[00:00.000 --> 00:00.740]  All right.
[00:00.980 --> 00:11.100]  Well, I'm glad to be here, because I gave a talk at the last HOPE, and at that time, I talked about all these people I'd warned about their vulnerabilities and said, it's fine, go ahead and do it.
[00:11.160 --> 00:12.940]  And right after that, I got in trouble.
[00:13.640 --> 00:18.820]  So I really need to amend all the reckless stuff I told you last time.
[00:18.960 --> 00:23.080]  So, I've been doing this for years, and I thought I'd quit.
[00:23.180 --> 00:26.460]  And then I looked back when I was preparing this talk and said, you know, I didn't really quit at all.
[00:26.540 --> 00:27.380]  This is like an addiction.
[00:27.540 --> 00:30.720]  Once you start telling people about their problems, you just keep on doing it.
[00:30.880 --> 00:36.600]  So, I mean, after the last one, I think I found this guy, 100,000 hits on Google, all vulnerable to SQL injection.
[00:37.160 --> 00:44.060]  And so I sent a message to the guy that made these websites and his customers, and he totally freaked out.
[00:44.540 --> 00:47.380]  Kind of said, the college told me they got to fire this guy immediately.
[00:47.800 --> 00:49.580]  And, you know, I got tenure.
[00:49.840 --> 00:51.660]  And this is just every semester.
[00:51.800 --> 00:54.700]  Somebody is screaming at the college that I must be fired or shot or something.
[00:55.220 --> 00:58.120]  And every... Now we keep on... Nobody's running our college.
[00:58.260 --> 00:59.780]  Nobody's been running for about a decade now.
[00:59.780 --> 01:03.320]  Just an endless chain of chumps sit in the chair and put on a hat and pretend to be the chancellor.
[01:04.100 --> 01:05.840]  And so they have no clue.
[01:05.940 --> 01:07.160]  Now they're just used to this fact.
[01:07.260 --> 01:09.840]  Well, I don't know who this sandbound guy is, but someone is all screaming at him.
[01:09.920 --> 01:10.460]  Just ignore it.
[01:10.640 --> 01:13.000]  So I'm particularly invulnerable.
[01:13.220 --> 01:17.300]  But anyway, eventually he did fix some of these.
[01:17.820 --> 01:19.320]  And then I started looking at colleges.
[01:19.380 --> 01:22.180]  I think I've done some of this before, but I did more of it again recently.
[01:22.380 --> 01:29.260]  If you go into colleges and just search for Viagra in EDU sites, you'll find all these Viagra cells at colleges.
[01:29.260 --> 01:34.420]  This is because... I've learned a lot more about it because one of our professors that I know got hacked.
[01:34.980 --> 01:39.140]  So if you would search for him on Google, click on his class and you go to a porn site.
[01:39.500 --> 01:42.040]  But if you actually type in a URL, you don't go to a porn site.
[01:42.120 --> 01:44.180]  And I finally got to go on the server and see the files.
[01:44.300 --> 01:49.060]  And these are done with PHP redirectors, which is what I thought, but I had never seen them before.
[01:49.160 --> 01:50.060]  And it's very interesting.
[01:50.180 --> 01:51.280]  Now I try to get samples.
[01:51.420 --> 01:53.240]  The stuff is obfuscated in a simple way.
[01:53.320 --> 01:54.480]  And it's easy to figure out.
[01:54.660 --> 01:55.600]  But anyway, that's what happens.
[01:55.660 --> 01:59.580]  If you have any PHP part of your file, they're typically some kind of file upload vulnerability.
[02:00.000 --> 02:03.460]  And they manage to put up files that redirect traffic from search engines.
[02:03.720 --> 02:05.080]  And that's SEO spam.
[02:05.640 --> 02:11.500]  The point of this is to become the top hit for people trying to buy Viagra from Google.
[02:11.680 --> 02:21.740]  And you do reputation theft of tricking some college website into forwarding to them so that it tricks the Google search bot into thinking that you have endorsed these products.
[02:22.040 --> 02:26.080]  So when I... in 2014, I told 19 colleges and some of them fixed it.
[02:27.300 --> 02:29.200]  And one of them was Maricopa.
[02:29.940 --> 02:34.960]  I didn't tell them... this is a case history which I used to try to put some pressure on UC Santa Cruz.
[02:35.240 --> 02:37.300]  UC Santa Cruz is by far the worst offender.
[02:37.420 --> 02:38.900]  They had thousands of infected sites.
[02:39.360 --> 02:40.860]  And they wouldn't do anything about it.
[02:40.860 --> 02:45.920]  And I contacted Jerry Brown, the governor, and a lot of people told him about Maricopa.
[02:46.020 --> 02:52.880]  Because we already looked through this in California when a college ignores a hack and lets it get worse until there's a real breach.
[02:53.060 --> 02:57.320]  And I said, you know, you really should do something about it because somebody now has the ability to upload files onto your site.
[02:57.540 --> 03:02.340]  And what they've done now is relatively harmless, just tailing Viagra traffic, but they could do anything.
[03:02.740 --> 03:07.840]  And so anyway, UC Santa Cruz did, after about two years, apparently improved their servers, and this wasn't so bad.
[03:09.380 --> 03:13.820]  But it was painfully obvious that like everyone else, they don't do any root cause analysis.
[03:14.060 --> 03:15.480]  All they do is re-image the servers.
[03:16.060 --> 03:17.820]  And most of the time, this just makes things worse.
[03:19.640 --> 03:24.900]  So I found a lot of other schools infected, notified a bunch of them, and some of them fixed it.
[03:25.240 --> 03:29.740]  And then largely because of what happened with... I'll tell you about it from Alex here.
[03:29.900 --> 03:33.700]  I started looking into Android app phones, and it's just more interesting stuff about disclosure.
[03:34.340 --> 03:40.220]  The OWASP has the top 10 mobile security risks, just like they have other web application risks.
[03:40.780 --> 03:47.860]  And I went to look through the most important businesses, in my opinion, and because I had a history in the financial sector, I thought about money, businesses to handle money.
[03:48.020 --> 03:54.420]  So I went through the top 10 banks, the top 10 stockbrokers, and top 10 insurance companies, and they are all vulnerable.
[03:54.560 --> 04:02.300]  Everyone on this list is vulnerable to code modification, which means they distribute the source code along with their app in Smalley, and you can just modify it and put a Trojan in.
[04:02.440 --> 04:07.240]  And I was able to Trojan them all to steal credit card numbers and passwords and secrets from the app.
[04:07.480 --> 04:13.040]  And I notified them and got no answer from anyone, and there is no way to notify any of these people.
[04:13.160 --> 04:14.880]  If you want to send them an email, you can't.
[04:14.980 --> 04:16.440]  There is no vulnerability disclosure policy.
[04:17.020 --> 04:18.820]  There is no vulnerability disclosure contact.
[04:19.560 --> 04:21.160]  They just don't care at all.
[04:21.160 --> 04:32.440]  They're all apparently still believe that they have fooled their customers into thinking they have no security problems, and if everyone just doesn't admit they exist, we'll be fine, which is a position Apple had about eight years ago.
[04:32.620 --> 04:41.200]  But almost everybody has had to give that up and admit that we've all got problems and we should have a steady flow of vulnerability reports coming in and patches going out.
[04:41.480 --> 04:43.520]  The green ones here are the ones that fixed it.
[04:43.880 --> 04:52.160]  And TD Ameritrade gets special dishonor because I sent them a Trojan version of their app, and said, this Trojan version takes the name and password and puts it in a log.
[04:52.340 --> 04:56.720]  So in their next update, they updated their own product to put the name and password in the log.
[04:56.960 --> 04:58.700]  I said, that's really awesome.
[05:00.180 --> 05:01.600]  I said, I wonder if they fixed it.
[05:01.660 --> 05:02.360]  So I Trojan it again.
[05:02.420 --> 05:04.280]  And now there were two copies of the name and the password in the log.
[05:04.340 --> 05:05.700]  And I said, how did that happen?
[05:06.300 --> 05:07.640]  So they went backwards.
[05:08.000 --> 05:13.120]  Maybe we should make fun of... maybe we should actually send a cease and desist letter that they're stealing your intellectual problems.
[05:13.120 --> 05:13.500]  Oh, yeah.
[05:14.020 --> 05:16.100]  Well, see, I didn't think of that.
[05:16.100 --> 05:21.720]  Anyway, and Geico actually has a reporting form, but they don't do anything when you report it.
[05:22.100 --> 05:23.940]  But still, at least they have a report.
[05:24.020 --> 05:25.880]  So then I got... this one got me in trouble again.
[05:27.040 --> 05:40.600]  Carnegie Mellon did a test of all the Android apps, about 80,000 a couple of years ago, and they've done an automated system that would automatically open the app in a machine and automatically click a few buttons and then see if it makes any HTTPS connections.
[05:40.600 --> 05:48.280]  And if it did, they would run it through a hardware router they designed to make impersonated HTTPS certificates with like three or four different errors.
[05:48.520 --> 05:58.320]  And if it actually made any connections with those bogus certificates, they would automatically flag it as an app that broke HTTPS and was therefore insecure, and they would automatically notify them.
[05:58.440 --> 06:07.300]  So I thought this is great for me because I'm always looking for something I'd give my students, and I don't have to wait for this responsible disclosure process because they already were told a long time ago by Carnegie Mellon.
[06:07.300 --> 06:11.440]  I went through their list to see how many were still vulnerable, nine or ten months later.
[06:11.680 --> 06:17.720]  And I found a bunch of medical apps that were vulnerable, handing medical information and sending it through broken HTTPS over the Internet.
[06:17.940 --> 06:19.880]  And it seemed to me like that's a violation of HIPAA.
[06:20.140 --> 06:26.480]  Now, I'm not a lawyer, but I looked at HIPAA, and it says you must use reasonable administrative, technical, and physical safeguards.
[06:26.560 --> 06:29.900]  And it seemed to me like broken encryption is not reasonable.
[06:30.580 --> 06:35.640]  And so I published this, put up a website listing them, and then I found a few of these.
[06:35.640 --> 06:38.300]  Lowest Med was one, and GenieMD is another.
[06:38.440 --> 06:41.100]  These are ones that have broken SSL.
[06:41.220 --> 06:42.280]  So you can use a fake certificate.
[06:42.900 --> 06:44.400]  Here's what you see with GenieMD.
[06:44.540 --> 06:53.760]  When you log in, you can just see the name and password on the bottom right being captured by burp, which is a man-in-the-middle attack tool, and it shouldn't be happening if it was checking the certificate.
[06:54.020 --> 07:01.140]  And it's the same with Lowest Med corporate, where you can order pharmaceutical products and a name and password are just passing through a man in the middle without any warning.
[07:01.840 --> 07:06.320]  So I told them, and they called the President of the College, demanding that I take down the website.
[07:06.780 --> 07:09.200]  And I was getting more savvy at this point.
[07:10.220 --> 07:13.200]  Their lawyer called the college and said, you have to get this guy to take it on the website.
[07:13.400 --> 07:18.260]  So then they called me, and I still gave me his email address, and I emailed the lawyer.
[07:18.380 --> 07:25.820]  And I said, in the first place, you can yell at the college all day, and it won't do any good because I put up that website, and I'm the only one that can take it down, and it's not on the college servers.
[07:26.400 --> 07:33.000]  And in the second place, if you have anything to say to me, put it in writing and I will pass it by my lawyer and we will craft a response.
[07:33.260 --> 07:36.680]  And suddenly, when I got an answer to that, there were no more nasty threats in it.
[07:38.180 --> 07:42.560]  He just said, well, we believe we're not a covered entity because we don't meet the other requirements of HIPAA.
[07:42.580 --> 07:43.960]  And I said, well, that might be true.
[07:43.980 --> 07:47.420]  And if you'll send me a paragraph about it, I'll put it on my website and say they say they're not covered.
[07:47.720 --> 07:51.740]  But I still think it's a lousy thing for you to send your customers data without proper encryption.
[07:51.740 --> 07:55.300]  And even if it's not officially required in the law, why are you like that?
[07:55.380 --> 07:56.840]  Anyway, got no answer to that.
[07:57.100 --> 08:03.040]  But anyway, so I tested some new apps and the one that really impressed me was Blue Cross Blue Shield.
[08:03.220 --> 08:03.940]  I didn't know this.
[08:04.040 --> 08:06.060]  Blue Cross Blue Shield is not organized at all.
[08:06.400 --> 08:12.680]  Apparently, you just form like a hospital and you join and your local group puts up their own website, their own apps, their own servers.
[08:12.800 --> 08:15.000]  There's no central repository at all.
[08:15.120 --> 08:16.160]  So there's dozens of them.
[08:16.280 --> 08:19.100]  So I tested them all and I found the one in North Carolina.
[08:19.100 --> 08:24.320]  Blue Cross Blue Shield was really one of the most awesome security vaults I found in Android apps.
[08:24.700 --> 08:27.540]  Because they had their own beautiful presentation here.
[08:27.760 --> 08:31.240]  And they have this window where you can also look for Facebook, Twitter, and YouTube.
[08:31.520 --> 08:32.780]  And they break HTTPS.
[08:33.080 --> 08:34.780]  They accept certificates without testing them.
[08:34.940 --> 08:47.060]  And since they chose to also let you do social networking inside their app, they lose not only your Blue Cross confidential data, they also lose your critter critter, your Google password, your YouTube password, everything is broken.
[08:47.260 --> 08:55.400]  And I thought this is pretty awesome that the Google Play store not only lets you put in apps that break HTTPS, they let you put in apps that lose Google credentials.
[08:55.680 --> 08:56.840]  And they don't even care about that.
[08:57.160 --> 08:58.320]  And that's the general thing.
[08:58.420 --> 09:00.840]  This is why iPhone is so much safer than Android.
[09:01.040 --> 09:04.780]  Because the iPhone store, the Apple store is highly policed.
[09:05.000 --> 09:07.080]  And the Android store is pretty much not policed at all.
[09:07.080 --> 09:08.460]  You can put up almost anything there.
[09:09.280 --> 09:10.900]  Anyway, so I told them.
[09:11.060 --> 09:12.040]  And in two days they fixed it.
[09:12.200 --> 09:14.020]  Which I thought was very interesting.
[09:14.300 --> 09:16.860]  Because obviously I reached the technician who could fix it.
[09:17.100 --> 09:19.520]  And I'm wondering, where's the management and lawyer?
[09:19.640 --> 09:21.280]  Because I'm not an expert.
[09:21.380 --> 09:25.900]  But I believe if you have a serious medical security problem, you can't just fix it in two days and call the job done.
[09:26.360 --> 09:28.420]  I think there's more you have to do.
[09:29.080 --> 09:30.560]  But it's not my issue.
[09:30.860 --> 09:32.660]  Anyway, so here's the one that got me in trouble.
[09:33.240 --> 09:34.820]  In this one, I did this.
[09:35.240 --> 09:38.640]  This is an advanced technical technique that may sound a little difficult if you don't understand.
[09:38.780 --> 09:40.920]  I used Google to search for something.
[09:42.400 --> 09:46.780]  So, what happened is, the college that I work at had a FTP server.
[09:46.860 --> 09:50.480]  And this file appeared on the server called W00000T.
[09:51.060 --> 09:52.940]  And then I said, that's kind of weird.
[09:53.060 --> 09:55.280]  Somebody found a way to upload files to an FTP server.
[09:55.420 --> 09:58.960]  And I searched online and there were about 110 servers at that time that had the same file.
[09:58.960 --> 10:01.460]  So I said, somebody has found a new way to attack some servers.
[10:01.600 --> 10:05.620]  And I was trying to find the common thread between the servers and try to figure out how they got in.
[10:05.920 --> 10:11.600]  Which I didn't do, because when I went to the Louisiana Health server, I saw this W00t file.
[10:11.740 --> 10:13.500]  And then I saw all these other files in the server.
[10:13.820 --> 10:17.000]  And I clicked on them and they were patient, had medical records, 2,000 of them.
[10:17.540 --> 10:20.300]  Just sitting on an open FTP site with no password or anything.
[10:20.560 --> 10:25.180]  And then I went to some search engine sites that indexed these things, scrapers.
[10:25.180 --> 10:29.760]  And I found that it had been known for two years and copies had been made at these other sites for two years.
[10:29.980 --> 10:34.600]  So I sent them a notice and I said, dude, your medical information is just hanging out for the whole world to see.
[10:34.800 --> 10:36.840]  And it's been that way for two years that I can tell.
[10:36.980 --> 10:38.080]  I think you've got a problem.
[10:38.440 --> 10:47.020]  And I found that, unlike these other places like Chase Manhattan where I can't find anybody to talk to at all, they have a HIPAA compliance office with an email address right on their website.
[10:47.240 --> 10:49.120]  And I said, hey, those people might care.
[10:49.180 --> 10:50.120]  And they really did care.
[10:50.120 --> 10:52.480]  When I told them, they took it down within four hours.
[10:52.600 --> 10:53.380]  The site was just gone.
[10:53.520 --> 10:54.720]  So I said, well, that's fine.
[10:54.780 --> 10:55.460]  That's the end of that.
[10:55.760 --> 10:57.040]  So I went on and did other things.
[10:57.220 --> 11:02.840]  And then when the next semester started, two months later, I got this email saying, was this you?
[11:03.300 --> 11:06.300]  Someone's emailing the college saying you hacked a medical server.
[11:06.440 --> 11:10.040]  And some guy, you're a computer science professor at your college hacked a medical server.
[11:10.320 --> 11:12.220]  They look around, well, this must be Sam.
[11:13.960 --> 11:15.840]  So they sent this to me, was this you?
[11:15.920 --> 11:23.140]  And I'm like, oh, well, I'd kind of like to say it wasn't, but it probably was.
[11:23.440 --> 11:32.920]  And so this guy named, it all started, this guy named John Poffenbarger then sent an email with a long, carefully reasoned, well-stated argument that why they must fire people like me.
[11:33.000 --> 11:34.240]  And I'm a bad example for students.
[11:34.300 --> 11:36.480]  And I'm disgraced to the profession and so on.
[11:37.200 --> 11:38.960]  I'm doing unethical things in class.
[11:38.960 --> 11:40.260]  And why haven't they fired me?
[11:40.340 --> 11:41.480]  And what's wrong with you morons anyway?
[11:41.480 --> 11:43.940]  And I said, who is this Poffenbarger guy?
[11:44.100 --> 11:44.840]  What's going on?
[11:44.980 --> 11:49.600]  The Poffenbarger guy had read this article, which I didn't know about until then.
[11:49.720 --> 11:50.900]  Well, this is good, clean fun.
[11:51.000 --> 11:52.840]  Now, I wasn't teaching any class at this time.
[11:52.980 --> 11:54.280]  This wasn't a class demonstration.
[11:54.980 --> 11:58.240]  And my, at this time, I would say I didn't hack anything.
[11:58.460 --> 12:02.660]  I just did a Google search and found their stuff and clicked on the link and I saw all this secret stuff.
[12:03.600 --> 12:06.700]  So they put, LSU had put out a legal notice.
[12:06.860 --> 12:08.780]  And I had never thought about this before.
[12:08.780 --> 12:16.420]  But if you do go to the bother of actually disclosing a vulnerability or a breach, apparently it's perfectly fine to just lie in that notification.
[12:16.540 --> 12:18.740]  Because you can be proud of yourself that we did it at all.
[12:18.840 --> 12:20.680]  So they tried to make it sound like they did nothing wrong.
[12:20.820 --> 12:23.720]  So I told them, you were breached for the last two years continuously.
[12:23.880 --> 12:24.900]  Stuff's been blowing in the breeze.
[12:25.100 --> 12:28.720]  And they said, the breach consisted of me looking at it on June 17th.
[12:29.320 --> 12:33.240]  And I said, oh, guys, I don't really feel like that's fair.
[12:33.520 --> 12:34.780]  So I complained to the reporter.
[12:34.900 --> 12:36.180]  I said, that's not what happened at all.
[12:36.280 --> 12:37.960]  I didn't hack anybody and they didn't care at all.
[12:38.020 --> 12:39.680]  I complained to the CEO of his newspaper.
[12:39.900 --> 12:43.500]  I went to the federal HIPAA site and filed myself for whistleblower protection.
[12:44.080 --> 12:47.140]  And I rapidly discovered nobody cares at all.
[12:47.280 --> 12:48.440]  There is nothing I can do.
[12:48.940 --> 12:51.060]  And so here was my position at this point.
[12:51.160 --> 12:53.660]  I believed what I'd done was 100% lawful.
[12:53.740 --> 12:56.020]  All I did was a Google search and then click on links that appeared.
[12:56.020 --> 12:59.160]  I didn't break a password or hack in with an exploit or anything.
[12:59.400 --> 13:00.860]  You can't just publish lies.
[13:01.560 --> 13:04.280]  And HIPAA protects whistleblowers, so I should be fine.
[13:04.620 --> 13:06.960]  But the main thing I noticed is I'm not getting anywhere.
[13:07.000 --> 13:08.020]  I need to talk to a lawyer.
[13:08.080 --> 13:11.560]  And it turned out I was wrong about everything except number four.
[13:11.880 --> 13:13.280]  So let me hand it over to Alex.
[13:24.020 --> 13:30.080]  So I get called and I'm really touched that I'm a real lawyer because I've never felt that way.
[13:32.460 --> 13:33.840]  So I get involved.
[13:34.060 --> 13:35.260]  And I get involved with the...
[13:35.860 --> 13:41.760]  Sam sends me the article, CCSF professor hacks hospital in class.
[13:41.960 --> 13:45.460]  And I'm thinking, Sam's not that much of a cowboy.
[13:45.680 --> 13:49.160]  Like, that's something I would do in my class because I teach an undergraduate computer class.
[13:49.260 --> 13:50.280]  And I have done that.
[13:50.380 --> 13:53.960]  Like, I've Googled or security cameras just like, hey, let's see if this works.
[13:54.340 --> 14:00.880]  You know, there are 20 students who are like, I want to do something interesting as opposed to talking about, like, you know, cyber bullying.
[14:01.080 --> 14:02.760]  Like, hey, let's go play with the security camera.
[14:02.900 --> 14:04.280]  I'm like, I will do that stuff.
[14:04.480 --> 14:05.160]  Sam won't.
[14:05.220 --> 14:07.760]  Sam's much more careful because he's a real professor.
[14:07.980 --> 14:12.060]  I'm, you know, an adjunct, which means, like, I'm less important than the potted plants.
[14:14.940 --> 14:17.000]  So who am I and why am I involved?
[14:17.120 --> 14:21.020]  I'm a teller of good stories and I have business cards that read Law Talking Guy.
[14:21.020 --> 14:30.620]  Um, however, thankfully my experience as being a lawyer, not as an InfoSec professional, but as a lawyer, is to think about pressure and motivation.
[14:30.960 --> 14:37.120]  The primary reason why anyone talks to someone like me is they have a problem and they want it fixed.
[14:38.680 --> 14:39.240]  Fixed.
[14:39.360 --> 14:43.080]  And I'm from New Jersey, so fixing problems is...
[14:43.660 --> 14:48.440]  I have a large selection of ways I can fix a problem.
[14:49.960 --> 14:51.760]  I'm never that far from a Home Depot.
[14:55.510 --> 15:01.060]  So, I read what Sam sends me and I'm like, okay, and then have a conversation with him.
[15:01.160 --> 15:03.360]  I'm like, okay, so here's how I'm seeing the story.
[15:03.860 --> 15:09.100]  Sam informs the hospital chain, UH Conway, I believe is the actual name of the hospital.
[15:09.380 --> 15:12.320]  Hey, your stuff is on the Internet.
[15:12.560 --> 15:14.580]  You are using Pastebin to store PHI.
[15:14.580 --> 15:16.560]  This is a bad thing.
[15:16.780 --> 15:17.360]  Trademark.
[15:18.840 --> 15:23.260]  And the compliance consultant informs local news, which is a requirement.
[15:23.480 --> 15:28.740]  You know, hey, we've been breached, and calls up the local Louisiana, northern Louisiana paper.
[15:29.500 --> 15:30.980]  It's a generalist outlet.
[15:31.260 --> 15:39.280]  Like, the next story that reporter is going to write is like bond issue for new library passes, right?
[15:39.280 --> 15:44.700]  It's, it's, they're interested in telling stories that are relevant to the people picking up the paper.
[15:45.080 --> 15:58.040]  So, they're not ever going to get, they're not going to parse stuff about the difference between professor finds vulnerability that has already been exploited, and professor pwns the shit out of hospital.
[15:58.560 --> 16:00.080]  Those are the same, right?
[16:00.160 --> 16:04.680]  Because they've got to dumb it down to breach occurred, because the compliance person has answered this.
[16:04.680 --> 16:09.600]  So, the, the problem is the first, the first person telling the story has a spin.
[16:09.880 --> 16:18.240]  They want it to, because they don't want you to not go to the hospital for the fear that your patient records are going to be, you know, out in the net.
[16:19.620 --> 16:22.240]  But, who cares from their point of view, right?
[16:22.800 --> 16:24.280]  It's not like there's much difference.
[16:24.440 --> 16:26.700]  I've got two column inches to tell the story.
[16:29.080 --> 16:32.180]  So, where this gets problematic though, because who cares?
[16:32.180 --> 16:37.980]  There's, there's a, there's a Louisiana newspaper that says bad things about Sam.
[16:38.060 --> 16:39.540]  Actually, it doesn't even mention your name.
[16:40.920 --> 16:45.740]  However, SC Magazine gets involved, like, hey, this is my, this is their beat.
[16:46.080 --> 16:52.540]  And they kind of fairly quickly figure out the culprit, and goes a bit further.
[16:52.760 --> 16:57.680]  The problem is, is that they're relying on the original story from the Louisiana paper.
[16:58.460 --> 17:07.710]  So, they read between the lines, figure out who it is, but, found security vuln in badly patched FTP server, is not, who cares?
[17:08.180 --> 17:13.900]  But, if we make it seem like, it's some, some cowboy stuff is going on.
[17:14.040 --> 17:16.260]  Hacks, hacks server during class.
[17:16.700 --> 17:18.260]  That's some rock star stuff.
[17:18.580 --> 17:22.190]  So, SC Magazine tells this other story, which is defamatory.
[17:23.560 --> 17:25.210]  Or, at least close to it.
[17:25.540 --> 17:26.380]  Now we care.
[17:26.540 --> 17:35.960]  Because now, Mr. Poffenbarger reads the SC Magazine, and gets on their, their, uh, CISP pearl clutching mode.
[17:36.200 --> 17:42.540]  And, he must be fired, because he's, you know, he's, he's, uh, uh, I don't know, leading our kids astray.
[17:43.140 --> 17:43.780]  Was it?
[17:43.880 --> 17:47.960]  You know, you're teaching them bad things, because they can't find bad things anywhere else.
[17:51.120 --> 17:52.880]  So, and of course, I get it.
[17:52.940 --> 17:54.480]  I do not have a CISP yet.
[17:54.820 --> 17:57.860]  Um, despite the pressure of my employer for me to get one.
[17:58.640 --> 18:03.900]  Um, so eventually I will have to, now that that's something that someone can take away from me.
[18:03.900 --> 18:05.300]  So, I get it.
[18:05.380 --> 18:06.940]  You get an ethics complaint against you.
[18:07.000 --> 18:09.900]  You actually have to go and explain why you did the thing you did.
[18:12.760 --> 18:14.700]  So, there's a right way to do this.
[18:14.920 --> 18:15.280]  Right?
[18:15.440 --> 18:16.700]  How do, how do we solve the problem?
[18:16.780 --> 18:17.980]  Go back to problem solving.
[18:18.240 --> 18:18.880]  There's the right way.
[18:19.260 --> 18:26.960]  Go and try to talk to people, and explain what it is you were doing, and I'm a good person, and you're a good person, and yeah, that never f*cking works.
[18:28.600 --> 18:29.540]  The legal way.
[18:29.840 --> 18:30.710]  Because I'm a lawyer.
[18:30.920 --> 18:31.760]  I have a toolbox.
[18:33.120 --> 18:36.140]  Eh, hammer, nail, every problem looks like one.
[18:36.680 --> 18:38.940]  Um, threatened litigation.
[18:39.240 --> 18:40.340]  Will not work.
[18:40.480 --> 18:41.800]  One, because it's going to get expensive.
[18:42.400 --> 18:45.960]  Two, it repeats and reinforces the inaccuracy.
[18:46.060 --> 18:47.180]  It's a Streisand problem.
[18:48.000 --> 18:49.340]  I don't want...
[18:49.340 --> 18:54.760]  Filing a suit against the hospital and SC magazine is dumb.
[18:55.710 --> 18:56.540]  It will not work.
[18:56.700 --> 18:58.500]  It will not get us what we want to have happen.
[18:59.800 --> 19:03.060]  So, we want to suppress the story or change the narrative.
[19:04.380 --> 19:06.100]  Can't appeal to the best in humanity.
[19:06.260 --> 19:09.380]  Because we have entrenched bureaucracy at the hospital.
[19:09.580 --> 19:10.920]  They're not going to change the story.
[19:11.960 --> 19:13.480]  They're going to say we misunderstood.
[19:13.480 --> 19:20.880]  They might issue a new statement that will be even more parsed and not helpful to us.
[19:21.620 --> 19:22.820]  Journalists are busy.
[19:25.400 --> 19:27.380]  However, threats aren't going to work.
[19:27.680 --> 19:30.820]  Filing a defamation lawsuit, we repeat the story.
[19:30.820 --> 19:36.000]  And even the guy who normally takes personals ads.
[19:36.480 --> 19:37.660]  If they still have those.
[19:37.780 --> 19:39.280]  You know, help wanted ads or whatever.
[19:39.560 --> 19:43.740]  Is going to become Woodward and or Bernstein when you threaten them with a libel suit.
[19:43.960 --> 19:45.960]  Because like, it's my first amendment right.
[19:46.460 --> 19:50.700]  You know, it sounds like, you know, many gun owners when I talk about second amendment rights.
[19:50.920 --> 19:52.620]  You know, it's like, you can't take that for me.
[19:52.700 --> 19:53.280]  I'm a journalist.
[19:53.420 --> 19:59.200]  Like, no, you're the photographer who takes pictures of cars for the auto trader.
[19:59.200 --> 20:01.120]  But you are technically a journalist.
[20:01.340 --> 20:04.880]  So, they're going to get... that's one of those instant triggers for them.
[20:05.020 --> 20:05.880]  So, we don't want to do this.
[20:06.000 --> 20:07.300]  This is not going to help us.
[20:07.800 --> 20:08.780]  So, what we did.
[20:08.980 --> 20:10.860]  The important coverage is the trade rag.
[20:11.040 --> 20:11.840]  SC Magazine.
[20:12.800 --> 20:15.880]  The trade rag has different motivations than a general purpose.
[20:16.920 --> 20:18.400]  They care about depth.
[20:18.520 --> 20:19.360]  They care about accuracy.
[20:20.460 --> 20:25.860]  And an exclusive story with Sam to explain what happened is valuable.
[20:26.100 --> 20:29.100]  Because now, they're not just one of many trade rags.
[20:29.100 --> 20:31.700]  They're the trade rag that has the story about what Sam did.
[20:32.600 --> 20:37.260]  Which we trade for links, you know, to go talk to them, offer them an exclusive.
[20:37.710 --> 20:38.200]  Boop.
[20:38.320 --> 20:42.440]  And we get the story changed with links back to it to say...
[20:42.440 --> 20:46.620]  So, if you Google it, you find the final story, which is Sam did...
[20:46.620 --> 20:49.360]  Sam Googled or found the phone, reported it.
[20:49.540 --> 20:53.880]  And it wasn't well handled by all the institutions.
[20:56.660 --> 20:59.400]  So, I want to talk a quick bit about this.
[20:59.540 --> 21:00.480]  Because this is publicity.
[21:02.020 --> 21:04.800]  Defamation is a statement about...
[21:04.800 --> 21:09.080]  It's an untrue act or untrue statement about you that's made public.
[21:10.100 --> 21:13.340]  Spoken to one other person or published to one other person.
[21:14.320 --> 21:16.660]  And it has to damage your reputation.
[21:18.620 --> 21:23.260]  Calling me a potential alcoholic is not defamation because it may be true.
[21:24.120 --> 21:25.820]  Calling me a real lawyer...
[21:25.820 --> 21:28.080]  Well, that's actually a nice thing.
[21:30.050 --> 21:31.940]  So, some parsing here.
[21:32.360 --> 21:35.440]  Sam hacked the server in class is an untrue negative statement.
[21:36.180 --> 21:39.260]  Successfully accessed the server affecting patient privacy.
[21:39.260 --> 21:43.740]  You did successfully access the server, but patient privacy was not affected.
[21:43.940 --> 21:44.940]  It was already gone.
[21:47.060 --> 21:50.640]  However, this one is not an untrue negative statement.
[21:50.860 --> 21:53.680]  UH Conway stated that Sam hacked the server in class.
[21:54.880 --> 21:57.280]  Because UH Conway did say that fact.
[21:57.540 --> 21:58.080]  Did say that.
[21:58.180 --> 21:58.940]  It's untrue.
[21:59.500 --> 22:04.820]  But restating it as UC Conway said it is a true statement.
[22:04.820 --> 22:09.140]  So, SC Magazine is not actually being slanderous.
[22:11.760 --> 22:12.940]  So, the damage to reputations.
[22:13.460 --> 22:15.520]  The second part we have to do for a defamation claim.
[22:15.720 --> 22:17.240]  We have to show economic harm.
[22:17.700 --> 22:19.600]  Contacts are business lost because of the statement.
[22:19.920 --> 22:21.700]  It doesn't necessarily have to be believed.
[22:21.860 --> 22:24.780]  It just has to be, you know, your persona non grata.
[22:24.840 --> 22:25.800]  I can't do business with you.
[22:25.860 --> 22:27.540]  I can't be seen to be doing business with you.
[22:28.330 --> 22:33.340]  And that's often worse than actually, I won't do business with you because I think you're a scumbag.
[22:33.340 --> 22:36.880]  It's like, I can't get clients to let you in on a gig.
[22:37.180 --> 22:40.860]  Or, maybe he should be fired for this.
[22:41.120 --> 22:42.780]  Also, a potential damage.
[22:44.080 --> 22:44.700]  Accusation of...
[22:44.700 --> 22:46.780]  And then there are things you don't have to show damage for.
[22:46.880 --> 22:48.060]  The per se defamation.
[22:48.700 --> 22:49.640]  Accusation of crime.
[22:50.000 --> 22:51.040]  Professional reputation.
[22:51.720 --> 22:53.860]  Or, my favorite, the loathsome disease.
[22:54.260 --> 22:55.140]  Sexually transmitted.
[22:56.120 --> 22:57.860]  That's, you know, a whole world from like 1600.
[23:00.220 --> 23:03.640]  However, here's the thing I want to talk about when we're talking about vulnerability disclosure.
[23:04.000 --> 23:05.660]  Did Sam break the law?
[23:07.360 --> 23:09.980]  And, arguably, he came really close to it.
[23:10.080 --> 23:12.180]  I will not admit that he did this.
[23:12.300 --> 23:16.280]  But, did he access an FTP server?
[23:18.730 --> 23:19.550]  Obviously I did.
[23:19.730 --> 23:19.970]  Yep.
[23:20.250 --> 23:21.330]  Because, you know...
[23:21.330 --> 23:24.130]  However, was that FTP...
[23:24.130 --> 23:26.010]  Did he have permission to do so?
[23:26.010 --> 23:33.690]  Of course, you know, if your password is enter, is that allowing everyone to come in?
[23:34.010 --> 23:40.270]  However, the same argument can be made if I inadvertently leave my front door unlocked, does that mean you're allowed to come in and take my stuff?
[23:42.350 --> 23:48.590]  So, the exceeding authorized access or unauthorized gets fuzzy at the edges.
[23:48.590 --> 23:51.990]  The other question, the other requirements for 1030, though.
[23:52.410 --> 23:53.130]  Network computer.
[23:53.730 --> 23:56.130]  It's a protected computer under 18 U.S.C. 1030.
[23:56.590 --> 24:00.550]  Means, is it in interstate commerce or communication?
[24:00.830 --> 24:02.990]  Or, does it affect interstate commerce or communication?
[24:03.390 --> 24:09.930]  So, everything we have that has circuits and an IP address is essentially a protected computer.
[24:10.150 --> 24:12.790]  And, the final requirement is, did you obtain information?
[24:13.350 --> 24:14.410]  Well, clearly he did.
[24:14.410 --> 24:19.530]  So, there's this danger when you're revealing vulns in other people's systems.
[24:20.210 --> 24:21.510]  You've misconfigured it.
[24:21.590 --> 24:22.430]  It's got malware.
[24:22.850 --> 24:24.910]  I can see stuff that I shouldn't.
[24:25.590 --> 24:32.350]  You are putting a lot of trust in them to say, thank you, I won't raise a complaint.
[24:33.750 --> 24:38.150]  The risk is, you say, excuse me, you seem to be on fire.
[24:38.370 --> 24:43.150]  I know you're on fire because I entered your house, went into your living room and saw you smoldering.
[24:43.150 --> 24:48.550]  Well, the question is, you came in my house, unbidden.
[24:49.010 --> 25:06.610]  And, we should be human enough and professionals enough to say, thank you for breaking, thank you for the crime of you entering my house to see that I'm on fire, is not as bad as the benefit I get from, hey, dude, you're on fire.
[25:08.410 --> 25:09.490]  But, this is a danger.
[25:11.630 --> 25:14.490]  So, I want you to think about that and I'll answer questions about it later.
[25:14.690 --> 25:15.710]  But, I'll let Sam talk about...
[25:19.820 --> 25:24.620]  Yeah, well, let me just say one thing, which he probably said, but I don't see my perspective.
[25:24.940 --> 25:31.180]  I thought that if I find a security barrier like a password, then I have to stop or I'm breaking the law.
[25:31.180 --> 25:32.200]  But, it's much worse.
[25:32.660 --> 25:38.860]  If I somehow gain possession of information that the owner of the site does not want me to have, I've now broken the law.
[25:39.440 --> 25:41.020]  And, I did not know that.
[25:43.100 --> 25:48.400]  So, it means practically everything is a little bit illegal and that's what I think everyone's always been saying.
[25:48.560 --> 25:51.480]  It's very difficult to be completely a white hat in this business.
[25:52.000 --> 25:54.280]  You end up wandering into the gray zone to some extent.
[25:54.280 --> 25:59.260]  Anyway, if we have some more time, which I imagine we do, I think we're going to move right along here.
[26:00.140 --> 26:01.340]  Oh yeah, we have plenty of time.
[26:01.460 --> 26:04.700]  There's one other thing I wanted to tell you, which I've been getting into lately.
[26:05.420 --> 26:06.960]  How many of you people own Bitcoins?
[26:08.320 --> 26:09.060]  Yeah, a few.
[26:09.280 --> 26:09.380]  Alright.
[26:09.660 --> 26:11.400]  Anyway, I may insult you.
[26:11.560 --> 26:13.080]  If so, you punch me after the talk.
[26:14.320 --> 26:18.380]  So, I ignored Bitcoin completely because I used to be a financial professional.
[26:19.060 --> 26:22.380]  I worked for a place, an escrow agency, getting contracts from the FTC.
[26:22.380 --> 26:24.960]  And I spent most of my time punishing pyramid schemes.
[26:25.240 --> 26:29.760]  That was my job, was analyzing the financial layout of pyramid schemes and returning money to their victims.
[26:30.180 --> 26:34.160]  And in one sense, all cryptocurrencies are just pyramid schemes.
[26:34.180 --> 26:37.120]  And I completely rejected them on that basis all along.
[26:37.260 --> 26:39.380]  I said, man, you'd have to be stupid to do this.
[26:39.440 --> 26:42.020]  I've spent a long time being involved in the finances of this.
[26:42.280 --> 26:43.440]  It's a bloody shame.
[26:44.400 --> 26:47.700]  But Bitcoin does serve as a beta test.
[26:47.760 --> 26:51.200]  And this is basically what all my ethical hacking training and everything else is.
[26:51.200 --> 26:55.640]  The criminals of the world are stealing stuff, but they're also doing interesting things.
[26:56.020 --> 27:03.400]  And you need... and the whole point of ethical hacking is to take the things the criminals are using and remove the useful part and repurpose it for something valuable.
[27:03.780 --> 27:06.440]  So, I've read these two books.
[27:06.880 --> 27:10.820]  The left one gives you the technical details of Bitcoin and the right one gives you the sort of history of it.
[27:10.820 --> 27:14.000]  And my students, some of them have been in cryptocurrency for a while.
[27:14.120 --> 27:14.780]  And I looked into it.
[27:14.900 --> 27:21.060]  The reason I looked into it was because of this article in the New York... there it is.
[27:21.180 --> 27:21.920]  Not that one.
[27:22.040 --> 27:22.600]  There, this one.
[27:23.100 --> 27:24.560]  I saw this in the Wall Street Journal.
[27:24.760 --> 27:29.280]  They're now hiring people that can program blockchains and starting them out with salaries of $250,000.
[27:29.900 --> 27:34.040]  And if there's real jobs at real companies in it, then it's worth taking a look at.
[27:34.040 --> 27:36.040]  And the point of this, this is not Bitcoin.
[27:36.460 --> 27:41.560]  This is using the technology that powers Bitcoin and making new financial vehicles that use it.
[27:41.740 --> 27:42.960]  And that's interesting.
[27:43.660 --> 27:45.480]  And the Bitcoin itself, of course...
[27:45.480 --> 27:48.700]  I just watched it and it just looked like a train wreck that just kept getting worse and worse.
[27:48.860 --> 27:49.940]  I mean, the main Bitcoin...
[27:49.940 --> 27:57.140]  Bitcoin has scams, pyramid schemes, rapid fluctuations up and down and no apparent actual value at all.
[27:57.540 --> 28:00.600]  So, I expected it to fall to zero and it never did.
[28:00.860 --> 28:03.780]  But when I first looked at it, I thought this is the point of Bitcoin.
[28:04.880 --> 28:07.300]  To teach kids about Bitcoin, give them a piggy bank.
[28:07.440 --> 28:10.220]  Six months later, smash the piggy bank, take their money and laugh.
[28:10.440 --> 28:12.520]  Because that is most people's experience of Bitcoin.
[28:12.760 --> 28:15.960]  You buy something, the person owning the bank just steals your money and leaves.
[28:16.080 --> 28:17.620]  And then you say, wait, they can't do that.
[28:17.700 --> 28:19.260]  And they said, oh, don't you understand?
[28:19.260 --> 28:23.860]  The whole point of Bitcoin is there is no government intrusion and no legal system and no FDIC.
[28:24.520 --> 28:25.500]  So, aren't you glad?
[28:25.740 --> 28:27.480]  And I said, wait, I'm not so glad.
[28:28.860 --> 28:34.080]  And when I studied cryptocurrencies more, I found more and more of them are just pump and dump schemes like Lisk, Lisk came out.
[28:34.200 --> 28:35.320]  It was just a sin and a shame.
[28:35.440 --> 28:36.960]  It was going to be the number three cryptocurrency.
[28:37.360 --> 28:39.200]  The day before it came out, I went on their website.
[28:39.380 --> 28:40.780]  Half the website wasn't even up.
[28:40.960 --> 28:43.440]  The software they said you could run wasn't even there.
[28:44.000 --> 28:45.960]  I couldn't get it to run on any platform.
[28:46.160 --> 28:47.960]  They launched it within a few hours.
[28:48.100 --> 28:49.100]  It got hacked so badly.
[28:49.220 --> 28:50.980]  Everyone was stealing money from each other's accounts.
[28:51.100 --> 28:52.660]  The value spent fell to zero.
[28:53.240 --> 28:54.700]  All this money just vanished.
[28:54.940 --> 28:56.700]  And, you know, that's kind of what tends to happen.
[28:56.940 --> 28:58.960]  A bunch of people just hype this up.
[28:59.060 --> 29:00.700]  There's actually nothing behind the curtain.
[29:00.980 --> 29:03.860]  And then a bunch of people throw money in it and somebody grabs it and leaves.
[29:04.040 --> 29:05.540]  And then everyone says, oh, what happened?
[29:06.000 --> 29:07.300]  So then Mt.
[29:07.400 --> 29:10.260]  Gox, the main Bitcoin bank, they stole all the money and left.
[29:10.820 --> 29:14.720]  They argued that they instead just insecurely stored the money and let someone else steal it.
[29:14.860 --> 29:18.720]  But anyway, the net effect of everybody that had any of that money is they're screwed.
[29:19.620 --> 29:22.860]  Is this a money doesn't have owners, it just has spenders?
[29:23.460 --> 29:23.540]  Yeah.
[29:23.820 --> 29:29.920]  Well, see, and by the way, you can, if you're technical, buy Bitcoin and keep the private key offline where it can't get stolen.
[29:30.040 --> 29:30.980]  But most people don't know that.
[29:31.080 --> 29:33.660]  They end up trusting some intermediary who then just steals the money.
[29:33.880 --> 29:34.800]  So it's really nothing.
[29:34.920 --> 29:36.220]  It's not the fault of the Bitcoin itself.
[29:36.300 --> 29:40.720]  It's just a convenient, complicated thing to wave in front of people while you pick their pocket.
[29:42.860 --> 29:46.500]  Anyway, so the blockchain is, however, very clever.
[29:46.500 --> 29:49.000]  And I started looking at the DAO and other ones here.
[29:49.080 --> 29:54.380]  The blockchain, the point of this is everybody has the complete ledger of all the transactions on their computer.
[29:55.060 --> 30:01.140]  So nobody can lie, so you do not need to have a trusted central party like a bank or a government with the master copy.
[30:01.380 --> 30:07.860]  Everybody has a copy and nobody can pervert the record unless they actually own 51% of all the copies.
[30:08.120 --> 30:13.860]  So as long as it's distributed enough that no one person has 51% of all the copies, the copies have to be true.
[30:14.680 --> 30:15.660]  And that's clever.
[30:15.920 --> 30:19.100]  And I got impressed at how many people are really taking it seriously.
[30:19.300 --> 30:21.840]  Microsoft Azure will offer you blockchain as a service.
[30:22.000 --> 30:24.260]  They will rent you virtual machines running this.
[30:25.280 --> 30:28.300]  Ethereum has it on there too, an alternative to Bitcoin.
[30:28.660 --> 30:33.220]  Santander, the main bank in Spain, is developing blockchain transfers.
[30:33.440 --> 30:35.580]  So is the bank in Sydney Stock Exchange.
[30:36.160 --> 30:37.260]  Many people are doing it.
[30:37.260 --> 30:40.980]  There are real applications for this technology besides Bitcoin.
[30:42.320 --> 30:48.680]  But the point of this, the reason why this works for Bitcoin is proof of work, which is environmentally pretty horrible.
[30:49.460 --> 30:54.580]  That's why it costs 1,000 times as much computing time to make a Bitcoin transaction as a Visa credit card transaction.
[30:55.040 --> 30:58.780]  But you have blocks of transactions that are signed by a hash value.
[30:58.920 --> 31:04.620]  And the hash value is carefully designed to be so difficult that only the fastest computer on earth can finish that hash in 10 minutes.
[31:04.620 --> 31:12.100]  And the point of that is so nobody bothers to hack it with a supercomputer, because they would make more money by legitimately mining it with that supercomputer.
[31:12.460 --> 31:13.080]  That's the plan.
[31:13.520 --> 31:17.160]  So they make it as difficult as possible to sign the blocks.
[31:17.400 --> 31:20.560]  It is very easy for anyone to verify that the blocks are signed.
[31:20.700 --> 31:22.460]  Very difficult for them to sign a new block.
[31:22.780 --> 31:25.140]  And so it would be very expensive for anyone to hack it.
[31:25.240 --> 31:26.960]  And that has worked in practice.
[31:27.340 --> 31:32.540]  Like I say, it has demonstrated for years, I think, $12 billion of market capitalization and Bitcoin.
[31:32.800 --> 31:34.660]  Everyone on earth is, of course, trying to steal it.
[31:34.780 --> 31:35.900]  And nobody really can.
[31:36.160 --> 31:44.520]  So this means you do not need the FDIC and the government and the banks to have a trustable ledger.
[31:44.660 --> 31:45.920]  And it works by Merkle trees.
[31:46.000 --> 31:46.620]  You have blocks.
[31:46.760 --> 31:47.840]  There's a hash in the next one.
[31:47.960 --> 31:49.460]  That is included in the hash in the next one.
[31:49.540 --> 31:54.440]  And so you can walk this tree very quickly by just calculating a hash and seeing that it matches.
[31:54.840 --> 31:57.260]  Adding a new leaf to this tree is expensive.
[31:57.260 --> 31:58.620]  That's what only miners can do.
[31:58.960 --> 32:05.900]  But everyone with an ordinary computer can have a 100% accurate tree and verify it with a small amount of computing power.
[32:06.160 --> 32:07.480]  So that's good.
[32:07.880 --> 32:13.080]  And in Bitcoin, one crazy thing about Bitcoin is it only makes a block every 10 minutes.
[32:13.700 --> 32:20.480]  But anyway, so what I was interested in, as far as I can tell, this is the first example many people talk about is voting.
[32:21.260 --> 32:23.160]  Because voting really bothers me.
[32:23.160 --> 32:24.400]  You go to the ballot box.
[32:24.520 --> 32:25.500]  You mark some piece of paper.
[32:25.620 --> 32:26.460]  You stick it in a box.
[32:26.580 --> 32:27.740]  You have no idea what happens.
[32:28.000 --> 32:29.460]  Then tomorrow they tell you the other guy won.
[32:29.700 --> 32:30.740]  You can't check the total.
[32:30.860 --> 32:32.060]  You don't know if they counted your vote.
[32:32.160 --> 32:33.040]  You don't know if they're lying.
[32:33.260 --> 32:34.120]  And it's important.
[32:34.620 --> 32:36.280]  And I say, man, this really sucks.
[32:36.340 --> 32:38.900]  And this is a case where the blockchain would be a good thing.
[32:39.720 --> 32:44.020]  In the blockchain, everybody has their own copy of the entire log on their machine.
[32:44.320 --> 32:45.420]  You cast a ballot.
[32:45.560 --> 32:46.660]  It percolates to the others.
[32:46.820 --> 32:49.120]  Everybody can look and see that their ballot is counted.
[32:49.120 --> 32:51.120]  And they can do their own counts to see who won.
[32:51.120 --> 32:52.740]  There's no argument about this.
[32:52.940 --> 32:55.500]  This is, in my opinion, a really good application of it.
[32:55.620 --> 32:57.960]  And so I learned enough about blockchains to program one.
[32:58.080 --> 32:59.100]  Which is not that hard.
[32:59.620 --> 33:00.860]  And I put it up on the website.
[33:01.040 --> 33:02.140]  So that's the way it was a while ago.
[33:02.260 --> 33:03.280]  I have three choices here.
[33:03.540 --> 33:04.400]  Her, him, and other.
[33:06.420 --> 33:08.020]  And other is by far the winner.
[33:08.220 --> 33:09.260]  And that seems to be...
[33:09.260 --> 33:11.860]  Which I think matches other polls in this particular election.
[33:12.040 --> 33:14.500]  I mean, I don't think anybody is voting for either of these people.
[33:14.640 --> 33:16.160]  They either hate her so they vote for him.
[33:16.260 --> 33:17.520]  Or they hate him and they vote for her.
[33:17.520 --> 33:19.640]  But everybody would rather have someone else.
[33:21.880 --> 33:22.600]  Anyway, so...
[33:24.900 --> 33:28.060]  Anyway, if you want to do this, this is on my website at samsfast.info.
[33:28.220 --> 33:28.800]  Go ahead and vote.
[33:29.080 --> 33:31.260]  You can do one vote for email address.
[33:31.340 --> 33:33.220]  So this is in no way like scientific or anything.
[33:33.380 --> 33:35.060]  But you see how blockchain voting works.
[33:35.160 --> 33:35.600]  You can vote.
[33:35.700 --> 33:39.200]  You can look at the whole ledger and see how it works.
[33:39.200 --> 33:43.340]  And there are people working on this to try to make real voting systems based on this.
[33:44.540 --> 33:47.720]  And I just thought I'd mention because when I looked at that paper handout, I couldn't find it.
[33:47.900 --> 33:49.560]  I'm doing some hands-on workshops here.
[33:49.780 --> 33:52.180]  A violent python tomorrow and exploit development the next day.
[33:52.340 --> 33:56.100]  So go up to the sixth floor if you want to practice doing any of these things with your own computer.
[33:56.780 --> 33:59.860]  And I think we've got plenty of time if anybody has questions.
[34:01.440 --> 34:02.220]  So that's it.
[34:06.100 --> 34:07.440]  Let me bring up that page.
[34:08.860 --> 34:09.740]  Yeah, there's that.
[34:10.980 --> 34:12.160]  So there's that page.
[34:14.180 --> 34:14.860]  Yeah, sure.
[34:17.320 --> 34:17.760]  Good.
[34:19.420 --> 34:20.600]  You got a mic that works there?
[34:20.700 --> 34:21.040]  Well, we'll see.
[34:21.540 --> 34:22.420]  I can bellow.
[34:23.060 --> 34:23.500]  Okay.
[34:23.900 --> 34:32.320]  So Sam was saying, well, if you've gone to anybody's website and they didn't want you to do that, then it turns out you violated 1030.
[34:32.580 --> 34:34.540]  But that's not true, right?
[34:34.600 --> 34:39.080]  That would be an ex post facto application of a private determinator of a public law.
[34:39.340 --> 34:43.520]  Isn't that exactly what we had, a lawsuit and locked up an anti-Semite for a year for?
[34:43.760 --> 34:44.880]  That's obviously for him.
[34:45.280 --> 34:45.800]  You're out of my gut.
[34:46.980 --> 34:51.260]  Third Circuit didn't even talk about the idea that...
[34:53.420 --> 34:55.600]  They didn't buy the ex post facto idea.
[34:55.760 --> 34:57.760]  But the thinking of the...
[34:57.760 --> 35:03.880]  Clearly there's got to be some understanding of what acceptable use is.
[35:04.580 --> 35:11.900]  We've found that we're not holding it as a violation if you violate the terms of service.
[35:11.900 --> 35:13.100]  That's...
[35:13.100 --> 35:14.320]  Nozzle.
[35:14.320 --> 35:14.460]  That's Drew.
[35:14.920 --> 35:15.480]  Nozzle.
[35:18.020 --> 35:25.120]  However, clearly finding bones is different than I used your web page.
[35:25.260 --> 35:38.260]  Because if you're doing something much more technical, you know, hackery, like viewing source, or incrementing a number in a URL, because God knows that's nigh impossible.
[35:39.120 --> 35:51.680]  And I realize this, and I hate saying mean things about people who aren't technical, but you know, the amount of times you've said, you watch people like, I keep typing the URL, you're typing it in the search window.
[35:53.400 --> 36:00.220]  But clearly, that might be the understanding, is that there's clearly not allowed.
[36:00.220 --> 36:07.380]  Like, which is the one where they actually sent a cease and desist letter, please stop scraping us.
[36:08.020 --> 36:16.220]  And clearly, like if I've actually gone through the bother of writing you a letter and saying, don't do this, that's clearly against authorization.
[36:18.640 --> 36:23.600]  Clearly, using the website for its intended purpose is with authorization.
[36:25.120 --> 36:33.500]  Where the fuzzy part is, is where no authorization is clearly granted, such as an FTP site.
[36:33.700 --> 36:34.060]  Right?
[36:34.620 --> 36:43.980]  You can, you might be able to have some argument about a message of the day, or a banner, when you come in to allow, to tell you what you are and aren't allowed to do.
[36:44.120 --> 36:45.460]  But that's a fuzzy spot.
[36:45.460 --> 36:48.300]  So, that's a long answer saying, it depends.
[36:50.560 --> 37:00.760]  So, say you found something totally different, the same university that already burned you once, but the same type of vulnerability, just as bad.
[37:00.920 --> 37:01.780]  What would you do differently?
[37:02.180 --> 37:03.500]  Yeah, I'm glad you mentioned that.
[37:03.620 --> 37:04.760]  What I should have done differently...
[37:04.760 --> 37:07.680]  See, I tried to be nice to them by contacting their HIPAA office.
[37:07.840 --> 37:09.380]  I now know that was a mistake.
[37:09.560 --> 37:18.660]  I should have turned them directly into the feds, because the reason I don't have any federal whistle protection, because only if you report directly to the feds do you get any whistle blower protection.
[37:18.840 --> 37:21.920]  So, my attempt to be polite, put myself in a vulnerable position.
[37:22.680 --> 37:25.500]  So, if I found anything else there, I would not talk to them at all.
[37:25.620 --> 37:28.260]  I would go straight to the feds, and then let the feds come down on them.
[37:28.500 --> 37:30.320]  That is the safer way to do it.
[37:30.680 --> 37:34.420]  And I certainly am not inclined to do them any favors anymore, so I don't really mind about being rude.
[37:35.080 --> 37:35.440]  Yeah?
[37:37.260 --> 37:41.260]  Is there, or should we lobby for something equivalent to a good Samaritan law?
[37:42.820 --> 37:43.260]  What?
[37:43.780 --> 37:44.080]  Ooh.
[37:44.400 --> 37:45.260]  Good Samaritan laws.
[37:45.620 --> 37:46.000]  Oh, yeah.
[37:46.360 --> 37:46.800]  I'm...
[37:46.800 --> 37:54.460]  Well, that would be nice, but I've been told at other conferences by people working on laws that it's absolutely a non-starter, because they're afraid it would let criminal hackers get through.
[37:54.980 --> 37:56.640]  But it would be nice, in my opinion.
[37:56.980 --> 37:58.460]  I think you got...
[37:58.460 --> 38:07.340]  Thinking of this, if the site is nice enough to have a report your phone here, or better yet, a bug bounty, or they're registered with one of the...
[38:10.000 --> 38:10.820]  I'm trying...
[38:10.820 --> 38:11.540]  Like, hacker one.
[38:11.980 --> 38:13.180]  Or bug crowd or something.
[38:14.280 --> 38:14.760]  Yeah.
[38:15.160 --> 38:21.040]  It's the, we would like to know about this, so, you know, file your complaint over here.
[38:22.480 --> 38:23.700]  That might be a...
[38:23.700 --> 38:27.880]  I'd be far more comfortable, even if it's not within the scope of the bug bounty.
[38:27.880 --> 38:31.980]  Just to say, like, clearly you're thinking about this and you will not instantly freak out.
[38:33.580 --> 38:34.340]  Because it's...
[38:34.340 --> 38:44.220]  You know, I've realized many of these shops aren't comfortable with vulnerability scanning, even when they actually hire people like us to do it.
[38:44.340 --> 38:48.080]  They're still like, oh, you can't touch that app, but it holds a lot of PHI.
[38:48.200 --> 38:50.080]  Yes, and we don't want you to see any of it.
[38:50.160 --> 38:52.200]  Like, I don't care.
[38:52.500 --> 38:55.700]  I don't want to, you know, I'm here to help you.
[38:55.700 --> 38:58.060]  Because you're paying me money to do that.
[38:58.220 --> 39:07.740]  But if they're willing to have some kind of, hey, talk to us if you've got a problem, versus the compliance officer, which is, they didn't put in the compliance officer because they love you.
[39:07.980 --> 39:10.540]  They put in the compliance officer because it's a requirement.
[39:13.500 --> 39:13.940]  Yeah.
[39:14.260 --> 39:15.240]  I learned the hard way.
[39:15.300 --> 39:17.980]  The compliance officer is not the person that wants to hear complaints.
[39:18.160 --> 39:20.240]  They just want to protect that institution.
[39:21.180 --> 39:21.620]  Yeah.
[39:24.460 --> 39:31.240]  So, let's say that some person somewhere decided that they wanted to threaten to sue me, and I don't live in their country.
[39:32.780 --> 39:34.620]  Do I have to care about this?
[39:34.880 --> 39:38.120]  Whether or not there's any veracity to their threat?
[39:39.800 --> 39:40.820]  That's for you, I think.
[39:41.260 --> 39:41.680]  Wait a minute.
[39:41.800 --> 39:48.300]  So, someone in another country is, like, you found a phone in a server elsewhere, and they want to come back at you?
[39:48.740 --> 39:51.420]  Well, let me just describe what happened.
[39:51.520 --> 39:52.600]  Now, this was some years ago.
[39:53.420 --> 40:06.920]  So, I was, as a subscriber of a service, offered a service using a mail forwarder, which turned out to be totally open, and I went to their abuse person and said, hey, by the way, you know, this is a totally open server.
[40:07.080 --> 40:14.420]  So, the person who offered me as a subscriber the use of this service said, oh, my God, you're hacking, and I'm going to sue you.
[40:14.420 --> 40:15.700]  And you can kind of see how that went.
[40:16.420 --> 40:23.300]  But they were in the Netherlands, which is not a country that I have even visited, much less a resident of.
[40:24.200 --> 40:25.520]  Do I have to care?
[40:26.560 --> 40:27.480]  Not as much.
[40:28.640 --> 40:33.680]  The question is this, because every time I get someone who wants to hire me to, like, I want you to go sue these people.
[40:33.780 --> 40:34.120]  Like, why?
[40:35.400 --> 40:38.000]  Like, this is for great justice.
[40:38.000 --> 40:38.760]  Like, really?
[40:40.660 --> 40:42.400]  It's like a $42 fine.
[40:42.520 --> 40:45.580]  I'll pay it just so I don't have to hear this.
[40:46.180 --> 40:49.540]  You know, there's a certain amount of, like, is this really a problem?
[40:49.800 --> 40:52.240]  Like, is this a problem that I'm going to get up and do anything about?
[40:52.340 --> 40:57.400]  Or am I going to fast forward through the Sarah McLachlan, you know, song over the abused cats?
[40:59.840 --> 41:00.800]  It's that problem.
[41:01.060 --> 41:08.560]  Like, so in your case, like, the Dutch company, unless they've suffered some real damage, is likely that's a...
[41:08.560 --> 41:12.820]  Because everyone talks about, I'm going to sue you until, you know, they get a bill from someone like...
[41:12.820 --> 41:14.620]  Until they actually want to put money towards it and do it.
[41:14.740 --> 41:14.840]  Yeah.
[41:16.540 --> 41:17.640]  So, it depends.
[41:17.860 --> 41:22.460]  If you're, like, hey, I just dropped all of Philips' intellectual property.
[41:22.760 --> 41:24.940]  Yeah, you're getting a lawsuit from Philips, even.
[41:25.040 --> 41:26.960]  And they'll come all the way from Holland...
[41:26.960 --> 41:30.040]  They'll come all the way from the Netherlands to put a hurtin' on you.
[41:30.240 --> 41:35.800]  But if it's, you said bad things about my service, yeah, I wouldn't worry about it.
[41:37.000 --> 41:39.280]  And that, I think, is the thing I had to get used to.
[41:39.340 --> 41:45.140]  I thought I was completely legal, but in fact, like everyone else, I'm in the gray zone, and I need guidance about how big the risks are.
[41:45.460 --> 41:47.540]  One real buzzkill, related to her question.
[41:47.940 --> 41:51.200]  On one point, there's a server in Belize stealing passwords.
[41:51.540 --> 41:54.060]  And I said, great, there are no computer laws in Belize.
[41:54.060 --> 41:55.780]  I want to hack in that server and steal them back.
[41:55.900 --> 41:57.660]  And I asked Alex, and he said, you can't do that.
[41:57.720 --> 41:58.380]  And I said, really?
[41:59.120 --> 42:00.300]  He said, yeah, if you're in the U.S. and you hack into a country with no laws, you're still breaking U.S. law.
[42:02.940 --> 42:04.640]  And I said, man, this is a buzzkill.
[42:08.400 --> 42:08.680]  Yeah.
[42:10.280 --> 42:10.640]  Go ahead.
[42:10.640 --> 42:11.180]  Hello.
[42:11.580 --> 42:18.820]  When I thought about doing blockchain voting before, I had always assumed that you would have to have some mapping between individuals in their vote.
[42:19.360 --> 42:23.520]  Is there a way to preserve voter anonymity with your blockchain voting approach?
[42:23.680 --> 42:25.120]  Yeah, well, now, there certainly may be.
[42:25.220 --> 42:32.820]  What I did in this case is when you vote, you put in your email address, and the email address is hashed and stored in a table separate from anything else.
[42:32.960 --> 42:35.680]  And then you get a voting token, and that's what you vote with.
[42:35.860 --> 42:38.600]  So you know your address, but no one else does.
[42:38.600 --> 42:41.380]  And there's no record correlating the address to the email.
[42:41.500 --> 42:43.840]  The only thing is there's a record that that email has now voted.
[42:44.320 --> 42:50.500]  And it's hashed in such a way that if someone steals it off my server, it will not be practical for them to send spam to the email addresses.
[42:50.920 --> 42:53.320]  But that, of course, is a very big issue.
[42:53.320 --> 42:58.280]  And another big issue is how do you make sure people are really citizens of the country and that they don't use two different email addresses.
[42:58.480 --> 43:00.620]  And those are all things that the blockchain doesn't fix.
[43:00.800 --> 43:02.360]  Those have to be handled offline.
[43:02.720 --> 43:03.260]  Thank you.
[43:03.500 --> 43:03.620]  Yeah.
[43:08.300 --> 43:08.920]  Hi, Sam.
[43:09.600 --> 43:15.940]  As a precursor to this question, could you pull up the slide with those three requirements for what made what you did illegal?
[43:16.800 --> 43:18.060]  Oh, well, those...
[43:18.060 --> 43:18.920]  I don't think I had...
[43:18.920 --> 43:20.080]  Or just like the 10-30 slide.
[43:20.080 --> 43:20.720]  I'm not sure.
[43:20.720 --> 43:21.640]  Maybe Alex had one.
[43:21.900 --> 43:22.520]  It was like the 10...
[43:22.520 --> 43:23.980]  Alex might have one listed there.
[43:25.280 --> 43:26.320]  So someplace up here.
[43:27.260 --> 43:27.780]  Go ahead.
[43:28.440 --> 43:29.880]  So you can find...
[43:29.880 --> 43:30.320]  Yeah.
[43:32.260 --> 43:33.000]  Oh, that was it.
[43:33.320 --> 43:33.780]  Oh, there you are.
[43:33.920 --> 43:34.080]  Okay.
[43:34.460 --> 43:34.580]  Yeah.
[43:34.720 --> 43:43.620]  So I remember at your talk two years ago at the previous OAP, you said that the most defined line for making things illegal and legal was running your code on somebody else's hardware.
[43:43.620 --> 43:44.600]  That's what I thought.
[43:44.820 --> 43:47.280]  I thought if you run code on someone's server, you broke the law.
[43:47.380 --> 43:50.000]  And if you pass a security boundary, you broke the law.
[43:50.100 --> 43:51.340]  But that is not true.
[43:51.920 --> 44:02.060]  The law says if you send a signal to a protected computer and the response causes you to have information you are not authorized to have, you've now broken the law.
[44:02.240 --> 44:05.100]  So if you have a URL and you put an apostrophe at the end...
[44:05.100 --> 44:05.480]  Yeah, that was...
[44:05.480 --> 44:08.760]  And then you see a SQL injection error message, you've now broken the CFAA.
[44:09.160 --> 44:11.940]  Because now you know something that they would rather you don't know.
[44:12.560 --> 44:18.200]  Years ago, people told me, if you violate their perceived terms of service, you've broken the law.
[44:18.360 --> 44:21.260]  And that appears to be true, although I didn't believe it.
[44:22.180 --> 44:23.180]  Is that fair enough?
[44:23.840 --> 44:26.060]  That's a better definition than I had.
[44:27.920 --> 44:29.170]  So it's actually...
[44:29.580 --> 44:36.060]  Because there's some cases, and I'm spacing on the one, where information that was public...
[44:37.460 --> 44:39.920]  Someone had misconfigured a DNS server.
[44:40.180 --> 44:45.420]  And you could do a dig AXFR and get the whole, you know, here's a whole zone transfer.
[44:45.660 --> 44:46.060]  Bloop!
[44:46.160 --> 44:46.980]  With no authentication.
[44:47.700 --> 44:49.840]  And it's like, this is, you know...
[44:49.840 --> 44:51.540]  Oh my God, they're going to know these secrets.
[44:51.920 --> 44:54.220]  Like, your publicly accessible DNS entries?
[44:55.880 --> 44:57.240]  That's if you want to have public.
[44:57.580 --> 45:01.420]  And it's like, nope, it's still a violation of the CFAA, because you should have known.
[45:01.720 --> 45:02.320]  Like, I...
[45:02.320 --> 45:05.460]  See, the problem is, there's an intention in there.
[45:05.580 --> 45:09.380]  And the intention is, the intention to find something that you probably shouldn't see.
[45:09.380 --> 45:10.900]  And that's the intention I have.
[45:11.000 --> 45:20.540]  Not the intention to do harm, but I clicked on that link, not because I was a customer of that hospital and I had a legitimate right to look at those records, because I thought something I shouldn't see was there.
[45:20.680 --> 45:21.680]  And that violates...
[45:21.680 --> 45:22.800]  That constitutes a violation.
[45:23.400 --> 45:23.740]  Okay.
[45:23.980 --> 45:25.860]  Just kind of a really quick follow-up question.
[45:25.980 --> 45:29.160]  I remember a couple years ago, there was a story about somebody who hacked a slot machine.
[45:29.700 --> 45:35.280]  And he got lots and lots of money out of it, but he didn't actually use any external hardware to break it.
[45:35.340 --> 45:37.780]  He just used what was available to him on the interface.
[45:38.040 --> 45:38.400]  Yeah.
[45:38.400 --> 45:39.540]  And that was his defense.
[45:39.680 --> 45:40.120]  He got off.
[45:40.280 --> 45:45.040]  And there was nothing wrong with what he did, according to his lawyer, because he didn't actually use any external tools.
[45:45.160 --> 45:45.840]  He just pressed...
[45:45.840 --> 45:48.300]  The quote was, he pressed the buttons in the right order.
[45:48.880 --> 45:55.420]  And so, that was actually the example that you used at your talk, SQL injection, where if you just put the apostrophe in and get the error message...
[45:55.940 --> 45:55.960]  Yeah.
[45:55.960 --> 45:56.680]  I thought that was okay.
[45:56.760 --> 45:56.960]  That was where he stopped.
[45:57.100 --> 45:58.040]  And you said that was where it stopped.
[45:58.120 --> 45:58.920]  One difference.
[45:59.300 --> 45:59.500]  Okay.
[45:59.520 --> 46:00.700]  A slot machine is...
[46:00.700 --> 46:03.440]  It may not be a protected computer under the computer fraud.
[46:03.440 --> 46:03.640]  That's right.
[46:03.640 --> 46:05.560]  It's not connected to the across-state transfer.
[46:05.720 --> 46:06.960]  So, CFAA doesn't apply.
[46:07.060 --> 46:08.160]  Some other law would probably apply.
[46:08.160 --> 46:13.960]  But, yeah, I thought SQL injection tests were legal, but they aren't as 100% legal.
[46:14.080 --> 46:14.680]  Now, there's a difference.
[46:14.860 --> 46:16.840]  There are things that are so illegal, you'll actually go to jail.
[46:16.960 --> 46:18.560]  And there are things that are completely clear.
[46:18.720 --> 46:19.820]  And then there's this gray zone.
[46:20.020 --> 46:23.100]  And putting an apostrophe at the end, I don't think anyone would go to prison just for that.
[46:23.280 --> 46:25.140]  But, it is not 100% legal.
[46:25.280 --> 46:26.240]  It's a little bit into the gray.
[46:26.500 --> 46:26.800]  Okay.
[46:27.020 --> 46:30.920]  So, these are the most clearly defined standards for where legal...
[46:30.920 --> 46:32.420]  Well, this is just from the CFA.
[46:32.620 --> 46:33.300]  I just read the thing.
[46:33.600 --> 46:33.640]  Okay.
[46:33.680 --> 46:37.560]  But it was written a long time ago, and it's written like a choose-your-own-adventure novel.
[46:37.560 --> 46:39.640]  One in column 33, one in column here.
[46:39.820 --> 46:44.380]  And there's a combination of columns that cover almost everything of the slightest interest.
[46:45.100 --> 46:53.800]  So, technically, almost everything in the world of hacking and security testing is illegal, unless you have a contract giving you permission to do it on that server, which I didn't know.
[46:56.100 --> 46:56.540]  All right.
[46:56.660 --> 46:56.940]  Let me see.
[46:57.140 --> 46:57.500]  How are we doing?
[46:58.000 --> 46:58.040]  Thank you.
[46:58.320 --> 46:58.480]  Yeah.
[47:00.360 --> 47:02.260]  Well, I reckon we probably used up our time.
[47:03.300 --> 47:04.400]  Yeah, we got a couple minutes.
[47:04.540 --> 47:05.260]  Are there any more questions?
[47:05.520 --> 47:05.920]  Oh, no, no.
[47:05.920 --> 47:06.120]  Okay.
[47:06.120 --> 47:07.760]  I just have a quick question.
[47:07.880 --> 47:13.900]  Would it have made any difference if you had been a patient at the hospital and you had seen your own record?
[47:14.200 --> 47:14.560]  Wow.
[47:14.740 --> 47:15.220]  Would it have?
[47:15.220 --> 47:16.220]  Ooh.
[47:16.560 --> 47:21.500]  I think the answer is still no.
[47:21.980 --> 47:31.940]  Even though you have a right under HIPAA to view your own records, I don't know if that would supersede the Computer Fraud and Abuse Act.
[47:31.940 --> 47:34.020]  And, of course, the danger of this...
[47:34.020 --> 47:34.840]  Because actually, wait a minute.
[47:35.460 --> 47:36.680]  I'm thinking of a case.
[47:36.920 --> 47:40.000]  I got a phone call from the EFF about a referral.
[47:40.180 --> 47:41.660]  Like, hey, Pennsylvania, you're there.
[47:42.580 --> 47:47.920]  Someone had found a vulnerability in a government, a state government website.
[47:48.340 --> 47:54.040]  And to test it, they used their own records because they were also a Pennsylvania resident.
[47:54.060 --> 47:56.640]  And they said, I can pull up my own records without authentication.
[47:58.440 --> 48:00.380]  And I remember, like, really puzzled.
[48:00.480 --> 48:01.120]  Like, well, wait a minute.
[48:01.360 --> 48:07.800]  If you have a right to view the record, does that supersede the not without permission?
[48:08.040 --> 48:17.300]  And I was like, you know, there's a rule about this in law, which is if you get that case, that makes precedent, which means you go and you argue it.
[48:17.380 --> 48:20.040]  The problem with precedent is that went through two courts.
[48:20.180 --> 48:22.280]  It went through the trial court and then went to the appeals court.
[48:23.140 --> 48:29.880]  You don't want to be that guy because you just spent five to six years dealing with me or someone like me.
[48:30.080 --> 48:32.140]  And I'm the most important person in your life.
[48:32.260 --> 48:34.880]  And you never want me to be the most important person in your life.
[48:35.320 --> 48:37.580]  Because I get grading really fast.
[48:39.540 --> 48:42.200]  There was something someone said about the slot machine.
[48:42.300 --> 48:46.160]  It reminded me to point out this Ethereum DAO hack is very interesting legal.
[48:46.260 --> 48:47.020]  I just want to mention it.
[48:47.020 --> 48:52.360]  They had this system where you can make code that runs an autonomous company outside any government and law.
[48:52.680 --> 48:55.300]  And it said explicitly that the code is what matters.
[48:55.480 --> 48:58.300]  Any statements made about the code and say the documentation don't matter.
[48:58.580 --> 49:00.920]  And then someone found a way to hack it and steal all the money.
[49:01.160 --> 49:02.620]  And they said, you stole the money.
[49:02.740 --> 49:03.280]  This is terrible.
[49:03.360 --> 49:05.600]  He said, I played the game by your rules.
[49:05.720 --> 49:07.240]  It says right here the code is the rules.
[49:07.380 --> 49:10.040]  I'm a legitimate customer investing and I deserve that money.
[49:10.360 --> 49:12.560]  And they did roll it back to save the money.
[49:12.620 --> 49:13.920]  But this is a very interesting case.
[49:13.920 --> 49:19.720]  If you do place your money in something that is not covered by any laws or government, then what do you do when someone steals it?
[49:20.320 --> 49:22.500]  And this guy claimed he didn't hack anything.
[49:22.640 --> 49:23.840]  He played the game by your rules.
[49:23.960 --> 49:24.700]  It's not my fault.
[49:24.780 --> 49:25.920]  You wrote a bunch of stupid rules.
[49:26.580 --> 49:27.760]  Anyway, have you got a question?
[49:28.100 --> 49:28.440]  Yeah.
[49:28.680 --> 49:30.920]  There's actually an instance where...
[49:31.620 --> 49:32.160]  Speak up.
[49:32.860 --> 49:34.000]  So, back story.
[49:34.320 --> 49:35.160]  There was this blog.
[49:35.640 --> 49:36.080]  Somebody...
[49:36.080 --> 49:36.760]  There was this...
[49:37.560 --> 49:38.000]  Sorry.
[49:38.000 --> 49:38.120]  Right.
[49:38.360 --> 49:39.320]  There was this blog.
[49:39.640 --> 49:47.640]  And this guy, stupidly, he had a demo running the database shared with the blog.
[49:47.940 --> 49:50.700]  Long story short, I have the entire schema.
[49:51.120 --> 49:51.640]  Yeah.
[49:51.640 --> 49:54.720]  And stupidly, I didn't use a proxy.
[49:55.000 --> 49:57.720]  So, there were like a couple days where I was like, oh shit.
[49:58.740 --> 50:01.100]  The FBI is going to show up at my door any day now.
[50:02.500 --> 50:02.900]  Yeah.
[50:03.400 --> 50:04.500]  I mean, that can happen.
[50:04.680 --> 50:05.980]  And technically, you've done something wrong.
[50:06.120 --> 50:07.740]  And so, this is why you call a lawyer.
[50:08.320 --> 50:08.420]  Yeah.
[50:08.500 --> 50:10.120]  Like, I didn't disclose it.
[50:11.040 --> 50:11.440]  But...
[50:11.440 --> 50:11.540]  Sure.
[50:11.540 --> 50:14.580]  At the same time, I didn't release it.
[50:14.720 --> 50:14.740]  Yeah.
[50:14.740 --> 50:16.620]  He stored the passwords in plain text.
[50:16.800 --> 50:17.800]  I got a...
[50:18.320 --> 50:21.240]  Ironically and sadly, we have a perverse incentive here.
[50:21.400 --> 50:21.520]  Yeah.
[50:21.820 --> 50:27.280]  I remember one time getting a similar question and I was very angry.
[50:27.480 --> 50:29.280]  I had a very low blood sugar and I was hungover.
[50:29.280 --> 50:36.200]  And I just said, really the safest path is to sell it on the Vaughan market rather than actually disclosing it.
[50:36.320 --> 50:41.540]  Because disclosure, the responsible disclosure is essentially saying...
[50:41.540 --> 50:42.840]  I hacked your system.
[50:42.840 --> 50:43.240]  I...
[50:43.240 --> 50:44.460]  Well, I found this out.
[50:44.820 --> 50:56.160]  I, me, this face, some contact information, and I'm putting my freedom in your hands to not be a dick about it.
[50:56.300 --> 50:57.360]  So, what do I do?
[50:57.600 --> 50:58.900]  Like, because this guy...
[50:58.900 --> 51:03.900]  Serious professionals have told me, if you find a Vaughan, don't tell them and let them get hacked.
[51:04.040 --> 51:05.720]  That is the most professional thing to do.
[51:05.820 --> 51:06.380]  Like, literally...
[51:06.380 --> 51:09.660]  I don't have the heart to do that, but that is the safest, wisest course of action.
[51:09.820 --> 51:11.480]  Like, literally, I like...
[51:11.480 --> 51:14.500]  I literally just ran SQL map and I'm like...
[51:14.500 --> 51:14.680]  Yeah.
[51:15.000 --> 51:16.800]  I just went full on script kitty.
[51:16.980 --> 51:17.600]  Like, it's...
[51:17.600 --> 51:21.080]  It's like, you've got this site and you're sharing the database.
[51:21.340 --> 51:21.440]  Yeah.
[51:21.440 --> 51:23.160]  You've got a demo that's vulnerable.
[51:23.860 --> 51:24.000]  If...
[51:24.000 --> 51:26.340]  Here's what I thought of.
[51:26.480 --> 51:32.660]  And admittedly, it was at the end of PumpCon, so I may have not been coherent at the time.
[51:32.920 --> 51:41.220]  But the idea of creating a vulnerability disclosure model for immature shops, because that's what these are.
[51:41.220 --> 51:42.260]  They're not...
[51:42.260 --> 51:43.820]  They're not the people who have a bug bounty.
[51:44.000 --> 51:46.240]  They're, you know...
[51:46.240 --> 51:46.840]  Joe...
[51:46.840 --> 51:55.340]  Joe is good with computers and put up a WordPress blog for your whatever, and they did it badly, is to have some kind of intermediary.
[51:55.480 --> 52:02.880]  Basically, contact and say, some guy who you'll never talk to found phones in your site, you should fix it.
[52:03.020 --> 52:04.100]  Like, can I go to the...
[52:04.100 --> 52:05.420]  Like, can I go to the...
[52:05.420 --> 52:05.900]  No.
[52:06.140 --> 52:07.620]  The feds and say something, or...
[52:07.620 --> 52:08.200]  Because...
[52:08.200 --> 52:08.380]  Okay.
[52:08.620 --> 52:08.960]  Hi.
[52:08.960 --> 52:10.520]  I committed a crime.
[52:10.740 --> 52:13.200]  Who should I go talk to about the crime I just committed?
[52:13.400 --> 52:13.600]  Yes.
[52:13.760 --> 52:14.480]  Law enforcement.
[52:17.040 --> 52:17.900]  That's the problem.
[52:18.200 --> 52:21.780]  Now, you could also send it to news agencies or WikiLeaks and all that jazz, you know, but...
[52:21.780 --> 52:22.740]  Like, part of me...
[52:22.740 --> 52:23.340]  But it's very unsatisfying.
[52:23.420 --> 52:27.460]  Part of me wants to go full on script kiddie with this and just like say, That's also a bad idea.
[52:27.460 --> 52:27.660]  Hey, I've got this.
[52:27.860 --> 52:30.040]  Let me just throw it on tour and just say...
[52:30.720 --> 52:32.280]  I mean, it's an option.
[52:32.500 --> 52:36.540]  But, you know, if you do go to news agencies, they might tell them about it for you.
[52:36.540 --> 52:37.820]  I've seen some that say they will now.
[52:37.820 --> 52:40.500]  You can submit something and they'll supposedly talk to the company.
[52:40.740 --> 52:41.540]  It's a problem.
[52:41.960 --> 52:44.540]  I know some people have ideas of making startups to do this.
[52:44.720 --> 52:46.360]  I think the law makes it very difficult.
[52:46.680 --> 52:47.040]  If you're...
[52:47.040 --> 52:47.940]  If you're actually...
[52:47.940 --> 52:49.060]  If it's a significant volume.
[52:49.200 --> 52:52.380]  If it's something like, it's not just some guy's blog about, you know...
[52:52.380 --> 52:55.340]  Oh, no, it's just some guy's blog, but he shared the system.
[52:55.800 --> 52:56.500]  But it was...
[52:56.500 --> 52:57.500]  Think of the importance, right?
[52:57.900 --> 53:00.500]  If you then said, I found this volume, they're like, I don't care.
[53:00.740 --> 53:10.360]  If it's something significant, if it's like, hey, it's a medical device manufacturer and I found this volume and I can, you know, I can give you extra, I can give you an extra double dose of insulin.
[53:10.360 --> 53:10.780]  Yeah.
[53:11.160 --> 53:13.120]  But you're not sure about disclosing it.
[53:13.900 --> 53:14.580]  Hit the...
[53:14.580 --> 53:16.440]  The EFF has a referral list.
[53:16.520 --> 53:18.480]  So you might be able to find someone who's like, yeah, I...
[53:18.480 --> 53:20.720]  Because the one thing you can do is this.
[53:20.960 --> 53:26.040]  If I am retained by someone who finds this, I don't have to reveal who hired me.
[53:26.760 --> 53:29.520]  I can just say, some guy found this volume.
[53:29.840 --> 53:32.060]  Here's the proof, here's the proof of concept.
[53:32.600 --> 53:34.000]  Go, go and take it.
[53:34.160 --> 53:36.620]  The downside is there's no way to make money from this model.
[53:36.800 --> 53:40.260]  Well, the most important thing I want to say is get a lawyer.
[53:40.740 --> 53:43.280]  This is deep water and you could get in trouble.
[53:43.420 --> 53:44.860]  Get a lawyer and listen to what they say.
[53:45.400 --> 53:46.760]  Before you do anything foolish.
[53:49.340 --> 53:49.780]  Yeah.
[53:49.860 --> 53:51.920]  It looks like we better quit.
[53:52.880 --> 53:53.560]  Nobody waiting.
[53:53.560 --> 53:56.320]  I think now is the time to cut it and make room for the next speaker.
[53:56.540 --> 53:56.820]  Thank you.