start	end	text
3630	10370	Yeah, no. I think we're gonna have to do it tomorrow. We'll do it tomorrow. I got to go.
10370	18310	I got to go. I'm giving a presentation at DEF CON. The cool thing is I'm recording it now
18310	23230	and it's going to be presented 20 years into the future in 2020. Isn't that cool?
23410	26190	All right. All right. I'll talk to you tomorrow. All right. Bye.
28430	36150	Yeah. Hi, everyone. It's good to be here. I'm coming to you from the past to talk about the
36150	46210	90s and how pen testing really came from the hacker community and just wouldn't really be there
46800	53850	if it wasn't for the hacker community. So I have some slides and I'm gonna share my screen here
53850	62430	so we can we can see them. All right. Great. I hope everyone can see the slides.
63610	72770	So, yeah. I'm happy to be here. My name is Chris Weisoppel. Some people might know me as
72770	81670	Weld Pond. And I'm gonna talk about how red teaming was born from the hacker community.
84210	91950	Some of you may have seen this picture. This is a picture of the group of us from the Loft,
91950	100330	which was a hacker group that I'm part of. And we actually got these t-shirts made up
100330	105650	to commemorate the event, Feds Love Loft. But we testified at the Senate. It was a little
105650	112970	controversial at the time. We were the first hackers to talk about computer security and try
112970	119870	to help the U.S. government understand what was going on. I don't know if you can see our
119870	125610	placards there in front of us, but they have our hacker names, not our real names,
125610	129550	which I thought was pretty interesting. They let us testify with our hacker names because,
129550	135930	of course, back in the 90s, it was kind of risky to be called out as a hacker with a hacker handle
136930	142230	and posting about vulnerabilities and things like that. So we didn't want to risk our day jobs
143050	149990	we were all, a lot of us were in IT. And, you know, if you said bad things about a big vendor,
149990	158070	it might be bad for you and your job. Unfortunately, or fortunately, I'm not sure
158070	166110	what, but, you know, our pictures were posted with our, it was posted in the newspapers the next day
166110	172550	and people at work kind of knew what we looked like. So the jig was kind of up that we did this,
173170	181530	that's me there. And here's a little different. I've made it a little bit shorter. But, you know,
181690	188510	a lot of people say, you know, how did this happen? How did you get there? And it really was,
189250	197070	you know, doing things the hacker way, you know, reverse engineering, exploring,
198270	205130	looking at hosts and networks, but we did it on our own machines. And we did it in order to
205130	212390	publicize the insecurity in software and hardware and took on a really kind of a consumer advocacy
213290	222270	approach. And I think while making trouble for vendors, a lot of other people saw the benefit
222270	231310	of what we were doing. And that's how we got invited to go speak at the Senate. And famously,
231310	237150	Mudge, who's there next to me, said we can take down the internet in 30 minutes. And we were
237150	246470	talking about BGP vulnerabilities, which are still a problem. BGP hijacking is still definitely an
246470	253470	issue a few years later. But I want to go back to sort of the beginning of sort of computer
253470	261850	security. And when I go back to the beginning of computer security, I think of, you know,
261850	270550	the Orange Book. This was a book that talked about design and security features, authentication,
271090	278630	encryption, auditing. It really talked about security features. And the book was kind of
278630	283670	made famous in the hacker community because it made an appearance in the movie Hackers.
284170	289830	But it really was the way that people thought about computer security, you know, in the early
289830	296910	and even in the mid 90s. It was all about security features. There's nothing in here about bugs in
296910	303790	code, right? And we all know that that blows a hole right through any security feature. So there
303790	310810	was a huge part of building secure systems that was completely missing until hackers started
311630	319210	exploring and probing things. The other big way people thought about computer security was CERT,
319210	325410	which was formed after the Morse worm. And in the early 90s, CERT said, you know, we'll start
325410	330750	taking a look at these vulnerabilities. You know, if someone finds a vulnerability, send it to CERT.
330750	337410	We'll understand it. We'll look at it. We'll talk to the vendors and we'll try to get them to fix it.
337610	342730	But one of the things we found at the loft is when we first started dealing with CERT, if we found
342730	349110	vulnerabilities, that we would send it to CERT and it would just become a black hole. We didn't know
349110	355470	if the vendor fixed it, if they fixed it in a silent fix. The general public didn't know about
355470	361590	it. So there was no way for them to know that they should be patching. And there was sort of no
361590	367990	consequences for vendors who wrote, you know, buggy, insecure code because the general public didn't
367990	373250	know about it. It was just something between CERT and the vendor. And, you know, I think that was
373250	379970	pretty broken until hackers basically, you know, did an end run around that whole model.
381130	390610	In the early days, there were some hackers that tried to start companies. The earliest company
390610	397590	that I know of is a company called ComSec Data Security. And here's actually the press release
399030	405650	from 1991. So the contacts here are Scott Chason and Chris Goggins, two of the founders
406390	412530	of ComSec. And they're quite proud to say that they're comprised mainly of the now-defunct
412530	420090	computer group, the Legion of Doom. And they plan to offer full-scale security package
420090	427010	to private industry. I don't know if people remember Legion of Doom, but, you know, several
427010	435930	members actually went to jail for CFAA violations. So, you know, maybe not the best group to be
435930	441890	saying this is the basis of our company. But what they were saying also is they were
441890	446630	bringing a fresh approach to the security consulting and the corporate marketplace.
447990	454950	That they know how systems are compromised and what actions need to be taken to secure them.
454950	461530	So this was actually a totally new thing. They were really kind of pioneering here, saying that
461530	467710	they know how systems are compromised. And so that's the fresh approach. Isn't that amazing
467710	475350	in 91 that that was brand new? And I have to applaud them for, you know, pioneering in the
476530	482510	industry here. But in the press release, I thought this part was actually pretty interesting. They
482510	487770	said that they were aware of the possible shock wave among the hacking underground over this
487770	493410	venture. The firm maintains that they are security consultants and not informants or
493410	498590	hacker trackers. We're not going to go after people. We are going to ensure that no one,
498590	504890	hacker or corporate spy, can compromise the security of our clients' computers. So, you know,
504890	511950	there was this idea that, like, if a hacker worked for a corporation, it was sort of narking, right?
511950	518970	The only reason you're there is to, you know, tell them about the other hackers that were out
518970	525110	there that you knew about from underground bulletin boards and mailing lists and bridges and things
525110	529810	like that. And they were claiming that's not what they're doing. That's not what they're doing. But
529810	536190	that was definitely a concern back then, this whole, you know, can the hacker community trust
536190	540770	someone who goes into corporate world? So it really kind of went both ways.
543210	554510	There was an interview afterwards by ISP News, and I thought this was actually kind of interesting.
555670	560750	ISP News was saying, given where you're coming from, why should a potential client trust you?
560750	566050	And the CG here is Chris Goggins, one of the founders. He says, I know it's a natural question,
566050	573330	just the very nature of creating a company should project an image that we are trying to come out
573330	577590	of the shadows, out of the underground. We're saying, look, everybody, we've been doing this
577590	584950	for a long time. Now we want to help. And, you know, ISP News says, I'm sure you understand the
584950	591050	natural suspicion that people have. And Goggins says, no, that's what I don't understand. If we
591050	595490	at ComSec were out to compromise information from an existing company's computer network,
595490	599610	we wouldn't have incorporated. We could have done that, and someone else could have
599610	604470	already done so. Then the information would be available from one hacker to another.
604470	611090	So he's really trying to say, hey, you know, we understand that people are going to be skeptical.
612570	620370	But, you know, you can trust us. Unfortunately, ComSec didn't go very far. It was just too early.
620370	626750	They couldn't get any customers. And, you know, some things had to happen between 91
627310	633410	and the late 90s before people could start to trust hackers and hacker techniques
634550	643370	to secure their systems. One of the big seminal papers, and something that was very seminal for me
643370	650090	when I was starting out doing computer security, was this paper by Dan Farmer and Witte Venema in
650090	656490	93. So just a couple years after ComSec. And they wrote this paper, improving the security of your
656490	662590	site by breaking into it. And they published this as a paper. I'm not sure if it was published in
662590	672550	USENIX security, but it was an academic paper that was in the form of something that a government
672550	679110	security person or a corporate security person could kind of understand. It wasn't all shady,
679370	686550	like Frack Magazine, etc. And basically, it just talked about, you know, look at the way that
686550	693650	attackers are breaking into networks, collect all of those things together, and try them on your own
695090	702950	network. Weak passwords, probing open ports, try exploiting trust,
702950	709590	exploit known bugs. Imagine that, exploiting known vulnerabilities to see if you have them.
709590	715870	This was a new concept in 93. And then they talked about locking down networks based on
715870	723570	understanding how hackers were and attackers were going after networks.
724770	731010	And then, a little bit later, well, not in the first one with Crack, but a little later,
731010	739550	these hacker tools started to show up. Really, the first hacker tool that was sort of, you know,
739550	747550	well known and well available was Crack by Alec Muffet. Came out in 1991. And his whole idea was
747550	755450	do a dictionary attack, or a brute force attack on Unix passwords. Seemed like a reasonable thing
755450	764450	to do. If attackers were guessing passwords, why not guess them first? And just do it right on the
764450	771110	password file, the encrypted passwords. Seems to make complete sense now. But back then, this was
771110	779530	considered only an attack tool. Why would a legitimate person use this kind of tool?
779950	787310	Randall Schwartz was an admin at Intel that was actually fired and was charged with a felony
787310	795770	for using Crack on the systems that he administered purely to tell the users of his system that they
795770	804750	should pick a stronger password. Thankfully, later, the felony was, charges were reversed
805650	811150	after a few years, but not so good for Randall Schwartz's career in the beginning. And of course,
811150	818350	we know now, with Have I Been Honed? and lots of different things,
818350	823690	figuring out if people are reusing passwords or weak passwords is critical.
824730	831650	Satan was a tool created by Dan Farmer and Weetzie Venema a few years after they wrote their paper,
831650	839490	basically automating the techniques that they said. So let's try all those vulnerabilities.
839490	844790	Let's target all those misconfigurations. Let's automate the process of finding these problems
844790	851850	on your network. Guess what? Dan Farmer got fired from his job at SGI for releasing this tool. He
851850	858210	actually got fired for writing a tool, which is now a multi-billion dollar industry from the likes
858210	867090	of, you know, Rapid7 and Qualys and Tenable. Dan got fired for pioneering the idea of network
867090	873210	scanning for vulnerabilities. A little bit of trivia there, that logo on the right
874230	883830	is the logo of Satan. And it was actually sketched by Neil Gaiman, the author of Sandman. So Dan was
883830	890250	friends with him. And then the final tool I wanted to mention was Netcat by Hobbit, came out in 96,
890250	894370	really as this network Swiss army knife. I'm sure everyone has used Netcat.
895630	901960	Didn't do anything except set up connections and send data to those connections.
902170	909690	I ported it to Windows and it actually turned out that that started getting flagged as something
909690	916830	that was malicious code by antivirus. So if you actually wanted to use that to scan systems and
916830	922460	test systems, you had to make sure that you didn't run a file of antivirus. So there's a lot of
923560	931420	misunderstandings in the early days. And hackers created the first real true information
932600	939440	sources about bugs in software, vulnerabilities, bug track with its full disclosure policy,
939440	945280	famously went around what cert was trying to do. It was a place where people could publish
945280	952760	information. If vendors weren't listening to you, you could just publish it publicly. And it
952760	959220	was a place where like-minded security people could find that. Really radical in the beginning
959220	967420	years. It was actually created in 1993 by Scott Chason, someone who, one of the founders of ComSec.
967420	974040	So I think we have a lot to thank Scott Chason for, for pioneering and pushing the limits.
974600	981360	He was also a, one of the early editors of FRAC, along with Chris Goggins, was one of the early
981360	987800	editors of FRAC, which, you know, started in the late 80s and still goes today. Very popular in the
987800	993660	mid 90s. Issues coming out on a monthly basis, all kinds of exploits and tools. And of course, we all
993660	998480	know about DEF CON as a place where people can gather and give presentations. And that's, that's
998480	1004880	where we are here today. The first computer security presentations about sort of real security
1004880	1013600	were created by hackers. And the other big change I think we saw with hackers entering the realm
1013600	1022220	here of computer security was they made computer security a participatory sport. Capture the flags
1022220	1028960	became a way to learn, learn by doing, learn by training with your adversaries, learn from your
1028960	1038280	adversaries and make it fun. Right? Up until then, security was sort of set it and forget it. You
1038280	1044580	know, maybe there was an audit by a, an audit and accounting firm to make sure you had, you know,
1044580	1049980	passwords turned on and you had logging and all that. But it was very static. It was very set it
1049980	1057400	and forget it and wait for the attackers to come. Where the hacking community really birthed this
1057400	1064120	notion of the pen test and the red teaming and adversarial, the adverse, bringing in the adversarial
1064120	1072740	nature for, for securing systems. And we know that that's made a huge, huge difference.
1074740	1081900	So I was a member of the loft starting in 93. And, you know, four or five years later, we said, hey,
1081900	1087280	you know, this is all fun. We're releasing things and that, but, you know, maybe this could be a
1087280	1092900	business. Maybe we could actually do consulting. Maybe we could sell software. And actually in 97,
1092900	1097860	we started selling loft crack. And we thought about, you know, maybe this could be a full time
1097860	1106260	gig. So let's try, let's try consulting. And we knew about CommSec back in 91. And they, we knew
1106260	1112480	that, you know, the loft was a known hacker group and we used our hacker names, but you know, maybe,
1112480	1119260	maybe, maybe times have changed. Maybe we could have a go at this. And so we tried our hands at
1119260	1125220	consulting. And one of the ways we did this was we found a local consulting company in the Boston
1125220	1133700	area. And we talked to them and we said, you know, maybe you should start a consulting business.
1133880	1143860	And the loft could, you know, be your security consulting business unit. And so we started
1143860	1151520	talking to them about coming on as employees. And we said, there's no better way for us to demonstrate
1151520	1159960	what our capabilities are than to try to hack, try to hack your company, right? Let's do a full-on
1159960	1170700	penetration test of your company. So we talked them into letting us do this. We did it pro bono,
1170700	1179620	you know, because we were trying to explain to them the value we had. So we did that. And we
1179620	1184940	were actually negotiating with them at the time, right? We were negotiating with them saying,
1184940	1190000	you know, what would our salaries be? What would the business look like? You know,
1190460	1197940	what would be the parameters around us coming to work at your company?
1198900	1210860	And we just did, we did a no-holds-barred, full-spectrum, you know, voicemail, wireless,
1210860	1217840	physical security, internet connection, you know, you name it, it was on the list.
1217840	1227040	It was in scope. We actually didn't do any email social engineering or voicemail social
1227040	1235760	engineering. But we did do things like physically penetrate in order to do things like, you know,
1235760	1245840	see what was in the trash and things like that. So here's the cover page of our security audit.
1245840	1250680	We went, we didn't go by the loft, we went by LHI Technologies. We took the loft-heavy
1250680	1257180	industries and made it LHI Technologies. And because we were doing some consulting,
1257180	1261660	selling some software at the time, and that was a part of the loft history where we were
1261660	1268340	actually sort of becoming a company. And we did this between August 20th and September 8th,
1268980	1279800	1997. It was a completely black box test. And, you know, we use a combination of tools and
1281280	1287940	network probing. I've blanked out the name of the company. It's been a few years, but
1288500	1296460	just, you know, make sense to keep them confidential. Security in 1997 was a lot
1296460	1304340	different than it is now. So just if I look, we look at the executive summary here,
1304340	1310420	you can see that from the internet, we were pretty much able to totally own everything.
1310420	1318760	All these critical corporate systems, Oracle databases, got corporate credit cards, voicemail,
1318760	1325720	the network routers, the dial-up systems, personal email, their intranet site.
1326760	1334380	So basically total ownage. And we did this without any kind of inside accomplices,
1334380	1341300	no previous knowledge. Completely, completely black box. So, you know, I could do a whole
1341300	1345940	presentation on the gory details of this, but I just wanted to highlight a couple things which
1345940	1354640	I thought were interesting. Things you don't always see in a pen test. So one is, you know,
1354640	1362420	one of the first ways we got in was through the web server. And if anyone had been doing
1362420	1372520	hacking in 1996, you probably heard of the PHF vulnerability. It was a CGI bin that came
1372520	1380080	pre-installed with Apache. And it had command injection, right? So you could just
1382580	1391160	put a delimiter character in there and put your command. Pretty basic. But of course,
1391160	1398220	you know, Apache should be running as its own user, right? It should be running as HTTPD,
1401320	1406000	shouldn't allow you to compromise the system through this vulnerability, right? Maybe you
1406000	1411880	could get... it's basically an information leakage if permissions are set correctly.
1411880	1419180	But we were poking around and we actually saw that someone didn't set the permissions on
1420460	1428880	HTTPD.conf file correctly. So the configuration file shouldn't be owned by the HTTPD process
1429440	1434940	because, you know, then any code that executes from the web server could change the configuration
1434940	1440860	and guess what part of the configuration of the server is? It's what user the server should run
1440860	1449940	as. So we use this command injection to edit that file and change it so that the next time
1449940	1457120	the server came up, the web server came up, it would be running as root. Nice little technique
1457120	1462560	there. But then we did uptime on the system and we saw that the system had been running for over
1462560	1471900	100 days. And, you know, we tried DDoSing it. But, you know, we basically had to wait for someone
1471900	1476840	to reboot the server. And so we didn't think we were going to go... we weren't going to get in
1476840	1482020	this way. We started probing some other systems and actually found some other vulnerabilities
1482900	1490300	and were able to get in. But a few days later, I was listening to the news
1491060	1500860	and I actually saw that there was a manhole explosion in Cambridge where this company was
1500860	1509860	located. And unfortunately, an employee of the power company actually died in the manhole
1511020	1519380	explosion. But it downed power in Cambridge for five hours. And after this happened,
1519380	1527440	I started started probing, you know, the system and started looking at their web server. And it
1527440	1532800	was up after an hour, it was up after a couple hours. So they obviously had backup. But after
1532800	1540940	about three hours, the system went down and they didn't have enough backup for this five-hour power
1540940	1547380	outage. And when the power came back up, it rebooted and we were now doing command execution
1547380	1553400	as root. So I just thought that was a little bit... I had never come into a situation like that before
1553400	1558800	in a pen test, but you just never know how things are going to go and what's going to go your way.
1560020	1566300	The other thing I thought was pretty interesting was we, you know, looked at the voicemail,
1566820	1573520	the voicemail systems. And you can see there on the left, the extension, we have the username in
1573520	1579400	the middle. I've grayed out some of them. And then the password on the right. And you can see
1579400	1585020	the new employee voicemail box gets a 1234 password. And you can see that some people never
1585020	1594040	changed it, like IT and facilities service line was 1234. The travel line was 1234. Directions
1594040	1599440	was 1234. But there's some other accounts on there where the extension and the password are the same,
1599440	1606380	4069. And if you look down, there's 18629, where the extension was the same as the password.
1606940	1614740	That actually happened to be the vice president that was negotiating with us at the time about
1614740	1622560	joining the company. And we sort of listed out what we were expecting for salaries, benefits,
1622560	1631060	how we wanted the jobs to work. And one of the things we really wanted was we wanted that
1631840	1637160	step van, or I don't know if it was a bread truck or whatever, that was in sneakers.
1637160	1645500	We wanted a sneakers van so that we could outfit it with electronic equipment to do wireless
1646220	1653680	and surveillance and have the mobile hacking unit. It looked totally awesome. I think everyone
1653680	1660680	who watched sneakers loved that. We put in that we wanted that. And we heard on this voicemail,
1660680	1665620	so we captured a couple of voicemails as evidence that we were able to get in the account.
1666040	1673760	And one of the voicemails was talking about those loft guys. And he said,
1673760	1680300	these guys want an effing Winnebago. And they were not happy with us. They thought we were
1680300	1686500	asking for the world. Sort of just didn't understand what we were going for.
1687040	1693280	So you don't always have a situation where you're negotiating with your potential future employer
1693980	1699080	while you're doing a no-holds-barred pen test with your get-out-of-jail-free card, right?
1699080	1707460	So, again, another bit of an interesting situation. But, you know, we didn't end up
1707460	1713640	joining there. And a couple years later, the loft ended up joining a startup company
1713640	1722600	called At Stake, which just did information security consulting. And I'm sure some of you
1722600	1730660	have heard of At Stake. This was an article from January 2000, where, you know, the way the news
1730660	1737400	looked at it was using good hackers to battle bad hackers. If you have a murky past and doubt you
1737400	1745700	could become a dot-com millionaire, think again. And I thought, you know, what a change from
1745700	1755340	the 1991 with ComSec, really not being thought of as credible. So a lot of things had to happen
1755340	1765300	over the 90s for really us to join At Stake and be perceived as a legitimate company. And
1765960	1775240	so that's my story. That's my story from 2000. I hope that you enjoy this in 2020.
1776540	1783000	And here's my contact information. There's this thing called Twitter is going to get invented,
1783000	1789020	I think. And I'm going to found this company called Veracode in 2006. Just some of my future
1789020	1794640	plans. So I hope you enjoyed it. I'm going to join on the Discord, which is another technology
1794640	1804600	that's just going to be invented. And hopefully, we can chat. So bye-bye, everyone.