We'd like to give our attention to Chris Hadnagy. Does anybody not know Chris?
Yeah, the one with the man crush raises his hand.
I think most of my employees...
Who are you?
No, we certainly appreciate Chris here today, and just as a friend, I want to say he's a big guy, but he's got a big heart, and we all know that, don't we?
So we appreciate all he's done for social engineering.
As a 16 years experience as a practitioner and researcher in the security field, he certainly puts efforts forth in training, educating, and really helping to drive the awareness that social engineering is one of the top threats in the security industry.
Let's give our attention to Chris Hadnagy. His theme is SE versus Predator, using SE in ways I never thought.
Thanks, guys. Appreciate it.
My voice is going as every DEF CON, as you know, so by the end of this talk, I'll sound like the Godfather.
I'll be like, I'm going to send you an email you can't refuse.
So, you know, we'll go with that.
Okay, so my job is awesome and fun. It really is.
And a lot of people ask me, is it really fun? And it is. Think about it.
Every day, I get to hack people, and I get paid for it.
And that's really cool.
Oh, yeah, I didn't start my time.
I have extra time.
Anyhow, people ask all the time, how fun is it?
You think about it. I get to send phishing emails every day.
I get to vish people.
I get to break into places and steal stuff.
And it's all legal.
That's kind of cool. I don't get to go to prison for it.
I get tased a couple times once, but, you know, it's all fun.
You know, you think about some of the things that I've got to do in my career.
I got to break into over a dozen of places.
I've sent over $15 million.
Phishing emails in my career.
All legal, by the way. Pretty cool.
I've made thousands of phishing calls personally, and my team has made thousands in addition.
I've got to write three, and I'm now going to announce I'm working on my fourth book as we speak right now.
My first book is pretty dated, right?
It's pretty dated, and it's got some bad information in it, like the whole chapter on NLP and my three Wikipedia references that made me a moron.
So, those are going away, and I'm rewriting the book, and I'll just tell you now, this will go nowhere out of this room, right?
It's going to be called Social Engineering, the Science of Human Hacking.
And it will be out in early 2018, so I'm working on that now.
And I get trolled by Dave Kennedy non-stop, which is fun, you know, I mean, kind of, maybe, no, not at all, but it looks like fun sometimes to the outside.
And I get to travel the globe doing things like hacking people.
And teaching, and meeting all sorts of cool people, and I've reconnected with so many students here at DEF CON.
So, it's really a fun job, until it stopped being fun all of a sudden, because I did a little research that involved looking at how pictures had automatically embedded GPS data in them.
And I started talking about that research publicly, and I couldn't get anybody interested in it until I met one reporter.
Her name was Laurie Siegel.
Actually, she's here.
She's in the back right there.
And she invited me to come on CNN, and we got to talk about a couple topics, and one of them was how these images are being leaked on the Internet, and that people are using them to geolocate women.
They're being harassed.
There's a slew of revenge porn that this was being involved in, and we got to do some really interesting research.
And at the time, that's all it was for me.
It was research.
And I got this really cool time to go on.
I got to go on the phone and talk with Laurie on CNN and be on national television talking about revenge porn.
And at the time, again, it was still just research.
And then things changed, because all of a sudden I got a lot of phone calls, and I got e-mails from women who were victims of revenge porn.
And they were asking for help, and there was nothing I could do.
There was absolutely nothing I could do, because to fix the problem, you have to hack someone else's computer, right?
To prove that it was her ex-boyfriend or husband or whoever.
That uploaded those images, I'd have to do something illegal.
And it felt really bad.
It felt really dirty, because here I am, these poor women, saw the news story, and there was nothing that can be done.
So we started putting together some resources to help them, some information.
We would give out, I had an e-mail that was kind of a template that would give them places they can call, places they can go to for help.
But still, there really wasn't much relief.
But it did give me some semblance of relief that we had something to help for.
But it was a...
Big eye-opener.
Here I was, doing my job, doing the coolest things on the planet, I thought at least, and then reality hit, right?
Reality where all of a sudden you're realizing that there's a lot of people out there that are being affected by these things in very negative ways.
And as you can see here, there was just some real problems.
And then I had another interesting thing occur.
I had an organization call me, government employee.
They saw the news story with Lori on geolocating pictures.
And they wanted me to do something that I really didn't feel comfortable with.
We all remember Ashley Madison, right?
We all remember Ashley Madison.
And Ashley Madison, you know, it's not a great site, of course, you know, unless you're into cheating on your spouse.
But the thing about Ashley Madison that was difficult for me when it came out as a breach was that you didn't have to authenticate, right?
So if you had an account on it, I could sign up in Ashley Madison with your account.
There was no two-factor.
There was no anything.
You didn't get anything.
You didn't get an email back saying, hey, did you really want to do this?
You signed up.
It was just you went there, you put an email in, you got an account.
And then there was no proof that after you got the account that you actually did anything wrong.
So we had a lot of companies that were calling saying, hey, can you scrape the breach data and see if our employees are there?
And I was like, no, I don't really want to do that because it feels like unless you could prove that the person was doing something wrong, you know, why would we want to go on this witch hunt?
And that's what it kind of felt like to me.
It was like a witch hunt.
So I kind of declined that.
And then I had this one client come to us, and they said, look, we have a reason why we want you to do this, because we see some traffic on our network that was encrypted, and we think it goes to places that involve child pornography.
So we just kind of want to see if we can look at the traffic at like the Ashley Madison dump and see if anyone in the organization has done that, then maybe out of their hundreds of thousands of employees that they had, instead of looking at all of them, focus just on those and see if they're doing something wrong.
And I was like, no, I don't want to see if those people were doing anything else sketchy at work.
So I did.
I said, okay, you know what?
That's a decent thing.
I can think I can do that.
So I scraped the data, and, man, we found it was thousands of employees that were on Ashley Madison.
So, you know, I made a little database for them, handed it over, and said, you know, use this sparingly because you don't know, you know, again, I gave them the whole spiel that we just talked about here.
And, lo and behold, there was an employee that they were able to target, and he was using his government-issued phone and devices to take videos of him raping children.
Yeah, yeah, pretty sick stuff.
And he was trafficking children in the Philippines.
And Michelle and I were sitting at a restaurant in D.C. with the head guy while he was landing from one of his trips and being arrested.
And that happened.
That felt good because where is he now?
That's where he is.
That felt good, right?
Not, of course, what happened.
That felt horrible.
But it felt good that there was something I did.
I never, I mean, I'm just a hacker, right?
I don't even have an education.
I'm like, came out of high school, got kicked out of college for running a war dialer, you know?
So I'm like, this doesn't even make sense.
And now I'm sitting here and I'm thinking, wow, something I just did had a profound effect and maybe saved children.
So that was a really, that was a really big deal for me.
It was like kind of a pivotal moment in my life where my career started taking a turn.
And I said, man, I can actually use these skills for something else, right?
And then I got a phone call.
Phone conversation went something like this, like, hey, can you help us catch a guy who's trafficking children?
And I'm like, you don't really want me, right?
Probably want the cops.
You don't really want me.
And they're like, well, we need to establish there's enough proof because the cops won't do anything.
Until there's proof.
So I said, okay, you know, maybe I can come and talk to you guys.
So I went and I talked, I talked to this organization about helping out and
come on, this was such a heavy topic.
I had to add some humor here somewhere, right?
Because we're all getting pretty somber, but yeah.
So I thought, okay, you know, maybe I can do this again.
Maybe I can use SC skills in a way that I never thought of using them.
So I sat and I said, let's, let's come up with a game.
And here was my game plan.
We were going to do lots of OSINT on this guy, right?
Because I wanted to feel before I did anything, I wanted to feel that there was some semblance
of proof that this guy really was a child trafficker, that he was producing child pornography
for sale.
So I did lots of OSINT.
Then I established my, my first plan was to establish that he had his first ticket, his
plane ticket, and that it wasn't that his first one was a loan, but that a second ticket
was coming back with two children.
Okay.
So that was the, that's what we had underway.
And then I said, okay, I need to establish that that was a real fact that that actually
happened.
And then third, I wanted to obtain his home address.
Now we had, of course, we had a bunch of other stuff going on in the background.
So they were collecting data on what he was doing and trying to tie it to him.
And then this was, this was my job.
So that was the plan.
Okay.
Now, before I go on, I need to say I'm not a lawyer, but my lawyer said that what I'm
about to do is okay.
Okay.
So I'm going to hope that they led me the right way, because I'm going to play you some
altered phone calls of this exact case and the things that I got to do.
Okay.
So we're going to talk about it.
So stage one.
Oh, same.
We doxed everything.
I had this guy's family.
Yeah.
I know that's a great one, right?
Research.
Okay.
So I had to establish everything.
I needed to know his family history, where he, where he came from, because he wasn't
from America.
I needed to understand, but he was living in America at the time.
So where he came from, the places he travels, where he likes to travel, his likes and dislikes,
you know, and, and as disturbing as this is, when you do this work, you realize you got
to actually look at them as a real person, right?
They, when you, you, you got to take out the fact that what they're doing and you got
to say, I need to understand that this guy may like the same music as me.
He likes baseball.
He may like the same things as me as hobbies outside of hurting children.
He has hobbies.
I need to understand those because depending on the attack vectors that we're going to,
we're going to perform, I needed to know all of that.
What businesses does he say he's a part of or what, where has he worked?
Right?
The licenses that he may have things like business licenses, other things.
And then of course, any houses, apartments, property, and other things that, that he would
own that we would then, um, you know, be able to obtain information on him.
This is what we call profiling, right?
So this helps us develop a profile on this target.
So we have a target.
We know all these things about him, and now we can say, here's, here's what we can utilize
and all this information to, to target this person.
After this was complete, you know, we had like dossiers.
We can write a book on this guy.
Then we moved to stage two.
Stage two was calling airlines over and over and over again until we found someone that
could confirm some things, which was confirmed that he had a flight.
Give us the details of the flight.
Okay.
So what pretext did I use?
Well, I developed a pretext that I was his assistant.
I was his personal assistant and that I was verifying flight details because he had some
very important guests.
Flying in with him.
And I needed to make sure because he had a messed up flight before he has a lot of stress
and anxiety with the messed up flight.
Now I need to, I need to stop for one second and say something about this call.
You're going to hear, because I'm looking out in the audience.
There's a ton of students that I've had in my classes here and what I'm about to play
breaks the rules of what I've taught you in five days on the course.
Okay.
So this may seem a little.
Hypocritical, but I want to explain first.
Our mantra is leave them feeling better for having met you.
Okay.
That's our mantra in professional social engineering.
We do not use fear-based or threat-based pretext ever in our work, but those rules go out the
window when I'm dealing with pedophiles.
Okay.
I don't care how they feel at the end of the day.
And I don't care if they feel scared with my pretext.
So once I can establish the fact that I think this guy is legit, then those rules go out
the window.
Now that may be self-justification, but there you have it.
Okay.
So after 20 calls, here's, here's what occurred.
Let's listen to this.
Hello, how can I help you?
Hi.
Sorry.
Sorry about crying in the background.
My name is Paul.
I'm a personal assistant for it.
And.
Very important guests flying in with him on your airline.
And we had so many problems on the flight out.
I didn't need to confirm that the tickets are still active and that he has seats right
next to each other.
Can you help me with that please?
And again, just excuse the noise.
I'm sorry.
I have a sick kid and I'm driving to the doctor and trying to take care of this now.
Oh, I'm really sorry to hear all that.
Um, I will get your confirmation number to be able to help you.
Okay.
Um, I'm sorry.
I'm driving, but let me just see.
He, um, my boss.
Basically he just called me and chewed me out because normally I do all these checks
before he flies, but my kid's been super sick and I'm a single dad.
So I don't, I think, I think he gave it to me.
I have a note here written down.
Let me just see if this is it, but maybe an old one.
Is it a X, D, C, V, F, W.
I'm sorry.
No, that is a confirmation number, but it's not the right one.
Okay.
Um, let me see again.
I'm driving.
I'm sorry.
How about this?
Can we look it up by his name?
Yeah.
Let's try it.
Uh, what is his name?
Okay.
Let me spell it for you.
Cause it's, it's a, it's, it's a hard name to spell.
Um, yes, I do see a ticket in the system room.
Okay.
Superb.
Um, so what I need to confirm is that he's going from, and that there's two other tickets
that will be children that are booked with him.
Do you, do you see that?
Um, let me take a look.
I, um, I'm not sure if I can tell you that.
Um.
Oh, so I, I, I understand.
Like I said, I'm driving to the doctor and I have my kid.
I don't have all this information on me and he's really not happy.
And I don't know how your boss is, but when he gets upset, it can really be bad.
The flight out was delayed two hours and he missed the meeting.
So he was mad also because of that.
I know, I know none of this is your problem, but I could just really, really use a break
today.
Oh, okay.
Hold on.
Hold on.
Uh, okay, listen, um, I, I do see his tickets going from two on, uh, he does have two tickets
and those seats are right next to him.
So you don't have to worry about that.
Do you want those confirmation numbers?
Yeah, you are a lifesaver.
I would love to have them.
Thank you.
Oh, no problem.
Um, so hope your kid feels better.
They're, um.
Okay.
Okay.
I can't thank you enough.
You probably saved my job.
And now if I need to call back, I'll have to go through all of that.
So, um, look, I got to run to the doctor's office now, but, um, I can't just, man, you
really, you gave me the break I needed today.
Thank you so much.
Uh, no problem.
I'm glad you're in the home.
Have a good day.
Thank you.
Okay.
So crying baby works, right?
Thanks.
Thanks.
Crying baby works every time.
I'm just telling you, right?
You hear it and you automatically feel sad, right?
For especially single dad thing.
So, you know, again, student, student, student, I'm sorry.
That breaks all the rules.
Okay.
But, but we, we had to do it.
Okay.
Then when we established that he had these flights, I got confirmation numbers.
I established that he had two children with him, um, on those return flights.
So now we just needed to get his home address.
So what we did is, um, we, we knew through other OSINT, um, because he had a, you know,
like a Facebook page where he posted normal things.
And when he traveled to make his travel appear normal, he would post pictures about his travels.
So we knew that he rented from a certain rental company.
Uh, so my, my pretext was going to be, let me get to that slide.
Yeah.
So my pretext was going to be that, uh, we did OSINT on, on the, on the area that he
rented and we found a local pizza shop.
So we got a pretext that, um, I'm calling from the pizza shop and that this guy left
his iPad after.
He, after he ate lunch at my pizza shop and, um, and then what I wanted to do was
return it to him.
So I'm going to try to get his home address from the rental car company so I can mail
him his, his, his iPad back.
And, uh, we knew this was going to be difficult, right?
Because I mean, man, you're calling a rental company and they're going to give you some,
some strangers, some strangers, um, uh, address.
So again, I'm breaking another rule.
Students, I use, I use bribery of offer of free food, um, to the, to the target to,
to get it.
I'll give you the end of that in a minute once you hear the call.
Hey there, this is, uh, Tony from Big Al's Pizza over on 5th.
I got a problem.
I hope you don't mind me missing it.
Oh, Big Al, I love your pizza.
You guys can get off some pizza.
Hey, thanks.
I got lucky.
If you help me out, I, I swear there's going to be some free food in it for you, okay?
Oh, man, I'll make, what can I do?
I'm just kidding.
Two little girls.
I had a great lunch, paid cash, was showing me pictures of his dogs and his kids and the
travels on his iPad.
He leaves and one of my gals goes to clean the table and his iPad's sitting there in
the seat.
He left with a, with a budget rental agreement that's sitting in the iPad.
So we just figured that, you know, that's where he rented the car.
I tried to get in, thing is passworded.
The rental agreement is like torn and wet, so I don't have a name on it, but I figured
I'd call you and see if I, you know, if I could get it.
This happened yesterday, so it wasn't even today, but I got so swamped and it was sitting
on my desk, I figured I'll, I'll, I'll try it out.
Now, so I got his name from the rental agreement, but no address or anything, so I'm not sure.
What can we do?
Well, let me, let me see if you can return this car to me.
I'm sure you can catch him and you can leave it here for pickup.
Okay, so let's, let's check.
That's a good idea.
His name is...
Ah, shucks, Tony.
You already left and he returned the car.
What do you want?
Oh, darn, man.
Well, okay, so this iPad looks brand new.
He's probably freaking out thinking he lost it somewhere and it's, it's passworded and
locked up, so it's probably not even online, but I don't know.
How do I get this back to him?
Like, if I had his address, I could ship it to him.
So what if I give it to you and you looked up his address and you ship it back?
I'm sorry, man.
We, we can't take responsibility for those items unless we find him in the car.
Let me think.
Ah, so I'm not supposed to do this.
Chris, you're a genius.
Yeah, you know, I can definitely do that.
I'll ship it out today.
What's the address, man?
All right, all the kids, ah.
You know what, Chris?
You're awesome.
This is going to be a $25 gift card for you here.
I'm going to put it in your name, but what's your full name?
Oh, you seriously don't use that?
What?
I love the pizza so much.
You know, I got this guy's iPad.
He had two beautiful kids with him.
I think he's probably wondering where it is.
Got all his business stuff on it.
So you just saved my day and you probably saved his day.
It's worth $25.
Cool?
Thanks, Tony.
This is awesome.
No problem, man.
So I called Big Dallas Pizza and I bought a $25 gift card.
Yeah, I don't want the kid going in there to get his gift card and be like, what the heck, you know?
So I wanted them to be rewarded for his work.
You know, he did help me out.
So, you know, he gave me the guys.
He went in and I just, you know, I don't even know.
I know the follow up.
I'm hoping he got the pizza and everything was good.
You know, I called them and just said, look, some kid's going to come in.
We're giving them an award for a great job at work.
His name is Chris.
You know, last name.
I want to pay with a card.
$25.
So, yeah, he got his pizza.
So we handed over all that OSINT to the federal government.
We handed over all the call data.
We handed over all his geolocation data that we had.
We had handed over his proof of flights.
And that was enough for them to start an actual investigation into this guy.
So.
So that was rewarding and exhilarating.
But, you know, you can ask my wife.
There was, like, many nights where I didn't sleep very well or at all because of the things
you're dealing with.
And it took a dozen of hours and a lot of stress.
And it was not my job.
Right.
So I'm still running the company, trying to keep my employees employed, you know, my
family happy while doing this.
And that's when I started to think.
That's when it hit me.
And I looked just like that gorilla when I had that.
This thought.
I said, what if I can harvest talent from this amazing community that we have of people
that are just so smart, way smarter than me and can do things that I can only dream of
doing.
Right.
There's a group of people downstairs right now hacking a car.
Okay.
The people in this community that are amazing that and we can build tools to track and
uncover perpetrators, people who hurt children, people who trafficked children and spread
child pornography.
And that's when it hit me that I needed to start.
Something.
So I did.
I started the Innocent Lives Foundation and it's an actual real foundation.
501 foundation that is being launched today.
As a matter of fact, here at DEF CON.
So a little bit about it.
Here's our, our mission statement.
I'll tell you the story of how it came about in a minute, but our, our goal is to unmask
anonymous online.
Child predators to assist in bringing them to justice.
Now, what does this mean?
Because we're not vigilantes, right?
As much as I want to don a Batman outfit, which was really bad on me, you know, that
tight.
No, I don't want the Cape because if I put it and don a bat and go beat these people,
it's not the goal.
It's not the goal, right?
We save more kids by turning all this information over to law enforcement and to working closely
with law enforcement in order to, to have them brought to justice.
So what I did is I assembled a team of people that can help.
Okay.
So I talked to Rob Barra.
When I put Iron Man, I don't mean that as the movie Iron Man.
This guy like runs Iron Man.
Like I eat pizza.
It's like unbelievable.
Like this case, like he's the most in shape person I've ever met in my life.
I think he actually eats nails.
Okay.
Ex army ranger.
And he's experienced in traffic and trapping traffickers.
It was a difficult.
Difficult sentence to say.
So he, he tracks human traffickers.
That's what he's done for many years after he exited the military.
Wonderful guy that has a lot of skill in this area.
And then I talked to Tim Maloney.
He's not only my business lawyer, but he's also very heavily involved in the nonprofit
world.
And I figured if we're going to do this, we kind of need a lawyer, right?
Need a lawyer to help us out.
And then I spoke to Neil Fallon.
If you don't know, Neil Fallon isn't get out.
No, just kidding.
That's the least thing or a clutch.
We've developed a friendship over the last few years.
Uh, because, um, interestingly enough, I reached out to him to come on the podcast.
And, um, and at first he's like, who's this weirdo that has the title human hacker that
wants me to come on his podcast.
And no joke.
This is how it happened.
He, he, he was releasing, um, um, earth rocker album and someone before like a month before
it's released, someone stole it and put it on the web.
So he calls me and he says, Hey, remember you wanted me to come on your podcast and
make you a deal.
Can you, can you track people?
Who steal stuff and put it on the web?
And I'm like, yes.
So, so he gave me the site and literally within an hour and a half, we had this guy's home
address.
We had his whole life story.
We knew everything about him.
So, and it ended up being, he was like some 20 year old kid that worked at the, uh, CD
factory in Germany that stole the CD and came home and pirated and put it on the web.
So, you know, he was like, I want to know more about this.
So we ended up hanging out.
A bunch of times and going and seeing him at his shows and stuff.
So I figured, you know, if you're going to do something like this, how cool would it
be to have someone like him with such a great name that can help bring awareness to it?
So I called him and he says, okay, look, so remember the first time you reached out
to me, it was really weird, but now you're like, you're asking me if I want to be part
of a foundation, that's going to trap child traffickers.
Like he goes, do you realize every call you make to me is just really, really good.
It gets weirder.
He's like, like what's next, man.
And I'm like, no, I'm just kidding.
I swear.
This is it after this.
I mean, it's like no more, nothing else can happen.
So right now this is our board.
And, um, and we met, we met, um, over the last few months and came up with it with this
plan.
So this is how we want to do it, right?
We're going to seek the assistance of the appropriate members.
Now, these are the questions that come up.
What does that mean?
Well, obviously we, I mean, I'm, I'm sure everybody in this room wants to help.
Um, you know, you can't hear these kinds of things and not want to help, but we have
to be able to vet people and make sure that they're, you know, make sure that they're
legit.
Right.
Because the other thing that we are very aware of is that, um, you know, if you are not
saying you saying a general thing, if, if anyone who is a child trafficker or a pedophile,
they can look at that as, Hey, maybe I can help me find the sources.
So we're going to be vetting people heavily, but we need the talent from this community
because without it, we can't, we can't succeed, right?
You guys can do things that normal humans can not do.
Right.
And it's amazing when you think about it.
We want to create tools that will assist.
Uh, you know, there's a tool out there right now that somebody has put out there that if
you're traveling, like for a hacker con, you can upload a picture of your hotel room and
it, it catalogs it.
And then law enforcement could take a picture of a child who's being trafficked and run it
through this database.
And it will correlate that data and tell law enforcement, which hotel it was taken in because
hotels use certain type of carpeting, certain type of bedding, serpentine, certain type
of curtains.
That's an amazing tool, isn't it?
I mean, they caught child traffickers.
Just because people like you were uploading images to this database from their hotel rooms,
you know?
And that sounds like a weird request.
Like when you're traveling.
Anyone know the name of it?
Such an amazing tool.
I forgot the name.
I'm going to get the name.
It's going to be on the site.
Okay.
I will.
I'm going to tweet it because I'm going to get it.
But.
There's tools like that that are out there for this purpose.
You know it?
Yeah, it's trafficcam.com, but it's T-R-A-F-F-I-C-K.
Trafficcam.com.
That's when you upload the photos of your hotel room, right?
For a law enforcement database.
I think that's the one.
It's spelled T-R-A-F-F-I-C-K cam.com.
Okay.
I'll check.
We'll check it out after.
And I will.
Oh, here it is.
Okay.
Yes.
This is it.
This is it.
You hand me your phone.
Thank you.
It's called the Polaris.
The Polaris Project.
Okay.
This is the one.
P-O-L-A-R-I-S project.org.
This is the one.
The name now.
This is it.
You upload a picture of your hotel room to the database on the website.
And it puts it out there for law enforcement to be able to correlate.
What I'm saying is how many of you didn't even know this existed before right now?
Right?
So think about this.
We need to get that message out there.
We need to be able to build these kinds of tools to help law enforcement.
We need to be able to collectively spread the word about that because we can all make
a difference when it comes to this.
So how else will we do it?
Well, we're going to use open source because we're not...
I need to stay above the law, right?
I still have a business and a family and my own kids I have to protect.
So I'm not looking for people who want to hack into things illegally.
We need to do this all above the board.
Because...
It's not just TV life.
You know, criminals get off because of a mess up.
On one thing, a criminal can get off.
So if we do anything illegal, it can make the whole case nullified.
So we have to be able to say that the things that we're doing are above board.
And we're going to use OSINT to do that.
And then we're going to establish, and we already have established,
numerous relationships with law enforcement agencies.
To be clear, we are not agents of any state agency.
That is not the case, right?
We are not...
Law enforcement.
But working closely with law enforcement.
Shortly before DEFCON, I uncovered 51,000 child erotica images on the open web.
51,000 child erotica images.
That can...
Nothing can be done about it.
Want to know why?
Because child erotica is not illegal.
As long as they're not showing the lower genitals of a child, it doesn't matter.
Isn't that disgusting?
And yet, these images all...
And yet, these images all lead to paste bin sites where they were selling the videos of those
child being raped.
51,000 images, right?
So we work closely with law enforcement to get those things out there.
So we can hopefully even make just a tiny, small, little dent, okay?
So about the org, and then we can talk.
That's the foundation website, InnocentLivesFoundation.org.
That's our Twitter account.
And we're going to be, of course, just reaching out to the community.
Asking for help in multiple ways about how we can do this.
So I left a lot of time because I wanted to just kind of open it up and see what you guys thought
and be able to answer any questions you have.
And also, it's a really heavy topic.
So I didn't...
You guys are so quiet.
I haven't had the room this quiet like in decades.
Yes, sir.
Do you have a framework or are you going to develop a framework to liaise with the law
enforcement in various states, cities?
Yeah, that's a good question.
So the question was, do we have a framework for...
For creating those relationships with law enforcement?
So this is all new for me.
So my...
Our present relationships with law enforcement have come about somewhat by accident.
I do a lot of training when it comes for a social engineering with the U.S.
government and law enforcement agencies.
So a lot of those relationships have led me to say, hey, you know, can you help me out?
Like, who would I talk to about this?
And I've gotten in with some of the federal agencies to be able to work out those relationships.
So I would not call that a framework because in my mind, a framework would be a definite
process for how to do this properly.
So yes, Rob Barrow, the one I put up there, he's the COO of the foundation, and his job
is to help us develop those processes and also the vetting process so that way we handle
both the volunteers as well as the handoff of law enforcement properly.
So yes.
Yes, ma'am.
Is it a foundation or is it a final one?
Is it a...
Is it a foundation or is it a final one?
That's a great question, and there is a difference, which I did not understand.
It is a 501 .
That is what the application has gone into the federal government, and I did get clarification
after we did all this that a foundation is normally like some kind of family fund type
of thing.
So it's...
But it is a 501, a legit 501 .
And we...
The application has been accepted.
You know, we're waiting for the final approval papers from the IRS, and then, you know, it's
all go time from there.
Yes, sir.
How's your interaction with law enforcement so far?
How's your reaction to this?
Yeah.
So the question was, how has law enforcement reacted to this so far?
So you can kind of imagine the first phone call that I had with law enforcement didn't
go so well because they were like, so you want to do what?
And you're, you know...
So here's what happened is I found a...
And it really was by mistake.
I'm working a case of a father.
Who has taken by force his daughter away from the mother and somehow has manipulated
the courts.
So he has won every full custody of her.
And the girl has alleged being molested by him.
And the courts are still doing nothing.
And in doing research into her name, which was she there, the father's name is Russian.
And doing research into his name, I came across some paste bins and I thought, oh man, maybe
this is some proof of this.
Of this stuff happening.
And that led me to some really, really dark stuff.
I mean, some really bad things.
So I called after the first few initial calls.
I called back that contact and said, hey, I have something that may be interest of you.
And soon as I handed over actionable intel, now I'm their best friend.
So it went...
And it wasn't planned, right?
I mean, obviously it can't be planned.
But at first they were like, I wonder who, you know, who this guy is.
You know, I'm emailing them because I didn't have the...
The org at the time.
And I'm emailing them from social-engineer.com, you know.
So, you know, it looks a little weird.
And now we have a very...
I mean, honestly, this guy probably calls me once a week and we talk about stuff.
And he...
One of the agents I'm in touch with, he specializes in revenge porn.
So I've been talking about that.
And another agent, the group of them specialize in crimes against children.
So I've gotten some good traction with that, but it started off really rough.
It's a great question though.
Let me go back here.
I don't want to look at you because you'll make me cry.
Okay.
That's my daughter.
Yeah.
Do you work with state law enforcement or state agencies?
Yeah, you know, I want to.
So I have one state agency right now that I met with.
And I had another one approach me here that heard through the grapevine about this and said,
would you be interested in working with local state?
Yes, I do want to because I think a lot of times that these problems will exist on a local,
local level, and it will be easier to get local law enforcement involved as opposed to state,
state law enforcement.
Yes.
How can we know that the traffic can?
That, that website?
Okay, that's a good question.
Well, you're not, they're not asking you to upload a picture of you in the hotel room.
So it's not like go lay on your bed and upload a picture.
So that's a different website, honey.
That's a different website.
Okay.
And if you upload any pictures of you anywhere, I will kill the internet.
Okay.
So that's how it's safe.
Okay.
The Polaris project is the one that Paul found.
That's the, that's the one.
That's a legit project that was made by someone in this community.
It's, it's, it's amazing.
And it's backed by law enforcement.
Well, no, the pictures are uploaded anonymously and your
name is not tagged to it.
Yes.
How are you protecting yourself when you do this?
Because you're about to be on a stage where you're going to be spaced out on the street for a little bit.
Yeah.
And that's sort of an installment problem wherever you're working.
Yeah.
So the question is, how am I protecting myself?
And I'm assuming you're meaning from a, an internet perspective.
Yeah.
Yeah.
So from an internet perspective, it's, it's, it's a, a lot of VPNs that don't come back to me.
And,
a lot of VPNs and machines that I don't leave laying around for my children to use.
Yeah.
That's, that's basically it for now, sir.
Are you then also doing that?
Clearly some agencies in the government have the ability to break things like
for another thing and you would never want to get rolled up into one of those.
Correct.
Investigations.
So are you making them aware when you are participating in these?
No.
That's a really good question.
So to be clear, it's like, we're not going out on the internet and typing in,
give me child porn and then looking for, for, you know, those people that are, that are doing it.
And then, and then, you know, that's not the process that we're following.
So a lot of times it comes from an example, that case I'm working now where this father
took the daughter and there's an alleged child abuse allegation.
And he is known for sex crimes against children.
Now we will take that name.
And look and try to uncover what he's doing online.
In the case of the child erotic images, we now have a list of usernames from those sites,
and we'll see if we can correlate them to real people in the real world.
Right.
So down the road, what I hope is that there will be more collaboration for
protection of what you're talking about.
That's what I hope.
I just want to make sure nobody here thought that running out on our own.
Bad idea.
Yeah.
Do not try this at home.
Yes, sir.
Thank you.
I don't, I don't know.
I really suck at that.
Yeah.
Okay.
Okay.
Talk to me afterward.
I, I, you know, here's the thing is like it.
Literally the, the way this came about was, was just that it was like, I got done with that job
and I was so stressed, but it was, there was so much exhilaration from the fact that he's off
the streets.
He's no longer trafficking children into this country for the purposes of sex and pornography.
And I'm like, I want to not do it ever again, but how do I not do it now that I know it exists?
And and that, that hit me.
So I said, I need to have help, but I didn't think about how are we going to market it?
It was like, well, these 400 people know they'll tell 400 people.
And then maybe in 18 years, it will become something, you know, I don't know.
I'd love to talk to you about that.
Okay.
Yes.
Boy, there's so many hands, sir.
Yeah.
So that you go to that website and you, you you'll put, and right now it's, it is literally
like, like two pages, you know, it's, it's the.
Yeah.
It's, it's the information about who we are, like what you heard here.
And there's a contact page and there is a donation page.
If you want to contact you do that, that will come directly to us.
And then we will reach out and talk about how we go through vetting and, and get people
involved.
Okay.
Now we'll be on the contact page.
Thank you for that, sir.
Yeah.
So you mentioned the donations.
So how is this going to primarily be financed?
Will it be donation based or will it be something else?
There'll be nothing else that I, that I have any ideas of yet.
Right now it will be donation based.
And it's, and it's, it's, it's free time on my part until, you know, that, that's it.
Yeah.
I mean, right now it's all been me and, and Rob has been helping out.
You know, it's, it's the donations are going to go towards not me because I have a job.
The donations are going to go towards helping hire people to build tools.
Let me, let me tell you why that's a really good question.
And I guess I should have explained this better.
I had a moment at a time where we needed help on something and it was something I could
not do.
My technical capabilities were not there.
And I called a really good friend in the industry.
And I said, Hey, can you help me do X, Y, Z?
And he said, yeah, I can do it this week.
I'm heading out of town to do a red team job.
Can I, can I call you next week?
I said, no problem.
And next week came and I called him and he's like, dude, I came back with the flu.
I can't even touch a keyboard this week.
Okay.
Next week.
My boss sent me on another job because I was out for a week and literally just went on
for like three months at the point where it no longer, the data was no longer useful.
And I said, you know what?
Though, if I could have said to him, you know what?
Here's three grand that your, your hourly rate, whatever it is, it's 200 bucks an hour.
I need you for 15 hours.
Here's three grand do this project.
Then I could have got that because he wouldn't have been taking, he could have went to his
boss and said, Hey, this guy wants to contract me.
You know, you cool with that.
And I could have got his time paid for.
And that's where the donation is going to go.
We want to build a tool.
We want to contact Polaris and say, Hey, let's partner, let's get you on the site,
whatever.
Maybe another tool like that.
That's where the money's going to go is towards that.
Yeah.
And then if we need to hire staff, because it actually becomes something that I hope
it will, then that's where it will go.
So that's the plan for it.
I should have explained that better.
So I really do appreciate you, you asking.
Yeah.
Thank you, sir.
No, that's a good question.
The only way we become an agent of law enforcement.
If law enforcement asks me to do it.
Oh yeah.
Law enforcement is not asking us to do this, right?
So, um, agent of law for me, if the FBI came and said, Hey, can you go crack, you know,
crack into this guy's life and see who he is, uh, then we would be an agent of law
enforcement, but I don't foresee law enforcement doing that.
If someone here is law enforcement and you want to do that and talk to me about it, talk
to me about it, please.
But that, that is not something that I think is going to happen anytime soon.
Okay.
Just we'll go along the line.
Yes, sir.
So it's a lot of just normal OSINT SE tools, right?
So what we did in those jobs, I use a lot of Maltego.
If you don't know Maltego, I don't know if those guys are still here, but you should
talk to the guys.
Maltego is like my, like if I was on a deserted island, that's what I would bring is Maltego
and my wife.
Okay.
But I bring Maltego, right?
Okay.
I love you, honey.
But.
I really would bring Maltego.
It's awesome, right?
So it's just open.
It's like Google dorking, Maltego, and then the many, many, I'll tell you who's amazing
is Michael Basil's site, inteltechniques.com.
He just put together a slew of search engines that just rip open the internet on all open
source stuff.
That's amazing.
And there's even some really good dark web search engines out there now, believe it or
not.
So that, those are the things that we're utilizing.
Okay.
Terry.
Asking for a friend.
How are you?
Oh, no, really?
This is a dirty pool.
So when you're doing these things and you're stumbling across the horrible things that
you're hitting that you're inevitably going to find, how are you protecting yourself from
legal action?
As.
I mean, how do you prevent or how are you protecting yourself from looking like a perpetrator
instead of one of the good guys looking for it?
Yeah, that's where the relationships with law enforcement comes in.
So the question was, how do I not look like one of the bad guys, right?
To law enforcement, I'm assuming is what you're asking.
That's where working with law enforcement closely comes in to protect that, right?
So letting them know what we're doing ahead of time.
Working with them and saying, this is where we're, you know, this is what we're looking
for.
This is who we're looking for.
The people that will work with the organization will be known by our contacts in law enforcement.
You know, there's, there's a whole process for that.
So we don't end up on the bad side of that.
And, and just to be clear, you know, cause there is a, there has been some research about
people who generally work in children against crimes units on the internet.
They don't last very long.
And that's because eight hours a day, they're spending looking at that crap and you can't,
I don't think a human brain was meant to do it.
If, if you're not, if you're not a pervert, right?
If you're not a deviant, um, and, and we won't ever, that's not going to be the case.
That's not the, that's not as the goal, right?
Of, of doing that.
It is to uncover people who are selling it and traffic it, not to find the child porn,
right?
As it is, is to uncover the people who are making money from it or who are conducting
business in doing that.
So that, those are the people that we're hunting.
Yes.
I'm schizophrenic already.
No, I'm just kidding.
Um, so that's actually a very, a very good question.
So you have to, you really do have, I think with any work you have to temper yourself,
right?
And you can't.
So for me, like with that one, that one case that I talked about, um, you know, my daughter
doesn't know this, but there was one point at night where I just went upstairs and I
just crawled up next to her and just hugged her for an hour.
And she's like, you're, you're, you're, you're, you're, you're, you're, you're, you're, you're,
you're being weird.
And I'm like, I know, but just let me hug you for a minute.
You know, let me just lay here and hug you.
And I do.
And, um, you know, this is not the purpose of the speech, but you ask, um, I, I have
a very heavy belief in God.
So I spent a lot of time, um, after these things, like making sure that I fill my mind
with better thoughts, things like the Bible and other things that will help me, uh, balance
the garbage out of there.
So, you know, everyone has their own methodology.
That is mine, sir.
Yeah.
Um, I haven't, I don't know.
I I've heard recently about these, um, about these things.
And I also, and here's something that I have used is, oh, I'm sorry.
Yes.
Um, he asked if there's software out there that, that will block.
Like that was just a, it sees that there's skin in an image and it blocks it.
So yeah.
Yeah.
But there's a, you know what?
Um, yeah, that sounds like a really shady site.
You want to block skin.
Go to hot dog, hot dog, hot, hot dog.com.
Yeah, no, no.
Don't listen to that guy.
Okay.
But, um, but what, um, um, what there's, there's text based browsers, right?
Where you can disable all images like the Tor browser itself.
You could say disable images.
And I've done that numerous times where, cause you know, there's usually a description
in the image or under the image and you can block the image.
You don't have to see it.
So the image doesn't load on your computer.
All you do is get the text, you know, what's there, but you, you have the URL.
You have that, but you don't need to see the image.
I've done that numerous times when I know what I'm going to, right?
Um, so that, that guy behind you had his hand up for a million years.
You have no blood circulation in your hand.
You're just worried about me dragging the tours of witness or having to testify to
how you've gathered up.
You're going to want to come up with some procedures.
And if you have people working for you, you're going to want to try and protect them as
well.
Yeah.
Be careful.
Yeah.
I'm open to advice.
So I appreciate it.
Thank you for that.
Hisham.
Um, I have a quick question.
How are you?
Well, um, for right now, we don't have any plans on, on geo on, on limiting geo location
because these people generally don't just stay in the U S right.
Yeah.
Language support will be a big thing, sir.
I would hope so.
That's one of the things, the strength of this community, you look at something like
set set was made literally over a glass of whiskey between Dave and I.
I called him like, I got this cool idea.
Can you do it?
He's like, I could do that.
No problem.
Bam.
I'm literally, it was like an hour later.
He sent me a Python script that was set zero zero one or 0.0.
It was like amazing.
Right.
And I'm like, wow, that's, that's crazy.
Like you, you just put that together.
Now we can fish people and I don't have to go buy a tool.
And then it went from that to what it is today, which is like the most ridiculous thing ever.
Right.
It's like a whole.
A whole suite of tools.
That's the, and now he has a team of people working on it.
Open source.
That's the goal is to have this community help do that kind of stuff.
Yes, ma'am.
Are you thinking about how to screen volunteers?
Yes, yes.
That process is already.
So, um, and we'll, we'll, we'll give more detail to any volunteers, but that's a, it's a good point.
Um, we will be, um, vetting them all through our own.
Like we have access to PI databases and stuff legitimately, and we will be running all names
through our federal.
And if they come back with, and this is before anyone even gets anything, uh, for work, you know,
that, that will be, that will be the case.
So that way we will not be.
Hopefully, I mean, you know, of course it's not a hundred percent and, um, we are going to reach
out and hopefully start working with people that we know from the community too, because there's
some verification in that too.
So the question was, well, this expand into other areas like human trafficking and things like that.
Um, so the original goal was to also have it cover revenge porn, cause that's a big problem,
but, uh, some things happened in the, in the org, in the, um, making of this foundation
where that did not come to fruition.
So, um, we felt at first it may be the best.
Yeah.
to just focus on this and then as we grow as a team and we get more answers, the answers
that you guys and gals have so we know our process and framework that we'll be able to
do that.
Thank you.
I look forward to your help on that too and advice.
Thank you guys.
Thank you so much.
Thank you.