1 00:00:00,190 --> 00:00:05,880 PEITER MUDGE ZATKO: Just so we're clear, I'm only speaking as myself today. I am not 2 00:00:05,880 --> 00:00:11,519 a representative of the US Government. I'm not a representative of my current employer. 3 00:00:11,519 --> 00:00:15,940 I'm pretty sure neither one of them would be really happy with me up here talking. But, 4 00:00:15,940 --> 00:00:22,940 I feel it's part of my duty as part of this community to kind of give you some stories 5 00:00:23,300 --> 00:00:28,920 that are personal stories from this community as what I took into the Government, what I 6 00:00:28,920 --> 00:00:32,570 learned while I was in the Government, what I saw that was a little bizarre while I was 7 00:00:32,570 --> 00:00:37,269 in the Government. And what I'm taking back out of it. 8 00:00:37,269 --> 00:00:44,269 And there are four stories I'm going to tell you that all have some unexpected outcomes 9 00:00:44,620 --> 00:00:48,210 and unexpected twists. You probably heard about some of the stories in the media, but 10 00:00:48,210 --> 00:00:54,100 these are kind of different back origins to them that you haven't heard before. I'll do 11 00:00:54,100 --> 00:00:58,210 my best to be as accurate as possible. But I'm going from memory from some of these, 12 00:00:58,210 --> 00:01:04,920 and some of these go back several years. Memory isn't perfect, so I apologize in advance. 13 00:01:04,920 --> 00:01:11,920 So I'm not trying to piss off or be pro or con any particular community, but I want 14 00:01:15,570 --> 00:01:21,710 understandings, which I why I'm trying to tell these kind of nonobvious stories. Somebody 15 00:01:21,710 --> 00:01:25,950 had tweeted me something encouraging me to do this talk and saying anything we can do 16 00:01:25,950 --> 00:01:32,040 to help people understand each other is good, because of course prejudice is bred from ignorance 17 00:01:32,040 --> 00:01:38,240 and exclusion. So you can kind of consider this my transparency/trip report from three 18 00:01:38,240 --> 00:01:45,240 years inside the DoD. Not long after I started working at DARPA, 19 00:01:46,110 --> 00:01:51,250 I got funding approval for the first of one of many programs that I would actually run. 20 00:01:51,250 --> 00:01:53,700 I know most folks are only familiar with a few of them. 21 00:01:53,700 --> 00:01:59,700 The first program was called CINDER. And it was focused on super evolved advanced persistent 22 00:01:59,700 --> 00:02:03,810 threat. The program had nothing to do with whistle blowers. It had nothing to do with 23 00:02:03,810 --> 00:02:10,810 humans. It was targeting autonomous software. And there was an author, Forbes Magazine, 24 00:02:11,810 --> 00:02:17,370 Andy Greenburg, who found out that Julian Assange and I knew each other and have kind 25 00:02:17,370 --> 00:02:24,310 of known each for, I don't know, 20 plus years. And he wrote an article that, the way I read 26 00:02:24,310 --> 00:02:28,260 the article, attempted to pit me and Julian against each other, claiming that CINDER was 27 00:02:28,260 --> 00:02:34,230 a response to WikiLeaks. You know, a sexy story of hacker friends, you know, who now 28 00:02:34,230 --> 00:02:38,200 find themselves at odds, one trying to spill the Government secrets, one trying to protect 29 00:02:38,200 --> 00:02:42,350 the Government secrets. Yeah, it's a sexy story, the problem is it's entirely untrue. 30 00:02:42,350 --> 00:02:47,900 Because CINDER had nothing to do with that. So since he and other folks wanted to kind 31 00:02:47,900 --> 00:02:53,410 of make it a story about me and Julian where there was no story before, I figured I'd tell 32 00:02:53,410 --> 00:03:00,410 you an actual story about me and Julian. And this first story is called how the DoD 33 00:03:01,780 --> 00:03:08,780 unintentionally created WikiLeaks. So it was 2009. I had yet to go into DARPA. I was over 34 00:03:12,540 --> 00:03:18,349 in Germany for the CCC Congress, which by the way is awesome. And by the way, Berlin 35 00:03:18,349 --> 00:03:25,349 is freezing in December. So it's a couple blocks from the hotel over to the Congress. 36 00:03:26,349 --> 00:03:29,580 And I braved it across. It takes about like 10 or 15 minutes before your lips come 37 00:03:29,580 --> 00:03:32,250 back and you can actually start to form words again. 38 00:03:32,250 --> 00:03:36,620 So there was this talk that I wanted to see at the Congress. I watched it. It was great. 39 00:03:36,620 --> 00:03:40,959 There was a gap between the next talk I that wanted to see, and the whole decision was 40 00:03:40,959 --> 00:03:47,440 do I go back to the hotel and go out in the frigid Berlin winter, or do I find something 41 00:03:47,440 --> 00:03:52,510 else to pass the time. It's CCC, it's easy to find things to pass the time there. And 42 00:03:52,510 --> 00:03:58,620 there was a talk that was going on about WikiLeaks. Remember, 2009. No State Department cables, 43 00:03:58,620 --> 00:04:03,489 no nothing at this point. WikiLeaks had been around, but it wasn't in the popular vernacular. 44 00:04:03,489 --> 00:04:09,270 It wasn't a household name. So I look and I go, Oh, what it's taking to 45 00:04:09,270 --> 00:04:13,040 run WikiLeaks, how do we do it behind-the-scenes operationally. I go: That's cool. And it talks 46 00:04:13,040 --> 00:04:18,600 in English and it's inside. So yea. And I'm looking at it, Julian Assange, Julian Assange. 47 00:04:18,600 --> 00:04:22,520 The name was ringing a bell but it didn't mean anything again, because of course he 48 00:04:22,520 --> 00:04:27,540 didn't hit it. Now I saw him on stage, and you know he's 49 00:04:27,540 --> 00:04:34,190 a kind of striking physical --> you know, shocking blonde white hair, sharply dressed, and I'm 50 00:04:34,190 --> 00:04:38,100 recognizing the voice and it took almost the entire talk before it dawned on me that I 51 00:04:38,100 --> 00:04:42,280 knew him by a different name. I knew him as Prof. Some of you remember Prof, some of you 52 00:04:42,280 --> 00:04:49,280 remember strobe that he wrote like ages ago. You know, he was over at suburbia.net --> profitsuburbia.net. 53 00:04:49,690 --> 00:04:54,940 I was like holy crap! This is the same guy who I've known for years. I hadn't seen him 54 00:04:54,940 --> 00:04:59,910 in like a decade or I hadn't interacted with him online. At one point I think he was even 55 00:04:59,910 --> 00:05:06,910 managing Sun's security updates and patches for all of the distributions for Sun Us at 56 00:05:07,100 --> 00:05:14,100 sunsite.unc.edu. So we should have nominated that for possible or potential epic ownage. 57 00:05:14,530 --> 00:05:20,050 That's kind of cool if you think about that. So after the talk I was all excited. I went 58 00:05:20,050 --> 00:05:24,030 up to him, waited until the smaller crowds died. You know, he was outside having a cigarette. 59 00:05:24,030 --> 00:05:27,080 I thought this is going to be fun, because I had cut my hair. You know, I didn't have 60 00:05:27,080 --> 00:05:33,790 the (inhales sharply) if you've seen the shirts. Most people remember me looking slightly different. 61 00:05:33,790 --> 00:05:39,430 And I'm like oh, I'm going to play with this a little bit. So I walk up to him. I know 62 00:05:39,430 --> 00:05:42,710 he doesn't know my voice, and he's not going to physically recognize me. So I do that whole 63 00:05:42,710 --> 00:05:48,199 like hacker jerk sort of, you know, say something that, you know, like what the hell how did 64 00:05:48,199 --> 00:05:50,729 they know that? And kind of to set up the state of detant. 65 00:05:50,729 --> 00:05:56,520 I go hey, when was the last time somebody called you prof? He looks at me weird. And 66 00:05:56,520 --> 00:06:02,110 I'm like well, if you think that's weird, did they ever find out why the MD 5 checksums 67 00:06:02,110 --> 00:06:06,580 on the Solaris update patches didn't match the actual patches that people installed? 68 00:06:06,580 --> 00:06:12,960 It was Sunsite, right? And he is just looking at me like who the heck is this guy? Probably 69 00:06:12,960 --> 00:06:16,310 possibly because he hadn't heard the phrase "prof" for a while and it could very well 70 00:06:16,310 --> 00:06:19,919 be that he had no clue what I was talking about with the latter one. 71 00:06:19,919 --> 00:06:25,070 And I go hey, it's me, it's Mudge, Mudge from the LOpht sort of thing, and he kind of relaxed 72 00:06:25,070 --> 00:06:32,070 and we chuckled about it. And I was saying hey, you know, you were really, really passionate 73 00:06:32,850 --> 00:06:39,850 up on stage about WikiLeaks. What was the real impetus? What was the turning point that 74 00:06:40,699 --> 00:06:47,699 made you do that? Because the last I had seen you, you were leaving the hack scene. Going 75 00:06:47,729 --> 00:06:52,509 off to academia to do your advanced degree. He was working on a crytographically based 76 00:06:52,509 --> 00:06:59,509 file system, a rubber hose file system for duress-based decrypting. And I said where 77 00:06:59,770 --> 00:07:03,960 did you go? The old gang and everything, I haven't seen you. 78 00:07:03,960 --> 00:07:08,680 So we chatted and he said let's go out and have dinner. So we spent the next several 79 00:07:08,680 --> 00:07:15,680 hours over food in Berlin. And we were chatting, and I wanted to know just how passionate he 80 00:07:17,940 --> 00:07:22,780 was. And how far he was willing to go on it. So I asked him a hypothetical question. I 81 00:07:22,780 --> 00:07:29,780 said let's suppose back in the day my thing was I collected packet captures of everything. 82 00:07:31,639 --> 00:07:37,669 Let's assume some of those packet captures have you going into the other systems. You 83 00:07:37,669 --> 00:07:42,539 know, beyond a shadow of a doubt. If I submitted those packet captures, kind of incriminating 84 00:07:42,539 --> 00:07:49,539 you to WikiLeaks, would you release them? And he looked at me, it only took a couple 85 00:07:49,650 --> 00:07:55,199 seconds. He said hey, we get some very similar sorts of questions. Because people ask us, 86 00:07:55,199 --> 00:07:58,960 you know, kind of on a parallel if someone were to send us a list of the contributors 87 00:07:58,960 --> 00:08:05,430 to WikiLeaks, would we publish it? And the answer is that, you know, we don't want to 88 00:08:05,430 --> 00:08:08,490 know who our contributors are, because we want to keep the protection there, "we" being 89 00:08:08,490 --> 00:08:13,770 WikiLeaks I'm speaking of as him from memory here. So we try to get in touch with the folks 90 00:08:13,770 --> 00:08:18,639 who contributed, but we won't know who they are. So ultimately in case that list is real, 91 00:08:18,639 --> 00:08:22,520 we would have to publish it. I was like oh, that's cool. And then we moved on to the next 92 00:08:22,520 --> 00:08:26,190 topic. Now if any of you actually interacted with 93 00:08:26,190 --> 00:08:30,740 him or knows somebody who has, they will tell you that he is a very smart person and it's 94 00:08:30,740 --> 00:08:37,740 absolutely right. It took me probably an hour to realize he never answered my question. 95 00:08:38,899 --> 00:08:45,899 But he told me an interesting story. He told me, and this is what stuck with me in 2009 96 00:08:46,320 --> 00:08:51,959 from that dinner, what the turning point was. Maybe this was a story just for me, maybe 97 00:08:51,959 --> 00:08:56,260 it was kind of the appropriate thing. But I took this to be kind of ground truth and 98 00:08:56,260 --> 00:09:00,050 it stuck with me, which is why I'm telling you. And I used to tell people inside the 99 00:09:00,050 --> 00:09:05,459 Government the same question when later WikiLeaks kind of popped up. He said I had gone off, 100 00:09:05,459 --> 00:09:12,080 I was over at University doing my graduate work. Something essentially fundamental research, 101 00:09:12,080 --> 00:09:17,880 which means something to the Government folks. He said it was funded, you know, by the US 102 00:09:17,880 --> 00:09:23,180 Government. It was a grant from like NSA type DARPA sort of funding. I don't know if those 103 00:09:23,180 --> 00:09:28,380 were the actual agencies. And he said it was during that time period 104 00:09:28,380 --> 00:09:34,140 where there was a big pull back from the DoD. And the message that the Universities received 105 00:09:34,140 --> 00:09:41,140 was we're not funding you to do basic research anymore. It's all classified now. His work 106 00:09:42,240 --> 00:09:45,620 got rolled up in that. Now, whether that was actually why it was 107 00:09:45,620 --> 00:09:48,770 being pulled back or if that was just the perceived message, I don't know. So if you 108 00:09:48,770 --> 00:09:55,770 think about it. Here is a nonUS citizen, who's made a life decision, go to graduate work, 109 00:09:56,580 --> 00:10:02,899 kind of leave the community that we knew him in. And all of a sudden his funding gets pulled 110 00:10:02,899 --> 00:10:06,480 and he is told that he is not allowed to know what it was he was doing, not allowed to know 111 00:10:06,480 --> 00:10:11,839 what he discovered, and no actual reason as to why the funding went. I mean, it's kind 112 00:10:11,839 --> 00:10:17,279 of what it's like when you're a graduate student and somebody pulls your funding, sort of thing. 113 00:10:17,279 --> 00:10:22,630 And this just really, really rubbed him wrong. He said this is the wrong reason for classification, 114 00:10:22,630 --> 00:10:27,420 if that's why he lost his funding. This was designed to keep people ignorant and withhold 115 00:10:27,420 --> 00:10:34,110 information to keep folks disadvantaged. He said it was at that point he decided that 116 00:10:34,110 --> 00:10:39,700 he was going to devote his life to exposing people who tried to keep secrets. And hence 117 00:10:39,700 --> 00:10:45,149 WikiLeaks was born. So when folks in the DoD would ask me, hey, 118 00:10:45,149 --> 00:10:51,870 do you know this WikiLeaks thing and what are your thoughts on how we could like, you 119 00:10:51,870 --> 00:10:57,529 know, address it? They were surprised with my answer by saying you know by some accounts, 120 00:10:57,529 --> 00:11:02,630 the Government actually created it in the first place. 121 00:11:02,630 --> 00:11:08,600 It was at that point during the night at the -- in the restaurant, Julian goes well, so 122 00:11:08,600 --> 00:11:11,839 that's what I've been doing for the past ten years. What are you up to? I said oh, I'm 123 00:11:11,839 --> 00:11:18,839 about to go work at DARPA. (laughter) So that's my first story. 124 00:11:19,380 --> 00:11:26,380 The second story is about Anonymous and the Department of Defense. I remember Anonymous 125 00:11:33,269 --> 00:11:37,560 from way back. I mean, Anonymous, I use it as like a proper noun. But obviously we're 126 00:11:37,560 --> 00:11:41,519 all familiar and it's much more. It's kind of a movement, a thought. It's more ephemeral 127 00:11:41,519 --> 00:11:47,510 than that. And when I remember them they were going after scientology and RIA and there 128 00:11:47,510 --> 00:11:54,510 were the FORTRANs and soap opera stuff going on. And at some point, their scope or the 129 00:11:54,750 --> 00:12:01,750 target expanded to include the Government. And general wisdom was that the triggering 130 00:12:02,329 --> 00:12:09,149 event was the DoD's response to WikiLeaks and Manning, et cetera. But the way I saw 131 00:12:09,149 --> 00:12:16,149 it, there was actually something else that was a bit more subtle that folks hadn't realized. 132 00:12:17,140 --> 00:12:24,060 So in 2011, the DoD released the strategy for operating in cyberspace. There was some 133 00:12:24,060 --> 00:12:29,750 very minor backlash to some of the wording. There was originally a version leaked of it, 134 00:12:29,750 --> 00:12:34,060 and that went out and it was followed up later by a later one. But there was some more specific 135 00:12:34,060 --> 00:12:41,060 backlash and chatter in the hacker researcher community. The strategy stated that the DoD 136 00:12:42,750 --> 00:12:49,750 was going to treat cyberspace as a domain to conduct operations in. And it appeared 137 00:12:49,870 --> 00:12:55,870 kind of modeled off of outer space, you know, treating space as, you know, these are DoDish 138 00:12:55,870 --> 00:12:59,750 words, a domain. And there were some confused conversations going oh, why isn't anybody 139 00:12:59,750 --> 00:13:05,690 upset if you treat cyberspace as a domain, there wasn't that much upset with treating 140 00:13:05,690 --> 00:13:12,339 space, and nobody lives in cyberspace, which you could only hear inside the Government, 141 00:13:12,339 --> 00:13:18,070 like a statement like that. Because if you think about it, you know, we all live in cyberspace. 142 00:13:18,070 --> 00:13:21,750 And the hacker researcher community made it -- you know, made cyberspace-- I'm really 143 00:13:21,750 --> 00:13:28,750 not a fan of that word --> made the Internet and online our homes well before the Government 144 00:13:29,959 --> 00:13:33,700 and everybody else kind of made it just where they always lived and did everything in. 145 00:13:33,700 --> 00:13:40,700 So if you send a message that that's somebody's backyard and that you're going to militarize 146 00:13:40,829 --> 00:13:47,829 and prep for war in somebody's backyard, that can sound really scary. And it can galvanize 147 00:13:50,060 --> 00:13:57,060 folks to respond. One of the problems was there was not an understanding 148 00:13:57,440 --> 00:14:04,440 as to who the message was actually intended for. So in addition to treating it as a domain, 149 00:14:07,240 --> 00:14:11,160 they said something else, which was and in response to --> and I'm paraphrasing --> but 150 00:14:11,160 --> 00:14:17,480 in response to hacks, we will consider responding with kinetic force. 151 00:14:17,480 --> 00:14:22,040 So if you don't actually specifically call out who the recipient of the message is, everybody 152 00:14:22,040 --> 00:14:28,010 reading it thinks it's directed to them. I read it. I thought it was directed to me. 153 00:14:28,010 --> 00:14:33,889 And I'm going like what the heck? You know, I joke my buddy and I replace his, you know, 154 00:14:33,889 --> 00:14:40,399 the HTML, the main Web Page, and that's considered a hack and all of a sudden I've got somebody 155 00:14:40,399 --> 00:14:45,850 launching a patriot missile at me? I mean, this makes no sense. What level of hack? Because 156 00:14:45,850 --> 00:14:50,089 if we look at like CFAA response, maybe they actually think a patriot missile is the right 157 00:14:50,089 --> 00:14:56,070 thing for defaceing a website. I don't know. And none of these are the right questions. 158 00:14:56,070 --> 00:15:00,480 Because I'm not the intended audience, but of course I'm reading it as if I was. And 159 00:15:00,480 --> 00:15:05,209 of course the logical next question is wait, do they understand how attribution works? 160 00:15:05,209 --> 00:15:11,800 Because what if I do it bouncing through an ally? What if I do it from within the U.S. 161 00:15:11,800 --> 00:15:18,800 Are they going to kineticically respond against themselves? And you kind of go okay, wait. 162 00:15:18,980 --> 00:15:23,440 Back up. If the message were directed to, let's say, 163 00:15:23,440 --> 00:15:30,440 you know, other countries, somebody in specific that has a significant power that they say 164 00:15:31,519 --> 00:15:35,720 look, we're talking about critical infrastructure or something of that nature, if you turn off 165 00:15:35,720 --> 00:15:39,529 the lights in New York, we will probably be able to figure out who you are, because you're 166 00:15:39,529 --> 00:15:44,300 not a small little hacker defacing Web sites and maybe there is attribution in place that 167 00:15:44,300 --> 00:15:47,800 we could respond to. That would have been an entirely different sort of message and 168 00:15:47,800 --> 00:15:52,579 I wouldn't have read it as the whole like wow, if I get in root on something in my own 169 00:15:52,579 --> 00:15:58,089 system, is the Government going to shoot me? Which is just silly. But I wasn't the only 170 00:15:58,089 --> 00:16:03,910 person who read it that way. And it's nice having been in this field and 171 00:16:03,910 --> 00:16:10,910 in the hacker researcher community for going on almost 25 years, actually, over 25 years, 172 00:16:11,360 --> 00:16:15,790 and some folks were sending me --> saying hey, have you seen what's going on in the chat 173 00:16:15,790 --> 00:16:21,880 rooms? And there were folks who were claiming affiliation or claiming support of Anonymous 174 00:16:21,880 --> 00:16:26,529 going hey, have you read this? Look who is trying to prep for war in our backyards? Do 175 00:16:26,529 --> 00:16:30,920 they even understand how attribution works? This is bullshit. If they think they can find 176 00:16:30,920 --> 00:16:35,380 me, it's on. Let's go. And the next thing you know there were a couple 177 00:16:35,380 --> 00:16:42,380 Web sites defaced, and they ended in like dot gov. Now this is where it gets kind of 178 00:16:43,440 --> 00:16:50,440 funky. Defacing a website is kind of a message. It's a little warning shot. But that's in 179 00:16:53,110 --> 00:16:58,079 a language that Govies don't know. So the Govies didn't get the message as far as, you 180 00:16:58,079 --> 00:17:01,959 know, what I saw. So here's the initial strategy for operating 181 00:17:01,959 --> 00:17:06,359 in cyberspace that goes out. Probably directed to somebody else, but by poor messaging is 182 00:17:06,359 --> 00:17:10,759 misinterpreted by the group. The group responds, fires a warning shot. The warning shot isn't 183 00:17:10,759 --> 00:17:14,799 understood. And it's like hey, what these vagabonds are doing? Look at the little street 184 00:17:14,799 --> 00:17:17,869 punks, or whatever. They're not somebody who actually has a message that we should actually 185 00:17:17,869 --> 00:17:21,689 engage in. And it's just this little cascading effect. 186 00:17:21,689 --> 00:17:28,689 So that is kind of unfortunately where I saw, you know, the expanding of scope and a lot 187 00:17:29,570 --> 00:17:34,090 of misunderstandings. I'm not saying the two groups should be friends. I'm not saying one 188 00:17:34,090 --> 00:17:38,749 group is good and one group is bad. But when you send a message out into the world, and 189 00:17:38,749 --> 00:17:43,879 this is for both groups, you really need to make sure it's understandable by all the parties 190 00:17:43,879 --> 00:17:47,279 that are going to receive it. You can't assume it's just going to be read by the person you 191 00:17:47,279 --> 00:17:51,869 had in mind. With all love and respect, there is one very 192 00:17:51,869 --> 00:17:56,869 obvious commonality between the hacker researcher group and the Government, and it's that they 193 00:17:56,869 --> 00:18:00,979 can be very arrogant and expect that everybody will speak their own language and they don't 194 00:18:00,979 --> 00:18:06,210 have to speak anybody else's. And I think that's a very common mistake. 195 00:18:06,210 --> 00:18:10,659 So the recommendation for the Government from my vantage point on both sides is figure out 196 00:18:10,659 --> 00:18:14,389 how your messages are going to be received by the more general populace of cyberspace, 197 00:18:14,389 --> 00:18:20,090 because we all live there now. This is actually a great opportunity for diplomacy. You can 198 00:18:20,090 --> 00:18:25,139 kind of think of it like the lost City of Atlantis. Because cyberspace kind of took 199 00:18:25,139 --> 00:18:28,190 the world, I think, the world by surprise. Obviously it hasn't been around that long. 200 00:18:28,190 --> 00:18:33,149 So what if Atlantis just popped pack up. And there was an advanced, very capable technical 201 00:18:33,149 --> 00:18:37,200 group of people there, you wouldn't sit there and ignore them. You wouldn't taunt them. 202 00:18:37,200 --> 00:18:40,580 You wouldn't attack them. You'd probably actually try to understand them and figure out how 203 00:18:40,580 --> 00:18:44,549 messaging to somebody else might be interpreted by them. And you might even try and figure 204 00:18:44,549 --> 00:18:50,210 out where you guys are and where you see things eye to eye and where you have differences. 205 00:18:50,210 --> 00:18:55,519 So my recommendations to the citizens of cyberspace is keep in mind that the Government and in 206 00:18:55,519 --> 00:19:02,029 particular the DoD has very specific focuses and goals. And they often only see things 207 00:19:02,029 --> 00:19:07,379 from their own point of view. Because they're really focused on doing that job. 208 00:19:07,379 --> 00:19:12,489 And when you read things that appear to be a message directed to you or your community, 209 00:19:12,489 --> 00:19:17,700 coming from an unlikely source, you should question whether or not the message is actually 210 00:19:17,700 --> 00:19:22,080 intended for you. Or if it's just intended for somebody else and really poorly worded. 211 00:19:22,080 --> 00:19:26,999 And if you still think a response is necessary, you really need to think about the message 212 00:19:26,999 --> 00:19:33,999 that you're sending to make sure that you don't make the same mistake in return. 213 00:19:36,179 --> 00:19:43,179 My third story is --> let me give you a little background. I know a lot of people approach 214 00:19:43,489 --> 00:19:50,489 me outside of work and go hey, you know what's going on. We're all owned. And these were 215 00:19:50,899 --> 00:19:56,119 large companies that are oftentimes funded by taxpayer money. I'll just say it. They 216 00:19:56,119 --> 00:20:01,200 are large Government contracting organizations. It's like hey, why don't you start a program 217 00:20:01,200 --> 00:20:06,559 that actually pays us to go clean up the compromises, or at least figure out what happened, and 218 00:20:06,559 --> 00:20:13,559 how bad the damage was. I'm like isn't that your job? And it made me think that there 219 00:20:16,349 --> 00:20:23,349 is actually --> there is not a financial incentive for these companies to actually go fix the 220 00:20:23,859 --> 00:20:29,700 problems. So the next question was is the inverse true? 221 00:20:29,700 --> 00:20:34,320 Can Government contractors actually make more money by remaining compromised and continuing 222 00:20:34,320 --> 00:20:41,320 to lose intellectual property? So this talk is called game theory is a bitch. 223 00:20:43,639 --> 00:20:48,639 I was having dinner with --> a lot of stories are because I'm outside having dinner because 224 00:20:48,639 --> 00:20:54,450 I don't cook. I was having dinner with an old friend and 225 00:20:54,450 --> 00:21:01,450 his company goes in and cleans up APT after big well-known names get compromised, whether 226 00:21:02,419 --> 00:21:06,929 they're Government contractors or commercial organizations. And he posed a really interesting 227 00:21:06,929 --> 00:21:11,789 hypothetical. Because we were just shooting the crap back and forth. He said what do you 228 00:21:11,789 --> 00:21:18,789 think about the following chain of events? First, RSA gets compromised. Networks defended 229 00:21:21,299 --> 00:21:28,299 by their tools are vulnerable and, as a result, a defense contractor gets compromised. Said 230 00:21:29,259 --> 00:21:34,159 defense contractor, if you look up on Wikipedia, is the one who made this really cool stealth 231 00:21:34,159 --> 00:21:41,159 drone. Later a really cool stealth drone goes missing over a Middle Eastern state. What 232 00:21:42,909 --> 00:21:47,399 do you think about that chain of events? And I'm like that's terrifying. He is like yes. 233 00:21:47,399 --> 00:21:51,749 I'm like no. No. For an entirely different reason. 234 00:21:51,749 --> 00:21:54,409 Look at it this way. I have no clue. That's a hypothetical and there are a whole bunch 235 00:21:54,409 --> 00:22:01,409 of rumors about what had happened. Let's assume that you as a country or a large organization 236 00:22:01,470 --> 00:22:07,289 that your advantage is technology. You can field the fastest and the best technology 237 00:22:07,289 --> 00:22:11,210 so you're ahead of everybody. That's your advantage. 238 00:22:11,210 --> 00:22:17,849 Newest most advanced toys. Someone else steals some of your tech. What do you have to do? 239 00:22:17,849 --> 00:22:24,849 You've got to replace it with newer tech. Right?You've got to keep your advantage. 240 00:22:25,169 --> 00:22:29,999 So suppose a Government contractor gets some of the super tech stolen, and what does the 241 00:22:29,999 --> 00:22:35,200 Government customer actually need to do? Well, the Government in that case --> and this is 242 00:22:35,200 --> 00:22:40,169 a game theory hypothetical --> need to pay someone to make the next version so that the 243 00:22:40,169 --> 00:22:46,049 people who just stole it don't achieve parity. So that they're not even. They could go to 244 00:22:46,049 --> 00:22:51,739 some other Government contractor, because of course the one in question just lost everything. 245 00:22:51,739 --> 00:22:57,859 But they actually most likely won't. And here's probably why. 246 00:22:57,859 --> 00:23:04,859 The initial contract for very expensive research efforts can take a long time to put in place. 247 00:23:05,700 --> 00:23:11,059 You're talking over a year. Sometimes longer than --> sometimes you measure it in years 248 00:23:11,059 --> 00:23:17,629 rather than months. That was part of the coolness of CFT was that we were measuring that in 249 00:23:17,629 --> 00:23:22,659 days. Imagine if you're under something, sequestration is what we're under now, it can take even 250 00:23:22,659 --> 00:23:27,940 longer. So if a Government agency wanted to start a new program to replace tech, so it's 251 00:23:27,940 --> 00:23:31,429 essentially starting the same program to do the same thing that you already were paying 252 00:23:31,429 --> 00:23:36,499 somebody to do, A, it's tough to get permission to do that. Because you've got to go justify 253 00:23:36,499 --> 00:23:41,629 taxpayer money and, well, we just gave you the money to do that. And, B, when you spin 254 00:23:41,629 --> 00:23:45,249 it back up, you're going to have to redo a lot of work. You're going to have to redo 255 00:23:45,249 --> 00:23:48,440 the contracting that you already had in place. You're going to have to spin people up to 256 00:23:48,440 --> 00:23:53,349 speed on management side. You're going to have to respin up the tech side. And you've 257 00:23:53,349 --> 00:23:57,629 spent years putting that in place. So why wouldn't you just go back to the people 258 00:23:57,629 --> 00:24:01,169 that you already have a relationship with, already have a contract with, they already 259 00:24:01,169 --> 00:24:05,649 know what they lost, or maybe you know what they lost and stuff, and you can tell them 260 00:24:05,649 --> 00:24:11,080 because they're your customer. So you can pay them to do the next thing. Remember, they're 261 00:24:11,080 --> 00:24:14,479 not financially incentivized to go fix how they were actually compromised in the first 262 00:24:14,479 --> 00:24:19,519 place, or cleaning it up. Because staying with the familiar solution or situation is 263 00:24:19,519 --> 00:24:24,710 comfortable, which makes it a trap that a Government funding source can actually be 264 00:24:24,710 --> 00:24:29,869 particularly susceptible to. You can view this on a case-by-case basis 265 00:24:29,869 --> 00:24:34,570 and kind of staying with the same contractor, it can even make sense. But if you step back 266 00:24:34,570 --> 00:24:39,440 and listen to what has been talked about in the media, you may see something that is a 267 00:24:39,440 --> 00:24:44,649 larger picture that seems like an endless list of technologies and IP being stolen. 268 00:24:44,649 --> 00:24:49,749 And each time it happens, that company is in a situation where, A, there is really no 269 00:24:49,749 --> 00:24:56,749 penalties or reprimands for it. On the contrary, they are rewarded with more funding. 270 00:24:58,009 --> 00:25:01,799 So because their customer needs to make the next tech to replace the stuff that just got 271 00:25:01,799 --> 00:25:05,669 stolen, to replace the stuff that just got stolen, to replace the stuff that just got 272 00:25:05,669 --> 00:25:11,249 stolen. So, yeah, game theory is a bitch because if you look at it from this angle --> and part 273 00:25:11,249 --> 00:25:15,359 of the neat thing is you can fall into game theoretics without realizing that you're doing 274 00:25:15,359 --> 00:25:20,809 it --> Government contractors can actually be in a situation or are actually in a situation 275 00:25:20,809 --> 00:25:24,499 that they are financially incentivized in some places not to listen to their network 276 00:25:24,499 --> 00:25:30,440 sys admins and not to really deal with the problem perhaps the way with the drastic changes 277 00:25:30,440 --> 00:25:37,440 that need to be made. The fourth and kind of closing story, and 278 00:25:40,469 --> 00:25:46,580 maybe I'll do a fifth story about Barnaby Jack and Abu Dhabi. Yeah, I think I'll do 279 00:25:46,580 --> 00:25:53,580 that. I mention Barnaby Jack and I get all teary. 280 00:25:55,099 --> 00:26:01,119 Yeah, maybe I just stick with the fourth story, then. 281 00:26:01,119 --> 00:26:05,320 The fourth story, closing, is more of a kind of plea to both the Government communities 282 00:26:05,320 --> 00:26:09,979 and the hacker researcher communities, because from the vantage point of both. I don't have 283 00:26:09,979 --> 00:26:15,989 a lot of examples of our community, the hacker researcher community, really reaching out 284 00:26:15,989 --> 00:26:21,820 in a proactive and positive way to educate and enlighten the Government. We do it, but 285 00:26:21,820 --> 00:26:28,820 we do it really ad hoc. And I think we need to try a little harder to do specific examples. 286 00:26:29,139 --> 00:26:34,200 I've been a little upset about some of the things on the news lately. And, actually, 287 00:26:34,200 --> 00:26:39,090 one of your options, it is a scary option, is to actually go inside and try and fix them 288 00:26:39,090 --> 00:26:44,070 there. People will fight you tooth and nail. It is not for the faint of heart. But that's 289 00:26:44,070 --> 00:26:48,119 actually what I did when I went over to DARPA. I didn't go there because I thought it was 290 00:26:48,119 --> 00:26:52,009 cool. I didn't go there because I wanted to be a part of the Government. I actually went 291 00:26:52,009 --> 00:26:57,399 there because I thought that they and other parts of the Government had kind of lost their 292 00:26:57,399 --> 00:27:00,899 way. And I had an opportunity to go in and fix it. 293 00:27:00,899 --> 00:27:07,070 I did get a really nice unofficial e-mail from somebody recently and it was about CFT, 294 00:27:07,070 --> 00:27:11,989 which makes me think that we actually, because you guys were all a big part of that, did 295 00:27:11,989 --> 00:27:17,450 manage to pull some of that off. So I'm going to quote from this e-mail I got to my personal 296 00:27:17,450 --> 00:27:24,190 account. And the person said "I recently had a meeting with all the agencies, and the DoD 297 00:27:24,190 --> 00:27:29,219 services, and listening to them it was my turn to be terrified because of how out of 298 00:27:29,219 --> 00:27:34,259 touch with reality they were with cyber security and cyber defenses, and it made me realize 299 00:27:34,259 --> 00:27:40,039 how much I and the DoD owe you" and that's us "for cyber fast track." And here is the 300 00:27:40,039 --> 00:27:45,089 part where I was happy. He said "I thought CFT was showing the Government how they should 301 00:27:45,089 --> 00:27:50,659 be doing contracting. But now I actually understand what you were doing. It was showing the Government 302 00:27:50,659 --> 00:27:55,159 what the real state-of-the-art is and why they should be afraid of people on the inside 303 00:27:55,159 --> 00:28:00,549 who continue to just preach the status quo and throw money at the same problems the same 304 00:28:00,549 --> 00:28:04,279 way they had done before. So that was actually pretty cool, because 305 00:28:04,279 --> 00:28:09,149 somebody --> they're starting to realize that. And I've heard people at high levels, flag 306 00:28:09,149 --> 00:28:15,080 officers, a couple pockets were starting to refer to hacker researchers as researchers. 307 00:28:15,080 --> 00:28:19,320 It was hacker equals researcher, not hacker equals criminal. I thought that was really 308 00:28:19,320 --> 00:28:23,669 cool. It's not saying that we should all go in and support the DoD and I'm not telling 309 00:28:23,669 --> 00:28:28,799 you you should like the DoD. I've got a lot of issues with the DoD, and I'll continue, 310 00:28:28,799 --> 00:28:34,529 and I'm sure they have a lot of issues with me. This talk might even be one of them. 311 00:28:34,529 --> 00:28:38,009 But what happens there is now that they know where some of the real ideas and some of the 312 00:28:38,009 --> 00:28:43,249 real talent come from, they're undoubtedly going to reach out and try to tap into it 313 00:28:43,249 --> 00:28:47,399 in various ways. And this kind of goes back to an earlier story where they kind of projected 314 00:28:47,399 --> 00:28:51,450 their problems and their images and their goals on somebody else. So there is likely 315 00:28:51,450 --> 00:28:58,450 to be some uninformed and failed outreach efforts. So I've got a couple of recommendations 316 00:28:58,729 --> 00:29:02,679 to the Government that maybe will help with that. 317 00:29:02,679 --> 00:29:08,719 So I think it's really cool when Government officials throw on blue jeans and a black 318 00:29:08,719 --> 00:29:13,129 T-shirt, because of course then they're part of our community. 319 00:29:13,129 --> 00:29:17,639 (Laughter) But that's not necessarily all there is to 320 00:29:17,639 --> 00:29:23,719 interacting with us. And it makes sense before you present at a conference like this, that 321 00:29:23,719 --> 00:29:27,639 you should probably consider attending one and actually interacting and getting to know 322 00:29:27,639 --> 00:29:33,229 the people. There was one guy who was a three-star general who did that at the Shmoocon, and 323 00:29:33,229 --> 00:29:36,529 I thought that that was one of the coolest things. He wasn't there for any agenda. And 324 00:29:36,529 --> 00:29:40,619 I remember conversations with him afterwards. He actually had an understanding. He was like 325 00:29:40,619 --> 00:29:44,379 oh, this is awesome. No, there is no way people should try and go in and mess with them or 326 00:29:44,379 --> 00:29:49,109 try and co-op them or try and --> and I was like yeah, exactly. That's us. That's the 327 00:29:49,109 --> 00:29:56,109 citizens. That's the population of the U.S. So the message to the other ones who haven't 328 00:29:56,619 --> 00:30:03,619 really made that turn is go and actually interact. Now the response I'd get was the schedule 329 00:30:04,799 --> 00:30:10,899 is too crazy. Can't possibly do it. And I saw those schedules, and sometimes I was even 330 00:30:10,899 --> 00:30:15,799 on those schedules. But if it's important enough --> I know, I acknowledge, they are 331 00:30:15,799 --> 00:30:22,059 crazy schedules. These guys work like bears, which doesn't mean that they sleep for half 332 00:30:22,059 --> 00:30:22,549 the year. (Laughter) 333 00:30:22,549 --> 00:30:28,249 A bad analogy as soon as I said it. I was going to say like a swear word, and bears 334 00:30:28,249 --> 00:30:33,639 came out instead. Anyway. If it's important enough for you to want to 335 00:30:33,639 --> 00:30:37,119 reach out to a community, you've got to go out and you've got to make the effort and 336 00:30:37,119 --> 00:30:40,059 you've got to put it in your schedule and you've got to go interact with them on a one-on-one 337 00:30:40,059 --> 00:30:46,669 level first. Because that showing your homework and doing your homework shows respect. 338 00:30:46,669 --> 00:30:52,450 The next suggestion to them is, and this is what I tried to encourage inside, is you can't 339 00:30:52,450 --> 00:30:57,200 go out and do a recruiting pitch. Because it comes across really poorly. I used to get 340 00:30:57,200 --> 00:31:03,899 so bent out of shape when I would see a Govie stand up at a hacker conference and I'm like 341 00:31:03,899 --> 00:31:09,179 here it comes. We do awesome stuff, but I can't tell you anything about it. Trust us. 342 00:31:09,179 --> 00:31:14,119 You with the mohawk, if you shaved your hair, if you put on a suit and maybe even a uniform, 343 00:31:14,119 --> 00:31:16,759 stopped smoking dope, you could come work for us and actually do something with your 344 00:31:16,759 --> 00:31:22,429 life. That's how I interpreted it. Now that might not be the message. It might just be 345 00:31:22,429 --> 00:31:26,589 a look, you know, we need help and we're trying to reach out to you. But it's just a take, 346 00:31:26,589 --> 00:31:29,950 take, take sort of message. What can you do for us today? You know, what can you do for 347 00:31:29,950 --> 00:31:36,950 us now? And to me it was offensive. What would it be like if you had a senior 348 00:31:39,499 --> 00:31:46,499 official from a very technical agency come out and actually give a technical talk? Because 349 00:31:46,899 --> 00:31:52,330 this is Ameritocracy. That's where this community came from. Ameritocricy is your value in the 350 00:31:52,330 --> 00:31:56,959 community is based upon how much you contribute to that community. And that's one of the reasons 351 00:31:56,959 --> 00:32:01,209 why I was really happy that --> because I know a lot of people are like why the hell did 352 00:32:01,209 --> 00:32:06,070 Mudge go over and go to the DoD? He was one of us and now he's one of them. And I had 353 00:32:06,070 --> 00:32:12,089 spent 15, 20 years contributing to this community, and I wasn't about to stop. And when I was 354 00:32:12,089 --> 00:32:16,639 there, I was able to actually fight for this community and try and make sure that the interactions 355 00:32:16,639 --> 00:32:22,709 were a little bit better and that we were treated and engaged with normally. And those 356 00:32:22,709 --> 00:32:28,979 10, 15 years of contribution gave me enough grace period to build trust up again on both 357 00:32:28,979 --> 00:32:32,179 sides. And you've got to do that and you do that 358 00:32:32,179 --> 00:32:36,080 by interacting with people. So the value of somebody in one of those agencies coming and 359 00:32:36,080 --> 00:32:41,009 giving a technical talk wouldn't be that you learned something really cool about how SE 360 00:32:41,009 --> 00:32:45,029 Linux was actually done and why it was done. Or what the internal battles were to get it 361 00:32:45,029 --> 00:32:49,029 across. It wouldn't be that somebody is going through the technical components of one of 362 00:32:49,029 --> 00:32:54,359 the numerous patents that are out there, you know, let's say the IPGLO location. You know, 363 00:32:54,359 --> 00:33:00,479 the ones that we've read about. It would actually be that they're engaging us and interacting 364 00:33:00,479 --> 00:33:07,479 with us in our own language and treating us as peers and starting a dialog. 365 00:33:08,039 --> 00:33:12,700 So I think I will give the Barnaby one after this. But I'm summarize this one here. 366 00:33:12,700 --> 00:33:19,049 Am I telling us --> you know, am I pleading that we should not challenge the Government? 367 00:33:19,049 --> 00:33:22,830 Absolutely not. I think challenging the Government is your patriotic duty as a citizen and I 368 00:33:22,830 --> 00:33:27,609 think it is very important to do. It's painful for both sides, but it's something that has 369 00:33:27,609 --> 00:33:34,609 to happen and it's why we're such a great nation. 370 00:33:35,159 --> 00:33:42,159 (Applause) We also need to --> I mean, you can't train 371 00:33:44,989 --> 00:33:48,789 a dog just by repeatedly beating it. I mean, it will learn some stuff, but it will probably 372 00:33:48,789 --> 00:33:53,409 learn stuff that you weren't intending and it will bite you at some point. So when you 373 00:33:53,409 --> 00:33:58,009 see the dog do something good, it's nice to give it a treat, and there are certain little 374 00:33:58,009 --> 00:34:02,099 pockets inside the Government. And one of the things that I think that we as a community 375 00:34:02,099 --> 00:34:06,379 can do better is, yes, we need to challenge the stuff that we're seeing. We need to challenge 376 00:34:06,379 --> 00:34:10,309 the things that are in the news. But if you see a small pocket of hope, like if you see 377 00:34:10,309 --> 00:34:17,309 a Congresswoman that is helping put through Erin's law, you know --> changing things like CFAA. I don't deal with 378 00:34:35,619 --> 00:34:42,619 losing people well. Excuse me. Somebody is going to change CFAA, we need 379 00:34:54,799 --> 00:35:00,260 to support them. We need to help them. We need to encourage them for actually going, 380 00:35:00,260 --> 00:35:04,230 because they're going to get a lot of crap thrown at them. And they're actually doing 381 00:35:04,230 --> 00:35:07,559 the right thing and there is not a lot of people supporting them. So we need to be more 382 00:35:07,559 --> 00:35:14,559 vocal as a community to actually support them. There was a Colonel in the Army who managed 383 00:35:14,559 --> 00:35:20,750 to get the NSA to have to include "Little Brother" as a book that they read as part 384 00:35:20,750 --> 00:35:26,769 of their training. Have you read "Little Brother," Cory Doctorow? That's awesome. That helps 385 00:35:26,769 --> 00:35:32,880 sensitivities. That guy caught a lot of crap for that, and it was really cool. I mean, 386 00:35:32,880 --> 00:35:36,710 there is nothing wrong with that book. That book gives you a new way of looking at things. 387 00:35:36,710 --> 00:35:39,900 And the more ways you have of looking at it, the more understanding you have and the more 388 00:35:39,900 --> 00:35:43,980 positive outcome. That guy is also, I say he is a Colonel. He 389 00:35:43,980 --> 00:35:48,130 is over at West Point. His name is Greg Conti. I'll call him out. He was one of the people 390 00:35:48,130 --> 00:35:51,730 who encouraged the cadets to actually go out and talk at our conferences and contribute 391 00:35:51,730 --> 00:35:58,730 to the UA --> build your own UAV at a 99.99 percent discount by Mike Wiegand was an example 392 00:35:59,430 --> 00:36:05,789 of that. And it's engaging and that's actually sharing in a creative dialog at Schmoocon. 393 00:36:05,789 --> 00:36:12,789 He and his colleague walked through their training course that they ran at Fort Meade, 394 00:36:13,029 --> 00:36:17,950 to try and socialize folks. It was lessons of the Kobayashi Maru. I highly recommend 395 00:36:17,950 --> 00:36:24,920 you go watch this talk. Because he had to teach them how to cheat. And it's hilarious 396 00:36:24,920 --> 00:36:31,920 and it's insightful and it's humanizing. Most importantly, it's humanizing. 397 00:36:32,640 --> 00:36:39,180 So where we see those pockets of hope and of outreach and of engagement, I'd just really 398 00:36:39,180 --> 00:36:43,220 like to ask all of us to try and figure out a way for each time we're challenging something, 399 00:36:43,220 --> 00:36:45,460 we really have to try and encourage the good behavior. 400 00:36:45,460 --> 00:36:52,349 Okay, so let me try to give my Barnaby one without breaking down into tears here. Let's 401 00:36:52,349 --> 00:36:58,210 see if I pulled myself together. It's a real quick one, but it's my tribute to him. 402 00:36:58,210 --> 00:37:03,480 Two things that happened in our actions with Barnaby that I'll always remember. I remember 403 00:37:03,480 --> 00:37:09,750 all of the interactions, but two stand out. One was a talk. I was on the steering committee 404 00:37:09,750 --> 00:37:14,710 of NDSS, and they asked me if I could bring in some folks to run some demos that would 405 00:37:14,710 --> 00:37:20,420 kind of break the academics out of the academic mold, and you know what better people than 406 00:37:20,420 --> 00:37:24,990 Barnaby Jack when he was working with EI and the rest of the EI team to actually come in. 407 00:37:24,990 --> 00:37:29,539 The problem is that the conference, like a lot of conferences, they were cheap. They 408 00:37:29,539 --> 00:37:33,269 wouldn't pay them to come do the work, or whatever. So I said all right, guys, you know, 409 00:37:33,269 --> 00:37:38,220 the drinking bill the night before is on me. I'll foot the bill myself, which is a very, 410 00:37:38,220 --> 00:37:43,640 very dangerous thing to do. Barnaby had a great time. I don't think they 411 00:37:43,640 --> 00:37:49,720 went to sleep, they just kept drinking. They were on in the morning, and the audience at 412 00:37:49,720 --> 00:37:55,710 NDSS I don't think actually really understood how cool the technology was that was being 413 00:37:55,710 --> 00:37:59,910 demonstrated. Because this is almost ten years ago, at this point. 414 00:37:59,910 --> 00:38:04,609 And Barnaby was remotely compromising a wireless router, replacing the firmware and then Trojaning 415 00:38:04,609 --> 00:38:07,700 the Microsoft updates that were going through it over the wire before they were delivered 416 00:38:07,700 --> 00:38:14,700 to the end system. And then they demonstrating a boot route, where they were getting an Ethernet 417 00:38:15,099 --> 00:38:20,760 -- so a computer that was told not to boot off the network, the Ethernet adapter was 418 00:38:20,760 --> 00:38:27,760 on the PCI board so it had direct memory access and it would still emit a boot P packet. And 419 00:38:28,690 --> 00:38:32,460 if you responded to it, the Ethernet board would actually shove it directly in memory 420 00:38:32,460 --> 00:38:37,910 and reboot it from the network even if your BIOS didn't have that capability. 421 00:38:37,910 --> 00:38:43,079 So of course they would say here is your base operating system. It has a little hypervisor, 422 00:38:43,079 --> 00:38:46,089 and of course the operating system would load up on top of it. This was a decade ago. This 423 00:38:46,089 --> 00:38:48,990 was awesome. And the reason why I don't think any of the 424 00:38:48,990 --> 00:38:54,359 audience actually caught the technical part of those talks is because Barnaby nearly threw 425 00:38:54,359 --> 00:38:59,019 up on stage ten times in the middle of trying to give that talk, and everybody in the first 426 00:38:59,019 --> 00:39:04,430 row was terrified that they were at some perverse form of a Gallagher hacker show. 427 00:39:04,430 --> 00:39:09,450 (Laughter) And then the other thing I remember about 428 00:39:09,450 --> 00:39:16,450 Barnaby was I had just gone in and I was working for DARPA. And my first public speaking engagement 429 00:39:20,010 --> 00:39:27,010 as a U.S. Official was in Abu Dhabi. So here I am, first time, the Government is a little 430 00:39:29,369 --> 00:39:33,940 nervous about me, I'm a little nervous about them. I'm flying under my Government official 431 00:39:33,940 --> 00:39:40,170 passport, not my blue tourist passport. So all the coordination between the countries 432 00:39:40,170 --> 00:39:44,769 that I imagine has to go on with those folks, and I'm in Abu Adbi and it was actually to 433 00:39:44,769 --> 00:39:48,980 do the keynote for Black Hat. It was the first year they were over there. And it was the 434 00:39:48,980 --> 00:39:55,720 first time ever that I was showing parts of the cyber analytic framework that I drove 435 00:39:55,720 --> 00:40:00,519 at DARPA. And it was my way of trying to get a small group of peers that I could interact 436 00:40:00,519 --> 00:40:05,400 with and get feedback and just talk honestly, you know, does this make sense or am I full 437 00:40:05,400 --> 00:40:09,470 of crap? And Barnaby was there and the Gruck is there. 438 00:40:09,470 --> 00:40:15,900 And those are two people that put together, that will deplete the world's alcohol supplies. 439 00:40:15,900 --> 00:40:21,849 And he was doing his jackpoting ATM machines. Now the UAE has a lot of money they've come 440 00:40:21,849 --> 00:40:28,849 into since the '70s. And in the palace there is an ATM machine that dispenses gold bars. 441 00:40:31,170 --> 00:40:35,349 (Laughter) Very expensive gold bars. Not like you've 442 00:40:35,349 --> 00:40:40,380 got a $200 withdrawal limit. I mean, these are in the tens if not hundreds, I can't remember 443 00:40:40,380 --> 00:40:43,859 how high up the price was. There might have been the ability to withdraw a million dollar 444 00:40:43,859 --> 00:40:49,039 gold bar from it. And some of you might have seen the picture of Barnaby going like that 445 00:40:49,039 --> 00:40:54,869 right next to the thing. So Barnaby's had a few drinks and they see 446 00:40:54,869 --> 00:41:01,869 the gold ATM machine. So how do you think it works? And they are peering behind it and 447 00:41:03,069 --> 00:41:09,230 everything. And the folks who are --> I think it's the son or one of the relatives of the 448 00:41:09,230 --> 00:41:16,230 Crown Prince, who I knew from a prior life, was looking at me going what's going on? And 449 00:41:17,099 --> 00:41:22,809 they're all starting to gather around the gold ATM. And I forget who it was that tweeted 450 00:41:22,809 --> 00:41:27,830 and said I remember Barnaby in the UAE and having to go to the State Department to basically 451 00:41:27,830 --> 00:41:32,349 -- or the embassy, calling the embassy to make sure everything was okay. 452 00:41:32,349 --> 00:41:39,119 So it wasn't the embassy, it was me, having to go over, talk to, you know, people who 453 00:41:39,119 --> 00:41:43,789 are part of the court of the Crown Prince and explaining: No, I know you're not used 454 00:41:43,789 --> 00:41:48,490 to extremely heavy drinkers, and you just invited a bunch of hackers into your country, 455 00:41:48,490 --> 00:41:51,690 and they've demonstrated a bunch of crazy terrifying things, and now they're eying your 456 00:41:51,690 --> 00:41:57,369 million dollar gold vending machine. (Laughter) 457 00:41:57,369 --> 00:42:01,099 It's Barnaby Jack. He's cool. Don't worry about it. I'll tell you what, you probably 458 00:42:01,099 --> 00:42:05,980 want to know if your million dollar gold vending machine has this problem. So why don't you 459 00:42:05,980 --> 00:42:10,539 let him do a little bit, and then when they walk away, why don't you pull the plug on 460 00:42:10,539 --> 00:42:15,680 the thing and then move it off the floor. Sure enough, everybody got a little tired. 461 00:42:15,680 --> 00:42:18,630 Because of course there's some research that has to go into these things, and the alcohol 462 00:42:18,630 --> 00:42:24,960 fueling only lasts so long. And when somebody got a little tired and decided to walk away, 463 00:42:24,960 --> 00:42:28,640 the next day you see there's this big curtain pulled around everything and nobody is allowed 464 00:42:28,640 --> 00:42:34,099 near the thing. So there was no reach out to the embassy and there was no international 465 00:42:34,099 --> 00:42:38,920 incident. But there was Barnaby Jack, and he will be missed. 466 00:42:38,920 --> 00:42:39,650 Thank you. (Applause) 467 00:42:39,650 --> 00:42:46,650 You can't go anywhere. So I'm joined up here by just a very small subset of the CFT 468 00:43:04,900 --> 00:43:11,900 performers that were involved with Mudge's DARPA program, cyber fast track. So we want 469 00:43:12,589 --> 00:43:19,589 to take the opportunity --> hold on a second. (Applause) 470 00:43:20,670 --> 00:43:27,670 We really just want to get up here and thank Mudge for all of his efforts inside DARPA 471 00:43:36,460 --> 00:43:41,390 with this program. We all had a lot of fun. You've seen some of the research that's come 472 00:43:41,390 --> 00:43:45,319 out of it at DEF CON and Black Hat and there will only be more that's coming out soon. 473 00:43:45,319 --> 00:43:50,339 But we also wanted to thank him for his entire career from LOpht to DARPA and now onwards 474 00:43:50,339 --> 00:43:55,279 to Google. I'm sure there's many more interesting things to come. So please give your strongest 475 00:43:55,279 --> 00:44:02,279 round of applause for Mudge and everything he's done for the cyber community. 476 00:44:02,680 --> 00:44:09,680 (Applause) There's more. Don't go anywhere yet. We're 477 00:44:13,920 --> 00:44:20,240 not done. So what we didn't mention is hopefully --> I'm 478 00:44:20,240 --> 00:44:23,490 going to say a few things about Mudge and hopefully some other people who participated 479 00:44:23,490 --> 00:44:29,670 in CFT will as well. My name is Joe Grand and I've known Mudge 480 00:44:29,670 --> 00:44:36,670 for a really long time. I was in the LOpht back in I guess we met in 1990, I was like 481 00:44:38,430 --> 00:44:45,000 a 15-year-old punk little kid. And ended up getting in trouble for some things, joined 482 00:44:45,000 --> 00:44:51,549 the LOpht, and Mudge came in around the same time. And he --> I don't know if I ever told 483 00:44:51,549 --> 00:44:56,130 him this, but he was one of my mentors growing up. From that point as a 16-year-old kid, 484 00:44:56,130 --> 00:45:01,170 everybody else in the LOpht was older. I sort of got to see the experience of somebody that 485 00:45:01,170 --> 00:45:06,480 was like six or eight, twenty years older than me. I don't exactly know. He never actually 486 00:45:06,480 --> 00:45:08,440 told me his age. (Laughter) 487 00:45:08,440 --> 00:45:13,569 But it was something that I got to follow along. I was in the LOpht and it was a great 488 00:45:13,569 --> 00:45:20,569 experience. And I sort of grew up in that from 16 to 22. After we started that stake, 489 00:45:21,359 --> 00:45:25,299 you know we sort of disappeared for a while. Mudge went one way, I went another. Some of 490 00:45:25,299 --> 00:45:31,589 the other guys just sort of disappeared. And then he sort of surfaced I guess 2008 491 00:45:31,589 --> 00:45:37,529 or '9, and it was like all of a sudden Mudge is back and he's in DARPA. And I was like 492 00:45:37,529 --> 00:45:43,980 holy shit. Mudge is back. And he's working for "the man." 493 00:45:43,980 --> 00:45:47,299 (Laughter) And here I was, grew up with him in the LOpht, 494 00:45:47,299 --> 00:45:54,099 and there is a lot of stuff in the LOpht that you guys don't know. And it was awesome. And 495 00:45:54,099 --> 00:45:58,839 yeah, I didn't really know what to think. I was still involved in DEF CON and the hacker 496 00:45:58,839 --> 00:46:03,000 community. It was just --> to me, seeing that, it was like wow, that was a big jump, and 497 00:46:03,000 --> 00:46:07,569 that takes some serious balls to do that. And I could never imagine doing that. And 498 00:46:07,569 --> 00:46:12,059 I think everyone was like what's going to happen? What's he actually going to do out 499 00:46:12,059 --> 00:46:16,480 there? It turned out to be an amazing thing. CFT 500 00:46:16,480 --> 00:46:21,579 happened and a huge number of my friends ended up doing all these projects. Charlie Miller 501 00:46:21,579 --> 00:46:26,309 had two projects in CFT, and I was like how is everybody doing all this stuff? I was like 502 00:46:26,309 --> 00:46:30,869 I want to do a project with CFT. I was running with Charlie one day and he was like yeah, 503 00:46:30,869 --> 00:46:37,069 you should do it. Mudge has this whole thing wrapped up. You just write a proposal and 504 00:46:37,069 --> 00:46:40,559 he reads it and if it gets approved they send you money and you can work on stuff. I'm like 505 00:46:40,559 --> 00:46:43,690 really, is it that easy? He's like yeah, do it. 506 00:46:43,690 --> 00:46:49,920 So that was last year. I was like I don't know, do I want to work for Mudge again? Like 507 00:46:49,920 --> 00:46:54,019 that's going to be really weird. Like we were in the L0pht and I don't want him to be my 508 00:46:54,019 --> 00:46:57,230 boss. Really, this was his huge complaint. It's like they'll give you money. I was like 509 00:46:57,230 --> 00:47:02,910 I don't want to work for Mudge. But he's like it's Not working for Mudge, you know some 510 00:47:02,910 --> 00:47:06,130 other group takes care of it. So I'm like all right, cool. And I thought 511 00:47:06,130 --> 00:47:12,519 it was just a great thing that he was doing. So I submitted a project that got rejected. 512 00:47:12,519 --> 00:47:17,210 And I'm not sure I'm allowed to say this because I don't know if it was part of the official 513 00:47:17,210 --> 00:47:22,089 process, but he called me up. Like I submitted the official proposal and like 15 inutes later 514 00:47:22,089 --> 00:47:26,009 he calls me. He said I need to talk to you in person about this. I don't need to send 515 00:47:26,009 --> 00:47:31,099 you an e-mail. So he explained the process. I said all right. That's cool. Too much engineering, 516 00:47:31,099 --> 00:47:35,410 whatever. It didn't fit the DARPA thing, the CFT thing. I'm like okay, that's fine. 517 00:47:35,410 --> 00:47:39,990 But it drove me to like --> it's like I've got to get a CFT in. All my friends are doing 518 00:47:39,990 --> 00:47:41,509 it, it's like I've got to take advantage of this while 519 00:47:41,509 --> 00:47:47,799 I can, man, before it goes away. So eventually I got one in and I'm still working 520 00:47:47,799 --> 00:47:54,799 on it right now. And it occurred to me that it's not that you can like --> you're doing 521 00:47:55,240 --> 00:47:59,680 this project to make money. Right? You're not doing a job to make money. It's the fact 522 00:47:59,680 --> 00:48:05,019 that you're able to get money to do what you want to do. And, you know, it's --> you do 523 00:48:05,019 --> 00:48:08,839 it --> you do what you love to do and you're not losing money is sort of what it is. And 524 00:48:08,839 --> 00:48:12,470 that's sort of what we try to do at the LOpht. It's like do what we want to do and not lose 525 00:48:12,470 --> 00:48:15,119 money, but make sure that we can keep kind of pushing things. 526 00:48:15,119 --> 00:48:17,650 So I don't know, I just wanted to say that. I don't know if you notice on the back --> can 527 00:48:17,650 --> 00:48:21,809 someone turn around? On the back of these shirts it says "making the theoretical, practical, 528 00:48:21,809 --> 00:48:22,769 since 1992." (Applause) 529 00:48:22,769 --> 00:48:29,769 And I don't know how we came up with that, but that was one quote that we talked about, 530 00:48:31,390 --> 00:48:35,749 writing exploits and kind of showing vendors, like look, this is a possibility. But the 531 00:48:35,749 --> 00:48:40,499 one that isn't on the back of this shirt is what we always used to say about making a 532 00:48:40,499 --> 00:48:44,359 dent in the universe when we were at the LOpht. I think Mudge actually came up with that. 533 00:48:44,359 --> 00:48:49,019 So we would be in interviews and news stuff and press, and Mudge would say we're going 534 00:48:49,019 --> 00:48:52,619 to make a dent in the universe. And I was like yeah yeah yeah, you know. I said it, 535 00:48:52,619 --> 00:48:57,309 but I was like that's total bullshit. How are we going to make a dent in the universe, 536 00:48:57,309 --> 00:49:01,880 we're are seven guys with --> you know, he had long hair, as you know. And seven guys 537 00:49:01,880 --> 00:49:05,130 in a warehouse, it's like how are we going to actually make a dent in the universe? 538 00:49:05,130 --> 00:49:08,019 Although the hacker community, is like a small -- that's not the universe. It's a small universer 539 00:49:08,019 --> 00:49:12,200 but it's not the universe. But he actually believed it. 540 00:49:12,200 --> 00:49:15,319 You know, and I was sort of like --> yeah, I was going along with it. But he believed 541 00:49:15,319 --> 00:49:19,900 it, and it didn't actually hit me until he got to DARPA and did CFT, and I was like holy 542 00:49:19,900 --> 00:49:24,920 shit, he did make a dent in the universe. You know? It's like that --> the work the he 543 00:49:24,920 --> 00:49:29,609 did and the work that came out of CFT totally changed the world, whether it's immediate 544 00:49:29,609 --> 00:49:33,029 or whether it's later. It changed the Government, it changed the thought process, it's amazing. 545 00:49:33,029 --> 00:49:38,309 So I just wanted to thank him and welcome him back out of working for "the man" back 546 00:49:38,309 --> 00:49:44,980 into like the normal world. So thanks. (Applause) 547 00:49:44,980 --> 00:49:51,980 I do also have to say that Charlie is responsible for probably 70 percent of the CFTs that were 548 00:49:53,960 --> 00:49:58,109 submitted. I had a similar phone call with him, I don't know, a couple years back. I 549 00:49:58,109 --> 00:50:04,059 remember distinctly. And people have a very interesting opinion of what it's like to participate 550 00:50:04,059 --> 00:50:10,049 in any sort of DARPA or government grant. And speaking with Charlie and learning about 551 00:50:10,049 --> 00:50:17,049 the streamline process and the kind of low overhead it takes to get a grant through and 552 00:50:17,059 --> 00:50:22,119 actually get funding to, again, do what you want to do was very attractive. So I think 553 00:50:22,119 --> 00:50:26,809 this program itself was wildly successful alone. But I think it also changed a lot of 554 00:50:26,809 --> 00:50:31,299 our personal views about dealing with the Government, and I hope that can continue with 555 00:50:31,299 --> 00:50:34,990 CFT with the next program manager. I would also say that bitsys --> are there 556 00:50:34,990 --> 00:50:40,660 any other bitsys guys up here? So bitsys helped run the program for DARPA. 557 00:50:40,660 --> 00:50:45,109 (Applause) So we will give them a round of applause ourselves 558 00:50:45,109 --> 00:50:52,109 because they are great to work with. You know, I hadn't registered for DEF CON 559 00:50:53,430 --> 00:50:59,710 in over 20 years, which brings some perspective. And I've known this guy for a very, very, 560 00:50:59,710 --> 00:51:06,109 very long time, and he always wanted to be something greater than the average bear and 561 00:51:06,109 --> 00:51:10,049 to change things. And I don't know if he would mind me saying 562 00:51:10,049 --> 00:51:16,759 this, but I'll say it anyway, back in the day, when his hunger was great, he asked me 563 00:51:16,759 --> 00:51:22,880 to take over the LOpht, which was probably a bad idea for a variety of reasons. But I 564 00:51:22,880 --> 00:51:29,880 had faith in him that he is going to figure it out. And he did. And I've worked for him 565 00:51:29,940 --> 00:51:35,890 now for the last couple years. And, unfortunately, I had been fired by him because the program 566 00:51:35,890 --> 00:51:42,529 is ending. But congratulations, guy, you really did good. 567 00:51:42,529 --> 00:51:45,490 Thanks, Dan. Thank you. 568 00:51:45,490 --> 00:51:52,140 (Applause). I just want to say something super quick. 569 00:51:52,140 --> 00:51:57,410 We're hackers, and we're individualists, and we hate anyone speaking for us. But Mudge 570 00:51:57,410 --> 00:52:01,170 is pretty much the only guy that I'll let speak for me any time he wants. 571 00:52:01,170 --> 00:52:01,759 (Applause) (End of session) 572 00:52:01,759 --> 00:52:02,199 (6:00 p.m. PT)