1
00:00:02,440 --> 00:00:13,880
Hi, y'all. I'm gonna move over here because I'm short as hell. Hi, everyone. Welcome, everyone, to Hackercourt. This is the last thing before closing. I swear we'll make it as entertaining as possible.

2
00:00:14,480 --> 00:00:24,560
But a little bit about me. My name is Winona. You can call me Win. I used to be a threat intel analyst, malware analyst, and now I'm in law school because I love suffering.

3
00:00:27,140 --> 00:00:42,680
Thank you. Thank you. But what I really care about is protecting hackers from liability. And so our goal here is basically to do two scenarios that are really close to something that, like, almost happened in real life a couple of times.

4
00:00:42,840 --> 00:00:49,820
And we're gonna go through the legal arguments, and we're gonna try and make this as technically and legally accurate as possible so that way we can play this scenario out.

5
00:00:50,300 --> 00:00:51,880
So here's how this is going to go.

6
00:00:52,360 --> 00:00:54,540
I have three apps.

7
00:00:54,560 --> 00:01:03,000
These are actually amazing lawyers who are going to give opening remarks, call witnesses who are gonna swear on our Bible, POC, or get the fuck out.

8
00:01:05,460 --> 00:01:09,280
And basically they're going to argue, like, a real court case.

9
00:01:09,660 --> 00:01:11,640
And, you know, in, like, 20 minutes.

10
00:01:11,780 --> 00:01:15,680
This is more like Judge Judy than, like, anything, like, real, like, so don't worry about it.

11
00:01:15,980 --> 00:01:19,180
So I'm gonna call the court to order, and we're gonna do this twice.

12
00:01:19,440 --> 00:01:21,320
Two, like, little mini trials.

13
00:01:22,280 --> 00:01:24,540
I want to thank a whole shitload of people.

14
00:01:24,560 --> 00:01:25,920
I know there's so many people on stage.

15
00:01:26,620 --> 00:01:32,280
But first off, I want to thank my two organizing partners, Emma Planky and Mari Dugas.

16
00:01:32,480 --> 00:01:36,440
They are amazing, badass women in cyber law.

17
00:01:38,420 --> 00:01:42,060
And then I also want to thank all of our participants.

18
00:01:42,620 --> 00:01:43,800
Many of them are lawyers.

19
00:01:43,900 --> 00:01:44,920
All of them are hackers.

20
00:01:45,200 --> 00:01:49,420
And all of them also care about making sure that y'all stay the hell out of trouble.

21
00:01:49,740 --> 00:01:54,540
So the last people that I want to thank, though, are also the original lawyers.

22
00:01:54,540 --> 00:01:55,780
Founders of HackerCourt.

23
00:01:55,880 --> 00:01:59,300
So this actually was a thing at Black Hat from 2001 to 2010.

24
00:01:59,660 --> 00:02:00,800
Tech has changed.

25
00:02:00,920 --> 00:02:01,820
The law has changed.

26
00:02:02,380 --> 00:02:04,220
DEFCON and Black Hat have all changed.

27
00:02:04,480 --> 00:02:07,760
So we've decided to revive it, give a little fun twist to it.

28
00:02:07,880 --> 00:02:11,160
But thank you, Dan, Carol, Jonathan, for giving us your full support.

29
00:02:12,440 --> 00:02:12,920
Okay.

30
00:02:14,480 --> 00:02:16,640
So I'm gonna call this court to order, y'all.

31
00:02:19,260 --> 00:02:23,760
Our first case is United States versus John Doe Researcher.

32
00:02:25,600 --> 00:02:27,860
And we're gonna say John Doe for a reason.

33
00:02:28,340 --> 00:02:34,640
So this individual, basically what they did was find a kill switch in a warmable ransomware variant.

34
00:02:34,920 --> 00:02:42,800
And then try to deploy that kill switch at scale, which bricked a couple of victim machines.

35
00:02:43,320 --> 00:02:46,300
Oh, my God!

36
00:02:48,280 --> 00:02:49,780
Y'all, get out of here.

37
00:02:56,840 --> 00:02:59,680
Oh, my God.

38
00:02:59,880 --> 00:03:01,960
I'm gonna cry on main stage, y'all.

39
00:03:02,940 --> 00:03:05,160
But I say John Doe for a reason.

40
00:03:05,240 --> 00:03:07,000
And I want a volunteer.

41
00:03:07,600 --> 00:03:09,760
Does anyone want to get up here on the stage?

42
00:03:10,040 --> 00:03:11,200
We can do shot the noob.

43
00:03:11,240 --> 00:03:12,080
You don't have to do shit.

44
00:03:12,240 --> 00:03:14,340
You just have to sit here and play our defendant.

45
00:03:15,540 --> 00:03:16,260
Let's do...

46
00:03:16,260 --> 00:03:16,560
All right, you.

47
00:03:16,680 --> 00:03:17,360
You're the one standing.

48
00:03:17,520 --> 00:03:17,880
Yeah, yeah, yeah.

49
00:03:17,880 --> 00:03:18,280
Come on, come on.

50
00:03:18,320 --> 00:03:18,440
Sit.

51
00:03:19,620 --> 00:03:20,600
Give him a hand, folks.

52
00:03:26,000 --> 00:03:26,600
Yeah.

53
00:03:26,960 --> 00:03:27,560
Please.

54
00:03:27,760 --> 00:03:29,440
Here's a participatory gift.

55
00:03:29,680 --> 00:03:30,280
Look at you.

56
00:03:30,280 --> 00:03:32,080
This is an actual speaker ops badge.

57
00:03:32,660 --> 00:03:33,520
Thank you.

58
00:03:35,340 --> 00:03:36,100
That's it.

59
00:03:40,260 --> 00:03:41,400
Oh, shit.

60
00:03:41,580 --> 00:03:42,380
That's cute.

61
00:03:42,440 --> 00:03:42,720
I mean...

62
00:03:42,720 --> 00:03:43,760
Great.

63
00:03:44,160 --> 00:03:44,680
All right.

64
00:03:44,760 --> 00:03:45,820
So what's your name?

65
00:03:46,640 --> 00:03:47,460
Jamba Juice.

66
00:03:47,760 --> 00:03:48,460
Jamba Juice.

67
00:03:48,580 --> 00:03:48,900
Great.

68
00:03:49,320 --> 00:03:49,940
All right.

69
00:03:50,020 --> 00:03:50,840
All right.

70
00:03:51,500 --> 00:03:52,420
Shot, man.

71
00:03:53,480 --> 00:03:54,080
Please.

72
00:03:54,220 --> 00:03:54,520
All right.

73
00:04:00,140 --> 00:04:06,040
So in the case where the government is accusing you of committing a egregious hacker computer

74
00:04:06,040 --> 00:04:07,500
crime, how do you plead?

75
00:04:07,620 --> 00:04:08,360
Guilty or not guilty?

76
00:04:09,520 --> 00:04:10,900
You want to say not guilty?

77
00:04:11,120 --> 00:04:11,200
Oh.

78
00:04:11,260 --> 00:04:11,620
Yeah.

79
00:04:12,100 --> 00:04:13,160
Not guilty.

80
00:04:13,560 --> 00:04:14,340
Thank you, Jamba Juice.

81
00:04:14,660 --> 00:04:15,400
All right.

82
00:04:16,360 --> 00:04:19,600
I want to introduce our two lawyers today.

83
00:04:19,680 --> 00:04:21,320
We have, first off, our prosecution.

84
00:04:22,300 --> 00:04:23,340
Harley Geiger.

85
00:04:23,340 --> 00:04:23,860
Hey.

86
00:04:24,100 --> 00:04:24,600
Don't boo.

87
00:04:24,880 --> 00:04:26,200
This is all just a simulation.

88
00:04:28,340 --> 00:04:28,940
Hey.

89
00:04:29,340 --> 00:04:29,720
Woo!

90
00:04:30,640 --> 00:04:31,240
Hey.

91
00:04:33,340 --> 00:04:38,060
Harley Geiger is actually a cyber and data protection lawyer at Venable and formerly

92
00:04:38,060 --> 00:04:41,380
an in-house attorney and senior director at fucking Rapid7, y'all.

93
00:04:41,580 --> 00:04:42,920
So please give him a hand.

94
00:04:48,020 --> 00:04:49,340
Our defense lawyer.

95
00:04:49,580 --> 00:04:50,540
Just as impressive.

96
00:04:51,080 --> 00:04:52,640
We have Kurt Opsal.

97
00:04:52,640 --> 00:04:58,000
Associate General Counsel for Cybersecurity and Civil Liberties Policies for the Filecoin

98
00:04:58,000 --> 00:05:03,000
Foundation and he volunteers as a special counsel for EFF and the Coders Rights Project.

99
00:05:03,340 --> 00:05:07,680
And he's been working to counsel and defend security hackers since DEFCON 13.

100
00:05:08,080 --> 00:05:09,100
So please give him a hand.

101
00:05:13,820 --> 00:05:14,420
Okay.

102
00:05:16,140 --> 00:05:17,440
Two final things.

103
00:05:17,540 --> 00:05:19,740
Very, very serious, though, before we get started.

104
00:05:20,080 --> 00:05:22,340
The first is we're not your lawyers.

105
00:05:22,340 --> 00:05:23,180
We are just lawyers.

106
00:05:23,280 --> 00:05:24,920
So please, this is not legal advice.

107
00:05:26,520 --> 00:05:28,800
And then the second is we are working off scripts.

108
00:05:29,000 --> 00:05:30,360
We're hackers, not actors.

109
00:05:30,560 --> 00:05:34,140
And you know, I see some hungover faces in the audience, too.

110
00:05:34,220 --> 00:05:35,880
So cannot confirm or deny.

111
00:05:37,000 --> 00:05:38,200
But can relate.

112
00:05:38,780 --> 00:05:39,260
Great.

113
00:05:40,040 --> 00:05:40,680
All right.

114
00:05:41,560 --> 00:05:42,040
Prosecution.

115
00:05:42,440 --> 00:05:44,020
Please begin with your opening statements.

116
00:05:44,700 --> 00:05:45,440
All right.

117
00:05:49,500 --> 00:05:51,160
Good afternoon, DEFCON jury.

118
00:05:51,840 --> 00:05:52,320
Good afternoon.

119
00:05:52,340 --> 00:06:05,140
We are here today because in August of 2023, Mr. Jamba Juice intentionally transmitted

120
00:06:05,140 --> 00:06:10,700
a program over the Internet that damaged a large number of businesses, including a hospital.

121
00:06:11,540 --> 00:06:17,240
Because of Mr. Juice's actions, the Nevada branch of the St. Grace of the Unbothered

122
00:06:17,240 --> 00:06:20,860
hospital was knocked offline for three days.

123
00:06:21,160 --> 00:06:22,040
All right.

124
00:06:22,340 --> 00:06:25,520
Well, Mr. Juice, who works in health care, knows that a hospital without systems for

125
00:06:25,520 --> 00:06:27,700
three days is an absolutely catastrophic event.

126
00:06:28,300 --> 00:06:32,860
And in fact, St. Grace had to reroute patients to hospitals on the other side of town.

127
00:06:33,340 --> 00:06:38,460
So the fact that no one was killed in this incident is a stroke of luck and a testament

128
00:06:38,460 --> 00:06:40,280
to the great skill of our medical professionals.

129
00:06:40,540 --> 00:06:46,020
But nonetheless, the patient care of people who are sick and injured and suffering, that

130
00:06:46,020 --> 00:06:49,300
patient care was delayed as a direct result of Mr. Juice's actions.

131
00:06:49,860 --> 00:06:51,660
So here is what Mr. Juice did.

132
00:06:52,340 --> 00:06:58,380
As we all know, earlier this year, an international criminal organization released the ego worm

133
00:06:58,380 --> 00:06:59,540
across the world.

134
00:06:59,740 --> 00:07:01,600
And this created a global security incident.

135
00:07:01,980 --> 00:07:06,780
Wherever the ego worm went, it exploited a vulnerability to insert ransomware into the

136
00:07:06,780 --> 00:07:07,380
host system.

137
00:07:07,560 --> 00:07:11,320
And as a worm, it spread from network to network at breakneck speed.

138
00:07:11,660 --> 00:07:15,900
And so thousands of organizations were in the midst of responding to this incident.

139
00:07:16,020 --> 00:07:17,280
They were working with law enforcement.

140
00:07:17,420 --> 00:07:19,260
They'd activated their IR plans.

141
00:07:19,600 --> 00:07:20,680
They were scrambling.

142
00:07:20,680 --> 00:07:23,780
The last thing that anyone needed was another loose cannon.

143
00:07:24,080 --> 00:07:31,140
And yet, Mr. Juice independently created a program in his home lab and released it upon

144
00:07:31,140 --> 00:07:31,620
the world.

145
00:07:32,140 --> 00:07:35,900
Mr. Juice's program was intended to be a patch.

146
00:07:36,080 --> 00:07:41,560
And this patch exploited the same vulnerability that the criminal organization used to propagate

147
00:07:41,560 --> 00:07:42,380
the ego worm.

148
00:07:42,580 --> 00:07:45,300
And the patch itself acted like a worm.

149
00:07:45,500 --> 00:07:50,660
And so Mr. Juice designed this patch to forcibly apply itself to every computer within the

150
00:07:50,680 --> 00:07:51,880
internet connection within reach.

151
00:07:52,100 --> 00:07:59,180
And so Mr. Juice's patch spread indiscriminately, as it was designed to do, impacting everything

152
00:07:59,180 --> 00:08:02,920
from manufacturing plants to hospitals like St. Grace.

153
00:08:03,560 --> 00:08:05,900
Yet the patch was also seriously flawed.

154
00:08:06,140 --> 00:08:11,520
It got out of control and caused some systems to crash, including St. Grace's hospital systems.

155
00:08:11,920 --> 00:08:18,580
So we will hear from the defense that Mr. Juice did not intend for this to happen, that

156
00:08:18,580 --> 00:08:19,880
Mr. Juice was trying to help.

157
00:08:19,960 --> 00:08:20,660
And indeed, there is no doubt about that.

158
00:08:20,680 --> 00:08:25,400
There is no evidence that Mr. Juice wanted to harm businesses or to disrupt hospital

159
00:08:25,400 --> 00:08:25,880
systems.

160
00:08:26,240 --> 00:08:32,140
However, Mr. Juice did intend for that program to go everywhere and to forcibly apply itself

161
00:08:32,520 --> 00:08:34,660
to every system that it came into contact with.

162
00:08:35,040 --> 00:08:36,440
What else did Mr. Juice want?

163
00:08:36,920 --> 00:08:37,200
Fame.

164
00:08:38,360 --> 00:08:39,720
Notoriety in hacker circles.

165
00:08:40,280 --> 00:08:41,300
How do we know this?

166
00:08:41,460 --> 00:08:45,360
Well, we will hear evidence that a mere two weeks after the incident, Mr. Juice was bragging

167
00:08:45,360 --> 00:08:46,860
about it on stage in Las Vegas.

168
00:08:50,680 --> 00:08:51,920
Could this have been avoided?

169
00:08:52,420 --> 00:08:56,940
Was there a way that Mr. Juice could have acted differently and avoided disrupting systems

170
00:08:56,940 --> 00:08:58,840
like St. Grace's hospital systems?

171
00:08:59,060 --> 00:08:59,380
Probably.

172
00:08:59,780 --> 00:09:04,920
But the evidence also shows that Mr. Juice made no effort to coordinate with the vendor,

173
00:09:05,080 --> 00:09:08,940
the manufacturer of the operating system, made no effort to coordinate with law enforcement

174
00:09:08,940 --> 00:09:12,280
or with anybody who was actively trying to defend against this attack.

175
00:09:12,600 --> 00:09:13,180
Why not?

176
00:09:13,720 --> 00:09:18,740
Because Mr. Juice was chasing clout and wanted glory for themselves, and that kind of selfish,

177
00:09:19,440 --> 00:09:20,660
recklessness puts everybody on the same page.

178
00:09:20,680 --> 00:09:21,120
It puts everybody at risk.

179
00:09:21,180 --> 00:09:22,860
It puts the entire infosec community at risk.

180
00:09:22,960 --> 00:09:25,600
Not to mention the people who are on the other end of those hospital systems.

181
00:09:26,080 --> 00:09:31,100
And that is why we have a responsibility to bring this case against Mr. Juice.

182
00:09:31,400 --> 00:09:37,640
Not for trying to help, but by forcibly applying that patch to every computer within reach,

183
00:09:38,000 --> 00:09:43,840
Mr. Juice's program impaired the integrity and the availability of systems without authorization

184
00:09:43,840 --> 00:09:44,800
causing harm.

185
00:09:45,280 --> 00:09:50,560
So accordingly, we charged Mr. Juice with one count under the Computer Fraud and Abuse Act.

186
00:09:52,060 --> 00:09:57,160
1030A5A, of knowingly causing the transmission of a program, and as a result, intentionally

187
00:09:57,160 --> 00:10:02,940
causing damage without authorization, as well as 1030A5B, intentionally accessing a computer

188
00:10:02,940 --> 00:10:06,980
without authorization and recklessly causing damage. Thank you very much.

189
00:10:11,120 --> 00:10:16,200
Thank you, Paul. Thank you, Prosecution. Yeah, all right. Defense Counsel?

190
00:10:16,200 --> 00:10:22,300
Thank you, Your Honor, and thank you, members of the jury. Good afternoon. I would like to start

191
00:10:22,300 --> 00:10:29,420
by reminding you that it is not a crime to be a good Samaritan. In fact, Mr. Juice is a hero.

192
00:10:29,980 --> 00:10:35,220
The eager worm was a threat to our national security and was holding countless businesses

193
00:10:35,220 --> 00:10:40,240
hostage. Who knows how many days they would have gone by before this hospital was next.

194
00:10:41,080 --> 00:10:44,400
My client does not deny that they didn't coordinate with law enforcement,

195
00:10:44,600 --> 00:10:45,700
but law enforcement,

196
00:10:46,200 --> 00:10:52,940
was too slow to react in the face of the destruction unfolding across the world from this worm.

197
00:10:53,180 --> 00:10:59,540
From this worm, not from my client. Coordination would have lost invaluable time essential

198
00:10:59,540 --> 00:11:06,140
to addressing this crisis. Yes, there was some damage. However, was it intentional?

199
00:11:06,420 --> 00:11:14,280
No. Mr. Juice was trying to fix this vulnerability, not brick computers. Was it reckless? No.

200
00:11:14,500 --> 00:11:16,180
To be reckless is to be...

201
00:11:16,200 --> 00:11:21,040
consciously disregard a substantial and unjustified risk. How could that...

202
00:11:21,470 --> 00:11:24,840
How could that have happened? How could a reasonable person have foreseen the patch

203
00:11:24,840 --> 00:11:29,540
would spread to this one hospital which happened to be running Windows XP?

204
00:11:30,960 --> 00:11:36,100
And that that patch would cause a blue screen of death on the particular operating scene?

205
00:11:36,180 --> 00:11:40,700
Even if this were a substantial risk, Mr. Juice wasn't aware of this.

206
00:11:40,880 --> 00:11:44,880
And that can't possibly be characterized as intentionally disregarding it.

207
00:11:48,960 --> 00:11:54,740
Finally, was there any access to begin with? Mr. Juice didn't know which computers the patch would propagate.

208
00:11:55,380 --> 00:11:59,660
How could Mr. Juice have knowingly and intentionally accessed any of them?

209
00:12:00,080 --> 00:12:05,260
Moreover, Mr. Juice did not access any of the computers. The worm did. The ego worm.

210
00:12:06,520 --> 00:12:09,820
They lost control of it after it was deployed. That's how worms operate.

211
00:12:10,140 --> 00:12:15,800
The affected computers did not do so much as ping back to the client. At no point,

212
00:12:15,800 --> 00:12:19,480
Was any of the information on these machines available to Mr. Juice?

213
00:12:19,780 --> 00:12:21,040
No access.

214
00:12:22,120 --> 00:12:25,860
Also, it's important to remember that nobody died.

215
00:12:26,580 --> 00:12:28,100
Were hospital systems down?

216
00:12:28,240 --> 00:12:28,680
Yes.

217
00:12:29,340 --> 00:12:34,100
Is my client worried about the general welfare of all patients and how they had to be rerouted?

218
00:12:34,160 --> 00:12:34,800
Of course.

219
00:12:36,500 --> 00:12:40,800
However, was the hospital able to get back up and running?

220
00:12:41,200 --> 00:12:42,120
Also, yes.

221
00:12:42,120 --> 00:12:46,400
So remember, intentional, reckless access.

222
00:12:46,720 --> 00:12:49,260
These are the three things the prosecution has to prove,

223
00:12:49,460 --> 00:12:51,980
and today you will find, members of the jury,

224
00:12:52,260 --> 00:12:55,840
that they will not be able to prove this beyond a reasonable doubt.

225
00:12:56,180 --> 00:12:56,840
Thank you.

226
00:13:01,200 --> 00:13:03,820
All right, all right, all right. Come on, come on.

227
00:13:04,940 --> 00:13:06,160
Thank you, Defense Counsel.

228
00:13:06,400 --> 00:13:08,120
Prosecution, please call up your first witness.

229
00:13:10,060 --> 00:13:11,940
I call Ian.

230
00:13:12,120 --> 00:13:15,280
Ian R., expert researcher, to the stand, please.

231
00:13:16,660 --> 00:13:18,060
All right, Ian, please take a seat.

232
00:13:22,360 --> 00:13:25,960
The man in the Adidas tracksuit and bucket hat, expert, please.

233
00:13:26,520 --> 00:13:30,060
Do you swear on this POC or GTFO to tell the truth, nothing but the whole truth?

234
00:13:31,800 --> 00:13:32,160
Yeah.

235
00:13:33,860 --> 00:13:34,960
Please have a seat, Mr. R.

236
00:13:40,820 --> 00:13:41,180
Okay.

237
00:13:41,420 --> 00:13:41,620
Okay.

238
00:13:41,620 --> 00:13:44,140
Can you state your name and occupation, please, Mr. R.?

239
00:13:44,140 --> 00:13:44,580
Sure.

240
00:13:45,060 --> 00:13:46,160
My name is Ian.

241
00:13:46,300 --> 00:13:50,800
I am a security researcher and organizer of the Pony Awards.

242
00:13:51,240 --> 00:13:51,760
Okay.

243
00:13:51,800 --> 00:13:56,080
And can you tell me what this slide is, Mr. R.?

244
00:13:56,080 --> 00:14:02,360
That is a screen cap of the CVE page for the Spen Ego Vulnerability.

245
00:14:02,560 --> 00:14:02,940
Okay.

246
00:14:02,980 --> 00:14:09,680
And can you tell me when was the first time that you know that this Spen Ego Vulnerability was used in the wild?

247
00:14:09,980 --> 00:14:11,480
It was used by a criminal group.

248
00:14:11,620 --> 00:14:15,040
It was used in August of 2023 to spread warmable ransomware.

249
00:14:15,440 --> 00:14:20,460
So the vulnerability was used by cybercriminals to spread ransomware.

250
00:14:20,680 --> 00:14:26,640
Was this the famous ego worm that threatened multiple industries and extorted hundreds of U.S. businesses?

251
00:14:27,040 --> 00:14:30,040
Yes, the ransomware in question was the ego worm.

252
00:14:30,340 --> 00:14:30,820
Okay.

253
00:14:30,900 --> 00:14:38,480
And so the vulnerability that you see here, would you characterize this as very dangerous to exploit, Mr. R.?

254
00:14:38,480 --> 00:14:38,940
Objection.

255
00:14:38,940 --> 00:14:39,260
Leading.

256
00:14:39,760 --> 00:14:40,440
Overruled.

257
00:14:40,440 --> 00:14:40,780
It's relevant.

258
00:14:41,000 --> 00:14:41,600
Ian, please.

259
00:14:41,620 --> 00:14:41,840
Please answer.

260
00:14:42,520 --> 00:14:43,320
It's bad.

261
00:14:43,440 --> 00:14:43,760
Yeah.

262
00:14:46,180 --> 00:14:48,900
So the vulnerability is very bad.

263
00:14:49,340 --> 00:14:56,080
When was the second time that this very bad, very dangerous Spen Ego Vulnerability was used in the wild?

264
00:14:56,600 --> 00:15:05,900
It was used by a researcher a bit afterwards to install a kill switch in vulnerable systems so the ego worm would no longer work.

265
00:15:06,200 --> 00:15:07,000
Thank you.

266
00:15:07,140 --> 00:15:11,140
But just to be clear, does that mean that the researcher exploited?

267
00:15:11,140 --> 00:15:21,640
Yes, he exploited the same vulnerability that you just described as very dangerous, very bad, as the criminal group, so that the researcher could then install their own software into machines that the criminal group was already extorting.

268
00:15:21,760 --> 00:15:22,820
Is that what you're saying, sir?

269
00:15:23,780 --> 00:15:28,320
Yes, but the researcher's software was to stop the criminal's ransomware worm.

270
00:15:28,720 --> 00:15:30,340
That's what a kill switch is.

271
00:15:30,800 --> 00:15:35,960
And this kill switch software from the researcher, is it designed to spread on its own?

272
00:15:36,300 --> 00:15:37,820
Yes, it's a wormable patch.

273
00:15:38,220 --> 00:15:39,240
What does that mean, sir?

274
00:15:39,240 --> 00:15:44,420
That it can spread from system to system without the control of the software developer.

275
00:15:44,900 --> 00:15:48,320
Okay, so it spreads from system to system without the control of the developer.

276
00:15:48,500 --> 00:15:53,120
And so for this to work, the researcher had to exploit that Spen Ego Vulnerability.

277
00:15:53,360 --> 00:15:59,560
So the exploit that the research used, is it stable on every kind of machine, Mr. R?

278
00:15:59,840 --> 00:16:00,440
No.

279
00:16:01,460 --> 00:16:08,580
The particular exploit was stable for every version of Windows back to Windows 7, but not for anything older than that.

280
00:16:09,240 --> 00:16:14,620
So the researcher was using this very dangerous vulnerability, and it's not stable on every type of machine.

281
00:16:15,060 --> 00:16:19,480
When we say that an exploit is not stable on this older type of machine, what happens?

282
00:16:20,180 --> 00:16:25,700
If the exploit is unstable for older versions of Windows and tries to run on a Windows XP machine,

283
00:16:25,940 --> 00:16:29,820
the exploit can effectively malfunction and cause a blue screen of death.

284
00:16:30,060 --> 00:16:33,840
A blue screen of death, and is this an example of a blue screen of death?

285
00:16:34,680 --> 00:16:35,800
Unfortunately, yeah.

286
00:16:37,640 --> 00:16:39,200
And when you're machined...

287
00:16:39,240 --> 00:16:41,320
Injection, that's not Windows XP.

288
00:16:49,180 --> 00:16:50,180
That's a fuck up.

289
00:16:50,340 --> 00:16:58,120
That's a mess up on the judge's part, whoops, but yes, we will be excluding this from evidence, apologies, prosecution.

290
00:17:03,040 --> 00:17:08,220
Mr. R, when a computer encounters this dread and eldritch screen,

291
00:17:08,480 --> 00:17:09,220
what happens?

292
00:17:09,240 --> 00:17:10,380
What happens to the computer?

293
00:17:10,920 --> 00:17:12,300
Uh, it, it breaks.

294
00:17:14,440 --> 00:17:18,080
Okay, so, so the machine can't run, people can't use it when, when this happens.

295
00:17:18,260 --> 00:17:18,480
Excellent.

296
00:17:18,540 --> 00:17:20,120
I want to just make sure that we have this correctly.

297
00:17:20,640 --> 00:17:26,980
There is a vulnerability in the operating system that a ransomware group was using to spread the ego worm,

298
00:17:27,160 --> 00:17:32,020
and that same vulnerability can be used to install a kill switch that stops the ego worm.

299
00:17:32,280 --> 00:17:38,480
However, if it's an older version of the operating system, the kill switch will shut down the machine,

300
00:17:38,480 --> 00:17:41,240
make it inoperable, is all that factually correct?

301
00:17:41,700 --> 00:17:42,260
Uh, yes.

302
00:17:42,660 --> 00:17:44,700
Okay, thank you, your honor, I have no further questions.

303
00:17:45,140 --> 00:17:46,100
Wonderful, defense counsel?

304
00:17:47,740 --> 00:17:52,420
Mr. R, can you describe how the ego worm ransomware worked?

305
00:17:52,840 --> 00:17:59,740
Yes, um, the ego worm has three parts, uh, the exploit, the loader, and the post exploitation payload.

306
00:18:00,000 --> 00:18:07,960
Uh, the exploit code exploits the span ego RCE vulnerability, allowing the attacker to run arbitrary code on a vulnerable machine,

307
00:18:07,960 --> 00:18:14,180
the loader then runs certain checks against the environment, making sure that the machine is an okay target,

308
00:18:14,340 --> 00:18:20,420
in this case, that included seeing if a certain registry key is set, uh, which would let it know that it had already hit that box before.

309
00:18:21,040 --> 00:18:29,260
Uh, if the registry key isn't already set, then the loader would then execute the payload, and that would, uh, encrypt all the files on the box,

310
00:18:29,340 --> 00:18:34,060
and then go hunting throughout the network in order to find other vulnerable machines to propagate to.

311
00:18:34,480 --> 00:18:37,940
Uh, all these stages are packaged together, so that the worm can't run.

312
00:18:37,960 --> 00:18:41,600
The worm could spread without having to rely on connecting back to a C2.

313
00:18:42,380 --> 00:18:45,500
Thank you. And how did Mr. Juice's patch work?

314
00:18:46,020 --> 00:18:51,960
Uh, the patch worked by just setting the registry key that the ego worm looks for prior to exploitation.

315
00:18:52,860 --> 00:18:58,820
Uh, the worm would think that it had already infected the patch machine, and it wouldn't exploit or spread from there.

316
00:18:59,580 --> 00:19:06,880
So you refer to both the ego worm and Mr. Juice's patch as being worms. What does it mean to be a worm?

317
00:19:07,100 --> 00:19:07,820
Uh, it...

318
00:19:11,120 --> 00:19:18,680
It means the program is self-propagating. Uh, it spreads on its own without the operator needing to do anything to keep it going.

319
00:19:19,060 --> 00:19:24,000
And these worms, is it correct to say they are spreading themselves using the same vulnerability?

320
00:19:24,440 --> 00:19:25,100
Uh, yup.

321
00:19:27,860 --> 00:19:36,660
So, in order for the systems at St. Grace the Unbothered to be patched by my client's program, they would also have to be vulnerable to the ego worm, correct?

322
00:19:36,780 --> 00:19:37,480
Uh, yes.

323
00:19:38,460 --> 00:19:42,780
Why did my client's patch reach the systems at St. Grace before the ego worm did?

324
00:19:43,200 --> 00:19:52,080
Um, there's nothing in either program that looked for particular targets beyond just being exploitable by SpendEgo. Uh, it was just luck.

325
00:19:53,440 --> 00:20:00,640
Luck. That's interesting. And what would have happened if the ego worm hit St. Grace before Mr. Juice's patch?

326
00:20:01,240 --> 00:20:02,540
Objection, Your Honor. That's irrelevant.

327
00:20:03,080 --> 00:20:05,360
Overruled. Um, please, uh, Ian, please respond.

328
00:20:05,820 --> 00:20:07,940
Uh, if the ego worm hit first...

329
00:20:07,940 --> 00:20:18,800
The hospital's data would have been stolen. Uh, the machines would have been locked and ransomed. Uh, many more would have been bricked for longer, and they would have had to pay the ransomware group in order to get the decryptor.

330
00:20:18,980 --> 00:20:23,820
And what happened to other companies' stolen data after being hit by the ego worm?

331
00:20:24,060 --> 00:20:30,460
Uh, those that didn't pay the ransom had their data leaked online, uh, available for anyone who knows how to look for it.

332
00:20:31,680 --> 00:20:33,100
So it sounds like my client...

333
00:20:34,040 --> 00:20:35,580
Sustained, you're right. Uh...

334
00:20:35,580 --> 00:20:37,540
That was literally my next line.

335
00:20:41,400 --> 00:20:47,520
Yes, sustained. Um, let's move this along, defense counsel, and thank you, prosecution and whoever that was.

336
00:20:49,220 --> 00:20:55,600
All right, all right. One final question, Mr. R. Have you analyzed my client's patching program?

337
00:20:55,940 --> 00:21:03,140
Would you say that Mr. Juice, in a technical sense, had access to any of the computer that it's read Mr. Juice had access?

338
00:21:03,900 --> 00:21:07,120
Uh, not really for most of them. They had access to the first box.

339
00:21:07,120 --> 00:21:11,100
Uh, they pointed it at when they kicked it off, but that was one of their own computers.

340
00:21:11,660 --> 00:21:19,520
After that, uh, didn't build any kind of telemetry into the program, so there wasn't any way that they could have known where it was spreading while it was spreading.

341
00:21:20,180 --> 00:21:21,300
That will be all. Thank you.

342
00:21:21,800 --> 00:21:23,580
Thank you, Mr. R. You may leave the witness box.

343
00:21:23,820 --> 00:21:25,380
Uh, defense counsel, please call up your witness.

344
00:21:28,000 --> 00:21:31,600
Thank you. I call Ian R., Pony Award organizer.

345
00:21:32,000 --> 00:21:33,500
Oh, Ian, that's actually you, though.

346
00:21:36,020 --> 00:21:36,420
Um...

347
00:21:37,120 --> 00:21:37,860
Great. Um...

348
00:21:37,860 --> 00:21:42,600
Oh, yeah, you're right. Yeah, okay.

349
00:21:42,840 --> 00:21:45,020
Uh, do you swear to tell the truth, the whole truth, nothing but the truth?

350
00:21:45,120 --> 00:21:46,280
Once again, yes.

351
00:21:46,540 --> 00:21:46,940
Okay, great.

352
00:21:49,480 --> 00:21:51,100
Mr. R., thank you for joining us today.

353
00:21:51,500 --> 00:21:54,040
Can you start off by telling me what a Pony Award is?

354
00:21:55,380 --> 00:21:55,740
Uh...

355
00:21:57,460 --> 00:22:01,960
It's a, it's a little statue of a horse that you get for being a good hacker.

356
00:22:03,220 --> 00:22:03,940
Well, uh...

357
00:22:03,940 --> 00:22:06,240
Sorry? Can, wait, say that again, please?

358
00:22:07,120 --> 00:22:10,300
It's a statue of a horse that you get for, uh, being a really good hacker.

359
00:22:10,580 --> 00:22:10,920
Okay.

360
00:22:12,440 --> 00:22:19,160
Is it true that on August 10th at approximately 6 p.m., my client received a Pony Award?

361
00:22:19,700 --> 00:22:20,220
Uh, yes.

362
00:22:20,500 --> 00:22:22,260
And what was the category?

363
00:22:22,980 --> 00:22:34,380
Uh, Epic Achievement. It's a catch-all category for work that pulls off something, uh, so truly epic that we couldn't have predicted it by creating an award category that would do it justice.

364
00:22:34,380 --> 00:22:38,260
And, and why did Mr. Juice receive this award?

365
00:22:39,220 --> 00:22:42,640
Uh, I don't know. He prevented a bunch of bad shit from going down.

366
00:22:42,940 --> 00:22:43,420
Um...

367
00:22:44,540 --> 00:22:48,560
The, the initial patch blew up on Twitter, and we needed to fit it somewhere.

368
00:22:48,760 --> 00:22:53,180
Uh, the hospital thing hadn't come out yet, so we didn't know that they had, uh, fucked up.

369
00:22:53,880 --> 00:22:54,920
No further questions.

370
00:22:56,300 --> 00:22:56,780
Prosecution?

371
00:22:59,660 --> 00:23:01,200
Mr., Mr. R., um...

372
00:23:01,680 --> 00:23:04,360
You had just said that you gave that award to Mr. Juice.

373
00:23:04,360 --> 00:23:11,260
Uh, and you didn't know that the hospital thing, uh, the hospital thing hadn't come out yet, and so we didn't know that they had fucked up.

374
00:23:11,500 --> 00:23:12,240
What, what...

375
00:23:13,120 --> 00:23:14,500
What did, what did you mean by that?

376
00:23:14,800 --> 00:23:16,680
Uh, they, they fucked up a hospital.

377
00:23:18,660 --> 00:23:19,740
It was very bad.

378
00:23:22,380 --> 00:23:33,800
So the same person that got the award had fucked up a hospital prior to you knowing about, uh, you know, prior, and you didn't know about this at the time that you gave them the, the award.

379
00:23:34,360 --> 00:23:41,240
If you had known about this incident ahead of awarding the ponies, would, would Mr. Juice still have gotten the Epic Achievement Award?

380
00:23:41,700 --> 00:23:42,580
Uh, no.

381
00:23:45,540 --> 00:23:46,000
So...

382
00:23:46,820 --> 00:23:48,000
Oh, don't boo!

383
00:23:51,180 --> 00:23:56,060
What would Mr. Juice have received instead of, of that award for fucking up a hospital?

384
00:23:56,200 --> 00:23:57,460
Probably an Epic Fail Award.

385
00:23:59,300 --> 00:24:01,300
And, and an Epic Fail Award is for what?

386
00:24:01,980 --> 00:24:04,260
Uh, for, uh, failing epically.

387
00:24:07,160 --> 00:24:14,740
So, Mr. R., uh, going, going back to the day of this, of the award ceremony, did, did, uh, Mr. Juice accept that award in person?

388
00:24:15,280 --> 00:24:15,660
Uh, yes.

389
00:24:16,360 --> 00:24:20,500
And did Mr. Juice make any remarks at the time accepting the award?

390
00:24:20,920 --> 00:24:23,180
Uh, he said he did it for the lulz.

391
00:24:24,620 --> 00:24:26,420
Sorry, can you repeat that please for the record?

392
00:24:28,560 --> 00:24:30,500
Uh, the lulz, your honor.

393
00:24:31,200 --> 00:24:34,340
And, and sir, what is, what is your interpretation of the lulz?

394
00:24:36,680 --> 00:24:37,940
Objection. That's speculative.

395
00:24:44,100 --> 00:24:46,460
Sustained. Prosecution, please rephrase.

396
00:24:46,740 --> 00:24:52,020
Okay. How would you characterize Mr. Juice's demeanor when he was accepting the award?

397
00:24:52,600 --> 00:24:56,220
Uh, very smug. Uh, like the whole thing was for laughs.

398
00:24:56,520 --> 00:24:59,220
Like the whole thing was for laughs. Thank you. No further questions.

399
00:24:59,760 --> 00:25:00,020
Alright.

400
00:25:03,180 --> 00:25:08,920
Your honor, I would like to put the defendant on the stand.

401
00:25:09,160 --> 00:25:12,980
Oh, Mr. Juice. Oh, well, please take the seat in the witness box.

402
00:25:13,480 --> 00:25:13,720
Alright.

403
00:25:15,900 --> 00:25:19,800
Alright. Do you swear on the POC or DTFO to say the whole truth, nothing but the truth?

404
00:25:20,760 --> 00:25:22,220
As he said, yes.

405
00:25:22,520 --> 00:25:22,900
Great.

406
00:25:23,300 --> 00:25:23,740
Yes.

407
00:25:28,660 --> 00:25:29,800
Uh, thank you.

408
00:25:29,820 --> 00:25:30,000
Thank you.

409
00:25:31,200 --> 00:25:36,860
You said in prior testimony, Mr. Juice, that you tested your patch on all the machines you had available.

410
00:25:37,320 --> 00:25:44,760
If you look at the slide here, uh, if you look at the slide here, you'll see your home lab's extensive list.

411
00:25:45,840 --> 00:25:50,000
Would you say that this was an extensive number of machines, even for a home lab?

412
00:25:51,400 --> 00:25:54,300
I mean, it looks a lot better than a home lab, let's be honest.

413
00:25:54,640 --> 00:25:55,700
Let me just start there.

414
00:25:55,940 --> 00:25:56,200
Yes.

415
00:25:56,200 --> 00:25:56,460
Okay.

416
00:25:56,460 --> 00:25:57,240
But yes.

417
00:25:57,440 --> 00:25:58,080
Very extensive.

418
00:25:58,280 --> 00:25:58,860
Very well done.

419
00:25:59,160 --> 00:26:00,460
Thank you, by the way.

420
00:26:01,240 --> 00:26:01,840
And, yeah.

421
00:26:02,380 --> 00:26:03,580
I think that answers your question.

422
00:26:04,060 --> 00:26:04,540
Thank you.

423
00:26:04,600 --> 00:26:04,900
Thank you.

424
00:26:04,960 --> 00:26:12,740
And do you also note that on there, there is a Windows XP machine still on here, the same operating machine as the hospital, Mr. Juice?

425
00:26:13,580 --> 00:26:19,020
Would you also say that it's impossible to test PSOR on every different variant of every different machine?

426
00:26:20,320 --> 00:26:24,540
Uh, you know, let me ask ChatGPT really quick, and I'll get back to you on that one.

427
00:26:24,660 --> 00:26:24,820
Alright.

428
00:26:24,820 --> 00:26:27,400
Before the defendant perjures himself, I'm going to say that was a yes.

429
00:26:28,780 --> 00:26:29,340
Wait, wait.

430
00:26:29,620 --> 00:26:30,620
No, no further questions.

431
00:26:31,000 --> 00:26:31,200
Great.

432
00:26:31,220 --> 00:26:32,040
Thank you, Mr. Juice.

433
00:26:32,520 --> 00:26:34,080
Uh, defendant, you may sit back down.

434
00:26:35,420 --> 00:26:36,400
Please give him a hand.

435
00:26:39,660 --> 00:26:43,960
Please give your closing final arguments, please, counsel, starting with prosecution.

436
00:26:47,500 --> 00:26:52,060
Hackers of the DEFCON jury, let's review the evidence that we've heard today.

437
00:26:52,060 --> 00:26:57,360
So, to carry a verdict against the defendant, there are certain elements that we have to prove.

438
00:26:57,680 --> 00:27:02,400
Uh, first, that Mr. Juice knowingly caused transmission of a program.

439
00:27:02,840 --> 00:27:07,240
Uh, we heard evidence that Mr. Juice knowingly transmitted the program, right?

440
00:27:07,400 --> 00:27:08,440
Uh, it was intentional.

441
00:27:08,560 --> 00:27:09,260
It's not an accident.

442
00:27:09,360 --> 00:27:11,980
I think that this is well, well accepted and uncontested.

443
00:27:12,160 --> 00:27:21,440
But second, that Mr. Juice intentionally or recklessly impaired the integrity and availability of systems without permission, right?

444
00:27:21,500 --> 00:27:22,040
Without authorization.

445
00:27:22,060 --> 00:27:22,180
Without authorization.

446
00:27:22,380 --> 00:27:37,060
We know that Mr. Juice created a program that was intentionally designed to spread to different computers rather indiscriminately and automatically and to access those computers and install itself on those computers without the permission of the computer owners.

447
00:27:37,560 --> 00:27:49,720
And when it comes to disruption, we know that, uh, by forcibly accessing and running code on these computers, Mr. Juice's program impaired the integrity and the availability of those systems, right?

448
00:27:49,800 --> 00:27:51,540
So, those are the elements that we have to prove.

449
00:27:52,060 --> 00:27:59,880
I understand very much that there may be an impulse to exonerate the defendant, uh, because of the defendant's good intentions in attempting to halt the ego worm.

450
00:28:00,040 --> 00:28:06,180
However, whether the defendant had good intentions is, is actually irrelevant for the elements that we just discussed.

451
00:28:06,540 --> 00:28:09,220
Uh, you can have good intentions and still break this law.

452
00:28:09,380 --> 00:28:12,640
The question is, did you intentionally submit the, uh, transmit the program?

453
00:28:12,860 --> 00:28:17,200
Would, was it intentionally going to disrupt the systems by forcibly applying itself?

454
00:28:17,400 --> 00:28:19,760
That was what the, the, the patch was designed to do.

455
00:28:20,040 --> 00:28:22,040
And were the defendants intentional?

456
00:28:22,040 --> 00:28:22,840
Were the defendants intentions really good?

457
00:28:23,120 --> 00:28:27,580
The evidence suggests that the defendant was actually chasing glory for his own personal gain.

458
00:28:27,840 --> 00:28:31,760
And that type of behavior puts the entire security community at risk.

459
00:28:31,880 --> 00:28:33,920
We lose trust if that is our reputation.

460
00:28:34,700 --> 00:28:39,540
Whether the defendant intended to take down the St. Grace Hospital computers is also irrelevant.

461
00:28:39,800 --> 00:28:51,760
The question is, did the defendant intend to impair the integrity and availability of the systems by forcibly installing unauthorized and untested software into the computers that don't belong to him?

462
00:28:51,760 --> 00:28:57,160
And if you believe that the answer to that is yes, then I humbly submit that that should lead to a verdict of guilty.

463
00:28:57,440 --> 00:28:58,080
Thank you.

464
00:28:58,140 --> 00:28:58,940
Thank you, prosecution.

465
00:28:59,320 --> 00:29:00,100
Defense counsel?

466
00:29:01,360 --> 00:29:02,260
Thank you, your honor.

467
00:29:02,660 --> 00:29:10,600
Members of the jury, who here does not aspire to use their infosec expertise to make the world suck a little bit less?

468
00:29:11,880 --> 00:29:21,340
The only thing, the only thing my client may be guilty of is an overzealous application of their elite hacks for talents in service of the world.

469
00:29:23,080 --> 00:29:27,860
The only thing Mr. Juice ever intended was to mitigate harm.

470
00:29:28,540 --> 00:29:37,840
Sure, that St. Grace systems were affected is an unfortunate and unforeseeable consequence of this attempt to save the world.

471
00:29:38,020 --> 00:29:42,060
But I remind you that no one has died as a result of this incident.

472
00:29:42,200 --> 00:29:47,100
And in fact, further harm by the Eagle World was mitigated.

473
00:29:47,460 --> 00:29:49,840
Is it fair to say that Mr. Juice was reckless?

474
00:29:50,100 --> 00:29:50,660
No.

475
00:29:51,760 --> 00:29:55,480
He made every attempt to test this patch given the resources he had available.

476
00:29:55,920 --> 00:30:01,720
Sure, given what we know now, Mr. Juice's choices may seem less favorable in retrospect.

477
00:30:02,240 --> 00:30:10,220
But with the information available at the time, can it really be said that he did this with a conscious disregard of the risks?

478
00:30:10,620 --> 00:30:13,420
When tested, the patch worked.

479
00:30:13,960 --> 00:30:20,560
And the long time that Mr. Juice spent testing, the further he knew the Eagle World would spread.

480
00:30:20,560 --> 00:30:23,620
My client did not act recklessly.

481
00:30:23,800 --> 00:30:30,720
He made a calculated, risk-informed choice during a time when there were no other good options.

482
00:30:31,780 --> 00:30:35,720
Mr. Juice does not deny that his code ran on St. Grace's computers.

483
00:30:36,580 --> 00:30:39,680
However, is it fair to say he accessed these computers?

484
00:30:39,960 --> 00:30:40,420
No.

485
00:30:40,660 --> 00:30:47,220
The prosecution would have you think that authoring code that runs on a computer is enough to say that you have access to it.

486
00:30:47,640 --> 00:30:48,460
I disagree.

487
00:30:49,000 --> 00:30:50,540
At what point would that happen?

488
00:30:50,540 --> 00:30:51,040
Will that argument end?

489
00:30:51,480 --> 00:31:01,180
Surely the contributors to open source projects whose code gets indirectly bundled into products cannot be said that they have access to every machine on which that project runs?

490
00:31:02,300 --> 00:31:05,400
I ask each of you to look into your hearts.

491
00:31:06,320 --> 00:31:13,080
Ask, when you look at Mr. Juice, do you see a clout-chasing criminal?

492
00:31:13,280 --> 00:31:18,240
Or do you see a reasonable person doing their best under enormous pressure

493
00:31:18,240 --> 00:31:22,820
and helping save everybody from this horrible ransomware attack?

494
00:31:24,260 --> 00:31:24,840
Thank you.

495
00:31:27,460 --> 00:31:30,100
Give our prosecution and defense a hand, folks.

496
00:31:31,680 --> 00:31:34,660
Okay, so here's how this is going to go, and it's going to go fast.

497
00:31:35,240 --> 00:31:36,800
Y'all are actually our jury.

498
00:31:37,680 --> 00:31:40,100
So, please, I promise this is a safe QR code.

499
00:31:40,200 --> 00:31:42,080
Ha, ha, ha, like putting a QR code on DEF CON, whatever.

500
00:31:42,320 --> 00:31:46,700
But I'm going to give y'all 60 seconds and give me a verdict.

501
00:31:46,760 --> 00:31:47,880
And I have a timer here.

502
00:31:47,880 --> 00:31:49,400
And we're going to figure this out.

503
00:31:49,480 --> 00:31:51,320
Is he guilty or innocent?

504
00:31:51,580 --> 00:31:55,140
Remember, this has to be beyond a reasonable doubt.

505
00:31:55,400 --> 00:32:00,780
So, if there is even a little bit of a doubt that he is not guilty, you've got to choose not guilty.

506
00:32:01,100 --> 00:32:01,700
Thank you.

507
00:32:03,160 --> 00:32:07,180
Yeah, I mean, not usually, but...

508
00:32:10,280 --> 00:32:10,980
Not guilty.

509
00:32:12,820 --> 00:32:14,860
Do the jurors have questions?

510
00:32:16,240 --> 00:32:16,720
No.

511
00:32:20,700 --> 00:32:21,220
.

512
00:32:21,220 --> 00:32:23,640
Are we allowed to mention jury documentation?

513
00:32:25,240 --> 00:32:27,560
There's a yes option and a no option.

514
00:32:28,460 --> 00:32:30,620
I would appeal to those jury instructions.

515
00:32:30,940 --> 00:32:34,200
I specifically said intent to harm was not .

516
00:32:34,200 --> 00:32:36,680
Would you like to have a unanimous vote?

517
00:32:37,460 --> 00:32:39,680
Y'all, what do you think we're here for?

518
00:32:39,760 --> 00:32:41,100
We're just here to have fun, okay?

519
00:32:43,500 --> 00:32:45,880
You're at the malicious compliance convention, respect.

520
00:32:46,720 --> 00:32:50,640
I'd say, for the record, I would appeal those jury instructions.

521
00:32:52,320 --> 00:32:55,800
Look, we have the motions of the jury instructions in your law, so you got to accept

522
00:32:55,800 --> 00:32:56,920
that and take your appeal later.

523
00:32:57,240 --> 00:32:57,620
I will.

524
00:32:57,740 --> 00:32:57,900
I will.

525
00:32:58,000 --> 00:33:01,560
But I specifically said that intent to harm was not one of the elements.

526
00:33:01,760 --> 00:33:02,200
It is not.

527
00:33:02,400 --> 00:33:06,080
You do not have to have intent to harm in order to commit a CFA violation.

528
00:33:06,620 --> 00:33:06,920
That's true.

529
00:33:07,020 --> 00:33:07,300
That's true.

530
00:33:09,340 --> 00:33:10,520
Well, if it was a...

531
00:33:11,220 --> 00:33:12,920
This is a little bit of a kangaroo court.

532
00:33:13,020 --> 00:33:13,900
Let's be real about it.

533
00:33:13,900 --> 00:33:15,960
This is exactly how it works.

534
00:33:16,660 --> 00:33:17,680
Yeah, this is...

535
00:33:17,680 --> 00:33:20,560
Well, actually, opportunities in the law are very, very...

536
00:33:20,560 --> 00:33:21,000
Oh.

537
00:33:22,180 --> 00:33:22,620
Just...

538
00:33:23,700 --> 00:33:24,140
No.

539
00:33:24,280 --> 00:33:24,900
All right, y'all.

540
00:33:24,920 --> 00:33:25,980
A minute is up.

541
00:33:26,180 --> 00:33:29,540
Now that over 500 of y'all have voted, which is insane.

542
00:33:29,640 --> 00:33:30,800
How many of y'all are voting twice?

543
00:33:30,880 --> 00:33:31,500
Hey, stop it.

544
00:33:34,260 --> 00:33:35,940
70 to 30%.

545
00:33:35,940 --> 00:33:37,060
Not guilty.

546
00:33:37,500 --> 00:33:39,120
Defendant, you are free to go.

547
00:33:39,640 --> 00:33:40,080
Shocker.

548
00:33:41,100 --> 00:33:42,280
Please, take a seat.

549
00:33:42,500 --> 00:33:42,800
Thank you.

550
00:33:42,800 --> 00:33:43,200
Thank you.

551
00:33:43,200 --> 00:33:43,320
Thank you.

552
00:33:43,320 --> 00:33:43,420
Thank you.

553
00:33:44,960 --> 00:33:46,160
Congratulations, Mr. Juice.

554
00:33:47,140 --> 00:33:48,240
Thank you, Mr. Juice.

555
00:33:48,700 --> 00:33:49,600
All right.

556
00:33:50,200 --> 00:33:53,100
We have one more scenario for y'all today.

557
00:33:53,340 --> 00:33:57,620
And I do want to point out, unfortunately, the legal part of my brain is this probably

558
00:33:57,620 --> 00:34:00,260
wouldn't have turned out this way from a legal perspective.

559
00:34:00,600 --> 00:34:05,020
This is probably access and it is probably intentional if we wanted to argue that.

560
00:34:05,580 --> 00:34:07,580
But, all right, scenario two.

561
00:34:09,220 --> 00:34:13,880
We have our telecom company versus an offshore company.

562
00:34:13,880 --> 00:34:16,900
So, we're going to get a little bit spicy in here today, guys.

563
00:34:17,040 --> 00:34:23,340
This is a state civil lawsuit, which means that the telecom company is suing the offensive

564
00:34:23,680 --> 00:34:23,960
startup.

565
00:34:25,540 --> 00:34:26,100
Yeah.

566
00:34:27,420 --> 00:34:27,980
Okay.

567
00:34:28,220 --> 00:34:30,040
So, here's what went down.

568
00:34:31,300 --> 00:34:36,840
An offensive security startup produced and created an exploitation and pen testing tool

569
00:34:36,840 --> 00:34:37,740
for legitimate purposes.

570
00:34:38,040 --> 00:34:43,860
This was then cracked and sold on a criminal forum and used its initial access to get in

571
00:34:43,860 --> 00:34:46,420
to and exploit, extort the telecom company.

572
00:34:46,860 --> 00:34:52,560
Telecom company can't sue the ransomware group, but they can definitely sue or try to sue the

573
00:34:52,560 --> 00:34:53,740
U.S. offset company.

574
00:34:53,740 --> 00:34:58,100
So, I know, it's a lot of walking up here.

575
00:34:58,620 --> 00:35:12,100
So, our plaintiff's counsel is the wonderful Mari Dougas, representing, oh, sorry, excuse

576
00:35:12,100 --> 00:35:16,160
me, who's a cyber data and privacy lawyer at Cooley and formerly worked at Harvard Belfer

577
00:35:16,160 --> 00:35:19,040
and the office of the staff judge advocate at U.S. Cyber Comm.

578
00:35:19,400 --> 00:35:23,600
And we welcome back our defense attorney because defense attorneys are overworked and underpaid.

579
00:35:25,240 --> 00:35:26,980
Kurt, please give him a hand, folks.

580
00:35:30,460 --> 00:35:35,080
And I love y'all, but remember, all of us lawyers up here do firmly believe, even the

581
00:35:35,080 --> 00:35:38,760
prosecution in all of these cases, believe that we want to be here to protect hackers.

582
00:35:38,940 --> 00:35:40,420
So just, we're all people, so.

583
00:35:41,500 --> 00:35:42,300
All right.

584
00:35:42,340 --> 00:35:46,200
Last but not least, our defendant, as much as we'd love another volunteer, our defendant

585
00:35:46,200 --> 00:35:47,280
now is Silas.

586
00:35:47,820 --> 00:35:50,480
He is playing, come on up, Silas.

587
00:35:57,700 --> 00:36:00,140
Fellow goon and just wonderful general human.

588
00:36:00,620 --> 00:36:05,120
He is playing the part of the CFO of the offset startup company.

589
00:36:06,100 --> 00:36:07,080
Oh, my God.

590
00:36:07,220 --> 00:36:08,340
Yeah, you're first.

591
00:36:10,420 --> 00:36:10,920
Great.

592
00:36:13,740 --> 00:36:18,520
So, Silas, in this case where the telecom company is suing you for millions of dollars of damage,

593
00:36:18,740 --> 00:36:20,400
do you choose to defend your startup in court?

594
00:36:21,040 --> 00:36:21,540
Yup.

595
00:36:21,640 --> 00:36:22,100
Great.

596
00:36:22,340 --> 00:36:23,160
All right.

597
00:36:24,000 --> 00:36:24,520
So, are you sure?

598
00:36:24,620 --> 00:36:25,060
Yup.

599
00:36:25,800 --> 00:36:26,640
Are you sure?

600
00:36:27,880 --> 00:36:28,440
Let's go.

601
00:36:28,660 --> 00:36:29,180
YOLO.

602
00:36:29,740 --> 00:36:30,440
All right.

603
00:36:30,780 --> 00:36:31,300
Great.

604
00:36:32,660 --> 00:36:35,080
So, plaintiff's counsel, please begin your opening remarks.

605
00:36:38,720 --> 00:36:42,420
Ladies and gentlemen of the DEFCON jury, thank you for joining us here.

606
00:36:42,620 --> 00:36:49,340
We are here today because Mr. Silas aided and abetted a criminal ransomware gang group

607
00:36:49,340 --> 00:36:52,660
who caused my client millions of dollars of damage.

608
00:36:52,660 --> 00:36:56,080
The defendant is a youth.

609
00:36:56,300 --> 00:36:57,720
He has no experience.

610
00:36:58,420 --> 00:37:03,440
He decided to create an offensive security tool and just pursued profit.

611
00:37:06,520 --> 00:37:16,580
A criminal ransomware gang group cracked his tool and used it to perpetrate a ruthless ransomware attack on my client on July 13th, 2023.

612
00:37:17,480 --> 00:37:22,040
Our client's systems were inaccessible for six hours.

613
00:37:22,040 --> 00:37:26,260
The attackers encrypted my client's networks and systems.

614
00:37:26,500 --> 00:37:30,920
They exfiltrated data, including our Q4 financial predictions, which tanked our stock.

615
00:37:32,240 --> 00:37:39,780
And, ultimately, our forensic investigation determined that the cracked entry-level tool was the initial point of access.

616
00:37:41,140 --> 00:37:46,100
So, today, we're here to talk to you about what aiding and abetting really means.

617
00:37:46,860 --> 00:37:52,020
The defendant aided and abetted a count of 18 USC-1030-A5s.

618
00:37:52,020 --> 00:37:53,640
We've already talked about today.

619
00:37:53,860 --> 00:37:59,860
The Computer Fraud and Abuse Act caused property damage to my client under the common law of our state.

620
00:38:00,540 --> 00:38:07,880
Today, we'll talk to you about proving that with the preponderance of the evidence, only 51%, you can have some doubt in your mind,

621
00:38:08,640 --> 00:38:13,960
that the party whom the defendant aided performed a wrongful act, our ransomware gang.

622
00:38:14,220 --> 00:38:15,160
We all agree on that.

623
00:38:15,820 --> 00:38:20,540
That the defendant was generally aware of his role in an overall unlawful scheme.

624
00:38:22,020 --> 00:38:25,340
And, he knowingly and substantially assisted in that scheme.

625
00:38:27,100 --> 00:38:28,400
There was property damage.

626
00:38:28,720 --> 00:38:31,100
There was an injury to my client from a ransomware attack.

627
00:38:31,720 --> 00:38:34,880
We can all understand that that is an unlawful act.

628
00:38:35,700 --> 00:38:37,720
And, the defendant was generally aware.

629
00:38:38,620 --> 00:38:49,120
Our expert witnesses today will show that the defendant knew that his tool was not only being purchased by ransomware gangs in general, but this specific group.

630
00:38:49,820 --> 00:38:52,000
And, he didn't decide to take action until the FBI.

631
00:38:52,020 --> 00:38:53,240
The FBI came knocking at his door.

632
00:38:54,200 --> 00:38:58,220
Had he conducted more diligence, we wouldn't have been in this situation.

633
00:38:59,800 --> 00:39:02,820
Finally, he substantially assisted in the wrongful act.

634
00:39:03,000 --> 00:39:06,040
Because, without this offensive security tool, this wouldn't have happened.

635
00:39:06,300 --> 00:39:08,600
It was the only initial point of access.

636
00:39:10,320 --> 00:39:13,980
We understand here that offensive security tools do have legitimate uses.

637
00:39:14,740 --> 00:39:18,240
But, they have the capacity to be weaponized by these bad actors.

638
00:39:19,040 --> 00:39:22,000
And, defendant played in to their bad acts.

639
00:39:22,020 --> 00:39:22,280
And, defendant played in to their bad actions.

640
00:39:23,540 --> 00:39:24,300
Thank you.

641
00:39:24,980 --> 00:39:25,920
Thank you, Martin.

642
00:39:30,800 --> 00:39:31,520
Defense counsel.

643
00:39:32,960 --> 00:39:36,780
Members of the jury, there are two sides to every story.

644
00:39:37,320 --> 00:39:46,660
Plaintiff's counsels painted a picture of reckless kids creating offensive security tools just to make money selling it to everyone from companies we all know.

645
00:39:47,400 --> 00:39:50,120
It goes to sometimes gets in the hands of criminal enterprises.

646
00:39:50,120 --> 00:39:53,760
The reality, significantly less cinematic.

647
00:39:54,220 --> 00:40:00,440
Defendants are five security professionals with almost ten years of cumulative experience between them.

648
00:40:02,680 --> 00:40:08,880
Defendants all graduated from top universities with computer science degrees.

649
00:40:09,100 --> 00:40:11,520
Were hired by top security companies.

650
00:40:12,620 --> 00:40:17,780
And, my client right here, Silas, is a seasoned security expert.

651
00:40:18,000 --> 00:40:19,880
A consummate professional.

652
00:40:21,320 --> 00:40:26,500
Defendants all moved through the ranks of these companies before seeing a gap in the product that they could fill.

653
00:40:26,740 --> 00:40:28,240
A better cobalt strike.

654
00:40:28,440 --> 00:40:29,960
A sleeker metasploit.

655
00:40:31,080 --> 00:40:36,740
Plaintiff's counsel will try to convince you that my clients aided and abetted an alleged criminal activity.

656
00:40:37,220 --> 00:40:42,860
What is the criminal organization that repurposed this tool for bad uses?

657
00:40:43,380 --> 00:40:49,660
We don't extend liability to a store owner who sells the robber a hammer he uses to break the window.

658
00:40:49,660 --> 00:40:51,800
Why would we do that here?

659
00:40:53,220 --> 00:40:56,000
Indeed, my clients are also victims.

660
00:40:56,700 --> 00:41:03,140
A bad actor hoodwinked them, purchased the entry level by pretending to be someone they weren't,

661
00:41:03,260 --> 00:41:08,820
and repurposed it for nefarious uses, committing a crime against my client.

662
00:41:09,420 --> 00:41:18,880
Off-sex startup was not genuinely aware of their role in this specific criminal activity at the time they sold the tool to the alleged ransomware gang.

663
00:41:18,880 --> 00:41:23,700
And they did not knowingly or substantially assist in any violations.

664
00:41:24,080 --> 00:41:30,360
Just because my clients were aware generally of potential malicious uses of their legitimate product

665
00:41:30,880 --> 00:41:37,440
does not make them liable for everything that happens downstream by victims of people who are misusing that tool.

666
00:41:37,720 --> 00:41:42,860
My clients were not even aware that the ransom gang was a buyer.

667
00:41:43,440 --> 00:41:48,260
My clients have also fully cooperated with U.S. law in due diligence

668
00:41:48,260 --> 00:41:51,120
and all of the ransomware investigations.

669
00:41:51,760 --> 00:41:54,860
But the telecom company still wants to sue.

670
00:41:55,060 --> 00:42:01,140
They seek to create new liability for everyone in infosec with no basis in law.

671
00:42:02,100 --> 00:42:08,420
If plaintiffs succeed with their claim, the entire infosec industry will be open to enormous liability.

672
00:42:09,120 --> 00:42:14,060
Think of all the dual-purpose tools that you use every day.

673
00:42:14,300 --> 00:42:17,460
Metasploit, Cobalt Strike, even Shodan or other scanners

674
00:42:17,460 --> 00:42:19,940
may not be safe from this legal theory.

675
00:42:20,480 --> 00:42:23,360
This court has an imperative to dismiss the case

676
00:42:23,360 --> 00:42:26,120
or else we will all pay the consequences.

677
00:42:26,780 --> 00:42:27,440
Thank you.

678
00:42:31,640 --> 00:42:33,240
Thank you, counsels.

679
00:42:34,700 --> 00:42:35,720
Alright, chill out, man.

680
00:42:37,660 --> 00:42:39,780
Alright, plaintiffs' counsel, please call up your first witness.

681
00:42:40,280 --> 00:42:42,300
I'd like to call Silas to the stand, please.

682
00:42:42,640 --> 00:42:43,580
Yeah, Silas, please.

683
00:42:47,460 --> 00:42:49,080
Do you swear to tell the whole truth and nothing but the truth?

684
00:42:50,180 --> 00:42:50,580
Yes.

685
00:42:50,740 --> 00:42:51,140
Great.

686
00:42:52,740 --> 00:42:53,140
Sit.

687
00:42:58,000 --> 00:42:58,760
All set there?

688
00:42:59,380 --> 00:43:00,160
I think I'm good.

689
00:43:00,440 --> 00:43:00,600
Alright.

690
00:43:00,880 --> 00:43:03,820
Could you please state your name and your occupation, please, for the record?

691
00:43:04,320 --> 00:43:05,820
Hi, my name is Silas Cutler.

692
00:43:05,960 --> 00:43:08,500
I'm the CFO and co-founder of Offensive Startup.

693
00:43:08,640 --> 00:43:11,060
We're offering a 15% discount if you use the code...

694
00:43:11,060 --> 00:43:11,840
Hey, hey, hey, hey, hey, hey!

695
00:43:14,140 --> 00:43:15,300
Stop it, stop it!

696
00:43:15,540 --> 00:43:15,940
I'm sorry.

697
00:43:17,460 --> 00:43:18,440
It's my first time on the stand.

698
00:43:18,720 --> 00:43:20,000
Silas, we talked about this.

699
00:43:22,680 --> 00:43:25,500
Mr. Silas, could you please tell me what's on the slide?

700
00:43:27,220 --> 00:43:30,300
This is a screenshot of a chat that I received from a security researcher.

701
00:43:32,020 --> 00:43:35,300
And, yeah, we were able to obtain that from you in discovery,

702
00:43:35,560 --> 00:43:38,840
but can you walk us through what the messages are about, please?

703
00:43:39,900 --> 00:43:41,200
Well, you can all read.

704
00:43:42,260 --> 00:43:45,480
The guy basically told us that he found a dark web post

705
00:43:45,480 --> 00:43:46,860
about some ransomware gangs

706
00:43:47,460 --> 00:43:49,900
and that it was a hacked version of entry-level for initial access.

707
00:43:50,540 --> 00:43:51,500
How'd you react to that?

708
00:43:52,680 --> 00:43:54,140
I didn't think too much about it.

709
00:43:55,120 --> 00:43:58,080
We get hit up by security researchers every few weeks about this kind of stuff.

710
00:43:58,340 --> 00:44:00,820
I told the CEO, and we just kind of moved on.

711
00:44:01,140 --> 00:44:02,100
There's not much we could do.

712
00:44:02,880 --> 00:44:07,020
So did you take the researcher's information, his message here, seriously?

713
00:44:07,540 --> 00:44:12,160
Did you believe that ransomware gangs were actually using your tool for initial access?

714
00:44:13,880 --> 00:44:14,940
I guess so, yeah.

715
00:44:14,940 --> 00:44:17,440
It happens with other security tools.

716
00:44:17,600 --> 00:44:19,040
So I didn't think he was lying or anything.

717
00:44:19,260 --> 00:44:22,080
It just didn't end up being a priority issue for us.

718
00:44:22,500 --> 00:44:23,700
All right, next exhibit.

719
00:44:26,080 --> 00:44:26,900
Same question.

720
00:44:27,060 --> 00:44:29,600
Can you walk us through what this chat is?

721
00:44:29,720 --> 00:44:30,000
Who's who?

722
00:44:32,180 --> 00:44:33,040
I'm trying to remember.

723
00:44:33,720 --> 00:44:36,480
This is our internal offset chat from 9 July.

724
00:44:38,040 --> 00:44:38,480
Yeah.

725
00:44:39,440 --> 00:44:41,820
And I'm the gray chat and the CEO is the blue.

726
00:44:42,300 --> 00:44:44,400
So why did you send that initial chat message?

727
00:44:46,020 --> 00:44:51,320
So I had gotten a weird-looking purchase order request, a PO, just written in bad English,

728
00:44:51,520 --> 00:44:53,420
and it came at a weird time of the night.

729
00:44:54,000 --> 00:44:58,560
Not that we don't check orders from out of the U.S. or anything, but something looked off to me.

730
00:44:59,520 --> 00:45:01,620
My due diligence checks came up with nothing.

731
00:45:01,800 --> 00:45:04,880
I Googled the guy's company and couldn't really find anything.

732
00:45:05,560 --> 00:45:06,480
That was weird, too.

733
00:45:06,580 --> 00:45:07,360
So I told the CEO.

734
00:45:08,160 --> 00:45:10,980
And when you told the CEO, did he seem concerned about this?

735
00:45:11,400 --> 00:45:11,780
Nah.

736
00:45:12,080 --> 00:45:14,720
He said, except the PO, we get weird requests all the time.

737
00:45:14,940 --> 00:45:16,100
It also could have just been a small company.

738
00:45:17,260 --> 00:45:22,660
Well, in the next line, it looks to me like you expressed some concern about the researcher's message.

739
00:45:22,980 --> 00:45:24,040
You mentioned that one.

740
00:45:24,300 --> 00:45:26,340
And you just told us that you weren't worried.

741
00:45:26,620 --> 00:45:28,220
You get these messages all the time.

742
00:45:28,400 --> 00:45:34,760
But yet you told the CEO, and I quote, we don't want entry level to be used for an actual attack.

743
00:45:35,380 --> 00:45:37,700
So did you or did you not take the threat seriously?

744
00:45:38,060 --> 00:45:38,800
I mean, sure.

745
00:45:39,000 --> 00:45:41,140
Again, I don't want anyone to get hurt.

746
00:45:41,260 --> 00:45:42,600
So of course I raised it with the CEO.

747
00:45:43,440 --> 00:45:44,920
But stuff like this happens all the time.

748
00:45:47,400 --> 00:45:49,300
Sometimes due diligence comes up with nothing.

749
00:45:49,360 --> 00:45:50,800
And we have to make a call.

750
00:45:51,480 --> 00:45:53,400
So what did you do to investigate further?

751
00:45:53,680 --> 00:45:55,300
You had suspicious order activity.

752
00:45:56,280 --> 00:45:58,980
What did you do beyond your minimum requirements?

753
00:46:00,240 --> 00:46:00,640
Nope.

754
00:46:00,700 --> 00:46:01,160
Just that.

755
00:46:02,300 --> 00:46:02,880
All right.

756
00:46:02,960 --> 00:46:03,440
All right.

757
00:46:03,780 --> 00:46:05,460
Let's move on to the next exhibit, then.

758
00:46:06,980 --> 00:46:08,040
So what's on this slide?

759
00:46:10,880 --> 00:46:14,100
Looks like a dark web, a post from a dark web forum.

760
00:46:14,240 --> 00:46:14,880
I think it's accessibility.

761
00:46:14,940 --> 00:46:15,040
CSS.

762
00:46:16,120 --> 00:46:16,840
Yeah, that's right.

763
00:46:17,640 --> 00:46:21,320
Describing the ransomware gang's use of entry levels specifically.

764
00:46:21,920 --> 00:46:23,320
Were you aware of this post?

765
00:46:28,220 --> 00:46:29,560
Yes, I think I've seen it before.

766
00:46:30,580 --> 00:46:31,220
That's a yes?

767
00:46:31,480 --> 00:46:31,700
Yes.

768
00:46:31,740 --> 00:46:32,140
All right.

769
00:46:32,200 --> 00:46:32,380
Sorry.

770
00:46:32,580 --> 00:46:33,740
Yes for the record, please.

771
00:46:34,780 --> 00:46:39,440
So after multiple researchers had told you that your tool was being spread online.

772
00:46:39,980 --> 00:46:41,480
Objective, projection, speculative.

773
00:46:42,100 --> 00:46:42,580
Sustained.

774
00:46:42,580 --> 00:46:44,940
And counsel, please ask a real question or proceed with exhibits.

775
00:46:46,340 --> 00:46:48,080
Did you do anything with this information?

776
00:46:49,400 --> 00:46:50,120
I don't remember.

777
00:46:50,860 --> 00:46:52,420
But probably just referred it to the CEO.

778
00:46:52,960 --> 00:46:54,680
This stuff happens all the time.

779
00:46:55,420 --> 00:46:58,400
The bad guys take our product, crack them, and do bad shit.

780
00:46:58,520 --> 00:46:59,300
It happens to everyone.

781
00:46:59,660 --> 00:47:00,560
We can't control them.

782
00:47:01,960 --> 00:47:05,760
We won't be able to run a business if I spend all day caring about what the bad guys do.

783
00:47:06,460 --> 00:47:07,480
So I'm going to sum this up.

784
00:47:07,900 --> 00:47:11,660
You were aware that ransomware groups have previously found and cracked your tool.

785
00:47:11,660 --> 00:47:13,900
You get a weird purchase order that you approve.

786
00:47:14,620 --> 00:47:20,420
And then the exact ransomware gang that attacked my client starts using a cracked version of entry level.

787
00:47:20,680 --> 00:47:21,420
Did I get that all?

788
00:47:21,940 --> 00:47:22,380
Yes.

789
00:47:22,960 --> 00:47:23,560
Thank you.

790
00:47:23,580 --> 00:47:24,540
No further questions, Your Honor.

791
00:47:25,060 --> 00:47:26,060
Thank you, Plaintiff's counsel.

792
00:47:26,260 --> 00:47:27,280
Defense, you may approach.

793
00:47:29,060 --> 00:47:29,960
Thank you, Your Honor.

794
00:47:31,040 --> 00:47:34,300
Silas, can you tell me what this is?

795
00:47:37,260 --> 00:47:41,640
This is language our internal company export control policies.

796
00:47:42,900 --> 00:47:46,240
It just says we're supposed to do due diligence on potential buyers.

797
00:47:46,520 --> 00:47:46,860
Great.

798
00:47:46,960 --> 00:47:47,360
Thank you.

799
00:47:47,480 --> 00:47:50,160
And what is the OFAC sanction list?

800
00:47:50,480 --> 00:47:52,540
Does your policy require you to run OFAC checks?

801
00:47:53,300 --> 00:47:56,420
It's a list of entities that it's illegal for the U.S. companies to sell stuff to.

802
00:47:57,020 --> 00:48:01,300
I mean, the policy doesn't explicitly say that we have to check OFAC, but we try to do it anyway.

803
00:48:01,700 --> 00:48:02,260
Of course.

804
00:48:02,440 --> 00:48:02,840
Great.

805
00:48:03,000 --> 00:48:06,020
Are there other lists that describe entities you couldn't sell to?

806
00:48:06,340 --> 00:48:06,760
Yes.

807
00:48:07,340 --> 00:48:10,120
The Commerce Department has an entities list of people we can't sell to either.

808
00:48:10,120 --> 00:48:10,960
Thank you.

809
00:48:11,680 --> 00:48:13,840
Do you know if Shadow Crypt is on either of those lists?

810
00:48:14,180 --> 00:48:15,240
They're on the OFAC list.

811
00:48:15,720 --> 00:48:18,200
And how do you check these lists when you have a new buyer?

812
00:48:19,000 --> 00:48:23,040
So, we check the information the buyer provides against two lists to make sure they're not on there.

813
00:48:23,200 --> 00:48:27,200
And usually, I just run some quick Google searches, I work in this field, I know the names of the big players.

814
00:48:27,420 --> 00:48:29,460
I'm not going to sell entry-level to Klopp, obviously.

815
00:48:31,160 --> 00:48:35,880
So, is there anything else you are legally obligated to do in your due diligence process?

816
00:48:36,620 --> 00:48:37,760
Aside from what I just said?

817
00:48:38,200 --> 00:48:38,560
No.

818
00:48:38,560 --> 00:48:41,840
No, it's not our job to research every company super in-depth to make sure they're legit.

819
00:48:42,520 --> 00:48:49,480
So, would you say you're abiding by your due diligence requirements even when you sold to someone who ended up misusing your tool?

820
00:48:50,520 --> 00:48:50,960
Yeah.

821
00:48:52,920 --> 00:48:53,480
Thank you.

822
00:48:53,520 --> 00:48:54,140
No further questions.

823
00:48:54,680 --> 00:48:55,420
Thank you, Silas.

824
00:48:55,440 --> 00:48:58,080
You may sit back in the defense, uh, defendant place.

825
00:48:59,220 --> 00:49:01,140
Please call up your next witness, defense counsel.

826
00:49:01,780 --> 00:49:06,380
Yes, my witness is an expert witness, Special Agent Smith from the FBI.

827
00:49:14,840 --> 00:49:17,980
I swear, I'm tired of saying it.

828
00:49:18,040 --> 00:49:18,580
I do, yes.

829
00:49:18,660 --> 00:49:18,840
Great.

830
00:49:23,320 --> 00:49:24,020
Thank you.

831
00:49:24,520 --> 00:49:27,260
Could you state your name and occupation, please?

832
00:49:27,820 --> 00:49:32,600
I am Special Agent Smith with the FBI Cyber Division, supporting the Ransomware Task Force.

833
00:49:33,060 --> 00:49:37,020
And can you tell me when you first came across the entry-level toolkit?

834
00:49:37,020 --> 00:49:42,100
I came across entry-level when Shadow Crypt started using it for operations over six months ago.

835
00:49:42,400 --> 00:49:47,580
We got a tip that their newest initial access tool was made by a U.S. company, which happened to be entry-level.

836
00:49:48,020 --> 00:49:51,840
And how does the FBI and DOJ investigate these tips?

837
00:49:52,320 --> 00:49:59,840
Well, FBI tries to determine whether the U.S. company is actually perpetrating a crime, and then the DOJ decides whether they want or not to prosecute.

838
00:50:00,040 --> 00:50:04,180
FBI will figure out what the company's role was in the overall ransomware incident.

839
00:50:04,360 --> 00:50:07,000
Whether the tool was stolen or if they were willing to supply it.

840
00:50:07,000 --> 00:50:14,880
It can be a little difficult because good faith security research tools and malware can sometimes have similar features and overlap.

841
00:50:15,720 --> 00:50:21,080
And what is DOJ's policy for prosecuting good faith security hackers?

842
00:50:21,440 --> 00:50:23,100
DOJ does not prosecute.

843
00:50:23,320 --> 00:50:26,580
They have a policy where good faith security researchers won't be charged.

844
00:50:27,200 --> 00:50:30,480
And can you define good faith security research?

845
00:50:30,860 --> 00:50:31,240
Yes.

846
00:50:31,240 --> 00:50:36,000
Good faith security research means accessing a computer solely for the purposes of good faith testing,

847
00:50:37,000 --> 00:50:40,080
or investigation or correction of a security flaw or vulnerability.

848
00:50:40,620 --> 00:50:41,360
All right.

849
00:50:41,600 --> 00:50:42,160
Great.

850
00:50:42,340 --> 00:50:43,140
Thank you, Agent Smith.

851
00:50:43,380 --> 00:50:49,460
Now, if you'll look at Exhibit 2, which showcases a description of the entry-level toolkit.

852
00:50:49,720 --> 00:50:58,880
It states, entry-level is a cutting-edge security penetration testing tool designed to help business identify and address potential weaknesses in their IT infrastructure.

853
00:50:59,280 --> 00:51:04,940
This state-of-the-art software is your first line of defense against malicious attacks and data breaches.

854
00:51:04,940 --> 00:51:07,900
Does that sound like good faith security research?

855
00:51:09,700 --> 00:51:11,600
I mean, it's a little more complicated than that.

856
00:51:11,600 --> 00:51:11,920
Yes or no?

857
00:51:13,620 --> 00:51:15,520
Yes, based on the product description.

858
00:51:15,760 --> 00:51:15,960
Sure.

859
00:51:16,040 --> 00:51:16,220
Great.

860
00:51:16,260 --> 00:51:16,680
Thank you.

861
00:51:16,680 --> 00:51:17,580
Thank you, Agent Smith.

862
00:51:17,860 --> 00:51:23,660
Did you ever approach my client, OffSecStartup, when you were investigating Shadow Crypt?

863
00:51:23,900 --> 00:51:24,340
Yes.

864
00:51:25,080 --> 00:51:30,640
And when you did approach my client for assistance with the investigation, when did you?

865
00:51:32,140 --> 00:51:34,920
It would have been a few months ago after the test.

866
00:51:34,920 --> 00:51:37,940
And what were you trying to ascertain?

867
00:51:38,500 --> 00:51:43,980
We were trying to determine whether or not OffSecStartup willingly sold a criminal group the toolkit.

868
00:51:44,820 --> 00:51:47,180
And did they fully cooperate with the investigation?

869
00:51:48,100 --> 00:51:49,780
Yes, but we did have to.

870
00:51:49,780 --> 00:51:50,200
Yes or no?

871
00:51:50,880 --> 00:51:51,440
Yes.

872
00:51:51,740 --> 00:51:52,340
Thank you.

873
00:51:52,800 --> 00:51:54,260
So, two final questions.

874
00:51:54,580 --> 00:51:57,580
Can you explain to me what cracked software is?

875
00:51:58,120 --> 00:52:03,780
Cracked software is where you bypass a software license key check to use that software without paying for it.

876
00:52:04,480 --> 00:52:05,640
Oh, that's interesting.

877
00:52:05,740 --> 00:52:06,540
Isn't that illegal?

878
00:52:07,100 --> 00:52:07,780
It is, yes.

879
00:52:08,480 --> 00:52:17,780
And so, when Shadow Crypt was using the entry-level toolkit, were they effectively committing a crime against my client?

880
00:52:18,620 --> 00:52:19,140
Sustained.

881
00:52:23,820 --> 00:52:24,460
That's fine.

882
00:52:24,560 --> 00:52:25,800
No further questions.

883
00:52:26,420 --> 00:52:26,740
Uh-huh.

884
00:52:27,420 --> 00:52:28,120
Thank you.

885
00:52:28,140 --> 00:52:28,660
Plaintiff's counsel?

886
00:52:30,060 --> 00:52:30,760
Thank you.

887
00:52:31,100 --> 00:52:33,380
Special Agent Smith, thanks so much for your time today.

888
00:52:33,380 --> 00:52:36,220
You're a subject matter expert in ransomware attacks, correct?

889
00:52:36,700 --> 00:52:37,180
Sure.

890
00:52:37,880 --> 00:52:38,360
Great.

891
00:52:40,020 --> 00:52:46,480
So, can you walk us through how Shadow Crypt ransomware would have worked if they had not had entry-level to gain initial access?

892
00:52:47,340 --> 00:52:50,680
Yeah, so that's a tough counterfactual, right?

893
00:52:50,760 --> 00:52:52,780
They would have needed another point of entry.

894
00:52:53,240 --> 00:53:00,720
There's plenty of other tools that they could have purchased on the dark web, but, of course, the success of those tools depends on the target systems and security.

895
00:53:01,200 --> 00:53:03,360
There's no one-size-fits-all for these types of tools.

896
00:53:03,360 --> 00:53:07,460
So, I'm hearing then the entry-level gave them unique access.

897
00:53:08,180 --> 00:53:09,780
It did give them access, yes.

898
00:53:10,300 --> 00:53:11,900
And you've worked in this space for a while.

899
00:53:12,380 --> 00:53:17,620
As the CFO, our defendant, said before, there are a lot of companies who create similar tools.

900
00:53:17,940 --> 00:53:20,060
Their tools have been cracked and repurposed by attackers.

901
00:53:20,500 --> 00:53:21,380
This is pretty common.

902
00:53:21,520 --> 00:53:22,760
Do you agree from your experience?

903
00:53:23,340 --> 00:53:23,620
Yeah.

904
00:53:23,660 --> 00:53:24,800
This is not a new phenomenon.

905
00:53:25,080 --> 00:53:27,000
It is pretty well-known in the security community.

906
00:53:27,540 --> 00:53:29,160
Have you worked with those other companies?

907
00:53:29,560 --> 00:53:30,240
Many times, yes.

908
00:53:30,680 --> 00:53:31,460
How does that work?

909
00:53:31,920 --> 00:53:33,340
So, usually, those companies come in.

910
00:53:33,820 --> 00:53:38,380
There's a few big players in the field, and we have rather productive working relationships with them.

911
00:53:38,720 --> 00:53:49,580
They have often sophisticated threat intelligence teams and capabilities, so they'll hear about these tools that are being cracked by particular groups or talked about on forums like we saw earlier well before we do.

912
00:53:49,780 --> 00:53:53,300
When they see that, they'll call me up, and then my team has some good leads to investigate.

913
00:53:53,780 --> 00:54:02,580
In a best-case scenario, we're able to shut down some of those forums or trace the money to find who purchased the tools for those groups or even get a heads-up on the potential victims.

914
00:54:02,580 --> 00:54:06,880
But none of that would happen without the companies reaching out to us and working with us proactively.

915
00:54:07,480 --> 00:54:11,040
Is that industry standard, would you say, that proactive outreach?

916
00:54:11,360 --> 00:54:17,560
If you're making an offensive security tool, then you'd be expected as the company to have a relationship with the FBI?

917
00:54:18,020 --> 00:54:18,500
Yes.

918
00:54:18,500 --> 00:54:18,760
Yeah.

919
00:54:18,820 --> 00:54:19,520
It is pretty common.

920
00:54:20,120 --> 00:54:29,600
So then it's reasonable to say that others in the same industry as offset startup regularly contact law enforcement to help limit this bad use of their cracked tools.

921
00:54:29,980 --> 00:54:30,460
Yes.

922
00:54:30,460 --> 00:54:30,660
Yeah.

923
00:54:30,740 --> 00:54:32,100
It is pretty common.

924
00:54:32,580 --> 00:54:34,320
I'm open about wanting companies to contact us.

925
00:54:34,560 --> 00:54:41,520
I go to all the security conferences, particularly in Vegas, and hand out my cards, and we do call up companies proactively to build relationships.

926
00:54:42,180 --> 00:54:42,740
Thank you.

927
00:54:43,000 --> 00:54:45,520
And did OffSec reach out to you proactively?

928
00:54:45,680 --> 00:54:47,500
Were they one of the companies who took your card at DEF CON?

929
00:54:47,720 --> 00:54:48,040
No.

930
00:54:48,180 --> 00:54:48,520
No.

931
00:54:48,560 --> 00:54:51,420
We had to reach out to them after the CISA FBI alert was published.

932
00:54:52,560 --> 00:54:52,960
Overruled.

933
00:54:52,960 --> 00:54:53,700
It's definitely relevant.

934
00:54:54,240 --> 00:54:54,800
Thank you.

935
00:54:55,820 --> 00:54:56,600
Let's switch gears.

936
00:54:57,300 --> 00:55:00,280
Are you familiar with this specific ransomware gang, Shadow Crypt?

937
00:55:00,520 --> 00:55:00,920
Yes.

938
00:55:00,920 --> 00:55:04,040
I've been tracking them for a while now and was familiar with their predecessor.

939
00:55:04,520 --> 00:55:07,320
Any particular nuances that you've observed?

940
00:55:07,780 --> 00:55:08,140
Yeah.

941
00:55:08,240 --> 00:55:12,000
One trend that we see is they're a little bolder in their non-dark web activity.

942
00:55:12,300 --> 00:55:16,200
They have some people who go out and make legitimate purchases of tools from companies directly.

943
00:55:16,480 --> 00:55:19,780
And I've seen a few cases where they've made purchases using the last name Gray.

944
00:55:20,520 --> 00:55:20,980
Great.

945
00:55:21,060 --> 00:55:22,360
Can you take a look at this slide, please?

946
00:55:24,980 --> 00:55:30,900
Can you confirm that these messages in the chat that we talked about with the CFO and the CEO reviewing this?

947
00:55:32,180 --> 00:55:34,180
Yes, they do.

948
00:55:34,680 --> 00:55:35,400
Thank you.

949
00:55:35,920 --> 00:55:40,900
Would you have been able to tell OffSec any more about Shadow Crypt's TTPs if they had come to you for assistance?

950
00:55:41,480 --> 00:55:41,840
Yeah.

951
00:55:41,860 --> 00:55:44,440
We share TTPs all the time with companies.

952
00:55:44,540 --> 00:55:45,500
That is my job.

953
00:55:46,360 --> 00:55:47,480
Glad you do your job.

954
00:55:47,820 --> 00:55:53,100
In your expert opinion, do sanctioned entities like Shadow Crypt frequently use real information

955
00:55:53,100 --> 00:55:54,400
when they're purchasing tools?

956
00:55:54,960 --> 00:55:55,800
Definitely not.

957
00:55:55,880 --> 00:55:56,040
No.

958
00:55:56,260 --> 00:55:56,780
No.

959
00:55:56,820 --> 00:55:59,480
They often use fake names or shell companies.

960
00:55:59,780 --> 00:56:00,880
Things like The Girl.

961
00:56:00,900 --> 00:56:02,080
They use the Ray name to hide their tracks.

962
00:56:02,480 --> 00:56:03,140
Thank you.

963
00:56:03,200 --> 00:56:03,820
No further questions.

964
00:56:04,520 --> 00:56:06,120
Thank you, witnesses and counsels.

965
00:56:06,940 --> 00:56:08,860
We are running a little bit close to time.

966
00:56:09,020 --> 00:56:12,480
So if the and DEF CON closing ceremonies are soon.

967
00:56:12,700 --> 00:56:15,940
So plaintiffs, please proceed with closing arguments and make them quick.

968
00:56:16,960 --> 00:56:17,940
We'll keep this brief.

969
00:56:18,580 --> 00:56:27,200
In a civil lawsuit, we only need 51% of the evidence to convict this client, to find him, find the defendant liable.

970
00:56:28,320 --> 00:56:30,120
There was an unlawful act.

971
00:56:30,120 --> 00:56:31,220
The ransomware attack.

972
00:56:31,740 --> 00:56:38,300
The defendant was generally aware of his role and his company's role in this attack at the time that they sold that tool.

973
00:56:38,700 --> 00:56:44,480
And they knowingly and substantially assisted that violation because this was the unique initial point of access.

974
00:56:45,220 --> 00:56:46,340
The case is clear.

975
00:56:46,480 --> 00:56:49,680
He must be found liable and will make the telecom company whole.

976
00:56:50,920 --> 00:56:52,200
DEFENSE, your closing remarks.

977
00:56:53,560 --> 00:56:54,620
Thank you, Your Honor.

978
00:56:54,720 --> 00:56:58,400
Members of the jury, this is an unprecedented case.

979
00:56:58,640 --> 00:56:59,860
The plaintiff is asking,

980
00:57:00,120 --> 00:57:07,700
I'm asking you to extend a theory of liability that could fundamentally destroy a critical component of the infosec industry.

981
00:57:09,200 --> 00:57:13,380
My clients cannot foresee every action their customers take.

982
00:57:13,720 --> 00:57:21,980
My client had no clear or direct awareness that entry level will be used by this particular ransomware gang in this particular attack.

983
00:57:22,820 --> 00:57:25,960
That is not enough under aiding and abetting.

984
00:57:26,120 --> 00:57:29,480
We reject these arguments by the plaintiffs.

985
00:57:29,480 --> 00:57:32,900
Offensive security is an important, legitimate business.

986
00:57:33,060 --> 00:57:37,840
And the outcome of this trial is important for everybody in this community.

987
00:57:38,720 --> 00:57:47,380
By subjecting it to a broad liability, whenever a bad actor uses pen testing tools to enter into a system instead of protecting it,

988
00:57:47,480 --> 00:57:51,040
we can't have liability for that or we won't have offensive tools.

989
00:57:51,260 --> 00:57:53,740
We cannot ask these companies to predict the future.

990
00:57:54,480 --> 00:57:55,440
So thank you.

991
00:57:55,500 --> 00:57:57,740
I ask you to find no liability.

992
00:57:59,480 --> 00:57:59,980
Thank you, guys.

993
00:58:00,100 --> 00:58:02,180
And thank you, everybody here who's participated today.

994
00:58:05,080 --> 00:58:06,040
All right, y'all.

995
00:58:06,320 --> 00:58:07,480
One last time.

996
00:58:07,540 --> 00:58:08,460
Let's give it a shot.

997
00:58:09,460 --> 00:58:17,820
So basically, in order to find the wonderful Silas Cutler here liable to the telecom company for, remember, millions of dollars,

998
00:58:18,860 --> 00:58:24,680
you all need to figure out if it is 51% chance likely that he aided and abetted.

999
00:58:24,860 --> 00:58:26,580
So make sure that you factor that in.

1000
00:58:26,640 --> 00:58:29,420
It doesn't have to be beyond a reasonable doubt like a criminal case.

1001
00:58:29,480 --> 00:58:30,520
It's 51%.

1002
00:58:31,300 --> 00:58:31,820
All right.

1003
00:58:32,440 --> 00:58:33,360
How do you feel, Silas?

1004
00:58:34,220 --> 00:58:35,140
Feel good about your chances?

1005
00:58:35,460 --> 00:58:35,800
I don't know.

1006
00:58:35,900 --> 00:58:36,260
No?

1007
00:58:36,440 --> 00:58:37,660
Looking great.

1008
00:58:41,340 --> 00:58:43,340
I don't want to bias the jury now.

1009
00:58:46,180 --> 00:58:46,800
All right.

1010
00:58:46,880 --> 00:58:47,400
Let's take a look.

1011
00:58:47,480 --> 00:58:48,200
Just like how awesome they are.

1012
00:58:52,620 --> 00:58:53,380
All right.

1013
00:58:59,480 --> 00:59:00,260
You got it.

1014
00:59:00,260 --> 00:59:00,700
Got you, family.

1015
00:59:01,240 --> 00:59:01,760
30%.

1016
00:59:04,300 --> 00:59:04,820
Wow.

1017
00:59:08,960 --> 00:59:09,920
All right, y'all.

1018
00:59:10,120 --> 00:59:11,520
400 of y'all have voted.

1019
00:59:11,700 --> 00:59:16,620
And with a majority 65 to 35, Silas is not guilty.

1020
00:59:17,100 --> 00:59:17,400
Yes!

1021
00:59:23,960 --> 00:59:25,680
Thank you, members of the jury.

1022
00:59:26,620 --> 00:59:29,460
Thank you, guys, so much for participating in Haggard Court today.

1023
00:59:30,280 --> 00:59:31,440
Really appreciate it.

1024
00:59:31,500 --> 00:59:34,700
Thank you all to the participants who have played and our wonderful defendants.

1025
00:59:34,760 --> 00:59:36,000
And have fun at closing, y'all.

1026
00:59:36,820 --> 00:59:38,220
I want to get the participants to wear their sunglasses.

1027
00:59:38,400 --> 00:59:38,760
Bye.

1028
00:59:38,800 --> 00:59:39,080
Bye.

1029
00:59:39,100 --> 00:59:39,320
Bye.

1030
00:59:39,360 --> 00:59:39,720
Bye.

1031
00:59:39,900 --> 00:59:40,260
Bye.

1032
00:59:40,260 --> 00:59:40,440
Bye.

1033
00:59:40,440 --> 00:59:40,480
Bye.