WEBVTT 00:10.420 --> 00:12.300 Naomi, which is probably most of you. 00:12.300 --> 00:13.200 My name is Weasel. 00:13.200 --> 00:16.120 I'm a member of the Nomad Mobile Research Center. 00:16.500 --> 00:22.500 It's an international group of hackers that's been around for, oh, seven, eight years? 00:23.040 --> 00:24.260 Something like that? 00:24.260 --> 00:32.920 Yeah, and we've just, you know, had thousands of projects that we all worked on, and probably maybe 1% of them have actually been finished and made it to fruition. 00:33.520 --> 00:46.480 Hopefully we've got a few here that might impress a few people, if anything, maybe inspire them to take them and do something useful with them, instead of them just sitting on our file server. 00:50.400 --> 00:53.300 Okay, I don't know, am I supposed to read these things? 00:53.400 --> 00:54.200 No, okay. 00:55.660 --> 00:57.620 These are a few quotes, feel free to read. 00:58.200 --> 01:00.040 Let me go ahead and introduce a few of the members. 01:00.040 --> 01:02.780 Most of you know Simple Nomad. 01:02.780 --> 01:04.400 He started the group. 01:04.600 --> 01:10.940 I think he's known for his goat porn, and Pandora. 01:11.560 --> 01:17.160 So if anybody has any support questions with Pandora, that's thenome at nmrc.org. 01:19.800 --> 01:22.320 Anyway, next to him is Jay Random. 01:22.320 --> 01:28.040 He's another long-term member, and probably his claim for fame is... 01:28.040 --> 01:29.640 I won't embarrass you. 01:29.940 --> 01:43.060 He was the maintainer of the Hack Fact for many years, and if we actually have time at the end of our presentation, he'll go over what's happened with that, and why it's not as up-to-date as it probably should be, or if it even should be up-to-date. 01:43.440 --> 01:45.260 And then over there is Mad Hat. 01:45.260 --> 01:48.660 If there are any single ladies in the audience, he will buy you a car. 01:48.660 --> 01:53.560 So, speak to him afterwards. 01:54.680 --> 01:58.940 I'll let you introduce your personal life. 01:59.040 --> 02:00.460 It's Mad Hat. 02:01.120 --> 02:05.640 He's recently joined the group, and he's coming up with some really exciting projects. 02:06.680 --> 02:07.980 And that's who we are. 02:08.960 --> 02:13.420 Okay, we'll go on to the where section and see what tools we've been going over here. 02:13.760 --> 02:15.440 And this is yours. 02:17.500 --> 02:22.700 First off, a tool that I had worked on previously called Encrypt. 02:23.440 --> 02:28.120 And I've talked about it previously at other conferences, so I'm not going to go into a whole lot of detail on it. 02:28.120 --> 02:32.400 It's a symmetrical crypto tool. 02:33.020 --> 02:37.440 The one thing, and it also had some file wiping features that came with it, and it was kind of nice. 02:37.440 --> 02:42.160 It included AES and Serpent and TwoFish. 02:43.500 --> 02:50.260 Included in that, Todd McDermott, who's contributed code to the project. 02:50.260 --> 02:51.500 I don't know if Todd is here. 02:51.500 --> 02:53.480 Is Todd McDermott in the audience anywhere? 02:53.840 --> 02:55.560 I was going to have him stand up. 02:55.560 --> 03:01.360 Anyway, he's contributed a lot of code to the project, and it's out on SourceForge if you're looking for it. 03:01.360 --> 03:11.860 But anyway, I'm hoping to get up... Todd wrote a drop-in replacement for RM called NRM, which does basically secure wiping of a file where it does multi-passes. 03:12.000 --> 03:18.020 And it forks off into the background and kind of runs and does all the passes so you get your prompt back. 03:18.140 --> 03:20.240 And that's the main thing that we've added into that. 03:20.240 --> 03:22.360 The other thing is, believe it or not, we put in... 03:23.280 --> 03:29.440 We had a lot of people asking for integration for the Encrypt tool into scripts, where they actually... 03:29.440 --> 03:36.940 And this was requested, say, we want to be able to pass the password on the command line or from a text file, which is horrid. 03:36.940 --> 03:43.180 However, they're wanting to do it for encrypting log files before transmitting them from one machine to the other. 03:43.940 --> 03:47.900 I'm not exactly sure... I don't use that feature, but I had enough people do it. 03:47.900 --> 03:49.560 I put it in there, and it's in the man pages. 03:49.560 --> 03:51.020 It says it's highly dangerous. 03:51.020 --> 04:04.100 But nonetheless, it's in there in case you want to assume that the box that was broken into makes sure that those log files that they get across there in a secure fashion. 04:04.300 --> 04:07.400 Anyway, next, Mad Hat. 04:07.400 --> 04:08.920 Why don't you come and talk about that? 04:14.580 --> 04:18.800 Alright, so, actually this is three different tools I wrote a while back. 04:25.250 --> 04:28.070 This is designed for short people, it's not my fault. 04:28.330 --> 04:30.510 Alright, can everybody hear me now? 04:31.370 --> 04:33.070 I'll take that as a yes. 04:33.110 --> 04:35.290 Alright, so these are actually three different tools. 04:35.750 --> 04:42.950 I had a project where I had to scan a large number of IPs on a daily basis and figure out what exactly was changing, what was going on. 04:42.950 --> 04:47.670 I love nmap and all the work that Fyodor has done on that. 04:47.670 --> 04:51.470 Unfortunately, it wasn't quite fast enough for what I needed, so I wrote the nmap wrapper. 04:51.530 --> 04:55.790 And what that does is it runs a bunch of nmap processes in parallel. 04:56.010 --> 04:59.370 Stores all of it to flat files right now using the graphical output. 04:59.630 --> 05:02.750 The other two tools work off of those databases. 05:02.870 --> 05:07.070 nmap report basically allows you to go in and specify what you want to see. 05:07.070 --> 05:09.410 So, show me all the hosts that are windows. 05:09.410 --> 05:12.930 Show me all the hosts that are nmap 480 open. 05:13.510 --> 05:19.830 nmap diff allows you to specify two specific dates and give you the diff on all the hosts or any particular host. 05:19.830 --> 05:24.870 The whole idea is being able to monitor large networks for changes. 05:24.870 --> 05:32.030 By default it only shows you new things are added, but you can also show whenever things go away a whole new host that comes up. 05:32.030 --> 05:38.810 And it just makes it a whole lot easier than trying to look at something that you only see a snapshot once every week or something of that nature. 05:38.810 --> 05:40.930 It shows you daily changes. 05:42.850 --> 05:45.330 Oh yeah, so I was... 05:45.330 --> 05:52.370 For this particular project, I was scanning around 150,000 IPs a day. 05:52.370 --> 05:58.690 And I had it down to around 10 hours to scan all 150,000 IPs, so I could have done it twice a day if necessary. 05:58.690 --> 06:04.770 From a single box, 3BSD box, sitting in a DMZ, scanning hosts worldwide. 06:04.770 --> 06:06.410 This was not like a single location. 06:06.410 --> 06:13.590 This was boxes all around the world, trying to deal with network latencies, you know, and well, the speed of light, things such as that. 06:14.310 --> 06:17.810 So it came in extremely handy. 06:22.220 --> 06:26.440 Alright, so for those of you who are at Black Hat, we went over this at Black Hat. 06:26.440 --> 06:28.600 The idea is single packet authentication. 06:28.600 --> 06:33.440 This was really a project just to see if it could be done. 06:33.520 --> 06:37.060 I run the local DC group in Dallas, which is DC214. 06:37.060 --> 06:42.080 And we started discussing a year and a half or so ago, you know, after Port Knocking came out. 06:42.400 --> 06:43.980 Is there a better way of doing this? 06:43.980 --> 06:45.600 You know, do we really need to send multiple packets? 06:45.600 --> 06:52.260 Can we do it with a single packet and make it not replayable and make it, you know, secure and actually do more than just open a port? 06:52.260 --> 06:53.420 You know, can we run commands? 06:53.420 --> 06:56.140 Can we do things like, say, reverse shell? 06:56.240 --> 06:58.260 Do we have to have any ports actually listening? 06:58.260 --> 07:00.400 So this is what we came up with. 07:01.340 --> 07:02.960 It's a simple protocol. 07:02.960 --> 07:05.220 It allows a remote user to authenticate the system. 07:05.260 --> 07:06.560 There's nothing listening. 07:06.560 --> 07:08.520 It sniffs all the packets that are coming in. 07:08.640 --> 07:12.580 We use PGP or GPG to encrypt the data. 07:13.260 --> 07:19.200 And whenever you do that, if you just use raw encryption, what is it, eight bytes in? 07:19.560 --> 07:26.500 Eight bytes in, there are four bytes that are the GPG ID of the key that can decrypt it. 07:26.500 --> 07:30.420 So basically, we look for that, we see that, we pass it on to the processing engine. 07:31.360 --> 07:32.440 Of course, it's free. 07:33.480 --> 07:34.240 Why not? 07:36.420 --> 07:36.700 Well... 07:37.120 --> 07:42.240 And of course, one of the issues we wanted to deal with was working across NAT because we always hated, you know, having somebody call us up. 07:42.440 --> 07:45.380 Hey, I need to be able to check my mail on such and such host. 07:45.380 --> 07:46.560 Okay, what IP are you on? 07:46.600 --> 07:48.260 I'm on 192.168. 07:48.260 --> 07:49.100 No, no, no, no, no. 07:49.140 --> 07:50.380 What IP are you going to be coming from? 07:50.380 --> 07:51.540 Well, it says 192. 07:51.540 --> 07:52.520 Oh, Jesus. 07:52.520 --> 08:00.420 So, they can send, you know, with the client, they can send a single packet and it looks at the source address and says, oh, okay, so we'll open it up for that IP. 08:00.420 --> 08:04.540 And then, of course, it monitors the traffic and after a certain timeout, it will automatically close the port. 08:04.980 --> 08:11.580 We're also, you know, working with the idea of doing a reverse shell, so you send a single packet and it connects back to you. 08:11.940 --> 08:17.320 And then we can also have it to where, in our sample code, where you can run arbitrary commands. 08:17.320 --> 08:23.080 And the commands are specified in the config file, so it's not like anybody who has access to it can run any command. 08:23.080 --> 08:27.420 You have a comma-separated list of the commands that are allowed to be run by that particular user. 08:28.860 --> 08:31.880 This is a visual representation of basically how it works. 08:31.880 --> 08:35.820 So, over on the left-hand side, you have the client with, you know, its GPG ID. 08:35.960 --> 08:45.600 It encrypts all the data, which includes, you know, an ID, session keys, timestamp, and then the command and control data for the application that's using this fault protocol. 08:46.220 --> 08:50.640 It's encrypted and signed, you know, encrypted for security and signed for authenticity. 08:50.960 --> 08:53.380 And then it can be, you know, it's a data packet. 08:53.380 --> 08:56.340 So, I mean, it can be TCP, UDP, ICMP, anything like that. 08:56.340 --> 08:59.320 We've implemented TCP and UDP in our sample code. 08:59.700 --> 09:02.420 And then, of course, you know, it encrypts it with the server's key. 09:02.460 --> 09:06.520 The server gets it, verifies that it's, you know, encrypted data, passes it on. 09:07.860 --> 09:10.060 It's kind of an idea of how it's laid out. 09:11.200 --> 09:15.380 I'm a Perl hacker, so the parts that I worked on are in Perl. 09:15.740 --> 09:20.140 The client right now, you know, can be on whatever host. 09:20.140 --> 09:21.180 Sends the data. 09:21.180 --> 09:24.700 SPA-D is basically a simple sniffer. 09:25.420 --> 09:27.080 Nomad Spark written in C. 09:27.460 --> 09:34.360 Once it verifies, you know, what it's looking for, sends it on to the SPA engine, which then calls GPG as necessary to decrypt. 09:34.540 --> 09:40.020 Checks the user config to verify, you know, whatever they're asking to do can be done. 09:40.020 --> 09:42.760 And it also keeps track of firewall states. 09:42.760 --> 09:51.440 So, for some reason, the daemon, you have to restart the daemon, and it's going to know what ports were already open and still keep track of them and close them as necessary. 09:54.850 --> 09:56.310 And a whole new one. 09:57.890 --> 10:01.470 And we will have time for questions a little bit later. 10:02.390 --> 10:13.990 Alright, so, at the job where I was mentioning where I wrote the nmap tool, my primary responsibility was scanning and monitoring of large groups of hosts. 10:13.990 --> 10:19.330 A whole lot of web servers and Unix boxes. 10:20.290 --> 10:31.450 At the time, whenever I first started on this particular project, there wasn't a lot out there to be able to scan all those same IPs on a daily basis, you know, for basic misconfigurations. 10:31.450 --> 10:32.870 Vulnerabilities, things such as that. 10:32.870 --> 10:38.170 So, I wrote, I started off writing a very simple HTTP scanner, and it kept growing and growing and growing. 10:40.190 --> 10:43.010 Works off command line, or it has a web-based GUI. 10:43.110 --> 10:45.390 You know, same script, just depends on how you call it. 10:46.330 --> 10:52.430 The configs are all in XML, so it's really easy to add and remove things or expand them. 10:52.550 --> 10:57.190 Lots of command line options to specify exactly what you want to scan for, how you want to scan it. 10:57.190 --> 11:03.410 Runs a whole bunch of processes in parallel, according to, you know, whatever your system can handle, so it's fairly quick. 11:03.550 --> 11:11.790 I added in, I started adding in some other features, like FTP to look for anonymous access, look for writable directories, things such as that. 11:12.630 --> 11:22.710 The SQL stuff was added because, you know, I happened to be working on parts of it whenever, you know, the whole SQL Clamor thing came around, so it was easy to add in other features. 11:23.130 --> 11:26.890 There was also some SMTP stuff, but, you know. 11:27.010 --> 11:31.290 It is extremely fast, that was the whole idea. 11:31.810 --> 11:35.330 You know, once again, I was scanning a large number of hosts. 11:35.750 --> 11:38.750 Needed to get it done, you know, in a short amount of time. 11:39.370 --> 11:42.410 The way the output works, there are multiple outputs. 11:42.450 --> 11:48.210 You know, there's a verbose output that would actually tell you, here's the vulnerability and here's the fix, and, you know, standard stuff for a scanner. 11:48.210 --> 11:55.210 But it also, another thing was, it was written so that I could export the data, import it into a database very easily. 11:55.530 --> 11:58.030 Also worked a whole lot of time on false positives. 11:58.030 --> 12:07.490 For anybody who's done any, you know, constant monitoring of hosts, the big thing is, oh look, there's a Apache vulnerability running on an IIS box. 12:07.790 --> 12:09.390 Yeah, that makes sense. 12:09.390 --> 12:15.750 So, I spent a whole lot of time making sure that there were as few false positives as possible, looking for a whole bunch of different things. 12:15.750 --> 12:23.470 You know, looking for custom 404s, you know, things that, it's starting to become a little bit more common in scanners, but at the time... 12:23.990 --> 12:26.850 And of course, once again, it's free. 12:28.030 --> 12:29.970 Hey, I'm gonna stand up here for a while. 12:31.270 --> 12:33.150 Alright, so here's another one. 12:33.310 --> 12:35.250 Once again, in Perl. 12:35.350 --> 12:42.190 This one, the idea is ICMP packets are sent out with a forged source address. 12:42.190 --> 12:55.690 The whole idea was, on the corporate network, we wanted to check to see if people had DSL lines or modems, you know, something, or even misconfigured network devices, so that things were being sent out the wrong direction. 12:57.090 --> 13:06.070 I wrote a small Perl module that allows for looping, so all of these actually use the same Perl module, so you can actually specify ranges of hosts in, you know, almost any format. 13:06.070 --> 13:07.510 Makes it really easy to run. 13:07.690 --> 13:11.110 So, what this does is it forges an ICMP echo request. 13:11.110 --> 13:19.410 The data contains the IP that it was supposed to be sent to, as well as a signed key, which is just using MD5 and a shared secret. 13:19.450 --> 13:23.010 The server snips those on that forged address. 13:23.010 --> 13:30.670 Whenever it comes in, it looks to see if the source, where it was being, where the echo appliance is coming from, is the same as within the data portion. 13:30.670 --> 13:35.890 Because the nice thing about ICMP is, whatever you send it in the data portion, it sends back in the data portion. 13:36.010 --> 13:38.610 So it made it very easy to be able to do this. 13:38.610 --> 13:43.330 So I was able to find DSL hooked up to a corporate network. 13:43.330 --> 13:46.230 Somebody had gotten a DSL line run to their desk. 13:46.230 --> 13:46.770 How? 13:46.770 --> 13:47.490 I don't know. 13:47.490 --> 13:49.190 I wasn't involved in that part. 13:49.370 --> 13:53.950 But basically, their default route went out to SBC. 13:54.010 --> 14:03.750 So I'm sitting here spewing packets to the 192 space, and all of a sudden I'm seeing data coming back from SBC, and that's not a good thing. 14:03.750 --> 14:10.410 And of course, my favorite was the networking devices that had odd routes added for no apparent reason. 14:10.550 --> 14:15.570 Of course, the networking guys denied that it was on purpose or anything like that, but it got changed rather quickly after you find it. 14:17.030 --> 14:22.130 Once again, fast, simple, very specific problem to solve. 14:27.200 --> 14:31.080 Okay, here's another contribution of mine. 14:31.080 --> 14:35.980 This is NPC, Nearly Perfect Crypto. 14:36.120 --> 14:40.360 And I'm so glad you're sitting right there in front of me. 14:40.400 --> 14:41.680 I really am. 14:42.620 --> 14:47.360 What this does is it's mainly meant as an academic tool, okay? 14:47.620 --> 14:48.840 Fuck you. 14:49.080 --> 14:53.280 I got mud up here causing shit for me. 14:53.280 --> 14:56.680 It really is meant as an academic tool, and I'll tell you why. 14:56.680 --> 15:00.560 I mean, there's a lot of people that don't understand how one-time pads work. 15:00.560 --> 15:03.840 What this is is an implementation of a one-time pad, okay? 15:03.840 --> 15:18.600 And the reason I say it's Nearly Perfect Crypto is because it is perfect, but it is as only reliable as Isaac, the pseudorandom number generator that I've got in there. 15:18.600 --> 15:25.060 And it is only as perfect as your key management, which is actually kind of the bad thing. 15:25.060 --> 15:32.120 So if I'm going to send, let's say, goat porn to Mudge, because... 15:33.660 --> 15:34.700 It wouldn't be the first time. 15:34.700 --> 15:36.040 No, it wouldn't be the first time. 15:36.040 --> 15:46.840 Then what I would do is I'd say, hmm, well this file is 30 meg in size, so then I'd need to generate a 30 meg key to make it happen. 15:46.840 --> 15:54.760 And then the trick is, is me getting that key to him, and then us never ever using that key ever again for anything. 15:54.760 --> 15:57.880 Destroying the key after it's done. 15:57.880 --> 16:04.920 I mean, literally, if I put it on a CD and hand it to him, and then we're done with it, we need to destroy the key. 16:04.920 --> 16:15.700 Perhaps with that NRM file that I had previously, or we throw the CDs into a vat of acid, or however you manage your paranoia with your CDs at home. 16:15.700 --> 16:17.060 However that happens. 16:17.340 --> 16:27.140 Anyway, because you're doing something which is like a one-time pad, it makes the crypto part, really it's not very complicated. 16:27.580 --> 16:30.020 You're just doing a simple XOR. 16:30.020 --> 16:35.940 So it is very fast, very simple, it's really nice to do. 16:35.940 --> 16:42.240 Like I said, if you can manage the key exchange, you're getting damn close to having pretty good crypto. 16:44.080 --> 16:56.100 Anyway, just to show you why this thing is so fast and secure, here's the main, and I have it in quotes there, crypto loop, because it's hardly a loop. 16:56.100 --> 17:00.460 And if you look right down here, toward the bottom, 17:05.190 --> 17:09.150 oh my god, I know why he showed up. 17:09.370 --> 17:10.890 You'll know in a minute. 17:11.630 --> 17:14.990 Where it says, wicked crypto, because we are XORing. 17:14.990 --> 17:22.830 And you can see that massively intense one line of code there that kicks so much ass. 17:24.090 --> 17:27.150 So anyway, we have this tool there to kind of play with this. 17:27.150 --> 17:39.130 And I'll tell you the truth, the main reason, actually, truthfully, the main reason I wrote this tool is because there's a friend of mine who we would like to really, really have some deep, serious conversations with. 17:39.270 --> 17:45.110 And we were talking about, well, how in the world could we actually do this in a secure fashion? 17:47.290 --> 17:51.750 Well, okay, we have a smartass up front who thinks he knows something. 17:51.890 --> 17:55.770 But nonetheless, we just kind of went over various scenarios and everything. 17:55.770 --> 17:57.310 So I've come up with this thing. 17:57.310 --> 18:03.270 By the way, this and all the tools, we're going to have a spot out there on the NMRC website. 18:03.510 --> 18:05.770 We'll put something up on the front page. 18:05.770 --> 18:07.230 Hopefully I'll get it done tonight. 18:07.350 --> 18:11.390 And we'll have pointers to all the tools, all the presentations. 18:11.710 --> 18:14.370 Please, all questions at the end, please. 18:15.010 --> 18:18.350 And, oh, well, see, now it's at time for Q&A. 18:18.350 --> 18:20.390 Now, this is the thing we're going to do. 18:20.390 --> 18:36.650 For the Q&A, because this is kind of a dry kind of tool talk, so what we're going to do, something different from the Q&A, is during the Q&A portion of this, we're going to go ahead and spank audience members who want to be spanked. 18:36.790 --> 18:52.930 Now, the thing that we're going to do is, the first thing is, if you're coming up here, I mean, obviously there's no female members, although I think we may be able to recruit some females that we happen to know to come up here to help spank. 18:58.620 --> 19:00.040 Lily, come on up. 19:00.760 --> 19:08.560 So you're going to have a choice of, you know, not only being spanked by a guy, but you can be spanked by a chick. 19:09.020 --> 19:14.600 Okay, now the thing is, if you want to be spanked, we do have a release form you do have to sign. 19:14.600 --> 19:26.700 If anyone has been reading on Full Disclosure, we did post a link to the release form, so if you filled out one previously, that you printed off and filled out, feel free to go ahead and bring it up. 19:26.940 --> 19:29.480 Let me get out the stuff that you're going to be spanked with. 19:29.480 --> 19:30.740 Hold on just a second. 19:43.300 --> 19:51.180 Alright, the first thing that we're going to spank people with is a ShmooCon, this is from the Shmoo group. 19:51.180 --> 20:00.480 When I was at ShmooCon, all the speakers got these because they handed out Shmoo balls to throw at speakers that weren't behaving well, or being stupid, or causing shit. 20:00.480 --> 20:07.320 So they gave the speakers something to fight back with, so we have a Shmoo group paddle that you can be spanked with. 20:07.320 --> 20:12.600 You can also be spanked via a nice firm hand. 20:13.820 --> 20:16.440 And the final thing to be spanked with 20:19.720 --> 20:24.480 is a copy of the third edition of Hacking Exposed. 20:28.610 --> 20:31.550 And just to show how it's going to work, 20:34.870 --> 20:37.750 I want to bring Mudge up here and spank him. 20:37.750 --> 20:39.330 Let's get Mudge up here. 21:19.190 --> 21:22.090 You guys should have seen the rehearsals. 22:10.940 --> 22:13.640 I would have to look at the code specifically. 22:13.640 --> 22:19.040 I stole some code from Todd McDermott because we worked on entropy stuff. 22:19.100 --> 22:28.000 Part of it is we're using processor timing speeds and we're throwing in some... I forget the exact call. 22:28.000 --> 22:35.100 It's one where you're saying, slow down, I'm relinquishing the processor, and so I get a random time. 22:35.100 --> 22:36.300 And so that gives me... 22:36.730 --> 22:41.300 between that and some other stuff thrown in, like the times and stuff. 22:46.870 --> 22:48.550 Okay, there you go. 22:49.670 --> 22:51.110 Okay, thank you. 22:51.970 --> 22:52.990 Anyone else? 22:52.990 --> 22:54.110 Anyone else want to... 22:57.410 --> 22:59.330 Comments instead of questions? 22:59.330 --> 23:00.710 Yeah, go ahead. 23:00.710 --> 23:01.710 You got a comment? 23:02.510 --> 23:04.610 Two comments, go ahead. 23:08.290 --> 23:10.070 All right. 23:10.130 --> 23:13.690 You want to get spanked while you're getting your comments? 23:16.050 --> 23:18.430 Who do you want to spank you? 23:18.630 --> 23:20.230 Sign the release form. 23:22.370 --> 23:24.090 He signed it. 23:24.090 --> 23:25.450 Woo! 23:27.390 --> 23:28.670 Jesus. 23:29.210 --> 23:31.830 Notice he didn't read it first. 23:38.580 --> 23:40.840 Give him a mic. 23:58.100 --> 24:02.120 Okay, so my first comment is your single packet authentication thing. 24:02.120 --> 24:06.620 Talk about using it behind a NAT so that you could open up a service and so forth. 24:06.620 --> 24:07.460 Aren't you opening... 24:08.160 --> 24:12.360 You're opening up that service for everything behind that NAT and everyone behind that NAT. 24:12.360 --> 24:14.080 Isn't that kind of insecure? 24:14.660 --> 24:15.140 Yes. 24:15.400 --> 24:18.240 Using the Internet is known to be insecure. 24:18.240 --> 24:19.680 Yes, of course it's insecure. 24:20.200 --> 24:22.620 Okay, just a comment on that. 24:26.280 --> 24:31.320 Really what this is, it's not considered true authentication on there. 24:31.320 --> 24:33.140 All you're doing is you're opening up the port. 24:33.140 --> 24:39.140 Obviously, you'd be opening up the port and then some other process would handle the authentication. 24:39.140 --> 24:40.260 So the tool's misnamed. 24:41.200 --> 24:43.060 No, we are authenticating. 24:43.060 --> 24:44.800 You actually are authenticating. 24:44.800 --> 24:48.880 You're saying, I am who I say I am if you trust PGP. 24:49.760 --> 24:55.940 And then if you trust PGP and it says, okay, I've signed that key, then yes, I know who you are, so I will at least open up the port. 24:55.940 --> 24:59.420 Now you've got to go ahead and provide credentials to get access to the box. 24:59.760 --> 25:01.900 So it's considered a layer. 25:01.900 --> 25:09.020 Okay, so the second comment is your tool where you used spoofed ICMP in order to try to map network topology. 25:09.020 --> 25:24.720 The fact that your client has not implemented anti-spoofing measures on his network all the way down to layer 2, the fact that the tool is allowed to work on the network means that you need to recommend to your client that he implement the anti-spoofing technology so that your tool won't work. 25:24.720 --> 25:30.120 Because it's best practice not to allow spoofed traffic to traverse your network or egress from it. 25:30.120 --> 25:32.100 You're assuming this is for business. 25:34.440 --> 25:36.420 I think it's for any kind of IP. 25:43.910 --> 25:45.650 Don't forget, you're going to come up here spanking. 25:46.830 --> 25:48.490 Which did you want? 25:51.910 --> 25:53.710 Alright, next question. 26:00.330 --> 26:01.370 Next question. 26:01.370 --> 26:02.910 We've got to keep things moving. 26:08.010 --> 26:10.170 Come on, there's got to be more questions than this. 26:10.170 --> 26:11.470 And there's got to be more people than this. 26:11.470 --> 26:14.050 Alright, who just wants to be spanked? 26:15.770 --> 26:18.110 Come on up, we're not shy. 26:18.210 --> 26:22.010 I see people that are like looking and thinking about it. 26:22.010 --> 26:24.710 Come on, let's get some... I'm serious, I'm looking at people. 26:24.870 --> 26:26.930 Oh my god, we've got people coming up. 26:28.690 --> 26:30.870 Yeah, yeah, yeah, come on, alright. 26:32.250 --> 26:35.630 Alright, sign a release form and get your ass spanked. 26:39.080 --> 26:40.520 He's going to read it first. 26:44.660 --> 26:46.140 There's check boxes on there. 26:46.140 --> 26:48.220 Oh, like to who you want to be... 26:51.200 --> 26:53.400 Yeah, like I would like to be spanked by. 26:53.400 --> 26:54.660 Check all that apply. 26:57.440 --> 26:58.900 Oh, we need a beer up here too. 26:58.900 --> 27:00.820 If someone could bring Helen back a beer. 27:01.080 --> 27:03.180 Yes, he has a heavy thing to drink in three minutes. 27:03.180 --> 27:03.820 Please. 27:04.760 --> 27:19.200 Also, the names that you want to be called during the spanking, such as, you can check all that apply, like Biatch, Script Kitty, Scene Whore, Russ Cooper, a number of different ones. 27:19.740 --> 27:21.180 Oh, there, we've got a beer. 27:21.180 --> 27:22.380 We've got a beer for you. 27:33.340 --> 27:39.160 Any other questions while we're at it, while we're getting some people ready to be spanked? 27:39.740 --> 27:42.100 This guy's already signed. 27:42.100 --> 27:43.280 Who do you want to spank you? 27:45.260 --> 27:47.000 Alright, there we go. 28:04.830 --> 28:06.970 Alright, who do you want to have spank you? 28:07.730 --> 28:08.370 Me? 28:17.070 --> 28:19.110 What instrument? 28:22.250 --> 28:24.250 Ah, USAP. 28:48.020 --> 28:52.360 Alright, anyone else got any... 28:55.240 --> 29:02.200 I want to bring Jay Random over here and talk about why the hack pack hadn't been updated in ages. 29:05.060 --> 29:07.780 Basically, it's all your fault. 29:08.580 --> 29:11.160 So, I think we were here maybe two years ago? 29:11.160 --> 29:12.240 Was that the last panel? 29:12.240 --> 29:29.700 Yeah, so two years ago, I spent maybe a good few months taking the hack pack as Nomite had left it, updating the HTML so it was all valid, updating all the URLs so they weren't broken, updating a good amount of the content so that it was relevant to today. 29:29.700 --> 29:35.080 You know, stuff that had been documented back then but wasn't known at the time. 29:36.360 --> 29:39.960 And so we basically came to people and said, we've redone everything. 29:39.960 --> 29:41.300 All we need is your input. 29:41.300 --> 29:49.860 We need more questions, more frequently asked questions that we can get documented in the pack so we can improve general knowledge in the community. 29:50.000 --> 29:52.660 And we just got spam. 29:52.660 --> 29:54.040 That's all we got. 29:54.040 --> 30:01.620 Penis enlargements, credit card bills, so yeah, the pack's pretty much dead. 30:01.620 --> 30:11.360 We're going to keep it online, but clearly no one's really interested in adding to it, so we'll just keep it as a kind of historical record, I guess. 30:16.340 --> 30:21.200 Alright, I think we're right back toward the end of the presentation. 30:21.200 --> 30:26.460 I wanted to go ahead and actually finish up with a couple of specific announcements. 30:26.460 --> 30:29.880 The girl in the picture, yes, she is wearing an NMRC t-shirt. 30:30.260 --> 30:42.160 And yes, I have the world's most understanding wife because I actually paid for the model and paid for the photo session to get these pictures, in particular, just for DEF CON. 30:42.440 --> 30:51.660 And we will make sure that some of the artwork is available on the NMRC website so that you can use it for backgrounds on your computers. 30:52.080 --> 30:55.000 And got a few shoutouts in there. 30:56.880 --> 30:59.120 CAU, they're represented over here. 30:59.120 --> 31:06.400 There's some green guy, that if you see the green guy, then you know that CAU, they've been very supportive for us. 31:06.400 --> 31:14.440 Obviously, all the DC 214 people, because a lot of the talks and stuff that we give, we try them out on our local DC Groups thing. 31:14.700 --> 31:21.280 Also, Mad Hat's going to be participating in the DC Groups panel that's on later this evening. 31:21.340 --> 31:23.720 John Kallis, I saw him at Black Hat. 31:23.720 --> 31:29.560 He had some ideas for SPA that actually were pretty good, that we had put in there, and shoutout to him. 31:29.560 --> 31:31.880 Of course, the rest of the NMRC people that aren't here. 31:32.440 --> 31:35.180 Mike Rash, who is somewhere out here in the audience. 31:35.180 --> 31:36.380 There he is, right there. 31:37.080 --> 31:37.640 F.W. 31:37.640 --> 31:42.860 Knopf, which actually was here last year, actually is very similar. 31:43.160 --> 31:48.120 He's very similar to SPA, so we've been talking with him and everything. 31:48.120 --> 31:58.480 And I just want you guys to know that we're trying, we're going to be actually, our first planning session for DEF CON 14 is going to take place later tonight. 31:59.060 --> 32:05.600 And we promise that we're going to have something really big and fantastic for you guys. 32:05.600 --> 32:15.560 We really appreciate all the support that you guys have given us over this wondrous time that we've been having. 32:15.640 --> 32:19.140 So, really do appreciate all the support from everyone. 32:19.140 --> 32:25.420 We'll try to do our best to give back as much as we can to everyone here. 32:25.440 --> 32:29.560 So, if we have nothing else, just want to say thanks. 32:29.560 --> 32:31.620 Oh, we have something over here, yes. 32:34.420 --> 32:36.820 The rumor is what now? 32:38.480 --> 32:43.840 There are, yes, of course there are rumors that it's not going to be here at Alexis Park next year. 32:44.380 --> 32:50.580 I don't know because there was those same rumors last year as well. 32:50.980 --> 32:57.820 I know there's rumors floating around at ShmooCon for example that it might not be here this year, but in fact it was. 32:58.080 --> 32:59.840 So, I don't know. 32:59.840 --> 33:12.920 I mean, as much as I can, I try to slide my tongue down the back of Jeff Moss's trousers, but he really doesn't tell me much as an exchange for kissing his ass. 33:12.940 --> 33:13.980 So, I don't know. 33:13.980 --> 33:15.780 Take that up with Jeff actually. 33:15.780 --> 33:17.040 Another question. 33:26.250 --> 33:26.930 Okay. 33:26.990 --> 33:29.030 Suggestions for the hack pack, we'll take... 33:29.030 --> 33:32.050 we'll get on that right away. 33:32.050 --> 33:32.770 Okay. 33:34.050 --> 33:38.170 No, and again, all the code and stuff that we're talking about, we will have links up to that stuff. 33:38.170 --> 33:40.190 I'll make sure that stuff gets put up tonight. 33:40.910 --> 33:44.130 So you can pull it down, play with it, break it. 33:44.830 --> 33:46.910 A number of us have been writing code. 33:46.910 --> 33:48.730 We don't profess to be coders. 33:49.230 --> 33:51.110 So, if you come up with... 33:51.110 --> 33:59.170 In fact, for example, SPA had a remotely exploitable heap overflow in it until I found that and corrected it. 33:59.170 --> 33:59.730 Okay . 33:59.930 --> 34:04.650 Anything you guys can do to help add to it. 34:04.650 --> 34:10.370 And if you come up with some better idea than what we've got, then that's even better. 34:10.370 --> 34:16.250 That means we've inspired someone to come up with something that's actually encoded by real coders. 34:16.250 --> 34:18.130 Instead of just hacker types. 34:18.130 --> 34:18.910 Okay. 34:21.340 --> 34:22.620 Do what now? 34:24.200 --> 34:25.140 Oh, yeah. 34:25.140 --> 34:33.140 And if you find any zero days in any of the code that we release, we recommend that you go ahead and turn it into iDefense because they need the help. 34:33.300 --> 34:34.020 Okay. 34:34.160 --> 34:35.220 They really do. 34:36.040 --> 34:38.460 Alright, so, that's it. 34:38.460 --> 34:42.600 We will see you guys next year and at cons in between. 34:42.600 --> 34:44.060 So, thanks a lot.