1
00:00:03,630 --> 00:00:05,130
Yeah, no.

2
00:00:06,370 --> 00:00:08,310
I think we're gonna have to do it tomorrow.

3
00:00:08,310 --> 00:00:09,590
We'll do it tomorrow.

4
00:00:09,590 --> 00:00:10,370
I got to go.

5
00:00:10,370 --> 00:00:11,010
I got to go.

6
00:00:11,010 --> 00:00:16,130
I'm giving a presentation at DEF CON.

7
00:00:16,210 --> 00:00:22,050
The cool thing is I'm recording it now and it's going to be presented 20 years into the future in 2020.

8
00:00:22,050 --> 00:00:23,230
Isn't that cool?

9
00:00:23,410 --> 00:00:24,010
All right.

10
00:00:24,010 --> 00:00:24,310
All right.

11
00:00:24,310 --> 00:00:25,350
I'll talk to you tomorrow.

12
00:00:25,350 --> 00:00:25,650
All right.

13
00:00:25,650 --> 00:00:26,190
Bye.

14
00:00:28,430 --> 00:00:29,190
Yeah.

15
00:00:29,190 --> 00:00:30,430
Hi, everyone.

16
00:00:30,430 --> 00:00:31,750
It's good to be here.

17
00:00:31,750 --> 00:00:48,470
I'm coming to you from the past to talk about the 90s and how pen testing really came from the hacker community and just wouldn't really be there if it wasn't for the hacker community.

18
00:00:48,470 --> 00:00:57,870
So I have some slides and I'm gonna share my screen here so we can we can see them.

19
00:00:58,930 --> 00:00:59,750
All right.

20
00:00:59,750 --> 00:01:00,170
Great.

21
00:01:00,170 --> 00:01:02,430
I hope everyone can see the slides.

22
00:01:03,610 --> 00:01:04,910
So, yeah.

23
00:01:06,510 --> 00:01:08,610
I'm happy to be here.

24
00:01:08,690 --> 00:01:11,130
My name is Chris Weisoppel.

25
00:01:11,130 --> 00:01:14,350
Some people might know me as Weld Pond.

26
00:01:14,590 --> 00:01:21,670
And I'm gonna talk about how red teaming was born from the hacker community.

27
00:01:24,210 --> 00:01:26,930
Some of you may have seen this picture.

28
00:01:27,230 --> 00:01:36,470
This is a picture of the group of us from the Loft, which was a hacker group that I'm part of.

29
00:01:36,470 --> 00:01:43,150
And we actually got these t-shirts made up to commemorate the event, Feds Love Loft.

30
00:01:43,150 --> 00:01:44,710
But we testified at the Senate.

31
00:01:44,750 --> 00:01:48,510
It was a little controversial at the time.

32
00:01:48,510 --> 00:01:54,510
We were the first hackers to talk about computer security and try to help the U.S.

33
00:01:54,510 --> 00:01:58,130
government understand what was going on.

34
00:01:58,390 --> 00:02:06,970
I don't know if you can see our placards there in front of us, but they have our hacker names, not our real names, which I thought was pretty interesting.

35
00:02:06,970 --> 00:02:20,110
They let us testify with our hacker names because, of course, back in the 90s, it was kind of risky to be called out as a hacker with a hacker handle and posting about vulnerabilities and things like that.

36
00:02:20,110 --> 00:02:25,410
So we didn't want to risk our day jobs we were all, a lot of us were in IT.

37
00:02:25,790 --> 00:02:34,330
And, you know, if you said bad things about a big vendor, it might be bad for you and your job.

38
00:02:35,650 --> 00:02:49,670
Unfortunately, or fortunately, I'm not sure what, but, you know, our pictures were posted with our, it was posted in the newspapers the next day and people at work kind of knew what we looked like.

39
00:02:49,670 --> 00:02:54,850
So the jig was kind of up that we did this, that's me there.

40
00:02:55,770 --> 00:02:58,170
And here's a little different.

41
00:02:58,170 --> 00:03:00,370
I've made it a little bit shorter.

42
00:03:00,390 --> 00:03:04,330
But, you know, a lot of people say, you know, how did this happen?

43
00:03:04,330 --> 00:03:05,890
How did you get there?

44
00:03:05,930 --> 00:03:22,850
And it really was, you know, doing things the hacker way, you know, reverse engineering, exploring, looking at hosts and networks, but we did it on our own machines.

45
00:03:23,010 --> 00:03:34,530
And we did it in order to publicize the insecurity in software and hardware and took on a really kind of a consumer advocacy approach.

46
00:03:34,570 --> 00:03:44,290
And I think while making trouble for vendors, a lot of other people saw the benefit of what we were doing.

47
00:03:44,890 --> 00:03:49,870
And that's how we got invited to go speak at the Senate.

48
00:03:49,870 --> 00:03:56,670
And famously, Mudge, who's there next to me, said we can take down the internet in 30 minutes.

49
00:03:56,670 --> 00:04:02,710
And we were talking about BGP vulnerabilities, which are still a problem.

50
00:04:02,710 --> 00:04:08,970
BGP hijacking is still definitely an issue a few years later.

51
00:04:08,970 --> 00:04:14,930
But I want to go back to sort of the beginning of sort of computer security.

52
00:04:15,670 --> 00:04:23,450
And when I go back to the beginning of computer security, I think of, you know, the Orange Book.

53
00:04:23,810 --> 00:04:33,130
This was a book that talked about design and security features, authentication, encryption, auditing.

54
00:04:33,130 --> 00:04:36,310
It really talked about security features.

55
00:04:36,790 --> 00:04:43,670
And the book was kind of made famous in the hacker community because it made an appearance in the movie Hackers.

56
00:04:44,170 --> 00:04:52,290
But it really was the way that people thought about computer security, you know, in the early and even in the mid 90s.

57
00:04:52,690 --> 00:04:54,790
It was all about security features.

58
00:04:54,790 --> 00:04:58,330
There's nothing in here about bugs in code, right?

59
00:04:58,330 --> 00:05:03,390
And we all know that that blows a hole right through any security feature.

60
00:05:03,390 --> 00:05:13,910
So there was a huge part of building secure systems that was completely missing until hackers started exploring and probing things.

61
00:05:13,970 --> 00:05:21,910
The other big way people thought about computer security was CERT, which was formed after the Morse worm.

62
00:05:22,050 --> 00:05:27,450
And in the early 90s, CERT said, you know, we'll start taking a look at these vulnerabilities.

63
00:05:27,450 --> 00:05:30,750
You know, if someone finds a vulnerability, send it to CERT.

64
00:05:30,750 --> 00:05:32,130
We'll understand it.

65
00:05:32,130 --> 00:05:33,650
We'll look at it.

66
00:05:33,910 --> 00:05:37,410
We'll talk to the vendors and we'll try to get them to fix it.

67
00:05:37,610 --> 00:05:48,650
But one of the things we found at the loft is when we first started dealing with CERT, if we found vulnerabilities, that we would send it to CERT and it would just become a black hole.

68
00:05:48,650 --> 00:05:53,010
We didn't know if the vendor fixed it, if they fixed it in a silent fix.

69
00:05:53,350 --> 00:05:55,770
The general public didn't know about it.

70
00:05:55,770 --> 00:05:59,450
So there was no way for them to know that they should be patching.

71
00:06:00,050 --> 00:06:08,670
And there was sort of no consequences for vendors who wrote, you know, buggy, insecure code because the general public didn't know about it.

72
00:06:08,670 --> 00:06:11,110
It was just something between CERT and the vendor.

73
00:06:11,410 --> 00:06:19,970
And, you know, I think that was pretty broken until hackers basically, you know, did an end run around that whole model.

74
00:06:21,130 --> 00:06:29,170
In the early days, there were some hackers that tried to start companies.

75
00:06:29,170 --> 00:06:35,830
The earliest company that I know of is a company called ComSec Data Security.

76
00:06:35,830 --> 00:06:40,830
And here's actually the press release from 1991.

77
00:06:41,230 --> 00:06:47,770
So the contacts here are Scott Chason and Chris Goggins, two of the founders of ComSec.

78
00:06:47,770 --> 00:06:55,250
And they're quite proud to say that they're comprised mainly of the now-defunct computer group, the Legion of Doom.

79
00:06:55,510 --> 00:07:01,770
And they plan to offer full-scale security package to private industry.

80
00:07:02,130 --> 00:07:11,850
I don't know if people remember Legion of Doom, but, you know, several members actually went to jail for CFAA violations.

81
00:07:12,110 --> 00:07:19,570
So, you know, maybe not the best group to be saying this is the basis of our company.

82
00:07:19,570 --> 00:07:26,630
But what they were saying also is they were bringing a fresh approach to the security consulting and the corporate marketplace.

83
00:07:27,990 --> 00:07:34,950
That they know how systems are compromised and what actions need to be taken to secure them.

84
00:07:34,950 --> 00:07:37,910
So this was actually a totally new thing.

85
00:07:37,910 --> 00:07:44,130
They were really kind of pioneering here, saying that they know how systems are compromised.

86
00:07:44,730 --> 00:07:46,690
And so that's the fresh approach.

87
00:07:46,690 --> 00:07:50,010
Isn't that amazing in 91 that that was brand new?

88
00:07:50,010 --> 00:07:57,590
And I have to applaud them for, you know, pioneering in the industry here.

89
00:07:57,590 --> 00:08:02,130
But in the press release, I thought this part was actually pretty interesting.

90
00:08:02,290 --> 00:08:08,650
They said that they were aware of the possible shock wave among the hacking underground over this venture.

91
00:08:08,690 --> 00:08:14,730
The firm maintains that they are security consultants and not informants or hacker trackers.

92
00:08:14,730 --> 00:08:17,310
We're not going to go after people.

93
00:08:17,310 --> 00:08:23,930
We are going to ensure that no one, hacker or corporate spy, can compromise the security of our clients' computers.

94
00:08:23,930 --> 00:08:31,950
So, you know, there was this idea that, like, if a hacker worked for a corporation, it was sort of narking, right?

95
00:08:31,950 --> 00:08:46,130
The only reason you're there is to, you know, tell them about the other hackers that were out there that you knew about from underground bulletin boards and mailing lists and bridges and things like that.

96
00:08:46,270 --> 00:08:48,750
And they were claiming that's not what they're doing.

97
00:08:48,750 --> 00:08:49,670
That's not what they're doing.

98
00:08:49,670 --> 00:08:58,510
But that was definitely a concern back then, this whole, you know, can the hacker community trust someone who goes into corporate world?

99
00:08:58,510 --> 00:09:00,770
So it really kind of went both ways.

100
00:09:03,210 --> 00:09:14,510
There was an interview afterwards by ISP News, and I thought this was actually kind of interesting.

101
00:09:15,670 --> 00:09:20,750
ISP News was saying, given where you're coming from, why should a potential client trust you?

102
00:09:20,750 --> 00:09:23,670
And the CG here is Chris Goggins, one of the founders.

103
00:09:23,870 --> 00:09:35,390
He says, I know it's a natural question, just the very nature of creating a company should project an image that we are trying to come out of the shadows, out of the underground.

104
00:09:35,390 --> 00:09:38,470
We're saying, look, everybody, we've been doing this for a long time.

105
00:09:38,470 --> 00:09:40,010
Now we want to help.

106
00:09:41,750 --> 00:09:47,370
And, you know, ISP News says, I'm sure you understand the natural suspicion that people have.

107
00:09:47,750 --> 00:09:50,510
And Goggins says, no, that's what I don't understand.

108
00:09:50,650 --> 00:09:57,450
If we at ComSec were out to compromise information from an existing company's computer network, we wouldn't have incorporated.

109
00:09:57,490 --> 00:10:01,510
We could have done that, and someone else could have already done so.

110
00:10:01,510 --> 00:10:04,470
Then the information would be available from one hacker to another.

111
00:10:04,470 --> 00:10:11,090
So he's really trying to say, hey, you know, we understand that people are going to be skeptical.

112
00:10:12,570 --> 00:10:14,850
But, you know, you can trust us.

113
00:10:15,330 --> 00:10:18,850
Unfortunately, ComSec didn't go very far.

114
00:10:18,850 --> 00:10:20,370
It was just too early.

115
00:10:20,370 --> 00:10:22,430
They couldn't get any customers.

116
00:10:23,070 --> 00:10:36,930
And, you know, some things had to happen between 91 and the late 90s before people could start to trust hackers and hacker techniques to secure their systems.

117
00:10:37,390 --> 00:10:50,810
One of the big seminal papers, and something that was very seminal for me when I was starting out doing computer security, was this paper by Dan Farmer and Witte Venema in 93.

118
00:10:50,810 --> 00:10:53,130
So just a couple years after ComSec.

119
00:10:53,130 --> 00:10:58,610
And they wrote this paper, improving the security of your site by breaking into it.

120
00:10:58,610 --> 00:11:01,110
And they published this as a paper.

121
00:11:01,110 --> 00:11:17,710
I'm not sure if it was published in USENIX security, but it was an academic paper that was in the form of something that a government security person or a corporate security person could kind of understand.

122
00:11:17,710 --> 00:11:21,990
It wasn't all shady, like Frack Magazine, etc.

123
00:11:22,130 --> 00:11:36,210
And basically, it just talked about, you know, look at the way that attackers are breaking into networks, collect all of those things together, and try them on your own network.

124
00:11:36,210 --> 00:11:45,230
Weak passwords, probing open ports, try exploiting trust, exploit known bugs.

125
00:11:45,230 --> 00:11:49,590
Imagine that, exploiting known vulnerabilities to see if you have them.

126
00:11:49,590 --> 00:11:51,830
This was a new concept in 93.

127
00:11:51,830 --> 00:12:03,570
And then they talked about locking down networks based on understanding how hackers were and attackers were going after networks.

128
00:12:04,770 --> 00:12:14,570
And then, a little bit later, well, not in the first one with Crack, but a little later, these hacker tools started to show up.

129
00:12:14,590 --> 00:12:23,710
Really, the first hacker tool that was sort of, you know, well known and well available was Crack by Alec Muffet.

130
00:12:23,990 --> 00:12:26,210
Came out in 1991.

131
00:12:26,210 --> 00:12:33,570
And his whole idea was do a dictionary attack, or a brute force attack on Unix passwords.

132
00:12:33,770 --> 00:12:36,110
Seemed like a reasonable thing to do.

133
00:12:36,110 --> 00:12:42,210
If attackers were guessing passwords, why not guess them first?

134
00:12:42,210 --> 00:12:47,430
And just do it right on the password file, the encrypted passwords.

135
00:12:47,430 --> 00:12:49,690
Seems to make complete sense now.

136
00:12:49,690 --> 00:12:54,290
But back then, this was considered only an attack tool.

137
00:12:54,290 --> 00:12:59,530
Why would a legitimate person use this kind of tool?

138
00:12:59,950 --> 00:13:18,750
Randall Schwartz was an admin at Intel that was actually fired and was charged with a felony for using Crack on the systems that he administered purely to tell the users of his system that they should pick a stronger password.

139
00:13:19,050 --> 00:13:30,670
Thankfully, later, the felony was, charges were reversed after a few years, but not so good for Randall Schwartz's career in the beginning.

140
00:13:30,670 --> 00:13:34,130
And of course, we know now, with Have I Been Honed?

141
00:13:34,210 --> 00:13:43,690
and lots of different things, figuring out if people are reusing passwords or weak passwords is critical.

142
00:13:44,730 --> 00:13:57,070
Satan was a tool created by Dan Farmer and Weetzie Venema a few years after they wrote their paper, basically automating the techniques that they said.

143
00:13:57,070 --> 00:13:59,490
So let's try all those vulnerabilities.

144
00:13:59,490 --> 00:14:02,150
Let's target all those misconfigurations.

145
00:14:02,150 --> 00:14:05,690
Let's automate the process of finding these problems on your network.

146
00:14:05,690 --> 00:14:06,890
Guess what?

147
00:14:06,890 --> 00:14:11,710
Dan Farmer got fired from his job at SGI for releasing this tool.

148
00:14:11,710 --> 00:14:22,010
He actually got fired for writing a tool, which is now a multi-billion dollar industry from the likes of, you know, Rapid7 and Qualys and Tenable.

149
00:14:22,110 --> 00:14:28,890
Dan got fired for pioneering the idea of network scanning for vulnerabilities.

150
00:14:28,970 --> 00:14:37,530
A little bit of trivia there, that logo on the right is the logo of Satan.

151
00:14:37,830 --> 00:14:42,970
And it was actually sketched by Neil Gaiman, the author of Sandman.

152
00:14:42,970 --> 00:14:44,970
So Dan was friends with him.

153
00:14:45,030 --> 00:14:52,030
And then the final tool I wanted to mention was Netcat by Hobbit, came out in 96, really as this network Swiss army knife.

154
00:14:52,030 --> 00:14:54,370
I'm sure everyone has used Netcat.

155
00:14:55,630 --> 00:15:01,960
Didn't do anything except set up connections and send data to those connections.

156
00:15:02,170 --> 00:15:13,910
I ported it to Windows and it actually turned out that that started getting flagged as something that was malicious code by antivirus.

157
00:15:13,910 --> 00:15:21,570
So if you actually wanted to use that to scan systems and test systems, you had to make sure that you didn't run a file of antivirus.

158
00:15:21,570 --> 00:15:26,680
So there's a lot of misunderstandings in the early days.

159
00:15:27,400 --> 00:15:43,380
And hackers created the first real true information sources about bugs in software, vulnerabilities, bug track with its full disclosure policy, famously went around what cert was trying to do.

160
00:15:43,380 --> 00:15:46,100
It was a place where people could publish information.

161
00:15:46,100 --> 00:15:52,680
If vendors weren't listening to you, you could just publish it publicly.

162
00:15:52,680 --> 00:15:56,580
And it was a place where like-minded security people could find that.

163
00:15:56,760 --> 00:15:59,860
Really radical in the beginning years.

164
00:15:59,860 --> 00:16:07,420
It was actually created in 1993 by Scott Chason, someone who, one of the founders of ComSec.

165
00:16:07,420 --> 00:16:14,040
So I think we have a lot to thank Scott Chason for, for pioneering and pushing the limits.

166
00:16:14,600 --> 00:16:26,380
He was also a, one of the early editors of FRAC, along with Chris Goggins, was one of the early editors of FRAC, which, you know, started in the late 80s and still goes today.

167
00:16:26,380 --> 00:16:28,700
Very popular in the mid 90s.

168
00:16:28,700 --> 00:16:32,860
Issues coming out on a monthly basis, all kinds of exploits and tools.

169
00:16:32,860 --> 00:16:37,360
And of course, we all know about DEF CON as a place where people can gather and give presentations.

170
00:16:37,360 --> 00:16:40,640
And that's, that's where we are here today.

171
00:16:40,660 --> 00:16:47,340
The first computer security presentations about sort of real security were created by hackers.

172
00:16:47,760 --> 00:17:01,180
And the other big change I think we saw with hackers entering the realm here of computer security was they made computer security a participatory sport.

173
00:17:01,180 --> 00:17:11,800
Capture the flags became a way to learn, learn by doing, learn by training with your adversaries, learn from your adversaries and make it fun.

174
00:17:11,800 --> 00:17:12,500
Right?

175
00:17:13,700 --> 00:17:18,280
Up until then, security was sort of set it and forget it.

176
00:17:18,280 --> 00:17:28,020
You know, maybe there was an audit by a, an audit and accounting firm to make sure you had, you know, passwords turned on and you had logging and all that.

177
00:17:28,020 --> 00:17:29,240
But it was very static.

178
00:17:29,240 --> 00:17:32,700
It was very set it and forget it and wait for the attackers to come.

179
00:17:32,700 --> 00:17:47,720
Where the hacking community really birthed this notion of the pen test and the red teaming and adversarial, the adverse, bringing in the adversarial nature for, for securing systems.

180
00:17:47,940 --> 00:17:52,740
And we know that that's made a huge, huge difference.

181
00:17:54,740 --> 00:17:58,340
So I was a member of the loft starting in 93.

182
00:17:58,640 --> 00:18:03,480
And, you know, four or five years later, we said, hey, you know, this is all fun.

183
00:18:03,480 --> 00:18:07,680
We're releasing things and that, but, you know, maybe this could be a business .

184
00:18:07,900 --> 00:18:10,060
Maybe we could actually do consulting.

185
00:18:10,060 --> 00:18:11,700
Maybe we could sell software.

186
00:18:11,700 --> 00:18:14,520
And actually in 97, we started selling loft crack.

187
00:18:14,640 --> 00:18:18,760
And we thought about, you know, maybe this could be a full time gig.

188
00:18:18,800 --> 00:18:21,940
So let's try, let's try consulting.

189
00:18:21,940 --> 00:18:24,760
And we knew about CommSec back in 91.

190
00:18:25,180 --> 00:18:34,680
And they, we knew that, you know, the loft was a known hacker group and we used our hacker names, but you know, maybe, maybe, maybe times have changed.

191
00:18:34,680 --> 00:18:36,740
Maybe we could have a go at this.

192
00:18:37,180 --> 00:18:39,920
And so we tried our hands at consulting.

193
00:18:39,920 --> 00:18:46,260
And one of the ways we did this was we found a local consulting company in the Boston area.

194
00:18:46,480 --> 00:18:53,700
And we talked to them and we said, you know, maybe you should start a consulting business.

195
00:18:53,880 --> 00:19:02,340
And the loft could, you know, be your security consulting business unit.

196
00:19:02,340 --> 00:19:08,260
And so we started talking to them about coming on as employees.

197
00:19:08,640 --> 00:19:18,880
And we said, there's no better way for us to demonstrate what our capabilities are than to try to hack, try to hack your company, right?

198
00:19:18,880 --> 00:19:25,300
Let's do a full-on penetration test of your company.

199
00:19:25,600 --> 00:19:28,840
So we talked them into letting us do this.

200
00:19:28,840 --> 00:19:36,560
We did it pro bono, you know, because we were trying to explain to them the value we had.

201
00:19:37,320 --> 00:19:39,000
So we did that.

202
00:19:39,000 --> 00:19:42,860
And we were actually negotiating with them at the time, right?

203
00:19:42,860 --> 00:19:47,320
We were negotiating with them saying, you know, what would our salaries be?

204
00:19:47,320 --> 00:19:49,460
What would the business look like?

205
00:19:49,460 --> 00:19:57,940
You know, what would be the parameters around us coming to work at your company?

206
00:19:58,900 --> 00:20:17,840
And we just did, we did a no-holds-barred, full-spectrum, you know, voicemail, wireless, physical security, internet connection, you know, you name it, it was on the list.

207
00:20:17,840 --> 00:20:19,800
It was in scope.

208
00:20:19,800 --> 00:20:28,120
We actually didn't do any email social engineering or voicemail social engineering.

209
00:20:28,440 --> 00:20:38,700
But we did do things like physically penetrate in order to do things like, you know, see what was in the trash and things like that.

210
00:20:40,140 --> 00:20:45,840
So here's the cover page of our security audit.

211
00:20:45,840 --> 00:20:49,460
We went, we didn't go by the loft, we went by LHI Technologies.

212
00:20:49,460 --> 00:20:53,840
We took the loft-heavy industries and made it LHI Technologies.

213
00:20:54,360 --> 00:21:03,780
And because we were doing some consulting, selling some software at the time, and that was a part of the loft history where we were actually sort of becoming a company.

214
00:21:03,780 --> 00:21:10,280
And we did this between August 20th and September 8th, 1997.

215
00:21:10,320 --> 00:21:16,620
It was a completely black box test.

216
00:21:16,620 --> 00:21:22,820
And, you know, we use a combination of tools and network probing.

217
00:21:22,820 --> 00:21:25,480
I've blanked out the name of the company.

218
00:21:25,580 --> 00:21:34,100
It's been a few years, but just, you know, make sense to keep them confidential.

219
00:21:34,500 --> 00:21:38,320
Security in 1997 was a lot different than it is now.

220
00:21:39,540 --> 00:21:50,420
So just if I look, we look at the executive summary here, you can see that from the internet, we were pretty much able to totally own everything.

221
00:21:50,420 --> 00:22:05,720
All these critical corporate systems, Oracle databases, got corporate credit cards, voicemail, the network routers, the dial-up systems, personal email, their intranet site.

222
00:22:06,760 --> 00:22:09,460
So basically total ownage.

223
00:22:10,220 --> 00:22:16,140
And we did this without any kind of inside accomplices, no previous knowledge.

224
00:22:16,640 --> 00:22:19,600
Completely, completely black box.

225
00:22:19,600 --> 00:22:27,800
So, you know, I could do a whole presentation on the gory details of this, but I just wanted to highlight a couple things which I thought were interesting.

226
00:22:28,700 --> 00:22:32,520
Things you don't always see in a pen test.

227
00:22:32,740 --> 00:22:39,080
So one is, you know, one of the first ways we got in was through the web server.

228
00:22:39,920 --> 00:22:47,140
And if anyone had been doing hacking in 1996, you probably heard of the PHF vulnerability.

229
00:22:47,480 --> 00:22:55,660
It was a CGI bin that came pre-installed with Apache.

230
00:22:55,840 --> 00:22:58,720
And it had command injection, right?

231
00:22:58,720 --> 00:23:07,820
So you could just put a delimiter character in there and put your command.

232
00:23:08,500 --> 00:23:10,080
Pretty basic.

233
00:23:10,080 --> 00:23:15,500
But of course, you know, Apache should be running as its own user, right?

234
00:23:15,500 --> 00:23:18,220
It should be running as HTTPD,

235
00:23:21,320 --> 00:23:25,680
shouldn't allow you to compromise the system through this vulnerability, right?

236
00:23:25,680 --> 00:23:31,880
Maybe you could get... it's basically an information leakage if permissions are set correctly.

237
00:23:31,880 --> 00:23:43,220
But we were poking around and we actually saw that someone didn't set the permissions on HTTPD.conf file correctly.

238
00:23:43,220 --> 00:23:58,880
So the configuration file shouldn't be owned by the HTTPD process because, you know, then any code that executes from the web server could change the configuration and guess what part of the configuration of the server is?

239
00:23:58,880 --> 00:24:01,740
It's what user the server should run as.

240
00:24:01,860 --> 00:24:14,480
So we use this command injection to edit that file and change it so that the next time the server came up, the web server came up, it would be running as root.

241
00:24:15,740 --> 00:24:18,080
Nice little technique there.

242
00:24:18,140 --> 00:24:24,000
But then we did uptime on the system and we saw that the system had been running for over 100 days.

243
00:24:24,460 --> 00:24:27,240
And, you know, we tried DDoSing it.

244
00:24:27,680 --> 00:24:33,500
But, you know, we basically had to wait for someone to reboot the server.

245
00:24:33,720 --> 00:24:37,640
And so we didn't think we were going to go... we weren't going to get in this way.

246
00:24:37,640 --> 00:24:44,640
We started probing some other systems and actually found some other vulnerabilities and were able to get in.

247
00:24:44,640 --> 00:25:02,220
But a few days later, I was listening to the news and I actually saw that there was a manhole explosion in Cambridge where this company was located.

248
00:25:02,220 --> 00:25:12,140
And unfortunately, an employee of the power company actually died in the manhole explosion.

249
00:25:12,140 --> 00:25:16,840
But it downed power in Cambridge for five hours.

250
00:25:16,840 --> 00:25:26,500
And after this happened, I started started probing, you know, the system and started looking at their web server.

251
00:25:26,760 --> 00:25:30,460
And it was up after an hour, it was up after a couple hours.

252
00:25:30,460 --> 00:25:32,220
So they obviously had backup.

253
00:25:32,220 --> 00:25:41,700
But after about three hours, the system went down and they didn't have enough backup for this five-hour power outage.

254
00:25:41,840 --> 00:25:48,480
And when the power came back up, it rebooted and we were now doing command execution as root.

255
00:25:49,200 --> 00:25:58,800
So I just thought that was a little bit... I had never come into a situation like that before in a pen test, but you just never know how things are going to go and what's going to go your way.

256
00:26:00,020 --> 00:26:08,060
The other thing I thought was pretty interesting was we, you know, looked at the voicemail, the voicemail systems.

257
00:26:08,060 --> 00:26:14,180
And you can see there on the left, the extension, we have the username in the middle.

258
00:26:14,180 --> 00:26:16,460
I've grayed out some of them.

259
00:26:16,680 --> 00:26:18,980
And then the password on the right.

260
00:26:18,980 --> 00:26:23,680
And you can see the new employee voicemail box gets a 1234 password.

261
00:26:23,680 --> 00:26:29,040
And you can see that some people never changed it, like IT and facilities service line was 1234.

262
00:26:29,040 --> 00:26:32,380
The travel line was 1234.

263
00:26:33,520 --> 00:26:35,260
Directions was 1234.

264
00:26:35,260 --> 00:26:40,960
But there's some other accounts on there where the extension and the password are the same, 4069.

265
00:26:41,120 --> 00:26:46,380
And if you look down, there's 18629, where the extension was the same as the password.

266
00:26:46,940 --> 00:26:56,840
That actually happened to be the vice president that was negotiating with us at the time about joining the company.

267
00:26:56,840 --> 00:27:06,700
And we sort of listed out what we were expecting for salaries, benefits, how we wanted the jobs to work.

268
00:27:07,660 --> 00:27:17,160
And one of the things we really wanted was we wanted that step van, or I don't know if it was a bread truck or whatever, that was in sneakers.

269
00:27:17,160 --> 00:27:31,700
We wanted a sneakers van so that we could outfit it with electronic equipment to do wireless and surveillance and have the mobile hacking unit.

270
00:27:31,700 --> 00:27:33,120
It looked totally awesome.

271
00:27:33,120 --> 00:27:36,080
I think everyone who watched sneakers loved that.

272
00:27:36,320 --> 00:27:38,560
We put in that we wanted that.

273
00:27:38,560 --> 00:27:45,620
And we heard on this voicemail, so we captured a couple of voicemails as evidence that we were able to get in the account.

274
00:27:46,040 --> 00:27:52,480
And one of the voicemails was talking about those loft guys.

275
00:27:52,480 --> 00:27:56,220
And he said, these guys want an effing Winnebago.

276
00:27:56,740 --> 00:27:59,660
And they were not happy with us.

277
00:27:59,660 --> 00:28:01,900
They thought we were asking for the world.

278
00:28:02,540 --> 00:28:06,500
Sort of just didn't understand what we were going for.

279
00:28:07,040 --> 00:28:19,080
So you don't always have a situation where you're negotiating with your potential future employer while you're doing a no-holds-barred pen test with your get-out-of-jail-free card, right?

280
00:28:19,080 --> 00:28:23,640
So, again, another bit of an interesting situation.

281
00:28:24,840 --> 00:28:28,780
But, you know, we didn't end up joining there.

282
00:28:28,780 --> 00:28:39,740
And a couple years later, the loft ended up joining a startup company called At Stake, which just did information security consulting.

283
00:28:40,000 --> 00:28:44,120
And I'm sure some of you have heard of At Stake.

284
00:28:44,120 --> 00:28:54,820
This was an article from January 2000, where, you know, the way the news looked at it was using good hackers to battle bad hackers.

285
00:28:55,200 --> 00:29:00,020
If you have a murky past and doubt you could become a dot-com millionaire, think again.

286
00:29:01,320 --> 00:29:14,000
And I thought, you know, what a change from the 1991 with ComSec, really not being thought of as credible.

287
00:29:14,000 --> 00:29:25,300
So a lot of things had to happen over the 90s for really us to join At Stake and be perceived as a legitimate company.

288
00:29:25,300 --> 00:29:28,580
And so that's my story.

289
00:29:28,580 --> 00:29:30,900
That's my story from 2000.

290
00:29:30,920 --> 00:29:35,240
I hope that you enjoy this in 2020.

291
00:29:36,540 --> 00:29:40,880
And here's my contact information.

292
00:29:40,880 --> 00:29:43,420
There's this thing called Twitter is going to get invented, I think.

293
00:29:43,420 --> 00:29:47,160
And I'm going to found this company called Veracode in 2006.

294
00:29:47,240 --> 00:29:49,960
Just some of my future plans.

295
00:29:49,960 --> 00:29:51,000
So I hope you enjoyed it.

296
00:29:51,000 --> 00:29:56,020
I'm going to join on the Discord, which is another technology that's just going to be invented.

297
00:29:56,240 --> 00:29:58,820
And hopefully, we can chat.

298
00:29:59,100 --> 00:30:04,600
So bye-bye, everyone.