1
00:00:00,000 --> 00:00:03,440
We really appreciate being here today. We're going to give our attention to Jason Street.

2
00:00:04,260 --> 00:00:07,920
Who's that? Have you given anybody awkward hugs lately? I've given a few. Alright.

3
00:00:10,720 --> 00:00:11,120
.

4
00:00:11,120 --> 00:00:11,160
.

5
00:00:17,060 --> 00:00:21,740
We're going to give our attention to Jason Street. His theme is how to protect your banks and enterprises.

6
00:00:22,100 --> 00:00:24,740
A talk by someone who robs banks and enterprises.

7
00:00:24,740 --> 00:00:25,160
.

8
00:00:28,360 --> 00:00:32,360
So I like to start these kind of talks with a legal disclaimer.

9
00:00:32,800 --> 00:00:35,000
I'm not a lawyer, but I've played one on the internet.

10
00:00:35,860 --> 00:00:39,600
This is it. I'm adorable, okay?

11
00:00:39,960 --> 00:00:44,660
I will not try to steal from you, kill you, or ruin you financially unless you pay me first.

12
00:00:44,820 --> 00:00:48,720
There's always a contract. So when I talk about some really horrible things

13
00:00:49,220 --> 00:00:52,720
and in some of these versions of this talk, every talk I've done

14
00:00:52,720 --> 00:00:53,660
this year has been different.

15
00:00:54,740 --> 00:00:57,540
Every version has one thing in common. It's really, really evil.

16
00:00:57,820 --> 00:01:01,240
So when I get to some of those points, just remember the kittens.

17
00:01:01,520 --> 00:01:06,420
I'm adorable. I'm not a bad guy. I'm just really good at playing one

18
00:01:06,420 --> 00:01:07,900
for good reasons.

19
00:01:09,000 --> 00:01:14,640
So the key thing about this talk, you're going to see a common thread, and it's just how we suck at risk assessments

20
00:01:14,640 --> 00:01:18,460
and how we're not worried about trying to defend our stuff so much

21
00:01:18,460 --> 00:01:21,400
of what's really going after us. We're defending ourselves

22
00:01:21,400 --> 00:01:25,800
from things that really may not actually be going after us,

23
00:01:25,860 --> 00:01:29,080
and we need to go and start scaling back and actually defending the stuff

24
00:01:29,080 --> 00:01:33,200
that we can do immediately and effectively right now

25
00:01:33,200 --> 00:01:35,760
instead of worrying about all those other threats that are coming out there.

26
00:01:36,260 --> 00:01:41,180
This is the perfect example because this was the Super Bowl from this year.

27
00:01:41,480 --> 00:01:44,800
The Vice President was there, 5,000 police officers, Secret Service,

28
00:01:45,240 --> 00:01:47,100
probably some in the audience right now. Hi, guys.

29
00:01:47,100 --> 00:01:51,140
And a lot of other kinds of law enforcement and feds

30
00:01:51,140 --> 00:01:55,400
there at that event. High security event. Tier level one security.

31
00:01:56,120 --> 00:01:59,200
Three teenagers went through a chain link fence.

32
00:01:59,500 --> 00:02:02,040
They found a ladder, and they were like,

33
00:02:02,100 --> 00:02:05,900
hey, let's just carry this ladder in and see what happens.

34
00:02:06,380 --> 00:02:09,660
And guess what happened? Everybody let them through.

35
00:02:10,040 --> 00:02:15,040
There's three guys carrying one ladder, 5,000 cops.

36
00:02:15,220 --> 00:02:16,600
Yeah, seems legit.

37
00:02:19,180 --> 00:02:20,580
What's up with that, right?

38
00:02:20,860 --> 00:02:24,180
The best part about it is they YouTube'd all of it.

39
00:02:24,800 --> 00:02:29,000
Guy Fieri and TMZ made cameos on this YouTube video.

40
00:02:29,240 --> 00:02:32,860
It was amazing. So there's your high level security event.

41
00:02:33,740 --> 00:02:36,780
It's like they were worried about all these other kinds of threats,

42
00:02:36,860 --> 00:02:40,040
but they were, you know, not prepared for teenagers

43
00:02:40,040 --> 00:02:44,880
and a chain link fence with a hole in it. It's like you may want to worry

44
00:02:44,880 --> 00:02:48,740
about those things. Least important slide, but it's got to be in there.

45
00:02:48,940 --> 00:02:52,940
I'm a blue team and a red team guy. So I don't

46
00:02:52,940 --> 00:02:56,060
just try to destroy the stuff. I like try to fix it as well.

47
00:02:56,260 --> 00:03:00,660
But how can you properly defend your networks and your companies and your

48
00:03:00,660 --> 00:03:04,500
corporations and your enterprises if you don't really know how they're attacked?

49
00:03:05,160 --> 00:03:08,820
And that's one of the other main themes of this talk is how do you

50
00:03:08,820 --> 00:03:12,580
attack them? So, because we suck at

51
00:03:12,580 --> 00:03:16,120
risk assessment. Remember in 2015? It was the Ebola's.

52
00:03:17,140 --> 00:03:19,320
Oh my God, the Ebola's came to America.

53
00:03:20,900 --> 00:03:24,620
Everybody flip. This is worse than Shark Week, right? Or the Summer of the Shark.

54
00:03:25,320 --> 00:03:27,180
It's like Ebola's came to America.

55
00:03:28,220 --> 00:03:31,200
How many people died from Ebola in America?

56
00:03:31,960 --> 00:03:36,440
Two people. Two people died. And that's tragic. That's not funny. Two people died

57
00:03:36,440 --> 00:03:37,880
from Ebola. That's horrible, right?

58
00:03:40,540 --> 00:03:42,060
Why are y'all laughing?

59
00:03:42,280 --> 00:03:45,560
Y'all are horrible. Now you make me laugh and I look like a jerk.

60
00:03:46,080 --> 00:03:49,260
It's like, okay, at that same

61
00:03:49,260 --> 00:03:53,660
Okay, yes, that is true. I am a jerk. But still, it's like that same

62
00:03:53,660 --> 00:03:57,880
year that two people died from Ebola, 55,000

63
00:03:58,540 --> 00:04:00,080
Americans died from the flu.

64
00:04:01,560 --> 00:04:05,100
So while you were out there preparing for the Ebola to come and get you,

65
00:04:05,100 --> 00:04:07,200
maybe you should have taken a flu shot.

66
00:04:08,520 --> 00:04:12,540
That's all I'm saying. Well, I mean, I'm saying it to them because they're dead and that's still once again tragic.

67
00:04:12,840 --> 00:04:16,940
Okay? But seriously, that's their threat they were

68
00:04:16,940 --> 00:04:20,940
looking at was something so out there and scary that the news kept reporting.

69
00:04:21,860 --> 00:04:24,660
But what they could have been doing is taking basic care of themselves

70
00:04:25,120 --> 00:04:29,020
and maybe surviving. And, because what do we fear?

71
00:04:29,260 --> 00:04:33,060
And what do we actually go after? The leading cause of death in perspective.

72
00:04:34,260 --> 00:04:35,080
The leading cause of death in perspective. The leading cause of death in perspective.

73
00:04:35,100 --> 00:04:38,840
One, heart and circulatory disorders. That's something I'm worried about.

74
00:04:38,960 --> 00:04:43,160
You know how much bacon I consume every day? It's like, that's horrible. I've got to worry about that. That's a big threat for me.

75
00:04:43,740 --> 00:04:45,640
I've already had cancer, so yolo.

76
00:04:46,300 --> 00:04:49,340
But look at the very, very, very, very, very bottom.

77
00:04:49,420 --> 00:04:52,820
Right there. Terrorism.

78
00:04:54,840 --> 00:04:58,960
You know? But what do we fear the most? What's driven

79
00:04:58,960 --> 00:05:03,020
our economy so much? It's like, what's empowered the TSA to be so

80
00:05:03,020 --> 00:05:05,000
idiotic? Terrorism.

81
00:05:05,100 --> 00:05:08,180
I have to grab your cotch serves for the security of America.

82
00:05:08,760 --> 00:05:12,760
You know? And that leads to another

83
00:05:12,760 --> 00:05:16,940
problem. Because once again, we may not even know what we're supposed

84
00:05:16,940 --> 00:05:20,980
to be protecting ourselves from, but what we do is we put

85
00:05:20,980 --> 00:05:25,100
in these institute, these policies and these things of saying, and telling the employees

86
00:05:25,100 --> 00:05:29,000
and not informing them properly of what they need to look at, so they do

87
00:05:29,000 --> 00:05:33,000
pattern matching. They'll go like, well this is the scenario and this is

88
00:05:33,000 --> 00:05:36,780
how I need to react. We don't give them the leeway to actually think critically.

89
00:05:37,360 --> 00:05:40,740
There's no critical thinking in a lot of the security postures

90
00:05:40,740 --> 00:05:44,740
of a lot of corporations, enterprises, and let's say governments.

91
00:05:45,480 --> 00:05:47,960
Because this is my actual USB drive.

92
00:05:48,880 --> 00:05:51,680
That was confiscated by that TSA agent.

93
00:05:53,060 --> 00:05:56,520
Do you know why that USB drive was confiscated?

94
00:05:57,080 --> 00:05:58,780
Because it looked like a grenade.

95
00:05:59,340 --> 00:06:01,680
It matched the pattern. That's it.

96
00:06:02,200 --> 00:06:03,640
It matched the pattern, exactly.

97
00:06:06,280 --> 00:06:10,140
Well no, I tell you, I pulled the top off, showed them that it was a USB drive,

98
00:06:10,580 --> 00:06:13,780
and then they're like, well you can't take it, we have to take it. And I'm like, no, I've got to destroy it.

99
00:06:14,220 --> 00:06:18,940
Because I actually had some malware that would actually mess with their machines, and if they plugged it in, then it would be my fault.

100
00:06:19,100 --> 00:06:22,920
And then it's like, I mean, I was like, no, I've got to destroy that one

101
00:06:22,920 --> 00:06:24,740
because I'm not getting another wrap, right?

102
00:06:26,260 --> 00:06:27,620
I now carry

103
00:06:27,620 --> 00:06:31,400
a USB drive grenade in my bag.

104
00:06:32,140 --> 00:06:36,220
But I take the top off and put it in another pocket, it goes fine. It's good.

105
00:06:38,480 --> 00:06:40,980
I've got a machine gun and a pistol

106
00:06:40,980 --> 00:06:44,660
in my bag, USB drives, but I put them

107
00:06:44,660 --> 00:06:47,500
separately in two different pieces. It's like, they're totally cool.

108
00:06:49,200 --> 00:06:52,060
It's like, because it doesn't match the pattern.

109
00:06:52,800 --> 00:06:55,660
Don't we all feel secure when we fly out of Vegas on Monday?

110
00:06:57,100 --> 00:06:59,720
Right? So that's one of the problems as well.

111
00:07:00,840 --> 00:07:04,120
And what are we actually looking at? It's like, it doesn't just go from physical,

112
00:07:04,240 --> 00:07:08,020
it's also from online. Everybody's worried about

113
00:07:08,020 --> 00:07:11,860
zero days. You know, zero days. Oh my gosh, they're dropping

114
00:07:11,860 --> 00:07:15,840
O days in here. Well not here in this talk, obviously. But you know, it's like

115
00:07:15,840 --> 00:07:18,580
in DEF CON, they're dropping O days. We've got to worry about this, worry about that.

116
00:07:18,580 --> 00:07:22,420
Uh, SQL Injection has surfaced as the number one attack in

117
00:07:22,420 --> 00:07:26,760
2015, probably 2017. SQL Injection

118
00:07:26,760 --> 00:07:30,520
is not a security vulnerability. It's crappy coding.

119
00:07:31,080 --> 00:07:34,580
Stop treating it as a security vulnerability. And people will say, well

120
00:07:34,580 --> 00:07:38,760
Jason, still, you know, crappy coding can be a security vulnerability. SQL Injection

121
00:07:38,760 --> 00:07:42,520
is not a security vulnerability, it is crappy coding.

122
00:07:43,160 --> 00:07:46,360
If you got a, if you're getting owned by SQL Injection,

123
00:07:46,360 --> 00:07:49,960
you need to talk to your coders, not to your security department.

124
00:07:50,220 --> 00:07:53,900
Well, you need to talk to your security department to watch out for those coders, because they're up to some sketchy stuff

125
00:07:53,900 --> 00:07:58,200
if they're still putting SQL Injections in their stuff. Alright? But who's

126
00:07:58,200 --> 00:08:02,280
coming after you? What are your threats? Is it nation states? Are you worried

127
00:08:02,280 --> 00:08:05,960
about nation states? I mean, I wouldn't be worried about nation states, well,

128
00:08:06,120 --> 00:08:10,320
maybe a little bit. But um, uh, but look at these, you know,

129
00:08:10,360 --> 00:08:14,080
it's like, you got nation states, unless you're running a centrifuge in Iran

130
00:08:14,080 --> 00:08:18,220
maybe, or maybe you're, uh, owning a telecom company,

131
00:08:18,340 --> 00:08:22,160
maybe, or you're the pope. Seriously, we spy on the pope.

132
00:08:22,320 --> 00:08:25,700
Not that sketchy one with the red shoes, but this pope, the current one.

133
00:08:25,820 --> 00:08:29,880
The guy who dresses up as a regular priest in Vatican City at night

134
00:08:29,880 --> 00:08:33,460
and feeds the homeless. He's like the Batman of popes, he's awesome.

135
00:08:34,020 --> 00:08:37,740
And it's like, and they still spy on him. What's up with that? So,

136
00:08:37,780 --> 00:08:41,660
uh, and also, we don't have to worry too much, this was actually from the vault, uh,

137
00:08:41,660 --> 00:08:45,280
Seven Lulls. The root password for the SSH, uh, um,

138
00:08:45,460 --> 00:08:48,720
system was 123abcdef.

139
00:08:49,400 --> 00:08:53,480
So it's nice that our government is actually using, you know, upper and lower case and numbers.

140
00:08:53,780 --> 00:08:57,640
I guess. Uh, so that's awesome. Are you worried

141
00:08:57,640 --> 00:09:01,000
about anonymous? You know, how many people in here is from anonymous?

142
00:09:01,780 --> 00:09:02,620
You failed!

143
00:09:05,220 --> 00:09:09,800
So it's like, uh, are we really worried about them? Cause it's like, I mean, I like that last article

144
00:09:09,800 --> 00:09:13,720
where it says, could the hacker group anonymous do any real damage to Donald Trump's

145
00:09:13,720 --> 00:09:17,660
campaign, uh, in the, in the, as it's foretold or, or threatened?

146
00:09:18,520 --> 00:09:21,680
No. Sorry. It's a moment of silence for that one.

147
00:09:21,820 --> 00:09:24,760
Um, how about criminals?

148
00:09:26,720 --> 00:09:29,520
Maybe criminals are out to be your threat.

149
00:09:29,960 --> 00:09:31,860
Maybe you should worry about getting robbed.

150
00:09:33,380 --> 00:09:36,420
Maybe they're the ones that are actually, nation states,

151
00:09:37,080 --> 00:09:40,180
with nation state tools, uh, hacking

152
00:09:40,180 --> 00:09:44,580
activist groups. Yes, those are threats and potential threats for certain areas.

153
00:09:44,740 --> 00:09:48,000
But the majority of people, you need to worry about your stuff getting stolen.

154
00:09:48,900 --> 00:09:52,400
People want to rob you. It's like, you know, you don't want

155
00:09:52,400 --> 00:09:55,120
to be a target of cyber crime. Couldn't resist the pun. Sorry, that was awesome.

156
00:09:55,560 --> 00:10:00,640
Target lost over a hundred million dollars from that breach so far.

157
00:10:01,220 --> 00:10:04,060
So far. It's still losing. It's like, uh,

158
00:10:04,060 --> 00:10:07,780
it's horrible. Did they, did their security

159
00:10:07,780 --> 00:10:11,880
controls, were they the vector of compromise? It was an

160
00:10:11,880 --> 00:10:15,880
HVAC system company that had a trust relationship.

161
00:10:16,320 --> 00:10:19,220
They, uh, compromised the HVAC system

162
00:10:19,990 --> 00:10:23,320
with a spear phishing campaign that they like to say was a sophisticated attack.

163
00:10:24,280 --> 00:10:28,080
Whatever. Um, and they, uh, they attacked the target.

164
00:10:28,900 --> 00:10:32,000
And that's how they got compromised. Because of the trust relationship.

165
00:10:32,880 --> 00:10:34,040
It's like, and, and

166
00:10:34,060 --> 00:10:37,620
that's one of the things we're going to go after a little bit more as well. And

167
00:10:37,620 --> 00:10:42,060
talking about spear phishing emails, you talk about zero days, phish

168
00:10:42,060 --> 00:10:45,660
gets me every time. It's like majority of workers blindly open email attachments,

169
00:10:45,720 --> 00:10:48,660
attachments, especially if they think it's from someone they know.

170
00:10:49,740 --> 00:10:53,740
Because why would someone send you something, you know, that's malicious? That's just me en route.

171
00:10:54,900 --> 00:10:58,080
Right? So, what I usually do at this

172
00:10:58,080 --> 00:11:01,960
point is, when I gave this talk in South

173
00:11:01,960 --> 00:11:05,300
Africa, I googled biggest bank in South Africa.

174
00:11:05,680 --> 00:11:09,800
That totally didn't work as well as I thought it would. Uh, but, uh, but

175
00:11:09,800 --> 00:11:14,000
when I went to Paris, I googled biggest, uh, bank in France.

176
00:11:14,840 --> 00:11:17,720
And I randomly would pick a

177
00:11:17,720 --> 00:11:21,620
target from that search. So I would be, and, and

178
00:11:21,620 --> 00:11:26,020
every single one of those, I actually, the person who was an employee from that bank

179
00:11:26,020 --> 00:11:29,520
in all those different countries were in the audience. It was sort of awkward but fun.

180
00:11:29,680 --> 00:11:31,680
Uh, and it shows you.

181
00:11:32,580 --> 00:11:35,860
That it can be that much of an impact. It can be that random and

182
00:11:35,860 --> 00:11:39,800
arbitrary. You're being attacked right now. But this is

183
00:11:39,800 --> 00:11:43,920
DEFCON. And it's like I didn't want to just go after our biggest bank because y'all would be all cheering me on

184
00:11:43,920 --> 00:11:47,420
and go woohoo and the banker person doesn't care. So it's like they're probably not in here, right?

185
00:11:47,860 --> 00:11:51,740
So I thought I'd do a little twist because Chris, uh, you know, he's like invited me here.

186
00:11:51,820 --> 00:11:55,360
I wanted to make something special for him. So I decided to put a little bit of a different theme on it.

187
00:11:55,920 --> 00:11:59,900
And let's go F society on this one. Let's take down the government.

188
00:12:00,680 --> 00:12:01,520
Anybody with me?

189
00:12:02,320 --> 00:12:02,760
Awesome.

190
00:12:03,520 --> 00:12:07,920
So just like, uh, F society, I'm just gonna go random and I'm gonna try to find a

191
00:12:07,920 --> 00:12:12,080
and it's based in New York. So let's go after one of those one percenter

192
00:12:12,080 --> 00:12:15,840
one percenter companies. The Power 100 in New York. That's where they list

193
00:12:15,840 --> 00:12:19,760
all those fancy companies making all those money with the hedge funds and the Ferraris and

194
00:12:19,760 --> 00:12:23,680
all those people, right? Evil Corp. Uh, I did some searching on there

195
00:12:23,680 --> 00:12:27,720
and I see the, the might have been best exemplified by related

196
00:12:27,720 --> 00:12:31,400
companies. Hold on. Related companies.

197
00:12:31,960 --> 00:12:35,760
I didn't even know that was real. I mean, that's just like E Corp, right? That's just like

198
00:12:35,760 --> 00:12:39,800
a random name that's like, doesn't sound like it's real. That's one of those generic names.

199
00:12:40,040 --> 00:12:43,660
So, yeah. Let's attack them, right? So I'm going after related

200
00:12:43,660 --> 00:12:47,640
companies now. So this is my now target. So

201
00:12:47,640 --> 00:12:51,580
as I'm targeting related companies, I just Google related companies. It's

202
00:12:51,580 --> 00:12:55,300
that easy. Uh, I know the CEO's name. I know their headquarters.

203
00:12:55,680 --> 00:13:00,080
I know the founder. I know when it was founded. The subsidiaries. Uh, subsid...

204
00:13:00,080 --> 00:13:04,020
whatever. Uh, the type of businesses and the profiles cause they're on YouTube

205
00:13:04,020 --> 00:13:07,980
and Instagram cause they're hip related companies, right? Uh, so let's go

206
00:13:07,980 --> 00:13:11,680
look at some of their, their stuff. Uh, let's go to their, uh, website.

207
00:13:12,460 --> 00:13:15,900
That's a pretty website. And that's how normal people

208
00:13:15,900 --> 00:13:19,920
see the website. When normal people go to a company's

209
00:13:19,920 --> 00:13:23,800
website, this is what they see. Have I ever been accused of being normal?

210
00:13:25,320 --> 00:13:27,960
No. Never. So, how do

211
00:13:27,960 --> 00:13:31,840
I see and an attacker see this website? Well, with this

212
00:13:31,840 --> 00:13:35,200
wonderful thing called extensions. So now,

213
00:13:35,800 --> 00:13:39,740
from just going to the website, all I have is

214
00:13:39,740 --> 00:13:44,020
their IP addresses, their hosting information, the NS lookup

215
00:13:44,020 --> 00:13:47,560
numbers. Uh, I know, it's sort of disappointing because they're actually

216
00:13:47,560 --> 00:13:51,700
really well protected and sort of irritating. Uh, cause they're using a lot of third party

217
00:13:51,700 --> 00:13:55,540
services to help them like SunGuard DNS and, uh,

218
00:13:57,560 --> 00:13:59,200
pphhosted.com for their mail

219
00:13:59,200 --> 00:14:03,360
server. Uh, really no joy. I was really unhappy about that cause

220
00:14:03,360 --> 00:14:07,200
usually I've got a lot more information at this point and y'all going, ooh, wow,

221
00:14:07,340 --> 00:14:11,240
but now you're just like, yeah, it's lame, Jason. You're right. Um, I did come up with this.

222
00:14:11,280 --> 00:14:15,200
All the domains that are listed on that IP address were things like

223
00:14:16,360 --> 00:14:19,380
onewarpark.com, related.com, then a whole bunch of

224
00:14:19,380 --> 00:14:23,460
.CNN, uh, I mean a .CNN, .CNN, there we go.

225
00:14:23,460 --> 00:14:27,300
A lot of China domains. And I'm fsociety, right?

226
00:14:27,360 --> 00:14:30,280
So is Dark Army involved in this? I don't know.

227
00:14:31,140 --> 00:14:34,780
I'm a little nervous now though. I'm a little nervous about this. Let's see what happens.

228
00:14:35,140 --> 00:14:39,200
So it's like, uh, I go on from there. Uh, let's look at some of their social media profiles.

229
00:14:40,300 --> 00:14:43,140
There's YouTube cause who wants to, I mean, Bloomberg

230
00:14:43,140 --> 00:14:46,940
seems very exciting and interesting so yeah, they got a lot of views on that one.

231
00:14:47,160 --> 00:14:51,420
What was it, 36 in three months? Yes. Uh, so y'all, uh, so

232
00:14:51,420 --> 00:14:55,160
sorry, I don't mean to disrelated .com. Um, but here's their

233
00:14:55,160 --> 00:14:58,380
Instagram. That's hip and those are some nice pictures of

234
00:14:59,200 --> 00:15:03,120
buildings. Um, but they've got 1,800 followers and they're only following

235
00:15:03,120 --> 00:15:06,000
170 cause they're very selective. Uh, that's nice.

236
00:15:07,080 --> 00:15:11,320
Let's go over their, uh, LinkedIn profile. Here's, I love LinkedIn. LinkedIn's like the

237
00:15:11,320 --> 00:15:14,920
Facebook of corporations. It's like, I will accept, by the way,

238
00:15:15,000 --> 00:15:19,420
I will accept every LinkedIn invite that I've gotten. I've accepted all of them.

239
00:15:21,420 --> 00:15:24,880
I've enjoyed my, my connections. So if you want to send me a LinkedIn invite, feel free.

240
00:15:25,000 --> 00:15:29,220
Uh, I'll take it. Um, and so right here at LinkedIn you see on the

241
00:15:29,220 --> 00:15:33,300
related companies, you see there's 1,600 targets, I'm sorry, employees.

242
00:15:33,400 --> 00:15:36,620
Uh, on LinkedIn, uh, that I can go after.

243
00:15:36,840 --> 00:15:41,060
Uh, which is awesome. And then you look over here, this is their

244
00:15:41,060 --> 00:15:45,100
Twitter profile. That's sad. It's like, uh, cause everybody knows I love to tweet.

245
00:15:45,320 --> 00:15:48,580
They're following four people. They have 309 followers.

246
00:15:48,580 --> 00:15:52,180
They've got one like, and they haven't

247
00:15:52,180 --> 00:15:56,240
tweeted yet. What the, how do you get

248
00:15:56,240 --> 00:16:00,600
309 followers without even tweeting? It's like, I don't know how that happens.

249
00:16:00,840 --> 00:16:03,860
But, uh, but they, they manage that. Um,

250
00:16:05,300 --> 00:16:08,200
here's their social profile, Facebook, cause, you know,

251
00:16:08,240 --> 00:16:12,460
I usually like to go after Facebook to go after employees. Uh, I, mostly

252
00:16:12,460 --> 00:16:16,560
every attack I've done, uh, successfully through a company has gone

253
00:16:16,560 --> 00:16:19,940
through their Facebook profile or their Twitter profile. But remember,

254
00:16:20,160 --> 00:16:24,260
I'm F Society. Okay? I'm going after the man.

255
00:16:24,520 --> 00:16:28,400
I ain't going after the employee. Okay? So here's the about

256
00:16:28,400 --> 00:16:32,120
page. This is where I usually go and pick my targets. So I'm looking at this

257
00:16:32,120 --> 00:16:36,500
long list of, you know, diversity here, and uh, I'm trying to figure out which person

258
00:16:36,500 --> 00:16:40,420
uh, I'm trying to attack. Right? And

259
00:16:40,420 --> 00:16:43,700
uh, I come across this one guy

260
00:16:44,280 --> 00:16:46,940
it's like, that's straight out of Mr. Robot, right?

261
00:16:48,580 --> 00:16:51,480
Timmer F. Galen. If that's not a made up name

262
00:16:51,480 --> 00:16:55,520
then it's like, that's an alias. He's like, he did something shady in his youth right now. You can tell

263
00:16:55,520 --> 00:16:59,500
that's a really poorly done alias. Sorry Timmer, or Tommer, or whatever it is. Uh,

264
00:16:59,600 --> 00:17:03,680
he's the executive vice president. He's gonna be my patsy. He's the guy I'm gonna act

265
00:17:03,680 --> 00:17:07,620
like I'm, I'm gonna assume his identity. And it's like, and how do you assume identity? You gotta find

266
00:17:07,620 --> 00:17:11,660
information about him. So, here's already some right now. Uh, he's been around.

267
00:17:11,660 --> 00:17:15,660
He was at Goldman Sachs. So, he's part of the man still. You know, part of

268
00:17:15,660 --> 00:17:19,560
the 1% there. Uh, these are some of the things that he's done. Some of the places he's been. That's

269
00:17:19,560 --> 00:17:23,500
good information. Uh, I do a little bit more Googling on him. Uh,

270
00:17:23,520 --> 00:17:26,920
get a little bit more information. Um, I get to his LinkedIn profile.

271
00:17:27,300 --> 00:17:27,620
Sad.

272
00:17:31,480 --> 00:17:35,120
Alias, right? That does not look like a legit profile of some kind of executive

273
00:17:35,520 --> 00:17:39,340
person in a company. It's like, he like, he created it and then like stopped halfway

274
00:17:39,340 --> 00:17:40,980
when he realized how horrible LinkedIn is.

275
00:17:41,660 --> 00:17:45,620
It's like, it's like I'm, I'm just done. Um, but that, I didn't

276
00:17:45,620 --> 00:17:49,460
stop there, right? So, I, I need, I don't need to find that much information out about him, you know,

277
00:17:49,480 --> 00:17:53,180
cause I'm just trying to assume his identity. It's not like I need to really find out where he lives,

278
00:17:53,340 --> 00:17:57,480
his home phone number, uh, his address, and where he was born. Uh,

279
00:17:57,700 --> 00:18:01,540
but I did. Um, so, that's

280
00:18:01,540 --> 00:18:05,400
cool. It's like, cause he, and you know what? Maybe we wanna like

281
00:18:05,400 --> 00:18:09,560
send him off onto the Hamptons and take over his apartment. It's like, uh, and that's

282
00:18:09,560 --> 00:18:13,300
cool cause we can Google Map it. Uh, and we know where it's at. And

283
00:18:13,300 --> 00:18:17,420
we can do something like that. So, now we've got a pretty good amount of information

284
00:18:17,420 --> 00:18:20,920
on Mr. Timmer, right? Um, what do we need to do now?

285
00:18:21,400 --> 00:18:24,680
We need to find out the victim. The person we're going to attack and compromise.

286
00:18:25,240 --> 00:18:29,460
So we can take over everything, right? Let's go back to this wonderful list here.

287
00:18:30,700 --> 00:18:33,520
Um, I literally, let's, let's just look down the list and I see that

288
00:18:33,520 --> 00:18:36,080
poor guy at the very bottom just like a, what about me?

289
00:18:38,040 --> 00:18:39,140
It's George Perez.

290
00:18:39,960 --> 00:18:43,120
So let's go after George Perez. He seems like real,

291
00:18:44,580 --> 00:18:48,060
I don't know what movie he was in, but it was a bad one, right?

292
00:18:48,620 --> 00:18:52,000
It's like, he's a C. That guy's got like a,

293
00:18:52,000 --> 00:18:55,900
like a Persian cat somewhere in a big armchair that he's done, he's done

294
00:18:55,900 --> 00:18:59,220
horrible things in his life is all I'm saying. Sorry. Uh,

295
00:18:59,860 --> 00:19:03,580
here's some more information about him. He's a vibrant urban sinner. He's reflected,

296
00:19:03,580 --> 00:19:07,500
he's really a nice guy. He helps with the art and he's like, it's not going to stop me

297
00:19:07,500 --> 00:19:11,420
from attacking him, but I just want to note that he seems like a really nice guy, uh, even

298
00:19:11,420 --> 00:19:14,820
though he does wear those shorts in public. Um, so, uh,

299
00:19:14,960 --> 00:19:18,820
this gives me some more information about his art. It gives me some more information about where he lives.

300
00:19:19,140 --> 00:19:23,340
All information that I can use to make the spear phishing email real.

301
00:19:23,920 --> 00:19:27,560
I want as much information that I can make the spear phishing email

302
00:19:27,560 --> 00:19:31,360
real. How do I send the email though? I gotta figure out what their email addresses

303
00:19:31,360 --> 00:19:34,840
are, and that's hard. Um, no it's not, sorry. Um,

304
00:19:34,900 --> 00:19:39,400
I go to email-format.com. I type in the domain

305
00:19:39,400 --> 00:19:43,380
name, and then they give you a nice little list of first name, last

306
00:19:43,380 --> 00:19:47,300
name, how the, uh, their emails are sent out. And

307
00:19:47,300 --> 00:19:51,060
this one was actually sort of funny. Because when I did this one,

308
00:19:51,220 --> 00:19:54,500
it came up with another, uh, it comes up with another tab.

309
00:19:54,980 --> 00:19:58,020
And this tab actually shows you where those email addresses have been used.

310
00:19:58,940 --> 00:20:02,000
And when it did, I saw that one that was highlighted right

311
00:20:02,000 --> 00:20:05,580
there. It was really weird. It was, uh, unionsquare

312
00:20:06,660 --> 00:20:10,020
leasing at related.com. And it went to this website

313
00:20:10,460 --> 00:20:13,340
and it said guest, and it had a number.

314
00:20:13,980 --> 00:20:18,040
And usually I don't do this, but all about hacking is usually just going on your instincts

315
00:20:18,040 --> 00:20:21,240
and just going, well what if I do this? So I went there.

316
00:20:21,780 --> 00:20:25,800
That doesn't look good. Does that look good to anybody? I mean,

317
00:20:25,800 --> 00:20:29,800
I got into social engineering so I wouldn't have to be technical, but, you know, even from my perspective,

318
00:20:29,980 --> 00:20:33,820
that don't look good. So I went through that, that code a little

319
00:20:33,820 --> 00:20:37,600
bit. It's like, I tried to act like I did, you know, like CSI, but not typing on two

320
00:20:37,600 --> 00:20:41,340
keyboards. Um, and I went to the main website

321
00:20:41,340 --> 00:20:45,580
and I'm thinking, yeah, that's not good for them. So they may want to fix that, FYI.

322
00:20:45,720 --> 00:20:49,540
Uh, I don't give, uh, warnings. I just let you see it and see. Um,

323
00:20:49,740 --> 00:20:53,560
so hopefully they'll fix that eventually when they get to this, or start the, uh,

324
00:20:53,560 --> 00:20:56,840
restraining order. Um, so now the next step is very important.

325
00:20:57,220 --> 00:21:00,820
Uh, this is the part where I do have to do an extra kitten warning, okay?

326
00:21:01,700 --> 00:21:05,280
Because if I send you an email about

327
00:21:06,000 --> 00:21:09,700
something good, something nice, like you won money,

328
00:21:09,820 --> 00:21:13,320
what are you going to do? What the ever. That's

329
00:21:13,320 --> 00:21:17,020
fake. No one sends me anything free. Ever.

330
00:21:17,420 --> 00:21:21,380
So, that doesn't usually work. So

331
00:21:21,380 --> 00:21:25,420
what happens if you send them something bad? Something that's

332
00:21:25,420 --> 00:21:29,000
horrible that's happened. After the Boston bombing,

333
00:21:29,280 --> 00:21:33,500
within a day or so, I got an email. It said, Boston

334
00:21:34,080 --> 00:21:37,300
News. It literally had an IP

335
00:21:37,300 --> 00:21:41,360
address on it, slash Boston. That was it!

336
00:21:44,420 --> 00:21:45,460
Your daughter

337
00:21:45,460 --> 00:21:48,560
was running in the Boston Marathon that day.

338
00:21:48,560 --> 00:21:52,620
You had relatives that live in Boston. You didn't

339
00:21:52,620 --> 00:21:56,520
know what was going on. CNN was giving you news about what was happening.

340
00:21:57,400 --> 00:22:00,300
Did you click that link? When

341
00:22:00,300 --> 00:22:04,620
tragedy strikes, we want to know more information. During

342
00:22:04,620 --> 00:22:08,560
different, uh, times in this, in this talk, in different places, I've

343
00:22:08,560 --> 00:22:12,460
used the murder of two girls. I've used a terrorist attack

344
00:22:12,460 --> 00:22:16,600
in Paris. I've used, uh, political unrest in South

345
00:22:16,600 --> 00:22:20,580
Africa to create my emails. Remember the kittens?

346
00:22:21,260 --> 00:22:24,140
But I'm an evil mother, because I'm trying to steal from you.

347
00:22:25,080 --> 00:22:28,600
What part do we forget about that? Have you

348
00:22:28,600 --> 00:22:32,560
ever been robbed by someone going, I'm sorry about having to do

349
00:22:32,560 --> 00:22:36,580
this, dude. It's like, uh, I know this is a little overkill. I mean, no pun intended, but I need all

350
00:22:36,580 --> 00:22:40,580
your money in your wallet. Okay? I mean, I'm, this shouldn't even have to

351
00:22:40,580 --> 00:22:44,660
be necessary, but I will kill you if you don't give me your money, okay? Please, I'm sorry.

352
00:22:44,660 --> 00:22:48,700
It has to be like, but I need your money. You don't get mugged like that

353
00:22:48,700 --> 00:22:49,800
unless you're in Canada, right?

354
00:22:52,080 --> 00:22:56,760
It's like, seriously. I am trying to steal from you.

355
00:22:56,800 --> 00:23:00,540
I broke into a building in a wheelchair before. I am a horrible

356
00:23:00,540 --> 00:23:02,960
person. I'm trying to rob you.

357
00:23:04,500 --> 00:23:08,400
So of course I'm going to use deaths of people. I'm going to use tragic

358
00:23:08,400 --> 00:23:12,620
events. You know why? It increases my odds of you clicking the link.

359
00:23:12,620 --> 00:23:16,540
And that's what I want. So what do I need

360
00:23:16,540 --> 00:23:19,240
to do now? I need to Google up some tragedy.

361
00:23:22,300 --> 00:23:24,140
Problems in Miami, quote,

362
00:23:24,240 --> 00:23:28,540
related group, which is our company. So, I mean, you know how hard

363
00:23:28,540 --> 00:23:30,880
it is to Google freaking related anything? It's like,

364
00:23:31,740 --> 00:23:35,700
this was like the worst assignment I gave myself ever, okay?

365
00:23:36,100 --> 00:23:40,420
Usually this thing takes under an hour to get ready and done. It took me

366
00:23:40,420 --> 00:23:44,140
forever. I mean, like at least two hours. And I was not even playing Overwatch

367
00:23:44,140 --> 00:23:48,240
at the time. It was like horrible. Okay? But I did find some dirt.

368
00:23:50,340 --> 00:23:52,000
This was at the beginning of July

369
00:23:52,000 --> 00:23:56,180
of this year. Did Miami's biggest developer avoid labor taxes?

370
00:23:56,320 --> 00:23:59,520
The feds are investigating. Go on. Right?

371
00:24:00,580 --> 00:24:04,000
It's like, this is by Nicholas Nihamas.

372
00:24:04,500 --> 00:24:08,040
And it talks about the, at the very bottom,

373
00:24:10,240 --> 00:24:11,120
yeah, that

374
00:24:12,440 --> 00:24:16,100
building complex. So, I got it.

375
00:24:16,260 --> 00:24:19,940
Let's send an email. Please note, it's in red, I used

376
00:24:19,940 --> 00:24:23,640
a common on a dot, dear feds, fu, I didn't do anything bad.

377
00:24:23,780 --> 00:24:27,560
This did not actually go out. This is a demo for hypothetical demo purposes.

378
00:24:28,360 --> 00:24:31,240
So it went to george.perez from

379
00:24:31,840 --> 00:24:35,400
timber.galem. Notice I'm using cccbcz because I didn't send it out.

380
00:24:35,400 --> 00:24:39,200
Subject line is, this is very concerning, we need a response immediately.

381
00:24:39,620 --> 00:24:42,760
Three exclamation points. You know why?

382
00:24:43,360 --> 00:24:45,920
One exclamation point, I'm sort of excited.

383
00:24:46,800 --> 00:24:50,880
Two exclamation points, I'm shouting. Three,

384
00:24:50,900 --> 00:24:55,420
serious business. Okay? That means you gotta pay attention

385
00:24:55,420 --> 00:24:58,760
to this one mother, something's going down. Right? So,

386
00:24:59,300 --> 00:25:03,360
greetings George. I've just been contacted by Nicholas Nihamas who says

387
00:25:03,360 --> 00:25:07,180
he's been reporting on our issues with that place. He just published

388
00:25:07,180 --> 00:25:11,460
a more disturbing article, which if the accusations

389
00:25:11,460 --> 00:25:15,060
regarding you bear out, will be leaving us with some tough decisions.

390
00:25:15,360 --> 00:25:19,400
I've already made inquiries to some old colleagues from Goldman Sachs in Moscow to find

391
00:25:19,400 --> 00:25:23,380
out what they can. We need to get ahead of this situation before it sinks our whole

392
00:25:23,380 --> 00:25:26,540
enterprise. Take care, Timur F. Galem, sent from a mobile device.

393
00:25:30,960 --> 00:25:32,840
Did I tell him to click that link?

394
00:25:34,060 --> 00:25:36,220
Did I tell him he really needed to click that link?

395
00:25:37,160 --> 00:25:38,780
Did that SOB click that link?

396
00:25:41,400 --> 00:25:44,500
Probably. We're gonna go out on a limb for the demo person. I probably

397
00:25:44,500 --> 00:25:47,920
think he would have clicked that link because he's like, because you want to know what's going on.

398
00:25:48,740 --> 00:25:52,360
I'm not telling you to do something, I'm telling you about something horrible

399
00:25:52,360 --> 00:25:55,320
that's happening and I'm giving you a way to find out more.

400
00:25:56,540 --> 00:26:00,340
And that's all that's necessary. So, I also have a

401
00:26:00,340 --> 00:26:03,820
confession to make. It's like, you know, just a little bit of one.

402
00:26:05,120 --> 00:26:08,340
I lied. I'm sorry, my friends, but

403
00:26:08,340 --> 00:26:12,460
my confession is I couldn't trust you. So, there was a

404
00:26:12,460 --> 00:26:16,240
little bit more to this than I was letting you on to because

405
00:26:16,240 --> 00:26:20,360
I'm trying to disrupt the government. I'm trying not to just take out

406
00:26:20,360 --> 00:26:24,300
like the related dot com. So, what else did I decide to do?

407
00:26:25,220 --> 00:26:26,220
This wasn't random.

408
00:26:26,960 --> 00:26:29,320
All my other talks were pretty random and arbitrary.

409
00:26:29,900 --> 00:26:33,620
But there was for a particular reason why I picked

410
00:26:34,400 --> 00:26:36,760
George here. Just a small one.

411
00:26:38,680 --> 00:26:42,320
I like that. George is bestie pals with somebody

412
00:26:42,320 --> 00:26:44,020
that I may actually do want to attack.

413
00:26:45,980 --> 00:26:50,260
So, what do I need to do? I needed to compromise George first.

414
00:26:51,360 --> 00:26:53,160
Now I've compromised George

415
00:26:53,160 --> 00:26:56,940
and now I can send emails out as George.

416
00:26:57,820 --> 00:26:59,960
Who am I going to be sending out an email to?

417
00:27:02,600 --> 00:27:03,940
Right. But how?

418
00:27:05,000 --> 00:27:07,600
You know, someone, exactly, through Twitter.

419
00:27:10,660 --> 00:27:11,860
Well played, sir.

420
00:27:13,020 --> 00:27:16,780
It's like, so how do I contact him? I don't have this, you know,

421
00:27:16,820 --> 00:27:19,360
how do you get the President's personal information?

422
00:27:20,340 --> 00:27:23,300
Maybe Paceman. Please note to the

423
00:27:23,300 --> 00:27:26,600
Feds, okay, I did obscure

424
00:27:27,200 --> 00:27:31,320
information that was necessary to obscure because I heard

425
00:27:31,320 --> 00:27:34,900
that he'd be pissed on, I'd be pissed off if I

426
00:27:34,900 --> 00:27:39,340
let this out, information. Secret Service did tell me, he said, if you release

427
00:27:39,340 --> 00:27:42,400
that, you're in trouble. And so I wouldn't do that.

428
00:27:43,420 --> 00:27:47,060
So, this is his official, there's his birth date,

429
00:27:47,060 --> 00:27:51,020
his social security number, all of Trump's personal email addresses that he

430
00:27:51,020 --> 00:27:54,840
uses, also all his family members' personal email addresses,

431
00:27:55,160 --> 00:27:59,040
all his Twitters, his YouTubes, all that on Paceman.

432
00:27:59,360 --> 00:28:01,340
So, yeah, that happened.

433
00:28:03,060 --> 00:28:07,060
But now that I've got a way to email him on his

434
00:28:07,060 --> 00:28:09,400
personal email address, look at all those cameras coming up.

435
00:28:09,600 --> 00:28:15,000
And I'm a horrible person because I should be clicking to the next slide, but

436
00:28:15,000 --> 00:28:15,460
I'm waiting.

437
00:28:21,440 --> 00:28:22,420
Are we good?

438
00:28:23,860 --> 00:28:25,180
Hold on, I got it.

439
00:28:27,000 --> 00:28:31,000
Okay. Had to be taking pictures of probably Secret Service to screw me

440
00:28:31,000 --> 00:28:35,020
later, but, you know, whatever. So now I need to find a way to get him

441
00:28:35,020 --> 00:28:39,080
and create the target, right? The email. I've got to create an email

442
00:28:39,080 --> 00:28:42,480
that'll make him click the link. So I just Googled,

443
00:28:42,480 --> 00:28:43,660
Reporter Trump Hates the Most.

444
00:28:46,900 --> 00:28:50,320
That sounds like it's gonna work, right? So I found this

445
00:28:50,320 --> 00:28:54,240
guy, Wayne Barrett, who authored a book that painted Trump's financial

446
00:28:54,240 --> 00:28:57,700
history as at the least shady. Really?

447
00:28:59,220 --> 00:29:01,380
That's my shocked face, by the way. Okay.

448
00:29:02,040 --> 00:29:06,400
Clutching the pearls and everything. So now I've got everything I need to

449
00:29:06,400 --> 00:29:10,100
know to create an email. And yes, there is a little thing because I really didn't change

450
00:29:10,100 --> 00:29:12,860
the first one very much. Here it is to

451
00:29:15,380 --> 00:29:17,360
chaosrq at Yahoo, which is his.

452
00:29:17,900 --> 00:29:21,580
George from george.perez. This looks

453
00:29:21,580 --> 00:29:26,040
it's going to be a huge issue. No matter our differences, we need to get

454
00:29:26,040 --> 00:29:29,840
ahead of this. Three exclamation points. Now two things.

455
00:29:30,060 --> 00:29:33,260
It's like I needed to do misspellings because that way you'd understand it better.

456
00:29:33,640 --> 00:29:37,720
And two, they've had a falling out.

457
00:29:38,420 --> 00:29:41,660
It's like actually George and Donald have actually had a falling out,

458
00:29:41,800 --> 00:29:45,640
so it's like I need to make sure that I understood that because I'm actually coming in like I'm

459
00:29:45,640 --> 00:29:49,860
trying to be concerned. So greetings, Donald. I've just been contacted

460
00:29:49,860 --> 00:29:53,720
by Wayne Barrett who says he's been writing a new book about you. He just published

461
00:29:53,720 --> 00:29:57,240
a very disturbing excerpt for his new book, which

462
00:29:57,240 --> 00:30:01,060
the accusations regarding you pair out will be leaving us with some tough decisions.

463
00:30:01,420 --> 00:30:05,620
I've already made inquiries to some old colleagues from Goldman Sachs and Moscow, which he probably

464
00:30:05,620 --> 00:30:07,520
knows too, to find out what they

465
00:30:07,720 --> 00:30:11,660
can. We need to get ahead of this situation before it gets worse. I still consider

466
00:30:11,660 --> 00:30:15,300
you a friend. I do not want you to see you being attacked this way.

467
00:30:15,800 --> 00:30:18,240
Take care, George Perez sent from a mobile device.

468
00:30:20,680 --> 00:30:22,300
No way he's clicking on that link, right?

469
00:30:23,320 --> 00:30:27,620
It'd be even funnier if he did it from his Android phone that he's no longer using and had a stage fright exploit

470
00:30:27,620 --> 00:30:31,280
on there. So I think that's essentially how you would describe the government.

471
00:30:31,720 --> 00:30:35,600
It's like you're taking over the control of the person who's actually supposedly

472
00:30:35,600 --> 00:30:39,420
leading him. I'm sorry not to get too political.

473
00:30:39,800 --> 00:30:43,560
I promise you, if you look at my DEFCON 18 talk, I showed you

474
00:30:43,560 --> 00:30:47,320
how to assassinate President Obama. So I'm an equal opportunity attacker.

475
00:30:49,800 --> 00:30:51,620
And also another thing is

476
00:30:51,620 --> 00:30:55,400
I sent from a mobile device. And the reason why I do that is

477
00:30:55,400 --> 00:30:59,620
because why? Because when you see that, you make allowances.

478
00:31:00,300 --> 00:31:03,660
I don't know how they say hello, greetings, salutations,

479
00:31:03,660 --> 00:31:07,420
what's up, dude? You know, I don't know those. I don't know how they say

480
00:31:07,800 --> 00:31:11,280
take care, see you later, hasta la vista. It's like I don't know.

481
00:31:11,860 --> 00:31:15,620
But when you see sent from a mobile device, the person goes, okay, well they were just in a hurry

482
00:31:15,620 --> 00:31:19,360
and they're just typing it out. And so that's the reason why all my emails,

483
00:31:19,520 --> 00:31:23,520
no matter what client I'm using, always say it came from a mobile device, because I don't care about

484
00:31:23,520 --> 00:31:26,620
spelling. So I think we can all agree,

485
00:31:27,460 --> 00:31:31,520
job done, right? Okay. Now guess what?

486
00:31:32,900 --> 00:31:35,600
This is my dessert and vegetables talk.

487
00:31:36,220 --> 00:31:39,320
Because I just gave you the dessert. I hope we all had a good laugh. We all

488
00:31:39,320 --> 00:31:43,400
realized, more importantly, how simple and easy it is

489
00:31:43,400 --> 00:31:47,600
to craft an attack. How an attacker will look at your system

490
00:31:47,600 --> 00:31:51,380
and use your social media, use the information that you're

491
00:31:51,380 --> 00:31:55,580
willing to give out against you, right? Can we all agree

492
00:31:55,580 --> 00:31:58,580
that that was a good way to explain that and show an example?

493
00:31:58,580 --> 00:32:01,780
So let's actually see what we can do now.

494
00:32:05,060 --> 00:32:05,780
Give up?

495
00:32:09,240 --> 00:32:09,680
Maybe.

496
00:32:10,080 --> 00:32:13,660
How many people have been to a talk here where someone has gone and said,

497
00:32:13,940 --> 00:32:18,400
I broke this and I dropped the O-Day and it's broken and I just trashed it.

498
00:32:18,540 --> 00:32:21,980
The whole GUI needs to be written. The company didn't know what to do. They're not responding properly.

499
00:32:22,340 --> 00:32:26,520
It's horribly trashed. Okay, I'm done. See you later.

500
00:32:27,580 --> 00:32:28,240
And you're like,

501
00:32:28,580 --> 00:32:32,000
how do you fix that? Well, I don't know. I just showed you how to break it.

502
00:32:34,240 --> 00:32:35,120
Those suck.

503
00:32:36,540 --> 00:32:40,440
If you're going to show me how something is broken, you better have some

504
00:32:40,440 --> 00:32:43,760
ways to show me how I can fix it or you're wasting my time.

505
00:32:44,900 --> 00:32:48,480
Period. So that's the way I look at this situation. So let's

506
00:32:48,480 --> 00:32:52,600
start doing some defensive stuff now. Because this is what the whole thing is all about.

507
00:32:52,880 --> 00:32:55,900
This next thing, this is a defensive talk. Surprise.

508
00:32:57,060 --> 00:32:59,960
One of the things you can do for your company, if you don't know

509
00:32:59,960 --> 00:33:03,300
how to do OSINT, if your employees don't know how to do OSINT,

510
00:33:03,480 --> 00:33:07,840
there are assets and ways for them to learn and to get resources for that

511
00:33:07,840 --> 00:33:11,420
that you don't have to work on. OSINTframework.com

512
00:33:11,420 --> 00:33:15,540
will be one of those resources. It's a drop-down list

513
00:33:15,540 --> 00:33:19,460
for your employees to go through to start looking at your site,

514
00:33:19,740 --> 00:33:23,860
your company, as an attacker would. Because you have

515
00:33:23,860 --> 00:33:27,680
to look at your company like an attacker would because attackers are

516
00:33:27,680 --> 00:33:31,380
looking at your company. Here's another thing.

517
00:33:32,040 --> 00:33:35,740
I'd like to thank April for pointing this one out to me. Mike Basil actually

518
00:33:35,740 --> 00:33:39,380
has a distro that you can boot up on

519
00:33:39,380 --> 00:33:43,760
for nothing but OSINT and social engineering purposes. It's like the

520
00:33:43,760 --> 00:33:46,520
Kali Linux for OSINT. It's like a

521
00:33:47,620 --> 00:33:51,700
Uber for hacking. But still, that's a great resource

522
00:33:51,700 --> 00:33:55,180
right there to give you all the tools pre-configured,

523
00:33:55,240 --> 00:33:59,640
pre-scripted out to help you do OSINT. To start looking

524
00:33:59,640 --> 00:34:03,180
at your employees' profiles that may be damaging to your company.

525
00:34:03,360 --> 00:34:07,700
That may be used against you. Also,

526
00:34:07,820 --> 00:34:11,680
we've learned how awesome Pastebin is, right? We already know that.

527
00:34:12,260 --> 00:34:14,380
Do searches on Pastebin.

528
00:34:15,300 --> 00:34:19,540
Pastebin has an alert feature. Your company's

529
00:34:19,540 --> 00:34:23,500
username, hackered, hacksword, carded,

530
00:34:23,540 --> 00:34:27,480
bin number list. It has the way to send you an alert

531
00:34:27,480 --> 00:34:31,060
when you put in the keywords to let you know, hey,

532
00:34:31,220 --> 00:34:35,400
you just showed up on Pastebin. And just heads up, there's

533
00:34:35,400 --> 00:34:38,620
hardly ever any reason you show up on Pastebin that's good.

534
00:34:39,940 --> 00:34:42,440
I have never heard of one yet.

535
00:34:43,400 --> 00:34:46,400
I'm like, oh look, I've been on Pastebin.

536
00:34:46,400 --> 00:34:49,860
Yeah, awesome. Another thing that you could do

537
00:34:49,860 --> 00:34:53,740
is see what your devices are doing out on the internet.

538
00:34:55,300 --> 00:34:56,240
That's Shodan.

539
00:34:57,620 --> 00:35:02,200
Look at this. Just like in a zombie movie, that many red dots is not

540
00:35:02,200 --> 00:35:05,800
going to end well for you, right? That's never a good thing.

541
00:35:06,720 --> 00:35:10,040
It's like all those are exposed and possibly

542
00:35:10,040 --> 00:35:12,400
compromisable machines and servers.

543
00:35:13,800 --> 00:35:16,460
And you know, a normal person would just leave it at that

544
00:35:16,460 --> 00:35:20,080
and just let you know to worry about it. But no, I'd like to go further. Let's look at one of them.

545
00:35:20,820 --> 00:35:24,260
This guy right here, 154.16.5.170.

546
00:35:24,740 --> 00:35:27,960
That's a lot of ports to be opened to see. It's like,

547
00:35:28,020 --> 00:35:31,480
I mean, a lot, right? So let's go and look at them.

548
00:35:32,600 --> 00:35:35,880
Here they are. They're net stack limited.

549
00:35:36,560 --> 00:35:38,520
And they're going to be even more limited after this is over.

550
00:35:39,660 --> 00:35:42,400
There's the ports. They've got OpenSSH running.

551
00:35:42,540 --> 00:35:46,420
That's nice. And look at the versions. That's what I like

552
00:35:46,420 --> 00:35:49,440
looking at. The versions of all these different servers.

553
00:35:49,780 --> 00:35:54,400
It's makingmoneycoach.com is their post-fix SMTPD server.

554
00:35:54,740 --> 00:35:57,560
Awesome. They won't be making much money after this, right?

555
00:35:58,300 --> 00:36:02,060
Not my fault. It's already out there. I go a little bit further.

556
00:36:02,240 --> 00:36:06,940
I see the Apache. They're running an Apache server 2.4.25.

557
00:36:07,520 --> 00:36:08,500
Yeah, that's concerning.

558
00:36:08,520 --> 00:36:11,620
But we'll get to that a little bit later. What's on that Apache server?

559
00:36:12,280 --> 00:36:16,180
Oh, that is. Who wants to guess

560
00:36:16,180 --> 00:36:18,460
the user ID and password is admin admin?

561
00:36:20,420 --> 00:36:24,360
I would not know. I'm not a bad person. I didn't actually

562
00:36:24,360 --> 00:36:27,180
check. I'm just saying, it probably is.

563
00:36:27,420 --> 00:36:32,160
But I was more concerned about the version.

564
00:36:32,640 --> 00:36:37,440
Because you can just Google the Apache 2.4.25

565
00:36:37,440 --> 00:36:41,220
and see vulnerabilities and see what comes up. And stuff like this

566
00:36:41,220 --> 00:36:43,940
comes up. They may be having some issues.

567
00:36:44,740 --> 00:36:47,360
If not now, in the near future, like by Monday.

568
00:36:48,260 --> 00:36:53,220
And you have to ask yourself, okay, well, Jason, who's really

569
00:36:53,220 --> 00:36:57,220
going through Shodan and trying to find vulnerabilities on servers

570
00:36:57,220 --> 00:37:01,320
and companies? Why would someone do that? That's just mean. This mother does it every day.

571
00:37:02,300 --> 00:37:02,780
Right?

572
00:37:02,780 --> 00:37:06,680
I mean, he's doing this.

573
00:37:06,760 --> 00:37:09,340
Why? Because he can.

574
00:37:10,200 --> 00:37:11,800
Look at the things that he's found.

575
00:37:13,920 --> 00:37:17,300
Before WannaCry came out, before WannaCry hit,

576
00:37:18,960 --> 00:37:21,440
1.17 million hosts scanned.

577
00:37:24,920 --> 00:37:26,600
33,468 found infected.

578
00:37:28,200 --> 00:37:30,400
I mean, that's what he wants to do on a Friday night?

579
00:37:30,400 --> 00:37:33,640
I'm not going to judge. It's cool. We all have hobbies.

580
00:37:34,440 --> 00:37:37,740
That's already out there. People are attacking.

581
00:37:37,920 --> 00:37:40,280
When you're physically at your house,

582
00:37:41,120 --> 00:37:45,980
you forgot to go to the store real quick and pick something up. You feel safe.

583
00:37:46,220 --> 00:37:50,320
Let me leave the door open or unlocked and just run out there. My neighbors will

584
00:37:50,320 --> 00:37:53,660
watch me. When you connect a computer onto

585
00:37:53,660 --> 00:37:58,000
the internet, your neighbors are now China,

586
00:37:58,000 --> 00:38:00,940
Russia, Paraguay, Texas,

587
00:38:01,360 --> 00:38:06,020
New York. It's everywhere. Especially Paraguay. You've got to watch out

588
00:38:06,020 --> 00:38:09,580
for the Paraguayans. Any Paraguayans in here? I just like saying Paraguayans.

589
00:38:10,100 --> 00:38:13,900
You've got to watch out for that because those are your neighbors and they are

590
00:38:13,900 --> 00:38:17,820
constantly scanning. They are looking not for you.

591
00:38:18,920 --> 00:38:21,780
They're not looking for you. They're looking for an IP

592
00:38:21,780 --> 00:38:25,980
address that shows vulnerable. That shows that it's available to be attacked.

593
00:38:25,980 --> 00:38:29,940
That's all they care about. Not nationality. Not political

594
00:38:29,940 --> 00:38:33,800
correctness. Just you're vulnerable. I attack you.

595
00:38:35,140 --> 00:38:37,700
If your teams are small and limited,

596
00:38:37,920 --> 00:38:41,900
start using blue teams and boxes. You've got Tenable. You've got

597
00:38:41,900 --> 00:38:45,200
Rapid7 does some good stuff. Pony Express does some good stuff.

598
00:38:45,620 --> 00:38:48,700
Vthread is really cool because it actually does virtual threat

599
00:38:49,280 --> 00:38:53,780
intel for your corporation's internal network. It actually shows you what an exfiltration

600
00:38:53,780 --> 00:38:54,780
attack looks like.

601
00:38:55,980 --> 00:38:59,160
I'm not here to hype products. I'm just here to tell you that those are some cool things that you can do.

602
00:38:59,480 --> 00:39:03,000
Literally, the biggest tool in my toolbox

603
00:39:03,000 --> 00:39:07,140
that I use more than any other tool ever

604
00:39:07,760 --> 00:39:08,640
is this.

605
00:39:10,780 --> 00:39:12,460
Or Bing if you want to get adventurous.

606
00:39:12,740 --> 00:39:16,160
Like I said, I attack everybody equally.

607
00:39:17,840 --> 00:39:21,900
What else can we do? What are some of the key things that we can do?

608
00:39:21,900 --> 00:39:24,940
Here's some things that I learned from Ubix that I want to share.

609
00:39:25,280 --> 00:39:27,720
This is one of my favorites. Wpad.

610
00:39:29,620 --> 00:39:33,800
If you've got Wpad on your network, you're going to have a bad day.

611
00:39:35,240 --> 00:39:37,340
Microsoft is anything but helpful.

612
00:39:37,780 --> 00:39:41,180
Everything and helpful, right? That's what I was trying to say. Of course, Microsoft. Love you guys.

613
00:39:42,100 --> 00:39:44,960
What do they do? They made it where

614
00:39:44,960 --> 00:39:49,660
if there was a host name on the internal network or the corporate network

615
00:39:49,660 --> 00:39:53,320
and the host name was Wpad, well that means

616
00:39:53,320 --> 00:39:56,600
all your workstation traffic should go through it.

617
00:39:58,580 --> 00:40:01,400
Guess what every attacker in the world's

618
00:40:01,400 --> 00:40:05,300
computer name is? Yes. W.

619
00:40:05,460 --> 00:40:09,300
Well, after they changed it from Kali Linux, they changed it to Wpad.

620
00:40:09,520 --> 00:40:13,460
Right? So here's what you need to do.

621
00:40:13,700 --> 00:40:17,640
Make a null route to 127.0.0.1 and the DNS

622
00:40:17,640 --> 00:40:21,280
entry for Wpad. So that way just no routes. It doesn't go anywhere.

623
00:40:21,600 --> 00:40:25,480
Keep Wpad from communicating. And if you possibly can, just

624
00:40:25,480 --> 00:40:28,460
disable NetBIOS. I mean, unless you're running Windows XP.

625
00:40:30,060 --> 00:40:31,840
Don't even raise your hand. Don't make me sad and cry.

626
00:40:33,660 --> 00:40:37,820
That's bad and you should feel bad. So you're probably not running Windows XP

627
00:40:37,820 --> 00:40:41,080
so maybe not so much with that. Another thing to use

628
00:40:41,080 --> 00:40:44,280
and I love this one. I love this one the most.

629
00:40:44,280 --> 00:40:48,120
But please understand my qualifier. If you don't do

630
00:40:48,120 --> 00:40:52,000
step four, you're screwed. Not my fault. Step one.

631
00:40:52,060 --> 00:40:55,140
Create a user called domainadmin underscore temp.

632
00:40:55,820 --> 00:41:00,140
I mean literally create that in your domain, your main domain controller.

633
00:41:00,420 --> 00:41:03,700
Put a password in the description. Say

634
00:41:04,280 --> 00:41:08,200
password is, let me think, I want to be secure. Password

635
00:41:08,200 --> 00:41:12,020
two. Okay. Delete account by

636
00:41:12,020 --> 00:41:13,760
July 2016.

637
00:41:14,540 --> 00:41:18,000
Make it realistic, right? And then you

638
00:41:18,000 --> 00:41:22,140
add it to the domain admins group. You literally

639
00:41:22,140 --> 00:41:26,260
make it a domain admin account. And you're saying, Jason, are you effing insane?

640
00:41:26,560 --> 00:41:30,240
Yes, but that's not the point. Okay. Step four.

641
00:41:30,500 --> 00:41:33,460
Under the login hours, you set to zero.

642
00:41:34,720 --> 00:41:37,600
What that means is they can never log in.

643
00:41:37,900 --> 00:41:41,640
The password is correct. It doesn't send an error that the password's wrong.

644
00:41:42,500 --> 00:41:44,080
It just doesn't log in.

645
00:41:44,900 --> 00:41:47,860
So you set up an email alert in the sim

646
00:41:47,860 --> 00:41:51,940
in the event viewer that someone used that account. You now

647
00:41:51,940 --> 00:41:56,020
have a zero false positive that

648
00:41:56,020 --> 00:41:59,460
someone is attacking your network and has compromised your domain controller.

649
00:41:59,840 --> 00:42:03,800
Zero false positives. Zero dollars. Very little evidence.

650
00:42:03,980 --> 00:42:07,780
You detected a breach. No blinky boxes required.

651
00:42:08,700 --> 00:42:10,820
That's something you should be using on Monday.

652
00:42:10,820 --> 00:42:13,740
So what else do we do?

653
00:42:15,060 --> 00:42:17,820
Credit where credit is due. That's all Rob Fuller.

654
00:42:18,240 --> 00:42:22,500
Twitter is Mubix. Cool guy. Another thing that I see

655
00:42:22,500 --> 00:42:26,760
way too often that really makes me sad, and I'm going to wait because everybody's taking

656
00:42:26,760 --> 00:42:30,780
pictures of Mubix's info. Okay, there we go.

657
00:42:31,380 --> 00:42:31,940
There we go.

658
00:42:34,600 --> 00:42:37,000
Unsegmented networks. What's up with that?

659
00:42:38,940 --> 00:42:40,980
Why are we keeping our networks

660
00:42:40,980 --> 00:42:45,040
all nice and open on the inside? I literally had to

661
00:42:45,040 --> 00:42:48,200
stop an engagement on the first day, tell the

662
00:42:48,940 --> 00:42:53,120
client that I was not charging them, that they had to use the money

663
00:42:53,120 --> 00:42:55,620
to actually put someone in how to create a network.

664
00:42:56,420 --> 00:43:00,800
It was a flat network. And brother, when I say flat, I mean

665
00:43:00,800 --> 00:43:05,000
the web servers were on the same 10.xxx

666
00:43:05,800 --> 00:43:06,360
network

667
00:43:07,240 --> 00:43:10,960
as the accountants, HR, web developers,

668
00:43:11,220 --> 00:43:14,600
CEOs. Email server on the same network.

669
00:43:15,600 --> 00:43:18,360
The kicker, the guest wireless

670
00:43:18,820 --> 00:43:22,760
access point that was unencrypted had the name of the company's name

671
00:43:22,760 --> 00:43:27,220
in guest. Where was it? On the same 10.xxx

672
00:43:27,220 --> 00:43:30,880
network. I literally was like, how can you try

673
00:43:30,880 --> 00:43:34,360
to pay me to pen test a network when you're just, it's open.

674
00:43:35,240 --> 00:43:38,400
It's like you're asking me

675
00:43:38,400 --> 00:43:40,660
to break into a house and you forgot to put walls up.

676
00:43:40,900 --> 00:43:45,400
I don't know how to do this. You win.

677
00:43:45,700 --> 00:43:49,860
I don't know. I literally have no idea.

678
00:43:49,960 --> 00:43:52,780
If you're trying to confuse the attacker, you worked.

679
00:43:55,840 --> 00:43:58,320
Segment your networks. Is there any

680
00:43:58,320 --> 00:44:02,240
reason why HR needs to talk over the network to the web developers?

681
00:44:02,780 --> 00:44:03,260
No.

682
00:44:04,360 --> 00:44:07,880
Is there any reason why the accountants need to talk over the network to the web developers?

683
00:44:08,780 --> 00:44:12,260
No. Is there any reason why the CEOs need to talk over the network to the web

684
00:44:12,260 --> 00:44:14,380
developers? Does anybody need to talk to the web developers is what I'm trying to say.

685
00:44:16,600 --> 00:44:20,160
It's like, no. It's like segment those networks.

686
00:44:20,440 --> 00:44:24,300
Make it like a submarine. It's like if one part goes down,

687
00:44:24,760 --> 00:44:27,760
it's like if a submarine gets hit and it doesn't destroy it, what happens?

688
00:44:27,860 --> 00:44:32,000
One part is breached. But the rest is safe. That sucks for Bob in engineering,

689
00:44:32,000 --> 00:44:33,940
but still, the rest of the sub is okay.

690
00:44:35,140 --> 00:44:39,560
So you want to do that. You want to segment. Now here's a list of

691
00:44:39,560 --> 00:44:43,820
tips and tricks that I want you to start using. The very first one is patch.

692
00:44:45,660 --> 00:44:47,140
Aren't we tired of hearing that?

693
00:44:48,320 --> 00:44:51,840
You know what's even more tiring? Having to keep saying it.

694
00:44:53,100 --> 00:44:54,220
That's pretty tiring.

695
00:44:55,920 --> 00:44:59,580
Remember WannaCry happened two months after the patch came out.

696
00:44:59,580 --> 00:45:02,780
And you're thinking, well, that's horrible. They should have known better.

697
00:45:03,120 --> 00:45:07,460
Listen here. DEF CON 2002.

698
00:45:08,680 --> 00:45:11,940
The vulnerability for SQL Slammer came out.

699
00:45:13,120 --> 00:45:15,180
September of 2002,

700
00:45:15,740 --> 00:45:18,040
Microsoft came with the patch.

701
00:45:19,560 --> 00:45:23,860
February 2003, SQL Slammer hit.

702
00:45:25,800 --> 00:45:27,420
That's not the sad part, by the way.

703
00:45:27,460 --> 00:45:27,940
I'm getting to it.

704
00:45:29,580 --> 00:45:32,420
The firewall logs when you get back. Guess what you're going to see?

705
00:45:33,100 --> 00:45:34,660
Traffic for SQL Slammer.

706
00:45:37,020 --> 00:45:40,320
I don't want to go through the line, but you understand that's an unpatched system

707
00:45:41,180 --> 00:45:45,120
that's running SQL that's unpatched on the internet

708
00:45:45,120 --> 00:45:49,340
that's infected, still going on. If that doesn't make you want to drink, I don't know what does

709
00:45:49,340 --> 00:45:53,300
and I don't drink. Okay? And so it's things like this

710
00:45:53,300 --> 00:45:57,000
that make an impact. But it's also a false impact.

711
00:45:57,880 --> 00:46:00,460
Because when something like this hits, people take notice.

712
00:46:01,120 --> 00:46:04,380
When it gets this bad, like on the second day, they really take notice.

713
00:46:05,280 --> 00:46:09,340
So there are probably more people patched for MS01117

714
00:46:10,980 --> 00:46:11,860
than MS0867.

715
00:46:15,320 --> 00:46:16,880
Because MS0867, if you do

716
00:46:16,880 --> 00:46:20,860
pen testing, is the golden ticket, right? And everybody thought MS01117

717
00:46:20,860 --> 00:46:24,660
was going to be, yay, it's the new one! But now, because of WannaCry,

718
00:46:25,120 --> 00:46:28,600
it's like, no, they're all patched for that. They're like, oh no, we've got to get that patched.

719
00:46:28,760 --> 00:46:32,460
But what about those ones from 2008? Oh no, we can leave those. It's like, who uses that, right?

720
00:46:32,800 --> 00:46:35,340
It's like, let's make sure we've got that one patch on.

721
00:46:36,500 --> 00:46:40,560
It's like, that's how they think. You have to make sure your policies dictate

722
00:46:42,080 --> 00:46:44,800
patching every month. And not just

723
00:46:44,800 --> 00:46:48,160
the OS, but all the applications that are out there.

724
00:46:48,340 --> 00:46:51,720
Make sure you're patching your Adobe and your Java.

725
00:46:51,720 --> 00:46:55,020
And your Adobe and Java. The Java and the Adobe.

726
00:46:55,740 --> 00:46:59,740
Like, every week I'm maybe on those. But still, make sure you have a patching

727
00:46:59,740 --> 00:47:03,780
policy for them. Another thing to do is a 1x1

728
00:47:03,780 --> 00:47:07,300
pixel GIF. And I literally Googled, trust me, you can see that

729
00:47:07,300 --> 00:47:10,860
I Googled 1.1 pixel GIF, and there's actually one there.

730
00:47:11,840 --> 00:47:15,660
Put it on your website. Put a link to it to a page

731
00:47:15,660 --> 00:47:19,580
that does nothing but record the IP address, the operating

732
00:47:19,580 --> 00:47:21,700
system, and user agent string of that.

733
00:47:21,720 --> 00:47:25,540
Of whoever clicked it. Because how many people do you know

734
00:47:25,540 --> 00:47:29,380
that are on a website going, I wonder if there's a secret pixel. I wonder if there's a secret pixel.

735
00:47:29,480 --> 00:47:33,460
I wonder if there's a secret pixel. Okay, I did that once, but I was bored and it was like 3 in the morning. Okay, don't judge me.

736
00:47:33,800 --> 00:47:37,140
Okay? But what does click on those links?

737
00:47:39,500 --> 00:47:41,740
Bots. Phishing people scraping the whole website

738
00:47:41,740 --> 00:47:45,300
for a phishing attack. Nikto. OpenVAS.

739
00:47:46,380 --> 00:47:49,620
And trust me, if you run a

740
00:47:49,620 --> 00:47:53,400
bank site and Nikto's perusing your website, they're not looking for their

741
00:47:53,400 --> 00:47:57,620
mortgage loan. Okay? Nikto's never there to check

742
00:47:57,620 --> 00:48:00,540
to see if they qualify. It's just not going to happen.

743
00:48:01,400 --> 00:48:05,360
So make sure you're alerting for those. And better yet,

744
00:48:05,480 --> 00:48:09,200
just not alerting to the fact that those user agents are going onto

745
00:48:09,200 --> 00:48:13,360
your website and people are scanning it. But then start blocking them.

746
00:48:14,780 --> 00:48:17,520
Your user agent strings, you have a list

747
00:48:17,520 --> 00:48:21,360
of bad user agent strings that you can tell your web server to

748
00:48:21,360 --> 00:48:25,580
refuse. It's like, you know, no Nikto.

749
00:48:25,900 --> 00:48:29,580
No OpenVAS. No Internet Explorer. It's like,

750
00:48:29,640 --> 00:48:33,060
no, I'm sorry, sorry, sorry. That was my web server, sorry.

751
00:48:33,380 --> 00:48:36,380
It's like, you can just say no to these user agent strings.

752
00:48:37,380 --> 00:48:40,840
And shut them down. They don't eliminate your risk.

753
00:48:41,200 --> 00:48:45,400
But it helps to narrow it. I'm not trying to tell you how to solve everything.

754
00:48:45,400 --> 00:48:48,100
I'm trying to help you be a little bit better secured.

755
00:48:49,160 --> 00:48:52,640
Another thing is, start blocking countries.

756
00:48:53,380 --> 00:48:55,320
Anybody here do business in Paraguay?

757
00:48:57,640 --> 00:49:01,280
You're shady. No, I'm sorry. It's like, but if you don't

758
00:49:01,280 --> 00:49:04,880
do business in Paraguay, why is Paraguay allowed to see you on the Internet?

759
00:49:05,840 --> 00:49:09,140
If you don't do business in Canada, because, you know, Canadians,

760
00:49:09,360 --> 00:49:12,700
it's like, you should be blocking Canada from seeing your website.

761
00:49:12,700 --> 00:49:16,140
Your whole entire network should be blocked at the firewall.

762
00:49:16,360 --> 00:49:20,320
The ASN number should be blocked. If you don't do business in those countries.

763
00:49:21,120 --> 00:49:24,380
It's like limiting the attack vector. Also limit spam.

764
00:49:24,680 --> 00:49:27,440
You tell that to your executives, and they'll sign off on it immediately.

765
00:49:28,100 --> 00:49:32,160
It'll help lower our spam. Oh, yeah, let's get that going. Let's get that done.

766
00:49:33,600 --> 00:49:36,040
So, you want to do that. Speaking of spam, it's like,

767
00:49:36,080 --> 00:49:40,680
in spear phishing and emails, do you own all the

768
00:49:40,680 --> 00:49:42,280
different domains and variations

769
00:49:43,500 --> 00:49:45,420
that could be used against you?

770
00:49:46,240 --> 00:49:49,320
This is one of the saddest slides I've ever created.

771
00:49:49,840 --> 00:49:54,260
This was a talk I did in 2012. And the reason why it was so sad

772
00:49:54,260 --> 00:49:57,640
is, as you can tell, PearsonFoundation.org and

773
00:49:59,180 --> 00:50:02,860
PearsonEd.com, one with a zero and the other one with a one,

774
00:50:03,000 --> 00:50:06,220
were available. Seriously.

775
00:50:07,200 --> 00:50:09,760
They're not available anymore. That was a popular talk.

776
00:50:09,760 --> 00:50:12,440
It's like, I don't know who owns it. Hopefully Pearson does, but I doubt it.

777
00:50:13,340 --> 00:50:15,960
They were available at the time that I gave the talk.

778
00:50:17,240 --> 00:50:21,440
That's sad. You should own the variations of your website.

779
00:50:22,040 --> 00:50:24,740
It's not going to solve your phishing problems.

780
00:50:25,240 --> 00:50:28,980
But once again, it helps lower the risk. It helps to mitigate it.

781
00:50:29,540 --> 00:50:33,860
Another thing is, sad but true, sometimes your employees need to click on a link.

782
00:50:34,200 --> 00:50:36,100
They need to click and download an attachment.

783
00:50:36,860 --> 00:50:39,860
First of all, you teach them how to be suspicious of those

784
00:50:39,860 --> 00:50:43,740
with someone sending them if you weren't expecting it. But the next thing you can do is tell them

785
00:50:43,740 --> 00:50:47,960
to go to places like Virustotal.com, tell them to upload the URL

786
00:50:47,960 --> 00:50:52,240
or the package. If the attachment only has non-private,

787
00:50:52,300 --> 00:50:55,440
non-secret confidential information,

788
00:50:55,800 --> 00:50:59,960
tell them to upload the attachment. Because let's face it, this site's owned by Google.

789
00:51:00,020 --> 00:51:03,720
They probably already have it, right? So it's not like you're divulging secrets.

790
00:51:03,720 --> 00:51:07,400
It's something they already got. So tell them to do that. Scan it

791
00:51:07,400 --> 00:51:10,840
to see if it's actually a virus, to see if it's actually something there.

792
00:51:11,800 --> 00:51:13,820
Yeah, it's sort of five minutes, but maybe more.

793
00:51:16,040 --> 00:51:19,440
Now, one of the next ones is web developers should be building

794
00:51:19,440 --> 00:51:22,000
good code, which makes it more secure.

795
00:51:22,940 --> 00:51:27,280
SQL injection is not a security vulnerability, it's crappy coding.

796
00:51:29,140 --> 00:51:31,140
So, last but not least,

797
00:51:31,140 --> 00:51:33,280
to the last but not least part,

798
00:51:33,440 --> 00:51:37,620
create teachable moments for your employees.

799
00:51:38,160 --> 00:51:41,360
Your employees don't always, I mean this is going to be a shock to you,

800
00:51:42,060 --> 00:51:46,000
but maybe, just maybe, your employees don't learn the best lessons

801
00:51:46,000 --> 00:51:50,640
by taking that 20 question quiz, multiple choice,

802
00:51:50,900 --> 00:51:54,700
that they can go back and change the answer if they got it wrong on their internet

803
00:51:54,700 --> 00:51:58,360
every quarter or year, right? Maybe not.

804
00:51:58,360 --> 00:52:01,040
So create teachable moments for them.

805
00:52:01,700 --> 00:52:05,040
Go and have your security team go around every building,

806
00:52:05,280 --> 00:52:08,940
every site that you own, and look under the keywords for passwords.

807
00:52:09,740 --> 00:52:13,780
Sad part is they'll probably find some. But more importantly, the employees will know

808
00:52:13,780 --> 00:52:17,220
that you're looking for those things. That you have a security team that actually exists

809
00:52:17,220 --> 00:52:20,560
and actually in the real world that could do something like that.

810
00:52:20,900 --> 00:52:25,620
It's like that creates a teachable moment. I gave a talk a couple years ago where I went to

811
00:52:25,620 --> 00:52:26,800
all these different security conferences,

812
00:52:28,360 --> 00:52:31,460
and I got results from those conferences on a Wi-Fi pineapple showing people,

813
00:52:31,580 --> 00:52:35,560
oh look, y'all connected on those. That's sad. It was very sad.

814
00:52:35,780 --> 00:52:39,960
It was even sadder, I went to RSA, they invited me to speak, never since.

815
00:52:40,840 --> 00:52:44,080
But within 7 minutes, 42 people

816
00:52:44,080 --> 00:52:47,920
connected to my Wi-Fi pineapple. RSA.

817
00:52:48,840 --> 00:52:52,480
A security event. Full of security people.

818
00:52:52,920 --> 00:52:54,720
I heard a lot of the SSPs go there.

819
00:52:54,720 --> 00:52:58,600
It's like 7 minutes, 42. I mean, I could have gotten more, but come on.

820
00:52:58,800 --> 00:53:02,800
The lucky number 7 and the answer for the life, the universe, and everything. I had to stop there.

821
00:53:04,380 --> 00:53:06,760
But you're thinking, Jason, that's an old example.

822
00:53:07,420 --> 00:53:09,080
What's a teachable moment for us now?

823
00:53:10,320 --> 00:53:13,300
How many people have gone to this website? Raise your hand.

824
00:53:15,100 --> 00:53:18,900
The answer is none. None of you have gone to this website.

825
00:53:19,980 --> 00:53:21,740
All you guys went to this website.

826
00:53:22,920 --> 00:53:25,540
See? You thought you were going

827
00:53:25,540 --> 00:53:29,820
here, you went there. To make it a little bit more

828
00:53:29,820 --> 00:53:33,600
clear, I've put a different graphic on the website now

829
00:53:33,600 --> 00:53:35,820
that I showed you the first time. It's this one.

830
00:53:40,700 --> 00:53:42,000
Social-engineering.org

831
00:53:42,760 --> 00:53:44,460
.cgi-bin.email

832
00:53:44,460 --> 00:53:47,400
.confirmation .index.php.

833
00:53:48,240 --> 00:53:51,720
If you actually go there right now, you will see that llama judging you harshly.

834
00:53:52,900 --> 00:53:54,300
As well it should.

835
00:53:55,420 --> 00:53:58,160
I own cgi-bin.email.

836
00:53:59,720 --> 00:54:02,360
So that means I can make everything my subdomain.

837
00:54:04,900 --> 00:54:06,760
Humans, when they're looking at the web,

838
00:54:07,020 --> 00:54:10,280
even if it's Eastern culture or Western culture, no matter which way they write,

839
00:54:10,600 --> 00:54:15,620
on a website, they read left to right. Computers always read

840
00:54:15,620 --> 00:54:19,540
right to left on a web address bar. So they don't care what my

841
00:54:19,540 --> 00:54:23,380
subdomains are. But humans look at the email,

842
00:54:23,480 --> 00:54:27,200
they look at the URL, they go social-engineering.org.

843
00:54:27,320 --> 00:54:31,480
That seems legit. I've seen cgi-bin before. Email, this is an email

844
00:54:31,480 --> 00:54:34,880
that they sent me. I'm getting a confirmation. Yeah, I should click on this.

845
00:54:37,560 --> 00:54:39,100
Oops. So there you go.

846
00:54:39,540 --> 00:54:41,920
Now I want to leave it with one last important thing.

847
00:54:43,160 --> 00:54:44,980
There are good employees.

848
00:54:45,780 --> 00:54:49,140
This is an example of an actually pretty good response

849
00:54:49,840 --> 00:54:52,720
from Mandalay Bay for Black Hat coming in

850
00:54:52,720 --> 00:54:57,600
the first part of the week. They used that conference

851
00:54:57,600 --> 00:55:01,960
as a teachable moment for their employees. Not by going and saying,

852
00:55:02,120 --> 00:55:05,680
oh, close down, we don't accept USB drives now because

853
00:55:05,680 --> 00:55:10,000
only email attachments because we're going to get pwned because the hacker's in town.

854
00:55:10,480 --> 00:55:11,120
UPS.

855
00:55:11,920 --> 00:55:15,920
No, they didn't do that. Okay? What they did was say,

856
00:55:16,120 --> 00:55:19,840
hey, this is a good time to be security weak. Learn here's

857
00:55:19,840 --> 00:55:24,000
a good security tip on email phishing. It actually tried to teach

858
00:55:24,000 --> 00:55:27,960
them a lesson using this as a way for a teachable moment

859
00:55:27,960 --> 00:55:31,660
by having the conference there. That's a proper way to do it.

860
00:55:32,320 --> 00:55:35,280
And once again, that's a positive thing to do.

861
00:55:35,680 --> 00:55:39,540
Are you doing positive messages to your company, to your executives

862
00:55:39,540 --> 00:55:43,300
when they do something right? When they actually get security

863
00:55:43,300 --> 00:55:47,580
right? Do you create a positive teachable moment?

864
00:55:48,000 --> 00:55:51,160
Or is it always negative, something that someone's failed at?

865
00:55:52,720 --> 00:55:55,620
Results may vary. So I'm going to leave it there.

866
00:55:56,060 --> 00:55:59,400
But I've got 14 seconds, so screw the questions. Sorry, we're just going to go with

867
00:55:59,400 --> 00:56:03,040
several minutes of uncomfortable silence. And I'm going to drink here.

868
00:56:06,560 --> 00:56:07,680
No, I'm serious. It's done.

869
00:56:07,780 --> 00:56:08,140
Thank you.

870
00:56:10,000 --> 00:56:10,240
.

871
00:56:10,240 --> 00:56:10,460
.

872
00:56:14,280 --> 00:56:14,520
.

873
00:56:15,020 --> 00:56:15,260
.

874
00:56:15,260 --> 00:56:15,280
.

875
00:56:15,280 --> 00:56:15,300
.

876
00:56:15,300 --> 00:56:15,320
.

877
00:56:15,320 --> 00:56:15,340
.