start	end	text
10420	16120	Naomi, which is probably most of you. My name is Weasel. I'm a member of the Nomad Mobile Research Center.
16500	24260	It's an international group of hackers that's been around for, oh, seven, eight years? Something like that?
24260	28740	Yeah, and we've just, you know, had thousands of projects that we all worked on,
28740	32920	and probably maybe 1% of them have actually been finished and made it to fruition.
33520	40940	Hopefully we've got a few here that might impress a few people,
40940	44460	if anything, maybe inspire them to take them and do something useful with them,
44460	46480	instead of them just sitting on our file server.
50400	54200	Okay, I don't know, am I supposed to read these things? No, okay.
55660	57620	These are a few quotes, feel free to read.
58200	60040	Let me go ahead and introduce a few of the members.
60040	70940	Most of you know Simple Nomad. He started the group. I think he's known for his goat porn, and Pandora.
71560	77160	So if anybody has any support questions with Pandora, that's thenome at nmrc.org.
79800	88040	Anyway, next to him is Jay Random. He's another long-term member, and probably his claim for fame is...
88040	93040	I won't embarrass you. He was the maintainer of the Hack Fact for many years,
93040	98860	and if we actually have time at the end of our presentation, he'll go over what's happened with that,
98860	103060	and why it's not as up-to-date as it probably should be, or if it even should be up-to-date.
103440	108660	And then over there is Mad Hat. If there are any single ladies in the audience, he will buy you a car.
108660	120460	So, speak to him afterwards. I'll let you introduce your personal life. It's Mad Hat.
121120	127980	He's recently joined the group, and he's coming up with some really exciting projects. And that's who we are.
128960	135440	Okay, we'll go on to the where section and see what tools we've been going over here. And this is yours.
137500	145980	First off, a tool that I had worked on previously called Encrypt. And I've talked about it previously at other conferences,
145980	152400	so I'm not going to go into a whole lot of detail on it. It's a symmetrical crypto tool.
153020	157440	The one thing, and it also had some file wiping features that came with it, and it was kind of nice.
157440	170260	It included AES and Serpent and TwoFish. Included in that, Todd McDermott, who's contributed code to the project.
170260	175560	I don't know if Todd is here. Is Todd McDermott in the audience anywhere? I was going to have him stand up.
175560	181360	Anyway, he's contributed a lot of code to the project, and it's out on SourceForge if you're looking for it.
181360	191860	But anyway, I'm hoping to get up... Todd wrote a drop-in replacement for RM called NRM, which does basically secure wiping of a file where it does multi-passes.
192000	198020	And it forks off into the background and kind of runs and does all the passes so you get your prompt back.
198140	202360	And that's the main thing that we've added into that. The other thing is, believe it or not, we put in...
203280	209440	We had a lot of people asking for integration for the Encrypt tool into scripts, where they actually...
209440	216940	And this was requested, say, we want to be able to pass the password on the command line or from a text file, which is horrid.
216940	223180	However, they're wanting to do it for encrypting log files before transmitting them from one machine to the other.
223940	227900	I'm not exactly sure... I don't use that feature, but I had enough people do it.
227900	231020	I put it in there, and it's in the man pages. It says it's highly dangerous.
231020	244100	But nonetheless, it's in there in case you want to assume that the box that was broken into makes sure that those log files that they get across there in a secure fashion.
244300	248920	Anyway, next, Mad Hat. Why don't you come and talk about that?
254580	258800	Alright, so, actually this is three different tools I wrote a while back.
265250	268070	This is designed for short people, it's not my fault.
268330	270510	Alright, can everybody hear me now?
271370	273070	I'll take that as a yes.
273110	275290	Alright, so these are actually three different tools.
275750	282950	I had a project where I had to scan a large number of IPs on a daily basis and figure out what exactly was changing, what was going on.
282950	287670	I love nmap and all the work that Fyodor has done on that.
287670	291470	Unfortunately, it wasn't quite fast enough for what I needed, so I wrote the nmap wrapper.
291530	295790	And what that does is it runs a bunch of nmap processes in parallel.
296010	299370	Stores all of it to flat files right now using the graphical output.
299630	302750	The other two tools work off of those databases.
302870	307070	nmap report basically allows you to go in and specify what you want to see.
307070	309410	So, show me all the hosts that are windows.
309410	312930	Show me all the hosts that are nmap 480 open.
313510	319830	nmap diff allows you to specify two specific dates and give you the diff on all the hosts or any particular host.
319830	324870	The whole idea is being able to monitor large networks for changes.
324870	332030	By default it only shows you new things are added, but you can also show whenever things go away a whole new host that comes up.
332030	338810	And it just makes it a whole lot easier than trying to look at something that you only see a snapshot once every week or something of that nature.
338810	340930	It shows you daily changes.
342850	345330	Oh yeah, so I was...
345330	352370	For this particular project, I was scanning around 150,000 IPs a day.
352370	358690	And I had it down to around 10 hours to scan all 150,000 IPs, so I could have done it twice a day if necessary.
358690	364770	From a single box, 3BSD box, sitting in a DMZ, scanning hosts worldwide.
364770	366410	This was not like a single location.
366410	373590	This was boxes all around the world, trying to deal with network latencies, you know, and well, the speed of light, things such as that.
374310	377810	So it came in extremely handy.
382220	386440	Alright, so for those of you who are at Black Hat, we went over this at Black Hat.
386440	388600	The idea is single packet authentication.
388600	393440	This was really a project just to see if it could be done.
393520	397060	I run the local DC group in Dallas, which is DC214.
397060	402080	And we started discussing a year and a half or so ago, you know, after Port Knocking came out.
402400	403980	Is there a better way of doing this?
403980	405600	You know, do we really need to send multiple packets?
405600	412260	Can we do it with a single packet and make it not replayable and make it, you know, secure and actually do more than just open a port?
412260	413420	You know, can we run commands?
413420	416140	Can we do things like, say, reverse shell?
416240	418260	Do we have to have any ports actually listening?
418260	420400	So this is what we came up with.
421340	422960	It's a simple protocol.
422960	425220	It allows a remote user to authenticate the system.
425260	426560	There's nothing listening.
426560	428520	It sniffs all the packets that are coming in.
428640	432580	We use PGP or GPG to encrypt the data.
433260	439200	And whenever you do that, if you just use raw encryption, what is it, eight bytes in?
439560	446500	Eight bytes in, there are four bytes that are the GPG ID of the key that can decrypt it.
446500	450420	So basically, we look for that, we see that, we pass it on to the processing engine.
451360	452440	Of course, it's free.
453480	454240	Why not?
456420	456700	Well...
457120	462240	And of course, one of the issues we wanted to deal with was working across NAT because we always hated, you know, having somebody call us up.
462440	465380	Hey, I need to be able to check my mail on such and such host.
465380	466560	Okay, what IP are you on?
466600	468260	I'm on 192.168.
468260	469100	No, no, no, no, no.
469140	470380	What IP are you going to be coming from?
470380	471540	Well, it says 192.
471540	472520	Oh, Jesus.
472520	480420	So, they can send, you know, with the client, they can send a single packet and it looks at the source address and says, oh, okay, so we'll open it up for that IP.
480420	484540	And then, of course, it monitors the traffic and after a certain timeout, it will automatically close the port.
484980	491580	We're also, you know, working with the idea of doing a reverse shell, so you send a single packet and it connects back to you.
491940	497320	And then we can also have it to where, in our sample code, where you can run arbitrary commands.
497320	503080	And the commands are specified in the config file, so it's not like anybody who has access to it can run any command.
503080	507420	You have a comma-separated list of the commands that are allowed to be run by that particular user.
508860	511880	This is a visual representation of basically how it works.
511880	515820	So, over on the left-hand side, you have the client with, you know, its GPG ID.
515960	525600	It encrypts all the data, which includes, you know, an ID, session keys, timestamp, and then the command and control data for the application that's using this fault protocol.
526220	530640	It's encrypted and signed, you know, encrypted for security and signed for authenticity.
530960	536340	And then it can be, you know, it's a data packet. So, I mean, it can be TCP, UDP, ICMP, anything like that.
536340	539320	We've implemented TCP and UDP in our sample code.
539700	542420	And then, of course, you know, it encrypts it with the server's key.
542460	546520	The server gets it, verifies that it's, you know, encrypted data, passes it on.
547860	550060	It's kind of an idea of how it's laid out.
551200	555380	I'm a Perl hacker, so the parts that I worked on are in Perl.
555740	560140	The client right now, you know, can be on whatever host.
560140	561180	Sends the data.
561180	564700	SPA-D is basically a simple sniffer.
565420	567080	Nomad Spark written in C.
567460	574360	Once it verifies, you know, what it's looking for, sends it on to the SPA engine, which then calls GPG as necessary to decrypt.
574540	580020	Checks the user config to verify, you know, whatever they're asking to do can be done.
580020	582760	And it also keeps track of firewall states.
582760	591440	So, for some reason, the daemon, you have to restart the daemon, and it's going to know what ports were already open and still keep track of them and close them as necessary.
594850	596310	And a whole new one.
597890	601470	And we will have time for questions a little bit later.
602390	613990	Alright, so, at the job where I was mentioning where I wrote the nmap tool, my primary responsibility was scanning and monitoring of large groups of hosts.
613990	619330	A whole lot of web servers and Unix boxes.
620290	631450	At the time, whenever I first started on this particular project, there wasn't a lot out there to be able to scan all those same IPs on a daily basis, you know, for basic misconfigurations.
631450	632870	Vulnerabilities, things such as that.
632870	638170	So, I wrote, I started off writing a very simple HTTP scanner, and it kept growing and growing and growing.
640190	643010	Works off command line, or it has a web-based GUI.
643110	645390	You know, same script, just depends on how you call it.
646330	652430	The configs are all in XML, so it's really easy to add and remove things or expand them.
652550	657190	Lots of command line options to specify exactly what you want to scan for, how you want to scan it.
657190	663410	Runs a whole bunch of processes in parallel, according to, you know, whatever your system can handle, so it's fairly quick.
663550	671790	I added in, I started adding in some other features, like FTP to look for anonymous access, look for writable directories, things such as that.
672630	682710	The SQL stuff was added because, you know, I happened to be working on parts of it whenever, you know, the whole SQL Clamor thing came around, so it was easy to add in other features.
683130	686890	There was also some SMTP stuff, but, you know.
687010	691290	It is extremely fast, that was the whole idea.
691810	695330	You know, once again, I was scanning a large number of hosts.
695750	698750	Needed to get it done, you know, in a short amount of time.
699370	702410	The way the output works, there are multiple outputs.
702450	708210	You know, there's a verbose output that would actually tell you, here's the vulnerability and here's the fix, and, you know, standard stuff for a scanner.
708210	715210	But it also, another thing was, it was written so that I could export the data, import it into a database very easily.
715530	718030	Also worked a whole lot of time on false positives.
718030	727490	For anybody who's done any, you know, constant monitoring of hosts, the big thing is, oh look, there's a Apache vulnerability running on an IIS box.
727790	729390	Yeah, that makes sense.
729390	735750	So, I spent a whole lot of time making sure that there were as few false positives as possible, looking for a whole bunch of different things.
735750	743470	You know, looking for custom 404s, you know, things that, it's starting to become a little bit more common in scanners, but at the time...
743990	746850	And of course, once again, it's free.
748030	749970	Hey, I'm gonna stand up here for a while.
751270	753150	Alright, so here's another one.
753310	755250	Once again, in Perl.
755350	762190	This one, the idea is ICMP packets are sent out with a forged source address.
762190	770590	The whole idea was, on the corporate network, we wanted to check to see if people had DSL lines or modems, you know, something,
770590	775690	or even misconfigured network devices, so that things were being sent out the wrong direction.
777090	782010	I wrote a small Perl module that allows for looping, so all of these actually use the same Perl module,
782010	786070	so you can actually specify ranges of hosts in, you know, almost any format.
786070	787510	Makes it really easy to run.
787690	791110	So, what this does is it forges an ICMP echo request.
791110	796510	The data contains the IP that it was supposed to be sent to, as well as a signed key,
796510	799410	which is just using MD5 and a shared secret.
799450	803010	The server snips those on that forged address.
803010	808870	Whenever it comes in, it looks to see if the source, where it was being, where the echo appliance is coming from,
808870	810670	is the same as within the data portion.
810670	815890	Because the nice thing about ICMP is, whatever you send it in the data portion, it sends back in the data portion.
816010	818610	So it made it very easy to be able to do this.
818610	823330	So I was able to find DSL hooked up to a corporate network.
823330	826230	Somebody had gotten a DSL line run to their desk.
826230	829190	How? I don't know. I wasn't involved in that part.
829370	833950	But basically, their default route went out to SBC.
834010	842070	So I'm sitting here spewing packets to the 192 space, and all of a sudden I'm seeing data coming back from SBC,
842070	843750	and that's not a good thing.
843750	850410	And of course, my favorite was the networking devices that had odd routes added for no apparent reason.
850550	853530	Of course, the networking guys denied that it was on purpose or anything like that,
853530	855570	but it got changed rather quickly after you find it.
857030	862130	Once again, fast, simple, very specific problem to solve.
867200	871080	Okay, here's another contribution of mine.
871080	875980	This is NPC, Nearly Perfect Crypto.
876120	881680	And I'm so glad you're sitting right there in front of me. I really am.
882620	887360	What this does is it's mainly meant as an academic tool, okay?
887620	893280	Fuck you. I got mud up here causing shit for me.
893280	896680	It really is meant as an academic tool, and I'll tell you why.
896680	900560	I mean, there's a lot of people that don't understand how one-time pads work.
900560	903840	What this is is an implementation of a one-time pad, okay?
903840	909360	And the reason I say it's Nearly Perfect Crypto is because it is perfect,
909360	918600	but it is as only reliable as Isaac, the pseudorandom number generator that I've got in there.
918600	925060	And it is only as perfect as your key management, which is actually kind of the bad thing.
925060	932120	So if I'm going to send, let's say, goat porn to Mudge, because...
933660	934700	It wouldn't be the first time.
934700	936040	No, it wouldn't be the first time.
936040	941480	Then what I would do is I'd say, hmm, well this file is 30 meg in size,
941480	946840	so then I'd need to generate a 30 meg key to make it happen.
946840	949760	And then the trick is, is me getting that key to him,
949760	954760	and then us never ever using that key ever again for anything.
954760	957880	Destroying the key after it's done.
957880	961260	I mean, literally, if I put it on a CD and hand it to him,
961260	964920	and then we're done with it, we need to destroy the key.
964920	967800	Perhaps with that NRM file that I had previously,
967800	971100	or we throw the CDs into a vat of acid,
971100	975700	or however you manage your paranoia with your CDs at home.
975700	977060	However that happens.
977340	981340	Anyway, because you're doing something which is like a one-time pad,
981340	987140	it makes the crypto part, really it's not very complicated.
987580	990020	You're just doing a simple XOR.
990020	995940	So it is very fast, very simple, it's really nice to do.
995940	998420	Like I said, if you can manage the key exchange,
999060	1002240	you're getting damn close to having pretty good crypto.
1004080	1009220	Anyway, just to show you why this thing is so fast and secure,
1009220	1013220	here's the main, and I have it in quotes there,
1013220	1016100	crypto loop, because it's hardly a loop.
1016100	1020460	And if you look right down here, toward the bottom,
1025190	1029150	oh my god, I know why he showed up.
1029370	1030890	You'll know in a minute.
1031630	1034990	Where it says, wicked crypto, because we are XORing.
1034990	1040190	And you can see that massively intense one line of code there
1040190	1042830	that kicks so much ass.
1044090	1047150	So anyway, we have this tool there to kind of play with this.
1047150	1049370	And I'll tell you the truth, the main reason,
1049370	1051610	actually, truthfully, the main reason I wrote this tool
1051610	1052990	is because there's a friend of mine
1054150	1059130	who we would like to really, really have some deep, serious conversations with.
1059270	1061850	And we were talking about, well, how in the world
1061850	1065110	could we actually do this in a secure fashion?
1067290	1071750	Well, okay, we have a smartass up front who thinks he knows something.
1071890	1075770	But nonetheless, we just kind of went over various scenarios and everything.
1075770	1077310	So I've come up with this thing.
1077310	1079990	By the way, this and all the tools, we're going to have a spot out there
1079990	1083270	on the NMRC website.
1083510	1085770	We'll put something up on the front page.
1085770	1087230	Hopefully I'll get it done tonight.
1087350	1091390	And we'll have pointers to all the tools, all the presentations.
1091710	1094370	Please, all questions at the end, please.
1095010	1098350	And, oh, well, see, now it's at time for Q&A.
1098350	1100390	Now, this is the thing we're going to do.
1100390	1105130	For the Q&A, because this is kind of a dry kind of tool talk,
1105690	1108510	so what we're going to do, something different from the Q&A,
1108510	1111090	is during the Q&A portion of this,
1111090	1113770	we're going to go ahead and spank audience members
1114510	1116650	who want to be spanked.
1116790	1119590	Now, the thing that we're going to do is,
1119590	1122090	the first thing is, if you're coming up here,
1122690	1125950	I mean, obviously there's no female members,
1125950	1130230	although I think we may be able to recruit some females
1130230	1132930	that we happen to know to come up here to help spank.
1138620	1140040	Lily, come on up.
1140760	1143540	So you're going to have a choice of, you know,
1143540	1146320	not only being spanked by a guy,
1146320	1148560	but you can be spanked by a chick.
1149020	1151640	Okay, now the thing is, if you want to be spanked,
1151640	1154600	we do have a release form you do have to sign.
1154600	1158320	If anyone has been reading on Full Disclosure,
1158320	1161000	we did post a link to the release form,
1161000	1163360	so if you filled out one previously,
1163360	1164880	that you printed off and filled out,
1164880	1166700	feel free to go ahead and bring it up.
1166940	1169480	Let me get out the stuff that you're going to be spanked with.
1169480	1170740	Hold on just a second.
1183300	1186100	Alright, the first thing that we're going to spank people with
1186100	1191180	is a ShmooCon, this is from the Shmoo group.
1191180	1193380	When I was at ShmooCon, all the speakers got these
1193380	1196060	because they handed out Shmoo balls to throw at speakers
1196060	1200480	that weren't behaving well, or being stupid, or causing shit.
1200480	1202980	So they gave the speakers something to fight back with,
1202980	1207320	so we have a Shmoo group paddle that you can be spanked with.
1207320	1212600	You can also be spanked via a nice firm hand.
1213820	1216440	And the final thing to be spanked with
1219720	1224480	is a copy of the third edition of Hacking Exposed.
1228610	1231550	And just to show how it's going to work,
1234870	1237750	I want to bring Mudge up here and spank him.
1237750	1239330	Let's get Mudge up here.
1279190	1282090	You guys should have seen the rehearsals.
1330940	1333640	I would have to look at the code specifically.
1333640	1336280	I stole some code from Todd McDermott
1336280	1339040	because we worked on entropy stuff.
1339100	1343860	Part of it is we're using processor timing speeds
1343860	1348000	and we're throwing in some... I forget the exact call.
1348000	1349100	It's one where you're saying,
1349650	1353360	slow down, I'm relinquishing the processor,
1353360	1355100	and so I get a random time.
1355100	1356300	And so that gives me...
1356730	1359720	between that and some other stuff thrown in,
1359720	1361300	like the times and stuff.
1366870	1368550	Okay, there you go.
1369670	1371110	Okay, thank you.
1371970	1374110	Anyone else? Anyone else want to...
1377410	1379330	Comments instead of questions?
1379330	1381710	Yeah, go ahead. You got a comment?
1382510	1384610	Two comments, go ahead.
1388290	1390070	All right.
1390130	1393690	You want to get spanked while you're getting your comments?
1396050	1398430	Who do you want to spank you?
1398630	1400230	Sign the release form.
1402370	1404090	He signed it.
1404090	1405450	Woo!
1407390	1408670	Jesus.
1409210	1411830	Notice he didn't read it first.
1418580	1420840	Give him a mic.
1438100	1442120	Okay, so my first comment is your single packet authentication thing.
1442120	1444220	Talk about using it behind a NAT
1444220	1446620	so that you could open up a service and so forth.
1446620	1447460	Aren't you opening...
1448160	1450800	You're opening up that service for everything behind that NAT
1450800	1452360	and everyone behind that NAT.
1452360	1454080	Isn't that kind of insecure?
1454660	1455140	Yes.
1455400	1458240	Using the Internet is known to be insecure.
1458240	1459680	Yes, of course it's insecure.
1460200	1462620	Okay, just a comment on that.
1466280	1468120	Really what this is,
1468120	1471320	it's not considered true authentication on there.
1471320	1473140	All you're doing is you're opening up the port.
1473140	1475640	Obviously, you'd be opening up the port
1475640	1477440	and then some other process
1477440	1479140	would handle the authentication.
1479140	1480260	So the tool's misnamed.
1481200	1483060	No, we are authenticating.
1483060	1484800	You actually are authenticating.
1484800	1486720	You're saying, I am who I say I am
1486720	1488880	if you trust PGP.
1489760	1491560	And then if you trust PGP
1491560	1493240	and it says, okay, I've signed that key,
1493240	1495940	then yes, I know who you are, so I will at least open up the port.
1495940	1497620	Now you've got to go ahead and provide credentials
1497620	1499420	to get access to the box.
1499760	1501900	So it's considered a layer.
1501900	1503680	Okay, so the second comment is
1503680	1506420	your tool where you used spoofed ICMP
1506420	1509020	in order to try to map network topology.
1509020	1510920	The fact that your client
1510920	1513300	has not implemented anti-spoofing measures
1513300	1515880	on his network all the way down to layer 2,
1515880	1518860	the fact that the tool is allowed to work on the network
1518860	1520600	means that you need to recommend to your client
1520600	1523360	that he implement the anti-spoofing technology
1523360	1524720	so that your tool won't work.
1524720	1527520	Because it's best practice not to allow spoofed traffic
1527520	1530120	to traverse your network or egress from it.
1530120	1532100	You're assuming this is for business.
1534440	1536420	I think it's for any kind of IP.
1543910	1545650	Don't forget, you're going to come up here spanking.
1546830	1548490	Which did you want?
1551910	1553710	Alright, next question.
1560330	1562910	Next question. We've got to keep things moving.
1568010	1570170	Come on, there's got to be more questions than this.
1570170	1571470	And there's got to be more people than this.
1571470	1574050	Alright, who just wants to be spanked?
1575770	1578110	Come on up, we're not shy.
1578210	1582010	I see people that are like looking and thinking about it.
1582010	1584710	Come on, let's get some... I'm serious, I'm looking at people.
1584870	1586930	Oh my god, we've got people coming up.
1588690	1590870	Yeah, yeah, yeah, come on, alright.
1592250	1595630	Alright, sign a release form and get your ass spanked.
1599080	1600520	He's going to read it first.
1604660	1606140	There's check boxes on there.
1606140	1608220	Oh, like to who you want to be...
1611200	1613400	Yeah, like I would like to be spanked by.
1613400	1614660	Check all that apply.
1617440	1618900	Oh, we need a beer up here too.
1618900	1620820	If someone could bring Helen back a beer.
1621080	1623180	Yes, he has a heavy thing to drink in three minutes.
1623180	1623820	Please.
1624760	1627420	Also, the names that you want to be called
1627420	1629780	during the spanking,
1629780	1631740	such as, you can check all that apply,
1631740	1634000	like Biatch, Script Kitty,
1634000	1636200	Scene Whore, Russ Cooper,
1637820	1639200	a number of different ones.
1639740	1641180	Oh, there, we've got a beer.
1641180	1642380	We've got a beer for you.
1653340	1656920	Any other questions while we're at it,
1656920	1659160	while we're getting some people ready to be spanked?
1659740	1662100	This guy's already signed.
1662100	1663280	Who do you want to spank you?
1665260	1667000	Alright, there we go.
1684830	1686970	Alright, who do you want to have spank you?
1687730	1688370	Me?
1697070	1699110	What instrument?
1702250	1704250	Ah, USAP.
1728020	1732360	Alright, anyone else got any...
1735240	1737660	I want to bring Jay Random over here
1737660	1739380	and talk about why the hack pack
1739380	1742200	hadn't been updated in ages.
1745060	1747780	Basically, it's all your fault.
1748580	1749880	So, I think we were here
1749880	1751160	maybe two years ago?
1751160	1752240	Was that the last panel?
1752240	1754120	Yeah, so two years ago,
1754120	1757240	I spent maybe a good few months
1757240	1759020	taking the hack pack as
1759020	1760840	Nomite had left it,
1761340	1763460	updating the HTML so it was all valid,
1763460	1765480	updating all the URLs so they weren't broken,
1765960	1767300	updating a good amount of the content
1767300	1769700	so that it was relevant to today.
1769700	1771860	You know, stuff that had been documented back then
1772420	1775080	but wasn't known at the time.
1776360	1777780	And so we basically came to people
1777780	1779960	and said, we've redone everything.
1779960	1781300	All we need is your input.
1781300	1782760	We need more questions,
1782760	1784080	more frequently asked questions
1784080	1786400	that we can get documented in the pack
1786400	1788600	so we can improve general knowledge
1788600	1789860	in the community.
1790000	1792660	And we just got spam.
1792660	1794040	That's all we got.
1794040	1795200	Penis enlargements,
1796060	1797540	credit card bills,
1798480	1799840	so yeah,
1799840	1801620	the pack's pretty much dead.
1801620	1803200	We're going to keep it online,
1803200	1805260	but clearly no one's really interested
1805260	1807240	in adding to it,
1807240	1809660	so we'll just keep it as a kind of
1809660	1811360	historical record, I guess.
1816340	1817680	Alright, I think we're right
1818320	1819740	back toward the end
1819740	1821200	of the presentation.
1821200	1823320	I wanted to go ahead and actually finish up
1823320	1826460	with a couple of specific announcements.
1826460	1827860	The girl in the picture, yes,
1827860	1829880	she is wearing an NMRC t-shirt.
1830260	1832600	And yes, I have the world's
1832600	1833740	most understanding wife
1833740	1835560	because I actually paid for the model
1835560	1837020	and paid for the photo session
1837020	1839480	to get these pictures, in particular,
1839480	1842160	just for DEF CON.
1842440	1843820	And we will make sure that
1843820	1845580	some of the artwork is available
1845580	1847000	on the NMRC website
1847000	1849160	so that you can use it for
1849840	1851660	backgrounds on your computers.
1852080	1855000	And got a few shoutouts in there.
1856880	1857600	CAU,
1857600	1859120	they're represented over here.
1859120	1860840	There's some green guy, that if you see
1860840	1862580	the green guy, then you know that
1862580	1864800	CAU, they've been very supportive
1865500	1866960	for us. Obviously,
1866960	1868720	all the DC 214 people, because
1868980	1870260	a lot of the talks and stuff
1870260	1872800	that we give, we try them out on our local
1872800	1874440	DC Groups thing.
1874700	1876680	Also, Mad Hat's going to be participating
1876680	1878880	in the DC
1878880	1881280	Groups panel that's on later this evening.
1881340	1883720	John Kallis, I saw him at Black Hat.
1883720	1885620	He had some ideas for
1885620	1887720	SPA that actually were pretty good, that we had put
1887720	1889560	in there, and shoutout to him.
1889560	1891880	Of course, the rest of the NMRC people that aren't here.
1892440	1893780	Mike Rash, who is
1893780	1895700	somewhere out here in the audience. There he is, right
1895700	1897960	there. F.W. Knopf,
1897960	1898860	which actually was
1900340	1901820	here last year,
1901820	1903720	actually is very similar. He's very
1903720	1905880	similar to SPA, so we've been talking with him
1907040	1908120	and everything.
1908120	1909820	And I just want you guys to know
1909820	1911640	that we're trying, we're going to be
1911640	1913500	actually, our first planning session
1913500	1915700	for DEF CON 14
1915700	1918480	is going to take place later tonight.
1919060	1919580	And we
1919580	1921040	promise that we're going to have something
1921640	1923460	really big
1923460	1925600	and fantastic for you guys.
1925600	1927120	We really appreciate
1927640	1929820	all the support that you guys have given us
1930620	1931740	over this
1932940	1933620	wondrous
1933620	1935560	time that we've been having.
1935640	1937620	So, really do appreciate all
1937620	1939620	the support from everyone. We'll try to
1939620	1941740	do our best to give back
1941740	1942840	as much as we can
1943620	1945680	to everyone here. So,
1945680	1947440	if we have nothing else,
1947440	1949560	just want to say thanks.
1949560	1951620	Oh, we have something over here, yes.
1954420	1955240	The rumor
1955240	1956820	is what now?
1958480	1959340	There are,
1959340	1961160	yes, of course there are rumors that it's not going to
1961160	1962920	be here at Alexis Park
1962920	1965400	next year. I don't know
1965400	1967120	because there was those same
1967120	1968880	rumors last year
1968880	1970580	as well.
1970980	1973000	I know there's rumors floating around at ShmooCon
1973000	1975020	for example that it might not
1975020	1976900	be here this year, but in fact it
1976900	1978980	was. So, I
1978980	1980580	don't know. I mean,
1980580	1982920	as much as I
1982920	1984900	can, I try to slide my tongue down the
1984900	1987060	back of Jeff Moss's
1987060	1988880	trousers, but he really doesn't tell me
1988880	1990820	much as an exchange
1990820	1992920	for kissing his ass.
1992940	1994860	So, I don't know. Take that up with Jeff
1994860	1997040	actually. Another question.
2006250	2006930	Okay.
2006990	2009030	Suggestions for the hack pack, we'll take...
2009030	2011070	we'll get on that
2011070	2012770	right away. Okay.
2014050	2015010	No, and again,
2015010	2017010	all the code and stuff that we're talking about, we will
2017010	2019050	have links up to that stuff. I'll make sure that stuff gets
2019050	2020190	put up tonight.
2020910	2023130	So you can pull it down, play with it,
2023130	2024130	break it.
2024830	2026910	A number of us have been writing code.
2026910	2028730	We don't profess to be coders.
2029230	2031110	So, if you come up with...
2031110	2032710	In fact, for example, SPA
2032710	2034690	had a remotely
2034690	2036530	exploitable heap overflow in it
2036530	2039170	until I found that and corrected it.
2039170	2039730	Okay.
2039930	2042670	Anything you guys can do to help add
2043430	2044650	to it.
2044650	2046610	And if you come up with some better idea
2046610	2048090	than what we've got,
2048090	2050370	then that's even better.
2050370	2052370	That means we've inspired someone
2052370	2054510	to come up with something that's actually
2054510	2056250	encoded by real coders.
2056250	2058130	Instead of just hacker types.
2058130	2058910	Okay.
2061340	2062620	Do what now?
2064200	2065140	Oh, yeah.
2065140	2066480	And if you find
2066480	2068480	any zero days in any of the
2068480	2070380	code that we release, we recommend that you go ahead
2070380	2072300	and turn it into iDefense because they need
2072300	2074020	the help. Okay.
2074160	2075220	They really do.
2076040	2078460	Alright, so, that's it.
2078460	2080460	We will see you guys next year
2080460	2082600	and at cons in between.
2082600	2084060	So, thanks a lot.