[00:00.000 --> 00:04.680]  The right codes and the seven proxies set up and so forth.
[00:05.160 --> 00:07.960]  And what we're going to be doing is a little bit of crowd control.
[00:08.180 --> 00:12.540]  And I apologize, that might be not as convenient for some of you as you'd like.
[00:13.120 --> 00:17.760]  We are anticipating... I think some of you saw this email from Emanuel late last night.
[00:17.820 --> 00:22.500]  We're anticipating a fire marshal on the 18th floor during the talks.
[00:22.600 --> 00:27.280]  We're going to be very, very diligent about keeping fire lanes open, about not overpopulating the room, stuff like that.
[00:27.280 --> 00:32.960]  So the Snowden, the Ellsberg keynote followed by the Snowden conversation, that I'm sure you all know is from 1 to 3 p.m.
[00:33.400 --> 00:37.620]  That's going to be simulcast in all three rooms on the 18th floor.
[00:37.780 --> 00:39.000]  So Olsen, Serpico and Manning.
[00:39.080 --> 00:40.980]  Manning, of course, will be where Ellsberg is live.
[00:43.060 --> 00:46.720]  And it'll also be simulcast to the first floor by the escalators.
[00:46.900 --> 00:48.740]  There's room for over 100 people there.
[00:49.100 --> 00:51.540]  First floor escalators down in the pavilion.
[00:52.000 --> 00:55.260]  And we'll have it at, I think, two separate locations on the second floor.
[00:55.260 --> 00:59.040]  And we'll have it simulcast to the Paris room on the sixth floor.
[00:59.380 --> 01:02.440]  And that's the current plan that might shift a little bit as we get things set up.
[01:02.720 --> 01:04.900]  So anyway, just be prepared to be asked lightly.
[01:04.940 --> 01:11.080]  And please be cooperative if you need to be in a room other than the room where the actual Ellsberg is sitting.
[01:11.640 --> 01:13.320]  But we think the streaming is going to be good.
[01:13.460 --> 01:14.140]  We've been testing it.
[01:14.140 --> 01:16.800]  And in fact, not only can you catch the stream any time.
[01:16.920 --> 01:21.800]  This has been a live stream since first thing yesterday at x.hope.net on the Radio Statler area.
[01:21.940 --> 01:24.460]  But you can also get recordings afterwards.
[01:24.780 --> 01:26.520]  So we hope everyone's got a really good experience.
[01:26.700 --> 01:28.060]  And we'll be mentioning this throughout the morning.
[01:28.180 --> 01:30.120]  So apologies that you'll be hearing it a couple of times.
[01:30.820 --> 01:33.160]  But that's where we're at with the keynote.
[01:33.160 --> 01:34.800]  So welcome.
[01:34.980 --> 01:37.280]  This is day two Saturday of HOPE.
[01:37.720 --> 01:39.400]  The 20th year of HOPE.
[01:39.700 --> 01:41.440]  The 10th event of HOPE.
[01:41.560 --> 01:43.020]  HOPE Number 10 or HOPE X.
[01:43.280 --> 01:45.560]  We have a spectacular program for today.
[01:45.760 --> 01:47.520]  We had a spectacular program yesterday.
[01:48.020 --> 01:49.040]  People did workshops.
[01:49.320 --> 01:50.400]  People learned how to solder.
[01:50.760 --> 01:51.780]  People rode Segways.
[01:52.000 --> 01:53.040]  I haven't heard of any crashes.
[01:53.280 --> 01:53.620]  That's good.
[01:53.720 --> 01:54.440]  Keep up the good work.
[01:54.960 --> 01:56.800]  And today we got more of the same stuff.
[01:56.980 --> 01:57.720]  We have workshops.
[01:57.900 --> 02:00.120]  The workshops are mostly listed on the website.
[02:00.280 --> 02:01.360]  They're not so much in the program.
[02:01.800 --> 02:04.060]  We also have the vendors down on the second floor.
[02:04.240 --> 02:06.420]  Here on the 18th floor we have the U-Track.
[02:06.540 --> 02:08.900]  Which is one where you can sign up to give a talk.
[02:09.140 --> 02:11.780]  And that's back that way in what's called the Madison Room.
[02:11.900 --> 02:13.160]  Or we call it the U-Room.
[02:13.240 --> 02:14.540]  Because you get to do the content.
[02:15.100 --> 02:16.980]  In addition, we have lightning talks.
[02:16.980 --> 02:18.340]  That'll be from 4 to 6 p.m.
[02:18.620 --> 02:19.700]  I was there yesterday.
[02:19.700 --> 02:22.540]  This was astoundingly popular.
[02:22.540 --> 02:25.120]  We had just about two full hours of lightning talks.
[02:25.360 --> 02:28.340]  About 80 or 90 people in the room at the peak towards the beginning.
[02:28.720 --> 02:30.080]  And we're going to do that again today.
[02:30.200 --> 02:30.720]  So 4 to 6.
[02:30.720 --> 02:34.240]  So if you want to give a five-minute talk, go to wiki.hope.net.
[02:34.240 --> 02:36.120]  Or you can find the link on x.hope.net.
[02:36.200 --> 02:38.340]  And you can sign up for a lightning talk.
[02:39.100 --> 02:39.420]  All right.
[02:39.600 --> 02:40.340]  So we ready to go here?
[02:40.520 --> 02:40.740]  Yeah.
[02:40.920 --> 02:41.420]  Looks like we are.
[02:41.520 --> 02:41.640]  Okay.
[02:41.720 --> 02:43.000]  I apologize for starting a little bit late.
[02:43.040 --> 02:45.700]  As some of you might have seen, we're still getting the AV.
[02:45.920 --> 02:50.280]  Everything just so for this live remote keynote this afternoon.
[02:50.400 --> 02:51.540]  And we think it's going to work.
[02:51.540 --> 02:51.920]  We'll see.
[02:52.440 --> 02:54.180]  As long as the fire marshal is happy.
[02:54.360 --> 02:56.420]  It's one of those things where we worry about the NSA.
[02:56.420 --> 02:57.540]  We worry about Google.
[02:57.740 --> 03:00.520]  We worry about, you know, the Russian satellites.
[03:00.720 --> 03:02.400]  We worry about all kinds of crazy things.
[03:03.100 --> 03:07.100]  But really speaking, the crowd control here is probably the smartest thing we can do.
[03:07.240 --> 03:10.100]  To make sure that that's all good.
[03:10.940 --> 03:12.940]  So, first talk, Saturday.
[03:13.220 --> 03:14.780]  HOPE Number 10.
[03:17.020 --> 03:18.160]  And what are we doing?
[03:18.400 --> 03:19.160]  We're doing...
[03:19.160 --> 03:21.360]  This is the X you're looking for.
[03:21.880 --> 03:22.280]  Astounding.
[03:22.520 --> 03:25.280]  And this is with Eric and, not Ruin, but...
[03:25.280 --> 03:25.600]  Joe.
[03:25.920 --> 03:26.220]  Joe.
[03:26.620 --> 03:27.220]  Welcome, guys.
[03:27.360 --> 03:27.760]  Take it away.
[03:28.980 --> 03:29.380]  All right.
[03:29.520 --> 03:29.840]  Okay, cool.
[03:30.100 --> 03:30.780]  Yeah, Ruben.
[03:30.960 --> 03:33.700]  I wanted to be here, but he couldn't make it because of flight issues.
[03:33.740 --> 03:35.700]  So I still want somebody to hang out with me.
[03:35.740 --> 03:36.680]  So this is my friend, Joe.
[03:38.480 --> 03:40.520]  This is the X you're looking for.
[03:41.080 --> 03:43.620]  I'm not going to really explain myself, but you can, if you want.
[03:44.100 --> 03:44.960]  If you don't want, okay.
[03:45.320 --> 03:45.660]  No.
[03:45.900 --> 03:46.060]  Okay.
[03:46.060 --> 03:46.460]  No, I'm good.
[03:47.680 --> 03:48.700]  Because it's not relevant.
[03:50.060 --> 03:53.920]  And as far as what this talk is about, I will actually get into that later.
[03:53.960 --> 03:55.700]  But first, I want to do a lot of foreplay.
[03:55.980 --> 03:57.220]  I like sidetracks.
[03:59.680 --> 04:01.780]  So we'll start this off with the first slide.
[04:02.280 --> 04:03.400]  The intro, we'll do a lot.
[04:03.480 --> 04:04.700]  Like I said, here's all the foreplay.
[04:04.700 --> 04:07.200]  So we'll do some philosophical digression.
[04:09.600 --> 04:10.640]  I can't see anybody.
[04:10.780 --> 04:13.620]  I wanted to see a show of hands who's ever played these games here.
[04:13.820 --> 04:14.360]  But whatever.
[04:14.960 --> 04:15.420]  Yeah, okay.
[04:15.500 --> 04:16.200]  I can kind of see that.
[04:17.180 --> 04:18.520]  As a kid, I liked this game.
[04:18.520 --> 04:23.680]  You know, the idea for the people that haven't played it is you're supposed to get all the...
[04:23.680 --> 04:24.580]  I'm already doing it wrong.
[04:24.840 --> 04:27.420]  You're supposed to get all the numbers in order, is the goal.
[04:27.780 --> 04:29.620]  And when I was a kid, I played with it a lot.
[04:29.620 --> 04:31.960]  I kind of got what I think is pretty good at it.
[04:32.040 --> 04:33.260]  Like, could probably solve it in about a minute.
[04:34.040 --> 04:34.800]  It's pretty easy.
[04:34.940 --> 04:37.580]  It's not like a Rubik's Cube or anything, which is also not incredibly hard.
[04:37.580 --> 04:41.500]  But, you know, you have some strategies towards the last couple rows and all that.
[04:42.080 --> 04:46.760]  But as almost like a pre-hacker, as a little kid, I was more interested...
[04:46.760 --> 04:51.440]  After I solved it the right way a few times, I wanted to think about solving it the wrong way a couple of times.
[04:51.600 --> 04:52.560]  See what would happen.
[04:52.700 --> 04:57.260]  And one of the wrong ways is to do 15, 14, 13, and down, as opposed to in order.
[04:57.780 --> 05:03.300]  And I found out fairly quickly that you can't do that, which is interesting.
[05:03.540 --> 05:09.780]  I'm working with this formal system that not every theorem is possible to prove.
[05:10.260 --> 05:12.280]  Or, I guess, it could be considered anti-theorems.
[05:13.420 --> 05:14.800]  And I was, like, kind of frustrated.
[05:14.800 --> 05:17.660]  I realized when I got to the end, things just weren't working out the same.
[05:17.760 --> 05:19.640]  The patterns I'm normally used to seeing.
[05:19.920 --> 05:24.340]  And even my stepdad, he took the thing and left with it for a little while and came back.
[05:24.340 --> 05:27.640]  And it was in backwards order, and I looked at it, and I'm like, BS, you know?
[05:28.380 --> 05:29.340]  So what he ended up doing...
[05:31.160 --> 05:35.720]  Although, he wasn't being clever, but the meaning of it to me still meant something, because I overthink things.
[05:35.940 --> 05:41.520]  But he changed the starting position, or in formal systems, the axiom, the starting rule.
[05:42.760 --> 05:44.020]  And that's what I did here.
[05:44.860 --> 05:46.400]  You actually can't solve this in order.
[05:46.680 --> 05:50.360]  It's randomly generated, so I can refresh it, and it's going to be a different thing every time.
[05:50.360 --> 05:55.600]  But I changed the algorithm for the checking, if it's provable or not.
[05:56.160 --> 05:59.340]  So you can solve this one 15, 14, and backwards.
[05:59.620 --> 06:01.220]  But you can't do it in order.
[06:01.760 --> 06:09.940]  And so with this game, only half of the possible combinations of the order of numbers are possible, and the other half are impossible.
[06:10.420 --> 06:11.940]  And I find that interesting.
[06:12.080 --> 06:14.020]  We're in an environment where things work differently.
[06:14.700 --> 06:16.640]  And I'll show a few more examples of that.
[06:17.320 --> 06:18.340]  This is another one.
[06:18.960 --> 06:22.660]  Does anybody know why this Rubik's Cube configuration is impossible?
[06:25.950 --> 06:27.490]  You can shout if anybody knows.
[06:28.850 --> 06:29.330]  But...
[06:29.330 --> 06:30.230]  Yes, awesome.
[06:30.450 --> 06:32.190]  Yeah, there's two middle blue cubes.
[06:32.390 --> 06:32.850]  Impossible.
[06:34.290 --> 06:39.150]  But there's certain patterns that you might be able to run into with this that you wouldn't with the normal Rubik's Cube.
[06:39.150 --> 06:41.110]  And it's another example of when people...
[06:41.110 --> 06:43.530]  They're so close, they say, to solving the Rubik's Cube.
[06:43.850 --> 06:44.790]  And they just...
[06:44.790 --> 06:46.350]  They're like, if I could just move that one piece.
[06:46.490 --> 06:49.770]  So they take the stickers off and move that one piece to try to give themselves a head start.
[06:49.890 --> 06:52.430]  When they don't realize they changed the entire universe.
[06:52.990 --> 06:53.270]  You know?
[06:53.390 --> 07:00.930]  So they've actually put themselves in a position where it's going to be not just hard to solve now, but possibly, literally impossible to solve.
[07:01.970 --> 07:03.190]  Again, I find that interesting.
[07:03.190 --> 07:05.690]  It's kind of like a hacking...
[07:06.090 --> 07:08.650]  A lot of hacking that I see isn't really breaking rules.
[07:08.830 --> 07:11.010]  It's more changing the environment or starting positions.
[07:11.990 --> 07:14.110]  This is a good example of changing the environment.
[07:14.710 --> 07:20.130]  This is a chess game that you probably wouldn't see if you start with the main axiom of the starting...
[07:20.130 --> 07:21.310]  The typical starting position.
[07:21.910 --> 07:22.650]  I think this is a...
[07:22.650 --> 07:25.630]  There's a lot of variations of chess, but this one I think they call it Chess 960.
[07:25.950 --> 07:31.570]  The idea of Chess 960 is you start with the pawns in the right location, but you randomize the bottom row.
[07:31.570 --> 07:35.510]  And both white and black will match the bottom row in the randomization.
[07:35.710 --> 07:38.570]  So you'll see, like, the two bishops in the middle match.
[07:38.710 --> 07:41.510]  And, like, if you look at them, they typically match.
[07:41.650 --> 07:44.870]  And the game, this is a game that arose out of that starting position.
[07:45.270 --> 07:54.430]  It's also interesting because it's games that wouldn't fall into the system, but they're still not uninteresting, in an adventurous kind of way.
[07:54.590 --> 07:55.890]  There's also changing the environment.
[07:56.110 --> 08:01.670]  So there was changing the starting position, but changing the environment, you might run into other interesting versions of the game.
[08:02.130 --> 08:03.970]  You know, 3D kind of a setup.
[08:04.930 --> 08:06.570]  Kind of a Q-Bert kind of a setup.
[08:07.390 --> 08:12.850]  All the while, I'm actually not that interested in chess, but it's interesting to talk about when talking about formal systems like that.
[08:14.410 --> 08:15.790]  This is another favorite of mine.
[08:16.250 --> 08:16.870]  I don't know...
[08:16.870 --> 08:19.370]  There's, like, kind of a 23-minute video out there.
[08:19.370 --> 08:21.690]  It's about this impossible Mario world.
[08:22.150 --> 08:24.190]  So it's an environment hack kind of a thing.
[08:24.430 --> 08:28.390]  So I cut it down to my favorite, like, less than 50 seconds of it.
[08:28.510 --> 08:31.310]  But the levels are just, like, nearly impossible.
[08:31.650 --> 08:35.790]  This guy still manages to get through it, but I just cut it down to the parts where he fails.
[08:36.970 --> 08:40.030]  So I'm going to make it a little bit bigger.
[08:41.130 --> 08:45.410]  Try to make it a little bit top-heavy, because the bottom's hard to see, because the chair's up there.
[08:47.150 --> 08:47.510]  So...
[08:48.510 --> 08:50.410]  A little blurry to you, but I took it off YouTube.
[08:50.770 --> 08:51.910]  So that's the start of the level.
[08:52.070 --> 08:53.390]  That's literally the beginning of the level.
[08:55.510 --> 08:57.170]  And if you haven't seen this, YouTube it later.
[08:57.310 --> 08:59.690]  Like, impossible Mario level, guy freaks out, whatever.
[08:59.830 --> 09:00.990]  Those words should get you there.
[09:07.860 --> 09:08.720]  I love this one.
[09:34.990 --> 09:38.350]  We really should have turned on the audio commentary, because it's awesome.
[09:38.570 --> 09:39.890]  Did you actually watch it last night, or...?
[09:39.890 --> 09:40.070]  Yeah.
[09:40.290 --> 09:40.570]  Yeah, yeah.
[09:40.710 --> 09:41.490]  It is really awesome.
[09:41.550 --> 09:44.790]  And the funny thing is, this guy actually manages to get through the...
[09:44.790 --> 09:48.790]  Well, you got through the first level and gave up halfway through the second level, which is this level here.
[09:48.950 --> 09:51.190]  But, yeah, it's pretty awesome.
[09:51.330 --> 09:54.210]  I do recommend Googling it, but not enough time here.
[09:54.690 --> 09:55.470]  Oh, let me just zoom out here.
[09:56.330 --> 09:56.670]  Yeah.
[09:57.030 --> 10:04.350]  So another thing is, on the idea of wrecking the Earth with the right resonant frequency, kind of like an earthquake machine reference, so that's why there's a picture of Tesla up there.
[10:04.530 --> 10:12.990]  I mean, I'm not really going to get into it, but I just want to foreshadow that with a story in this book.
[10:12.990 --> 10:15.670]  Has anybody read or heard of this book?
[10:16.370 --> 10:18.190]  And I can't see hands, but I do see a couple.
[10:18.390 --> 10:24.170]  And that's awesome, because, honestly, I have never met a single person that has actually read this book.
[10:24.250 --> 10:26.490]  And I try to get all my friends to read this book.
[10:26.590 --> 10:33.450]  And it's like, those of you that have read it, you know it can get kind of heavy, kind of deep, and it's a little bit long, and it takes a little while to read if you really want to get everything out of it.
[10:33.450 --> 10:39.490]  But I've probably learned half the concepts I know about hacking from this book, and it's not even about hacking.
[10:39.930 --> 10:42.070]  It's a way about thinking about formal systems.
[10:42.790 --> 10:57.470]  But, like, a hundred pages in, there's this really cool story, like in the middle of the chapters, about the tortoise and crab, kind of this antagonistic thing where there's a record player that's supposed to be super high fidelity, should be able to play any sound.
[10:57.470 --> 11:00.870]  It's important that it's high fidelity, because it means it's sufficiently complex.
[11:01.350 --> 11:03.690]  But it's supposed to be able to reproduce any sound.
[11:03.850 --> 11:10.650]  But with the resonant frequency thing, say maybe the horn that the audio is coming out of might have a resonant frequency that could break the horn.
[11:10.930 --> 11:13.390]  Or maybe the wood and the record player or whatever.
[11:13.550 --> 11:17.470]  So, it means that there are still possibilities that it's not perfect.
[11:17.630 --> 11:19.050]  There's certain things that it can't do.
[11:20.750 --> 11:23.950]  So, this is kind of a... this is not from the book.
[11:24.090 --> 11:25.250]  This is one of my friends.
[11:25.270 --> 11:26.950]  He drew these pictures up.
[11:26.950 --> 11:32.570]  And some of it I kind of bastardized a little bit, just to kind of fit into my format.
[11:33.230 --> 11:36.530]  But, so this is the crab handing the tortoise the record.
[11:36.990 --> 11:38.110]  You know, he pulls it out.
[11:38.330 --> 11:40.170]  It has the bad frequency in it.
[11:40.190 --> 11:42.690]  So, when he plays it, you know, like that happens, right?
[11:43.530 --> 11:51.770]  So, the next iteration of security, you try to make a special record player that has a special needle that does some signature analysis on the record.
[11:51.770 --> 12:00.230]  So, if it notices the bad frequencies, either it decides not to play it or maybe it tries to filter it somehow or whatnot.
[12:00.530 --> 12:04.750]  But, still with signature analysis, there's ways that you can defeat signatures.
[12:04.970 --> 12:07.930]  Like in a kind of metaphor for AV or IDS.
[12:08.130 --> 12:15.430]  So, this red record player either can bypass the filter or if it can't, there's still a problem.
[12:15.430 --> 12:22.490]  If it decides not to play that audio, then you're still defeating the other goal of having a high fidelity record player that can play all audio.
[12:22.630 --> 12:24.310]  Well, there's some audio it can't reproduce.
[12:25.210 --> 12:27.610]  So, he plays the record, you know, that happens again.
[12:28.590 --> 12:32.110]  So, one of the solutions to that is to have several different horns.
[12:32.110 --> 12:42.730]  You know, if you give it one record that it is going to ignore for one horn that it can't play on, it'll just switch over dynamically to the other horn that it can play on.
[12:44.030 --> 12:51.590]  But, still, you have several tracks on there or several frequencies or whatever and one of them is bound to hit it.
[12:51.930 --> 12:54.210]  And, I mean, this, you know, and then obviously this.
[12:54.490 --> 12:58.830]  But, it's a bit of cat and mouse and kind of the point is that this is kind of inevitable.
[12:58.830 --> 13:04.750]  No matter what you do, there's, because the system does something, you're going to have a problem.
[13:05.590 --> 13:08.390]  Which does translate to security systems.
[13:08.710 --> 13:13.470]  And, if you'll notice, the record kind of does look like Chrome, right?
[13:14.150 --> 13:15.350]  Just a little bit.
[13:17.410 --> 13:17.970]  Unintentional.
[13:19.010 --> 13:19.710]  But, yeah.
[13:20.190 --> 13:23.430]  So, now, kind of getting into what this talk is about.
[13:24.130 --> 13:25.970]  And that's getting on lists.
[13:25.970 --> 13:31.210]  And it's kind of like, if you've read the abstract for this, it's kind of the first paragraph.
[13:31.670 --> 13:47.590]  But, so when we're being watched and they're looking at signatures of our behavior or whatnot, a lot of us, or I guess I'm not speaking for everybody, but one of the first ideas is to try to avoid getting on those lists.
[13:47.590 --> 13:50.570]  Just to try to, yeah, to not get on the list.
[13:50.670 --> 13:51.750]  To try to do what you can to hide.
[13:52.690 --> 13:55.350]  So, like, a little image here.
[13:55.730 --> 13:59.010]  You've got this guy in a library trying to check out a 2600 magazine.
[14:01.290 --> 14:02.010]  Horribly pixelated.
[14:02.910 --> 14:04.850]  So, not the most recent issue, but the one before it.
[14:05.650 --> 14:11.830]  And, you know, this cartoony FBI guy here holding a little paper saying, you know, this is my list of terrorizers, right?
[14:12.630 --> 14:16.830]  So, you could try to avoid checking out 2600 overtly.
[14:17.570 --> 14:23.570]  You know, maybe try to be more covert about it, which is kind of a horrible, like, backing down kind of solution to that.
[14:24.330 --> 14:35.350]  So, the theme of this talk, and this is just a metaphor, this isn't specific, but the theme of this talk is to encourage everybody to check out all the bad things.
[14:35.870 --> 14:38.150]  Or, not even bad things, but the things that are on the list.
[14:38.150 --> 14:50.770]  And the thing is, if they're trying to signature this kind of list on who might be a terrorist or bad person they're trying to watch, but you're encouraging the good people to check out these marked books, now that data doesn't have as much use.
[14:51.310 --> 14:52.790]  Because these aren't terrorists.
[14:53.170 --> 14:53.570]  There's trolls.
[14:58.050 --> 15:00.310]  So, now on to most of the talk.
[15:00.310 --> 15:01.910]  I talk some lower tech first.
[15:02.310 --> 15:07.350]  And then, after that, I'll get into some more specific, like, higher tech stuff.
[15:07.550 --> 15:13.210]  Like, you know, antivirus, forensics, intrusion detection, which is going to be my favorite part of it.
[15:14.130 --> 15:17.390]  So, first, we'll talk about some license plate oddities.
[15:17.550 --> 15:18.130]  And these aren't attacks.
[15:18.310 --> 15:21.510]  These are just, like, again, funny stuff with formal systems or signature-based stuff.
[15:22.450 --> 15:24.630]  I'm sure a lot of you might have seen these pictures.
[15:24.630 --> 15:27.790]  And I captioned it with funny, but not verified to work.
[15:28.150 --> 15:34.450]  And the caveat to that is recently I was in some training for reverse engineering malware or whatever.
[15:34.630 --> 15:43.450]  But one of the guys there worked for law enforcement and said that with the way the system works, it's likely that this could work because it hardly does any sanitizing.
[15:43.630 --> 15:46.810]  It doesn't even check for, like, aspect ratio or anything like that.
[15:46.970 --> 15:47.650]  I don't know.
[15:47.710 --> 15:48.070]  I don't care.
[15:48.210 --> 15:58.690]  It's just, like, the idea, you know, should make you think that about context, that those readers are looking at the context of a license plate, and that's all they care about.
[15:58.930 --> 16:03.270]  But you can slip in your own context, such as this.
[16:04.750 --> 16:10.510]  But another thing that's kind of interesting, and there's going to be several of these, but this is a while ago in 1979.
[16:10.790 --> 16:13.310]  There's a guy that had a license plate that said no plate.
[16:14.490 --> 16:19.510]  And the context of license plate is, you know, this is identification in essence.
[16:20.430 --> 16:27.490]  But a different context is when police officers in Los Angeles during this time would see a car that had no plates.
[16:27.730 --> 16:31.790]  In the plate section of the form that they were filling out for the violation, they'd literally write in no plate.
[16:32.010 --> 16:36.950]  So this guy got 2,500 violations because of his plate.
[16:37.210 --> 16:41.550]  And, you know, it was stressful for him, but after a while he thought it was cute, so he decided to keep the plate.
[16:41.550 --> 16:47.630]  So then the police or law enforcement actually ended up trying to change it to either missing or none because of this.
[16:48.970 --> 16:50.170]  You know, but again, the cat and mouse.
[16:50.410 --> 16:54.090]  So there's another guy in Marina Del Rey that had a plate that said missing.
[16:54.330 --> 16:57.170]  You know, so this guy specifically had some issues.
[16:57.910 --> 17:01.650]  And then like, you know, plates that didn't have tags, the police would write no tag.
[17:01.650 --> 17:06.690]  So, you know, this guy here in Delaware got 200 violations for having a plate that said no tag.
[17:07.330 --> 17:11.910]  And then Void, another guy that had a... these are like examples of... it's really funny.
[17:12.530 --> 17:14.750]  And then, you know, Unknown, this guy in Westchester.
[17:15.630 --> 17:17.410]  And then some other guy that really liked X's.
[17:21.580 --> 17:26.860]  I didn't come up with this term, but the idea... and this is like something that even kind of hit home for us.
[17:26.860 --> 17:31.340]  We're from Arizona and I would like to get out, but that's where we're from.
[17:33.080 --> 17:38.860]  For a while, they did the little speed traps on the freeway and a lot of other places, intersections and all that.
[17:39.360 --> 17:46.990]  And, you know, when you sped past it, it would take a picture of you and it would check out your information in the DMV, MVD.
[17:47.990 --> 17:49.300]  And it would... what do you want?
[17:49.400 --> 17:50.640]  It's gone now, thankfully.
[17:50.880 --> 17:51.020]  Yes.
[17:51.210 --> 17:51.400]  Yes.
[17:51.560 --> 17:52.200]  It didn't work.
[17:52.700 --> 17:54.200]  Maybe because it's unconstitutional.
[17:54.210 --> 17:54.940]  I don't know, but...
[17:54.940 --> 17:55.640]  Oh, no.
[17:55.760 --> 18:00.800]  You know what really happened was they found out that too many people were just plain rejecting it.
[18:00.900 --> 18:04.800]  It's like, I could be driving my dad's car and my dad would give me shit for it.
[18:05.160 --> 18:06.440]  I'd be driving my dad's car.
[18:06.540 --> 18:07.520]  I'd be speeding on the freeway.
[18:07.620 --> 18:12.540]  They'd send him a ticket in the mail and my dad would just call up and say, that's not me.
[18:12.940 --> 18:14.760]  And that's as far as it went.
[18:14.940 --> 18:18.860]  And it became too expensive to go to court every single time.
[18:19.020 --> 18:22.320]  And everyone eventually caught on and said, oh, we can just fight it.
[18:22.320 --> 18:24.580]  And then the ticket went nowhere else.
[18:25.020 --> 18:27.020]  So it just wasn't profitable at that point.
[18:27.820 --> 18:33.360]  And so, but yeah, the attack is you have a target somebody you don't like.
[18:33.800 --> 18:36.820]  So you spoof their plates somehow, you know, Photoshop, whatever.
[18:37.180 --> 18:40.380]  But you put it on your car, which is illegal and, you know, whatever.
[18:40.620 --> 18:43.760]  But the idea is you pick your target and then you speed through the trap.
[18:44.160 --> 18:45.540]  And guess who gets ticketed?
[18:45.540 --> 18:48.710]  So this is something I think that was pretty big in Maryland.
[18:48.990 --> 18:51.880]  It caught my radar, but it's kind of funny.
[18:51.960 --> 18:52.920]  It's a signature abuse.
[18:54.860 --> 18:57.470]  So now on to something that's kind of interesting.
[18:57.730 --> 19:02.060]  Totally inspired by an episode of Off the Hook I listened to about the guy.
[19:02.260 --> 19:06.620]  I forget what state, maybe somewhere in the Midwest, like Ohio or something like that.
[19:06.800 --> 19:09.380]  But the guy wore Google Glass into the theater.
[19:09.990 --> 19:13.560]  Because obviously you can record a feature-length film with Google Glass.
[19:13.980 --> 19:16.230]  You all know that's kind of not true because of battery life.
[19:16.520 --> 19:19.560]  But he got detained by a couple three-letter agencies, I guess.
[19:19.730 --> 19:20.840]  And that's just ridiculous.
[19:21.740 --> 19:23.580]  But Pirateye, the way the technology works...
[19:23.580 --> 19:26.840]  And before I get into that, like I took a screenshot a few months ago when I was researching their site.
[19:27.360 --> 19:32.560]  And at the time, yeah, there's, you know...
[19:35.520 --> 19:41.730]  But yeah, the way the technology works is there's this little five-inch lens at the top of the theater that scans through like a few seats at a time.
[19:41.730 --> 19:49.180]  It detects lenses and it's supposed to not, you know, has tolerance for false positives like people wearing glasses.
[19:50.320 --> 20:00.640]  And then once it detects lenses, it actually sends the picture to a NOC that like humans that analyze these pictures and try to decide, you know, is this a phone or a camera or something recording the movie?
[20:00.700 --> 20:10.280]  And if the people in the NOC decide, yes, this is probably somebody trying to pirate a movie, then they actually like SMS local law enforcement to go and take the guy down.
[20:11.700 --> 20:16.760]  And I mean, so what I just described here, this is kind of a busy little picture that whatever.
[20:17.400 --> 20:22.400]  Kind of blurry, but really, really blurry guy sitting back here with a phone, you know, whatever.
[20:23.380 --> 20:24.560]  So that's my attack.
[20:26.470 --> 20:28.320]  I call it Spider-Eye, you know.
[20:29.120 --> 20:31.080]  And I have it up on my Thingiverse.
[20:31.380 --> 20:33.210]  My handle is XLogicX.
[20:34.580 --> 20:37.620]  Just Google Spider-Eye case for Thingiverse.
[20:38.520 --> 20:41.230]  And also, I brought them.
[20:43.160 --> 20:44.470]  That's a Spider-Eye case.
[20:46.020 --> 20:49.140]  It's just an iPhone case with a lens in it.
[20:49.440 --> 20:53.460]  So it probably, I don't even know if it fit an iPhone very well at all.
[20:53.520 --> 20:54.140]  That's not the point.
[20:54.340 --> 21:01.710]  And I felt like a total tool printing up a bunch of these at my local hackerspace, HeatSync Labs, because, you know, everybody makes iPhone cases.
[21:01.970 --> 21:02.580]  It's whatever.
[21:03.960 --> 21:07.040]  But towards the end of this, like, you guys are welcome to come up here and take them.
[21:07.040 --> 21:08.640]  I have about 20 of them up here.
[21:08.940 --> 21:10.820]  So if you want a souvenir, come up and take them.
[21:13.080 --> 21:17.780]  The idea is you put one in a cup holder, in a seat, in the whole theater.
[21:20.360 --> 21:23.880]  And I don't know what movies are playing tonight or tomorrow, but, you know, if you guys want to go on a trip.
[21:25.060 --> 21:29.620]  There's one close to Time Central or Times Square.
[21:32.520 --> 21:33.540]  Okay, barcode stuff.
[21:34.050 --> 21:37.120]  This is some stuff I played around with, like, almost a decade ago at work.
[21:37.120 --> 21:37.580]  It's funny.
[21:37.730 --> 21:41.040]  But the idea is that, the original idea.
[21:41.200 --> 21:44.760]  And this is kind of playing into Rambam's first law, if you don't know it.
[21:45.140 --> 21:48.680]  It's, when you collect data, it's, I forget the quote.
[21:49.020 --> 21:54.900]  But it's something to the effect of, like, the data is going to be used in unintended ways after you collect it.
[21:56.520 --> 22:00.840]  But the initial idea is, say you have correlated goods, so hot dogs and buns.
[22:00.980 --> 22:05.240]  If you're a store, you can sell the hot dogs, like, put them on sale, advertise that they're on sale.
[22:05.960 --> 22:08.720]  But then maybe jack up the price of the buns, kind of covertly.
[22:09.480 --> 22:13.480]  So maybe the customer is still net not saving money.
[22:14.060 --> 22:15.540]  But that could be kind of obvious.
[22:15.740 --> 22:17.340]  You know, hot dogs and buns, we know that's correlated.
[22:17.340 --> 22:22.200]  So statistically, you might want to find out what are correlated goods that aren't so obvious.
[22:22.440 --> 22:26.740]  And this is, like, out of the whole useless business school that I went through.
[22:26.860 --> 22:29.900]  One of the things, one of the funny tidbits that I ran into was this topic.
[22:29.900 --> 22:35.140]  But one of the non-obvious correlated goods that came up was diapers and wine.
[22:35.340 --> 22:39.300]  For some reason, there's actually a positive correlation between diapers and wine.
[22:39.580 --> 22:44.940]  So the idea is you jack up the price of one or the other, and you put the advertised other one on sale.
[22:44.940 --> 22:48.320]  So VIP cards, like, that's the solution.
[22:48.940 --> 22:54.760]  VIP cards were the way to track statistical correlations between what people are purchasing.
[22:55.520 --> 22:56.000]  So...
[22:56.000 --> 22:56.260]  Okay, go ahead.
[22:56.460 --> 23:01.180]  One point to that is the incentive for these cards has always been you save.
[23:01.180 --> 23:03.780]  You save, like, 10 cents here, 20 cents here.
[23:03.820 --> 23:07.400]  But you're voluntarily giving them advertising information.
[23:07.640 --> 23:09.940]  It's like they don't have to do any market research.
[23:10.120 --> 23:12.300]  You just... they just do it for you.
[23:12.420 --> 23:12.820]  It's free.
[23:12.820 --> 23:16.960]  And you don't necessarily save because the whole jack up the price of the other one.
[23:18.100 --> 23:20.280]  But yeah, so Rombaum's first law.
[23:21.680 --> 23:23.200]  HSAs were buying this crap up.
[23:23.300 --> 23:27.440]  Along with, like, law enforcement and other people, like, people... other people want this data.
[23:28.020 --> 23:33.800]  So you can find out... I mean, you could really learn a lot about somebody on their grocery habits.
[23:33.960 --> 23:37.020]  Like their hobbies, clothing size, which also tells you other stuff about them.
[23:37.460 --> 23:38.240]  Their diet.
[23:38.620 --> 23:40.740]  If they own a pet, you'll know, probably.
[23:41.640 --> 23:43.780]  You know, birth control purchasing, things like that.
[23:43.900 --> 23:45.560]  Like, there's sensitive things about what you purchase.
[23:45.700 --> 23:47.580]  And that data is being sold to a lot of people.
[23:47.900 --> 23:48.320]  But...
[23:48.320 --> 23:53.020]  And to another point, does anyone remember the recent case of that lady that sued Google over...
[23:56.150 --> 23:58.260]  They found out that she was pregnant.
[23:58.420 --> 24:00.400]  She started getting adverts for being pregnant.
[24:00.920 --> 24:02.000]  No, wait, that was Target?
[24:02.200 --> 24:02.640]  My mistake.
[24:02.920 --> 24:04.200]  Well, anyway, that's to that point.
[24:04.420 --> 24:06.180]  Yeah, and actually got a couple more points on that even.
[24:06.340 --> 24:08.760]  But yeah, so insurance claims, like, again, on the same thing.
[24:08.960 --> 24:10.120]  Like, specific things.
[24:10.200 --> 24:10.600]  Ice cream.
[24:10.600 --> 24:12.320]  It means obesity or diabetes.
[24:12.940 --> 24:14.300]  Processed meats and homogenized milk.
[24:14.420 --> 24:15.940]  That's cardiovascular disease.
[24:16.380 --> 24:18.500]  And then cancers, like, chemical sweeteners and all that.
[24:18.620 --> 24:23.300]  But, like, seriously, you might get rejected for claims because of your shopping preferences.
[24:23.480 --> 24:24.120]  And that's horrible.
[24:24.160 --> 24:25.360]  I don't know if they're still doing that.
[24:25.600 --> 24:28.140]  Because I think they had a program called Smart Mouth.
[24:28.760 --> 24:30.840]  And I heard about this from one of Rombom's talks.
[24:30.960 --> 24:33.060]  But I don't know if they're still doing it.
[24:33.140 --> 24:34.120]  But I know they're trying.
[24:34.240 --> 24:35.860]  And that's still pretty sick.
[24:36.220 --> 24:41.240]  Also, and this isn't the only case, but it's been attempted to be used as evidence in court.
[24:41.400 --> 24:47.900]  Like, this guy, Robert Rivera, at the Vons grocery store, he slipped on some yogurt that, I guess, was spilled in the aisle.
[24:48.040 --> 24:49.240]  I mean, it was the store's fault.
[24:49.480 --> 24:50.400]  He got injured.
[24:50.540 --> 24:51.800]  He's in the hospital for about 10 days.
[24:51.980 --> 24:53.140]  And he tried to sue for damages.
[24:53.180 --> 24:55.380]  And, I mean, that's not completely unreasonable, I guess.
[24:55.480 --> 24:55.800]  I don't know.
[24:55.900 --> 24:56.940]  Who cares about the politics of that?
[24:57.080 --> 25:00.160]  But the point is, the store tried to look into his...
[25:00.160 --> 25:05.680]  Datamine his VIP card purchases to try to paint a picture that this guy was buying a lot of alcohol and was a drunk.
[25:05.780 --> 25:06.460]  And that's why he fell.
[25:07.080 --> 25:08.640]  They ultimately didn't use it in court.
[25:08.800 --> 25:13.880]  And my speculation on that is they'd be showing their cards if they did that.
[25:13.880 --> 25:19.260]  If they used that in court, that would really demonstrate to people that they are willing to do this kind of crap.
[25:22.680 --> 25:26.120]  So, this isn't a solution to this, just kind of a funny way to troll.
[25:27.320 --> 25:29.200]  This is my VIP card.
[25:30.260 --> 25:34.300]  And notice it ends in 2600, including the checksum.
[25:35.740 --> 25:37.980]  This one, in particular, I made it...
[25:37.980 --> 25:40.660]  I made sure it works that safe way, specifically.
[25:41.140 --> 25:44.000]  The reason for that is because they're more nationally recognized.
[25:44.260 --> 25:48.880]  The store that a lot of us in Phoenix go to is a store called Fry's, which is a Kroger store.
[25:49.480 --> 25:51.420]  Which it also happens to work at, by the way.
[25:51.420 --> 25:55.500]  But I didn't go with that just because it's not... you couldn't use it here.
[25:56.480 --> 26:00.060]  And on that, I have a couple hundred of them.
[26:00.860 --> 26:03.320]  So, I recommend everybody take one.
[26:05.350 --> 26:06.860]  It's... let me pull one out.
[26:08.420 --> 26:11.160]  You won't be able to see it from here, but this is the back that I was talking about.
[26:11.220 --> 26:11.900]  And this is the front.
[26:11.900 --> 26:18.900]  And one funny thing that I found out the hard way is Safeway apparently does not do keychain format cards.
[26:19.540 --> 26:20.280]  They do now.
[26:24.050 --> 26:27.720]  So, another thing on Thingiverse that I have is a UPC barcode generator.
[26:28.000 --> 26:29.760]  And I know this is kind of like crazy.
[26:29.920 --> 26:30.960]  Like, why would we do this?
[26:31.020 --> 26:31.980]  And I'll get into that.
[26:32.120 --> 26:33.420]  Like, you don't have to.
[26:33.720 --> 26:36.280]  It's just like gimmicky, and I like gimmicky stuff.
[26:36.280 --> 26:44.540]  So, it's an OpenSCAD format program that you just put in the barcode number, and it will generate the 3D image for you.
[26:44.680 --> 26:47.900]  So, you can laser cut it, which this is an example of.
[26:48.000 --> 26:49.060]  You could 3D print it.
[26:49.420 --> 26:54.040]  I also have a sticker on my phone, which is totally gimmicky.
[26:54.240 --> 26:56.980]  Like, I wouldn't even recommend this because it started falling apart after a few weeks.
[26:57.080 --> 26:58.940]  But it worked, like, for a couple of weeks.
[26:59.060 --> 26:59.520]  It's really funny.
[27:00.500 --> 27:03.300]  So, if you don't want to do that, there's smartphone apps.
[27:03.340 --> 27:05.160]  There's a couple of examples that you could use.
[27:05.160 --> 27:08.800]  It's just make sure you use the UPC code from the option if they have more.
[27:10.040 --> 27:21.120]  And on my same thingiverse list of stuff that I have, I also have a list of barcodes that I would suggest for each store that I could keep regularly updated as long as people comment them.
[27:21.810 --> 27:29.240]  And all I need, if it's a store I don't have, is just the first 6 of 12 digits because I wrote a Perl script that will randomly generate the...
[27:29.790 --> 27:34.440]  pseudo-randomly generate the last 6 digits, making sure that the last 4 are 2600.
[27:37.580 --> 27:39.800]  So, yeah, if you don't want to do that, just print it on a piece of paper.
[27:39.960 --> 27:40.080]  Whatever.
[27:40.420 --> 27:41.240]  Just use...
[27:41.240 --> 27:43.340]  The point of this is, these aren't serialized codes.
[27:43.360 --> 27:44.680]  We're all using the same barcode.
[27:44.800 --> 27:45.760]  We're all the same customer.
[27:46.300 --> 27:51.240]  We're, like, this 200-300 strong customer as one.
[27:51.700 --> 27:56.940]  And, you know, one funny question that comes up is, you know, what about the reward points or whatever?
[27:57.080 --> 27:57.740]  F*cking use them.
[27:58.810 --> 27:59.480]  Whoever's first.
[27:59.660 --> 28:00.040]  That's the idea.
[28:00.360 --> 28:03.740]  Like, seriously, who's to stop you from just generating...
[28:04.280 --> 28:06.440]  You find somebody else's barcode, you generate...
[28:06.440 --> 28:09.460]  How hard is it to generate somebody else's barcode and use their barcode?
[28:09.660 --> 28:10.980]  There's no security to it.
[28:11.060 --> 28:12.080]  That's, like, not the point.
[28:12.280 --> 28:14.180]  So, yeah, this is a community card.
[28:14.440 --> 28:15.540]  That's what this is for.
[28:15.540 --> 28:18.440]  And, you know, like I said, I was just saying about the Thingiverse thing.
[28:19.240 --> 28:21.560]  If a barcode gets blacklisted, first of all, that's...
[28:21.560 --> 28:23.280]  I find that to be a success because it's funny.
[28:23.380 --> 28:24.580]  They realized it and they got pissed off.
[28:24.720 --> 28:31.200]  But if it happens, I mean, I have my little Perl script and it's on GitHub, but it'll generate a new barcode, you know.
[28:33.240 --> 28:34.560]  So now on to the technical stuff.
[28:34.940 --> 28:42.620]  And these first two things I'm kind of going to race through because I did talk about some of these tools at HOPE 9 with the Explosive Stego talk.
[28:43.560 --> 28:45.640]  But I'll talk about a little bit of forensic stuff.
[28:46.340 --> 28:47.060]  Scalpel, foremost.
[28:47.820 --> 28:49.800]  It just kind of looks for headers and footers.
[28:51.560 --> 28:55.380]  So the idea is you have in green here your file.
[28:55.620 --> 28:56.840]  It's kind of a hex up the file.
[28:56.860 --> 28:59.920]  So this is the content and, you know, the hex of it.
[29:00.260 --> 29:05.740]  But stuff like the file name, what cluster location is, file size, timestamps, that's metadata.
[29:05.780 --> 29:06.740]  That's not part of the file.
[29:06.880 --> 29:08.640]  So Scalpel is not going to carve that part out.
[29:08.740 --> 29:09.800]  It's going to just carve the content out.
[29:09.900 --> 29:11.240]  So that's just the content right there.
[29:12.420 --> 29:13.780]  And this is a busy slide.
[29:13.940 --> 29:14.520]  But this...
[29:14.520 --> 29:18.440]  If you really wanted to know how Scalpel works, this part kind of in...
[29:18.440 --> 29:19.240]  Well, that's stupid.
[29:19.400 --> 29:21.640]  In the middle here, this is like an actual...
[29:21.640 --> 29:23.580]  Yeah, that's just the Scalpel signature.
[29:23.940 --> 29:30.300]  So this is like the file type, whether it's case-sensitive, how much to carve out if it doesn't have a footer and doesn't know where to stop, and then header, footer.
[29:30.640 --> 29:32.440]  So I jump out here, header.
[29:32.580 --> 29:33.820]  That's what it actually looks for in the file.
[29:33.920 --> 29:36.000]  That's the header without the end bracket there.
[29:36.400 --> 29:40.600]  The footer, and then the content, and then it spits out a serialized file name right there.
[29:40.600 --> 29:41.280]  And that's...
[29:41.280 --> 29:41.720]  That's all it does.
[29:42.590 --> 29:46.200]  So what would that do is the idea.
[29:46.520 --> 29:47.180]  It would...
[29:47.180 --> 29:54.640]  It's a fixed amount of data, but it would actually recursively carve out a lot of files because of all the ones inside of that.
[29:55.320 --> 29:56.140]  And it does.
[29:56.560 --> 29:57.580]  It's pretty devastating.
[29:58.020 --> 30:01.360]  So I'm not going to do a live demo of this part.
[30:01.360 --> 30:03.660]  I want to save a little bit of time for live demo for the IDS stuff.
[30:03.860 --> 30:06.220]  But this is me running the script.
[30:06.780 --> 30:09.220]  So Magic Bomb is a script that kind of exploits that.
[30:09.300 --> 30:10.660]  I'm doing a multiplayer of 50.
[30:11.420 --> 30:12.240]  Generated the payload.
[30:14.720 --> 30:17.880]  And then just to show what the payload looks like, the size of it.
[30:18.020 --> 30:19.800]  It's 17K right there.
[30:23.900 --> 30:25.640]  And then I'm going to run scalpel on that file.
[30:26.000 --> 30:27.340]  Just keep in mind it's 17K.
[30:27.340 --> 30:28.900]  Okay, 50 files of each carved out.
[30:30.660 --> 30:32.160]  I guess I had to make it obvious.
[30:36.160 --> 30:39.880]  And now I'm going to run a command to see how big the folder is of what it carved out.
[30:40.040 --> 30:41.520]  And it turns out to be 17 megabytes.
[30:42.080 --> 30:44.880]  So 17K payload and it carves out 17 megabytes.
[30:45.080 --> 30:47.040]  And it's all false positive.
[30:47.160 --> 30:47.980]  They're not actual files.
[30:51.330 --> 30:52.610]  So now we'll look at the audit.
[30:53.330 --> 30:55.770]  Text file to outputs, which will become relevant in a second here.
[30:55.930 --> 30:59.650]  But it gives you all the file names and the length.
[30:59.650 --> 31:02.250]  And it doesn't give you a total, which is kind of sucky.
[31:03.250 --> 31:07.390]  But because of that, my response to that is a Perl script that we'll just go through and parse that out.
[31:07.950 --> 31:09.010]  And sum it all up.
[31:09.430 --> 31:10.850]  Pretty simple Perl script.
[31:12.890 --> 31:18.710]  Because we're going to start doing something that only generates an audit text file instead of actually carving because of how large it's going to get.
[31:18.810 --> 31:22.130]  So we want a way to kind of demonstrate how devastating it is.
[31:24.110 --> 31:28.690]  So just to show on the same audit text file, it's about 16.7 megs is what my Perl script says.
[31:28.690 --> 31:30.850]  So not absolutely accurate, but pretty close.
[31:31.010 --> 31:33.810]  17 megs flat compared to 16.7 megs.
[31:34.610 --> 31:36.450]  So let's remove that output stuff.
[31:38.970 --> 31:41.430]  And we're going to... we should be running scalpel again.
[31:42.010 --> 31:43.590]  Just to show there's nothing in there now.
[31:43.770 --> 31:45.250]  With a multiplier of 30,000.
[31:48.180 --> 31:49.960]  That one takes a couple seconds longer.
[31:55.050 --> 31:55.490]  Okay.
[31:55.490 --> 31:55.570]  Yep.
[31:56.530 --> 31:59.190]  I think I even sped up the video because it says 90 seconds there.
[31:59.830 --> 31:59.970]  All right.
[32:00.250 --> 32:02.090]  So this one's 10 megabytes as a payload.
[32:04.410 --> 32:08.310]  Now, I'm going to run scalpel against it, but I'm going to do dash P. That's preview mode.
[32:08.310 --> 32:13.030]  So I'm not going to actually carve it out because my hard drive wouldn't even fit the output, is the point of this one.
[32:14.290 --> 32:18.450]  So it's carving, generates the audit text file, finds 30,000 of each.
[32:23.110 --> 32:25.150]  And I'll run that Perl script against it.
[32:27.830 --> 32:29.470]  And it's some processing.
[32:30.050 --> 32:31.870]  It's far worse if you carve.
[32:31.870 --> 32:33.670]  3.7 terabytes.
[32:38.710 --> 32:41.890]  And yeah, I think I highlighted like each little chunk just to demonstrate that.
[32:42.090 --> 32:43.130]  But yeah, whatever else, skip that.
[32:43.270 --> 32:44.690]  It's just, it's 3.7 terabytes.
[32:45.710 --> 32:46.970]  So conclusion of that.
[32:47.110 --> 32:47.550]  Damages.
[32:48.150 --> 32:49.910]  17K, it carves out 17 megs.
[32:50.270 --> 32:51.550]  13.3 megs.
[32:51.650 --> 32:52.770]  Oh, and that would DOS your brain.
[32:52.870 --> 32:54.010]  You know, you're trying to analyze all that.
[32:54.590 --> 32:56.490]  13 or 10.3 megabytes.
[32:56.650 --> 32:58.230]  That's 3.7 terabytes.
[32:58.390 --> 32:59.190]  Might DOS your drive.
[32:59.590 --> 33:00.790]  100 megabyte payload.
[33:01.010 --> 33:01.770]  It'll DOS scalpel.
[33:01.890 --> 33:02.970]  Scalpel will just break.
[33:03.890 --> 33:05.150]  I mean, in my example.
[33:05.330 --> 33:06.810]  So you might, if you have a beefier machine.
[33:07.050 --> 33:09.470]  Well, maybe, maybe it'll eventually get through it.
[33:09.590 --> 33:11.710]  And of course your hard drive is going to fill up before that.
[33:11.990 --> 33:13.870]  Well, do a one gig payload, whatever.
[33:14.090 --> 33:15.330]  I mean, it's just the payload.
[33:16.850 --> 33:17.290]  All right.
[33:17.410 --> 33:18.330]  So we're done with that part of it.
[33:18.450 --> 33:20.130]  I'll quickly go through some AV stuff.
[33:20.310 --> 33:22.650]  I also covered HivSneeze in that talk.
[33:23.090 --> 33:24.570]  This is the only slide I have on it.
[33:24.610 --> 33:29.570]  It's just a script that generates files that look like malware to AV products, but isn't.
[33:29.630 --> 33:30.570]  It's just a signature part.
[33:30.630 --> 33:31.490]  And that's all that that does.
[33:31.590 --> 33:32.210]  It's a funny troll.
[33:32.210 --> 33:32.930]  Just saturate.
[33:33.070 --> 33:34.210]  It's a signature based thing.
[33:34.310 --> 33:35.470]  Just saturate the signature based thing.
[33:35.550 --> 33:37.710]  Give it the X that it's looking for, I guess.
[33:39.050 --> 33:42.490]  And so the next thing I want to talk about is what I call a tumor.
[33:42.730 --> 33:43.550]  This is really interesting.
[33:43.690 --> 33:51.570]  This is really playing with the way that one particular vendor in specific uses the quarantine process.
[33:52.310 --> 33:52.790]  So...
[33:52.790 --> 33:53.370]  What's up, man?
[33:53.490 --> 33:57.470]  We can't tell you what it is, but it starts with an M and it ends with an E.
[34:00.380 --> 34:04.860]  So this signature, actually, it's not random binary.
[34:04.860 --> 34:06.560]  It actually says expect us.
[34:06.800 --> 34:11.840]  But the signature is looking for the letter X, which is the second letter there.
[34:12.340 --> 34:16.400]  So like, you know, metaphorically, we could say that the letter X is malware.
[34:16.600 --> 34:22.520]  So if it sees a string of binary that has that signature in there, then flag it as malware and quarantine it.
[34:22.520 --> 34:24.760]  So this is kind of the quarantine process.
[34:25.120 --> 34:26.680]  First of all, we have our metadata there.
[34:27.040 --> 34:32.900]  This vendor will take the metadata, make a text file out of it, and it'll have the virus file itself.
[34:33.120 --> 34:36.840]  And it'll XOR both of those files with the key of 6A.
[34:37.400 --> 34:41.260]  And this is what you end up with is XORed metadata, XORed virus.
[34:41.740 --> 34:44.420]  And it does it in a 7-zip archive container.
[34:44.760 --> 34:45.860]  It doesn't compress it.
[34:45.920 --> 34:46.800]  It's just an archive container.
[34:46.920 --> 34:49.180]  So if you were actually hex-dump it, it's still kind of intact.
[34:49.380 --> 34:50.960]  It's XORed, but it's intact.
[34:53.260 --> 34:55.180]  So, one thing about...
[34:55.180 --> 34:59.040]  Maybe a lot of you know, but talk about that ever-so-powerful double XOR encryption.
[34:59.780 --> 35:03.040]  If you use the same key twice, it just comes back to its original point.
[35:03.120 --> 35:05.420]  It's kind of like a, you know, double ROT13.
[35:05.680 --> 35:11.660]  You know, you rotated 13 characters, you rotated 13 characters again, you overlap the 26, and you're back to where you started.
[35:11.940 --> 35:17.580]  And that's double XOR, which is crucial for the next point of playing with this quarantine process.
[35:17.580 --> 35:19.480]  So, this is the tumor.
[35:19.700 --> 35:25.020]  This would be a tumor, in theory, if this were to be a virus signature.
[35:25.960 --> 35:27.220]  So, say that is our signature.
[35:27.340 --> 35:29.000]  It detects that, so it has to quarantine it.
[35:29.420 --> 35:32.360]  And then, some extra benign data here.
[35:32.720 --> 35:36.540]  So, we XOR it, and we end up with this as an output.
[35:36.820 --> 35:39.100]  More bended data, because we're going to go through another round of it.
[35:39.100 --> 35:41.160]  But this is our 7-zip container that we talked about before.
[35:41.580 --> 35:45.700]  And it turns out, the neutered part of it, it did neuter that part.
[35:45.800 --> 35:49.680]  But when you XOR it, that second part happens to be the signature now.
[35:51.000 --> 35:52.520]  So, it's going to get quarantined again.
[35:52.640 --> 35:53.240]  It really will.
[35:53.920 --> 35:55.000]  And we do that.
[35:55.440 --> 35:57.800]  And it just, now that's back to its original.
[35:57.960 --> 36:00.320]  It just keeps going and going, in theory.
[36:00.560 --> 36:02.160]  In theory, it's actually benign in practice.
[36:02.520 --> 36:04.280]  You know, in theory, in practice, theory, in practice...
[36:04.280 --> 36:07.260]  Or, in theory, theory and practice are the same, but in practice they're not.
[36:07.260 --> 36:08.020]  You know, that kind of thing.
[36:09.120 --> 36:10.400]  So, let's see how much time I have.
[36:10.580 --> 36:13.900]  I kind of want to speed through this, just because I won't have enough time for the IDS stuff.
[36:14.060 --> 36:17.100]  But, I have the proof of concept video for this.
[36:18.920 --> 36:20.120]  I might actually skip through this.
[36:20.860 --> 36:23.320]  The first part of it, I actually rip out a signature...
[36:23.320 --> 36:24.580]  No, it's just like four minutes.
[36:24.720 --> 36:25.620]  That's not so bad.
[36:26.520 --> 36:26.620]  Yeah.
[36:27.580 --> 36:28.540]  I started a little bit late.
[36:28.620 --> 36:31.580]  It feels like I'm going slow, and I'm really not.
[36:32.600 --> 36:35.380]  So, we're ripping out the CLAM AV signatures.
[36:35.900 --> 36:41.440]  Using a little bit of DD on the signature, because it's actually a TAR file, but you've got to skip the first 512 bytes.
[36:42.060 --> 36:46.380]  You've got to change the permissions, and maybe I'll make this a little bit bigger while it runs.
[36:46.780 --> 36:46.880]  Okay.
[36:48.520 --> 36:52.640]  So, now we're just going to look at this CLAM AV signature file in the raw.
[36:53.580 --> 36:57.460]  I'll scroll down quite a bit here, just to show that, because these are non-sensical names.
[36:57.460 --> 37:01.300]  But here we go, like anarchy and intermediate or media.
[37:01.680 --> 37:03.920]  Those are all like the equals part of it.
[37:04.080 --> 37:06.000]  After that was kind of ASCII hex.
[37:06.320 --> 37:07.820]  So, it's the actual signature.
[37:09.860 --> 37:15.880]  Now, I'm just kind of doing a filter for one of the signatures that tends to be really useful for tumorizing for me.
[37:17.960 --> 37:21.020]  Yeah, it's a specific ALBA worm for IRC.
[37:22.900 --> 37:24.380]  I'm going to kind of grep it out.
[37:25.800 --> 37:26.480]  There we go.
[37:26.580 --> 37:28.740]  And then, I'm going to highlight that signature.
[37:30.620 --> 37:34.660]  And I'm doing it this way, because like, you can actually use HivSneeze to do this automatically.
[37:34.660 --> 37:36.400]  I updated it a few months ago.
[37:36.400 --> 37:38.640]  But I want to show how you can manually do it.
[37:38.760 --> 37:39.620]  I don't like magic.
[37:39.840 --> 37:40.400]  I hate magic.
[37:40.760 --> 37:46.420]  So, I think it's really cool to show you manually how you can create a payload and show it working.
[37:47.280 --> 37:52.280]  So, I'm going to use NextXD to make it binary, like from ASCII to an actual binary file.
[37:52.460 --> 37:53.700]  And I'll cut the file out.
[37:53.780 --> 37:55.020]  And it actually looks kind of like a script.
[37:56.120 --> 37:57.340]  That's a hex stump of it.
[37:57.720 --> 38:01.880]  So, now this is a Perl one-liner that's going to XOR it with the letter lowercase J.
[38:01.880 --> 38:04.980]  Just so you know, in ASCII or hex, that's 6A.
[38:04.980 --> 38:06.600]  That's the actual key that this vendor uses.
[38:07.440 --> 38:08.860]  So, I'm going to hex stump that.
[38:09.000 --> 38:09.840]  That's the result of that.
[38:10.060 --> 38:14.760]  And side-by-side or line-by-line, the top is XOR, the bottom is the original.
[38:15.060 --> 38:17.360]  So, now all we really do is just cat them together.
[38:18.160 --> 38:23.940]  Kind of like how we had those two bytes in the previous XOR example for the tumor.
[38:25.600 --> 38:26.400]  Tumor.txt.
[38:27.920 --> 38:30.060]  And hex-dumping that, there they are combined.
[38:30.440 --> 38:31.360]  And that's the payload.
[38:34.440 --> 38:36.280]  So, now what I'm doing here, this is a VM.
[38:36.980 --> 38:38.880]  So, I'm just copying it to the shared drive.
[38:38.880 --> 38:42.220]  And then I flip over to the Windows VM to show it in action.
[38:55.520 --> 38:56.340]  It's hard to see.
[38:56.420 --> 38:59.240]  It's kind of blurry, but I'm copying the tumor file over to the desktop there.
[39:01.720 --> 39:02.720]  And then here in a second.
[39:02.860 --> 39:05.440]  Yeah, it's quarantined now in the quarantine folder.
[39:05.660 --> 39:06.700]  This .bub file.
[39:07.060 --> 39:11.020]  Also, notice when we come over here, I think I had to expand it out.
[39:11.680 --> 39:12.140]  Yeah, there we go.
[39:12.920 --> 39:13.040]  Up.
[39:14.020 --> 39:14.500]  Come on.
[39:14.820 --> 39:15.080]  All right.
[39:15.240 --> 39:15.840]  It's 3K.
[39:17.380 --> 39:20.340]  Which is actually a little bit bigger than that small text file we were looking at.
[39:21.460 --> 39:23.740]  So, if I try to access it, on access.
[39:25.200 --> 39:26.420]  I'm going to just open it.
[39:28.020 --> 39:28.900]  It flips out.
[39:29.140 --> 39:29.620]  It throws an alert.
[39:31.820 --> 39:34.880]  It actually scanned as a virus from the quarantine folder.
[39:37.560 --> 39:38.520]  So, I close it.
[39:38.800 --> 39:40.620]  It's actually 6K now.
[39:41.160 --> 39:41.620]  Odd.
[39:42.380 --> 39:42.840]  Metadata.
[39:43.260 --> 39:44.240]  Let's access it again.
[39:44.520 --> 39:47.260]  So, obviously, you're going to want to go with a lot bigger file.
[39:47.260 --> 39:49.320]  Otherwise, this is going to take a really long time.
[39:50.000 --> 39:50.800]  But it's a tumor.
[39:51.060 --> 39:51.160]  You know?
[39:51.260 --> 39:51.760]  Slow growth.
[39:52.720 --> 39:53.700]  It's scanning again, though.
[39:53.800 --> 39:56.040]  Every time we access it, and now it's 8K.
[39:58.940 --> 40:02.340]  I don't even plan to, like, weaponize this or anything, because that's, like, not interesting to me.
[40:02.400 --> 40:05.140]  As a hacker, what's interesting is just screwing around, right?
[40:05.200 --> 40:06.680]  I don't care about it being damaging.
[40:06.820 --> 40:08.100]  I find this just incredibly interesting.
[40:08.260 --> 40:10.620]  It's just kind of a signature-based system.
[40:10.620 --> 40:14.860]  And we're playing with the way it does its quarantine process and get a weird side effect of it.
[40:15.000 --> 40:16.180]  And I find that kind of interesting.
[40:16.180 --> 40:17.200]  So, that's a tumor.
[40:18.600 --> 40:27.700]  Another point we should say is, in this particular AV product, I usually have it set up to do an auto-scan of the drive every day at a certain time.
[40:27.900 --> 40:37.360]  So, given on an enterprise system, if you have a file, say, 1 meg in size, and every day it doubles in size, by the end of the year, it's going to fill up the drive.
[40:37.760 --> 40:43.980]  So, you can imagine a mass-scale attack at an enterprise with just one of these files on each individual system.
[40:43.980 --> 40:48.920]  So, I would say that it doesn't double in size, though, because what makes it grow is actually just the metadata.
[40:49.420 --> 40:50.880]  But it still would grow every time.
[40:50.980 --> 40:52.380]  And if you had enough of them, it would be pretty...
[40:52.840 --> 40:53.640]  It sucks either way.
[40:54.400 --> 40:56.980]  Especially with retention policy, you just can't get rid of that file.
[40:57.080 --> 40:57.740]  It's kind of funny.
[40:58.400 --> 41:00.140]  So, now, the IDS part, my favorite part.
[41:01.340 --> 41:04.520]  First of all, I'll go into, like, kind of one of those OWASP top 10 things.
[41:05.860 --> 41:07.140]  So, I like this one.
[41:07.440 --> 41:11.820]  I have a couple of slides on it, but I will instead just demo this one real quick.
[41:12.160 --> 41:13.700]  So, this is our IDS.
[41:13.800 --> 41:17.080]  In this case, we're using a little front-end called Snorby.
[41:18.020 --> 41:23.640]  The rule that it fired on is a SQL injection one, possible SQL server version URI.
[41:24.260 --> 41:26.980]  So, if we go down here, this is what it captured, the hex stump of that.
[41:27.680 --> 41:30.860]  And I'll look at the ASCII version real quick, because it's a little bit more readable.
[41:32.160 --> 41:36.960]  You know, you have... mostly it's signaturing off of the union select part of it.
[41:37.280 --> 41:39.320]  But then you have some obfuscated stuff there, right?
[41:40.080 --> 41:41.660]  So, we're going to go ahead and copy that.
[41:42.840 --> 41:45.160]  And this attack is so obscure.
[41:47.120 --> 41:49.420]  We work... so, I don't even want to get into it.
[41:49.500 --> 41:51.800]  But I just want to mention that this could happen.
[41:52.140 --> 41:54.880]  This is the narrative, is that you're an analyst.
[41:54.880 --> 41:55.940]  You see this signature.
[41:56.880 --> 42:00.240]  You may not understand as much as you should about SQL injection.
[42:00.860 --> 42:01.860]  As this analyst.
[42:02.920 --> 42:10.320]  And you're like, well, I'm pretty sure our company's website doesn't even have a SQL backend for this particular page that it's going off of.
[42:10.500 --> 42:12.440]  So, let's just try it out.
[42:12.680 --> 42:13.300]  See what happens.
[42:13.740 --> 42:16.020]  So, this is their company's website.
[42:16.320 --> 42:17.400]  You know, I'm a bank.
[42:19.240 --> 42:21.020]  And, you know, this unit.
[42:21.400 --> 42:22.480]  Not already a customer.
[42:22.660 --> 42:23.040]  Sign up now.
[42:23.220 --> 42:23.700]  For reasons.
[42:24.200 --> 42:25.520]  With really great reasons.
[42:27.220 --> 42:28.080]  So, yeah.
[42:28.080 --> 42:30.260]  We'll try to replay that SQL injection.
[42:30.480 --> 42:33.780]  And see what kind of SQL injection attack that might be.
[42:34.460 --> 42:35.400]  So, we play the attack.
[42:36.980 --> 42:38.260]  That's not SQL injection.
[42:38.620 --> 42:40.000]  That's actually cross-site scripting.
[42:41.640 --> 42:44.680]  So, instead of a normal vector of cross-site scripting attacks.
[42:44.780 --> 42:46.440]  Where you send the link in an email or whatever.
[42:46.920 --> 42:50.260]  You're sending it to a different demographic of people through IDS.
[42:50.740 --> 42:53.560]  And it sounds very specific and unlikely to work.
[42:54.380 --> 42:54.860]  But...
[42:54.860 --> 42:56.860]  You'd be surprised how often this works.
[42:58.360 --> 43:02.020]  I'm not trying to put down anyone who works in a security operations department.
[43:02.260 --> 43:03.780]  But there's some pretty stupid people out there.
[43:03.960 --> 43:05.660]  And they will fall for this.
[43:07.400 --> 43:10.100]  So now, my favorite, favorite part.
[43:10.300 --> 43:11.540]  It's favorite part because of IDS.
[43:11.640 --> 43:12.860]  My favorite part because of this tool.
[43:13.500 --> 43:14.880]  This tool called 8Ball.
[43:17.160 --> 43:18.680]  It's not the first tool of its kind.
[43:19.200 --> 43:21.560]  There's been some older tools like Stick and Snot.
[43:22.020 --> 43:23.320]  This one's a little bit different.
[43:23.600 --> 43:24.760]  But it also...
[43:24.760 --> 43:30.420]  Mostly, it's something that I've used for testing the performance of my own IDS.
[43:30.500 --> 43:32.300]  Because it has some ways to throttle it a little bit.
[43:32.400 --> 43:36.580]  And you can kind of find, like, that border of where your IDS is starting to drop packets.
[43:36.740 --> 43:38.320]  Like, it helps you fine-tune that.
[43:39.400 --> 43:43.220]  It's kind of like testmyids.com, if anybody's been there.
[43:43.780 --> 43:44.860]  It doesn't even...
[43:44.860 --> 43:47.040]  It's a website, but it doesn't even have HTML tags.
[43:47.220 --> 43:48.860]  It's just this string of text here.
[43:49.360 --> 43:52.180]  And the rule that it's triggering on is this rule down here.
[43:52.380 --> 43:54.260]  It's just literally checking for if it...
[43:54.260 --> 44:00.760]  If the packet has UID equals zero, parenthesis, root, end parenthesis, trigger and alert.
[44:00.980 --> 44:02.600]  So that's why that website just has that.
[44:02.640 --> 44:03.200]  And it's that easy.
[44:03.800 --> 44:05.860]  It's kind of a little bit of IDS demystified right there.
[44:06.960 --> 44:09.120]  So let's look at a slightly more complicated rule.
[44:09.640 --> 44:10.620]  It's a lot of crap there.
[44:10.700 --> 44:12.400]  In fact, even at the end, it had a dot, dot, dot.
[44:12.400 --> 44:13.420]  It's not even the whole rule.
[44:14.060 --> 44:26.780]  So to unpack that a little bit, this rule is looking for from outside the network on any port to inside your network on web server ports to a web server defined by some variables on your IDS.
[44:26.980 --> 44:31.120]  It also needs to have a awstats.pl in the URI.
[44:31.500 --> 44:34.400]  And there's some regex in there as well that needs to match.
[44:34.400 --> 44:37.280]  So it needs to either have configure, update, or plugin mode.
[44:37.440 --> 44:40.940]  And then it needs an equals, any amount of any characters or none.
[44:41.460 --> 44:45.860]  And then it needs to have any amount of characters surrounded by pipes or system.
[44:45.860 --> 44:51.700]  So, could we just send a packet that is a get for slash awstats.pl?
[44:52.630 --> 44:55.420]  Question, configure equals A surrounded by brackets?
[44:56.140 --> 44:57.280]  Answer is yes, we can.
[44:58.060 --> 45:00.500]  So, that's that signature that it fired.
[45:02.020 --> 45:05.920]  And down here is that get request.
[45:06.500 --> 45:07.980]  And this is just totally generated.
[45:08.120 --> 45:09.540]  This wouldn't even attack anything.
[45:09.720 --> 45:11.420]  It really wouldn't even work for what it's looking for.
[45:11.640 --> 45:13.200]  We're just like poking the signature.
[45:13.380 --> 45:14.180]  It's looking for X.
[45:14.300 --> 45:15.620]  We're giving it the X it's looking for.
[45:16.820 --> 45:18.500]  So, we automate it.
[45:19.820 --> 45:22.480]  So, it takes in a lot of configurations.
[45:22.800 --> 45:27.520]  But one thing, the thing that I use for testing performance is it does have a speed setting.
[45:27.520 --> 45:31.520]  So you can kind of throttle it down and watch it go slowly.
[45:31.660 --> 45:31.900]  Go ahead.
[45:32.060 --> 45:44.160]  I was going to say, if you guys want to screw with IDS signatures, but you don't really want to screw around too much with like downloading stuff, all you really have to do is mess with your user agent string in your browser.
[45:44.160 --> 45:53.300]  For example, many IDS products will actually flag you as worm traffic just by setting your user agent string to Internet Exploder.
[45:54.180 --> 45:54.620]  Yes.
[45:55.500 --> 45:56.460]  Internet Exploder.
[45:57.880 --> 46:00.440]  So, I'm going to start this out because time is kind of...
[46:00.440 --> 46:02.120]  I wanted to do a live demo.
[46:02.440 --> 46:04.820]  I can, but I just need to let this go.
[46:05.020 --> 46:08.780]  So, I'm running the eight ball right now.
[46:10.780 --> 46:14.080]  And it's running through sending all these packets to the IDS.
[46:15.000 --> 46:18.500]  I'll make myself available down in the mezzanine if you want to see this live.
[46:19.860 --> 46:21.560]  Because there's a couple of things that could take a while.
[46:21.740 --> 46:32.760]  Like the attack itself or like this thing right here is pretty quick, but then to get my IDS to update and show me that it all hit, like it could take a few minutes and a few minutes is kind of what I don't have.
[46:32.760 --> 46:39.320]  So, but the cool, my favorite thing about this is it actually will do the PCRE or regex stuff as well.
[46:39.360 --> 46:43.820]  So, if the rule itself has regex in it, I should say that this is all automated.
[46:43.980 --> 46:48.580]  It will look at a rule file and it will generate a packet dynamically for each rule.
[46:48.680 --> 46:49.720]  This isn't handcrafted.
[46:49.720 --> 46:56.220]  So, you feed it a suricata or snort rule set and it will just generate these packets and send them at the target.
[46:56.880 --> 47:02.020]  Lighting up unique several different rules on the IDS.
[47:02.540 --> 47:09.820]  But yeah, with the regex one or regular expression one, it actually looks at the regular expression and generates text that would match the regular expression.
[47:10.320 --> 47:12.120]  It's like regex porn.
[47:15.020 --> 47:17.120]  So, how are we doing on this time on this video?
[47:17.440 --> 47:18.460]  I'm just going to kind of skip along.
[47:18.660 --> 47:19.200]  Five minutes.
[47:23.300 --> 47:26.740]  So, yeah, this is a showing like there's, this is snorby.
[47:26.860 --> 47:28.040]  There wasn't anything there, zero.
[47:28.200 --> 47:29.080]  And this is output.
[47:29.240 --> 47:31.760]  We got like almost 5k different unique events.
[47:32.680 --> 47:34.520]  And someone has to investigate those.
[47:35.280 --> 47:35.680]  Yeah.
[47:37.000 --> 47:40.980]  So, a couple of features I don't have that I'd like to add, but UDP, you can do some spoofing.
[47:41.140 --> 47:41.700]  I don't have that.
[47:42.040 --> 47:44.800]  Maybe pad the packets out, fill up the drive a little bit quicker.
[47:45.240 --> 47:50.880]  Long circuiting, which like if you guys have heard of short circuiting with programming, you have like a lot of or, like a conditional with a lot of ors.
[47:51.080 --> 47:53.120]  If the first one is satisfied, you don't look at the rest.
[47:53.300 --> 48:00.660]  Well, you could take advantage of that, do that the other way, where if you have a lot of components of your IDS rules, you could like match all the first components but not match the last one.
[48:00.800 --> 48:05.520]  So, it has to spend more resources like analyzing it, but it doesn't even come into the channel.
[48:05.660 --> 48:07.600]  It doesn't even like, you don't even see an alert on it.
[48:07.600 --> 48:11.500]  And then Redos, Regex denial of service, which is incredibly interesting.
[48:12.680 --> 48:13.840]  Anyway, that's IDS stuff.
[48:13.980 --> 48:15.400]  And I just kind of want to wrap this up real quick.
[48:15.800 --> 48:16.760]  There's other stuff you can do.
[48:16.920 --> 48:22.680]  Yara, Attention Deficit Disorders isn't mine, but it's a really cool tool that I think got released during ShmooCon this year.
[48:22.860 --> 48:24.520]  It throws like artifacts into memory.
[48:24.760 --> 48:26.980]  So, tools like volatility will like...
[48:26.980 --> 48:30.160]  If you're like an analyst that doesn't know what you're looking for, that could screw with you.
[48:30.720 --> 48:31.920]  So, here's the record player again.
[48:32.160 --> 48:34.640]  The idea is we need to add some security to it, you know, thin thread, right?
[48:35.680 --> 48:38.660]  Trailblazer, turbulence, like all the iterations of this, this crappy stuff.
[48:39.460 --> 48:41.340]  Add some stellar wind to it, shell trumpet.
[48:41.680 --> 48:43.480]  Magic Lantern to look at the record player.
[48:43.800 --> 48:48.720]  XKEYSCORE, PRISM, and total information awareness, and all that f*cking shit down there, right?
[48:50.020 --> 48:52.900]  I didn't have time to like, do visual stuff for the rest of it.
[48:53.120 --> 48:55.260]  So like, that's like the environment we work in.
[48:55.400 --> 48:59.020]  And as far as records and music, like we can't listen to these records.
[48:59.020 --> 49:00.860]  It's a lot harder to listen to these records.
[49:01.240 --> 49:06.760]  It's not as high fidelity, it's incredibly complex, but it's not as, you know, you can't reproduce every sound, right?
[49:07.020 --> 49:11.440]  So, the whole point of this is we encourage you to play these kind of records, right?
[49:13.120 --> 49:15.380]  And we're not the only music producers.
[49:15.380 --> 49:17.800]  We like other remixes and DJs.
[49:19.060 --> 49:20.040]  So, that's the point.
[49:20.200 --> 49:22.780]  And if there's any questions, please come up to the microphone.
[49:23.320 --> 49:25.080]  If you have even, not just questions, but suggestions.
[49:25.080 --> 49:27.780]  If you have some novel other ideas that I didn't cover, because this is just me.
[49:28.220 --> 49:29.040]  So, I'd like to hear it.
[49:29.180 --> 49:32.040]  And now's a good time to come up and take some stuff, if you want to.
[49:33.160 --> 49:36.260]  And this is Ruben's stuff, but Joe's the guy with me right now.
[49:37.480 --> 49:38.880]  I can put up your information if you want.
[49:39.100 --> 49:39.360]  No.
[49:39.500 --> 49:39.700]  Okay.
[49:39.800 --> 49:40.260]  That's cool.
[49:41.340 --> 49:42.700]  I prefer not to be flagged.
[49:43.620 --> 49:44.800]  You don't want to get on a list.