1
00:00:00,000 --> 00:00:06,820
Next talk will be by Robert Hansen, or rsnake, about searching the invisible internet.

2
00:00:12,280 --> 00:00:19,940
All right. So my name is Robert Hansen. I also go by rsnake. I am a hacker. We do exist.

3
00:00:20,040 --> 00:00:24,660
We're real people. And I hope all of you feel like after this, you are hackers too.

4
00:00:24,660 --> 00:00:33,620
So my job is a bit of a weird one. Back when I started the internet, there really wasn't a job called security.

5
00:00:33,940 --> 00:00:38,680
There was no way to do what we do. It was sort of a side task.

6
00:00:40,240 --> 00:00:43,960
And it's grown a lot in the last 20-something years that I've been in the industry,

7
00:00:44,080 --> 00:00:51,440
where there's a lot of people who are putting things on the internet, but they really don't know that people like me can find them.

8
00:00:51,580 --> 00:00:54,560
So, for instance, you just saw Shodan with the internet camera.

9
00:00:55,520 --> 00:01:01,020
When I'm looking at the internet, I'm looking at it in a different way than you would, let's say, if you were using Google.

10
00:01:01,760 --> 00:01:05,820
If you are looking for something like shoes or whatever, you type in shoes in Google,

11
00:01:06,320 --> 00:01:13,480
and it'll find webpages and sites that are very popular, that people want to tell you about.

12
00:01:13,720 --> 00:01:17,520
They're heavily marketed. There's this whole thing called search engine optimization,

13
00:01:17,820 --> 00:01:19,760
where you try to get yourself to the top of Google.

14
00:01:19,920 --> 00:01:23,500
And you do that by a lot of tricks, by getting people to backlink to you effectively.

15
00:01:24,200 --> 00:01:24,640
So...

16
00:01:24,660 --> 00:01:30,000
A guy like me is somewhat interested in what the internet knows about any particular website,

17
00:01:30,180 --> 00:01:32,740
but I'm actually more interested in what people don't know.

18
00:01:33,360 --> 00:01:36,080
As a hacker, I'm trying to find the edges.

19
00:01:36,320 --> 00:01:39,080
I'm trying to find ways into their environment.

20
00:01:40,220 --> 00:01:42,220
So, let's take an example.

21
00:01:42,440 --> 00:01:47,860
And by the way, I'm doing this all on my phone, just mostly because I find it very interesting to try to...

22
00:01:51,320 --> 00:01:53,060
Kind of helps if the cord's long enough.

23
00:01:53,060 --> 00:01:59,340
So, let's say I'm trying to find something like sears.com.

24
00:02:00,720 --> 00:02:02,840
So, Sears is a very large company.

25
00:02:02,980 --> 00:02:07,460
I'm sure a lot of you have gone there at one point or another, buy tires or something.

26
00:02:09,140 --> 00:02:13,340
But Sears is actually a much more complicated thing than just a singular website.

27
00:02:14,480 --> 00:02:20,200
There's lots and lots and lots of different, let's say, subdomains of their main domain.

28
00:02:20,500 --> 00:02:23,040
So, any one of these things might be...

29
00:02:23,040 --> 00:02:31,520
A printer, or they might be a camera, or they might be a satellite office, a sales office, or something like that.

30
00:02:31,840 --> 00:02:36,840
So, you can see very quickly that if you look at the internet a little bit differently,

31
00:02:37,000 --> 00:02:43,220
you're going to start finding all kinds of very interesting things, like development servers, and staging servers, and test servers,

32
00:02:43,480 --> 00:02:50,420
quality assurance servers, sites that people have put online without really realizing that they're still accessible.

33
00:02:50,620 --> 00:02:52,620
And people like you and I can go and find them.

34
00:02:53,040 --> 00:02:53,900
And connect to them.

35
00:02:54,880 --> 00:03:00,020
This is all public information, but it's public information that they don't necessarily know is public.

36
00:03:00,200 --> 00:03:04,160
They're not really thinking about it as it's being publicly accessible on the internet.

37
00:03:06,100 --> 00:03:12,440
So, the problem is, we know that Sears owns a lot of other things other than sears.com.

38
00:03:12,700 --> 00:03:17,340
They own kmart.com, they own structure.com, and a bunch of other things.

39
00:03:17,980 --> 00:03:19,360
So, how do we find that?

40
00:03:19,460 --> 00:03:23,020
Well, if we start looking at different subnets that they own,

41
00:03:23,040 --> 00:03:27,640
they're within, you can find things like huge blocks of IP space.

42
00:03:27,860 --> 00:03:36,140
Like this has 42 records in Illinois in one very small block, 256 addresses,

43
00:03:36,440 --> 00:03:39,320
which is a small amount of space on the internet.

44
00:03:39,620 --> 00:03:45,980
So, if we pivot and we look inside that network, if we start drilling into what's going on there,

45
00:03:46,160 --> 00:03:49,000
you're going to start seeing that they own a lot of other things.

46
00:03:49,760 --> 00:03:53,020
They own shopyourwayshoes.com.

47
00:03:53,020 --> 00:03:58,280
And a bunch of other things, kmart.com, which we knew about, etc.

48
00:03:58,660 --> 00:04:02,480
All of these things are potentially vulnerable and are all sort of on the internet.

49
00:04:03,400 --> 00:04:05,880
The other thing you need to sort of think about.

50
00:04:06,180 --> 00:04:08,600
So, let's say one day I build a website.

51
00:04:09,700 --> 00:04:12,340
And think of a website sort of like a photograph.

52
00:04:12,840 --> 00:04:16,660
And that photograph is the thing that I'm trying to present to the internet.

53
00:04:17,200 --> 00:04:21,640
Now, if I, let's say there's a camera over here.

54
00:04:21,640 --> 00:04:24,700
And that camera is, then there's a TV attached to it.

55
00:04:24,760 --> 00:04:26,860
And you can see whatever it's pointing to.

56
00:04:26,980 --> 00:04:28,260
So, it's pointed at my picture.

57
00:04:28,560 --> 00:04:30,520
So, that's what's called a proxy server.

58
00:04:30,760 --> 00:04:34,800
And the proxy server is basically showing you whatever I have on this photograph.

59
00:04:35,720 --> 00:04:42,540
So, a lot of secure, a lot of companies will use proxy servers to sort of pretend like they're not located here.

60
00:04:42,640 --> 00:04:43,700
They're located over there.

61
00:04:44,140 --> 00:04:45,620
They do that for security reasons.

62
00:04:45,840 --> 00:04:47,680
They do it for performance reasons, etc.

63
00:04:48,580 --> 00:04:51,620
So, if you actually hack into what you think it is,

64
00:04:51,640 --> 00:04:54,520
what you think they are, you're hacking into that thing over there, which isn't them.

65
00:04:54,820 --> 00:04:58,940
And so, therefore, it's less bad if something bad happens, theoretically anyway.

66
00:05:00,080 --> 00:05:04,480
So, the problem is I had to, at one point, build that photograph.

67
00:05:04,800 --> 00:05:06,620
I had to build that website somewhere.

68
00:05:06,800 --> 00:05:08,840
It has to exist on the internet for real somewhere.

69
00:05:10,040 --> 00:05:14,620
And later on, after it's built and it's functioning and someone's had a chance to look at it,

70
00:05:14,660 --> 00:05:18,140
then I can take a, put that on the video and have it proxy through.

71
00:05:19,200 --> 00:05:21,560
So, if you can rewind the internet.

72
00:05:21,560 --> 00:05:27,160
And look backwards in time, which means basically getting a lot of snapshots of the internet over time,

73
00:05:27,380 --> 00:05:28,680
you can sort of just look.

74
00:05:28,820 --> 00:05:34,020
Hey, where was, well, now they're there, but where were they, let's say, a year ago?

75
00:05:34,200 --> 00:05:36,340
Well, they might be here when they were building the site.

76
00:05:36,680 --> 00:05:41,440
So, instead of connecting to there and attacking that thing, the attacker will attack this thing.

77
00:05:41,880 --> 00:05:46,440
Even though this thing isn't where the website is anymore from a user's perspective,

78
00:05:46,640 --> 00:05:47,820
it's actually where it is.

79
00:05:47,880 --> 00:05:49,720
It's really where the photograph actually is.

80
00:05:49,760 --> 00:05:50,520
It's where the website is.

81
00:05:51,760 --> 00:05:55,720
So, knowing how the internet is structured and knowing how it evolves

82
00:05:55,720 --> 00:06:01,460
can allow you to attack the real place, the real place on the internet where the thing really is located.

83
00:06:02,720 --> 00:06:05,860
And so, you'd think, like, big companies, they should know better.

84
00:06:05,980 --> 00:06:07,940
This should not be something that ever happens.

85
00:06:08,680 --> 00:06:12,540
And so, when I talk to an average company or an average organization or whatever,

86
00:06:12,640 --> 00:06:14,940
and I say, how many sites do you have on the internet?

87
00:06:15,140 --> 00:06:16,020
Like, what do you think?

88
00:06:17,080 --> 00:06:18,800
So, let's say it was an eBay or something.

89
00:06:18,940 --> 00:06:20,120
And you go talk to...

90
00:06:21,540 --> 00:06:22,460
Let's say the CEO.

91
00:06:22,680 --> 00:06:27,520
You're like, well, so what sites do you care about or are on the internet?

92
00:06:27,700 --> 00:06:31,000
And they'll say eBay and PayPal, let's say, before they got acquired or moved off.

93
00:06:32,060 --> 00:06:33,340
And so, that's two websites.

94
00:06:34,260 --> 00:06:40,560
And then if you go talk to the network admins, they'll say, oh, it's eBay and PayPal and rent.com

95
00:06:40,560 --> 00:06:41,580
and a bunch of other stuff.

96
00:06:42,040 --> 00:06:45,300
But there's a whole bunch of other marketing websites that they don't know about.

97
00:06:45,480 --> 00:06:49,080
And you go talk to the marketing team, and the marketing team will only know about the marketing sites,

98
00:06:49,180 --> 00:06:50,500
and they won't even be thinking about all that.

99
00:06:50,520 --> 00:06:52,480
They'll be thinking about all these internal assets or anything else.

100
00:06:52,860 --> 00:06:55,380
So, it's not that any one of those people are wrong.

101
00:06:55,600 --> 00:06:59,640
It's that no one of them know all of what's going on all at one time.

102
00:06:59,940 --> 00:07:02,480
So, that's actually the crux of this problem.

103
00:07:02,680 --> 00:07:11,360
When you have this massive buildup of websites and entities, a company will buy another company.

104
00:07:11,560 --> 00:07:13,740
They don't necessarily know what they're buying.

105
00:07:13,860 --> 00:07:16,860
They're just buying, you know, a bunch of people and a bunch of equipment.

106
00:07:17,500 --> 00:07:20,500
But really what they're doing is they're buying this gigantic internet asset.

107
00:07:21,020 --> 00:07:24,620
Archive of all this stuff that's accumulated over many years, potentially.

108
00:07:25,600 --> 00:07:31,020
So, if you're trying to protect yourself, the very first thing you need to know is what you're trying to protect.

109
00:07:31,240 --> 00:07:33,300
You need to find everything first.

110
00:07:33,680 --> 00:07:38,140
And then it's usually very easy to break in in one of those things.

111
00:07:38,400 --> 00:07:42,220
As a defender, as someone on the security side as opposed to the hacking side,

112
00:07:42,500 --> 00:07:48,460
you basically need to identify where those places are so that you can put the proper defenses in place.

113
00:07:49,460 --> 00:07:50,500
So, that's it.

114
00:07:51,340 --> 00:07:52,240
Thank you, everybody.