start	end	text
3800	5640	Actually, we are back to DEF CON.
13570	16050	After two years, we are back to DEF CON.
16050	19730	And this year, we wanted to talk about something new.
19730	22450	Actually, also two years ago, we were talking about something new.
24950	27890	We will talk about asymmetric digital warfare.
28710	32550	What is it? What is the point today?
33430	35030	What will happen in the future?
35030	37610	And we will take a very good example,
37610	42410	which is the Department of Defense FCS program,
42410	45430	which stands for Future Combat System.
46870	49610	Before starting, I want to tell you that
49610	52630	you will not get all the information you need
52630	55630	out from this speech directly,
55630	58050	because the speech comes together
58050	62410	with the release of the second episode of our comics.
62550	66050	If you go on zoneh.org website,
66050	69050	we already published, one month ago,
70050	74550	the first sample, actually, of Hacker Comics ever,
74550	76950	which was quite successful,
76950	80030	and I suggest you to go there and download it.
80030	81290	It's for free, of course.
82570	85430	And the second episode, it is complementary
85430	88830	to the speech we are going to have today.
88830	91590	If you want to understand everything what we are going to talk,
91590	95030	and if you want to get even more deep examples,
95030	97670	you definitely have to go, either to download
97670	100390	the comic from our website,
100390	104470	or we will distribute later, to all of you,
104970	109290	a CD, which is actually, was signed originally also by us.
109290	111970	We are the authors of the comic.
111970	117050	And this is the PDF file containing the comic book.
118370	122930	There will not be any questions and answers section.
122930	123970	We don't have the time,
123970	126230	but we will ask you a couple of questions.
126230	128030	To those who are capable to answer,
128590	132150	we will give a nice T-shirt,
132150	136830	with the cover of our comic book,
136830	138070	which is that one.
139210	141570	Anyway, my name is Roberto Preatoni.
141570	144230	I am the founder of zonedge.org,
144230	148130	which is the last mirror,
148130	150230	the defacement mirror archive.
150230	151490	All of the others, they closed.
151490	152610	It's a hell of a job to do it.
152610	154430	Maybe the next year in DEF CON,
154430	155830	I will try to explain to the people
155830	158150	what is a mirror archive,
158150	160590	the reason of existing of such thing,
160590	164010	and the efforts which are behind.
164250	165790	But not today.
166230	167250	First of all, the credits.
167250	168950	I have to give two credits.
168950	172570	The first credit goes to the MIT Technology Magazine.
172570	174890	I was on vacation the last year.
174890	176270	I was reading a very good article
176270	178630	on the MIT Technology Magazine.
178670	180730	And this article brought to my attention
180730	184970	the problem that the American army
184970	188950	had during the Second Gulf War.
189450	191530	We will see what kind of problems.
191770	194650	And the second credit,
194650	196850	I want to credit globalsecurity.org.
196850	198670	It is a very nice website.
198670	201070	You can get any kind of possible information
201070	202790	about military system.
202950	205870	You can spend years downloading material
205870	207690	and watching stuff.
207690	208770	Of course, most of the things
208770	210810	are traditionally military weapons.
210810	212910	But due to the fact that the FCS,
212910	213890	Future Combat System,
213890	217930	it is a known program under development,
217930	219130	you can find also references
219710	221810	on globalsecurity.org.
223570	226550	Another thing I want to say before starting,
226550	229570	it is all the material you will find here,
229570	232010	and on the slide which you have on your CD, I guess.
232070	233310	It's public.
233330	234870	We didn't hack anything.
234870	236370	So you can get it by yourself.
236370	238790	If Johnny Lang is around,
238790	240350	he can teach you how to use Google
240350	242930	in the proper way to download such material
242930	244410	and to find it.
244770	246670	First of all,
246670	248670	there are several good reasons
248670	251350	to download Zone H comic
252050	254290	beside the fact that it is necessary
254290	256170	to understand our speech.
256850	259030	We have the Dark Tangent,
259030	260870	DEFCON's mastermind,
260870	262670	himself playing as a guest star
262670	265350	in the comic.
265350	267350	And the second reason,
268070	269330	you can see my ass,
269330	270010	basically.
271750	273330	Which, I don't want to tell you
273330	275430	it's even better than the first reason,
275430	276450	but up to you.
276450	277830	Actually, I don't have it so flat,
277830	279350	it's a little bit more rounded.
283130	286350	My friend here is Fabio Ghioni,
288550	294550	and he is one of the best experts
294550	297890	in asymmetric warfare,
297890	298970	anti-terrorism.
298970	300750	If you read his CV,
300750	301890	it's very long.
302530	303770	You can get it actually
303770	306170	from the DEFCON website.
306710	308410	Actually, it's your turn.
308410	310030	We will talk a little bit me,
310110	311070	a little bit him.
311990	313790	Now it's a little bit me.
314590	316450	So, asymmetric warfare.
316450	318510	I don't want to bore anybody
318510	320570	with conventional things,
320570	322870	but some things must be said before.
323550	325690	And there are a lot of things
325690	327490	which are misunderstood.
327490	328750	For example,
328750	331030	the definition of asymmetric warfare
331030	333110	and the definition of unconventional.
333650	335070	For unconventional,
335070	337110	so you understand the rest of the speech, of course.
337110	339910	For unconventional weapons,
339910	342350	or unconventional means,
342350	343330	I give you an example.
343330	344490	You have a fork.
344870	346790	A fork you use it to eat, of course,
346890	347770	a steak or whatever.
347770	349390	Then an unconventional use of this fork
349390	351710	is to stick it in the eye of this guy over here.
352150	354190	So, that's a thing.
355050	356110	Then there is another thing,
356110	357530	an image, a very good drawing
357530	359170	that I saw in a newspaper
359390	360690	a few years back, where there was
361290	362430	a big marine soldier
362430	365810	and a small, I would say, Iraqi guy.
365810	368290	You know, these drawers on newspapers.
368590	369530	And the small Iraqi guy
369530	370830	said, you know,
371330	372810	huge marine soldier with
372810	374090	full of weapons everywhere
374090	377490	and millions of dollars of research.
377490	378410	And the small Iraqi guy
378410	380430	with some sand in his hand,
380430	382830	threw the sand in the eyes of the big soldier.
382830	385470	And he said, ah, that's not fair, that's unconventional.
385770	387770	So, that's unconventional.
387770	388850	And then asymmetric.
388850	391890	For asymmetric, there is a thing very interesting.
391930	392810	When I was in Cuba
392810	394110	about a year ago
394110	397410	to see Ramiro Valdez.
397410	399510	Ramiro Valdez is one of the heroes of the revolution
399510	400630	in Cuba.
401490	402970	Hero in Cuba.
402970	404990	Not everywhere else, of course.
404990	407350	And I remember that he said
407350	409010	among other things, he said,
409010	410970	ah, Americans, they invented the term
410970	412970	asymmetric because they want to
412970	415030	invade us and they say that we are preparing
415030	417170	for asymmetric warfare. Actually, they are not
417170	419110	because they don't have even lines, phone lines
419110	420510	to get connection
421230	422470	on the internet. But
423130	424890	that's one thing.
424970	426950	And what does that mean?
426950	428790	That a country,
428790	431010	it means that a country that doesn't have the means
431010	432990	to combat the war, which is
432990	434950	systemic, which is a huge
434950	437110	expensive war, uses
437890	438950	whatever it has
438950	441070	unconventional means. That is one
441070	443150	of the meanings of asymmetric. The other thing is
443150	444710	for example, Islam
445330	447270	and a nation, like for example
447270	449110	the USA or another nation.
449110	450990	So if you have France against Germany,
450990	452970	it's symmetric. You have territory,
452970	454770	you have people, you have whatever, a nation
454770	457010	against another nation. If you have
457010	459290	Islam, Islam is scattered everywhere.
459290	460550	You can have people working
460550	462610	in your country.
462730	464490	You can have people
464490	466910	everywhere. That's asymmetric.
466910	468570	Religious matters and everything
468570	469810	like that.
470830	471430	So...
473570	474490	when it is
474490	475950	used, this is...
475950	477830	I just basically explained it.
478570	480770	When you are invading a
480770	482570	country or you are combating
482570	484690	an enemy which has means
484690	486770	which are too big to be
486770	488170	compared to, like for example, the
488170	489930	United States right now is the only country
489930	492370	which can fight a systemic war, which is a war
494310	496130	where you have like bombs, intelligent
496130	498090	bombs. Hit the third window
498090	500070	on the left on the 20th floor and
500070	502050	kill the man who is taking
502270	504250	a pee in that moment. But don't kill the cat
504250	506310	that is in the room. So that's
507850	508250	intelligent
508250	510030	bomb. Then if you kill the cat,
510030	512070	it says, shit, it didn't work, so we didn't spend that
512070	513670	much money. And
515230	516210	the country where
516210	518110	this man is and he is taking a pee and the cat
518110	520390	was killed but he didn't have to be killed, etc,
520390	522170	etc, they don't have the money to
522170	524310	fight this war, so they use whatever they have.
524830	525770	So it's called
526590	528250	asymmetric. It's also called dirty war.
528250	529630	It's called it in many ways.
534760	535200	So,
535200	537080	for example, did
537080	539040	everybody see the Black Hawk Down movie?
539680	540980	So whoever didn't see it, I mean
540980	543040	that's a very famous
543040	544720	or very important
544720	547460	example of
548120	550040	asymmetry in a war.
550540	551540	Okay? And the use
551540	553520	of unconventional means. So you have this
554340	554820	big
556740	557220	Sikorsky
557220	559260	helicopter, which is very
559260	561360	expensive and it costs a lot of money
561360	563780	in research and development.
563880	565820	You have soldiers, you have weapons,
565820	567480	you have maintenance.
567820	569520	I mean, you would never believe how much
569520	571320	it costs to maintain
571320	573500	an helicopter after 100 hours of
573500	575060	flight. It must be maintained for
575600	577180	a lot of million dollars again.
577200	579060	So you have all this thing and then you had
580240	581000	a little boy
581780	583280	with, you know,
583440	585500	a watch and a cell phone.
585500	587860	Actually it was a satellite phone.
587880	589000	And he saw the helicopters coming
589000	591060	and he called the guys on the base and he said,
591060	593140	they are coming. And the
593140	596180	whole thing went, you know,
596180	597100	went like that.
597100	598880	The Black Hawk went down and
599520	601380	that battle was lost.
601560	603040	So the big expense, the
603040	605020	Delta Force and all the millions of dollars
605020	607300	spent on satellite recognition
607300	608940	and everything, all was spent
608940	610940	for nothing because this little guy, which
610940	613160	I mean, how much does it cost, this little guy?
613160	615060	You only have to feed him something
615840	617020	and a satellite
617020	619660	phone, so you have to pay the phone bill and that's it.
619660	621180	And he destroyed everything.
623260	624840	This is, you know, I mean,
624840	626880	everybody nowadays does the example of the
626880	629140	Twin Towers. So you have the 19 men,
629140	630900	19 cutters and then you have the 11th
630900	632240	September thing.
632240	634900	All the intelligence expenses that have been done
635860	637120	in the years before
637120	638660	didn't prevent this episode
638660	640860	like many other episodes. Of course, there are
641000	642860	a lot of things that have been prevented, but we
642860	644460	will never know what they are.
646560	648840	So, why are we saying
648840	649920	this? Because in this
651020	652580	years, the electronic
653400	654660	warfare, the electronic
654660	656640	men is the best way to hit
657180	658800	the countries which are
658800	660900	technologically developed.
660900	662800	So we have, for example, all the
662800	664560	western bloc countries.
664580	666320	These countries depend
666320	668660	almost totally on digital
668660	671160	systems, on telematic systems,
671160	673260	on electronic systems.
673260	675480	So the critical infrastructures,
675480	677120	telecommunication infrastructures,
677380	679300	food supply, banking systems,
679300	680700	military systems, even
680700	683040	for example in the United States, missiles,
683040	685060	I think they have IP addresses.
685060	686540	So everything depends on
686540	688940	electronic and telematic systems.
689280	690680	So, what do you need to
690680	692620	do to hit such a country?
692620	694520	You might use electronic means
694520	696540	if you know where to hit, of course.
696540	699300	So you need to do some research before, some intelligence.
699440	699640	But
700660	702420	both the intelligence and the
702420	704400	fighting, you do it using
704980	706240	a computer like this one.
706240	708740	You connect to the network and if you
708740	710420	are good to search
710420	712600	or to find things and you are good also
712600	714760	on exploiting them,
714760	716680	then you might hit a critical
716680	718800	infrastructure and create a blackout.
719860	720860	You know that in the past
720860	722580	years there have been several blackouts around
722580	724700	the western countries. For example in Italy, where
724700	726660	I come from, there was a huge blackout
726660	729120	about two years ago where all the country went black.
729120	729800	Totally.
730820	732580	The government said that it was
732880	734640	a tree, some tree that fell over
734640	736800	some type of wire. It was a totally impossible
736800	738720	explanation. So who will ever
738720	741060	know what happened? Nobody.
741140	742700	And the same thing happened also in the United
742700	743620	States.
744740	746760	Three years ago, I think. Or a couple of years
746760	749200	ago too. And in other countries.
749360	750720	So they said it was Switzerland.
751040	752620	In Italy they said it was Switzerland.
752620	754800	The tree fell over some kind of wire
754800	756880	and then everything went blackout. The whole country
756880	758500	was incredible. I was there
759220	760520	at night. I was out
760520	762540	tapping at night actually. I never saw
762540	764500	this type of darkness.
764540	765960	It was totally scary.
766280	768200	So you can hit
768880	770440	these critical infrastructures
770440	772180	and the thing is that
772180	774300	you can create more damage doing this
774300	776540	than doing a lot of other things.
776720	778260	So for example, the bombings that were
778260	780000	in London last week
780000	782400	or two weeks ago. What did they do?
782400	784900	They killed people. Fifty people died.
785360	785600	But
786520	788620	after these fifty people died
789620	790440	the country
790440	792240	what did it suffer? Okay, there was
792360	793460	a human life.
794720	796360	Nobody can contest the fact
796360	798120	that it is valuable.
798120	800340	But nothing changed.
800400	801780	The structures were totally
801780	803980	there. It was psychological.
803980	805500	It was mediatic. It was
806000	808400	public opinion. It was all these kind of things.
808400	810280	So that's what terrorists want to hit
810280	812080	at that moment. But if they
812080	813920	really wanted to create damage,
813920	815940	they didn't have to kill those fifty people.
815940	817440	They could just stop a nuclear
818030	819120	power reactor or
819940	822280	damage it somehow. You don't need to do
822280	823900	very sophisticated things to
823900	825960	exploit critical infrastructures.
825960	827560	You just need to do a little
827560	830640	thing that just creates havoc.
831100	831780	Okay?
831800	833960	So this is the thing. Then I will go on
833960	836060	later and I give the microphone back
836060	837680	to this guy.
841320	842040	It might
842040	843740	sound strange, but the main difference
844460	846160	between the first and the second
846160	847700	Gulf War was a bandwidth
848240	849280	difference.
850740	852080	In the next ten years
852080	853360	the US has developed
854680	855240	a way to
856560	857260	distribute
857260	859700	information, to collect information.
860720	861000	And
861000	863240	basically, in the second
863240	865320	Gulf War, the US troops were enjoying
865320	867260	forty-two times more bandwidth
867260	869480	than in the first Gulf
869480	871020	War. How
871020	874220	this bandwidth was actually used?
875420	877120	Well, the picture on the center is
877500	878380	a typical
879960	881450	command center,
881450	883790	command and control center,
883790	885810	which collects
886210	888310	a lot of data,
888310	889810	which could be
889810	891590	data and voice interception
891590	893530	or data coming from spies
893530	895630	deployed on the territory. They are going
895630	898490	to be fed, actually, into the system.
899290	899650	From
899650	901490	stealth planes,
901490	903750	which are actually flying over the
903750	906090	territory and watching the situation,
906090	907510	taking pictures,
907510	909210	spy drones, unmanned
909210	910850	vehicles, from
910850	913270	satellites, and also
913270	915410	from the Blue Force Tracker, which is a very important
915410	916630	system for
917490	919270	the American Army. It is the
919270	921290	system, if you see in the movie, when they
921290	923130	are, I don't know, on the enemy
923130	925490	territory, and they open the laptop,
925490	926830	and the laptop is showing
926830	928410	some red triangles
928990	931110	on the map, which is, this is the
931110	933210	enemy, and some blue triangles,
933210	935350	this is us. Actually, this system
935350	937170	is not science fiction. It is
937170	939030	existing, and they are already using it
940030	941070	successfully.
941930	943310	Well, I want to tell
943310	944390	you one thing.
945050	947270	If you open Google Maps, or
947270	948790	if you ever used
949350	951070	downloading the trial version, not
951070	952810	cracked, of course, of
952810	955050	Keyhole, the software which
955050	957050	was used by CNN to
957050	959050	show you, basically, the
959050	961010	toilet in which the guy was pissing,
961010	963070	and beside it was the cat from the
963070	965070	satellite. Do you have any
965070	966450	idea how many
967370	969190	megabytes, gigs,
969190	970910	it's actually taking a picture
972350	972950	taken
972950	975230	from a satellite? Huge
975230	977230	amount. Now, if you have a satellite
977230	979570	which is taking picture on the territory,
979570	981030	on the enemy territory, and you have to
981030	982650	download to give this picture
982650	984930	to the troops, then you need
984930	986850	bandwidth. You can't do the
986850	989290	800 x 600 JPEG picture.
989290	990990	This is good for browsing Britney
990990	992290	Spears' website, but not
992290	994330	to go at
994330	996290	war. This is the reason why
996290	998650	U.S. Army developed such a large
998650	1000770	bandwidth network.
1001210	1002620	Was it working?
1002970	1003910	No.
1004470	1005850	When U.S. troops
1007030	1008390	entered into
1008390	1010370	the territory, they started to
1011170	1012450	experience a lot
1012450	1014490	of troubles. Now,
1014490	1016290	focus your attention.
1016290	1018430	Do you remember exactly the day
1018430	1020190	when they started to
1020190	1021630	invade Iraq?
1021630	1024190	The guy was sitting, the CNN
1024190	1026230	guy, was sitting on the top
1026230	1028090	of a U.S. tank which was
1028090	1030190	running 120
1030190	1032230	kilometers per hour. I don't know
1032230	1034530	it in miles. You can do calculations by yourself.
1035070	1035750	And it was
1035750	1038170	75. And it was running
1038170	1040170	and running and running. And the
1040170	1042110	journalist was saying, there is nobody
1042110	1043830	nobody is facing us.
1043830	1045930	We don't see the enemy. And that
1045930	1047250	was the problem. Because
1047250	1049430	they were running
1049430	1051310	too fast. And they were losing
1051310	1053130	connectivity. Try to
1053910	1055830	hook yourself into a
1055830	1057590	Wi-Fi network while you are
1057590	1059610	on your car and you are driving fast.
1059610	1062070	You can't.
1062070	1063610	And basically the
1063610	1066090	Humvees which were in front of the U.S.
1066090	1069250	troops, they had to stop
1069250	1070690	even for 12
1070690	1072350	hours to download the
1072350	1074030	tactical data. Now,
1074030	1074870	do you know the difference between
1075470	1076910	strategical and tactical
1076910	1078930	data? Tactical data are the data
1078930	1080930	which are necessary to survive in the next 5
1080930	1082870	minutes. Because it's telling
1082870	1084890	you where the enemy is.
1085250	1086930	From which point you should
1087590	1089110	expect to be attacked.
1089110	1090750	Where should you go not to be
1090750	1092690	attacked. What you should do.
1092770	1094730	Because the command and control center is
1094730	1097290	telling you to do this, this and that.
1097950	1098910	And if you rely on
1098910	1099410	connectivity
1100530	1102830	for having such service, it's good
1102830	1104770	as long as you have connectivity.
1104770	1106790	But if you don't have any more connectivity, what is
1106790	1108550	happening? You don't know where your enemy is
1108550	1110930	while your enemy knows very well where you
1110930	1112830	are. Because you are stopped in the
1112830	1114250	middle of the desert.
1116970	1117450	And
1119010	1120790	how was organized the system
1120790	1123190	for the second Gulf War?
1123190	1124270	Basically we had
1125050	1126870	two command and control centers.
1126870	1128770	One was located in Qatar. The second
1128770	1130390	was located in Kuwait.
1130390	1132330	And all
1132330	1132950	the data
1134110	1136410	gathered by the probes
1136410	1138410	was actually fed into a system
1138410	1140270	which was producing too much
1140270	1141610	of intelligence.
1142590	1144030	It is like if you
1144030	1146170	enable all of your
1146170	1147330	IDS messaging
1147990	1150210	or if you are using zone alarm and
1150210	1152130	you tell to zone alarm
1152130	1154290	to pop up the window each time you
1154290	1156630	are receiving a
1156630	1158310	strange packet. It will pop up
1158310	1159930	every five seconds. And
1159930	1162330	what will be the end? You will switch
1162330	1164230	off the pop up thing.
1164230	1165830	Too much of information equals
1165830	1167470	no information.
1168230	1169810	And this was a problem.
1170030	1172430	The second problem was that the information
1172430	1174590	was fed into a satellite system.
1174590	1176410	The satellite system was downloading
1177210	1178490	sending, sorry,
1179310	1180510	through a traditional
1180510	1182310	radio streaming
1184050	1185370	to a
1185370	1186370	vehicle which was located
1186370	1188370	back of the US troops and from
1188370	1190290	the vehicle which was
1190290	1192310	actually supposed to act as a router
1192310	1194310	to distribute the information
1195370	1196570	the data
1196570	1198450	were sent using
1198450	1200290	an eye
1200290	1201210	of sight
1202730	1204750	microwave beam.
1204750	1206750	I guess for security
1206750	1208470	reason they didn't want to
1208470	1210490	have the high technology
1210490	1212050	enemy which is the
1212050	1213970	Iraqi troops
1215290	1215810	intercepting
1215810	1217770	the data of the US troops
1220290	1221970	but this system is working
1221970	1223770	as long as you can see
1224530	1226030	the vehicle which is on your
1226030	1227490	back. But if you are running
1227490	1230110	75 miles per hour because you don't
1230110	1231930	face the enemy, then you are
1231930	1234010	losing this link and you are not
1234010	1235910	capable to get any data. This was the reason
1235910	1238150	why they had to stop and wait 12 hours
1238150	1239870	to get the data.
1239870	1242230	And they were killed, actually.
1242230	1243050	Sorry.
1244390	1246230	US soldiers lost life
1246230	1248050	also due to this.
1248050	1250170	Because they didn't have the backup of the
1250170	1252230	intelligence telling them where the enemy
1252230	1254030	is. They were facing the enemy
1254030	1256890	in the same moment they realized it was existing.
1256950	1258210	And at the same time
1258210	1259930	the bullets, they were
1260550	1262450	flying over their head.
1264870	1266070	Now,
1266750	1268150	the blue force tracking
1268150	1269690	system, it's the system
1269690	1272490	who tells you where the enemy is.
1272830	1273750	Luckily,
1273750	1276670	when they developed it,
1276670	1277510	they assigned
1277710	1279430	a certain amount of bandwidth
1279430	1281690	to the BFT, which is
1281690	1283790	actually working using
1283790	1285350	the satellites. It doesn't work using
1286510	1287890	direct microwave
1287890	1289190	beams.
1289470	1291730	It means you can always receive it
1291730	1293730	actually the same system you are using on your
1293730	1296070	car for your GPS system.
1296070	1297610	Very similar.
1299090	1300090	Luckily,
1300090	1301790	the amount of bandwidth developed
1301790	1303970	from the very beginning to supply
1303970	1305730	information through the BFT
1305730	1308070	system was more
1308070	1310010	than it was actually needed.
1310010	1311630	So, the developers
1311630	1313910	having such extra bandwidth,
1313910	1314810	they were thinking,
1315450	1317970	what are we going to do? Are we going to use
1317970	1319770	this bandwidth or not? Yes.
1319770	1321390	What do we do? Let's build
1321390	1323270	an email system.
1323930	1325890	You never know. It might come
1325890	1327650	in handy. It actually came in handy
1327650	1330170	because the whole Iraqi invasion
1331030	1331670	having
1331670	1333590	the first system not working
1333590	1336570	was actually organized through emails.
1337430	1338070	USA
1338070	1340030	was at war
1340030	1341930	in the sense that through the email
1341930	1343950	coming from the BFT system,
1343950	1345790	they were capable to finally coordinate
1345790	1347450	their own action.
1349570	1351570	This was the past.
1352090	1353310	Now, a question for you.
1353310	1355170	To the one who is going to answer to me,
1355170	1357210	I'm going to give a T-shirt.
1357210	1358130	What is this?
1359090	1360530	Can you tell me what is this?
1363650	1364490	Excuse me?
1365690	1366650	What is it?
1367890	1369250	A trigger. No, no, no, no, no, no.
1369250	1370770	Not a landmine. No, no, no, no, no.
1373390	1373930	No?
1375550	1377290	No, diesel pump? No, no, no, no?
1377730	1379050	You have it in your kitchen.
1379050	1381310	You have diesel pumps in your kitchen. What are you doing?
1383970	1385030	What, what?
1386610	1387530	Microwave?
1389410	1390330	Magnetron.
1391670	1393690	Please, it's a magnetron.
1393690	1394610	And you have it in your
1395930	1397530	microwave oven.
1397570	1399050	And it's a system that can be used
1399050	1400270	actually to disrupt
1402430	1403030	direct
1403030	1405250	microwave beams as it
1405250	1407110	was used in the
1407110	1409390	Iraq invasion. We will see later
1409390	1410950	some other examples
1410950	1413090	how to use such thing.
1413090	1415070	Anyway, this was the
1415070	1416670	past. And US Army
1417470	1418970	actually didn't want to
1418970	1421150	experience anymore such problem.
1421150	1423050	No bandwidth, no connectivity,
1423050	1424910	no tactical data, equal
1424910	1426710	death. So
1426710	1428930	they decided to
1428930	1430730	develop a new system which is called
1430730	1432950	FCS, which stands
1432950	1435370	for Future Combat System.
1435370	1437450	And it is a
1437450	1439090	21 billion dollar program
1439090	1440910	but it is going to be upgraded
1440910	1443370	already. It's exactly in the middle
1443370	1444930	of its own development.
1444930	1446710	It's not science fiction.
1446710	1449270	Some prototypes have been already developed.
1449610	1451030	And this is the system which is
1451030	1452890	meant to totally
1454210	1454730	substitute
1454730	1456750	the way the US
1456750	1459470	is doing the war in the future.
1461490	1462970	In which way?
1463610	1465170	We will come to the hacking part
1465170	1466570	later, don't worry.
1468150	1469630	The old war
1469630	1471610	concept was that you should have
1471610	1473330	heavy war equipment.
1473330	1474950	The big Abram tank
1475730	1477410	with having massive
1477410	1479410	fire powers. I want to shoot once
1479410	1481490	and I want to kill them all.
1483250	1483970	Large
1483970	1485450	battlefronts. Full
1485450	1488050	division deployed on the territory.
1488230	1489850	Let's occupy, hit,
1489850	1490950	destroy.
1492350	1493590	Having low tech
1493590	1495350	infantry because
1495350	1497270	high tech infantry cost
1497510	1499410	a lot. And of
1499410	1501110	course having vehicles
1501110	1501930	which were
1502970	1505330	driven by real people.
1505330	1507370	Now, under the FCS program
1507370	1509590	things are going to be changed.
1509990	1511150	Not anymore
1511150	1513410	heavy war equipment, but light
1513410	1515470	war equipment. Instead of the big
1515470	1517350	Abram tank, they are going to develop
1517350	1520170	small, lighter tank.
1521790	1522910	Faster than
1522910	1524850	the Abram one.
1524890	1527330	Having not a massive fire power,
1527330	1529330	but having a minimal fire power.
1529550	1530790	But they are so fast
1530790	1532790	that they can shoot you and then move
1532790	1534810	and shoot you again and then move and shoot
1534810	1536930	again and again and again. Like if you
1536930	1539170	are surrounded by a
1539170	1541830	lot of bees. Basically you don't know.
1541830	1542950	You are going to
1543790	1547110	get hit from a lot of different
1547110	1548390	directions.
1548390	1549770	Instead of a large
1549770	1550890	division of soldiers
1550890	1552910	deployed on the territory, they are going
1552910	1554690	to deploy small
1554690	1557030	families, called families of
1557030	1558890	soldiers. Typically in
1558890	1559410	12
1562290	1562850	12
1562850	1564110	people unit.
1564930	1566930	So I put 12 people here,
1566930	1569090	12 people there, 12 people there.
1569190	1570950	If you know where they are, they
1570950	1572830	are very much vulnerable.
1573110	1574670	You can kill them very easily.
1574670	1577150	But there is a trick. We have a
1577150	1578570	large use of intelligence.
1578570	1580170	What does it mean?
1580170	1582550	It means that I must be capable
1582550	1584730	to supply through the FCS system
1584730	1586630	information, immediate information, to the
1586630	1588610	people, to the troops deployed on the
1588610	1590690	battlefield, so that even if
1590690	1592710	they are small families of soldiers,
1592710	1593690	they will be constantly
1594930	1597150	aware about what is going on.
1597270	1598410	And the trick is that
1598410	1600570	when the enemy thinks
1600570	1602370	that they
1602370	1604530	identified our troops,
1604530	1606670	we are already capable to understand
1606670	1608590	it, we move the troops somewhere else,
1608590	1610670	and we hit the enemy. And then we are going to move them
1610670	1612690	and again and again and again.
1613570	1615110	And finally, having a
1615110	1619510	large use of automatic vehicles.
1619510	1620990	We have some examples here.
1620990	1623730	Public data from globalsecurity.org.
1623730	1624830	Some of them, especially
1624830	1626930	the one in the box, you already
1626930	1629570	saw the drones, the spy drones,
1629570	1631010	they are already
1631010	1632990	in force. Some other
1632990	1634590	are prototypes. You can see also
1634590	1636750	the size of the vehicle compared
1636750	1638690	to the human being. They are much
1638690	1640370	smaller than what we were used to see
1640970	1642170	a long time ago.
1643290	1644930	And these are the working prototypes
1644930	1646910	of combat drones.
1647190	1648770	In our comic,
1648770	1650730	our heroes, they have
1650730	1652790	to actually get
1652790	1654790	rid of one of these combat drones
1654790	1656730	which gets hijacked by
1656730	1658190	an enemy's hacker,
1658190	1660290	and it's used against
1660290	1661910	its own troops.
1663830	1664790	Now,
1665690	1667330	always from public data,
1667330	1669190	we can see that this is the
1669190	1671070	timing, the
1671070	1673030	Gantt diagram, basically,
1673030	1674990	on how the FCS is meant
1674990	1676890	to be deployed in the following
1676890	1678770	years, when they
1678770	1680930	developed this in 2001.
1681010	1683070	And one thing you can note, it is that
1683070	1684610	it's saying
1685670	1687190	that the problem,
1687190	1688590	actual problem, is that
1688590	1691570	there is a lack of artificial intelligence.
1691570	1693250	So they are drones,
1693250	1695290	but they have limited capability of
1695290	1697150	understanding the surroundings.
1697150	1697710	Which means
1699190	1701890	they can drive around by themselves,
1701890	1704050	but in combat situations,
1704050	1705770	if you have the risk
1705770	1707630	to kill one of your own
1707630	1709970	soldiers, better not to take such risk.
1709970	1711650	Such vehicles will be taken over
1711650	1713450	by a U.S. Army
1715190	1716190	soldier,
1716190	1717210	and they will be remotely
1717210	1720050	controlled by him,
1720050	1722110	which will actually tell to the drone
1722110	1724110	where to shoot and how to shoot.
1725150	1727070	Now, the question is,
1727070	1729110	from the hacker point of view,
1730550	1731850	to receive the
1732570	1734410	signal, the control signal,
1734410	1736230	it must be hooked to a network,
1736230	1738390	and there is a network, we will see later.
1738750	1740050	If there is a network,
1740050	1741810	it means such thing is
1741810	1745030	permanently connected and authenticated to the network.
1745490	1746150	Good.
1747070	1748550	But it can get, for example,
1748550	1750830	it can get stuck into a hole
1750830	1752870	or the wheels
1752870	1754690	can blow up and the thing,
1754690	1756410	the whole thing will be stopped
1756410	1757850	in the middle of somewhere.
1757910	1760690	So what if the enemy is going to put its own hands
1760690	1762470	over it? It is dangerous to have
1762710	1765130	a thing which is permanently connected to your network.
1765130	1766570	Because the enemy can put
1766570	1768030	the hands over the network.
1768070	1770210	So I guess, I didn't find any reference,
1770210	1772530	but I expect there are some,
1772530	1773570	there might be some
1774570	1776390	system to protect
1776390	1778030	in such situation,
1778030	1779770	like self-destroying system.
1779770	1783090	Self-destroying, it doesn't mean it is going to be blown up.
1783110	1784430	Because it might be dangerous.
1784430	1787170	Because it might be close to your own soldiers.
1787290	1788510	Self-destroying means
1788510	1790090	that you will destroy
1790090	1791970	the digital contents of the drones,
1791970	1793630	leaving just basically a piece of art.
1793630	1795970	You remember this, the American spy plane,
1795970	1798370	which was landing on the Chinese island
1798890	1800130	a few years ago?
1801170	1802790	The American soldiers,
1802790	1804610	before landing on the Chinese island,
1804610	1805630	it was a spy plane.
1805630	1807950	Basically, it was connected to the US Army network.
1807950	1810610	They destroyed, not physically, but logically,
1810610	1812670	all the content in the airplane.
1813030	1814670	The Chinese authorities, they were capable
1814670	1816490	to put their hands over
1816810	1818710	a piece of hardware without the software.
1818710	1820370	And you know better than me that if you have
1820370	1821890	the hardware without the software,
1821890	1825210	it's basically a little bit more than nothing.
1826990	1828250	Now, then,
1828250	1830110	if it has really such
1830750	1832610	auto-destruction system,
1833910	1835210	the smart hacker
1835210	1838130	employed by the enemy
1838810	1839810	might think
1839810	1841810	ways to trigger the system
1841810	1844090	of the self-destruction.
1844090	1845530	Not doing it today,
1845530	1847190	but doing it the day you need it
1847190	1850010	and this thing is deployed on the battlefield.
1850090	1850930	You are relying
1850930	1853350	on its usage,
1853350	1854970	but the hacker will actually
1856350	1857770	destroy the content,
1857770	1860390	triggering the self-destruction mechanism.
1860390	1860670	Now,
1862070	1863810	how this thing works?
1863810	1865970	The FCS system,
1865970	1868390	it is managed
1868390	1870870	by a huge network,
1870870	1872210	the largest network after
1872210	1874650	Internet, actually, if I think,
1874650	1876230	which is called Mosaic.
1876290	1878230	Mosaic network, it is meant
1878230	1879690	to manage the whole
1880210	1881250	war infrastructure
1881250	1884550	of US Army.
1886750	1888670	Ships, submarines,
1888670	1890410	airplanes,
1890410	1892510	infantry, drones, everything
1892510	1894370	will be connected somehow
1894370	1896070	to this network.
1896170	1898250	The network, the Mosaic network,
1898250	1900790	it is meant to have a kind of quality of service
1902890	1903570	feature
1904390	1905570	based on
1906510	1908450	the importance of
1908450	1910510	the packet. If the packet
1910510	1912470	is coming from the command and control
1912470	1914530	center,
1914530	1916270	this packet has priority
1916270	1918390	in the mesh network
1918390	1920970	because it is a mesh network.
1921310	1922030	It means
1922030	1924390	even if the network is
1924390	1926490	congested, blocked
1926490	1929030	somehow, overloaded,
1929030	1930430	the packets coming
1930430	1932230	from the high priority centers
1932230	1934250	will be routed
1934250	1936190	correctly to the end,
1936190	1938390	having the other packets waiting for
1938390	1940310	that. And in our comic,
1940310	1942390	we can't say it here, but we can say it
1942390	1944130	on the comic because the comic is
1944130	1945670	science fiction.
1945670	1948150	We actually imagine the way to
1948150	1950110	exploit such
1950430	1951710	a system just
1951710	1954230	flooding it by high priority
1954230	1956050	packets, by replicating
1956050	1958450	them and saturating the network.
1959350	1960130	Now,
1963370	1966050	the FCS system, it is a system,
1966150	1967630	a daring system.
1967630	1969010	They already tried some
1969010	1971650	of the pieces, some of the equipment
1971650	1973630	and the network, it is
1973630	1975350	TCP IP based
1975350	1977090	and it's basically using
1977630	1979750	traditional network
1979750	1981870	equipment and
1981870	1983130	several of the
1983130	1986350	drones are actually Linux based.
1986350	1987870	A miniaturized version of Linux
1987870	1989630	of course, with
1989630	1990730	harder
1991730	1993370	stacks,
1993370	1996690	maybe less holes, you never know.
1997630	1999890	But it's still something which is public
1999890	2001810	and based on
2001810	2004010	public networking system.
2004970	2005270	And
2005670	2007370	now comes the problem.
2007710	2009310	What I call the
2009310	2011910	Apollo 13 effect.
2011910	2013950	Do you actually know what was the
2013950	2015810	real reason why
2015810	2017530	the Apollo 13
2018530	2019670	had the problem?
2019670	2021470	You remember that the oxygen tank
2021470	2022670	exploded.
2023070	2025570	If you know the reason, you can get a second
2025570	2027390	T-shirt. Which was the real reason
2027390	2029030	why the oxygen tank
2029030	2031370	of the Apollo 13 exploded.
2032510	2033190	Not
2033190	2034890	communication problems.
2035390	2037210	Wiring? Almost.
2041810	2042770	Excuse me?
2043670	2046790	A short in the oxygen center, but why?
2050360	2052340	Electrical? Yes, almost.
2052340	2053480	We are close.
2060380	2062020	No, no, no, no.
2062020	2063460	Well, if nobody is...
2063820	2064820	You?
2067790	2069150	No?
2069150	2071070	No?
2071070	2072390	Voltage.
2072750	2074270	Voltage.
2075270	2076390	The Apollo 13
2077150	2079310	project was a huge project.
2080010	2081210	A lot of suppliers
2082210	2083290	Rockwell,
2083290	2085390	Boeing, and so on.
2085390	2087070	They were helping NASA to develop
2087070	2088430	the systems.
2089070	2090750	From Apollo 12
2090750	2092950	to Apollo 13, the difference
2092950	2094970	is that they decided
2094970	2096950	to increase the voltage
2096950	2098730	which was used
2098730	2101090	to run the systems
2101090	2103350	in the Apollo 13.
2104070	2104710	So
2104710	2106870	all the developers,
2106870	2109630	all the subcontractors, they were informed, of course,
2109630	2110890	except one.
2111190	2112230	Rockwell.
2113270	2115070	And, which is
2115070	2116950	by the way, one of the subcontractors
2116950	2119290	of the SCS system, but anyway.
2119570	2120950	Not being informed about
2120950	2123110	such increase in the voltage,
2123110	2125250	they were supplying the oxygen tank
2125250	2126770	and it blown up.
2126770	2129530	Because it was overloaded by voltage.
2130230	2131130	You can get the T-shirt
2131130	2132030	anyway.
2133470	2135590	Now, why it happened?
2135590	2137030	It's actually normal. In my
2137030	2138990	experience, when I work
2138990	2141370	besides Zone H, I do penetration tests
2141370	2143110	with my own company.
2143130	2144910	And one of the things
2144910	2147250	I noticed is when you have complex systems
2147250	2149410	made up, for example, by different
2150190	2151270	subcontractors,
2151270	2153330	the implementation of such systems
2153330	2155750	it is introducing more vulnerabilities.
2155750	2156790	Rockwell was one of
2157390	2158850	a new vulnerability for the Apollo
2158850	2161430	13 program.
2162030	2162870	Now, I expect
2162870	2165410	given the fact that we have
2165410	2165970	FCS
2167770	2169050	being a consortium
2169050	2171330	much bigger than the Apollo 13
2171330	2173010	one of company,
2173010	2175110	mostly American company.
2175230	2177550	The leader of the consortium is Boeing.
2177550	2179510	You can see actually advertising on CNN
2179510	2181070	in these days, not
2181070	2182930	specifically related to the FCS
2182930	2185050	system, but the images they are showing
2185050	2187290	are belonging to the FCS system.
2187770	2188990	So the general
2188990	2191130	public start to be aware
2191130	2192730	about such system.
2193830	2195070	The Apollo 13
2195070	2196930	sorry, the FCS
2196930	2199110	system, it is led by Boeing, having
2199110	2201470	also a large consortium
2201470	2202270	of company
2204530	2205290	to be
2205290	2207510	actually managed as a project manager.
2207830	2209070	We can say actually Boeing
2209070	2211370	is the FCS project manager
2212430	2213270	on behalf
2213270	2215490	of the Department of Defense.
2217350	2218390	Now,
2220130	2221750	how does it work?
2221750	2223090	The U.S. Congress tell
2223090	2224950	to U.S. Army, yes, you have to develop
2225090	2226830	a new system. They assign a budget
2226830	2229030	and then they name
2229170	2230810	a project leader, Boeing.
2231310	2232470	Then the system are
2233070	2234710	divided in subsystems
2234710	2236970	and in consortium. There is the consortium
2236970	2238990	of companies which
2238990	2241110	are developing robotics, artificial
2241110	2243190	intelligence. Then there is a consortium
2243490	2245010	of companies which is developing
2245690	2247130	unmanned vehicles.
2247130	2249090	Another consortium of companies which is
2249090	2251790	developing weaponry, and so on.
2251790	2253110	Each company has to
2253110	2255130	report to Boeing how things are going
2255130	2256950	on. And
2256950	2259310	of course, each consortium
2259310	2261470	itself has a consortium leader.
2261470	2262930	The consortium leader has to
2262930	2265150	act as a sub project manager
2265150	2267030	to the rest of the companies
2267030	2269530	belonging to the same consortium.
2270530	2271810	Each consortium
2271810	2273110	and each company
2273110	2275530	in the consortium has its own
2275530	2277310	project manager, internal
2277310	2279390	company project manager, who has to lead
2279390	2281550	the activity of the programmers,
2281550	2282990	for example,
2282990	2285030	which are developing within the company
2285290	2287810	a particular piece of the SES system.
2288010	2289170	Now, you can imagine,
2289170	2291790	if you add all the programmers,
2291790	2292670	each programmer
2293690	2295370	developing the system,
2295370	2296890	by the way, FCS system,
2296890	2299130	it is 31 millions of code,
2299130	2300850	the software, 31 millions
2300850	2303010	of lines of code. You can imagine
2303010	2305030	how many conceptual and practical
2305030	2307030	vulnerabilities there might be introduced
2307030	2308890	by people who never developed, for
2308890	2310790	example, such software, because nobody
2310790	2312890	did it before. It is a totally
2312890	2314730	new thing. And when
2315230	2316930	a lot of programmers belonging to
2317110	2319030	a company, which is put together
2319030	2321010	with a lot of other different companies
2321010	2323450	which are belonging to a consortium,
2323450	2325150	which are put together with several
2325150	2327250	other consortiums, are going, finally,
2327250	2329630	to integrate what they produced,
2329630	2331090	the software, you can imagine
2331090	2332890	the huge amount of shit
2332890	2334810	that can come out.
2338190	2339390	Now,
2340350	2341410	as a personal
2341410	2343130	experience, and also analyzing
2343130	2345870	the data coming from Zone H,
2345870	2347110	we have
2347110	2348890	one million of cyber crimes
2348890	2350550	web defacement,
2350550	2352790	let's call it web defacement,
2352790	2355070	filed in our archives. For each,
2355070	2356530	we know how it happened
2356530	2359790	and the reason of the attacks.
2360930	2363110	We can say, today,
2363450	2365030	most of the hacks which we
2365030	2366910	see every day,
2366910	2368710	two and a half thousand servers hacked
2368710	2370850	per day. This is the amount of data
2370850	2373130	we are receiving at zoneh.org.
2373690	2375070	80% of
2375070	2376870	the time, the system is
2376870	2378910	hacked through the application layer.
2378910	2381730	And FCS system is mostly application.
2382230	2382670	Now,
2382670	2384850	I want to say they are better
2384850	2386110	than the average.
2386110	2388770	It will be vulnerable, maybe
2390090	2391070	40%
2391070	2393170	on the application level,
2393490	2394950	but still there are
2394950	2397190	possible vulnerabilities to be introduced
2397190	2399730	by the system integration, for example,
2399730	2400990	the protocol might be
2400990	2402890	bugged, the transmission protocol might be
2402890	2405110	bugged, the hardware
2405110	2407030	integration might introduce vulnerabilities
2407030	2409190	and also, of course,
2409190	2411450	information leakage.
2411730	2413110	Hackers are
2413890	2415310	actively looking
2415310	2417050	to get information about the
2417050	2419210	FCS. I met, personally,
2419370	2421330	a guy in Rome
2421330	2423490	which was representing
2423490	2424170	US Navi
2425110	2427270	and he was investigating on
2427270	2429170	leaks. He didn't
2429170	2431430	name to me the FCS system
2431430	2432970	itself. He told me
2432970	2435170	we are looking for information
2435170	2435950	about
2437030	2438830	hackers coming from the
2438830	2441010	East Europe, stealing a piece of
2441010	2442450	information about military
2443150	2444850	software or military
2444850	2447010	programs under development.
2447390	2448870	Well, the only military program
2448870	2450850	under development so far, big, is the
2450850	2452230	FCS system. And
2453030	2454810	no need to name it, actually.
2454810	2456850	It was clear to me that they are having
2456850	2459050	such problem already. There are spies
2459050	2460570	who are actually using
2460570	2461330	hacker
2463050	2464850	means to get information
2464850	2466770	about this new system.
2475140	2476300	Now,
2479590	2480170	if
2481790	2483350	there are software
2483350	2485370	problems, that might be software
2485370	2487270	problems, again, read the comic
2487270	2489290	and you will get a very good hint on how
2489290	2491830	to hack the mosaic network.
2493130	2495650	There are also other problems. First of all,
2495650	2497610	the FCS system is organized
2497610	2499050	following the lobbying
2499610	2500850	standard procedure
2501610	2503310	in the American way.
2503310	2505710	So, the president got
2505950	2507250	a lot of money for his
2507250	2509390	campaign from Boeing.
2509390	2512090	Therefore, Boeing, for example,
2513410	2515470	doing some science fiction.
2515490	2517690	Boeing is named as a project leader,
2517690	2519330	but then also other people, they were
2519330	2521230	sustaining the campaign, then
2521230	2523490	they also have to have a little
2523490	2525470	piece. So, it is
2525470	2527410	not always distributed as it
2527410	2530170	should be, the work.
2530850	2531530	Lobbyism
2531530	2533370	has a big part in the decision
2533370	2535550	to which company assign a project
2535550	2537610	or not. Then,
2537610	2539570	the military software is not open
2539570	2541310	sourced, of course. You know,
2541310	2543310	Linux is the most audited
2543310	2545630	code ever. Still, we are finding
2545630	2547930	vulnerabilities. Still.
2548230	2549470	Firefox.
2550550	2551230	Everybody
2551230	2553330	using Firefox because it was open sourced
2553330	2554550	two years ago.
2556130	2557350	I don't know
2557350	2559230	anybody who was actually reading the
2559230	2561210	source, but they were saying, oh, it's open
2561210	2563770	sourced, so I can use it. It's safe.
2563770	2565370	But still, are coming
2565370	2566810	out new vulnerabilities.
2567110	2569310	Because it's open sourced. A closed
2569310	2571350	source platform, basically
2571350	2573690	it is a never audited platform.
2573710	2575050	Because who is going to audit
2575050	2577330	the FCS system? The same people
2577330	2579330	who are developing it. And you know better
2579330	2581190	than me that you can't audit
2581190	2582570	your own job.
2583170	2585350	The job should be outsourced by somebody
2585350	2587270	else, but because it's
2587270	2589430	military, you can't do it.
2589430	2591170	Therefore, I expect, by my
2591170	2593310	experience, to find a lot
2593310	2595090	of vulnerability in the application level
2595090	2597450	and within the lines.
2599170	2600970	Then, if the FCS
2600970	2603090	system is leading your
2603090	2605190	troops on the battlefield,
2606310	2607430	losing somehow
2607430	2608930	connectivity, or being
2608930	2609890	hacked,
2611670	2613230	leads to a lot of trouble.
2613230	2615390	Because you don't have anymore a large battlefront
2615390	2617270	which is capable to defend itself.
2617270	2619230	Now you have small families of soldiers,
2619230	2621370	12 soldiers, dispersed in the territory.
2621370	2623170	They don't get shit from the satellite
2623170	2625110	or information. They don't know where they are.
2625110	2627090	They don't know where the enemy is. They don't get
2627090	2629030	the command from
2629030	2630990	the command and control center. They don't know what
2630990	2632950	to do. They are blind, basically. They are
2632950	2634110	slow, because they are
2635150	2636770	without heavy equipment.
2636770	2638990	And they are a very vulnerable
2638990	2640470	target.
2641070	2642790	Now, if I am
2642790	2644850	an enemy of the United
2644850	2646470	States today, definitely
2646470	2648230	I would start
2648910	2650470	a program for
2650470	2652390	collecting as much
2652390	2654630	information as I can about
2654630	2656730	such FCS system.
2656730	2658790	Because nobody can
2658790	2660870	fight against
2660870	2662890	the United States using the same
2662890	2664950	system, because you need
2664990	2666230	a lot of money. There is no
2667370	2668410	symmetric power
2668950	2670890	as an enemy for the United States.
2670890	2673130	The only way you can fight
2673130	2675070	the United States, if the United States
2675070	2676870	is adopting such a system, is
2676870	2679190	to use asymmetric ways.
2679190	2680790	And one of the ways is to hack
2680790	2682870	the servers of the companies
2682870	2684910	which today are going to
2684910	2686290	develop such
2687170	2688830	a system, and to try to
2688830	2691110	steal information. And one of the things
2691110	2693010	which we did,
2693010	2694070	we were imagining
2695010	2695930	to be
2696670	2698610	I don't know, hackers
2698610	2700950	coming from North Korea,
2700950	2703230	or hackers coming from Iran,
2703230	2705130	and to see how much of information
2705130	2707030	we could find
2707030	2708170	on the Internet
2709150	2711370	to hack the system.
2714300	2715820	It's not done.
2719280	2720000	So...
2720820	2722220	This is a question
2722220	2723520	I put there, just
2724500	2726940	a little forward to the question.
2726960	2728180	The most
2728180	2730020	vulnerable system, as everybody knows,
2730020	2732360	is our brain,
2732360	2733960	right? So it's the human being.
2733960	2735880	The human being with all its vulnerabilities
2735880	2738200	and its ways to be bought
2738200	2739780	or exploited.
2739900	2741880	So, that's why I put
2741880	2743220	this question there.
2743220	2746060	Who are the best security-aware managers
2746060	2748840	or people in the world's history?
2749700	2750920	The Pharaohs.
2751220	2752960	They got a lot
2752960	2755080	of people to build the pyramids
2755080	2756800	and then at the end they killed them all.
2756800	2758940	I didn't find any slide with the people being killed
2758940	2760780	afterwards, so I didn't put it, but
2760780	2761960	that's the thing.
2762520	2765120	So, we cannot do it now.
2765360	2766720	The right way would be
2766720	2769100	we build a future combat system
2769100	2771400	and then we kill everybody that build it.
2771400	2773200	Then we wouldn't have anybody to maintain it,
2773200	2774560	but that's not a problem.
2774860	2777180	It's illegal, but what the hell.
2778880	2779740	So,
2780820	2782840	this is just to explode
2782840	2785120	what I was saying before.
2785460	2786700	This slide,
2786700	2788780	I borrowed it from a Swedish
2788780	2791500	study from a university there.
2791500	2792840	That's actually pretty...
2792840	2794540	I liked it very much because it explains
2794540	2797100	all the phases of the conflict.
2797180	2798440	You have the
2798440	2800520	mechanical war at the center, which is
2800520	2802520	big armies facing each other
2802520	2804880	with the guns and going forward and shooting
2804880	2806380	and everybody falls down.
2806380	2807780	At the end, only one soldier remains
2807780	2809420	and that army won.
2810060	2812600	There was the old way to fight.
2812600	2814180	Then you have the dirty war,
2814180	2816360	which is terrorism or resistance war.
2816360	2817860	Depends from the viewpoint.
2818000	2819920	If you win, it's resistance. If you lose,
2819920	2821200	it's terrorism.
2821940	2823180	Then you have
2823800	2825080	peace war, which is
2825760	2827900	the war that was fought between the Eastern
2827900	2829260	Bloc and the Western Bloc when there was
2829260	2831280	the Soviet Union.
2831580	2832900	And the systemic war, which is
2832900	2834840	the war that can be fought
2834840	2837280	only by the United States right now, which has the money.
2837280	2838960	It's the big difference between
2839400	2840800	all the other types of war and
2840800	2842520	systemic war is money
2842520	2845040	and the other wars are people. More people,
2845040	2845800	more money.
2847160	2848800	And, you know, little windows
2848800	2850940	that you can hit with the intelligent bombs.
2851040	2852960	And then you have the ICT war. ICT war
2852960	2855000	is a type of dirty war which can be fought
2855000	2856440	only by
2858280	2858680	subjects
2858680	2860840	which have the capability or which
2860840	2863060	are linked, which have a high technological
2864200	2864680	situation
2864680	2866820	in their countries and can be fought only
2866820	2868800	against another country which
2868800	2870760	has the same situation. For example, you cannot
2870760	2872540	fight an ICT war against Iran
2872540	2874720	because they have only two servers, I think.
2874860	2876380	Last time I checked,
2876380	2878760	it was a couple of mail servers
2878760	2880580	in the mines and whatever
2880580	2882460	ministry, etc.
2882460	2884260	They don't have anything on the nuclear side, so
2884260	2887080	that's unfortunate for the intelligent people here.
2887960	2888220	And
2888840	2890160	but you can fight an ICT
2890160	2891820	war between, I don't know,
2891820	2894040	I'm just doing fiction, Japan and
2894040	2896080	whatever, Korea. They are not at war, but
2896080	2897620	if they would, that would be
2898070	2899640	the thing. So
2902020	2904200	if you want to, this is taken from
2904460	2906320	a book which is called Unrestricted Warfare.
2906320	2907060	I think everybody
2908140	2909960	that has some interest
2909960	2912060	in this has read it. It was
2912060	2913400	first translated by the CIA
2913400	2916080	and then it was retranslated again because there were
2916080	2917940	some points which were not totally
2917940	2920120	clear. And they were the first
2920120	2921900	that unrestricted because
2921900	2922360	they
2924280	2926020	hypothesized that any kind of
2926020	2928160	means to fight a war,
2928160	2930160	there are no rules in fighting a war,
2930160	2932340	which means that you can do just about anything.
2932340	2933920	The important thing is the result,
2933920	2934920	to win.
2935920	2938080	And they were the first to
2938080	2940140	say that one of the
2940140	2941920	best means to fight a war would be
2941920	2943920	through electronic means,
2943920	2945660	exploiting the electronics
2945660	2947200	and the telematics.
2948680	2949740	So, future
2949740	2951880	combat system. This is all
2951880	2953960	the material you will see from here
2953960	2955980	on up to the last
2955980	2956680	slide, which is
2957740	2960150	done by some, I think, Accenture.
2960480	2961880	They are all being
2961880	2963820	taken from open source.
2963960	2965400	Nothing has been hacked.
2966200	2967000	Right?
2967880	2969040	Okay.
2970320	2971960	So, this is
2971960	2974280	the distribution of the consortiums
2974280	2976060	that work on the future combat
2976060	2977720	system. So, if you want to do
2977720	2980060	research from an intelligence point of
2980060	2982460	view, you start from here.
2982460	2983920	You see who is working for
2983920	2985760	whom and on what.
2986080	2988020	And then, you get...
2989480	2990480	Wow!
2990480	2991940	You get all the companies
2991940	2993480	that work on what project
2993480	2995580	and where they are located.
2997380	2998180	One,
2998180	3000300	two, three, four pages.
3000300	3001140	Wow!
3001840	3003940	Wow! What's that?
3004360	3006740	You get all the...
3006740	3008180	What is this?
3010020	3011000	So, this is
3011000	3014360	the specific project
3014360	3015800	that has been
3017100	3018440	assigned, the description
3018440	3019800	of the project, the company
3019800	3023160	and other little information about that.
3023200	3024380	And then, you have one, two
3024380	3026760	and here you go.
3027060	3028380	So, this is all you
3028380	3030280	need, actually, to do what
3030280	3032420	you need to do if you want to start
3032960	3034500	fighting this future combat
3034500	3036060	system. You have
3036060	3038480	the companies, you have the projects,
3038480	3039840	you have the
3041120	3042300	project managers,
3042300	3044180	the people, the ICs, their
3044180	3046400	email address, their email service and their
3046400	3048340	phone number. So,
3048340	3049780	what else do you want? We have
3049780	3052300	two pages of that as an example because we didn't want
3052300	3054080	to make the presentation too long.
3055120	3055980	So,
3055980	3058060	you know, of course, that if you have
3058060	3060120	already an email address of a person,
3060120	3061680	you can do a lot of things from remote
3061680	3063740	because you can use modern
3063740	3065920	Trojan horses technologies or
3066460	3068100	things like that. And I assure
3068100	3070000	you that in the industrial espionage
3070000	3072420	business, which is a business right now,
3072420	3073620	this type of
3074040	3076040	methods and exploiting is
3076040	3077980	being used constantly. And
3077980	3079620	it is very well paid.
3079900	3081220	Very well paid.
3082100	3084100	In the other hand, if you don't have the technical
3084100	3085780	capability, you can just send a person with
3086660	3088000	a bag full of money and
3088000	3090080	you just find out how much one of these
3090080	3091820	people costs. Maybe he's not happy.
3092220	3094080	How people are bought
3094080	3096020	in companies. Maybe you didn't get your
3096020	3098220	promotion. Maybe your boss was too harsh
3098220	3100220	on you. Maybe, I don't know,
3100220	3101960	your wife left you and then you are not
3101960	3103960	happy. And then this person comes
3103960	3105460	near to you at the bar and says,
3105460	3108140	you are better than
3108140	3109740	that. I think you should do
3110280	3112220	something for a better cause.
3112220	3114100	Here is $10,000.
3114120	3116800	$10,000 is not too much. Here is $20,000.
3117000	3118280	At the end, somebody says,
3118280	3119840	okay, let's do it.
3120920	3122320	So, another
3122320	3124160	thing, which you can see here,
3124160	3126580	is a system like the future combat system.
3126620	3128660	What can exploit it? We said before,
3128660	3130180	I mean, you just need to jam it. You don't need to
3130180	3131660	hack it, actually. Because hackers
3132170	3134240	are perfect. They want to
3134240	3135540	do things.
3136120	3138360	It's the act of hacking, which must be.
3138360	3140500	It's not always the result.
3140500	3142520	You want to do that thing
3142520	3144960	and then you say, okay, it's easy to do it.
3144960	3146840	The easy thing is
3146840	3147380	for
3149560	3150720	no good shit,
3150720	3152160	you say in America.
3152180	3154740	I want to do it in a very artistic way.
3154740	3156740	Maybe you take six months and you never get
3156740	3158580	the result because it's too old by the time you get
3158580	3160300	the result. So you just
3160300	3162700	sometimes need to jam something.
3162700	3164280	The communication, for example.
3164280	3166200	In this case, you have an EMP
3166200	3168760	shock generator, which is an electromagnetic
3168760	3170760	pulse shock generator.
3170760	3172380	It's a bomb, basically.
3172440	3175040	You can rent it for research
3175040	3176920	and discovery or research and development
3176920	3179380	purposes, if you can prove you are a researcher.
3179600	3181040	And a lot of people can prove it
3181040	3183440	for $1,500 a month.
3183440	3184140	And then you can
3184620	3186680	have the option to buy it for $11,000
3186680	3187840	afterwards.
3189760	3190620	So this is
3190620	3192600	public. I mean, if you want to buy it, I
3192600	3193740	thought about it, actually.
3195580	3196920	You put it in the middle
3196920	3198700	of a square
3198700	3200900	somewhere and then you activate it.
3200900	3202880	You run very fast because you need to
3202880	3204900	get about three miles far.
3204900	3206620	And then everything
3207240	3208440	in three miles
3208440	3210740	just burns out. Every circuit
3210740	3212780	and all the people that are around the bomb
3212780	3215040	also get suntanned
3215200	3216220	a little bit.
3217500	3217760	So
3220000	3220900	this I put
3220900	3222840	because in the company
3222840	3224900	where I work for, there are a lot of
3224900	3226880	consultants which are being paid a lot of money
3226880	3229060	to do things like that.
3229200	3230640	This is a security management
3230640	3232900	learning model. And it's supposed
3232900	3234800	to tell you how to do security
3234800	3236720	in a company or whatever.
3237220	3237480	And
3238940	3240960	from my experience,
3240960	3243100	all the things that we just said
3243100	3244660	and all the things that we saw
3244660	3247040	in the past, I can tell you that this is just
3247040	3248840	if you work for a company, just
3248840	3250920	don't pay people to do things like that. They are very
3250920	3252840	good if you want to make a big
3252840	3254760	picture. We say in Italy,
3254760	3256940	if you want to wrap fish, you go and buy fish
3256940	3258960	and you need paper to wrap it.
3259060	3260820	That's the thing.
3260820	3263140	So sorry if there is any big consultant in here.
3263140	3264920	And if you have any questions, we don't
3264920	3266780	have enough time. So just write us
3266780	3267560	an email.
3268260	3268920	Okay?
3272620	3274560	You can come here.
3274660	3277140	We have the CD with the comic. You can get it.
3277140	3278940	And by the way, it was supposed to
3278940	3280820	be signed by the Dark Tangent
3280820	3282580	but you know the little Cisco problem
3282580	3285220	he had in the Black Hat
3286160	3286940	was keeping
3286940	3288800	him busy. So basically he will
3288800	3290680	sign it just
3290680	3293000	if you show up yourself with a CD
3293000	3294640	he will sign it. We'll be happy to sign it.
3294640	3296820	CDs are there. And we have a few
3296820	3298620	keystraps here.