1
00:00:08,690 --> 00:00:13,290
This is not the same Shmoo presentation that we anticipated.

2
00:00:13,290 --> 00:00:17,590
There will not be a Hookers for Hackers giveaway this time.

3
00:00:17,590 --> 00:00:19,570
So , I'm sorry to disappoint you.

4
00:00:19,570 --> 00:00:22,590
We have some other, you know, mostly nerdy crap to talk about.

5
00:00:22,590 --> 00:00:25,310
So , maybe next year.

6
00:00:25,670 --> 00:00:31,470
So, I don't know exactly why you're all here, but, you know, we're going to give you everything and we'll figure it out as we go.

7
00:00:31,470 --> 00:00:33,030
I'm Pablos from the Shmoo group.

8
00:00:33,230 --> 00:00:34,470
We do have some stickers.

9
00:00:34,470 --> 00:00:36,470
If you didn't get one, you know, you're a lamer.

10
00:00:36,470 --> 00:00:37,190
Right.

11
00:00:37,490 --> 00:00:38,970
Go to those guys right there.

12
00:00:38,970 --> 00:00:40,030
Raise your hands, guys.

13
00:00:40,410 --> 00:00:49,830
So, what we'd like to do at DEF CON is just lambaste you with everything that we can think of that we've been working on, or at least the cool stuff.

14
00:00:49,830 --> 00:00:51,030
And it's ready.

15
00:00:51,030 --> 00:00:53,710
And so, we have a panel of all different Shmoo guys.

16
00:00:53,710 --> 00:00:56,690
There are a whole bunch of others, but the ones that have stuff to show you today are here.

17
00:00:56,690 --> 00:00:57,730
We're the troublemakers.

18
00:00:57,730 --> 00:00:59,630
They're troublemakers, yeah.

19
00:01:00,130 --> 00:01:02,990
And, um, but a couple things we want to talk about.

20
00:01:02,990 --> 00:01:07,110
And I guess first I'd like to know, did Mike Lynn make it here or not?

21
00:01:07,110 --> 00:01:08,050
Is Mike here?

22
00:01:08,490 --> 00:01:09,370
Spot the Mike.

23
00:01:09,370 --> 00:01:09,770
Spot the Mike.

24
00:01:09,770 --> 00:01:10,770
So , there's no Mike.

25
00:01:11,110 --> 00:01:15,950
Okay, well, I'm sure you all are aware of what's going on with Mike in the recent fiasco.

26
00:01:15,950 --> 00:01:32,130
And he's not allowed to talk, but we wanted to say a couple things about what he's up to, which is important because everything that we do here at DEF CON and in security research has to do with reverse engineering and disclosure of vulnerabilities.

27
00:01:32,130 --> 00:01:37,490
And, unfortunately, it's what we have to work with as far as making systems secure.

28
00:01:37,550 --> 00:01:41,310
We have to find the problems, we have to tell people about them, and we have to fix them.

29
00:01:41,450 --> 00:01:43,070
And that's a lot of what's going on.

30
00:01:43,070 --> 00:01:47,650
And it's really, really pivotal, I think as most of you guys know, to support that.

31
00:01:47,650 --> 00:01:50,810
So , reverse engineering and Mike Lynn.

32
00:01:52,010 --> 00:01:53,570
Oh, now I see why you're clapping.

33
00:01:53,570 --> 00:01:54,570
Clap for Mike!

34
00:01:56,750 --> 00:01:58,470
That's kind of a side project.

35
00:01:58,630 --> 00:01:59,730
Yeah, this is Mike.

36
00:02:04,950 --> 00:02:05,390
So...

37
00:02:07,630 --> 00:02:12,310
So, as you know, Mike recently, in the last few days, managed to get sued and settle with Cisco.

38
00:02:12,490 --> 00:02:16,290
But the work that he's been doing goes on with other people.

39
00:02:16,490 --> 00:02:25,270
And it goes on, and what's important about it is that we can't let a culture of cover-ups for security issues develop.

40
00:02:25,610 --> 00:02:30,570
And if you look at the interests of vendors and the security research community, they're kind of opposed.

41
00:02:30,650 --> 00:02:38,690
But the important, I think, message from what Mike's just been through is that vendors have an obligation to their customers.

42
00:02:38,690 --> 00:02:47,070
And it's really the customers that are being kept in the dark when the vendors aren't disclosing the vulnerabilities that have been around for a while, even once they've been fixed.

43
00:02:47,070 --> 00:02:52,910
So, I think that an important thing to recognize is that all you guys are really important, right?

44
00:02:52,910 --> 00:02:54,790
The work that you're doing is really important.

45
00:02:54,830 --> 00:02:59,690
Some guys, every year, put their ass on the line and some get picked up.

46
00:02:59,690 --> 00:03:01,690
And Mike's not the first, but he's the most recent.

47
00:03:01,690 --> 00:03:05,630
So the important thing is keep up the good work.

48
00:03:05,670 --> 00:03:06,910
And this is...

49
00:03:08,210 --> 00:03:09,470
You guys rock.

50
00:03:09,470 --> 00:03:15,190
This is from a project I worked on to secure cell phones to thighs.

51
00:03:15,470 --> 00:03:24,190
And I managed to patent the use of women's thighs, which, you know, I don't know if there's anyone that leap here, but if you are, let me know.

52
00:03:24,890 --> 00:03:34,550
And then the other thing I wanted to say before we move on is that don't get sidetracked by all the work that people are talking about as far as vulnerabilities.

53
00:03:34,550 --> 00:03:37,750
There's a lot more to security than finding vulnerabilities and exploits.

54
00:03:37,870 --> 00:03:41,090
There's a lot more to security than just patch management and IDS.

55
00:03:41,090 --> 00:03:43,710
There's a lot more to security than policy management.

56
00:03:43,950 --> 00:03:46,610
And what there is is architecture.

57
00:03:46,610 --> 00:03:55,690
What we want to do is change the world so that 15 years from now, we aren't coming back to DEF CON and telling you about the latest exploit we found in firewalls or Wi-Fi or whatever.

58
00:03:55,770 --> 00:04:04,930
We need to find fundamental ways to change the computer systems that we use We need to find ways to take the academic research that's been done and put it into practice.

59
00:04:05,010 --> 00:04:08,110
And this is unfortunately not something that the market has been really good at.

60
00:04:08,110 --> 00:04:11,570
And so I think it's up to you guys since you're learning to think different.

61
00:04:11,570 --> 00:04:17,390
You're already on the fringe a little bit and you've learned about how to break shit.

62
00:04:17,530 --> 00:04:18,710
You know how to break shit.

63
00:04:18,710 --> 00:04:20,650
You know how to build shit that can't be broken.

64
00:04:20,650 --> 00:04:25,330
And what we need to do is figure out how to do that and kind of move our entire industry forward.

65
00:04:25,330 --> 00:04:26,670
And the world in general.

66
00:04:26,670 --> 00:04:28,090
So that's what I wanted to say.

67
00:04:28,090 --> 00:04:31,410
With that, I'm going to hand it over to Eric Johanson.

68
00:04:33,170 --> 00:04:38,190
And Eric is going to take on getting on with the exploits and shit.

69
00:04:41,060 --> 00:04:42,360
Good afternoon, folks.

70
00:04:42,360 --> 00:04:43,240
How are you?

71
00:04:45,100 --> 00:04:47,020
You guys still alive?

72
00:04:50,080 --> 00:04:53,200
So, let's see.

73
00:04:53,200 --> 00:04:59,440
Back at the beginning of this year, I did some work related to international domain names.

74
00:04:59,440 --> 00:05:02,640
This work was apparently...

75
00:05:02,640 --> 00:05:09,820
I was not the first person to do this work specifically related to international domain names and homograph attacks.

76
00:05:10,080 --> 00:05:21,700
I found some holes in, well, most of the browsers that are out there related to how they handle Unicode characters and domain names.

77
00:05:21,700 --> 00:05:24,480
And this attack has been talked about.

78
00:05:24,480 --> 00:05:26,640
There were papers published in 2000.

79
00:05:26,640 --> 00:05:31,140
The vendors were notified and no fixes were done.

80
00:05:31,480 --> 00:05:33,440
This seems like a problem.

81
00:05:34,020 --> 00:05:35,460
No?

82
00:05:41,500 --> 00:05:53,960
So, it was interesting when I gave this short presentation demoing this exploit at ShmooCon because everyone went up in arms and said, you should have notified the vendors first.

83
00:05:55,420 --> 00:06:01,860
The vendors that I did notify several weeks in advance before ShmooCon told me that it was not a vulnerability.

84
00:06:02,320 --> 00:06:04,360
We will be making no fixes.

85
00:06:04,400 --> 00:06:05,480
It's a feature.

86
00:06:05,980 --> 00:06:07,840
It is a feature.

87
00:06:08,940 --> 00:06:12,360
A large hardware manufacturer...

88
00:06:12,360 --> 00:06:14,780
These are not the exploits you are looking for.

89
00:06:17,700 --> 00:06:43,780
Okay, so an IDN exploit or a homograph attack, what it basically is, if you have, let's say, PayPal.com and you have, over here, PayPal.com only the first A in PayPal is actually a Russian A which looks and smells and tastes identical to a Latin A that is effectively a homograph attack because users cannot tell the difference.

90
00:06:43,780 --> 00:06:50,540
There is no difference on your browser, on most platforms, the difference between those two domain names.

91
00:06:50,540 --> 00:06:51,460
So...

92
00:06:53,640 --> 00:06:54,240
Hmm...

93
00:06:54,240 --> 00:06:57,240
Phishers would probably really like that, I suspect.

94
00:06:59,140 --> 00:06:59,740
So...

95
00:06:59,740 --> 00:07:01,340
You know, it was interesting.

96
00:07:01,340 --> 00:07:09,500
The vendor response I got, basically, most vendors told me, this is not a bug.

97
00:07:09,920 --> 00:07:10,740
Go away.

98
00:07:10,740 --> 00:07:12,220
We don't want to hear from you.

99
00:07:12,220 --> 00:07:17,140
After it was released, suddenly I'm getting calls from legal departments.

100
00:07:17,140 --> 00:07:34,460
So, clearly, vulnerability disclosure is something that we all face as security researchers because just this week, we have someone that's also going to be dealing with more issues related to how they disclose something.

101
00:07:34,480 --> 00:07:39,460
There's an RFC written out related to vulnerability disclosure.

102
00:07:39,460 --> 00:07:42,560
Everyone seems to be doing things in a slightly different way.

103
00:07:42,640 --> 00:07:52,340
But ultimately, what a lot of people seem to be forgetting is just because a vulnerability is found, doesn't mean that they're the first people to find it.

104
00:07:52,880 --> 00:07:56,640
I was not the first person to find the IDN homograph attack vulnerability.

105
00:07:56,640 --> 00:07:58,220
It still hadn't been fixed.

106
00:07:58,260 --> 00:08:03,980
The work that Mike has been doing, it is very likely that other people know about those attacks.

107
00:08:04,980 --> 00:08:06,560
It's very likely.

108
00:08:06,780 --> 00:08:12,260
And just because it hasn't been disclosed does not mean that it places all of our society at risk.

109
00:08:12,400 --> 00:08:20,580
So, in short, I think ultimately, for consumers to be the best informed, they need to be aware of these vulnerabilities.

110
00:08:21,220 --> 00:08:25,500
And ultimately, vendors are out to make the most money.

111
00:08:25,840 --> 00:08:33,160
And I think that's in direct conflict with the Internet and the routers of this world and the web browsers of this world.

112
00:08:33,360 --> 00:08:38,520
So, think really hard when you find that vulnerability about how you want to handle it.

113
00:08:38,520 --> 00:08:40,300
Don't be bought out.

114
00:08:40,500 --> 00:08:41,920
Don't let it happen.

115
00:08:43,540 --> 00:08:43,900
So...

116
00:08:44,900 --> 00:08:45,620
Yeah!

117
00:08:50,590 --> 00:08:52,310
All right, so...

118
00:08:52,890 --> 00:08:55,910
Yeah, I know, we're going to get up here and we're going to preach a little bit or whatever.

119
00:08:55,910 --> 00:08:57,630
We got cool shit, don't worry.

120
00:08:59,190 --> 00:09:01,150
Everybody's like, hey man, what is it?

121
00:09:01,150 --> 00:09:06,110
So we're going to get down and dirty and this will fry your fucking brain.

122
00:09:07,930 --> 00:09:12,470
If you're not familiar with what Rainbow Tables are, Dan will go into it a little bit.

123
00:09:12,470 --> 00:09:17,630
If you haven't been to the rainbowtables.shmoo.com website, you'll get into that.

124
00:09:19,010 --> 00:09:20,750
But Dan's got something.

125
00:09:20,850 --> 00:09:22,350
Dan's got a new bag.

126
00:09:22,370 --> 00:09:23,810
Anybody here know math?

127
00:09:24,630 --> 00:09:26,230
All right, hi all.

128
00:09:28,370 --> 00:09:38,110
There's no slide for this, but since I'm up here and I have all of your attention, I saw Jennifer Granick just leave, but could everybody who's from the EFF who's here, please stand up.

129
00:09:40,650 --> 00:09:42,090
We're talking about...

130
00:09:42,530 --> 00:09:43,610
Hey guys.

131
00:09:45,310 --> 00:09:48,450
All right, I'm just going to do introductions quick as I see you.

132
00:09:48,450 --> 00:09:53,210
I used to work with these guys very briefly as a staff technologist and now I'm elsewhere.

133
00:09:53,330 --> 00:09:55,030
But these guys, we had a party last night.

134
00:09:55,030 --> 00:09:56,210
You might have been to it.

135
00:09:56,290 --> 00:10:00,550
We're talking about vulnerability disclosure, full disclosure, legal ramifications.

136
00:10:00,550 --> 00:10:07,250
Jennifer Granick, who is Mike's counsel, and the EFF, these are all the guys saving all of our asses every day.

137
00:10:07,250 --> 00:10:10,250
So please give a round of applause for the EFF.

138
00:10:17,480 --> 00:10:18,840
Go to the dunk tank.

139
00:10:18,840 --> 00:10:20,100
I'm going to be there tomorrow.

140
00:10:20,100 --> 00:10:20,920
Dunk me.

141
00:10:21,680 --> 00:10:23,420
All right, so Rainbow Tables.

142
00:10:23,780 --> 00:10:25,040
Who's familiar with Rainbow Crack?

143
00:10:25,040 --> 00:10:26,120
Put your hand up.

144
00:10:27,020 --> 00:10:27,900
Word.

145
00:10:28,020 --> 00:10:34,260
All right, Rainbow Crack is an implementation of a technique made by a European researcher.

146
00:10:34,600 --> 00:10:37,920
And without getting into the heavy math of that, basically it's software.

147
00:10:37,920 --> 00:10:39,200
You can download it.

148
00:10:39,260 --> 00:10:41,280
Jennifer Granick, I see you walking back there.

149
00:10:41,280 --> 00:10:41,800
Jennifer?

150
00:10:41,800 --> 00:10:43,680
Everybody give Jennifer a hand of applause.

151
00:10:43,680 --> 00:10:44,740
Kiss her ass.

152
00:10:47,400 --> 00:10:49,080
Thank you.

153
00:10:50,860 --> 00:11:03,100
So you download Rainbow Crack, and basically what it lets you do is consume all of her CPU time and generate, according to what it says, nearly every single possible landman hash.

154
00:11:03,100 --> 00:11:04,260
Anybody familiar with landman?

155
00:11:04,260 --> 00:11:05,320
Raise your hand.

156
00:11:05,960 --> 00:11:06,520
Word.

157
00:11:06,520 --> 00:11:07,460
Okay, great.

158
00:11:07,500 --> 00:11:10,520
So that's what it does, right?

159
00:11:10,520 --> 00:11:20,800
And we, like Beetle over there in the Bosox cap, had a good idea and he said, hey, we got a bunch of people and we have a bunch of machines and we have too much free time, so let's just do this.

160
00:11:20,800 --> 00:11:23,480
Let's just generate every single landman hash that there is.

161
00:11:23,720 --> 00:11:25,080
So we started doing it.

162
00:11:25,080 --> 00:11:27,220
We just downloaded the code off the guy's website.

163
00:11:27,520 --> 00:11:33,640
We fired it up on about 150 machines across different shmoo, and we generated it.

164
00:11:33,640 --> 00:11:36,440
And our goal was to use it to generate...

165
00:11:36,440 --> 00:11:39,960
You can do different key spaces, like if you want to do five characters, six characters, whatever.

166
00:11:39,960 --> 00:11:45,920
We wanted to do the configuration that had every single seven-character valid hash for landman.

167
00:11:45,920 --> 00:11:49,700
Every uppercase, alphanumeric character, a certain set of symbols and space.

168
00:11:50,320 --> 00:11:51,780
So we did it.

169
00:11:51,780 --> 00:11:54,340
And, you know, landman, right?

170
00:11:54,340 --> 00:11:55,480
We put it up.

171
00:11:55,480 --> 00:11:57,000
The link is live, right?

172
00:11:58,520 --> 00:12:03,340
RainbowTables.shmoo.com 43 gigabytes over BitTorrent.

173
00:12:03,340 --> 00:12:04,640
Go download it now.

174
00:12:04,640 --> 00:12:07,700
If you have a laptop, saturate Defcon's bandwidth.

175
00:12:07,700 --> 00:12:10,620
We're going for the BitTorrent record here.

176
00:12:11,000 --> 00:12:11,980
World's largest torrent.

177
00:12:11,980 --> 00:12:12,900
Can you man the slides for me?

178
00:12:12,900 --> 00:12:13,480
Right there.

179
00:12:13,480 --> 00:12:14,020
Right.

180
00:12:15,260 --> 00:12:15,660
So...

181
00:12:15,660 --> 00:12:18,700
The big thing was that we were told...

182
00:12:19,220 --> 00:12:21,580
And I'll cover the political part real quick.

183
00:12:21,580 --> 00:12:23,000
He'll cover the technical part.

184
00:12:23,000 --> 00:12:24,700
But the political part was...

185
00:12:25,500 --> 00:12:27,680
We got an email, and you'll see the email in just a second.

186
00:12:27,680 --> 00:12:34,500
It said, hey, I wrote Rainbow Crack, and I don't like you giving away the tables for free because, you know, I charge for them.

187
00:12:34,500 --> 00:12:37,580
And mind you, there's no license on the Rainbow Crack code at all.

188
00:12:37,580 --> 00:12:38,060
None.

189
00:12:38,060 --> 00:12:39,040
You know, the code is free.

190
00:12:39,040 --> 00:12:41,500
You can download it, but there's no BSD, no GPL, whatever.

191
00:12:41,540 --> 00:12:49,320
Meanwhile, I mean, there's other folks out there that are charging $700, $800 for, like, the Landman Symbol 32, you know, plus space tables.

192
00:12:49,480 --> 00:12:50,120
$700.

193
00:12:50,380 --> 00:12:51,940
You can go get those tables.

194
00:12:51,940 --> 00:12:55,480
Because, obviously, it's a little difficult for everybody to get together and just kind of generate them.

195
00:12:55,480 --> 00:12:56,200
Preach, brother.

196
00:12:56,280 --> 00:12:57,760
And we said, fuck it.

197
00:12:58,040 --> 00:12:59,680
We'll just generate them and give them away for free.

198
00:12:59,680 --> 00:13:00,200
So, there.

199
00:13:00,200 --> 00:13:02,620
A 43.9 gigabyte torrent.

200
00:13:02,620 --> 00:13:03,880
Join the torrent, bitches.

201
00:13:04,300 --> 00:13:05,180
Right there.

202
00:13:07,720 --> 00:13:10,240
That's an $800 torrent, I guess.

203
00:13:12,480 --> 00:13:14,640
We're all about added value.

204
00:13:15,020 --> 00:13:19,040
And Dan will go over the finer technical points of the email that we received.

205
00:13:19,600 --> 00:13:20,280
All right.

206
00:13:20,340 --> 00:13:23,860
There's the email that we got from the author of Rainbow Crack.

207
00:13:23,960 --> 00:13:26,660
And I would butcher his name, so I'm not going to mention it.

208
00:13:27,280 --> 00:13:28,540
But , you know...

209
00:13:28,540 --> 00:13:29,460
All right, you can read it.

210
00:13:29,460 --> 00:13:31,140
I mean, the text is sort of small, but you can see it.

211
00:13:31,140 --> 00:13:33,060
We bolded out the important points.

212
00:13:33,060 --> 00:13:36,560
For those guys selling the table without permission from me, they are not welcome.

213
00:13:36,660 --> 00:13:38,040
But you are worse.

214
00:13:39,860 --> 00:13:44,480
And the second paragraph basically goes into why he generated it, why it's cool, yada, yada, yada.

215
00:13:44,480 --> 00:13:46,340
And then, obviously, the third paragraph.

216
00:13:46,340 --> 00:13:47,060
Are you feeling cool?

217
00:13:47,060 --> 00:13:49,460
Because knowing all the passwords is cooler than trying to crack one.

218
00:13:49,460 --> 00:13:53,380
That's the line from our original website, rainbowtables.shimmy.com.

219
00:13:53,600 --> 00:13:57,560
All over the world, there will be a lot of guys can do what you do.

220
00:13:57,560 --> 00:13:58,140
They aren't.

221
00:13:58,140 --> 00:13:58,720
Do you know why?

222
00:13:58,720 --> 00:14:00,940
To show off proof neither your ability nor knowledge.

223
00:14:00,940 --> 00:14:03,080
We're just running your code, dude.

224
00:14:03,080 --> 00:14:04,320
We liked you.

225
00:14:04,480 --> 00:14:06,400
Why can't we all just get along?

226
00:14:06,860 --> 00:14:08,260
We're not hippies.

227
00:14:08,640 --> 00:14:12,260
And then, you know, if possible, please keep honored, blah, blah, blah.

228
00:14:12,460 --> 00:14:14,720
Don't be crazy anymore.

229
00:14:16,100 --> 00:14:19,120
Well, I mean, look at us.

230
00:14:19,420 --> 00:14:20,220
Honestly.

231
00:14:22,620 --> 00:14:24,180
Don't we all look sane?

232
00:14:24,180 --> 00:14:31,900
All right, so we basically said that we had a lot of reasons as we were doing the rainbow table generation to make it better.

233
00:14:31,960 --> 00:14:33,320
And initially, that was all we were going to do.

234
00:14:33,320 --> 00:14:35,620
We were like, oh, you know, there's some pieces of code here we could optimize.

235
00:14:36,400 --> 00:14:39,780
But then we had that email, and so that pissed us right off.

236
00:14:39,780 --> 00:14:44,180
And I mean, the big key was that, like, you know, once Dan started looking at it, he was like, fuck it.

237
00:14:44,180 --> 00:14:45,680
I mean, we can do something better.

238
00:14:47,280 --> 00:14:49,240
So we don't need your stinking code, dude.

239
00:14:49,240 --> 00:14:51,680
And snacks, by the way, says fuck off.

240
00:14:51,840 --> 00:14:52,340
Yeah.

241
00:14:53,860 --> 00:14:56,100
So we have an unnamed project.

242
00:14:56,100 --> 00:14:57,600
We don't have a name for it yet.

243
00:14:57,840 --> 00:14:58,760
You okay, man?

244
00:14:59,580 --> 00:15:00,380
Sorry.

245
00:15:01,880 --> 00:15:03,700
We're making people fall out of their chairs already.

246
00:15:03,700 --> 00:15:04,360
Sweet.

247
00:15:06,940 --> 00:15:09,340
All right, so we have an unnamed project.

248
00:15:09,380 --> 00:15:12,220
It's me, Dan Moniz, and Reverend Dr.

249
00:15:12,220 --> 00:15:14,160
Patrick Stack, who's not here.

250
00:15:14,160 --> 00:15:16,060
Some of you may know him as Optix.

251
00:15:16,500 --> 00:15:20,780
He's not a schmoo, but we're working together on this because we both love each other.

252
00:15:22,040 --> 00:15:27,120
So we wanted to improve on Rainbow Crack, and so we started out just trying to optimize Rainbow Crack.

253
00:15:27,120 --> 00:15:30,640
Leave the method the same, but just, you know, make it better.

254
00:15:30,820 --> 00:15:33,980
But in the process of doing that, we found out it is to suck.

255
00:15:35,860 --> 00:15:38,940
So we changed our approach, and we made a new tool.

256
00:15:38,940 --> 00:15:40,620
It doesn't have a name yet.

257
00:15:41,820 --> 00:15:43,040
Problems with Rainbow Crack.

258
00:15:43,040 --> 00:15:44,900
Who here knows a little bit of math?

259
00:15:45,940 --> 00:15:46,640
All right.

260
00:15:48,440 --> 00:15:49,640
All right.

261
00:15:49,700 --> 00:15:51,500
So I'm going to blow through this.

262
00:15:51,500 --> 00:15:58,140
If you want to come to the nitty-gritty, it's either going to be, and they're going to pimp this later, either at SchmooCon in January in D.C.

263
00:15:58,140 --> 00:15:59,320
in 2006.

264
00:15:59,320 --> 00:16:00,460
Or Guantanamo.

265
00:16:00,460 --> 00:16:01,100
We're on the edge.

266
00:16:01,980 --> 00:16:07,540
Or, if we're really good at it, we'll get it done by TourCon, which you should also come to this September.

267
00:16:09,120 --> 00:16:10,840
A reduction function bias.

268
00:16:10,840 --> 00:16:17,980
There's a reduction function in Rainbow Crack, and it has this bias issue, meaning that it does something a little fucked up.

269
00:16:18,240 --> 00:16:36,860
If your key space is six valid inputs, and you have a 2 to the 4, which is 16, number of outputs, the reduction that Rainbow Crack does, slightly simplified, I'm ignoring one little thing that doesn't matter, is the total number of outputs, modulo the total number of inputs,

270
00:16:36,860 --> 00:16:39,340
and that equals what we're calling a bias marker.

271
00:16:39,440 --> 00:16:40,500
Break it down.

272
00:16:41,920 --> 00:16:44,560
So, here's some modular arithmetic, real simple.

273
00:16:44,560 --> 00:16:49,040
0 mod 6 equals 0, all the way through to 15 mod 6 equals 3.

274
00:16:49,060 --> 00:16:50,540
You can sort of see the columns.

275
00:16:50,680 --> 00:16:56,740
It's a lot of modular arithmetic, but one thing you'll notice is that there are three of every single value, i.e.

276
00:16:56,740 --> 00:16:58,300
the thing to the right of the equals sign.

277
00:16:58,300 --> 00:17:01,180
There's three of every of them, except four and five.

278
00:17:01,360 --> 00:17:05,180
We only have two of those in this 16 issue here.

279
00:17:05,180 --> 00:17:15,040
So, say that Landman only had six possible inputs, and say that the algorithm, which in Landman is DES, had 2 to the 4 outputs, or 16.

280
00:17:16,340 --> 00:17:31,300
By taking an arbitrary random output from the algorithm, we can assume that the algorithm output is random, and modulo it by 6, there's a better chance of the input values being below that bias marker, that thing to the right of the equals sign.

281
00:17:31,300 --> 00:17:38,560
So, values 0 to 3, because we have more of those, have a better chance of being picked at random due to this than the 4 to the 5 values.

282
00:17:38,560 --> 00:17:40,100
We only have two of those.

283
00:17:40,260 --> 00:17:40,860
See?

284
00:17:41,780 --> 00:17:43,680
I know I'm going quick.

285
00:17:44,380 --> 00:17:55,720
So, the real bias problem here is that's just a summation, you know, that's for i equals 0 to i equals 7 of 69 to the i.

286
00:17:55,720 --> 00:18:03,080
So, this Riemann sum is not an integral factor of 2 to the 64, just like 6 is not an integral factor of 16.

287
00:18:03,240 --> 00:18:05,200
This modular arithmetic has a bias.

288
00:18:05,760 --> 00:18:17,840
So, if we bring this back to what Rainbow Crack actually does, instead of my bullshit example, you can assume that the output of DES is statistically random, or at least random enough that the bias would still be present.

289
00:18:18,080 --> 00:18:19,440
Why it matters.

290
00:18:19,480 --> 00:18:20,620
Okay, here's some math.

291
00:18:20,620 --> 00:18:21,720
I'm going to break it down.

292
00:18:21,940 --> 00:18:26,260
n equals the floored result of the total number of outputs over the total number of inputs.

293
00:18:26,260 --> 00:18:31,920
We're going to add 1 if n is below the bias marker, if it's one of those low values we have more of.

294
00:18:32,080 --> 00:18:34,660
And that 1 represents the extra chance.

295
00:18:34,660 --> 00:18:37,580
We have only two 4s and 5s, we have three of everything else.

296
00:18:37,860 --> 00:18:44,560
1 plus n, so those are those more present values over the total number of outputs, chance of hitting that key.

297
00:18:44,980 --> 00:18:47,660
n, the ones that we only have two of.

298
00:18:47,660 --> 00:18:48,720
Same thing.

299
00:18:49,020 --> 00:18:56,560
Values below that bias marker are unfairly weighted and are more likely to be inputs to the rainbow chain generation.

300
00:18:56,560 --> 00:18:59,860
What that basically means is, he screws up the math.

301
00:19:00,160 --> 00:19:07,400
And he basically does modular arithmetic wrong, so that he ends up generating impossible value hashes.

302
00:19:07,400 --> 00:19:08,800
They can't work.

303
00:19:08,800 --> 00:19:17,760
So our generation technique, or how we get around this, we start generating at the last possible input that's valid for landman, and we walk towards the first.

304
00:19:18,220 --> 00:19:22,760
As we generate, we use a bit mask, so we can determine if we have computed the key or not.

305
00:19:22,760 --> 00:19:26,040
We know if the bit mask works, if it's there or if it's not.

306
00:19:26,040 --> 00:19:33,180
So we have 100%, like mathematically provable 100% verified key space, because everything is accounted for.

307
00:19:33,560 --> 00:19:42,040
At 1 bit per input, this method requires 768 gigabytes of disk space, if we were going to do it on one machine.

308
00:19:43,840 --> 00:19:46,240
Our badass sorting foo.

309
00:19:47,700 --> 00:19:52,160
We separate out anything that has less than or equal to 6 characters.

310
00:19:52,280 --> 00:19:57,020
7 character key space is one table, 5 to 6 character key space is another.

311
00:19:57,020 --> 00:20:00,800
We do this so that you can detect the length of the password really easily.

312
00:20:00,840 --> 00:20:01,840
Landman primer.

313
00:20:01,840 --> 00:20:03,800
Here's how landman works really quickly.

314
00:20:03,800 --> 00:20:08,100
Take 14 bytes of input, split it into two chunks, each one is 7 bytes.

315
00:20:08,400 --> 00:20:09,780
Hash them independently.

316
00:20:10,800 --> 00:20:12,380
So say I have a password of dog.

317
00:20:12,620 --> 00:20:15,940
Dog turns into dog with nulls at the end of it.

318
00:20:16,200 --> 00:20:19,760
And then we split it into dog and then some more nulls.

319
00:20:20,500 --> 00:20:27,920
You can detect that the first half is 7 characters or less of this particular password, because the second half of the password is the null hash.

320
00:20:27,980 --> 00:20:29,880
It's the hash of nulls.

321
00:20:30,300 --> 00:20:34,220
Which is always going to be the same for any password 7 characters or less.

322
00:20:34,660 --> 00:20:39,900
Now with the password of SpamDadRules Word!

323
00:20:39,920 --> 00:20:41,300
Where's your Spam Daddy?

324
00:20:42,240 --> 00:20:45,640
There was one guy in the audience who that was designed to be for.

325
00:20:47,520 --> 00:20:49,860
That's my elite Stego technique.

326
00:20:50,360 --> 00:20:52,000
Alright, so, same thing.

327
00:20:52,000 --> 00:20:53,060
More than 7 characters.

328
00:20:53,060 --> 00:20:56,240
So it goes to that, SpamDad and then rules, null null null.

329
00:20:56,260 --> 00:21:01,400
You know that this hash is 7 characters That's actually more than That slide is wrong.

330
00:21:01,400 --> 00:21:03,640
This hash is actually more than 7 characters.

331
00:21:03,640 --> 00:21:04,720
7 characters or more.

332
00:21:05,000 --> 00:21:07,420
Because the second half of the hash is not the null password hash.

333
00:21:07,420 --> 00:21:08,860
We get the rules in there.

334
00:21:09,400 --> 00:21:13,720
So this decreases the time spent looking through every hash that can't work.

335
00:21:14,580 --> 00:21:18,300
RainbowCrack loses, because RainbowCrack just generates random hashes.

336
00:21:18,420 --> 00:21:19,620
He's just using your CPU time.

337
00:21:19,620 --> 00:21:21,160
He's just saying I don't know.

338
00:21:21,440 --> 00:21:22,420
That might work.

339
00:21:22,760 --> 00:21:25,220
And that reduction function has that bias problem.

340
00:21:25,280 --> 00:21:28,280
So, random hash, okay, fair enough.

341
00:21:28,280 --> 00:21:30,420
That's, you know, a pretty good approach.

342
00:21:30,420 --> 00:21:33,480
But plus this error equals lame.

343
00:21:33,480 --> 00:21:36,000
Bad plus suck equals lame-zor.

344
00:21:37,560 --> 00:21:39,480
Now we get our crack on.

345
00:21:41,260 --> 00:21:46,420
RTcrack, that's the tool that you use in RainbowCrack to actually crack the passwords once you've made them all.

346
00:21:46,860 --> 00:21:53,640
It reads in as much of the hash table file that RTgen, which is the generator, generates using the read syscall.

347
00:21:54,080 --> 00:21:59,200
And then it walks linearly to check to see if the endpoints of the rainbow chain match.

348
00:21:59,420 --> 00:22:02,840
And this has O to the N complexity, big O notations, standard stuff.

349
00:22:03,960 --> 00:22:08,520
We store the start point and the endpoints in separate files on corresponding offsets.

350
00:22:08,520 --> 00:22:19,180
And then we take the page size on the x86 architecture, 4096 bytes, divide it by the entry size, 8, plus 1 for the index, and that gives us 513.

351
00:22:19,500 --> 00:22:24,820
So every 513th entry, after we've sorted them all, we store it in a special index file.

352
00:22:24,820 --> 00:22:33,820
And at crack time, we mmap this endpoint index file and use divide and conquer or Fibonacci find to find out if the endpoint is in the index file.

353
00:22:33,820 --> 00:22:39,520
Or if it's not, to find out what offset the endpoint is referenced in in the master index file.

354
00:22:39,800 --> 00:22:41,300
Now we get our search on.

355
00:22:41,820 --> 00:22:52,520
Thus, for each offset, we read a max , maximum of one page of memory off of disk rather than reading the 12 gigabyte file you did.

356
00:22:53,040 --> 00:22:58,780
So 496 bytes maximum, ever, to read 512 possible hashes.

357
00:22:59,080 --> 00:23:01,920
And this is a Bayes tree that's been modified slightly.

358
00:23:02,120 --> 00:23:08,660
Patrick, who came up with this method, has a doctorate of divinity in searching and sorting from the church of Donald Knuth.

359
00:23:09,520 --> 00:23:10,180
Awesome.

360
00:23:10,920 --> 00:23:12,340
Give it up for optics.

361
00:23:12,540 --> 00:23:13,380
Optics.

362
00:23:16,860 --> 00:23:18,100
Anybody have any Advil?

363
00:23:18,160 --> 00:23:23,280
He sent an email to Zhu, trying to explain this to him, and Zhu's like, nah man, I don't know that.

364
00:23:25,340 --> 00:23:28,000
So Rainbow Crack gets an L for lame.

365
00:23:28,240 --> 00:23:33,660
Disk IO in Rainbow Crack costs as much CPU time as encryption, if not more.

366
00:23:34,040 --> 00:23:39,380
And so Rainbow Crack fails to account for this in the way he does his statistics about how long it's going to take you to make all the keyspace.

367
00:23:39,380 --> 00:23:40,880
Don't be crazy anymore.

368
00:23:42,900 --> 00:23:44,700
Say it more whiny.

369
00:23:44,700 --> 00:23:46,360
Don't be crazy anymore.

370
00:23:47,200 --> 00:23:48,880
So here's our secret sauce.

371
00:23:48,880 --> 00:23:59,680
Our code is implemented in C and assembly for the IA-64 Itanium 2 and running on a classified number of processors in an undisclosed location.

372
00:23:59,820 --> 00:24:03,100
But we have to give a shout out to SGI for helping us out with this.

373
00:24:03,100 --> 00:24:05,180
Any SGI people in the house?

374
00:24:05,940 --> 00:24:06,880
Nobody?

375
00:24:06,880 --> 00:24:07,960
I'm sorry.

376
00:24:08,920 --> 00:24:11,340
We also implemented the generator.

377
00:24:11,400 --> 00:24:18,140
We haven't done the cracker yet, but the generator's in VHDL to run as customized specialized hardware on a Spartan 3 FPGA.

378
00:24:18,140 --> 00:24:19,160
Flip that up.

379
00:24:19,220 --> 00:24:19,960
There we go.

380
00:24:19,960 --> 00:24:24,520
Things generating landman hashes as we speak, basically.

381
00:24:24,880 --> 00:24:26,340
Okay, I'm holding it up higher.

382
00:24:26,340 --> 00:24:27,080
Jeez.

383
00:24:27,080 --> 00:24:28,140
And that's me.

384
00:24:28,140 --> 00:24:28,840
I'm done.

385
00:24:28,840 --> 00:24:30,960
It has blinking lights and shit.

386
00:24:32,400 --> 00:24:33,260
Thank you.

387
00:24:34,620 --> 00:24:36,740
Oh my god!

388
00:24:36,740 --> 00:24:38,360
That's so fucking cool.

389
00:24:42,120 --> 00:24:44,840
The brain's coming out of my ears.

390
00:24:45,860 --> 00:24:47,180
That's just hot, man.

391
00:24:47,180 --> 00:24:48,400
That's so hot.

392
00:24:49,480 --> 00:24:54,060
Alright, so I'm going to talk about a few wireless things here and there.

393
00:24:55,580 --> 00:25:00,220
First of all, why oh why do we Wi-Fi?

394
00:25:00,780 --> 00:25:03,540
Who here has an open wireless network at home?

395
00:25:04,160 --> 00:25:04,840
Go ahead.

396
00:25:04,840 --> 00:25:05,960
You can admit it.

397
00:25:06,500 --> 00:25:09,480
My name's Beetle, and I have an open wireless network at home.

398
00:25:11,960 --> 00:25:14,240
You know, crap.

399
00:25:14,400 --> 00:25:16,340
My TiVo, it can't do WPA.

400
00:25:16,340 --> 00:25:18,220
And my PSP, it can't either.

401
00:25:18,220 --> 00:25:19,700
Does it really fucking matter?

402
00:25:19,900 --> 00:25:26,300
I mean, at the end of the day, does it matter if somebody's reading my streams of Girls Gone Wild?

403
00:25:26,760 --> 00:25:31,280
I mean, does it matter that somebody's messing with my Wipeout Pure ad hoc session?

404
00:25:31,560 --> 00:25:33,020
Do we really care?

405
00:25:33,220 --> 00:25:36,800
Some of the technology, it really doesn't matter if it's that secure.

406
00:25:36,980 --> 00:25:38,160
It's dumb.

407
00:25:38,160 --> 00:25:40,640
It's dumb, it's entertainment, blah blah blah.

408
00:25:41,020 --> 00:25:45,420
But, when you start looking at different environments, where in the world should you be actually doing wireless?

409
00:25:45,420 --> 00:25:46,300
Coffee shops?

410
00:25:46,300 --> 00:25:46,880
Eh, alright.

411
00:25:46,880 --> 00:25:47,320
Airports?

412
00:25:47,320 --> 00:25:48,120
Mm, maybe.

413
00:25:48,440 --> 00:25:49,240
Hospitals?

414
00:25:49,700 --> 00:25:50,500
Banks?

415
00:25:51,980 --> 00:25:53,720
Nuclear power plants?

416
00:25:56,340 --> 00:25:57,640
You know, this is interesting.

417
00:25:57,640 --> 00:25:59,340
I got this from Matt Fisher.

418
00:25:59,340 --> 00:26:00,380
He sent this to me.

419
00:26:00,820 --> 00:26:01,340
Scanned it in.

420
00:26:01,340 --> 00:26:03,080
He was like, man, check this out.

421
00:26:03,080 --> 00:26:05,800
They're doing wireless at some nuke plants.

422
00:26:06,000 --> 00:26:08,140
I'm like, okay, cool.

423
00:26:08,480 --> 00:26:10,020
He was like, no, no, no.

424
00:26:10,500 --> 00:26:11,740
Look a little closer.

425
00:26:13,200 --> 00:26:14,920
IP address, baby.

426
00:26:19,050 --> 00:26:26,290
Not only do they tell you that they're running Cisco hardware, they tell you what the internal address space is at Comanche Peak, Arizona, or Azima.

427
00:26:27,570 --> 00:26:28,390
It's great.

428
00:26:28,390 --> 00:26:33,710
Azima has installed monitoring devices on more than 50 pieces of critical equipment.

429
00:26:39,780 --> 00:26:41,760
Where did we go wrong?

430
00:26:41,760 --> 00:26:44,660
I mean, and where the hell are we going?

431
00:26:45,420 --> 00:26:47,900
I mean, it's a technology of convenience, right?

432
00:26:47,900 --> 00:26:52,300
But there's obviously this inconvenience of securing it, so we just put it out there.

433
00:26:52,540 --> 00:26:56,460
And then all these users, as far as they're concerned, they're left in the authentication cold.

434
00:26:56,460 --> 00:26:58,900
And then the standards, they're half-assed to begin with.

435
00:26:58,900 --> 00:27:01,860
And then how they're implemented, that's half-assed as well.

436
00:27:02,480 --> 00:27:07,400
And then, of course, everybody has this acronym knowledge.

437
00:27:07,700 --> 00:27:11,980
Everybody has a degree in acronyms now, and they use the acronyms to secure their networks.

438
00:27:12,460 --> 00:27:13,340
Right?

439
00:27:13,360 --> 00:27:16,320
I have an EAP-protected network, really.

440
00:27:17,180 --> 00:27:18,300
Hallelujah.

441
00:27:18,800 --> 00:27:21,860
I use a VPN to secure my wireless, really.

442
00:27:22,780 --> 00:27:25,180
How did you deploy that VPN?

443
00:27:25,180 --> 00:27:27,360
In what configuration is that VPN?

444
00:27:27,360 --> 00:27:29,700
Which EAP are you using?

445
00:27:30,900 --> 00:27:32,680
Choose a mobile network with care.

446
00:27:34,880 --> 00:27:36,940
Choose a mobile network at random.

447
00:27:40,430 --> 00:27:43,150
How the fuck does the user know?

448
00:27:43,850 --> 00:27:45,510
Really, how?

449
00:27:46,510 --> 00:27:48,450
Let's look at a rogue access point attack.

450
00:27:48,450 --> 00:27:49,830
Graphical, we've seen this.

451
00:27:49,830 --> 00:27:50,990
Defcon, two years ago.

452
00:27:50,990 --> 00:27:53,030
Unfortunately, the press just caught on this year.

453
00:27:55,450 --> 00:28:00,650
Wi-Fi card comes in, gets disassociated by an access point that's closer or stronger.

454
00:28:00,830 --> 00:28:07,630
SSID effectively becomes bad guy, and this, before Windows XP Service Pack 2, would occur without the user's knowledge.

455
00:28:07,730 --> 00:28:10,850
Now, with Service Pack 2, it tells you when the SSID changes.

456
00:28:10,850 --> 00:28:11,710
Ooh.

457
00:28:13,730 --> 00:28:15,130
Rock on.

458
00:28:17,270 --> 00:28:22,090
So nobody can forge an SSID or duplicate an SSID or a MAC address or any of that.

459
00:28:22,090 --> 00:28:23,530
So, rogue access point attacks.

460
00:28:23,530 --> 00:28:37,170
When you're choosing your Wi-Fi weapon, normal gear running at 14 dBm, Cisco gear running at 20 dBm, Sineo gear running at 23 dBm, throw on a nice little directional antenna, you get 15 dBd and 38 dBd total.

461
00:28:37,170 --> 00:28:38,370
Six watts!

462
00:28:38,370 --> 00:28:40,710
Versus 25 milliwatts.

463
00:28:40,710 --> 00:28:42,710
You will win every time.

464
00:28:43,630 --> 00:28:48,950
There's no way that somebody's going to actually get on to the other access point, the legitimate access point.

465
00:28:48,950 --> 00:28:49,690
They're mine.

466
00:28:50,490 --> 00:28:53,110
So we have things that you can display, such as Hotmail.

467
00:28:53,110 --> 00:28:54,510
That's not Hotmail.

468
00:28:57,820 --> 00:28:59,320
You have other things, like PayPal.

469
00:28:59,320 --> 00:29:00,680
That's not PayPal.

470
00:29:02,860 --> 00:29:04,480
And at airports.

471
00:29:04,700 --> 00:29:06,220
That's pretty interesting.

472
00:29:06,320 --> 00:29:07,980
You're seeing this across the country.

473
00:29:07,980 --> 00:29:09,580
Joe's Wireless Hotspot.

474
00:29:09,580 --> 00:29:11,380
I don't know who they are.

475
00:29:12,880 --> 00:29:13,820
Done.

476
00:29:14,940 --> 00:29:17,400
Rogue access points are not going to go away.

477
00:29:17,400 --> 00:29:23,440
Users are going to be users, and they will fall victim to being drawn over to impersonating access points.

478
00:29:23,440 --> 00:29:29,680
If you didn't notice, phishing, identity theft, on the rise.

479
00:29:29,820 --> 00:29:32,760
Wireless hotspot usage, on the rise.

480
00:29:33,220 --> 00:29:36,640
Apparently, some people, like Gartner, feel that that's not a threat.

481
00:29:36,640 --> 00:29:37,480
It's overblown.

482
00:29:37,480 --> 00:29:39,280
Gartner can blow us.

483
00:29:40,340 --> 00:29:41,880
This is a problem.

484
00:29:42,060 --> 00:29:43,240
Pay attention.

485
00:29:45,060 --> 00:29:46,560
It gets worse.

486
00:29:47,020 --> 00:29:48,080
Rogue radius.

487
00:29:48,560 --> 00:29:54,620
So you secure your nice little network with EAP, and there's a nice little acronym bonanza with regards to EAP.

488
00:29:54,620 --> 00:29:59,380
Who says that rogue access points can't be used against wireless corporate networks that are using EAP?

489
00:29:59,840 --> 00:30:04,340
Plenty of ways to screw EAP up, and they allow for things such as EAP peaking.

490
00:30:04,360 --> 00:30:05,840
That's my new term for it.

491
00:30:06,500 --> 00:30:08,380
This is kind of how EAP works.

492
00:30:08,980 --> 00:30:11,160
You say, hey, I want to join the network.

493
00:30:12,320 --> 00:30:15,420
Access point replies back and says, hey, who the hell are you?

494
00:30:15,420 --> 00:30:16,700
You send your identity.

495
00:30:17,240 --> 00:30:18,960
Radius server validates that.

496
00:30:18,960 --> 00:30:20,220
Gives you a dynamic key.

497
00:30:20,220 --> 00:30:21,500
Allows you onto the network.

498
00:30:21,760 --> 00:30:25,780
There are variations of EAP, such as EAP TTLS.

499
00:30:26,660 --> 00:30:28,820
EAP TTLS, very similar.

500
00:30:28,840 --> 00:30:31,380
You have your 802.11 authentication association.

501
00:30:31,380 --> 00:30:33,320
EAP protocol exchange.

502
00:30:33,320 --> 00:30:34,800
TTLS protocol exchange.

503
00:30:34,800 --> 00:30:37,220
A nice little secure tunnel is established.

504
00:30:37,900 --> 00:30:41,280
And through that secure tunnel, that's where you pass your credentials.

505
00:30:41,980 --> 00:30:44,660
And everything else happens like it's supposed to.

506
00:30:45,220 --> 00:30:47,740
Ah, what's the weakness here?

507
00:30:47,780 --> 00:31:03,020
If you have a previous EAP TTLS authentication established, and a rogue access point with a radius server comes in, and you are not doing remote certificate checking, and or loose checking, disassociated, and of course, what you do is associate, authenticate,

508
00:31:03,020 --> 00:31:10,880
set up EAP TTLS, secure tunnel, and then you pass your credentials over the secure tunnel to the wrong person.

509
00:31:12,980 --> 00:31:14,960
So, how do you actually implement this?

510
00:31:14,960 --> 00:31:20,740
EAP TTLS with PAP, which is a variation that you can probably Google for.

511
00:31:21,180 --> 00:31:26,360
Windows XP Service Pack 2 using EAP TTLS with PAP, probably using a phone client.

512
00:31:26,360 --> 00:31:40,380
You have your rogue radius server come in, rogue access point disassociates users, learns username and password of every user that's on the access point at that time, disassociates them, copies the credits to the local EAP config, and then impersonates the victim.

513
00:31:41,580 --> 00:31:42,580
Google!

514
00:31:43,100 --> 00:31:47,600
You can find plenty of educational institutions that are using EAP TTLS with PAP.

515
00:31:48,860 --> 00:31:55,880
Ah, but there's a different vulnerability as well, because Microsoft provides something secure and protected EAP.

516
00:31:56,020 --> 00:32:00,660
And when it's used with client certificates, server certificates, rock on.

517
00:32:01,380 --> 00:32:03,600
But PKI is to suck.

518
00:32:04,780 --> 00:32:07,000
Nobody can get it right in the wired world.

519
00:32:07,000 --> 00:32:09,920
How in the world are we going to get PKI right in the wireless world?

520
00:32:09,920 --> 00:32:18,760
And so, we provide the nice little option for people to use their username and password over a secure tunnel to associate to wireless networks.

521
00:32:19,000 --> 00:32:29,940
If you don't validate the server certificate and or you don't check all of the certificate stores in the normal store for Windows, you are a victim to a peep attack.

522
00:32:29,940 --> 00:32:43,760
In this case, what you do is disassociate all the users, learn the domain and username immediately with your rogue access point and radius server, disassociate them again, seed the local password file with a bogus password.

523
00:32:43,960 --> 00:32:48,140
Windows XP Service Pack 2 is kind enough to keep re-associating to you.

524
00:32:48,240 --> 00:32:51,120
Over and over and over.

525
00:32:51,120 --> 00:32:54,880
And as they do, they keep providing their username and password.

526
00:32:54,880 --> 00:32:58,460
It's only part of the password, so it's difficult for you to get it, right?

527
00:32:58,460 --> 00:33:06,720
Until your dictionary stumbles upon their correct password, they authenticate successfully to you and bang, you have their username and password.

528
00:33:06,720 --> 00:33:09,440
MS Chat V2 does not protect against this.

529
00:33:10,660 --> 00:33:12,660
Wireless weaponry for Windows.

530
00:33:13,380 --> 00:33:15,100
Rogue access point attacks.

531
00:33:15,100 --> 00:33:18,240
Only in use by sophisticated hackers, right?

532
00:33:18,480 --> 00:33:22,720
Because it's so hard to set up an access point and give people the internet.

533
00:33:23,680 --> 00:33:25,240
Wireless access points?

534
00:33:25,300 --> 00:33:26,800
Easy to set up.

535
00:33:27,320 --> 00:33:30,460
If you want to set it up on one Windows laptop, you can do it.

536
00:33:30,480 --> 00:33:32,600
Evil twin access points for dummies.

537
00:33:32,940 --> 00:33:35,620
You can see it airsnarf.shmoo.com, airsnarf4win.

538
00:33:35,700 --> 00:33:36,660
html.

539
00:33:37,060 --> 00:33:43,500
But why should you run only one access point or one rogue access point when you can run one, two, three?

540
00:33:44,060 --> 00:33:45,300
Rogue Squadron.

541
00:33:45,400 --> 00:33:50,160
Because it's so hard for people to run airsnarf, which is a shell script.

542
00:33:51,600 --> 00:33:53,860
Rogue access point set up for the masses.

543
00:33:53,860 --> 00:33:59,320
It's a modified WRT54G firmware based off of EWRT, adds a username and password.

544
00:33:59,880 --> 00:34:02,280
Capture and logging looks like this.

545
00:34:13,090 --> 00:34:16,250
It's the first firmware release from the shmoo group.

546
00:34:19,510 --> 00:34:23,690
We had shmoo hot interns working on this all night.

547
00:34:25,410 --> 00:34:26,010
There you go.

548
00:34:26,010 --> 00:34:28,590
It's basically using captive portal or no cat.

549
00:34:28,970 --> 00:34:39,670
Allows you to set up a captive portal, people associate, and no matter what site that they go to, just as we've demonstrated before, you redirect them to the local captive portal, ask for their username and password.

550
00:34:39,770 --> 00:34:47,670
I'm not going to describe how easy it would be to modify this to display a T-Mobile graphic.

551
00:34:49,170 --> 00:34:50,970
Username and password entered.

552
00:34:51,410 --> 00:34:56,450
All you do is log into the box later on, SSH, dump your passwords, you're gone.

553
00:34:56,470 --> 00:35:00,850
Airsnarf.shmoo.com slash rogue underscore squadron is where you can get that.

554
00:35:02,410 --> 00:35:04,210
And here's Rodney!

555
00:35:04,310 --> 00:35:05,090
Thanks.

556
00:35:13,370 --> 00:35:14,450
So I'm lazy.

557
00:35:14,450 --> 00:35:16,470
I don't actually usually try to break things.

558
00:35:16,470 --> 00:35:21,910
Well, I break things once in a while, but usually I just look at vendors' products because they're broken enough, so why not just have fun with them?

559
00:35:22,650 --> 00:35:25,510
So anyway, never let Beetle type your slides.

560
00:35:26,030 --> 00:35:29,590
Shooting your security wad, which was about broken products.

561
00:35:29,590 --> 00:35:31,470
Okay, so what am I ranting about?

562
00:35:31,570 --> 00:35:33,490
You know, I have to keep up with the crowd here.

563
00:35:33,490 --> 00:35:42,090
So I've been doing product reviews, I do public ones, I do private ones, you know, take a box, set it up in a conference room, test it for a week, it goes off in a corner gibbering, hopefully I get some money out of it .

564
00:35:42,710 --> 00:35:44,890
People put out really lame features.

565
00:35:44,890 --> 00:35:50,290
I'm going to, if I can get this thing with a fruit in the front to back up, back up to this slide of beetles .

566
00:35:50,290 --> 00:35:51,370
I'm going to steal one here.

567
00:35:51,750 --> 00:35:52,790
Come on , buttons.

568
00:35:53,650 --> 00:35:54,510
Back up here.

569
00:35:54,510 --> 00:36:02,150
So with this Microsoft Windows, they ship you a security product that says, do you want to validate the server certificate?

570
00:36:02,150 --> 00:36:04,230
They let you turn that off.

571
00:36:04,270 --> 00:36:06,870
This is in the standard shipping product.

572
00:36:06,870 --> 00:36:08,130
What were they thinking?

573
00:36:08,610 --> 00:36:10,010
I mean, it's crypto, right?

574
00:36:10,010 --> 00:36:11,630
We do it or don't, we yell at people.

575
00:36:11,630 --> 00:36:15,910
Do you want a button in your browser that says, oh, just turn off all the crypto, it doesn't really matter.

576
00:36:16,930 --> 00:36:18,030
They weren't thinking.

577
00:36:18,030 --> 00:36:20,650
Well, they were thinking about something like money probably.

578
00:36:21,430 --> 00:36:23,670
But anyway, you know, vendors do things like this.

579
00:36:23,750 --> 00:36:25,450
Microsoft's certainly not the only one.

580
00:36:25,450 --> 00:36:29,070
Anyway, we see incredibly features that go by.

581
00:36:29,070 --> 00:36:35,370
I mean, you know, people who build firewalls that you can get to by clear text HTTP because no bad guy would ever get on your management land.

582
00:36:35,370 --> 00:36:36,470
Just never happens.

583
00:36:36,790 --> 00:36:45,610
So what we tell you is something, I wrote this slide way before the teal camo shock troops with their boot knives came in and cut pages out of the presentations.

584
00:36:46,370 --> 00:36:50,070
There's a risk of Ford Pinto gas tank syndrome, which I call FPGS.

585
00:36:50,090 --> 00:36:59,650
This was something that happened a long, long time ago where some bean counter at Ford to say that they could save a penny per car by changing the bolts in the gas tank, which gave them this really interesting characteristic that if you ran into the back of a Ford Pinto,

586
00:36:59,650 --> 00:37:00,810
the gas tank exploded.

587
00:37:00,950 --> 00:37:02,790
Most people involved were unhappy.

588
00:37:03,570 --> 00:37:08,450
And, you know, lawyers figured this out and eventually the memos came out and Ford got sued and they don't do that anymore.

589
00:37:08,450 --> 00:37:09,910
Well, we hope they don't do that anymore.

590
00:37:09,950 --> 00:37:11,210
Of course, now we build plastic cars.

591
00:37:11,210 --> 00:37:12,650
You just look at them and they fall apart.

592
00:37:13,510 --> 00:37:19,470
Anyway, so I ask these really hard questions of vendors and the vendors get all freaked out when I ask them these things.

593
00:37:19,510 --> 00:37:20,950
Now, remember, I'm not a hacker.

594
00:37:20,950 --> 00:37:22,190
I just play one on the internet.

595
00:37:22,210 --> 00:37:25,130
I mean, I do my own stunts, but I'm just playing one on the internet here.

596
00:37:25,130 --> 00:37:27,150
I'm not really as scary as most of you guys are.

597
00:37:27,190 --> 00:37:30,390
Anyway, so, like, does your product produce an external log?

598
00:37:30,390 --> 00:37:31,870
Now, apparently, this is hard.

599
00:37:31,990 --> 00:37:32,690
So, think about it.

600
00:37:32,690 --> 00:37:34,270
So, I have these IDS products.

601
00:37:34,270 --> 00:37:35,650
I power off the box.

602
00:37:35,710 --> 00:37:36,850
Go do my bad things.

603
00:37:36,850 --> 00:37:37,830
Power the box back on.

604
00:37:37,830 --> 00:37:40,050
It doesn't generate any messages when it gets powered back on.

605
00:37:40,050 --> 00:37:41,670
It just starts talking again.

606
00:37:41,670 --> 00:37:44,090
And so, I would think that would be a simple message to generate.

607
00:37:44,090 --> 00:37:45,310
This is apparently hard.

608
00:37:45,970 --> 00:37:48,350
Do you have a security incident reporting mechanism?

609
00:37:48,350 --> 00:37:56,370
Yes, I wrote this slide a long time ago before some people did some things that made some people's incident response teams, um, cause us to question them.

610
00:37:56,370 --> 00:37:57,450
Let's just say it that way.

611
00:37:57,630 --> 00:37:59,370
Um, some people don't even have things.

612
00:37:59,370 --> 00:38:03,410
I mean, there are many worse vendors out there than, you know, Cisco, Microsoft, that type of character.

613
00:38:03,530 --> 00:38:05,930
Do you store your key material securely?

614
00:38:05,930 --> 00:38:12,950
So, after you've got this access point or radius or whatever box it is with wireless, if your private key's in the clear, uh, so, what was the point?

615
00:38:12,950 --> 00:38:15,450
You know, if you don't keep the thing secure, I mean, there's a whole bunch of crypto.

616
00:38:15,450 --> 00:38:16,790
We've been doing this for 20 years.

617
00:38:16,790 --> 00:38:18,090
You should be able to figure this out.

618
00:38:18,270 --> 00:38:19,450
Do you have a management interface?

619
00:38:19,450 --> 00:38:20,390
Is it secure?

620
00:38:20,930 --> 00:38:25,050
I, you know, sitting on the phone with somebody doing a firewall audit, and I say, what do the firewall rules look like?

621
00:38:25,050 --> 00:38:29,530
And the CEO orders the IT geek to let me telnet into the box from the public internet.

622
00:38:30,290 --> 00:38:33,690
I'm like, uh, I don't need to know what your firewall rules are anymore, dude.

623
00:38:34,050 --> 00:38:36,390
Um , telnet's not too, too common.

624
00:38:36,390 --> 00:38:38,510
We still have SSH1, which is breakable.

625
00:38:38,590 --> 00:38:40,230
There's a lot of clear text HTTP.

626
00:38:40,270 --> 00:38:41,570
There were vendors at Black Hat.

627
00:38:41,570 --> 00:38:43,610
We're a studly, we have a booth at Black Hat.

628
00:38:43,610 --> 00:38:45,250
Let me show you our management interface.

629
00:38:45,250 --> 00:38:47,270
HTTP colon slash slash.

630
00:38:47,270 --> 00:38:49,630
So it's like, uh, that's not secure.

631
00:38:49,650 --> 00:38:53,690
You know, building a steel door and a grass hut doesn't actually stop very many people.

632
00:38:53,690 --> 00:38:57,830
It only stops the people without the lighters and half the hackers smoke, so like, get over it.

633
00:38:58,650 --> 00:38:59,330
Alright.

634
00:38:59,530 --> 00:39:02,070
Security products should not make things worse.

635
00:39:02,170 --> 00:39:05,890
Uh, they should not increase the attack surface, to use somebody's buzzwords.

636
00:39:06,070 --> 00:39:09,170
People keep doing central failure, central server, central failures, yeah.

637
00:39:09,170 --> 00:39:12,070
Central servers, which is a nice single point of failure.

638
00:39:12,070 --> 00:39:14,630
And then they wonder why we attack the servers, you know.

639
00:39:14,630 --> 00:39:23,430
I do these reviews where they go, you know, 10,000 clients or I'll have policy enforcement and we have one box in the middle that we have old copies of SSH on and clear text access to and all these things.

640
00:39:23,430 --> 00:39:25,810
Gee, the hackers figure out it's a target.

641
00:39:25,810 --> 00:39:26,910
What a surprise.

642
00:39:27,390 --> 00:39:30,390
Um, people should communicate securely among the components.

643
00:39:30,390 --> 00:39:35,030
Again, you know, do product reviews and people send all sorts of information back and forth in the clear.

644
00:39:35,030 --> 00:39:38,590
And that's if you don't fuzz it or replay attack it or things like that.

645
00:39:38,750 --> 00:39:41,010
And they run sloppy distros, you know.

646
00:39:41,070 --> 00:39:47,990
Download Linux, put it on a box, you know, paint the front of the box some sexy color because you hired the marketing department to make up a logo.

647
00:39:48,050 --> 00:39:51,090
You did all this four years ago before you got venture funding.

648
00:39:51,230 --> 00:40:01,610
So, you know, this thing gets into the field and suddenly I'm some sort of obnoxious rocket scientist because I noticed they're running Red Hat 5.2, you know.

649
00:40:01,610 --> 00:40:06,710
And it's like, it's okay because it's a policy enforcement product from a big router vendor or a big, whatever software vendor.

650
00:40:07,070 --> 00:40:08,610
So, you know, sloppy distributions.

651
00:40:08,610 --> 00:40:09,450
We will notice.

652
00:40:09,450 --> 00:40:12,470
People do Telnet to port 22 and read the banners.

653
00:40:12,510 --> 00:40:13,930
It's actually not that hard.

654
00:40:13,930 --> 00:40:15,930
Apparently the vendors don't think any of us know this.

655
00:40:15,930 --> 00:40:17,370
You need to promote this fact.

656
00:40:18,230 --> 00:40:19,410
Stupid vendor tricks.

657
00:40:19,410 --> 00:40:20,970
Logging, logging when they start up.

658
00:40:20,970 --> 00:40:22,810
There's all sorts of log analysis tools out there.

659
00:40:22,810 --> 00:40:23,750
That's really nice.

660
00:40:23,750 --> 00:40:25,750
Can we now have some logs to analyze, please?

661
00:40:26,150 --> 00:40:33,210
You know, do a scan on a box that does some sort of SSL web server balancing, you know, get no logs out.

662
00:40:33,210 --> 00:40:37,390
Go to the vendor and say, what's the knob I set to the position so I can see when the attacks happen?

663
00:40:37,390 --> 00:40:38,610
They go, oh, there's no logging.

664
00:40:38,610 --> 00:40:39,550
That's a feature.

665
00:40:40,090 --> 00:40:43,190
You know, and like, how are we supposed to know there's a problem here anymore?

666
00:40:43,490 --> 00:40:44,910
People do self-signed certificates.

667
00:40:44,910 --> 00:40:46,750
I have a homework assignment for all of you.

668
00:40:46,750 --> 00:41:00,390
Somebody please take a copy of Ettercap and when you get when you grab the self-signed certificate out of the Linksys box or one of various other things, please change the text and generate a new certificate so you look exactly like the vendor's cheesy self-signed certificate that they won't replace.

669
00:41:00,510 --> 00:41:07,850
And because man-in-the-middle attacks are quite possible, a self-signed certificate is only marginally better than no certificate at all because anybody can make these things up.

670
00:41:08,290 --> 00:41:09,910
People don't put change control in.

671
00:41:09,910 --> 00:41:19,470
Everybody wants to have a GUI so they can be hot and bothered during the demo to make sure they can click on things and it's all multi-colors and they're teal blue and cute and red and black and blinking and all these things, but you can't do change control.

672
00:41:19,470 --> 00:41:21,070
How about a little command prompt once in a while?

673
00:41:21,070 --> 00:41:22,030
Something like that?

674
00:41:22,450 --> 00:41:23,730
Incoherent documentation.

675
00:41:23,730 --> 00:41:29,810
I have a VPN box I have to manage for a very, very large customer with many dozens of class B addresses.

676
00:41:29,890 --> 00:41:31,310
I printed out the manual.

677
00:41:31,310 --> 00:41:34,570
The manual's 1078 pages long.

678
00:41:34,570 --> 00:41:37,210
I'm not sure anybody's ever read the whole manual.

679
00:41:37,650 --> 00:41:39,590
And then there's a user interface on top of that.

680
00:41:39,590 --> 00:41:42,010
I mean, has anybody actually figured out how juniper zones work?

681
00:41:42,030 --> 00:41:44,530
There's a lot of these things that are very strange.

682
00:41:44,750 --> 00:41:48,030
It would be nice if the vendors followed the protocol specs once in a while.

683
00:41:48,190 --> 00:41:53,450
You know, I do these voice over IP security classes and I have a domain name, tissue samples from the crater wall dot net.

684
00:41:53,490 --> 00:41:56,070
That's actually a valid domain name, yes I really own it.

685
00:41:56,110 --> 00:42:00,410
That character string is too long for most products because I mean, they didn't read the protocol spec.

686
00:42:00,410 --> 00:42:03,050
And DNS has been around since, what, Lincoln was president?

687
00:42:03,050 --> 00:42:05,690
Um, you know, could we please follow the protocol specs?

688
00:42:05,690 --> 00:42:12,690
At least before you go cook up some your own stupid proprietary protocol that's on top of it that's better because your EAP method's better than the standard EAP methods?

689
00:42:12,690 --> 00:42:15,770
Not that the standard ones are that good, but at least could we all use the same ones?

690
00:42:15,770 --> 00:42:17,910
We should all at least be in the same leaking rowboat.

691
00:42:19,370 --> 00:42:20,770
Alright, things you should try.

692
00:42:20,770 --> 00:42:23,270
Now this sounds really cheesy and stupid, but you can make money doing this.

693
00:42:23,270 --> 00:42:24,170
It's very odd.

694
00:42:24,250 --> 00:42:26,410
Um, run nmap and nnessus.

695
00:42:26,410 --> 00:42:31,710
You know, half the time I run nnessus, like, you know, some box in the network will go jump off the corner and reset to factory defaults.

696
00:42:31,710 --> 00:42:40,450
Now, since we all know how to download these things and run them, and the bad guys do, and so do the children in high school or elementary school, or they're teaching in kindergarten now, probably.

697
00:42:40,770 --> 00:42:43,390
Um, you know, yeah, you're learning kindergarten, I'm sure.

698
00:42:43,390 --> 00:42:46,370
So, I mean they should be able to survive little things like this.

699
00:42:46,370 --> 00:42:48,290
This apparently is news to a lot of the vendors.

700
00:42:48,390 --> 00:42:55,190
Uh, the vendors don't tend to go there are vendors, actually, there are vendors here at Black Hat they tend to be doing things like hiding in very loud Hawaiian shirts, but they do walk around.

701
00:42:55,190 --> 00:42:56,570
They're the ones with the good haircuts.

702
00:42:56,690 --> 00:42:59,750
Um, anyway, tell net to port 22 and read the banner.

703
00:42:59,750 --> 00:43:02,670
That's a really exotic way of doing a security analysis.

704
00:43:02,730 --> 00:43:04,790
Unfortunately, that gets me a lot of information.

705
00:43:04,790 --> 00:43:08,010
You know, I write these product reviews and I'm the token hacker and it's all very scary.

706
00:43:08,030 --> 00:43:10,290
I tell net to port 22 and read the banner.

707
00:43:10,450 --> 00:43:11,650
I mean, it's really, really hard.

708
00:43:11,650 --> 00:43:13,870
And I do this over and over again, in print.

709
00:43:13,870 --> 00:43:16,370
And the vendors who follow them don't actually figure it out still.

710
00:43:16,370 --> 00:43:18,130
It's like, you'd think they would notice this stuff.

711
00:43:18,530 --> 00:43:20,650
Another one, try to look at doing crypto.

712
00:43:20,650 --> 00:43:22,210
Crypto, apparently, is hard.

713
00:43:22,210 --> 00:43:25,890
Thank god the hackers think it's hard because they don't steal the private keys as much as they could.

714
00:43:26,290 --> 00:43:28,530
Open SSL, turn on SSL 2.

715
00:43:28,530 --> 00:43:33,310
Is there any redeeming social value in running SSL 2 in anything on the public internet today?

716
00:43:33,310 --> 00:43:34,650
I don't think there is.

717
00:43:34,650 --> 00:43:36,590
But there's lots of products still supporting it.

718
00:43:36,930 --> 00:43:38,530
Go after the web interface.

719
00:43:38,530 --> 00:43:43,350
There's like 5 billion people up and over from the dot-com boom who know how to write broken HTML.

720
00:43:43,370 --> 00:43:48,050
And about half of them are working for vendors building sophisticated web-based management interfaces.

721
00:43:48,730 --> 00:43:56,350
And they've got cross-site scripting and forms you can blow up and fields you can fill in 2,000 A's and they jump into a corner and psych vault and all these kinds of things.

722
00:43:56,350 --> 00:43:57,430
Etter tap.

723
00:43:57,690 --> 00:43:58,950
Man in the middle of the boxes.

724
00:43:58,950 --> 00:44:01,690
I mean, if they don't secure the connections, you can man in the middle of the things.

725
00:44:02,050 --> 00:44:03,610
Go look for a random exploit.

726
00:44:03,610 --> 00:44:05,850
This is something they don't seem to think anybody would do.

727
00:44:05,910 --> 00:44:11,110
I'm testing a product and I'm reading security focus, various random mailing lists, and an exploit will come out.

728
00:44:11,170 --> 00:44:12,910
I don't care if it's old or new.

729
00:44:12,910 --> 00:44:15,770
Go try it on the thing you're trying to use or trying to evaluate.

730
00:44:15,910 --> 00:44:18,610
Apparently, nobody expects you to actually keep up with the current news.

731
00:44:18,610 --> 00:44:22,430
You're supposed to buy a product, move into a cave, and run it there for the next 20 years.

732
00:44:22,470 --> 00:44:24,230
Everybody runs iOS 11.4, right?

733
00:44:24,230 --> 00:44:26,130
That's close to the current rev, definitely.

734
00:44:26,390 --> 00:44:28,310
So, try the current stuff.

735
00:44:28,310 --> 00:44:30,170
You know, the bad guys might try the current stuff.

736
00:44:30,170 --> 00:44:33,850
That's sort of why they're called zero days, the ones that are even more current than the current ones that are known.

737
00:44:33,850 --> 00:44:35,570
You'd think you'd figure this out.

738
00:44:36,250 --> 00:44:38,710
It's really easy to go after a lot of products.

739
00:44:38,710 --> 00:44:39,610
It's pretty stupid.

740
00:44:39,610 --> 00:44:41,390
It's embarrassingly stupid.

741
00:44:41,750 --> 00:44:44,850
And vendors just assume nobody would actually do this.

742
00:44:44,850 --> 00:44:51,550
There are no real ha- I mean, there's nobody goes to de- there are not 500 people in a tent in a parking lot in Las Vegas right now talking about hacking.

743
00:44:51,550 --> 00:44:52,270
Doesn't happen.

744
00:44:52,270 --> 00:44:54,230
You just heard it on the internet, it's a bad rumor.

745
00:44:54,230 --> 00:44:55,890
It just really isn't happening.

746
00:44:56,670 --> 00:45:00,170
You know, so I mean, everybody's really just sweetness and light and just leaves the networks all alone.

747
00:45:00,170 --> 00:45:02,930
And the bad guys, of course, are much more gentle than we are, right?

748
00:45:02,930 --> 00:45:03,610
We all know that.

749
00:45:03,610 --> 00:45:05,190
You know, they're much more gentle than we are.

750
00:45:05,290 --> 00:45:05,890
Anyway.

751
00:45:06,530 --> 00:45:06,990
Alright.

752
00:45:06,990 --> 00:45:08,330
How can you make things better?

753
00:45:08,410 --> 00:45:10,610
So, you know, this is actually the stock slide.

754
00:45:10,610 --> 00:45:11,730
I decided to leave this one good.

755
00:45:12,710 --> 00:45:13,830
How can you make things better?

756
00:45:13,830 --> 00:45:18,990
Well, we're trying to be educated consumers here, so test things, you know, try to actually do something and figure out how to make it better.

757
00:45:18,990 --> 00:45:20,130
Try to report bugs.

758
00:45:20,130 --> 00:45:23,790
I mean, if the vendor is so much of a bimbo that's going to yell at you for reporting them, that's their problem.

759
00:45:23,790 --> 00:45:26,430
You should still try to figure out how to report the bugs reasonably.

760
00:45:26,790 --> 00:45:30,050
If you can get one of these things to break, if you can find something breaking, give me a paper.

761
00:45:30,110 --> 00:45:31,990
I'm on the program committee for ShmooCon.

762
00:45:32,110 --> 00:45:33,190
Give me a paper.

763
00:45:33,350 --> 00:45:36,110
All of our papers starts today, as of right now.

764
00:45:36,130 --> 00:45:38,630
It's on the website, www.shmoocon.org.

765
00:45:38,910 --> 00:45:41,470
We'll have paper copies we'll put out there afterwards.

766
00:45:41,730 --> 00:45:44,310
But you find something you can break, we want it to break a track.

767
00:45:44,310 --> 00:45:45,330
You're going to give me the book here?

768
00:45:46,690 --> 00:45:48,230
He's going to stand up here and harass me.

769
00:45:48,290 --> 00:45:49,310
Okay, I just got one more slide.

770
00:45:49,310 --> 00:45:49,990
You can take it.

771
00:45:50,430 --> 00:45:51,290
Hey, yeah, definitely.

772
00:45:51,290 --> 00:45:52,370
Right, I'll get the book later.

773
00:45:52,890 --> 00:45:54,610
You just, you know, you just wait.

774
00:45:55,890 --> 00:45:56,910
You're the time Nazi.

775
00:45:56,910 --> 00:46:00,670
Yeah, well, some of us had to be the time Nazi when you were standing up here, you know, going through, flashing things.

776
00:46:01,670 --> 00:46:03,770
Report flaws, document the risks.

777
00:46:04,010 --> 00:46:07,410
People say, you know, I say, my God, you run HTTP on the management interface.

778
00:46:07,410 --> 00:46:09,870
And the blender goes, nobody's ever said that to me.

779
00:46:09,870 --> 00:46:11,250
We think it's just fine.

780
00:46:11,250 --> 00:46:12,550
Everybody loves this.

781
00:46:12,550 --> 00:46:13,370
It's bullshit.

782
00:46:13,370 --> 00:46:17,830
Anyway, disrupt future purchases of insecure equipment.

783
00:46:18,090 --> 00:46:20,110
The only way they're going to understand is the money.

784
00:46:20,110 --> 00:46:22,890
If they ship lame shit, don't buy it.

785
00:46:22,890 --> 00:46:24,430
Make sure they lose sales.

786
00:46:24,430 --> 00:46:26,790
If it hits their pocketbook, they'll understand.

787
00:46:27,170 --> 00:46:30,990
And the other side of it is encourage future purchases of clueful stuff.

788
00:46:30,990 --> 00:46:34,830
If you find gear that's secure and works well, make sure it gets bought again.

789
00:46:34,950 --> 00:46:37,410
And make sure you show things are easy to break.

790
00:46:37,410 --> 00:46:39,190
People don't believe this stuff can happen.

791
00:46:39,190 --> 00:46:40,470
Nobody would crack DES.

792
00:46:40,470 --> 00:46:42,730
Nobody would build a rainbow table to crack Landman.

793
00:46:42,790 --> 00:46:43,890
Landman's perfect.

794
00:46:44,210 --> 00:46:46,270
Nobody would actually do any of these things.

795
00:46:46,270 --> 00:46:48,630
Nobody ever actually tries to break SSH1.

796
00:46:48,630 --> 00:46:53,070
It's just, there's all this mythology out there that nobody actually tries to go after any of these things.

797
00:46:53,090 --> 00:47:00,010
So, there's a lot of things you can do and there's a lot of lame products out there and it's low-hanging fruit, I know, but we should get rid of the low-hanging fruit.

798
00:47:00,010 --> 00:47:06,810
You know, we should have to spend more time listening to them doing exotic tables than listening to me be a scary guy because I can skel-telnet to port 22.

799
00:47:06,810 --> 00:47:08,130
Here you go.

800
00:47:08,930 --> 00:47:10,850
Man, I love listening to him rap.

801
00:47:10,850 --> 00:47:12,530
That's ridiculous.

802
00:47:16,020 --> 00:47:16,700
Okay.

803
00:47:17,000 --> 00:47:23,940
Before we get to kick-ass zero day, we built some gear last year.

804
00:47:23,960 --> 00:47:25,300
Actually, the year before that, we built some gear.

805
00:47:25,300 --> 00:47:26,300
We had the robot.

806
00:47:26,680 --> 00:47:29,200
We had 82.11 bounce.

807
00:47:29,540 --> 00:47:30,680
We had the sniper Yagi.

808
00:47:30,680 --> 00:47:31,460
Tissue box.

809
00:47:31,880 --> 00:47:40,740
Some of us had to move the sniper Yagi across interstate lines in a car and, I mean, I had to drive the speed limit at Defcon, dude.

810
00:47:40,740 --> 00:47:41,880
It really sucked.

811
00:47:42,340 --> 00:47:47,160
So, I told you we'd bring some gear and we did.

812
00:47:47,840 --> 00:47:49,680
Cowboy, show them what you got.

813
00:47:50,480 --> 00:47:52,000
This is the 802.11.

814
00:47:54,300 --> 00:48:04,420
This is a 9 DBI flat panel antenna back-ended by a 1 watt amp with a 0 to 100 DBI rotary select attenuator that allows you to direction find.

815
00:48:04,420 --> 00:48:05,160
You can see her.

816
00:48:07,980 --> 00:48:09,960
You mean it doesn't go to 11?

817
00:48:10,420 --> 00:48:11,960
That's messed up, man.

818
00:48:14,020 --> 00:48:17,580
For those of you that can't see it real close, we've got some actual close-up pictures.

819
00:48:17,580 --> 00:48:22,700
We made sure that we got these done once we got on site, so there's some of that doodoo brow background.

820
00:48:25,820 --> 00:48:28,160
We've got a few things that are a little bit better than that.

821
00:48:28,680 --> 00:48:30,320
Yeah, it's battery powered.

822
00:48:31,500 --> 00:48:32,820
She likes that.

823
00:48:34,520 --> 00:48:36,640
Is the tattoo battery powered?

824
00:48:37,580 --> 00:48:38,580
Thank you to all our models.

825
00:48:38,580 --> 00:48:40,460
Mike will tell you, don't touch the heat sink.

826
00:48:40,460 --> 00:48:43,960
We don't pay any of our models like those NMRC guys.

827
00:48:44,960 --> 00:48:45,780
Here she is.

828
00:48:45,780 --> 00:48:47,960
She's wearing one of the new ShmooCon 2006 shirts.

829
00:48:47,960 --> 00:48:48,600
Right on, baby.

830
00:48:48,600 --> 00:48:50,820
And you can dunk her for the FF too.

831
00:48:51,500 --> 00:48:52,600
Great stuff.

832
00:48:53,020 --> 00:48:56,420
Yeah, the 802.11 bloodhound for direction finding.

833
00:48:56,480 --> 00:49:01,700
Like I said, all of it back-ends into an iPAQ, which you're running either familiar or Pocket PC on.

834
00:49:01,700 --> 00:49:04,080
Run your basic wireless discovery utility.

835
00:49:04,380 --> 00:49:07,960
But, what you can do is long-range shots and it's hand-held.

836
00:49:07,980 --> 00:49:09,260
You can go dual-handed.

837
00:49:09,260 --> 00:49:10,160
That's pretty cool too.

838
00:49:10,160 --> 00:49:14,260
If you really want to just be Steven Seagal or some other...

839
00:49:16,800 --> 00:49:18,160
It's balanced.

840
00:49:18,240 --> 00:49:19,500
Check it out, baby.

841
00:49:19,940 --> 00:49:21,460
It sticks right there.

842
00:49:25,760 --> 00:49:33,840
So, apparently, Mike was hanging out with one of these in the car, turned on, and drove by a cop.

843
00:49:38,970 --> 00:49:41,330
So, he got pulled over, right?

844
00:49:41,850 --> 00:49:42,790
No, we didn't get pulled over.

845
00:49:42,790 --> 00:49:44,430
Actually, I was in the car with the cop.

846
00:49:44,450 --> 00:49:45,370
Oh, really?

847
00:49:46,250 --> 00:49:47,670
And the guy next to us...

848
00:49:48,690 --> 00:49:54,930
And we rolled down our window and he says, yeah, man, that thing's been sitting off my radar detector for two miles.

849
00:49:56,690 --> 00:49:59,830
Apparently, he thought we were test-driving the new radar gun.

850
00:50:02,550 --> 00:50:03,570
That's hot.

851
00:50:03,570 --> 00:50:04,650
And I really mean literally.

852
00:50:04,650 --> 00:50:05,230
It's hot.

853
00:50:05,230 --> 00:50:07,530
You don't want to touch certain parts of it.

854
00:50:08,870 --> 00:50:11,310
And when you aim it at people, I guess they get hot too.

855
00:50:11,310 --> 00:50:12,170
She's hot.

856
00:50:15,290 --> 00:50:16,090
Alright.

857
00:50:16,550 --> 00:50:21,510
So, if you want to check out some of the 802.11 Bloodhound later on, just meet up with Mike.

858
00:50:21,510 --> 00:50:23,050
He'll describe it in more detail.

859
00:50:23,050 --> 00:50:24,350
It's sexy stuff.

860
00:50:25,170 --> 00:50:31,610
I'm supposed to be participating in one of the award-driving teams, and we were a little short on gear, so I decided to bring some.

861
00:50:31,610 --> 00:50:32,630
And there you go.

862
00:50:32,630 --> 00:50:34,050
Thanks a lot, Mike, for building that.

863
00:50:34,050 --> 00:50:34,810
Thank you.

864
00:50:40,930 --> 00:50:44,750
So, I'm just going to introduce Kaz.

865
00:50:44,750 --> 00:50:49,550
Kaz has a zero-day for Metasploit, Canvas, and Kismet.

866
00:50:52,710 --> 00:51:00,110
Well, last year I came and wasn't really supposed to talk, and they convinced me to talk five minutes before we gave a presentation.

867
00:51:00,110 --> 00:51:02,810
The only person to release a zero-day last year in WPA.

868
00:51:02,810 --> 00:51:05,510
So, I released a zero-day in WPA last year.

869
00:51:05,910 --> 00:51:09,170
So, I decided to go ahead and release another zero-day.

870
00:51:10,390 --> 00:51:14,050
I recently started a new industry.

871
00:51:14,050 --> 00:51:16,370
This is Pot Kettle Industries.

872
00:51:17,010 --> 00:51:18,890
We're looking for the Gartner report.

873
00:51:20,170 --> 00:51:21,870
I'm still looking for VC.

874
00:51:21,870 --> 00:51:24,270
If you're a VC, come talk to me afterwards.

875
00:51:24,290 --> 00:51:26,090
So, what does Pot Kettle Industries do?

876
00:51:26,090 --> 00:51:27,950
We exploit the exploiters.

877
00:51:27,950 --> 00:51:35,870
One of the things that I'm really tired of doing is finding all these exploits that are published on full disclosure and full nav that are full of holes.

878
00:51:35,910 --> 00:51:40,370
Y'all talk about how everybody else's shit sucks, but your shit's worse.

879
00:51:41,550 --> 00:51:46,590
I don't know how many of you read the source code of shit that hits full disclosure.

880
00:51:46,790 --> 00:51:50,170
Almost all of it is vulnerable at some point in time.

881
00:51:50,290 --> 00:51:53,770
So, I decided to start writing exploits for the exploits.

882
00:51:53,770 --> 00:51:57,470
I haven't quite figured out how I'm going to profit, but it's in the business plan.

883
00:51:57,810 --> 00:51:59,850
Peel all the underpants.

884
00:52:02,670 --> 00:52:05,190
I'll let you go ahead and do that for me, Paulos.

885
00:52:06,770 --> 00:52:10,870
Alright, so the first exploit that we released is in a multi -HTML.

886
00:52:10,970 --> 00:52:13,350
It's a remote exploit released by Banshee.

887
00:52:13,450 --> 00:52:15,050
Supposedly , Banshee is supposed to be here today.

888
00:52:15,050 --> 00:52:16,070
Are you here today?

889
00:52:16,650 --> 00:52:18,910
I have a sticker for you.

890
00:52:19,750 --> 00:52:22,830
I released an exploit and it got owned .

891
00:52:23,570 --> 00:52:24,890
Got owned.

892
00:52:26,110 --> 00:52:29,490
I have asked for a CVE and it has been granted.

893
00:52:29,490 --> 00:52:32,810
I have the first CVE for vulnerability in an exploit.

894
00:52:35,350 --> 00:52:38,770
And I have an exploit available for that right here.

895
00:52:40,770 --> 00:52:51,710
So today, or for the last couple of weeks, they've been asking me to look at Kismet to try and find some vulnerabilities so we can exploit other people during the DEF CON war driving contest this week.

896
00:52:54,050 --> 00:52:55,690
That's top secret.

897
00:52:55,690 --> 00:52:57,630
Those people are listening.

898
00:52:57,990 --> 00:53:01,010
Okay, we ought to return all the CDs.

899
00:53:01,010 --> 00:53:02,470
We're going to burn them and make new CDs.

900
00:53:02,470 --> 00:53:09,930
Please go to the Shmoo page in your conference program and tear it out with a razor blade right now.

901
00:53:09,930 --> 00:53:10,690
Throw it away.

902
00:53:10,690 --> 00:53:11,730
Do us a favor.

903
00:53:13,270 --> 00:53:26,630
Among many of the other vulnerabilities that I found in Kismet, some of them, Beatle's team is keeping private, and if you're running Kismet for this DEF CON war drive contest, you'll be owned.

904
00:53:26,730 --> 00:53:27,770
So don't.

905
00:53:30,850 --> 00:53:38,550
The easiest way to evade Kismet, like I said, I really believe in full disclosure and all that wonderful stuff and responsible disclosure.

906
00:53:38,950 --> 00:53:41,450
Sorry, I've been told I'm supposed to hold still.

907
00:53:43,150 --> 00:53:47,310
I believe in responsible disclosure except for people that are trying to own other people.

908
00:53:47,310 --> 00:53:55,650
Well, if you want to protect your network and somebody's attacking you and trying to find your network with Kismet, the easiest thing for you to do is to evade Kismet detection.

909
00:53:56,090 --> 00:54:01,170
What you're seeing on the screen right now is an fscanf from the Kismet client.

910
00:54:01,210 --> 00:54:04,470
This is what it does to read the packets that are coming from the Kismet server.

911
00:54:04,690 --> 00:54:24,990
I don't know how many of you can read C, but if you note in there, the first thing it's scanning is an integer and then it looks for a string that's enumerated it has the hex of 0-1 then the SSID and then the hex of 0-1 and then continues on as the scanf string.

912
00:54:25,250 --> 00:54:30,190
If you add hex of 0-1 to your SSID, guess what?

913
00:54:30,250 --> 00:54:35,190
Anytime Kismet sends your SSID across the network, it's not going to be seen.

914
00:54:35,350 --> 00:54:46,850
So if you want to keep your network protected from anybody using Kismet, make your SSID shmoo with a hex of 0-1 at the end of it, anybody using Kismet is not going to be able to see your access points now.

915
00:54:47,710 --> 00:54:48,150
Awesome .

916
00:54:54,880 --> 00:54:57,080
That's zero day number one.

917
00:54:57,940 --> 00:54:59,920
There are some buffer overflows in Kismet.

918
00:55:00,100 --> 00:55:02,420
The guy who wrote it was supposed to come to Defcon.

919
00:55:02,420 --> 00:55:05,760
He announced about two weeks ago that he's not coming.

920
00:55:05,760 --> 00:55:09,680
He's fixed two of the vulnerabilities that are in Kismet in the last two weeks.

921
00:55:09,700 --> 00:55:12,260
There's three more that are remotely exploitable.

922
00:55:12,260 --> 00:55:14,640
Don't be using Kismet over the next week.

923
00:55:14,640 --> 00:55:15,980
You will be owned.

924
00:55:15,980 --> 00:55:19,440
When was the last time you heard you should download the latest rev of the software?

925
00:55:20,660 --> 00:55:23,580
Download the latest patches for your exploits, kids.

926
00:55:27,460 --> 00:55:30,420
Patch management is not just for users anymore.

927
00:55:31,320 --> 00:55:33,680
How do I go back?

928
00:55:33,740 --> 00:55:35,080
Arrow keys?

929
00:55:35,500 --> 00:55:38,200
Shift, tab, control, delete.

930
00:55:38,880 --> 00:55:41,300
Have you used a computer?

931
00:55:41,300 --> 00:55:42,240
Whatever.

932
00:55:42,440 --> 00:55:44,800
We don't need no stinking slides.

933
00:55:44,800 --> 00:55:46,760
If it's not written in Perl, I don't know how to use it.

934
00:55:46,760 --> 00:55:48,180
Put the girls back on.

935
00:55:50,900 --> 00:55:52,560
There's the Kismet evasion.

936
00:55:52,660 --> 00:55:57,380
I have a really simple exploit for Metasploit in Canvas using H.G.

937
00:55:57,380 --> 00:55:59,340
Moore's exploitation technique.

938
00:56:00,100 --> 00:56:10,740
About two and a half years ago, he announced in an advisory that he was able to exploit various different companies by sending stuff into their Apache web server log.

939
00:56:10,760 --> 00:56:22,740
The Apache admins of those web servers were using things like tail-f and a vulnerable Xterm to launch commands using Xterm control characters.

940
00:56:22,740 --> 00:56:32,480
What his advisory said about two years ago was anybody writing any applications that take user input needs to filter out the user input.

941
00:56:32,480 --> 00:56:33,040
Well, guess what?

942
00:56:33,040 --> 00:56:35,760
Canvas and Metasploit take input.

943
00:56:35,840 --> 00:56:40,080
The way Metasploit works is all of their exploits do...

944
00:56:40,680 --> 00:56:50,460
If you do a check instead of an exploit, they will do a banner grab and then do a lame regular expression on the banner and then print what the banner was so you can validate it yourself.

945
00:56:50,860 --> 00:56:57,740
So all you have to do is match their lame regular expression and then print some control characters like H.G.

946
00:56:57,740 --> 00:56:59,500
Moore provided in his vulnerability.

947
00:56:59,800 --> 00:57:04,460
So what I'm going to do is I'm going to wget a shell script and then I'm going to run it.

948
00:57:04,640 --> 00:57:07,220
And now I've owned anybody that uses Metasploit.

949
00:57:07,940 --> 00:57:13,280
Every single exploit that Canvas ships with does print if you run it in the command line mode.

950
00:57:13,280 --> 00:57:22,180
Every single exploit that comes with Metasploit prints some piece of data from the user or from the server that you're trying to exploit without filtering it.

951
00:57:22,180 --> 00:57:27,840
If you're running Xterm that comes with Debian and you're running Metasploit or Canvas from it in the command line mode, guess what?

952
00:57:27,840 --> 00:57:28,860
You're ownerable.

953
00:57:31,380 --> 00:57:32,820
Owner awesome.

954
00:57:35,480 --> 00:57:36,980
So using H.G.

955
00:57:36,980 --> 00:57:38,500
Moore's exploits against himself.

956
00:57:38,500 --> 00:57:40,380
So there's two more zero day.

957
00:57:42,940 --> 00:57:45,100
I think you might be at your limit.

958
00:57:47,920 --> 00:57:51,320
Hey, we're not starting anything, okay?

959
00:57:51,320 --> 00:57:52,880
I mean, we're just making a point.

960
00:57:52,880 --> 00:57:55,100
And the general point is, look...

961
00:57:55,100 --> 00:57:56,140
Set an example.

962
00:57:57,200 --> 00:57:58,160
Seriously.

963
00:57:58,440 --> 00:58:03,920
The stuff that you're throwing out there, it's great if it busts stuff open, right?

964
00:58:03,920 --> 00:58:06,360
But at the same time, watch your back.

965
00:58:06,480 --> 00:58:11,580
Because other people are going to be looking at your code as you throw it out there for other people to use.

966
00:58:13,000 --> 00:58:18,800
Speaking of code and application security and that sort of thing...

967
00:58:19,480 --> 00:58:21,080
and ranting...

968
00:58:21,080 --> 00:58:24,540
I'd like to introduce Bruce Potter, founder of the Shmoo Group.

969
00:58:29,060 --> 00:58:29,700
Hello.

970
00:58:31,180 --> 00:58:35,460
I'm a little nervous to hit the next button because they've been slinging slides all day and I haven't been around.

971
00:58:36,500 --> 00:58:40,060
And I'm not sure if they've been screwing with me yet or not, so I guess I'm about to figure out.

972
00:58:42,700 --> 00:58:43,600
Okay, good.

973
00:58:48,080 --> 00:58:49,600
Are there pictures of me on there?

974
00:58:49,600 --> 00:58:50,640
That's all I want to know.

975
00:58:51,300 --> 00:58:52,800
Did we upload those yet?

976
00:58:53,900 --> 00:58:58,940
Yeah, so for the record, Nomad's got the most powerful lens on a camera known to mankind.

977
00:58:58,940 --> 00:59:04,500
I'm sitting up there on stage and he comes up and shows me a picture of my shorts that he took from sitting out there in the audience.

978
00:59:05,460 --> 00:59:05,860
So...

979
00:59:06,700 --> 00:59:07,560
Pwned.

980
00:59:07,920 --> 00:59:09,980
My crotch was owned, okay?

981
00:59:11,160 --> 00:59:12,700
Only in Vegas.

982
00:59:13,080 --> 00:59:14,980
You might want to see someone about that.

983
00:59:14,980 --> 00:59:15,580
Yeah.

984
00:59:16,340 --> 00:59:17,900
Nomad was up my pants.

985
00:59:19,540 --> 00:59:20,420
Bluetooth security...

986
00:59:20,420 --> 00:59:23,480
Look, we talked about a lot of stuff today.

987
00:59:23,480 --> 00:59:24,960
We've been all over the damn road.

988
00:59:25,620 --> 00:59:27,500
And what we're trying to do is raise awareness.

989
00:59:27,780 --> 00:59:29,440
There's no threat here, right?

990
00:59:29,440 --> 00:59:37,740
The press is sitting up here visibly scribbling away, and they're trying to figure out is there anything in common with all these talks or are they just all a bunch of crazies?

991
00:59:38,060 --> 00:59:40,200
All we're really trying to do is raise awareness.

992
00:59:40,220 --> 00:59:44,620
One thing we really don't have anything new on this year but I want to talk about is Bluetooth security.

993
00:59:44,700 --> 00:59:46,320
Shit's gotten worse, guys.

994
00:59:47,080 --> 00:59:48,480
It hasn't gotten better.

995
00:59:48,480 --> 00:59:51,480
There's more Bluetooth radios out than there ever have been.

996
00:59:51,480 --> 00:59:52,980
It's not dying.

997
00:59:53,440 --> 00:59:56,200
Regardless of whatever the hell the press and Gartner and people think.

998
00:59:56,220 --> 00:59:59,420
Two million radios every week are integrated into devices.

999
00:59:59,980 --> 01:00:03,680
And I tell you, people are doing nasty shit with Bluetooth right now.

1000
01:00:03,680 --> 01:00:06,480
Last year, we tracked people for fun at Black Hat.

1001
01:00:06,480 --> 01:00:07,800
That was just kind of the thing.

1002
01:00:07,800 --> 01:00:09,120
And then tryfinet.org.

1003
01:00:09,120 --> 01:00:09,740
Bloover?

1004
01:00:09,740 --> 01:00:11,220
Man, that's an awesome tool.

1005
01:00:11,220 --> 01:00:12,540
What's the phone it runs on?

1006
01:00:14,260 --> 01:00:15,500
6260 or something?

1007
01:00:15,580 --> 01:00:16,800
Buy some of those, man.

1008
01:00:16,800 --> 01:00:18,060
Buy them in bulk.

1009
01:00:19,580 --> 01:00:21,240
You can run Bloover on.

1010
01:00:21,240 --> 01:00:23,720
You can make the phones vulnerable phones.

1011
01:00:23,720 --> 01:00:24,460
You can make them dial.

1012
01:00:24,460 --> 01:00:26,380
You can grab down address books.

1013
01:00:26,380 --> 01:00:27,540
Things of that nature.

1014
01:00:28,240 --> 01:00:30,260
A lot of the new phones are patched.

1015
01:00:30,260 --> 01:00:32,020
But this is just an example, guys.

1016
01:00:32,020 --> 01:00:34,100
My car has Bluetooth in it.

1017
01:00:34,360 --> 01:00:37,640
One day, I'll be driving down the road and some hacker will shut my car off.

1018
01:00:37,640 --> 01:00:41,140
Or he'll sequentially deploy all my airbags and do some kind of techno thing.

1019
01:00:45,020 --> 01:00:47,200
And that day can't be far off.

1020
01:00:47,200 --> 01:00:51,180
And once they put the Bluetooth dart in my butt, I think my life will be over.

1021
01:00:51,200 --> 01:00:53,220
Oh, I never should have touched that microphone.

1022
01:00:54,440 --> 01:00:55,060
Alright, so anyway.

1023
01:00:55,060 --> 01:00:55,860
That's that.

1024
01:00:57,380 --> 01:00:58,100
Pairing attacks.

1025
01:00:58,100 --> 01:00:59,860
There's a paper that came out on pairing attacks.

1026
01:00:59,860 --> 01:01:02,580
We have nothing to do with tryfinet.org.

1027
01:01:02,580 --> 01:01:04,620
I'm just pimping these guys because they have a great tool.

1028
01:01:05,260 --> 01:01:08,220
But there's a paper on some pairing attacks that came out recently.

1029
01:01:09,060 --> 01:01:21,540
Basically discussing how to force phones to forget their pairing and then repair with them and intercept the pairing process and then basically brute force guess the key.

1030
01:01:21,880 --> 01:01:25,380
Everyone's always been able to brute force guess the key in the pairing process.

1031
01:01:25,440 --> 01:01:28,900
The standards bodies admitted this when the protocol was developed.

1032
01:01:29,060 --> 01:01:30,120
This is not new.

1033
01:01:30,120 --> 01:01:35,860
When you pair a Bluetooth phone, go lock yourself in a Faraday cage if you're really paranoid, and pair.

1034
01:01:35,880 --> 01:01:37,480
And that way, no one can intercept it.

1035
01:01:37,540 --> 01:01:44,620
But the neat new trick is that you can trick a phone into thinking, oh, I've lost my pairing with my earbud or whatever, I should repair.

1036
01:01:45,240 --> 01:01:53,460
So, I like to liken this to a rogue access point attack where you've got a rogue device pretending to be another one in your network, it just happens to be your little Bluetooth PicoNet.

1037
01:01:53,640 --> 01:01:59,460
If you're at DEF CON and you're talking on your Bluetooth earbud and your phone suddenly says, what I really want to do...

1038
01:02:01,000 --> 01:02:06,940
If it says, what I really want to do right now is repair the earbud because I've forgotten the pairing, no.

1039
01:02:06,940 --> 01:02:15,920
Put the phone away, stop talking to your girlfriend or your Vegas hookup and just go drink because someone's screwing with you and they're going to try to break into your phone.

1040
01:02:18,600 --> 01:02:21,260
Wow, I'm not even sure where the 802.11 seems to...

1041
01:02:21,260 --> 01:02:23,220
That happens on your wired earbud.

1042
01:02:23,220 --> 01:02:24,220
Just go home.

1043
01:02:25,260 --> 01:02:27,140
Yeah, that's the voices in your head at that point.

1044
01:02:29,600 --> 01:02:36,980
So, defending wireless networks, this should say defending 802.11 networks because, you know, 802.11 does not equal wireless and vice versa.

1045
01:02:37,180 --> 01:02:38,780
We talked a lot about the offense.

1046
01:02:38,780 --> 01:02:44,260
This slide is actually taken directly from our Black Hat talk that Beatle and I gave, so it doesn't make any sense in its current context.

1047
01:02:45,980 --> 01:02:49,380
We had done something a few years ago called Hotspot DK.

1048
01:02:49,380 --> 01:02:57,160
It was a hotspot defense kit in a response to a problem where there's a lot of money being spent to protect enterprise wireless networks in the enterprise.

1049
01:02:57,360 --> 01:03:00,080
You know, like, hey, let's buy wireless intrusion detection systems.

1050
01:03:00,080 --> 01:03:03,360
We'll put sensors up everywhere and we'll put things in a nock and we'll be secure.

1051
01:03:03,740 --> 01:03:05,000
Well, hallelujah, brother.

1052
01:03:05,160 --> 01:03:06,600
Your infrastructure will be secure.

1053
01:03:06,600 --> 01:03:08,600
Your clients are still out there in the window.

1054
01:03:09,020 --> 01:03:09,480
You know?

1055
01:03:09,680 --> 01:03:15,860
Your EVP or your nock guy or whoever that's got a laptop leaves your enterprise and goes to Starbucks.

1056
01:03:15,880 --> 01:03:20,820
Your wireless IDS is not at Starbucks when AirSnarf is beating the shit out of it.

1057
01:03:20,840 --> 01:03:21,460
Alright?

1058
01:03:21,620 --> 01:03:23,960
We need to pay more attention to wireless client security.

1059
01:03:23,960 --> 01:03:32,260
So, a year and a half ago, literally, the day that DEF CON Federal started, we were scheduled to speak on day two, we sat... what?

1060
01:03:32,740 --> 01:03:34,460
Black Hat, what the hell did I say?

1061
01:03:34,460 --> 01:03:37,060
DEF CON Federal 2006.

1062
01:03:37,060 --> 01:03:38,080
Be there.

1063
01:03:39,320 --> 01:03:41,900
It'll be in the Las Vegas County Jail.

1064
01:03:42,400 --> 01:03:43,580
Or Guantanamo.

1065
01:03:43,580 --> 01:03:45,600
Or Guantanamo, if we're lucky.

1066
01:03:46,100 --> 01:03:46,800
Jeez.

1067
01:03:46,800 --> 01:03:47,680
Go Gitmo.

1068
01:03:48,940 --> 01:03:50,940
What the hell was my train of thought?

1069
01:03:50,940 --> 01:03:52,020
Oh, we wrote this tool.

1070
01:03:52,240 --> 01:03:59,160
We wrote this tool literally in the day before our talk at Black Hat when we were drinking and talking to friends.

1071
01:03:59,300 --> 01:04:03,980
It wasn't rocket science to write a little tool that protected wireless clients.

1072
01:04:03,980 --> 01:04:05,960
Nothing out there at the time existed like it.

1073
01:04:05,960 --> 01:04:12,880
We released it under BSD license and said, take it, integrate it into your own products, we don't give a shit, just fix the problem, secure the clients.

1074
01:04:12,880 --> 01:04:15,400
Now you can buy it from other people.

1075
01:04:15,400 --> 01:04:16,900
And it's taken a year and a half to get there.

1076
01:04:16,900 --> 01:04:23,880
There's really still no huge amounts of support in the operating systems and the drivers and whatever to try to protect the clients while they're on the road.

1077
01:04:23,880 --> 01:04:25,580
And really, that's a massive problem.

1078
01:04:26,380 --> 01:04:27,400
So things are not much better.

1079
01:04:27,400 --> 01:04:28,820
I'm skipping ahead in my slides.

1080
01:04:29,600 --> 01:04:32,560
We're working on Hotspot DKV2.

1081
01:04:33,300 --> 01:04:36,820
It turns out that my third major was computer science.

1082
01:04:37,700 --> 01:04:40,180
The first two were biology and physics.

1083
01:04:40,500 --> 01:04:42,860
Marketing, economics...

1084
01:04:42,860 --> 01:04:44,280
I went through a lot of majors.

1085
01:04:46,300 --> 01:04:52,360
I almost got into a fist fight with one of my professors and then I watched him dent my car on purpose.

1086
01:04:52,360 --> 01:04:56,400
And I realized at that point that computer science is probably not the way I was going to graduate college.

1087
01:04:57,240 --> 01:04:59,200
And I can't code for shit.

1088
01:04:59,340 --> 01:05:04,240
So I've been trying to write Hotspot DKV2 for the last couple weeks and it's been a qualified disaster.

1089
01:05:04,240 --> 01:05:07,500
And the guy who I normally rely on is actually moving to Alaska right now.

1090
01:05:07,500 --> 01:05:08,720
This is not like a line.

1091
01:05:08,720 --> 01:05:10,320
So I don't have code to release.

1092
01:05:10,320 --> 01:05:14,740
But ultimately, what we're trying to do is build an environmental monitor.

1093
01:05:14,920 --> 01:05:17,300
I like to liken this to going to downtown Baltimore.

1094
01:05:17,300 --> 01:05:19,500
How many people, first of all, live near Baltimore?

1095
01:05:20,260 --> 01:05:21,860
Okay, we all work for the government.

1096
01:05:21,860 --> 01:05:23,760
How many people have been to Baltimore?

1097
01:05:23,760 --> 01:05:29,440
Alright, when you go about a block or two outside of downtown, it gets really scary really quick.

1098
01:05:29,440 --> 01:05:32,340
That town is... it's not so pretty.

1099
01:05:32,340 --> 01:05:39,280
If I'm in downtown Baltimore and I hear gunshots and then I check my body and I'm not hit, it doesn't make me any less nervous.

1100
01:05:40,120 --> 01:05:42,340
I don't think to myself, oh, thank god, they missed me.

1101
01:05:43,440 --> 01:05:44,920
Let's go get a coffee, dear.

1102
01:05:46,440 --> 01:05:48,180
So, this is the same kind of thing.

1103
01:05:48,180 --> 01:05:53,460
We're trying to build an environmental monitor that looks for nasty things happening in the air that might not be happening directly to us.

1104
01:05:53,460 --> 01:05:57,100
Think of it as wireless IDS for your mobile device, right?

1105
01:05:57,100 --> 01:05:59,540
This is really kind of a decent idea, I think.

1106
01:05:59,560 --> 01:06:01,620
There was actually a question posed yesterday to me.

1107
01:06:01,620 --> 01:06:03,000
Why don't you use Snort Wireless?

1108
01:06:03,060 --> 01:06:04,820
Well, we kind of want to do it lightweight.

1109
01:06:04,820 --> 01:06:07,760
We want to try something new, so we're slinging our own code to give this a shot.

1110
01:06:07,760 --> 01:06:10,440
If people are interested in helping out, please contact me.

1111
01:06:10,440 --> 01:06:14,340
I'd be more than happy to, well, have you write the code, because I'm really shitty at it.

1112
01:06:15,480 --> 01:06:16,040
Question?

1113
01:06:16,040 --> 01:06:17,040
Okay, fire.

1114
01:06:19,820 --> 01:06:22,760
No, no, the question is, if you help out, do you have to drive around Baltimore?

1115
01:06:22,760 --> 01:06:24,320
No, I'll do that for you.

1116
01:06:24,960 --> 01:06:26,600
Wait a second, Bruce.

1117
01:06:26,600 --> 01:06:29,240
Didn't you say that IDSs sucked?

1118
01:06:30,680 --> 01:06:32,300
I think that's what I heard.

1119
01:06:34,260 --> 01:06:35,940
So, there we go.

1120
01:06:35,940 --> 01:06:36,860
Where the hell did this come from?

1121
01:06:36,920 --> 01:06:38,140
Oh, Jesus.

1122
01:06:38,320 --> 01:06:40,300
Way to avoid the question.

1123
01:06:41,580 --> 01:06:44,220
I'm trying to get to a geometry here.

1124
01:06:45,240 --> 01:06:46,040
What ?

1125
01:06:47,180 --> 01:06:49,720
We only have one certified open office operator.

1126
01:06:49,720 --> 01:06:51,280
How do I go backwards?

1127
01:06:52,280 --> 01:06:53,600
Oh, the back arrow.

1128
01:06:54,660 --> 01:06:56,080
Hey, is that my slide?

1129
01:06:56,080 --> 01:06:57,560
You wouldn't learn that in computer science.

1130
01:06:57,560 --> 01:06:58,560
Oh, I did that.

1131
01:06:59,720 --> 01:07:01,620
I forgot my slide.

1132
01:07:02,380 --> 01:07:03,820
Alright, so this is Hotspot DK.

1133
01:07:03,820 --> 01:07:09,320
So to get to the question Eric asked, this microphone and I are going to have a carnal knowledge here shortly.

1134
01:07:10,460 --> 01:07:14,580
So, as security professionals, I'll get there.

1135
01:07:14,580 --> 01:07:15,020
Alright?

1136
01:07:15,020 --> 01:07:15,800
Thank you, brother.

1137
01:07:15,820 --> 01:07:16,540
Hallelujah.

1138
01:07:17,020 --> 01:07:18,520
We haven't learned a lot.

1139
01:07:19,260 --> 01:07:25,020
People have called me kind of a killjoy the last couple days because every time I've been on stage, I've been pointing at the audience and being like, it's all your fault.

1140
01:07:26,180 --> 01:07:29,540
We've learned the same things over and over, which is kind of alluring a lot.

1141
01:07:29,540 --> 01:07:32,280
You get to learn the same thing and fill up the queue.

1142
01:07:33,160 --> 01:07:35,240
So, here's the deal.

1143
01:07:35,980 --> 01:07:38,760
We get paid to know security stuff.

1144
01:07:39,540 --> 01:07:51,500
And ultimately, we should have a better knowledge of our environment and our equipment, as Ronnie talked about, understanding what vendor gear we're putting in, understand the applications running in our environments, that kind of thing.

1145
01:07:51,560 --> 01:07:54,440
Ultimately, users are the ones kind of affected by IDSs.

1146
01:07:54,440 --> 01:07:58,700
Is a transaction I just committed with the Bank of America legitimate, or have I been owned?

1147
01:07:58,700 --> 01:08:00,020
Is my credit card down?

1148
01:08:00,020 --> 01:08:01,280
Bank of America can find out.

1149
01:08:01,280 --> 01:08:05,720
It'll take six months to discover it, but it would be nice if you found out in real time.

1150
01:08:05,720 --> 01:08:09,760
It would be nice if the people in the NOC just got little pop-up windows that were binary ones and zeros.

1151
01:08:09,760 --> 01:08:10,980
Secure, not secure.

1152
01:08:10,980 --> 01:08:11,920
What's the state of the network?

1153
01:08:11,920 --> 01:08:12,360
Bing!

1154
01:08:12,360 --> 01:08:12,800
Zero.

1155
01:08:12,800 --> 01:08:13,240
Secure.

1156
01:08:13,240 --> 01:08:14,000
What's the state of the network?

1157
01:08:14,000 --> 01:08:14,420
Bing!

1158
01:08:14,420 --> 01:08:14,820
Zero.

1159
01:08:14,820 --> 01:08:15,520
Insecure.

1160
01:08:15,520 --> 01:08:16,060
What?

1161
01:08:17,760 --> 01:08:19,160
Then you know your own.

1162
01:08:19,600 --> 01:08:21,540
You just cast that in stone.

1163
01:08:21,760 --> 01:08:22,380
Yes.

1164
01:08:22,960 --> 01:08:24,000
Everything's secure.

1165
01:08:24,000 --> 01:08:30,600
What we really need to be focusing on as an industry is a better understanding of the tools and our own enterprises and looking at the integrity of things.

1166
01:08:30,600 --> 01:08:35,820
It's not good enough just to say, are there traces of an attack, but has an attack been successful?

1167
01:08:35,820 --> 01:08:36,980
That's the real rub.

1168
01:08:36,980 --> 01:08:41,140
There's a lot of people focusing on forensics and looking at the after-the-fact type of stuff.

1169
01:08:41,140 --> 01:08:44,860
But we need to have a deeper understanding of what's going on in our environment.

1170
01:08:45,040 --> 01:08:50,120
Brian Watring, who couldn't be here today, has been working for years on a tool called OSIRIS.

1171
01:08:50,360 --> 01:08:54,120
You can go to hostintegritymonitoring.com and take a look at it.

1172
01:08:54,400 --> 01:08:57,620
Think of it as tripwire on steroids.

1173
01:08:57,620 --> 01:09:03,480
It's examining configurations and checksums and all kinds of things about the... Pablo , go.

1174
01:09:03,480 --> 01:09:04,420
It's free.

1175
01:09:04,420 --> 01:09:05,000
Just get it.

1176
01:09:05,000 --> 01:09:05,420
It's free.

1177
01:09:05,420 --> 01:09:06,180
Just get it.

1178
01:09:06,180 --> 01:09:10,340
And he actually just has a book that was published about how to do host integrity monitoring.

1179
01:09:10,480 --> 01:09:16,160
And what's unfortunate is that there's not a lot of other tools out there that deal with that kind of thing and I think we need to focus on that.

1180
01:09:17,660 --> 01:09:18,020
Further...

1181
01:09:18,020 --> 01:09:19,600
I made a triangle.

1182
01:09:19,600 --> 01:09:20,080
What?

1183
01:09:20,080 --> 01:09:20,760
What?

1184
01:09:21,100 --> 01:09:22,980
You made a triangle in college?

1185
01:09:23,420 --> 01:09:24,780
Yeah, I made a triangle in college.

1186
01:09:24,780 --> 01:09:25,760
It was glorious.

1187
01:09:25,760 --> 01:09:26,820
This is my PowerPoint food.

1188
01:09:26,820 --> 01:09:29,860
Beetle has arrows going back and forth and worms and all kinds of shit.

1189
01:09:29,860 --> 01:09:31,180
And I have a triangle.

1190
01:09:31,940 --> 01:09:33,200
And they're both built by bandits.

1191
01:09:33,200 --> 01:09:34,180
Bring on the triangle.

1192
01:09:34,180 --> 01:09:35,840
What do you want from me, buddy?

1193
01:09:36,260 --> 01:09:38,220
Tell me about wireless IDS.

1194
01:09:38,240 --> 01:09:39,240
Wireless IDS?

1195
01:09:39,620 --> 01:09:40,820
Why wireless IDS?

1196
01:09:40,820 --> 01:09:42,020
Because you said they were good.

1197
01:09:42,640 --> 01:09:45,000
Wireless IDS in the client, I think, is a reasonable thing.

1198
01:09:45,000 --> 01:09:46,820
That gets back to this kind of thing.

1199
01:09:47,160 --> 01:09:47,960
God!

1200
01:09:49,480 --> 01:09:53,120
Don't you mean host IDS on wireless clients?

1201
01:09:53,200 --> 01:09:53,940
It's okay, Matt.

1202
01:09:53,940 --> 01:09:54,880
It's almost over.

1203
01:09:54,880 --> 01:09:56,120
Apparently we need a keyboard IDS .

1204
01:09:56,120 --> 01:09:58,200
Do we have any more shit we can show instead?

1205
01:09:58,200 --> 01:09:58,720
Yeah.

1206
01:09:58,720 --> 01:09:59,140
All right.

1207
01:09:59,140 --> 01:09:59,560
I'll make this short.

1208
01:09:59,560 --> 01:10:01,880
Your IT security needs includes a different user interface.

1209
01:10:01,880 --> 01:10:04,460
Go play with this in the parking lot.

1210
01:10:04,460 --> 01:10:05,060
Yeah , go play with that.

1211
01:10:05,060 --> 01:10:07,420
I'll just stick it down my pants with a one watt amp.

1212
01:10:09,540 --> 01:10:10,340
Vegas was hot.

1213
01:10:10,340 --> 01:10:11,880
Can we get pictures before and after?

1214
01:10:12,480 --> 01:10:14,440
So, anyway, sure.

1215
01:10:14,440 --> 01:10:16,220
Look, you can see it backwards over there.

1216
01:10:16,300 --> 01:10:20,760
IDS and the normal user get along fine because that's who really needs to consume the information.

1217
01:10:20,760 --> 01:10:23,460
What we really care about is how bad is shit, right?

1218
01:10:23,560 --> 01:10:25,580
Users need to make rash tactical reactions.

1219
01:10:25,580 --> 01:10:29,500
We in the operations world need to make strategic reactions like, oh god, we got broken into.

1220
01:10:29,500 --> 01:10:30,300
Let's respond.

1221
01:10:30,300 --> 01:10:32,200
Incident response and things of that nature.

1222
01:10:32,420 --> 01:10:33,920
Does that get down your path?

1223
01:10:33,920 --> 01:10:34,840
All right, thank you.

1224
01:10:35,140 --> 01:10:51,540
Further, I think you need, when you think about security in the data center, sorry about the rant, and if you were a black hat, I really apologize, but you really need to think about things in a structured fashion , and it turns out we need to spend as much time thinking about patch management and configuration management as we do firewalls and software security and IDS.

1225
01:10:51,540 --> 01:10:53,280
Where do we buy the honeypot hats?

1226
01:10:53,500 --> 01:10:54,900
The honeypot hats?

1227
01:10:55,280 --> 01:10:58,500
I'll make you one out of this soaking wet towel and some electronic devices later.

1228
01:10:59,660 --> 01:11:00,920
Dead man walking.

1229
01:11:02,300 --> 01:11:08,720
Anyway, I don't really want to get into this triangle, because it'll be controversial and more than I really want to do, and Beedle's standing behind me threatening to beat the shit out of me.

1230
01:11:08,720 --> 01:11:11,740
As a moment, I'm just going to do that to piss him off.

1231
01:11:15,380 --> 01:11:16,480
That was awesome, dude.

1232
01:11:16,480 --> 01:11:17,560
Awesome, whatever.

1233
01:11:24,340 --> 01:11:24,660
So...

1234
01:11:25,980 --> 01:11:27,560
Is Mike Lynn in the house?

1235
01:11:27,560 --> 01:11:29,100
Is he in here, man?

1236
01:11:29,400 --> 01:11:30,040
Motherfucker.

1237
01:11:30,180 --> 01:11:30,940
I told him to come.

1238
01:11:30,940 --> 01:11:34,620
Yeah, so Mike was at ShmooCon.

1239
01:11:34,620 --> 01:11:48,160
If you missed his talk on signal intelligence and how to capture really interesting things that are in the air all day long and how to decode them, because people are using leaked crypto like ASCII.

1240
01:11:51,120 --> 01:11:54,100
You missed a really cool talk at ShmooCon.

1241
01:11:54,300 --> 01:11:55,760
And it was a lot of fun.

1242
01:11:55,760 --> 01:11:58,740
Who here was at ShmooCon earlier this year?

1243
01:11:58,740 --> 01:11:59,220
Awesome.

1244
01:11:59,220 --> 01:11:59,860
Right on, man.

1245
01:11:59,860 --> 01:12:00,200
Thanks.

1246
01:12:00,200 --> 01:12:00,680
That's cool.

1247
01:12:00,680 --> 01:12:03,600
So, ShmooCon 2006.

1248
01:12:03,800 --> 01:12:05,340
January 13th through 15th.

1249
01:12:05,340 --> 01:12:06,200
Washington, D.C.

1250
01:12:06,200 --> 01:12:06,940
again.

1251
01:12:07,100 --> 01:12:09,040
Pre-registration is live now.

1252
01:12:09,040 --> 01:12:11,740
If you missed out on ShmooCon last year, it's sold out.

1253
01:12:11,740 --> 01:12:12,660
We didn't have...

1254
01:12:12,660 --> 01:12:14,120
He is the ticket Nazi.

1255
01:12:14,120 --> 01:12:15,600
When we sell out, we sell out.

1256
01:12:15,600 --> 01:12:16,540
Yeah, we were done, man.

1257
01:12:16,540 --> 01:12:17,840
We didn't have any space.

1258
01:12:17,840 --> 01:12:19,120
We had no more chairs.

1259
01:12:19,120 --> 01:12:21,760
We would have been people standing in the back...

1260
01:12:21,760 --> 01:12:22,280
Oh, or something.

1261
01:12:22,280 --> 01:12:22,960
Okay.

1262
01:12:25,240 --> 01:12:27,640
So, yeah, you can go to ShmooCon.org.

1263
01:12:27,900 --> 01:12:29,680
What we really like about ShmooCon...

1264
01:12:30,460 --> 01:12:34,520
And particularly how we can kind of get it out there for people to see.

1265
01:12:34,780 --> 01:12:38,760
We threw a lot of ads together last year for people, their entertainment.

1266
01:12:38,820 --> 01:12:40,700
And we're interested in soliciting those again from people.

1267
01:12:40,700 --> 01:12:47,100
So if you have an advertisement for ShmooCon that you'd like to get onto the web, we'd like to get it onto the web for you.

1268
01:12:47,160 --> 01:12:49,200
And so just build it, make it.

1269
01:12:49,300 --> 01:12:51,440
We'll compare it with all the other ads that we receive.

1270
01:12:51,440 --> 01:12:58,980
The best ad that we get, we're gonna pay for that dude, wherever you are, to fly to ShmooCon, stay at ShmooCon, hang out at ShmooCon.

1271
01:12:59,580 --> 01:13:01,040
Yeah, man.

1272
01:13:02,560 --> 01:13:05,080
Please do not hire an artist from Singapore or somewhere.

1273
01:13:05,520 --> 01:13:07,200
No sweatshops, alright?

1274
01:13:07,380 --> 01:13:11,780
Here's an example ad, just so that, if you want some mind view.

1275
01:13:15,060 --> 01:13:16,680
See if this will actually play.

1276
01:13:16,680 --> 01:13:17,420
Hopefully.

1277
01:13:49,520 --> 01:13:50,880
That's pretty hot.

1278
01:13:52,320 --> 01:13:53,480
Right on.

1279
01:13:57,200 --> 01:14:00,500
So, we're really interested in more people submitting.

1280
01:14:00,520 --> 01:14:01,840
Rodney's got the CFP.

1281
01:14:01,840 --> 01:14:03,320
So the CFP's out.

1282
01:14:03,380 --> 01:14:04,800
And we're handing it out.

1283
01:14:04,800 --> 01:14:08,640
So if you want to see what we're interested in, what we'd like you to present on, feel free to do that.

1284
01:14:08,660 --> 01:14:10,260
We had three tracks last year.

1285
01:14:10,260 --> 01:14:11,720
Build it, break it, and bop it.

1286
01:14:11,720 --> 01:14:13,960
So we're really interested in people like building things.

1287
01:14:14,080 --> 01:14:16,920
And as Pablo said at DEF CON last year, build cool shit.

1288
01:14:17,220 --> 01:14:23,760
And the other thing, if you have an idea for a talk, and you haven't done a talk before, you're not sure how you'd go about doing that, talk to us anyway.

1289
01:14:23,760 --> 01:14:26,320
We're trying to encourage new people, new blood to show up.

1290
01:14:26,320 --> 01:14:31,640
And we've got all sorts of folks, PhDs, professors give courses, all sorts of people do presentations.

1291
01:14:31,640 --> 01:14:33,460
We can help you out with that kind of stuff.

1292
01:14:33,540 --> 01:14:35,300
So if you have a good idea, talk to us.

1293
01:14:35,300 --> 01:14:37,040
Doesn't matter if you've given a presentation before.

1294
01:14:37,040 --> 01:14:37,580
Go right ahead.

1295
01:14:37,580 --> 01:14:38,620
Please, we encourage it.

1296
01:14:38,620 --> 01:14:42,900
It's important to mention that when we're at ShmooCon, we don't talk at ShmooCon.

1297
01:14:42,900 --> 01:14:46,580
We usually, you know, we might give a few rants here and there and some informative things.

1298
01:14:46,580 --> 01:14:47,760
But those are sidebar things.

1299
01:14:47,760 --> 01:14:50,220
We actually provide a venue for everybody else to talk.

1300
01:14:50,220 --> 01:14:55,580
We come here and we just kind of throw a bunch of stuff together and we try and jazz people up and get people excited about doing these kind of things.

1301
01:14:55,580 --> 01:14:59,040
So we're interested in providing a venue for you to give presentations.

1302
01:14:59,040 --> 01:15:01,320
So submit what you want and we'll make it happen.

1303
01:15:02,540 --> 01:15:03,900
So that's it for us.

1304
01:15:03,900 --> 01:15:05,720
Does anybody have any questions?

1305
01:15:06,780 --> 01:15:07,900
Please ask questions.

1306
01:15:07,900 --> 01:15:09,100
Priest is walking up.

1307
01:15:11,960 --> 01:15:13,180
Alright, thanks a lot guys.

1308
01:15:13,180 --> 01:15:14,420
We really appreciate it.

1309
01:15:14,420 --> 01:15:15,140
Have a good day.

1310
01:15:15,140 --> 01:15:16,180
Have a good DEF CON.