[00:08.690 --> 00:13.290]  This is not the same Shmoo presentation that we anticipated.
[00:13.290 --> 00:17.590]  There will not be a Hookers for Hackers giveaway this time.
[00:17.590 --> 00:19.570]  So, I'm sorry to disappoint you.
[00:19.570 --> 00:22.590]  We have some other, you know, mostly nerdy crap to talk about.
[00:22.590 --> 00:25.310]  So, maybe next year.
[00:25.670 --> 00:28.910]  So, I don't know exactly why you're all here,
[00:28.910 --> 00:30.050]  but, you know, we're going to give you everything
[00:30.050 --> 00:31.470]  and we'll figure it out as we go.
[00:31.470 --> 00:33.030]  I'm Pablos from the Shmoo group.
[00:33.230 --> 00:34.470]  We do have some stickers.
[00:34.470 --> 00:36.470]  If you didn't get one, you know, you're a lamer.
[00:36.470 --> 00:37.190]  Right.
[00:37.490 --> 00:40.030]  Go to those guys right there. Raise your hands, guys.
[00:40.410 --> 00:44.350]  So, what we'd like to do at DEF CON
[00:44.350 --> 00:47.730]  is just lambaste you with everything that we can think of
[00:47.730 --> 00:49.830]  that we've been working on, or at least the cool stuff.
[00:49.830 --> 00:51.030]  And it's ready.
[00:51.030 --> 00:53.710]  And so, we have a panel of all different Shmoo guys.
[00:53.710 --> 00:54.630]  There are a whole bunch of others,
[00:54.630 --> 00:56.690]  but the ones that have stuff to show you today are here.
[00:56.690 --> 00:57.730]  We're the troublemakers.
[00:57.730 --> 00:59.630]  They're troublemakers, yeah.
[01:00.130 --> 01:02.990]  And, um, but a couple things we want to talk about.
[01:02.990 --> 01:05.010]  And I guess first I'd like to know,
[01:05.010 --> 01:07.110]  did Mike Lynn make it here or not?
[01:07.110 --> 01:08.050]  Is Mike here?
[01:08.490 --> 01:09.370]  Spot the Mike.
[01:09.370 --> 01:09.770]  Spot the Mike.
[01:09.770 --> 01:10.770]  So, there's no Mike.
[01:11.110 --> 01:13.950]  Okay, well, I'm sure you all are aware of what's going on with Mike
[01:13.950 --> 01:15.950]  in the recent fiasco.
[01:15.950 --> 01:17.890]  And he's not allowed to talk,
[01:17.890 --> 01:20.430]  but we wanted to say a couple things about what he's up to,
[01:20.430 --> 01:24.390]  which is important because everything that we do here at DEF CON
[01:24.390 --> 01:29.210]  and in security research has to do with reverse engineering
[01:29.210 --> 01:32.130]  and disclosure of vulnerabilities.
[01:32.130 --> 01:35.530]  And, unfortunately, it's what we have to work with
[01:35.530 --> 01:37.490]  as far as making systems secure.
[01:37.550 --> 01:38.950]  We have to find the problems,
[01:38.950 --> 01:40.130]  we have to tell people about them,
[01:40.130 --> 01:41.310]  and we have to fix them.
[01:41.450 --> 01:43.070]  And that's a lot of what's going on.
[01:43.070 --> 01:44.570]  And it's really, really pivotal,
[01:44.570 --> 01:45.890]  I think as most of you guys know,
[01:46.310 --> 01:47.650]  to support that.
[01:47.650 --> 01:50.810]  So, reverse engineering and Mike Lynn.
[01:52.010 --> 01:53.570]  Oh, now I see why you're clapping.
[01:53.570 --> 01:54.570]  Clap for Mike!
[01:56.750 --> 01:58.470]  That's kind of a side project.
[01:58.630 --> 01:59.730]  Yeah, this is Mike.
[02:04.950 --> 02:05.390]  So...
[02:07.630 --> 02:10.210]  So, as you know, Mike recently, in the last few days,
[02:10.210 --> 02:12.310]  managed to get sued and settle with Cisco.
[02:12.490 --> 02:16.290]  But the work that he's been doing goes on with other people.
[02:16.490 --> 02:18.950]  And it goes on, and what's important about it
[02:18.950 --> 02:23.270]  is that we can't let a culture of cover-ups
[02:23.270 --> 02:25.270]  for security issues develop.
[02:25.610 --> 02:27.270]  And if you look at the interests of vendors
[02:27.270 --> 02:29.350]  and the security research community,
[02:29.350 --> 02:30.570]  they're kind of opposed.
[02:30.650 --> 02:32.130]  But the important, I think, message
[02:32.130 --> 02:33.970]  from what Mike's just been through
[02:33.970 --> 02:38.690]  is that vendors have an obligation to their customers.
[02:38.690 --> 02:40.670]  And it's really the customers that are being kept in the dark
[02:40.670 --> 02:44.010]  when the vendors aren't disclosing the vulnerabilities
[02:44.010 --> 02:45.630]  that have been around for a while,
[02:45.630 --> 02:47.070]  even once they've been fixed.
[02:47.070 --> 02:49.950]  So, I think that an important thing to recognize
[02:49.950 --> 02:52.910]  is that all you guys are really important, right?
[02:52.910 --> 02:54.790]  The work that you're doing is really important.
[02:54.830 --> 02:57.690]  Some guys, every year, put their ass on the line
[02:57.690 --> 02:59.690]  and some get picked up.
[02:59.690 --> 03:01.690]  And Mike's not the first, but he's the most recent.
[03:01.690 --> 03:05.630]  So the important thing is keep up the good work.
[03:05.670 --> 03:06.910]  And this is...
[03:08.210 --> 03:09.470]  You guys rock.
[03:09.470 --> 03:11.330]  This is from a project I worked on
[03:11.330 --> 03:15.190]  to secure cell phones to thighs.
[03:15.470 --> 03:20.030]  And I managed to patent the use of women's thighs,
[03:20.030 --> 03:22.530]  which, you know, I don't know if there's anyone that leap here,
[03:22.530 --> 03:24.190]  but if you are, let me know.
[03:24.890 --> 03:26.430]  And then the other thing I wanted to say
[03:26.430 --> 03:27.710]  before we move on is that
[03:29.070 --> 03:29.910]  don't get sidetracked
[03:29.910 --> 03:33.410]  by all the work that people are talking about
[03:33.410 --> 03:34.550]  as far as vulnerabilities.
[03:34.550 --> 03:35.610]  There's a lot more to security
[03:35.610 --> 03:37.750]  than finding vulnerabilities and exploits.
[03:37.870 --> 03:39.010]  There's a lot more to security
[03:39.010 --> 03:41.090]  than just patch management and IDS.
[03:41.090 --> 03:43.710]  There's a lot more to security than policy management.
[03:43.950 --> 03:46.610]  And what there is is architecture.
[03:46.610 --> 03:48.450]  What we want to do is change the world
[03:48.450 --> 03:50.030]  so that 15 years from now,
[03:50.450 --> 03:51.670]  we aren't coming back to DEF CON
[03:51.670 --> 03:53.210]  and telling you about the latest exploit
[03:53.210 --> 03:55.690]  we found in firewalls or Wi-Fi or whatever.
[03:55.770 --> 03:57.250]  We need to find fundamental ways
[03:57.250 --> 03:59.890]  to change the computer systems that we use
[03:59.890 --> 04:02.810]  We need to find ways to take the academic research
[04:02.810 --> 04:04.930]  that's been done and put it into practice.
[04:05.010 --> 04:06.350]  And this is unfortunately not something
[04:06.350 --> 04:08.110]  that the market has been really good at.
[04:08.110 --> 04:10.010]  And so I think it's up to you guys
[04:10.010 --> 04:11.570]  since you're learning to think different.
[04:11.570 --> 04:13.910]  You're already on the fringe a little bit
[04:13.910 --> 04:17.390]  and you've learned about how to break shit.
[04:17.530 --> 04:18.710]  You know how to break shit.
[04:18.710 --> 04:20.650]  You know how to build shit that can't be broken.
[04:20.650 --> 04:22.530]  And what we need to do is figure out how to do that
[04:22.530 --> 04:25.330]  and kind of move our entire industry forward.
[04:25.330 --> 04:26.670]  And the world in general.
[04:26.670 --> 04:28.090]  So that's what I wanted to say.
[04:28.090 --> 04:31.410]  With that, I'm going to hand it over to Eric Johanson.
[04:33.170 --> 04:38.190]  And Eric is going to take on getting on with the exploits and shit.
[04:41.060 --> 04:43.240]  Good afternoon, folks. How are you?
[04:45.100 --> 04:47.020]  You guys still alive?
[04:50.080 --> 04:53.200]  So, let's see.
[04:53.200 --> 04:55.460]  Back at the beginning of this year,
[04:55.460 --> 04:59.440]  I did some work related to international domain names.
[04:59.440 --> 05:02.640]  This work was apparently...
[05:02.640 --> 05:04.720]  I was not the first person to do this work
[05:05.520 --> 05:09.820]  specifically related to international domain names and homograph attacks.
[05:10.080 --> 05:14.840]  I found some holes in, well, most of the browsers that are out there
[05:14.840 --> 05:21.700]  related to how they handle Unicode characters and domain names.
[05:21.700 --> 05:24.480]  And this attack has been talked about.
[05:24.480 --> 05:26.640]  There were papers published in 2000.
[05:26.640 --> 05:31.140]  The vendors were notified and no fixes were done.
[05:31.480 --> 05:33.440]  This seems like a problem.
[05:34.020 --> 05:35.460]  No?
[05:41.500 --> 05:46.520]  So, it was interesting when I gave this short presentation
[05:46.520 --> 05:48.460]  demoing this exploit at ShmooCon
[05:48.460 --> 05:51.280]  because everyone went up in arms and said,
[05:51.280 --> 05:53.960]  you should have notified the vendors first.
[05:55.420 --> 05:59.440]  The vendors that I did notify several weeks in advance before ShmooCon
[05:59.440 --> 06:01.860]  told me that it was not a vulnerability.
[06:02.320 --> 06:04.360]  We will be making no fixes.
[06:04.400 --> 06:05.480]  It's a feature.
[06:05.980 --> 06:07.840]  It is a feature.
[06:08.940 --> 06:12.360]  A large hardware manufacturer...
[06:12.360 --> 06:14.780]  These are not the exploits you are looking for.
[06:17.700 --> 06:21.300]  Okay, so an IDN exploit or a homograph attack,
[06:21.300 --> 06:23.160]  what it basically is,
[06:23.160 --> 06:26.900]  if you have, let's say, PayPal.com
[06:26.900 --> 06:30.700]  and you have, over here, PayPal.com
[06:30.700 --> 06:34.780]  only the first A in PayPal is actually a Russian A
[06:34.780 --> 06:38.300]  which looks and smells and tastes identical to a Latin A
[06:39.060 --> 06:41.640]  that is effectively a homograph attack
[06:41.640 --> 06:43.780]  because users cannot tell the difference.
[06:43.780 --> 06:48.360]  There is no difference on your browser, on most platforms,
[06:48.360 --> 06:50.540]  the difference between those two domain names.
[06:50.540 --> 06:51.460]  So...
[06:53.640 --> 06:54.240]  Hmm...
[06:54.240 --> 06:57.240]  Phishers would probably really like that, I suspect.
[06:59.140 --> 06:59.740]  So...
[06:59.740 --> 07:01.340]  You know, it was interesting.
[07:01.340 --> 07:03.840]  The vendor response I got,
[07:03.840 --> 07:07.340]  basically, most vendors told me,
[07:07.340 --> 07:09.500]  this is not a bug.
[07:09.920 --> 07:12.220]  Go away. We don't want to hear from you.
[07:12.220 --> 07:13.700]  After it was released,
[07:13.700 --> 07:17.140]  suddenly I'm getting calls from legal departments.
[07:17.140 --> 07:20.800]  So, clearly, vulnerability disclosure is something that
[07:21.920 --> 07:24.800]  we all face as security researchers because
[07:26.360 --> 07:29.540]  just this week, we have someone that's also
[07:29.540 --> 07:32.280]  going to be dealing with more issues
[07:32.280 --> 07:34.460]  related to how they disclose something.
[07:34.480 --> 07:37.400]  There's an RFC written out
[07:37.400 --> 07:39.460]  related to vulnerability disclosure.
[07:39.460 --> 07:42.560]  Everyone seems to be doing things in a slightly different way.
[07:42.640 --> 07:45.800]  But ultimately, what a lot of people seem to be forgetting
[07:45.800 --> 07:49.040]  is just because a vulnerability is found,
[07:49.040 --> 07:52.340]  doesn't mean that they're the first people to find it.
[07:52.880 --> 07:56.640]  I was not the first person to find the IDN homograph attack vulnerability.
[07:56.640 --> 07:58.220]  It still hadn't been fixed.
[07:58.260 --> 07:59.860]  The work that Mike has been doing,
[07:59.860 --> 08:03.980]  it is very likely that other people know about those attacks.
[08:04.980 --> 08:06.560]  It's very likely.
[08:06.780 --> 08:08.460]  And just because it hasn't been disclosed
[08:08.460 --> 08:12.260]  does not mean that it places all of our society at risk.
[08:12.400 --> 08:14.620]  So, in short, I think
[08:15.340 --> 08:18.360]  ultimately, for consumers to be the best informed,
[08:18.360 --> 08:20.580]  they need to be aware of these vulnerabilities.
[08:21.220 --> 08:25.500]  And ultimately, vendors are out to make the most money.
[08:25.840 --> 08:29.140]  And I think that's in direct conflict with the Internet
[08:29.140 --> 08:31.280]  and the routers of this world
[08:31.280 --> 08:33.160]  and the web browsers of this world.
[08:33.360 --> 08:36.820]  So, think really hard when you find that vulnerability
[08:36.820 --> 08:38.520]  about how you want to handle it.
[08:38.520 --> 08:40.300]  Don't be bought out.
[08:40.500 --> 08:41.920]  Don't let it happen.
[08:43.540 --> 08:43.900]  So...
[08:44.900 --> 08:45.620]  Yeah!
[08:50.590 --> 08:52.310]  All right, so...
[08:52.890 --> 08:54.170]  Yeah, I know, we're going to get up here
[08:54.170 --> 08:55.910]  and we're going to preach a little bit or whatever.
[08:55.910 --> 08:57.630]  We got cool shit, don't worry.
[08:59.190 --> 09:01.150]  Everybody's like, hey man, what is it?
[09:01.150 --> 09:03.750]  So we're going to get down and dirty
[09:04.150 --> 09:06.110]  and this will fry your fucking brain.
[09:07.930 --> 09:10.590]  If you're not familiar with what Rainbow Tables are,
[09:10.590 --> 09:12.470]  Dan will go into it a little bit.
[09:12.470 --> 09:16.450]  If you haven't been to the rainbowtables.shmoo.com website,
[09:16.450 --> 09:17.630]  you'll get into that.
[09:19.010 --> 09:20.750]  But Dan's got something.
[09:20.850 --> 09:22.350]  Dan's got a new bag.
[09:22.370 --> 09:23.810]  Anybody here know math?
[09:24.630 --> 09:26.230]  All right, hi all.
[09:28.370 --> 09:30.490]  There's no slide for this, but since I'm up here
[09:30.490 --> 09:32.430]  and I have all of your attention,
[09:32.430 --> 09:34.470]  I saw Jennifer Granick just leave,
[09:34.470 --> 09:36.910]  but could everybody who's from the EFF who's here,
[09:36.910 --> 09:38.110]  please stand up.
[09:40.650 --> 09:42.090]  We're talking about...
[09:42.530 --> 09:43.610]  Hey guys.
[09:45.310 --> 09:48.450]  All right, I'm just going to do introductions quick as I see you.
[09:48.450 --> 09:51.990]  I used to work with these guys very briefly as a staff technologist
[09:51.990 --> 09:53.210]  and now I'm elsewhere.
[09:53.330 --> 09:55.030]  But these guys, we had a party last night.
[09:55.030 --> 09:56.210]  You might have been to it.
[09:56.290 --> 09:58.690]  We're talking about vulnerability disclosure,
[09:58.690 --> 10:00.550]  full disclosure, legal ramifications.
[10:00.550 --> 10:03.990]  Jennifer Granick, who is Mike's counsel, and the EFF,
[10:03.990 --> 10:07.250]  these are all the guys saving all of our asses every day.
[10:07.250 --> 10:10.250]  So please give a round of applause for the EFF.
[10:17.480 --> 10:18.840]  Go to the dunk tank.
[10:18.840 --> 10:20.100]  I'm going to be there tomorrow.
[10:20.100 --> 10:20.920]  Dunk me.
[10:21.680 --> 10:23.420]  All right, so Rainbow Tables.
[10:23.780 --> 10:25.040]  Who's familiar with Rainbow Crack?
[10:25.040 --> 10:26.120]  Put your hand up.
[10:27.020 --> 10:27.900]  Word.
[10:28.020 --> 10:31.660]  All right, Rainbow Crack is an implementation of a technique
[10:31.660 --> 10:34.260]  made by a European researcher.
[10:34.600 --> 10:36.640]  And without getting into the heavy math of that,
[10:36.640 --> 10:37.920]  basically it's software.
[10:37.920 --> 10:39.200]  You can download it.
[10:39.260 --> 10:41.280]  Jennifer Granick, I see you walking back there.
[10:41.280 --> 10:41.800]  Jennifer?
[10:41.800 --> 10:43.680]  Everybody give Jennifer a hand of applause.
[10:43.680 --> 10:44.740]  Kiss her ass.
[10:47.400 --> 10:49.080]  Thank you.
[10:50.860 --> 10:53.140]  So you download Rainbow Crack,
[10:53.140 --> 10:57.120]  and basically what it lets you do is consume all of her CPU time
[10:57.120 --> 10:59.920]  and generate, according to what it says,
[10:59.920 --> 11:03.100]  nearly every single possible landman hash.
[11:03.100 --> 11:04.260]  Anybody familiar with landman?
[11:04.260 --> 11:05.320]  Raise your hand.
[11:05.960 --> 11:06.520]  Word.
[11:06.520 --> 11:07.460]  Okay, great.
[11:07.500 --> 11:10.520]  So that's what it does, right?
[11:10.520 --> 11:14.540]  And we, like Beetle over there in the Bosox cap,
[11:14.540 --> 11:16.020]  had a good idea and he said,
[11:16.020 --> 11:18.300]  hey, we got a bunch of people and we have a bunch of machines
[11:18.300 --> 11:19.660]  and we have too much free time,
[11:19.660 --> 11:20.800]  so let's just do this.
[11:20.800 --> 11:23.480]  Let's just generate every single landman hash that there is.
[11:23.720 --> 11:25.080]  So we started doing it.
[11:25.080 --> 11:27.220]  We just downloaded the code off the guy's website.
[11:27.520 --> 11:30.580]  We fired it up on about 150 machines
[11:30.580 --> 11:32.380]  across different shmoo,
[11:32.380 --> 11:33.640]  and we generated it.
[11:33.640 --> 11:36.440]  And our goal was to use it to generate...
[11:36.440 --> 11:37.740]  You can do different key spaces,
[11:37.740 --> 11:39.960]  like if you want to do five characters, six characters, whatever.
[11:39.960 --> 11:42.540]  We wanted to do the configuration that had
[11:42.540 --> 11:45.920]  every single seven-character valid hash for landman.
[11:45.920 --> 11:47.740]  Every uppercase, alphanumeric character,
[11:47.840 --> 11:49.700]  a certain set of symbols and space.
[11:50.320 --> 11:51.780]  So we did it.
[11:51.780 --> 11:54.340]  And, you know, landman, right?
[11:54.340 --> 11:55.480]  We put it up.
[11:55.480 --> 11:57.000]  The link is live, right?
[11:58.520 --> 12:00.200]  RainbowTables.shmoo.com
[12:00.820 --> 12:03.340]  43 gigabytes over BitTorrent.
[12:03.340 --> 12:04.640]  Go download it now.
[12:04.640 --> 12:07.700]  If you have a laptop, saturate Defcon's bandwidth.
[12:07.700 --> 12:10.620]  We're going for the BitTorrent record here.
[12:11.000 --> 12:11.980]  World's largest torrent.
[12:11.980 --> 12:12.900]  Can you man the slides for me?
[12:12.900 --> 12:13.480]  Right there.
[12:13.480 --> 12:14.020]  Right.
[12:15.260 --> 12:15.660]  So...
[12:15.660 --> 12:18.700]  The big thing was that we were told...
[12:19.220 --> 12:21.580]  And I'll cover the political part real quick.
[12:21.580 --> 12:23.000]  He'll cover the technical part.
[12:23.000 --> 12:24.700]  But the political part was...
[12:25.500 --> 12:27.680]  We got an email, and you'll see the email in just a second.
[12:27.680 --> 12:30.580]  It said, hey, I wrote Rainbow Crack,
[12:30.580 --> 12:32.740]  and I don't like you giving away the tables for free
[12:32.740 --> 12:34.500]  because, you know, I charge for them.
[12:34.500 --> 12:37.580]  And mind you, there's no license on the Rainbow Crack code at all.
[12:37.580 --> 12:38.060]  None.
[12:38.060 --> 12:39.040]  You know, the code is free.
[12:39.040 --> 12:41.500]  You can download it, but there's no BSD, no GPL, whatever.
[12:41.540 --> 12:43.560]  Meanwhile, I mean, there's other folks out there
[12:43.560 --> 12:45.740]  that are charging $700, $800 for, like,
[12:45.740 --> 12:49.320]  the Landman Symbol 32, you know, plus space tables.
[12:49.480 --> 12:50.120]  $700.
[12:50.380 --> 12:51.940]  You can go get those tables.
[12:51.940 --> 12:54.080]  Because, obviously, it's a little difficult for everybody
[12:54.080 --> 12:55.480]  to get together and just kind of generate them.
[12:55.480 --> 12:56.200]  Preach, brother.
[12:56.280 --> 12:57.760]  And we said, fuck it.
[12:58.040 --> 12:59.680]  We'll just generate them and give them away for free.
[12:59.680 --> 13:00.200]  So, there.
[13:00.200 --> 13:02.620]  A 43.9 gigabyte torrent.
[13:02.620 --> 13:03.880]  Join the torrent, bitches.
[13:04.300 --> 13:05.180]  Right there.
[13:07.720 --> 13:10.240]  That's an $800 torrent, I guess.
[13:12.480 --> 13:14.640]  We're all about added value.
[13:15.020 --> 13:17.360]  And Dan will go over the finer technical points
[13:17.360 --> 13:19.040]  of the email that we received.
[13:19.600 --> 13:20.280]  All right.
[13:20.340 --> 13:23.860]  There's the email that we got from the author of Rainbow Crack.
[13:23.960 --> 13:26.660]  And I would butcher his name, so I'm not going to mention it.
[13:27.280 --> 13:28.540]  But, you know...
[13:28.540 --> 13:29.460]  All right, you can read it.
[13:29.460 --> 13:31.140]  I mean, the text is sort of small, but you can see it.
[13:31.140 --> 13:33.060]  We bolded out the important points.
[13:33.060 --> 13:35.500]  For those guys selling the table without permission from me,
[13:35.500 --> 13:36.560]  they are not welcome.
[13:36.660 --> 13:38.040]  But you are worse.
[13:39.860 --> 13:42.500]  And the second paragraph basically goes into why he generated it,
[13:42.500 --> 13:44.480]  why it's cool, yada, yada, yada.
[13:44.480 --> 13:46.340]  And then, obviously, the third paragraph.
[13:46.340 --> 13:47.060]  Are you feeling cool?
[13:47.060 --> 13:49.460]  Because knowing all the passwords is cooler than trying to crack one.
[13:49.460 --> 13:51.940]  That's the line from our original website,
[13:51.940 --> 13:53.380]  rainbowtables.shimmy.com.
[13:53.600 --> 13:55.460]  All over the world, there will be a lot of guys
[13:55.960 --> 13:57.560]  can do what you do.
[13:57.560 --> 13:58.140]  They aren't.
[13:58.140 --> 13:58.720]  Do you know why?
[13:58.720 --> 14:00.940]  To show off proof neither your ability nor knowledge.
[14:00.940 --> 14:03.080]  We're just running your code, dude.
[14:03.080 --> 14:04.320]  We liked you.
[14:04.480 --> 14:06.400]  Why can't we all just get along?
[14:06.860 --> 14:08.260]  We're not hippies.
[14:08.640 --> 14:11.120]  And then, you know, if possible, please keep honored,
[14:11.120 --> 14:12.260]  blah, blah, blah.
[14:12.460 --> 14:14.720]  Don't be crazy anymore.
[14:16.100 --> 14:18.040]  Well, I mean,
[14:18.040 --> 14:19.120]  look at us.
[14:19.420 --> 14:20.220]  Honestly.
[14:22.620 --> 14:24.180]  Don't we all look sane?
[14:24.180 --> 14:25.520]  All right, so we basically said
[14:26.240 --> 14:28.360]  that we had a lot of reasons as we were doing
[14:28.360 --> 14:29.520]  the rainbow table generation
[14:29.520 --> 14:31.900]  to make it better.
[14:31.960 --> 14:33.320]  And initially, that was all we were going to do.
[14:33.320 --> 14:35.620]  We were like, oh, you know, there's some pieces of code here we could optimize.
[14:36.400 --> 14:38.260]  But then we had that email,
[14:38.260 --> 14:39.780]  and so that pissed us right off.
[14:39.780 --> 14:41.700]  And I mean, the big key was that, like, you know,
[14:41.700 --> 14:44.180]  once Dan started looking at it, he was like, fuck it.
[14:44.180 --> 14:45.680]  I mean, we can do something better.
[14:47.280 --> 14:49.240]  So we don't need your stinking code, dude.
[14:49.240 --> 14:50.680]  And snacks, by the way,
[14:50.680 --> 14:51.680]  says fuck off.
[14:51.840 --> 14:52.340]  Yeah.
[14:53.860 --> 14:56.100]  So we have an unnamed project.
[14:56.100 --> 14:57.600]  We don't have a name for it yet.
[14:57.840 --> 14:58.760]  You okay, man?
[14:59.580 --> 15:00.380]  Sorry.
[15:01.880 --> 15:03.700]  We're making people fall out of their chairs already.
[15:03.700 --> 15:04.360]  Sweet.
[15:06.940 --> 15:09.340]  All right, so we have an unnamed project.
[15:09.380 --> 15:11.040]  It's me, Dan Moniz,
[15:11.040 --> 15:13.200]  and Reverend Dr. Patrick Stack,
[15:13.200 --> 15:14.160]  who's not here.
[15:14.160 --> 15:16.060]  Some of you may know him as Optix.
[15:16.500 --> 15:18.380]  He's not a schmoo, but we're working together on this
[15:18.380 --> 15:20.780]  because we both love each other.
[15:22.040 --> 15:24.020]  So we wanted to improve on Rainbow Crack,
[15:24.020 --> 15:26.140]  and so we started out just trying to optimize
[15:26.140 --> 15:28.660]  Rainbow Crack. Leave the method the same,
[15:28.660 --> 15:30.640]  but just, you know, make it better.
[15:30.820 --> 15:32.120]  But in the process of doing that,
[15:32.120 --> 15:33.980]  we found out it is to suck.
[15:35.860 --> 15:37.660]  So we changed our approach,
[15:37.660 --> 15:38.940]  and we made a new tool.
[15:38.940 --> 15:40.620]  It doesn't have a name yet.
[15:41.820 --> 15:43.040]  Problems with Rainbow Crack.
[15:43.040 --> 15:44.900]  Who here knows a little bit of math?
[15:45.940 --> 15:46.640]  All right.
[15:48.440 --> 15:49.640]  All right.
[15:49.700 --> 15:51.500]  So I'm going to blow through this.
[15:51.500 --> 15:53.100]  If you want to come to the nitty-gritty,
[15:53.100 --> 15:55.120]  it's either going to be, and they're going to pimp this later,
[15:55.120 --> 15:58.140]  either at SchmooCon in January in D.C.
[15:58.140 --> 15:59.320]  in 2006.
[15:59.320 --> 16:01.100]  Or Guantanamo. We're on the edge.
[16:01.980 --> 16:03.820]  Or, if we're really good at it,
[16:03.820 --> 16:05.080]  we'll get it done by TourCon,
[16:05.080 --> 16:07.540]  which you should also come to this September.
[16:09.120 --> 16:10.840]  A reduction function bias.
[16:10.840 --> 16:13.300]  There's a reduction function in Rainbow Crack,
[16:13.300 --> 16:15.200]  and it has this bias issue,
[16:15.200 --> 16:17.980]  meaning that it does something a little fucked up.
[16:18.240 --> 16:19.480]  If your key space is
[16:19.480 --> 16:21.480]  six valid inputs,
[16:21.480 --> 16:24.040]  and you have a 2 to the 4,
[16:24.040 --> 16:25.300]  which is 16,
[16:25.300 --> 16:26.820]  number of outputs,
[16:26.820 --> 16:29.320]  the reduction that Rainbow Crack
[16:29.320 --> 16:31.060]  does, slightly simplified,
[16:31.060 --> 16:33.460]  I'm ignoring one little thing that doesn't matter,
[16:33.460 --> 16:34.980]  is the total number of outputs,
[16:34.980 --> 16:36.860]  modulo the total number of inputs,
[16:36.860 --> 16:39.340]  and that equals what we're calling a bias marker.
[16:39.440 --> 16:40.500]  Break it down.
[16:41.920 --> 16:43.260]  So, here's some
[16:43.260 --> 16:44.560]  modular arithmetic, real simple.
[16:44.560 --> 16:47.140]  0 mod 6 equals 0, all the way through to
[16:47.140 --> 16:49.040]  15 mod 6 equals 3.
[16:49.060 --> 16:50.540]  You can sort of see the columns.
[16:50.680 --> 16:53.340]  It's a lot of modular arithmetic, but one thing you'll notice
[16:53.340 --> 16:54.740]  is that there are three
[16:54.740 --> 16:57.280]  of every single value, i.e. the thing
[16:57.280 --> 16:59.300]  to the right of the equals sign. There's three of every of them,
[16:59.300 --> 17:01.180]  except four and five.
[17:01.360 --> 17:02.500]  We only have two of those
[17:02.960 --> 17:05.180]  in this 16 issue here.
[17:05.180 --> 17:07.240]  So, say that Landman only had
[17:07.240 --> 17:09.180]  six possible inputs,
[17:09.180 --> 17:11.260]  and say that the algorithm, which in Landman
[17:11.260 --> 17:12.820]  is DES, had
[17:12.820 --> 17:15.040]  2 to the 4 outputs, or 16.
[17:16.340 --> 17:17.880]  By taking an arbitrary
[17:17.880 --> 17:19.940]  random output from the algorithm,
[17:19.940 --> 17:22.040]  we can assume that the algorithm output is random,
[17:22.580 --> 17:24.100]  and modulo it by 6,
[17:24.100 --> 17:25.960]  there's a better chance of the
[17:25.960 --> 17:27.680]  input values being below
[17:27.680 --> 17:30.080]  that bias marker, that thing to the
[17:30.080 --> 17:32.000]  right of the equals sign. So, values 0
[17:32.000 --> 17:34.220]  to 3, because we have more of those,
[17:34.220 --> 17:36.080]  have a better chance of being picked at random
[17:36.080 --> 17:38.120]  due to this than the 4 to the 5
[17:38.120 --> 17:40.100]  values. We only have two of those.
[17:40.260 --> 17:40.860]  See?
[17:41.780 --> 17:43.680]  I know I'm going quick.
[17:44.380 --> 17:46.300]  So, the real bias problem here is
[17:46.300 --> 17:48.700]  that's just a summation,
[17:48.700 --> 17:49.960]  you know, that's for
[17:49.960 --> 17:52.620]  i equals 0 to i equals
[17:52.620 --> 17:54.880]  7 of 69
[17:54.880 --> 17:56.740]  to the i. So, this Riemann sum
[17:56.740 --> 17:58.640]  is not an integral factor of
[17:58.640 --> 18:00.220]  2 to the 64, just like
[18:00.220 --> 18:03.080]  6 is not an integral factor of 16.
[18:03.240 --> 18:05.200]  This modular arithmetic has a bias.
[18:05.760 --> 18:06.800]  So, if we bring this back
[18:06.800 --> 18:08.400]  to what Rainbow Crack actually does,
[18:08.400 --> 18:10.760]  instead of my bullshit example,
[18:10.760 --> 18:12.740]  you can assume that the output of DES is statistically
[18:12.740 --> 18:14.860]  random, or at least random enough
[18:15.780 --> 18:16.820]  that the bias would
[18:16.820 --> 18:19.440]  still be present. Why it matters.
[18:19.480 --> 18:20.780]  Okay, here's some math. I'm going to
[18:20.780 --> 18:22.620]  break it down. n equals the
[18:22.620 --> 18:24.700]  floored result of the total number of outputs
[18:24.700 --> 18:26.780]  over the total number of inputs. We're going to
[18:26.780 --> 18:28.880]  add 1 if n is below
[18:28.880 --> 18:30.740]  the bias marker, if it's one of those low values we
[18:30.740 --> 18:32.780]  have more of. And that
[18:32.780 --> 18:34.660]  1 represents the extra chance.
[18:34.660 --> 18:36.860]  We have only two 4s and 5s, we have three of everything
[18:36.860 --> 18:38.940]  else. 1 plus n,
[18:38.940 --> 18:40.920]  so those are those more present values
[18:40.920 --> 18:43.000]  over the total number of outputs,
[18:43.000 --> 18:44.560]  chance of hitting that key.
[18:44.980 --> 18:47.660]  n, the ones that we only have two of.
[18:47.660 --> 18:48.720]  Same thing.
[18:49.020 --> 18:51.020]  Values below that bias marker
[18:51.020 --> 18:53.000]  are unfairly weighted
[18:53.000 --> 18:54.720]  and are more likely to be inputs to the
[18:54.720 --> 18:57.100]  rainbow chain generation. What that basically
[18:57.100 --> 18:59.000]  means is, he screws up the
[18:59.000 --> 19:01.080]  math. And he basically
[19:01.080 --> 19:02.780]  does modular arithmetic
[19:02.780 --> 19:05.020]  wrong, so that he ends up generating
[19:05.640 --> 19:06.560]  impossible value
[19:06.560 --> 19:08.800]  hashes. They can't work.
[19:08.800 --> 19:10.620]  So our generation technique,
[19:10.620 --> 19:12.700]  or how we get around this, we start generating
[19:12.700 --> 19:14.700]  at the last possible input that's
[19:14.700 --> 19:16.780]  valid for landman, and we walk towards
[19:16.780 --> 19:18.620]  the first. As we
[19:18.620 --> 19:20.600]  generate, we use a bit mask, so we can
[19:20.600 --> 19:22.760]  determine if we have computed the key or not.
[19:22.760 --> 19:24.520]  We know if the bit mask works,
[19:24.520 --> 19:26.340]  if it's there or if it's not. So we have
[19:26.340 --> 19:28.480]  100%, like mathematically
[19:28.480 --> 19:30.660]  provable 100% verified
[19:30.660 --> 19:33.180]  key space, because everything is accounted for.
[19:33.560 --> 19:34.640]  At 1 bit per
[19:34.640 --> 19:36.780]  input, this method requires
[19:37.780 --> 19:38.820]  768 gigabytes
[19:38.820 --> 19:40.800]  of disk space, if we were going to do it
[19:40.800 --> 19:42.040]  on one machine.
[19:43.840 --> 19:44.880]  Our badass
[19:44.880 --> 19:46.240]  sorting foo.
[19:47.700 --> 19:48.940]  We separate out
[19:48.940 --> 19:50.740]  anything that has less than or equal to
[19:50.740 --> 19:52.940]  6 characters. 7 character
[19:52.940 --> 19:54.740]  key space is one
[19:54.740 --> 19:57.020]  table, 5 to 6 character key space is another.
[19:57.020 --> 19:59.020]  We do this so that you can detect the length of the password
[19:59.020 --> 20:00.800]  really easily.
[20:00.840 --> 20:02.880]  Landman primer. Here's how landman works
[20:02.880 --> 20:05.560]  really quickly. Take 14 bytes of input,
[20:05.560 --> 20:08.100]  split it into two chunks, each one is 7 bytes.
[20:08.400 --> 20:09.780]  Hash them independently.
[20:10.800 --> 20:11.560]  So say I have a password of
[20:11.560 --> 20:13.620]  dog. Dog turns into
[20:13.620 --> 20:15.940]  dog with nulls at the end of it.
[20:16.200 --> 20:17.640]  And then we split it into dog
[20:17.640 --> 20:19.760]  and then some more nulls.
[20:20.500 --> 20:21.600]  You can detect that
[20:21.600 --> 20:23.540]  the first half is 7 characters or less
[20:23.540 --> 20:25.380]  of this particular password, because the
[20:25.380 --> 20:27.920]  second half of the password is the null hash.
[20:27.980 --> 20:29.880]  It's the hash of nulls.
[20:30.300 --> 20:31.740]  Which is always going to be the same
[20:31.740 --> 20:34.220]  for any password 7 characters or less.
[20:34.660 --> 20:35.920]  Now with the password of
[20:36.720 --> 20:37.120]  SpamDadRules
[20:39.100 --> 20:39.900]  Word!
[20:39.920 --> 20:41.300]  Where's your Spam Daddy?
[20:42.240 --> 20:44.220]  There was one guy in the audience who that was
[20:44.220 --> 20:45.640]  designed to be for.
[20:47.520 --> 20:48.420]  That's my elite
[20:48.420 --> 20:49.860]  Stego technique.
[20:50.360 --> 20:52.320]  Alright, so, same thing. More than
[20:52.320 --> 20:54.480]  7 characters. So it goes to that, SpamDad
[20:54.480 --> 20:56.240]  and then rules, null null null.
[20:56.260 --> 20:58.680]  You know that this hash is 7 characters
[20:59.400 --> 21:00.300]  That's actually more than
[21:00.300 --> 21:02.180]  That slide is wrong. This hash is actually
[21:02.180 --> 21:04.720]  more than 7 characters. 7 characters or more.
[21:05.000 --> 21:06.240]  Because the second half of the hash
[21:06.240 --> 21:08.060]  is not the null password hash. We get the rules
[21:08.060 --> 21:10.140]  in there. So this decreases
[21:10.140 --> 21:12.180]  the time spent looking through
[21:12.180 --> 21:13.720]  every hash that can't work.
[21:14.580 --> 21:16.100]  RainbowCrack loses, because
[21:16.100 --> 21:18.300]  RainbowCrack just generates random hashes.
[21:18.420 --> 21:20.020]  He's just using your CPU time. He's just saying
[21:20.020 --> 21:22.420]  I don't know. That might work.
[21:22.760 --> 21:24.100]  And that reduction function has that
[21:24.100 --> 21:26.180]  bias problem. So, random
[21:26.180 --> 21:28.280]  hash, okay, fair enough.
[21:28.280 --> 21:30.420]  That's, you know, a pretty good approach.
[21:30.420 --> 21:31.880]  But plus this error
[21:32.420 --> 21:34.340]  equals lame. Bad plus suck
[21:34.340 --> 21:36.000]  equals lame-zor.
[21:37.560 --> 21:38.400]  Now we get our
[21:38.400 --> 21:39.480]  crack on.
[21:41.260 --> 21:42.360]  RTcrack, that's the tool
[21:42.360 --> 21:44.440]  that you use in RainbowCrack to actually crack
[21:44.440 --> 21:46.420]  the passwords once you've made them all.
[21:46.860 --> 21:48.200]  It reads in as much of the
[21:48.200 --> 21:50.440]  hash table file that RTgen, which is
[21:50.440 --> 21:52.320]  the generator, generates using
[21:52.320 --> 21:54.360]  the read syscall. And then
[21:54.360 --> 21:56.520]  it walks linearly to check
[21:56.520 --> 21:58.280]  to see if the endpoints of the rainbow chain
[21:58.280 --> 22:00.260]  match. And this has O to the N
[22:00.260 --> 22:02.840]  complexity, big O notations, standard stuff.
[22:03.960 --> 22:04.620]  We store the
[22:04.620 --> 22:06.340]  start point and the endpoints in separate
[22:06.340 --> 22:08.520]  files on corresponding offsets.
[22:08.520 --> 22:10.040]  And then we take the page size
[22:10.040 --> 22:12.140]  on the x86 architecture,
[22:12.140 --> 22:14.340]  4096 bytes, divide it by
[22:14.340 --> 22:16.340]  the entry size, 8, plus 1
[22:16.340 --> 22:18.260]  for the index, and that gives us
[22:18.260 --> 22:20.040]  513. So every
[22:20.040 --> 22:22.320]  513th entry, after we've sorted
[22:22.320 --> 22:24.820]  them all, we store it in a special index file.
[22:24.820 --> 22:26.000]  And at crack time, we
[22:26.000 --> 22:27.500]  mmap this
[22:28.000 --> 22:30.080]  endpoint index file and use divide and conquer
[22:30.080 --> 22:32.000]  or Fibonacci find to find out if
[22:32.000 --> 22:33.820]  the endpoint is in the index file.
[22:33.820 --> 22:35.900]  Or if it's not, to find out
[22:35.900 --> 22:37.900]  what offset the endpoint is referenced
[22:37.900 --> 22:39.520]  in in the master index file.
[22:39.800 --> 22:41.300]  Now we get our search on.
[22:41.820 --> 22:44.300]  Thus, for each offset, we read a
[22:44.300 --> 22:46.120]  max, maximum
[22:46.120 --> 22:49.320]  of one page of memory off of disk
[22:49.320 --> 22:50.420]  rather than reading
[22:50.420 --> 22:53.280]  the 12 gigabyte file you did.
[22:53.280 --> 22:54.280]  So 496
[22:54.280 --> 22:56.380]  bytes maximum, ever,
[22:56.380 --> 22:58.780]  to read 512 possible hashes.
[22:59.080 --> 23:00.280]  And this is a Bayes tree that's been
[23:00.280 --> 23:01.920]  modified slightly.
[23:02.120 --> 23:04.340]  Patrick, who came up with this method, has a doctorate
[23:04.340 --> 23:06.220]  of divinity in searching and sorting
[23:06.220 --> 23:08.660]  from the church of Donald Knuth.
[23:09.520 --> 23:10.180]  Awesome.
[23:10.920 --> 23:12.340]  Give it up for optics.
[23:12.540 --> 23:13.380]  Optics.
[23:16.860 --> 23:18.100]  Anybody have any Advil?
[23:18.160 --> 23:20.060]  He sent an email to Zhu, trying to
[23:20.060 --> 23:21.940]  explain this to him, and Zhu's like,
[23:21.940 --> 23:23.280]  nah man, I don't know that.
[23:25.340 --> 23:26.420]  So Rainbow Crack
[23:26.420 --> 23:28.000]  gets an L for lame.
[23:28.240 --> 23:29.680]  Disk IO in Rainbow Crack
[23:29.680 --> 23:31.680]  costs as much CPU time as
[23:31.680 --> 23:33.660]  encryption, if not more.
[23:34.040 --> 23:35.820]  And so Rainbow Crack fails to account for this
[23:35.820 --> 23:37.740]  in the way he does his statistics about how long it's
[23:37.740 --> 23:39.380]  going to take you to make all the keyspace.
[23:39.380 --> 23:40.880]  Don't be crazy anymore.
[23:42.900 --> 23:43.620]  Say it
[23:43.620 --> 23:46.360]  more whiny. Don't be crazy anymore.
[23:47.200 --> 23:47.900]  So here's
[23:47.900 --> 23:49.440]  our secret sauce. Our code
[23:49.440 --> 23:51.800]  is implemented in C and assembly
[23:51.800 --> 23:53.860]  for the IA-64 Itanium 2
[23:53.860 --> 23:55.700]  and running on a classified
[23:55.700 --> 23:57.100]  number of processors
[23:57.800 --> 23:59.680]  in an undisclosed location.
[23:59.820 --> 24:01.800]  But we have to give a shout out to SGI for
[24:01.800 --> 24:03.940]  helping us out with this. Any SGI
[24:03.940 --> 24:05.180]  people in the house?
[24:05.940 --> 24:07.960]  Nobody? I'm sorry.
[24:08.920 --> 24:09.700]  We also
[24:09.700 --> 24:11.340]  implemented the generator.
[24:11.400 --> 24:14.240]  We haven't done the cracker yet, but the generator's in VHDL
[24:14.240 --> 24:15.400]  to run as customized
[24:15.920 --> 24:18.140]  specialized hardware on a Spartan 3 FPGA.
[24:18.140 --> 24:19.960]  Flip that up. There we go.
[24:19.960 --> 24:21.620]  Things generating landman hashes
[24:21.620 --> 24:24.520]  as we speak, basically.
[24:24.880 --> 24:26.340]  Okay, I'm holding it up higher.
[24:26.340 --> 24:28.140]  Jeez. And that's me.
[24:28.140 --> 24:29.960]  I'm done. It has blinking lights
[24:29.960 --> 24:30.960]  and shit.
[24:32.400 --> 24:33.260]  Thank you.
[24:34.620 --> 24:36.740]  Oh my god!
[24:36.740 --> 24:38.360]  That's so fucking cool.
[24:42.120 --> 24:44.840]  The brain's coming out of my ears.
[24:45.860 --> 24:46.520]  That's just
[24:46.520 --> 24:48.400]  hot, man. That's so hot.
[24:49.480 --> 24:50.480]  Alright, so
[24:50.480 --> 24:52.380]  I'm going to talk about a few wireless
[24:52.380 --> 24:54.060]  things here and there.
[24:55.580 --> 24:56.940]  First of all,
[24:57.800 --> 24:58.740]  why oh why
[24:58.740 --> 25:00.220]  do we Wi-Fi?
[25:00.780 --> 25:02.460]  Who here has an open wireless
[25:02.460 --> 25:03.540]  network at home?
[25:04.160 --> 25:05.960]  Go ahead. You can admit it.
[25:06.500 --> 25:08.340]  My name's Beetle, and I have an open
[25:08.340 --> 25:09.480]  wireless network at home.
[25:11.960 --> 25:14.240]  You know, crap.
[25:14.400 --> 25:16.340]  My TiVo, it can't do WPA.
[25:16.340 --> 25:18.220]  And my PSP, it can't either.
[25:18.220 --> 25:19.700]  Does it really fucking matter?
[25:19.900 --> 25:21.880]  I mean, at the end of the day, does it matter
[25:21.880 --> 25:23.580]  if somebody's reading my streams of
[25:24.820 --> 25:26.300]  Girls Gone Wild?
[25:26.760 --> 25:28.080]  I mean, does it matter
[25:28.080 --> 25:29.500]  that somebody's messing with my
[25:29.500 --> 25:31.280]  Wipeout Pure ad hoc session?
[25:31.560 --> 25:33.020]  Do we really care?
[25:33.220 --> 25:35.140]  Some of the technology, it really doesn't matter
[25:35.140 --> 25:38.160]  if it's that secure. It's dumb.
[25:38.160 --> 25:40.640]  It's dumb, it's entertainment, blah blah blah.
[25:41.020 --> 25:42.180]  But, when you start
[25:42.180 --> 25:43.740]  looking at different environments, where in the world
[25:43.740 --> 25:45.420]  should you be actually doing wireless?
[25:45.420 --> 25:46.880]  Coffee shops? Eh, alright.
[25:46.880 --> 25:49.240]  Airports? Mm, maybe. Hospitals?
[25:49.700 --> 25:50.500]  Banks?
[25:51.980 --> 25:53.720]  Nuclear power plants?
[25:56.340 --> 25:57.640]  You know, this is interesting.
[25:57.640 --> 25:59.340]  I got this from Matt Fisher.
[25:59.340 --> 26:00.380]  He sent this to me.
[26:00.820 --> 26:03.080]  Scanned it in. He was like, man, check this out.
[26:03.080 --> 26:05.800]  They're doing wireless at some nuke plants.
[26:06.000 --> 26:08.140]  I'm like, okay, cool.
[26:08.480 --> 26:10.020]  He was like, no, no, no.
[26:10.500 --> 26:11.740]  Look a little closer.
[26:13.200 --> 26:14.920]  IP address, baby.
[26:19.050 --> 26:20.310]  Not only do they tell you
[26:20.310 --> 26:21.710]  that they're running Cisco hardware,
[26:21.710 --> 26:23.630]  they tell you what the internal address space is
[26:23.630 --> 26:26.290]  at Comanche Peak, Arizona, or Azima.
[26:27.570 --> 26:28.390]  It's great.
[26:28.390 --> 26:30.290]  Azima has installed monitoring devices
[26:30.290 --> 26:33.710]  on more than 50 pieces of critical equipment.
[26:39.780 --> 26:41.760]  Where did we go wrong?
[26:41.760 --> 26:42.380]  I mean,
[26:42.380 --> 26:44.660]  and where the hell are we going?
[26:45.420 --> 26:47.900]  I mean, it's a technology of convenience, right?
[26:47.900 --> 26:50.000]  But there's obviously this inconvenience
[26:50.000 --> 26:52.300]  of securing it, so we just put it out there.
[26:52.540 --> 26:53.820]  And then all these users,
[26:53.820 --> 26:54.880]  as far as they're concerned,
[26:54.880 --> 26:56.460]  they're left in the authentication cold.
[26:56.460 --> 26:58.900]  And then the standards, they're half-assed to begin with.
[26:58.900 --> 27:01.860]  And then how they're implemented, that's half-assed as well.
[27:02.480 --> 27:03.300]  And then, of course,
[27:03.300 --> 27:04.660]  everybody has this acronym
[27:06.520 --> 27:07.400]  knowledge.
[27:07.700 --> 27:09.600]  Everybody has a degree in acronyms now,
[27:09.600 --> 27:11.980]  and they use the acronyms to secure their networks.
[27:12.460 --> 27:13.340]  Right?
[27:13.360 --> 27:16.320]  I have an EAP-protected network, really.
[27:17.180 --> 27:18.300]  Hallelujah.
[27:18.800 --> 27:21.860]  I use a VPN to secure my wireless, really.
[27:22.780 --> 27:25.180]  How did you deploy that VPN?
[27:25.180 --> 27:27.360]  In what configuration is that VPN?
[27:27.360 --> 27:29.700]  Which EAP are you using?
[27:30.900 --> 27:32.680]  Choose a mobile network with care.
[27:34.880 --> 27:36.940]  Choose a mobile network at random.
[27:40.430 --> 27:43.150]  How the fuck does the user know?
[27:43.850 --> 27:45.510]  Really, how?
[27:46.510 --> 27:48.450]  Let's look at a rogue access point attack.
[27:48.450 --> 27:49.830]  Graphical, we've seen this.
[27:49.830 --> 27:50.990]  Defcon, two years ago.
[27:50.990 --> 27:53.030]  Unfortunately, the press just caught on this year.
[27:55.450 --> 27:57.450]  Wi-Fi card comes in,
[27:57.450 --> 27:59.210]  gets disassociated by an access point
[27:59.210 --> 28:00.650]  that's closer or stronger.
[28:00.830 --> 28:02.570]  SSID effectively becomes bad guy,
[28:02.570 --> 28:04.690]  and this, before Windows XP Service Pack 2,
[28:04.690 --> 28:07.630]  would occur without the user's knowledge.
[28:07.730 --> 28:08.810]  Now, with Service Pack 2,
[28:08.810 --> 28:10.850]  it tells you when the SSID changes.
[28:10.850 --> 28:11.710]  Ooh.
[28:13.730 --> 28:15.130]  Rock on.
[28:17.270 --> 28:18.870]  So nobody can forge an SSID
[28:18.870 --> 28:20.310]  or duplicate an SSID
[28:20.310 --> 28:22.090]  or a MAC address or any of that.
[28:22.090 --> 28:23.530]  So, rogue access point attacks.
[28:23.530 --> 28:25.430]  When you're choosing your Wi-Fi weapon,
[28:25.430 --> 28:27.590]  normal gear running at 14 dBm,
[28:27.590 --> 28:29.190]  Cisco gear running at 20 dBm,
[28:29.190 --> 28:31.530]  Sineo gear running at 23 dBm,
[28:31.530 --> 28:33.910]  throw on a nice little directional antenna,
[28:33.910 --> 28:37.170]  you get 15 dBd and 38 dBd total.
[28:37.170 --> 28:38.370]  Six watts!
[28:38.370 --> 28:40.710]  Versus 25 milliwatts.
[28:40.710 --> 28:42.710]  You will win every time.
[28:43.630 --> 28:44.650]  There's no way
[28:44.650 --> 28:46.030]  that somebody's going to actually
[28:46.030 --> 28:47.850]  get on to the other access point,
[28:47.850 --> 28:49.690]  the legitimate access point. They're mine.
[28:50.490 --> 28:52.110]  So we have things that you can display,
[28:52.110 --> 28:54.510]  such as Hotmail. That's not Hotmail.
[28:57.820 --> 28:58.820]  You have other things,
[28:58.820 --> 29:00.680]  like PayPal. That's not PayPal.
[29:02.860 --> 29:04.480]  And at airports.
[29:04.700 --> 29:06.220]  That's pretty interesting.
[29:06.320 --> 29:07.980]  You're seeing this across the country.
[29:07.980 --> 29:09.580]  Joe's Wireless Hotspot.
[29:09.580 --> 29:11.380]  I don't know who they are.
[29:12.880 --> 29:13.820]  Done.
[29:14.940 --> 29:15.860]  Rogue access points
[29:15.860 --> 29:17.400]  are not going to go away.
[29:17.400 --> 29:18.840]  Users are going to be users,
[29:18.840 --> 29:20.280]  and they will fall victim to being
[29:20.280 --> 29:23.440]  drawn over to impersonating access points.
[29:23.440 --> 29:24.860]  If you didn't notice,
[29:24.860 --> 29:28.320]  phishing, identity theft,
[29:28.320 --> 29:29.680]  on the rise.
[29:29.820 --> 29:32.760]  Wireless hotspot usage, on the rise.
[29:33.220 --> 29:33.880]  Apparently,
[29:33.880 --> 29:35.260]  some people, like Gartner,
[29:35.260 --> 29:36.640]  feel that that's not a threat.
[29:36.640 --> 29:39.280]  It's overblown. Gartner can blow us.
[29:40.340 --> 29:41.880]  This is a problem.
[29:42.060 --> 29:43.240]  Pay attention.
[29:45.060 --> 29:46.560]  It gets worse.
[29:47.020 --> 29:48.080]  Rogue radius.
[29:48.560 --> 29:51.020]  So you secure your nice little network
[29:51.020 --> 29:52.980]  with EAP, and there's a nice little acronym
[29:52.980 --> 29:54.620]  bonanza with regards to EAP.
[29:54.620 --> 29:56.660]  Who says that rogue access points can't be used against
[29:56.660 --> 29:59.380]  wireless corporate networks that are using EAP?
[29:59.840 --> 30:01.760]  Plenty of ways to screw EAP up,
[30:01.760 --> 30:03.020]  and they allow for things such as
[30:03.020 --> 30:05.840]  EAP peaking. That's my new term for it.
[30:06.500 --> 30:07.180]  This is kind of how
[30:07.180 --> 30:08.380]  EAP works.
[30:08.980 --> 30:11.160]  You say, hey, I want to join the network.
[30:12.320 --> 30:12.920]  Access point
[30:12.920 --> 30:15.420]  replies back and says, hey, who the hell are you?
[30:15.420 --> 30:16.700]  You send your identity.
[30:17.240 --> 30:18.960]  Radius server validates that.
[30:18.960 --> 30:21.500]  Gives you a dynamic key. Allows you onto the network.
[30:21.760 --> 30:23.100]  There are variations of
[30:23.100 --> 30:24.720]  EAP, such as EAP
[30:24.720 --> 30:27.060]  TTLS. EAP
[30:27.060 --> 30:28.820]  TTLS, very similar.
[30:28.840 --> 30:31.380]  You have your 802.11 authentication association.
[30:31.380 --> 30:33.320]  EAP protocol exchange.
[30:33.320 --> 30:35.300]  TTLS protocol exchange. A nice little
[30:35.300 --> 30:37.220]  secure tunnel is established.
[30:37.900 --> 30:39.380]  And through that secure tunnel,
[30:39.380 --> 30:41.280]  that's where you pass your credentials.
[30:41.980 --> 30:43.340]  And everything else happens
[30:43.340 --> 30:44.660]  like it's supposed to.
[30:45.220 --> 30:47.740]  Ah, what's the weakness here?
[30:47.780 --> 30:49.060]  If you have a previous EAP
[30:49.060 --> 30:51.380]  TTLS authentication established,
[30:51.380 --> 30:53.240]  and a rogue access point with
[30:53.400 --> 30:55.300]  a radius server comes in, and you are
[30:55.300 --> 30:57.160]  not doing remote certificate checking,
[30:57.160 --> 30:59.900]  and or loose checking, disassociated,
[30:59.900 --> 31:02.000]  and of course, what you do is associate,
[31:02.000 --> 31:03.820]  authenticate, set up EAP
[31:04.660 --> 31:05.960]  TTLS, secure
[31:05.960 --> 31:07.880]  tunnel, and then you pass your credentials
[31:07.880 --> 31:09.980]  over the secure tunnel to the wrong
[31:09.980 --> 31:10.880]  person.
[31:12.980 --> 31:13.940]  So, how do you
[31:13.940 --> 31:15.920]  actually implement this? EAP TTLS
[31:15.920 --> 31:18.020]  with PAP, which is a variation
[31:18.020 --> 31:19.840]  that you can probably Google
[31:19.840 --> 31:21.680]  for. Windows XP
[31:21.680 --> 31:23.940]  Service Pack 2 using EAP TTLS with
[31:23.940 --> 31:26.360]  PAP, probably using a phone client.
[31:26.360 --> 31:28.900]  You have your rogue radius
[31:28.900 --> 31:30.660]  server come in, rogue access point
[31:30.660 --> 31:32.440]  disassociates users, learns username
[31:32.440 --> 31:34.600]  and password of every user that's on the access
[31:34.600 --> 31:36.700]  point at that time, disassociates them,
[31:36.700 --> 31:38.800]  copies the credits to the local EAP config,
[31:38.800 --> 31:40.380]  and then impersonates the victim.
[31:41.580 --> 31:42.580]  Google!
[31:43.100 --> 31:44.560]  You can find plenty of educational
[31:44.560 --> 31:46.720]  institutions that are using EAP TTLS
[31:46.720 --> 31:47.600]  with PAP.
[31:48.860 --> 31:50.460]  Ah, but there's a different vulnerability
[31:50.460 --> 31:52.480]  as well, because Microsoft provides
[31:52.480 --> 31:54.460]  something secure and
[31:54.460 --> 31:56.560]  protected EAP. And when it's used
[31:56.560 --> 31:58.380]  with client certificates,
[31:58.380 --> 32:00.660]  server certificates, rock on.
[32:01.380 --> 32:02.520]  But PKI is
[32:02.520 --> 32:03.600]  to suck.
[32:04.780 --> 32:06.560]  Nobody can get it right in the wired
[32:06.560 --> 32:08.340]  world. How in the world are we going to get PKI
[32:08.340 --> 32:10.440]  right in the wireless world? And so,
[32:10.440 --> 32:12.020]  we provide the nice little option
[32:12.020 --> 32:14.460]  for people to use their username and password
[32:14.460 --> 32:15.900]  over a secure tunnel
[32:16.380 --> 32:18.760]  to associate to wireless networks.
[32:19.000 --> 32:20.400]  If you don't validate the
[32:20.400 --> 32:22.340]  server certificate and or you
[32:22.340 --> 32:24.160]  don't check all of the certificate stores
[32:24.160 --> 32:26.540]  in the normal store for Windows,
[32:26.540 --> 32:27.640]  you are a victim to
[32:28.800 --> 32:30.720]  a peep attack. In this case,
[32:30.720 --> 32:32.340]  what you do is disassociate all the
[32:32.340 --> 32:34.360]  users, learn
[32:34.360 --> 32:36.300]  the domain and username immediately
[32:36.300 --> 32:38.480]  with your rogue access point and radius server,
[32:39.060 --> 32:40.740]  disassociate them again,
[32:40.740 --> 32:42.340]  seed the local password file with
[32:42.460 --> 32:44.500]  a bogus password. Windows XP
[32:44.500 --> 32:46.240]  Service Pack 2 is kind enough to keep
[32:46.240 --> 32:48.140]  re-associating to you.
[32:48.240 --> 32:51.120]  Over and over and over.
[32:51.120 --> 32:53.240]  And as they do, they keep providing
[32:53.240 --> 32:55.100]  their username and password. It's
[32:55.100 --> 32:57.340]  only part of the password, so it's difficult
[32:57.340 --> 32:58.900]  for you to get it, right? Until
[32:59.600 --> 33:01.340]  your dictionary stumbles upon
[33:01.340 --> 33:03.040]  their correct password, they authenticate
[33:03.040 --> 33:05.120]  successfully to you and bang, you
[33:05.120 --> 33:06.940]  have their username and password. MS
[33:06.940 --> 33:09.440]  Chat V2 does not protect against this.
[33:10.660 --> 33:11.180]  Wireless
[33:11.180 --> 33:12.660]  weaponry for Windows.
[33:13.380 --> 33:15.100]  Rogue access point attacks.
[33:15.100 --> 33:17.460]  Only in use by sophisticated hackers,
[33:17.460 --> 33:19.320]  right? Because it's so
[33:19.320 --> 33:21.320]  hard to set up an access point and
[33:21.320 --> 33:22.720]  give people the internet.
[33:23.680 --> 33:25.240]  Wireless access points?
[33:25.300 --> 33:26.800]  Easy to set up.
[33:27.320 --> 33:29.500]  If you want to set it up on one Windows laptop,
[33:29.500 --> 33:31.320]  you can do it. Evil twin access
[33:31.320 --> 33:33.360]  points for dummies. You can see it
[33:33.360 --> 33:35.620]  airsnarf.shmoo.com, airsnarf4win.
[33:35.700 --> 33:36.660]  html.
[33:37.060 --> 33:39.180]  But why should you run only one access
[33:39.180 --> 33:41.400]  point or one rogue access point when you can run
[33:41.400 --> 33:43.500]  one, two, three?
[33:44.060 --> 33:45.300]  Rogue Squadron.
[33:45.400 --> 33:47.300]  Because it's so hard for people to run
[33:47.300 --> 33:50.160]  airsnarf, which is a shell script.
[33:51.600 --> 33:53.860]  Rogue access point set up for the masses.
[33:53.860 --> 33:55.600]  It's a modified WRT54G
[33:55.600 --> 33:57.420]  firmware based off of EWRT,
[33:57.420 --> 33:59.320]  adds a username and password.
[33:59.880 --> 34:01.340]  Capture and logging looks like
[34:01.340 --> 34:02.280]  this.
[34:13.090 --> 34:15.250]  It's the first firmware release from the
[34:15.250 --> 34:16.250]  shmoo group.
[34:19.510 --> 34:21.330]  We had shmoo hot
[34:21.330 --> 34:23.690]  interns working on this all night.
[34:25.410 --> 34:27.150]  There you go. It's basically using captive
[34:27.150 --> 34:28.590]  portal or no cat.
[34:28.970 --> 34:31.150]  Allows you to set up a captive portal,
[34:31.150 --> 34:33.110]  people associate, and no matter
[34:33.110 --> 34:35.150]  what site that they go to, just as we've demonstrated
[34:35.150 --> 34:37.110]  before, you redirect them to the local captive
[34:37.110 --> 34:39.670]  portal, ask for their username and password.
[34:39.770 --> 34:41.170]  I'm not going to describe
[34:41.170 --> 34:43.170]  how easy it would be to
[34:43.170 --> 34:45.350]  modify this to display a T-Mobile
[34:46.790 --> 34:47.670]  graphic.
[34:49.170 --> 34:50.970]  Username and password entered.
[34:51.410 --> 34:53.330]  All you do is log into the box later on,
[34:53.330 --> 34:55.190]  SSH, dump your
[34:55.190 --> 34:56.450]  passwords, you're gone.
[34:56.470 --> 34:58.990]  Airsnarf.shmoo.com slash rogue underscore
[34:58.990 --> 35:00.850]  squadron is where you can get that.
[35:02.410 --> 35:03.210]  And here's
[35:03.210 --> 35:05.090]  Rodney! Thanks.
[35:13.370 --> 35:14.450]  So I'm lazy.
[35:14.450 --> 35:16.010]  I don't actually usually try to
[35:16.010 --> 35:17.590]  break things. Well, I break things once in a while, but
[35:17.590 --> 35:19.750]  usually I just look at vendors' products because they're broken
[35:19.750 --> 35:21.910]  enough, so why not just have fun with them?
[35:22.650 --> 35:23.890]  So anyway,
[35:23.890 --> 35:25.510]  never let Beetle type your slides.
[35:26.030 --> 35:27.870]  Shooting your security wad, which was about
[35:28.410 --> 35:29.590]  broken products.
[35:29.590 --> 35:31.470]  Okay, so what am I ranting about?
[35:31.570 --> 35:33.490]  You know, I have to keep up with the crowd here.
[35:33.490 --> 35:35.490]  So I've been doing product reviews, I do public ones, I do
[35:35.490 --> 35:37.810]  private ones, you know, take a box, set it up in a
[35:37.810 --> 35:39.790]  conference room, test it for a week, it goes off in a
[35:39.790 --> 35:41.770]  corner gibbering, hopefully I get some money out of
[35:41.770 --> 35:43.990]  it. People put out
[35:43.990 --> 35:45.730]  really lame features. I'm going to, if I
[35:45.730 --> 35:48.730]  can get this thing with a fruit in the front to back up,
[35:48.730 --> 35:49.730]  back up to this slide of
[35:50.170 --> 35:52.170]  beetles. I'm going to steal one here.
[35:52.170 --> 35:54.130]  Come on, buttons.
[35:54.130 --> 35:56.910]  Back up here. So with this Microsoft
[35:56.910 --> 35:57.810]  Windows, they ship
[35:57.810 --> 35:59.890]  you a security product that says,
[35:59.890 --> 36:02.150]  do you want to validate the server certificate?
[36:02.150 --> 36:04.230]  They let you turn that off.
[36:04.270 --> 36:05.950]  This is in the standard shipping
[36:05.950 --> 36:08.130]  product. What were they thinking?
[36:08.610 --> 36:10.010]  I mean, it's crypto, right?
[36:10.010 --> 36:11.630]  We do it or don't, we yell at people.
[36:11.630 --> 36:13.890]  Do you want a button in your browser that says, oh, just
[36:13.890 --> 36:15.910]  turn off all the crypto, it doesn't really matter.
[36:16.930 --> 36:18.030]  They weren't thinking.
[36:18.030 --> 36:19.850]  Well, they were thinking about something like money
[36:19.850 --> 36:21.910]  probably. But anyway,
[36:21.910 --> 36:23.670]  you know, vendors do things like this.
[36:23.750 --> 36:25.450]  Microsoft's certainly not the only one.
[36:25.450 --> 36:26.950]  Anyway, we see incredibly
[36:26.950 --> 36:29.690]  features that go by. I mean, you know,
[36:29.690 --> 36:31.370]  people who build firewalls that you can get to
[36:31.370 --> 36:33.430]  by clear text HTTP because no
[36:33.430 --> 36:35.370]  bad guy would ever get on your management land.
[36:35.370 --> 36:37.430]  Just never happens. So what we tell you
[36:37.430 --> 36:39.070]  is something, I wrote this slide way before
[36:39.070 --> 36:41.530]  the teal camo shock
[36:41.530 --> 36:43.370]  troops with their boot knives came in
[36:43.370 --> 36:45.610]  and cut pages out of the presentations.
[36:46.370 --> 36:47.310]  There's a risk of
[36:47.310 --> 36:50.070]  Ford Pinto gas tank syndrome, which I call FPGS.
[36:50.090 --> 36:51.390]  This was something that happened a long, long
[36:51.390 --> 36:53.250]  time ago where some bean counter at Ford to say
[36:53.250 --> 36:55.210]  that they could save a penny per car by changing the
[36:55.210 --> 36:57.210]  bolts in the gas tank, which gave them this really
[36:57.210 --> 36:59.270]  interesting characteristic that if you ran into the back of a Ford
[36:59.270 --> 37:00.810]  Pinto, the gas tank exploded.
[37:00.950 --> 37:02.790]  Most people involved were unhappy.
[37:03.570 --> 37:05.290]  And, you know, lawyers figured this out and eventually
[37:05.290 --> 37:07.390]  the memos came out and Ford got sued
[37:07.390 --> 37:09.350]  and they don't do that anymore. Well, we hope they don't do that
[37:09.350 --> 37:11.210]  anymore. Of course, now we build plastic cars.
[37:11.210 --> 37:12.650]  You just look at them and they fall apart.
[37:13.510 --> 37:15.270]  Anyway, so I ask these really
[37:15.270 --> 37:17.170]  hard questions of vendors and the vendors
[37:17.170 --> 37:19.470]  get all freaked out when I ask them these things.
[37:19.510 --> 37:21.230]  Now, remember, I'm not a hacker. I just
[37:21.230 --> 37:23.550]  play one on the internet. I mean, I do my own stunts,
[37:23.550 --> 37:25.130]  but I'm just playing one on the internet here.
[37:25.130 --> 37:27.150]  I'm not really as scary as most of you guys are.
[37:27.190 --> 37:29.190]  Anyway, so, like, does your product
[37:29.190 --> 37:31.210]  produce an external log? Now, apparently, this is
[37:31.210 --> 37:33.250]  hard. So, think about it. So, I have these
[37:33.250 --> 37:35.650]  IDS products. I power off the box.
[37:35.710 --> 37:37.370]  Go do my bad things. Power the box
[37:37.370 --> 37:39.250]  back on. It doesn't generate any messages when it
[37:39.250 --> 37:41.670]  gets powered back on. It just starts talking again.
[37:41.670 --> 37:43.310]  And so, I would think that would be a simple
[37:43.310 --> 37:45.310]  message to generate. This is apparently hard.
[37:45.970 --> 37:47.330]  Do you have a security incident
[37:47.330 --> 37:49.230]  reporting mechanism? Yes, I wrote this slide
[37:49.330 --> 37:51.250]  a long time ago before some people did some
[37:51.250 --> 37:53.130]  things that made some people's incident response
[37:53.130 --> 37:56.370]  teams, um, cause us to question them.
[37:56.370 --> 37:57.450]  Let's just say it that way.
[37:57.630 --> 37:59.370]  Um, some people don't even have things.
[37:59.370 --> 38:01.150]  I mean, there are many worse vendors out there
[38:01.150 --> 38:03.410]  than, you know, Cisco, Microsoft, that type of character.
[38:03.530 --> 38:05.230]  Do you store your key material
[38:05.230 --> 38:07.130]  securely? So, after you've got this access
[38:07.130 --> 38:09.610]  point or radius or whatever box it is with wireless,
[38:09.610 --> 38:11.490]  if your private key's in the clear,
[38:11.490 --> 38:13.190]  uh, so, what was the point? You know,
[38:13.190 --> 38:15.450]  if you don't keep the thing secure, I mean, there's a whole bunch of crypto.
[38:15.450 --> 38:17.190]  We've been doing this for 20 years. You should be able
[38:17.190 --> 38:19.450]  to figure this out. Do you have a management interface?
[38:19.450 --> 38:21.450]  Is it secure? I, you know,
[38:21.450 --> 38:23.530]  sitting on the phone with somebody doing a firewall audit,
[38:23.530 --> 38:25.050]  and I say, what do the firewall rules look like?
[38:25.050 --> 38:27.310]  And the CEO orders the IT geek to let me
[38:27.310 --> 38:29.530]  telnet into the box from the public internet.
[38:30.290 --> 38:31.370]  I'm like, uh,
[38:31.370 --> 38:33.690]  I don't need to know what your firewall rules are anymore, dude.
[38:34.050 --> 38:35.330]  Um, telnet's not
[38:35.330 --> 38:37.510]  too, too common. We still have SSH1,
[38:37.510 --> 38:39.250]  which is breakable. There's a lot of clear
[38:39.250 --> 38:41.570]  text HTTP. There were vendors at Black Hat.
[38:41.570 --> 38:43.610]  We're a studly, we have a booth at Black Hat.
[38:43.610 --> 38:45.250]  Let me show you our management interface.
[38:45.250 --> 38:47.270]  HTTP colon slash slash.
[38:47.270 --> 38:49.630]  So it's like, uh, that's not secure.
[38:49.650 --> 38:51.710]  You know, building a steel door and a grass hut
[38:51.710 --> 38:53.690]  doesn't actually stop very many people.
[38:53.690 --> 38:55.110]  It only stops the people without the lighters
[38:55.110 --> 38:57.830]  and half the hackers smoke, so like, get over it.
[38:58.650 --> 38:59.330]  Alright.
[38:59.530 --> 39:02.070]  Security products should not make things worse.
[39:02.170 --> 39:03.550]  Uh, they should not increase
[39:03.550 --> 39:05.890]  the attack surface, to use somebody's buzzwords.
[39:06.070 --> 39:07.630]  People keep doing central failure,
[39:07.630 --> 39:09.170]  central server, central failures, yeah.
[39:09.170 --> 39:11.290]  Central servers, which is a nice single point
[39:11.290 --> 39:13.290]  of failure. And then they wonder why we attack
[39:13.290 --> 39:15.330]  the servers, you know. I do these reviews
[39:15.330 --> 39:17.250]  where they go, you know, 10,000 clients or I'll have
[39:17.250 --> 39:19.110]  policy enforcement and we have one box in the middle
[39:19.110 --> 39:21.250]  that we have old copies of SSH on
[39:21.250 --> 39:23.430]  and clear text access to and all these things.
[39:23.430 --> 39:25.810]  Gee, the hackers figure out it's a target.
[39:25.810 --> 39:26.910]  What a surprise.
[39:27.390 --> 39:29.310]  Um, people should communicate securely
[39:29.310 --> 39:31.330]  among the components. Again, you know,
[39:31.330 --> 39:33.410]  do product reviews and people send all sorts
[39:33.410 --> 39:35.030]  of information back and forth in the clear.
[39:35.030 --> 39:37.390]  And that's if you don't fuzz it or replay attack it
[39:37.390 --> 39:39.450]  or things like that. And they run
[39:39.450 --> 39:41.410]  sloppy distros, you know. Download
[39:41.410 --> 39:43.730]  Linux, put it on a box, you know,
[39:43.730 --> 39:45.610]  paint the front of the box some sexy color
[39:45.610 --> 39:47.990]  because you hired the marketing department to make up a logo.
[39:48.050 --> 39:49.490]  You did all this four years ago
[39:49.490 --> 39:51.610]  before you got venture funding. So,
[39:51.610 --> 39:53.190]  you know, this thing gets
[39:53.750 --> 39:55.590]  into the field and
[39:55.590 --> 39:57.610]  suddenly I'm some sort of obnoxious rocket
[39:57.610 --> 39:59.510]  scientist because I noticed they're running Red Hat
[39:59.510 --> 40:01.610]  5.2, you know.
[40:01.610 --> 40:03.530]  And it's like, it's okay because it's a policy enforcement
[40:03.530 --> 40:05.630]  product from a big router vendor or a big, whatever
[40:05.630 --> 40:07.630]  software vendor. So, you know,
[40:07.630 --> 40:09.450]  sloppy distributions. We will notice.
[40:09.450 --> 40:11.430]  People do Telnet to port 22 and read the
[40:11.430 --> 40:13.930]  banners. It's actually not that hard.
[40:13.930 --> 40:15.530]  Apparently the vendors don't think any of us know
[40:15.530 --> 40:17.370]  this. You need to promote this fact.
[40:18.230 --> 40:19.870]  Stupid vendor tricks. Logging,
[40:19.870 --> 40:21.530]  logging when they start up. There's all sorts of
[40:21.530 --> 40:23.750]  log analysis tools out there. That's really nice.
[40:23.750 --> 40:25.750]  Can we now have some logs to analyze, please?
[40:26.150 --> 40:26.950]  You know,
[40:26.950 --> 40:29.530]  do a scan on a box
[40:29.530 --> 40:31.210]  that does some sort of SSL web server
[40:31.210 --> 40:33.210]  balancing, you know, get no logs out.
[40:33.210 --> 40:35.310]  Go to the vendor and say, what's the knob I set
[40:35.310 --> 40:37.390]  to the position so I can see when the attacks happen?
[40:37.390 --> 40:39.550]  They go, oh, there's no logging. That's a feature.
[40:40.090 --> 40:41.370]  You know, and like, how are we
[40:41.370 --> 40:43.190]  supposed to know there's a problem here anymore?
[40:43.490 --> 40:45.470]  People do self-signed certificates. I have a homework
[40:45.470 --> 40:47.390]  assignment for all of you. Somebody please
[40:47.390 --> 40:49.430]  take a copy of Ettercap and when you get
[40:49.430 --> 40:51.390]  when you grab the self-signed certificate out of the
[40:51.390 --> 40:53.590]  Linksys box or one of various other things,
[40:53.590 --> 40:55.430]  please change the text and generate a new certificate
[40:55.430 --> 40:57.410]  so you look exactly like the vendor's
[40:57.410 --> 40:59.370]  cheesy self-signed certificate that they
[40:59.370 --> 41:01.430]  won't replace. And because man-in-the-middle
[41:01.430 --> 41:03.350]  attacks are quite possible, a self-signed
[41:03.350 --> 41:05.490]  certificate is only marginally better than no certificate
[41:05.490 --> 41:07.850]  at all because anybody can make these things up.
[41:08.290 --> 41:09.910]  People don't put change control in.
[41:09.910 --> 41:11.530]  Everybody wants to have a GUI so they can be hot
[41:11.530 --> 41:13.350]  and bothered during the demo to make sure they can click
[41:13.350 --> 41:14.910]  on things and it's all multi-colors and they're
[41:14.910 --> 41:17.110]  teal blue and cute and red and black and blinking
[41:17.110 --> 41:19.470]  and all these things, but you can't do change control.
[41:19.470 --> 41:21.070]  How about a little command prompt once in a while?
[41:21.070 --> 41:23.730]  Something like that? Incoherent documentation.
[41:23.730 --> 41:25.570]  I have a VPN box I have to manage
[41:25.570 --> 41:27.450]  for a very, very large customer with
[41:27.450 --> 41:29.810]  many dozens of class B addresses.
[41:29.890 --> 41:31.310]  I printed out the manual.
[41:31.310 --> 41:34.570]  The manual's 1078 pages long.
[41:34.570 --> 41:37.210]  I'm not sure anybody's ever read the whole manual.
[41:37.650 --> 41:38.910]  And then there's a user interface
[41:38.910 --> 41:40.590]  on top of that. I mean, has anybody actually figured
[41:40.590 --> 41:42.610]  out how juniper zones work? There's a lot
[41:42.610 --> 41:44.530]  of these things that are very strange.
[41:44.750 --> 41:46.690]  It would be nice if the vendors followed the protocol
[41:46.690 --> 41:48.570]  specs once in a while. You know, I do
[41:48.570 --> 41:50.250]  these voice over IP security classes and
[41:50.250 --> 41:52.670]  I have a domain name, tissue samples from the crater wall
[41:52.670 --> 41:54.670]  dot net. That's actually a valid domain
[41:54.670 --> 41:56.630]  name, yes I really own it. That character
[41:56.630 --> 41:58.670]  string is too long for most products because
[41:58.670 --> 42:00.410]  I mean, they didn't read the protocol spec.
[42:00.410 --> 42:03.050]  And DNS has been around since, what, Lincoln was president?
[42:03.050 --> 42:05.170]  Um, you know, could we please follow the protocol
[42:05.170 --> 42:07.110]  specs? At least before you go cook up some
[42:07.110 --> 42:09.010]  your own stupid proprietary protocol that's
[42:09.010 --> 42:10.890]  on top of it that's better because your EAP
[42:10.890 --> 42:12.690]  method's better than the standard EAP methods?
[42:12.690 --> 42:14.450]  Not that the standard ones are that good, but at least
[42:14.450 --> 42:16.430]  could we all use the same ones? We should all at least
[42:16.430 --> 42:17.910]  be in the same leaking rowboat.
[42:19.370 --> 42:20.990]  Alright, things you should try. Now this
[42:20.990 --> 42:22.830]  sounds really cheesy and stupid, but you can make money
[42:22.830 --> 42:25.170]  doing this. It's very odd. Um, run nmap
[42:25.170 --> 42:27.170]  and nnessus. You know, half the time
[42:27.170 --> 42:29.050]  I run nnessus, like, you know, some box in the network
[42:29.050 --> 42:31.710]  will go jump off the corner and reset to factory defaults.
[42:31.710 --> 42:33.570]  Now, since we all know how to download
[42:33.970 --> 42:35.930]  these things and run them, and the bad guys
[42:35.930 --> 42:37.710]  do, and so do the children in high school or
[42:37.710 --> 42:39.510]  elementary school, or they're teaching in kindergarten
[42:39.510 --> 42:41.890]  now, probably. Um, you know,
[42:41.890 --> 42:43.830]  yeah, you're learning kindergarten, I'm sure. So, I mean
[42:43.830 --> 42:45.630]  they should be able to survive little
[42:45.630 --> 42:47.690]  things like this. This apparently is news to a lot of the
[42:47.690 --> 42:49.630]  vendors. Uh, the vendors don't tend to go
[42:49.630 --> 42:51.610]  there are vendors, actually, there are vendors here at Black Hat
[42:51.610 --> 42:53.570]  they tend to be doing things like hiding in very loud
[42:53.570 --> 42:55.670]  Hawaiian shirts, but they do walk around. They're the ones with
[42:55.670 --> 42:57.870]  the good haircuts. Um, anyway,
[42:57.870 --> 42:59.750]  tell net to port 22 and read the banner.
[42:59.750 --> 43:01.790]  That's a really exotic way of doing a security
[43:01.790 --> 43:03.950]  analysis. Unfortunately, that gets me a lot
[43:03.950 --> 43:05.850]  of information. You know, I write these product reviews
[43:05.850 --> 43:08.010]  and I'm the token hacker and it's all very scary.
[43:08.030 --> 43:10.290]  I tell net to port 22 and read the banner.
[43:10.450 --> 43:11.650]  I mean, it's really, really hard.
[43:11.650 --> 43:13.870]  And I do this over and over again, in print.
[43:13.870 --> 43:15.790]  And the vendors who follow them don't actually figure
[43:15.790 --> 43:18.130]  it out still. It's like, you'd think they would notice this stuff.
[43:18.530 --> 43:19.850]  Another one, try to look at
[43:19.850 --> 43:22.210]  doing crypto. Crypto, apparently, is hard.
[43:22.210 --> 43:23.690]  Thank god the hackers think it's hard because
[43:23.690 --> 43:25.890]  they don't steal the private keys as much as they could.
[43:26.290 --> 43:28.530]  Open SSL, turn on SSL 2.
[43:28.530 --> 43:30.550]  Is there any redeeming social value in running
[43:30.550 --> 43:32.610]  SSL 2 in anything on the public internet
[43:32.610 --> 43:34.650]  today? I don't think there is.
[43:34.650 --> 43:36.590]  But there's lots of products still supporting it.
[43:36.930 --> 43:38.530]  Go after the web interface.
[43:38.530 --> 43:40.490]  There's like 5 billion people up and over from the
[43:40.490 --> 43:42.530]  dot-com boom who know how to write broken
[43:42.530 --> 43:44.610]  HTML. And about half of them are working for
[43:44.610 --> 43:46.770]  vendors building sophisticated web-based
[43:46.770 --> 43:48.050]  management interfaces.
[43:48.730 --> 43:50.510]  And they've got cross-site scripting and
[43:50.510 --> 43:52.390]  forms you can blow up and fields you can fill in
[43:52.390 --> 43:54.130]  2,000 A's and they jump into a corner and
[43:54.130 --> 43:56.350]  psych vault and all these kinds of things.
[43:56.350 --> 43:58.950]  Etter tap. Man in the middle of the boxes.
[43:58.950 --> 44:00.430]  I mean, if they don't secure the connections,
[44:00.430 --> 44:01.690]  you can man in the middle of the things.
[44:02.050 --> 44:04.090]  Go look for a random exploit. This is something
[44:04.090 --> 44:05.850]  they don't seem to think anybody would do.
[44:05.910 --> 44:07.890]  I'm testing a product and I'm reading security
[44:07.890 --> 44:09.930]  focus, various random mailing lists, and an
[44:09.930 --> 44:12.170]  exploit will come out. I don't care if it's old
[44:12.170 --> 44:14.230]  or new. Go try it on the thing you're trying
[44:14.230 --> 44:16.270]  to use or trying to evaluate. Apparently,
[44:16.270 --> 44:18.050]  nobody expects you to actually keep up with
[44:18.050 --> 44:19.770]  the current news. You're supposed to buy a product,
[44:19.770 --> 44:21.530]  move into a cave, and run it there for the next
[44:21.530 --> 44:24.230]  20 years. Everybody runs iOS 11.4, right?
[44:24.230 --> 44:26.130]  That's close to the current rev, definitely.
[44:26.390 --> 44:28.310]  So, try the current stuff.
[44:28.310 --> 44:30.170]  You know, the bad guys might try the current stuff.
[44:30.170 --> 44:31.550]  That's sort of why they're called zero days,
[44:31.550 --> 44:32.710]  the ones that are even more current than the
[44:32.710 --> 44:34.570]  current ones that are known. You'd think you'd
[44:34.570 --> 44:37.910]  figure this out. It's really easy to go after
[44:38.090 --> 44:39.610]  a lot of products. It's pretty stupid.
[44:39.610 --> 44:42.830]  It's embarrassingly stupid. And vendors just
[44:42.830 --> 44:44.850]  assume nobody would actually do this.
[44:44.850 --> 44:46.110]  There are no real ha- I mean, there's nobody
[44:46.110 --> 44:48.110]  goes to de- there are not 500 people in a tent
[44:48.110 --> 44:50.550]  in a parking lot in Las Vegas right now
[44:50.550 --> 44:52.270]  talking about hacking. Doesn't happen.
[44:52.270 --> 44:54.230]  You just heard it on the internet, it's a bad rumor.
[44:54.230 --> 44:55.890]  It just really isn't happening.
[44:56.670 --> 44:58.050]  You know, so I mean, everybody's really just
[44:58.050 --> 45:00.170]  sweetness and light and just leaves the networks all alone.
[45:00.170 --> 45:01.910]  And the bad guys, of course, are much more gentle
[45:01.910 --> 45:03.610]  than we are, right? We all know that.
[45:03.610 --> 45:05.190]  You know, they're much more gentle than we are.
[45:05.290 --> 45:08.330]  Anyway. Alright. How can you make things better?
[45:08.410 --> 45:10.610]  So, you know, this is actually the stock slide.
[45:10.610 --> 45:11.730]  I decided to leave this one good.
[45:12.710 --> 45:13.830]  How can you make things better?
[45:13.830 --> 45:15.790]  Well, we're trying to be educated consumers here,
[45:15.790 --> 45:17.770]  so test things, you know, try to actually do something
[45:17.770 --> 45:18.990]  and figure out how to make it better.
[45:18.990 --> 45:21.070]  Try to report bugs. I mean, if the vendor is so much
[45:21.070 --> 45:22.890]  of a bimbo that's going to yell at you for reporting them,
[45:22.890 --> 45:24.950]  that's their problem. You should still try to figure out
[45:24.950 --> 45:26.430]  how to report the bugs reasonably.
[45:26.790 --> 45:28.210]  If you can get one of these things to break,
[45:28.210 --> 45:30.050]  if you can find something breaking, give me a paper.
[45:30.110 --> 45:31.990]  I'm on the program committee for ShmooCon.
[45:32.110 --> 45:34.850]  Give me a paper. All of our papers starts today,
[45:34.850 --> 45:37.030]  as of right now. It's on the website,
[45:37.030 --> 45:39.890]  www.shmoocon.org. We'll have paper copies
[45:39.890 --> 45:41.470]  we'll put out there afterwards.
[45:41.730 --> 45:43.090]  But you find something you can break,
[45:43.090 --> 45:44.310]  we want it to break a track.
[45:44.310 --> 45:45.330]  You're going to give me the book here?
[45:46.690 --> 45:48.230]  He's going to stand up here and harass me.
[45:48.290 --> 45:49.990]  Okay, I just got one more slide. You can take it.
[45:50.430 --> 45:52.370]  Hey, yeah, definitely. Right, I'll get the book later.
[45:52.890 --> 45:54.610]  You just, you know, you just wait.
[45:55.890 --> 45:56.910]  You're the time Nazi.
[45:56.910 --> 45:58.290]  Yeah, well, some of us had to be the time Nazi
[45:58.290 --> 45:59.470]  when you were standing up here, you know,
[45:59.470 --> 46:00.670]  going through, flashing things.
[46:01.670 --> 46:03.770]  Report flaws, document the risks.
[46:04.010 --> 46:05.530]  People say, you know, I say, my God,
[46:05.530 --> 46:07.410]  you run HTTP on the management interface.
[46:07.410 --> 46:09.870]  And the blender goes, nobody's ever said that to me.
[46:09.870 --> 46:12.550]  We think it's just fine. Everybody loves this.
[46:12.550 --> 46:13.370]  It's bullshit.
[46:13.370 --> 46:15.890]  Anyway, disrupt future purchases
[46:15.890 --> 46:17.830]  of insecure equipment.
[46:18.090 --> 46:19.250]  The only way they're going to understand
[46:19.250 --> 46:20.110]  is the money.
[46:20.110 --> 46:22.890]  If they ship lame shit, don't buy it.
[46:22.890 --> 46:24.430]  Make sure they lose sales.
[46:24.430 --> 46:26.790]  If it hits their pocketbook, they'll understand.
[46:27.170 --> 46:28.750]  And the other side of it is encourage
[46:28.750 --> 46:30.990]  future purchases of clueful stuff.
[46:30.990 --> 46:33.050]  If you find gear that's secure and works well,
[46:33.050 --> 46:34.830]  make sure it gets bought again.
[46:34.950 --> 46:37.410]  And make sure you show things are easy to break.
[46:37.410 --> 46:39.190]  People don't believe this stuff can happen.
[46:39.190 --> 46:40.470]  Nobody would crack DES.
[46:40.470 --> 46:42.730]  Nobody would build a rainbow table to crack Landman.
[46:42.790 --> 46:43.890]  Landman's perfect.
[46:44.210 --> 46:46.270]  Nobody would actually do any of these things.
[46:46.270 --> 46:48.630]  Nobody ever actually tries to break SSH1.
[46:48.630 --> 46:50.690]  It's just, there's all this mythology out there
[46:50.690 --> 46:53.070]  that nobody actually tries to go after any of these things.
[46:53.090 --> 46:54.450]  So, there's a lot of things you can do
[46:54.450 --> 46:56.450]  and there's a lot of lame products out there
[46:56.450 --> 46:58.330]  and it's low-hanging fruit, I know,
[46:58.330 --> 47:00.010]  but we should get rid of the low-hanging fruit.
[47:00.010 --> 47:01.810]  You know, we should have to spend more time
[47:01.810 --> 47:03.210]  listening to them doing exotic tables
[47:03.210 --> 47:04.870]  than listening to me be a scary guy
[47:04.870 --> 47:06.810]  because I can skel-telnet to port 22.
[47:06.810 --> 47:08.130]  Here you go.
[47:08.930 --> 47:10.850]  Man, I love listening to him rap.
[47:10.850 --> 47:12.530]  That's ridiculous.
[47:16.020 --> 47:16.700]  Okay.
[47:17.000 --> 47:18.380]  Before we get to
[47:18.980 --> 47:20.460]  kick-ass zero day,
[47:21.800 --> 47:23.940]  we built some gear last year.
[47:23.960 --> 47:24.820]  Actually, the year before that,
[47:24.820 --> 47:26.300]  we built some gear. We had the robot.
[47:26.680 --> 47:29.200]  We had 82.11 bounce.
[47:29.540 --> 47:30.680]  We had the sniper Yagi.
[47:30.680 --> 47:31.460]  Tissue box.
[47:31.880 --> 47:35.240]  Some of us had to move the sniper Yagi
[47:35.240 --> 47:36.820]  across interstate lines
[47:36.820 --> 47:38.760]  in a car and, I mean,
[47:38.760 --> 47:40.740]  I had to drive the speed limit at Defcon, dude.
[47:40.740 --> 47:41.880]  It really sucked.
[47:42.340 --> 47:44.900]  So, I told you we'd bring
[47:44.900 --> 47:47.160]  some gear and we did.
[47:47.840 --> 47:48.840]  Cowboy, show them
[47:48.840 --> 47:49.680]  what you got.
[47:50.480 --> 47:52.000]  This is the 802.11.
[47:54.300 --> 47:56.720]  This is a 9 DBI flat panel
[47:56.720 --> 47:58.520]  antenna back-ended by a 1 watt amp
[47:58.520 --> 48:00.820]  with a 0 to 100 DBI
[48:00.820 --> 48:02.900]  rotary select attenuator that allows you
[48:02.900 --> 48:04.420]  to direction find.
[48:04.420 --> 48:05.160]  You can see her.
[48:07.980 --> 48:09.960]  You mean it doesn't go to 11?
[48:10.420 --> 48:11.960]  That's messed up, man.
[48:14.020 --> 48:16.040]  For those of you that can't see it real close,
[48:16.040 --> 48:17.580]  we've got some actual close-up pictures.
[48:17.580 --> 48:18.960]  We made sure that we got these done
[48:18.960 --> 48:21.120]  once we got on site, so there's some of that
[48:21.120 --> 48:22.700]  doodoo brow background.
[48:25.820 --> 48:28.160]  We've got a few things that are a little bit better than that.
[48:28.680 --> 48:30.320]  Yeah, it's battery powered.
[48:31.500 --> 48:32.820]  She likes that.
[48:34.520 --> 48:36.640]  Is the tattoo battery powered?
[48:37.580 --> 48:38.580]  Thank you to all our models.
[48:38.580 --> 48:40.460]  Mike will tell you, don't touch the heat sink.
[48:40.460 --> 48:42.480]  We don't pay any of our models like those
[48:42.480 --> 48:43.960]  NMRC guys.
[48:44.960 --> 48:46.420]  Here she is. She's wearing one of the
[48:46.420 --> 48:48.600]  new ShmooCon 2006 shirts. Right on, baby.
[48:48.600 --> 48:50.820]  And you can dunk her for the FF too.
[48:51.500 --> 48:52.600]  Great stuff.
[48:53.020 --> 48:53.940]  Yeah, the 802.11
[48:53.940 --> 48:56.420]  bloodhound for direction finding.
[48:56.480 --> 48:58.360]  Like I said, all of it back-ends into
[48:58.360 --> 49:00.260]  an iPAQ, which you're running either familiar
[49:00.260 --> 49:02.260]  or Pocket PC on. Run your basic
[49:02.260 --> 49:04.080]  wireless discovery utility.
[49:04.380 --> 49:06.560]  But, what you can do is long-range shots
[49:06.560 --> 49:07.960]  and it's hand-held.
[49:07.980 --> 49:10.160]  You can go dual-handed. That's pretty cool too.
[49:10.160 --> 49:11.220]  If you really want to just be
[49:12.120 --> 49:14.260]  Steven Seagal or some other...
[49:16.800 --> 49:18.160]  It's balanced.
[49:18.240 --> 49:19.500]  Check it out, baby.
[49:19.940 --> 49:21.460]  It sticks right there.
[49:25.760 --> 49:28.420]  So, apparently, Mike was
[49:28.420 --> 49:30.280]  hanging out with one of these
[49:30.280 --> 49:32.300]  in the car, turned on, and
[49:32.300 --> 49:33.840]  drove by a cop.
[49:38.970 --> 49:40.210]  So, he got
[49:40.210 --> 49:41.330]  pulled over, right?
[49:41.850 --> 49:44.430]  No, we didn't get pulled over. Actually, I was in the car with the cop.
[49:44.450 --> 49:45.370]  Oh, really?
[49:46.250 --> 49:47.670]  And the guy next to us...
[49:48.690 --> 49:50.230]  And we rolled down our window
[49:50.230 --> 49:52.170]  and he says, yeah, man, that thing's
[49:52.170 --> 49:54.930]  been sitting off my radar detector for two miles.
[49:56.690 --> 49:58.410]  Apparently, he thought we were test-driving
[49:58.410 --> 49:59.830]  the new radar gun.
[50:02.550 --> 50:03.570]  That's hot.
[50:03.570 --> 50:04.650]  And I really mean literally.
[50:04.650 --> 50:05.230]  It's hot.
[50:05.230 --> 50:07.530]  You don't want to touch certain parts of it.
[50:08.870 --> 50:09.850]  And when you aim it
[50:09.850 --> 50:11.310]  at people, I guess they get hot too.
[50:11.310 --> 50:12.170]  She's hot.
[50:15.290 --> 50:16.090]  Alright.
[50:16.550 --> 50:17.910]  So, if you want to check out
[50:17.910 --> 50:19.570]  some of the 802.11 Bloodhound
[50:19.570 --> 50:21.510]  later on, just meet up with Mike.
[50:21.510 --> 50:23.050]  He'll describe it in more detail.
[50:23.050 --> 50:24.350]  It's sexy stuff.
[50:25.170 --> 50:27.150]  I'm supposed to be participating in one of the
[50:27.150 --> 50:28.610]  award-driving teams, and
[50:29.090 --> 50:31.610]  we were a little short on gear, so I decided to bring some.
[50:31.610 --> 50:32.630]  And there you go.
[50:32.630 --> 50:34.810]  Thanks a lot, Mike, for building that. Thank you.
[50:40.930 --> 50:41.510]  So,
[50:42.650 --> 50:44.130]  I'm just going to introduce
[50:44.130 --> 50:44.750]  Kaz.
[50:44.750 --> 50:48.050]  Kaz has a zero-day for Metasploit,
[50:48.050 --> 50:49.550]  Canvas, and Kismet.
[50:52.710 --> 50:53.410]  Well,
[50:53.910 --> 50:56.110]  last year I came and wasn't really supposed to talk,
[50:56.110 --> 50:57.630]  and they convinced me to talk
[50:58.050 --> 51:00.110]  five minutes before we gave a presentation.
[51:00.110 --> 51:02.090]  The only person to release a zero-day last year
[51:02.090 --> 51:03.670]  in WPA. So, I released a zero-day
[51:03.670 --> 51:05.510]  in WPA last year.
[51:05.910 --> 51:08.190]  So, I decided to go ahead and release another
[51:08.190 --> 51:09.170]  zero-day.
[51:10.390 --> 51:11.510]  I recently started
[51:12.770 --> 51:14.050]  a new industry.
[51:14.050 --> 51:16.370]  This is Pot Kettle Industries.
[51:17.010 --> 51:18.070]  We're looking for the Gartner
[51:18.070 --> 51:18.890]  report.
[51:20.170 --> 51:21.870]  I'm still looking for VC.
[51:21.870 --> 51:24.270]  If you're a VC, come talk to me afterwards.
[51:24.290 --> 51:26.090]  So, what does Pot Kettle Industries do?
[51:26.090 --> 51:27.950]  We exploit the exploiters.
[51:27.950 --> 51:29.830]  One of the things that I'm really tired of doing
[51:29.830 --> 51:31.750]  is finding all these exploits that are published
[51:31.750 --> 51:33.950]  on full disclosure and full nav
[51:33.950 --> 51:35.870]  that are full of holes.
[51:35.910 --> 51:37.950]  Y'all talk about how everybody else's shit
[51:37.950 --> 51:40.370]  sucks, but your shit's worse.
[51:41.550 --> 51:41.950]  I don't know
[51:41.950 --> 51:43.970]  how many of you read
[51:43.970 --> 51:46.590]  the source code of shit that hits full disclosure.
[51:46.790 --> 51:47.930]  Almost all of it
[51:47.930 --> 51:50.170]  is vulnerable at some point in time.
[51:50.290 --> 51:52.010]  So, I decided to start
[51:52.010 --> 51:53.770]  writing exploits for the exploits.
[51:53.770 --> 51:55.830]  I haven't quite figured out how I'm going to profit,
[51:55.830 --> 51:57.470]  but it's in the business plan.
[51:57.810 --> 51:59.850]  Peel all the underpants.
[52:02.670 --> 52:03.370]  I'll let you
[52:03.370 --> 52:05.190]  go ahead and do that for me, Paulos.
[52:06.770 --> 52:07.390]  Alright, so
[52:07.390 --> 52:09.550]  the first exploit that we released is in a
[52:09.550 --> 52:11.170]  multi-HTML.
[52:11.430 --> 52:13.890]  It's a remote exploit released by Banshee.
[52:13.890 --> 52:15.390]  Supposedly, Banshee is supposed to be here today.
[52:15.390 --> 52:17.950]  Are you here today?
[52:17.950 --> 52:21.150]  I have a sticker for you.
[52:21.150 --> 52:22.390]  I released an exploit
[52:22.390 --> 52:22.830]  and it got owned.
[52:23.570 --> 52:24.890]  Got owned.
[52:26.110 --> 52:28.510]  I have asked for a CVE
[52:28.510 --> 52:30.430]  and it has been granted. I have the first CVE
[52:30.430 --> 52:32.810]  for vulnerability in an exploit.
[52:35.350 --> 52:36.490]  And I have an exploit
[52:36.490 --> 52:38.770]  available for that right here.
[52:40.770 --> 52:42.930]  So today, or for the last couple
[52:42.930 --> 52:44.530]  of weeks, they've been asking me to look at Kismet
[52:44.530 --> 52:46.470]  to try and find some vulnerabilities so
[52:46.470 --> 52:48.250]  we can exploit other people
[52:48.710 --> 52:50.650]  during the DEF CON war driving contest
[52:50.650 --> 52:51.710]  this week.
[52:54.050 --> 52:55.690]  That's top secret.
[52:55.690 --> 52:57.630]  Those people are listening.
[52:57.990 --> 53:01.010]  Okay, we ought to return all the CDs.
[53:01.010 --> 53:02.470]  We're going to burn them and make new CDs.
[53:02.470 --> 53:04.590]  Please go to the Shmoo page
[53:04.590 --> 53:06.510]  in your conference program
[53:06.510 --> 53:08.390]  and tear it out with a razor blade
[53:08.390 --> 53:10.690]  right now. Throw it away.
[53:10.690 --> 53:11.730]  Do us a favor.
[53:13.270 --> 53:14.630]  Among many of the other
[53:14.630 --> 53:16.830]  vulnerabilities that I found in Kismet,
[53:16.830 --> 53:18.710]  some of them, Beatle's team
[53:18.710 --> 53:20.950]  is keeping private, and if you're running Kismet
[53:20.950 --> 53:22.050]  for this
[53:22.770 --> 53:24.510]  DEF CON war drive contest,
[53:25.150 --> 53:26.630]  you'll be owned.
[53:26.730 --> 53:27.770]  So don't.
[53:30.850 --> 53:34.110]  The easiest way to evade Kismet,
[53:34.110 --> 53:34.710]  like I said,
[53:34.710 --> 53:36.770]  I really believe in full disclosure and all that wonderful
[53:36.770 --> 53:38.550]  stuff and responsible disclosure.
[53:38.950 --> 53:41.450]  Sorry, I've been told I'm supposed to hold still.
[53:43.150 --> 53:44.990]  I believe in responsible disclosure
[53:44.990 --> 53:47.310]  except for people that are trying to own other people.
[53:47.310 --> 53:49.050]  Well, if you want to protect your network
[53:49.050 --> 53:51.110]  and somebody's attacking you and trying to find your network
[53:51.110 --> 53:53.210]  with Kismet, the easiest thing for you to do
[53:53.210 --> 53:55.650]  is to evade Kismet detection.
[53:56.090 --> 53:57.350]  What you're seeing on the screen
[53:57.350 --> 53:59.190]  right now is an fscanf from
[53:59.190 --> 54:01.170]  the Kismet client.
[54:01.210 --> 54:03.150]  This is what it does to read the packets that are coming
[54:03.150 --> 54:05.050]  from the Kismet server. I don't know
[54:05.050 --> 54:07.470]  how many of you can read C,
[54:08.670 --> 54:09.790]  but if you note in there,
[54:09.790 --> 54:11.090]  the first thing it's scanning
[54:11.930 --> 54:12.910]  is an integer
[54:13.350 --> 54:15.270]  and then it looks for a string
[54:16.430 --> 54:17.430]  that's enumerated
[54:17.430 --> 54:19.430]  it has the hex of 0-1
[54:19.430 --> 54:20.950]  then the SSID
[54:20.950 --> 54:22.410]  and then the hex of 0-1
[54:22.410 --> 54:24.990]  and then continues on as the scanf string.
[54:25.250 --> 54:27.190]  If you add hex
[54:27.190 --> 54:29.370]  of 0-1 to your SSID,
[54:29.370 --> 54:31.090]  guess what? Anytime Kismet
[54:31.090 --> 54:33.110]  sends your SSID across
[54:33.110 --> 54:35.190]  the network, it's not going to be seen.
[54:35.350 --> 54:36.930]  So if you want to keep your network
[54:36.930 --> 54:39.190]  protected from anybody using Kismet,
[54:39.190 --> 54:41.350]  make your SSID shmoo with a hex
[54:41.350 --> 54:43.130]  of 0-1 at the end of it,
[54:43.130 --> 54:44.870]  anybody using Kismet is not going to be able to see
[54:44.870 --> 54:46.850]  your access points now.
[54:47.710 --> 54:48.150]  Awesome.
[54:54.880 --> 54:55.320]  That's
[54:55.320 --> 54:57.080]  zero day number one.
[54:57.940 --> 54:59.320]  There are some buffer overflows
[54:59.320 --> 55:01.160]  in Kismet. The guy who wrote it
[55:01.160 --> 55:03.200]  was supposed to come to Defcon. He announced
[55:03.200 --> 55:05.760]  about two weeks ago that he's not coming.
[55:05.760 --> 55:07.240]  He's fixed two of the vulnerabilities
[55:07.240 --> 55:09.680]  that are in Kismet in the last two weeks.
[55:09.700 --> 55:11.300]  There's three more that are remotely
[55:11.300 --> 55:13.400]  exploitable. Don't be using Kismet
[55:13.400 --> 55:15.280]  over the next week. You will be
[55:15.280 --> 55:17.120]  owned. When was the last time you heard
[55:17.120 --> 55:19.440]  you should download the latest rev of the software?
[55:20.660 --> 55:21.120]  Download
[55:21.120 --> 55:23.580]  the latest patches for your exploits, kids.
[55:27.460 --> 55:29.380]  Patch management is not just for users
[55:29.380 --> 55:30.420]  anymore.
[55:31.320 --> 55:33.680]  How do I go back?
[55:33.740 --> 55:35.080]  Arrow keys?
[55:35.500 --> 55:37.140]  Shift, tab, control,
[55:37.140 --> 55:38.200]  delete.
[55:38.880 --> 55:41.300]  Have you used a computer?
[55:41.300 --> 55:42.240]  Whatever.
[55:42.440 --> 55:44.800]  We don't need no stinking slides.
[55:44.800 --> 55:46.760]  If it's not written in Perl, I don't know how to use it.
[55:46.760 --> 55:48.180]  Put the girls back on.
[55:50.900 --> 55:52.560]  There's the Kismet evasion.
[55:52.660 --> 55:54.720]  I have a really simple exploit
[55:54.720 --> 55:56.740]  for Metasploit in Canvas using
[55:56.740 --> 55:59.340]  H.G. Moore's exploitation technique.
[56:00.100 --> 56:00.900]  About two
[56:00.900 --> 56:01.660]  and a half years ago,
[56:02.720 --> 56:04.760]  he announced in an advisory that he
[56:04.760 --> 56:05.620]  was able to exploit
[56:06.620 --> 56:08.900]  various different companies by sending
[56:08.900 --> 56:10.740]  stuff into their Apache web server log.
[56:10.760 --> 56:11.620]  The Apache
[56:12.700 --> 56:14.020]  admins of those web servers
[56:14.020 --> 56:15.880]  were using things like tail-f
[56:15.880 --> 56:17.240]  and a vulnerable Xterm
[56:17.240 --> 56:19.380]  to launch commands using
[56:20.700 --> 56:21.820]  Xterm control
[56:21.820 --> 56:22.740]  characters.
[56:22.740 --> 56:25.620]  What his advisory said about two years ago
[56:25.620 --> 56:27.840]  was anybody writing any applications
[56:27.840 --> 56:28.220]  that take
[56:29.680 --> 56:31.680]  user input needs to filter out
[56:31.680 --> 56:33.040]  the user input. Well, guess what?
[56:33.040 --> 56:35.760]  Canvas and Metasploit take input.
[56:35.840 --> 56:37.600]  The way Metasploit works is all of their
[56:37.600 --> 56:40.080]  exploits do...
[56:40.680 --> 56:41.980]  If you do a check
[56:41.980 --> 56:44.000]  instead of an exploit, they will do a banner
[56:44.000 --> 56:46.120]  grab and then do a
[56:46.120 --> 56:48.180]  lame regular expression on the banner and then print
[56:48.180 --> 56:50.980]  what the banner was so you can validate it yourself.
[56:50.980 --> 56:52.200]  So all you have to do is
[56:52.200 --> 56:54.160]  match their lame regular expression
[56:54.160 --> 56:56.360]  and then print some
[56:56.360 --> 56:58.200]  control characters like H.G. Moore
[56:58.200 --> 56:59.920]  provided in his vulnerability.
[56:59.920 --> 57:02.080]  So what I'm going to do is I'm going to wget a
[57:02.740 --> 57:04.760]  shell script and then I'm going to run it.
[57:04.760 --> 57:06.060]  And now I've owned anybody
[57:06.060 --> 57:07.220]  that uses Metasploit.
[57:07.940 --> 57:09.340]  Every single exploit
[57:09.340 --> 57:11.320]  that Canvas ships with does
[57:11.320 --> 57:13.280]  print if you run it in the command line mode.
[57:13.280 --> 57:15.280]  Every single exploit that comes with Metasploit
[57:15.280 --> 57:17.200]  prints some piece of data from
[57:17.200 --> 57:19.480]  the user or from
[57:19.480 --> 57:21.200]  the server that you're trying to exploit
[57:21.200 --> 57:23.240]  without filtering it. If you're running Xterm that
[57:23.240 --> 57:25.320]  comes with Debian and you're running Metasploit
[57:25.320 --> 57:27.440]  or Canvas from it in the command line mode,
[57:27.440 --> 57:28.860]  guess what? You're ownerable.
[57:31.380 --> 57:32.820]  Owner awesome.
[57:35.480 --> 57:35.960]  So
[57:35.960 --> 57:37.180]  using H.G. Moore's
[57:37.180 --> 57:38.880]  exploits against himself. So there's
[57:38.880 --> 57:40.380]  two more zero day.
[57:42.940 --> 57:45.100]  I think you might be at your limit.
[57:47.920 --> 57:48.740]  Hey, we're
[57:48.740 --> 57:51.000]  not starting anything,
[57:51.000 --> 57:52.880]  okay? I mean, we're just making a point.
[57:52.880 --> 57:55.100]  And the general point is, look...
[57:55.100 --> 57:56.140]  Set an example.
[57:57.200 --> 57:58.160]  Seriously.
[57:58.440 --> 58:00.800]  The stuff that you're throwing out there,
[58:00.800 --> 58:02.820]  it's great if it busts
[58:02.820 --> 58:05.300]  stuff open, right? But at the same time,
[58:05.300 --> 58:06.360]  watch your back.
[58:06.480 --> 58:08.720]  Because other people are going to be looking
[58:08.720 --> 58:10.740]  at your code as you throw it out there for other people
[58:10.740 --> 58:11.580]  to use.
[58:13.000 --> 58:14.540]  Speaking of code
[58:14.540 --> 58:16.060]  and application security
[58:16.060 --> 58:18.800]  and that sort of thing...
[58:19.480 --> 58:21.080]  and ranting...
[58:21.080 --> 58:23.100]  I'd like to introduce Bruce Potter,
[58:23.100 --> 58:24.540]  founder of the Shmoo Group.
[58:29.060 --> 58:29.700]  Hello.
[58:31.180 --> 58:32.620]  I'm a little nervous to hit the next
[58:32.620 --> 58:34.340]  button because they've been slinging slides all day
[58:34.340 --> 58:35.460]  and I haven't been around.
[58:36.500 --> 58:38.600]  And I'm not sure if they've been screwing with me yet or not,
[58:38.600 --> 58:40.060]  so I guess I'm about to figure out.
[58:42.700 --> 58:43.600]  Okay, good.
[58:48.080 --> 58:50.640]  Are there pictures of me on there? That's all I want to know.
[58:51.300 --> 58:52.800]  Did we upload those yet?
[58:53.900 --> 58:55.580]  Yeah, so for the record,
[58:55.580 --> 58:57.520]  Nomad's got the most powerful lens
[58:57.520 --> 58:58.940]  on a camera known to mankind.
[58:58.940 --> 59:00.920]  I'm sitting up there on stage and he comes up and shows me
[59:01.040 --> 59:02.740]  a picture of my shorts that he took from
[59:02.740 --> 59:04.500]  sitting out there in the audience.
[59:05.460 --> 59:05.860]  So...
[59:06.700 --> 59:07.560]  Pwned.
[59:07.920 --> 59:09.980]  My crotch was owned, okay?
[59:11.160 --> 59:12.700]  Only in Vegas.
[59:13.080 --> 59:14.980]  You might want to see someone about that.
[59:14.980 --> 59:15.580]  Yeah.
[59:16.340 --> 59:17.900]  Nomad was up my pants.
[59:19.540 --> 59:20.420]  Bluetooth security...
[59:20.420 --> 59:21.160]  Look,
[59:22.020 --> 59:24.960]  we talked about a lot of stuff today. We've been all over the damn road.
[59:25.620 --> 59:26.480]  And what we're trying to do
[59:26.480 --> 59:27.500]  is raise awareness.
[59:27.780 --> 59:29.440]  There's no threat here, right?
[59:29.440 --> 59:32.220]  The press is sitting up here
[59:32.220 --> 59:34.700]  visibly scribbling away, and they're trying to figure out
[59:34.700 --> 59:36.240]  is there anything in common with all these talks
[59:36.240 --> 59:37.740]  or are they just all a bunch of crazies?
[59:38.060 --> 59:40.200]  All we're really trying to do is raise awareness.
[59:40.220 --> 59:42.540]  One thing we really don't have anything new on this year
[59:42.540 --> 59:44.620]  but I want to talk about is Bluetooth security.
[59:44.700 --> 59:46.320]  Shit's gotten worse, guys.
[59:47.080 --> 59:48.480]  It hasn't gotten better.
[59:48.480 --> 59:49.780]  There's more Bluetooth radios out
[59:49.780 --> 59:52.980]  than there ever have been. It's not dying.
[59:53.440 --> 59:54.400]  Regardless of whatever the hell
[59:54.400 --> 59:56.200]  the press and Gartner and people think.
[59:56.220 --> 59:58.300]  Two million radios every week are integrated
[59:58.300 --> 59:59.420]  into devices.
[59:59.980 --> 01:00:02.420]  And I tell you, people are doing nasty shit
[01:00:02.420 --> 01:00:03.680]  with Bluetooth right now.
[01:00:03.680 --> 01:00:06.480]  Last year, we tracked people for fun at Black Hat.
[01:00:06.480 --> 01:00:07.800]  That was just kind of the thing.
[01:00:07.800 --> 01:00:10.280]  And then tryfinet.org. Bloover? Man,
[01:00:10.280 --> 01:00:12.540]  that's an awesome tool. What's the phone it runs on?
[01:00:14.260 --> 01:00:15.500]  6260 or something?
[01:00:15.580 --> 01:00:16.800]  Buy some of those, man.
[01:00:16.800 --> 01:00:18.060]  Buy them in bulk.
[01:00:19.580 --> 01:00:21.240]  You can run Bloover on.
[01:00:21.240 --> 01:00:22.580]  You can make the phones
[01:00:22.580 --> 01:00:24.460]  vulnerable phones. You can make them dial.
[01:00:24.460 --> 01:00:26.380]  You can grab down address books.
[01:00:26.380 --> 01:00:27.540]  Things of that nature.
[01:00:28.240 --> 01:00:30.260]  A lot of the new phones are patched.
[01:00:30.260 --> 01:00:32.020]  But this is just an example, guys.
[01:00:32.020 --> 01:00:34.100]  My car has Bluetooth in it.
[01:00:34.360 --> 01:00:35.760]  One day, I'll be driving down the road
[01:00:35.760 --> 01:00:37.640]  and some hacker will shut my car off.
[01:00:37.640 --> 01:00:39.680]  Or he'll sequentially deploy all my airbags
[01:00:39.680 --> 01:00:41.140]  and do some kind of techno thing.
[01:00:45.020 --> 01:00:47.200]  And that day can't be far off.
[01:00:47.200 --> 01:00:49.080]  And once they put the Bluetooth dart
[01:00:49.080 --> 01:00:51.180]  in my butt, I think my life will be over.
[01:00:51.200 --> 01:00:53.220]  Oh, I never should have touched that microphone.
[01:00:54.440 --> 01:00:55.060]  Alright, so anyway.
[01:00:55.060 --> 01:00:55.860]  That's that.
[01:00:57.380 --> 01:00:58.900]  Pairing attacks. There's a paper that came out
[01:00:58.900 --> 01:00:59.860]  on pairing attacks.
[01:00:59.860 --> 01:01:02.580]  We have nothing to do with tryfinet.org.
[01:01:02.580 --> 01:01:04.620]  I'm just pimping these guys because they have a great tool.
[01:01:05.260 --> 01:01:07.040]  But there's a paper on some pairing attacks
[01:01:07.040 --> 01:01:08.220]  that came out recently.
[01:01:09.060 --> 01:01:10.440]  Basically discussing how to
[01:01:12.100 --> 01:01:13.240]  force phones to forget
[01:01:13.240 --> 01:01:15.080]  their pairing and then repair with them
[01:01:15.080 --> 01:01:17.140]  and intercept the pairing process
[01:01:17.140 --> 01:01:19.200]  and then basically
[01:01:19.940 --> 01:01:21.540]  brute force guess the key.
[01:01:21.880 --> 01:01:22.980]  Everyone's always been able to
[01:01:22.980 --> 01:01:25.380]  brute force guess the key in the pairing process.
[01:01:25.440 --> 01:01:26.980]  The standards bodies admitted this
[01:01:26.980 --> 01:01:28.900]  when the protocol was developed.
[01:01:29.060 --> 01:01:31.320]  This is not new. When you pair a Bluetooth phone,
[01:01:31.320 --> 01:01:32.880]  go lock yourself in a Faraday cage
[01:01:32.880 --> 01:01:35.860]  if you're really paranoid, and pair.
[01:01:35.880 --> 01:01:37.480]  And that way, no one can intercept it.
[01:01:37.540 --> 01:01:39.520]  But the neat new trick
[01:01:39.520 --> 01:01:41.040]  is that you can trick a phone
[01:01:41.040 --> 01:01:43.120]  into thinking, oh, I've lost my pairing with my earbud
[01:01:43.120 --> 01:01:44.620]  or whatever, I should repair.
[01:01:45.240 --> 01:01:47.120]  So, I like to liken this
[01:01:47.120 --> 01:01:48.840]  to a rogue access point attack
[01:01:48.840 --> 01:01:50.740]  where you've got a rogue device pretending to be another one
[01:01:50.740 --> 01:01:53.460]  in your network, it just happens to be your little Bluetooth PicoNet.
[01:01:53.640 --> 01:01:54.880]  If you're at DEF CON
[01:01:54.880 --> 01:01:56.940]  and you're talking on your Bluetooth earbud
[01:01:56.940 --> 01:01:58.800]  and your phone suddenly says,
[01:01:58.800 --> 01:01:59.460]  what I really want to do...
[01:02:01.000 --> 01:02:03.180]  If it says, what I really want to do right now
[01:02:03.180 --> 01:02:04.720]  is repair the earbud
[01:02:04.720 --> 01:02:06.940]  because I've forgotten the pairing, no.
[01:02:06.940 --> 01:02:08.820]  Put the phone away, stop talking
[01:02:08.820 --> 01:02:10.520]  to your girlfriend or your
[01:02:10.520 --> 01:02:12.800]  Vegas hookup and just go drink
[01:02:12.800 --> 01:02:14.220]  because someone's screwing with you
[01:02:14.220 --> 01:02:15.920]  and they're going to try to break into your phone.
[01:02:18.600 --> 01:02:19.620]  Wow, I'm not even sure
[01:02:19.620 --> 01:02:21.260]  where the 802.11 seems to...
[01:02:21.260 --> 01:02:23.220]  That happens on your wired earbud.
[01:02:23.220 --> 01:02:24.220]  Just go home.
[01:02:25.260 --> 01:02:27.140]  Yeah, that's the voices in your head at that point.
[01:02:29.600 --> 01:02:30.300]  So,
[01:02:30.300 --> 01:02:31.700]  defending wireless networks,
[01:02:31.700 --> 01:02:33.380]  this should say defending 802.11 networks
[01:02:33.380 --> 01:02:35.020]  because, you know, 802.11
[01:02:35.020 --> 01:02:36.980]  does not equal wireless and vice versa.
[01:02:37.180 --> 01:02:38.780]  We talked a lot about the offense.
[01:02:38.780 --> 01:02:40.900]  This slide is actually taken directly from our Black Hat talk
[01:02:41.340 --> 01:02:43.000]  that Beatle and I gave, so it doesn't make any sense
[01:02:43.000 --> 01:02:44.260]  in its current context.
[01:02:45.980 --> 01:02:47.080]  We had done something
[01:02:47.700 --> 01:02:48.860]  a few years ago called Hotspot
[01:02:48.860 --> 01:02:50.440]  DK. It was a hotspot defense kit
[01:02:50.440 --> 01:02:52.600]  in a response to a problem where
[01:02:52.600 --> 01:02:54.920]  there's a lot of money being spent to protect enterprise
[01:02:54.920 --> 01:02:57.160]  wireless networks in the enterprise.
[01:02:57.360 --> 01:02:58.780]  You know, like, hey, let's buy
[01:02:58.780 --> 01:03:00.780]  wireless intrusion detection systems. We'll put sensors up
[01:03:00.780 --> 01:03:03.360]  everywhere and we'll put things in a nock and we'll be secure.
[01:03:03.740 --> 01:03:05.000]  Well, hallelujah, brother.
[01:03:05.160 --> 01:03:06.600]  Your infrastructure will be secure.
[01:03:06.600 --> 01:03:08.600]  Your clients are still out there in the window.
[01:03:09.020 --> 01:03:09.480]  You know?
[01:03:09.680 --> 01:03:12.460]  Your EVP or your nock guy or whoever
[01:03:12.460 --> 01:03:14.480]  that's got a laptop leaves your enterprise
[01:03:14.480 --> 01:03:15.860]  and goes to Starbucks.
[01:03:15.880 --> 01:03:17.980]  Your wireless IDS is not at Starbucks
[01:03:17.980 --> 01:03:20.820]  when AirSnarf is beating the shit out of it.
[01:03:20.840 --> 01:03:22.700]  Alright? We need to pay more attention
[01:03:22.700 --> 01:03:23.960]  to wireless client security.
[01:03:23.960 --> 01:03:26.380]  So, a year and a half ago, literally,
[01:03:26.380 --> 01:03:28.420]  the day that DEF CON Federal
[01:03:28.420 --> 01:03:30.840]  started, we were scheduled to speak on day two,
[01:03:30.840 --> 01:03:32.260]  we sat... what?
[01:03:32.740 --> 01:03:34.460]  Black Hat, what the hell did I say?
[01:03:34.460 --> 01:03:37.060]  DEF CON Federal 2006.
[01:03:37.060 --> 01:03:38.080]  Be there.
[01:03:39.320 --> 01:03:41.900]  It'll be in the Las Vegas County Jail.
[01:03:42.400 --> 01:03:43.580]  Or Guantanamo.
[01:03:43.580 --> 01:03:45.600]  Or Guantanamo, if we're lucky.
[01:03:46.100 --> 01:03:46.800]  Jeez.
[01:03:46.800 --> 01:03:47.680]  Go Gitmo.
[01:03:48.940 --> 01:03:50.940]  What the hell was my train of thought?
[01:03:50.940 --> 01:03:52.020]  Oh, we wrote this tool.
[01:03:52.240 --> 01:03:54.480]  We wrote this tool literally
[01:03:54.480 --> 01:03:56.700]  in the day before our talk
[01:03:56.700 --> 01:03:59.160]  at Black Hat when we were drinking and talking to friends.
[01:03:59.300 --> 01:04:00.660]  It wasn't rocket science
[01:04:00.660 --> 01:04:02.160]  to write a little tool that
[01:04:02.160 --> 01:04:03.980]  protected wireless clients.
[01:04:03.980 --> 01:04:05.960]  Nothing out there at the time existed like it.
[01:04:05.960 --> 01:04:08.120]  We released it under BSD license and said,
[01:04:08.120 --> 01:04:10.100]  take it, integrate it into your own products,
[01:04:10.100 --> 01:04:12.040]  we don't give a shit, just fix the problem,
[01:04:12.040 --> 01:04:12.880]  secure the clients.
[01:04:12.880 --> 01:04:15.400]  Now you can buy it from other people.
[01:04:15.400 --> 01:04:16.900]  And it's taken a year and a half to get there.
[01:04:16.900 --> 01:04:18.860]  There's really still no huge amounts of support
[01:04:18.860 --> 01:04:20.840]  in the operating systems and the drivers and whatever
[01:04:20.840 --> 01:04:23.880]  to try to protect the clients while they're on the road.
[01:04:23.880 --> 01:04:25.580]  And really, that's a massive problem.
[01:04:26.380 --> 01:04:27.400]  So things are not much better.
[01:04:27.400 --> 01:04:28.820]  I'm skipping ahead in my slides.
[01:04:29.600 --> 01:04:30.780]  We're working on Hotspot
[01:04:31.600 --> 01:04:32.560]  DKV2.
[01:04:33.300 --> 01:04:34.740]  It turns out that my third major
[01:04:34.740 --> 01:04:36.820]  was computer science.
[01:04:37.700 --> 01:04:38.760]  The first two were
[01:04:38.760 --> 01:04:40.180]  biology and physics.
[01:04:40.500 --> 01:04:42.860]  Marketing, economics...
[01:04:42.860 --> 01:04:44.280]  I went through a lot of majors.
[01:04:46.300 --> 01:04:48.740]  I almost got into a fist fight
[01:04:48.740 --> 01:04:50.380]  with one of my professors and then I watched him
[01:04:50.380 --> 01:04:52.360]  dent my car on purpose.
[01:04:52.360 --> 01:04:54.800]  And I realized at that point that computer science is probably not the way
[01:04:54.800 --> 01:04:56.400]  I was going to graduate college.
[01:04:57.240 --> 01:04:59.200]  And I can't code for shit.
[01:04:59.340 --> 01:05:00.680]  So I've been trying to write Hotspot
[01:05:01.380 --> 01:05:02.820]  DKV2 for the last couple weeks
[01:05:02.820 --> 01:05:04.240]  and it's been a qualified disaster.
[01:05:04.240 --> 01:05:06.580]  And the guy who I normally rely on is actually moving to
[01:05:06.580 --> 01:05:08.720]  Alaska right now. This is not like a line.
[01:05:08.720 --> 01:05:10.320]  So I don't have code to release.
[01:05:10.320 --> 01:05:12.180]  But ultimately, what we're trying to do
[01:05:12.180 --> 01:05:14.740]  is build an environmental monitor.
[01:05:14.920 --> 01:05:16.520]  I like to liken this to going to
[01:05:16.520 --> 01:05:18.320]  downtown Baltimore. How many people, first of all,
[01:05:18.320 --> 01:05:19.500]  live near Baltimore?
[01:05:20.260 --> 01:05:21.860]  Okay, we all work for the government.
[01:05:21.860 --> 01:05:23.760]  How many people have been to Baltimore?
[01:05:23.760 --> 01:05:25.700]  Alright, when you go about
[01:05:25.820 --> 01:05:27.680]  a block or two outside of downtown,
[01:05:27.680 --> 01:05:29.440]  it gets really scary really quick.
[01:05:29.440 --> 01:05:32.340]  That town is... it's not so pretty.
[01:05:32.340 --> 01:05:33.620]  If I'm in downtown Baltimore
[01:05:33.620 --> 01:05:35.980]  and I hear gunshots and then I check my body
[01:05:35.980 --> 01:05:37.900]  and I'm not hit, it doesn't make
[01:05:37.900 --> 01:05:39.280]  me any less nervous.
[01:05:40.120 --> 01:05:41.780]  I don't think to myself, oh, thank god,
[01:05:41.780 --> 01:05:42.340]  they missed me.
[01:05:43.440 --> 01:05:44.920]  Let's go get a coffee, dear.
[01:05:46.440 --> 01:05:47.780]  So, this is the same
[01:05:47.780 --> 01:05:49.420]  kind of thing. We're trying to build an environmental monitor
[01:05:49.420 --> 01:05:51.580]  that looks for nasty things happening in the air
[01:05:51.580 --> 01:05:53.460]  that might not be happening directly to us.
[01:05:53.460 --> 01:05:55.280]  Think of it as wireless IDS for your
[01:05:55.280 --> 01:05:57.100]  mobile device, right?
[01:05:57.100 --> 01:05:59.540]  This is really kind of a decent idea, I think.
[01:05:59.560 --> 01:06:01.620]  There was actually a question posed yesterday to me.
[01:06:01.620 --> 01:06:03.000]  Why don't you use Snort Wireless?
[01:06:03.060 --> 01:06:04.820]  Well, we kind of want to do it lightweight.
[01:06:04.820 --> 01:06:07.760]  We want to try something new, so we're slinging our own code to give this a shot.
[01:06:07.760 --> 01:06:09.640]  If people are interested in helping out,
[01:06:09.640 --> 01:06:11.300]  please contact me. I'd be more than happy to,
[01:06:11.300 --> 01:06:13.640]  well, have you write the code, because I'm really shitty
[01:06:13.640 --> 01:06:14.340]  at it.
[01:06:15.480 --> 01:06:17.040]  Question? Okay, fire.
[01:06:19.820 --> 01:06:20.900]  No, no, the question is,
[01:06:20.900 --> 01:06:22.760]  if you help out, do you have to drive around Baltimore?
[01:06:22.760 --> 01:06:24.320]  No, I'll do that for you.
[01:06:24.960 --> 01:06:26.600]  Wait a second, Bruce.
[01:06:26.600 --> 01:06:29.240]  Didn't you say that IDSs sucked?
[01:06:30.680 --> 01:06:32.300]  I think that's what I heard.
[01:06:34.260 --> 01:06:34.640]  So,
[01:06:35.180 --> 01:06:36.860]  there we go. Where the hell did this come from?
[01:06:36.920 --> 01:06:38.140]  Oh, Jesus.
[01:06:38.320 --> 01:06:40.300]  Way to avoid the question.
[01:06:41.580 --> 01:06:43.360]  I'm trying to get to a
[01:06:43.360 --> 01:06:45.640]  geometry here.
[01:06:45.640 --> 01:06:47.580]  What?
[01:06:47.580 --> 01:06:48.640]  We only have one certified
[01:06:48.640 --> 01:06:49.720]  open office operator.
[01:06:49.720 --> 01:06:51.280]  How do I go backwards?
[01:06:52.280 --> 01:06:53.600]  Oh, the back arrow.
[01:06:54.660 --> 01:06:56.080]  Hey, is that my slide?
[01:06:56.080 --> 01:06:57.560]  You wouldn't learn that in computer science.
[01:06:57.560 --> 01:06:58.560]  Oh, I did that.
[01:06:59.720 --> 01:07:01.620]  I forgot my slide.
[01:07:02.380 --> 01:07:03.820]  Alright, so this is Hotspot DK.
[01:07:03.820 --> 01:07:05.460]  So to get to the question Eric asked,
[01:07:05.460 --> 01:07:07.900]  this microphone and I are going to have a
[01:07:07.900 --> 01:07:11.800]  carnal knowledge here shortly.
[01:07:11.800 --> 01:07:12.320]  So,
[01:07:12.320 --> 01:07:13.840]  as security professionals,
[01:07:13.840 --> 01:07:14.580]  I'll get there.
[01:07:14.580 --> 01:07:16.540]  Alright? Thank you, brother. Hallelujah.
[01:07:17.020 --> 01:07:18.520]  We haven't learned a lot.
[01:07:19.260 --> 01:07:20.600]  People have called me kind of a killjoy
[01:07:20.600 --> 01:07:22.300]  the last couple days because every time I've been on stage,
[01:07:22.300 --> 01:07:25.020]  I've been pointing at the audience and being like, it's all your fault.
[01:07:26.180 --> 01:07:26.600]  We've learned
[01:07:26.600 --> 01:07:28.580]  the same things over and over, which is kind of
[01:07:28.580 --> 01:07:29.540]  alluring a lot.
[01:07:29.540 --> 01:07:32.280]  You get to learn the same thing and fill up the queue.
[01:07:33.160 --> 01:07:34.560]  So, here's
[01:07:34.560 --> 01:07:35.240]  the deal.
[01:07:35.980 --> 01:07:38.760]  We get paid to know security stuff.
[01:07:39.540 --> 01:07:40.940]  And ultimately,
[01:07:41.660 --> 01:07:42.600]  we should have a better
[01:07:42.600 --> 01:07:44.340]  knowledge of our environment and our equipment,
[01:07:44.340 --> 01:07:46.340]  as Ronnie talked about, understanding what
[01:07:46.340 --> 01:07:48.340]  vendor gear we're putting in, understand the
[01:07:48.340 --> 01:07:50.360]  applications running in our environments,
[01:07:50.360 --> 01:07:52.540]  that kind of thing. Ultimately, users
[01:07:52.540 --> 01:07:54.440]  are the ones kind of affected by IDSs.
[01:07:54.440 --> 01:07:56.620]  Is a transaction I just committed with the Bank of America
[01:07:56.620 --> 01:07:58.700]  legitimate, or have I been owned?
[01:07:58.700 --> 01:08:00.020]  Is my credit card down?
[01:08:00.020 --> 01:08:02.440]  Bank of America can find out. It'll take six months
[01:08:02.440 --> 01:08:04.540]  to discover it, but it would be nice if you
[01:08:04.540 --> 01:08:06.660]  found out in real time. It would be nice if the people
[01:08:06.660 --> 01:08:08.500]  in the NOC just got little pop-up windows
[01:08:08.500 --> 01:08:10.980]  that were binary ones and zeros. Secure, not secure.
[01:08:10.980 --> 01:08:12.800]  What's the state of the network? Bing! Zero.
[01:08:12.800 --> 01:08:14.820]  Secure. What's the state of the network? Bing! Zero.
[01:08:14.820 --> 01:08:16.060]  Insecure. What?
[01:08:17.760 --> 01:08:19.160]  Then you know your own.
[01:08:19.600 --> 01:08:21.540]  You just cast that in stone.
[01:08:21.760 --> 01:08:22.380]  Yes.
[01:08:22.960 --> 01:08:24.860]  Everything's secure. What we really need to be
[01:08:24.860 --> 01:08:26.780]  focusing on as an industry is a better
[01:08:26.780 --> 01:08:29.000]  understanding of the tools and our own enterprises
[01:08:29.000 --> 01:08:30.600]  and looking at the integrity of things.
[01:08:30.600 --> 01:08:32.720]  It's not good enough just to say, are there
[01:08:32.720 --> 01:08:34.820]  traces of an attack, but has an attack
[01:08:34.820 --> 01:08:36.980]  been successful? That's the real rub.
[01:08:36.980 --> 01:08:38.700]  There's a lot of people focusing on forensics
[01:08:38.700 --> 01:08:41.140]  and looking at the after-the-fact type of stuff.
[01:08:41.140 --> 01:08:42.540]  But we need to have a deeper understanding
[01:08:42.540 --> 01:08:44.860]  of what's going on in our environment.
[01:08:45.040 --> 01:08:46.800]  Brian Watring, who couldn't be here
[01:08:46.800 --> 01:08:48.960]  today, has been working for years on a
[01:08:48.960 --> 01:08:50.480]  tool called OSIRIS.
[01:08:50.480 --> 01:08:52.980]  You can go to hostintegritymonitoring.com
[01:08:52.980 --> 01:08:54.800]  and take a look at it.
[01:08:55.640 --> 01:08:56.860]  Think of it as tripwire
[01:08:56.860 --> 01:08:59.360]  on steroids. It's examining configurations
[01:09:00.120 --> 01:09:00.740]  and checksums
[01:09:00.740 --> 01:09:02.900]  and all kinds of things about the...
[01:09:02.900 --> 01:09:04.620]  Pablo, go. It's free.
[01:09:04.620 --> 01:09:06.180]  Just get it. It's free. Just get it.
[01:09:06.180 --> 01:09:08.320]  And he actually just has a book that was published
[01:09:08.320 --> 01:09:10.340]  about how to do host integrity monitoring.
[01:09:10.480 --> 01:09:12.140]  And what's unfortunate is that
[01:09:12.140 --> 01:09:14.400]  there's not a lot of other tools out there that deal with that kind of thing
[01:09:14.400 --> 01:09:16.160]  and I think we need to focus on that.
[01:09:17.660 --> 01:09:18.020]  Further...
[01:09:18.020 --> 01:09:20.080]  I made a triangle. What?
[01:09:20.080 --> 01:09:22.060]  What? You made a triangle
[01:09:22.060 --> 01:09:24.140]  in college? Yeah, I made a triangle
[01:09:24.140 --> 01:09:26.140]  in college. It was glorious. This is my
[01:09:26.140 --> 01:09:28.100]  PowerPoint food. Beetle has arrows going back
[01:09:28.100 --> 01:09:29.860]  and forth and worms and all kinds of shit.
[01:09:29.860 --> 01:09:31.180]  And I have a triangle.
[01:09:31.940 --> 01:09:34.180]  And they're both built by bandits. Bring on the triangle.
[01:09:34.180 --> 01:09:35.840]  What do you want from me, buddy?
[01:09:36.260 --> 01:09:38.220]  Tell me about wireless IDS.
[01:09:38.240 --> 01:09:40.820]  Wireless IDS? Why wireless IDS?
[01:09:40.820 --> 01:09:42.020]  Because you said they were good.
[01:09:42.640 --> 01:09:44.280]  Wireless IDS in the client, I think,
[01:09:44.280 --> 01:09:46.820]  is a reasonable thing. That gets back to this kind of thing.
[01:09:47.160 --> 01:09:47.960]  God!
[01:09:49.480 --> 01:09:50.160]  Don't you mean
[01:09:50.160 --> 01:09:52.240]  host IDS on wireless
[01:09:52.240 --> 01:09:54.320]  clients? It's okay, Matt. It's almost
[01:09:54.320 --> 01:09:56.120]  over. Apparently we need a keyboard
[01:09:56.120 --> 01:09:58.200]  IDS. Do we have any more shit we can show instead?
[01:09:58.200 --> 01:09:59.560]  Yeah. All right. I'll make this short.
[01:09:59.560 --> 01:10:01.880]  Your IT security needs includes a different user interface.
[01:10:01.880 --> 01:10:04.460]  Go play with this in the parking lot.
[01:10:04.460 --> 01:10:05.880]  Yeah, go play with that. I'll just stick it down my
[01:10:05.880 --> 01:10:07.420]  pants with a one watt amp.
[01:10:09.540 --> 01:10:10.340]  Vegas was hot.
[01:10:10.340 --> 01:10:11.880]  Can we get pictures before and after?
[01:10:12.480 --> 01:10:13.620]  So, anyway,
[01:10:13.620 --> 01:10:16.220]  sure. Look, you can see it backwards over there.
[01:10:16.300 --> 01:10:17.920]  IDS and the normal user get along
[01:10:17.920 --> 01:10:19.840]  fine because that's who really needs to consume
[01:10:19.840 --> 01:10:21.780]  the information. What we really care about is
[01:10:21.780 --> 01:10:23.460]  how bad is shit, right?
[01:10:23.560 --> 01:10:25.580]  Users need to make rash tactical reactions.
[01:10:25.580 --> 01:10:27.880]  We in the operations world need to make strategic reactions
[01:10:27.880 --> 01:10:30.300]  like, oh god, we got broken into. Let's respond.
[01:10:30.300 --> 01:10:32.200]  Incident response and things of that nature.
[01:10:32.420 --> 01:10:34.840]  Does that get down your path? All right, thank you.
[01:10:35.140 --> 01:10:36.340]  Further, I think you need,
[01:10:36.340 --> 01:10:39.120]  when you think about security in the data center,
[01:10:39.120 --> 01:10:40.580]  sorry about the rant, and if you were a
[01:10:40.580 --> 01:10:42.740]  black hat, I really apologize, but
[01:10:42.740 --> 01:10:44.740]  you really need to think about things in a structured
[01:10:44.740 --> 01:10:46.440]  fashion, and it turns out we need to
[01:10:46.440 --> 01:10:48.700]  spend as much time thinking about patch management and configuration
[01:10:48.700 --> 01:10:50.620]  management as we do firewalls and software
[01:10:50.620 --> 01:10:52.540]  security and IDS. Where do we buy the
[01:10:52.540 --> 01:10:55.640]  honeypot hats? The honeypot hats?
[01:10:55.640 --> 01:10:56.620]  I'll make you one out of this
[01:10:56.620 --> 01:10:58.500]  soaking wet towel and some electronic devices later.
[01:10:59.660 --> 01:11:00.920]  Dead man walking.
[01:11:02.300 --> 01:11:03.560]  Anyway, I don't really want to get into
[01:11:03.560 --> 01:11:05.360]  this triangle, because it'll be controversial
[01:11:05.360 --> 01:11:07.540]  and more than I really want to do, and Beedle's standing behind me
[01:11:07.540 --> 01:11:08.720]  threatening to beat the shit out of me.
[01:11:08.720 --> 01:11:11.740]  As a moment, I'm just going to do that to piss him off.
[01:11:15.380 --> 01:11:17.560]  That was awesome, dude. Awesome, whatever.
[01:11:24.340 --> 01:11:24.660]  So...
[01:11:25.980 --> 01:11:27.560]  Is Mike Lynn in the house?
[01:11:27.560 --> 01:11:29.100]  Is he in here, man?
[01:11:29.400 --> 01:11:30.940]  Motherfucker. I told him to come.
[01:11:30.940 --> 01:11:34.620]  Yeah, so Mike was at ShmooCon.
[01:11:34.620 --> 01:11:36.860]  If you missed his talk on signal intelligence
[01:11:36.860 --> 01:11:40.780]  and how to capture really interesting things
[01:11:40.780 --> 01:11:42.280]  that are in the air all day long
[01:11:42.280 --> 01:11:44.680]  and how to decode them, because people are using
[01:11:44.680 --> 01:11:46.120]  leaked crypto like
[01:11:47.120 --> 01:11:48.160]  ASCII.
[01:11:51.120 --> 01:11:54.100]  You missed a really cool talk at ShmooCon.
[01:11:54.300 --> 01:11:56.520]  And it was a lot of fun. Who here was at
[01:11:56.520 --> 01:11:58.740]  ShmooCon earlier this year?
[01:11:58.740 --> 01:12:00.680]  Awesome. Right on, man. Thanks. That's cool.
[01:12:00.680 --> 01:12:03.600]  So, ShmooCon 2006.
[01:12:03.800 --> 01:12:05.340]  January 13th through 15th.
[01:12:05.340 --> 01:12:06.940]  Washington, D.C. again.
[01:12:07.100 --> 01:12:09.040]  Pre-registration is live now.
[01:12:09.040 --> 01:12:11.740]  If you missed out on ShmooCon last year, it's sold out.
[01:12:11.740 --> 01:12:12.660]  We didn't have...
[01:12:12.660 --> 01:12:15.600]  He is the ticket Nazi. When we sell out, we sell out.
[01:12:15.600 --> 01:12:17.840]  Yeah, we were done, man. We didn't have any space.
[01:12:17.840 --> 01:12:19.120]  We had no more chairs.
[01:12:19.120 --> 01:12:21.760]  We would have been people standing in the back...
[01:12:21.760 --> 01:12:22.960]  Oh, or something. Okay.
[01:12:25.240 --> 01:12:27.640]  So, yeah, you can go to ShmooCon.org.
[01:12:27.900 --> 01:12:29.680]  What we really like about ShmooCon...
[01:12:30.460 --> 01:12:33.620]  And particularly how we can kind of get it out there
[01:12:33.620 --> 01:12:34.520]  for people to see.
[01:12:34.780 --> 01:12:37.320]  We threw a lot of ads together last year
[01:12:37.320 --> 01:12:38.760]  for people, their entertainment.
[01:12:38.820 --> 01:12:40.700]  And we're interested in soliciting those again from people.
[01:12:40.700 --> 01:12:43.620]  So if you have an advertisement for ShmooCon
[01:12:43.620 --> 01:12:45.120]  that you'd like to get onto the web,
[01:12:45.120 --> 01:12:47.100]  we'd like to get it onto the web for you.
[01:12:47.160 --> 01:12:49.200]  And so just build it, make it.
[01:12:49.300 --> 01:12:51.440]  We'll compare it with all the other ads that we receive.
[01:12:51.440 --> 01:12:52.800]  The best ad that we get,
[01:12:52.800 --> 01:12:55.380]  we're gonna pay for that dude, wherever you are,
[01:12:55.380 --> 01:12:58.120]  to fly to ShmooCon, stay at ShmooCon,
[01:12:58.120 --> 01:12:58.980]  hang out at ShmooCon.
[01:12:59.580 --> 01:13:01.040]  Yeah, man.
[01:13:02.560 --> 01:13:04.160]  Please do not hire an artist from Singapore
[01:13:04.160 --> 01:13:05.080]  or somewhere.
[01:13:05.520 --> 01:13:07.200]  No sweatshops, alright?
[01:13:07.380 --> 01:13:09.340]  Here's an example ad, just so that,
[01:13:09.340 --> 01:13:11.780]  if you want some mind view.
[01:13:15.060 --> 01:13:16.680]  See if this will actually play.
[01:13:16.680 --> 01:13:17.420]  Hopefully.
[01:13:49.520 --> 01:13:50.880]  That's pretty hot.
[01:13:52.320 --> 01:13:53.480]  Right on.
[01:13:57.200 --> 01:13:58.760]  So, we're really interested
[01:13:58.760 --> 01:14:00.500]  in more people submitting.
[01:14:00.520 --> 01:14:01.840]  Rodney's got the CFP.
[01:14:01.840 --> 01:14:03.320]  So the CFP's out.
[01:14:03.380 --> 01:14:04.800]  And we're handing it out.
[01:14:04.800 --> 01:14:07.320]  So if you want to see what we're interested in,
[01:14:07.320 --> 01:14:08.600]  what we'd like you to present on,
[01:14:08.600 --> 01:14:08.640]  feel free to do that.
[01:14:08.660 --> 01:14:10.260]  We had three tracks last year.
[01:14:10.260 --> 01:14:11.720]  Build it, break it, and bop it.
[01:14:11.720 --> 01:14:13.960]  So we're really interested in people like building things.
[01:14:14.080 --> 01:14:15.900]  And as Pablo said at DEF CON last year,
[01:14:15.900 --> 01:14:16.920]  build cool shit.
[01:14:17.220 --> 01:14:19.580]  And the other thing, if you have an idea for a talk,
[01:14:19.580 --> 01:14:20.960]  and you haven't done a talk before,
[01:14:20.960 --> 01:14:22.840]  you're not sure how you'd go about doing that,
[01:14:22.840 --> 01:14:23.760]  talk to us anyway.
[01:14:23.760 --> 01:14:25.140]  We're trying to encourage new people,
[01:14:25.140 --> 01:14:26.320]  new blood to show up.
[01:14:26.320 --> 01:14:27.340]  And we've got all sorts of folks,
[01:14:28.000 --> 01:14:30.180]  PhDs, professors give courses,
[01:14:30.180 --> 01:14:31.640]  all sorts of people do presentations.
[01:14:31.640 --> 01:14:33.460]  We can help you out with that kind of stuff.
[01:14:33.540 --> 01:14:35.300]  So if you have a good idea, talk to us.
[01:14:35.300 --> 01:14:37.040]  Doesn't matter if you've given a presentation before.
[01:14:37.040 --> 01:14:38.620]  Go right ahead. Please, we encourage it.
[01:14:38.620 --> 01:14:41.000]  It's important to mention that when we're at ShmooCon,
[01:14:41.000 --> 01:14:42.900]  we don't talk at ShmooCon.
[01:14:42.900 --> 01:14:45.340]  We usually, you know, we might give a few rants here and there
[01:14:45.340 --> 01:14:46.580]  and some informative things.
[01:14:46.580 --> 01:14:47.760]  But those are sidebar things.
[01:14:47.760 --> 01:14:50.220]  We actually provide a venue for everybody else to talk.
[01:14:50.220 --> 01:14:52.260]  We come here and we just kind of throw a bunch of stuff together
[01:14:52.260 --> 01:14:54.180]  and we try and jazz people up and get people excited
[01:14:54.180 --> 01:14:55.580]  about doing these kind of things.
[01:14:55.580 --> 01:14:57.800]  So we're interested in providing a venue for you
[01:14:57.800 --> 01:14:59.040]  to give presentations.
[01:14:59.040 --> 01:15:01.320]  So submit what you want and we'll make it happen.
[01:15:02.540 --> 01:15:03.900]  So that's it for us.
[01:15:03.900 --> 01:15:05.720]  Does anybody have any questions?
[01:15:06.780 --> 01:15:07.900]  Please ask questions.
[01:15:07.900 --> 01:15:09.100]  Priest is walking up.
[01:15:11.960 --> 01:15:13.180]  Alright, thanks a lot guys.
[01:15:13.180 --> 01:15:14.420]  We really appreciate it.
[01:15:14.420 --> 01:15:16.180]  Have a good day. Have a good DEF CON.