1
00:00:00,000 --> 00:00:03,375
We'll let them set up for this because it will take a little bit.

2
00:00:03,375 --> 00:00:05,876
Quick announcement before we start the panel.

3
00:00:05,876 --> 00:00:05,876
There's going to be a section up this where one of the people

4
00:00:05,876 --> 00:00:05,876
up here will be recording video that might capture faces in the audience,

5
00:00:05,876 --> 00:00:08,125
being DEF CON you have the warning you can hide.

6
00:00:08,125 --> 00:00:11,250
We don't normally do that but you've been officially warned.

7
00:00:11,250 --> 00:00:13,999
Sit in the back and we won't be able to get your picture.

8
00:00:13,999 --> 00:00:15,584
I'm going to take a test photo.

9
00:00:15,584 --> 00:00:16,584
He's a fed!

10
00:00:16,584 --> 00:00:17,584
He's a fed!

11
00:00:17,584 --> 00:00:19,042
This is all a tick, he's a fed!

12
00:00:19,042 --> 00:00:20,083
Raise your hands.

13
00:00:20,083 --> 00:00:21,834
We've got more people coming in.

14
00:00:21,834 --> 00:00:21,834
Now we want to take a picture with your hands

15
00:00:21,834 --> 00:00:24,834
up that acknowledges that it's okay to take your pictures.

16
00:00:24,834 --> 00:00:25,834
Yes!

17
00:00:25,834 --> 00:00:27,501
We've got free spaces in the front.

18
00:00:27,501 --> 00:00:30,083
As you come in the door, find the guys with the hands.

19
00:00:30,083 --> 00:00:33,375
As you come in, see people with hands, they've got empty chairs.

20
00:00:33,375 --> 00:00:34,375
Look, he's here.

21
00:00:34,375 --> 00:00:34,375
Just in case you have to, like, go to the bathroom or something

22
00:00:34,375 --> 00:00:37,292
because there's chocolate up here and it might get messy.

23
00:00:37,292 --> 00:00:38,292
Exit out the back.

24
00:00:38,292 --> 00:00:39,292
Exit out the side.

25
00:00:39,292 --> 00:00:42,375
While we're setting up, I'd like to go over the ground rules.

26
00:00:42,375 --> 00:00:43,542
We have a lot of nudity.

27
00:00:43,542 --> 00:00:44,959
Rich Mogull stole my seat.

28
00:00:44,959 --> 00:00:44,959
You might not see him for most of the presentation,

29
00:00:44,959 --> 00:00:47,250
but I assure you he'll be under me and squirming.

30
00:00:47,250 --> 00:00:49,250
And will probably take his pants off.

31
00:00:49,250 --> 00:00:52,626
People with their hands up should have Rich take his hands off.

32
00:00:52,626 --> 00:00:55,459
I've got to run my slides first, I haven't started yet.

33
00:00:55,459 --> 00:00:55,459
What Rich just said in analyst terms is he's going

34
00:00:55,459 --> 00:00:55,459
to check his content to make sure it's viable

35
00:00:55,459 --> 00:00:56,459
for this audience.

36
00:00:56,459 --> 00:00:57,709
Who's easily offended?

37
00:00:57,709 --> 00:00:58,709
In are you here?

38
00:00:58,709 --> 00:00:58,709
Is this one of those things your friend tries

39
00:00:58,709 --> 00:01:01,584
to take you to the Claremont lounge, the worst club ever?

40
00:01:01,584 --> 00:01:04,584
There's no reason you'd be here if you're easily offended.

41
00:01:04,584 --> 00:01:05,959
It's aversion therapy.

42
00:01:05,959 --> 00:01:05,959
Do you know statistically speaking every fail panel someone has gotten

43
00:01:05,959 --> 00:01:07,083
down to their underwear.

44
00:01:07,083 --> 00:01:08,751
Does that offend anybody here?

45
00:01:08,751 --> 00:01:11,501
The majority of the time, 75% of the time it's been Rich.

46
00:01:11,501 --> 00:01:12,542
We have 100 bucks.

47
00:01:12,542 --> 00:01:14,959
I like the butter, it made my nipples tasty.

48
00:01:14,959 --> 00:01:14,959
But Rob has already Rob has already offered to donate $100

49
00:01:14,959 --> 00:01:17,459
to the Barnaby Jack fund if Rich gets his pants off.

50
00:01:17,459 --> 00:01:21,250
So, if Rich doesn't get his pants off, he doesn't like the memory of Barnaby.

51
00:01:21,250 --> 00:01:22,959
I don't have a knife or gun on me.

52
00:01:22,959 --> 00:01:23,959
Now I do.

53
00:01:23,959 --> 00:01:24,999
No, actually, I don't.

54
00:01:24,999 --> 00:01:24,999
Usually we make waffles but this year we're making pancakes

55
00:01:24,999 --> 00:01:27,292
also known as flap jacks in memory of Barnaby.

56
00:01:27,292 --> 00:01:27,292
Half the funds going to Barnaby's family and the other half

57
00:01:27,292 --> 00:01:30,667
of EFF and if you haven't noticed, the EFF is important this year.

58
00:01:30,667 --> 00:01:30,667
So please if you want pancakes, feel free

59
00:01:30,667 --> 00:01:30,667
to donate any money you can find in your heart to give for Barns

60
00:01:30,667 --> 00:01:33,083
and something like our little civil liberties.

61
00:01:33,083 --> 00:01:34,083
So thanks.

62
00:01:34,083 --> 00:01:35,083
Do we have any Feds?

63
00:01:35,083 --> 00:01:36,542
We don't want to call you out.

64
00:01:36,542 --> 00:01:37,626
Just raise your hand.

65
00:01:37,626 --> 00:01:39,999
I was led to believe that would work, sorry.

66
00:01:39,999 --> 00:01:40,999
Any prior military?

67
00:01:40,999 --> 00:01:41,999
You know what?

68
00:01:41,999 --> 00:01:43,999
He's actually immigrating to England.

69
00:01:43,999 --> 00:01:45,375
Yeah, he's going to England.

70
00:01:45,375 --> 00:01:47,250
Maybe not after this panel, though.

71
00:01:47,250 --> 00:01:48,250
Right.

72
00:01:48,250 --> 00:01:49,999
Well, thank you for your service.

73
00:01:49,999 --> 00:01:52,459
Everybody, let's give them a round of applause.

74
00:01:52,459 --> 00:01:54,584
Wait wait wait, unless it's the Air Force.

75
00:01:54,584 --> 00:01:55,999
Do not clap for the Air Force.

76
00:01:55,999 --> 00:01:56,999
They're military?

77
00:01:56,999 --> 00:01:58,501
They are not the military.

78
00:01:58,501 --> 00:02:00,209
They hang out with the Coast Guard.

79
00:02:00,209 --> 00:02:02,834
They're the guys who have the nuclear weapons.

80
00:02:02,834 --> 00:02:04,083
There's more than that.

81
00:02:04,083 --> 00:02:04,083
We're going to go into the part of fail panel where we discuss Army

82
00:02:04,083 --> 00:02:04,083
and nuclear weapons apparently so, if you don't want to be here

83
00:02:04,083 --> 00:02:06,501
for that we got to get somebody to ride the bomb.

84
00:02:06,501 --> 00:02:06,501
If you can find the guy in the Air Force in this room,

85
00:02:06,501 --> 00:02:06,501
you should walk up to him and ask him

86
00:02:06,501 --> 00:02:07,834
if he will ride your bomb.

87
00:02:07,834 --> 00:02:10,375
And by bomb you should point to your quat ral region.

88
00:02:10,375 --> 00:02:12,999
We're actually supposed to start in five minutes.

89
00:02:12,999 --> 00:02:15,792
There's phrases you don't hear at DEF CON all the time.

90
00:02:15,792 --> 00:02:16,999
Is your consistency okay.

91
00:02:16,999 --> 00:02:18,083
It's very regular.

92
00:02:18,083 --> 00:02:19,209
8:20 every morning.

93
00:02:19,209 --> 00:02:20,626
Whether you need it or not.

94
00:02:20,626 --> 00:02:21,999
We all need a reading break.

95
00:02:21,999 --> 00:02:21,999
RICH MOGULL:    I'd like I'd like to draw attention to Rob Graham,

96
00:02:21,999 --> 00:02:21,999
he's wearing Google Glasses, every time the last two months I've seen

97
00:02:21,999 --> 00:02:23,626
him, he's had Google Glasses on.

98
00:02:23,626 --> 00:02:24,626
Shower!

99
00:02:24,626 --> 00:02:25,626
shower!

100
00:02:25,626 --> 00:02:26,626
shower!

101
00:02:26,626 --> 00:02:27,876
Put it in the blender.

102
00:02:27,876 --> 00:02:28,876
Let it blend.

103
00:02:28,876 --> 00:02:31,250
Okay, Glass, search for pictures of diarrhea.

104
00:02:31,250 --> 00:02:32,250
(Laughter).

105
00:02:32,250 --> 00:02:35,792
The best feature of Google Glass is that it's great for trolling.

106
00:02:35,792 --> 00:02:35,792
Like walking around DEF CON with Google Glass with tape

107
00:02:35,792 --> 00:02:37,999
over this and watching people's reactions.

108
00:02:37,999 --> 00:02:37,999
Because of course tape over the camera doesn't do

109
00:02:37,999 --> 00:02:38,999
anything bad.

110
00:02:38,999 --> 00:02:40,125
But then they get upset.

111
00:02:40,125 --> 00:02:40,125
It's great to go out to dinner with Dave and sit there

112
00:02:40,125 --> 00:02:42,999
the entire dinner lock loaning up in the air doing this.

113
00:02:42,999 --> 00:02:43,999
Yeah, yeah, yeah.

114
00:02:43,999 --> 00:02:44,999
Uh huh.

115
00:02:44,999 --> 00:02:44,999
DAVE MAYNOR: And that, ladies and gentlemen,

116
00:02:44,999 --> 00:02:47,125
is why you should not have Google Glasses.

117
00:02:47,125 --> 00:02:48,125
But we have beer.

118
00:02:48,125 --> 00:02:49,292
So who here is wait, no.

119
00:02:49,292 --> 00:02:50,292
What's the age?

120
00:02:50,292 --> 00:02:51,834
Yeah, who here is 21 and over?

121
00:02:51,834 --> 00:02:52,959
I had to check on that.

122
00:02:52,959 --> 00:02:54,626
Wait, where's the rest of the beer.

123
00:02:54,626 --> 00:02:55,792
This is the prefail.

124
00:02:55,792 --> 00:02:56,999
We've already failed.

125
00:02:56,999 --> 00:02:57,999
The warmup.

126
00:02:57,999 --> 00:02:58,999
Stretch it out.

127
00:02:58,999 --> 00:02:58,999
DAVE MAYNOR: Everybody look at my beautiful fiancee over there

128
00:02:58,999 --> 00:02:59,999
and say we want beer.

129
00:02:59,999 --> 00:03:00,999
Beeeeeeeeer!

130
00:03:00,999 --> 00:03:04,584
And by beautiful fiancee, I mean the woman in red hair, not the big guy.

131
00:03:04,584 --> 00:03:04,584
While we do share a bed occasionally, we only have sex when it's

132
00:03:04,584 --> 00:03:05,834
absolutely necessary.

133
00:03:05,834 --> 00:03:06,999
I I'll have a bud light.

134
00:03:06,999 --> 00:03:08,292
I need something after that.

135
00:03:08,292 --> 00:03:09,292
I'm really fast.

136
00:03:09,292 --> 00:03:10,751
I can be done in two minutes.

137
00:03:10,751 --> 00:03:12,083
In case you didn't hear it.

138
00:03:12,083 --> 00:03:15,083
Liquidmatrix's comment is "I can be done in two minutes."

139
00:03:15,083 --> 00:03:16,083
Hey, Ron!

140
00:03:16,083 --> 00:03:16,083
Welcome to the 6th annual DEF CON

141
00:03:16,083 --> 00:03:17,083
security jam!

142
00:03:17,083 --> 00:03:18,083
Whoo!

143
00:03:18,083 --> 00:03:19,999
You were supposed to shout free bird.

144
00:03:19,999 --> 00:03:20,999
You fail.

145
00:03:20,999 --> 00:03:22,209
Room keys, throw that way.

146
00:03:22,209 --> 00:03:23,250
Underwear that way.

147
00:03:23,250 --> 00:03:24,709
We're not doing that again.

148
00:03:24,709 --> 00:03:26,334
This is the 6th annual fail panel.

149
00:03:26,334 --> 00:03:29,834
Each year they let us sit up here and make asses of you and ourselves.

150
00:03:29,834 --> 00:03:30,999
So thank you for coming.

151
00:03:30,999 --> 00:03:33,584
It would be much less fun if we didn't have targets.

152
00:03:33,584 --> 00:03:33,584
With the flap jacks, this year we're making pancakes

153
00:03:33,584 --> 00:03:33,584
otherwise known as flap jacks so half

154
00:03:33,584 --> 00:03:36,209
the money we raise through your generous offerings.

155
00:03:36,209 --> 00:03:39,083
Half we raise will go to EFF and half to Barnaby's family.

156
00:03:39,083 --> 00:03:41,250
If you don't like what you get, tough luck.

157
00:03:41,250 --> 00:03:41,250
So we have a variety of folks, I'll let them introduce themselves

158
00:03:41,250 --> 00:03:42,417
as they do their spots.

159
00:03:42,417 --> 00:03:42,417
I have a quick fail before we let our next volunteer do

160
00:03:42,417 --> 00:03:43,417
their thing.

161
00:03:43,417 --> 00:03:45,250
I want to give the award to logarithm.

162
00:03:45,250 --> 00:03:46,876
Who was at black hat this year.

163
00:03:46,876 --> 00:03:46,876
Raise your hand if you're Blackhat and if you were, did you stay

164
00:03:46,876 --> 00:03:46,876
at Caesar's did you have one of these lovely shower hangers

165
00:03:46,876 --> 00:03:48,709
on your bathroom shower at Caesar's?

166
00:03:48,709 --> 00:03:49,709
You got lucky.

167
00:03:49,709 --> 00:03:49,709
I'm going to give logarithm the award for creepiest vendor

168
00:03:49,709 --> 00:03:50,876
at Blackhat this year.

169
00:03:50,876 --> 00:03:50,876
Nothing like waking up at far too early in the morning

170
00:03:50,876 --> 00:03:50,876
or late in the afternoon and going to take a shower and discovering this

171
00:03:50,876 --> 00:03:50,876
hanging on your shower head that says,

172
00:03:50,876 --> 00:03:50,876
"Think you're exposed?"

173
00:03:50,876 --> 00:03:51,876
(Laughter).

174
00:03:51,876 --> 00:03:52,999
What about your assets?

175
00:03:52,999 --> 00:03:52,999
And you know, there's nothing that makes me feel

176
00:03:52,999 --> 00:03:52,999
like wanting to purchase something like a vendor

177
00:03:52,999 --> 00:03:55,375
like being stalked first thing in the morning.

178
00:03:55,375 --> 00:03:56,542
In the shower naked.

179
00:03:56,542 --> 00:03:56,542
And David, the guy who came in to do it in my room opened

180
00:03:56,542 --> 00:03:56,542
the door and saw me there and decided he did not want

181
00:03:56,542 --> 00:03:58,876
to into my shower so he handed it to me and ran.

182
00:03:58,876 --> 00:04:00,501
Rich, are your slides done yet?

183
00:04:00,501 --> 00:04:01,501
I just started.

184
00:04:01,501 --> 00:04:02,501
Excellent.

185
00:04:02,501 --> 00:04:03,501
I'll go last.

186
00:04:03,501 --> 00:04:04,501
As usual.

187
00:04:04,501 --> 00:04:06,459
Can we look like we're professional?

188
00:04:06,459 --> 00:04:07,792
You seriously Google.

189
00:04:07,792 --> 00:04:08,792
He really is.

190
00:04:08,792 --> 00:04:09,834
I can go whenever.

191
00:04:09,834 --> 00:04:10,834
Absolutely.

192
00:04:10,834 --> 00:04:11,834
Excellent.

193
00:04:11,834 --> 00:04:13,083
Fuck you, man, I got kids.

194
00:04:13,083 --> 00:04:14,083
He's using Bing!

195
00:04:14,083 --> 00:04:14,083
Actually, actually, being DEF CON in the DEF CON network being that it's

196
00:04:14,083 --> 00:04:14,083
DEF CON and the DEF CON network, he knows that no one else

197
00:04:14,083 --> 00:04:17,417
is monitoring what's going to Bing so it's probably pretty safe.

198
00:04:17,417 --> 00:04:17,417
There are two things I like to do in private and both have Bing

199
00:04:17,417 --> 00:04:18,417
in the phrase.

200
00:04:18,417 --> 00:04:19,834
I think you scared Alex.

201
00:04:19,834 --> 00:04:21,209
Where's the Bing in Shizer.

202
00:04:21,209 --> 00:04:22,209
Are you ready?

203
00:04:22,209 --> 00:04:23,209
I'm ready.

204
00:04:23,209 --> 00:04:24,751
Okay, Jamie, take it away.

205
00:04:24,751 --> 00:04:25,999
(cheers and applause)?

206
00:04:25,999 --> 00:04:28,083
JAMES ARLEN: So I got a mic, a mic, and a GA.

207
00:04:28,083 --> 00:04:29,250
This keeps turning off.

208
00:04:29,250 --> 00:04:30,250
It wasn't me.

209
00:04:30,250 --> 00:04:31,250
Oh, fuck.

210
00:04:31,250 --> 00:04:32,250
VGA.

211
00:04:32,250 --> 00:04:34,999
I'll keep my finger on the button, the entire time.

212
00:04:34,999 --> 00:04:36,999
Please connect directly to the NSA.

213
00:04:36,999 --> 00:04:36,999
Last year at the fail panel this says

214
00:04:36,999 --> 00:04:37,999
poisonous mic.

215
00:04:37,999 --> 00:04:39,501
Labeling here sucks this year.

216
00:04:39,501 --> 00:04:39,501
Last year I did my slides on stage much as Rich

217
00:04:39,501 --> 00:04:40,501
is doing right now.

218
00:04:40,501 --> 00:04:41,501
And look at that.

219
00:04:41,501 --> 00:04:41,501
Next year we should all just do our slides

220
00:04:41,501 --> 00:04:42,999
as we give our presentations.

221
00:04:42,999 --> 00:04:42,999
JAMES ARLEN: You know what, I could have done this

222
00:04:42,999 --> 00:04:42,999
with just preview but I wanted to give you a title slide so I could talk

223
00:04:42,999 --> 00:04:45,667
about how to discover that hotel Internet is funny.

224
00:04:45,667 --> 00:04:46,999
We're not projecting.

225
00:04:46,999 --> 00:04:47,999
What's going on?

226
00:04:47,999 --> 00:04:48,999
I can see it there!

227
00:04:48,999 --> 00:04:49,999
Fail over here.

228
00:04:49,999 --> 00:04:50,999
Now it's over there.

229
00:04:50,999 --> 00:04:52,125
Failing over there.

230
00:04:52,125 --> 00:04:53,125
AV people.

231
00:04:53,125 --> 00:04:54,751
Here we fail, there we fail.

232
00:04:54,751 --> 00:04:55,751
Everywhere we fail.

233
00:04:55,751 --> 00:04:56,999
(cheers and applause).

234
00:04:56,999 --> 00:04:58,167
Don't be a cyber douche.

235
00:04:58,167 --> 00:04:59,167
So Dan Charles.

236
00:04:59,167 --> 00:05:00,167
Yay!

237
00:05:00,167 --> 00:05:02,125
You're blowing the circuit breaker.

238
00:05:02,125 --> 00:05:03,125
Yeah, I know.

239
00:05:03,125 --> 00:05:04,125
I can hold it.

240
00:05:04,125 --> 00:05:05,834
Keep your finger on the button.

241
00:05:05,834 --> 00:05:09,876
When you all start to see me shake, you'll know it's from being electrocuted.

242
00:05:09,876 --> 00:05:10,876
In a round motion.

243
00:05:10,876 --> 00:05:12,125
Is that good for you, Chris?

244
00:05:12,125 --> 00:05:13,125
All right.

245
00:05:14,709 --> 00:05:18,876
So last year I did my slides on stage and that was fun and all.

246
00:05:18,876 --> 00:05:20,542
This year I decided to be prepared.

247
00:05:20,542 --> 00:05:23,501
So when I got to Vegas, I still had no slides.

248
00:05:27,167 --> 00:05:31,999
Anybody stay in a hotel that has no guest protection

249
00:05:31,999 --> 00:05:34,083
on its Wi Fi?

250
00:05:34,999 --> 00:05:38,709
Anybody stay in a hotel that has no guest protection

251
00:05:38,709 --> 00:05:42,375
on its Wi Fi and I just lost my slides.

252
00:05:43,209 --> 00:05:45,083
We can see them.

253
00:05:45,083 --> 00:05:47,167
I think we shorted the whole stage out.

254
00:05:47,167 --> 00:05:50,834
I lost that screen, too.

255
00:05:50,999 --> 00:05:55,125
I'm sitting at Caesar's trying to prepare for my training with Rich.

256
00:05:55,125 --> 00:05:58,999
Did you guys break something?

257
00:05:59,459 --> 00:06:02,959
There's no    What did you step on    JAMES ARLEN: Hit the breaker.

258
00:06:03,083 --> 00:06:04,999
Did we blow the whole room?

259
00:06:04,999 --> 00:06:05,999
Oh, no.

260
00:06:05,999 --> 00:06:06,999
Holy shit.

261
00:06:06,999 --> 00:06:08,083
Anybody got a lighter.

262
00:06:08,083 --> 00:06:09,834
I have a lighter.

263
00:06:09,834 --> 00:06:12,751
JAMES ARLEN: So Rich and I are sitting in Rich's room,

264
00:06:12,751 --> 00:06:16,125
trying to prepare, looking at slides.

265
00:06:18,083 --> 00:06:20,918
All of a sudden out of the complete freaking

266
00:06:20,918 --> 00:06:22,792
blue, (cheers).

267
00:06:22,792 --> 00:06:29,999
What are they doing?

268
00:06:29,999 --> 00:06:31,375
I have no idea.

269
00:06:31,375 --> 00:06:33,792
You're going to hold that circuit breaker?

270
00:06:35,751 --> 00:06:37,999
This is still off.

271
00:06:38,999 --> 00:06:40,999
We're calling for help.

272
00:06:41,125 --> 00:06:43,959
There's no help coming.

273
00:06:43,959 --> 00:06:46,542
Call the union.

274
00:06:48,876 --> 00:06:54,459
Half cooked pancakes are delicious.

275
00:06:54,999 --> 00:06:58,999
JAMES ARLEN: You ever have a moment you knew somebody else

276
00:06:58,999 --> 00:07:01,584
was in your computer?

277
00:07:02,999 --> 00:07:06,999
You got to Vegas and forgot to turn on your firewall.

278
00:07:08,250 --> 00:07:12,751
Because failure, that's my modus operandi, bitches.

279
00:07:12,999 --> 00:07:17,667
I look over at my machine because somebody else's desktop

280
00:07:17,667 --> 00:07:19,334
is on it.

281
00:07:21,751 --> 00:07:22,999
(Laughter).

282
00:07:25,375 --> 00:07:31,125
Out of an abundance of caution, I asked our local Mac security expert,

283
00:07:31,125 --> 00:07:35,876
Rich Mogull, read his articles on Mac world.

284
00:07:36,999 --> 00:07:40,250
I can't keep the Mac things straight.

285
00:07:40,250 --> 00:07:43,584
The power is on on the fucking thing.

286
00:07:43,584 --> 00:07:44,999
There's power on on that.

287
00:07:44,999 --> 00:07:45,999
Keep talking.

288
00:07:45,999 --> 00:07:46,999
JAMES ARLEN: Okay.

289
00:07:46,999 --> 00:07:48,459
Please don't touch me there.

290
00:07:53,417 --> 00:07:58,334
I have large monitors in my office that exceed sanity.

291
00:07:58,375 --> 00:08:02,250
I habitually leave air server running because it's an easy way

292
00:08:02,250 --> 00:08:05,999
to take what I'm looking at on my phone or iPad and put it

293
00:08:05,999 --> 00:08:08,626
on a monitor in my office.

294
00:08:08,999 --> 00:08:09,999
Guess what?

295
00:08:10,334 --> 00:08:13,918
People will promiscuously join whatever air

296
00:08:13,918 --> 00:08:19,999
server they can in the hopes that it's the TV in the hotel room.

297
00:08:19,999 --> 00:08:31,501
Raise your hand if you're promiscuous.

298
00:08:31,501 --> 00:08:33,250
Jay Daniel wins on that one.

299
00:08:33,250 --> 00:08:35,959
Rich and I are trying to scramble and remembering what's the code

300
00:08:35,959 --> 00:08:39,999
for screen shot and grabbing our phones to take a picture of it.

301
00:08:41,083 --> 00:08:44,250
And then the music starts.

302
00:08:49,751 --> 00:08:54,501
So I'd been fooling around with this and for reasons that shall remain not

303
00:08:54,501 --> 00:08:58,584
astonishing to anyone I lose a folder full of screen shots you

304
00:08:58,584 --> 00:09:01,667
but I did catch this lovely one.

305
00:09:03,083 --> 00:09:07,584
Which is the guy troubleshooting why he can't hear his YouTube video

306
00:09:07,584 --> 00:09:09,083
any more.

307
00:09:11,709 --> 00:09:16,501
I had perfect fidelity of it.

308
00:09:16,501 --> 00:09:20,792
So as a call to action, as a go out and stamp

309
00:09:20,792 --> 00:09:24,999
out cyber douchery everywhere.

310
00:09:25,209 --> 00:09:31,751
I will ask all of you individually and severally, to please run air server,

311
00:09:31,751 --> 00:09:37,999
configure your air server host name as capital A small ppetTV.

312
00:09:40,542 --> 00:09:52,751
If you're on a Mac.

313
00:09:52,751 --> 00:09:54,999
The keys you're looking for that neither Rich

314
00:09:54,999 --> 00:09:58,334
nor I could remember are command shift 3.

315
00:09:58,501 --> 00:10:00,083
Or 4.

316
00:10:00,083 --> 00:10:04,792
JAMES ARLEN: 4 makes you draw a window, 3 takes it in the instant.

317
00:10:04,792 --> 00:10:08,999
Just because air server by default fills the entire screen.

318
00:10:08,999 --> 00:10:13,125
Just keep hitting those three keys while they puzzle out why their audio

319
00:10:13,125 --> 00:10:17,209
or video disappeared or share their corporate secrets with you

320
00:10:17,209 --> 00:10:19,709
because they're dumb.

321
00:10:21,459 --> 00:10:23,083
I'm going to say this.

322
00:10:23,083 --> 00:10:26,999
As years of a Mac user, it is easy to be very secure.

323
00:10:26,999 --> 00:10:30,999
It is foolish to just depend on intrinsic security because look

324
00:10:30,999 --> 00:10:34,667
at me, I've got a genius to depend on.

325
00:10:38,459 --> 00:10:39,999
Not rich.

326
00:10:41,999 --> 00:10:44,250
Rich is a different kind of genius.

327
00:10:44,999 --> 00:10:48,751
Anybody know who had 90 minutes to prep a Blackhat talk?

328
00:10:50,626 --> 00:10:53,999
First talk of the morning, 90 minutes prep and he killed it

329
00:10:53,999 --> 00:10:55,626
for an hour.

330
00:10:56,000 --> 00:10:59,584
There are no other professionals like that in our industry.

331
00:10:59,792 --> 00:11:03,584
So my call to action, configure your air server as AppleTV,

332
00:11:03,584 --> 00:11:07,542
server runs on Raspberry Pi mby the way.

333
00:11:07,999 --> 00:11:12,375
Send screen shots to me so I can post them

334
00:11:12,375 --> 00:11:16,501
and we can titter in glee.

335
00:11:17,876 --> 00:11:23,083
If somebody is so enterprising to take my intellectual property

336
00:11:23,083 --> 00:11:27,125
and build such a device, please, someone make me

337
00:11:27,125 --> 00:11:33,292
a Raspberry Pi image that connects via Wi Fi to whatever it can and runs

338
00:11:33,292 --> 00:11:37,459
as an air server as AppleTV and screen shots once

339
00:11:37,459 --> 00:11:39,584
every second.

340
00:11:40,417 --> 00:11:41,999
Build it.

341
00:11:42,334 --> 00:11:44,459
Send it to me, I will give you all the creds

342
00:11:44,459 --> 00:11:47,375
in the world times one magillion.

343
00:11:47,375 --> 00:11:48,959
Build it and you will come.

344
00:11:48,959 --> 00:11:57,167
JAMES ARLEN: I did not say that.

345
00:11:57,167 --> 00:12:01,209
(Groaning) walked right into it.

346
00:12:01,667 --> 00:12:02,834
Can you do it?

347
00:12:02,834 --> 00:12:03,834
Can somebody do it?

348
00:12:03,834 --> 00:12:05,792
Is anybody better at scripting than me?

349
00:12:05,792 --> 00:12:07,459
Oh, you have a box that does that?

350
00:12:07,999 --> 00:12:09,999
You're going to make one for me.

351
00:12:09,999 --> 00:12:10,999
Fuck it.

352
00:12:10,999 --> 00:12:11,999
You rock.

353
00:12:11,999 --> 00:12:15,125
Can we offer him something congratulations and thank you?

354
00:12:15,751 --> 00:12:18,250
We have half done flap jacks.

355
00:12:18,999 --> 00:12:20,792
They're almost done.

356
00:12:20,792 --> 00:12:21,792
Okay.

357
00:12:22,375 --> 00:12:24,375
That's not beer man.

358
00:12:28,083 --> 00:12:34,959
Fucking close to water.

359
00:12:38,209 --> 00:12:40,250
Thank you so much.

360
00:12:40,250 --> 00:12:43,083
You can get a pancake.

361
00:12:45,209 --> 00:12:47,375
Put beer on the pancakes.

362
00:12:56,209 --> 00:12:58,417
We usually do.

363
00:12:58,417 --> 00:13:01,125
You're not going to put your tongue in my ear this year.

364
00:13:07,999 --> 00:13:19,626
There is no connection between the two.

365
00:13:19,626 --> 00:13:20,626
(off mic).

366
00:13:24,918 --> 00:13:25,999
Excellent.

367
00:13:28,792 --> 00:13:34,125
Let's hear it for carry over.

368
00:13:45,751 --> 00:13:54,999
All right, just waiting for the other side.

369
00:13:54,999 --> 00:14:00,751
I mentioned the box is looking empty, so I'm going

370
00:14:00,751 --> 00:14:03,918
to put $100 in it.

371
00:14:05,918 --> 00:14:11,999
That's a Canadian $5 bill which is worth $5 U.S.

372
00:14:12,125 --> 00:14:14,709
because of the economy.

373
00:14:15,083 --> 00:14:17,709
We have oil and wood we can sell you.

374
00:14:22,209 --> 00:14:25,999
It is a great value.

375
00:14:30,250 --> 00:14:32,292
It's butter flavored.

376
00:14:35,125 --> 00:14:37,999
For your nipples.

377
00:14:38,250 --> 00:14:42,709
I would like some butter for my nipples, please.

378
00:14:42,876 --> 00:14:45,584
Also can I get a little bit of syrup.

379
00:14:46,584 --> 00:14:50,292
So who is going to lick the butter and syrup off my nipples.

380
00:14:50,292 --> 00:14:52,584
Chocolate car caramel or strawberries.

381
00:14:56,083 --> 00:14:59,334
I don't want Canadians licking stuff off my nipples.

382
00:15:00,459 --> 00:15:02,167
I have standards.

383
00:15:12,125 --> 00:15:15,999
Word on slides on this side.

384
00:15:16,501 --> 00:15:18,083
Slides, schmides.

385
00:15:20,083 --> 00:15:22,083
They really want to see these.

386
00:15:24,375 --> 00:15:27,083
Everyone lean over that way so we can see slides.

387
00:15:27,083 --> 00:15:28,459
In an effort to get you guys moving

388
00:15:28,459 --> 00:15:32,083
along so you can hear from some other esteemed colleagues,

389
00:15:32,083 --> 00:15:36,667
we'll do slides on one side while they work on the other.

390
00:15:36,999 --> 00:15:38,250
Okay?

391
00:15:39,334 --> 00:15:41,959
Yeah, this should be on the fail panel, right?

392
00:15:41,959 --> 00:15:42,999
Projector fail.

393
00:15:44,667 --> 00:15:46,375
It's small.

394
00:15:46,375 --> 00:15:49,083
That's what she said.

395
00:15:49,083 --> 00:15:50,334
I've heard that before.

396
00:15:50,334 --> 00:15:52,292
Mostly from Rich though.

397
00:15:53,209 --> 00:15:54,626
All right.

398
00:15:54,999 --> 00:15:56,501
We're so scrooge'd.

399
00:15:56,834 --> 00:15:58,751
So a little by me.

400
00:15:58,751 --> 00:16:01,125
My name is Larry Pesce, and I'm a penetration tester,

401
00:16:01,125 --> 00:16:03,083
hardware hacker.

402
00:16:03,083 --> 00:16:05,167
I'm currently between jobs.

403
00:16:05,167 --> 00:16:06,834
So my employer was supposed to send me to DEF CON

404
00:16:06,834 --> 00:16:09,959
to come give this presentation as part of the fail panel and this

405
00:16:09,959 --> 00:16:13,792
is all stuff that I discovered while I was working for them.

406
00:16:13,792 --> 00:16:15,999
And they laid me off lost Monday.

407
00:16:18,709 --> 00:16:20,250
Boo.

408
00:16:20,250 --> 00:16:23,999
With an 8 week old baby at home and a 5 year old.

409
00:16:23,999 --> 00:16:29,334
But in any case, tweeted and all that good stuff that I got laid off.

410
00:16:29,334 --> 00:16:32,999
I got laid off at 10:30 in the morning and I had an offer letter by 7:00 p.m.

411
00:16:32,999 --> 00:16:34,167
(cheers and applause).

412
00:16:34,167 --> 00:16:35,167
For pornography?

413
00:16:35,167 --> 00:16:40,959
LARRY PESCE: It was.

414
00:16:40,959 --> 00:16:42,999
And I took it.

415
00:16:42,999 --> 00:16:46,709
Boy, did he ever take it!

416
00:16:46,709 --> 00:16:49,125
Where can you buy it?

417
00:16:49,209 --> 00:16:50,999
Uporn.

418
00:16:52,999 --> 00:16:55,334
Based on the fact I'm technically currently

419
00:16:55,334 --> 00:16:59,083
unemployed because I don't start with the other company for a month,

420
00:16:59,083 --> 00:17:01,918
I had to do redaction to protect the innocent and

421
00:17:01,918 --> 00:17:04,375
the fact that I can't afford a lawyer right now

422
00:17:04,375 --> 00:17:06,999
because I'm not getting paid.

423
00:17:06,999 --> 00:17:10,334
So donate a lot of money so he has a lower when he gets through.

424
00:17:10,459 --> 00:17:13,501
LARRY PESCE: To that former network guy.

425
00:17:15,459 --> 00:17:17,999
Certified instructor of the SANS institute.

426
00:17:18,167 --> 00:17:20,542
Member of the pauldotcom security group

427
00:17:20,542 --> 00:17:23,959
and also an extra cost HAM radio operator which

428
00:17:23,959 --> 00:17:28,083
is completely irrelevant to this presentation.

429
00:17:28,083 --> 00:17:29,959
Which means you have no sex life.

430
00:17:29,959 --> 00:17:31,292
LARRY PESCE: Right.

431
00:17:31,292 --> 00:17:32,999
I also have kids, right, Rich.

432
00:17:34,584 --> 00:17:37,584
What is this talk I'm going to talk about.

433
00:17:37,751 --> 00:17:40,083
I just changed jobs.

434
00:17:40,083 --> 00:17:41,083
Fuck.

435
00:17:41,083 --> 00:17:43,334
Really, again, and but I had just changed jobs

436
00:17:43,334 --> 00:17:45,999
into the energy sector.

437
00:17:45,999 --> 00:17:47,250
So you know, had been doing consulting

438
00:17:47,250 --> 00:17:49,918
for penetration testing in all sorts of industry

439
00:17:49,918 --> 00:17:52,626
but was now specifically tailored to just pen testing

440
00:17:52,626 --> 00:17:55,209
and hardware hacking in the energy sector which was

441
00:17:55,209 --> 00:17:57,918
a completely new thing for me.

442
00:17:57,918 --> 00:17:59,876
I'd never done any work in the energy sector so all sorts

443
00:17:59,876 --> 00:18:02,999
of new terms and things I had to understand.

444
00:18:03,667 --> 00:18:07,999
Whole new industry and on day one of my new job I was on a plane

445
00:18:07,999 --> 00:18:10,083
to a client site.

446
00:18:11,083 --> 00:18:12,334
Excellent.

447
00:18:12,709 --> 00:18:15,083
And I and after about six weeks, we find out we're going to come do

448
00:18:15,083 --> 00:18:16,918
the fail panel.

449
00:18:16,918 --> 00:18:18,209
What am I going to talk about?

450
00:18:18,209 --> 00:18:20,626
This is my impression of the energy sector, security

451
00:18:20,626 --> 00:18:24,999
in the energy sector after about six weeks on the job.

452
00:18:24,999 --> 00:18:26,626
And sort of why I think that.

453
00:18:26,876 --> 00:18:28,083
All right.

454
00:18:28,083 --> 00:18:29,999
So day two on the job.

455
00:18:29,999 --> 00:18:30,999
Hi.

456
00:18:30,999 --> 00:18:31,999
Howdy.

457
00:18:32,083 --> 00:18:33,083
Okay.

458
00:18:33,542 --> 00:18:35,083
So day two on the job.

459
00:18:35,417 --> 00:18:37,999
You don't mind if I rub back, right?

460
00:18:38,542 --> 00:18:40,375
No, oh, no.

461
00:18:40,501 --> 00:18:44,709
Do you now understand why we are the way we are?

462
00:18:44,709 --> 00:18:48,250
LARRY PESCE: Just wait.

463
00:18:48,250 --> 00:18:51,209
Wait, there's more, he slices, he dices.

464
00:18:51,209 --> 00:18:53,334
LARRY PESCE: There's more flap jacks.

465
00:18:53,334 --> 00:18:54,334
Yay.

466
00:18:54,959 --> 00:18:58,459
First time I ever saw naked man on wireless router was Larry.

467
00:18:58,667 --> 00:19:00,876
I have that picture.

468
00:19:03,334 --> 00:19:05,999
Did Bing it?

469
00:19:05,999 --> 00:19:07,876
You.

470
00:19:07,876 --> 00:19:08,250
LARRY PESCE: You have the picture but I have

471
00:19:08,250 --> 00:19:09,999
the life sized cutout.

472
00:19:11,834 --> 00:19:13,459
In the basement.

473
00:19:13,459 --> 00:19:14,959
And it has made many rounds around our house

474
00:19:14,959 --> 00:19:18,334
in various closets and the pantry and my daughter goes and opens

475
00:19:18,334 --> 00:19:21,999
the pantry and goes and closes the door and waits for Mommy to go

476
00:19:21,999 --> 00:19:23,751
to the pantry.

477
00:19:24,459 --> 00:19:27,292
Mommy, why isn't Daddy's router bigger?

478
00:19:27,292 --> 00:19:28,292
(Laughter).

479
00:19:28,292 --> 00:19:30,918
LARRY PESCE: Wow.

480
00:19:30,999 --> 00:19:31,999
Wow.

481
00:19:31,999 --> 00:19:33,459
I'm not going to touch that one.

482
00:19:33,459 --> 00:19:35,125
It was a Linksys.

483
00:19:35,125 --> 00:19:36,209
Yeah, small antenna.

484
00:19:36,209 --> 00:19:37,209
All right.

485
00:19:37,501 --> 00:19:39,999
So    Very small gain.

486
00:19:42,250 --> 00:19:45,459
LARRY PESCE: Yeah, more than yours, though.

487
00:19:45,751 --> 00:19:47,083
That's all right.

488
00:19:47,209 --> 00:19:56,083
LARRY PESCE: See, I don't even feel it.

489
00:19:56,709 --> 00:20:00,042
In order to understand the reason I feel this whole energy

490
00:20:00,042 --> 00:20:04,876
sector security stuff is totally screwed, we need to understand AMI,

491
00:20:04,876 --> 00:20:07,999
advanced metering infrastructure.

492
00:20:07,999 --> 00:20:10,167
Not BIOS folks.

493
00:20:10,167 --> 00:20:13,083
I didn't know that on day 2 of my job either.

494
00:20:13,918 --> 00:20:17,501
Lots of new acronyms and stuff in the energy sector that I had no idea

495
00:20:17,501 --> 00:20:21,751
about and it took a little bit of explaining but that's okay.

496
00:20:22,125 --> 00:20:25,417
So let's understand a little bit about AMI.

497
00:20:25,417 --> 00:20:28,125
Speaking in general sort of terms, no particular vendor and those sorts

498
00:20:28,125 --> 00:20:29,792
of things.

499
00:20:29,792 --> 00:20:33,876
What we end up with is a meter on your house that reads

500
00:20:33,876 --> 00:20:36,375
usage, meterology.

501
00:20:36,501 --> 00:20:39,501
And that meterology now needs to be reported back to the provider,

502
00:20:39,501 --> 00:20:42,876
to the energy company so they know how much electricity you're

503
00:20:42,876 --> 00:20:45,709
using or how much gas you're using.

504
00:20:45,876 --> 00:20:49,250
So that metrology gets sent over a network over some sort

505
00:20:49,250 --> 00:20:53,125
of aggregation device and that aggregator connects back

506
00:20:53,125 --> 00:20:57,417
to the utility., which then connects to a system potentially

507
00:20:57,417 --> 00:21:00,876
in a DMZ which then the accounting folks connect

508
00:21:00,876 --> 00:21:03,999
to from their internal network.

509
00:21:03,999 --> 00:21:07,459
So now you can start following the path from a meter to a host

510
00:21:07,459 --> 00:21:09,999
on the internal network.

511
00:21:10,125 --> 00:21:11,417
Great.

512
00:21:11,459 --> 00:21:14,626
So    What about these are not smart meters?

513
00:21:14,626 --> 00:21:15,959
These are actual meters?

514
00:21:15,959 --> 00:21:17,834
LARRY PESCE: And/or smart meters.

515
00:21:17,834 --> 00:21:20,626
It all depends on the type of device that are installed.

516
00:21:21,999 --> 00:21:24,999
Multiple different types of meters whether they be start

517
00:21:24,999 --> 00:21:27,999
or otherwise that have some type of wireless technology

518
00:21:27,999 --> 00:21:30,709
to contact this quote aggregator.

519
00:21:30,999 --> 00:21:35,292
The first week on the job I got to pen test one of the aggregators.

520
00:21:36,626 --> 00:21:38,626
So what did I find?

521
00:21:38,626 --> 00:21:41,876
Unfortunately, crossing your arms doesn't hide the boner.

522
00:21:46,083 --> 00:21:48,959
And tweet that in 2.

523
00:21:48,959 --> 00:21:49,959
All right.

524
00:21:49,959 --> 00:21:55,292
Real quick, how close will we get to Rich Mogull tonight speaking

525
00:21:55,292 --> 00:21:57,250
of boners.

526
00:21:57,250 --> 00:21:58,459
Take off your pants.

527
00:22:01,999 --> 00:22:03,792
Password, please.

528
00:22:03,792 --> 00:22:08,876
1, 2, 3, 4.

529
00:22:08,876 --> 00:22:09,876
Password 1.

530
00:22:09,876 --> 00:22:10,876
Password 1.

531
00:22:10,876 --> 00:22:11,876
I gotcha.

532
00:22:11,876 --> 00:22:12,876
We'll save that.

533
00:22:12,876 --> 00:22:15,999
We need to get more money out of the people before I drop trout.

534
00:22:15,999 --> 00:22:17,959
Isn't the password the same as trout.

535
00:22:17,959 --> 00:22:20,834
We crossed 500 in donations.

536
00:22:20,834 --> 00:22:22,999
Thank you, people, let's keep it going.

537
00:22:25,626 --> 00:22:31,999
Everybody, Rich Rich Rich Rich Rich Rich Rich!

538
00:22:31,999 --> 00:22:32,999
.

539
00:22:32,999 --> 00:22:39,083
I think your pants are worth a thousand dollars this year.

540
00:22:39,083 --> 00:22:40,999
I'm running for Congress.

541
00:22:45,125 --> 00:22:47,626
Everyone is a weiner.

542
00:22:47,626 --> 00:22:49,375
District 5 in Phoenix.

543
00:22:50,083 --> 00:22:53,083
All right.

544
00:22:53,083 --> 00:23:18,125
What do we get if we get a thousand dollars, Rich.

545
00:23:18,125 --> 00:23:19,334
He loses the shorts.

546
00:23:19,334 --> 00:23:21,999
We get to tie Dave to a chair with his pants down.

547
00:23:23,959 --> 00:23:25,501
Very good.

548
00:23:31,751 --> 00:23:33,125
There you go.

549
00:23:33,125 --> 00:23:38,999
I'm the only person in history that drops my pants

550
00:23:38,999 --> 00:23:42,334
at RSA and DEF CON.

551
00:23:44,083 --> 00:23:45,709
Multiple times.

552
00:23:45,709 --> 00:23:48,209
Anybody want pancakes, raise your hand.

553
00:23:48,751 --> 00:23:51,876
That's what she said.

554
00:23:51,876 --> 00:23:54,918
LARRY PESCE: All right, speaking of boners,

555
00:23:54,918 --> 00:24:00,834
the first aggregator device I got to test had Ethernet and external port

556
00:24:00,834 --> 00:24:03,292
accessible winning!

557
00:24:03,542 --> 00:24:06,459
however, the Ethernet was shut down.

558
00:24:06,626 --> 00:24:08,918
The password was on.

559
00:24:12,876 --> 00:24:15,999
Doing brute force against it wasn't going to work for us.

560
00:24:15,999 --> 00:24:17,999
So that was pretty good.

561
00:24:17,999 --> 00:24:20,417
However, we can still observe all the boot process and get all sorts

562
00:24:20,417 --> 00:24:23,125
of information about it via serial port and then we look

563
00:24:23,125 --> 00:24:25,667
and discover this other port.

564
00:24:25,999 --> 00:24:30,334
And yes, the boner police have come for you.

565
00:24:31,250 --> 00:24:35,334
So we open up the other port and there's an SD card inside.

566
00:24:36,626 --> 00:24:38,667
What can go wrong?

567
00:24:38,667 --> 00:24:40,999
This is a device hung on a telephone pole 12 feet

568
00:24:40,999 --> 00:24:44,125
up so you need an extension ladder.

569
00:24:46,834 --> 00:24:48,959
So great, SD card.

570
00:24:48,959 --> 00:24:50,417
But what the heck is on it?

571
00:24:50,417 --> 00:24:56,918
So the manual claims that it contains the operating system and configuration

572
00:24:56,918 --> 00:25:01,999
files for the device on a hidden file system.

573
00:25:08,250 --> 00:25:13,999
By the way, day 2 on the job, I remove the SD card and threw it

574
00:25:13,999 --> 00:25:15,876
in my Mac.

575
00:25:16,876 --> 00:25:21,375
It mounted or attempted to mount, didn't find any file systems.

576
00:25:21,375 --> 00:25:22,999
Crap, hidden file systems.

577
00:25:22,999 --> 00:25:23,999
How did they do that?

578
00:25:24,083 --> 00:25:27,999
I made a DD image of the SD card.

579
00:25:27,999 --> 00:25:32,375
Couldn't identify any of the images on the ISO image either.

580
00:25:32,375 --> 00:25:33,375
No big deal.

581
00:25:35,584 --> 00:25:40,083
I ran strings and found interesting stuff on what appeared

582
00:25:40,083 --> 00:25:45,999
to be configuration from the entire disk image in plain text.

583
00:25:46,501 --> 00:25:50,083
Great, hidden file system unencrypted.

584
00:25:51,792 --> 00:25:57,209
So I put the image on my own SD card, so as not to damage the original.

585
00:25:57,792 --> 00:25:59,083
Put it back.

586
00:25:59,834 --> 00:26:03,709
And moved the device over to my Linux workstation so I could

587
00:26:03,709 --> 00:26:06,167
attempt to play with it.

588
00:26:06,375 --> 00:26:08,999
And I plugged it in to about 204 system

589
00:26:08,999 --> 00:26:12,999
and it ought mounted 3ESX file systems.

590
00:26:13,083 --> 00:26:17,459
Wait, I thought it was hidden.

591
00:26:17,542 --> 00:26:19,876
On Windows it is.

592
00:26:30,959 --> 00:26:33,999
You realize if the vendor releases vulnerability,

593
00:26:33,999 --> 00:26:38,792
they'll say it's the hard to understand format so we're fine.

594
00:26:38,792 --> 00:26:40,083
LARRY PESCE: Yes.

595
00:26:40,083 --> 00:26:42,250
At least it's not proprietary.

596
00:26:43,083 --> 00:26:45,999
LARRY PESCE: Yeah, just you wait.

597
00:26:49,459 --> 00:26:53,709
I start going through the file system and search for configs.

598
00:26:53,792 --> 00:26:57,501
And I find that there's a running and a quote golden config.

599
00:26:57,959 --> 00:27:00,876
And when you change the running config on the SD card,

600
00:27:00,876 --> 00:27:05,125
it detects that changes were made and boots the golden config.

601
00:27:05,250 --> 00:27:07,501
So I changed both.

602
00:27:09,209 --> 00:27:11,918
I changed the running config.

603
00:27:11,999 --> 00:27:16,125
Modified that detectedded it was changed on the boot and started

604
00:27:16,125 --> 00:27:19,999
the golden config that I changed to my own user name

605
00:27:19,999 --> 00:27:24,083
and password and now I'm root on the system.

606
00:27:24,959 --> 00:27:27,292
And by the way, they were attempting to get away

607
00:27:27,292 --> 00:27:30,459
with being able to modify some of those files on that SD card

608
00:27:30,459 --> 00:27:32,999
by using Unix file permissions.

609
00:27:33,375 --> 00:27:35,083
So they were owned by root.

610
00:27:35,250 --> 00:27:36,876
But guess what?

611
00:27:36,876 --> 00:27:39,667
It's mounted on my file system and on my system as a file system

612
00:27:39,667 --> 00:27:42,417
and I am root on my file system so I have the right

613
00:27:42,417 --> 00:27:44,709
to change those files.

614
00:27:44,999 --> 00:27:45,999
So I did.

615
00:27:46,083 --> 00:27:49,501
Insert my SD card into the device, reboot it.

616
00:27:49,501 --> 00:27:51,999
And I now have a local user account on the device

617
00:27:51,999 --> 00:27:57,459
before tack accounting has to wait for the 3G connection to start.

618
00:27:57,918 --> 00:28:02,334
So I have full control of the device and the device contains Wi Fi access

619
00:28:02,334 --> 00:28:05,501
point which connects outbound over the 3G and

620
00:28:05,501 --> 00:28:09,999
because I configure it I can set up routing and offer free Wi Fi

621
00:28:09,999 --> 00:28:14,751
for everyone in the neighborhood, amongst other things.

622
00:28:14,959 --> 00:28:19,626
Excuse me, could you narrate the pictures on the slide?

623
00:28:19,626 --> 00:28:21,334
I feel like you're glossing over it.

624
00:28:21,334 --> 00:28:23,250
LARRY PESCE: Well that's the point.

625
00:28:23,667 --> 00:28:27,209
So the initial vendor response was oh, but you didn't use your high security

626
00:28:27,209 --> 00:28:30,167
mount for mounting this on the pole.

627
00:28:30,167 --> 00:28:31,209
Oh, you mean the one with will big hole

628
00:28:31,209 --> 00:28:34,584
in it so you can still gain access to the SD card slot?

629
00:28:34,999 --> 00:28:35,999
No.

630
00:28:35,999 --> 00:28:39,167
And aluminum that we can take out with a crowbar?

631
00:28:39,167 --> 00:28:40,167
Awesome.

632
00:28:40,167 --> 00:28:44,959
So we contacted the vendor through our client.

633
00:28:44,959 --> 00:28:46,250
And they said sure, how about we just put a password

634
00:28:46,250 --> 00:28:47,999
on the config file?

635
00:28:48,250 --> 00:28:51,209
I'm not exactly sure what they meant by that.

636
00:28:51,209 --> 00:28:54,417
But I don't think they were either.

637
00:28:54,417 --> 00:28:55,876
When you say you have a shortcoming

638
00:28:55,876 --> 00:29:00,083
in security knowledge you can't put a password on a file.

639
00:29:00,083 --> 00:29:01,250
LARRY PESCE: You can.

640
00:29:01,250 --> 00:29:02,459
But how are they going to start reading it and putting

641
00:29:02,459 --> 00:29:04,459
the password in memory.

642
00:29:04,459 --> 00:29:09,083
Just put it at the beginning of the file.

643
00:29:09,083 --> 00:29:11,083
So include the password in band.

644
00:29:11,083 --> 00:29:13,876
No one's talking about music yet, buddy.

645
00:29:13,876 --> 00:29:17,083
LARRY PESCE: Not yet.

646
00:29:18,709 --> 00:29:22,999
When we talk to the vendor, we said guys, that's really dumb.

647
00:29:22,999 --> 00:29:25,999
Vendor, how about we maybe work with you on a contract

648
00:29:25,999 --> 00:29:29,999
to test your stuff before you deliver it to customers?

649
00:29:29,999 --> 00:29:33,083
And they said oh, well we have a team that does that for us.

650
00:29:33,083 --> 00:29:34,250
An internal team.

651
00:29:34,751 --> 00:29:36,999
Yes, they must be awesome.

652
00:29:37,999 --> 00:29:41,709
If my calculations are correct, you suck.

653
00:29:41,709 --> 00:29:44,250
And yes, I bet you all read that in doc Brown's voice.

654
00:29:44,542 --> 00:29:45,542
Yeah.

655
00:29:45,542 --> 00:29:46,999
Titty sprinkles, right?

656
00:29:47,751 --> 00:29:49,083
All right.

657
00:29:49,083 --> 00:29:51,375
So I finished that.

658
00:29:51,626 --> 00:29:53,999
Engagement, spent a week back at home.

659
00:29:53,999 --> 00:29:58,459
My 10th day on the job, I'm back at another vendor or another customer.

660
00:29:58,667 --> 00:30:00,501
And I'm pen testing a different device

661
00:30:00,501 --> 00:30:05,501
from a different manufacturer but with similar type of function.

662
00:30:05,501 --> 00:30:07,834
So another one of these aggregator devices.

663
00:30:07,876 --> 00:30:10,083
This one was really well secured.

664
00:30:10,667 --> 00:30:15,542
Same thing for serial port, no exposed SD card Ethernet was fully

665
00:30:15,542 --> 00:30:17,334
shut down.

666
00:30:17,334 --> 00:30:19,417
You name it.

667
00:30:19,417 --> 00:30:22,709
But in due diligence to the customer, we asked them to login to the device

668
00:30:22,709 --> 00:30:25,876
for us and then we were going to review all the settings

669
00:30:25,876 --> 00:30:29,334
on the system and it was a Linux based system.

670
00:30:29,334 --> 00:30:31,792
So we wanted to review the Linux configure to see

671
00:30:31,792 --> 00:30:35,209
if there was anything they made mistakes.

672
00:30:35,417 --> 00:30:36,999
Go figure.

673
00:30:37,042 --> 00:30:40,834
So Unix based operating system.

674
00:30:40,834 --> 00:30:43,292
Serial and Ethernet were externally accessible.

675
00:30:43,626 --> 00:30:44,792
Once we logged in, we were taking a look

676
00:30:44,792 --> 00:30:47,334
to see what had been done for hardening.

677
00:30:47,876 --> 00:30:51,834
And the first one was distinct lack of SE shadows and

678
00:30:51,834 --> 00:30:54,959
all passwords were readable.

679
00:30:57,876 --> 00:30:59,459
Thank you.

680
00:31:00,999 --> 00:31:05,918
Yeah, so next, I'm like all right, let's do what I just did two weeks ago

681
00:31:05,918 --> 00:31:09,999
and see if I can get a DD image from the system.

682
00:31:10,417 --> 00:31:13,334
So I started trying to do DD over net cap.

683
00:31:13,459 --> 00:31:15,584
Unfortunately, the user I was logged

684
00:31:15,584 --> 00:31:19,667
into the device did not have read access to the entire file system so

685
00:31:19,667 --> 00:31:21,125
it failed.

686
00:31:21,667 --> 00:31:23,792
So I could not get my DD image to the local workstation

687
00:31:23,792 --> 00:31:26,999
after enabling Ethernet and all that good stuff.

688
00:31:27,083 --> 00:31:28,918
And it was also in 10 years of pen testing

689
00:31:28,918 --> 00:31:32,501
the first time I ever use the netcat in a pen test.

690
00:31:33,250 --> 00:31:36,626
Sorry, Ed.

691
00:31:36,626 --> 00:31:39,999
So I started looking around the operating system

692
00:31:39,999 --> 00:31:43,626
and find an application proxy.

693
00:31:44,375 --> 00:31:46,999
Which gives the user an ability to use commands

694
00:31:46,999 --> 00:31:50,999
from a nonprivileged account just like the one I had.

695
00:31:51,083 --> 00:31:57,792
This sounds like pseudo to me but it wasn't pseudo.

696
00:31:57,876 --> 00:32:00,959
So they kind of reinvented the wheel.

697
00:32:00,959 --> 00:32:01,959
Again.

698
00:32:01,959 --> 00:32:02,999
LARRY PESCE: Again.

699
00:32:02,999 --> 00:32:05,459
So the command has been obscured to protect

700
00:32:05,459 --> 00:32:09,918
the vendor so we start looking at the app proxy.

701
00:32:10,083 --> 00:32:13,584
The dash A gives us the level of access needed.

702
00:32:13,626 --> 00:32:14,626
Sweet.

703
00:32:14,999 --> 00:32:18,083
The dash C is the command we want to run from a white list

704
00:32:18,083 --> 00:32:20,292
of commands and the dash P gives us

705
00:32:20,292 --> 00:32:24,999
the command line options to set command in the white list.

706
00:32:24,999 --> 00:32:27,083
Did you guys see any authentication for using

707
00:32:27,083 --> 00:32:31,167
a potential system level command in that whole setup?

708
00:32:31,250 --> 00:32:33,083
Yeah, no, me neither.

709
00:32:33,250 --> 00:32:37,083
Didn't acquire additional name and password much like SUDU might,

710
00:32:37,083 --> 00:32:41,083
and granted access to the commands in the white list.

711
00:32:41,999 --> 00:32:44,709
Turned out that the dash P flag doesn't do sanity

712
00:32:44,709 --> 00:32:46,834
checks or filtering.

713
00:32:47,125 --> 00:32:48,626
(Laughter).

714
00:32:48,999 --> 00:32:52,125
So you pipe the output from one of those white listed commands

715
00:32:52,125 --> 00:32:55,250
like IP config to dev null and then you pipe another

716
00:32:55,250 --> 00:33:00,501
command that you want to do to it and it executes it happily as system.

717
00:33:03,876 --> 00:33:05,083
Yay!

718
00:33:08,417 --> 00:33:10,501
All right, so.

719
00:33:13,083 --> 00:33:18,999
So I get a copy image via netcat, via this privileged escalation

720
00:33:18,999 --> 00:33:25,626
and I start doing über link strings against the image and find a bunch

721
00:33:25,626 --> 00:33:31,501
of databases and database definitions that include commands such

722
00:33:31,501 --> 00:33:33,999
as create table.

723
00:33:33,999 --> 00:33:38,999
ID integer name text, salt text, password text, update date, date,

724
00:33:38,999 --> 00:33:41,626
and the primary key.

725
00:33:41,918 --> 00:33:43,250
Name salt and password.

726
00:33:43,250 --> 00:33:44,250
Great.

727
00:33:44,250 --> 00:33:50,751
So they're storing the password and the salt as text in the database.

728
00:33:51,626 --> 00:33:52,667
No!

729
00:33:53,334 --> 00:33:55,501
It just gets better.

730
00:33:55,542 --> 00:33:58,999
Now, that said, just pancakes?

731
00:34:00,626 --> 00:34:02,876
Anybody want pancakes.

732
00:34:02,876 --> 00:34:03,876
Flap jacks.

733
00:34:04,459 --> 00:34:06,959
Keep flapping those jacks.

734
00:34:07,417 --> 00:34:10,501
Raise your hand for pancakes!

735
00:34:10,501 --> 00:34:12,667
LARRY PESCE: Raise your hand.

736
00:34:12,999 --> 00:34:15,375
Keep them up.

737
00:34:15,375 --> 00:34:18,209
Wave money if you want pancakes.

738
00:34:18,209 --> 00:34:21,709
Wave something else if you want something else.

739
00:34:21,999 --> 00:34:24,709
Maynor still has his shirt on.

740
00:34:24,709 --> 00:34:26,250
Don't worry, he'll get it off.

741
00:34:26,250 --> 00:34:34,083
Another few hundred bucks and that will go.

742
00:34:34,083 --> 00:34:36,876
I had no idea what this database was for.

743
00:34:40,083 --> 00:34:42,999
Now I have access to the entire image.

744
00:34:42,999 --> 00:34:44,417
Access to the databases.

745
00:34:44,417 --> 00:34:45,417
That feels good.

746
00:34:45,417 --> 00:34:46,751
I'm from the vendor.

747
00:34:46,751 --> 00:34:48,999
I'm to make sure you don't complete this talk.

748
00:34:48,999 --> 00:34:51,626
LARRY PESCE: Nice, vendor response on this one.

749
00:34:51,709 --> 00:34:54,417
We're still waiting and well, I don't work there any more so I'll

750
00:34:54,417 --> 00:34:58,584
probably never find out what the response from the vendor was.

751
00:34:59,999 --> 00:35:04,083
I'm wondering why they ran out of D on their salad sign though.

752
00:35:05,167 --> 00:35:09,584
Try our Asian salad and they couldn't find the capital D so

753
00:35:09,584 --> 00:35:11,999
they had to use the upside down P.

754
00:35:11,999 --> 00:35:13,999
I don't know.

755
00:35:15,375 --> 00:35:17,209
Here's the final fail.

756
00:35:17,209 --> 00:35:19,334
Who wants pancakes.

757
00:35:19,375 --> 00:35:20,375
What?

758
00:35:20,375 --> 00:35:21,375
Too much?

759
00:35:25,250 --> 00:35:37,334
You can tell how many people here are not parents.

760
00:35:37,334 --> 00:35:42,125
LARRY PESCE: Yes, that's nothing if you're a parent, right?

761
00:35:42,125 --> 00:35:44,999
Except that the ass is a little bit bigger.

762
00:35:45,334 --> 00:35:46,709
All right.

763
00:35:46,709 --> 00:35:48,999
So this one was pointed out to me by my former boss who asked not

764
00:35:48,999 --> 00:35:50,667
to be named.

765
00:35:50,999 --> 00:35:53,999
So I asked for some help figuring out some information about utilities

766
00:35:53,999 --> 00:35:56,542
and pictures and all that type of stuff.

767
00:35:56,542 --> 00:36:01,834
And he sent me to Flickr for a interesting government agency

768
00:36:01,834 --> 00:36:06,083
that supports energy in Tennessee.

769
00:36:06,375 --> 00:36:09,083
And I will leave it at that.

770
00:36:09,542 --> 00:36:11,751
And these did get reported to said government agency and

771
00:36:11,751 --> 00:36:14,834
they removed them from their Flickr stream.

772
00:36:15,375 --> 00:36:18,834
However, you know that saying with some creep has got a copy

773
00:36:18,834 --> 00:36:21,417
of everything on the Internet?

774
00:36:21,626 --> 00:36:23,626
Yeah, sometimes that creep is me.

775
00:36:23,626 --> 00:36:26,334
So once they already removed them, I still had copies.

776
00:36:26,334 --> 00:36:28,834
Once it's on the Internet, it's already there.

777
00:36:28,834 --> 00:36:29,834
You guys know that.

778
00:36:29,834 --> 00:36:31,999
So let's look at this particular case study.

779
00:36:31,999 --> 00:36:32,250
So here's a picture from their Flickr stream

780
00:36:32,250 --> 00:36:34,375
for marketing purposes.

781
00:36:36,375 --> 00:36:38,209
It gets better.

782
00:36:38,209 --> 00:36:42,709
I'll call out specific things for you.

783
00:36:42,709 --> 00:36:44,292
Weave got a picture of a badge.

784
00:36:47,501 --> 00:36:51,584
We've got security video cameras and we can potentially gather locations

785
00:36:51,584 --> 00:36:55,999
and we have a gentleman by the name of Rick's phone number.

786
00:36:56,626 --> 00:36:57,999
Two of them.

787
00:36:57,999 --> 00:37:00,459
You also have this nifty red jacket right here.

788
00:37:00,459 --> 00:37:01,584
Is that members only?

789
00:37:01,584 --> 00:37:03,083
Might be.

790
00:37:03,083 --> 00:37:05,876
So you found the most advanced power plant

791
00:37:05,876 --> 00:37:09,792
in North America because they're on XP.

792
00:37:09,792 --> 00:37:11,083
Yes.

793
00:37:13,125 --> 00:37:16,292
If anybody thinks I'm joking, I'm not.

794
00:37:18,083 --> 00:37:20,375
There was another picture.

795
00:37:24,834 --> 00:37:26,083
Yep.

796
00:37:26,626 --> 00:37:30,417
LARRY PESCE: So there's a flyaway book

797
00:37:30,417 --> 00:37:34,584
is their DR plan underneath a box of tissues

798
00:37:34,584 --> 00:37:38,999
because apparently it makes them cry.

799
00:37:39,375 --> 00:37:42,083
Is it crying that the tissues are for?

800
00:37:42,083 --> 00:37:44,459
Yeah, definitely not the other one, Dave.

801
00:37:44,459 --> 00:37:45,459
Trust me.

802
00:37:45,751 --> 00:37:49,999
We've got XP in the background on cube well and XP and what appears

803
00:37:49,999 --> 00:37:51,667
to be IE7.

804
00:37:52,751 --> 00:37:54,459
We've also got.

805
00:37:54,459 --> 00:37:56,626
Is that a testing valid authority.

806
00:37:56,667 --> 00:38:01,834
Seriously, most advanced control room I've seen.

807
00:38:03,125 --> 00:38:08,083
LARRY PESCE: This fine lady is taking a picture.

808
00:38:09,918 --> 00:38:12,792
There are three monitors connected to the system.

809
00:38:12,792 --> 00:38:13,834
How can I tell?

810
00:38:14,626 --> 00:38:17,334
The background was customized by her to be

811
00:38:17,334 --> 00:38:21,834
a family and we see a picture legs at the bottom and it is the same

812
00:38:21,834 --> 00:38:25,209
on two monitors so those are on the same system using

813
00:38:25,209 --> 00:38:28,083
the same Windows backgrounds.

814
00:38:28,083 --> 00:38:30,959
I don't know what that is.

815
00:38:30,959 --> 00:38:33,417
But it looks like there's some sort of plant control or plant monitoring

816
00:38:33,417 --> 00:38:35,751
software on one workstation.

817
00:38:35,999 --> 00:38:38,334
I didn't we're running    Don't want to rub it

818
00:38:38,334 --> 00:38:40,999
in too much    LARRY PESCE: But we're doing some sort

819
00:38:40,999 --> 00:38:44,083
of plant control and monitoring on a machine that has access

820
00:38:44,083 --> 00:38:45,709
to outlook.

821
00:38:48,667 --> 00:38:50,501
And Office.

822
00:38:51,417 --> 00:38:53,459
That's kind of sketchy.

823
00:38:53,459 --> 00:38:57,209
Most advanced power plant in the country!

824
00:38:58,083 --> 00:39:01,125
Did you see there's a clock up here    LARRY PESCE: I did.

825
00:39:01,125 --> 00:39:02,334
But it's analog.

826
00:39:02,334 --> 00:39:03,876
LARRY PESCE: Yes.

827
00:39:03,876 --> 00:39:06,876
That means there's probably nothing we can do with that.

828
00:39:06,876 --> 00:39:08,709
LARRY PESCE: Except tell the time.

829
00:39:08,709 --> 00:39:11,792
It's guaranteed incorrect relative to the grid.

830
00:39:12,834 --> 00:39:17,876
Seriously, like you need to use something better than NTP.

831
00:39:17,876 --> 00:39:21,584
You want to find a cesium clock source, find a power control room.

832
00:39:21,584 --> 00:39:22,584
They'll have two.

833
00:39:22,751 --> 00:39:24,542
And they're using a battery powered clock

834
00:39:24,542 --> 00:39:27,209
on the wall they got from IKEA.

835
00:39:27,999 --> 00:39:31,250
They have cesium sourced time.

836
00:39:31,501 --> 00:39:34,792
And they're using a battery powered clock from IKEA.

837
00:39:36,083 --> 00:39:38,209
Or Wal Mart or whatever.

838
00:39:38,209 --> 00:39:41,626
LARRY PESCE: And you zoom into this particular pick this

839
00:39:41,626 --> 00:39:43,876
is Microsoft Word.

840
00:39:50,375 --> 00:39:55,334
So based on my six weeks of experience, we are so screwed.

841
00:39:55,334 --> 00:39:57,083
Because we're in an industry that we're starting

842
00:39:57,083 --> 00:40:01,375
to tell them you guys need to start at the beginning and stuff.

843
00:40:01,375 --> 00:40:05,999
By practicing defense and depth 2003 called and think want their

844
00:40:05,999 --> 00:40:07,999
security back.

845
00:40:10,167 --> 00:40:14,375
Last year I brought you Afro circus to make everything better.

846
00:40:16,918 --> 00:40:20,125
I don't have anything quite as bad as Afro circus.

847
00:40:20,125 --> 00:40:22,999
I'm not going to plant the ear wig for you guys this year.

848
00:40:22,999 --> 00:40:25,584
However, I do have some dead mouse for you.

849
00:40:25,709 --> 00:40:28,999
But it's not going to be the ear wig that I plant.

850
00:40:29,000 --> 00:40:30,999
It's the eye wig.

851
00:40:31,209 --> 00:40:35,918
To make it all better    Wait, wait, anyone want pancakes    LARRY

852
00:40:35,918 --> 00:40:39,542
PESCE: You'll want pancakes after this.

853
00:40:39,999 --> 00:40:42,000
You do not want the dry heaves.

854
00:40:42,000 --> 00:40:45,083
You'll want something to throw up.

855
00:40:45,083 --> 00:40:47,083
Because dead mouse is always better.

856
00:40:47,083 --> 00:40:48,626
When cats throw up to techno.

857
00:40:48,626 --> 00:40:50,083
Pgh    LARRY PESCE: Wait for it.

858
00:40:50,083 --> 00:40:51,083
Wait for it.

859
00:40:51,083 --> 00:40:52,792
Give it up for Barnaby, please.

860
00:40:52,792 --> 00:40:56,000
Dude, I think I saw this guy at one of the DEF CON parties last night.

861
00:41:15,542 --> 00:41:26,083
Wait for it, wait for it.

862
00:41:38,709 --> 00:41:42,083
Don't worry, this is not the 10 hour video.

863
00:41:44,918 --> 00:41:47,959
¯ yes, I'm going to play the whole thing.

864
00:41:48,083 --> 00:41:51,083
Flap jacks, anyone.

865
00:41:51,375 --> 00:41:59,083
How long did you spend collecting these videos?

866
00:41:59,417 --> 00:42:01,542
YouTube.

867
00:42:01,918 --> 00:42:06,918
LARRY PESCE: Here comes the money shot!

868
00:42:06,918 --> 00:42:07,918
Cats throwing up to techno always makes

869
00:42:07,918 --> 00:42:09,834
everything better.

870
00:42:10,999 --> 00:42:14,876
Guys want to see that again?

871
00:42:16,167 --> 00:42:17,626
All right.

872
00:42:17,626 --> 00:42:18,999
So with that, who's next.

873
00:42:19,334 --> 00:42:24,626
Are we missing Mr. Rob Graham.

874
00:42:24,626 --> 00:42:25,999
Mr. Rob Graham to the podium.

875
00:42:25,999 --> 00:42:26,999
Larry!

876
00:42:27,083 --> 00:42:28,083
,!

877
00:42:28,417 --> 00:42:30,375
Do you need my delay port adapter.

878
00:42:32,083 --> 00:42:33,918
We all need it.

879
00:42:33,918 --> 00:42:34,999
We need what you got.

880
00:42:35,209 --> 00:42:39,125
LARRY PESCE: Thank you very much.

881
00:42:44,959 --> 00:42:47,083
(Applause.) You guys will never listen to dead mouse

882
00:42:47,083 --> 00:42:48,999
the same way again.

883
00:42:49,083 --> 00:42:52,209
If we ever did to begin with.

884
00:42:52,209 --> 00:42:53,292
While Rob makes his way to the podium, I'd

885
00:42:53,292 --> 00:42:56,292
like to give you some background about Rob.

886
00:42:56,999 --> 00:42:58,999
He's somewhat of a cheater.

887
00:42:58,999 --> 00:43:00,501
He broke the rules.

888
00:43:00,501 --> 00:43:03,999
We all, like normal people, do our presentations 5

889
00:43:03,999 --> 00:43:07,375
to 15 minutes before this panel.

890
00:43:07,375 --> 00:43:10,999
Rob did his last week at home before he even got on a plane

891
00:43:10,999 --> 00:43:12,918
to come here.

892
00:43:13,083 --> 00:43:15,792
So don't be amazed at anything he talks about.

893
00:43:15,792 --> 00:43:18,959
It was all done a week ago.

894
00:43:18,999 --> 00:43:22,751
I didn't even pick a topic until I got here.

895
00:43:22,999 --> 00:43:25,959
ROB GRAHAM: It's true.

896
00:43:25,959 --> 00:43:28,999
We're talking Rich to my right.

897
00:43:28,999 --> 00:43:31,209
No, I'm not Rich.

898
00:43:32,459 --> 00:43:34,959
That's why you're looking at my chest.

899
00:43:36,999 --> 00:43:43,626
How much money do we have and what part Rich's clothes are

900
00:43:43,626 --> 00:43:46,292
coming off next?

901
00:43:46,292 --> 00:43:47,751
Rich, seriously, we're in the speaker room

902
00:43:47,751 --> 00:43:50,999
about an hour before the talk and we're just saying what should

903
00:43:50,999 --> 00:43:52,459
I present?

904
00:43:54,083 --> 00:43:57,167
And then he was right here a few minutes ago.

905
00:43:57,751 --> 00:44:00,209
Furiously putting to the slides.

906
00:44:00,209 --> 00:44:01,459
Just a together slides.

907
00:44:01,459 --> 00:44:02,999
Just a quick update.

908
00:44:02,999 --> 00:44:06,209
We've raised about a thousand so far.

909
00:44:06,209 --> 00:44:12,834
(Applause.) That's 500 for Barnaby's family, 500 for EFF.

910
00:44:12,999 --> 00:44:14,959
Give until it hurts.

911
00:44:14,959 --> 00:44:16,959
Although actually, Barnaby's family.

912
00:44:16,959 --> 00:44:17,959
EFF.

913
00:44:17,959 --> 00:44:22,250
Home in New Zealand and give until it hurts even though we're making

914
00:44:22,250 --> 00:44:24,876
you hurt up here.

915
00:44:27,709 --> 00:44:29,375
Hey, Jack, don't go away.

916
00:44:29,542 --> 00:44:30,999
Because you know what?

917
00:44:30,999 --> 00:44:31,999
I don't have a job technically because I don't have start

918
00:44:31,999 --> 00:44:33,918
until the end of the month.

919
00:44:33,918 --> 00:44:34,959
But you know what?

920
00:44:35,709 --> 00:44:37,167
Here's 100 bucks.

921
00:44:54,125 --> 00:44:56,334
(cheers and applause).

922
00:44:56,834 --> 00:44:59,083
Would somebody go out in the hallway?

923
00:44:59,083 --> 00:45:01,167
There's like 100 people out there who didn't get the call

924
00:45:01,167 --> 00:45:03,083
to get more money.

925
00:45:03,083 --> 00:45:04,459
Can we yell it louder.

926
00:45:05,501 --> 00:45:10,250
We've got a teensy tiensee people, and there are a lot

927
00:45:10,250 --> 00:45:14,501
of people who want to see you're on.

928
00:45:17,751 --> 00:45:19,834
These are the panel rooms.

929
00:45:27,834 --> 00:45:32,709
I think we all know what this picture is.

930
00:45:32,709 --> 00:45:35,250
It's a gold plated fiberoptic panel.

931
00:45:37,709 --> 00:45:40,959
So this is a monster.com cable.

932
00:45:40,959 --> 00:45:42,999
They'll charge you 150 bucks for it and it's better than

933
00:45:42,999 --> 00:45:45,751
the two dollar cables because it's got gold plating

934
00:45:45,751 --> 00:45:49,834
to make sure that the fiber option connection is better.

935
00:45:49,834 --> 00:45:53,542
But Rob, what does gold have to do with fiberoptics.

936
00:45:53,667 --> 00:45:55,918
Oxygen free.

937
00:45:56,209 --> 00:46:00,250
Lead free probably and environmentally sound.

938
00:46:01,417 --> 00:46:05,959
And we all know the monster company, the marketing around this

939
00:46:05,959 --> 00:46:10,125
is that it's it gives superior life like sound.

940
00:46:10,667 --> 00:46:13,999
But this is a digital cable.

941
00:46:14,125 --> 00:46:16,999
Bits that go in are the same bits that go out.

942
00:46:17,167 --> 00:46:20,999
As long as that condition is true, every cable is equal.

943
00:46:20,999 --> 00:46:23,626
You can't add to the digital signal.

944
00:46:24,999 --> 00:46:26,542
Monster can.

945
00:46:26,542 --> 00:46:28,959
Oxygen free cable.

946
00:46:28,999 --> 00:46:30,834
Please, marketing.

947
00:46:30,834 --> 00:46:33,834
But Rob, what does gold have to do with fiberoptics?

948
00:46:33,834 --> 00:46:38,083
ROB GRAHAM: I don't know.

949
00:46:38,292 --> 00:46:40,999
So this is digital astrology.

950
00:46:40,999 --> 00:46:42,999
Somehow we can add to the bits.

951
00:46:43,542 --> 00:46:47,167
There's some magical mysticism we can add to the bits.

952
00:46:47,167 --> 00:46:51,209
We laugh at monster but we don't laugh at television sets.

953
00:46:51,584 --> 00:46:55,250
We laugh at Costco or Best Buy and go down the aisle

954
00:46:55,250 --> 00:46:59,999
of television sets and pick the prettiest one.

955
00:47:01,292 --> 00:47:03,959
But in the old days, I guess in analog TV

956
00:47:03,959 --> 00:47:07,999
by the old days I meant before half of us were born, TVs were analog

957
00:47:07,999 --> 00:47:10,999
and yeah, there was adjustments you could make

958
00:47:10,999 --> 00:47:13,375
to the TV to fix things.

959
00:47:13,667 --> 00:47:16,209
But with digital TV, it's digital.

960
00:47:16,209 --> 00:47:18,334
Same concept as monster cable.

961
00:47:18,959 --> 00:47:20,334
Bits in.

962
00:47:20,334 --> 00:47:22,959
It's 24 frames per second.

963
00:47:24,584 --> 00:47:30,999
It's 1080p or 780i or 24 bits per pixel.

964
00:47:30,999 --> 00:47:32,334
And that's the color.

965
00:47:32,709 --> 00:47:35,999
Any adjustment you make on that is degrading color you're not

966
00:47:35,999 --> 00:47:37,584
improving it.

967
00:47:38,584 --> 00:47:41,167
So digital is digital.

968
00:47:41,167 --> 00:47:44,501
Anything that does to make a vibrant optimized contrast

969
00:47:44,501 --> 00:47:48,083
and color is making the picture worse.

970
00:47:48,083 --> 00:47:51,584
And that's why you get these TVs home and you have nice pretty showroom

971
00:47:51,584 --> 00:47:54,918
you have nice pretty pictures with lots of colors and colors

972
00:47:54,918 --> 00:47:57,999
is really vibrant and you really like it.

973
00:47:57,999 --> 00:47:59,918
But then you get home and try to watch TV

974
00:47:59,918 --> 00:48:02,459
on it and everything is crap.

975
00:48:02,459 --> 00:48:05,751
Like you're watching Star Wars and Darth Vader is a black blob

976
00:48:05,751 --> 00:48:10,584
and Luke is a white blob and all the colors are saturated.

977
00:48:10,584 --> 00:48:11,999
And that's just racist!

978
00:48:11,999 --> 00:48:16,125
Can you get prescription Google Glasses, please?

979
00:48:16,125 --> 00:48:18,501
Obviously you're not sitting close enough.

980
00:48:18,501 --> 00:48:21,999
ROB GRAHAM: And So    But Rob, what does fiber optics have

981
00:48:21,999 --> 00:48:24,083
to do with gold?

982
00:48:26,292 --> 00:48:31,626
You watch directly and you can see the folds in Darth Vader's robes,

983
00:48:31,626 --> 00:48:37,083
you watch the same movie on TV and you can't see the details.

984
00:48:37,083 --> 00:48:39,417
It pisses me off because I've bought two TVs

985
00:48:39,417 --> 00:48:43,542
because no matter how many settings I've gone to I can't get

986
00:48:43,542 --> 00:48:46,876
to what a computer monitor shows.

987
00:48:46,876 --> 00:48:48,999
So the factory defaults are wrong.

988
00:48:49,999 --> 00:48:53,083
That's the color and contrast and the sharpness and

989
00:48:53,083 --> 00:48:58,501
all this other nasty stuff that they've distorted the digital signal.

990
00:48:58,501 --> 00:49:02,083
Maybe you need different cable.

991
00:49:02,083 --> 00:49:12,999
ROB GRAHAM: It looked great in the store because I bought it, right.

992
00:49:12,999 --> 00:49:15,584
There's a company called eColor that produces, in case

993
00:49:15,584 --> 00:49:19,459
all the distortion already on your digital TV is not enough,

994
00:49:19,459 --> 00:49:22,709
they'll sell you a box to do more.

995
00:49:31,999 --> 00:49:36,083
Preserving simple device with HDMI in and HDMI out just going

996
00:49:36,083 --> 00:49:38,999
through algorithms on SPCA.

997
00:49:39,584 --> 00:49:40,999
It's digital.

998
00:49:40,999 --> 00:49:43,417
Mathematical stuff on SVGA and you're great.

999
00:49:43,792 --> 00:49:48,083
But Rob, what does gold have to do with fiberoptics?

1000
00:49:48,083 --> 00:49:56,083
ROB GRAHAM: So I'm here to liberate the chips.

1001
00:49:56,083 --> 00:49:57,999
You have SPJs in service of evil.

1002
00:49:58,083 --> 00:50:00,375
So I want to liberate the chips.

1003
00:50:01,209 --> 00:50:03,999
So now I'm going to do that and grab actually,

1004
00:50:03,999 --> 00:50:06,250
can you grab this thing.

1005
00:50:06,250 --> 00:50:08,999
That's what she said.

1006
00:50:08,999 --> 00:50:09,999
This is the box.

1007
00:50:09,999 --> 00:50:10,999
You go on to Amazon.

1008
00:50:12,876 --> 00:50:17,584
The chip is a $50 chip but since these things suck

1009
00:50:17,584 --> 00:50:22,918
and only morons buy them, you can get them used on eBay

1010
00:50:22,918 --> 00:50:26,375
or close on Amazon for $10.

1011
00:50:26,501 --> 00:50:31,042
So I've got three boxes for $10 each.

1012
00:50:31,042 --> 00:50:34,999
It has a button.

1013
00:50:34,999 --> 00:50:39,000
There's all this crap in here and stuff.

1014
00:50:39,083 --> 00:50:41,876
You don't want any of this crap.

1015
00:50:42,083 --> 00:50:45,834
You've got the device, you've got power supply.

1016
00:50:45,959 --> 00:50:48,000
The little remote control.

1017
00:50:48,083 --> 00:50:49,083
The box.

1018
00:50:50,167 --> 00:50:51,999
So yeah, you have the device here and it comes

1019
00:50:51,999 --> 00:50:53,834
with a little protective plastic because you want

1020
00:50:53,834 --> 00:50:55,999
to keep it pretty because it sucks.

1021
00:50:57,667 --> 00:51:00,459
You got your little power supply and the power supply you sort of need

1022
00:51:00,459 --> 00:51:02,999
and you don't need this other crap.

1023
00:51:03,626 --> 00:51:06,292
So this device, I spent a long time trying to get

1024
00:51:06,292 --> 00:51:09,751
the case open so I could actually preserve the case but it's

1025
00:51:09,751 --> 00:51:11,834
all glued together.

1026
00:51:11,834 --> 00:51:13,999
So you just have to break it.

1027
00:51:13,999 --> 00:51:16,417
Once you break it, it doesn't go back together.

1028
00:51:16,417 --> 00:51:23,083
It's just broken.

1029
00:51:23,083 --> 00:51:24,083
(Laughter).

1030
00:51:24,083 --> 00:51:27,709
So you have this device and what you have it's really hard

1031
00:51:27,709 --> 00:51:33,999
to see so I'm going to try to use the display here, photo booth.

1032
00:51:33,999 --> 00:51:34,999
Let's try this.

1033
00:51:35,083 --> 00:51:38,125
So you can see there's three chips on this.

1034
00:51:38,334 --> 00:51:42,375
There's HDMI in and out and there's FPGA in the middle.

1035
00:51:42,999 --> 00:51:46,375
Now as hackers, what we know is that every device

1036
00:51:46,375 --> 00:51:49,709
in the world has a daytime debugging port on it

1037
00:51:49,709 --> 00:51:53,751
and usually first thing we do to grab device is go hunting

1038
00:51:53,751 --> 00:51:59,584
for chip pads, pads on mother board to go solder our connectors on it.

1039
00:51:59,626 --> 00:52:04,459
But these guys you can see they already have

1040
00:52:04,459 --> 00:52:08,542
the Jtag interface on it.

1041
00:52:08,542 --> 00:52:09,542
So that's awesome.

1042
00:52:09,542 --> 00:52:12,250
But Rob, what does gold have to do with fiberoptics.

1043
00:52:12,250 --> 00:52:16,542
ROB GRAHAM: These are gold plated for enhanced sound.

1044
00:52:17,709 --> 00:52:18,999
(Laughter).

1045
00:52:20,083 --> 00:52:23,584
So what we're going to do is can we have J tag which means

1046
00:52:23,584 --> 00:52:26,167
a back door to the FPJ chip.

1047
00:52:26,999 --> 00:52:30,083
Can you plug this in to power supply?

1048
00:52:48,834 --> 00:52:50,999
This is nice, powered up.

1049
00:52:51,125 --> 00:52:52,459
Another notebook.

1050
00:52:54,417 --> 00:52:55,999
There's a camera.

1051
00:53:00,959 --> 00:53:02,083
Anthony weiner.

1052
00:53:02,083 --> 00:53:03,083
BOOS.

1053
00:53:03,083 --> 00:53:12,375
Anthony Weiner's name will stop electronics.

1054
00:53:20,792 --> 00:53:26,083
It's probably gold plated too.

1055
00:53:26,083 --> 00:53:30,999
Really he'll show us his tinker bell.

1056
00:53:31,999 --> 00:53:36,999
And yes, that's what the kids recalling it.

1057
00:53:36,999 --> 00:53:38,999
For those new in the room, welcome.

1058
00:53:38,999 --> 00:53:42,584
Bring money down here, get your flap jacks over there.

1059
00:53:42,584 --> 00:53:45,999
It's not like you're giving money away.

1060
00:53:45,999 --> 00:53:47,792
Bring the money over here.

1061
00:53:49,999 --> 00:53:53,999
The money is going half half the money donated today is going

1062
00:53:53,999 --> 00:53:59,292
to Barnaby Jack's family and the other half is going to the EFF.

1063
00:53:59,542 --> 00:54:02,959
To be more specific it's Barnaby Jack's family is trying

1064
00:54:02,959 --> 00:54:04,999
to fly him home to New Zealand which

1065
00:54:04,999 --> 00:54:07,250
is where he's from and is really expensive

1066
00:54:07,250 --> 00:54:09,709
if you didn't know that.

1067
00:54:23,918 --> 00:54:25,209
Line up!

1068
00:54:25,999 --> 00:54:29,999
Standard J tag dongle.

1069
00:54:30,167 --> 00:54:31,999
USB port.

1070
00:54:31,999 --> 00:54:36,999
Rob, did you say dongle?

1071
00:54:36,999 --> 00:54:41,375
My flower is still down.

1072
00:54:43,626 --> 00:54:45,999
Get to the back door.

1073
00:54:45,999 --> 00:54:47,834
So we don't care about the HDME interface

1074
00:54:47,834 --> 00:54:51,999
or whatever this device is other than it's evil.

1075
00:54:52,125 --> 00:54:54,083
And we need to expunge the spirit.

1076
00:54:55,417 --> 00:54:59,125
So we just so I've downloaded the AlterraSPGA software so

1077
00:54:59,125 --> 00:55:02,959
all I need to do is connect up the chip.

1078
00:55:03,999 --> 00:55:13,999
Scan the bus through the device and then upload it.

1079
00:55:13,999 --> 00:55:15,125
What's the upload key?

1080
00:55:15,125 --> 00:55:17,209
It's his first time.

1081
00:55:17,584 --> 00:55:20,083
He's never presented before.

1082
00:55:20,083 --> 00:55:23,501
He won't remember what it's like and won't want to do it again.

1083
00:55:23,501 --> 00:55:26,999
ROB GRAHAM: I practiced this, that's what Dave was talking about.

1084
00:55:26,999 --> 00:55:29,501
I practiced it to make sure I was getting it right.

1085
00:55:29,501 --> 00:55:31,250
And you no, I can't even find the key.

1086
00:55:31,250 --> 00:55:32,417
Donations welcome.

1087
00:55:32,417 --> 00:55:36,083
We can't give you beer for in Vegas

1088
00:55:36,083 --> 00:55:41,292
for some really weird money.

1089
00:55:41,292 --> 00:55:42,375
We can give you sex.

1090
00:55:42,375 --> 00:55:49,083
But we can give you beer and randomly donate money next to us.

1091
00:55:49,083 --> 00:55:51,542
Michelle, it's American beer so it is water.

1092
00:55:55,459 --> 00:55:58,417
Guys on the street meet for me.

1093
00:56:04,083 --> 00:56:06,292
I will not throw beer.

1094
00:56:15,459 --> 00:56:21,959
ROB GRAHAM: I practiced for two weeks well, two weeks ago.

1095
00:56:24,209 --> 00:56:26,083
That's what he said.

1096
00:56:26,083 --> 00:56:29,083
ROB GRAHAM: And application all ready to go.

1097
00:56:29,083 --> 00:56:30,167
All I do is plug it in.

1098
00:56:30,167 --> 00:56:32,125
How's that working out for you?

1099
00:56:32,125 --> 00:56:35,626
But Rob, what does gold have to do with fiberoptics.

1100
00:56:44,083 --> 00:56:48,999
If you need a pancake, Jason has some.

1101
00:56:48,999 --> 00:56:49,999
Raise your hand.

1102
00:56:50,083 --> 00:56:52,459
I'm a technical analyst.

1103
00:56:54,709 --> 00:57:00,083
ROB GRAHAM: So I had to plug it in the right way around.

1104
00:57:00,334 --> 00:57:02,834
That's what he said.

1105
00:57:06,834 --> 00:57:10,542
We connected to the device, identified the FPGA chip

1106
00:57:10,542 --> 00:57:13,083
and model number here.

1107
00:57:13,209 --> 00:57:18,626
I downloaded this SOF file, that's the FPGA description from the Internet.

1108
00:57:18,626 --> 00:57:20,792
There's a project up on github that has

1109
00:57:20,792 --> 00:57:26,834
all the bit point mining software that can just download to the FPGA.

1110
00:57:30,125 --> 00:57:33,083
So now I'm downloading it and we'll see if it works.

1111
00:57:34,999 --> 00:57:38,999
Usually does it the first time you actually hit twice.

1112
00:57:38,999 --> 00:57:39,999
I don't know why.

1113
00:57:39,999 --> 00:57:44,999
Play with it a jiggle it around.

1114
00:57:44,999 --> 00:57:46,250
Play with your dongle.

1115
00:57:46,250 --> 00:57:47,709
Show a video of the skirt.

1116
00:57:47,709 --> 00:57:48,709
Wait, what?

1117
00:57:48,709 --> 00:57:50,167
I don't know, it works for me.

1118
00:57:50,167 --> 00:57:53,083
Show us your bit hub.

1119
00:57:53,083 --> 00:57:55,876
ROB GRAHAM: Now we've downloaded mining software

1120
00:57:55,876 --> 00:58:00,751
to the FPGA and you're using control program to do the mining and send

1121
00:58:00,751 --> 00:58:03,959
the results up to the Internet.

1122
00:58:09,334 --> 00:58:10,999
Password is on there.

1123
00:58:12,792 --> 00:58:18,667
My password is food bar 123 so, if you're looking for my password,

1124
00:58:18,667 --> 00:58:21,999
that's usually my password.

1125
00:58:21,999 --> 00:58:29,375
But Rob, what does food bar have to do with gold.

1126
00:58:33,125 --> 00:58:37,999
You can hunt down my passwords, e mail addresses, they tend not

1127
00:58:37,999 --> 00:58:40,250
to be Rob Graham.

1128
00:58:45,292 --> 00:58:47,999
I've used kevin Bitnick a lot.

1129
00:58:47,999 --> 00:58:49,292
How about Carlos Danger?

1130
00:58:49,292 --> 00:58:53,999
Is that going to work?

1131
00:58:54,083 --> 00:58:58,083
This is slow, it takes a while but it's running here.

1132
00:59:00,792 --> 00:59:05,292
You don't see it from a live demo but what had been running

1133
00:59:05,292 --> 00:59:09,876
for a few weeks, I just put the machine asleep.

1134
00:59:15,999 --> 00:59:17,709
He admits it.

1135
00:59:17,709 --> 00:59:22,083
It's created one chunk and sends them up to the server.

1136
00:59:22,584 --> 00:59:28,334
It does about 14 mega hashes a second is the rate.

1137
00:59:28,334 --> 00:59:29,999
It's pretty slow.

1138
00:59:29,999 --> 00:59:32,209
Faster than a desktop shall but slower than a GPU

1139
00:59:32,209 --> 00:59:34,999
but using 10 watts of power.

1140
00:59:37,292 --> 00:59:40,999
And it costs 10 bucks.

1141
00:59:40,999 --> 00:59:44,999
That's my chip liberation, taking this evil company

1142
00:59:44,999 --> 00:59:49,792
and products and doing something good.

1143
00:59:49,792 --> 00:59:51,250
How much money have you made.

1144
00:59:51,375 --> 00:59:54,250
ROB GRAHAM: Less than $10.

1145
00:59:54,250 --> 01:00:03,999
There's more gold in fiberoptics than that.

1146
01:00:07,709 --> 01:00:09,334
(Laughter).

1147
01:00:09,834 --> 01:00:11,667
That means he's done.

1148
01:00:13,834 --> 01:00:15,918
(cheers and applause).

1149
01:00:17,999 --> 01:00:25,584
So this is a this is a very special fail panel.

1150
01:00:26,125 --> 01:00:29,999
We've expanded the members of the panel.

1151
01:00:29,999 --> 01:00:32,918
We have a fail panel virgin on the team.

1152
01:00:32,999 --> 01:00:36,375
And our first female fail panelist.

1153
01:00:36,375 --> 01:00:40,209
But not both at the same time.

1154
01:00:40,209 --> 01:00:43,834
So we didn't warn her we are going to put her up on stage right now

1155
01:00:43,834 --> 01:00:46,501
but I think it's a good time.

1156
01:00:46,501 --> 01:00:47,501
Yeah.

1157
01:00:47,792 --> 01:00:49,334
Mostly because she's not drinking enough

1158
01:00:49,334 --> 01:00:51,209
in the fucking lemur.

1159
01:00:51,209 --> 01:00:54,125
All right.

1160
01:00:54,125 --> 01:00:57,042
Here we go.

1161
01:00:57,042 --> 01:00:59,501
So I said to Rob, I need to borrow your computer, here,

1162
01:00:59,501 --> 01:01:01,751
I've got a USB drive.

1163
01:01:01,999 --> 01:01:04,209
Said seems legit and he plugged it in.

1164
01:01:05,209 --> 01:01:07,209
It was gold plated.

1165
01:01:07,584 --> 01:01:14,792
But Wendy, what does gold have to do with fiberoptics.

1166
01:01:15,501 --> 01:01:17,584
Just wait and see.

1167
01:01:17,834 --> 01:01:20,999
But Dave, why is my penis in your ear.

1168
01:01:20,999 --> 01:01:23,999
DAVE MAYNOR: I'm trying to hear you come, obviously.

1169
01:01:31,792 --> 01:01:33,709
I just heard something.

1170
01:01:34,918 --> 01:01:36,959
It was very small.

1171
01:01:38,375 --> 01:01:40,709
Sounded like a dead mouse.

1172
01:01:40,709 --> 01:01:43,999
I'm a Jewish boy from Jersey, it's not going to impress anyone.

1173
01:01:43,999 --> 01:01:48,292
It's not the size of the penis.

1174
01:01:48,709 --> 01:01:50,751
It's the amount of syphilis you have.

1175
01:01:50,751 --> 01:01:56,999
WENDY: It's not the size of the ship and it's not the motion

1176
01:01:56,999 --> 01:01:59,375
of the ocean.

1177
01:01:59,375 --> 01:02:00,999
It's whether the ship can stay in port

1178
01:02:00,999 --> 01:02:04,459
until all passengers have disembarked.

1179
01:02:06,083 --> 01:02:08,125
(cheers and applause).

1180
01:02:09,959 --> 01:02:12,209
I've got three kids.

1181
01:02:12,209 --> 01:02:13,209
Call me sniper.

1182
01:02:13,209 --> 01:02:14,334
One shot, one kill.

1183
01:02:16,834 --> 01:02:17,999
(Laughter).

1184
01:02:17,999 --> 01:02:21,209
It looks like we're a little over $1,500 right now.

1185
01:02:24,375 --> 01:02:28,250
I want to give a special shout jut sky talks just threw

1186
01:02:28,250 --> 01:02:29,876
200 in.

1187
01:02:31,999 --> 01:02:34,999
And let me just say in the security community we often

1188
01:02:34,999 --> 01:02:38,459
focus on some blow hazards and some FUD and I know you'll be

1189
01:02:38,459 --> 01:02:42,792
startled, there are actually ass holes in this community.

1190
01:02:44,417 --> 01:02:46,083
Fuck them.

1191
01:02:46,083 --> 01:02:49,083
There are awesome people sitting around you and maybe even sitting

1192
01:02:49,083 --> 01:02:50,999
on this panel.

1193
01:02:50,999 --> 01:02:51,999
So absolutely.

1194
01:02:51,999 --> 01:02:54,626
So as you're exhausted and trying to focus on getting through it,

1195
01:02:54,626 --> 01:02:57,792
maybe there's awesome people around you.

1196
01:02:57,792 --> 01:02:58,876
Have a conversation.

1197
01:02:59,292 --> 01:03:01,959
And people just open up.

1198
01:03:01,959 --> 01:03:03,999
So anyway, there's a bucket here.

1199
01:03:03,999 --> 01:03:07,334
It looks pretty good but it will look better with a little more in it.

1200
01:03:08,083 --> 01:03:09,999
That's what she said.

1201
01:03:10,999 --> 01:03:14,083
Speaking of she, hey, Wendy, what's going on.

1202
01:03:14,626 --> 01:03:23,417
It looks like we did    WENDY: $1,900 last year is that what it was?

1203
01:03:23,417 --> 01:03:24,999
Okay, we can do better this time.

1204
01:03:24,999 --> 01:03:26,083
Hi, everybody.

1205
01:03:26,083 --> 01:03:27,999
I'm Alex Rothman Shostack, Esquire.

1206
01:03:27,999 --> 01:03:29,083
Shostack, Esquire.

1207
01:03:32,999 --> 01:03:35,667
Speaker phone.

1208
01:03:35,709 --> 01:03:42,999
Hi, mom, I'm in front of about 2,000 people.

1209
01:03:46,834 --> 01:03:50,584
In is the boldest move in the history of fail panel.

1210
01:03:50,584 --> 01:03:55,083
Hi, mom, how are you doing?

1211
01:03:55,083 --> 01:03:58,083
I'm great, I guess you're in front of 10,000 people, huh?

1212
01:03:58,083 --> 01:03:59,375
2,000, but that's okay.

1213
01:03:59,375 --> 01:04:01,083
2,000, but that's close enough.

1214
01:04:01,083 --> 01:04:03,999
Hi, mom (in unison).

1215
01:04:03,999 --> 01:04:04,999
You still there?

1216
01:04:08,083 --> 01:04:09,584
(Laughter).

1217
01:04:09,751 --> 01:04:10,999
You wanted something?

1218
01:04:12,999 --> 01:04:14,083
What's that?

1219
01:04:14,083 --> 01:04:16,292
Mom: I'm waiting for squawking to stop.

1220
01:04:16,292 --> 01:04:20,459
Anyway, I just wanted to talk to you guys before you left the country.

1221
01:04:20,959 --> 01:04:22,999
We hope the rash cleared up.

1222
01:04:22,999 --> 01:04:23,999
Can we talk later.

1223
01:04:23,999 --> 01:04:25,999
Mom: That would be great.

1224
01:04:25,999 --> 01:04:28,083
Okay, thanks, mom, bye.

1225
01:04:37,209 --> 01:04:41,209
(Applause.)    We have to give it up for him.

1226
01:04:41,209 --> 01:04:44,125
Seriously, who else would let her mother hear this place.

1227
01:04:44,125 --> 01:04:47,250
Dude, at DEF CON, everyone had your mother.

1228
01:04:47,417 --> 01:04:49,125
Boos.

1229
01:04:49,292 --> 01:04:55,417
There's room for more.

1230
01:04:55,417 --> 01:04:56,417
All right.

1231
01:04:56,417 --> 01:04:58,626
ALEX ROTHMAN: All right.

1232
01:04:58,626 --> 01:05:03,999
So    Hey, you with the beer, come back here.

1233
01:05:03,999 --> 01:05:04,999
We thank you.

1234
01:05:04,999 --> 01:05:07,792
Hey, Wendy, are you going to be talking about blog.

1235
01:05:07,792 --> 01:05:10,959
ALEX ROTHMAN: Yeah, I'm Alex Rothman, Shostack, Esquire.

1236
01:05:10,959 --> 01:05:13,999
And I'm going to talk about let's just say I listen

1237
01:05:13,999 --> 01:05:17,417
to presentations for a living.

1238
01:05:18,334 --> 01:05:22,209
And yeah, bring me more to drink, please.

1239
01:05:22,292 --> 01:05:28,751
So after the first few hundred of those, it all starts to look like this.

1240
01:05:28,751 --> 01:05:30,417
And I wanted to share this with you.

1241
01:05:31,834 --> 01:05:34,083
Quick pause, have you ever seen dead mouse

1242
01:05:34,083 --> 01:05:36,083
in a presentation?

1243
01:05:36,250 --> 01:05:39,999
ALEX ROTHMAN: I've heard dead mouse and seen some

1244
01:05:39,999 --> 01:05:42,334
pretty (Laughter).

1245
01:05:48,834 --> 01:05:50,999
ALEX ROTHMAN: This is still not enough

1246
01:05:50,999 --> 01:05:53,125
for vendor presentations.

1247
01:05:53,501 --> 01:05:58,667
Who will donate money for Wendy to shotgun a beer.

1248
01:05:59,209 --> 01:06:01,417
Canadian beer.

1249
01:06:01,584 --> 01:06:03,501
Fine American beer.

1250
01:06:03,751 --> 01:06:07,584
Can't you give a version something a little better.

1251
01:06:07,751 --> 01:06:09,751
Bourbon is bad.

1252
01:06:10,083 --> 01:06:13,792
Who's got bourbon.

1253
01:06:13,792 --> 01:06:14,999
Wait, there's a virgin.

1254
01:06:14,999 --> 01:06:17,709
What kind of Scotch is that?

1255
01:06:21,501 --> 01:06:23,083
Single malt.

1256
01:06:23,542 --> 01:06:25,083
I'll take it.

1257
01:06:34,834 --> 01:06:38,209
I'll take it.

1258
01:06:38,209 --> 01:06:41,751
None of this bourbon shift.

1259
01:06:41,999 --> 01:06:42,999
Thank you.

1260
01:06:42,999 --> 01:06:47,999
Wait, wait, you're a virgin with Bon.

1261
01:06:49,417 --> 01:06:54,375
ALEX ROTHMAN: At Schmoo con, I got on stage and somebody handed

1262
01:06:54,375 --> 01:06:59,751
me a big plastic cup with what I found out later was rum.

1263
01:06:59,999 --> 01:07:05,626
15 minutes later I went off the stage completely wasted.

1264
01:07:05,626 --> 01:07:07,876
Can someone get a picture of her with the bourbon

1265
01:07:07,876 --> 01:07:09,834
for her RSA photo.

1266
01:07:11,125 --> 01:07:14,667
ALEX ROTHMAN: Please label it Alex Rothman Shostack, Esquire,

1267
01:07:14,667 --> 01:07:17,999
otherwise, I have to explain it to my boss.

1268
01:07:17,999 --> 01:07:19,626
Why I didn't share with him.

1269
01:07:28,709 --> 01:07:31,751
Every presentation starts with there are bad guys out there

1270
01:07:31,751 --> 01:07:35,834
and they're trying to put a big ass key into your computer.

1271
01:07:36,417 --> 01:07:39,459
But just to make sure we're all on the same page,

1272
01:07:39,459 --> 01:07:42,999
are there bad guys out there with big keys?

1273
01:07:42,999 --> 01:07:45,999
ALEX ROTHMAN: Well some of them think they're really big

1274
01:07:45,999 --> 01:07:48,626
but they're not that big.

1275
01:07:48,792 --> 01:07:50,918
It's all about key length, right?

1276
01:07:50,918 --> 01:07:51,918
Right?

1277
01:07:55,250 --> 01:07:58,125
So yeah, more, blah, blah because generations

1278
01:07:58,125 --> 01:08:03,083
because we don't understand these people but they wear masks.

1279
01:08:03,083 --> 01:08:04,999
I really like V for vendetta.

1280
01:08:04,999 --> 01:08:06,999
Yeah, and then of course there are scary,

1281
01:08:06,999 --> 01:08:11,542
scary numbers, lots of scary numbers, usually percentages that don't have

1282
01:08:11,542 --> 01:08:15,584
anything to do with anything else but of course they have to wind

1283
01:08:15,584 --> 01:08:18,083
up with big scary numbers.

1284
01:08:18,083 --> 01:08:20,292
What's the biggest number you've seen?

1285
01:08:20,292 --> 01:08:24,083
ALEX ROTHMAN: I can't talk about that in public.

1286
01:08:29,501 --> 01:08:31,999
He just wants to brag about it.

1287
01:08:31,999 --> 01:08:32,999
That's all.

1288
01:08:33,834 --> 01:08:36,999
And then of course everybody's got a solution.

1289
01:08:36,999 --> 01:08:39,334
Hey, I didn't know you were using my picture.

1290
01:08:39,334 --> 01:08:43,626
ALEX ROTHMAN: Everybody's got a solution.

1291
01:08:43,626 --> 01:08:45,999
And have you noticed that every term in security was made

1292
01:08:45,999 --> 01:08:48,459
up by    Is that a spider?

1293
01:08:48,459 --> 01:08:51,999
ALEX ROTHMAN: Was made up by people who desperately want

1294
01:08:51,999 --> 01:08:56,834
to be macho so they use all sorts of law enforcement and weapon

1295
01:08:56,834 --> 01:09:01,542
and violence things we've secured ninjas and knights and spears

1296
01:09:01,542 --> 01:09:05,501
and blood and we don't have hair balls.

1297
01:09:05,501 --> 01:09:08,834
My DS SOP says I have to secure this presentation

1298
01:09:08,834 --> 01:09:11,417
as a TSCPI because you haven't gone

1299
01:09:11,417 --> 01:09:13,876
through an SS SPI.

1300
01:09:13,876 --> 01:09:15,792
ALEX ROTHMAN: Yes, I do, thank you.

1301
01:09:17,083 --> 01:09:18,834
I don't know why they keep going

1302
01:09:18,834 --> 01:09:22,334
through this macho stuff when this is just as scary.

1303
01:09:22,417 --> 01:09:25,125
That's my mom!

1304
01:09:25,209 --> 01:09:27,834
ALEX ROTHMAN: That's right.

1305
01:09:27,834 --> 01:09:31,375
Wait a minute, that man just paid $100 for pancakes.

1306
01:09:38,626 --> 01:09:40,167
(cheers and applause).

1307
01:09:40,167 --> 01:09:41,999
Did you have any good meals in Vegas.

1308
01:09:41,999 --> 01:09:42,999
Yeah.

1309
01:09:42,999 --> 01:09:43,999
Yeah.

1310
01:09:43,999 --> 01:09:44,999
I had a steak.

1311
01:09:44,999 --> 01:09:46,167
Well, I had a pancake.

1312
01:09:49,125 --> 01:09:51,125
$33 a pancake.

1313
01:09:51,501 --> 01:09:55,125
I believe at this point    Cheers, everyone.

1314
01:09:55,125 --> 01:09:59,999
To all of you.

1315
01:09:59,999 --> 01:10:02,667
Hey, real quick while we're doing this, everybody raise your glasses

1316
01:10:02,667 --> 01:10:05,999
and say good bye to our very good friend Barnaby.

1317
01:10:05,999 --> 01:10:07,667
To Barnaby!

1318
01:10:07,667 --> 01:10:17,542
I can't help notice, one Wendy, you still have some left.

1319
01:10:17,542 --> 01:10:19,667
I did.

1320
01:10:19,667 --> 01:10:20,834
I'm very observant.

1321
01:10:20,834 --> 01:10:23,584
I'm stretching it out.

1322
01:10:23,667 --> 01:10:24,999
And that's what is he said.

1323
01:10:26,626 --> 01:10:30,209
So Wendy as a fail panel virgin.

1324
01:10:30,375 --> 01:10:34,999
The first fail panel I was prepared for was heckling from the audience.

1325
01:10:35,999 --> 01:10:38,959
It was over quick.

1326
01:10:38,959 --> 01:10:39,417
I wasn't prepared for the constant heckling

1327
01:10:39,417 --> 01:10:41,000
to the copanelists.

1328
01:10:41,250 --> 01:10:46,042
ALEX ROTHMAN: I know most of you guys.

1329
01:10:46,042 --> 01:10:50,999
I found the angry old lady trick works really well at least for me.

1330
01:10:50,999 --> 01:10:53,999
I think we should have more of this in security.

1331
01:10:54,000 --> 01:10:57,709
And of course everybody wants to tell me that they're the best

1332
01:10:57,709 --> 01:11:01,083
and unique and the first one to have done something really,

1333
01:11:01,083 --> 01:11:04,209
really exciting and it's all because it's not antivirus

1334
01:11:04,209 --> 01:11:06,709
and it's not a firewall.

1335
01:11:06,834 --> 01:11:11,709
Everybody is, like, shooting down these things and everybody

1336
01:11:11,709 --> 01:11:15,542
is saying the S word, signature.

1337
01:11:15,542 --> 01:11:16,999
No, we don't use signatures.

1338
01:11:16,999 --> 01:11:19,999
We're better than this because we don't use signatures.

1339
01:11:19,999 --> 01:11:20,999
We use rules.

1340
01:11:21,083 --> 01:11:22,459
(Laughter).

1341
01:11:22,918 --> 01:11:23,999
Yeah.

1342
01:11:23,999 --> 01:11:26,834
I actually    What do rules have to do with fiberoptics.

1343
01:11:26,834 --> 01:11:28,083
The golden rule.

1344
01:11:30,209 --> 01:11:32,918
Is this like the golden shower?

1345
01:11:34,417 --> 01:11:37,999
ALEX ROTHMAN: That's later, I need another drink for that.

1346
01:11:37,999 --> 01:11:41,999
We need to raise $3,000 for that.

1347
01:11:42,125 --> 01:11:46,626
It's like you hitting on judge Judy: It's not anti virus

1348
01:11:46,626 --> 01:11:50,999
and not a firewall and nobody is ready to say get rid

1349
01:11:50,999 --> 01:11:54,459
of your antivirus or firewall.

1350
01:11:55,834 --> 01:12:02,209
Everybody is saying these days they're great because they're not also they're

1351
01:12:02,209 --> 01:12:06,999
the best because they have really big data.

1352
01:12:08,375 --> 01:12:10,999
Their data is really big.

1353
01:12:10,999 --> 01:12:13,959
It's much bigger than the other vendor's data.

1354
01:12:14,250 --> 01:12:16,083
Would you like to see our data?

1355
01:12:16,083 --> 01:12:18,083
We'll show you how big it is.

1356
01:12:18,083 --> 01:12:19,999
Would you like to measure our big data?

1357
01:12:20,125 --> 01:12:24,999
It's really and they want to stick their big data in everything.

1358
01:12:26,999 --> 01:12:30,083
There's a DI for data injection.

1359
01:12:30,083 --> 01:12:31,918
Wendy and I are both analysts.

1360
01:12:31,918 --> 01:12:38,083
I've had two recently one it was backed by SQL server and the other

1361
01:12:38,083 --> 01:12:43,834
is they deal with large SharePoint servers.

1362
01:12:44,542 --> 01:12:47,834
So you're a double whore?

1363
01:12:49,667 --> 01:12:52,999
ALEX ROTHMAN: Nobody on the crew nobs what's knows what's

1364
01:12:52,999 --> 01:12:57,584
coming up next because I made this up yesterday in the bathtub.

1365
01:12:57,584 --> 01:12:59,999
Chicky chicky wow wow.

1366
01:13:01,999 --> 01:13:04,792
Save that, that's come up.

1367
01:13:04,999 --> 01:13:05,999
.

1368
01:13:08,125 --> 01:13:09,999
That says realist.

1369
01:13:09,999 --> 01:13:15,083
ALEX ROTHMAN: We're note just fast, we're realer time than they are.

1370
01:13:15,083 --> 01:13:16,417
Because hardware cloud.

1371
01:13:16,417 --> 01:13:17,999
We're realer time than they are.

1372
01:13:17,999 --> 01:13:26,999
I'm going to throw out an idea here.

1373
01:13:27,083 --> 01:13:30,375
What happens if you get cloud hardware?

1374
01:13:30,501 --> 01:13:32,542
Then it gets really hard.

1375
01:13:32,542 --> 01:13:33,667
Yeah, it does.

1376
01:13:33,667 --> 01:13:35,083
That's what she said.

1377
01:13:35,999 --> 01:13:39,417
ALEX ROTHMAN: So all of this makes me do this.

1378
01:13:40,999 --> 01:13:43,709
I feel slightly uncomfortable.

1379
01:13:43,709 --> 01:13:45,751
ALEX ROTHMAN: I really need a helmet.

1380
01:13:46,125 --> 01:13:48,167
That would help me during the presentations I have

1381
01:13:48,167 --> 01:13:52,999
to watch and listen to, if I had a helmet, I would feel better sometimes.

1382
01:13:52,999 --> 01:13:54,292
It would clean up easier.

1383
01:13:54,292 --> 01:13:57,667
ALEX ROTHMAN: Here's my solution to the problem.

1384
01:13:57,667 --> 01:14:01,999
We need more sound effects in security.

1385
01:14:01,999 --> 01:14:03,334
Is that how you spell more.

1386
01:14:03,334 --> 01:14:05,083
ALEX ROTHMAN: Well yes, yes it is.

1387
01:14:05,083 --> 01:14:06,083
I can't spell.

1388
01:14:06,125 --> 01:14:08,083
Just play dead mouse, Wendy.

1389
01:14:08,083 --> 01:14:11,999
ALEX ROTHMAN: As you can see, we're almost there.

1390
01:14:11,999 --> 01:14:14,959
A lot of vendor names sound like side effects.

1391
01:14:15,918 --> 01:14:17,792
We have hadoop.

1392
01:14:17,999 --> 01:14:18,999
Splunk.

1393
01:14:18,999 --> 01:14:22,834
Splunk is a real thing.

1394
01:14:27,626 --> 01:14:30,167
What's's gold got to do with splunk.

1395
01:14:30,167 --> 01:14:32,626
If you have the gold, you get to splunk.

1396
01:14:40,083 --> 01:14:42,417
Last Corona, we're going to auction it.

1397
01:14:42,999 --> 01:14:47,083
Who will take their shirt off for a Corona.

1398
01:14:56,292 --> 01:14:58,417
Underwear, oh, God, yes.

1399
01:14:58,751 --> 01:15:01,375
We've got 40 over there.

1400
01:15:01,999 --> 01:15:04,792
Nice gentleman with the gray cap.

1401
01:15:04,959 --> 01:15:06,417
Anyone over 40.

1402
01:15:06,999 --> 01:15:10,792
Sold, Corona with 40 thank you, serve.

1403
01:15:18,125 --> 01:15:20,709
This is just sound effects.

1404
01:15:26,626 --> 01:15:28,501
Hadoop, Hadoop.

1405
01:15:31,292 --> 01:15:36,542
They're all just Norwegians.

1406
01:15:36,876 --> 01:15:39,959
ALEX ROTHMAN: So yes, sound effects.

1407
01:15:39,959 --> 01:15:41,542
We really need sound effects.

1408
01:15:41,999 --> 01:15:43,626
When you're talking about people are telling me

1409
01:15:43,626 --> 01:15:46,083
about malware, I love it when they pronounce is mall ware

1410
01:15:46,083 --> 01:15:48,459
because then I think of this.

1411
01:15:50,709 --> 01:15:53,999
Let's go to the mall ware.

1412
01:15:55,709 --> 01:15:58,584
ALEX ROTHMAN: Any time somebody starts talking

1413
01:15:58,584 --> 01:16:00,876
about mall wear, I can start thinking

1414
01:16:00,876 --> 01:16:02,999
about elevator music.

1415
01:16:07,999 --> 01:16:10,999
Everything that you hear in a mall, you can start thinking

1416
01:16:10,999 --> 01:16:14,083
about it whenever anybody sells mall wear.

1417
01:16:14,209 --> 01:16:17,250
Is there a Victoria's Secret to this mall wear?

1418
01:16:17,292 --> 01:16:19,292
(cheers and applause).

1419
01:16:19,292 --> 01:16:20,542
(cheers and applause).

1420
01:16:20,542 --> 01:16:29,250
5, 4, 3, 2, 1.

1421
01:16:32,999 --> 01:16:33,999
Fail!

1422
01:16:33,999 --> 01:16:38,876
That would be a targeting fail.

1423
01:16:38,876 --> 01:16:40,959
ALEX ROTHMAN: We need a flap jack trebuchet,

1424
01:16:40,959 --> 01:16:42,999
that's what we need.

1425
01:16:44,751 --> 01:16:47,083
I have an ultimate fail.

1426
01:16:48,501 --> 01:16:56,459
My kids are here so they can see what dad does for a living.

1427
01:16:56,751 --> 01:17:00,626
They're too busy to come to my talk.

1428
01:17:02,501 --> 01:17:04,999
ALEX ROTHMAN: Dissed.

1429
01:17:06,959 --> 01:17:11,999
One of them is teaching scratch at roots.

1430
01:17:11,999 --> 01:17:14,792
So wait.

1431
01:17:15,250 --> 01:17:16,876
He's working.

1432
01:17:17,209 --> 01:17:20,999
Right now my daughter and new best friend are using

1433
01:17:20,999 --> 01:17:26,959
a scavenger hunt I don't know how that happened and my son is teaching.

1434
01:17:30,834 --> 01:17:33,834
That is so awesome.

1435
01:17:33,834 --> 01:17:34,834
.

1436
01:17:34,834 --> 01:17:36,501
Jamie, I think you misunderstand.

1437
01:17:36,792 --> 01:17:39,751
Jamie, I think you understand the word fail then.

1438
01:17:41,999 --> 01:17:43,999
Chopped liver, hi.

1439
01:17:51,375 --> 01:18:02,083
That man is going to pass fire school.

1440
01:18:02,709 --> 01:18:05,999
ALEX ROTHMAN: Settle down I have to do more sound events.

1441
01:18:12,999 --> 01:18:16,999
Analytics is like magic, you should be thinking this.

1442
01:18:16,999 --> 01:18:19,876
Analytics, it's magic.

1443
01:18:19,999 --> 01:18:22,417
I thought you were giving me a hand job there.

1444
01:18:22,417 --> 01:18:24,918
ALEX ROTHMAN: This is a linguistic program.

1445
01:18:24,918 --> 01:18:27,709
I'm going to continue everybody, a room full of people.

1446
01:18:27,709 --> 01:18:29,999
We overflowed the first donation bucket so we're

1447
01:18:29,999 --> 01:18:32,083
starting a new one.

1448
01:18:36,125 --> 01:18:38,083
ALEX ROTHMAN: Excellent.

1449
01:18:38,083 --> 01:18:39,083
Yay!

1450
01:18:39,083 --> 01:18:40,083
All right.

1451
01:18:40,083 --> 01:18:41,626
Jamie, the next one is for you.

1452
01:18:41,626 --> 01:18:44,417
Next sound effect is for you because cyber.

1453
01:18:47,709 --> 01:18:55,167
Every time you hear cyber, I want you to think cyber.

1454
01:18:55,999 --> 01:18:58,375
Wendy, I don't know if you know this or not

1455
01:18:58,375 --> 01:19:01,584
but that sounds like a masturbation sound.

1456
01:19:01,834 --> 01:19:04,250
ALEX ROTHMAN: Maybe for you it does.

1457
01:19:04,250 --> 01:19:05,375
It does, actually.

1458
01:19:09,292 --> 01:19:13,999
ALEX ROTHMAN: Cyber, cyber, cyber, say it

1459
01:19:13,999 --> 01:19:18,501
with me (quack quack) chant chant.

1460
01:19:18,999 --> 01:19:31,459
Next door is wondering what the fuck is going on.

1461
01:19:31,459 --> 01:19:37,542
What does cyber have to do with fiberoptics?

1462
01:19:37,542 --> 01:19:38,626
So cyber.

1463
01:19:38,999 --> 01:19:42,667
ALEX ROTHMAN: So next one I want you to be thinking this.

1464
01:19:42,999 --> 01:19:43,999
All right.

1465
01:19:43,999 --> 01:19:46,459
And finally, some things are just too big    That's what

1466
01:19:46,459 --> 01:19:50,667
she said    ALEX ROTHMAN: Yeah, that's what I said.

1467
01:19:54,834 --> 01:20:00,083
Some things just require a different level of side effect.

1468
01:20:09,459 --> 01:20:11,459
All the things, yeah.

1469
01:20:11,459 --> 01:20:12,459
Yeah.

1470
01:20:12,459 --> 01:20:13,584
Oh, my God, hair ball.

1471
01:20:13,584 --> 01:20:20,250
Hair ball.

1472
01:20:20,250 --> 01:20:23,250
And that's what she said.

1473
01:20:23,375 --> 01:20:24,999
ALEX ROTHMAN: Holy cow.

1474
01:20:48,042 --> 01:20:49,501
All right.

1475
01:20:49,501 --> 01:20:52,417
So pancake should go for 20 bucks now.

1476
01:20:52,417 --> 01:20:53,999
Rich for the finishing touch.

1477
01:20:54,999 --> 01:21:01,083
Did you say finishing or facial touch?

1478
01:21:01,083 --> 01:21:02,999
How come he still has his pants on.

1479
01:21:03,375 --> 01:21:06,083
We have time constraints.

1480
01:21:06,083 --> 01:21:08,501
What does gold have do do with Rich's pants.

1481
01:21:08,501 --> 01:21:09,999
ALEX ROTHMAN: All right.

1482
01:21:09,999 --> 01:21:16,542
So the very last sound effect I want to share with you, hey, hey, pipe down.

1483
01:21:16,999 --> 01:21:17,999
I'm talking.

1484
01:21:17,999 --> 01:21:20,167
Who's late coming?

1485
01:21:20,167 --> 01:21:21,999
ALEX ROTHMAN: Last sound effect.

1486
01:21:21,999 --> 01:21:23,334
It's got to be a big one.

1487
01:21:23,834 --> 01:21:25,167
I love sound effects.

1488
01:21:25,709 --> 01:21:36,375
¯ oh, my gosh!

1489
01:21:36,375 --> 01:21:39,792
So that's what I wanted to think of when somebody says ATP, yes, oh,

1490
01:21:39,792 --> 01:21:44,959
my God, because that's back to the whole macho sexual thing, too.

1491
01:21:44,959 --> 01:21:45,959
It's so flipy!

1492
01:21:45,959 --> 01:21:47,626
ALEX ROTHMAN: It is.

1493
01:21:49,999 --> 01:21:52,751
So remember what did I tell you today?

1494
01:21:52,751 --> 01:21:53,751
What did I tell you?

1495
01:22:11,501 --> 01:22:14,626
So I'll just leave that right here with you.

1496
01:22:14,626 --> 01:22:19,459
Remember, cyber, cyber, cyber.

1497
01:22:46,667 --> 01:22:48,250
Thank you.

1498
01:22:55,999 --> 01:23:01,999
(Applause.) All right, this took me about 20 minutes to put together.

1499
01:23:02,542 --> 01:23:04,501
I already did it.

1500
01:23:04,999 --> 01:23:09,626
We have something better, but wait until the end.

1501
01:23:10,083 --> 01:23:14,250
I say that a lot and they're always disappointed.

1502
01:23:14,792 --> 01:23:15,999
But yeah.

1503
01:23:17,125 --> 01:23:21,501
So basically, this is my top 5 fails of the last year and

1504
01:23:21,501 --> 01:23:25,999
the first one isn't last year, it was 2011 but I haven't had

1505
01:23:25,999 --> 01:23:31,999
a chance to share it 2011, I'm in Beijing, China teaching a class.

1506
01:23:34,167 --> 01:23:36,501
That's not my fucking problem.

1507
01:23:36,501 --> 01:23:37,501
I'm up here.

1508
01:23:37,501 --> 01:23:38,501
All right.

1509
01:23:40,250 --> 01:23:50,918
Can somebody I mean    Donating 60 for the dino toy cyber only cost her $60.

1510
01:23:58,999 --> 01:24:02,584
Be able to stand in the hall and you'll be able

1511
01:24:02,584 --> 01:24:05,209
to see my slides fine.

1512
01:24:06,083 --> 01:24:08,584
Don't worry, come.

1513
01:24:08,959 --> 01:24:13,751
Do you know what happens when you fail on this panel, Rich.

1514
01:24:14,999 --> 01:24:19,792
You get something big.

1515
01:24:22,083 --> 01:24:23,375
Yeah.

1516
01:24:23,459 --> 01:24:25,501
We'll do that at the end.

1517
01:24:25,999 --> 01:24:29,209
RICH MOGULL: I'm in China teaching

1518
01:24:29,209 --> 01:24:32,292
a cloud security class.

1519
01:24:32,292 --> 01:24:33,959
This is going well.

1520
01:24:33,999 --> 01:24:35,999
When you were in China, did you get approached

1521
01:24:35,999 --> 01:24:38,751
by any women to have sex with you.

1522
01:24:38,999 --> 01:24:41,083
Just your mom.

1523
01:24:41,125 --> 01:24:44,751
You're the only Cybersecurity who went

1524
01:24:44,751 --> 01:24:50,999
to China and have not been propositions by a honeypot.

1525
01:24:51,167 --> 01:24:53,709
It was a honey net.

1526
01:24:53,999 --> 01:24:59,709
That means it was both men and women.

1527
01:25:01,876 --> 01:25:02,999
I don't know what's up with the AV

1528
01:25:02,999 --> 01:25:04,918
because I'm sending out.

1529
01:25:04,918 --> 01:25:08,999
RICH MOGULL: So part of the lab for this is we do a bunch of stuff

1530
01:25:08,999 --> 01:25:11,999
with Amazon web services.

1531
01:25:11,999 --> 01:25:15,501
I'm sitting there with the students, look, this is a little difficult.

1532
01:25:15,501 --> 01:25:16,292
I said no more than 15 students and they all need

1533
01:25:16,292 --> 01:25:19,667
to speak English because I don't speak Chinese.

1534
01:25:21,999 --> 01:25:26,709
And so I had 30 students and most of them didn't speak English.

1535
01:25:27,918 --> 01:25:31,083
Little challenging, there was no translators.

1536
01:25:31,334 --> 01:25:34,709
And so it was one of those experiences.

1537
01:25:34,709 --> 01:25:36,083
This was for a large company.

1538
01:25:36,083 --> 01:25:37,083
HP.

1539
01:25:37,083 --> 01:25:38,083
And.

1540
01:25:38,375 --> 01:25:41,459
I'm sorry, you coughed, what did you say.

1541
01:25:41,459 --> 01:25:43,999
RICH MOGULL: So blow me.

1542
01:25:43,999 --> 01:25:44,999
And.

1543
01:25:44,999 --> 01:25:46,417
Put it in the crowd.

1544
01:25:46,417 --> 01:25:49,667
So we do all our labs at Amazon web services.

1545
01:25:49,876 --> 01:25:52,999
I have everything set up and all of a sudden I'm getting pissed

1546
01:25:52,999 --> 01:25:55,999
off and yelling at the network guy because none

1547
01:25:55,999 --> 01:25:59,459
of the students can connect to virtual servers, whole thing

1548
01:25:59,459 --> 01:26:03,167
is falling apart, we're not able to do any of the labs and what

1549
01:26:03,167 --> 01:26:05,876
the fuck is going on here?

1550
01:26:06,083 --> 01:26:08,709
I take a step back and think for a moment.

1551
01:26:08,751 --> 01:26:11,751
I had 25 students.

1552
01:26:11,751 --> 01:26:15,834
We launched 50 instances in Amazon, making 50SHH connections

1553
01:26:15,834 --> 01:26:19,667
simultaneously from one IP address.

1554
01:26:22,083 --> 01:26:25,999
I'm thinking the dude over there at Amazon is thinking this.

1555
01:26:30,375 --> 01:26:31,999
Maybe this.

1556
01:26:33,209 --> 01:26:35,459
More likely this.

1557
01:26:38,709 --> 01:26:42,626
And if it's Dave Maynor, this.

1558
01:26:43,918 --> 01:26:46,709
Really, probably this.

1559
01:26:46,834 --> 01:26:50,667
So the end result was for about half an hour, we were blocked

1560
01:26:50,667 --> 01:26:53,999
from Amazon, student couldn't do labs and eventually

1561
01:26:53,999 --> 01:26:58,083
they released it and decided we weren't a threat.

1562
01:26:59,083 --> 01:27:01,999
So I have to go fast because Dave has cool stuff.

1563
01:27:03,209 --> 01:27:07,999
Number 4, this occurred four days ago.

1564
01:27:07,999 --> 01:27:11,083
So I'm teaching a cloud security class at Blackhat.

1565
01:27:11,209 --> 01:27:15,584
You kind of somebody knows about the Blackhat Web site is.

1566
01:27:15,584 --> 01:27:19,999
They probably can type in the URL, they heard of Blackhat.

1567
01:27:19,999 --> 01:27:21,876
It says 4.

1568
01:27:21,876 --> 01:27:24,834
RICH MOGULL: 5, 4, 3.

1569
01:27:24,999 --> 01:27:26,999
Dave, we can read by the way.

1570
01:27:26,999 --> 01:27:30,999
RICH MOGULL: It's a new thing and he's totally excited.

1571
01:27:32,834 --> 01:27:34,999
So don't burst his bubble.

1572
01:27:36,792 --> 01:27:41,709
This is a great reading level.

1573
01:27:41,709 --> 01:27:45,125
Yes, it is.

1574
01:27:45,125 --> 01:27:47,584
I've got a bunch of students in my class and I feel bad

1575
01:27:47,584 --> 01:27:49,999
about this one because the person involved

1576
01:27:49,999 --> 01:27:52,999
is actually really, really nice and I'd feel worse

1577
01:27:52,999 --> 01:27:56,083
if she was in this room but she's not.

1578
01:27:56,083 --> 01:27:58,834
So this person early on we identified that

1579
01:27:58,834 --> 01:28:01,999
she teaches security at a college.

1580
01:28:01,999 --> 01:28:05,083
So I don't think a university, community college or something.

1581
01:28:05,083 --> 01:28:06,999
You're not telling that story, man.

1582
01:28:06,999 --> 01:28:10,167
RICH MOGULL: Jamie was here, he'd help me coteach the class.

1583
01:28:10,167 --> 01:28:13,709
So she teaches at a college and supervise this person.

1584
01:28:13,709 --> 01:28:16,999
She said look, she sat me down and it was quiet.

1585
01:28:17,250 --> 01:28:21,876
She's like okay, so I hate to admit this, I do mostly policy

1586
01:28:21,876 --> 01:28:24,334
and management stuff.

1587
01:28:24,834 --> 01:28:27,959
But I don't know what you mean by key.

1588
01:28:28,167 --> 01:28:29,876
I thought for a second.

1589
01:28:29,999 --> 01:28:31,083
And I thought.

1590
01:28:31,292 --> 01:28:36,501
And I thought, and I thought and I'm like you mean an SSH key,

1591
01:28:36,501 --> 01:28:38,751
she goes yeah.

1592
01:28:39,125 --> 01:28:44,667
So she's teaching security classes at the college level and doesn't know

1593
01:28:44,667 --> 01:28:46,918
what SSH key is.

1594
01:28:47,209 --> 01:28:49,709
Favorite fail number 4.

1595
01:28:49,709 --> 01:28:53,876
You would laugh if you weren't so fucking disturbed

1596
01:28:53,876 --> 01:28:56,083
at the concept.

1597
01:28:56,083 --> 01:29:00,999
standing there going I have no response to that question.

1598
01:29:01,501 --> 01:29:04,292
RICH MOGULL: This is better than

1599
01:29:04,292 --> 01:29:09,918
a class where I was trying to help her find her SSH key.

1600
01:29:12,250 --> 01:29:16,375
Pull up file explore and she goes I don't know what this is.

1601
01:29:19,083 --> 01:29:22,626
Here it is, I need you to search on star.pim.

1602
01:29:22,667 --> 01:29:25,083
You know what she typed in next?

1603
01:29:25,083 --> 01:29:25,751
S t a r.

1604
01:29:25,751 --> 01:29:30,375
Guess who she worked for?

1605
01:29:30,626 --> 01:29:33,167
That would be the federal government.

1606
01:29:34,999 --> 01:29:37,999
Using your federal government laptop.

1607
01:29:40,083 --> 01:29:44,792
Number 3 this also occurred at our class and Jamie is going

1608
01:29:44,792 --> 01:29:47,751
to fucking love this one.

1609
01:29:47,999 --> 01:29:49,792
Look at the preview of what's next.

1610
01:29:50,999 --> 01:29:53,999
JAMES ARLEN: Laughing.

1611
01:29:53,999 --> 01:29:57,999
We can't show you until you donate more money.

1612
01:30:01,626 --> 01:30:04,626
RICH MOGULL: Donate more money.

1613
01:30:04,999 --> 01:30:08,999
You have one guy, there's always a dude, always a guy,

1614
01:30:08,999 --> 01:30:13,834
mostly and they always know a lot and they're really wanting

1615
01:30:13,834 --> 01:30:17,834
to impress you with their background.

1616
01:30:17,834 --> 01:30:19,918
So this individual    Rich, rich, did I tell you about that type I broke

1617
01:30:19,918 --> 01:30:21,375
into an Apple?

1618
01:30:21,375 --> 01:30:24,792
RICH MOGULL: You did three years ago here and now there's a black hat

1619
01:30:24,792 --> 01:30:28,834
on the failed exploit on a panel that nobody noticed.

1620
01:30:28,834 --> 01:30:30,125
It was a zero day at the time.

1621
01:30:30,584 --> 01:30:35,999
So this guy    Rich, technical term for that person is asshole.

1622
01:30:35,999 --> 01:30:41,042
RICH MOGULL: I spent 8 years as a undergrad, so I don't know

1623
01:30:41,042 --> 01:30:43,459
all the terms.

1624
01:30:43,459 --> 01:30:46,459
In Cherokee that means enlightened one.

1625
01:30:47,584 --> 01:30:51,626
Just as asshole enlightened your penis.

1626
01:30:54,667 --> 01:30:56,876
It's the fail panel.

1627
01:30:56,876 --> 01:30:58,209
It ain't going to get better.

1628
01:30:58,209 --> 01:31:02,918
So this individual mentioned how he just finished his where's

1629
01:31:02,918 --> 01:31:05,375
the squeaky thing.

1630
01:31:06,209 --> 01:31:08,999
Stat stat stat.

1631
01:31:09,876 --> 01:31:13,584
His Cybersecurity graduate degree.

1632
01:31:15,083 --> 01:31:20,083
He informed us that in the first talk and said

1633
01:31:20,083 --> 01:31:25,876
in ominous tones "Have you ever heard of heap spray?"

1634
01:31:25,876 --> 01:31:27,834
well yes.

1635
01:31:28,501 --> 01:31:30,999
I've heard that term before.

1636
01:31:30,999 --> 01:31:34,542
He says well you know, we're the guys who heap spray'd

1637
01:31:34,542 --> 01:31:36,999
the college from Amazon.

1638
01:31:39,375 --> 01:31:40,999
What!

1639
01:31:40,999 --> 01:31:45,083
RICH MOGULL: I thought about that

1640
01:31:45,083 --> 01:31:53,999
for a moment and another moment and the first words that were going

1641
01:31:53,999 --> 01:32:01,083
through my head I really didn't have the heart.

1642
01:32:01,083 --> 01:32:02,626
My name is Montego Montoya.

1643
01:32:03,125 --> 01:32:05,167
You killed my father.

1644
01:32:05,167 --> 01:32:07,709
Prepare to heap spray the college from Amazon.

1645
01:32:11,083 --> 01:32:14,459
RICH MOGULL: It is very rare I don't know how

1646
01:32:14,459 --> 01:32:17,999
to respond to something along lines.

1647
01:32:17,999 --> 01:32:20,999
So I decided to look for heap spray defenses online.

1648
01:32:21,083 --> 01:32:26,792
And I was pretty much not able to come up with anything.

1649
01:32:27,501 --> 01:32:30,292
He got frustrated later because he couldn't realize that,

1650
01:32:30,292 --> 01:32:33,167
when you enter something into the user interface if it has

1651
01:32:33,167 --> 01:32:36,667
a space in there and you get an error and it says no spaces allowed,

1652
01:32:36,667 --> 01:32:38,999
you just take the space out.

1653
01:32:38,999 --> 01:32:43,459
So it was a really good class.

1654
01:32:43,459 --> 01:32:46,709
But Rich, what do spaces have to do with fiberoptics?

1655
01:32:46,709 --> 01:32:52,999
RICH MOGULL: Number 2.

1656
01:32:53,334 --> 01:32:56,209
Like Wendy, I work as an analyst.

1657
01:32:56,209 --> 01:32:58,167
I'm willing to admit the name of my company

1658
01:32:58,167 --> 01:33:01,459
because I actually own the company.

1659
01:33:07,417 --> 01:33:10,999
And all these presentations    I said Rob is going to be pissed.

1660
01:33:10,999 --> 01:33:12,626
Hey, look.

1661
01:33:18,999 --> 01:33:23,083
When I was a little girl.

1662
01:33:24,167 --> 01:33:28,417
We all know ATP is a big deal.

1663
01:33:28,959 --> 01:33:33,959
Rich, I'm no expert here, but that looks racist.

1664
01:33:33,999 --> 01:33:38,959
RICH MOGULL: Yeah, that's because Bing is racist.

1665
01:33:39,209 --> 01:33:44,999
You see how you spelled high h i g h.

1666
01:33:44,999 --> 01:33:51,751
I can't believe it's not butter.

1667
01:33:51,751 --> 01:33:57,250
Pour some on me, baby.

1668
01:33:57,250 --> 01:33:58,626
Premature there, hey?

1669
01:34:02,209 --> 01:34:05,999
RICH MOGULL: Too soon?

1670
01:34:08,834 --> 01:34:09,999
Finally.

1671
01:34:11,083 --> 01:34:17,292
Holy years ago I remember I talked about a web application firewall vendor

1672
01:34:17,292 --> 01:34:20,999
and they talked about the ATP marketing guy

1673
01:34:20,999 --> 01:34:24,751
at a reception we were at at RSA.

1674
01:34:24,751 --> 01:34:27,999
And I said well you know you don't that's not how these guys do

1675
01:34:27,999 --> 01:34:29,999
those things.

1676
01:34:29,999 --> 01:34:32,375
I said I know we did a survey and ATP.

1677
01:34:34,083 --> 01:34:37,375
This is the last victim.

1678
01:34:38,999 --> 01:34:41,334
No less than $20.

1679
01:34:47,083 --> 01:34:48,751
This is free, $20.

1680
01:34:48,751 --> 01:35:02,999
RICH MOGULL: Hey guys, MMaynor guys, Maynor has good stuff.

1681
01:35:02,999 --> 01:35:04,167
I got to get through this.

1682
01:35:10,167 --> 01:35:14,459
This is e mail of the year, I got it about a week ago.

1683
01:35:14,459 --> 01:35:16,626
I'm going to let you read this for a moment.

1684
01:35:16,959 --> 01:35:21,459
I'm contacting you on behalf of VISACA who would like to speak

1685
01:35:21,459 --> 01:35:24,626
to you about how IT can form Cybersecurity

1686
01:35:24,626 --> 01:35:26,626
with cobit 5.

1687
01:35:28,083 --> 01:35:30,667
I got one of these too Rob Graham.

1688
01:35:30,667 --> 01:35:31,999
Rich Mogull this is critical for IT teams in the name

1689
01:35:31,999 --> 01:35:34,999
of escalating advanced persistent threats.

1690
01:35:34,999 --> 01:35:37,834
So apparently we can use a control fast track known

1691
01:35:37,834 --> 01:35:40,999
as code bit to stop ATP attacks.

1692
01:35:40,999 --> 01:35:41,999
ALEX ROTHMAN: Yes!

1693
01:35:41,999 --> 01:35:42,999
Oh, my God!

1694
01:35:42,999 --> 01:35:48,542
Rich Mogull now, my absolute favorite fail occurred

1695
01:35:48,542 --> 01:35:54,709
literally 30 minutes before this talk.

1696
01:35:55,083 --> 01:36:00,751
So I walk out to get coffee, I go into the normal area of the hotel

1697
01:36:00,751 --> 01:36:04,999
and I'm come back with my cup of coffee.

1698
01:36:04,999 --> 01:36:06,834
That's the area that's normal.

1699
01:36:06,834 --> 01:36:08,375
Not the area with normal people.

1700
01:36:08,876 --> 01:36:11,667
RICH MOGULL: Normal people, not us.

1701
01:36:12,250 --> 01:36:15,459
Otherwise as we refer to them, targets.

1702
01:36:15,459 --> 01:36:16,459
(Laughter).

1703
01:36:18,167 --> 01:36:21,999
RICH MOGULL: Somebody comes up to me, he's super nice,

1704
01:36:21,999 --> 01:36:24,792
he did not look like this.

1705
01:36:24,792 --> 01:36:28,999
This is my normal impression of normals at Vegas and he comes

1706
01:36:28,999 --> 01:36:34,083
up to me and it's great and he's nice and he goes "Excuse me, sir?"

1707
01:36:34,083 --> 01:36:37,626
I've got all the goon stuff on.

1708
01:36:37,626 --> 01:36:39,250
Admittedly the badge doesn't mean anything

1709
01:36:39,250 --> 01:36:42,209
but the dumb ass tactical vest does.

1710
01:36:43,584 --> 01:36:47,584
He goes what's going on over at the Convention Center.

1711
01:36:47,709 --> 01:36:49,999
It's DEF CON, the world's biggest hacker conference

1712
01:36:49,999 --> 01:36:52,209
and his face goes like this.

1713
01:36:56,375 --> 01:36:58,751
And I'm not used to that reaction.

1714
01:36:58,876 --> 01:37:00,501
That's cool.

1715
01:37:00,501 --> 01:37:01,626
That's interesting.

1716
01:37:01,626 --> 01:37:02,626
Blah, blah, blah.

1717
01:37:02,626 --> 01:37:03,626
They ask questions.

1718
01:37:03,626 --> 01:37:04,999
I'm like is something okay?

1719
01:37:04,999 --> 01:37:06,999
And he goes wonderful.

1720
01:37:06,999 --> 01:37:07,999
And I'm like why?

1721
01:37:08,209 --> 01:37:11,083
And he goes "I work for the NSA."

1722
01:37:21,417 --> 01:37:34,999
No bullshit, 30 minutes before this talk.

1723
01:37:41,751 --> 01:37:46,209
DAVE MAYNOR: You came to the fail panel.

1724
01:37:46,584 --> 01:37:49,918
RICH MOGULL: Jack Daniel and I were talking whoever gives us

1725
01:37:49,918 --> 01:37:53,792
$100 gets to roll around in the money right now.

1726
01:37:55,292 --> 01:37:56,834
Come on.

1727
01:37:56,999 --> 01:37:57,999
Hands up.

1728
01:37:57,999 --> 01:38:02,083
And for $200 you can roll around in the cash with Rich.

1729
01:38:06,334 --> 01:38:12,459
All right, I need to go to the ATM but I'm doing it myself.

1730
01:38:12,459 --> 01:38:13,459
Hold on.

1731
01:38:14,334 --> 01:38:18,125
Tell me which ATM you're going to in case it's mine.

1732
01:38:18,292 --> 01:38:23,626
So I have here a collection of spoons.

1733
01:38:23,876 --> 01:38:28,918
Apparently to make can pancakes at fail panel you need a lot of spoons.

1734
01:38:28,999 --> 01:38:32,751
I have had them signed by the members of the fail panel.

1735
01:38:33,375 --> 01:38:34,792
You can.

1736
01:38:34,792 --> 01:38:35,959
There are no spoon.

1737
01:38:35,999 --> 01:38:40,375
You cannot unsee this shit.

1738
01:38:40,459 --> 01:38:48,959
Barnaby would be so proud.

1739
01:38:52,501 --> 01:39:02,209
You know, my partner over there is Securosis, Rich Mogull,

1740
01:39:02,209 --> 01:39:09,334
he's he's rolling around in the dough.

1741
01:39:09,334 --> 01:39:10,959
Wow, that escalated quickly.

1742
01:39:10,999 --> 01:39:14,083
That's a lot of money there.

1743
01:39:14,209 --> 01:39:19,999
So I got these three spoons and I got I don't know of us are there?

1744
01:39:19,999 --> 01:39:20,999
A lot.

1745
01:39:20,999 --> 01:39:21,999
All of us.

1746
01:39:22,375 --> 01:39:26,125
You can buy a spoon, you can buy a spoon that comes

1747
01:39:26,125 --> 01:39:29,999
with certain associated thank you.

1748
01:39:29,999 --> 01:39:31,083
A lot of water.

1749
01:39:31,250 --> 01:39:34,959
With not just the authentication token but also

1750
01:39:34,959 --> 01:39:38,292
the authorization, the larger the dollar value

1751
01:39:38,292 --> 01:39:43,375
the more authorization is placed upon the spoon such as the ability

1752
01:39:43,375 --> 01:39:47,584
to have Chris Hoff lick the spoon for you.

1753
01:39:50,334 --> 01:39:54,834
Or the ability to spank people with spoons.

1754
01:39:54,999 --> 01:39:59,999
You figure out what your off is.

1755
01:40:03,292 --> 01:40:05,542
Come up with the money and apparently we have

1756
01:40:05,542 --> 01:40:07,999
to let Dave Maynor talk again.

1757
01:40:08,250 --> 01:40:11,792
Before Dave starts, I want to thank you everyone for coming

1758
01:40:11,792 --> 01:40:15,083
and more importantly I want to thank the number of people such

1759
01:40:15,083 --> 01:40:17,999
as Liz and Martin and Jason and Jack who helped make

1760
01:40:17,999 --> 01:40:19,918
this possible.

1761
01:40:19,918 --> 01:40:22,667
We couldn't get these pancakes out to you without them.

1762
01:40:22,667 --> 01:40:32,167
Let's give a round of applause for helpers and also everyone who

1763
01:40:32,167 --> 01:40:44,000
donated beer for you guys to buy, thank you, everyone, thank you.

1764
01:40:44,000 --> 01:40:45,918
Please clean up after yourselves.

1765
01:40:45,918 --> 01:40:46,542
ALEX ROTHMAN: Jack just pointed out to me that when Rich was rolling

1766
01:40:46,542 --> 01:40:49,792
around in the money he was reliving his days at Gartner.

1767
01:40:51,876 --> 01:40:55,876
Gartner jokes is always funny.hell.

1768
01:40:55,876 --> 01:40:59,834
DAVE MAYNOR: Hello, everybody, my name is Dave Maynor.

1769
01:40:59,834 --> 01:41:04,334
Most of you know me as shit head.

1770
01:41:05,083 --> 01:41:09,083
I'd like to start out by asking everybody what do I have

1771
01:41:09,083 --> 01:41:11,792
to do with fiberoptics?

1772
01:41:14,334 --> 01:41:17,584
The answer is absolutely nothing.

1773
01:41:17,959 --> 01:41:20,584
How many people are here last year for the fail panel.

1774
01:41:20,999 --> 01:41:23,083
I can't believe you came back.

1775
01:41:23,083 --> 01:41:24,209
You foolish people.

1776
01:41:24,626 --> 01:41:30,542
Last year I did this thing with the iBot enhancing.

1777
01:41:32,667 --> 01:41:37,250
So I had become known to some people as the fail whisperer.

1778
01:41:37,709 --> 01:41:41,167
I'm very good at inducing fail in things.

1779
01:41:41,167 --> 01:41:44,292
In fact, here's a picture of me that has failed.

1780
01:41:44,292 --> 01:41:45,292
Look at that.

1781
01:41:45,292 --> 01:41:46,542
I have two chins.

1782
01:41:47,083 --> 01:41:50,417
Fail, I'm also wearing a tie, fail.

1783
01:41:51,083 --> 01:41:56,542
So I work at fail like most artists work in oils.

1784
01:41:56,876 --> 01:42:00,876
I get to pen test things so I fail a lot.

1785
01:42:01,375 --> 01:42:04,209
One example is that many years ago Jacob

1786
01:42:04,209 --> 01:42:07,584
Applebaum who is a complete media whore wanted

1787
01:42:07,584 --> 01:42:09,584
to distribute.

1788
01:42:12,459 --> 01:42:16,334
He's stopped being a media whore and now become a media darling.

1789
01:42:19,083 --> 01:42:22,999
He wanted to prove something in CC and redacted information.

1790
01:42:25,334 --> 01:42:27,250
I thought this was stupid.

1791
01:42:27,375 --> 01:42:31,334
So I wrote a blog post about it and it says document redacted.

1792
01:42:31,584 --> 01:42:34,626
So the funny thing about this is that while you can redact large

1793
01:42:34,626 --> 01:42:38,667
portions of the document, you can redact the font size.

1794
01:42:38,834 --> 01:42:42,292
So you can figure out how many letters are

1795
01:42:42,292 --> 01:42:46,459
in each word of small redacted blogs.

1796
01:42:46,751 --> 01:42:49,459
It was pretty easy to find out.

1797
01:42:49,459 --> 01:42:51,999
So we were able to before his big CC presentation

1798
01:42:51,999 --> 01:42:54,459
decipher his message.

1799
01:42:54,959 --> 01:42:56,918
And what did the message say?

1800
01:42:59,083 --> 01:43:00,626
I found a new way to apply hair product

1801
01:43:00,626 --> 01:43:03,292
to make it look like I just rolled out of bed.

1802
01:43:05,999 --> 01:43:07,417
No seriously.

1803
01:43:08,542 --> 01:43:12,250
He was talking about something with MD5.

1804
01:43:12,876 --> 01:43:16,999
Funny thing he posted something he thought was secure and everybody

1805
01:43:16,999 --> 01:43:19,209
read it ahead of time.

1806
01:43:19,250 --> 01:43:21,292
I'm going through this because I'm going to go

1807
01:43:21,292 --> 01:43:24,375
through my credentials about why I have fails.

1808
01:43:24,959 --> 01:43:27,667
But this year I have no fail to offer I only have success

1809
01:43:27,667 --> 01:43:31,083
and unfortunately, my success was horrible.

1810
01:43:31,459 --> 01:43:34,292
So that was a fail.

1811
01:43:34,876 --> 01:43:39,999
So one quick story of a recent pen test we had gone right,

1812
01:43:39,999 --> 01:43:46,918
I can't really tell you the client but it's a really funny thing when we

1813
01:43:46,918 --> 01:43:52,792
came in, they were gung ho, they were ready for us.

1814
01:43:52,792 --> 01:43:56,584
They they let us know ahead of time how we weren't doing anything,

1815
01:43:56,584 --> 01:44:00,751
we weren't getting in or breaking anything.

1816
01:44:01,083 --> 01:44:03,083
So the window comes around, 5 7 minutes

1817
01:44:03,083 --> 01:44:05,999
into the window we had broken into everything,

1818
01:44:05,999 --> 01:44:08,999
we had domain admin remotely.

1819
01:44:08,999 --> 01:44:10,999
So I didn't know what else to do.

1820
01:44:10,999 --> 01:44:14,999
Normally at this point you start writing a report but, if you know me, I don't

1821
01:44:14,999 --> 01:44:18,125
like to write because I can't read which means I'll do

1822
01:44:18,125 --> 01:44:21,999
anything to avoid writing a report, which brings us to calling

1823
01:44:21,999 --> 01:44:25,999
a registrar and I can't mention the registrar's name but we called

1824
01:44:25,999 --> 01:44:29,417
the registrar and I in my greatest southern hick voice went

1825
01:44:29,417 --> 01:44:33,083
oh, my God my boss is in tex and our site just crashed, I have

1826
01:44:33,083 --> 01:44:37,292
to change the DNS over and I don't have the password.

1827
01:44:37,292 --> 01:44:38,542
Can you help me out.

1828
01:44:39,626 --> 01:44:41,999
The person who sounded like they were

1829
01:44:41,999 --> 01:44:45,292
in Kansas or Washington or somewhere said well gosh,

1830
01:44:45,292 --> 01:44:48,459
you need the password to do that.

1831
01:44:48,459 --> 01:44:50,292
I said well I don't have the password.

1832
01:44:50,292 --> 01:44:52,209
My boss is in turkey Caracas.

1833
01:44:52,209 --> 01:44:55,375
I was trying to channel a Baptist preacher.

1834
01:44:55,501 --> 01:44:59,709
Nobody wants to mess with a man of God.

1835
01:45:00,083 --> 01:45:04,459
Is there anything you can prove you work for this company?

1836
01:45:04,626 --> 01:45:06,083
What do you want, son?

1837
01:45:06,083 --> 01:45:08,083
What can I get for you.

1838
01:45:08,083 --> 01:45:11,334
A little exaggeration, he said can you send me an e mail

1839
01:45:11,334 --> 01:45:15,876
from your work account or can you put a page on the Web site

1840
01:45:15,876 --> 01:45:19,751
to prove that you have control over it.

1841
01:45:19,751 --> 01:45:21,334
Well, yes, son, I can.

1842
01:45:21,334 --> 01:45:22,459
Let me go right ahead.

1843
01:45:22,999 --> 01:45:29,751
And sense I had domain admin it was easy, you right click in the ISS directly.

1844
01:45:34,999 --> 01:45:37,375
I feel a disturbance in the force.

1845
01:45:37,375 --> 01:45:40,501
It's a small disturbance, more of a ripple actually.

1846
01:45:41,083 --> 01:45:43,999
So I right click in the ISS directory.

1847
01:45:43,999 --> 01:45:47,584
I create a file called Go Daddy wait, I can't say the name.

1848
01:45:47,584 --> 01:45:52,751
I right click on the directory.

1849
01:45:52,751 --> 01:45:53,751
Create a file.

1850
01:45:53,751 --> 01:45:54,751
And I say redacted.

1851
01:45:55,834 --> 01:45:59,167
Does this prove that I work for the company?

1852
01:45:59,167 --> 01:46:00,167
I give him the URL.

1853
01:46:00,167 --> 01:46:04,876
He goes and looks at it and said yeah, sure and gives me the password.

1854
01:46:05,999 --> 01:46:10,334
To which I spent the rest of the night figuring out how

1855
01:46:10,334 --> 01:46:14,501
to do split routing with e mail so I can get a copy

1856
01:46:14,501 --> 01:46:18,083
of all e mail coming in via DNS.

1857
01:46:18,083 --> 01:46:21,083
I called him the next morning at 8:00 a.m.

1858
01:46:21,083 --> 01:46:23,125
and asked system admin why he hasn't gotten any e mail

1859
01:46:23,125 --> 01:46:24,999
since midnight.

1860
01:46:25,083 --> 01:46:27,459
Game over, man.

1861
01:46:27,626 --> 01:46:29,250
Game over.

1862
01:46:29,375 --> 01:46:31,083
They shocked.

1863
01:46:31,167 --> 01:46:32,501
They were appalled.

1864
01:46:34,999 --> 01:46:37,751
Some would say they were shocked and appalled.

1865
01:46:37,999 --> 01:46:40,459
Were they awe'd?

1866
01:46:40,459 --> 01:46:44,417
No, they were normal.

1867
01:46:44,417 --> 01:46:48,999
Which brings me quickly to why I have no this is all funny,

1868
01:46:48,999 --> 01:46:51,999
but I have wait, what?

1869
01:46:51,999 --> 01:46:52,999
Time.

1870
01:46:52,999 --> 01:46:55,209
I have no actual fail this year to talk about.

1871
01:46:55,209 --> 01:46:59,999
Last year I did a trick and it was a very funny magic trick.

1872
01:46:59,999 --> 01:47:00,999
I did two tricks.

1873
01:47:01,167 --> 01:47:03,584
Well, one guy was named rich, he didn't pay well,

1874
01:47:03,584 --> 01:47:06,459
but then again I didn't have to do much.

1875
01:47:08,584 --> 01:47:10,292
It was over quick.

1876
01:47:10,334 --> 01:47:13,918
So I did this trick with an iPod where I could be

1877
01:47:13,918 --> 01:47:17,999
within 100 meters of every jukebox that us ooh uses

1878
01:47:17,999 --> 01:47:22,959
an app and I can make all the boxes play oompah.

1879
01:47:25,667 --> 01:47:29,167
Any time somebody would check Foursquare I'd find a jukebox

1880
01:47:29,167 --> 01:47:31,125
and play oompah.

1881
01:47:31,125 --> 01:47:32,626
I thought it was hilarious.

1882
01:47:32,626 --> 01:47:35,334
So Chris Hoff tweeted where he was going

1883
01:47:35,334 --> 01:47:42,375
to a bar and minutes later Dave hacked his location on a computer

1884
01:47:42,375 --> 01:47:47,375
and played oompah on a local jukebox.

1885
01:47:47,375 --> 01:47:48,375
So that's.

1886
01:47:48,375 --> 01:47:49,999
DAVE MAYNOR: That was funny.

1887
01:47:49,999 --> 01:47:53,083
If you look at video and audio from last year,

1888
01:47:53,083 --> 01:47:56,667
the last thing I say before I walk off stage

1889
01:47:56,667 --> 01:48:02,999
is "executives use jukebox plays to determine how popular a group is.

1890
01:48:02,999 --> 01:48:09,083
It's my calling in life to get Hanson to release a new album."

1891
01:48:09,083 --> 01:48:10,459
See, I thought I was joking.

1892
01:48:11,792 --> 01:48:14,125
I didn't believe in the power of the I just wanted

1893
01:48:14,125 --> 01:48:16,626
to put this picture up again.

1894
01:48:16,626 --> 01:48:18,125
There was a chick sitting on my lab when I figured this

1895
01:48:18,125 --> 01:48:20,125
out and she had a gun.

1896
01:48:20,125 --> 01:48:24,417
I was like it deserves to be at the presentation two years in a row.

1897
01:48:24,417 --> 01:48:27,083
But I can't believe in the power of the fail panel.

1898
01:48:27,083 --> 01:48:29,667
So I want to let you all know, I am witnessing to you

1899
01:48:29,667 --> 01:48:32,584
the fail panel power is real.

1900
01:48:32,751 --> 01:48:34,751
It is real.

1901
01:48:34,751 --> 01:48:36,375
It is so real.

1902
01:48:36,375 --> 01:48:40,999
Hanson released a new album, look at the date.

1903
01:48:40,999 --> 01:48:43,125
Worship the fail panel.

1904
01:48:43,125 --> 01:48:46,459
We change the world here every summer.

1905
01:49:02,250 --> 01:49:03,999
I want you to know because we don't do it

1906
01:49:03,999 --> 01:49:07,417
because we're egotistical sons of bitches like Rob Graham.

1907
01:49:07,667 --> 01:49:14,876
We do it because we're trying to help everyone have a better life.

1908
01:49:14,876 --> 01:49:19,375
And I believe and I believe Hanson will have nothing to do with that.

1909
01:49:19,751 --> 01:49:21,792
Thank you.

1910
01:49:21,999 --> 01:49:27,125
(cheers and applause)    Thank you.

1911
01:49:27,459 --> 01:49:32,542
But Dave, what does Hanson have to do with fiberoptics?

1912
01:49:32,542 --> 01:49:33,542
Get the butter.

1913
01:49:33,542 --> 01:49:36,501
Oh, my God.

1914
01:49:36,999 --> 01:49:43,792
That's how rock stars do it.

1915
01:49:44,083 --> 01:49:49,751
It burns., oh, it's just him.

1916
01:49:49,999 --> 01:49:53,459
Do not want.

1917
01:49:53,792 --> 01:49:56,542
You know what?

1918
01:49:56,834 --> 01:50:01,667
I have never, never seen a crowd throw a Bono shirt back.

1919
01:50:01,667 --> 01:50:05,167
I'm going to tell you right there we have very polite fans.

1920
01:50:05,167 --> 01:50:06,417
Thank you, everyone.

1921
01:50:06,417 --> 01:50:07,834
Enjoy the rest of the show.

1922
01:50:07,834 --> 01:50:10,667
All right, who wants to lick the butter off my nibbles.

1923
01:50:10,667 --> 01:50:12,876
I promise I won't get no hair in your teeth.

1924
01:50:12,876 --> 01:50:14,083
I don't promise that at all.

1925
01:50:14,083 --> 01:50:15,709
It's only butter flavored.

1926
01:50:15,709 --> 01:50:18,709
We do have pancake leftovers such as syrup, jelly, nuts.

1927
01:50:18,709 --> 01:50:19,709
Napkins.

1928
01:50:19,709 --> 01:50:22,501
Throw money in the bucket on the way out and take some.

1929
01:50:22,501 --> 01:50:23,999
We do not want to take it home.

1930
01:50:23,999 --> 01:50:25,209
We have extra beer, too.

1931
01:50:25,209 --> 01:50:26,209
And syrup.