Hi, y'all. I'm gonna move over here because I'm short as hell. Hi, everyone. Welcome, everyone, to Hackercourt. This is the last thing before closing. I swear we'll make it as entertaining as possible.
But a little bit about me. My name is Winona. You can call me Win. I used to be a threat intel analyst, malware analyst, and now I'm in law school because I love suffering.
Thank you. Thank you. But what I really care about is protecting hackers from liability. And so our goal here is basically to do two scenarios that are really close to something that, like, almost happened in real life a couple of times.
And we're gonna go through the legal arguments, and we're gonna try and make this as technically and legally accurate as possible so that way we can play this scenario out.
So here's how this is going to go.
I have three apps.
These are actually amazing lawyers who are going to give opening remarks, call witnesses who are gonna swear on our Bible, POC, or get the fuck out.
And basically they're going to argue, like, a real court case.
And, you know, in, like, 20 minutes.
This is more like Judge Judy than, like, anything, like, real, like, so don't worry about it.
So I'm gonna call the court to order, and we're gonna do this twice.
Two, like, little mini trials.
I want to thank a whole shitload of people.
I know there's so many people on stage.
But first off, I want to thank my two organizing partners, Emma Planky and Mari Dugas.
They are amazing, badass women in cyber law.
And then I also want to thank all of our participants.
Many of them are lawyers.
All of them are hackers.
And all of them also care about making sure that y'all stay the hell out of trouble.
So the last people that I want to thank, though, are also the original lawyers.
Founders of HackerCourt.
So this actually was a thing at Black Hat from 2001 to 2010.
Tech has changed.
The law has changed.
DEFCON and Black Hat have all changed.
So we've decided to revive it, give a little fun twist to it.
But thank you, Dan, Carol, Jonathan, for giving us your full support.
Okay.
So I'm gonna call this court to order, y'all.
Our first case is United States versus John Doe Researcher.
And we're gonna say John Doe for a reason.
So this individual, basically what they did was find a kill switch in a warmable ransomware variant.
And then try to deploy that kill switch at scale, which bricked a couple of victim machines.
Oh, my God!
Y'all, get out of here.
Oh, my God.
I'm gonna cry on main stage, y'all.
But I say John Doe for a reason.
And I want a volunteer.
Does anyone want to get up here on the stage?
We can do shot the noob.
You don't have to do shit.
You just have to sit here and play our defendant.
Let's do...
All right, you.
You're the one standing.
Yeah, yeah, yeah.
Come on, come on.
Sit.
Give him a hand, folks.
Yeah.
Please.
Here's a participatory gift.
Look at you.
This is an actual speaker ops badge.
Thank you.
That's it.
Oh, shit.
That's cute.
I mean...
Great.
All right.
So what's your name?
Jamba Juice.
Jamba Juice.
Great.
All right.
All right.
Shot, man.
Please.
All right.
So in the case where the government is accusing you of committing a egregious hacker computer
crime, how do you plead?
Guilty or not guilty?
You want to say not guilty?
Oh.
Yeah.
Not guilty.
Thank you, Jamba Juice.
All right.
I want to introduce our two lawyers today.
We have, first off, our prosecution.
Harley Geiger.
Hey.
Don't boo.
This is all just a simulation.
Hey.
Woo!
Hey.
Harley Geiger is actually a cyber and data protection lawyer at Venable and formerly
an in-house attorney and senior director at fucking Rapid7, y'all.
So please give him a hand.
Our defense lawyer.
Just as impressive.
We have Kurt Opsal.
Associate General Counsel for Cybersecurity and Civil Liberties Policies for the Filecoin
Foundation and he volunteers as a special counsel for EFF and the Coders Rights Project.
And he's been working to counsel and defend security hackers since DEFCON 13.
So please give him a hand.
Okay.
Two final things.
Very, very serious, though, before we get started.
The first is we're not your lawyers.
We are just lawyers.
So please, this is not legal advice.
And then the second is we are working off scripts.
We're hackers, not actors.
And you know, I see some hungover faces in the audience, too.
So cannot confirm or deny.
But can relate.
Great.
All right.
Prosecution.
Please begin with your opening statements.
All right.
Good afternoon, DEFCON jury.
Good afternoon.
We are here today because in August of 2023, Mr. Jamba Juice intentionally transmitted
a program over the Internet that damaged a large number of businesses, including a hospital.
Because of Mr. Juice's actions, the Nevada branch of the St. Grace of the Unbothered
hospital was knocked offline for three days.
All right.
Well, Mr. Juice, who works in health care, knows that a hospital without systems for
three days is an absolutely catastrophic event.
And in fact, St. Grace had to reroute patients to hospitals on the other side of town.
So the fact that no one was killed in this incident is a stroke of luck and a testament
to the great skill of our medical professionals.
But nonetheless, the patient care of people who are sick and injured and suffering, that
patient care was delayed as a direct result of Mr. Juice's actions.
So here is what Mr. Juice did.
As we all know, earlier this year, an international criminal organization released the ego worm
across the world.
And this created a global security incident.
Wherever the ego worm went, it exploited a vulnerability to insert ransomware into the
host system.
And as a worm, it spread from network to network at breakneck speed.
And so thousands of organizations were in the midst of responding to this incident.
They were working with law enforcement.
They'd activated their IR plans.
They were scrambling.
The last thing that anyone needed was another loose cannon.
And yet, Mr. Juice independently created a program in his home lab and released it upon
the world.
Mr. Juice's program was intended to be a patch.
And this patch exploited the same vulnerability that the criminal organization used to propagate
the ego worm.
And the patch itself acted like a worm.
And so Mr. Juice designed this patch to forcibly apply itself to every computer within the
internet connection within reach.
And so Mr. Juice's patch spread indiscriminately, as it was designed to do, impacting everything
from manufacturing plants to hospitals like St. Grace.
Yet the patch was also seriously flawed.
It got out of control and caused some systems to crash, including St. Grace's hospital systems.
So we will hear from the defense that Mr. Juice did not intend for this to happen, that
Mr. Juice was trying to help.
And indeed, there is no doubt about that.
There is no evidence that Mr. Juice wanted to harm businesses or to disrupt hospital
systems.
However, Mr. Juice did intend for that program to go everywhere and to forcibly apply itself
to every system that it came into contact with.
What else did Mr. Juice want?
Fame.
Notoriety in hacker circles.
How do we know this?
Well, we will hear evidence that a mere two weeks after the incident, Mr. Juice was bragging
about it on stage in Las Vegas.
Could this have been avoided?
Was there a way that Mr. Juice could have acted differently and avoided disrupting systems
like St. Grace's hospital systems?
Probably.
But the evidence also shows that Mr. Juice made no effort to coordinate with the vendor,
the manufacturer of the operating system, made no effort to coordinate with law enforcement
or with anybody who was actively trying to defend against this attack.
Why not?
Because Mr. Juice was chasing clout and wanted glory for themselves, and that kind of selfish,
recklessness puts everybody on the same page.
It puts everybody at risk.
It puts the entire infosec community at risk.
Not to mention the people who are on the other end of those hospital systems.
And that is why we have a responsibility to bring this case against Mr. Juice.
Not for trying to help, but by forcibly applying that patch to every computer within reach,
Mr. Juice's program impaired the integrity and the availability of systems without authorization
causing harm.
So accordingly, we charged Mr. Juice with one count under the Computer Fraud and Abuse Act.
1030A5A, of knowingly causing the transmission of a program, and as a result, intentionally
causing damage without authorization, as well as 1030A5B, intentionally accessing a computer
without authorization and recklessly causing damage. Thank you very much.
Thank you, Paul. Thank you, Prosecution. Yeah, all right. Defense Counsel?
Thank you, Your Honor, and thank you, members of the jury. Good afternoon. I would like to start
by reminding you that it is not a crime to be a good Samaritan. In fact, Mr. Juice is a hero.
The eager worm was a threat to our national security and was holding countless businesses
hostage. Who knows how many days they would have gone by before this hospital was next.
My client does not deny that they didn't coordinate with law enforcement,
but law enforcement,
was too slow to react in the face of the destruction unfolding across the world from this worm.
From this worm, not from my client. Coordination would have lost invaluable time essential
to addressing this crisis. Yes, there was some damage. However, was it intentional?
No. Mr. Juice was trying to fix this vulnerability, not brick computers. Was it reckless? No.
To be reckless is to be...
consciously disregard a substantial and unjustified risk. How could that...
How could that have happened? How could a reasonable person have foreseen the patch
would spread to this one hospital which happened to be running Windows XP?
And that that patch would cause a blue screen of death on the particular operating scene?
Even if this were a substantial risk, Mr. Juice wasn't aware of this.
And that can't possibly be characterized as intentionally disregarding it.
Finally, was there any access to begin with? Mr. Juice didn't know which computers the patch would propagate.
How could Mr. Juice have knowingly and intentionally accessed any of them?
Moreover, Mr. Juice did not access any of the computers. The worm did. The ego worm.
They lost control of it after it was deployed. That's how worms operate.
The affected computers did not do so much as ping back to the client. At no point,
Was any of the information on these machines available to Mr. Juice?
No access.
Also, it's important to remember that nobody died.
Were hospital systems down?
Yes.
Is my client worried about the general welfare of all patients and how they had to be rerouted?
Of course.
However, was the hospital able to get back up and running?
Also, yes.
So remember, intentional, reckless access.
These are the three things the prosecution has to prove,
and today you will find, members of the jury,
that they will not be able to prove this beyond a reasonable doubt.
Thank you.
All right, all right, all right. Come on, come on.
Thank you, Defense Counsel.
Prosecution, please call up your first witness.
I call Ian.
Ian R., expert researcher, to the stand, please.
All right, Ian, please take a seat.
The man in the Adidas tracksuit and bucket hat, expert, please.
Do you swear on this POC or GTFO to tell the truth, nothing but the whole truth?
Yeah.
Please have a seat, Mr. R.
Okay.
Okay.
Can you state your name and occupation, please, Mr. R.?
Sure.
My name is Ian.
I am a security researcher and organizer of the Pony Awards.
Okay.
And can you tell me what this slide is, Mr. R.?
That is a screen cap of the CVE page for the Spen Ego Vulnerability.
Okay.
And can you tell me when was the first time that you know that this Spen Ego Vulnerability was used in the wild?
It was used by a criminal group.
It was used in August of 2023 to spread warmable ransomware.
So the vulnerability was used by cybercriminals to spread ransomware.
Was this the famous ego worm that threatened multiple industries and extorted hundreds of U.S. businesses?
Yes, the ransomware in question was the ego worm.
Okay.
And so the vulnerability that you see here, would you characterize this as very dangerous to exploit, Mr. R.?
Objection.
Leading.
Overruled.
It's relevant.
Ian, please.
Please answer.
It's bad.
Yeah.
So the vulnerability is very bad.
When was the second time that this very bad, very dangerous Spen Ego Vulnerability was used in the wild?
It was used by a researcher a bit afterwards to install a kill switch in vulnerable systems so the ego worm would no longer work.
Thank you.
But just to be clear, does that mean that the researcher exploited?
Yes, he exploited the same vulnerability that you just described as very dangerous, very bad, as the criminal group, so that the researcher could then install their own software into machines that the criminal group was already extorting.
Is that what you're saying, sir?
Yes, but the researcher's software was to stop the criminal's ransomware worm.
That's what a kill switch is.
And this kill switch software from the researcher, is it designed to spread on its own?
Yes, it's a wormable patch.
What does that mean, sir?
That it can spread from system to system without the control of the software developer.
Okay, so it spreads from system to system without the control of the developer.
And so for this to work, the researcher had to exploit that Spen Ego Vulnerability.
So the exploit that the research used, is it stable on every kind of machine, Mr. R?
No.
The particular exploit was stable for every version of Windows back to Windows 7, but not for anything older than that.
So the researcher was using this very dangerous vulnerability, and it's not stable on every type of machine.
When we say that an exploit is not stable on this older type of machine, what happens?
If the exploit is unstable for older versions of Windows and tries to run on a Windows XP machine,
the exploit can effectively malfunction and cause a blue screen of death.
A blue screen of death, and is this an example of a blue screen of death?
Unfortunately, yeah.
And when you're machined...
Injection, that's not Windows XP.
That's a fuck up.
That's a mess up on the judge's part, whoops, but yes, we will be excluding this from evidence, apologies, prosecution.
Mr. R, when a computer encounters this dread and eldritch screen,
what happens?
What happens to the computer?
Uh, it, it breaks.
Okay, so, so the machine can't run, people can't use it when, when this happens.
Excellent.
I want to just make sure that we have this correctly.
There is a vulnerability in the operating system that a ransomware group was using to spread the ego worm,
and that same vulnerability can be used to install a kill switch that stops the ego worm.
However, if it's an older version of the operating system, the kill switch will shut down the machine,
make it inoperable, is all that factually correct?
Uh, yes.
Okay, thank you, your honor, I have no further questions.
Wonderful, defense counsel?
Mr. R, can you describe how the ego worm ransomware worked?
Yes, um, the ego worm has three parts, uh, the exploit, the loader, and the post exploitation payload.
Uh, the exploit code exploits the span ego RCE vulnerability, allowing the attacker to run arbitrary code on a vulnerable machine,
the loader then runs certain checks against the environment, making sure that the machine is an okay target,
in this case, that included seeing if a certain registry key is set, uh, which would let it know that it had already hit that box before.
Uh, if the registry key isn't already set, then the loader would then execute the payload, and that would, uh, encrypt all the files on the box,
and then go hunting throughout the network in order to find other vulnerable machines to propagate to.
Uh, all these stages are packaged together, so that the worm can't run.
The worm could spread without having to rely on connecting back to a C2.
Thank you. And how did Mr. Juice's patch work?
Uh, the patch worked by just setting the registry key that the ego worm looks for prior to exploitation.
Uh, the worm would think that it had already infected the patch machine, and it wouldn't exploit or spread from there.
So you refer to both the ego worm and Mr. Juice's patch as being worms. What does it mean to be a worm?
Uh, it...
It means the program is self-propagating. Uh, it spreads on its own without the operator needing to do anything to keep it going.
And these worms, is it correct to say they are spreading themselves using the same vulnerability?
Uh, yup.
So, in order for the systems at St. Grace the Unbothered to be patched by my client's program, they would also have to be vulnerable to the ego worm, correct?
Uh, yes.
Why did my client's patch reach the systems at St. Grace before the ego worm did?
Um, there's nothing in either program that looked for particular targets beyond just being exploitable by SpendEgo. Uh, it was just luck.
Luck. That's interesting. And what would have happened if the ego worm hit St. Grace before Mr. Juice's patch?
Objection, Your Honor. That's irrelevant.
Overruled. Um, please, uh, Ian, please respond.
Uh, if the ego worm hit first...
The hospital's data would have been stolen. Uh, the machines would have been locked and ransomed. Uh, many more would have been bricked for longer, and they would have had to pay the ransomware group in order to get the decryptor.
And what happened to other companies' stolen data after being hit by the ego worm?
Uh, those that didn't pay the ransom had their data leaked online, uh, available for anyone who knows how to look for it.
So it sounds like my client...
Sustained, you're right. Uh...
That was literally my next line.
Yes, sustained. Um, let's move this along, defense counsel, and thank you, prosecution and whoever that was.
All right, all right. One final question, Mr. R. Have you analyzed my client's patching program?
Would you say that Mr. Juice, in a technical sense, had access to any of the computer that it's read Mr. Juice had access?
Uh, not really for most of them. They had access to the first box.
Uh, they pointed it at when they kicked it off, but that was one of their own computers.
After that, uh, didn't build any kind of telemetry into the program, so there wasn't any way that they could have known where it was spreading while it was spreading.
That will be all. Thank you.
Thank you, Mr. R. You may leave the witness box.
Uh, defense counsel, please call up your witness.
Thank you. I call Ian R., Pony Award organizer.
Oh, Ian, that's actually you, though.
Um...
Great. Um...
Oh, yeah, you're right. Yeah, okay.
Uh, do you swear to tell the truth, the whole truth, nothing but the truth?
Once again, yes.
Okay, great.
Mr. R., thank you for joining us today.
Can you start off by telling me what a Pony Award is?
Uh...
It's a, it's a little statue of a horse that you get for being a good hacker.
Well, uh...
Sorry? Can, wait, say that again, please?
It's a statue of a horse that you get for, uh, being a really good hacker.
Okay.
Is it true that on August 10th at approximately 6 p.m., my client received a Pony Award?
Uh, yes.
And what was the category?
Uh, Epic Achievement. It's a catch-all category for work that pulls off something, uh, so truly epic that we couldn't have predicted it by creating an award category that would do it justice.
And, and why did Mr. Juice receive this award?
Uh, I don't know. He prevented a bunch of bad shit from going down.
Um...
The, the initial patch blew up on Twitter, and we needed to fit it somewhere.
Uh, the hospital thing hadn't come out yet, so we didn't know that they had, uh, fucked up.
No further questions.
Prosecution?
Mr., Mr. R., um...
You had just said that you gave that award to Mr. Juice.
Uh, and you didn't know that the hospital thing, uh, the hospital thing hadn't come out yet, and so we didn't know that they had fucked up.
What, what...
What did, what did you mean by that?
Uh, they, they fucked up a hospital.
It was very bad.
So the same person that got the award had fucked up a hospital prior to you knowing about, uh, you know, prior, and you didn't know about this at the time that you gave them the, the award.
If you had known about this incident ahead of awarding the ponies, would, would Mr. Juice still have gotten the Epic Achievement Award?
Uh, no.
So...
Oh, don't boo!
What would Mr. Juice have received instead of, of that award for fucking up a hospital?
Probably an Epic Fail Award.
And, and an Epic Fail Award is for what?
Uh, for, uh, failing epically.
So, Mr. R., uh, going, going back to the day of this, of the award ceremony, did, did, uh, Mr. Juice accept that award in person?
Uh, yes.
And did Mr. Juice make any remarks at the time accepting the award?
Uh, he said he did it for the lulz.
Sorry, can you repeat that please for the record?
Uh, the lulz, your honor.
And, and sir, what is, what is your interpretation of the lulz?
Objection. That's speculative.
Sustained. Prosecution, please rephrase.
Okay. How would you characterize Mr. Juice's demeanor when he was accepting the award?
Uh, very smug. Uh, like the whole thing was for laughs.
Like the whole thing was for laughs. Thank you. No further questions.
Alright.
Your honor, I would like to put the defendant on the stand.
Oh, Mr. Juice. Oh, well, please take the seat in the witness box.
Alright.
Alright. Do you swear on the POC or DTFO to say the whole truth, nothing but the truth?
As he said, yes.
Great.
Yes.
Uh, thank you.
Thank you.
You said in prior testimony, Mr. Juice, that you tested your patch on all the machines you had available.
If you look at the slide here, uh, if you look at the slide here, you'll see your home lab's extensive list.
Would you say that this was an extensive number of machines, even for a home lab?
I mean, it looks a lot better than a home lab, let's be honest.
Let me just start there.
Yes.
Okay.
But yes.
Very extensive.
Very well done.
Thank you, by the way.
And, yeah.
I think that answers your question.
Thank you.
Thank you.
And do you also note that on there, there is a Windows XP machine still on here, the same operating machine as the hospital, Mr. Juice?
Would you also say that it's impossible to test PSOR on every different variant of every different machine?
Uh, you know, let me ask ChatGPT really quick, and I'll get back to you on that one.
Alright.
Before the defendant perjures himself, I'm going to say that was a yes.
Wait, wait.
No, no further questions.
Great.
Thank you, Mr. Juice.
Uh, defendant, you may sit back down.
Please give him a hand.
Please give your closing final arguments, please, counsel, starting with prosecution.
Hackers of the DEFCON jury, let's review the evidence that we've heard today.
So, to carry a verdict against the defendant, there are certain elements that we have to prove.
Uh, first, that Mr. Juice knowingly caused transmission of a program.
Uh, we heard evidence that Mr. Juice knowingly transmitted the program, right?
Uh, it was intentional.
It's not an accident.
I think that this is well, well accepted and uncontested.
But second, that Mr. Juice intentionally or recklessly impaired the integrity and availability of systems without permission, right?
Without authorization.
Without authorization.
We know that Mr. Juice created a program that was intentionally designed to spread to different computers rather indiscriminately and automatically and to access those computers and install itself on those computers without the permission of the computer owners.
And when it comes to disruption, we know that, uh, by forcibly accessing and running code on these computers, Mr. Juice's program impaired the integrity and the availability of those systems, right?
So, those are the elements that we have to prove.
I understand very much that there may be an impulse to exonerate the defendant, uh, because of the defendant's good intentions in attempting to halt the ego worm.
However, whether the defendant had good intentions is, is actually irrelevant for the elements that we just discussed.
Uh, you can have good intentions and still break this law.
The question is, did you intentionally submit the, uh, transmit the program?
Would, was it intentionally going to disrupt the systems by forcibly applying itself?
That was what the, the, the patch was designed to do.
And were the defendants intentional?
Were the defendants intentions really good?
The evidence suggests that the defendant was actually chasing glory for his own personal gain.
And that type of behavior puts the entire security community at risk.
We lose trust if that is our reputation.
Whether the defendant intended to take down the St. Grace Hospital computers is also irrelevant.
The question is, did the defendant intend to impair the integrity and availability of the systems by forcibly installing unauthorized and untested software into the computers that don't belong to him?
And if you believe that the answer to that is yes, then I humbly submit that that should lead to a verdict of guilty.
Thank you.
Thank you, prosecution.
Defense counsel?
Thank you, your honor.
Members of the jury, who here does not aspire to use their infosec expertise to make the world suck a little bit less?
The only thing, the only thing my client may be guilty of is an overzealous application of their elite hacks for talents in service of the world.
The only thing Mr. Juice ever intended was to mitigate harm.
Sure, that St. Grace systems were affected is an unfortunate and unforeseeable consequence of this attempt to save the world.
But I remind you that no one has died as a result of this incident.
And in fact, further harm by the Eagle World was mitigated.
Is it fair to say that Mr. Juice was reckless?
No.
He made every attempt to test this patch given the resources he had available.
Sure, given what we know now, Mr. Juice's choices may seem less favorable in retrospect.
But with the information available at the time, can it really be said that he did this with a conscious disregard of the risks?
When tested, the patch worked.
And the long time that Mr. Juice spent testing, the further he knew the Eagle World would spread.
My client did not act recklessly.
He made a calculated, risk-informed choice during a time when there were no other good options.
Mr. Juice does not deny that his code ran on St. Grace's computers.
However, is it fair to say he accessed these computers?
No.
The prosecution would have you think that authoring code that runs on a computer is enough to say that you have access to it.
I disagree.
At what point would that happen?
Will that argument end?
Surely the contributors to open source projects whose code gets indirectly bundled into products cannot be said that they have access to every machine on which that project runs?
I ask each of you to look into your hearts.
Ask, when you look at Mr. Juice, do you see a clout-chasing criminal?
Or do you see a reasonable person doing their best under enormous pressure
and helping save everybody from this horrible ransomware attack?
Thank you.
Give our prosecution and defense a hand, folks.
Okay, so here's how this is going to go, and it's going to go fast.
Y'all are actually our jury.
So, please, I promise this is a safe QR code.
Ha, ha, ha, like putting a QR code on DEF CON, whatever.
But I'm going to give y'all 60 seconds and give me a verdict.
And I have a timer here.
And we're going to figure this out.
Is he guilty or innocent?
Remember, this has to be beyond a reasonable doubt.
So, if there is even a little bit of a doubt that he is not guilty, you've got to choose not guilty.
Thank you.
Yeah, I mean, not usually, but...
Not guilty.
Do the jurors have questions?
No.
.
Are we allowed to mention jury documentation?
There's a yes option and a no option.
I would appeal to those jury instructions.
I specifically said intent to harm was not .
Would you like to have a unanimous vote?
Y'all, what do you think we're here for?
We're just here to have fun, okay?
You're at the malicious compliance convention, respect.
I'd say, for the record, I would appeal those jury instructions.
Look, we have the motions of the jury instructions in your law, so you got to accept
that and take your appeal later.
I will.
I will.
But I specifically said that intent to harm was not one of the elements.
It is not.
You do not have to have intent to harm in order to commit a CFA violation.
That's true.
That's true.
Well, if it was a...
This is a little bit of a kangaroo court.
Let's be real about it.
This is exactly how it works.
Yeah, this is...
Well, actually, opportunities in the law are very, very...
Oh.
Just...
No.
All right, y'all.
A minute is up.
Now that over 500 of y'all have voted, which is insane.
How many of y'all are voting twice?
Hey, stop it.
70 to 30%.
Not guilty.
Defendant, you are free to go.
Shocker.
Please, take a seat.
Thank you.
Thank you.
Thank you.
Thank you.
Congratulations, Mr. Juice.
Thank you, Mr. Juice.
All right.
We have one more scenario for y'all today.
And I do want to point out, unfortunately, the legal part of my brain is this probably
wouldn't have turned out this way from a legal perspective.
This is probably access and it is probably intentional if we wanted to argue that.
But, all right, scenario two.
We have our telecom company versus an offshore company.
So, we're going to get a little bit spicy in here today, guys.
This is a state civil lawsuit, which means that the telecom company is suing the offensive
startup.
Yeah.
Okay.
So, here's what went down.
An offensive security startup produced and created an exploitation and pen testing tool
for legitimate purposes.
This was then cracked and sold on a criminal forum and used its initial access to get in
to and exploit, extort the telecom company.
Telecom company can't sue the ransomware group, but they can definitely sue or try to sue the
U.S. offset company.
So, I know, it's a lot of walking up here.
So, our plaintiff's counsel is the wonderful Mari Dougas, representing, oh, sorry, excuse
me, who's a cyber data and privacy lawyer at Cooley and formerly worked at Harvard Belfer
and the office of the staff judge advocate at U.S. Cyber Comm.
And we welcome back our defense attorney because defense attorneys are overworked and underpaid.
Kurt, please give him a hand, folks.
And I love y'all, but remember, all of us lawyers up here do firmly believe, even the
prosecution in all of these cases, believe that we want to be here to protect hackers.
So just, we're all people, so.
All right.
Last but not least, our defendant, as much as we'd love another volunteer, our defendant
now is Silas.
He is playing, come on up, Silas.
Fellow goon and just wonderful general human.
He is playing the part of the CFO of the offset startup company.
Oh, my God.
Yeah, you're first.
Great.
So, Silas, in this case where the telecom company is suing you for millions of dollars of damage,
do you choose to defend your startup in court?
Yup.
Great.
All right.
So, are you sure?
Yup.
Are you sure?
Let's go.
YOLO.
All right.
Great.
So, plaintiff's counsel, please begin your opening remarks.
Ladies and gentlemen of the DEFCON jury, thank you for joining us here.
We are here today because Mr. Silas aided and abetted a criminal ransomware gang group
who caused my client millions of dollars of damage.
The defendant is a youth.
He has no experience.
He decided to create an offensive security tool and just pursued profit.
A criminal ransomware gang group cracked his tool and used it to perpetrate a ruthless ransomware attack on my client on July 13th, 2023.
Our client's systems were inaccessible for six hours.
The attackers encrypted my client's networks and systems.
They exfiltrated data, including our Q4 financial predictions, which tanked our stock.
And, ultimately, our forensic investigation determined that the cracked entry-level tool was the initial point of access.
So, today, we're here to talk to you about what aiding and abetting really means.
The defendant aided and abetted a count of 18 USC-1030-A5s.
We've already talked about today.
The Computer Fraud and Abuse Act caused property damage to my client under the common law of our state.
Today, we'll talk to you about proving that with the preponderance of the evidence, only 51%, you can have some doubt in your mind,
that the party whom the defendant aided performed a wrongful act, our ransomware gang.
We all agree on that.
That the defendant was generally aware of his role in an overall unlawful scheme.
And, he knowingly and substantially assisted in that scheme.
There was property damage.
There was an injury to my client from a ransomware attack.
We can all understand that that is an unlawful act.
And, the defendant was generally aware.
Our expert witnesses today will show that the defendant knew that his tool was not only being purchased by ransomware gangs in general, but this specific group.
And, he didn't decide to take action until the FBI.
The FBI came knocking at his door.
Had he conducted more diligence, we wouldn't have been in this situation.
Finally, he substantially assisted in the wrongful act.
Because, without this offensive security tool, this wouldn't have happened.
It was the only initial point of access.
We understand here that offensive security tools do have legitimate uses.
But, they have the capacity to be weaponized by these bad actors.
And, defendant played in to their bad acts.
And, defendant played in to their bad actions.
Thank you.
Thank you, Martin.
Defense counsel.
Members of the jury, there are two sides to every story.
Plaintiff's counsels painted a picture of reckless kids creating offensive security tools just to make money selling it to everyone from companies we all know.
It goes to sometimes gets in the hands of criminal enterprises.
The reality, significantly less cinematic.
Defendants are five security professionals with almost ten years of cumulative experience between them.
Defendants all graduated from top universities with computer science degrees.
Were hired by top security companies.
And, my client right here, Silas, is a seasoned security expert.
A consummate professional.
Defendants all moved through the ranks of these companies before seeing a gap in the product that they could fill.
A better cobalt strike.
A sleeker metasploit.
Plaintiff's counsel will try to convince you that my clients aided and abetted an alleged criminal activity.
What is the criminal organization that repurposed this tool for bad uses?
We don't extend liability to a store owner who sells the robber a hammer he uses to break the window.
Why would we do that here?
Indeed, my clients are also victims.
A bad actor hoodwinked them, purchased the entry level by pretending to be someone they weren't,
and repurposed it for nefarious uses, committing a crime against my client.
Off-sex startup was not genuinely aware of their role in this specific criminal activity at the time they sold the tool to the alleged ransomware gang.
And they did not knowingly or substantially assist in any violations.
Just because my clients were aware generally of potential malicious uses of their legitimate product
does not make them liable for everything that happens downstream by victims of people who are misusing that tool.
My clients were not even aware that the ransom gang was a buyer.
My clients have also fully cooperated with U.S. law in due diligence
and all of the ransomware investigations.
But the telecom company still wants to sue.
They seek to create new liability for everyone in infosec with no basis in law.
If plaintiffs succeed with their claim, the entire infosec industry will be open to enormous liability.
Think of all the dual-purpose tools that you use every day.
Metasploit, Cobalt Strike, even Shodan or other scanners
may not be safe from this legal theory.
This court has an imperative to dismiss the case
or else we will all pay the consequences.
Thank you.
Thank you, counsels.
Alright, chill out, man.
Alright, plaintiffs' counsel, please call up your first witness.
I'd like to call Silas to the stand, please.
Yeah, Silas, please.
Do you swear to tell the whole truth and nothing but the truth?
Yes.
Great.
Sit.
All set there?
I think I'm good.
Alright.
Could you please state your name and your occupation, please, for the record?
Hi, my name is Silas Cutler.
I'm the CFO and co-founder of Offensive Startup.
We're offering a 15% discount if you use the code...
Hey, hey, hey, hey, hey, hey!
Stop it, stop it!
I'm sorry.
It's my first time on the stand.
Silas, we talked about this.
Mr. Silas, could you please tell me what's on the slide?
This is a screenshot of a chat that I received from a security researcher.
And, yeah, we were able to obtain that from you in discovery,
but can you walk us through what the messages are about, please?
Well, you can all read.
The guy basically told us that he found a dark web post
about some ransomware gangs
and that it was a hacked version of entry-level for initial access.
How'd you react to that?
I didn't think too much about it.
We get hit up by security researchers every few weeks about this kind of stuff.
I told the CEO, and we just kind of moved on.
There's not much we could do.
So did you take the researcher's information, his message here, seriously?
Did you believe that ransomware gangs were actually using your tool for initial access?
I guess so, yeah.
It happens with other security tools.
So I didn't think he was lying or anything.
It just didn't end up being a priority issue for us.
All right, next exhibit.
Same question.
Can you walk us through what this chat is?
Who's who?
I'm trying to remember.
This is our internal offset chat from 9 July.
Yeah.
And I'm the gray chat and the CEO is the blue.
So why did you send that initial chat message?
So I had gotten a weird-looking purchase order request, a PO, just written in bad English,
and it came at a weird time of the night.
Not that we don't check orders from out of the U.S. or anything, but something looked off to me.
My due diligence checks came up with nothing.
I Googled the guy's company and couldn't really find anything.
That was weird, too.
So I told the CEO.
And when you told the CEO, did he seem concerned about this?
Nah.
He said, except the PO, we get weird requests all the time.
It also could have just been a small company.
Well, in the next line, it looks to me like you expressed some concern about the researcher's message.
You mentioned that one.
And you just told us that you weren't worried.
You get these messages all the time.
But yet you told the CEO, and I quote, we don't want entry level to be used for an actual attack.
So did you or did you not take the threat seriously?
I mean, sure.
Again, I don't want anyone to get hurt.
So of course I raised it with the CEO.
But stuff like this happens all the time.
Sometimes due diligence comes up with nothing.
And we have to make a call.
So what did you do to investigate further?
You had suspicious order activity.
What did you do beyond your minimum requirements?
Nope.
Just that.
All right.
All right.
Let's move on to the next exhibit, then.
So what's on this slide?
Looks like a dark web, a post from a dark web forum.
I think it's accessibility.
CSS.
Yeah, that's right.
Describing the ransomware gang's use of entry levels specifically.
Were you aware of this post?
Yes, I think I've seen it before.
That's a yes?
Yes.
All right.
Sorry.
Yes for the record, please.
So after multiple researchers had told you that your tool was being spread online.
Objective, projection, speculative.
Sustained.
And counsel, please ask a real question or proceed with exhibits.
Did you do anything with this information?
I don't remember.
But probably just referred it to the CEO.
This stuff happens all the time.
The bad guys take our product, crack them, and do bad shit.
It happens to everyone.
We can't control them.
We won't be able to run a business if I spend all day caring about what the bad guys do.
So I'm going to sum this up.
You were aware that ransomware groups have previously found and cracked your tool.
You get a weird purchase order that you approve.
And then the exact ransomware gang that attacked my client starts using a cracked version of entry level.
Did I get that all?
Yes.
Thank you.
No further questions, Your Honor.
Thank you, Plaintiff's counsel.
Defense, you may approach.
Thank you, Your Honor.
Silas, can you tell me what this is?
This is language our internal company export control policies.
It just says we're supposed to do due diligence on potential buyers.
Great.
Thank you.
And what is the OFAC sanction list?
Does your policy require you to run OFAC checks?
It's a list of entities that it's illegal for the U.S. companies to sell stuff to.
I mean, the policy doesn't explicitly say that we have to check OFAC, but we try to do it anyway.
Of course.
Great.
Are there other lists that describe entities you couldn't sell to?
Yes.
The Commerce Department has an entities list of people we can't sell to either.
Thank you.
Do you know if Shadow Crypt is on either of those lists?
They're on the OFAC list.
And how do you check these lists when you have a new buyer?
So, we check the information the buyer provides against two lists to make sure they're not on there.
And usually, I just run some quick Google searches, I work in this field, I know the names of the big players.
I'm not going to sell entry-level to Klopp, obviously.
So, is there anything else you are legally obligated to do in your due diligence process?
Aside from what I just said?
No.
No, it's not our job to research every company super in-depth to make sure they're legit.
So, would you say you're abiding by your due diligence requirements even when you sold to someone who ended up misusing your tool?
Yeah.
Thank you.
No further questions.
Thank you, Silas.
You may sit back in the defense, uh, defendant place.
Please call up your next witness, defense counsel.
Yes, my witness is an expert witness, Special Agent Smith from the FBI.
I swear, I'm tired of saying it.
I do, yes.
Great.
Thank you.
Could you state your name and occupation, please?
I am Special Agent Smith with the FBI Cyber Division, supporting the Ransomware Task Force.
And can you tell me when you first came across the entry-level toolkit?
I came across entry-level when Shadow Crypt started using it for operations over six months ago.
We got a tip that their newest initial access tool was made by a U.S. company, which happened to be entry-level.
And how does the FBI and DOJ investigate these tips?
Well, FBI tries to determine whether the U.S. company is actually perpetrating a crime, and then the DOJ decides whether they want or not to prosecute.
FBI will figure out what the company's role was in the overall ransomware incident.
Whether the tool was stolen or if they were willing to supply it.
It can be a little difficult because good faith security research tools and malware can sometimes have similar features and overlap.
And what is DOJ's policy for prosecuting good faith security hackers?
DOJ does not prosecute.
They have a policy where good faith security researchers won't be charged.
And can you define good faith security research?
Yes.
Good faith security research means accessing a computer solely for the purposes of good faith testing,
or investigation or correction of a security flaw or vulnerability.
All right.
Great.
Thank you, Agent Smith.
Now, if you'll look at Exhibit 2, which showcases a description of the entry-level toolkit.
It states, entry-level is a cutting-edge security penetration testing tool designed to help business identify and address potential weaknesses in their IT infrastructure.
This state-of-the-art software is your first line of defense against malicious attacks and data breaches.
Does that sound like good faith security research?
I mean, it's a little more complicated than that.
Yes or no?
Yes, based on the product description.
Sure.
Great.
Thank you.
Thank you, Agent Smith.
Did you ever approach my client, OffSecStartup, when you were investigating Shadow Crypt?
Yes.
And when you did approach my client for assistance with the investigation, when did you?
It would have been a few months ago after the test.
And what were you trying to ascertain?
We were trying to determine whether or not OffSecStartup willingly sold a criminal group the toolkit.
And did they fully cooperate with the investigation?
Yes, but we did have to.
Yes or no?
Yes.
Thank you.
So, two final questions.
Can you explain to me what cracked software is?
Cracked software is where you bypass a software license key check to use that software without paying for it.
Oh, that's interesting.
Isn't that illegal?
It is, yes.
And so, when Shadow Crypt was using the entry-level toolkit, were they effectively committing a crime against my client?
Sustained.
That's fine.
No further questions.
Uh-huh.
Thank you.
Plaintiff's counsel?
Thank you.
Special Agent Smith, thanks so much for your time today.
You're a subject matter expert in ransomware attacks, correct?
Sure.
Great.
So, can you walk us through how Shadow Crypt ransomware would have worked if they had not had entry-level to gain initial access?
Yeah, so that's a tough counterfactual, right?
They would have needed another point of entry.
There's plenty of other tools that they could have purchased on the dark web, but, of course, the success of those tools depends on the target systems and security.
There's no one-size-fits-all for these types of tools.
So, I'm hearing then the entry-level gave them unique access.
It did give them access, yes.
And you've worked in this space for a while.
As the CFO, our defendant, said before, there are a lot of companies who create similar tools.
Their tools have been cracked and repurposed by attackers.
This is pretty common.
Do you agree from your experience?
Yeah.
This is not a new phenomenon.
It is pretty well-known in the security community.
Have you worked with those other companies?
Many times, yes.
How does that work?
So, usually, those companies come in.
There's a few big players in the field, and we have rather productive working relationships with them.
They have often sophisticated threat intelligence teams and capabilities, so they'll hear about these tools that are being cracked by particular groups or talked about on forums like we saw earlier well before we do.
When they see that, they'll call me up, and then my team has some good leads to investigate.
In a best-case scenario, we're able to shut down some of those forums or trace the money to find who purchased the tools for those groups or even get a heads-up on the potential victims.
But none of that would happen without the companies reaching out to us and working with us proactively.
Is that industry standard, would you say, that proactive outreach?
If you're making an offensive security tool, then you'd be expected as the company to have a relationship with the FBI?
Yes.
Yeah.
It is pretty common.
So then it's reasonable to say that others in the same industry as offset startup regularly contact law enforcement to help limit this bad use of their cracked tools.
Yes.
Yeah.
It is pretty common.
I'm open about wanting companies to contact us.
I go to all the security conferences, particularly in Vegas, and hand out my cards, and we do call up companies proactively to build relationships.
Thank you.
And did OffSec reach out to you proactively?
Were they one of the companies who took your card at DEF CON?
No.
No.
We had to reach out to them after the CISA FBI alert was published.
Overruled.
It's definitely relevant.
Thank you.
Let's switch gears.
Are you familiar with this specific ransomware gang, Shadow Crypt?
Yes.
I've been tracking them for a while now and was familiar with their predecessor.
Any particular nuances that you've observed?
Yeah.
One trend that we see is they're a little bolder in their non-dark web activity.
They have some people who go out and make legitimate purchases of tools from companies directly.
And I've seen a few cases where they've made purchases using the last name Gray.
Great.
Can you take a look at this slide, please?
Can you confirm that these messages in the chat that we talked about with the CFO and the CEO reviewing this?
Yes, they do.
Thank you.
Would you have been able to tell OffSec any more about Shadow Crypt's TTPs if they had come to you for assistance?
Yeah.
We share TTPs all the time with companies.
That is my job.
Glad you do your job.
In your expert opinion, do sanctioned entities like Shadow Crypt frequently use real information
when they're purchasing tools?
Definitely not.
No.
No.
They often use fake names or shell companies.
Things like The Girl.
They use the Ray name to hide their tracks.
Thank you.
No further questions.
Thank you, witnesses and counsels.
We are running a little bit close to time.
So if the and DEF CON closing ceremonies are soon.
So plaintiffs, please proceed with closing arguments and make them quick.
We'll keep this brief.
In a civil lawsuit, we only need 51% of the evidence to convict this client, to find him, find the defendant liable.
There was an unlawful act.
The ransomware attack.
The defendant was generally aware of his role and his company's role in this attack at the time that they sold that tool.
And they knowingly and substantially assisted that violation because this was the unique initial point of access.
The case is clear.
He must be found liable and will make the telecom company whole.
DEFENSE, your closing remarks.
Thank you, Your Honor.
Members of the jury, this is an unprecedented case.
The plaintiff is asking,
I'm asking you to extend a theory of liability that could fundamentally destroy a critical component of the infosec industry.
My clients cannot foresee every action their customers take.
My client had no clear or direct awareness that entry level will be used by this particular ransomware gang in this particular attack.
That is not enough under aiding and abetting.
We reject these arguments by the plaintiffs.
Offensive security is an important, legitimate business.
And the outcome of this trial is important for everybody in this community.
By subjecting it to a broad liability, whenever a bad actor uses pen testing tools to enter into a system instead of protecting it,
we can't have liability for that or we won't have offensive tools.
We cannot ask these companies to predict the future.
So thank you.
I ask you to find no liability.
Thank you, guys.
And thank you, everybody here who's participated today.
All right, y'all.
One last time.
Let's give it a shot.
So basically, in order to find the wonderful Silas Cutler here liable to the telecom company for, remember, millions of dollars,
you all need to figure out if it is 51% chance likely that he aided and abetted.
So make sure that you factor that in.
It doesn't have to be beyond a reasonable doubt like a criminal case.
It's 51%.
All right.
How do you feel, Silas?
Feel good about your chances?
I don't know.
No?
Looking great.
I don't want to bias the jury now.
All right.
Let's take a look.
Just like how awesome they are.
All right.
You got it.
Got you, family.
30%.
Wow.
All right, y'all.
400 of y'all have voted.
And with a majority 65 to 35, Silas is not guilty.
Yes!
Thank you, members of the jury.
Thank you, guys, so much for participating in Haggard Court today.
Really appreciate it.
Thank you all to the participants who have played and our wonderful defendants.
And have fun at closing, y'all.
I want to get the participants to wear their sunglasses.
Bye.
Bye.
Bye.
Bye.
Bye.
Bye.
Bye.