1
00:00:00,000 --> 00:00:06,220
Good morning, everyone, and welcome to the Packard Hacking Village at Debt Fund 25 in Las Vegas, Nevada.

2
00:00:11,080 --> 00:00:20,020
First and foremost, on a personal note, we cannot thank you enough for all the support, for your contributions, for all these years.

3
00:00:21,000 --> 00:00:33,260
If it wasn't for all of you and for your support, we would not be here. It's such a big village and such a strong support. So we are very, very, very grateful for that.

4
00:00:34,120 --> 00:00:39,660
The Wallachian mission is and has always been on security awareness.

5
00:00:41,120 --> 00:00:47,460
This year, the Packard Hacking Village have a number of events and learning opportunities,

6
00:00:48,220 --> 00:00:49,600
including the venerable

7
00:00:49,600 --> 00:00:50,000
Appalachian

8
00:00:50,020 --> 00:00:54,540
Packard Detective, which is a Neapolitan, and Captor the Package.

9
00:00:56,200 --> 00:00:57,900
We also have the fantastic

10
00:00:58,540 --> 00:01:01,200
Slave of DJs to keep the village entertained.

11
00:01:02,220 --> 00:01:03,800
Okay? Even nice and

12
00:01:03,800 --> 00:01:04,660
entertained and lively.

13
00:01:05,280 --> 00:01:07,800
This year, Cheap City and Honeypots

14
00:01:07,800 --> 00:01:10,000
are back. We are also

15
00:01:10,000 --> 00:01:11,900
very excited that we have something

16
00:01:11,900 --> 00:01:13,340
new in store for this year.

17
00:01:13,900 --> 00:01:15,200
Hands-on workshops.

18
00:01:15,320 --> 00:01:17,380
There is a tremendous demand

19
00:01:17,380 --> 00:01:19,380
for training and

20
00:01:19,380 --> 00:01:19,860
continuous

21
00:01:19,860 --> 00:01:20,000
training.

22
00:01:20,020 --> 00:01:35,100
We hope that you will take advantage of the many opportunities here at the Packard Hacking Village and ultimately at DepCon to learn, to collaborate, and to be inspired.

23
00:01:36,160 --> 00:01:39,760
And of course, here we are at the Speaker workshops.

24
00:01:41,300 --> 00:01:47,600
This is a very special year for this event, the Speaker workshops and the Packard Hacking Village.

25
00:01:47,660 --> 00:01:50,000
This is the fifth anniversary of the Packard Hacking Village.

26
00:01:50,020 --> 00:01:56,840
the Speaker Workshops. We are going to kick it off right off the bat with a very, very special keynote.

27
00:01:57,800 --> 00:02:03,940
Dan Gere said in this keynote at Black Act 2014, and I quote,

28
00:02:05,200 --> 00:02:14,780
Titan security is now a riveting concern, a top issue in many venues more important than this one.

29
00:02:15,560 --> 00:02:22,520
Or in that way he said bluntly at the 11th poll last year in 2016 in New York City, and I quote,

30
00:02:23,100 --> 00:02:28,280
We are now in a national security crisis, cyber security crisis.

31
00:02:29,140 --> 00:02:32,500
So what does this have to do with the keynote this morning?

32
00:02:33,600 --> 00:02:40,320
There are maybe not many people starting to enter or study cyber security, which is very, very welcoming to see.

33
00:02:41,580 --> 00:02:44,760
However, the body of knowledge is now too deep.

34
00:02:44,780 --> 00:02:47,780
It's too deep and intimidating to grasp, and history can be easily forgotten.

35
00:02:48,660 --> 00:02:51,280
How did we get into this mess in the first place?

36
00:02:51,900 --> 00:02:57,960
In May of 1998, a group of hackers testified in front of a panel of U.S. senators.

37
00:02:58,600 --> 00:03:02,240
They had the group of Locke, based out of Boston, Massachusetts.

38
00:03:03,520 --> 00:03:08,140
One of the members of Locke testified for the 12th time, for twice awful.

39
00:03:08,900 --> 00:03:12,740
Locke warned that the Internet, the software, and the hardware

40
00:03:12,740 --> 00:03:14,640
are not safe and secure.

41
00:03:14,780 --> 00:03:15,960
Security is an afterthought.

42
00:03:18,340 --> 00:03:25,620
Their warning was a disaster porthole, and as we all know, tragically ignored.

43
00:03:25,960 --> 00:03:29,960
On a side note, please read the wonderful Washington Post article,

44
00:03:30,000 --> 00:03:33,360
A Disaster Porthole and Ignored.

45
00:03:34,940 --> 00:03:40,520
Their warning and efforts also took a way from many of our careers

46
00:03:41,560 --> 00:03:43,680
and lifestyles in this field,

47
00:03:43,680 --> 00:03:44,740
including mine.

48
00:03:46,360 --> 00:03:50,940
And why many of us are here today at Desmond.

49
00:03:51,480 --> 00:03:57,520
It is my fantastic honor to introduce you all to the keynote we had this morning

50
00:03:57,520 --> 00:04:00,440
at your conference speaker workshop for twice awful.

51
00:04:05,880 --> 00:04:10,800
Thank you very much, and thank you for that warm, warm, very warm welcome.

52
00:04:11,640 --> 00:04:14,120
And it's a pleasure to be here speaking today.

53
00:04:14,840 --> 00:04:17,360
My first time speaking at the Packet Hacking Village.

54
00:04:18,620 --> 00:04:22,900
And, you know, since it was the 25th anniversary of DEFCON,

55
00:04:22,960 --> 00:04:24,640
I've been coming since DEFCON 4.

56
00:04:24,940 --> 00:04:29,360
I think I missed a few along the way, but I thought, you know,

57
00:04:29,360 --> 00:04:33,580
why not have a bit of a retrospective to talk about how we got here

58
00:04:34,320 --> 00:04:39,240
and what an impact hackers had on the security industry,

59
00:04:39,240 --> 00:04:42,040
and really made the security industry what it is today.

60
00:04:42,300 --> 00:04:47,180
It would be very, very different if it wasn't for the input of people

61
00:04:47,180 --> 00:04:51,520
who are doing independent research and taking that hacker mindset.

62
00:04:53,540 --> 00:04:57,080
So I'll start off where Ming started off here with,

63
00:04:57,640 --> 00:05:05,000
this was the picture of the gang of us testifying before the Senate in May 1998.

64
00:05:06,580 --> 00:05:08,160
If you can't recognize me,

65
00:05:09,240 --> 00:05:10,140
my hair's a little different.

66
00:05:10,920 --> 00:05:12,160
I still have the goatee.

67
00:05:12,200 --> 00:05:16,140
It was a little bigger back then, but you might, you probably can't see it,

68
00:05:16,220 --> 00:05:19,340
but on the placards there in the front, you can see

69
00:05:19,340 --> 00:05:21,960
Tan, KingPing, Mudge, Walt Mons, Maze Road.

70
00:05:23,100 --> 00:05:26,200
And there's kind of an interesting aspect to this is

71
00:05:26,900 --> 00:05:29,520
when we got invited to come speak,

72
00:05:30,500 --> 00:05:34,980
we said, well, we'll only do it under our hacker aliases.

73
00:05:35,780 --> 00:05:36,640
And they said, why?

74
00:05:37,560 --> 00:05:39,220
And they said, because we have data.

75
00:05:39,240 --> 00:05:39,440
We have data jobs.

76
00:05:40,140 --> 00:05:45,340
And back in 1998, if you were called a hacker

77
00:05:45,340 --> 00:05:49,260
and you had hands-on keyboards at some IT,

78
00:05:49,480 --> 00:05:52,760
in an IT admin responsibility,

79
00:05:53,320 --> 00:05:56,740
they might say, we don't want someone like that with that kind of responsibility.

80
00:05:57,060 --> 00:05:58,300
You might lose your job.

81
00:05:59,580 --> 00:06:04,880
And so that was the mindset back then because it hadn't changed yet.

82
00:06:05,120 --> 00:06:07,900
I don't think you'd have that today if you said,

83
00:06:07,900 --> 00:06:10,120
hey, I call myself a hacker and I go to DEF CON.

84
00:06:10,800 --> 00:06:13,880
They'd probably say, hey, we need to give you more responsibility.

85
00:06:15,240 --> 00:06:18,420
But back then, it wasn't like that.

86
00:06:19,380 --> 00:06:21,080
But how did we get to this point?

87
00:06:21,580 --> 00:06:22,900
This is around 1998.

88
00:06:23,380 --> 00:06:26,040
Things had to happen before that, before we got invited.

89
00:06:26,480 --> 00:06:30,340
And what I like to say is we made trouble.

90
00:06:31,540 --> 00:06:32,840
We got noticed.

91
00:06:33,620 --> 00:06:34,860
And how did we do that?

92
00:06:34,980 --> 00:06:35,920
We made people upset.

93
00:06:35,920 --> 00:06:41,040
We didn't break the law, as far as I can talk about today.

94
00:06:43,440 --> 00:06:45,900
But we did make people upset.

95
00:06:46,320 --> 00:06:48,600
People didn't like the idea of full disclosure.

96
00:06:49,600 --> 00:06:51,660
Microsoft really didn't like that.

97
00:06:51,820 --> 00:06:54,420
They didn't like us putting out documentation

98
00:06:54,420 --> 00:06:57,520
how their password storage mechanism sucks.

99
00:06:57,860 --> 00:07:00,220
They didn't like that because then all their customers,

100
00:07:00,420 --> 00:07:04,400
including banks and the DOD,

101
00:07:04,600 --> 00:07:05,240
would say,

102
00:07:05,920 --> 00:07:07,080
your software is insecure.

103
00:07:07,320 --> 00:07:07,640
It sucks.

104
00:07:07,740 --> 00:07:08,240
Fix it.

105
00:07:08,540 --> 00:07:09,880
And that costs them money.

106
00:07:09,980 --> 00:07:10,980
It makes them look bad.

107
00:07:12,220 --> 00:07:18,560
So by causing trouble and causing pain for other organizations,

108
00:07:18,800 --> 00:07:21,380
we actually raised a lot of awareness

109
00:07:21,380 --> 00:07:24,040
to the kind of problems that were out there.

110
00:07:24,580 --> 00:07:27,040
And we kind of stumbled upon this.

111
00:07:27,100 --> 00:07:31,660
I can't say that there was a master plan.

112
00:07:32,220 --> 00:07:35,420
We just started taking our research

113
00:07:35,420 --> 00:07:38,440
and instead of just sort of posting it to bug track

114
00:07:39,180 --> 00:07:42,320
and being very academic about it,

115
00:07:42,460 --> 00:07:47,720
we decided that we really should be more consumer advocate focused.

116
00:07:47,960 --> 00:07:49,880
We should take the research,

117
00:07:50,040 --> 00:07:52,240
instead of being just pure technical research,

118
00:07:52,580 --> 00:07:58,320
we should think of it as vendors are doing bad things

119
00:07:58,320 --> 00:07:59,500
that are harming consumers.

120
00:08:00,280 --> 00:08:03,580
And that really started around 1995 or so.

121
00:08:03,580 --> 00:08:05,720
And it changed it from like,

122
00:08:05,880 --> 00:08:07,600
oh, I know how to break into your system,

123
00:08:07,660 --> 00:08:09,520
to wait a minute,

124
00:08:10,240 --> 00:08:12,080
the vendors are shipping code

125
00:08:12,080 --> 00:08:15,160
that is causing this problem for their customers.

126
00:08:15,920 --> 00:08:20,580
And I think that was a big sort of paradigm shift

127
00:08:21,900 --> 00:08:24,920
that caused hackers to be that force

128
00:08:26,740 --> 00:08:31,300
that was siding with the user.

129
00:08:31,540 --> 00:08:32,600
If you fight for the user,

130
00:08:32,600 --> 00:08:33,920
you know, what is that, the Tron line?

131
00:08:35,220 --> 00:08:37,880
And so by sort of causing trouble,

132
00:08:38,540 --> 00:08:39,620
we got noticed.

133
00:08:39,920 --> 00:08:44,500
And that is how the Senate came to us saying,

134
00:08:44,740 --> 00:08:48,060
you know, you guys have an angle on this

135
00:08:48,060 --> 00:08:51,300
that's different than what we're hearing from big vendors.

136
00:08:51,480 --> 00:08:52,740
It's different than what we're hearing

137
00:08:52,740 --> 00:08:54,300
from the government accounting office,

138
00:08:54,440 --> 00:08:56,280
which is really just going through a checklist saying,

139
00:08:56,340 --> 00:08:57,520
you didn't figure this correctly,

140
00:08:57,640 --> 00:08:58,740
you didn't figure this correctly.

141
00:08:59,040 --> 00:09:00,900
And that's how the government thought about it.

142
00:09:01,000 --> 00:09:02,040
And we,

143
00:09:02,040 --> 00:09:03,440
we basically said,

144
00:09:03,520 --> 00:09:04,860
hey, the vendors can do better.

145
00:09:05,540 --> 00:09:07,720
They can ship things that are secure by default.

146
00:09:08,040 --> 00:09:09,280
They can ship things that aren't,

147
00:09:09,280 --> 00:09:10,120
aren't as broken.

148
00:09:11,540 --> 00:09:13,580
The problem was the vendors didn't know how to do that yet.

149
00:09:13,680 --> 00:09:14,180
But we'll get,

150
00:09:14,200 --> 00:09:15,080
we'll, we'll, we'll get it.

151
00:09:17,820 --> 00:09:19,760
So now I just want to go back

152
00:09:21,160 --> 00:09:24,880
to what the computer security was

153
00:09:24,880 --> 00:09:27,480
before hackers came onto the scene

154
00:09:27,480 --> 00:09:30,220
and started to inject themselves into the dialogue.

155
00:09:30,740 --> 00:09:31,180
Um,

156
00:09:32,040 --> 00:09:33,820
we had the famous orange book,

157
00:09:34,580 --> 00:09:35,620
Common Criteria,

158
00:09:36,400 --> 00:09:37,320
which was,

159
00:09:38,040 --> 00:09:38,360
um,

160
00:09:38,620 --> 00:09:41,060
basically a lot of things that you should do

161
00:09:41,060 --> 00:09:42,360
to build a secure system.

162
00:09:43,260 --> 00:09:46,340
You know, you need all those features and functionality.

163
00:09:46,340 --> 00:09:47,400
You need your encryption,

164
00:09:47,560 --> 00:09:48,240
your authorization,

165
00:09:49,540 --> 00:09:51,920
you need your logging and your auditing

166
00:09:51,920 --> 00:09:52,760
and all of that.

167
00:09:53,080 --> 00:09:53,600
Um,

168
00:09:55,020 --> 00:09:56,240
but it left out,

169
00:09:56,260 --> 00:09:59,420
it left out the fact that there could be mistakes

170
00:10:00,100 --> 00:10:01,160
in the software.

171
00:10:02,120 --> 00:10:04,440
That the engineers might actually make mistakes.

172
00:10:05,200 --> 00:10:05,900
That was,

173
00:10:05,900 --> 00:10:06,080
that,

174
00:10:06,180 --> 00:10:07,100
they didn't even think about that.

175
00:10:07,320 --> 00:10:08,000
It's not in,

176
00:10:08,080 --> 00:10:09,820
this is not in that book at all.

177
00:10:10,540 --> 00:10:12,440
Who has software that has bugs in it?

178
00:10:14,080 --> 00:10:15,760
Software has always had bugs in it.

179
00:10:16,160 --> 00:10:16,600
Yet,

180
00:10:16,720 --> 00:10:19,260
this was completely ignored in the orange book.

181
00:10:19,540 --> 00:10:20,200
It's like,

182
00:10:20,220 --> 00:10:21,720
it's like the software was perfect.

183
00:10:22,660 --> 00:10:25,260
You'd have great security if you followed the orange book

184
00:10:25,260 --> 00:10:26,880
if you made perfect software.

185
00:10:27,340 --> 00:10:28,820
Well, we all know that doesn't exist.

186
00:10:29,460 --> 00:10:29,900
Right?

187
00:10:29,900 --> 00:10:30,360
So,

188
00:10:30,580 --> 00:10:30,800
um,

189
00:10:31,040 --> 00:10:32,580
that was just a gaping,

190
00:10:32,580 --> 00:10:33,020
gaping,

191
00:10:33,020 --> 00:10:33,960
gaping huge hole

192
00:10:33,960 --> 00:10:36,540
that hackers came on the scene and said,

193
00:10:36,640 --> 00:10:38,120
you guys have this gaping hole

194
00:10:38,120 --> 00:10:39,640
in the way you're building systems.

195
00:10:40,340 --> 00:10:42,240
You're building systems with bugs in them.

196
00:10:42,580 --> 00:10:44,260
And we're gonna exploit those bugs

197
00:10:44,260 --> 00:10:46,080
and we're gonna bypass all of your controls.

198
00:10:46,900 --> 00:10:47,340
Um,

199
00:10:47,420 --> 00:10:47,960
the other,

200
00:10:47,960 --> 00:10:48,480
the other,

201
00:10:48,600 --> 00:10:48,780
uh,

202
00:10:48,840 --> 00:10:51,340
aspect of the way computer security was,

203
00:10:51,420 --> 00:10:52,220
was thought of was,

204
00:10:52,280 --> 00:10:52,820
was CERT.

205
00:10:54,120 --> 00:10:54,560
And,

206
00:10:54,620 --> 00:10:54,760
uh,

207
00:10:54,940 --> 00:10:56,980
CERT was formed after the Morris worm

208
00:10:56,980 --> 00:10:58,320
in order to,

209
00:10:58,320 --> 00:10:58,920
you know,

210
00:10:58,940 --> 00:11:01,220
basically put information out there

211
00:11:01,220 --> 00:11:02,300
when they knew,

212
00:11:02,360 --> 00:11:03,840
when there was attacks that happened.

213
00:11:04,040 --> 00:11:05,160
The problem was,

214
00:11:05,260 --> 00:11:07,180
this was really a government funded

215
00:11:07,180 --> 00:11:09,660
and a government organized with a government mindset.

216
00:11:10,160 --> 00:11:10,640
And,

217
00:11:10,740 --> 00:11:12,440
and the mindset back then was

218
00:11:12,440 --> 00:11:15,000
sort of like the intelligence communities today

219
00:11:15,000 --> 00:11:15,720
is like,

220
00:11:15,820 --> 00:11:16,120
yeah,

221
00:11:16,180 --> 00:11:17,700
we'll hoover up a lot of information.

222
00:11:17,900 --> 00:11:18,820
We'll analyze it

223
00:11:18,820 --> 00:11:20,560
and then we'll give out the information to you

224
00:11:20,560 --> 00:11:21,660
that we think you should have.

225
00:11:22,460 --> 00:11:22,940
Right?

226
00:11:23,020 --> 00:11:24,420
So basically CERT was,

227
00:11:24,540 --> 00:11:26,160
they wanted to be in control

228
00:11:26,700 --> 00:11:27,180
of

229
00:11:27,800 --> 00:11:28,840
vulnerability information,

230
00:11:29,680 --> 00:11:30,720
weaknesses in,

231
00:11:30,740 --> 00:11:31,280
in software,

232
00:11:31,640 --> 00:11:32,120
uh,

233
00:11:32,260 --> 00:11:33,380
weaknesses in configuration.

234
00:11:33,720 --> 00:11:35,020
They wanted to be in control

235
00:11:35,020 --> 00:11:36,020
and manage

236
00:11:36,020 --> 00:11:38,300
how the public knew about weaknesses.

237
00:11:38,440 --> 00:11:41,060
So if you reported something to CERT in 1993,

238
00:11:41,860 --> 00:11:43,740
it might just go into a black hole.

239
00:11:44,340 --> 00:11:46,700
And they might stop communicating with you.

240
00:11:47,420 --> 00:11:48,220
They said,

241
00:11:48,320 --> 00:11:48,460
hey,

242
00:11:49,140 --> 00:11:49,860
we're the good guys.

243
00:11:50,020 --> 00:11:51,740
Send the information to us

244
00:11:51,740 --> 00:11:52,600
and we'll make sure

245
00:11:52,600 --> 00:11:54,980
that security gets better.

246
00:11:55,740 --> 00:11:57,100
But what we found out

247
00:11:57,100 --> 00:11:58,900
was we would send them information

248
00:11:58,900 --> 00:12:00,460
and we didn't know what,

249
00:12:00,460 --> 00:12:00,640
what,

250
00:12:00,640 --> 00:12:01,520
what happened to it.

251
00:12:02,080 --> 00:12:02,960
We didn't even know

252
00:12:02,960 --> 00:12:04,020
if they contacted the vendor.

253
00:12:04,180 --> 00:12:05,120
We don't even know

254
00:12:05,120 --> 00:12:06,640
if the vendor patched the software

255
00:12:06,640 --> 00:12:08,380
or what patch was available

256
00:12:08,380 --> 00:12:09,400
to fix the issue

257
00:12:09,400 --> 00:12:10,360
we might have told them.

258
00:12:10,500 --> 00:12:12,200
So it was a total black hole

259
00:12:12,200 --> 00:12:13,260
and it didn't work.

260
00:12:13,440 --> 00:12:14,820
So that government mindset

261
00:12:14,820 --> 00:12:15,420
of closed,

262
00:12:15,560 --> 00:12:16,500
controlled information,

263
00:12:17,140 --> 00:12:17,620
um,

264
00:12:17,740 --> 00:12:18,600
just doesn't work

265
00:12:18,600 --> 00:12:19,800
when it comes to,

266
00:12:19,800 --> 00:12:20,020
uh,

267
00:12:20,720 --> 00:12:22,460
comes to securing our,

268
00:12:22,500 --> 00:12:23,020
our world.

269
00:12:24,460 --> 00:12:25,740
So in 1993,

270
00:12:25,840 --> 00:12:27,040
I was just starting to get into

271
00:12:27,100 --> 00:12:27,280
security.

272
00:12:27,280 --> 00:12:27,900
I was involved with The Loft

273
00:12:27,900 --> 00:12:28,980
at that time

274
00:12:28,980 --> 00:12:30,200
and I got introduced

275
00:12:30,200 --> 00:12:30,880
to this paper,

276
00:12:31,040 --> 00:12:32,700
Improving the Security of Your Site

277
00:12:32,700 --> 00:12:33,720
by Breaking Into It.

278
00:12:34,180 --> 00:12:34,840
And to me,

279
00:12:34,920 --> 00:12:35,540
this was

280
00:12:36,860 --> 00:12:37,320
a,

281
00:12:37,320 --> 00:12:37,480
a,

282
00:12:37,480 --> 00:12:38,560
a seminal paper.

283
00:12:38,880 --> 00:12:39,340
Um,

284
00:12:39,420 --> 00:12:40,440
if you've never read it,

285
00:12:40,460 --> 00:12:41,520
go out there and read it

286
00:12:41,520 --> 00:12:42,720
because this is what really,

287
00:12:42,780 --> 00:12:43,840
they really codified,

288
00:12:44,460 --> 00:12:44,920
really,

289
00:12:45,060 --> 00:12:45,400
how,

290
00:12:45,600 --> 00:12:46,580
how the hacker mindset

291
00:12:47,600 --> 00:12:48,500
can be used

292
00:12:48,500 --> 00:12:49,220
to secure systems.

293
00:12:50,280 --> 00:12:50,740
Basically,

294
00:12:50,780 --> 00:12:52,240
what this paper said was,

295
00:12:52,320 --> 00:12:53,340
why don't you study

296
00:12:53,340 --> 00:12:54,200
how your systems

297
00:12:54,200 --> 00:12:55,220
are being compromised,

298
00:12:56,380 --> 00:12:56,840
see,

299
00:12:56,840 --> 00:12:58,240
look at the technique

300
00:12:58,240 --> 00:12:58,800
they're using

301
00:12:58,800 --> 00:13:00,100
to compromise the system,

302
00:13:00,260 --> 00:13:01,040
and then,

303
00:13:01,100 --> 00:13:01,560
basically,

304
00:13:01,700 --> 00:13:02,960
test all your other systems

305
00:13:02,960 --> 00:13:03,740
to see if they have

306
00:13:03,740 --> 00:13:04,300
that problem.

307
00:13:05,900 --> 00:13:06,380
It,

308
00:13:06,420 --> 00:13:06,960
I mean,

309
00:13:06,980 --> 00:13:08,260
it seems completely obvious

310
00:13:08,260 --> 00:13:08,800
today,

311
00:13:09,200 --> 00:13:09,560
right?

312
00:13:09,840 --> 00:13:11,300
But back in 1993,

313
00:13:11,580 --> 00:13:12,260
this was actually

314
00:13:12,260 --> 00:13:13,060
a new concept.

315
00:13:13,600 --> 00:13:14,860
People who did security

316
00:13:14,860 --> 00:13:16,180
for a corporate network

317
00:13:16,180 --> 00:13:17,340
did not do this.

318
00:13:17,760 --> 00:13:19,160
They didn't do this at all.

319
00:13:19,760 --> 00:13:20,480
And so,

320
00:13:20,660 --> 00:13:21,180
um,

321
00:13:21,280 --> 00:13:21,460
what,

322
00:13:21,540 --> 00:13:22,340
what Dan Farmer

323
00:13:22,340 --> 00:13:23,240
and Weeti Venema did

324
00:13:23,240 --> 00:13:24,940
was they started collecting

325
00:13:24,940 --> 00:13:26,100
information about

326
00:13:26,100 --> 00:13:27,380
how systems were compromised.

327
00:13:27,720 --> 00:13:29,040
It was a trust violation

328
00:13:29,040 --> 00:13:29,780
with,

329
00:13:29,880 --> 00:13:30,140
you know,

330
00:13:31,060 --> 00:13:31,760
exploiting trust

331
00:13:31,760 --> 00:13:32,740
with our hosts.

332
00:13:32,900 --> 00:13:34,220
Was it a weak password?

333
00:13:34,980 --> 00:13:35,080
Um,

334
00:13:35,300 --> 00:13:36,020
was it,

335
00:13:36,020 --> 00:13:36,520
was it a,

336
00:13:36,520 --> 00:13:37,600
a well-known bug?

337
00:13:38,380 --> 00:13:39,900
And they started

338
00:13:39,900 --> 00:13:40,860
to script these up

339
00:13:40,860 --> 00:13:41,780
and,

340
00:13:41,880 --> 00:13:42,180
um,

341
00:13:42,380 --> 00:13:42,920
put them,

342
00:13:42,960 --> 00:13:43,640
put them together.

343
00:13:44,740 --> 00:13:45,240
And,

344
00:13:45,460 --> 00:13:45,720
um,

345
00:13:45,940 --> 00:13:47,520
what they really did was

346
00:13:47,520 --> 00:13:48,080
they made

347
00:13:48,900 --> 00:13:49,900
information security

348
00:13:49,900 --> 00:13:51,300
a participatory sport.

349
00:13:51,680 --> 00:13:52,940
There was this give and take

350
00:13:52,940 --> 00:13:53,780
between the attacker

351
00:13:53,780 --> 00:13:54,920
and the defender

352
00:13:54,940 --> 00:13:56,580
where the attacker learns,

353
00:13:56,700 --> 00:13:57,900
the defender can learn

354
00:13:57,900 --> 00:13:58,600
from the attacker.

355
00:13:58,980 --> 00:13:59,580
And,

356
00:13:59,780 --> 00:14:00,020
um,

357
00:14:00,340 --> 00:14:00,500
uh,

358
00:14:00,540 --> 00:14:02,140
so studying the way

359
00:14:02,140 --> 00:14:02,880
attackers behave

360
00:14:02,880 --> 00:14:04,020
or simulating

361
00:14:04,020 --> 00:14:05,460
how an attack might happen

362
00:14:05,460 --> 00:14:06,440
or practicing

363
00:14:06,440 --> 00:14:07,440
red teaming,

364
00:14:07,480 --> 00:14:07,900
right,

365
00:14:08,080 --> 00:14:08,700
um,

366
00:14:08,740 --> 00:14:09,620
were all things

367
00:14:09,620 --> 00:14:10,940
that hackers brought

368
00:14:10,940 --> 00:14:11,580
to the table.

369
00:14:11,680 --> 00:14:13,060
And they made security

370
00:14:13,060 --> 00:14:14,520
an active participatory,

371
00:14:14,660 --> 00:14:15,200
uh,

372
00:14:15,300 --> 00:14:15,700
activity

373
00:14:15,700 --> 00:14:17,380
as opposed to a static

374
00:14:17,940 --> 00:14:18,620
configure,

375
00:14:18,780 --> 00:14:19,380
configuration

376
00:14:19,700 --> 00:14:20,380
of features

377
00:14:20,920 --> 00:14:21,260
and,

378
00:14:21,320 --> 00:14:21,960
and technology.

379
00:14:23,760 --> 00:14:24,440
Um,

380
00:14:24,660 --> 00:14:26,080
so around this time

381
00:14:26,080 --> 00:14:27,020
we started to see

382
00:14:27,020 --> 00:14:27,600
the first,

383
00:14:28,020 --> 00:14:29,320
the first hacker tools.

384
00:14:29,880 --> 00:14:30,380
You know,

385
00:14:30,400 --> 00:14:31,700
we have so many tools today.

386
00:14:31,820 --> 00:14:32,740
It's completely awesome

387
00:14:32,740 --> 00:14:33,540
how many people

388
00:14:33,540 --> 00:14:34,600
write great tools

389
00:14:34,600 --> 00:14:35,640
and put them out there.

390
00:14:35,820 --> 00:14:36,600
But these are some

391
00:14:36,600 --> 00:14:37,680
of the very first ones,

392
00:14:37,860 --> 00:14:38,320
um,

393
00:14:38,480 --> 00:14:38,760
that,

394
00:14:38,840 --> 00:14:39,840
that came to the table.

395
00:14:40,100 --> 00:14:40,500
Um,

396
00:14:40,680 --> 00:14:41,060
you know,

397
00:14:41,080 --> 00:14:41,160
I,

398
00:14:41,280 --> 00:14:41,440
I,

399
00:14:41,440 --> 00:14:42,560
I was looking sort of

400
00:14:42,560 --> 00:14:42,820
for the,

401
00:14:42,860 --> 00:14:43,640
what was the first,

402
00:14:43,700 --> 00:14:44,260
you know,

403
00:14:44,280 --> 00:14:44,980
hacker mindset

404
00:14:44,980 --> 00:14:45,880
kind of tool.

405
00:14:46,000 --> 00:14:46,240
And I,

406
00:14:46,240 --> 00:14:47,340
I think it really was Crack

407
00:14:47,340 --> 00:14:48,260
by Alec Muffet.

408
00:14:48,260 --> 00:14:50,380
He came up with the idea

409
00:14:50,380 --> 00:14:51,300
that,

410
00:14:51,380 --> 00:14:52,040
um,

411
00:14:52,300 --> 00:14:53,620
you could test the strength

412
00:14:53,620 --> 00:14:54,360
of your passwords

413
00:14:54,940 --> 00:14:56,420
and see if they're guessable.

414
00:14:56,940 --> 00:14:57,420
Right?

415
00:14:57,500 --> 00:14:58,460
It makes perfect sense,

416
00:14:58,680 --> 00:14:58,840
right?

417
00:14:58,980 --> 00:14:59,400
Like,

418
00:14:59,500 --> 00:15:00,340
why not

419
00:15:01,060 --> 00:15:02,300
see if your users

420
00:15:02,300 --> 00:15:03,680
are using weak passwords

421
00:15:03,680 --> 00:15:05,360
and tell them to fix it?

422
00:15:05,700 --> 00:15:06,180
Right?

423
00:15:06,320 --> 00:15:06,900
But again,

424
00:15:07,020 --> 00:15:08,400
it takes that hacker mindset

425
00:15:08,400 --> 00:15:09,500
to do that.

426
00:15:09,620 --> 00:15:10,520
The normal security

427
00:15:10,520 --> 00:15:11,380
person's mindset

428
00:15:11,380 --> 00:15:12,200
didn't do that.

429
00:15:12,260 --> 00:15:12,880
It took the hack,

430
00:15:12,920 --> 00:15:13,560
hacker mindset

431
00:15:13,560 --> 00:15:14,740
to kind of change that.

432
00:15:15,400 --> 00:15:16,660
And this was a radical

433
00:15:16,660 --> 00:15:17,680
notion back then.

434
00:15:17,780 --> 00:15:18,240
Again,

435
00:15:18,260 --> 00:15:19,360
it seems completely obvious

436
00:15:19,360 --> 00:15:19,900
today,

437
00:15:20,160 --> 00:15:21,200
but it really was

438
00:15:21,200 --> 00:15:22,040
a radical notion.

439
00:15:22,200 --> 00:15:22,940
It was so radical

440
00:15:22,940 --> 00:15:24,520
that Randall Schwartz,

441
00:15:24,640 --> 00:15:25,240
who was

442
00:15:25,240 --> 00:15:25,980
assistant administrator

443
00:15:25,980 --> 00:15:26,800
at Intel,

444
00:15:27,000 --> 00:15:27,680
got fired

445
00:15:27,680 --> 00:15:28,700
for running Crack

446
00:15:28,700 --> 00:15:29,700
on the systems

447
00:15:29,700 --> 00:15:31,300
that he was responsible for.

448
00:15:31,600 --> 00:15:32,740
He was responsible

449
00:15:32,740 --> 00:15:33,660
for the security

450
00:15:33,660 --> 00:15:34,480
of the system.

451
00:15:34,700 --> 00:15:35,840
He ran Crack

452
00:15:35,840 --> 00:15:37,120
because he had read

453
00:15:37,120 --> 00:15:37,780
about the tool.

454
00:15:37,960 --> 00:15:39,040
He understood it.

455
00:15:39,080 --> 00:15:39,960
It made sense.

456
00:15:40,160 --> 00:15:40,620
I'm gonna see

457
00:15:40,620 --> 00:15:41,520
if any of my users

458
00:15:41,520 --> 00:15:42,020
are using,

459
00:15:42,080 --> 00:15:42,300
uh,

460
00:15:42,320 --> 00:15:43,180
guessable passwords.

461
00:15:44,010 --> 00:15:45,800
And someone caught him

462
00:15:45,800 --> 00:15:46,820
running this process

463
00:15:46,820 --> 00:15:47,720
and doing this

464
00:15:47,720 --> 00:15:48,000
and,

465
00:15:48,260 --> 00:15:48,980
and he,

466
00:15:49,020 --> 00:15:49,760
he got fired

467
00:15:49,760 --> 00:15:50,120
and charged

468
00:15:50,120 --> 00:15:50,860
with a felony

469
00:15:51,640 --> 00:15:53,300
for running a security

470
00:15:53,300 --> 00:15:53,680
tool,

471
00:15:53,800 --> 00:15:53,900
uh,

472
00:15:54,000 --> 00:15:55,000
a hacker tool.

473
00:15:55,240 --> 00:15:55,760
Right?

474
00:15:55,880 --> 00:15:56,520
It wasn't considered

475
00:15:56,520 --> 00:15:57,240
a security tool.

476
00:15:57,660 --> 00:15:58,180
Um,

477
00:15:59,280 --> 00:16:00,600
this example here

478
00:16:00,600 --> 00:16:00,960
is,

479
00:16:01,000 --> 00:16:01,160
uh,

480
00:16:01,340 --> 00:16:02,040
a program called

481
00:16:02,040 --> 00:16:02,440
Satan

482
00:16:02,440 --> 00:16:03,960
that Dan Farmer

483
00:16:03,960 --> 00:16:04,580
and Weedsy Venema

484
00:16:04,580 --> 00:16:04,900
wrote.

485
00:16:05,980 --> 00:16:07,200
And they were

486
00:16:07,200 --> 00:16:07,860
automating

487
00:16:07,860 --> 00:16:08,820
all the things

488
00:16:08,820 --> 00:16:09,640
that they were learning

489
00:16:09,640 --> 00:16:10,680
from attackers.

490
00:16:10,880 --> 00:16:11,560
Like I was saying,

491
00:16:11,640 --> 00:16:11,900
you know,

492
00:16:11,920 --> 00:16:13,020
secure your network

493
00:16:13,020 --> 00:16:13,980
by breaking into it.

494
00:16:13,980 --> 00:16:14,620
They said,

495
00:16:14,660 --> 00:16:15,600
why don't we automate that

496
00:16:15,600 --> 00:16:16,300
and why don't we

497
00:16:16,300 --> 00:16:16,980
script it up?

498
00:16:17,400 --> 00:16:17,920
So,

499
00:16:17,940 --> 00:16:18,180
uh,

500
00:16:18,400 --> 00:16:18,640
Dan,

501
00:16:19,040 --> 00:16:19,680
um,

502
00:16:19,840 --> 00:16:20,720
wrote this tool

503
00:16:20,720 --> 00:16:22,240
and released it

504
00:16:22,860 --> 00:16:24,360
and he called it Satan.

505
00:16:24,820 --> 00:16:25,340
I'm

506
00:16:25,980 --> 00:16:26,540
not sure

507
00:16:26,540 --> 00:16:27,580
exactly what it is.

508
00:16:27,660 --> 00:16:28,120
System administrator

509
00:16:28,120 --> 00:16:28,740
toolkit

510
00:16:28,740 --> 00:16:29,880
or something like that.

511
00:16:30,320 --> 00:16:30,840
And,

512
00:16:30,920 --> 00:16:31,060
uh,

513
00:16:31,880 --> 00:16:33,100
once he released it,

514
00:16:33,160 --> 00:16:33,760
he got fired

515
00:16:33,760 --> 00:16:34,420
from his job

516
00:16:34,420 --> 00:16:34,960
at SGI.

517
00:16:36,160 --> 00:16:37,000
He was,

518
00:16:37,000 --> 00:16:37,180
uh,

519
00:16:37,220 --> 00:16:37,920
he was a programmer

520
00:16:37,920 --> 00:16:38,640
at SGI

521
00:16:38,640 --> 00:16:40,360
and they saw

522
00:16:40,360 --> 00:16:41,040
that he released

523
00:16:41,040 --> 00:16:41,920
a hacker tool

524
00:16:43,980 --> 00:16:44,080
and he said,

525
00:16:44,160 --> 00:16:44,920
we can't have a hacker

526
00:16:44,920 --> 00:16:45,740
working at our company

527
00:16:45,740 --> 00:16:46,380
that's releasing

528
00:16:46,380 --> 00:16:47,520
these bad hacker tools.

529
00:16:48,000 --> 00:16:48,800
This was really

530
00:16:48,800 --> 00:16:49,740
the first vulnerability

531
00:16:49,740 --> 00:16:50,220
scanner.

532
00:16:51,140 --> 00:16:51,580
Um,

533
00:16:52,740 --> 00:16:53,180
and,

534
00:16:53,300 --> 00:16:53,500
uh,

535
00:16:53,660 --> 00:16:54,980
now it's a huge market.

536
00:16:55,160 --> 00:16:56,000
It's a standard thing

537
00:16:56,000 --> 00:16:56,520
that you do.

538
00:16:56,680 --> 00:16:57,540
But there was someone

539
00:16:57,540 --> 00:16:58,060
who had the right

540
00:16:58,060 --> 00:16:58,600
to first one

541
00:16:58,600 --> 00:16:59,600
and the person

542
00:16:59,600 --> 00:17:00,620
who wrote the first one

543
00:17:00,620 --> 00:17:01,500
got fired.

544
00:17:02,060 --> 00:17:02,500
So,

545
00:17:02,580 --> 00:17:02,880
I,

546
00:17:02,980 --> 00:17:03,920
I think some of the theme

547
00:17:03,920 --> 00:17:04,700
that I'm trying to bring

548
00:17:04,700 --> 00:17:05,780
across is progress

549
00:17:05,780 --> 00:17:06,800
is made by people

550
00:17:06,800 --> 00:17:07,780
who are making trouble.

551
00:17:08,260 --> 00:17:09,240
They're doing things

552
00:17:09,240 --> 00:17:09,880
that other people

553
00:17:09,880 --> 00:17:10,460
don't like.

554
00:17:13,980 --> 00:17:14,700
They don't like the idea

555
00:17:14,700 --> 00:17:15,480
that these tools

556
00:17:15,480 --> 00:17:16,120
are out there

557
00:17:16,120 --> 00:17:16,720
that can break

558
00:17:16,720 --> 00:17:17,480
into their system

559
00:17:17,480 --> 00:17:18,420
because they don't understand.

560
00:17:19,120 --> 00:17:19,540
Um,

561
00:17:19,700 --> 00:17:19,940
and,

562
00:17:20,080 --> 00:17:20,340
you know,

563
00:17:20,380 --> 00:17:21,240
over the past,

564
00:17:21,320 --> 00:17:21,640
you know,

565
00:17:21,700 --> 00:17:22,340
20 years,

566
00:17:22,440 --> 00:17:23,320
we've gotten more people

567
00:17:23,320 --> 00:17:23,820
to understand,

568
00:17:24,020 --> 00:17:24,780
but there's still things

569
00:17:24,780 --> 00:17:25,560
that we have to do

570
00:17:25,560 --> 00:17:26,160
to make trouble

571
00:17:26,160 --> 00:17:27,220
to keep pushing,

572
00:17:27,260 --> 00:17:28,120
pushing the envelope.

573
00:17:29,440 --> 00:17:29,860
Um,

574
00:17:30,340 --> 00:17:30,920
and then,

575
00:17:30,980 --> 00:17:31,680
Hobbit wrote,

576
00:17:31,840 --> 00:17:32,080
um,

577
00:17:32,240 --> 00:17:33,540
Netcat in 1996,

578
00:17:34,400 --> 00:17:34,820
um,

579
00:17:35,000 --> 00:17:35,400
which,

580
00:17:35,500 --> 00:17:36,480
if you haven't played

581
00:17:36,480 --> 00:17:36,980
with Netcat,

582
00:17:37,080 --> 00:17:37,620
at least read

583
00:17:37,620 --> 00:17:38,380
the readme file.

584
00:17:43,980 --> 00:17:44,340
It's,

585
00:17:44,340 --> 00:17:45,400
it's just an awesome,

586
00:17:45,580 --> 00:17:46,120
um,

587
00:17:46,280 --> 00:17:47,120
look into

588
00:17:47,120 --> 00:17:48,100
the mind

589
00:17:48,100 --> 00:17:48,460
of someone

590
00:17:49,000 --> 00:17:49,520
deconstructing

591
00:17:49,520 --> 00:17:50,140
TCPIP

592
00:17:50,140 --> 00:17:51,300
and sockets.

593
00:17:52,200 --> 00:17:53,300
As far as I know,

594
00:17:53,320 --> 00:17:54,240
no one's been fired

595
00:17:54,240 --> 00:17:55,640
directly for using

596
00:17:55,640 --> 00:17:56,060
Netcat,

597
00:17:56,180 --> 00:17:56,360
but,

598
00:17:56,440 --> 00:17:56,880
who,

599
00:17:57,520 --> 00:17:59,140
things could still happen.

600
00:18:00,420 --> 00:18:01,120
And then,

601
00:18:01,140 --> 00:18:01,680
on the information

602
00:18:01,680 --> 00:18:02,660
resources side,

603
00:18:02,900 --> 00:18:03,680
who was sharing

604
00:18:03,680 --> 00:18:04,060
the information

605
00:18:04,060 --> 00:18:05,120
about all this,

606
00:18:05,140 --> 00:18:05,860
all these issues,

607
00:18:05,940 --> 00:18:06,500
how attackers

608
00:18:06,500 --> 00:18:07,160
were working?

609
00:18:07,520 --> 00:18:08,700
It was the hacker community.

610
00:18:09,280 --> 00:18:10,520
It was Bug Track,

611
00:18:10,760 --> 00:18:11,940
which started in 1993,

612
00:18:12,340 --> 00:18:13,080
the same year

613
00:18:13,980 --> 00:18:14,200
it started

614
00:18:14,200 --> 00:18:15,500
in 1993.

615
00:18:16,840 --> 00:18:17,400
And,

616
00:18:17,520 --> 00:18:17,980
and that,

617
00:18:17,980 --> 00:18:19,060
that really was the birth

618
00:18:19,060 --> 00:18:20,040
of a new form

619
00:18:20,040 --> 00:18:21,160
of information sharing

620
00:18:21,160 --> 00:18:22,200
that wasn't controlled

621
00:18:22,200 --> 00:18:22,980
by the government,

622
00:18:23,180 --> 00:18:23,780
wasn't controlled

623
00:18:23,780 --> 00:18:24,460
by CERT.

624
00:18:24,640 --> 00:18:25,340
It was

625
00:18:25,960 --> 00:18:26,620
people talking

626
00:18:26,620 --> 00:18:27,400
to other people.

627
00:18:27,860 --> 00:18:28,420
And,

628
00:18:28,600 --> 00:18:29,080
that's,

629
00:18:29,080 --> 00:18:29,940
that's really what started

630
00:18:29,940 --> 00:18:30,460
the openness

631
00:18:30,460 --> 00:18:31,820
that we needed

632
00:18:31,820 --> 00:18:32,300
to,

633
00:18:32,320 --> 00:18:32,460
uh,

634
00:18:32,560 --> 00:18:33,060
to secure,

635
00:18:33,260 --> 00:18:34,660
to secure our environment.

636
00:18:36,540 --> 00:18:37,100
The,

637
00:18:37,160 --> 00:18:37,760
the next step

638
00:18:37,760 --> 00:18:38,240
in this was

639
00:18:38,240 --> 00:18:39,320
hackers starting

640
00:18:39,320 --> 00:18:40,620
to write commercial software.

641
00:18:41,180 --> 00:18:41,900
This was

642
00:18:41,900 --> 00:18:42,840
hackers sort of

643
00:18:43,320 --> 00:18:44,080
moving into

644
00:18:44,080 --> 00:18:44,940
the commercial space.

645
00:18:45,500 --> 00:18:46,460
And I,

646
00:18:46,520 --> 00:18:47,080
I think really

647
00:18:47,080 --> 00:18:47,940
one of the first,

648
00:18:47,940 --> 00:18:48,540
the first,

649
00:18:48,620 --> 00:18:48,780
uh,

650
00:18:48,860 --> 00:18:49,700
commercial software

651
00:18:49,700 --> 00:18:50,400
written by a hacker

652
00:18:50,400 --> 00:18:50,680
was,

653
00:18:50,820 --> 00:18:50,940
uh,

654
00:18:51,140 --> 00:18:52,780
the Internet Security Scanner

655
00:18:52,780 --> 00:18:53,580
by,

656
00:18:53,660 --> 00:18:53,840
uh,

657
00:18:53,940 --> 00:18:54,620
by Chris Klaus.

658
00:18:55,340 --> 00:18:55,820
And,

659
00:18:55,880 --> 00:18:56,140
uh,

660
00:18:56,240 --> 00:18:57,160
we at the Loft

661
00:18:57,700 --> 00:18:58,520
started to think,

662
00:18:58,580 --> 00:18:58,760
hey,

663
00:19:00,340 --> 00:19:01,360
we could make

664
00:19:01,360 --> 00:19:02,420
a piece of software

665
00:19:02,420 --> 00:19:03,620
that is targeted

666
00:19:03,620 --> 00:19:05,380
at system administrators.

667
00:19:05,740 --> 00:19:05,980
You know,

668
00:19:06,000 --> 00:19:06,260
most,

669
00:19:06,360 --> 00:19:06,740
most,

670
00:19:06,900 --> 00:19:07,640
you know,

671
00:19:07,640 --> 00:19:08,720
tools that hackers write

672
00:19:08,720 --> 00:19:09,380
for other hackers

673
00:19:09,380 --> 00:19:09,740
are,

674
00:19:09,780 --> 00:19:10,960
are command line tools.

675
00:19:11,300 --> 00:19:11,880
You know,

676
00:19:11,900 --> 00:19:12,740
Alec Muffet's crack

677
00:19:12,740 --> 00:19:13,840
was a command line tool.

678
00:19:14,220 --> 00:19:15,300
What we learned was

679
00:19:15,300 --> 00:19:15,760
Windows,

680
00:19:15,820 --> 00:19:17,440
Windows NT administrators

681
00:19:17,440 --> 00:19:18,400
can't use that.

682
00:19:19,440 --> 00:19:19,920
Right?

683
00:19:19,980 --> 00:19:20,220
So,

684
00:19:20,340 --> 00:19:20,820
we,

685
00:19:20,900 --> 00:19:21,060
we,

686
00:19:21,080 --> 00:19:21,700
uh,

687
00:19:22,360 --> 00:19:23,660
we open sourced

688
00:19:23,660 --> 00:19:24,760
our command line version,

689
00:19:24,920 --> 00:19:25,920
but we built a,

690
00:19:25,940 --> 00:19:27,220
a version with the GUI,

691
00:19:27,240 --> 00:19:27,920
um,

692
00:19:28,100 --> 00:19:29,220
so that actual

693
00:19:29,220 --> 00:19:30,460
Windows NT administrators

694
00:19:30,460 --> 00:19:31,380
could use it.

695
00:19:31,500 --> 00:19:31,980
And,

696
00:19:32,060 --> 00:19:32,420
and we,

697
00:19:32,460 --> 00:19:33,140
and we sold that.

698
00:19:33,280 --> 00:19:33,560
And we said,

699
00:19:33,580 --> 00:19:33,700
hey,

700
00:19:33,700 --> 00:19:34,100
wait a minute,

701
00:19:34,240 --> 00:19:35,420
we can actually make money,

702
00:19:35,500 --> 00:19:36,260
um,

703
00:19:36,680 --> 00:19:37,460
you know,

704
00:19:37,480 --> 00:19:38,540
building the tools

705
00:19:38,540 --> 00:19:39,560
to help secure systems.

706
00:19:40,460 --> 00:19:41,420
So this again

707
00:19:41,420 --> 00:19:42,400
was another change

708
00:19:42,400 --> 00:19:42,980
of,

709
00:19:43,000 --> 00:19:43,280
of,

710
00:19:43,300 --> 00:19:44,300
of just becoming more

711
00:19:44,300 --> 00:19:45,480
of the security industry

712
00:19:45,480 --> 00:19:46,820
at the time.

713
00:19:48,320 --> 00:19:49,400
And then around,

714
00:19:49,560 --> 00:19:49,940
um,

715
00:19:50,020 --> 00:19:50,520
1998,

716
00:19:51,500 --> 00:19:52,060
um,

717
00:19:52,740 --> 00:19:54,140
we started to,

718
00:19:54,140 --> 00:19:54,500
uh,

719
00:19:54,620 --> 00:19:55,560
really interface

720
00:19:55,560 --> 00:19:56,240
with Microsoft.

721
00:19:56,340 --> 00:19:57,600
And we really started

722
00:19:57,600 --> 00:19:58,380
to tell Microsoft

723
00:19:58,380 --> 00:19:59,780
what was wrong

724
00:19:59,780 --> 00:20:00,700
with their

725
00:20:00,700 --> 00:20:01,440
networking protocols,

726
00:20:01,800 --> 00:20:02,620
what was wrong

727
00:20:02,620 --> 00:20:03,420
with the way that

728
00:20:03,700 --> 00:20:04,360
we were building things.

729
00:20:04,760 --> 00:20:06,380
And we came up

730
00:20:06,380 --> 00:20:06,940
with the notion,

731
00:20:07,180 --> 00:20:08,380
much like,

732
00:20:08,400 --> 00:20:08,700
um,

733
00:20:10,220 --> 00:20:10,740
uh,

734
00:20:10,820 --> 00:20:11,600
Dan Farmer

735
00:20:11,600 --> 00:20:11,980
and,

736
00:20:12,020 --> 00:20:12,700
and Weetzie's,

737
00:20:12,760 --> 00:20:12,980
uh,

738
00:20:13,220 --> 00:20:14,320
notion of improving

739
00:20:14,320 --> 00:20:15,040
your network

740
00:20:15,040 --> 00:20:16,380
by breaking into it.

741
00:20:16,500 --> 00:20:17,240
We said,

742
00:20:17,260 --> 00:20:17,380
well,

743
00:20:17,420 --> 00:20:17,880
wait a minute,

744
00:20:18,080 --> 00:20:19,840
what about improving

745
00:20:19,840 --> 00:20:21,140
the security of a product

746
00:20:21,140 --> 00:20:22,160
by breaking into it?

747
00:20:22,240 --> 00:20:23,220
So instead of looking at

748
00:20:23,220 --> 00:20:23,940
the whole network

749
00:20:23,940 --> 00:20:24,820
and finding the weaknesses

750
00:20:24,820 --> 00:20:25,600
in the network,

751
00:20:26,280 --> 00:20:27,640
why not look at,

752
00:20:27,680 --> 00:20:28,040
isolate,

753
00:20:28,400 --> 00:20:29,580
look at one piece

754
00:20:29,580 --> 00:20:30,240
of software,

755
00:20:30,980 --> 00:20:32,140
put that software

756
00:20:32,140 --> 00:20:32,620
in,

757
00:20:32,620 --> 00:20:33,560
in a lab environment

758
00:20:34,360 --> 00:20:35,740
with your debugger,

759
00:20:35,880 --> 00:20:36,540
your,

760
00:20:36,640 --> 00:20:38,180
your packet capture,

761
00:20:38,940 --> 00:20:39,440
and,

762
00:20:39,560 --> 00:20:40,020
you know,

763
00:20:40,020 --> 00:20:40,480
and,

764
00:20:40,660 --> 00:20:40,800
uh,

765
00:20:40,800 --> 00:20:41,000
other,

766
00:20:41,100 --> 00:20:42,620
other reverse engineering tools,

767
00:20:42,820 --> 00:20:44,520
and start to think,

768
00:20:44,620 --> 00:20:44,780
hey,

769
00:20:44,820 --> 00:20:45,700
we can actually secure

770
00:20:45,700 --> 00:20:47,380
software by trying

771
00:20:47,380 --> 00:20:48,360
to break into the software.

772
00:20:49,260 --> 00:20:49,760
So,

773
00:20:49,880 --> 00:20:50,540
to me,

774
00:20:50,560 --> 00:20:51,120
this was sort of

775
00:20:51,120 --> 00:20:51,540
the beginning

776
00:20:51,540 --> 00:20:52,440
of,

777
00:20:52,580 --> 00:20:54,160
of the process

778
00:20:54,160 --> 00:20:54,640
that we,

779
00:20:54,760 --> 00:20:55,800
that a lot of companies

780
00:20:55,800 --> 00:20:56,280
use today

781
00:20:56,280 --> 00:20:57,660
to actually try to secure

782
00:20:57,660 --> 00:20:58,220
their software

783
00:20:58,220 --> 00:20:59,000
before they ship

784
00:20:59,000 --> 00:20:59,520
their software

785
00:21:05,540 --> 00:21:06,020
But,

786
00:21:06,160 --> 00:21:07,260
at the same time,

787
00:21:07,800 --> 00:21:08,960
the security industry

788
00:21:08,960 --> 00:21:09,940
still isn't,

789
00:21:09,940 --> 00:21:10,340
isn't,

790
00:21:10,340 --> 00:21:11,140
isn't woken up.

791
00:21:11,200 --> 00:21:11,680
If you were,

792
00:21:11,700 --> 00:21:12,280
if you were,

793
00:21:12,300 --> 00:21:12,540
uh,

794
00:21:12,680 --> 00:21:13,960
working and doing security

795
00:21:13,960 --> 00:21:14,360
in,

796
00:21:14,400 --> 00:21:14,560
like,

797
00:21:14,560 --> 00:21:15,100
1998,

798
00:21:15,560 --> 00:21:16,040
1999,

799
00:21:16,960 --> 00:21:17,440
um,

800
00:21:17,640 --> 00:21:18,200
they,

801
00:21:18,200 --> 00:21:19,180
they're still doing this.

802
00:21:19,240 --> 00:21:19,740
They're selling

803
00:21:19,740 --> 00:21:21,160
security features.

804
00:21:21,560 --> 00:21:22,040
That,

805
00:21:22,140 --> 00:21:22,460
that's,

806
00:21:22,460 --> 00:21:23,420
that's the only thing

807
00:21:23,420 --> 00:21:24,280
that they knew how to do

808
00:21:24,280 --> 00:21:25,100
to secure a network.

809
00:21:26,280 --> 00:21:26,760
Or,

810
00:21:26,840 --> 00:21:27,660
or selling compliance.

811
00:21:28,440 --> 00:21:29,440
And we all know

812
00:21:29,440 --> 00:21:30,420
that this is just,

813
00:21:30,480 --> 00:21:31,480
gets bypassed,

814
00:21:32,620 --> 00:21:33,480
bypass all those things,

815
00:21:33,580 --> 00:21:34,420
and you ignore

816
00:21:34,900 --> 00:21:36,100
all the compliance issues.

817
00:21:36,600 --> 00:21:36,720
Right?

818
00:21:36,880 --> 00:21:37,140
Like,

819
00:21:37,200 --> 00:21:37,800
you don't even,

820
00:21:37,820 --> 00:21:38,900
you don't even look at the book

821
00:21:38,900 --> 00:21:39,260
and say,

822
00:21:39,420 --> 00:21:39,840
hey,

823
00:21:39,960 --> 00:21:41,040
let's see if they check

824
00:21:41,040 --> 00:21:41,780
this box.

825
00:21:42,000 --> 00:21:42,740
I'm gonna attack

826
00:21:42,740 --> 00:21:43,880
and see if they check

827
00:21:43,880 --> 00:21:44,480
that box.

828
00:21:44,760 --> 00:21:45,540
That's just not

829
00:21:45,540 --> 00:21:47,660
how the hacker mindset works.

830
00:21:48,020 --> 00:21:48,420
It's,

831
00:21:48,440 --> 00:21:48,680
it's,

832
00:21:48,680 --> 00:21:48,920
it's,

833
00:21:48,980 --> 00:21:49,000
so,

834
00:21:49,200 --> 00:21:50,280
compliance is completely

835
00:21:50,280 --> 00:21:51,500
orthogonal to the,

836
00:21:51,520 --> 00:21:52,560
to the hacker process.

837
00:21:55,040 --> 00:21:55,520
So,

838
00:21:55,660 --> 00:21:56,780
in 2000,

839
00:21:57,660 --> 00:21:58,140
um,

840
00:21:58,260 --> 00:21:59,320
we decided to

841
00:22:00,060 --> 00:22:00,540
basically,

842
00:22:01,040 --> 00:22:01,860
a lot of people

843
00:22:02,620 --> 00:22:02,700
came out,

844
00:22:02,880 --> 00:22:04,380
and this is what we did

845
00:22:04,380 --> 00:22:04,860
at the Loft.

846
00:22:04,920 --> 00:22:05,220
We said,

847
00:22:05,300 --> 00:22:06,360
let's take all the things

848
00:22:06,360 --> 00:22:06,640
we're,

849
00:22:06,640 --> 00:22:07,280
we're doing here,

850
00:22:07,420 --> 00:22:08,560
the tools we're building,

851
00:22:08,780 --> 00:22:10,720
the processes we're using

852
00:22:10,720 --> 00:22:12,300
to reverse engineer software,

853
00:22:12,640 --> 00:22:14,040
to pen test networks,

854
00:22:14,980 --> 00:22:16,660
let's see if we can just do this

855
00:22:16,660 --> 00:22:17,660
as a business.

856
00:22:19,040 --> 00:22:19,520
And,

857
00:22:19,520 --> 00:22:19,640
uh,

858
00:22:20,560 --> 00:22:21,320
you know,

859
00:22:21,320 --> 00:22:21,400
the,

860
00:22:21,500 --> 00:22:22,260
the headlines were,

861
00:22:22,320 --> 00:22:22,900
were pretty,

862
00:22:23,080 --> 00:22:23,800
you know,

863
00:22:23,860 --> 00:22:24,060
uh,

864
00:22:24,220 --> 00:22:24,700
you know,

865
00:22:24,700 --> 00:22:26,120
we're gonna use good hackers

866
00:22:26,120 --> 00:22:26,460
to,

867
00:22:26,560 --> 00:22:27,020
to fight,

868
00:22:27,120 --> 00:22:28,300
fight the bad hackers.

869
00:22:28,840 --> 00:22:29,320
Um,

870
00:22:32,620 --> 00:22:32,820
the simple,

871
00:22:32,920 --> 00:22:33,500
easy boxes,

872
00:22:33,620 --> 00:22:33,840
right,

873
00:22:33,900 --> 00:22:34,220
for the,

874
00:22:34,220 --> 00:22:35,060
for the general public.

875
00:22:36,280 --> 00:22:36,680
But,

876
00:22:36,740 --> 00:22:37,500
the idea was

877
00:22:37,940 --> 00:22:38,340
that,

878
00:22:38,380 --> 00:22:38,580
uh,

879
00:22:38,700 --> 00:22:39,900
we were gonna take all the things

880
00:22:39,900 --> 00:22:40,720
that we were doing,

881
00:22:41,140 --> 00:22:41,540
um,

882
00:22:42,160 --> 00:22:43,560
that we had sort of,

883
00:22:44,720 --> 00:22:45,120
um,

884
00:22:45,700 --> 00:22:47,180
created over the last few years,

885
00:22:47,220 --> 00:22:48,480
and we were gonna sell those

886
00:22:48,480 --> 00:22:49,380
as services,

887
00:22:49,800 --> 00:22:50,200
um,

888
00:22:50,340 --> 00:22:51,000
to customers.

889
00:22:51,240 --> 00:22:51,600
So,

890
00:22:51,700 --> 00:22:53,260
I don't think we were the,

891
00:22:53,280 --> 00:22:53,760
you know,

892
00:22:53,780 --> 00:22:53,860
the,

893
00:22:53,960 --> 00:22:54,460
the first,

894
00:22:54,660 --> 00:22:55,100
you know,

895
00:22:55,120 --> 00:22:57,020
company to do,

896
00:22:57,060 --> 00:22:58,360
do commercial pen testing.

897
00:22:58,860 --> 00:22:59,260
Um,

898
00:22:59,960 --> 00:23:00,360
but,

899
00:23:00,360 --> 00:23:00,500
it,

900
00:23:00,720 --> 00:23:01,880
it definitely put it on the map

901
00:23:01,880 --> 00:23:02,760
that,

902
00:23:02,800 --> 00:23:03,200
uh,

903
00:23:03,520 --> 00:23:03,940
that,

904
00:23:04,040 --> 00:23:05,180
that you could use these techniques

905
00:23:05,180 --> 00:23:06,220
to secure your network

906
00:23:06,220 --> 00:23:07,260
and secure your software.

907
00:23:08,800 --> 00:23:09,240
So,

908
00:23:09,340 --> 00:23:10,020
some of the things

909
00:23:10,020 --> 00:23:10,600
that we different,

910
00:23:10,720 --> 00:23:11,300
did different

911
00:23:11,300 --> 00:23:12,980
that other security consultancies,

912
00:23:13,560 --> 00:23:14,000
uh,

913
00:23:14,140 --> 00:23:15,180
weren't doing at the time,

914
00:23:15,240 --> 00:23:15,600
but seemed

915
00:23:15,600 --> 00:23:16,980
totally normal today.

916
00:23:17,240 --> 00:23:18,540
This was completely new.

917
00:23:18,620 --> 00:23:18,980
We conducted

918
00:23:18,980 --> 00:23:20,360
our own vulnerability research.

919
00:23:20,640 --> 00:23:21,640
It was a consultant,

920
00:23:21,720 --> 00:23:22,420
consultancy

921
00:23:22,420 --> 00:23:23,380
that had people going out

922
00:23:23,380 --> 00:23:23,920
and pen testing

923
00:23:23,920 --> 00:23:24,820
and people back at,

924
00:23:24,840 --> 00:23:25,600
back at that,

925
00:23:25,680 --> 00:23:26,420
back at the office,

926
00:23:27,560 --> 00:23:28,000
um,

927
00:23:28,160 --> 00:23:29,080
building tools

928
00:23:29,080 --> 00:23:29,960
and doing,

929
00:23:30,440 --> 00:23:30,660
research.

930
00:23:31,760 --> 00:23:32,160
So,

931
00:23:33,960 --> 00:23:34,360
um,

932
00:23:35,780 --> 00:23:36,180
and,

933
00:23:36,260 --> 00:23:36,440
uh,

934
00:23:36,540 --> 00:23:37,700
we came up with the concept

935
00:23:37,700 --> 00:23:38,200
of,

936
00:23:38,200 --> 00:23:39,700
we can help you secure

937
00:23:39,700 --> 00:23:40,400
your application

938
00:23:41,180 --> 00:23:42,440
by breaking into it

939
00:23:42,440 --> 00:23:42,820
for you

940
00:23:42,820 --> 00:23:43,440
and telling you

941
00:23:43,440 --> 00:23:44,140
how we did it.

942
00:23:44,820 --> 00:23:45,220
Um,

943
00:23:45,300 --> 00:23:46,160
and then other companies

944
00:23:46,160 --> 00:23:46,840
started to follow.

945
00:23:47,080 --> 00:23:47,700
You've probably heard of

946
00:23:47,700 --> 00:23:48,040
Gardens,

947
00:23:48,180 --> 00:23:49,300
went to VeriSign,

948
00:23:49,920 --> 00:23:50,320
Foundstone,

949
00:23:50,820 --> 00:23:51,220
uh,

950
00:23:51,300 --> 00:23:52,060
went to McAfee.

951
00:23:52,100 --> 00:23:53,480
I think McAfee still calls

952
00:23:53,480 --> 00:23:53,720
their,

953
00:23:53,780 --> 00:23:54,020
uh,

954
00:23:54,440 --> 00:23:54,840
their,

955
00:23:54,860 --> 00:23:56,080
their adversarial,

956
00:23:56,100 --> 00:23:56,420
um,

957
00:23:56,540 --> 00:23:57,360
security services

958
00:23:57,360 --> 00:23:57,940
Foundstone.

959
00:23:59,880 --> 00:24:00,580
And then,

960
00:24:00,600 --> 00:24:01,640
shortly after that,

961
00:24:01,740 --> 00:24:03,600
we had all kinds of

962
00:24:03,600 --> 00:24:04,200
worms

963
00:24:05,460 --> 00:24:06,240
that were,

964
00:24:06,260 --> 00:24:07,040
that were affecting

965
00:24:07,040 --> 00:24:07,560
Microsoft,

966
00:24:08,100 --> 00:24:08,820
excuse me,

967
00:24:08,880 --> 00:24:09,920
Microsoft products.

968
00:24:10,680 --> 00:24:11,540
Code Red,

969
00:24:11,940 --> 00:24:12,960
SQL Slammer,

970
00:24:13,180 --> 00:24:13,940
I mean,

971
00:24:13,980 --> 00:24:14,680
basically,

972
00:24:15,280 --> 00:24:15,800
uh,

973
00:24:16,380 --> 00:24:16,900
it,

974
00:24:16,940 --> 00:24:17,400
it was,

975
00:24:17,440 --> 00:24:18,200
it was pretty much

976
00:24:18,200 --> 00:24:18,440
of a,

977
00:24:18,440 --> 00:24:19,060
a disaster.

978
00:24:19,280 --> 00:24:19,760
If you were in,

979
00:24:19,860 --> 00:24:20,100
in,

980
00:24:20,100 --> 00:24:20,380
in,

981
00:24:20,380 --> 00:24:21,920
in Windows NT Admin

982
00:24:21,920 --> 00:24:23,340
or Windows 2000 Admin

983
00:24:23,340 --> 00:24:24,120
in 2002,

984
00:24:24,420 --> 00:24:24,620
you were,

985
00:24:24,620 --> 00:24:25,580
you were like patching IIS,

986
00:24:25,640 --> 00:24:25,920
like,

987
00:24:25,960 --> 00:24:26,740
on a monthly basis

988
00:24:26,740 --> 00:24:27,780
just so you didn't get

989
00:24:27,780 --> 00:24:28,220
wormed,

990
00:24:28,220 --> 00:24:28,880
a worm attack.

991
00:24:29,160 --> 00:24:30,120
It was really bad.

992
00:24:30,420 --> 00:24:30,860
So,

993
00:24:30,880 --> 00:24:31,840
Bill Gates came out with

994
00:24:31,840 --> 00:24:33,100
the Trusted Computing Memo.

995
00:24:34,080 --> 00:24:34,520
And,

996
00:24:34,720 --> 00:24:35,660
he said,

997
00:24:35,920 --> 00:24:36,380
um,

998
00:24:36,640 --> 00:24:37,560
we're going to stop

999
00:24:37,560 --> 00:24:37,960
everything.

1000
00:24:38,300 --> 00:24:38,720
We're going to stop

1001
00:24:38,720 --> 00:24:39,480
building software

1002
00:24:39,480 --> 00:24:40,940
the way we used to build it.

1003
00:24:41,060 --> 00:24:41,960
We're going to train

1004
00:24:41,960 --> 00:24:43,100
all of our engineers

1005
00:24:43,680 --> 00:24:44,560
on writing

1006
00:24:44,560 --> 00:24:45,500
secure software

1007
00:24:45,500 --> 00:24:46,400
because they,

1008
00:24:46,480 --> 00:24:47,120
they had a book,

1009
00:24:47,220 --> 00:24:47,560
um,

1010
00:24:47,800 --> 00:24:48,780
Writing Secure Code,

1011
00:24:48,920 --> 00:24:49,540
I think it's called.

1012
00:24:49,720 --> 00:24:50,740
We're going to train them

1013
00:24:50,740 --> 00:24:50,960
on,

1014
00:24:50,960 --> 00:24:51,000
on,

1015
00:24:51,000 --> 00:24:51,440
on that.

1016
00:24:52,300 --> 00:24:53,140
And then we're going to

1017
00:24:53,140 --> 00:24:53,940
build secure software.

1018
00:24:55,120 --> 00:24:55,560
Um,

1019
00:24:56,300 --> 00:24:57,500
the problem was,

1020
00:25:00,120 --> 00:25:01,240
they all read the book

1021
00:25:01,240 --> 00:25:02,120
and they all got the training

1022
00:25:02,120 --> 00:25:02,960
and then they went back

1023
00:25:02,960 --> 00:25:03,860
to their desks

1024
00:25:03,860 --> 00:25:05,240
and they still didn't know

1025
00:25:05,240 --> 00:25:06,220
how to build secure software.

1026
00:25:07,040 --> 00:25:08,660
They thought they could do it,

1027
00:25:08,680 --> 00:25:09,820
but they couldn't.

1028
00:25:10,440 --> 00:25:11,240
They didn't,

1029
00:25:11,240 --> 00:25:12,140
they didn't have

1030
00:25:12,140 --> 00:25:13,360
the capability

1031
00:25:14,180 --> 00:25:14,620
of,

1032
00:25:15,060 --> 00:25:15,500
of,

1033
00:25:15,680 --> 00:25:15,820
uh,

1034
00:25:16,040 --> 00:25:17,320
of making sure

1035
00:25:17,760 --> 00:25:18,640
that the software

1036
00:25:18,640 --> 00:25:19,380
they were releasing

1037
00:25:19,380 --> 00:25:20,420
was actually secure.

1038
00:25:20,660 --> 00:25:20,940
And,

1039
00:25:20,940 --> 00:25:21,320
uh,

1040
00:25:21,320 --> 00:25:21,900
because there was nothing

1041
00:25:21,900 --> 00:25:22,380
in their,

1042
00:25:22,480 --> 00:25:23,060
in their,

1043
00:25:23,140 --> 00:25:23,300
uh,

1044
00:25:23,560 --> 00:25:24,600
they had secure,

1045
00:25:24,680 --> 00:25:26,140
secure coding guidelines

1046
00:25:26,800 --> 00:25:27,960
but there was nothing

1047
00:25:27,960 --> 00:25:28,700
in their process

1048
00:25:28,700 --> 00:25:29,980
which was adversarial

1049
00:25:29,980 --> 00:25:30,540
in nature.

1050
00:25:30,900 --> 00:25:32,140
There was no process

1051
00:25:32,140 --> 00:25:32,780
of testing.

1052
00:25:33,040 --> 00:25:34,100
There was no process

1053
00:25:34,100 --> 00:25:34,640
of attacking.

1054
00:25:35,400 --> 00:25:35,920
So,

1055
00:25:36,060 --> 00:25:36,640
they,

1056
00:25:36,840 --> 00:25:37,700
they didn't

1057
00:25:37,700 --> 00:25:38,320
actually know

1058
00:25:38,320 --> 00:25:38,900
how to write

1059
00:25:38,900 --> 00:25:39,700
secure software.

1060
00:25:40,200 --> 00:25:40,720
So,

1061
00:25:40,760 --> 00:25:41,680
what did Microsoft do?

1062
00:25:43,460 --> 00:25:44,540
They hired a company

1063
00:25:44,540 --> 00:25:45,700
started by hackers

1064
00:25:45,700 --> 00:25:46,820
to come and teach them

1065
00:25:46,820 --> 00:25:47,520
how to

1066
00:25:47,520 --> 00:25:53,540
to secure their software. So Microsoft hired AtStake. I was there for months at a time,

1067
00:25:54,220 --> 00:26:00,720
helping them write, completely rewrite IIS, helping them secure Exchange, SQL Server.

1068
00:26:01,600 --> 00:26:06,020
We taught them how to threat model. They had no concept of threat modeling at the time.

1069
00:26:06,460 --> 00:26:10,160
You know, Microsoft likes to talk about how they have stride and they have all these threat

1070
00:26:10,160 --> 00:26:15,420
modeling standards. They learned it from hackers. Hackers taught them how to do that. What was

1071
00:26:15,420 --> 00:26:20,280
the hacker mindset for trying to break into a piece of software? So this came from hackers.

1072
00:26:20,440 --> 00:26:25,780
They didn't understand exploiting heap overflows. Their engineers just didn't get it. We had

1073
00:26:25,780 --> 00:26:30,940
to teach them that because they weren't going to fix buffer overflows on the heap because

1074
00:26:30,940 --> 00:26:36,240
they didn't think it was exploitable. They didn't have any concept of fuzzing software.

1075
00:26:37,040 --> 00:26:44,540
Dave Itell, who's now founder of Immunity, wrote the spike fuzzer while on the right

1076
00:26:45,420 --> 00:26:53,360
on the Microsoft campus because he wanted to fuzz the software that we were testing

1077
00:26:53,360 --> 00:26:58,720
for Microsoft. And he said, let me write a general purpose fuzzer called spike. And

1078
00:26:58,720 --> 00:27:04,520
then he later open sourced it. One kind of funny aspect of this was Dave wanted to do

1079
00:27:04,520 --> 00:27:12,500
this using his Linux laptop. And Microsoft explicitly said, you can't bring a Linux laptop

1080
00:27:12,500 --> 00:27:14,080
onto the Microsoft campus.

1081
00:27:15,440 --> 00:27:20,780
Dave We had to get special permission from some senior vice president. And it had to

1082
00:27:20,780 --> 00:27:28,840
only be in this room. And it was tightly controlled. They were afraid that if a little of that

1083
00:27:28,840 --> 00:27:35,320
software, that GPL software somehow got onto the Microsoft network, their lawyers had them

1084
00:27:35,320 --> 00:27:39,940
so scared that all their software would be GPLed. It was like the GPL virus is what they

1085
00:27:39,940 --> 00:27:45,320
called it. And they thought that using a Linux laptop was a really scary thing. You know,

1086
00:27:45,420 --> 00:27:50,540
now it's now, you know, Azure, you can spin up Linux boxes, right, so it's taken them

1087
00:27:50,540 --> 00:27:55,920
a long time to get over it. We taught them how to do things like find the attack surface.

1088
00:27:56,400 --> 00:28:00,660
We would do threat modeling with the engineers, and they would tell us about all the inputs

1089
00:28:00,660 --> 00:28:06,020
into the program, what other components it talked to. And then we would run something

1090
00:28:06,020 --> 00:28:11,580
like Sysinternals process explorer. And we'd be like, you didn't mention this namepipe,

1091
00:28:11,820 --> 00:28:15,400
you know. You didn't mention that it read from this file. And then we would run a list

1092
00:28:15,400 --> 00:28:18,000
And the people who built the software

1093
00:28:18,000 --> 00:28:19,880
didn't actually understand how their software worked

1094
00:28:19,880 --> 00:28:22,220
because they were calling into libraries

1095
00:28:22,220 --> 00:28:24,100
that were doing things that they didn't understand.

1096
00:28:24,680 --> 00:28:27,560
So we taught them how to go to the ground truth

1097
00:28:27,560 --> 00:28:30,920
to actually look at what the software was doing, right?

1098
00:28:31,000 --> 00:28:32,800
Take a reverse engineering process.

1099
00:28:33,080 --> 00:28:35,620
They could only think with a forward engineering process.

1100
00:28:36,040 --> 00:28:36,940
And so they didn't even,

1101
00:28:37,080 --> 00:28:38,540
the engineers at Microsoft

1102
00:28:38,540 --> 00:28:40,460
didn't even know how their software worked.

1103
00:28:41,000 --> 00:28:43,920
And so we taught them how to do that.

1104
00:28:43,920 --> 00:28:45,620
It's really interesting that Microsoft

1105
00:28:45,620 --> 00:28:48,840
actually ended up buying the company

1106
00:28:48,840 --> 00:28:50,440
that made Sysinternals.

1107
00:28:52,800 --> 00:28:54,860
And then this was sort of finally,

1108
00:28:55,160 --> 00:28:57,360
you know, we look at the Microsoft SDLC

1109
00:28:57,360 --> 00:28:59,960
as the standard, they like to say,

1110
00:29:00,060 --> 00:29:04,600
we have a great process for building software securely.

1111
00:29:05,280 --> 00:29:10,860
And they were the main contributors to ISO 2734,

1112
00:29:11,920 --> 00:29:13,580
which is the process

1113
00:29:13,580 --> 00:29:13,900
for building a software.

1114
00:29:13,900 --> 00:29:17,360
Where did they learn most of the stuff that's in there?

1115
00:29:17,560 --> 00:29:18,640
They learned it from hackers.

1116
00:29:19,320 --> 00:29:22,040
So we could say that if you think your software

1117
00:29:22,040 --> 00:29:24,860
is more secure today than it was, you know, 15 years ago,

1118
00:29:25,080 --> 00:29:27,760
it's because hackers taught software vendors

1119
00:29:27,760 --> 00:29:29,200
how to secure their software.

1120
00:29:31,900 --> 00:29:36,400
So, you know, basically I take this to about 2003 or so,

1121
00:29:37,000 --> 00:29:39,400
where sort of the modern era of security

1122
00:29:39,400 --> 00:29:41,920
and building software started.

1123
00:29:41,920 --> 00:29:44,980
And down to where we are today.

1124
00:29:45,320 --> 00:29:48,620
So penetration testing once was a scary thing

1125
00:29:48,620 --> 00:29:49,900
that you hired hackers for.

1126
00:29:50,220 --> 00:29:52,740
And, you know, you had to get special permission for it.

1127
00:29:52,820 --> 00:29:54,720
It's now a requirement, right?

1128
00:29:54,800 --> 00:29:56,760
If you're a financial services,

1129
00:29:56,940 --> 00:29:58,100
you have some certain compliance,

1130
00:29:58,480 --> 00:30:00,460
you need to pen test your applications, right?

1131
00:30:00,600 --> 00:30:02,040
So now it's a requirement.

1132
00:30:03,660 --> 00:30:05,880
People have a product security response team

1133
00:30:05,880 --> 00:30:07,760
to communicate with hackers, right?

1134
00:30:09,160 --> 00:30:11,900
And developers are using hacker technology.

1135
00:30:11,920 --> 00:30:12,220
And they're using the same techniques

1136
00:30:12,220 --> 00:30:14,520
as they build the software to test it

1137
00:30:14,520 --> 00:30:16,960
in order to make sure that that software is secure.

1138
00:30:17,180 --> 00:30:20,140
So today we really do have securing your product

1139
00:30:20,140 --> 00:30:23,120
by trying to break into it.

1140
00:30:23,960 --> 00:30:27,660
And I'm also happy to say that bug bounties came

1141
00:30:27,660 --> 00:30:31,740
because the idea of someone poking around in your software

1142
00:30:31,740 --> 00:30:35,620
and informing you about it became a legitimate good thing

1143
00:30:35,620 --> 00:30:37,400
that companies wanted to reward.

1144
00:30:38,040 --> 00:30:41,600
So this is really full circle from 20 years ago.

1145
00:30:41,920 --> 00:30:46,800
When if you, you know, there are people that would report bugs

1146
00:30:46,800 --> 00:30:48,140
and they would be threatened,

1147
00:30:48,240 --> 00:30:50,360
like Mike Lynn was threatened from Cisco.

1148
00:30:51,580 --> 00:30:54,440
And Dmitry Skylarov was threatened,

1149
00:30:55,260 --> 00:30:57,260
well, arrested because from,

1150
00:30:57,820 --> 00:31:01,560
he came to DEF CON about 15 years ago.

1151
00:31:01,600 --> 00:31:04,720
He was arrested because he was going to talk about bugs in DRM.

1152
00:31:06,080 --> 00:31:08,900
So we've come full circle from people notifying

1153
00:31:10,360 --> 00:31:11,400
of vulnerabilities.

1154
00:31:12,260 --> 00:31:15,120
And, you know, potentially getting arrested to today.

1155
00:31:15,220 --> 00:31:18,100
It's a, you know, it's all, it's all a good thing.

1156
00:31:19,260 --> 00:31:21,460
So now I want to take us to today.

1157
00:31:24,140 --> 00:31:26,500
And where have we come?

1158
00:31:26,620 --> 00:31:27,740
Where have we come today?

1159
00:31:28,080 --> 00:31:30,860
You know, it still looks pretty bad out there.

1160
00:31:31,020 --> 00:31:35,040
I mean, if you see what Petya ransomware worm

1161
00:31:35,040 --> 00:31:38,700
was able to do on modern, you know, modern networks,

1162
00:31:38,800 --> 00:31:41,360
huge companies like Maersk and FedEx,

1163
00:31:41,920 --> 00:31:44,280
the Ukrainian government,

1164
00:31:45,640 --> 00:31:48,480
it's still probably, it's still pretty bad out there, right?

1165
00:31:48,700 --> 00:31:50,640
The really crazy thing is nation states

1166
00:31:51,140 --> 00:31:52,640
are pretending to be hackers.

1167
00:31:53,740 --> 00:31:55,980
I don't know for sure if a nation state

1168
00:31:58,200 --> 00:32:00,700
released Petya or not Petya, what you want to call it.

1169
00:32:00,880 --> 00:32:04,400
But I find it very interesting that whatever their motives

1170
00:32:04,400 --> 00:32:06,280
and what they were trying to do,

1171
00:32:06,800 --> 00:32:09,340
they were trying to look like criminal hackers, right?

1172
00:32:09,520 --> 00:32:11,520
So this is now, we've, we've,

1173
00:32:11,520 --> 00:32:15,740
we've come to this point that this is just a part that the,

1174
00:32:16,580 --> 00:32:17,980
even people that are, you know,

1175
00:32:17,980 --> 00:32:19,980
doing offensive operations for governments,

1176
00:32:20,220 --> 00:32:22,120
they want to look like us, right?

1177
00:32:22,180 --> 00:32:24,900
They want to look like the people that go to DEFCON.

1178
00:32:25,160 --> 00:32:27,740
They think that that's a, that's how you,

1179
00:32:28,200 --> 00:32:29,220
that's how you hide yourself.

1180
00:32:30,980 --> 00:32:33,740
And today hackers are insiders, right?

1181
00:32:34,040 --> 00:32:36,020
We could be sellouts, we could be insiders,

1182
00:32:36,100 --> 00:32:37,080
whatever you want to call it.

1183
00:32:37,180 --> 00:32:39,080
I put the names of some of the companies up here

1184
00:32:39,080 --> 00:32:40,480
that people have disclosed.

1185
00:32:40,480 --> 00:32:42,320
I know that the three other guys up there,

1186
00:32:42,360 --> 00:32:43,320
I know where they work, but they,

1187
00:32:43,340 --> 00:32:44,560
they like to keep it a little bit,

1188
00:32:44,560 --> 00:32:46,060
a little bit on the down low.

1189
00:32:46,220 --> 00:32:47,920
Some people are still really paranoid.

1190
00:32:50,040 --> 00:32:52,340
But hackers, hackers are insiders.

1191
00:32:52,500 --> 00:32:54,740
You know, Mudge worked for DARPA.

1192
00:32:54,940 --> 00:32:57,520
You know, he was a government employee working for DARPA,

1193
00:32:57,560 --> 00:33:01,660
funding, using his insider position for,

1194
00:33:01,800 --> 00:33:07,040
to use DARPA funds to fund hacker style projects

1195
00:33:07,440 --> 00:33:09,780
like Charlie Miller and Chris Vlasic hacking the Jeep,

1196
00:33:09,780 --> 00:33:11,980
was funded through, through DARPA.

1197
00:33:12,360 --> 00:33:15,500
So now that we're insiders, we're really in powerful

1198
00:33:15,500 --> 00:33:19,220
positions to actually change, you know, change things.

1199
00:33:20,060 --> 00:33:21,620
And that's, that's a good thing.

1200
00:33:21,740 --> 00:33:24,440
You know, it was basically Windows Snyder and Katie

1201
00:33:24,440 --> 00:33:28,080
Masuris who over time got Microsoft to even do a bug

1202
00:33:28,080 --> 00:33:29,820
bounty program, right?

1203
00:33:29,900 --> 00:33:31,720
And they, they, they came from the hacker community.

1204
00:33:34,100 --> 00:33:36,280
And we all know insiders are more powerful, right?

1205
00:33:38,400 --> 00:33:39,620
But we're getting old.

1206
00:33:39,680 --> 00:33:39,760
We're getting older.

1207
00:33:40,500 --> 00:33:43,000
Right, we're old insiders, right?

1208
00:33:43,420 --> 00:33:48,500
We need the next generation to keep doing what, what we did.

1209
00:33:48,860 --> 00:33:52,560
Right, we need people to still keep making trouble.

1210
00:33:52,780 --> 00:33:55,960
And I do still pe, still see people out there making trouble.

1211
00:33:57,040 --> 00:34:01,180
I don't know, you, most people have probably heard of Justine Bone and

1212
00:34:01,180 --> 00:34:04,800
her company MedSec, which caused a lot of trouble for

1213
00:34:04,800 --> 00:34:08,900
St. Jude Medical Devices by selling their,

1214
00:34:08,900 --> 00:34:09,740
their, their, their, their, their, their, their, their, their, their, their, their,

1215
00:34:09,740 --> 00:34:13,340
their research around how their pacemaker had vulnerabilities that could kill someone,

1216
00:34:13,480 --> 00:34:16,900
selling their research to a hedge fund that shorted the stock.

1217
00:34:17,940 --> 00:34:19,040
That's making trouble.

1218
00:34:19,200 --> 00:34:20,960
That's trying to change things up.

1219
00:34:21,060 --> 00:34:21,940
They didn't do anything illegal.

1220
00:34:22,440 --> 00:34:26,020
Right, they, there is a lawsuit out there, but I think they'll probably be okay.

1221
00:34:28,040 --> 00:34:33,360
And they brought a new mindset into thinking about how should we,

1222
00:34:33,440 --> 00:34:38,800
how can we fix the market around cybersecurity for a long time.

1223
00:34:38,920 --> 00:34:39,340
It's been.

1224
00:34:39,740 --> 00:34:39,820
There is.

1225
00:34:39,820 --> 00:34:46,160
a vendor-customer relationship where the vendor decides how much security they're

1226
00:34:46,160 --> 00:34:49,180
gonna put in their products and the consumers have no visibility into it.

1227
00:34:49,340 --> 00:34:52,380
And, you know, it's kind of a, it's kind of a lemon market right?

1228
00:34:52,480 --> 00:34:55,260
Like you, you, the consumer has no power over

1229
00:34:55,260 --> 00:34:59,080
making their world a more secure place, and in, in, in general the average person.

1230
00:34:59,500 --> 00:35:03,200
And, and, what MedSec did was by bringing in the investor community

1231
00:35:03,720 --> 00:35:07,420
brought in another party, they brought in the owners of the companies.

1232
00:35:07,640 --> 00:35:09,720
The investors who own, part of the investment market and people.

1233
00:35:09,720 --> 00:35:16,240
of these public companies and brought them to the table and woke them up to say, hey,

1234
00:35:16,340 --> 00:35:19,900
maybe the security of these products is going to change how much money I make with this

1235
00:35:19,900 --> 00:35:20,200
company.

1236
00:35:20,780 --> 00:35:25,740
So it's not the people who are the employees of the company that, you know, were necessary

1237
00:35:25,740 --> 00:35:26,440
and in control.

1238
00:35:26,600 --> 00:35:32,880
Now, what MedSec did was brought in this other party, the investor community, and we're

1239
00:35:32,880 --> 00:35:34,200
starting to see more of that now.

1240
00:35:34,200 --> 00:35:41,060
Now, Ponemon Institute came out with a report showing how stocks dip after major vulnerabilities

1241
00:35:41,060 --> 00:35:47,080
are announced, and the study broke down how much it dipped and for how long the stock

1242
00:35:47,080 --> 00:35:51,800
dipped, and it turned out that companies that had a very good security, mature security

1243
00:35:51,800 --> 00:35:58,640
posture and had a really good response, their stock dipped less, half as much, and for half

1244
00:35:58,640 --> 00:36:03,400
as much time, whereas companies that were very immature from a security perspective

1245
00:36:03,400 --> 00:36:04,180
and had a really good response, their stock dipped less, half as much, and for half

1246
00:36:04,180 --> 00:36:08,440
and had a really bad response, their stock dipped twice as much and lasted twice as longer.

1247
00:36:09,240 --> 00:36:15,340
My analysis on that is the investor community sees the vulnerability from the mature company

1248
00:36:15,340 --> 00:36:18,460
as, you know, a black swan, right?

1249
00:36:18,720 --> 00:36:22,380
It's something that, oh, it happened, it happens to everybody, but it's not going to be a

1250
00:36:22,380 --> 00:36:23,460
regularly occurring event.

1251
00:36:24,200 --> 00:36:28,440
But when it happens to a company that doesn't have a good response and can't talk about

1252
00:36:28,440 --> 00:36:32,800
how they're securing their software, the investor community thinks, well, this is going to

1253
00:36:32,800 --> 00:36:33,880
happen again and again and again.

1254
00:36:33,940 --> 00:36:34,160
This is going to happen again and again and again.

1255
00:36:34,160 --> 00:36:36,280
This is actually going to damage the brand and hurt the company.

1256
00:36:36,580 --> 00:36:41,720
So we're starting to get the investors that own these companies to think about security.

1257
00:36:42,000 --> 00:36:48,100
So it's still early days, but I think that that's an interesting new angle.

1258
00:36:51,860 --> 00:36:57,500
So what I want to ask you to do is to make me nervous.

1259
00:36:58,160 --> 00:37:00,380
I want you to go out there and do something.

1260
00:37:00,740 --> 00:37:04,140
I don't want you to break the law, but I want you to do something.

1261
00:37:04,140 --> 00:37:09,920
I want you to do something that, after you do it, I say, I don't know if that's a good idea.

1262
00:37:11,480 --> 00:37:16,560
That was my reaction to when I first saw the MedSec incident.

1263
00:37:16,880 --> 00:37:18,780
I said, really, are we going to go down this path?

1264
00:37:19,640 --> 00:37:22,480
This is going to tarnish the research community.

1265
00:37:22,900 --> 00:37:24,700
This is going to make hackers look bad.

1266
00:37:25,220 --> 00:37:29,760
And then I thought about it, and I said, maybe we should give this a chance.

1267
00:37:30,000 --> 00:37:31,300
Maybe we should let this play out.

1268
00:37:31,460 --> 00:37:33,880
Maybe there's some big benefit down the road to this.

1269
00:37:33,880 --> 00:37:34,900
Someone's trying something.

1270
00:37:35,360 --> 00:37:37,140
But it made me nervous at the beginning.

1271
00:37:37,580 --> 00:37:38,500
It really did.

1272
00:37:39,180 --> 00:37:43,360
And so that's my call to you, is to do something that makes me nervous.

1273
00:37:43,700 --> 00:37:45,260
Because I've been doing this a long time.

1274
00:37:45,460 --> 00:37:46,180
I've seen a lot.

1275
00:37:46,340 --> 00:37:47,440
I made other people nervous.

1276
00:37:48,620 --> 00:37:53,320
But do something that makes me nervous, and I think that will be pushing the envelope.

1277
00:37:54,840 --> 00:37:58,780
So I just want to finish here with something a little bit practical,

1278
00:37:59,940 --> 00:38:02,980
and a way that we all can influence.

1279
00:38:04,860 --> 00:38:07,600
And that is the concept of security champions.

1280
00:38:07,980 --> 00:38:10,220
Now, I'm in the application security business.

1281
00:38:10,820 --> 00:38:13,780
I help companies build secure software.

1282
00:38:14,440 --> 00:38:18,020
And part of it is to build that security culture.

1283
00:38:18,700 --> 00:38:20,640
The security team can't do it all.

1284
00:38:22,620 --> 00:38:24,420
You know, pen testers can't do it all.

1285
00:38:24,500 --> 00:38:25,420
Hackers can't do it all.

1286
00:38:25,580 --> 00:38:27,180
We have to enlist the masses.

1287
00:38:27,640 --> 00:38:31,140
We have to get them to understand the security mindset.

1288
00:38:32,120 --> 00:38:33,620
And so the notion of security,

1289
00:38:33,620 --> 00:38:38,740
the security champion is, you know, take the example of a company that builds software.

1290
00:38:39,160 --> 00:38:42,500
In every development team or every scrum team in that company,

1291
00:38:42,720 --> 00:38:47,060
identify an individual who has the aptitude and the interest

1292
00:38:47,060 --> 00:38:50,540
in maybe learning a little bit more about security.

1293
00:38:50,940 --> 00:38:53,060
So their software developer is their day job.

1294
00:38:53,500 --> 00:38:57,200
Get them interested in security.

1295
00:38:57,740 --> 00:38:59,000
Give them some extra training.

1296
00:38:59,560 --> 00:39:02,120
You know, do some reverse engineering with them.

1297
00:39:02,780 --> 00:39:06,100
Do a capture-the-flag exercise with them.

1298
00:39:06,240 --> 00:39:07,840
Get them interested in security.

1299
00:39:08,080 --> 00:39:12,660
And if you can get, you know, one person in each development team interested in security,

1300
00:39:12,880 --> 00:39:15,140
it has a huge impact across the organization.

1301
00:39:15,580 --> 00:39:17,400
Because there's just not enough security people,

1302
00:39:17,600 --> 00:39:20,520
and there's a lot of people building software out there.

1303
00:39:20,700 --> 00:39:24,320
And I think you can take this to other places to educate people.

1304
00:39:25,040 --> 00:39:31,700
So I think that is something that we all have a responsibility to do where we work or in our lives is

1305
00:39:31,700 --> 00:39:32,100
to educate people.

1306
00:39:32,100 --> 00:39:32,280
And I think that is something that we all have a responsibility to do where we work or in our lives is to educate.

1307
00:39:33,420 --> 00:39:36,240
Because it can't be an us and them, you know.

1308
00:39:37,100 --> 00:39:40,200
I know it's called the wall of sheep, and there's a bunch of sheep out there,

1309
00:39:40,300 --> 00:39:41,560
and then there's the wolves, right?

1310
00:39:41,780 --> 00:39:44,400
But it would be great if we could get some of those sheep more educated.

1311
00:39:45,840 --> 00:39:50,260
So with that, I'm going to end it there.

1312
00:39:50,360 --> 00:39:53,260
This is my contact info if you want to contact me.

1313
00:39:53,960 --> 00:39:56,800
I don't know, Ming, if I went over time, if we have any time for questions.

1314
00:39:59,140 --> 00:40:01,520
We do have time for a few questions.

1315
00:40:02,100 --> 00:40:06,520
And if you have a question for Chris, and please have, you know,

1316
00:40:06,560 --> 00:40:10,840
we definitely welcome you because this is a fantastic opportunity right now.

1317
00:40:12,320 --> 00:40:13,500
The mic is all yours.

1318
00:40:20,340 --> 00:40:21,680
Hey, good morning.

1319
00:40:21,780 --> 00:40:23,800
Thanks for taking the time to speak with us.

1320
00:40:23,840 --> 00:40:24,880
Chris, my name's David.

1321
00:40:25,000 --> 00:40:26,000
I'm from New York.

1322
00:40:26,300 --> 00:40:31,960
I just, I wanted to ask you, I've read news articles,

1323
00:40:32,100 --> 00:40:35,400
and talk about how difficult it is for companies to keep themselves secure,

1324
00:40:35,560 --> 00:40:39,540
that they're effectively gladiators in this pit, going against everyone out there,

1325
00:40:39,600 --> 00:40:42,180
malicious and hacktivists and all the like.

1326
00:40:43,320 --> 00:40:47,120
Have you heard any theories or any proposals that are convincing

1327
00:40:47,120 --> 00:40:50,480
for how companies can share their data potentially with one another,

1328
00:40:50,680 --> 00:40:55,020
to say we found this vulnerability, this is something perhaps to look for in your work,

1329
00:40:55,100 --> 00:40:58,280
and kind of help bridge that gap and help them unify?

1330
00:40:58,800 --> 00:41:01,060
So what you're really talking about is information sharing.

1331
00:41:01,060 --> 00:41:05,260
And I'm a huge proponent of fully open information sharing.

1332
00:41:05,520 --> 00:41:08,380
I don't like all these little pockets of groups, government groups,

1333
00:41:08,620 --> 00:41:12,020
or just financial services groups, where they share stuff amongst themselves.

1334
00:41:12,320 --> 00:41:13,760
I think that's incredibly inefficient.

1335
00:41:14,260 --> 00:41:14,700
Right?

1336
00:41:14,780 --> 00:41:19,860
The idea of DEF CON, the idea of bug track, were to make information sharing completely open.

1337
00:41:20,220 --> 00:41:23,320
So I think we should have as open as possible, right?

1338
00:41:23,600 --> 00:41:24,560
Information sharing.

1339
00:41:24,760 --> 00:41:26,960
I don't care if the adversaries get the information, too.

1340
00:41:27,360 --> 00:41:31,020
As long as the defenders work on that information, it's better.

1341
00:41:31,020 --> 00:41:36,080
The problem with open information sharing is the adversaries take advantage of it,

1342
00:41:36,100 --> 00:41:37,660
and the defenders don't.

1343
00:41:37,800 --> 00:41:40,780
If the defenders took advantage of it, it would be fine.

1344
00:41:41,000 --> 00:41:45,020
So I'm all for as much open information sharing as we can have.

1345
00:41:45,480 --> 00:41:46,240
Thank you.

1346
00:41:48,140 --> 00:41:49,600
Anyone else for a question?

1347
00:41:50,340 --> 00:41:52,500
Thanks, Chris.

1348
00:41:52,620 --> 00:41:59,280
Do you think that yourself, other members of LOFT, and other individuals in the early 90s and late 90s

1349
00:41:59,280 --> 00:42:04,540
received the reward and recognition that they should, given what they did for the security sector today?

1350
00:42:05,420 --> 00:42:07,840
And just for the record, I don't, unless you convince me otherwise.

1351
00:42:09,720 --> 00:42:10,780
You know, I don't know.

1352
00:42:10,900 --> 00:42:12,780
I think I'm a pretty humble guy.

1353
00:42:13,120 --> 00:42:14,920
I don't need any more reward.

1354
00:42:15,060 --> 00:42:16,680
I've been very successful in my career.

1355
00:42:17,220 --> 00:42:18,700
I've met a lot of great people.

1356
00:42:19,400 --> 00:42:23,780
I get to stand up here and talk with you and meet you, so I'm fine myself.

1357
00:42:24,620 --> 00:42:28,220
I don't think I need a Presidential Medal of Honor or anything like that.

1358
00:42:29,280 --> 00:42:29,740
Do you agree with that as well?

1359
00:42:31,360 --> 00:42:35,080
Some of them probably would have a different answer, yeah.

1360
00:42:37,420 --> 00:42:38,460
So really quick.

1361
00:42:38,660 --> 00:42:42,480
What spaces do you think really need to be made nervous these days?

1362
00:42:43,060 --> 00:42:44,800
Could you repeat the end?

1363
00:42:44,920 --> 00:42:45,020
Sure.

1364
00:42:45,400 --> 00:42:50,900
What places or what sectors do you think really need to be made more nervous these days?

1365
00:42:51,260 --> 00:42:52,900
I missed the last part again.

1366
00:42:53,200 --> 00:42:53,660
No problem.

1367
00:42:54,080 --> 00:42:57,940
What places or what sectors do you think really need to get,

1368
00:42:57,940 --> 00:43:01,360
really need to be made more nervous right now?

1369
00:43:01,540 --> 00:43:02,360
Oh, okay.

1370
00:43:02,500 --> 00:43:04,880
I was missing the nervous word.

1371
00:43:07,900 --> 00:43:09,680
That's a good question.

1372
00:43:10,280 --> 00:43:12,240
I know the government is already nervous.

1373
00:43:14,180 --> 00:43:17,500
I think it's the IOT sector.

1374
00:43:18,380 --> 00:43:22,740
I don't think they're getting quite the feedback loop that they need to.

1375
00:43:23,300 --> 00:43:26,620
I think that, you know, people are just shipping products,

1376
00:43:26,620 --> 00:43:28,700
and ignoring things.

1377
00:43:28,980 --> 00:43:32,520
I think the noise level has to be raised there.

1378
00:43:33,480 --> 00:43:37,580
You know, we saw the Mirai botnet was sort of a wake-up call.

1379
00:43:38,040 --> 00:43:42,920
I don't think that changed how people are manufacturing these inexpensive IOT devices,

1380
00:43:42,980 --> 00:43:48,620
that, you know, it might cost $50, but it causes a world of hurt, you know?

1381
00:43:49,380 --> 00:43:53,860
Sort of like dumping your toxic waste in the swamp, right?

1382
00:43:53,900 --> 00:43:55,900
Just because something is cheap doesn't, to do,

1383
00:43:55,900 --> 00:43:59,160
or make, doesn't mean it doesn't have really bad consequences.

1384
00:43:59,560 --> 00:44:01,200
So, yeah, let's make them nervous.

1385
00:44:04,740 --> 00:44:05,480
Anyone else?

1386
00:44:05,860 --> 00:44:06,680
Maybe one more?

1387
00:44:06,960 --> 00:44:07,460
One more?

1388
00:44:07,580 --> 00:44:08,460
One more question?

1389
00:44:12,060 --> 00:44:12,940
Absolutely welcome.

1390
00:44:13,220 --> 00:44:14,000
Absolutely welcome.

1391
00:44:18,680 --> 00:44:19,320
Hi, Chris.

1392
00:44:19,380 --> 00:44:20,200
Thanks for the talk.

1393
00:44:20,360 --> 00:44:21,040
It was a great talk.

1394
00:44:21,240 --> 00:44:24,100
I want to ask you, sometimes when you get a software,

1395
00:44:24,100 --> 00:44:25,140
you want to reverse.

1396
00:44:25,460 --> 00:44:28,300
When you look at the agreement, one of them is,

1397
00:44:28,440 --> 00:44:29,840
do not reverse engineer.

1398
00:44:30,140 --> 00:44:33,200
Do you observe it and sit on your hand,

1399
00:44:33,300 --> 00:44:34,800
or you just go ahead and do it anyway?

1400
00:44:35,960 --> 00:44:38,000
I would go and do it anyway.

1401
00:44:38,380 --> 00:44:43,820
I think, you know, you can't ask for permission, right?

1402
00:44:43,880 --> 00:44:44,920
They're not going to give you permission.

1403
00:44:46,680 --> 00:44:50,180
So I would go ahead and do it anyway.

1404
00:44:51,320 --> 00:44:52,960
You know, as a,

1405
00:44:52,960 --> 00:44:57,840
as a company, it's something that I can't do at work.

1406
00:44:58,180 --> 00:45:01,660
I need to follow those rules myself.

1407
00:45:02,100 --> 00:45:03,960
But I don't think we would have gotten anywhere

1408
00:45:04,980 --> 00:45:07,820
with making better products unless people did that.

1409
00:45:08,000 --> 00:45:11,620
So, again, that's along the lines of making people angry.

1410
00:45:14,780 --> 00:45:17,300
Can you share with us where WeldPond came from,

1411
00:45:17,340 --> 00:45:18,520
or is that completely taboo?

1412
00:45:19,340 --> 00:45:20,880
No, it's, I can share.

1413
00:45:21,040 --> 00:45:22,940
It's actually a fairly boring story.

1414
00:45:22,960 --> 00:45:23,920
But quickly.

1415
00:45:25,800 --> 00:45:30,340
So the first BBS I connected to that,

1416
00:45:30,860 --> 00:45:32,320
it had a requirement.

1417
00:45:32,520 --> 00:45:35,560
I think it was called The Works in Lexington, Massachusetts.

1418
00:45:36,880 --> 00:45:40,420
Jason Scott was the guy who does textfiles.com.

1419
00:45:40,580 --> 00:45:43,000
Jason Scott, you probably all know, was the sysop.

1420
00:45:44,720 --> 00:45:48,980
And the BBS was set up that it said no real names.

1421
00:45:49,260 --> 00:45:50,920
You can't use your real name on the BBS.

1422
00:45:51,120 --> 00:45:52,580
You got to put in a fake name.

1423
00:45:52,960 --> 00:45:53,620
So I signed up for an account.

1424
00:45:54,380 --> 00:45:56,040
I was like, oh, I just,

1425
00:45:56,100 --> 00:45:59,240
I don't want to spend time thinking of some cool name.

1426
00:46:00,560 --> 00:46:03,780
You know, so all I did was I looked above my desk

1427
00:46:03,780 --> 00:46:05,300
and I had a map of the Boston area.

1428
00:46:06,020 --> 00:46:07,480
And I just put my finger up there,

1429
00:46:07,560 --> 00:46:08,940
and I put my finger on WeldPond,

1430
00:46:09,100 --> 00:46:12,080
which is a, it's a pond in Dedham, Massachusetts.

1431
00:46:13,000 --> 00:46:14,520
And that's where I came up with the name.

1432
00:46:14,660 --> 00:46:17,120
I didn't think I'd be using it 24 years later.

1433
00:46:18,560 --> 00:46:20,000
So that's where it came from.

1434
00:46:21,840 --> 00:46:22,200
No.

1435
00:46:23,340 --> 00:46:25,000
Thank you so much, Chris.

1436
00:46:25,320 --> 00:46:26,420
Thank you so much.

1437
00:46:29,840 --> 00:46:33,140
I, when we received this, when we received the CFP,

1438
00:46:33,200 --> 00:46:34,560
we were like, oh, my God.

1439
00:46:36,780 --> 00:46:38,740
You know, it's a tremendous honor for you

1440
00:46:38,740 --> 00:46:41,680
to give the keynote here at the Packet Hacking Village

1441
00:46:41,680 --> 00:46:42,760
and Speaker Workshops.

1442
00:46:44,180 --> 00:46:46,320
I cannot, personally, I cannot thank you enough

1443
00:46:46,320 --> 00:46:49,880
for everything that you've done for not only the community here,

1444
00:46:50,080 --> 00:46:52,320
but also for me personally

1445
00:46:52,320 --> 00:46:53,640
and my career as well, too.

1446
00:46:53,960 --> 00:46:57,040
And I'm totally very, very grateful for that.

1447
00:46:57,240 --> 00:46:59,000
So thank you for everything that you've done

1448
00:46:59,000 --> 00:47:01,340
for the community and for me personally.

1449
00:47:01,700 --> 00:47:03,640
And I also want to say a very special thank you

1450
00:47:03,640 --> 00:47:06,120
to each and every one of you here who was at this talk.

1451
00:47:06,720 --> 00:47:08,520
Just looking at this room right now,

1452
00:47:08,660 --> 00:47:10,860
now, this is my 11th DEF CON.

1453
00:47:11,240 --> 00:47:14,620
And it really, really does feel like going back to the old days

1454
00:47:14,620 --> 00:47:17,940
when I first got, when I got to a talk at Alexis,

1455
00:47:18,080 --> 00:47:19,620
not Alexis Park, but at the Riviera.

1456
00:47:19,900 --> 00:47:22,300
I mean, DEF CON talks, if you, if you, you know,

1457
00:47:22,300 --> 00:47:23,060
if you could believe,

1458
00:47:24,180 --> 00:47:26,080
were just as big.

1459
00:47:26,460 --> 00:47:28,440
So just like going back to the old days.

1460
00:47:28,700 --> 00:47:29,920
Thank you all so much.

1461
00:47:30,080 --> 00:47:30,900
Thank you, Chris.