1
00:00:10,420 --> 00:00:12,300
Naomi, which is probably most of you.

2
00:00:12,300 --> 00:00:13,200
My name is Weasel.

3
00:00:13,200 --> 00:00:16,120
I'm a member of the Nomad Mobile Research Center.

4
00:00:16,500 --> 00:00:22,500
It's an international group of hackers that's been around for, oh, seven, eight years?

5
00:00:23,040 --> 00:00:24,260
Something like that?

6
00:00:24,260 --> 00:00:32,920
Yeah, and we've just, you know, had thousands of projects that we all worked on, and probably maybe 1% of them have actually been finished and made it to fruition.

7
00:00:33,520 --> 00:00:46,480
Hopefully we've got a few here that might impress a few people, if anything, maybe inspire them to take them and do something useful with them, instead of them just sitting on our file server.

8
00:00:50,400 --> 00:00:53,300
Okay, I don't know, am I supposed to read these things?

9
00:00:53,400 --> 00:00:54,200
No, okay.

10
00:00:55,660 --> 00:00:57,620
These are a few quotes, feel free to read.

11
00:00:58,200 --> 00:01:00,040
Let me go ahead and introduce a few of the members.

12
00:01:00,040 --> 00:01:02,780
Most of you know Simple Nomad.

13
00:01:02,780 --> 00:01:04,400
He started the group.

14
00:01:04,600 --> 00:01:10,940
I think he's known for his goat porn, and Pandora.

15
00:01:11,560 --> 00:01:17,160
So if anybody has any support questions with Pandora, that's thenome at nmrc.org.

16
00:01:19,800 --> 00:01:22,320
Anyway, next to him is Jay Random.

17
00:01:22,320 --> 00:01:28,040
He's another long-term member, and probably his claim for fame is...

18
00:01:28,040 --> 00:01:29,640
I won't embarrass you.

19
00:01:29,940 --> 00:01:43,060
He was the maintainer of the Hack Fact for many years, and if we actually have time at the end of our presentation, he'll go over what's happened with that, and why it's not as up-to-date as it probably should be, or if it even should be up-to-date.

20
00:01:43,440 --> 00:01:45,260
And then over there is Mad Hat.

21
00:01:45,260 --> 00:01:48,660
If there are any single ladies in the audience, he will buy you a car.

22
00:01:48,660 --> 00:01:53,560
So, speak to him afterwards.

23
00:01:54,680 --> 00:01:58,940
I'll let you introduce your personal life.

24
00:01:59,040 --> 00:02:00,460
It's Mad Hat.

25
00:02:01,120 --> 00:02:05,640
He's recently joined the group, and he's coming up with some really exciting projects.

26
00:02:06,680 --> 00:02:07,980
And that's who we are.

27
00:02:08,960 --> 00:02:13,420
Okay, we'll go on to the where section and see what tools we've been going over here.

28
00:02:13,760 --> 00:02:15,440
And this is yours.

29
00:02:17,500 --> 00:02:22,700
First off, a tool that I had worked on previously called Encrypt.

30
00:02:23,440 --> 00:02:28,120
And I've talked about it previously at other conferences, so I'm not going to go into a whole lot of detail on it.

31
00:02:28,120 --> 00:02:32,400
It's a symmetrical crypto tool.

32
00:02:33,020 --> 00:02:37,440
The one thing, and it also had some file wiping features that came with it, and it was kind of nice.

33
00:02:37,440 --> 00:02:42,160
It included AES and Serpent and TwoFish.

34
00:02:43,500 --> 00:02:50,260
Included in that, Todd McDermott, who's contributed code to the project.

35
00:02:50,260 --> 00:02:51,500
I don't know if Todd is here.

36
00:02:51,500 --> 00:02:53,480
Is Todd McDermott in the audience anywhere?

37
00:02:53,840 --> 00:02:55,560
I was going to have him stand up.

38
00:02:55,560 --> 00:03:01,360
Anyway, he's contributed a lot of code to the project, and it's out on SourceForge if you're looking for it.

39
00:03:01,360 --> 00:03:11,860
But anyway, I'm hoping to get up... Todd wrote a drop-in replacement for RM called NRM, which does basically secure wiping of a file where it does multi-passes.

40
00:03:12,000 --> 00:03:18,020
And it forks off into the background and kind of runs and does all the passes so you get your prompt back.

41
00:03:18,140 --> 00:03:20,240
And that's the main thing that we've added into that.

42
00:03:20,240 --> 00:03:22,360
The other thing is, believe it or not, we put in...

43
00:03:23,280 --> 00:03:29,440
We had a lot of people asking for integration for the Encrypt tool into scripts, where they actually...

44
00:03:29,440 --> 00:03:36,940
And this was requested, say, we want to be able to pass the password on the command line or from a text file, which is horrid.

45
00:03:36,940 --> 00:03:43,180
However, they're wanting to do it for encrypting log files before transmitting them from one machine to the other.

46
00:03:43,940 --> 00:03:47,900
I'm not exactly sure... I don't use that feature, but I had enough people do it.

47
00:03:47,900 --> 00:03:49,560
I put it in there, and it's in the man pages.

48
00:03:49,560 --> 00:03:51,020
It says it's highly dangerous.

49
00:03:51,020 --> 00:04:04,100
But nonetheless, it's in there in case you want to assume that the box that was broken into makes sure that those log files that they get across there in a secure fashion.

50
00:04:04,300 --> 00:04:07,400
Anyway, next, Mad Hat.

51
00:04:07,400 --> 00:04:08,920
Why don't you come and talk about that?

52
00:04:14,580 --> 00:04:18,800
Alright, so, actually this is three different tools I wrote a while back.

53
00:04:25,250 --> 00:04:28,070
This is designed for short people, it's not my fault.

54
00:04:28,330 --> 00:04:30,510
Alright, can everybody hear me now?

55
00:04:31,370 --> 00:04:33,070
I'll take that as a yes.

56
00:04:33,110 --> 00:04:35,290
Alright, so these are actually three different tools.

57
00:04:35,750 --> 00:04:42,950
I had a project where I had to scan a large number of IPs on a daily basis and figure out what exactly was changing, what was going on.

58
00:04:42,950 --> 00:04:47,670
I love nmap and all the work that Fyodor has done on that.

59
00:04:47,670 --> 00:04:51,470
Unfortunately, it wasn't quite fast enough for what I needed, so I wrote the nmap wrapper.

60
00:04:51,530 --> 00:04:55,790
And what that does is it runs a bunch of nmap processes in parallel.

61
00:04:56,010 --> 00:04:59,370
Stores all of it to flat files right now using the graphical output.

62
00:04:59,630 --> 00:05:02,750
The other two tools work off of those databases.

63
00:05:02,870 --> 00:05:07,070
nmap report basically allows you to go in and specify what you want to see.

64
00:05:07,070 --> 00:05:09,410
So, show me all the hosts that are windows.

65
00:05:09,410 --> 00:05:12,930
Show me all the hosts that are nmap 480 open.

66
00:05:13,510 --> 00:05:19,830
nmap diff allows you to specify two specific dates and give you the diff on all the hosts or any particular host.

67
00:05:19,830 --> 00:05:24,870
The whole idea is being able to monitor large networks for changes.

68
00:05:24,870 --> 00:05:32,030
By default it only shows you new things are added, but you can also show whenever things go away a whole new host that comes up.

69
00:05:32,030 --> 00:05:38,810
And it just makes it a whole lot easier than trying to look at something that you only see a snapshot once every week or something of that nature.

70
00:05:38,810 --> 00:05:40,930
It shows you daily changes.

71
00:05:42,850 --> 00:05:45,330
Oh yeah, so I was...

72
00:05:45,330 --> 00:05:52,370
For this particular project, I was scanning around 150,000 IPs a day.

73
00:05:52,370 --> 00:05:58,690
And I had it down to around 10 hours to scan all 150,000 IPs, so I could have done it twice a day if necessary.

74
00:05:58,690 --> 00:06:04,770
From a single box, 3BSD box, sitting in a DMZ, scanning hosts worldwide.

75
00:06:04,770 --> 00:06:06,410
This was not like a single location.

76
00:06:06,410 --> 00:06:13,590
This was boxes all around the world, trying to deal with network latencies, you know, and well, the speed of light, things such as that.

77
00:06:14,310 --> 00:06:17,810
So it came in extremely handy.

78
00:06:22,220 --> 00:06:26,440
Alright, so for those of you who are at Black Hat, we went over this at Black Hat.

79
00:06:26,440 --> 00:06:28,600
The idea is single packet authentication.

80
00:06:28,600 --> 00:06:33,440
This was really a project just to see if it could be done.

81
00:06:33,520 --> 00:06:37,060
I run the local DC group in Dallas, which is DC214.

82
00:06:37,060 --> 00:06:42,080
And we started discussing a year and a half or so ago, you know, after Port Knocking came out.

83
00:06:42,400 --> 00:06:43,980
Is there a better way of doing this?

84
00:06:43,980 --> 00:06:45,600
You know, do we really need to send multiple packets?

85
00:06:45,600 --> 00:06:52,260
Can we do it with a single packet and make it not replayable and make it, you know, secure and actually do more than just open a port?

86
00:06:52,260 --> 00:06:53,420
You know, can we run commands?

87
00:06:53,420 --> 00:06:56,140
Can we do things like, say, reverse shell?

88
00:06:56,240 --> 00:06:58,260
Do we have to have any ports actually listening?

89
00:06:58,260 --> 00:07:00,400
So this is what we came up with.

90
00:07:01,340 --> 00:07:02,960
It's a simple protocol.

91
00:07:02,960 --> 00:07:05,220
It allows a remote user to authenticate the system.

92
00:07:05,260 --> 00:07:06,560
There's nothing listening.

93
00:07:06,560 --> 00:07:08,520
It sniffs all the packets that are coming in.

94
00:07:08,640 --> 00:07:12,580
We use PGP or GPG to encrypt the data.

95
00:07:13,260 --> 00:07:19,200
And whenever you do that, if you just use raw encryption, what is it, eight bytes in?

96
00:07:19,560 --> 00:07:26,500
Eight bytes in, there are four bytes that are the GPG ID of the key that can decrypt it.

97
00:07:26,500 --> 00:07:30,420
So basically, we look for that, we see that, we pass it on to the processing engine.

98
00:07:31,360 --> 00:07:32,440
Of course, it's free.

99
00:07:33,480 --> 00:07:34,240
Why not?

100
00:07:36,420 --> 00:07:36,700
Well...

101
00:07:37,120 --> 00:07:42,240
And of course, one of the issues we wanted to deal with was working across NAT because we always hated, you know, having somebody call us up.

102
00:07:42,440 --> 00:07:45,380
Hey, I need to be able to check my mail on such and such host.

103
00:07:45,380 --> 00:07:46,560
Okay, what IP are you on?

104
00:07:46,600 --> 00:07:48,260
I'm on 192.168.

105
00:07:48,260 --> 00:07:49,100
No, no, no, no, no.

106
00:07:49,140 --> 00:07:50,380
What IP are you going to be coming from?

107
00:07:50,380 --> 00:07:51,540
Well, it says 192.

108
00:07:51,540 --> 00:07:52,520
Oh, Jesus.

109
00:07:52,520 --> 00:08:00,420
So, they can send, you know, with the client, they can send a single packet and it looks at the source address and says, oh, okay, so we'll open it up for that IP.

110
00:08:00,420 --> 00:08:04,540
And then, of course, it monitors the traffic and after a certain timeout, it will automatically close the port.

111
00:08:04,980 --> 00:08:11,580
We're also, you know, working with the idea of doing a reverse shell, so you send a single packet and it connects back to you.

112
00:08:11,940 --> 00:08:17,320
And then we can also have it to where, in our sample code, where you can run arbitrary commands.

113
00:08:17,320 --> 00:08:23,080
And the commands are specified in the config file, so it's not like anybody who has access to it can run any command.

114
00:08:23,080 --> 00:08:27,420
You have a comma-separated list of the commands that are allowed to be run by that particular user.

115
00:08:28,860 --> 00:08:31,880
This is a visual representation of basically how it works.

116
00:08:31,880 --> 00:08:35,820
So, over on the left-hand side, you have the client with, you know, its GPG ID.

117
00:08:35,960 --> 00:08:45,600
It encrypts all the data, which includes, you know, an ID, session keys, timestamp, and then the command and control data for the application that's using this fault protocol.

118
00:08:46,220 --> 00:08:50,640
It's encrypted and signed, you know, encrypted for security and signed for authenticity.

119
00:08:50,960 --> 00:08:53,380
And then it can be, you know, it's a data packet.

120
00:08:53,380 --> 00:08:56,340
So, I mean, it can be TCP, UDP, ICMP, anything like that.

121
00:08:56,340 --> 00:08:59,320
We've implemented TCP and UDP in our sample code.

122
00:08:59,700 --> 00:09:02,420
And then, of course, you know, it encrypts it with the server's key.

123
00:09:02,460 --> 00:09:06,520
The server gets it, verifies that it's, you know, encrypted data, passes it on.

124
00:09:07,860 --> 00:09:10,060
It's kind of an idea of how it's laid out.

125
00:09:11,200 --> 00:09:15,380
I'm a Perl hacker, so the parts that I worked on are in Perl.

126
00:09:15,740 --> 00:09:20,140
The client right now, you know, can be on whatever host.

127
00:09:20,140 --> 00:09:21,180
Sends the data.

128
00:09:21,180 --> 00:09:24,700
SPA-D is basically a simple sniffer.

129
00:09:25,420 --> 00:09:27,080
Nomad Spark written in C.

130
00:09:27,460 --> 00:09:34,360
Once it verifies, you know, what it's looking for, sends it on to the SPA engine, which then calls GPG as necessary to decrypt.

131
00:09:34,540 --> 00:09:40,020
Checks the user config to verify, you know, whatever they're asking to do can be done.

132
00:09:40,020 --> 00:09:42,760
And it also keeps track of firewall states.

133
00:09:42,760 --> 00:09:51,440
So, for some reason, the daemon, you have to restart the daemon, and it's going to know what ports were already open and still keep track of them and close them as necessary.

134
00:09:54,850 --> 00:09:56,310
And a whole new one.

135
00:09:57,890 --> 00:10:01,470
And we will have time for questions a little bit later.

136
00:10:02,390 --> 00:10:13,990
Alright, so, at the job where I was mentioning where I wrote the nmap tool, my primary responsibility was scanning and monitoring of large groups of hosts.

137
00:10:13,990 --> 00:10:19,330
A whole lot of web servers and Unix boxes.

138
00:10:20,290 --> 00:10:31,450
At the time, whenever I first started on this particular project, there wasn't a lot out there to be able to scan all those same IPs on a daily basis, you know, for basic misconfigurations.

139
00:10:31,450 --> 00:10:32,870
Vulnerabilities, things such as that.

140
00:10:32,870 --> 00:10:38,170
So, I wrote, I started off writing a very simple HTTP scanner, and it kept growing and growing and growing.

141
00:10:40,190 --> 00:10:43,010
Works off command line, or it has a web-based GUI.

142
00:10:43,110 --> 00:10:45,390
You know, same script, just depends on how you call it.

143
00:10:46,330 --> 00:10:52,430
The configs are all in XML, so it's really easy to add and remove things or expand them.

144
00:10:52,550 --> 00:10:57,190
Lots of command line options to specify exactly what you want to scan for, how you want to scan it.

145
00:10:57,190 --> 00:11:03,410
Runs a whole bunch of processes in parallel, according to, you know, whatever your system can handle, so it's fairly quick.

146
00:11:03,550 --> 00:11:11,790
I added in, I started adding in some other features, like FTP to look for anonymous access, look for writable directories, things such as that.

147
00:11:12,630 --> 00:11:22,710
The SQL stuff was added because, you know, I happened to be working on parts of it whenever, you know, the whole SQL Clamor thing came around, so it was easy to add in other features.

148
00:11:23,130 --> 00:11:26,890
There was also some SMTP stuff, but, you know.

149
00:11:27,010 --> 00:11:31,290
It is extremely fast, that was the whole idea.

150
00:11:31,810 --> 00:11:35,330
You know, once again, I was scanning a large number of hosts.

151
00:11:35,750 --> 00:11:38,750
Needed to get it done, you know, in a short amount of time.

152
00:11:39,370 --> 00:11:42,410
The way the output works, there are multiple outputs.

153
00:11:42,450 --> 00:11:48,210
You know, there's a verbose output that would actually tell you, here's the vulnerability and here's the fix, and, you know, standard stuff for a scanner.

154
00:11:48,210 --> 00:11:55,210
But it also, another thing was, it was written so that I could export the data, import it into a database very easily.

155
00:11:55,530 --> 00:11:58,030
Also worked a whole lot of time on false positives.

156
00:11:58,030 --> 00:12:07,490
For anybody who's done any, you know, constant monitoring of hosts, the big thing is, oh look, there's a Apache vulnerability running on an IIS box.

157
00:12:07,790 --> 00:12:09,390
Yeah, that makes sense.

158
00:12:09,390 --> 00:12:15,750
So, I spent a whole lot of time making sure that there were as few false positives as possible, looking for a whole bunch of different things.

159
00:12:15,750 --> 00:12:23,470
You know, looking for custom 404s, you know, things that, it's starting to become a little bit more common in scanners, but at the time...

160
00:12:23,990 --> 00:12:26,850
And of course, once again, it's free.

161
00:12:28,030 --> 00:12:29,970
Hey, I'm gonna stand up here for a while.

162
00:12:31,270 --> 00:12:33,150
Alright, so here's another one.

163
00:12:33,310 --> 00:12:35,250
Once again, in Perl.

164
00:12:35,350 --> 00:12:42,190
This one, the idea is ICMP packets are sent out with a forged source address.

165
00:12:42,190 --> 00:12:55,690
The whole idea was, on the corporate network, we wanted to check to see if people had DSL lines or modems, you know, something, or even misconfigured network devices, so that things were being sent out the wrong direction.

166
00:12:57,090 --> 00:13:06,070
I wrote a small Perl module that allows for looping, so all of these actually use the same Perl module, so you can actually specify ranges of hosts in, you know, almost any format.

167
00:13:06,070 --> 00:13:07,510
Makes it really easy to run.

168
00:13:07,690 --> 00:13:11,110
So, what this does is it forges an ICMP echo request.

169
00:13:11,110 --> 00:13:19,410
The data contains the IP that it was supposed to be sent to, as well as a signed key, which is just using MD5 and a shared secret.

170
00:13:19,450 --> 00:13:23,010
The server snips those on that forged address.

171
00:13:23,010 --> 00:13:30,670
Whenever it comes in, it looks to see if the source, where it was being, where the echo appliance is coming from, is the same as within the data portion.

172
00:13:30,670 --> 00:13:35,890
Because the nice thing about ICMP is, whatever you send it in the data portion, it sends back in the data portion.

173
00:13:36,010 --> 00:13:38,610
So it made it very easy to be able to do this.

174
00:13:38,610 --> 00:13:43,330
So I was able to find DSL hooked up to a corporate network.

175
00:13:43,330 --> 00:13:46,230
Somebody had gotten a DSL line run to their desk.

176
00:13:46,230 --> 00:13:46,770
How?

177
00:13:46,770 --> 00:13:47,490
I don't know.

178
00:13:47,490 --> 00:13:49,190
I wasn't involved in that part.

179
00:13:49,370 --> 00:13:53,950
But basically, their default route went out to SBC.

180
00:13:54,010 --> 00:14:03,750
So I'm sitting here spewing packets to the 192 space, and all of a sudden I'm seeing data coming back from SBC, and that's not a good thing.

181
00:14:03,750 --> 00:14:10,410
And of course, my favorite was the networking devices that had odd routes added for no apparent reason.

182
00:14:10,550 --> 00:14:15,570
Of course, the networking guys denied that it was on purpose or anything like that, but it got changed rather quickly after you find it.

183
00:14:17,030 --> 00:14:22,130
Once again, fast, simple, very specific problem to solve.

184
00:14:27,200 --> 00:14:31,080
Okay, here's another contribution of mine.

185
00:14:31,080 --> 00:14:35,980
This is NPC, Nearly Perfect Crypto.

186
00:14:36,120 --> 00:14:40,360
And I'm so glad you're sitting right there in front of me.

187
00:14:40,400 --> 00:14:41,680
I really am.

188
00:14:42,620 --> 00:14:47,360
What this does is it's mainly meant as an academic tool, okay?

189
00:14:47,620 --> 00:14:48,840
Fuck you.

190
00:14:49,080 --> 00:14:53,280
I got mud up here causing shit for me.

191
00:14:53,280 --> 00:14:56,680
It really is meant as an academic tool, and I'll tell you why.

192
00:14:56,680 --> 00:15:00,560
I mean, there's a lot of people that don't understand how one-time pads work.

193
00:15:00,560 --> 00:15:03,840
What this is is an implementation of a one-time pad, okay?

194
00:15:03,840 --> 00:15:18,600
And the reason I say it's Nearly Perfect Crypto is because it is perfect, but it is as only reliable as Isaac, the pseudorandom number generator that I've got in there.

195
00:15:18,600 --> 00:15:25,060
And it is only as perfect as your key management, which is actually kind of the bad thing.

196
00:15:25,060 --> 00:15:32,120
So if I'm going to send, let's say, goat porn to Mudge, because...

197
00:15:33,660 --> 00:15:34,700
It wouldn't be the first time.

198
00:15:34,700 --> 00:15:36,040
No, it wouldn't be the first time.

199
00:15:36,040 --> 00:15:46,840
Then what I would do is I'd say, hmm, well this file is 30 meg in size, so then I'd need to generate a 30 meg key to make it happen.

200
00:15:46,840 --> 00:15:54,760
And then the trick is, is me getting that key to him, and then us never ever using that key ever again for anything.

201
00:15:54,760 --> 00:15:57,880
Destroying the key after it's done.

202
00:15:57,880 --> 00:16:04,920
I mean, literally, if I put it on a CD and hand it to him, and then we're done with it, we need to destroy the key.

203
00:16:04,920 --> 00:16:15,700
Perhaps with that NRM file that I had previously, or we throw the CDs into a vat of acid, or however you manage your paranoia with your CDs at home.

204
00:16:15,700 --> 00:16:17,060
However that happens.

205
00:16:17,340 --> 00:16:27,140
Anyway, because you're doing something which is like a one-time pad, it makes the crypto part, really it's not very complicated.

206
00:16:27,580 --> 00:16:30,020
You're just doing a simple XOR.

207
00:16:30,020 --> 00:16:35,940
So it is very fast, very simple, it's really nice to do.

208
00:16:35,940 --> 00:16:42,240
Like I said, if you can manage the key exchange, you're getting damn close to having pretty good crypto.

209
00:16:44,080 --> 00:16:56,100
Anyway, just to show you why this thing is so fast and secure, here's the main, and I have it in quotes there, crypto loop, because it's hardly a loop.

210
00:16:56,100 --> 00:17:00,460
And if you look right down here, toward the bottom,

211
00:17:05,190 --> 00:17:09,150
oh my god, I know why he showed up.

212
00:17:09,370 --> 00:17:10,890
You'll know in a minute.

213
00:17:11,630 --> 00:17:14,990
Where it says, wicked crypto, because we are XORing.

214
00:17:14,990 --> 00:17:22,830
And you can see that massively intense one line of code there that kicks so much ass.

215
00:17:24,090 --> 00:17:27,150
So anyway, we have this tool there to kind of play with this.

216
00:17:27,150 --> 00:17:39,130
And I'll tell you the truth, the main reason, actually, truthfully, the main reason I wrote this tool is because there's a friend of mine who we would like to really, really have some deep, serious conversations with.

217
00:17:39,270 --> 00:17:45,110
And we were talking about, well, how in the world could we actually do this in a secure fashion?

218
00:17:47,290 --> 00:17:51,750
Well, okay, we have a smartass up front who thinks he knows something.

219
00:17:51,890 --> 00:17:55,770
But nonetheless, we just kind of went over various scenarios and everything.

220
00:17:55,770 --> 00:17:57,310
So I've come up with this thing.

221
00:17:57,310 --> 00:18:03,270
By the way, this and all the tools, we're going to have a spot out there on the NMRC website.

222
00:18:03,510 --> 00:18:05,770
We'll put something up on the front page.

223
00:18:05,770 --> 00:18:07,230
Hopefully I'll get it done tonight.

224
00:18:07,350 --> 00:18:11,390
And we'll have pointers to all the tools, all the presentations.

225
00:18:11,710 --> 00:18:14,370
Please, all questions at the end, please.

226
00:18:15,010 --> 00:18:18,350
And, oh, well, see, now it's at time for Q&A.

227
00:18:18,350 --> 00:18:20,390
Now, this is the thing we're going to do.

228
00:18:20,390 --> 00:18:36,650
For the Q&A, because this is kind of a dry kind of tool talk, so what we're going to do, something different from the Q&A, is during the Q&A portion of this, we're going to go ahead and spank audience members who want to be spanked.

229
00:18:36,790 --> 00:18:52,930
Now, the thing that we're going to do is, the first thing is, if you're coming up here, I mean, obviously there's no female members, although I think we may be able to recruit some females that we happen to know to come up here to help spank.

230
00:18:58,620 --> 00:19:00,040
Lily, come on up.

231
00:19:00,760 --> 00:19:08,560
So you're going to have a choice of, you know, not only being spanked by a guy, but you can be spanked by a chick.

232
00:19:09,020 --> 00:19:14,600
Okay, now the thing is, if you want to be spanked, we do have a release form you do have to sign.

233
00:19:14,600 --> 00:19:26,700
If anyone has been reading on Full Disclosure, we did post a link to the release form, so if you filled out one previously, that you printed off and filled out, feel free to go ahead and bring it up.

234
00:19:26,940 --> 00:19:29,480
Let me get out the stuff that you're going to be spanked with.

235
00:19:29,480 --> 00:19:30,740
Hold on just a second.

236
00:19:43,300 --> 00:19:51,180
Alright, the first thing that we're going to spank people with is a ShmooCon, this is from the Shmoo group.

237
00:19:51,180 --> 00:20:00,480
When I was at ShmooCon, all the speakers got these because they handed out Shmoo balls to throw at speakers that weren't behaving well, or being stupid, or causing shit.

238
00:20:00,480 --> 00:20:07,320
So they gave the speakers something to fight back with, so we have a Shmoo group paddle that you can be spanked with.

239
00:20:07,320 --> 00:20:12,600
You can also be spanked via a nice firm hand.

240
00:20:13,820 --> 00:20:16,440
And the final thing to be spanked with

241
00:20:19,720 --> 00:20:24,480
is a copy of the third edition of Hacking Exposed.

242
00:20:28,610 --> 00:20:31,550
And just to show how it's going to work,

243
00:20:34,870 --> 00:20:37,750
I want to bring Mudge up here and spank him.

244
00:20:37,750 --> 00:20:39,330
Let's get Mudge up here.

245
00:21:19,190 --> 00:21:22,090
You guys should have seen the rehearsals.

246
00:22:10,940 --> 00:22:13,640
I would have to look at the code specifically.

247
00:22:13,640 --> 00:22:19,040
I stole some code from Todd McDermott because we worked on entropy stuff.

248
00:22:19,100 --> 00:22:28,000
Part of it is we're using processor timing speeds and we're throwing in some... I forget the exact call.

249
00:22:28,000 --> 00:22:35,100
It's one where you're saying, slow down, I'm relinquishing the processor, and so I get a random time.

250
00:22:35,100 --> 00:22:36,300
And so that gives me...

251
00:22:36,730 --> 00:22:41,300
between that and some other stuff thrown in, like the times and stuff.

252
00:22:46,870 --> 00:22:48,550
Okay, there you go.

253
00:22:49,670 --> 00:22:51,110
Okay, thank you.

254
00:22:51,970 --> 00:22:52,990
Anyone else?

255
00:22:52,990 --> 00:22:54,110
Anyone else want to...

256
00:22:57,410 --> 00:22:59,330
Comments instead of questions?

257
00:22:59,330 --> 00:23:00,710
Yeah, go ahead.

258
00:23:00,710 --> 00:23:01,710
You got a comment?

259
00:23:02,510 --> 00:23:04,610
Two comments, go ahead.

260
00:23:08,290 --> 00:23:10,070
All right.

261
00:23:10,130 --> 00:23:13,690
You want to get spanked while you're getting your comments?

262
00:23:16,050 --> 00:23:18,430
Who do you want to spank you?

263
00:23:18,630 --> 00:23:20,230
Sign the release form.

264
00:23:22,370 --> 00:23:24,090
He signed it.

265
00:23:24,090 --> 00:23:25,450
Woo!

266
00:23:27,390 --> 00:23:28,670
Jesus.

267
00:23:29,210 --> 00:23:31,830
Notice he didn't read it first.

268
00:23:38,580 --> 00:23:40,840
Give him a mic.

269
00:23:58,100 --> 00:24:02,120
Okay, so my first comment is your single packet authentication thing.

270
00:24:02,120 --> 00:24:06,620
Talk about using it behind a NAT so that you could open up a service and so forth.

271
00:24:06,620 --> 00:24:07,460
Aren't you opening...

272
00:24:08,160 --> 00:24:12,360
You're opening up that service for everything behind that NAT and everyone behind that NAT.

273
00:24:12,360 --> 00:24:14,080
Isn't that kind of insecure?

274
00:24:14,660 --> 00:24:15,140
Yes.

275
00:24:15,400 --> 00:24:18,240
Using the Internet is known to be insecure.

276
00:24:18,240 --> 00:24:19,680
Yes, of course it's insecure.

277
00:24:20,200 --> 00:24:22,620
Okay, just a comment on that.

278
00:24:26,280 --> 00:24:31,320
Really what this is, it's not considered true authentication on there.

279
00:24:31,320 --> 00:24:33,140
All you're doing is you're opening up the port.

280
00:24:33,140 --> 00:24:39,140
Obviously, you'd be opening up the port and then some other process would handle the authentication.

281
00:24:39,140 --> 00:24:40,260
So the tool's misnamed.

282
00:24:41,200 --> 00:24:43,060
No, we are authenticating.

283
00:24:43,060 --> 00:24:44,800
You actually are authenticating.

284
00:24:44,800 --> 00:24:48,880
You're saying, I am who I say I am if you trust PGP.

285
00:24:49,760 --> 00:24:55,940
And then if you trust PGP and it says, okay, I've signed that key, then yes, I know who you are, so I will at least open up the port.

286
00:24:55,940 --> 00:24:59,420
Now you've got to go ahead and provide credentials to get access to the box.

287
00:24:59,760 --> 00:25:01,900
So it's considered a layer.

288
00:25:01,900 --> 00:25:09,020
Okay, so the second comment is your tool where you used spoofed ICMP in order to try to map network topology.

289
00:25:09,020 --> 00:25:24,720
The fact that your client has not implemented anti-spoofing measures on his network all the way down to layer 2, the fact that the tool is allowed to work on the network means that you need to recommend to your client that he implement the anti-spoofing technology so that your tool won't work.

290
00:25:24,720 --> 00:25:30,120
Because it's best practice not to allow spoofed traffic to traverse your network or egress from it.

291
00:25:30,120 --> 00:25:32,100
You're assuming this is for business.

292
00:25:34,440 --> 00:25:36,420
I think it's for any kind of IP.

293
00:25:43,910 --> 00:25:45,650
Don't forget, you're going to come up here spanking.

294
00:25:46,830 --> 00:25:48,490
Which did you want?

295
00:25:51,910 --> 00:25:53,710
Alright, next question.

296
00:26:00,330 --> 00:26:01,370
Next question.

297
00:26:01,370 --> 00:26:02,910
We've got to keep things moving.

298
00:26:08,010 --> 00:26:10,170
Come on, there's got to be more questions than this.

299
00:26:10,170 --> 00:26:11,470
And there's got to be more people than this.

300
00:26:11,470 --> 00:26:14,050
Alright, who just wants to be spanked?

301
00:26:15,770 --> 00:26:18,110
Come on up, we're not shy.

302
00:26:18,210 --> 00:26:22,010
I see people that are like looking and thinking about it.

303
00:26:22,010 --> 00:26:24,710
Come on, let's get some... I'm serious, I'm looking at people.

304
00:26:24,870 --> 00:26:26,930
Oh my god, we've got people coming up.

305
00:26:28,690 --> 00:26:30,870
Yeah, yeah, yeah, come on, alright.

306
00:26:32,250 --> 00:26:35,630
Alright, sign a release form and get your ass spanked.

307
00:26:39,080 --> 00:26:40,520
He's going to read it first.

308
00:26:44,660 --> 00:26:46,140
There's check boxes on there.

309
00:26:46,140 --> 00:26:48,220
Oh, like to who you want to be...

310
00:26:51,200 --> 00:26:53,400
Yeah, like I would like to be spanked by.

311
00:26:53,400 --> 00:26:54,660
Check all that apply.

312
00:26:57,440 --> 00:26:58,900
Oh, we need a beer up here too.

313
00:26:58,900 --> 00:27:00,820
If someone could bring Helen back a beer.

314
00:27:01,080 --> 00:27:03,180
Yes, he has a heavy thing to drink in three minutes.

315
00:27:03,180 --> 00:27:03,820
Please.

316
00:27:04,760 --> 00:27:19,200
Also, the names that you want to be called during the spanking, such as, you can check all that apply, like Biatch, Script Kitty, Scene Whore, Russ Cooper, a number of different ones.

317
00:27:19,740 --> 00:27:21,180
Oh, there, we've got a beer.

318
00:27:21,180 --> 00:27:22,380
We've got a beer for you.

319
00:27:33,340 --> 00:27:39,160
Any other questions while we're at it, while we're getting some people ready to be spanked?

320
00:27:39,740 --> 00:27:42,100
This guy's already signed.

321
00:27:42,100 --> 00:27:43,280
Who do you want to spank you?

322
00:27:45,260 --> 00:27:47,000
Alright, there we go.

323
00:28:04,830 --> 00:28:06,970
Alright, who do you want to have spank you?

324
00:28:07,730 --> 00:28:08,370
Me?

325
00:28:17,070 --> 00:28:19,110
What instrument?

326
00:28:22,250 --> 00:28:24,250
Ah, USAP.

327
00:28:48,020 --> 00:28:52,360
Alright, anyone else got any...

328
00:28:55,240 --> 00:29:02,200
I want to bring Jay Random over here and talk about why the hack pack hadn't been updated in ages.

329
00:29:05,060 --> 00:29:07,780
Basically, it's all your fault.

330
00:29:08,580 --> 00:29:11,160
So, I think we were here maybe two years ago?

331
00:29:11,160 --> 00:29:12,240
Was that the last panel?

332
00:29:12,240 --> 00:29:29,700
Yeah, so two years ago, I spent maybe a good few months taking the hack pack as Nomite had left it, updating the HTML so it was all valid, updating all the URLs so they weren't broken, updating a good amount of the content so that it was relevant to today.

333
00:29:29,700 --> 00:29:35,080
You know, stuff that had been documented back then but wasn't known at the time.

334
00:29:36,360 --> 00:29:39,960
And so we basically came to people and said, we've redone everything.

335
00:29:39,960 --> 00:29:41,300
All we need is your input.

336
00:29:41,300 --> 00:29:49,860
We need more questions, more frequently asked questions that we can get documented in the pack so we can improve general knowledge in the community.

337
00:29:50,000 --> 00:29:52,660
And we just got spam.

338
00:29:52,660 --> 00:29:54,040
That's all we got.

339
00:29:54,040 --> 00:30:01,620
Penis enlargements, credit card bills, so yeah, the pack's pretty much dead.

340
00:30:01,620 --> 00:30:11,360
We're going to keep it online, but clearly no one's really interested in adding to it, so we'll just keep it as a kind of historical record, I guess.

341
00:30:16,340 --> 00:30:21,200
Alright, I think we're right back toward the end of the presentation.

342
00:30:21,200 --> 00:30:26,460
I wanted to go ahead and actually finish up with a couple of specific announcements.

343
00:30:26,460 --> 00:30:29,880
The girl in the picture, yes, she is wearing an NMRC t-shirt.

344
00:30:30,260 --> 00:30:42,160
And yes, I have the world's most understanding wife because I actually paid for the model and paid for the photo session to get these pictures, in particular, just for DEF CON.

345
00:30:42,440 --> 00:30:51,660
And we will make sure that some of the artwork is available on the NMRC website so that you can use it for backgrounds on your computers.

346
00:30:52,080 --> 00:30:55,000
And got a few shoutouts in there.

347
00:30:56,880 --> 00:30:59,120
CAU, they're represented over here.

348
00:30:59,120 --> 00:31:06,400
There's some green guy, that if you see the green guy, then you know that CAU, they've been very supportive for us.

349
00:31:06,400 --> 00:31:14,440
Obviously, all the DC 214 people, because a lot of the talks and stuff that we give, we try them out on our local DC Groups thing.

350
00:31:14,700 --> 00:31:21,280
Also, Mad Hat's going to be participating in the DC Groups panel that's on later this evening.

351
00:31:21,340 --> 00:31:23,720
John Kallis, I saw him at Black Hat.

352
00:31:23,720 --> 00:31:29,560
He had some ideas for SPA that actually were pretty good, that we had put in there, and shoutout to him.

353
00:31:29,560 --> 00:31:31,880
Of course, the rest of the NMRC people that aren't here.

354
00:31:32,440 --> 00:31:35,180
Mike Rash, who is somewhere out here in the audience.

355
00:31:35,180 --> 00:31:36,380
There he is, right there.

356
00:31:37,080 --> 00:31:37,640
F.W.

357
00:31:37,640 --> 00:31:42,860
Knopf, which actually was here last year, actually is very similar.

358
00:31:43,160 --> 00:31:48,120
He's very similar to SPA, so we've been talking with him and everything.

359
00:31:48,120 --> 00:31:58,480
And I just want you guys to know that we're trying, we're going to be actually, our first planning session for DEF CON 14 is going to take place later tonight.

360
00:31:59,060 --> 00:32:05,600
And we promise that we're going to have something really big and fantastic for you guys.

361
00:32:05,600 --> 00:32:15,560
We really appreciate all the support that you guys have given us over this wondrous time that we've been having.

362
00:32:15,640 --> 00:32:19,140
So, really do appreciate all the support from everyone.

363
00:32:19,140 --> 00:32:25,420
We'll try to do our best to give back as much as we can to everyone here.

364
00:32:25,440 --> 00:32:29,560
So, if we have nothing else, just want to say thanks.

365
00:32:29,560 --> 00:32:31,620
Oh, we have something over here, yes.

366
00:32:34,420 --> 00:32:36,820
The rumor is what now?

367
00:32:38,480 --> 00:32:43,840
There are, yes, of course there are rumors that it's not going to be here at Alexis Park next year.

368
00:32:44,380 --> 00:32:50,580
I don't know because there was those same rumors last year as well.

369
00:32:50,980 --> 00:32:57,820
I know there's rumors floating around at ShmooCon for example that it might not be here this year, but in fact it was.

370
00:32:58,080 --> 00:32:59,840
So, I don't know.

371
00:32:59,840 --> 00:33:12,920
I mean, as much as I can, I try to slide my tongue down the back of Jeff Moss's trousers, but he really doesn't tell me much as an exchange for kissing his ass.

372
00:33:12,940 --> 00:33:13,980
So, I don't know.

373
00:33:13,980 --> 00:33:15,780
Take that up with Jeff actually.

374
00:33:15,780 --> 00:33:17,040
Another question.

375
00:33:26,250 --> 00:33:26,930
Okay.

376
00:33:26,990 --> 00:33:29,030
Suggestions for the hack pack, we'll take...

377
00:33:29,030 --> 00:33:32,050
we'll get on that right away.

378
00:33:32,050 --> 00:33:32,770
Okay.

379
00:33:34,050 --> 00:33:38,170
No, and again, all the code and stuff that we're talking about, we will have links up to that stuff.

380
00:33:38,170 --> 00:33:40,190
I'll make sure that stuff gets put up tonight.

381
00:33:40,910 --> 00:33:44,130
So you can pull it down, play with it, break it.

382
00:33:44,830 --> 00:33:46,910
A number of us have been writing code.

383
00:33:46,910 --> 00:33:48,730
We don't profess to be coders.

384
00:33:49,230 --> 00:33:51,110
So, if you come up with...

385
00:33:51,110 --> 00:33:59,170
In fact, for example, SPA had a remotely exploitable heap overflow in it until I found that and corrected it.

386
00:33:59,170 --> 00:33:59,730
Okay .

387
00:33:59,930 --> 00:34:04,650
Anything you guys can do to help add to it.

388
00:34:04,650 --> 00:34:10,370
And if you come up with some better idea than what we've got, then that's even better.

389
00:34:10,370 --> 00:34:16,250
That means we've inspired someone to come up with something that's actually encoded by real coders.

390
00:34:16,250 --> 00:34:18,130
Instead of just hacker types.

391
00:34:18,130 --> 00:34:18,910
Okay.

392
00:34:21,340 --> 00:34:22,620
Do what now?

393
00:34:24,200 --> 00:34:25,140
Oh, yeah.

394
00:34:25,140 --> 00:34:33,140
And if you find any zero days in any of the code that we release, we recommend that you go ahead and turn it into iDefense because they need the help.

395
00:34:33,300 --> 00:34:34,020
Okay.

396
00:34:34,160 --> 00:34:35,220
They really do.

397
00:34:36,040 --> 00:34:38,460
Alright, so, that's it.

398
00:34:38,460 --> 00:34:42,600
We will see you guys next year and at cons in between.

399
00:34:42,600 --> 00:34:44,060
So, thanks a lot.