WEBVTT 00:08.690 --> 00:13.290 This is not the same Shmoo presentation that we anticipated. 00:13.290 --> 00:17.590 There will not be a Hookers for Hackers giveaway this time. 00:17.590 --> 00:19.570 So , I'm sorry to disappoint you. 00:19.570 --> 00:22.590 We have some other, you know, mostly nerdy crap to talk about. 00:22.590 --> 00:25.310 So , maybe next year. 00:25.670 --> 00:31.470 So, I don't know exactly why you're all here, but, you know, we're going to give you everything and we'll figure it out as we go. 00:31.470 --> 00:33.030 I'm Pablos from the Shmoo group. 00:33.230 --> 00:34.470 We do have some stickers. 00:34.470 --> 00:36.470 If you didn't get one, you know, you're a lamer. 00:36.470 --> 00:37.190 Right. 00:37.490 --> 00:38.970 Go to those guys right there. 00:38.970 --> 00:40.030 Raise your hands, guys. 00:40.410 --> 00:49.830 So, what we'd like to do at DEF CON is just lambaste you with everything that we can think of that we've been working on, or at least the cool stuff. 00:49.830 --> 00:51.030 And it's ready. 00:51.030 --> 00:53.710 And so, we have a panel of all different Shmoo guys. 00:53.710 --> 00:56.690 There are a whole bunch of others, but the ones that have stuff to show you today are here. 00:56.690 --> 00:57.730 We're the troublemakers. 00:57.730 --> 00:59.630 They're troublemakers, yeah. 01:00.130 --> 01:02.990 And, um, but a couple things we want to talk about. 01:02.990 --> 01:07.110 And I guess first I'd like to know, did Mike Lynn make it here or not? 01:07.110 --> 01:08.050 Is Mike here? 01:08.490 --> 01:09.370 Spot the Mike. 01:09.370 --> 01:09.770 Spot the Mike. 01:09.770 --> 01:10.770 So , there's no Mike. 01:11.110 --> 01:15.950 Okay, well, I'm sure you all are aware of what's going on with Mike in the recent fiasco. 01:15.950 --> 01:32.130 And he's not allowed to talk, but we wanted to say a couple things about what he's up to, which is important because everything that we do here at DEF CON and in security research has to do with reverse engineering and disclosure of vulnerabilities. 01:32.130 --> 01:37.490 And, unfortunately, it's what we have to work with as far as making systems secure. 01:37.550 --> 01:41.310 We have to find the problems, we have to tell people about them, and we have to fix them. 01:41.450 --> 01:43.070 And that's a lot of what's going on. 01:43.070 --> 01:47.650 And it's really, really pivotal, I think as most of you guys know, to support that. 01:47.650 --> 01:50.810 So , reverse engineering and Mike Lynn. 01:52.010 --> 01:53.570 Oh, now I see why you're clapping. 01:53.570 --> 01:54.570 Clap for Mike! 01:56.750 --> 01:58.470 That's kind of a side project. 01:58.630 --> 01:59.730 Yeah, this is Mike. 02:04.950 --> 02:05.390 So... 02:07.630 --> 02:12.310 So, as you know, Mike recently, in the last few days, managed to get sued and settle with Cisco. 02:12.490 --> 02:16.290 But the work that he's been doing goes on with other people. 02:16.490 --> 02:25.270 And it goes on, and what's important about it is that we can't let a culture of cover-ups for security issues develop. 02:25.610 --> 02:30.570 And if you look at the interests of vendors and the security research community, they're kind of opposed. 02:30.650 --> 02:38.690 But the important, I think, message from what Mike's just been through is that vendors have an obligation to their customers. 02:38.690 --> 02:47.070 And it's really the customers that are being kept in the dark when the vendors aren't disclosing the vulnerabilities that have been around for a while, even once they've been fixed. 02:47.070 --> 02:52.910 So, I think that an important thing to recognize is that all you guys are really important, right? 02:52.910 --> 02:54.790 The work that you're doing is really important. 02:54.830 --> 02:59.690 Some guys, every year, put their ass on the line and some get picked up. 02:59.690 --> 03:01.690 And Mike's not the first, but he's the most recent. 03:01.690 --> 03:05.630 So the important thing is keep up the good work. 03:05.670 --> 03:06.910 And this is... 03:08.210 --> 03:09.470 You guys rock. 03:09.470 --> 03:15.190 This is from a project I worked on to secure cell phones to thighs. 03:15.470 --> 03:24.190 And I managed to patent the use of women's thighs, which, you know, I don't know if there's anyone that leap here, but if you are, let me know. 03:24.890 --> 03:34.550 And then the other thing I wanted to say before we move on is that don't get sidetracked by all the work that people are talking about as far as vulnerabilities. 03:34.550 --> 03:37.750 There's a lot more to security than finding vulnerabilities and exploits. 03:37.870 --> 03:41.090 There's a lot more to security than just patch management and IDS. 03:41.090 --> 03:43.710 There's a lot more to security than policy management. 03:43.950 --> 03:46.610 And what there is is architecture. 03:46.610 --> 03:55.690 What we want to do is change the world so that 15 years from now, we aren't coming back to DEF CON and telling you about the latest exploit we found in firewalls or Wi-Fi or whatever. 03:55.770 --> 04:04.930 We need to find fundamental ways to change the computer systems that we use We need to find ways to take the academic research that's been done and put it into practice. 04:05.010 --> 04:08.110 And this is unfortunately not something that the market has been really good at. 04:08.110 --> 04:11.570 And so I think it's up to you guys since you're learning to think different. 04:11.570 --> 04:17.390 You're already on the fringe a little bit and you've learned about how to break shit. 04:17.530 --> 04:18.710 You know how to break shit. 04:18.710 --> 04:20.650 You know how to build shit that can't be broken. 04:20.650 --> 04:25.330 And what we need to do is figure out how to do that and kind of move our entire industry forward. 04:25.330 --> 04:26.670 And the world in general. 04:26.670 --> 04:28.090 So that's what I wanted to say. 04:28.090 --> 04:31.410 With that, I'm going to hand it over to Eric Johanson. 04:33.170 --> 04:38.190 And Eric is going to take on getting on with the exploits and shit. 04:41.060 --> 04:42.360 Good afternoon, folks. 04:42.360 --> 04:43.240 How are you? 04:45.100 --> 04:47.020 You guys still alive? 04:50.080 --> 04:53.200 So, let's see. 04:53.200 --> 04:59.440 Back at the beginning of this year, I did some work related to international domain names. 04:59.440 --> 05:02.640 This work was apparently... 05:02.640 --> 05:09.820 I was not the first person to do this work specifically related to international domain names and homograph attacks. 05:10.080 --> 05:21.700 I found some holes in, well, most of the browsers that are out there related to how they handle Unicode characters and domain names. 05:21.700 --> 05:24.480 And this attack has been talked about. 05:24.480 --> 05:26.640 There were papers published in 2000. 05:26.640 --> 05:31.140 The vendors were notified and no fixes were done. 05:31.480 --> 05:33.440 This seems like a problem. 05:34.020 --> 05:35.460 No? 05:41.500 --> 05:53.960 So, it was interesting when I gave this short presentation demoing this exploit at ShmooCon because everyone went up in arms and said, you should have notified the vendors first. 05:55.420 --> 06:01.860 The vendors that I did notify several weeks in advance before ShmooCon told me that it was not a vulnerability. 06:02.320 --> 06:04.360 We will be making no fixes. 06:04.400 --> 06:05.480 It's a feature. 06:05.980 --> 06:07.840 It is a feature. 06:08.940 --> 06:12.360 A large hardware manufacturer... 06:12.360 --> 06:14.780 These are not the exploits you are looking for. 06:17.700 --> 06:43.780 Okay, so an IDN exploit or a homograph attack, what it basically is, if you have, let's say, PayPal.com and you have, over here, PayPal.com only the first A in PayPal is actually a Russian A which looks and smells and tastes identical to a Latin A that is effectively a homograph attack because users cannot tell the difference. 06:43.780 --> 06:50.540 There is no difference on your browser, on most platforms, the difference between those two domain names. 06:50.540 --> 06:51.460 So... 06:53.640 --> 06:54.240 Hmm... 06:54.240 --> 06:57.240 Phishers would probably really like that, I suspect. 06:59.140 --> 06:59.740 So... 06:59.740 --> 07:01.340 You know, it was interesting. 07:01.340 --> 07:09.500 The vendor response I got, basically, most vendors told me, this is not a bug. 07:09.920 --> 07:10.740 Go away. 07:10.740 --> 07:12.220 We don't want to hear from you. 07:12.220 --> 07:17.140 After it was released, suddenly I'm getting calls from legal departments. 07:17.140 --> 07:34.460 So, clearly, vulnerability disclosure is something that we all face as security researchers because just this week, we have someone that's also going to be dealing with more issues related to how they disclose something. 07:34.480 --> 07:39.460 There's an RFC written out related to vulnerability disclosure. 07:39.460 --> 07:42.560 Everyone seems to be doing things in a slightly different way. 07:42.640 --> 07:52.340 But ultimately, what a lot of people seem to be forgetting is just because a vulnerability is found, doesn't mean that they're the first people to find it. 07:52.880 --> 07:56.640 I was not the first person to find the IDN homograph attack vulnerability. 07:56.640 --> 07:58.220 It still hadn't been fixed. 07:58.260 --> 08:03.980 The work that Mike has been doing, it is very likely that other people know about those attacks. 08:04.980 --> 08:06.560 It's very likely. 08:06.780 --> 08:12.260 And just because it hasn't been disclosed does not mean that it places all of our society at risk. 08:12.400 --> 08:20.580 So, in short, I think ultimately, for consumers to be the best informed, they need to be aware of these vulnerabilities. 08:21.220 --> 08:25.500 And ultimately, vendors are out to make the most money. 08:25.840 --> 08:33.160 And I think that's in direct conflict with the Internet and the routers of this world and the web browsers of this world. 08:33.360 --> 08:38.520 So, think really hard when you find that vulnerability about how you want to handle it. 08:38.520 --> 08:40.300 Don't be bought out. 08:40.500 --> 08:41.920 Don't let it happen. 08:43.540 --> 08:43.900 So... 08:44.900 --> 08:45.620 Yeah! 08:50.590 --> 08:52.310 All right, so... 08:52.890 --> 08:55.910 Yeah, I know, we're going to get up here and we're going to preach a little bit or whatever. 08:55.910 --> 08:57.630 We got cool shit, don't worry. 08:59.190 --> 09:01.150 Everybody's like, hey man, what is it? 09:01.150 --> 09:06.110 So we're going to get down and dirty and this will fry your fucking brain. 09:07.930 --> 09:12.470 If you're not familiar with what Rainbow Tables are, Dan will go into it a little bit. 09:12.470 --> 09:17.630 If you haven't been to the rainbowtables.shmoo.com website, you'll get into that. 09:19.010 --> 09:20.750 But Dan's got something. 09:20.850 --> 09:22.350 Dan's got a new bag. 09:22.370 --> 09:23.810 Anybody here know math? 09:24.630 --> 09:26.230 All right, hi all. 09:28.370 --> 09:38.110 There's no slide for this, but since I'm up here and I have all of your attention, I saw Jennifer Granick just leave, but could everybody who's from the EFF who's here, please stand up. 09:40.650 --> 09:42.090 We're talking about... 09:42.530 --> 09:43.610 Hey guys. 09:45.310 --> 09:48.450 All right, I'm just going to do introductions quick as I see you. 09:48.450 --> 09:53.210 I used to work with these guys very briefly as a staff technologist and now I'm elsewhere. 09:53.330 --> 09:55.030 But these guys, we had a party last night. 09:55.030 --> 09:56.210 You might have been to it. 09:56.290 --> 10:00.550 We're talking about vulnerability disclosure, full disclosure, legal ramifications. 10:00.550 --> 10:07.250 Jennifer Granick, who is Mike's counsel, and the EFF, these are all the guys saving all of our asses every day. 10:07.250 --> 10:10.250 So please give a round of applause for the EFF. 10:17.480 --> 10:18.840 Go to the dunk tank. 10:18.840 --> 10:20.100 I'm going to be there tomorrow. 10:20.100 --> 10:20.920 Dunk me. 10:21.680 --> 10:23.420 All right, so Rainbow Tables. 10:23.780 --> 10:25.040 Who's familiar with Rainbow Crack? 10:25.040 --> 10:26.120 Put your hand up. 10:27.020 --> 10:27.900 Word. 10:28.020 --> 10:34.260 All right, Rainbow Crack is an implementation of a technique made by a European researcher. 10:34.600 --> 10:37.920 And without getting into the heavy math of that, basically it's software. 10:37.920 --> 10:39.200 You can download it. 10:39.260 --> 10:41.280 Jennifer Granick, I see you walking back there. 10:41.280 --> 10:41.800 Jennifer? 10:41.800 --> 10:43.680 Everybody give Jennifer a hand of applause. 10:43.680 --> 10:44.740 Kiss her ass. 10:47.400 --> 10:49.080 Thank you. 10:50.860 --> 11:03.100 So you download Rainbow Crack, and basically what it lets you do is consume all of her CPU time and generate, according to what it says, nearly every single possible landman hash. 11:03.100 --> 11:04.260 Anybody familiar with landman? 11:04.260 --> 11:05.320 Raise your hand. 11:05.960 --> 11:06.520 Word. 11:06.520 --> 11:07.460 Okay, great. 11:07.500 --> 11:10.520 So that's what it does, right? 11:10.520 --> 11:20.800 And we, like Beetle over there in the Bosox cap, had a good idea and he said, hey, we got a bunch of people and we have a bunch of machines and we have too much free time, so let's just do this. 11:20.800 --> 11:23.480 Let's just generate every single landman hash that there is. 11:23.720 --> 11:25.080 So we started doing it. 11:25.080 --> 11:27.220 We just downloaded the code off the guy's website. 11:27.520 --> 11:33.640 We fired it up on about 150 machines across different shmoo, and we generated it. 11:33.640 --> 11:36.440 And our goal was to use it to generate... 11:36.440 --> 11:39.960 You can do different key spaces, like if you want to do five characters, six characters, whatever. 11:39.960 --> 11:45.920 We wanted to do the configuration that had every single seven-character valid hash for landman. 11:45.920 --> 11:49.700 Every uppercase, alphanumeric character, a certain set of symbols and space. 11:50.320 --> 11:51.780 So we did it. 11:51.780 --> 11:54.340 And, you know, landman, right? 11:54.340 --> 11:55.480 We put it up. 11:55.480 --> 11:57.000 The link is live, right? 11:58.520 --> 12:03.340 RainbowTables.shmoo.com 43 gigabytes over BitTorrent. 12:03.340 --> 12:04.640 Go download it now. 12:04.640 --> 12:07.700 If you have a laptop, saturate Defcon's bandwidth. 12:07.700 --> 12:10.620 We're going for the BitTorrent record here. 12:11.000 --> 12:11.980 World's largest torrent. 12:11.980 --> 12:12.900 Can you man the slides for me? 12:12.900 --> 12:13.480 Right there. 12:13.480 --> 12:14.020 Right. 12:15.260 --> 12:15.660 So... 12:15.660 --> 12:18.700 The big thing was that we were told... 12:19.220 --> 12:21.580 And I'll cover the political part real quick. 12:21.580 --> 12:23.000 He'll cover the technical part. 12:23.000 --> 12:24.700 But the political part was... 12:25.500 --> 12:27.680 We got an email, and you'll see the email in just a second. 12:27.680 --> 12:34.500 It said, hey, I wrote Rainbow Crack, and I don't like you giving away the tables for free because, you know, I charge for them. 12:34.500 --> 12:37.580 And mind you, there's no license on the Rainbow Crack code at all. 12:37.580 --> 12:38.060 None. 12:38.060 --> 12:39.040 You know, the code is free. 12:39.040 --> 12:41.500 You can download it, but there's no BSD, no GPL, whatever. 12:41.540 --> 12:49.320 Meanwhile, I mean, there's other folks out there that are charging $700, $800 for, like, the Landman Symbol 32, you know, plus space tables. 12:49.480 --> 12:50.120 $700. 12:50.380 --> 12:51.940 You can go get those tables. 12:51.940 --> 12:55.480 Because, obviously, it's a little difficult for everybody to get together and just kind of generate them. 12:55.480 --> 12:56.200 Preach, brother. 12:56.280 --> 12:57.760 And we said, fuck it. 12:58.040 --> 12:59.680 We'll just generate them and give them away for free. 12:59.680 --> 13:00.200 So, there. 13:00.200 --> 13:02.620 A 43.9 gigabyte torrent. 13:02.620 --> 13:03.880 Join the torrent, bitches. 13:04.300 --> 13:05.180 Right there. 13:07.720 --> 13:10.240 That's an $800 torrent, I guess. 13:12.480 --> 13:14.640 We're all about added value. 13:15.020 --> 13:19.040 And Dan will go over the finer technical points of the email that we received. 13:19.600 --> 13:20.280 All right. 13:20.340 --> 13:23.860 There's the email that we got from the author of Rainbow Crack. 13:23.960 --> 13:26.660 And I would butcher his name, so I'm not going to mention it. 13:27.280 --> 13:28.540 But , you know... 13:28.540 --> 13:29.460 All right, you can read it. 13:29.460 --> 13:31.140 I mean, the text is sort of small, but you can see it. 13:31.140 --> 13:33.060 We bolded out the important points. 13:33.060 --> 13:36.560 For those guys selling the table without permission from me, they are not welcome. 13:36.660 --> 13:38.040 But you are worse. 13:39.860 --> 13:44.480 And the second paragraph basically goes into why he generated it, why it's cool, yada, yada, yada. 13:44.480 --> 13:46.340 And then, obviously, the third paragraph. 13:46.340 --> 13:47.060 Are you feeling cool? 13:47.060 --> 13:49.460 Because knowing all the passwords is cooler than trying to crack one. 13:49.460 --> 13:53.380 That's the line from our original website, rainbowtables.shimmy.com. 13:53.600 --> 13:57.560 All over the world, there will be a lot of guys can do what you do. 13:57.560 --> 13:58.140 They aren't. 13:58.140 --> 13:58.720 Do you know why? 13:58.720 --> 14:00.940 To show off proof neither your ability nor knowledge. 14:00.940 --> 14:03.080 We're just running your code, dude. 14:03.080 --> 14:04.320 We liked you. 14:04.480 --> 14:06.400 Why can't we all just get along? 14:06.860 --> 14:08.260 We're not hippies. 14:08.640 --> 14:12.260 And then, you know, if possible, please keep honored, blah, blah, blah. 14:12.460 --> 14:14.720 Don't be crazy anymore. 14:16.100 --> 14:19.120 Well, I mean, look at us. 14:19.420 --> 14:20.220 Honestly. 14:22.620 --> 14:24.180 Don't we all look sane? 14:24.180 --> 14:31.900 All right, so we basically said that we had a lot of reasons as we were doing the rainbow table generation to make it better. 14:31.960 --> 14:33.320 And initially, that was all we were going to do. 14:33.320 --> 14:35.620 We were like, oh, you know, there's some pieces of code here we could optimize. 14:36.400 --> 14:39.780 But then we had that email, and so that pissed us right off. 14:39.780 --> 14:44.180 And I mean, the big key was that, like, you know, once Dan started looking at it, he was like, fuck it. 14:44.180 --> 14:45.680 I mean, we can do something better. 14:47.280 --> 14:49.240 So we don't need your stinking code, dude. 14:49.240 --> 14:51.680 And snacks, by the way, says fuck off. 14:51.840 --> 14:52.340 Yeah. 14:53.860 --> 14:56.100 So we have an unnamed project. 14:56.100 --> 14:57.600 We don't have a name for it yet. 14:57.840 --> 14:58.760 You okay, man? 14:59.580 --> 15:00.380 Sorry. 15:01.880 --> 15:03.700 We're making people fall out of their chairs already. 15:03.700 --> 15:04.360 Sweet. 15:06.940 --> 15:09.340 All right, so we have an unnamed project. 15:09.380 --> 15:12.220 It's me, Dan Moniz, and Reverend Dr. 15:12.220 --> 15:14.160 Patrick Stack, who's not here. 15:14.160 --> 15:16.060 Some of you may know him as Optix. 15:16.500 --> 15:20.780 He's not a schmoo, but we're working together on this because we both love each other. 15:22.040 --> 15:27.120 So we wanted to improve on Rainbow Crack, and so we started out just trying to optimize Rainbow Crack. 15:27.120 --> 15:30.640 Leave the method the same, but just, you know, make it better. 15:30.820 --> 15:33.980 But in the process of doing that, we found out it is to suck. 15:35.860 --> 15:38.940 So we changed our approach, and we made a new tool. 15:38.940 --> 15:40.620 It doesn't have a name yet. 15:41.820 --> 15:43.040 Problems with Rainbow Crack. 15:43.040 --> 15:44.900 Who here knows a little bit of math? 15:45.940 --> 15:46.640 All right. 15:48.440 --> 15:49.640 All right. 15:49.700 --> 15:51.500 So I'm going to blow through this. 15:51.500 --> 15:58.140 If you want to come to the nitty-gritty, it's either going to be, and they're going to pimp this later, either at SchmooCon in January in D.C. 15:58.140 --> 15:59.320 in 2006. 15:59.320 --> 16:00.460 Or Guantanamo. 16:00.460 --> 16:01.100 We're on the edge. 16:01.980 --> 16:07.540 Or, if we're really good at it, we'll get it done by TourCon, which you should also come to this September. 16:09.120 --> 16:10.840 A reduction function bias. 16:10.840 --> 16:17.980 There's a reduction function in Rainbow Crack, and it has this bias issue, meaning that it does something a little fucked up. 16:18.240 --> 16:36.860 If your key space is six valid inputs, and you have a 2 to the 4, which is 16, number of outputs, the reduction that Rainbow Crack does, slightly simplified, I'm ignoring one little thing that doesn't matter, is the total number of outputs, modulo the total number of inputs, 16:36.860 --> 16:39.340 and that equals what we're calling a bias marker. 16:39.440 --> 16:40.500 Break it down. 16:41.920 --> 16:44.560 So, here's some modular arithmetic, real simple. 16:44.560 --> 16:49.040 0 mod 6 equals 0, all the way through to 15 mod 6 equals 3. 16:49.060 --> 16:50.540 You can sort of see the columns. 16:50.680 --> 16:56.740 It's a lot of modular arithmetic, but one thing you'll notice is that there are three of every single value, i.e. 16:56.740 --> 16:58.300 the thing to the right of the equals sign. 16:58.300 --> 17:01.180 There's three of every of them, except four and five. 17:01.360 --> 17:05.180 We only have two of those in this 16 issue here. 17:05.180 --> 17:15.040 So, say that Landman only had six possible inputs, and say that the algorithm, which in Landman is DES, had 2 to the 4 outputs, or 16. 17:16.340 --> 17:31.300 By taking an arbitrary random output from the algorithm, we can assume that the algorithm output is random, and modulo it by 6, there's a better chance of the input values being below that bias marker, that thing to the right of the equals sign. 17:31.300 --> 17:38.560 So, values 0 to 3, because we have more of those, have a better chance of being picked at random due to this than the 4 to the 5 values. 17:38.560 --> 17:40.100 We only have two of those. 17:40.260 --> 17:40.860 See? 17:41.780 --> 17:43.680 I know I'm going quick. 17:44.380 --> 17:55.720 So, the real bias problem here is that's just a summation, you know, that's for i equals 0 to i equals 7 of 69 to the i. 17:55.720 --> 18:03.080 So, this Riemann sum is not an integral factor of 2 to the 64, just like 6 is not an integral factor of 16. 18:03.240 --> 18:05.200 This modular arithmetic has a bias. 18:05.760 --> 18:17.840 So, if we bring this back to what Rainbow Crack actually does, instead of my bullshit example, you can assume that the output of DES is statistically random, or at least random enough that the bias would still be present. 18:18.080 --> 18:19.440 Why it matters. 18:19.480 --> 18:20.620 Okay, here's some math. 18:20.620 --> 18:21.720 I'm going to break it down. 18:21.940 --> 18:26.260 n equals the floored result of the total number of outputs over the total number of inputs. 18:26.260 --> 18:31.920 We're going to add 1 if n is below the bias marker, if it's one of those low values we have more of. 18:32.080 --> 18:34.660 And that 1 represents the extra chance. 18:34.660 --> 18:37.580 We have only two 4s and 5s, we have three of everything else. 18:37.860 --> 18:44.560 1 plus n, so those are those more present values over the total number of outputs, chance of hitting that key. 18:44.980 --> 18:47.660 n, the ones that we only have two of. 18:47.660 --> 18:48.720 Same thing. 18:49.020 --> 18:56.560 Values below that bias marker are unfairly weighted and are more likely to be inputs to the rainbow chain generation. 18:56.560 --> 18:59.860 What that basically means is, he screws up the math. 19:00.160 --> 19:07.400 And he basically does modular arithmetic wrong, so that he ends up generating impossible value hashes. 19:07.400 --> 19:08.800 They can't work. 19:08.800 --> 19:17.760 So our generation technique, or how we get around this, we start generating at the last possible input that's valid for landman, and we walk towards the first. 19:18.220 --> 19:22.760 As we generate, we use a bit mask, so we can determine if we have computed the key or not. 19:22.760 --> 19:26.040 We know if the bit mask works, if it's there or if it's not. 19:26.040 --> 19:33.180 So we have 100%, like mathematically provable 100% verified key space, because everything is accounted for. 19:33.560 --> 19:42.040 At 1 bit per input, this method requires 768 gigabytes of disk space, if we were going to do it on one machine. 19:43.840 --> 19:46.240 Our badass sorting foo. 19:47.700 --> 19:52.160 We separate out anything that has less than or equal to 6 characters. 19:52.280 --> 19:57.020 7 character key space is one table, 5 to 6 character key space is another. 19:57.020 --> 20:00.800 We do this so that you can detect the length of the password really easily. 20:00.840 --> 20:01.840 Landman primer. 20:01.840 --> 20:03.800 Here's how landman works really quickly. 20:03.800 --> 20:08.100 Take 14 bytes of input, split it into two chunks, each one is 7 bytes. 20:08.400 --> 20:09.780 Hash them independently. 20:10.800 --> 20:12.380 So say I have a password of dog. 20:12.620 --> 20:15.940 Dog turns into dog with nulls at the end of it. 20:16.200 --> 20:19.760 And then we split it into dog and then some more nulls. 20:20.500 --> 20:27.920 You can detect that the first half is 7 characters or less of this particular password, because the second half of the password is the null hash. 20:27.980 --> 20:29.880 It's the hash of nulls. 20:30.300 --> 20:34.220 Which is always going to be the same for any password 7 characters or less. 20:34.660 --> 20:39.900 Now with the password of SpamDadRules Word! 20:39.920 --> 20:41.300 Where's your Spam Daddy? 20:42.240 --> 20:45.640 There was one guy in the audience who that was designed to be for. 20:47.520 --> 20:49.860 That's my elite Stego technique. 20:50.360 --> 20:52.000 Alright, so, same thing. 20:52.000 --> 20:53.060 More than 7 characters. 20:53.060 --> 20:56.240 So it goes to that, SpamDad and then rules, null null null. 20:56.260 --> 21:01.400 You know that this hash is 7 characters That's actually more than That slide is wrong. 21:01.400 --> 21:03.640 This hash is actually more than 7 characters. 21:03.640 --> 21:04.720 7 characters or more. 21:05.000 --> 21:07.420 Because the second half of the hash is not the null password hash. 21:07.420 --> 21:08.860 We get the rules in there. 21:09.400 --> 21:13.720 So this decreases the time spent looking through every hash that can't work. 21:14.580 --> 21:18.300 RainbowCrack loses, because RainbowCrack just generates random hashes. 21:18.420 --> 21:19.620 He's just using your CPU time. 21:19.620 --> 21:21.160 He's just saying I don't know. 21:21.440 --> 21:22.420 That might work. 21:22.760 --> 21:25.220 And that reduction function has that bias problem. 21:25.280 --> 21:28.280 So, random hash, okay, fair enough. 21:28.280 --> 21:30.420 That's, you know, a pretty good approach. 21:30.420 --> 21:33.480 But plus this error equals lame. 21:33.480 --> 21:36.000 Bad plus suck equals lame-zor. 21:37.560 --> 21:39.480 Now we get our crack on. 21:41.260 --> 21:46.420 RTcrack, that's the tool that you use in RainbowCrack to actually crack the passwords once you've made them all. 21:46.860 --> 21:53.640 It reads in as much of the hash table file that RTgen, which is the generator, generates using the read syscall. 21:54.080 --> 21:59.200 And then it walks linearly to check to see if the endpoints of the rainbow chain match. 21:59.420 --> 22:02.840 And this has O to the N complexity, big O notations, standard stuff. 22:03.960 --> 22:08.520 We store the start point and the endpoints in separate files on corresponding offsets. 22:08.520 --> 22:19.180 And then we take the page size on the x86 architecture, 4096 bytes, divide it by the entry size, 8, plus 1 for the index, and that gives us 513. 22:19.500 --> 22:24.820 So every 513th entry, after we've sorted them all, we store it in a special index file. 22:24.820 --> 22:33.820 And at crack time, we mmap this endpoint index file and use divide and conquer or Fibonacci find to find out if the endpoint is in the index file. 22:33.820 --> 22:39.520 Or if it's not, to find out what offset the endpoint is referenced in in the master index file. 22:39.800 --> 22:41.300 Now we get our search on. 22:41.820 --> 22:52.520 Thus, for each offset, we read a max , maximum of one page of memory off of disk rather than reading the 12 gigabyte file you did. 22:53.040 --> 22:58.780 So 496 bytes maximum, ever, to read 512 possible hashes. 22:59.080 --> 23:01.920 And this is a Bayes tree that's been modified slightly. 23:02.120 --> 23:08.660 Patrick, who came up with this method, has a doctorate of divinity in searching and sorting from the church of Donald Knuth. 23:09.520 --> 23:10.180 Awesome. 23:10.920 --> 23:12.340 Give it up for optics. 23:12.540 --> 23:13.380 Optics. 23:16.860 --> 23:18.100 Anybody have any Advil? 23:18.160 --> 23:23.280 He sent an email to Zhu, trying to explain this to him, and Zhu's like, nah man, I don't know that. 23:25.340 --> 23:28.000 So Rainbow Crack gets an L for lame. 23:28.240 --> 23:33.660 Disk IO in Rainbow Crack costs as much CPU time as encryption, if not more. 23:34.040 --> 23:39.380 And so Rainbow Crack fails to account for this in the way he does his statistics about how long it's going to take you to make all the keyspace. 23:39.380 --> 23:40.880 Don't be crazy anymore. 23:42.900 --> 23:44.700 Say it more whiny. 23:44.700 --> 23:46.360 Don't be crazy anymore. 23:47.200 --> 23:48.880 So here's our secret sauce. 23:48.880 --> 23:59.680 Our code is implemented in C and assembly for the IA-64 Itanium 2 and running on a classified number of processors in an undisclosed location. 23:59.820 --> 24:03.100 But we have to give a shout out to SGI for helping us out with this. 24:03.100 --> 24:05.180 Any SGI people in the house? 24:05.940 --> 24:06.880 Nobody? 24:06.880 --> 24:07.960 I'm sorry. 24:08.920 --> 24:11.340 We also implemented the generator. 24:11.400 --> 24:18.140 We haven't done the cracker yet, but the generator's in VHDL to run as customized specialized hardware on a Spartan 3 FPGA. 24:18.140 --> 24:19.160 Flip that up. 24:19.220 --> 24:19.960 There we go. 24:19.960 --> 24:24.520 Things generating landman hashes as we speak, basically. 24:24.880 --> 24:26.340 Okay, I'm holding it up higher. 24:26.340 --> 24:27.080 Jeez. 24:27.080 --> 24:28.140 And that's me. 24:28.140 --> 24:28.840 I'm done. 24:28.840 --> 24:30.960 It has blinking lights and shit. 24:32.400 --> 24:33.260 Thank you. 24:34.620 --> 24:36.740 Oh my god! 24:36.740 --> 24:38.360 That's so fucking cool. 24:42.120 --> 24:44.840 The brain's coming out of my ears. 24:45.860 --> 24:47.180 That's just hot, man. 24:47.180 --> 24:48.400 That's so hot. 24:49.480 --> 24:54.060 Alright, so I'm going to talk about a few wireless things here and there. 24:55.580 --> 25:00.220 First of all, why oh why do we Wi-Fi? 25:00.780 --> 25:03.540 Who here has an open wireless network at home? 25:04.160 --> 25:04.840 Go ahead. 25:04.840 --> 25:05.960 You can admit it. 25:06.500 --> 25:09.480 My name's Beetle, and I have an open wireless network at home. 25:11.960 --> 25:14.240 You know, crap. 25:14.400 --> 25:16.340 My TiVo, it can't do WPA. 25:16.340 --> 25:18.220 And my PSP, it can't either. 25:18.220 --> 25:19.700 Does it really fucking matter? 25:19.900 --> 25:26.300 I mean, at the end of the day, does it matter if somebody's reading my streams of Girls Gone Wild? 25:26.760 --> 25:31.280 I mean, does it matter that somebody's messing with my Wipeout Pure ad hoc session? 25:31.560 --> 25:33.020 Do we really care? 25:33.220 --> 25:36.800 Some of the technology, it really doesn't matter if it's that secure. 25:36.980 --> 25:38.160 It's dumb. 25:38.160 --> 25:40.640 It's dumb, it's entertainment, blah blah blah. 25:41.020 --> 25:45.420 But, when you start looking at different environments, where in the world should you be actually doing wireless? 25:45.420 --> 25:46.300 Coffee shops? 25:46.300 --> 25:46.880 Eh, alright. 25:46.880 --> 25:47.320 Airports? 25:47.320 --> 25:48.120 Mm, maybe. 25:48.440 --> 25:49.240 Hospitals? 25:49.700 --> 25:50.500 Banks? 25:51.980 --> 25:53.720 Nuclear power plants? 25:56.340 --> 25:57.640 You know, this is interesting. 25:57.640 --> 25:59.340 I got this from Matt Fisher. 25:59.340 --> 26:00.380 He sent this to me. 26:00.820 --> 26:01.340 Scanned it in. 26:01.340 --> 26:03.080 He was like, man, check this out. 26:03.080 --> 26:05.800 They're doing wireless at some nuke plants. 26:06.000 --> 26:08.140 I'm like, okay, cool. 26:08.480 --> 26:10.020 He was like, no, no, no. 26:10.500 --> 26:11.740 Look a little closer. 26:13.200 --> 26:14.920 IP address, baby. 26:19.050 --> 26:26.290 Not only do they tell you that they're running Cisco hardware, they tell you what the internal address space is at Comanche Peak, Arizona, or Azima. 26:27.570 --> 26:28.390 It's great. 26:28.390 --> 26:33.710 Azima has installed monitoring devices on more than 50 pieces of critical equipment. 26:39.780 --> 26:41.760 Where did we go wrong? 26:41.760 --> 26:44.660 I mean, and where the hell are we going? 26:45.420 --> 26:47.900 I mean, it's a technology of convenience, right? 26:47.900 --> 26:52.300 But there's obviously this inconvenience of securing it, so we just put it out there. 26:52.540 --> 26:56.460 And then all these users, as far as they're concerned, they're left in the authentication cold. 26:56.460 --> 26:58.900 And then the standards, they're half-assed to begin with. 26:58.900 --> 27:01.860 And then how they're implemented, that's half-assed as well. 27:02.480 --> 27:07.400 And then, of course, everybody has this acronym knowledge. 27:07.700 --> 27:11.980 Everybody has a degree in acronyms now, and they use the acronyms to secure their networks. 27:12.460 --> 27:13.340 Right? 27:13.360 --> 27:16.320 I have an EAP-protected network, really. 27:17.180 --> 27:18.300 Hallelujah. 27:18.800 --> 27:21.860 I use a VPN to secure my wireless, really. 27:22.780 --> 27:25.180 How did you deploy that VPN? 27:25.180 --> 27:27.360 In what configuration is that VPN? 27:27.360 --> 27:29.700 Which EAP are you using? 27:30.900 --> 27:32.680 Choose a mobile network with care. 27:34.880 --> 27:36.940 Choose a mobile network at random. 27:40.430 --> 27:43.150 How the fuck does the user know? 27:43.850 --> 27:45.510 Really, how? 27:46.510 --> 27:48.450 Let's look at a rogue access point attack. 27:48.450 --> 27:49.830 Graphical, we've seen this. 27:49.830 --> 27:50.990 Defcon, two years ago. 27:50.990 --> 27:53.030 Unfortunately, the press just caught on this year. 27:55.450 --> 28:00.650 Wi-Fi card comes in, gets disassociated by an access point that's closer or stronger. 28:00.830 --> 28:07.630 SSID effectively becomes bad guy, and this, before Windows XP Service Pack 2, would occur without the user's knowledge. 28:07.730 --> 28:10.850 Now, with Service Pack 2, it tells you when the SSID changes. 28:10.850 --> 28:11.710 Ooh. 28:13.730 --> 28:15.130 Rock on. 28:17.270 --> 28:22.090 So nobody can forge an SSID or duplicate an SSID or a MAC address or any of that. 28:22.090 --> 28:23.530 So, rogue access point attacks. 28:23.530 --> 28:37.170 When you're choosing your Wi-Fi weapon, normal gear running at 14 dBm, Cisco gear running at 20 dBm, Sineo gear running at 23 dBm, throw on a nice little directional antenna, you get 15 dBd and 38 dBd total. 28:37.170 --> 28:38.370 Six watts! 28:38.370 --> 28:40.710 Versus 25 milliwatts. 28:40.710 --> 28:42.710 You will win every time. 28:43.630 --> 28:48.950 There's no way that somebody's going to actually get on to the other access point, the legitimate access point. 28:48.950 --> 28:49.690 They're mine. 28:50.490 --> 28:53.110 So we have things that you can display, such as Hotmail. 28:53.110 --> 28:54.510 That's not Hotmail. 28:57.820 --> 28:59.320 You have other things, like PayPal. 28:59.320 --> 29:00.680 That's not PayPal. 29:02.860 --> 29:04.480 And at airports. 29:04.700 --> 29:06.220 That's pretty interesting. 29:06.320 --> 29:07.980 You're seeing this across the country. 29:07.980 --> 29:09.580 Joe's Wireless Hotspot. 29:09.580 --> 29:11.380 I don't know who they are. 29:12.880 --> 29:13.820 Done. 29:14.940 --> 29:17.400 Rogue access points are not going to go away. 29:17.400 --> 29:23.440 Users are going to be users, and they will fall victim to being drawn over to impersonating access points. 29:23.440 --> 29:29.680 If you didn't notice, phishing, identity theft, on the rise. 29:29.820 --> 29:32.760 Wireless hotspot usage, on the rise. 29:33.220 --> 29:36.640 Apparently, some people, like Gartner, feel that that's not a threat. 29:36.640 --> 29:37.480 It's overblown. 29:37.480 --> 29:39.280 Gartner can blow us. 29:40.340 --> 29:41.880 This is a problem. 29:42.060 --> 29:43.240 Pay attention. 29:45.060 --> 29:46.560 It gets worse. 29:47.020 --> 29:48.080 Rogue radius. 29:48.560 --> 29:54.620 So you secure your nice little network with EAP, and there's a nice little acronym bonanza with regards to EAP. 29:54.620 --> 29:59.380 Who says that rogue access points can't be used against wireless corporate networks that are using EAP? 29:59.840 --> 30:04.340 Plenty of ways to screw EAP up, and they allow for things such as EAP peaking. 30:04.360 --> 30:05.840 That's my new term for it. 30:06.500 --> 30:08.380 This is kind of how EAP works. 30:08.980 --> 30:11.160 You say, hey, I want to join the network. 30:12.320 --> 30:15.420 Access point replies back and says, hey, who the hell are you? 30:15.420 --> 30:16.700 You send your identity. 30:17.240 --> 30:18.960 Radius server validates that. 30:18.960 --> 30:20.220 Gives you a dynamic key. 30:20.220 --> 30:21.500 Allows you onto the network. 30:21.760 --> 30:25.780 There are variations of EAP, such as EAP TTLS. 30:26.660 --> 30:28.820 EAP TTLS, very similar. 30:28.840 --> 30:31.380 You have your 802.11 authentication association. 30:31.380 --> 30:33.320 EAP protocol exchange. 30:33.320 --> 30:34.800 TTLS protocol exchange. 30:34.800 --> 30:37.220 A nice little secure tunnel is established. 30:37.900 --> 30:41.280 And through that secure tunnel, that's where you pass your credentials. 30:41.980 --> 30:44.660 And everything else happens like it's supposed to. 30:45.220 --> 30:47.740 Ah, what's the weakness here? 30:47.780 --> 31:03.020 If you have a previous EAP TTLS authentication established, and a rogue access point with a radius server comes in, and you are not doing remote certificate checking, and or loose checking, disassociated, and of course, what you do is associate, authenticate, 31:03.020 --> 31:10.880 set up EAP TTLS, secure tunnel, and then you pass your credentials over the secure tunnel to the wrong person. 31:12.980 --> 31:14.960 So, how do you actually implement this? 31:14.960 --> 31:20.740 EAP TTLS with PAP, which is a variation that you can probably Google for. 31:21.180 --> 31:26.360 Windows XP Service Pack 2 using EAP TTLS with PAP, probably using a phone client. 31:26.360 --> 31:40.380 You have your rogue radius server come in, rogue access point disassociates users, learns username and password of every user that's on the access point at that time, disassociates them, copies the credits to the local EAP config, and then impersonates the victim. 31:41.580 --> 31:42.580 Google! 31:43.100 --> 31:47.600 You can find plenty of educational institutions that are using EAP TTLS with PAP. 31:48.860 --> 31:55.880 Ah, but there's a different vulnerability as well, because Microsoft provides something secure and protected EAP. 31:56.020 --> 32:00.660 And when it's used with client certificates, server certificates, rock on. 32:01.380 --> 32:03.600 But PKI is to suck. 32:04.780 --> 32:07.000 Nobody can get it right in the wired world. 32:07.000 --> 32:09.920 How in the world are we going to get PKI right in the wireless world? 32:09.920 --> 32:18.760 And so, we provide the nice little option for people to use their username and password over a secure tunnel to associate to wireless networks. 32:19.000 --> 32:29.940 If you don't validate the server certificate and or you don't check all of the certificate stores in the normal store for Windows, you are a victim to a peep attack. 32:29.940 --> 32:43.760 In this case, what you do is disassociate all the users, learn the domain and username immediately with your rogue access point and radius server, disassociate them again, seed the local password file with a bogus password. 32:43.960 --> 32:48.140 Windows XP Service Pack 2 is kind enough to keep re-associating to you. 32:48.240 --> 32:51.120 Over and over and over. 32:51.120 --> 32:54.880 And as they do, they keep providing their username and password. 32:54.880 --> 32:58.460 It's only part of the password, so it's difficult for you to get it, right? 32:58.460 --> 33:06.720 Until your dictionary stumbles upon their correct password, they authenticate successfully to you and bang, you have their username and password. 33:06.720 --> 33:09.440 MS Chat V2 does not protect against this. 33:10.660 --> 33:12.660 Wireless weaponry for Windows. 33:13.380 --> 33:15.100 Rogue access point attacks. 33:15.100 --> 33:18.240 Only in use by sophisticated hackers, right? 33:18.480 --> 33:22.720 Because it's so hard to set up an access point and give people the internet. 33:23.680 --> 33:25.240 Wireless access points? 33:25.300 --> 33:26.800 Easy to set up. 33:27.320 --> 33:30.460 If you want to set it up on one Windows laptop, you can do it. 33:30.480 --> 33:32.600 Evil twin access points for dummies. 33:32.940 --> 33:35.620 You can see it airsnarf.shmoo.com, airsnarf4win. 33:35.700 --> 33:36.660 html. 33:37.060 --> 33:43.500 But why should you run only one access point or one rogue access point when you can run one, two, three? 33:44.060 --> 33:45.300 Rogue Squadron. 33:45.400 --> 33:50.160 Because it's so hard for people to run airsnarf, which is a shell script. 33:51.600 --> 33:53.860 Rogue access point set up for the masses. 33:53.860 --> 33:59.320 It's a modified WRT54G firmware based off of EWRT, adds a username and password. 33:59.880 --> 34:02.280 Capture and logging looks like this. 34:13.090 --> 34:16.250 It's the first firmware release from the shmoo group. 34:19.510 --> 34:23.690 We had shmoo hot interns working on this all night. 34:25.410 --> 34:26.010 There you go. 34:26.010 --> 34:28.590 It's basically using captive portal or no cat. 34:28.970 --> 34:39.670 Allows you to set up a captive portal, people associate, and no matter what site that they go to, just as we've demonstrated before, you redirect them to the local captive portal, ask for their username and password. 34:39.770 --> 34:47.670 I'm not going to describe how easy it would be to modify this to display a T-Mobile graphic. 34:49.170 --> 34:50.970 Username and password entered. 34:51.410 --> 34:56.450 All you do is log into the box later on, SSH, dump your passwords, you're gone. 34:56.470 --> 35:00.850 Airsnarf.shmoo.com slash rogue underscore squadron is where you can get that. 35:02.410 --> 35:04.210 And here's Rodney! 35:04.310 --> 35:05.090 Thanks. 35:13.370 --> 35:14.450 So I'm lazy. 35:14.450 --> 35:16.470 I don't actually usually try to break things. 35:16.470 --> 35:21.910 Well, I break things once in a while, but usually I just look at vendors' products because they're broken enough, so why not just have fun with them? 35:22.650 --> 35:25.510 So anyway, never let Beetle type your slides. 35:26.030 --> 35:29.590 Shooting your security wad, which was about broken products. 35:29.590 --> 35:31.470 Okay, so what am I ranting about? 35:31.570 --> 35:33.490 You know, I have to keep up with the crowd here. 35:33.490 --> 35:42.090 So I've been doing product reviews, I do public ones, I do private ones, you know, take a box, set it up in a conference room, test it for a week, it goes off in a corner gibbering, hopefully I get some money out of it . 35:42.710 --> 35:44.890 People put out really lame features. 35:44.890 --> 35:50.290 I'm going to, if I can get this thing with a fruit in the front to back up, back up to this slide of beetles . 35:50.290 --> 35:51.370 I'm going to steal one here. 35:51.750 --> 35:52.790 Come on , buttons. 35:53.650 --> 35:54.510 Back up here. 35:54.510 --> 36:02.150 So with this Microsoft Windows, they ship you a security product that says, do you want to validate the server certificate? 36:02.150 --> 36:04.230 They let you turn that off. 36:04.270 --> 36:06.870 This is in the standard shipping product. 36:06.870 --> 36:08.130 What were they thinking? 36:08.610 --> 36:10.010 I mean, it's crypto, right? 36:10.010 --> 36:11.630 We do it or don't, we yell at people. 36:11.630 --> 36:15.910 Do you want a button in your browser that says, oh, just turn off all the crypto, it doesn't really matter. 36:16.930 --> 36:18.030 They weren't thinking. 36:18.030 --> 36:20.650 Well, they were thinking about something like money probably. 36:21.430 --> 36:23.670 But anyway, you know, vendors do things like this. 36:23.750 --> 36:25.450 Microsoft's certainly not the only one. 36:25.450 --> 36:29.070 Anyway, we see incredibly features that go by. 36:29.070 --> 36:35.370 I mean, you know, people who build firewalls that you can get to by clear text HTTP because no bad guy would ever get on your management land. 36:35.370 --> 36:36.470 Just never happens. 36:36.790 --> 36:45.610 So what we tell you is something, I wrote this slide way before the teal camo shock troops with their boot knives came in and cut pages out of the presentations. 36:46.370 --> 36:50.070 There's a risk of Ford Pinto gas tank syndrome, which I call FPGS. 36:50.090 --> 36:59.650 This was something that happened a long, long time ago where some bean counter at Ford to say that they could save a penny per car by changing the bolts in the gas tank, which gave them this really interesting characteristic that if you ran into the back of a Ford Pinto, 36:59.650 --> 37:00.810 the gas tank exploded. 37:00.950 --> 37:02.790 Most people involved were unhappy. 37:03.570 --> 37:08.450 And, you know, lawyers figured this out and eventually the memos came out and Ford got sued and they don't do that anymore. 37:08.450 --> 37:09.910 Well, we hope they don't do that anymore. 37:09.950 --> 37:11.210 Of course, now we build plastic cars. 37:11.210 --> 37:12.650 You just look at them and they fall apart. 37:13.510 --> 37:19.470 Anyway, so I ask these really hard questions of vendors and the vendors get all freaked out when I ask them these things. 37:19.510 --> 37:20.950 Now, remember, I'm not a hacker. 37:20.950 --> 37:22.190 I just play one on the internet. 37:22.210 --> 37:25.130 I mean, I do my own stunts, but I'm just playing one on the internet here. 37:25.130 --> 37:27.150 I'm not really as scary as most of you guys are. 37:27.190 --> 37:30.390 Anyway, so, like, does your product produce an external log? 37:30.390 --> 37:31.870 Now, apparently, this is hard. 37:31.990 --> 37:32.690 So, think about it. 37:32.690 --> 37:34.270 So, I have these IDS products. 37:34.270 --> 37:35.650 I power off the box. 37:35.710 --> 37:36.850 Go do my bad things. 37:36.850 --> 37:37.830 Power the box back on. 37:37.830 --> 37:40.050 It doesn't generate any messages when it gets powered back on. 37:40.050 --> 37:41.670 It just starts talking again. 37:41.670 --> 37:44.090 And so, I would think that would be a simple message to generate. 37:44.090 --> 37:45.310 This is apparently hard. 37:45.970 --> 37:48.350 Do you have a security incident reporting mechanism? 37:48.350 --> 37:56.370 Yes, I wrote this slide a long time ago before some people did some things that made some people's incident response teams, um, cause us to question them. 37:56.370 --> 37:57.450 Let's just say it that way. 37:57.630 --> 37:59.370 Um, some people don't even have things. 37:59.370 --> 38:03.410 I mean, there are many worse vendors out there than, you know, Cisco, Microsoft, that type of character. 38:03.530 --> 38:05.930 Do you store your key material securely? 38:05.930 --> 38:12.950 So, after you've got this access point or radius or whatever box it is with wireless, if your private key's in the clear, uh, so, what was the point? 38:12.950 --> 38:15.450 You know, if you don't keep the thing secure, I mean, there's a whole bunch of crypto. 38:15.450 --> 38:16.790 We've been doing this for 20 years. 38:16.790 --> 38:18.090 You should be able to figure this out. 38:18.270 --> 38:19.450 Do you have a management interface? 38:19.450 --> 38:20.390 Is it secure? 38:20.930 --> 38:25.050 I, you know, sitting on the phone with somebody doing a firewall audit, and I say, what do the firewall rules look like? 38:25.050 --> 38:29.530 And the CEO orders the IT geek to let me telnet into the box from the public internet. 38:30.290 --> 38:33.690 I'm like, uh, I don't need to know what your firewall rules are anymore, dude. 38:34.050 --> 38:36.390 Um , telnet's not too, too common. 38:36.390 --> 38:38.510 We still have SSH1, which is breakable. 38:38.590 --> 38:40.230 There's a lot of clear text HTTP. 38:40.270 --> 38:41.570 There were vendors at Black Hat. 38:41.570 --> 38:43.610 We're a studly, we have a booth at Black Hat. 38:43.610 --> 38:45.250 Let me show you our management interface. 38:45.250 --> 38:47.270 HTTP colon slash slash. 38:47.270 --> 38:49.630 So it's like, uh, that's not secure. 38:49.650 --> 38:53.690 You know, building a steel door and a grass hut doesn't actually stop very many people. 38:53.690 --> 38:57.830 It only stops the people without the lighters and half the hackers smoke, so like, get over it. 38:58.650 --> 38:59.330 Alright. 38:59.530 --> 39:02.070 Security products should not make things worse. 39:02.170 --> 39:05.890 Uh, they should not increase the attack surface, to use somebody's buzzwords. 39:06.070 --> 39:09.170 People keep doing central failure, central server, central failures, yeah. 39:09.170 --> 39:12.070 Central servers, which is a nice single point of failure. 39:12.070 --> 39:14.630 And then they wonder why we attack the servers, you know. 39:14.630 --> 39:23.430 I do these reviews where they go, you know, 10,000 clients or I'll have policy enforcement and we have one box in the middle that we have old copies of SSH on and clear text access to and all these things. 39:23.430 --> 39:25.810 Gee, the hackers figure out it's a target. 39:25.810 --> 39:26.910 What a surprise. 39:27.390 --> 39:30.390 Um, people should communicate securely among the components. 39:30.390 --> 39:35.030 Again, you know, do product reviews and people send all sorts of information back and forth in the clear. 39:35.030 --> 39:38.590 And that's if you don't fuzz it or replay attack it or things like that. 39:38.750 --> 39:41.010 And they run sloppy distros, you know. 39:41.070 --> 39:47.990 Download Linux, put it on a box, you know, paint the front of the box some sexy color because you hired the marketing department to make up a logo. 39:48.050 --> 39:51.090 You did all this four years ago before you got venture funding. 39:51.230 --> 40:01.610 So, you know, this thing gets into the field and suddenly I'm some sort of obnoxious rocket scientist because I noticed they're running Red Hat 5.2, you know. 40:01.610 --> 40:06.710 And it's like, it's okay because it's a policy enforcement product from a big router vendor or a big, whatever software vendor. 40:07.070 --> 40:08.610 So, you know, sloppy distributions. 40:08.610 --> 40:09.450 We will notice. 40:09.450 --> 40:12.470 People do Telnet to port 22 and read the banners. 40:12.510 --> 40:13.930 It's actually not that hard. 40:13.930 --> 40:15.930 Apparently the vendors don't think any of us know this. 40:15.930 --> 40:17.370 You need to promote this fact. 40:18.230 --> 40:19.410 Stupid vendor tricks. 40:19.410 --> 40:20.970 Logging, logging when they start up. 40:20.970 --> 40:22.810 There's all sorts of log analysis tools out there. 40:22.810 --> 40:23.750 That's really nice. 40:23.750 --> 40:25.750 Can we now have some logs to analyze, please? 40:26.150 --> 40:33.210 You know, do a scan on a box that does some sort of SSL web server balancing, you know, get no logs out. 40:33.210 --> 40:37.390 Go to the vendor and say, what's the knob I set to the position so I can see when the attacks happen? 40:37.390 --> 40:38.610 They go, oh, there's no logging. 40:38.610 --> 40:39.550 That's a feature. 40:40.090 --> 40:43.190 You know, and like, how are we supposed to know there's a problem here anymore? 40:43.490 --> 40:44.910 People do self-signed certificates. 40:44.910 --> 40:46.750 I have a homework assignment for all of you. 40:46.750 --> 41:00.390 Somebody please take a copy of Ettercap and when you get when you grab the self-signed certificate out of the Linksys box or one of various other things, please change the text and generate a new certificate so you look exactly like the vendor's cheesy self-signed certificate that they won't replace. 41:00.510 --> 41:07.850 And because man-in-the-middle attacks are quite possible, a self-signed certificate is only marginally better than no certificate at all because anybody can make these things up. 41:08.290 --> 41:09.910 People don't put change control in. 41:09.910 --> 41:19.470 Everybody wants to have a GUI so they can be hot and bothered during the demo to make sure they can click on things and it's all multi-colors and they're teal blue and cute and red and black and blinking and all these things, but you can't do change control. 41:19.470 --> 41:21.070 How about a little command prompt once in a while? 41:21.070 --> 41:22.030 Something like that? 41:22.450 --> 41:23.730 Incoherent documentation. 41:23.730 --> 41:29.810 I have a VPN box I have to manage for a very, very large customer with many dozens of class B addresses. 41:29.890 --> 41:31.310 I printed out the manual. 41:31.310 --> 41:34.570 The manual's 1078 pages long. 41:34.570 --> 41:37.210 I'm not sure anybody's ever read the whole manual. 41:37.650 --> 41:39.590 And then there's a user interface on top of that. 41:39.590 --> 41:42.010 I mean, has anybody actually figured out how juniper zones work? 41:42.030 --> 41:44.530 There's a lot of these things that are very strange. 41:44.750 --> 41:48.030 It would be nice if the vendors followed the protocol specs once in a while. 41:48.190 --> 41:53.450 You know, I do these voice over IP security classes and I have a domain name, tissue samples from the crater wall dot net. 41:53.490 --> 41:56.070 That's actually a valid domain name, yes I really own it. 41:56.110 --> 42:00.410 That character string is too long for most products because I mean, they didn't read the protocol spec. 42:00.410 --> 42:03.050 And DNS has been around since, what, Lincoln was president? 42:03.050 --> 42:05.690 Um, you know, could we please follow the protocol specs? 42:05.690 --> 42:12.690 At least before you go cook up some your own stupid proprietary protocol that's on top of it that's better because your EAP method's better than the standard EAP methods? 42:12.690 --> 42:15.770 Not that the standard ones are that good, but at least could we all use the same ones? 42:15.770 --> 42:17.910 We should all at least be in the same leaking rowboat. 42:19.370 --> 42:20.770 Alright, things you should try. 42:20.770 --> 42:23.270 Now this sounds really cheesy and stupid, but you can make money doing this. 42:23.270 --> 42:24.170 It's very odd. 42:24.250 --> 42:26.410 Um, run nmap and nnessus. 42:26.410 --> 42:31.710 You know, half the time I run nnessus, like, you know, some box in the network will go jump off the corner and reset to factory defaults. 42:31.710 --> 42:40.450 Now, since we all know how to download these things and run them, and the bad guys do, and so do the children in high school or elementary school, or they're teaching in kindergarten now, probably. 42:40.770 --> 42:43.390 Um, you know, yeah, you're learning kindergarten, I'm sure. 42:43.390 --> 42:46.370 So, I mean they should be able to survive little things like this. 42:46.370 --> 42:48.290 This apparently is news to a lot of the vendors. 42:48.390 --> 42:55.190 Uh, the vendors don't tend to go there are vendors, actually, there are vendors here at Black Hat they tend to be doing things like hiding in very loud Hawaiian shirts, but they do walk around. 42:55.190 --> 42:56.570 They're the ones with the good haircuts. 42:56.690 --> 42:59.750 Um, anyway, tell net to port 22 and read the banner. 42:59.750 --> 43:02.670 That's a really exotic way of doing a security analysis. 43:02.730 --> 43:04.790 Unfortunately, that gets me a lot of information. 43:04.790 --> 43:08.010 You know, I write these product reviews and I'm the token hacker and it's all very scary. 43:08.030 --> 43:10.290 I tell net to port 22 and read the banner. 43:10.450 --> 43:11.650 I mean, it's really, really hard. 43:11.650 --> 43:13.870 And I do this over and over again, in print. 43:13.870 --> 43:16.370 And the vendors who follow them don't actually figure it out still. 43:16.370 --> 43:18.130 It's like, you'd think they would notice this stuff. 43:18.530 --> 43:20.650 Another one, try to look at doing crypto. 43:20.650 --> 43:22.210 Crypto, apparently, is hard. 43:22.210 --> 43:25.890 Thank god the hackers think it's hard because they don't steal the private keys as much as they could. 43:26.290 --> 43:28.530 Open SSL, turn on SSL 2. 43:28.530 --> 43:33.310 Is there any redeeming social value in running SSL 2 in anything on the public internet today? 43:33.310 --> 43:34.650 I don't think there is. 43:34.650 --> 43:36.590 But there's lots of products still supporting it. 43:36.930 --> 43:38.530 Go after the web interface. 43:38.530 --> 43:43.350 There's like 5 billion people up and over from the dot-com boom who know how to write broken HTML. 43:43.370 --> 43:48.050 And about half of them are working for vendors building sophisticated web-based management interfaces. 43:48.730 --> 43:56.350 And they've got cross-site scripting and forms you can blow up and fields you can fill in 2,000 A's and they jump into a corner and psych vault and all these kinds of things. 43:56.350 --> 43:57.430 Etter tap. 43:57.690 --> 43:58.950 Man in the middle of the boxes. 43:58.950 --> 44:01.690 I mean, if they don't secure the connections, you can man in the middle of the things. 44:02.050 --> 44:03.610 Go look for a random exploit. 44:03.610 --> 44:05.850 This is something they don't seem to think anybody would do. 44:05.910 --> 44:11.110 I'm testing a product and I'm reading security focus, various random mailing lists, and an exploit will come out. 44:11.170 --> 44:12.910 I don't care if it's old or new. 44:12.910 --> 44:15.770 Go try it on the thing you're trying to use or trying to evaluate. 44:15.910 --> 44:18.610 Apparently, nobody expects you to actually keep up with the current news. 44:18.610 --> 44:22.430 You're supposed to buy a product, move into a cave, and run it there for the next 20 years. 44:22.470 --> 44:24.230 Everybody runs iOS 11.4, right? 44:24.230 --> 44:26.130 That's close to the current rev, definitely. 44:26.390 --> 44:28.310 So, try the current stuff. 44:28.310 --> 44:30.170 You know, the bad guys might try the current stuff. 44:30.170 --> 44:33.850 That's sort of why they're called zero days, the ones that are even more current than the current ones that are known. 44:33.850 --> 44:35.570 You'd think you'd figure this out. 44:36.250 --> 44:38.710 It's really easy to go after a lot of products. 44:38.710 --> 44:39.610 It's pretty stupid. 44:39.610 --> 44:41.390 It's embarrassingly stupid. 44:41.750 --> 44:44.850 And vendors just assume nobody would actually do this. 44:44.850 --> 44:51.550 There are no real ha- I mean, there's nobody goes to de- there are not 500 people in a tent in a parking lot in Las Vegas right now talking about hacking. 44:51.550 --> 44:52.270 Doesn't happen. 44:52.270 --> 44:54.230 You just heard it on the internet, it's a bad rumor. 44:54.230 --> 44:55.890 It just really isn't happening. 44:56.670 --> 45:00.170 You know, so I mean, everybody's really just sweetness and light and just leaves the networks all alone. 45:00.170 --> 45:02.930 And the bad guys, of course, are much more gentle than we are, right? 45:02.930 --> 45:03.610 We all know that. 45:03.610 --> 45:05.190 You know, they're much more gentle than we are. 45:05.290 --> 45:05.890 Anyway. 45:06.530 --> 45:06.990 Alright. 45:06.990 --> 45:08.330 How can you make things better? 45:08.410 --> 45:10.610 So, you know, this is actually the stock slide. 45:10.610 --> 45:11.730 I decided to leave this one good. 45:12.710 --> 45:13.830 How can you make things better? 45:13.830 --> 45:18.990 Well, we're trying to be educated consumers here, so test things, you know, try to actually do something and figure out how to make it better. 45:18.990 --> 45:20.130 Try to report bugs. 45:20.130 --> 45:23.790 I mean, if the vendor is so much of a bimbo that's going to yell at you for reporting them, that's their problem. 45:23.790 --> 45:26.430 You should still try to figure out how to report the bugs reasonably. 45:26.790 --> 45:30.050 If you can get one of these things to break, if you can find something breaking, give me a paper. 45:30.110 --> 45:31.990 I'm on the program committee for ShmooCon. 45:32.110 --> 45:33.190 Give me a paper. 45:33.350 --> 45:36.110 All of our papers starts today, as of right now. 45:36.130 --> 45:38.630 It's on the website, www.shmoocon.org. 45:38.910 --> 45:41.470 We'll have paper copies we'll put out there afterwards. 45:41.730 --> 45:44.310 But you find something you can break, we want it to break a track. 45:44.310 --> 45:45.330 You're going to give me the book here? 45:46.690 --> 45:48.230 He's going to stand up here and harass me. 45:48.290 --> 45:49.310 Okay, I just got one more slide. 45:49.310 --> 45:49.990 You can take it. 45:50.430 --> 45:51.290 Hey, yeah, definitely. 45:51.290 --> 45:52.370 Right, I'll get the book later. 45:52.890 --> 45:54.610 You just, you know, you just wait. 45:55.890 --> 45:56.910 You're the time Nazi. 45:56.910 --> 46:00.670 Yeah, well, some of us had to be the time Nazi when you were standing up here, you know, going through, flashing things. 46:01.670 --> 46:03.770 Report flaws, document the risks. 46:04.010 --> 46:07.410 People say, you know, I say, my God, you run HTTP on the management interface. 46:07.410 --> 46:09.870 And the blender goes, nobody's ever said that to me. 46:09.870 --> 46:11.250 We think it's just fine. 46:11.250 --> 46:12.550 Everybody loves this. 46:12.550 --> 46:13.370 It's bullshit. 46:13.370 --> 46:17.830 Anyway, disrupt future purchases of insecure equipment. 46:18.090 --> 46:20.110 The only way they're going to understand is the money. 46:20.110 --> 46:22.890 If they ship lame shit, don't buy it. 46:22.890 --> 46:24.430 Make sure they lose sales. 46:24.430 --> 46:26.790 If it hits their pocketbook, they'll understand. 46:27.170 --> 46:30.990 And the other side of it is encourage future purchases of clueful stuff. 46:30.990 --> 46:34.830 If you find gear that's secure and works well, make sure it gets bought again. 46:34.950 --> 46:37.410 And make sure you show things are easy to break. 46:37.410 --> 46:39.190 People don't believe this stuff can happen. 46:39.190 --> 46:40.470 Nobody would crack DES. 46:40.470 --> 46:42.730 Nobody would build a rainbow table to crack Landman. 46:42.790 --> 46:43.890 Landman's perfect. 46:44.210 --> 46:46.270 Nobody would actually do any of these things. 46:46.270 --> 46:48.630 Nobody ever actually tries to break SSH1. 46:48.630 --> 46:53.070 It's just, there's all this mythology out there that nobody actually tries to go after any of these things. 46:53.090 --> 47:00.010 So, there's a lot of things you can do and there's a lot of lame products out there and it's low-hanging fruit, I know, but we should get rid of the low-hanging fruit. 47:00.010 --> 47:06.810 You know, we should have to spend more time listening to them doing exotic tables than listening to me be a scary guy because I can skel-telnet to port 22. 47:06.810 --> 47:08.130 Here you go. 47:08.930 --> 47:10.850 Man, I love listening to him rap. 47:10.850 --> 47:12.530 That's ridiculous. 47:16.020 --> 47:16.700 Okay. 47:17.000 --> 47:23.940 Before we get to kick-ass zero day, we built some gear last year. 47:23.960 --> 47:25.300 Actually, the year before that, we built some gear. 47:25.300 --> 47:26.300 We had the robot. 47:26.680 --> 47:29.200 We had 82.11 bounce. 47:29.540 --> 47:30.680 We had the sniper Yagi. 47:30.680 --> 47:31.460 Tissue box. 47:31.880 --> 47:40.740 Some of us had to move the sniper Yagi across interstate lines in a car and, I mean, I had to drive the speed limit at Defcon, dude. 47:40.740 --> 47:41.880 It really sucked. 47:42.340 --> 47:47.160 So, I told you we'd bring some gear and we did. 47:47.840 --> 47:49.680 Cowboy, show them what you got. 47:50.480 --> 47:52.000 This is the 802.11. 47:54.300 --> 48:04.420 This is a 9 DBI flat panel antenna back-ended by a 1 watt amp with a 0 to 100 DBI rotary select attenuator that allows you to direction find. 48:04.420 --> 48:05.160 You can see her. 48:07.980 --> 48:09.960 You mean it doesn't go to 11? 48:10.420 --> 48:11.960 That's messed up, man. 48:14.020 --> 48:17.580 For those of you that can't see it real close, we've got some actual close-up pictures. 48:17.580 --> 48:22.700 We made sure that we got these done once we got on site, so there's some of that doodoo brow background. 48:25.820 --> 48:28.160 We've got a few things that are a little bit better than that. 48:28.680 --> 48:30.320 Yeah, it's battery powered. 48:31.500 --> 48:32.820 She likes that. 48:34.520 --> 48:36.640 Is the tattoo battery powered? 48:37.580 --> 48:38.580 Thank you to all our models. 48:38.580 --> 48:40.460 Mike will tell you, don't touch the heat sink. 48:40.460 --> 48:43.960 We don't pay any of our models like those NMRC guys. 48:44.960 --> 48:45.780 Here she is. 48:45.780 --> 48:47.960 She's wearing one of the new ShmooCon 2006 shirts. 48:47.960 --> 48:48.600 Right on, baby. 48:48.600 --> 48:50.820 And you can dunk her for the FF too. 48:51.500 --> 48:52.600 Great stuff. 48:53.020 --> 48:56.420 Yeah, the 802.11 bloodhound for direction finding. 48:56.480 --> 49:01.700 Like I said, all of it back-ends into an iPAQ, which you're running either familiar or Pocket PC on. 49:01.700 --> 49:04.080 Run your basic wireless discovery utility. 49:04.380 --> 49:07.960 But, what you can do is long-range shots and it's hand-held. 49:07.980 --> 49:09.260 You can go dual-handed. 49:09.260 --> 49:10.160 That's pretty cool too. 49:10.160 --> 49:14.260 If you really want to just be Steven Seagal or some other... 49:16.800 --> 49:18.160 It's balanced. 49:18.240 --> 49:19.500 Check it out, baby. 49:19.940 --> 49:21.460 It sticks right there. 49:25.760 --> 49:33.840 So, apparently, Mike was hanging out with one of these in the car, turned on, and drove by a cop. 49:38.970 --> 49:41.330 So, he got pulled over, right? 49:41.850 --> 49:42.790 No, we didn't get pulled over. 49:42.790 --> 49:44.430 Actually, I was in the car with the cop. 49:44.450 --> 49:45.370 Oh, really? 49:46.250 --> 49:47.670 And the guy next to us... 49:48.690 --> 49:54.930 And we rolled down our window and he says, yeah, man, that thing's been sitting off my radar detector for two miles. 49:56.690 --> 49:59.830 Apparently, he thought we were test-driving the new radar gun. 50:02.550 --> 50:03.570 That's hot. 50:03.570 --> 50:04.650 And I really mean literally. 50:04.650 --> 50:05.230 It's hot. 50:05.230 --> 50:07.530 You don't want to touch certain parts of it. 50:08.870 --> 50:11.310 And when you aim it at people, I guess they get hot too. 50:11.310 --> 50:12.170 She's hot. 50:15.290 --> 50:16.090 Alright. 50:16.550 --> 50:21.510 So, if you want to check out some of the 802.11 Bloodhound later on, just meet up with Mike. 50:21.510 --> 50:23.050 He'll describe it in more detail. 50:23.050 --> 50:24.350 It's sexy stuff. 50:25.170 --> 50:31.610 I'm supposed to be participating in one of the award-driving teams, and we were a little short on gear, so I decided to bring some. 50:31.610 --> 50:32.630 And there you go. 50:32.630 --> 50:34.050 Thanks a lot, Mike, for building that. 50:34.050 --> 50:34.810 Thank you. 50:40.930 --> 50:44.750 So, I'm just going to introduce Kaz. 50:44.750 --> 50:49.550 Kaz has a zero-day for Metasploit, Canvas, and Kismet. 50:52.710 --> 51:00.110 Well, last year I came and wasn't really supposed to talk, and they convinced me to talk five minutes before we gave a presentation. 51:00.110 --> 51:02.810 The only person to release a zero-day last year in WPA. 51:02.810 --> 51:05.510 So, I released a zero-day in WPA last year. 51:05.910 --> 51:09.170 So, I decided to go ahead and release another zero-day. 51:10.390 --> 51:14.050 I recently started a new industry. 51:14.050 --> 51:16.370 This is Pot Kettle Industries. 51:17.010 --> 51:18.890 We're looking for the Gartner report. 51:20.170 --> 51:21.870 I'm still looking for VC. 51:21.870 --> 51:24.270 If you're a VC, come talk to me afterwards. 51:24.290 --> 51:26.090 So, what does Pot Kettle Industries do? 51:26.090 --> 51:27.950 We exploit the exploiters. 51:27.950 --> 51:35.870 One of the things that I'm really tired of doing is finding all these exploits that are published on full disclosure and full nav that are full of holes. 51:35.910 --> 51:40.370 Y'all talk about how everybody else's shit sucks, but your shit's worse. 51:41.550 --> 51:46.590 I don't know how many of you read the source code of shit that hits full disclosure. 51:46.790 --> 51:50.170 Almost all of it is vulnerable at some point in time. 51:50.290 --> 51:53.770 So, I decided to start writing exploits for the exploits. 51:53.770 --> 51:57.470 I haven't quite figured out how I'm going to profit, but it's in the business plan. 51:57.810 --> 51:59.850 Peel all the underpants. 52:02.670 --> 52:05.190 I'll let you go ahead and do that for me, Paulos. 52:06.770 --> 52:10.870 Alright, so the first exploit that we released is in a multi -HTML. 52:10.970 --> 52:13.350 It's a remote exploit released by Banshee. 52:13.450 --> 52:15.050 Supposedly , Banshee is supposed to be here today. 52:15.050 --> 52:16.070 Are you here today? 52:16.650 --> 52:18.910 I have a sticker for you. 52:19.750 --> 52:22.830 I released an exploit and it got owned . 52:23.570 --> 52:24.890 Got owned. 52:26.110 --> 52:29.490 I have asked for a CVE and it has been granted. 52:29.490 --> 52:32.810 I have the first CVE for vulnerability in an exploit. 52:35.350 --> 52:38.770 And I have an exploit available for that right here. 52:40.770 --> 52:51.710 So today, or for the last couple of weeks, they've been asking me to look at Kismet to try and find some vulnerabilities so we can exploit other people during the DEF CON war driving contest this week. 52:54.050 --> 52:55.690 That's top secret. 52:55.690 --> 52:57.630 Those people are listening. 52:57.990 --> 53:01.010 Okay, we ought to return all the CDs. 53:01.010 --> 53:02.470 We're going to burn them and make new CDs. 53:02.470 --> 53:09.930 Please go to the Shmoo page in your conference program and tear it out with a razor blade right now. 53:09.930 --> 53:10.690 Throw it away. 53:10.690 --> 53:11.730 Do us a favor. 53:13.270 --> 53:26.630 Among many of the other vulnerabilities that I found in Kismet, some of them, Beatle's team is keeping private, and if you're running Kismet for this DEF CON war drive contest, you'll be owned. 53:26.730 --> 53:27.770 So don't. 53:30.850 --> 53:38.550 The easiest way to evade Kismet, like I said, I really believe in full disclosure and all that wonderful stuff and responsible disclosure. 53:38.950 --> 53:41.450 Sorry, I've been told I'm supposed to hold still. 53:43.150 --> 53:47.310 I believe in responsible disclosure except for people that are trying to own other people. 53:47.310 --> 53:55.650 Well, if you want to protect your network and somebody's attacking you and trying to find your network with Kismet, the easiest thing for you to do is to evade Kismet detection. 53:56.090 --> 54:01.170 What you're seeing on the screen right now is an fscanf from the Kismet client. 54:01.210 --> 54:04.470 This is what it does to read the packets that are coming from the Kismet server. 54:04.690 --> 54:24.990 I don't know how many of you can read C, but if you note in there, the first thing it's scanning is an integer and then it looks for a string that's enumerated it has the hex of 0-1 then the SSID and then the hex of 0-1 and then continues on as the scanf string. 54:25.250 --> 54:30.190 If you add hex of 0-1 to your SSID, guess what? 54:30.250 --> 54:35.190 Anytime Kismet sends your SSID across the network, it's not going to be seen. 54:35.350 --> 54:46.850 So if you want to keep your network protected from anybody using Kismet, make your SSID shmoo with a hex of 0-1 at the end of it, anybody using Kismet is not going to be able to see your access points now. 54:47.710 --> 54:48.150 Awesome . 54:54.880 --> 54:57.080 That's zero day number one. 54:57.940 --> 54:59.920 There are some buffer overflows in Kismet. 55:00.100 --> 55:02.420 The guy who wrote it was supposed to come to Defcon. 55:02.420 --> 55:05.760 He announced about two weeks ago that he's not coming. 55:05.760 --> 55:09.680 He's fixed two of the vulnerabilities that are in Kismet in the last two weeks. 55:09.700 --> 55:12.260 There's three more that are remotely exploitable. 55:12.260 --> 55:14.640 Don't be using Kismet over the next week. 55:14.640 --> 55:15.980 You will be owned. 55:15.980 --> 55:19.440 When was the last time you heard you should download the latest rev of the software? 55:20.660 --> 55:23.580 Download the latest patches for your exploits, kids. 55:27.460 --> 55:30.420 Patch management is not just for users anymore. 55:31.320 --> 55:33.680 How do I go back? 55:33.740 --> 55:35.080 Arrow keys? 55:35.500 --> 55:38.200 Shift, tab, control, delete. 55:38.880 --> 55:41.300 Have you used a computer? 55:41.300 --> 55:42.240 Whatever. 55:42.440 --> 55:44.800 We don't need no stinking slides. 55:44.800 --> 55:46.760 If it's not written in Perl, I don't know how to use it. 55:46.760 --> 55:48.180 Put the girls back on. 55:50.900 --> 55:52.560 There's the Kismet evasion. 55:52.660 --> 55:57.380 I have a really simple exploit for Metasploit in Canvas using H.G. 55:57.380 --> 55:59.340 Moore's exploitation technique. 56:00.100 --> 56:10.740 About two and a half years ago, he announced in an advisory that he was able to exploit various different companies by sending stuff into their Apache web server log. 56:10.760 --> 56:22.740 The Apache admins of those web servers were using things like tail-f and a vulnerable Xterm to launch commands using Xterm control characters. 56:22.740 --> 56:32.480 What his advisory said about two years ago was anybody writing any applications that take user input needs to filter out the user input. 56:32.480 --> 56:33.040 Well, guess what? 56:33.040 --> 56:35.760 Canvas and Metasploit take input. 56:35.840 --> 56:40.080 The way Metasploit works is all of their exploits do... 56:40.680 --> 56:50.460 If you do a check instead of an exploit, they will do a banner grab and then do a lame regular expression on the banner and then print what the banner was so you can validate it yourself. 56:50.860 --> 56:57.740 So all you have to do is match their lame regular expression and then print some control characters like H.G. 56:57.740 --> 56:59.500 Moore provided in his vulnerability. 56:59.800 --> 57:04.460 So what I'm going to do is I'm going to wget a shell script and then I'm going to run it. 57:04.640 --> 57:07.220 And now I've owned anybody that uses Metasploit. 57:07.940 --> 57:13.280 Every single exploit that Canvas ships with does print if you run it in the command line mode. 57:13.280 --> 57:22.180 Every single exploit that comes with Metasploit prints some piece of data from the user or from the server that you're trying to exploit without filtering it. 57:22.180 --> 57:27.840 If you're running Xterm that comes with Debian and you're running Metasploit or Canvas from it in the command line mode, guess what? 57:27.840 --> 57:28.860 You're ownerable. 57:31.380 --> 57:32.820 Owner awesome. 57:35.480 --> 57:36.980 So using H.G. 57:36.980 --> 57:38.500 Moore's exploits against himself. 57:38.500 --> 57:40.380 So there's two more zero day. 57:42.940 --> 57:45.100 I think you might be at your limit. 57:47.920 --> 57:51.320 Hey, we're not starting anything, okay? 57:51.320 --> 57:52.880 I mean, we're just making a point. 57:52.880 --> 57:55.100 And the general point is, look... 57:55.100 --> 57:56.140 Set an example. 57:57.200 --> 57:58.160 Seriously. 57:58.440 --> 58:03.920 The stuff that you're throwing out there, it's great if it busts stuff open, right? 58:03.920 --> 58:06.360 But at the same time, watch your back. 58:06.480 --> 58:11.580 Because other people are going to be looking at your code as you throw it out there for other people to use. 58:13.000 --> 58:18.800 Speaking of code and application security and that sort of thing... 58:19.480 --> 58:21.080 and ranting... 58:21.080 --> 58:24.540 I'd like to introduce Bruce Potter, founder of the Shmoo Group. 58:29.060 --> 58:29.700 Hello. 58:31.180 --> 58:35.460 I'm a little nervous to hit the next button because they've been slinging slides all day and I haven't been around. 58:36.500 --> 58:40.060 And I'm not sure if they've been screwing with me yet or not, so I guess I'm about to figure out. 58:42.700 --> 58:43.600 Okay, good. 58:48.080 --> 58:49.600 Are there pictures of me on there? 58:49.600 --> 58:50.640 That's all I want to know. 58:51.300 --> 58:52.800 Did we upload those yet? 58:53.900 --> 58:58.940 Yeah, so for the record, Nomad's got the most powerful lens on a camera known to mankind. 58:58.940 --> 59:04.500 I'm sitting up there on stage and he comes up and shows me a picture of my shorts that he took from sitting out there in the audience. 59:05.460 --> 59:05.860 So... 59:06.700 --> 59:07.560 Pwned. 59:07.920 --> 59:09.980 My crotch was owned, okay? 59:11.160 --> 59:12.700 Only in Vegas. 59:13.080 --> 59:14.980 You might want to see someone about that. 59:14.980 --> 59:15.580 Yeah. 59:16.340 --> 59:17.900 Nomad was up my pants. 59:19.540 --> 59:20.420 Bluetooth security... 59:20.420 --> 59:23.480 Look, we talked about a lot of stuff today. 59:23.480 --> 59:24.960 We've been all over the damn road. 59:25.620 --> 59:27.500 And what we're trying to do is raise awareness. 59:27.780 --> 59:29.440 There's no threat here, right? 59:29.440 --> 59:37.740 The press is sitting up here visibly scribbling away, and they're trying to figure out is there anything in common with all these talks or are they just all a bunch of crazies? 59:38.060 --> 59:40.200 All we're really trying to do is raise awareness. 59:40.220 --> 59:44.620 One thing we really don't have anything new on this year but I want to talk about is Bluetooth security. 59:44.700 --> 59:46.320 Shit's gotten worse, guys. 59:47.080 --> 59:48.480 It hasn't gotten better. 59:48.480 --> 59:51.480 There's more Bluetooth radios out than there ever have been. 59:51.480 --> 59:52.980 It's not dying. 59:53.440 --> 59:56.200 Regardless of whatever the hell the press and Gartner and people think. 59:56.220 --> 59:59.420 Two million radios every week are integrated into devices. 59:59.980 --> 01:00:03.680 And I tell you, people are doing nasty shit with Bluetooth right now. 01:00:03.680 --> 01:00:06.480 Last year, we tracked people for fun at Black Hat. 01:00:06.480 --> 01:00:07.800 That was just kind of the thing. 01:00:07.800 --> 01:00:09.120 And then tryfinet.org. 01:00:09.120 --> 01:00:09.740 Bloover? 01:00:09.740 --> 01:00:11.220 Man, that's an awesome tool. 01:00:11.220 --> 01:00:12.540 What's the phone it runs on? 01:00:14.260 --> 01:00:15.500 6260 or something? 01:00:15.580 --> 01:00:16.800 Buy some of those, man. 01:00:16.800 --> 01:00:18.060 Buy them in bulk. 01:00:19.580 --> 01:00:21.240 You can run Bloover on. 01:00:21.240 --> 01:00:23.720 You can make the phones vulnerable phones. 01:00:23.720 --> 01:00:24.460 You can make them dial. 01:00:24.460 --> 01:00:26.380 You can grab down address books. 01:00:26.380 --> 01:00:27.540 Things of that nature. 01:00:28.240 --> 01:00:30.260 A lot of the new phones are patched. 01:00:30.260 --> 01:00:32.020 But this is just an example, guys. 01:00:32.020 --> 01:00:34.100 My car has Bluetooth in it. 01:00:34.360 --> 01:00:37.640 One day, I'll be driving down the road and some hacker will shut my car off. 01:00:37.640 --> 01:00:41.140 Or he'll sequentially deploy all my airbags and do some kind of techno thing. 01:00:45.020 --> 01:00:47.200 And that day can't be far off. 01:00:47.200 --> 01:00:51.180 And once they put the Bluetooth dart in my butt, I think my life will be over. 01:00:51.200 --> 01:00:53.220 Oh, I never should have touched that microphone. 01:00:54.440 --> 01:00:55.060 Alright, so anyway. 01:00:55.060 --> 01:00:55.860 That's that. 01:00:57.380 --> 01:00:58.100 Pairing attacks. 01:00:58.100 --> 01:00:59.860 There's a paper that came out on pairing attacks. 01:00:59.860 --> 01:01:02.580 We have nothing to do with tryfinet.org. 01:01:02.580 --> 01:01:04.620 I'm just pimping these guys because they have a great tool. 01:01:05.260 --> 01:01:08.220 But there's a paper on some pairing attacks that came out recently. 01:01:09.060 --> 01:01:21.540 Basically discussing how to force phones to forget their pairing and then repair with them and intercept the pairing process and then basically brute force guess the key. 01:01:21.880 --> 01:01:25.380 Everyone's always been able to brute force guess the key in the pairing process. 01:01:25.440 --> 01:01:28.900 The standards bodies admitted this when the protocol was developed. 01:01:29.060 --> 01:01:30.120 This is not new. 01:01:30.120 --> 01:01:35.860 When you pair a Bluetooth phone, go lock yourself in a Faraday cage if you're really paranoid, and pair. 01:01:35.880 --> 01:01:37.480 And that way, no one can intercept it. 01:01:37.540 --> 01:01:44.620 But the neat new trick is that you can trick a phone into thinking, oh, I've lost my pairing with my earbud or whatever, I should repair. 01:01:45.240 --> 01:01:53.460 So, I like to liken this to a rogue access point attack where you've got a rogue device pretending to be another one in your network, it just happens to be your little Bluetooth PicoNet. 01:01:53.640 --> 01:01:59.460 If you're at DEF CON and you're talking on your Bluetooth earbud and your phone suddenly says, what I really want to do... 01:02:01.000 --> 01:02:06.940 If it says, what I really want to do right now is repair the earbud because I've forgotten the pairing, no. 01:02:06.940 --> 01:02:15.920 Put the phone away, stop talking to your girlfriend or your Vegas hookup and just go drink because someone's screwing with you and they're going to try to break into your phone. 01:02:18.600 --> 01:02:21.260 Wow, I'm not even sure where the 802.11 seems to... 01:02:21.260 --> 01:02:23.220 That happens on your wired earbud. 01:02:23.220 --> 01:02:24.220 Just go home. 01:02:25.260 --> 01:02:27.140 Yeah, that's the voices in your head at that point. 01:02:29.600 --> 01:02:36.980 So, defending wireless networks, this should say defending 802.11 networks because, you know, 802.11 does not equal wireless and vice versa. 01:02:37.180 --> 01:02:38.780 We talked a lot about the offense. 01:02:38.780 --> 01:02:44.260 This slide is actually taken directly from our Black Hat talk that Beatle and I gave, so it doesn't make any sense in its current context. 01:02:45.980 --> 01:02:49.380 We had done something a few years ago called Hotspot DK. 01:02:49.380 --> 01:02:57.160 It was a hotspot defense kit in a response to a problem where there's a lot of money being spent to protect enterprise wireless networks in the enterprise. 01:02:57.360 --> 01:03:00.080 You know, like, hey, let's buy wireless intrusion detection systems. 01:03:00.080 --> 01:03:03.360 We'll put sensors up everywhere and we'll put things in a nock and we'll be secure. 01:03:03.740 --> 01:03:05.000 Well, hallelujah, brother. 01:03:05.160 --> 01:03:06.600 Your infrastructure will be secure. 01:03:06.600 --> 01:03:08.600 Your clients are still out there in the window. 01:03:09.020 --> 01:03:09.480 You know? 01:03:09.680 --> 01:03:15.860 Your EVP or your nock guy or whoever that's got a laptop leaves your enterprise and goes to Starbucks. 01:03:15.880 --> 01:03:20.820 Your wireless IDS is not at Starbucks when AirSnarf is beating the shit out of it. 01:03:20.840 --> 01:03:21.460 Alright? 01:03:21.620 --> 01:03:23.960 We need to pay more attention to wireless client security. 01:03:23.960 --> 01:03:32.260 So, a year and a half ago, literally, the day that DEF CON Federal started, we were scheduled to speak on day two, we sat... what? 01:03:32.740 --> 01:03:34.460 Black Hat, what the hell did I say? 01:03:34.460 --> 01:03:37.060 DEF CON Federal 2006. 01:03:37.060 --> 01:03:38.080 Be there. 01:03:39.320 --> 01:03:41.900 It'll be in the Las Vegas County Jail. 01:03:42.400 --> 01:03:43.580 Or Guantanamo. 01:03:43.580 --> 01:03:45.600 Or Guantanamo, if we're lucky. 01:03:46.100 --> 01:03:46.800 Jeez. 01:03:46.800 --> 01:03:47.680 Go Gitmo. 01:03:48.940 --> 01:03:50.940 What the hell was my train of thought? 01:03:50.940 --> 01:03:52.020 Oh, we wrote this tool. 01:03:52.240 --> 01:03:59.160 We wrote this tool literally in the day before our talk at Black Hat when we were drinking and talking to friends. 01:03:59.300 --> 01:04:03.980 It wasn't rocket science to write a little tool that protected wireless clients. 01:04:03.980 --> 01:04:05.960 Nothing out there at the time existed like it. 01:04:05.960 --> 01:04:12.880 We released it under BSD license and said, take it, integrate it into your own products, we don't give a shit, just fix the problem, secure the clients. 01:04:12.880 --> 01:04:15.400 Now you can buy it from other people. 01:04:15.400 --> 01:04:16.900 And it's taken a year and a half to get there. 01:04:16.900 --> 01:04:23.880 There's really still no huge amounts of support in the operating systems and the drivers and whatever to try to protect the clients while they're on the road. 01:04:23.880 --> 01:04:25.580 And really, that's a massive problem. 01:04:26.380 --> 01:04:27.400 So things are not much better. 01:04:27.400 --> 01:04:28.820 I'm skipping ahead in my slides. 01:04:29.600 --> 01:04:32.560 We're working on Hotspot DKV2. 01:04:33.300 --> 01:04:36.820 It turns out that my third major was computer science. 01:04:37.700 --> 01:04:40.180 The first two were biology and physics. 01:04:40.500 --> 01:04:42.860 Marketing, economics... 01:04:42.860 --> 01:04:44.280 I went through a lot of majors. 01:04:46.300 --> 01:04:52.360 I almost got into a fist fight with one of my professors and then I watched him dent my car on purpose. 01:04:52.360 --> 01:04:56.400 And I realized at that point that computer science is probably not the way I was going to graduate college. 01:04:57.240 --> 01:04:59.200 And I can't code for shit. 01:04:59.340 --> 01:05:04.240 So I've been trying to write Hotspot DKV2 for the last couple weeks and it's been a qualified disaster. 01:05:04.240 --> 01:05:07.500 And the guy who I normally rely on is actually moving to Alaska right now. 01:05:07.500 --> 01:05:08.720 This is not like a line. 01:05:08.720 --> 01:05:10.320 So I don't have code to release. 01:05:10.320 --> 01:05:14.740 But ultimately, what we're trying to do is build an environmental monitor. 01:05:14.920 --> 01:05:17.300 I like to liken this to going to downtown Baltimore. 01:05:17.300 --> 01:05:19.500 How many people, first of all, live near Baltimore? 01:05:20.260 --> 01:05:21.860 Okay, we all work for the government. 01:05:21.860 --> 01:05:23.760 How many people have been to Baltimore? 01:05:23.760 --> 01:05:29.440 Alright, when you go about a block or two outside of downtown, it gets really scary really quick. 01:05:29.440 --> 01:05:32.340 That town is... it's not so pretty. 01:05:32.340 --> 01:05:39.280 If I'm in downtown Baltimore and I hear gunshots and then I check my body and I'm not hit, it doesn't make me any less nervous. 01:05:40.120 --> 01:05:42.340 I don't think to myself, oh, thank god, they missed me. 01:05:43.440 --> 01:05:44.920 Let's go get a coffee, dear. 01:05:46.440 --> 01:05:48.180 So, this is the same kind of thing. 01:05:48.180 --> 01:05:53.460 We're trying to build an environmental monitor that looks for nasty things happening in the air that might not be happening directly to us. 01:05:53.460 --> 01:05:57.100 Think of it as wireless IDS for your mobile device, right? 01:05:57.100 --> 01:05:59.540 This is really kind of a decent idea, I think. 01:05:59.560 --> 01:06:01.620 There was actually a question posed yesterday to me. 01:06:01.620 --> 01:06:03.000 Why don't you use Snort Wireless? 01:06:03.060 --> 01:06:04.820 Well, we kind of want to do it lightweight. 01:06:04.820 --> 01:06:07.760 We want to try something new, so we're slinging our own code to give this a shot. 01:06:07.760 --> 01:06:10.440 If people are interested in helping out, please contact me. 01:06:10.440 --> 01:06:14.340 I'd be more than happy to, well, have you write the code, because I'm really shitty at it. 01:06:15.480 --> 01:06:16.040 Question? 01:06:16.040 --> 01:06:17.040 Okay, fire. 01:06:19.820 --> 01:06:22.760 No, no, the question is, if you help out, do you have to drive around Baltimore? 01:06:22.760 --> 01:06:24.320 No, I'll do that for you. 01:06:24.960 --> 01:06:26.600 Wait a second, Bruce. 01:06:26.600 --> 01:06:29.240 Didn't you say that IDSs sucked? 01:06:30.680 --> 01:06:32.300 I think that's what I heard. 01:06:34.260 --> 01:06:35.940 So, there we go. 01:06:35.940 --> 01:06:36.860 Where the hell did this come from? 01:06:36.920 --> 01:06:38.140 Oh, Jesus. 01:06:38.320 --> 01:06:40.300 Way to avoid the question. 01:06:41.580 --> 01:06:44.220 I'm trying to get to a geometry here. 01:06:45.240 --> 01:06:46.040 What ? 01:06:47.180 --> 01:06:49.720 We only have one certified open office operator. 01:06:49.720 --> 01:06:51.280 How do I go backwards? 01:06:52.280 --> 01:06:53.600 Oh, the back arrow. 01:06:54.660 --> 01:06:56.080 Hey, is that my slide? 01:06:56.080 --> 01:06:57.560 You wouldn't learn that in computer science. 01:06:57.560 --> 01:06:58.560 Oh, I did that. 01:06:59.720 --> 01:07:01.620 I forgot my slide. 01:07:02.380 --> 01:07:03.820 Alright, so this is Hotspot DK. 01:07:03.820 --> 01:07:09.320 So to get to the question Eric asked, this microphone and I are going to have a carnal knowledge here shortly. 01:07:10.460 --> 01:07:14.580 So, as security professionals, I'll get there. 01:07:14.580 --> 01:07:15.020 Alright? 01:07:15.020 --> 01:07:15.800 Thank you, brother. 01:07:15.820 --> 01:07:16.540 Hallelujah. 01:07:17.020 --> 01:07:18.520 We haven't learned a lot. 01:07:19.260 --> 01:07:25.020 People have called me kind of a killjoy the last couple days because every time I've been on stage, I've been pointing at the audience and being like, it's all your fault. 01:07:26.180 --> 01:07:29.540 We've learned the same things over and over, which is kind of alluring a lot. 01:07:29.540 --> 01:07:32.280 You get to learn the same thing and fill up the queue. 01:07:33.160 --> 01:07:35.240 So, here's the deal. 01:07:35.980 --> 01:07:38.760 We get paid to know security stuff. 01:07:39.540 --> 01:07:51.500 And ultimately, we should have a better knowledge of our environment and our equipment, as Ronnie talked about, understanding what vendor gear we're putting in, understand the applications running in our environments, that kind of thing. 01:07:51.560 --> 01:07:54.440 Ultimately, users are the ones kind of affected by IDSs. 01:07:54.440 --> 01:07:58.700 Is a transaction I just committed with the Bank of America legitimate, or have I been owned? 01:07:58.700 --> 01:08:00.020 Is my credit card down? 01:08:00.020 --> 01:08:01.280 Bank of America can find out. 01:08:01.280 --> 01:08:05.720 It'll take six months to discover it, but it would be nice if you found out in real time. 01:08:05.720 --> 01:08:09.760 It would be nice if the people in the NOC just got little pop-up windows that were binary ones and zeros. 01:08:09.760 --> 01:08:10.980 Secure, not secure. 01:08:10.980 --> 01:08:11.920 What's the state of the network? 01:08:11.920 --> 01:08:12.360 Bing! 01:08:12.360 --> 01:08:12.800 Zero. 01:08:12.800 --> 01:08:13.240 Secure. 01:08:13.240 --> 01:08:14.000 What's the state of the network? 01:08:14.000 --> 01:08:14.420 Bing! 01:08:14.420 --> 01:08:14.820 Zero. 01:08:14.820 --> 01:08:15.520 Insecure. 01:08:15.520 --> 01:08:16.060 What? 01:08:17.760 --> 01:08:19.160 Then you know your own. 01:08:19.600 --> 01:08:21.540 You just cast that in stone. 01:08:21.760 --> 01:08:22.380 Yes. 01:08:22.960 --> 01:08:24.000 Everything's secure. 01:08:24.000 --> 01:08:30.600 What we really need to be focusing on as an industry is a better understanding of the tools and our own enterprises and looking at the integrity of things. 01:08:30.600 --> 01:08:35.820 It's not good enough just to say, are there traces of an attack, but has an attack been successful? 01:08:35.820 --> 01:08:36.980 That's the real rub. 01:08:36.980 --> 01:08:41.140 There's a lot of people focusing on forensics and looking at the after-the-fact type of stuff. 01:08:41.140 --> 01:08:44.860 But we need to have a deeper understanding of what's going on in our environment. 01:08:45.040 --> 01:08:50.120 Brian Watring, who couldn't be here today, has been working for years on a tool called OSIRIS. 01:08:50.360 --> 01:08:54.120 You can go to hostintegritymonitoring.com and take a look at it. 01:08:54.400 --> 01:08:57.620 Think of it as tripwire on steroids. 01:08:57.620 --> 01:09:03.480 It's examining configurations and checksums and all kinds of things about the... Pablo , go. 01:09:03.480 --> 01:09:04.420 It's free. 01:09:04.420 --> 01:09:05.000 Just get it. 01:09:05.000 --> 01:09:05.420 It's free. 01:09:05.420 --> 01:09:06.180 Just get it. 01:09:06.180 --> 01:09:10.340 And he actually just has a book that was published about how to do host integrity monitoring. 01:09:10.480 --> 01:09:16.160 And what's unfortunate is that there's not a lot of other tools out there that deal with that kind of thing and I think we need to focus on that. 01:09:17.660 --> 01:09:18.020 Further... 01:09:18.020 --> 01:09:19.600 I made a triangle. 01:09:19.600 --> 01:09:20.080 What? 01:09:20.080 --> 01:09:20.760 What? 01:09:21.100 --> 01:09:22.980 You made a triangle in college? 01:09:23.420 --> 01:09:24.780 Yeah, I made a triangle in college. 01:09:24.780 --> 01:09:25.760 It was glorious. 01:09:25.760 --> 01:09:26.820 This is my PowerPoint food. 01:09:26.820 --> 01:09:29.860 Beetle has arrows going back and forth and worms and all kinds of shit. 01:09:29.860 --> 01:09:31.180 And I have a triangle. 01:09:31.940 --> 01:09:33.200 And they're both built by bandits. 01:09:33.200 --> 01:09:34.180 Bring on the triangle. 01:09:34.180 --> 01:09:35.840 What do you want from me, buddy? 01:09:36.260 --> 01:09:38.220 Tell me about wireless IDS. 01:09:38.240 --> 01:09:39.240 Wireless IDS? 01:09:39.620 --> 01:09:40.820 Why wireless IDS? 01:09:40.820 --> 01:09:42.020 Because you said they were good. 01:09:42.640 --> 01:09:45.000 Wireless IDS in the client, I think, is a reasonable thing. 01:09:45.000 --> 01:09:46.820 That gets back to this kind of thing. 01:09:47.160 --> 01:09:47.960 God! 01:09:49.480 --> 01:09:53.120 Don't you mean host IDS on wireless clients? 01:09:53.200 --> 01:09:53.940 It's okay, Matt. 01:09:53.940 --> 01:09:54.880 It's almost over. 01:09:54.880 --> 01:09:56.120 Apparently we need a keyboard IDS . 01:09:56.120 --> 01:09:58.200 Do we have any more shit we can show instead? 01:09:58.200 --> 01:09:58.720 Yeah. 01:09:58.720 --> 01:09:59.140 All right. 01:09:59.140 --> 01:09:59.560 I'll make this short. 01:09:59.560 --> 01:10:01.880 Your IT security needs includes a different user interface. 01:10:01.880 --> 01:10:04.460 Go play with this in the parking lot. 01:10:04.460 --> 01:10:05.060 Yeah , go play with that. 01:10:05.060 --> 01:10:07.420 I'll just stick it down my pants with a one watt amp. 01:10:09.540 --> 01:10:10.340 Vegas was hot. 01:10:10.340 --> 01:10:11.880 Can we get pictures before and after? 01:10:12.480 --> 01:10:14.440 So, anyway, sure. 01:10:14.440 --> 01:10:16.220 Look, you can see it backwards over there. 01:10:16.300 --> 01:10:20.760 IDS and the normal user get along fine because that's who really needs to consume the information. 01:10:20.760 --> 01:10:23.460 What we really care about is how bad is shit, right? 01:10:23.560 --> 01:10:25.580 Users need to make rash tactical reactions. 01:10:25.580 --> 01:10:29.500 We in the operations world need to make strategic reactions like, oh god, we got broken into. 01:10:29.500 --> 01:10:30.300 Let's respond. 01:10:30.300 --> 01:10:32.200 Incident response and things of that nature. 01:10:32.420 --> 01:10:33.920 Does that get down your path? 01:10:33.920 --> 01:10:34.840 All right, thank you. 01:10:35.140 --> 01:10:51.540 Further, I think you need, when you think about security in the data center, sorry about the rant, and if you were a black hat, I really apologize, but you really need to think about things in a structured fashion , and it turns out we need to spend as much time thinking about patch management and configuration management as we do firewalls and software security and IDS. 01:10:51.540 --> 01:10:53.280 Where do we buy the honeypot hats? 01:10:53.500 --> 01:10:54.900 The honeypot hats? 01:10:55.280 --> 01:10:58.500 I'll make you one out of this soaking wet towel and some electronic devices later. 01:10:59.660 --> 01:11:00.920 Dead man walking. 01:11:02.300 --> 01:11:08.720 Anyway, I don't really want to get into this triangle, because it'll be controversial and more than I really want to do, and Beedle's standing behind me threatening to beat the shit out of me. 01:11:08.720 --> 01:11:11.740 As a moment, I'm just going to do that to piss him off. 01:11:15.380 --> 01:11:16.480 That was awesome, dude. 01:11:16.480 --> 01:11:17.560 Awesome, whatever. 01:11:24.340 --> 01:11:24.660 So... 01:11:25.980 --> 01:11:27.560 Is Mike Lynn in the house? 01:11:27.560 --> 01:11:29.100 Is he in here, man? 01:11:29.400 --> 01:11:30.040 Motherfucker. 01:11:30.180 --> 01:11:30.940 I told him to come. 01:11:30.940 --> 01:11:34.620 Yeah, so Mike was at ShmooCon. 01:11:34.620 --> 01:11:48.160 If you missed his talk on signal intelligence and how to capture really interesting things that are in the air all day long and how to decode them, because people are using leaked crypto like ASCII. 01:11:51.120 --> 01:11:54.100 You missed a really cool talk at ShmooCon. 01:11:54.300 --> 01:11:55.760 And it was a lot of fun. 01:11:55.760 --> 01:11:58.740 Who here was at ShmooCon earlier this year? 01:11:58.740 --> 01:11:59.220 Awesome. 01:11:59.220 --> 01:11:59.860 Right on, man. 01:11:59.860 --> 01:12:00.200 Thanks. 01:12:00.200 --> 01:12:00.680 That's cool. 01:12:00.680 --> 01:12:03.600 So, ShmooCon 2006. 01:12:03.800 --> 01:12:05.340 January 13th through 15th. 01:12:05.340 --> 01:12:06.200 Washington, D.C. 01:12:06.200 --> 01:12:06.940 again. 01:12:07.100 --> 01:12:09.040 Pre-registration is live now. 01:12:09.040 --> 01:12:11.740 If you missed out on ShmooCon last year, it's sold out. 01:12:11.740 --> 01:12:12.660 We didn't have... 01:12:12.660 --> 01:12:14.120 He is the ticket Nazi. 01:12:14.120 --> 01:12:15.600 When we sell out, we sell out. 01:12:15.600 --> 01:12:16.540 Yeah, we were done, man. 01:12:16.540 --> 01:12:17.840 We didn't have any space. 01:12:17.840 --> 01:12:19.120 We had no more chairs. 01:12:19.120 --> 01:12:21.760 We would have been people standing in the back... 01:12:21.760 --> 01:12:22.280 Oh, or something. 01:12:22.280 --> 01:12:22.960 Okay. 01:12:25.240 --> 01:12:27.640 So, yeah, you can go to ShmooCon.org. 01:12:27.900 --> 01:12:29.680 What we really like about ShmooCon... 01:12:30.460 --> 01:12:34.520 And particularly how we can kind of get it out there for people to see. 01:12:34.780 --> 01:12:38.760 We threw a lot of ads together last year for people, their entertainment. 01:12:38.820 --> 01:12:40.700 And we're interested in soliciting those again from people. 01:12:40.700 --> 01:12:47.100 So if you have an advertisement for ShmooCon that you'd like to get onto the web, we'd like to get it onto the web for you. 01:12:47.160 --> 01:12:49.200 And so just build it, make it. 01:12:49.300 --> 01:12:51.440 We'll compare it with all the other ads that we receive. 01:12:51.440 --> 01:12:58.980 The best ad that we get, we're gonna pay for that dude, wherever you are, to fly to ShmooCon, stay at ShmooCon, hang out at ShmooCon. 01:12:59.580 --> 01:13:01.040 Yeah, man. 01:13:02.560 --> 01:13:05.080 Please do not hire an artist from Singapore or somewhere. 01:13:05.520 --> 01:13:07.200 No sweatshops, alright? 01:13:07.380 --> 01:13:11.780 Here's an example ad, just so that, if you want some mind view. 01:13:15.060 --> 01:13:16.680 See if this will actually play. 01:13:16.680 --> 01:13:17.420 Hopefully. 01:13:49.520 --> 01:13:50.880 That's pretty hot. 01:13:52.320 --> 01:13:53.480 Right on. 01:13:57.200 --> 01:14:00.500 So, we're really interested in more people submitting. 01:14:00.520 --> 01:14:01.840 Rodney's got the CFP. 01:14:01.840 --> 01:14:03.320 So the CFP's out. 01:14:03.380 --> 01:14:04.800 And we're handing it out. 01:14:04.800 --> 01:14:08.640 So if you want to see what we're interested in, what we'd like you to present on, feel free to do that. 01:14:08.660 --> 01:14:10.260 We had three tracks last year. 01:14:10.260 --> 01:14:11.720 Build it, break it, and bop it. 01:14:11.720 --> 01:14:13.960 So we're really interested in people like building things. 01:14:14.080 --> 01:14:16.920 And as Pablo said at DEF CON last year, build cool shit. 01:14:17.220 --> 01:14:23.760 And the other thing, if you have an idea for a talk, and you haven't done a talk before, you're not sure how you'd go about doing that, talk to us anyway. 01:14:23.760 --> 01:14:26.320 We're trying to encourage new people, new blood to show up. 01:14:26.320 --> 01:14:31.640 And we've got all sorts of folks, PhDs, professors give courses, all sorts of people do presentations. 01:14:31.640 --> 01:14:33.460 We can help you out with that kind of stuff. 01:14:33.540 --> 01:14:35.300 So if you have a good idea, talk to us. 01:14:35.300 --> 01:14:37.040 Doesn't matter if you've given a presentation before. 01:14:37.040 --> 01:14:37.580 Go right ahead. 01:14:37.580 --> 01:14:38.620 Please, we encourage it. 01:14:38.620 --> 01:14:42.900 It's important to mention that when we're at ShmooCon, we don't talk at ShmooCon. 01:14:42.900 --> 01:14:46.580 We usually, you know, we might give a few rants here and there and some informative things. 01:14:46.580 --> 01:14:47.760 But those are sidebar things. 01:14:47.760 --> 01:14:50.220 We actually provide a venue for everybody else to talk. 01:14:50.220 --> 01:14:55.580 We come here and we just kind of throw a bunch of stuff together and we try and jazz people up and get people excited about doing these kind of things. 01:14:55.580 --> 01:14:59.040 So we're interested in providing a venue for you to give presentations. 01:14:59.040 --> 01:15:01.320 So submit what you want and we'll make it happen. 01:15:02.540 --> 01:15:03.900 So that's it for us. 01:15:03.900 --> 01:15:05.720 Does anybody have any questions? 01:15:06.780 --> 01:15:07.900 Please ask questions. 01:15:07.900 --> 01:15:09.100 Priest is walking up. 01:15:11.960 --> 01:15:13.180 Alright, thanks a lot guys. 01:15:13.180 --> 01:15:14.420 We really appreciate it. 01:15:14.420 --> 01:15:15.140 Have a good day. 01:15:15.140 --> 01:15:16.180 Have a good DEF CON.