[00:02.570 --> 00:03.510]  All right, thanks for that.
[00:04.050 --> 00:06.770]  Anybody in here reverse malware or reverse anything in general?
[00:07.070 --> 00:07.650]  Reverse engineering?
[00:07.950 --> 00:08.310]  Okay.
[00:08.610 --> 00:09.410]  There's a few out there.
[00:09.710 --> 00:17.430]  So basically this is some research that I was doing while I was actually building a sandbox tackler to actually make the virtual machines look like physical machines.
[00:17.810 --> 00:20.070]  And it's some research that I'll go into in a little bit here.
[00:20.170 --> 00:26.030]  So if you guys want to hit me up, a lot of these tools will be released open-source, MIT license, so you can feel free to do whatever you like with them.
[00:26.310 --> 00:31.750]  So right now I'm porting them all over from C to some other languages that are more sysadmin friendly.
[00:32.390 --> 00:37.710]  So yeah, as you guys know, I'm doing... I do pen testing for a living.
[00:37.830 --> 00:39.310]  Been doing it professionally about 11 years.
[00:39.870 --> 00:42.430]  I've spoken at DEF CON several times.
[00:43.530 --> 00:44.770]  Doing Black Hat this year.
[00:44.950 --> 00:47.930]  Doing two DEF CON talks this year also.
[00:48.230 --> 00:51.410]  So I'm doing a ton of research into ATM hacking, which is awesome.
[00:51.890 --> 00:54.030]  So yeah, point of sale hacking also.
[00:54.510 --> 00:59.250]  So yeah, I do a lot of... I actually built a blockchain where you can pass off live EMV transactions.
[00:59.450 --> 01:00.130]  It's the first of its kind.
[01:00.130 --> 01:06.450]  So you can basically grab... or the bad people can grab live credit card transactions out of memory.
[01:06.610 --> 01:10.450]  And they can actually inject the actual first stage of communication for EMV transactions.
[01:10.770 --> 01:12.750]  So it's something where it hasn't been done in the past.
[01:12.930 --> 01:16.470]  And it's something where we want to get some people thinking on ways to actually protect it.
[01:17.370 --> 01:23.030]  So... and I did... my telephone denial of service talk got the attention of DHS a couple years back.
[01:23.370 --> 01:30.110]  So the University of Houston were doing a PSAP mitigation methods for stopping telephone denial of service for EMV.
[01:30.130 --> 01:30.750]  E911 Center.
[01:30.830 --> 01:32.330]  So really cool projects working on the side.
[01:32.490 --> 01:36.250]  Like I said, also hacks on property management software.
[01:36.430 --> 01:37.070]  So hotel keys.
[01:37.490 --> 01:46.570]  I modified Sammy Kamkar's mag spoofer to actually do brute forcing so it can handle the heat of a lot more credit card actual mag strip transactions.
[01:46.810 --> 01:48.170]  So it's a pretty cool device.
[01:48.210 --> 01:52.770]  If you guys are into ATM hacking or just point of sale hacking, hit me up on Twitter or something else.
[01:53.050 --> 01:53.230]  So...
[01:54.250 --> 02:00.230]  And yeah, I funded all my resources here by unbricking 180 3 terabyte Seagate hard drives.
[02:01.510 --> 02:09.590]  So that afforded me to buy all the awesome stuff I have in my hackerspace, such as ATM machines, build gas pump skimmers, a bunch of other really cool stuff.
[02:09.610 --> 02:11.290]  So for some research I was doing, so...
[02:11.290 --> 02:17.850]  And then also, yeah, just to buy some pretty beefy computers and things like that I needed for some of the actual back-ends that I made.
[02:18.110 --> 02:18.370]  So...
[02:18.770 --> 02:19.810]  Yeah, so that was pretty cool.
[02:20.110 --> 02:21.350]  I have a pretty neat hackerspace.
[02:21.470 --> 02:21.930]  I love it to death.
[02:22.110 --> 02:24.850]  If you guys don't have hackerspaces, definitely get to be part of one.
[02:25.070 --> 02:25.670]  It's pretty cool.
[02:26.010 --> 02:26.670]  I actually...
[02:26.670 --> 02:28.510]  I did some other really cool...
[02:28.510 --> 02:30.270]  Right there is the actual mag spoofer.
[02:30.430 --> 02:35.150]  So that thing with the huge wire on it actually generates EM fields that can talk to magnetic head readers.
[02:35.670 --> 02:37.530]  So that's what I use for brute forcing.
[02:37.710 --> 02:39.230]  That one has a pretty heavy-duty battery in it.
[02:39.230 --> 02:39.230]  Right.
[02:39.630 --> 02:43.770]  And then some of the other ones are 88 cent device that can stop gas pump skimmers.
[02:43.990 --> 02:45.090]  So that's some pretty cool stuff.
[02:45.190 --> 02:48.230]  If you are all about looping serial data, then you can see some skimmers on the side.
[02:48.530 --> 02:48.690]  So...
[02:49.690 --> 02:50.710]  Anyways, yeah.
[02:50.890 --> 02:52.770]  So brute forcing made keys, things like that.
[02:53.090 --> 02:53.330]  So...
[02:53.330 --> 02:57.990]  And then, yeah, sending hidden instructions through interface device instructions through a secure mag strip transaction.
[02:59.010 --> 02:59.450]  So...
[02:59.450 --> 03:00.690]  And let's just talk about...
[03:00.690 --> 03:02.810]  Enough tangents about other security stuff.
[03:03.030 --> 03:03.430]  So...
[03:03.430 --> 03:06.910]  Making computers immune to ransomware is the actual concept behind it.
[03:06.910 --> 03:09.670]  I have some actual software methods.
[03:09.850 --> 03:15.210]  And then I actually have a couple of hardware methods for people who don't want to install stuff written by Weston on their computer.
[03:15.550 --> 03:15.710]  So...
[03:16.610 --> 03:18.370]  So basically, I'm going to show how the tools are used.
[03:18.450 --> 03:20.090]  A brief history of malware and ransomware.
[03:20.510 --> 03:22.650]  How I came across some of the malware.
[03:22.670 --> 03:23.410]  It's pretty interesting.
[03:23.630 --> 03:27.490]  And it involved trading interstellar credits for any EVE people that are out there.
[03:28.050 --> 03:28.410]  So...
[03:28.410 --> 03:31.530]  How it was pulled apart and how the actual payload evasion methods work.
[03:31.970 --> 03:32.330]  So...
[03:32.330 --> 03:40.590]  And how to defend your system from the droppers, the actual main payloads, instead of just relying on heuristics, data from the actual anti-virus engines, which everybody in the room pretty much knows is dead.
[03:40.970 --> 03:41.170]  So...
[03:41.770 --> 03:45.210]  In effect, making your computer immune to most modern malware and ransomware.
[03:46.770 --> 03:47.170]  So...
[03:47.170 --> 03:47.830]  So...
[03:47.830 --> 03:48.410]  How did this start out?
[03:48.550 --> 03:56.570]  I actually started building a tackler for a virtual machine, which basically takes a look at what malware is looking for and then makes it true on the virtual machine so it looks like a physical machine.
[03:56.770 --> 04:02.870]  So instead of having 43 Ida Pro slides, as much as everyone would appreciate that, I'm going to go a little bit more conceptual.
[04:02.870 --> 04:06.690]  And yeah, you guys will actually be able to look at the code a little bit after September here.
[04:06.930 --> 04:07.210]  So...
[04:07.770 --> 04:08.170]  Yeah.
[04:08.270 --> 04:11.970]  I'm going to look at the actual unpackers and the injectors in a little bit of detail also.
[04:12.250 --> 04:12.650]  So...
[04:12.650 --> 04:14.470]  So which ransomware was this tested on?
[04:14.670 --> 04:16.230]  I tested it on Samsung...
[04:16.230 --> 04:16.950]  Or excuse me, not Samsung.
[04:17.470 --> 04:17.870]  SamSam.
[04:18.390 --> 04:22.070]  They had a couple of custom variants that were released pretty recently.
[04:22.250 --> 04:26.770]  Then also the original versions of CryptoLocker, CryptoWall, Locky.
[04:26.770 --> 04:32.410]  There's a bunch of other off-brand or Sam's Club type ones that, you know, just spawned once or twice.
[04:32.590 --> 04:33.390]  So it's something where...
[04:33.390 --> 04:36.010]  Yeah, I also got a lot of it working on those variants.
[04:36.610 --> 04:36.970]  So...
[04:36.970 --> 04:38.950]  Yeah, so this works on 26 different variants.
[04:39.090 --> 04:43.290]  It's not just, you know, me getting it to work on one and then claiming the sky is falling.
[04:44.370 --> 04:44.730]  So...
[04:44.730 --> 04:46.170]  Oh yeah, ransomware had to evolve.
[04:46.410 --> 04:51.150]  So originally ransomware, it started out as, you know, just locking your computer screen.
[04:51.150 --> 04:56.350]  And there became next-generation features inside of firewalls, other IDS environments.
[04:56.690 --> 05:02.150]  And it actually required the malware to start evading actual sandbox methods.
[05:02.530 --> 05:04.230]  So that's what actually led to my...
[05:04.230 --> 05:08.070]  Some of the sandbox simulators and stuff like that that I actually developed.
[05:08.230 --> 05:10.150]  Then I'm putting them all into one toolset.
[05:10.550 --> 05:10.830]  So...
[05:11.550 --> 05:13.790]  And yeah, some of the next-generation security features.
[05:13.990 --> 05:16.210]  So some of the next-generation firewalls, things like that.
[05:16.390 --> 05:17.710]  They'll actually spin up a virtual machine.
[05:17.710 --> 05:22.170]  And the actual malware is now looking to see if it has, you know, Outlook installed.
[05:22.330 --> 05:25.290]  If there's actually received emails instead of just looking for the presence of some of that stuff.
[05:25.630 --> 05:28.170]  It'll also look for... to see if people are trying to tear it apart.
[05:28.310 --> 05:28.790]  If there's...
[05:28.790 --> 05:32.690]  I've seen ones that actually go after IDA Pro licenses, stuff like that.
[05:32.810 --> 05:37.150]  So they're getting very evasive in the actual methods that they use to detect if it's a real environment.
[05:37.430 --> 05:39.470]  Along with some of the memory allocation.
[05:39.510 --> 05:48.630]  One of the first ones that I built was actually making my computer look like it had 2 gigs of RAM instead of 16 gigs for the actual machine that I was trying it out on.
[05:48.930 --> 05:49.050]  So...
[05:49.050 --> 05:53.570]  And the second that it saw that it did not have, you know, over 2 gigs of RAM, it assumed it was a simulated machine.
[05:53.710 --> 05:56.070]  And that was on a very, very old malware.
[05:56.250 --> 05:57.830]  It's gotten a lot more complex since then.
[05:57.950 --> 06:00.010]  But that's where that original concept was conceived.
[06:00.310 --> 06:00.630]  So...
[06:02.030 --> 06:03.670]  So yeah, the basics... the basis behind it.
[06:03.710 --> 06:07.190]  It's gonna be able to detect the physical machines from the actual virtual machines.
[06:07.190 --> 06:19.030]  And if anybody does reversing for as far as malware goes, it's very hard for some of the new methods to actually get them to fully do what they're gonna do in your sandbox environment to see specifically what they're going for.
[06:19.190 --> 06:28.910]  So that's why myself and a couple of the researchers actually, we actually have a couple sandboxes out in the wild actually grabbing malware.
[06:29.070 --> 06:32.910]  We also have a disposable mail service that is used for a lot of...
[06:32.910 --> 06:37.310]  It's one of his honeypots that he runs out on the dark web.
[06:37.550 --> 06:37.790]  So...
[06:37.790 --> 06:38.430]  It's pretty cool.
[06:38.510 --> 06:40.730]  We come across a lot of crazy executable files.
[06:40.970 --> 06:43.010]  And we like to pull apart the special looking ones.
[06:44.150 --> 06:44.550]  So...
[06:44.550 --> 06:45.230]  And yeah...
[06:45.230 --> 06:45.930]  So...
[06:45.930 --> 06:52.170]  This year, while everybody else is enjoying Christmas with their families, I was receiving the earlier versions of...
[06:52.170 --> 06:56.110]  It was one of the newer toolkits that actually launched some of the malware.
[06:56.590 --> 06:56.990]  So...
[06:56.990 --> 06:57.770]  I was one of the...
[06:57.770 --> 07:02.430]  Me and a couple of other researchers were actually looking at, you know, how the actual payloads were developed.
[07:02.430 --> 07:03.750]  And a lot of the evasion methods.
[07:03.930 --> 07:06.430]  That the newest versions that they're going to be launching over the next year.
[07:07.470 --> 07:09.710]  And this is one of the things that led into the...
[07:09.710 --> 07:12.530]  They actually went with the software service platform this time around.
[07:12.910 --> 07:14.630]  Which is another buzzword from a couple of years back.
[07:14.910 --> 07:15.170]  So...
[07:15.170 --> 07:19.310]  It's something where, you know, with X amount of Bitcoins, you can actually launch a campaign.
[07:19.630 --> 07:22.330]  You literally just throw some MX records in there.
[07:22.530 --> 07:24.270]  And then it'll actually track who's paid.
[07:24.830 --> 07:26.890]  You know, how your actual progress and your stuff's going.
[07:27.310 --> 07:30.570]  And they actually have better technical support than most of the vendors out there.
[07:30.570 --> 07:30.950]  So...
[07:30.950 --> 07:32.810]  For the people to actually get Bitcoins and stuff.
[07:32.930 --> 07:33.450]  It's pretty crazy.
[07:33.690 --> 07:35.410]  It's like I was saying, it's a full service now.
[07:35.930 --> 07:36.390]  And it's...
[07:36.390 --> 07:36.970]  I think...
[07:36.970 --> 07:39.810]  The last figures that I saw, they were making somewhere around 40 to 50 million.
[07:40.490 --> 07:40.810]  Depending...
[07:40.810 --> 07:41.510]  Per month, actually.
[07:41.810 --> 07:44.270]  On some of the actual ransomware that are going out there.
[07:45.310 --> 07:45.630]  So...
[07:46.270 --> 07:47.630]  And how did I get my first sample of it?
[07:47.630 --> 07:48.170]  Like I said...
[07:49.050 --> 07:51.330]  He was an acquaintance that I actually met at Defcon 18.
[07:51.930 --> 07:53.110]  I met him at the Toxic Barbecue.
[07:53.550 --> 07:53.910]  And...
[07:54.390 --> 07:55.410]  It was a pretty...
[07:55.410 --> 07:56.570]  He was a pretty interesting guy.
[07:56.810 --> 07:58.490]  We went off on tangents back and forth.
[07:58.610 --> 07:59.430]  And it was a pretty good time.
[08:00.150 --> 08:00.510]  So...
[08:00.510 --> 08:03.010]  But yeah, he's pretty heavy into the malware scene, reversing scene.
[08:04.070 --> 08:06.630]  Yeah, he runs a lot of self-destructing mail services.
[08:06.970 --> 08:11.430]  And he has a couple other honeypots out there that just have amazing pieces of malware.
[08:11.590 --> 08:13.130]  We come across a lot of custom-tailored stuff.
[08:14.030 --> 08:15.550]  Like I was saying...
[08:15.550 --> 08:17.010]  This New Year's, he reached out to me.
[08:17.110 --> 08:19.790]  And I actually had to reactivate my EVE account to send to some ISK.
[08:20.210 --> 08:20.370]  Because...
[08:21.190 --> 08:23.390]  I was really, really interested in getting this one.
[08:23.430 --> 08:24.610]  He was talking about it for a while.
[08:24.870 --> 08:25.130]  So...
[08:25.130 --> 08:27.790]  And it was something that once it was actually launched...
[08:27.790 --> 08:31.630]  Before they actually started setting it up on the malicious servers, we actually got the first end of it.
[08:31.810 --> 08:33.850]  I wish I would have torn it apart a little more thoroughly.
[08:33.990 --> 08:35.750]  There was a couple of vulnerabilities in zero-days.
[08:35.770 --> 08:36.930]  I could have got some bug bounties on.
[08:37.710 --> 08:38.030]  So...
[08:38.030 --> 08:39.990]  But as far as the actual specific malware...
[08:39.990 --> 08:40.670]  I started ready...
[08:40.670 --> 08:41.150]  Oh, let's see here.
[08:42.190 --> 08:42.630]  Oh, yeah.
[08:42.710 --> 08:43.770]  The actual ones that...
[08:43.770 --> 08:45.510]  I'm gonna be doing a talk down in Georgia.
[08:46.150 --> 08:48.130]  I came across one of the first of its kind.
[08:48.330 --> 08:49.790]  It's an ICS-based malware.
[08:50.010 --> 08:51.510]  So it's going after industrial control systems.
[08:51.690 --> 08:54.610]  This one is specific to Top Drive and Kelly Rig systems.
[08:55.110 --> 08:58.130]  So it's the actual first one that's actually ever gone after oil wells.
[08:58.210 --> 08:59.550]  It steals some of the drilling information.
[08:59.990 --> 09:00.390]  So...
[09:00.390 --> 09:00.970]  That's what I'm saying.
[09:01.050 --> 09:05.490]  When we come across custom-tailored stuff, it's some of the things that don't show up on a lot of the vendor's pages.
[09:05.930 --> 09:06.150]  So...
[09:06.150 --> 09:10.610]  So if you guys are into ICS malware, that's definitely gonna be online eventually.
[09:10.870 --> 09:11.170]  So...
[09:11.170 --> 09:12.550]  And I'll release my slides after that, too.
[09:12.550 --> 09:12.930]  So...
[09:13.350 --> 09:13.830]  But, yeah.
[09:14.930 --> 09:15.430]  So, yeah.
[09:15.530 --> 09:17.750]  Like I said, they're launching it as a software-as-a-service platform.
[09:17.930 --> 09:19.810]  There's no need to set up the servers anymore.
[09:19.950 --> 09:27.750]  There's no need to actually launch your own campaigns, reflect emails, all the things that stopped bad people and ended up in spam folders.
[09:27.970 --> 09:30.270]  So they actually have ways to generate a lot of these lists.
[09:30.710 --> 09:34.010]  They have actual professional teams working around the clock developing this.
[09:34.470 --> 09:39.510]  Some of the droppers I've seen change their signature like 30 minutes on time.
[09:39.510 --> 09:44.790]  It's just amazing how quick they're actually evolving this to avoid signature detection, especially for the droppers.
[09:45.010 --> 09:47.330]  And the droppers are the first bit.
[09:47.410 --> 09:50.430]  It's kind of like the snow plow that comes before the bus, which is the actual part.
[09:50.570 --> 09:55.850]  And a lot of the droppers were actually going after watchdogs on antivirus software.
[09:55.850 --> 09:59.010]  So that's one of the big things that I actually exploited in our favor.
[09:59.330 --> 10:00.950]  And it's something that... yeah.
[10:01.810 --> 10:03.030]  So this is what a dropper is.
[10:03.130 --> 10:05.870]  It's basically the method that they use to pull the rest of the software down.
[10:05.990 --> 10:12.250]  Because if you... just with some of the current methods for detecting, the bigger the program, the easier it is to detect.
[10:12.490 --> 10:15.350]  So the actual dropper, they're usually small.
[10:15.490 --> 10:20.030]  They're usually involving some kind of user error or some kind of vulnerability in the actual operating system.
[10:20.030 --> 10:29.610]  And this is one of the methods that, you know, where they actually get the main payload and the actual encryption functionality onto the computer.
[10:29.730 --> 10:30.750]  So this is like the first stage.
[10:30.810 --> 10:32.070]  Like I said, it's the snow plow.
[10:33.110 --> 10:33.510]  So...
[10:33.510 --> 10:34.850]  And what is the payload?
[10:35.110 --> 10:35.510]  So...
[10:36.030 --> 10:38.690]  So the payload is actually what goes after...
[10:38.690 --> 10:40.010]  what the malware does.
[10:40.210 --> 10:49.190]  Like if it was defined as an encryption malware, or if it, you know, steals passwords, or if it does this or that, or if it ruins a perfectly good install of Windows 7, there's several...
[10:49.730 --> 10:51.430]  Several things that are considered payloads.
[10:51.590 --> 10:51.990]  And that's...
[10:52.950 --> 10:54.110]  That's one of the things that...
[10:54.110 --> 10:54.850]  Yeah, it's...
[10:54.850 --> 10:57.350]  Whatever the payload is, that's what its defined project is.
[10:57.410 --> 11:00.350]  And sometimes they need to actually, you know, take out the antivirus watchdogs.
[11:00.650 --> 11:04.410]  A lot of the newer AV engines, they'll actually detect when things are pulled into memory and encrypted.
[11:05.190 --> 11:05.510]  So...
[11:05.510 --> 11:07.290]  So that's one of the biggest features they go after.
[11:07.630 --> 11:08.930]  And what is a ransomware looking for?
[11:09.010 --> 11:12.610]  So all the ones that have pulled apart, they're looking for files that are near and dear to people.
[11:12.830 --> 11:14.730]  The kinds that people would actually pay money for.
[11:15.290 --> 11:18.410]  Be it in a business setting, or, you know, if it's kitten pictures kind of situation.
[11:18.410 --> 11:18.950]  So...
[11:18.950 --> 11:20.690]  Yeah, these are pretty much graphics, photos.
[11:21.290 --> 11:21.610]  Source...
[11:21.610 --> 11:22.130]  Source codes.
[11:22.350 --> 11:22.930]  A huge one.
[11:23.410 --> 11:29.450]  And a lot of the people that have actually helped, you know, recover, you know, encrypted files and stuff like that, it was just because they needed one or two of them.
[11:29.730 --> 11:31.950]  Because it was like, oh, we backed them up a week and a half ago.
[11:32.310 --> 11:34.430]  So that will also come into play later on in this talk.
[11:34.670 --> 11:34.930]  So...
[11:34.930 --> 11:36.310]  So here's what the malware is looking for.
[11:36.430 --> 11:37.810]  It's going to look specifically for these files.
[11:38.090 --> 11:50.190]  If those file extensions are not there, some of them, the very, very new ones, after I started sharing some of my research, they actually started checking some of the padding information at the beginning of the files to go beyond the actual file extensions.
[11:50.510 --> 11:54.490]  But as far as that goes, I found methods around blocking some of those attacks.
[11:54.890 --> 11:55.070]  So...
[11:56.330 --> 12:00.890]  Yeah, so they're using very advanced features to actually stop people from reverse engineering them.
[12:01.590 --> 12:01.990]  So...
[12:01.990 --> 12:02.390]  And it's...
[12:02.390 --> 12:03.070]  Yeah, just...
[12:03.070 --> 12:05.230]  Like, it literally is as professional...
[12:06.090 --> 12:08.050]  As professional as a lot of the companies that are out there.
[12:08.170 --> 12:11.090]  So it's something where, you know, like, how am I supposed to pull their malware apart now?
[12:11.090 --> 12:13.270]  I accepted the end user license agreement to install it.
[12:13.730 --> 12:14.090]  So...
[12:14.090 --> 12:15.210]  But it's pretty cool.
[12:15.310 --> 12:16.450]  Like, some of the methods...
[12:16.450 --> 12:22.010]  It's like, you know, this used to be in, like, how people would try to get around, like, 30,000, $40,000 software licenses.
[12:22.210 --> 12:24.090]  And now it's included in base malware.
[12:24.470 --> 12:24.730]  So...
[12:24.730 --> 12:25.330]  That's what I'm saying.
[12:25.370 --> 12:27.610]  These guys are sticking a lot of money in research and development.
[12:28.930 --> 12:29.290]  So...
[12:29.290 --> 12:29.530]  Yeah.
[12:29.590 --> 12:30.690]  And actually attacking the dropper.
[12:30.770 --> 12:34.070]  I haven't seen a lot of AV manufacturers out there.
[12:34.170 --> 12:39.930]  And if anybody's ever seen any other open-source free projects that have looked into this kind of stuff, it's definitely something I'd be interested in.
[12:39.930 --> 12:40.450]  So...
[12:40.450 --> 12:41.730]  It's attacking that first stage.
[12:41.850 --> 12:43.330]  This has already gotten past your antivirus engine.
[12:43.450 --> 12:45.190]  This thing was made 24 minutes ago.
[12:45.390 --> 12:46.670]  It's been emailed to one of your employees.
[12:46.810 --> 12:47.550]  It's now on their desktop.
[12:49.230 --> 12:49.550]  So...
[12:49.550 --> 12:49.750]  Yeah.
[12:49.830 --> 12:51.230]  As you can see, this one actually...
[12:52.290 --> 12:52.930]  It bypassed...
[12:52.930 --> 12:55.690]  It bypassed all the heuristics engines on all the antiviruses that are added on.
[12:55.910 --> 12:58.170]  So it was, like, six or seven of them.
[12:58.230 --> 12:59.930]  I wasn't just picking on this one.
[13:01.150 --> 13:01.470]  So...
[13:01.470 --> 13:03.070]  And once it's failed you, I have a method.
[13:03.490 --> 13:05.330]  The original method, if it was called Old Yeller.
[13:05.930 --> 13:06.250]  So...
[13:06.950 --> 13:09.070]  And why this works is because...
[13:09.070 --> 13:10.390]  Yeah, it actually looks...
[13:10.390 --> 13:14.570]  Every single one of the droppers that I was looking for has some sort of method of actually seeking out watchdogs.
[13:14.870 --> 13:16.230]  And that's part of...
[13:16.230 --> 13:22.970]  The watchdog program is what restarts the antivirus engine once it's actually been shut down or some of the other vital parts of the antivirus engine.
[13:32.050 --> 13:32.530]  So...
[13:33.090 --> 13:38.570]  actually generated a registry key or an intentional panic in the operating system to crash it.
[13:39.050 --> 13:47.590]  There's a simple registry key that you have to change and then you have to spawn up a process ID that has the same name and some of the features and feature sets of one of the watch...
[13:47.590 --> 13:48.490]  Or I can simulate...
[13:48.490 --> 13:51.850]  Now I can simulate up to five different watchdogs without code infringements.
[13:52.290 --> 13:56.390]  And that's something where the malware will actually go after these watchdogs and...
[13:56.990 --> 14:02.110]  Yeah, once the actual watchdog program's killed, it'll actually blue screen in the entire operating system.
[14:02.410 --> 14:02.630]  So...
[14:02.630 --> 14:06.970]  And if you have that employee in the company that clicks spearfish emails six, seven times...
[14:07.790 --> 14:11.230]  You can actually overwrite your hibernation file and it'll soft brick your system.
[14:11.470 --> 14:11.750]  So...
[14:11.750 --> 14:15.330]  You actually have to not brick it, but it'll actually make you have to do a full recovery on it.
[14:15.630 --> 14:17.810]  So it's something where they'll be like, hey my computer, does it start up?
[14:17.890 --> 14:18.430]  It has a blue screen.
[14:18.570 --> 14:19.590]  And you'll know exactly what happened.
[14:19.950 --> 14:22.430]  And there was actually no encryption that went on in the back end.
[14:23.770 --> 14:24.170]  So...
[14:24.170 --> 14:25.430]  And the software method two.
[14:25.830 --> 14:30.710]  So Keats, that's basically the sandbox simulation or the early versions of it.
[14:30.710 --> 14:31.230]  So...
[14:31.230 --> 14:32.610]  And that was the software method.
[14:32.930 --> 14:33.370]  And this is...
[14:33.370 --> 14:36.450]  Like I said, these are all combined into the third tool down the road here.
[14:36.970 --> 14:37.450]  So...
[14:37.450 --> 14:41.410]  And what this one does is basically does the exact opposite of what my actual tackler did.
[14:41.550 --> 14:44.050]  Is it makes physical machines look like virtual machines.
[14:44.150 --> 14:45.930]  It installs debuggers.
[14:46.050 --> 14:47.010]  It removes user data.
[14:47.530 --> 14:50.710]  It'll do pretty much everything that antiviruses or viruses are looking for.
[14:50.870 --> 14:53.370]  It simulates five sandbox environments on your computer.
[14:53.730 --> 14:54.270]  It takes...
[14:54.270 --> 14:55.770]  Makes it look like an unused sandbox.
[14:56.190 --> 14:58.370]  There's tons of actual details.
[14:58.370 --> 15:01.030]  And I have an actual list once I actually release it on GitHub.
[15:01.430 --> 15:01.630]  So...
[15:03.350 --> 15:06.630]  And yeah, emo is the method that is the combination of all of these.
[15:07.630 --> 15:08.030]  So...
[15:08.030 --> 15:12.410]  And in a nutshell, emo is a program that makes malware kill itself.
[15:12.610 --> 15:13.530]  So that's how it got its name.
[15:13.910 --> 15:14.150]  So...
[15:17.490 --> 15:21.510]  So basically, here's the beta version of it, which I basically...
[15:22.090 --> 15:24.590]  The last time I wrote something in C++, nobody...
[15:24.590 --> 15:25.370]  Not many people.
[15:25.470 --> 15:29.570]  There were a couple of manufacturers that did a talk last year on injecting fake credit cards into memory.
[15:30.130 --> 15:33.490]  So that when people would skim memory and steal credit card data, they would steal fake ones.
[15:33.610 --> 15:35.710]  The validity rate of the credit cards would go very, very low.
[15:35.830 --> 15:37.590]  Like 0.08% from 98%.
[15:38.490 --> 15:41.310]  So this one, I'm actually writing a VB and it pops out PowerShell scripts.
[15:41.610 --> 15:43.410]  And like I said, the C version, I'll release it.
[15:43.510 --> 15:48.450]  It'll be a little out of date at the time, but it's something where I want sys-admins to actually use it for once.
[15:48.710 --> 15:49.030]  So...
[15:49.030 --> 15:52.010]  And I made an awesome GUI, as you can, in Visual Basic.
[15:53.330 --> 15:58.570]  So basically, you can protect against specific malwares, stuff like that.
[15:58.770 --> 16:03.550]  It actually will update those details for as far as the droppers that are usually associated with them.
[16:03.690 --> 16:06.430]  Some of them are used by several different criminal organizations.
[16:06.790 --> 16:07.190]  So...
[16:07.190 --> 16:16.930]  But you can pick the window, the actual operating system that you have, and it'll actually change that infrastructure to make it look like certain registry keys for different environments, things like that.
[16:17.010 --> 16:18.770]  It'll just confuse the malware and it'll look for...
[16:18.770 --> 16:21.650]  It'll intentionally spoof those flags that the malware's looking for.
[16:22.010 --> 16:24.910]  And if you try to protect a Windows XP system, it'll actually tell you to upgrade.
[16:25.290 --> 16:25.470]  So...
[16:26.870 --> 16:27.830]  So it's pretty awesome.
[16:27.990 --> 16:28.490]  But, yeah.
[16:29.050 --> 16:29.830]  So you can do...
[16:29.830 --> 16:32.730]  Shifting your file system, which is a really cool system.
[16:32.950 --> 16:40.390]  So basically, you can grab all those file extensions, like Excel files, C files, stuff like that, and it'll actually shift them and cipher them, which I'll actually show.
[16:40.530 --> 16:43.970]  It's a living, breathing file system, so you can have internal file extensions.
[16:43.970 --> 16:47.350]  So all your Excel files internally are XBYJ241.
[16:47.510 --> 16:50.350]  And if it comes with the natural Excel files...
[16:50.350 --> 16:53.430]  And there's also some Outlook plugins, I'll go into it in a second.
[16:54.170 --> 16:58.310]  But you can actually have your own migrating file extensions that disassociates all the original ones.
[16:58.590 --> 17:04.690]  Because, like, some people internally, like, they'll, you know, anything that's a JAR file, they'll point it to their text editor or something like that.
[17:04.770 --> 17:08.230]  That's pretty much the exact same concept, except for it evolves daily, or you can do it even twice a day.
[17:08.410 --> 17:12.530]  And you can disassociate those file extensions so that your users aren't confused.
[17:12.530 --> 17:16.270]  And you can use shortcuts, links, that actually link to the original files.
[17:16.430 --> 17:18.590]  And it actually hides that integrity of those files.
[17:18.730 --> 17:21.950]  And actually, I'll go into a little bit here on the next slide.
[17:22.310 --> 17:22.530]  So...
[17:23.130 --> 17:25.310]  Yes, you can associate the attached programs.
[17:25.330 --> 17:28.190]  Then you can attach the original programs if you want to revert the process.
[17:28.350 --> 17:29.490]  You can have it automatically do it.
[17:29.550 --> 17:34.450]  So if you have a backup at 5pm every night or something, it'll actually do that automatically for you if you'd want.
[17:34.670 --> 17:35.570]  You can protect your email.
[17:35.850 --> 17:43.490]  So on Outlook, 2007 and above, with certain service packs, it'll actually strip the macros out of any file that comes into the file system.
[17:43.590 --> 17:44.830]  You wouldn't want to do it across the board.
[17:44.890 --> 17:48.010]  Across the board, but it's something where you have that user that clicks those emails all the time.
[17:49.110 --> 17:51.390]  So it basically saves it as the oldest version of the file.
[17:51.490 --> 17:55.870]  Then, yeah, notifies you that a file has been changed and stuff like that.
[17:55.950 --> 18:00.730]  And then you can also have it passed off or forwarded to their other one, which can be running inside of a VM.
[18:00.910 --> 18:02.570]  So it's something that I haven't...
[18:02.570 --> 18:06.310]  I don't know why Microsoft hasn't actually done some of those.
[18:06.430 --> 18:08.210]  They have an amazing team on their hands.
[18:08.270 --> 18:11.130]  And I think that it's something that they'll eventually come to.
[18:11.130 --> 18:14.530]  the conclusion of that sometimes people, you know, can't trust their users the most.
[18:15.030 --> 18:23.010]  And the recovery files, there's three of the actual malwares that they grab certain registry settings, things like that, off of your actual computer.
[18:23.470 --> 18:32.410]  And some of it is randomized information, but a majority of it is information that if you have it at the time of your computer, you can actually do an R file, which is a recovery file.
[18:32.590 --> 18:39.130]  So say, for example, if you haven't backed up your files in a week and a half or something like that, you can actually use the R file to revert to a snapshot.
[18:39.130 --> 18:42.530]  And then you can inject your R values, and it will actually generate the same key.
[18:42.910 --> 18:49.710]  So that process takes about a half an hour, and you can actually decrypt more than one file on your operating system, because it will come up with the same exact splash page.
[18:49.950 --> 19:00.210]  And that doesn't work on all the actual ones, but it's something where if you just have two files that are stopping you from paying $1,800 of bitcoins, it's like, hey, I'll take an hour and a half and run this three times to get those three files I need.
[19:00.210 --> 19:03.770]  So you're basically able to use their free recovery service more than once.
[19:05.030 --> 19:05.470]  So...
[19:06.450 --> 19:07.690]  And yeah, the hardware method.
[19:07.970 --> 19:08.350]  So...
[19:08.910 --> 19:10.170]  Who's ever seen these on eBay?
[19:10.390 --> 19:11.870]  Or on any vendor site?
[19:12.070 --> 19:14.270]  The $8, 256 gigabyte?
[19:14.770 --> 19:15.210]  Yeah.
[19:15.390 --> 19:15.470]  Yeah.
[19:15.490 --> 19:16.030]  Really good deal.
[19:16.990 --> 19:17.930]  That seems legit.
[19:18.250 --> 19:19.670]  It's from overseas.
[19:20.730 --> 19:21.170]  Yep.
[19:21.350 --> 19:24.450]  But, actually, if you look at these, they're actually about eight gigabyte hard drives.
[19:24.590 --> 19:28.990]  They have corrupted actual file partitions, stuff like that.
[19:29.190 --> 19:32.570]  So it makes an eight gigabyte partition look like it actually...
[19:33.730 --> 19:37.250]  So the table of content looks like there's 256 gigabytes and formatted.
[19:37.510 --> 19:37.870]  So...
[19:37.870 --> 19:43.070]  That's something where you can actually take one of these hacked devices and actually, you check the integrity of it.
[19:43.730 --> 19:47.050]  It's seriously just a 16 gig or an 8 gig SD card.
[19:47.230 --> 19:51.990]  Anything over that, it'll start copying over itself, but it'll still keep the table of content value so it still looks like it's there.
[19:53.510 --> 19:58.810]  So basically, I made it as big as I could, filled it with random file extensions here.
[19:59.110 --> 20:05.170]  So I generated, you know, hundreds of MP4s, hundreds of CDRW, just random file extensions.
[20:05.470 --> 20:10.170]  And some of the malware actually goes through and does an initial parse of actual file sizes.
[20:10.290 --> 20:14.290]  So it'll encrypt all your small files first because it's expecting to get busted halfway through the process.
[20:14.690 --> 20:24.330]  So that's something where, yeah, once it's actually parsing some of your file extensions and file sizes and stuff like that, it'll actually, yeah, go through the list.
[20:24.470 --> 20:25.830]  And this hardware version of it.
[20:26.250 --> 20:31.870]  Once they actually start encrypting, and a lot of them incrementally encrypt, so anybody in here still have a floppy drive in their computer?
[20:33.590 --> 20:34.810]  There's a couple old-school people.
[20:34.930 --> 20:41.310]  But as far as that goes, you can just put this USB stick in as your A drive, and it will actually, yeah, they usually hit them incrementally.
[20:41.430 --> 20:43.310]  Obviously, that's something that can easily change.
[20:44.330 --> 20:46.730]  But that's where the second hardware method comes in.
[20:47.170 --> 20:55.630]  So basically, just randomly generate hundreds upon hundreds upon thousands of these, fill your partitions with it, and it'll eventually copy over itself at 8 or 16 gigabytes.
[20:56.530 --> 20:59.750]  And anything beyond that point will actually cause a memory leak.
[20:59.970 --> 21:08.570]  And with each file that's encrypted, it does like a 1.3% CPU utilization, so it'll actually crash the operating system the exact same way that Old Yellow does.
[21:08.730 --> 21:10.610]  So it's a pretty cool process.
[21:10.730 --> 21:11.510]  And this one's all hardware.
[21:11.650 --> 21:24.010]  It's literally something you can just slap on the computer, and as long as that device is actually has stuff encrypted on it, and depending which of the encryptors, some of them, you know, they can get pretty deep into it, it can get 80% done before it actually locks the operating system up.
[21:24.170 --> 21:27.510]  But it gets laggy, slow, you're going to get a call from one of your users.
[21:30.750 --> 21:40.310]  And hardware method two was actually... I did a similar talk to this at B-Sides in Boston, and this guy walked up to me and he's like, hey, you should make a honeypot that's an actual file partition.
[21:40.630 --> 21:43.270]  So who here has played with 10C 3.0s or 2.0s?
[21:44.230 --> 21:45.450]  Yeah, these things are amazing.
[21:45.730 --> 21:59.030]  So basically, this works on the variants of CryptoLol, a lot of the CryptoLocker, and all the other, like I was saying, the Sam's Choice variants of the malware, pretty much any of them that yeah, just do straight routining.
[21:59.330 --> 22:06.110]  So that's something where the hardware method, number two, is basically... it's a 10C 3.0, it mounts as a USB drive partition.
[22:06.310 --> 22:07.390]  You can put it as the first one.
[22:08.050 --> 22:12.110]  And basically, you load it with files and you load the actual payload.
[22:12.270 --> 22:18.210]  So once the partition is touched, it switches to a human interface device and it will actually shut the operating system down gracefully.
[22:18.910 --> 22:23.210]  And I have an ungraceful method in the next slide because it is a 10C and it is malware.
[22:23.590 --> 22:23.870]  So...
[22:24.930 --> 22:27.870]  So you can do a hard shut run, you can do a halt, whatever you want to do.
[22:28.250 --> 22:32.470]  Thanks to the nameless guy at B-Sides who mentioned that because that was an amazing idea.
[22:32.770 --> 22:34.250]  And like I said, this will all be open-source.
[22:34.390 --> 22:40.890]  I'll release the code for the 10C 3.1 and the 3.2, I believe, is the two that I'm building around.
[22:41.030 --> 22:43.410]  But it should work on some of the older ones with simple modifications.
[22:46.250 --> 22:50.530]  Or you can do the graceful shutdown or you can take it down old school style.
[22:50.890 --> 22:51.230]  So...
[22:51.890 --> 22:54.450]  Just hard coding the reset pins with...
[22:54.450 --> 22:55.550]  This was originally...
[22:55.550 --> 22:57.770]  It started its life as a power management system for a KVM.
[22:57.910 --> 23:03.290]  And you can feed simple inputs through the network interface which I also have plans for this when I release it.
[23:03.450 --> 23:07.390]  So you basically just get the power pulled on it when it gets the termination signal.
[23:07.650 --> 23:11.290]  So this is, I think, about a $60 way to protect a computer.
[23:11.290 --> 23:12.450]  The 10Cs are about $20.
[23:12.990 --> 23:19.330]  But once you slide it in there, you can fill it with the exact same details and files that the actual malware will go after.
[23:20.710 --> 23:21.030]  So...
[23:22.010 --> 23:22.970]  And yeah, back to the software.
[23:23.070 --> 23:23.530]  Back to Emo.
[23:24.010 --> 23:24.330]  So...
[23:25.270 --> 23:27.550]  And I have some other CryptoLocker simulators.
[23:27.770 --> 23:29.610]  It was originally something before I worked for Rapid7.
[23:29.830 --> 23:32.770]  It was one of the things we'd include in some of our pen tests.
[23:32.930 --> 23:34.330]  Some of the smaller customers loved it.
[23:34.390 --> 23:36.850]  The ones that didn't do backups properly.
[23:37.010 --> 23:41.450]  They would want to see how far, you know, CryptoLocker or some of the other malware would actually get in their file system.
[23:41.650 --> 23:43.170]  So I actually reversed...
[23:43.170 --> 23:44.270]  And I'll show it here in a little bit.
[23:45.190 --> 23:45.590]  So...
[23:45.590 --> 23:47.110]  I can hide your backup system folders.
[23:47.430 --> 23:52.030]  So some of your shadow copies, it'll actually change those to systems folders, which are totally ignored.
[23:52.290 --> 23:59.130]  Because getting a ransomware page to pop up does not actually happen if you brick or boost the operating system up.
[23:59.390 --> 24:01.610]  So it's something where it deletes the backup copies.
[24:01.730 --> 24:09.490]  I have yet to find a version of ransomware that actually does DOD wiping or even does low-level formatting on any of the free space on the computer.
[24:10.250 --> 24:11.310]  So that's something where...
[24:11.590 --> 24:12.290]  No level...
[24:12.290 --> 24:13.030]  Low-level formatting.
[24:13.210 --> 24:14.950]  So you can hide them in actual bad partitions.
[24:15.110 --> 24:19.650]  There's tons of other places that once people actually start modifying, I'm excited to see what they do.
[24:19.890 --> 24:24.170]  And one of the biggest other responses is some of the people that actually write the malware seeing how they respond to it.
[24:24.310 --> 24:26.350]  And then you get to parry and joust back and forth.
[24:27.110 --> 24:27.470]  So...
[24:27.470 --> 24:27.890]  It's pretty awesome.
[24:28.070 --> 24:31.730]  And then, yeah, you can morph your entire file system, which I will be showing demonstration here in a little...
[24:31.730 --> 24:33.870]  Or not demo, but an actual slide in a little bit.
[24:33.870 --> 24:35.670]  I don't have time to fully demo some of this.
[24:36.350 --> 24:41.990]  And then, yeah, the macro stripper, like I was saying, that's also built into the latest version of Emo.
[24:42.450 --> 24:46.830]  And switches to internal trusted file structure, so it won't actually open a lot of the other file systems.
[24:46.930 --> 24:48.530]  It'll ask, what do you want to associate it with?
[24:48.870 --> 24:51.470]  And you can actually jack your OK button up.
[24:51.990 --> 24:57.150]  So it's like way down here, so people don't just automatically, you know, click it or, you know, use their normal methods.
[24:57.290 --> 25:00.490]  So there's some pretty other pretty cool features built into this.
[25:00.490 --> 25:04.110]  And it tries to break the users of their repetitious patterns and paths.
[25:04.590 --> 25:04.830]  So...
[25:06.310 --> 25:08.150]  And here's the original version that I made.
[25:08.290 --> 25:09.470]  I made it the Western edition.
[25:09.750 --> 25:16.190]  But it basically looked for open shares, saw how much it would be encrypted, and then it calculated a Bitcoin ransom.
[25:16.550 --> 25:21.850]  So, and this was basically a neutered or a zoo form of, yeah, pretty much the same subroutines.
[25:21.970 --> 25:23.890]  Even antivirus engines would detect it as malware.
[25:24.150 --> 25:27.350]  So it's something where I don't think anybody would be comfortable running that other system.
[25:27.950 --> 25:32.430]  So that's something where, you know, we would do it on some of those engagements at the previous employer that I had.
[25:32.430 --> 25:33.710]  So it's pretty cool.
[25:33.890 --> 25:36.870]  A lot of people, if they ever want to see, you know, how far it would be effective.
[25:37.850 --> 25:41.350]  And, yeah, here's some of the newer versions of the actual post home features.
[25:41.590 --> 25:42.030]  Are we good?
[25:42.190 --> 25:42.350]  Okay.
[25:42.930 --> 25:44.510]  Testing the post home, call home features.
[25:44.690 --> 25:47.490]  So somebody has some fancy $60,000 firewall.
[25:47.630 --> 25:48.890]  You can test to see if it'll call.
[25:48.970 --> 25:55.190]  It'll just send random jargon to actual servers in Eastern Europe and Ukraine and stuff like that.
[25:55.290 --> 25:59.450]  So it'll make call-outs that are very suspicious to see if your IDS team will catch it.
[25:59.450 --> 26:01.130]  You can search for open read and writes.
[26:01.330 --> 26:03.010]  You can test your backups against encryption.
[26:03.310 --> 26:04.170]  So you can...
[26:04.170 --> 26:08.330]  There's a 14-digit file extension that you have to put on these and it'll actually parse.
[26:08.850 --> 26:09.750]  It'll encrypt those.
[26:09.890 --> 26:15.870]  And then you can see how your team would actually handle that in the event of an actual encryption going on in the system.
[26:16.390 --> 26:19.630]  So you can build a master unlock bait file or that R file like I was showing.
[26:19.730 --> 26:25.010]  It'll grab some of the ones that are custom... grab custom-specific details from the actual system.
[26:25.650 --> 26:28.990]  And you can check for different account levels as part of your domain.
[26:29.090 --> 26:30.210]  See if you have any open reader rights.
[26:30.450 --> 26:33.390]  Or see if there's a, you know, Buffalo Drive sitting on the network or something that would...
[26:33.390 --> 26:35.930]  It would have come across on an actual scan.
[26:36.190 --> 26:36.510]  So...
[26:36.510 --> 26:39.150]  And if there are other tools out there, I'd love to hear about them also.
[26:40.030 --> 26:40.350]  So...
[26:40.350 --> 26:42.690]  Or any functionality that people think would be good at this.
[26:42.770 --> 26:44.810]  I left a little bit of time at the end here for questioning.
[26:46.070 --> 26:46.390]  So...
[26:46.390 --> 26:50.070]  And yeah, you can actually control the Keats and old Yeller functionality.
[26:50.870 --> 26:52.990]  And you can pull system files at time of infection.
[26:52.990 --> 26:53.570]  So...
[26:53.570 --> 26:57.230]  You can basically download or downgrade the clock on some of them.
[26:57.350 --> 26:58.810]  Because there are some customers that are really stubborn.
[26:59.270 --> 27:02.030]  And they figured that there would be some, you know, free way to do it.
[27:02.910 --> 27:03.230]  So...
[27:03.230 --> 27:04.950]  That's something where you can test payload...
[27:05.530 --> 27:06.090]  avoidance also.
[27:07.390 --> 27:07.710]  So...
[27:07.710 --> 27:08.990]  And yeah, here's the newest version of it.
[27:09.130 --> 27:10.070]  It has a fancy GUI.
[27:10.190 --> 27:10.910]  It looks like...
[27:10.910 --> 27:11.830]  I haven't been...
[27:11.830 --> 27:13.630]  Actually seen a system with the crypto...
[27:13.630 --> 27:14.130]  Or...
[27:14.130 --> 27:15.030]  Yeah, the crypto wall...
[27:15.030 --> 27:16.670]  Actual GUI come up on it for a while.
[27:16.790 --> 27:18.570]  But it has a lot of the functionality.
[27:19.530 --> 27:20.930]  Like I was saying, the testing...
[27:20.930 --> 27:21.790]  Calculate your ransom.
[27:23.130 --> 27:24.410]  Check Password Usernames.
[27:25.650 --> 27:26.370]  I'm testing...
[27:26.990 --> 27:27.350]  Also...
[27:27.350 --> 27:28.650]  Plugging in some simple tools.
[27:28.850 --> 27:31.930]  But there's also automatic scanning tools that will do a lot better job of that.
[27:33.970 --> 27:34.330]  So...
[27:34.330 --> 27:36.190]  And yeah, like I was saying, a look at the emo tool.
[27:36.590 --> 27:36.950]  So...
[27:36.950 --> 27:40.490]  As far as the seed value, that randomly generates your hidden folder.
[27:40.610 --> 27:47.130]  Because if it went into the install folder of something, or it was always in the same place, it would be pretty simple for people to actually go after your hidden files.
[27:47.310 --> 27:49.750]  Or check what your file extensions were changed to.
[27:49.930 --> 27:51.390]  You also need to save that information.
[27:51.830 --> 27:59.630]  You don't need to save it locally, but it has to be saved somewhere on the network where you can actually revert and make some of the new creations and the new links to where your files are.
[27:59.830 --> 28:01.690]  So that your users don't get confused.
[28:01.990 --> 28:02.770]  That's something where...
[28:02.770 --> 28:05.610]  I wanted this to be absolutely user-friendly.
[28:05.850 --> 28:07.730]  Like where they literally click the link where it's always been.
[28:07.990 --> 28:10.610]  And it'll automatically open it and re-associate it.
[28:12.650 --> 28:13.010]  So...
[28:13.370 --> 28:14.910]  Oh yeah, and there's the Outlook plugin.
[28:15.110 --> 28:17.410]  So it'll actually revert some of it.
[28:17.470 --> 28:20.090]  It will say it can't open it because it's an external file structure.
[28:20.550 --> 28:24.170]  And as you can see, it randomly generates your internal file structure.
[28:24.410 --> 28:25.910]  And then it also strips out all the macros.
[28:26.830 --> 28:27.190]  So...
[28:27.190 --> 28:27.650]  Yeah.
[28:28.730 --> 28:30.210]  And let me see where the...
[28:30.210 --> 28:32.790]  Yeah, right there's an example of some of the test pictures.
[28:33.690 --> 28:35.350]  That was the original ones that I was going through.
[28:35.530 --> 28:38.230]  But it basically looks like you got hit by CryptoLocker.
[28:38.230 --> 28:41.970]  But it's, you know, actually your internal randomized file structure for...
[28:41.970 --> 28:44.470]  So that one on the bottom was originally a PowerPoint presentation.
[28:44.790 --> 28:46.610]  And the top one was an actual picture.
[28:47.050 --> 28:47.450]  So...
[28:47.450 --> 28:52.990]  And as you can see, it'll pop in and pop out for as far as the actual original allocation program.
[28:53.150 --> 28:54.550]  So whatever you're allocating it to.
[28:54.710 --> 29:01.910]  So if it's, you know, paint in this instance, it's something where it actually has that file association every time that that folder is interacted with.
[29:02.090 --> 29:02.330]  So...
[29:02.330 --> 29:05.370]  And some of the shortcuts, you can strip that also.
[29:06.010 --> 29:06.410]  So...
[29:06.410 --> 29:07.630]  And it does take care of...
[29:07.630 --> 29:10.610]  Aside from just the extensions, I know that there are some actual...
[29:11.230 --> 29:16.530]  There's XML information, some of the other stuff on the back end of the actual file that'll say, you know, what that file is.
[29:16.650 --> 29:18.010]  It'll say that it's a this or that.
[29:18.590 --> 29:21.730]  Not a lot of the malware at this time actually digs that deep into it.
[29:21.810 --> 29:23.150]  It goes strictly off of file extensions.
[29:23.890 --> 29:26.530]  Some of the newer variants, like I was saying, I have padding.
[29:27.050 --> 29:28.170]  So it's very, very hard.
[29:28.310 --> 29:30.590]  And it works with the actual file shortcuts and everything.
[29:30.750 --> 29:33.870]  So it's something where you can actually hide your file structure really, really good.
[29:34.590 --> 29:41.910]  And it's very resilient too, because as soon as the actual ransomware comes across a lot of these file extensions, and this is pretty simple to integrate.
[29:42.030 --> 29:43.010]  You guys can play with it too.
[29:43.270 --> 29:44.890]  But like I said, this stuff will be launched.
[29:45.630 --> 29:50.790]  I'm pretty busy with some of the research I was doing for the DEF CON and Black Hat this year.
[29:50.850 --> 29:54.750]  So this is something that I will be launching it after September or October.
[29:55.230 --> 29:55.590]  So...
[29:55.590 --> 29:57.870]  And it's all open-source, free MIT licensing.
[29:58.690 --> 29:59.910]  So you can feel free to modify it.
[29:59.910 --> 30:01.490]  You can throw your logos on it.
[30:01.570 --> 30:02.030]  Everything like that.
[30:02.290 --> 30:02.430]  So...
[30:04.030 --> 30:05.370]  So I'm going to open up to questioning.
[30:05.870 --> 30:06.510]  I figured...
[30:06.510 --> 30:11.050]  And since I'm before the actual closing ceremony, you can never get in trouble for finishing early.
[30:11.470 --> 30:11.790]  So...
[30:11.790 --> 30:12.250]  Yeah.
[30:12.410 --> 30:16.490]  If you guys want to have any questions or would like to ask them, you can pop up to the microphone quick.
[30:28.310 --> 30:28.630]  Yes.
[30:28.630 --> 30:28.850]  Thanks.
[30:28.970 --> 30:30.390]  This is really interesting and informative.
[30:30.910 --> 30:31.050]  Thank you.
[30:31.050 --> 30:33.530]  So I'm sort of wondering from a usability perspective...
[30:33.530 --> 30:35.130]  I may have misunderstood something here.
[30:35.250 --> 30:36.610]  So if I need clarification, let me know.
[30:37.790 --> 30:50.230]  The obfuscation of the suffixes seems like a really useful idea, but I'm worried that if users end up being exposed to that, it's going to frighten them and it's also going to give them some trouble in reopening things.
[30:50.490 --> 30:53.770]  So I'm wondering if you've sort of tried to reckon with that and what you're thinking about.
[30:54.430 --> 30:54.470]  Yep.
[30:54.890 --> 30:57.130]  That's where the actual file shortcuts come into play.
[30:57.270 --> 30:59.750]  You can literally have them look like they're original file extensions.
[31:00.090 --> 31:01.190]  And the actual imaging.
[31:01.530 --> 31:02.510]  And I have an actual...
[31:03.270 --> 31:10.350]  I don't know if I had it on that final slide, but it'll actually show the original one in the actual GIF image associated with the file because it is an unnamed file.
[31:10.450 --> 31:12.150]  You can have any kind of padding information in there.
[31:12.450 --> 31:17.070]  And that's where you can re-associate it, but you don't want to re-associate it too much with the original file or it'll get encrypted.
[31:17.970 --> 31:18.170]  So...
[31:18.170 --> 31:18.730]  And some of them...
[31:18.730 --> 31:18.790]  Yeah.
[31:19.350 --> 31:27.950]  One of the things I was sort of wondering about with shortcuts especially, you know, like people might try moving them around and whether that would sort of break your process and stuff like that.
[31:28.070 --> 31:30.150]  Like whether that would keep them from getting back to where they need to be.
[31:30.150 --> 31:37.590]  Yeah, wherever you have the actual text file that's with the R values, you can set where you want pretty much the safety to go.
[31:37.770 --> 31:39.790]  It's mostly the My Documents folder right off the bat.
[31:40.090 --> 31:43.350]  You can have custom ones across your network or on your actual operating system.
[31:43.590 --> 31:46.350]  So you can set where you want those to go and it'll re-associate them.
[31:46.450 --> 31:50.110]  Even if they move them, it'll actually still re-associate them with the links.
[31:50.270 --> 31:50.630]  Cool.
[31:50.810 --> 31:51.250]  And that's something.
[31:51.250 --> 32:02.230]  But it also sounds like it's maybe so like they work with whoever their IT guy is to be like this thing happened and so now we can actually go back to that and sort of like fix that all up before they get back in and use the system regularly or...
[32:02.230 --> 32:03.210]  Yeah, you can revert it.
[32:03.610 --> 32:05.030]  That's why I have the actual...
[32:05.450 --> 32:08.270]  There's files so you can undo all the processes that you're doing.
[32:08.450 --> 32:14.170]  And it's as I'm saying like to make it more user friendly, you can even link it to other, you know, files.
[32:14.310 --> 32:17.250]  You can leave it to a real Excel file and like that's what I'm saying because there's ways...
[32:18.210 --> 32:23.910]  And that's what I'm saying with modern antivirus engines, some of the easiest ways to do it wouldn't be the safest way.
[32:24.050 --> 32:26.670]  It would leave you open to some attack surface but it would be better than nothing.
[32:27.410 --> 32:29.090]  So that's one of the original ones.
[32:29.330 --> 32:29.670]  Alright, thanks a lot.
[32:29.790 --> 32:30.150]  Thank you.
[32:31.750 --> 32:32.970]  Then what is your question?
[32:33.970 --> 32:36.110]  I got actually a pair of questions for you.
[32:37.890 --> 32:40.130]  First off, thank you for being here.
[32:41.270 --> 32:44.410]  Ransomware has been a complete pain in the ass since it's come out.
[32:44.870 --> 32:45.110]  It's just...
[32:45.110 --> 32:46.570]  It's getting annoying hearing about it.
[32:46.570 --> 32:50.870]  On the plus side it's kept me plenty busy so more work is good but kind of.
[32:51.430 --> 32:52.990]  So my first question is...
[32:53.610 --> 32:59.130]  As you were talking about the ammo tool, which different versions of malware...
[32:59.610 --> 33:02.010]  Sorry, ransomware it goes after, it keeps track of...
[33:02.010 --> 33:03.190]  I know there's a lot of...
[33:03.190 --> 33:04.650]  There's a lot of different versions out there.
[33:05.010 --> 33:10.770]  What I was curious about is that with the new stuff like the Kerberos and the...
[33:13.070 --> 33:14.030]  Cerebus and...
[33:14.030 --> 33:16.030]  And that's how much Tesla crypt...
[33:16.570 --> 33:16.630]  Yeah.
[33:16.770 --> 33:18.850]  Which are the three ones I've been dealing with most recently.
[33:19.370 --> 33:19.410]  Yeah.
[33:20.170 --> 33:24.030]  Does the same tool apply high to those versus the ransomware?
[33:24.870 --> 33:25.110]  Yeah.
[33:25.370 --> 33:29.130]  We threw a couple banking Trojans at it and did pretty much the same thing.
[33:29.550 --> 33:36.490]  Some of the banking Trojans have destructive payloads which is what I think that the actual malware manufacturers will go to after they...
[33:36.490 --> 33:47.090]  You know, if this was to get used widely and that's why I'm doing MIT license, I can gladly have somebody rip it off and like start integrating it in something good and proper where it's actually installed on, you know, full-scale environments or it's,
[33:47.090 --> 33:50.090]  you know, tested for, you know, hospitals, banks, things like that.
[33:50.170 --> 33:51.410]  It's not something that's written.
[33:51.550 --> 33:52.990]  You have to compile it yourself, stuff like that.
[33:53.190 --> 33:56.550]  So that's why I'm trying to make it simple to use where it all PowerShell scripts and stuff.
[33:56.750 --> 33:59.470]  Does that answer your question about like some of the actually variants?
[33:59.630 --> 34:00.210]  It works on...
[34:00.210 --> 34:01.630]  The thing is that they...
[34:01.630 --> 34:07.050]  Some of the custom droppers and stuff like that, yeah, it works against a lot of them that have the same features and uniqueness.
[34:07.470 --> 34:10.230]  And even that evade sandboxes, you pretty much just got it.
[34:10.370 --> 34:10.730]  All right.
[34:10.730 --> 34:21.570]  The second question is that I haven't been talking with another small group of people who are just working on some way of blocking ransomware even if the payload gets onto the machine.
[34:21.950 --> 34:22.010]  Yeah.
[34:22.130 --> 34:25.890]  One of the ways they come up with was using a localized set of...
[34:25.890 --> 34:26.570]  What was it?
[34:28.210 --> 34:29.070]  Of group policy.
[34:29.450 --> 34:34.410]  Using group policy of the machine in order to lock down executables, certain programs to run like macros.
[34:34.830 --> 34:37.690]  So even when they're launched, it just stops a detonation track.
[34:37.890 --> 34:38.130]  Oh, yeah.
[34:38.490 --> 34:43.730]  Have you seen anything that's gone around that, that's gone completely straight through without missing a beat?
[34:43.930 --> 34:44.250]  Yeah.
[34:44.370 --> 34:48.790]  That's some of the actual methods that some of the antivirus people actually went into.
[34:49.090 --> 34:52.650]  And I did see that there was a couple of tutorials on...
[34:52.650 --> 34:53.550]  I can't remember if it was on Reddit.
[34:53.910 --> 35:00.370]  But, yeah, there's people that have ways to actually make your operating system a little bit more resilient without actually installing anything.
[35:00.770 --> 35:01.450]  So, yeah.
[35:01.690 --> 35:02.890]  And that's kind of a cool thing.
[35:03.050 --> 35:03.630]  I definitely would...
[35:03.630 --> 35:06.070]  If you hit me up on Twitter, definitely share some of that information.
[35:06.070 --> 35:06.930]  Maybe it's something...
[35:06.930 --> 35:09.910]  As long as it's open-source, I can, you know, throw it in with the tool.
[35:10.750 --> 35:11.070]  So...
[35:11.070 --> 35:11.390]  Sure.
[35:11.630 --> 35:12.250]  We'll talk...
[35:12.250 --> 35:12.930]  We'll talk offline.
[35:13.190 --> 35:14.390]  So, there's a whole thing to that.
[35:15.810 --> 35:16.130]  But...
[35:16.130 --> 35:16.370]  Leslie...
[35:16.370 --> 35:17.850]  A million ISK.
[35:19.510 --> 35:20.150]  Seems like...
[35:20.770 --> 35:23.990]  Seems like an odd thing to ask for considering what we're talking about.
[35:24.090 --> 35:24.670]  He's German.
[35:24.830 --> 35:25.710]  The guy that I work with.
[35:25.870 --> 35:26.950]  So, he's a huge Eve guy.
[35:27.150 --> 35:29.190]  He's got fleets of...
[35:29.650 --> 35:30.290]  Ships that...
[35:30.290 --> 35:33.650]  He's the reason I quit is because I'm like, I'm never going to be in null space like that guy is.
[35:33.930 --> 35:34.050]  So...
[35:34.050 --> 35:34.770]  Money well spent then.
[35:34.770 --> 35:35.610]  I spent a billion ISK.
[35:35.710 --> 35:36.970]  I only have like 10 billion left.
[35:37.770 --> 35:38.090]  So...
[35:38.090 --> 35:38.930]  Money well spent then.
[35:40.070 --> 35:41.070]  No, it's pretty good stuff.
[35:41.250 --> 35:41.570]  But it's...
[35:41.570 --> 35:42.270]  Yeah, I just honestly...
[35:42.270 --> 35:45.570]  Since I got married and stuff and, you know, full-time program and stuff, it's...
[35:45.570 --> 35:49.130]  Yeah, it's hard to actually get into gaming as much as I used to.
[35:49.430 --> 35:49.690]  So...
[35:49.690 --> 35:50.850]  So, thank you very much for your time.
[35:50.990 --> 35:51.130]  Yeah.
[35:51.170 --> 35:51.510]  Thank you, man.
[35:54.170 --> 35:54.490]  Hi.
[35:54.550 --> 35:56.670]  Thanks for a terrific talk.
[35:56.970 --> 35:57.170]  Hi.
[35:57.230 --> 35:57.430]  Thank you.
[35:58.370 --> 36:02.290]  We ran into the same problem in different organizations that I was...
[36:02.290 --> 36:03.130]  I was involved in.
[36:03.310 --> 36:04.910]  And we found a...
[36:04.910 --> 36:10.970]  Actually, a really simple solution to kind of not execute any ransomware.
[36:12.130 --> 36:17.610]  I don't know if that's the sort of place to share it, but it's pretty simple.
[36:17.690 --> 36:19.810]  We just created a local user.
[36:20.190 --> 36:20.390]  Mm-hmm.
[36:20.610 --> 36:28.890]  And all the browsing activities, so all the browsers and Outlook were just launched in the context of that user.
[36:29.410 --> 36:29.730]  Okay.
[36:30.150 --> 36:30.730]  And that was it.
[36:31.110 --> 36:31.210]  Yep.
[36:31.610 --> 36:37.130]  And now the ransomware, when it executed, couldn't access any of the user's files.
[36:37.430 --> 36:37.590]  Yeah.
[36:38.470 --> 36:38.530]  Yep.
[36:38.990 --> 36:39.370]  That was it.
[36:39.570 --> 36:44.490]  There's a couple ideas, and installed programs that I've seen that do some similar stuff to them.
[36:44.550 --> 36:45.490]  That's a really, really good approach.
[36:45.990 --> 36:49.790]  The thing is, the more that it's used, the more they combat it and find ways around it.
[36:50.290 --> 36:50.610]  So...
[36:50.610 --> 36:52.210]  Which I know, that's a really, really good concept.
[36:52.490 --> 36:54.510]  And I wish they would think a little...
[36:54.510 --> 36:57.510]  I hate using the word outside the box, but I wish they would think more outside the box like that.
[36:57.510 --> 36:58.270]  Because that's like...
[36:58.270 --> 36:58.950]  So those are some of the ideas.
[36:59.010 --> 37:00.590]  Whoever thought of that, brilliant guy.
[37:01.450 --> 37:01.810]  So...
[37:01.810 --> 37:02.690]  Great talk again.
[37:02.850 --> 37:03.070]  Thank you.
[37:03.190 --> 37:03.530]  Oh, thank you.
[37:04.050 --> 37:04.150]  Yeah.
[37:05.090 --> 37:05.830]  Any other questions?
[37:07.130 --> 37:08.390]  How are we doing on time here, too?
[37:11.190 --> 37:11.810]  You want any time?
[37:11.910 --> 37:12.030]  Okay.
[37:12.390 --> 37:12.690]  Awesome.
[37:13.250 --> 37:13.590]  Sweet.
[37:14.130 --> 37:14.490]  Yeah.
[37:15.210 --> 37:21.050]  If you guys don't have any other questions, I'll probably be down after the actual area, down there smoking.
[37:21.510 --> 37:24.410]  So that's pretty much where I'll be the rest of the afternoon.
[37:24.410 --> 37:24.950]  So...
[37:24.950 --> 37:25.350]  But yeah.
[37:25.470 --> 37:28.370]  I know if you guys have any questions, or if you have any ideas, want to bounce ideas off of me.
[37:28.530 --> 37:32.350]  If something didn't make sense, I love explaining some of the tangents I go on.
[37:32.790 --> 37:33.110]  So...
[37:33.110 --> 37:37.970]  Or if you guys want to talk about hacking ATMs and point-of-sale systems, hit me up at Fcon and Black Hat this year.
[37:38.610 --> 37:38.930]  So...
[37:38.930 --> 37:39.370]  Awesome.
[37:39.470 --> 37:41.470]  Well, thanks again for your time, and I'll let you guys be.
[37:41.630 --> 37:41.950]  Thank you.
[38:28.020 --> 38:30.820]  Thank you.
[38:47.360 --> 38:48.760]  Thank
[39:02.920 --> 39:03.820]  you.
[39:29.550 --> 39:31.070]  Keep up the good word questions.
[39:33.290 --> 39:34.350]  It's scary shit.
[39:36.290 --> 39:36.850]  Ransomware.
[41:28.830 --> 41:30.750]  Where are you going next?
[41:31.270 --> 41:32.370]  My next conference?
[41:34.350 --> 41:36.130]  Oh, I'm going to go down and smoke in front.
[41:36.530 --> 41:38.890]  I'm going to go down and smoke in front, right in the lobby.
[41:41.610 --> 41:42.490]  Sweet, definitely.
[41:43.550 --> 41:44.050]  Awesome.
[42:01.040 --> 42:01.540]  Hello.
[42:02.700 --> 42:03.020]  Okay.
[42:03.400 --> 42:06.700]  I was under the impression I had 45 minutes, so I tailored it to that.
[42:07.260 --> 42:09.060]  Does anybody have any additional questions?
[42:09.940 --> 42:11.320]  If you guys want to step up to the microphone.
[42:11.800 --> 42:14.440]  So we have a little bit until the actual closing ceremony starts.
[42:14.860 --> 42:19.600]  So if anybody wants to talk about ATM hacking or any...
[42:23.660 --> 42:26.020]  You know, that's one of the big things is...
[42:26.020 --> 42:28.940]  You guys have all seen some of the EMB relay attacks and stuff like that.
[42:29.100 --> 42:30.360]  So that's going to be one of the things.
[42:30.360 --> 42:34.240]  I can't go into too much detail about some of it, but it's pretty cool stuff.
[42:34.360 --> 42:35.760]  And I made an actual fraud.
[42:35.980 --> 42:45.080]  If you guys go to the actual demo labs, I'm going to be showing the actual cash out backend system, which is basically a Carter site where you have to enter two key...
[42:45.080 --> 42:47.000]  You actually have to enter two passwords.
[42:47.000 --> 42:52.780]  It pops into a DMVPN and then you actually register the exact same way that a banking frontend would.
[42:52.980 --> 42:54.400]  So it's a really, really cool process.
[42:54.680 --> 43:01.120]  And it actually is secure because I was kind of trying to design what the bad guys would make in the future for the actual fraud.
[43:01.680 --> 43:05.000]  So you actually need DES keys to assign your fraud device to their network.
[43:05.320 --> 43:07.760]  So I mean, it's the exact same way on the frontend.
[43:07.800 --> 43:09.900]  You have to have DES keys for your ATM machine.
[43:09.980 --> 43:10.860]  Now it's the same way.
[43:11.040 --> 43:14.000]  Or I would see it going the same way with some of the actual backends.
[43:14.000 --> 43:15.780]  So that's pretty cool stuff.
[43:16.180 --> 43:19.900]  But yeah, as far as the actual chain, you're getting everybody's credit card transactions.
[43:20.240 --> 43:21.420]  So say for example, like the...
[43:21.940 --> 43:29.720]  When the actual EMV transactions are popped out and a lot of the information, it's actually sent into a... which I don't have slides for this part, but it's...
[43:29.720 --> 43:33.920]  You're able to see everybody's information and then you have delimiting characters that will actually grab your transaction.
[43:34.420 --> 43:40.860]  And that's some of the tunnel ID information so you can initiate the connection with the fraud backend or whoever the Carter site is.
[43:40.860 --> 43:44.020]  And it's kind of a cool system that was...
[43:44.020 --> 43:45.100]  It's totally conceptual.
[43:45.100 --> 43:52.620]  So it's built to actually have like some of the smaller Carter sites being able to generate some of their unsold transactions into each other.
[43:53.000 --> 43:54.800]  So it's a pretty crazy system.
[43:55.160 --> 43:55.380]  So...
[43:55.380 --> 43:56.000]  Yes, do you have any questions?
[43:56.120 --> 43:58.360]  Just kind of a general question to your malware or other things.
[43:58.500 --> 43:59.240]  Like if you were...
[43:59.760 --> 44:04.940]  The dark way of saying this is if you were put in charge of a Russian malware network, what would you do that they're not doing?
[44:05.140 --> 44:07.340]  Or what are you afraid that they'll do in the future?
[44:07.760 --> 44:08.320]  I don't know.
[44:08.480 --> 44:10.680]  The biggest thing I'm scared of is the destructive payloads.
[44:10.760 --> 44:18.680]  Because it's like one thing, if you can save the customer's data, but if it all gets like crazy erased, some weird things like that, that's...
[44:18.680 --> 44:24.460]  Or some of the worst ones are like the ones that are actually docs, or not doc stuff, but they'll actually release some of the information and stuff like that.
[44:24.540 --> 44:24.980]  I think...
[44:24.980 --> 44:29.260]  Because if they can't have the information, no one can kind of situation is kind of how I see it going.
[44:29.460 --> 44:31.300]  So that's why like some of the more...
[44:31.300 --> 44:34.700]  Let's just blue screen the box is kind of the method that I've gone after.
[44:34.700 --> 44:35.580]  But as far as...
[44:35.580 --> 44:39.580]  Yeah, tips for the malware manufacturers, I honestly can't think...
[44:39.580 --> 44:40.680]  They're doing an amazing job.
[44:40.880 --> 44:42.620]  Like some of the stuff that they thought of, I was like...
[44:43.240 --> 44:45.600]  I was like, that'd be cool if they could do this and this.
[44:45.880 --> 44:49.920]  And I literally like two weeks later, like one of my buddies would be like, they're doing this now.
[44:50.080 --> 44:51.120]  And I'm like...
[44:51.120 --> 44:53.440]  Okay, they're in my brain somehow, you know?
[44:53.920 --> 44:54.560]  So it's...
[44:54.560 --> 44:56.480]  Yeah, they're totally staying on top of the ball.
[44:56.560 --> 44:57.680]  They have professional programmers.
[44:57.820 --> 44:59.800]  A lot of them are pretty...
[44:59.800 --> 45:02.880]  You know, they're out-of-work ex-developers for this, this, and this.
[45:02.960 --> 45:04.040]  Got tons of experience.
[45:04.120 --> 45:07.960]  So it's like crazy the amount of resources they're going into.
[45:08.080 --> 45:12.000]  And like I was saying, their customer support and just some of their portals and stuff is...
[45:12.000 --> 45:14.100]  It's scary to see that they're actually developing that stuff.
[45:14.700 --> 45:15.100]  So...
[45:15.100 --> 45:16.080]  Does that answer your question?
[45:16.220 --> 45:16.360]  Yeah.
[45:16.640 --> 45:16.980]  Awesome.
[45:17.200 --> 45:18.460]  Not great news, but thanks.
[45:19.420 --> 45:19.820]  Yeah.
[45:21.040 --> 45:22.260]  Anybody else have any other questions?
[45:24.740 --> 45:25.100]  Sweet.
[45:26.280 --> 45:27.360]  How are we doing on time now?
[45:34.650 --> 45:34.990]  Okay.
[45:35.230 --> 45:37.310]  Yeah, we have like five minutes if you guys do want anything else.
[45:37.410 --> 45:38.210]  If not, I'll just...
[45:38.210 --> 45:38.330]  Yes.
[45:39.930 --> 45:41.310]  Yeah, Hackers got talent.
[45:42.630 --> 45:43.550]  Hackers got talent.
[45:44.030 --> 45:45.490]  I actually had to miss that yesterday.
[45:45.590 --> 45:46.290]  I was working on it before.
[45:47.590 --> 45:48.370]  Oh, for my URL?
[45:49.810 --> 45:51.730]  Well, right now I have just a parked...
[45:53.550 --> 45:56.850]  I have a parked domain that I'm going to be using and it's my trap better be full.
[45:58.350 --> 45:59.710]  So that'll be pretty awesome.
[45:59.970 --> 46:01.850]  Then I have my main Nestle's URL.
[46:02.150 --> 46:02.370]  Then...
[46:02.370 --> 46:03.090]  Yeah.
[46:03.310 --> 46:06.470]  So yeah, if you guys go on my Twitter, you'll be able to find some of the contact info.
[46:06.890 --> 46:07.150]  So...
[46:07.150 --> 46:17.210]  But yeah, if you guys have any questions about any of that or if you want to contribute to it or if you want some of the early beta versions to be able to test it out before I actually release it, that'd be kind of cool beans.
[46:17.410 --> 46:18.690]  And yeah, if you guys want...
[46:18.690 --> 46:21.170]  The cool thing about some of these things are it's not...
[46:21.170 --> 46:21.450]  It's...
[46:21.450 --> 46:26.730]  You're 15 minutes away from changing some of the registry settings for your actual amount of memory inside the computer.
[46:26.990 --> 46:32.490]  Or if you want to change file structures and run a zoo version of CryptoLocker, see if it actually...
[46:32.490 --> 46:33.150]  How it affects it.
[46:33.350 --> 46:35.190]  And then you can go into like some of the details.
[46:35.410 --> 46:37.750]  Like through some of the same processes that I went through and just...
[46:37.750 --> 46:43.450]  Yeah, it's awesome seeing like something you did affect ransomware in that way.
[46:43.630 --> 46:44.790]  And just some of the malware in general.
[46:45.110 --> 46:45.370]  So...
[46:45.370 --> 46:46.570]  Especially some of the banking Trojans.
[46:46.610 --> 46:47.870]  Those ones are really fun to play with.
[46:47.870 --> 46:48.790]  Because they've...
[46:48.790 --> 46:51.630]  They've stuck a lot of time and resources into a lot of that stuff.
[46:52.330 --> 46:52.770]  So...
[46:53.370 --> 46:54.770]  But any other questions?
[46:55.370 --> 46:55.810]  Otherwise...
[46:55.810 --> 46:56.970]  I'm gonna go...
[46:56.970 --> 46:58.190]  I'm gonna go smoke out front.
[46:58.490 --> 46:58.730]  So...
[46:58.730 --> 46:59.810]  If you guys wanna...
[46:59.810 --> 47:01.530]  If you wanna join me...
[47:01.530 --> 47:03.470]  I'll be downstairs in a haze of smoke.
[47:03.730 --> 47:03.950]  So...
[47:03.950 --> 47:04.290]  Thanks guys.
[47:21.180 --> 47:23.980]  Thanks guys.