WEBVTT 00:03.630 --> 00:05.130 Yeah, no. 00:06.370 --> 00:08.310 I think we're gonna have to do it tomorrow. 00:08.310 --> 00:09.590 We'll do it tomorrow. 00:09.590 --> 00:10.370 I got to go. 00:10.370 --> 00:11.010 I got to go. 00:11.010 --> 00:16.130 I'm giving a presentation at DEF CON. 00:16.210 --> 00:22.050 The cool thing is I'm recording it now and it's going to be presented 20 years into the future in 2020. 00:22.050 --> 00:23.230 Isn't that cool? 00:23.410 --> 00:24.010 All right. 00:24.010 --> 00:24.310 All right. 00:24.310 --> 00:25.350 I'll talk to you tomorrow. 00:25.350 --> 00:25.650 All right. 00:25.650 --> 00:26.190 Bye. 00:28.430 --> 00:29.190 Yeah. 00:29.190 --> 00:30.430 Hi, everyone. 00:30.430 --> 00:31.750 It's good to be here. 00:31.750 --> 00:48.470 I'm coming to you from the past to talk about the 90s and how pen testing really came from the hacker community and just wouldn't really be there if it wasn't for the hacker community. 00:48.470 --> 00:57.870 So I have some slides and I'm gonna share my screen here so we can we can see them. 00:58.930 --> 00:59.750 All right. 00:59.750 --> 01:00.170 Great. 01:00.170 --> 01:02.430 I hope everyone can see the slides. 01:03.610 --> 01:04.910 So, yeah. 01:06.510 --> 01:08.610 I'm happy to be here. 01:08.690 --> 01:11.130 My name is Chris Weisoppel. 01:11.130 --> 01:14.350 Some people might know me as Weld Pond. 01:14.590 --> 01:21.670 And I'm gonna talk about how red teaming was born from the hacker community. 01:24.210 --> 01:26.930 Some of you may have seen this picture. 01:27.230 --> 01:36.470 This is a picture of the group of us from the Loft, which was a hacker group that I'm part of. 01:36.470 --> 01:43.150 And we actually got these t-shirts made up to commemorate the event, Feds Love Loft. 01:43.150 --> 01:44.710 But we testified at the Senate. 01:44.750 --> 01:48.510 It was a little controversial at the time. 01:48.510 --> 01:54.510 We were the first hackers to talk about computer security and try to help the U.S. 01:54.510 --> 01:58.130 government understand what was going on. 01:58.390 --> 02:06.970 I don't know if you can see our placards there in front of us, but they have our hacker names, not our real names, which I thought was pretty interesting. 02:06.970 --> 02:20.110 They let us testify with our hacker names because, of course, back in the 90s, it was kind of risky to be called out as a hacker with a hacker handle and posting about vulnerabilities and things like that. 02:20.110 --> 02:25.410 So we didn't want to risk our day jobs we were all, a lot of us were in IT. 02:25.790 --> 02:34.330 And, you know, if you said bad things about a big vendor, it might be bad for you and your job. 02:35.650 --> 02:49.670 Unfortunately, or fortunately, I'm not sure what, but, you know, our pictures were posted with our, it was posted in the newspapers the next day and people at work kind of knew what we looked like. 02:49.670 --> 02:54.850 So the jig was kind of up that we did this, that's me there. 02:55.770 --> 02:58.170 And here's a little different. 02:58.170 --> 03:00.370 I've made it a little bit shorter. 03:00.390 --> 03:04.330 But, you know, a lot of people say, you know, how did this happen? 03:04.330 --> 03:05.890 How did you get there? 03:05.930 --> 03:22.850 And it really was, you know, doing things the hacker way, you know, reverse engineering, exploring, looking at hosts and networks, but we did it on our own machines. 03:23.010 --> 03:34.530 And we did it in order to publicize the insecurity in software and hardware and took on a really kind of a consumer advocacy approach. 03:34.570 --> 03:44.290 And I think while making trouble for vendors, a lot of other people saw the benefit of what we were doing. 03:44.890 --> 03:49.870 And that's how we got invited to go speak at the Senate. 03:49.870 --> 03:56.670 And famously, Mudge, who's there next to me, said we can take down the internet in 30 minutes. 03:56.670 --> 04:02.710 And we were talking about BGP vulnerabilities, which are still a problem. 04:02.710 --> 04:08.970 BGP hijacking is still definitely an issue a few years later. 04:08.970 --> 04:14.930 But I want to go back to sort of the beginning of sort of computer security. 04:15.670 --> 04:23.450 And when I go back to the beginning of computer security, I think of, you know, the Orange Book. 04:23.810 --> 04:33.130 This was a book that talked about design and security features, authentication, encryption, auditing. 04:33.130 --> 04:36.310 It really talked about security features. 04:36.790 --> 04:43.670 And the book was kind of made famous in the hacker community because it made an appearance in the movie Hackers. 04:44.170 --> 04:52.290 But it really was the way that people thought about computer security, you know, in the early and even in the mid 90s. 04:52.690 --> 04:54.790 It was all about security features. 04:54.790 --> 04:58.330 There's nothing in here about bugs in code, right? 04:58.330 --> 05:03.390 And we all know that that blows a hole right through any security feature. 05:03.390 --> 05:13.910 So there was a huge part of building secure systems that was completely missing until hackers started exploring and probing things. 05:13.970 --> 05:21.910 The other big way people thought about computer security was CERT, which was formed after the Morse worm. 05:22.050 --> 05:27.450 And in the early 90s, CERT said, you know, we'll start taking a look at these vulnerabilities. 05:27.450 --> 05:30.750 You know, if someone finds a vulnerability, send it to CERT. 05:30.750 --> 05:32.130 We'll understand it. 05:32.130 --> 05:33.650 We'll look at it. 05:33.910 --> 05:37.410 We'll talk to the vendors and we'll try to get them to fix it. 05:37.610 --> 05:48.650 But one of the things we found at the loft is when we first started dealing with CERT, if we found vulnerabilities, that we would send it to CERT and it would just become a black hole. 05:48.650 --> 05:53.010 We didn't know if the vendor fixed it, if they fixed it in a silent fix. 05:53.350 --> 05:55.770 The general public didn't know about it. 05:55.770 --> 05:59.450 So there was no way for them to know that they should be patching. 06:00.050 --> 06:08.670 And there was sort of no consequences for vendors who wrote, you know, buggy, insecure code because the general public didn't know about it. 06:08.670 --> 06:11.110 It was just something between CERT and the vendor. 06:11.410 --> 06:19.970 And, you know, I think that was pretty broken until hackers basically, you know, did an end run around that whole model. 06:21.130 --> 06:29.170 In the early days, there were some hackers that tried to start companies. 06:29.170 --> 06:35.830 The earliest company that I know of is a company called ComSec Data Security. 06:35.830 --> 06:40.830 And here's actually the press release from 1991. 06:41.230 --> 06:47.770 So the contacts here are Scott Chason and Chris Goggins, two of the founders of ComSec. 06:47.770 --> 06:55.250 And they're quite proud to say that they're comprised mainly of the now-defunct computer group, the Legion of Doom. 06:55.510 --> 07:01.770 And they plan to offer full-scale security package to private industry. 07:02.130 --> 07:11.850 I don't know if people remember Legion of Doom, but, you know, several members actually went to jail for CFAA violations. 07:12.110 --> 07:19.570 So, you know, maybe not the best group to be saying this is the basis of our company. 07:19.570 --> 07:26.630 But what they were saying also is they were bringing a fresh approach to the security consulting and the corporate marketplace. 07:27.990 --> 07:34.950 That they know how systems are compromised and what actions need to be taken to secure them. 07:34.950 --> 07:37.910 So this was actually a totally new thing. 07:37.910 --> 07:44.130 They were really kind of pioneering here, saying that they know how systems are compromised. 07:44.730 --> 07:46.690 And so that's the fresh approach. 07:46.690 --> 07:50.010 Isn't that amazing in 91 that that was brand new? 07:50.010 --> 07:57.590 And I have to applaud them for, you know, pioneering in the industry here. 07:57.590 --> 08:02.130 But in the press release, I thought this part was actually pretty interesting. 08:02.290 --> 08:08.650 They said that they were aware of the possible shock wave among the hacking underground over this venture. 08:08.690 --> 08:14.730 The firm maintains that they are security consultants and not informants or hacker trackers. 08:14.730 --> 08:17.310 We're not going to go after people. 08:17.310 --> 08:23.930 We are going to ensure that no one, hacker or corporate spy, can compromise the security of our clients' computers. 08:23.930 --> 08:31.950 So, you know, there was this idea that, like, if a hacker worked for a corporation, it was sort of narking, right? 08:31.950 --> 08:46.130 The only reason you're there is to, you know, tell them about the other hackers that were out there that you knew about from underground bulletin boards and mailing lists and bridges and things like that. 08:46.270 --> 08:48.750 And they were claiming that's not what they're doing. 08:48.750 --> 08:49.670 That's not what they're doing. 08:49.670 --> 08:58.510 But that was definitely a concern back then, this whole, you know, can the hacker community trust someone who goes into corporate world? 08:58.510 --> 09:00.770 So it really kind of went both ways. 09:03.210 --> 09:14.510 There was an interview afterwards by ISP News, and I thought this was actually kind of interesting. 09:15.670 --> 09:20.750 ISP News was saying, given where you're coming from, why should a potential client trust you? 09:20.750 --> 09:23.670 And the CG here is Chris Goggins, one of the founders. 09:23.870 --> 09:35.390 He says, I know it's a natural question, just the very nature of creating a company should project an image that we are trying to come out of the shadows, out of the underground. 09:35.390 --> 09:38.470 We're saying, look, everybody, we've been doing this for a long time. 09:38.470 --> 09:40.010 Now we want to help. 09:41.750 --> 09:47.370 And, you know, ISP News says, I'm sure you understand the natural suspicion that people have. 09:47.750 --> 09:50.510 And Goggins says, no, that's what I don't understand. 09:50.650 --> 09:57.450 If we at ComSec were out to compromise information from an existing company's computer network, we wouldn't have incorporated. 09:57.490 --> 10:01.510 We could have done that, and someone else could have already done so. 10:01.510 --> 10:04.470 Then the information would be available from one hacker to another. 10:04.470 --> 10:11.090 So he's really trying to say, hey, you know, we understand that people are going to be skeptical. 10:12.570 --> 10:14.850 But, you know, you can trust us. 10:15.330 --> 10:18.850 Unfortunately, ComSec didn't go very far. 10:18.850 --> 10:20.370 It was just too early. 10:20.370 --> 10:22.430 They couldn't get any customers. 10:23.070 --> 10:36.930 And, you know, some things had to happen between 91 and the late 90s before people could start to trust hackers and hacker techniques to secure their systems. 10:37.390 --> 10:50.810 One of the big seminal papers, and something that was very seminal for me when I was starting out doing computer security, was this paper by Dan Farmer and Witte Venema in 93. 10:50.810 --> 10:53.130 So just a couple years after ComSec. 10:53.130 --> 10:58.610 And they wrote this paper, improving the security of your site by breaking into it. 10:58.610 --> 11:01.110 And they published this as a paper. 11:01.110 --> 11:17.710 I'm not sure if it was published in USENIX security, but it was an academic paper that was in the form of something that a government security person or a corporate security person could kind of understand. 11:17.710 --> 11:21.990 It wasn't all shady, like Frack Magazine, etc. 11:22.130 --> 11:36.210 And basically, it just talked about, you know, look at the way that attackers are breaking into networks, collect all of those things together, and try them on your own network. 11:36.210 --> 11:45.230 Weak passwords, probing open ports, try exploiting trust, exploit known bugs. 11:45.230 --> 11:49.590 Imagine that, exploiting known vulnerabilities to see if you have them. 11:49.590 --> 11:51.830 This was a new concept in 93. 11:51.830 --> 12:03.570 And then they talked about locking down networks based on understanding how hackers were and attackers were going after networks. 12:04.770 --> 12:14.570 And then, a little bit later, well, not in the first one with Crack, but a little later, these hacker tools started to show up. 12:14.590 --> 12:23.710 Really, the first hacker tool that was sort of, you know, well known and well available was Crack by Alec Muffet. 12:23.990 --> 12:26.210 Came out in 1991. 12:26.210 --> 12:33.570 And his whole idea was do a dictionary attack, or a brute force attack on Unix passwords. 12:33.770 --> 12:36.110 Seemed like a reasonable thing to do. 12:36.110 --> 12:42.210 If attackers were guessing passwords, why not guess them first? 12:42.210 --> 12:47.430 And just do it right on the password file, the encrypted passwords. 12:47.430 --> 12:49.690 Seems to make complete sense now. 12:49.690 --> 12:54.290 But back then, this was considered only an attack tool. 12:54.290 --> 12:59.530 Why would a legitimate person use this kind of tool? 12:59.950 --> 13:18.750 Randall Schwartz was an admin at Intel that was actually fired and was charged with a felony for using Crack on the systems that he administered purely to tell the users of his system that they should pick a stronger password. 13:19.050 --> 13:30.670 Thankfully, later, the felony was, charges were reversed after a few years, but not so good for Randall Schwartz's career in the beginning. 13:30.670 --> 13:34.130 And of course, we know now, with Have I Been Honed? 13:34.210 --> 13:43.690 and lots of different things, figuring out if people are reusing passwords or weak passwords is critical. 13:44.730 --> 13:57.070 Satan was a tool created by Dan Farmer and Weetzie Venema a few years after they wrote their paper, basically automating the techniques that they said. 13:57.070 --> 13:59.490 So let's try all those vulnerabilities. 13:59.490 --> 14:02.150 Let's target all those misconfigurations. 14:02.150 --> 14:05.690 Let's automate the process of finding these problems on your network. 14:05.690 --> 14:06.890 Guess what? 14:06.890 --> 14:11.710 Dan Farmer got fired from his job at SGI for releasing this tool. 14:11.710 --> 14:22.010 He actually got fired for writing a tool, which is now a multi-billion dollar industry from the likes of, you know, Rapid7 and Qualys and Tenable. 14:22.110 --> 14:28.890 Dan got fired for pioneering the idea of network scanning for vulnerabilities. 14:28.970 --> 14:37.530 A little bit of trivia there, that logo on the right is the logo of Satan. 14:37.830 --> 14:42.970 And it was actually sketched by Neil Gaiman, the author of Sandman. 14:42.970 --> 14:44.970 So Dan was friends with him. 14:45.030 --> 14:52.030 And then the final tool I wanted to mention was Netcat by Hobbit, came out in 96, really as this network Swiss army knife. 14:52.030 --> 14:54.370 I'm sure everyone has used Netcat. 14:55.630 --> 15:01.960 Didn't do anything except set up connections and send data to those connections. 15:02.170 --> 15:13.910 I ported it to Windows and it actually turned out that that started getting flagged as something that was malicious code by antivirus. 15:13.910 --> 15:21.570 So if you actually wanted to use that to scan systems and test systems, you had to make sure that you didn't run a file of antivirus. 15:21.570 --> 15:26.680 So there's a lot of misunderstandings in the early days. 15:27.400 --> 15:43.380 And hackers created the first real true information sources about bugs in software, vulnerabilities, bug track with its full disclosure policy, famously went around what cert was trying to do. 15:43.380 --> 15:46.100 It was a place where people could publish information. 15:46.100 --> 15:52.680 If vendors weren't listening to you, you could just publish it publicly. 15:52.680 --> 15:56.580 And it was a place where like-minded security people could find that. 15:56.760 --> 15:59.860 Really radical in the beginning years. 15:59.860 --> 16:07.420 It was actually created in 1993 by Scott Chason, someone who, one of the founders of ComSec. 16:07.420 --> 16:14.040 So I think we have a lot to thank Scott Chason for, for pioneering and pushing the limits. 16:14.600 --> 16:26.380 He was also a, one of the early editors of FRAC, along with Chris Goggins, was one of the early editors of FRAC, which, you know, started in the late 80s and still goes today. 16:26.380 --> 16:28.700 Very popular in the mid 90s. 16:28.700 --> 16:32.860 Issues coming out on a monthly basis, all kinds of exploits and tools. 16:32.860 --> 16:37.360 And of course, we all know about DEF CON as a place where people can gather and give presentations. 16:37.360 --> 16:40.640 And that's, that's where we are here today. 16:40.660 --> 16:47.340 The first computer security presentations about sort of real security were created by hackers. 16:47.760 --> 17:01.180 And the other big change I think we saw with hackers entering the realm here of computer security was they made computer security a participatory sport. 17:01.180 --> 17:11.800 Capture the flags became a way to learn, learn by doing, learn by training with your adversaries, learn from your adversaries and make it fun. 17:11.800 --> 17:12.500 Right? 17:13.700 --> 17:18.280 Up until then, security was sort of set it and forget it. 17:18.280 --> 17:28.020 You know, maybe there was an audit by a, an audit and accounting firm to make sure you had, you know, passwords turned on and you had logging and all that. 17:28.020 --> 17:29.240 But it was very static. 17:29.240 --> 17:32.700 It was very set it and forget it and wait for the attackers to come. 17:32.700 --> 17:47.720 Where the hacking community really birthed this notion of the pen test and the red teaming and adversarial, the adverse, bringing in the adversarial nature for, for securing systems. 17:47.940 --> 17:52.740 And we know that that's made a huge, huge difference. 17:54.740 --> 17:58.340 So I was a member of the loft starting in 93. 17:58.640 --> 18:03.480 And, you know, four or five years later, we said, hey, you know, this is all fun. 18:03.480 --> 18:07.680 We're releasing things and that, but, you know, maybe this could be a business . 18:07.900 --> 18:10.060 Maybe we could actually do consulting. 18:10.060 --> 18:11.700 Maybe we could sell software. 18:11.700 --> 18:14.520 And actually in 97, we started selling loft crack. 18:14.640 --> 18:18.760 And we thought about, you know, maybe this could be a full time gig. 18:18.800 --> 18:21.940 So let's try, let's try consulting. 18:21.940 --> 18:24.760 And we knew about CommSec back in 91. 18:25.180 --> 18:34.680 And they, we knew that, you know, the loft was a known hacker group and we used our hacker names, but you know, maybe, maybe, maybe times have changed. 18:34.680 --> 18:36.740 Maybe we could have a go at this. 18:37.180 --> 18:39.920 And so we tried our hands at consulting. 18:39.920 --> 18:46.260 And one of the ways we did this was we found a local consulting company in the Boston area. 18:46.480 --> 18:53.700 And we talked to them and we said, you know, maybe you should start a consulting business. 18:53.880 --> 19:02.340 And the loft could, you know, be your security consulting business unit. 19:02.340 --> 19:08.260 And so we started talking to them about coming on as employees. 19:08.640 --> 19:18.880 And we said, there's no better way for us to demonstrate what our capabilities are than to try to hack, try to hack your company, right? 19:18.880 --> 19:25.300 Let's do a full-on penetration test of your company. 19:25.600 --> 19:28.840 So we talked them into letting us do this. 19:28.840 --> 19:36.560 We did it pro bono, you know, because we were trying to explain to them the value we had. 19:37.320 --> 19:39.000 So we did that. 19:39.000 --> 19:42.860 And we were actually negotiating with them at the time, right? 19:42.860 --> 19:47.320 We were negotiating with them saying, you know, what would our salaries be? 19:47.320 --> 19:49.460 What would the business look like? 19:49.460 --> 19:57.940 You know, what would be the parameters around us coming to work at your company? 19:58.900 --> 20:17.840 And we just did, we did a no-holds-barred, full-spectrum, you know, voicemail, wireless, physical security, internet connection, you know, you name it, it was on the list. 20:17.840 --> 20:19.800 It was in scope. 20:19.800 --> 20:28.120 We actually didn't do any email social engineering or voicemail social engineering. 20:28.440 --> 20:38.700 But we did do things like physically penetrate in order to do things like, you know, see what was in the trash and things like that. 20:40.140 --> 20:45.840 So here's the cover page of our security audit. 20:45.840 --> 20:49.460 We went, we didn't go by the loft, we went by LHI Technologies. 20:49.460 --> 20:53.840 We took the loft-heavy industries and made it LHI Technologies. 20:54.360 --> 21:03.780 And because we were doing some consulting, selling some software at the time, and that was a part of the loft history where we were actually sort of becoming a company. 21:03.780 --> 21:10.280 And we did this between August 20th and September 8th, 1997. 21:10.320 --> 21:16.620 It was a completely black box test. 21:16.620 --> 21:22.820 And, you know, we use a combination of tools and network probing. 21:22.820 --> 21:25.480 I've blanked out the name of the company. 21:25.580 --> 21:34.100 It's been a few years, but just, you know, make sense to keep them confidential. 21:34.500 --> 21:38.320 Security in 1997 was a lot different than it is now. 21:39.540 --> 21:50.420 So just if I look, we look at the executive summary here, you can see that from the internet, we were pretty much able to totally own everything. 21:50.420 --> 22:05.720 All these critical corporate systems, Oracle databases, got corporate credit cards, voicemail, the network routers, the dial-up systems, personal email, their intranet site. 22:06.760 --> 22:09.460 So basically total ownage. 22:10.220 --> 22:16.140 And we did this without any kind of inside accomplices, no previous knowledge. 22:16.640 --> 22:19.600 Completely, completely black box. 22:19.600 --> 22:27.800 So, you know, I could do a whole presentation on the gory details of this, but I just wanted to highlight a couple things which I thought were interesting. 22:28.700 --> 22:32.520 Things you don't always see in a pen test. 22:32.740 --> 22:39.080 So one is, you know, one of the first ways we got in was through the web server. 22:39.920 --> 22:47.140 And if anyone had been doing hacking in 1996, you probably heard of the PHF vulnerability. 22:47.480 --> 22:55.660 It was a CGI bin that came pre-installed with Apache. 22:55.840 --> 22:58.720 And it had command injection, right? 22:58.720 --> 23:07.820 So you could just put a delimiter character in there and put your command. 23:08.500 --> 23:10.080 Pretty basic. 23:10.080 --> 23:15.500 But of course, you know, Apache should be running as its own user, right? 23:15.500 --> 23:18.220 It should be running as HTTPD, 23:21.320 --> 23:25.680 shouldn't allow you to compromise the system through this vulnerability, right? 23:25.680 --> 23:31.880 Maybe you could get... it's basically an information leakage if permissions are set correctly. 23:31.880 --> 23:43.220 But we were poking around and we actually saw that someone didn't set the permissions on HTTPD.conf file correctly. 23:43.220 --> 23:58.880 So the configuration file shouldn't be owned by the HTTPD process because, you know, then any code that executes from the web server could change the configuration and guess what part of the configuration of the server is? 23:58.880 --> 24:01.740 It's what user the server should run as. 24:01.860 --> 24:14.480 So we use this command injection to edit that file and change it so that the next time the server came up, the web server came up, it would be running as root. 24:15.740 --> 24:18.080 Nice little technique there. 24:18.140 --> 24:24.000 But then we did uptime on the system and we saw that the system had been running for over 100 days. 24:24.460 --> 24:27.240 And, you know, we tried DDoSing it. 24:27.680 --> 24:33.500 But, you know, we basically had to wait for someone to reboot the server. 24:33.720 --> 24:37.640 And so we didn't think we were going to go... we weren't going to get in this way. 24:37.640 --> 24:44.640 We started probing some other systems and actually found some other vulnerabilities and were able to get in. 24:44.640 --> 25:02.220 But a few days later, I was listening to the news and I actually saw that there was a manhole explosion in Cambridge where this company was located. 25:02.220 --> 25:12.140 And unfortunately, an employee of the power company actually died in the manhole explosion. 25:12.140 --> 25:16.840 But it downed power in Cambridge for five hours. 25:16.840 --> 25:26.500 And after this happened, I started started probing, you know, the system and started looking at their web server. 25:26.760 --> 25:30.460 And it was up after an hour, it was up after a couple hours. 25:30.460 --> 25:32.220 So they obviously had backup. 25:32.220 --> 25:41.700 But after about three hours, the system went down and they didn't have enough backup for this five-hour power outage. 25:41.840 --> 25:48.480 And when the power came back up, it rebooted and we were now doing command execution as root. 25:49.200 --> 25:58.800 So I just thought that was a little bit... I had never come into a situation like that before in a pen test, but you just never know how things are going to go and what's going to go your way. 26:00.020 --> 26:08.060 The other thing I thought was pretty interesting was we, you know, looked at the voicemail, the voicemail systems. 26:08.060 --> 26:14.180 And you can see there on the left, the extension, we have the username in the middle. 26:14.180 --> 26:16.460 I've grayed out some of them. 26:16.680 --> 26:18.980 And then the password on the right. 26:18.980 --> 26:23.680 And you can see the new employee voicemail box gets a 1234 password. 26:23.680 --> 26:29.040 And you can see that some people never changed it, like IT and facilities service line was 1234. 26:29.040 --> 26:32.380 The travel line was 1234. 26:33.520 --> 26:35.260 Directions was 1234. 26:35.260 --> 26:40.960 But there's some other accounts on there where the extension and the password are the same, 4069. 26:41.120 --> 26:46.380 And if you look down, there's 18629, where the extension was the same as the password. 26:46.940 --> 26:56.840 That actually happened to be the vice president that was negotiating with us at the time about joining the company. 26:56.840 --> 27:06.700 And we sort of listed out what we were expecting for salaries, benefits, how we wanted the jobs to work. 27:07.660 --> 27:17.160 And one of the things we really wanted was we wanted that step van, or I don't know if it was a bread truck or whatever, that was in sneakers. 27:17.160 --> 27:31.700 We wanted a sneakers van so that we could outfit it with electronic equipment to do wireless and surveillance and have the mobile hacking unit. 27:31.700 --> 27:33.120 It looked totally awesome. 27:33.120 --> 27:36.080 I think everyone who watched sneakers loved that. 27:36.320 --> 27:38.560 We put in that we wanted that. 27:38.560 --> 27:45.620 And we heard on this voicemail, so we captured a couple of voicemails as evidence that we were able to get in the account. 27:46.040 --> 27:52.480 And one of the voicemails was talking about those loft guys. 27:52.480 --> 27:56.220 And he said, these guys want an effing Winnebago. 27:56.740 --> 27:59.660 And they were not happy with us. 27:59.660 --> 28:01.900 They thought we were asking for the world. 28:02.540 --> 28:06.500 Sort of just didn't understand what we were going for. 28:07.040 --> 28:19.080 So you don't always have a situation where you're negotiating with your potential future employer while you're doing a no-holds-barred pen test with your get-out-of-jail-free card, right? 28:19.080 --> 28:23.640 So, again, another bit of an interesting situation. 28:24.840 --> 28:28.780 But, you know, we didn't end up joining there. 28:28.780 --> 28:39.740 And a couple years later, the loft ended up joining a startup company called At Stake, which just did information security consulting. 28:40.000 --> 28:44.120 And I'm sure some of you have heard of At Stake. 28:44.120 --> 28:54.820 This was an article from January 2000, where, you know, the way the news looked at it was using good hackers to battle bad hackers. 28:55.200 --> 29:00.020 If you have a murky past and doubt you could become a dot-com millionaire, think again. 29:01.320 --> 29:14.000 And I thought, you know, what a change from the 1991 with ComSec, really not being thought of as credible. 29:14.000 --> 29:25.300 So a lot of things had to happen over the 90s for really us to join At Stake and be perceived as a legitimate company. 29:25.300 --> 29:28.580 And so that's my story. 29:28.580 --> 29:30.900 That's my story from 2000. 29:30.920 --> 29:35.240 I hope that you enjoy this in 2020. 29:36.540 --> 29:40.880 And here's my contact information. 29:40.880 --> 29:43.420 There's this thing called Twitter is going to get invented, I think. 29:43.420 --> 29:47.160 And I'm going to found this company called Veracode in 2006. 29:47.240 --> 29:49.960 Just some of my future plans. 29:49.960 --> 29:51.000 So I hope you enjoyed it. 29:51.000 --> 29:56.020 I'm going to join on the Discord, which is another technology that's just going to be invented. 29:56.240 --> 29:58.820 And hopefully, we can chat. 29:59.100 --> 30:04.600 So bye-bye, everyone.