
The most vulnerable system, as everybody knows, is our brain, right?

501
00:45:32,680 --> 00:45:33,960
So it's the human being.

502
00:45:33,960 --> 00:45:39,780
The human being with all its vulnerabilities and its ways to be bought or exploited.

503
00:45:39,900 --> 00:45:43,220
So, that's why I put this question there.

504
00:45:43,220 --> 00:45:48,840
Who are the best security-aware managers or people in the world's history?

505
00:45:49,700 --> 00:45:50,920
The Pharaohs.

506
00:45:51,220 --> 00:45:56,800
They got a lot of people to build the pyramids and then at the end they killed them all.

507
00:45:56,800 --> 00:46:01,960
I didn't find any slide with the people being killed afterwards, so I didn't put it, but that's the thing.

508
00:46:02,520 --> 00:46:05,120
So, we cannot do it now.

509
00:46:05,360 --> 00:46:11,400
The right way would be we build a future combat system and then we kill everybody that build it.

510
00:46:11,400 --> 00:46:14,560
Then we wouldn't have anybody to maintain it, but that's not a problem.

511
00:46:14,860 --> 00:46:17,180
It's illegal, but what the hell.

512
00:46:18,880 --> 00:46:25,120
So, this is just to explode what I was saying before.

513
00:46:25,460 --> 00:46:31,500
This slide, I borrowed it from a Swedish study from a university there.

514
00:46:31,500 --> 00:46:32,840
That's actually pretty...

515
00:46:32,840 --> 00:46:37,100
I liked it very much because it explains all the phases of the conflict.

516
00:46:37,180 --> 00:46:46,380
You have the mechanical war at the center, which is big armies facing each other with the guns and going forward and shooting and everybody falls down.

517
00:46:46,380 --> 00:46:49,420
At the end, only one soldier remains and that army won.

518
00:46:50,060 --> 00:46:52,600
There was the old way to fight.

519
00:46:52,600 --> 00:46:56,360
Then you have the dirty war, which is terrorism or resistance war.

520
00:46:56,360 --> 00:46:57,860
Depends from the viewpoint.

521
00:46:58,000 --> 00:46:59,360
If you win, it's resistance.

522
00:46:59,360 --> 00:47:01,200
If you lose, it's terrorism.

523
00:47:01,940 --> 00:47:11,280
Then you have peace war, which is the war that was fought between the Eastern Bloc and the Western Bloc when there was the Soviet Union.

524
00:47:11,580 --> 00:47:17,280
And the systemic war, which is the war that can be fought only by the United States right now, which has the money.

525
00:47:17,280 --> 00:47:24,540
It's the big difference between all the other types of war and systemic war is money and the other wars are people.

526
00:47:24,540 --> 00:47:25,800
More people, more money.

527
00:47:27,160 --> 00:47:30,940
And, you know, little windows that you can hit with the intelligent bombs.

528
00:47:31,040 --> 00:47:32,440
And then you have the ICT war.

529
00:47:32,440 --> 00:47:50,060
ICT war is a type of dirty war which can be fought only by subjects which have the capability or which are linked, which have a high technological situation in their countries and can be fought only against another country which has the same situation.

530
00:47:50,060 --> 00:47:54,720
For example, you cannot fight an ICT war against Iran because they have only two servers, I think.

531
00:47:54,860 --> 00:48:02,460
Last time I checked, it was a couple of mail servers in the mines and whatever ministry, etc.

532
00:48:02,460 --> 00:48:07,080
They don't have anything on the nuclear side, so that's unfortunate for the intelligent people here.

533
00:48:07,960 --> 00:48:15,240
And but you can fight an ICT war between, I don't know, I'm just doing fiction, Japan and whatever, Korea.

534
00:48:15,240 --> 00:48:19,020
They are not at war, but if they would, that would be the thing.

535
00:48:19,480 --> 00:48:26,320
So if you want to, this is taken from a book which is called Unrestricted Warfare.

536
00:48:26,320 --> 00:48:31,820
I think everybody that has some interest in this has read it.

537
00:48:31,820 --> 00:48:38,860
It was first translated by the CIA and then it was retranslated again because there were some points which were not totally clear.

538
00:48:39,160 --> 00:48:52,340
And they were the first that unrestricted because they hypothesized that any kind of means to fight a war, there are no rules in fighting a war, which means that you can do just about anything.

539
00:48:52,340 --> 00:48:54,920
The important thing is the result, to win.

540
00:48:55,920 --> 00:49:07,200
And they were the first to say that one of the best means to fight a war would be through electronic means, exploiting the electronics and the telematics.

541
00:49:08,680 --> 00:49:11,180
So, future combat system.

542
00:49:11,180 --> 00:49:20,150
This is all the material you will see from here on up to the last slide, which is done by some, I think, Accenture.

543
00:49:20,480 --> 00:49:23,820
They are all being taken from open source.

544
00:49:23,960 --> 00:49:25,400
Nothing has been hacked.

545
00:49:26,200 --> 00:49:27,000
Right?

546
00:49:27,880 --> 00:49:29,040
Okay.

547
00:49:30,320 --> 00:49:36,660
So, this is the distribution of the consortiums that work on the future combat system.

548
00:49:36,660 --> 00:49:42,460
So, if you want to do research from an intelligence point of view, you start from here.

549
00:49:42,460 --> 00:49:45,760
You see who is working for whom and on what.

550
00:49:46,080 --> 00:49:48,020
And then, you get...

551
00:49:49,480 --> 00:49:50,480
Wow!

552
00:49:50,480 --> 00:49:55,580
You get all the companies that work on what project and where they are located.

553
00:49:57,380 --> 00:50:00,300
One, two, three, four pages.

554
00:50:00,300 --> 00:50:01,140
Wow!

555
00:50:01,840 --> 00:50:02,880
Wow!

556
00:50:02,880 --> 00:50:03,940
What's that?

557
00:50:04,360 --> 00:50:06,740
You get all the...

558
00:50:06,740 --> 00:50:08,180
What is this?

559
00:50:10,020 --> 00:50:23,160
So, this is the specific project that has been assigned, the description of the project, the company and other little information about that.

560
00:50:23,200 --> 00:50:26,760
And then, you have one, two and here you go.

561
00:50:27,060 --> 00:50:35,500
So, this is all you need, actually, to do what you need to do if you want to start fighting this future combat system.

562
00:50:35,600 --> 00:50:47,500
You have the companies, you have the projects, you have the project managers, the people, the ICs, their email address, their email service and their phone number.

563
00:50:47,720 --> 00:50:49,460
So, what else do you want?

564
00:50:49,460 --> 00:50:54,080
We have two pages of that as an example because we didn't want to make the presentation too long.

565
00:50:55,120 --> 00:51:07,360
So, you know, of course, that if you have already an email address of a person, you can do a lot of things from remote because you can use modern Trojan horses technologies or things like that.

566
00:51:07,360 --> 00:51:17,320
And I assure you that in the industrial espionage business, which is a business right now, this type of methods and exploiting is being used constantly.

567
00:51:17,580 --> 00:51:19,620
And it is very well paid.

568
00:51:19,900 --> 00:51:21,220
Very well paid.

569
00:51:22,100 --> 00:51:30,780
In the other hand, if you don't have the technical capability, you can just send a person with a bag full of money and you just find out how much one of these people costs.

570
00:51:30,780 --> 00:51:31,820
Maybe he's not happy.

571
00:51:32,220 --> 00:51:35,040
How people are bought in companies.

572
00:51:35,040 --> 00:51:36,580
Maybe you didn't get your promotion.

573
00:51:36,580 --> 00:51:38,680
Maybe your boss was too harsh on you.

574
00:51:38,680 --> 00:51:42,380
Maybe, I don't know, your wife left you and then you are not happy.

575
00:51:42,380 --> 00:51:48,680
And then this person comes near to you at the bar and says, you are better than that.

576
00:51:48,680 --> 00:51:52,220
I think you should do something for a better cause.

577
00:51:52,220 --> 00:51:54,100
Here is $10,000.

578
00:51:54,120 --> 00:51:55,520
$10,000 is not too much.

579
00:51:55,520 --> 00:51:56,800
Here is $20,000.

580
00:51:57,000 --> 00:51:59,840
At the end, somebody says, okay, let's do it.

581
00:52:00,920 --> 00:52:06,580
So, another thing, which you can see here, is a system like the future combat system.

582
00:52:06,620 --> 00:52:07,640
What can exploit it?

583
00:52:07,640 --> 00:52:09,720
We said before, I mean, you just need to jam it.

584
00:52:09,720 --> 00:52:11,200
You don't need to hack it, actually.

585
00:52:11,200 --> 00:52:13,560
Because hackers are perfect.

586
00:52:13,560 --> 00:52:15,540
They want to do things.

587
00:52:16,120 --> 00:52:18,360
It's the act of hacking, which must be.

588
00:52:18,360 --> 00:52:20,500
It's not always the result.

589
00:52:20,500 --> 00:52:24,960
You want to do that thing and then you say, okay, it's easy to do it.

590
00:52:24,960 --> 00:52:32,160
The easy thing is for no good shit, you say in America.

591
00:52:32,180 --> 00:52:34,740
I want to do it in a very artistic way.

592
00:52:34,740 --> 00:52:39,520
Maybe you take six months and you never get the result because it's too old by the time you get the result.

593
00:52:39,860 --> 00:52:42,700
So you just sometimes need to jam something.

594
00:52:42,700 --> 00:52:44,280
The communication, for example.

595
00:52:44,280 --> 00:52:50,760
In this case, you have an EMP shock generator, which is an electromagnetic pulse shock generator.

596
00:52:50,760 --> 00:52:52,380
It's a bomb, basically.

597
00:52:52,440 --> 00:52:59,380
You can rent it for research and discovery or research and development purposes, if you can prove you are a researcher.

598
00:52:59,600 --> 00:53:03,440
And a lot of people can prove it for $1,500 a month.

599
00:53:03,440 --> 00:53:07,840
And then you can have the option to buy it for $11,000 afterwards.

600
00:53:09,760 --> 00:53:11,160
So this is public.

601
00:53:11,160 --> 00:53:13,740
I mean, if you want to buy it, I thought about it, actually.

602
00:53:15,580 --> 00:53:20,900
You put it in the middle of a square somewhere and then you activate it.

603
00:53:20,900 --> 00:53:24,900
You run very fast because you need to get about three miles far.

604
00:53:24,900 --> 00:53:30,060
And then everything in three miles just burns out.

605
00:53:30,060 --> 00:53:36,220
Every circuit and all the people that are around the bomb also get suntanned a little bit.

606
00:53:37,500 --> 00:53:49,060
So this I put because in the company where I work for, there are a lot of consultants which are being paid a lot of money to do things like that.

607
00:53:49,200 --> 00:53:51,900
This is a security management learning model.

608
00:53:52,000 --> 00:53:56,720
And it's supposed to tell you how to do security in a company or whatever.

609
00:53:57,220 --> 00:54:10,620
And from my experience, all the things that we just said and all the things that we saw in the past, I can tell you that this is just if you work for a company, just don't pay people to do things like that.

610
00:54:10,620 --> 00:54:13,440
They are very good if you want to make a big picture.

611
00:54:13,440 --> 00:54:18,960
We say in Italy, if you want to wrap fish, you go and buy fish and you need paper to wrap it.

612
00:54:19,060 --> 00:54:20,820
That's the thing.

613
00:54:20,820 --> 00:54:23,140
So sorry if there is any big consultant in here.

614
00:54:23,140 --> 00:54:25,940
And if you have any questions, we don't have enough time.

615
00:54:25,940 --> 00:54:27,560
So just write us an email.

616
00:54:28,260 --> 00:54:28,920
Okay?

617
00:54:32,620 --> 00:54:34,560
You can come here.

618
00:54:34,660 --> 00:54:36,440
We have the CD with the comic.

619
00:54:36,440 --> 00:54:37,140
You can get it.

620
00:54:37,140 --> 00:54:47,900
And by the way, it was supposed to be signed by the Dark Tangent but you know the little Cisco problem he had in the Black Hat was keeping him busy.

621
00:54:47,900 --> 00:54:53,900
So basically he will sign it just if you show up yourself with a CD he will sign it.

622
00:54:53,900 --> 00:54:54,640
We'll be happy to sign it.

623
00:54:54,640 --> 00:54:55,820
CDs are there.

624
00:54:56,080 --> 00:54:58,620
And we have a few keystraps here.