[00:32.100 --> 00:34.300]  Extremely, extremely educated guys.
[00:36.460 --> 00:44.080]  McAfee back then, on an average, would get 300 brand new viruses never before seen in the wild each month.
[00:45.200 --> 00:46.720]  Now think about that.
[00:48.600 --> 00:52.060]  300 never before seen viruses each month.
[00:53.260 --> 00:54.180]  That's a lot.
[00:54.860 --> 00:57.240]  And as he says, that's approximately 10 a day.
[00:58.280 --> 01:02.280]  Right now, that number is up to 500 or 600 per month.
[01:07.080 --> 01:08.740]  You know, it's funny you should mention that.
[01:08.780 --> 01:09.420]  I've got a story.
[01:12.640 --> 01:15.860]  I almost had a lot of trouble for making that exact same statement.
[01:16.360 --> 01:21.440]  I was kicking back with a lot of people at dinner who were from McAfee.
[01:21.440 --> 01:23.240]  And we were all talking about it.
[01:23.340 --> 01:25.560]  And they were like, oh yes, it was the Michelangelo virus.
[01:25.740 --> 01:26.060]  I didn't know it.
[01:26.460 --> 01:29.820]  It's, you know, John found the cure for it.
[01:29.940 --> 01:30.940]  And he wrote the code.
[01:31.180 --> 01:33.300]  And it's what put McAfee on the map.
[01:33.440 --> 01:36.640]  And we're all talking about just how great McAfee was and how, you know, like this.
[01:36.660 --> 01:38.220]  I said, wow, the Michelangelo virus.
[01:38.380 --> 01:39.980]  So how long did it take John to write it?
[01:40.540 --> 01:41.240]  Dead silence.
[01:42.560 --> 01:45.980]  I mean, I could feel the glares staring at me.
[01:45.980 --> 01:47.720]  And I'm going, it was a joke.
[01:48.000 --> 01:50.000]  He was like, you're going, you don't need any kid about that.
[01:51.440 --> 01:57.500]  Honestly, McAfee is really, really good about not having anybody in there who's ever, ever written a computer virus.
[01:58.240 --> 02:02.260]  I actually know of several cases where they've interviewed people they desperately wanted to hire.
[02:02.600 --> 02:08.480]  And one of the questions they ask, you know, they ask during the interview, you know, arbitrarily is like, so have you, like, you know, ever written a virus?
[02:08.700 --> 02:10.640]  And he goes, yeah, I wrote one or two when I was a kid.
[02:10.640 --> 02:13.540]  And they're like, can't hire you.
[02:13.820 --> 02:16.880]  And here's the, here's the security to escort you out.
[02:19.520 --> 02:25.900]  I would say I can't think of a single antivirus software company that actually would employ anyone who's ever written a virus.
[02:26.160 --> 02:27.960]  They're very, very strict about that.
[02:29.020 --> 02:42.960]  Even if you download the generic virus writing programs, and there's thousands of them out there right now, if you've ever played with one and just arbitrarily created one just for experiments, forget about ever working at an antivirus company.
[02:43.220 --> 02:43.660]  Period.
[02:45.300 --> 02:49.960]  Alright, what we're going to do is, I'm going to switch off the code here and go to my actual presentation here.
[02:50.440 --> 02:51.200]  Hold on a second.
[03:20.710 --> 03:23.170]  I hate to admit it, I actually enjoy using PowerPoint.
[03:23.570 --> 03:24.890]  It's really, really simple.
[03:26.050 --> 03:27.970]  Okay, this is the introduction of computer viruses.
[03:30.050 --> 03:30.630]  That's me.
[03:32.310 --> 03:35.570]  This took a whole of five minutes the first time I tried to use this.
[03:39.460 --> 03:46.460]  So basically, when we go through this presentation here, you should be able to actually understand...
[03:47.760 --> 03:48.880]  Ooh, get to be on stage.
[03:50.060 --> 03:51.800]  Basically how computer viruses work.
[03:51.940 --> 03:52.860]  That's what we're going to do here.
[03:52.860 --> 03:58.740]  We're going to give you an introduction about what... you know, give you a little bit more education about what you're dealing with out there.
[03:59.860 --> 04:04.940]  First of all, can someone actually define to me what a computer virus is?
[04:09.700 --> 04:11.700]  Malicious software replicating code?
[04:11.900 --> 04:12.400]  Is that what you said?
[04:12.900 --> 04:13.680]  That's very good.
[04:14.120 --> 04:15.580]  I would accept that.
[04:16.460 --> 04:19.620]  The key word here is replicating code, though.
[04:20.880 --> 04:21.180]  Okay?
[04:22.060 --> 04:23.760]  Malicious software that replicates.
[04:24.740 --> 04:27.460]  For a virus to be a virus, it has to spread.
[04:28.620 --> 04:35.700]  Now, when I say there's 600, you know, up to 600 brand new viruses released in the wild per month.
[04:36.580 --> 04:38.280]  You notice you never see these.
[04:38.460 --> 04:39.200]  There's a reason.
[04:39.640 --> 04:40.900]  Most of them suck.
[04:41.060 --> 04:42.420]  They're not written very well.
[04:42.420 --> 04:43.560]  You know?
[04:44.540 --> 04:48.080]  I do know of cases where you have the heavy duty virus writers.
[04:48.320 --> 04:50.180]  Well, this is the old school virus writers.
[04:50.400 --> 04:56.220]  Now, any script kitty with basic knowledge can actually write a virus now and do massive amounts of damage.
[04:57.600 --> 04:59.640]  And we'll get into that a little bit later.
[04:59.900 --> 05:02.420]  Because that's a nice little rant and rave I get pissed off about.
[05:04.160 --> 05:09.080]  In the old school, the guys who were writing the viruses were brilliant.
[05:09.400 --> 05:10.640]  These were good coders.
[05:10.880 --> 05:13.900]  I mean, these guys who knew the programming languages inside and out.
[05:14.620 --> 05:17.500]  Not only that, they knew your machine inside and out.
[05:17.700 --> 05:19.600]  They knew exactly what the calls to make.
[05:19.720 --> 05:21.460]  They knew exactly how to make the code small.
[05:23.160 --> 05:25.540]  Who cares if they were jerks for writing the damn virus?
[05:25.680 --> 05:26.960]  They were brilliant jerks, you know?
[05:29.240 --> 05:31.460]  The problem nowadays is anybody can write them.
[05:31.740 --> 05:31.980]  Anybody.
[05:33.440 --> 05:34.920]  But you don't see most of these videos.
[05:35.220 --> 05:38.100]  Like I said, most of them suck and, you know, it just happens.
[05:39.540 --> 05:47.000]  But I do know some of the old school guys who used to actually send the viruses into like McAfee and Norton.
[05:47.140 --> 05:49.480]  And they're going, alright guys, see if you can figure this one out.
[05:49.480 --> 05:54.960]  And they would actually have 24 hour sessions where they would actually reverse engineer the virus code.
[05:55.160 --> 05:58.800]  And actually have a DAT file update for it the next day just to go...
[06:00.360 --> 06:04.400]  And I'm going, wait a minute, you guys would actually pay the amount of time to actually do that?
[06:04.800 --> 06:06.000]  It's a matter of pride.
[06:06.460 --> 06:06.860]  Yeah.
[06:07.180 --> 06:09.120]  Well, they don't do the matter of pride thing anymore.
[06:09.160 --> 06:12.460]  Unless it's something, you know, heavy duty like the I love you virus or something like that.
[06:12.460 --> 06:20.180]  Which wasn't that, in my opinion, although it was a virus, it really wasn't a virus.
[06:21.020 --> 06:27.740]  You know, it was a visual basic script written by, you know, putz boy, you know.
[06:31.240 --> 06:32.860]  Alright, the types of computer viruses.
[06:33.120 --> 06:34.720]  We're going to go over types of computer viruses.
[06:35.160 --> 06:36.980]  We're going to talk about fakes and false alarms.
[06:37.300 --> 06:38.640]  That's what gets most of us in trouble.
[06:38.980 --> 06:42.460]  Well, not most of us, lots of us in trouble.
[06:42.460 --> 06:47.080]  And basically the conclusion is going to be talking about more of the visual basic scripts.
[06:49.440 --> 06:52.020]  Alright, the types of computer viruses that are out there.
[06:52.540 --> 06:53.800]  Food sector viruses.
[06:54.280 --> 06:55.380]  There's bio infectors.
[06:55.880 --> 06:57.460]  Multi-partite viruses.
[06:58.100 --> 06:58.680]  Macros.
[06:59.340 --> 07:02.460]  And you notice I didn't put VBS scripts there yet.
[07:03.440 --> 07:06.180]  Because that's a totally different subject, in my opinion.
[07:08.300 --> 07:08.580]  Alright.
[07:14.760 --> 07:15.920]  It affects the bios.
[07:17.780 --> 07:19.560]  There's a new virus that affects bios.
[07:20.240 --> 07:21.600]  Yeah, it's a boot sector.
[07:24.460 --> 07:31.560]  Because, well, just for information, there's about 30 or 40 viruses out there that affect the bios.
[07:33.000 --> 07:37.240]  Anti-CMOS is a very, very old boot sector virus that affected the bios.
[07:37.240 --> 07:38.640]  So, this is not new.
[07:39.880 --> 07:41.040]  Someone had a question back there?
[07:42.380 --> 07:42.780]  Anybody?
[07:43.220 --> 07:43.600]  Bueller?
[07:43.860 --> 07:43.960]  No?
[07:44.300 --> 07:44.720]  Okay, fine.
[07:45.620 --> 07:49.060]  Alright, on the boot sector viruses, we're going to discuss how they work and the different types.
[07:51.160 --> 07:52.920]  Alright, everybody look at the pretty screen.
[07:53.160 --> 07:54.140]  Oh, this looks really bizarre.
[07:54.900 --> 07:55.380]  Okay.
[07:56.220 --> 08:00.220]  The boot sector viruses attacks the NBR of the hard drive and the floppy disk.
[08:00.220 --> 08:02.640]  Does anyone actually remember using floppy disks?
[08:03.420 --> 08:03.660]  Yeah.
[08:04.520 --> 08:05.240]  Rocking, man.
[08:05.880 --> 08:06.740]  Remember the sneaker net?
[08:07.480 --> 08:07.880]  Yeah.
[08:07.880 --> 08:08.140]  Wasn't that?
[08:08.400 --> 08:08.580]  Yeah?
[08:08.700 --> 08:10.220]  He's like, hey, I need a file.
[08:10.400 --> 08:10.840]  Huh, shit.
[08:10.980 --> 08:11.240]  I don't know.
[08:12.560 --> 08:15.500]  Remember the days when nobody had elevators in the really big, tall buildings?
[08:15.500 --> 08:19.360]  And he was like, hey, man, I need you to take that file over to George.
[08:19.520 --> 08:19.900]  Oh, man.
[08:19.980 --> 08:21.140]  He's eight floors down.
[08:21.320 --> 08:22.020]  You suck.
[08:22.380 --> 08:22.740]  God.
[08:23.000 --> 08:23.920]  I hate this job.
[08:24.520 --> 08:24.740]  Yeah.
[08:24.980 --> 08:25.820]  That was my job.
[08:26.600 --> 08:27.200]  Here, Rob.
[08:27.280 --> 08:27.860]  Take this fire.
[08:28.800 --> 08:29.820]  Alright, I'm taking the file.
[08:29.940 --> 08:30.420]  I'm taking the file.
[08:30.560 --> 08:31.020]  I'm taking the file.
[08:31.620 --> 08:31.900]  Yeah.
[08:32.080 --> 08:35.500]  Yeah, but I could hold, you know, I was, you know, I could hold 10 megs myself.
[08:35.760 --> 08:35.880]  You know?
[08:36.240 --> 08:36.920]  It was pretty cool.
[08:37.960 --> 08:38.320]  Alright.
[08:38.520 --> 08:40.960]  So, no, that was fine.
[08:41.620 --> 08:42.560]  Good timing here.
[08:42.560 --> 08:45.640]  The NBR is actually divided into three different parts.
[08:45.920 --> 08:49.420]  You have the code part, the fat, and partition information part, and the marker.
[08:49.960 --> 08:50.400]  55AA.
[08:50.900 --> 08:53.300]  Is anyone actually familiar with the 55AA?
[08:54.840 --> 08:56.220]  One person, two persons?
[08:56.660 --> 08:57.280]  Guy in the background?
[08:58.840 --> 08:59.720]  What's 55AA?
[09:03.210 --> 09:04.530]  Get that boy up here, on any point.
[09:04.750 --> 09:06.370]  Yes, it's the last two bytes in the bootsector.
[09:09.070 --> 09:12.710]  Alright, the way the virus, or the bootsector virus actually attacks the NBR.
[09:13.390 --> 09:19.690]  The virus first copies the boot code on the drive to a different sector on the drive.
[09:20.210 --> 09:29.610]  Now, the hard drive itself on the bootsector has multiple sectors to use for different types of programs to make allocations to it.
[09:30.070 --> 09:32.850]  Lots of these sectors are never used by anything.
[09:33.170 --> 09:33.810]  Ever.
[09:34.830 --> 09:36.130]  Virus writers knew this.
[09:37.490 --> 09:42.270]  A real common ones are sectors 7, 9, 12, 17, 22.
[09:42.610 --> 09:47.290]  These are sectors a lot of viruses actually sit there and will copy the code, the actual boot code.
[09:47.550 --> 09:57.130]  The boot code, you know, it gives you like, syntax error, file, file, crap, you know, for the DOS babies here, you know, where you'll do something, you'll screw up and all of a sudden get the error message.
[09:57.130 --> 09:59.870]  That's where the error message came from is that code.
[10:00.530 --> 10:01.850]  So that code would actually be written.
[10:01.970 --> 10:08.050]  It also gives the instructions of how to interpret the FAT allocation table and so forth.
[10:08.530 --> 10:11.850]  That code is copied to a different sector completely.
[10:12.610 --> 10:15.350]  It then copies itself over the code.
[10:16.610 --> 10:19.350]  And then at the end of the code, it actually points to the different sectors.
[10:19.650 --> 10:25.290]  So if it actually copies to multiple sectors, like say it will copy to 7, 9, and 12.
[10:25.730 --> 10:27.970]  At the end of the code, it says, check 7.
[10:28.150 --> 10:32.090]  If 7 isn't the right code, go to 9.
[10:32.310 --> 10:34.150]  If that's not the right code, go to 12 and so forth.
[10:34.370 --> 10:36.910]  Until it actually finds the correct code to actually boot up.
[10:40.860 --> 10:43.880]  Just to add a little point here real quick before I go to this slide here.
[10:45.580 --> 10:53.140]  It is actually very, very possible to multi-infect a hard drive with several different boot sector viruses.
[10:54.440 --> 10:56.380]  I've done a lot of experimenting with that.
[10:56.620 --> 11:01.440]  Where it's like, you know, do the New York boot, the anti-EXE, and anti-CMOS.
[11:01.660 --> 11:12.300]  And it's kind of cool because what most people do, if they think they have a virus, is they'll run their scan disk, you know, put the disk into the drive, boot up off the disk, and they'll scan the drive once.
[11:12.680 --> 11:14.160]  Alright, good, I got rid of the virus.
[11:14.500 --> 11:17.500]  But it doesn't necessarily find the viruses past that.
[11:18.740 --> 11:20.220]  So, good safety tip.
[11:20.220 --> 11:27.060]  If you actually have to boot up and scan your system to get rid of a virus, boot up again and scan again.
[11:27.740 --> 11:29.740]  Verify that there's not a virus there again.
[11:31.100 --> 11:43.340]  Now, the second thing is, alright, on the second portion of the boot sector, there's the FAT partition info that holds all the MBR data and the partition information, the directory structure of the disk.
[11:44.340 --> 11:47.160]  Now, some viruses are, you know, real bitches.
[11:47.820 --> 11:53.620]  And they'll actually encrypt the FAT partition and directory structure of the hard drive.
[11:56.200 --> 12:01.940]  Requiring the virus to actually load to decrypt your directory structure.
[12:02.820 --> 12:07.240]  So, if you remove it incorrectly, everything's gone.
[12:07.640 --> 12:08.500]  It's all encrypted.
[12:09.420 --> 12:14.960]  My absolute favorite virus in the whole world is the monkey virus, which actually does this exact same thing.
[12:15.800 --> 12:18.560]  The monkey was a brilliant virus.
[12:20.140 --> 12:21.640]  It's just a real mean thing.
[12:21.880 --> 12:27.240]  Because on many of the boot sector viruses, to actually get rid of them requires a real simple command.
[12:28.440 --> 12:30.140]  FDISK slash MBR.
[12:31.420 --> 12:31.860]  Alright.
[12:32.180 --> 12:34.760]  How many people have actually used FDISK slash MBR?
[12:35.160 --> 12:36.660]  Oh, man, I love you guys.
[12:36.740 --> 12:37.320]  You guys rock.
[12:37.600 --> 12:40.940]  I've done this talk group going, Oh my God, what a great command.
[12:41.180 --> 12:42.120]  Never even heard of that.
[12:42.260 --> 12:44.460]  I'm going, pshh, alright, cool, whatever.
[12:45.080 --> 12:45.600]  You know.
[12:46.380 --> 12:48.760]  For those of you who haven't used it, I ain't capping on you.
[12:48.880 --> 12:49.140]  It's cool.
[12:50.340 --> 12:51.600]  FDISK slash MBR.
[12:52.320 --> 12:54.300]  You know, people are going, well, wait a minute, you're going to run FDISK?
[12:54.460 --> 12:54.620]  No.
[12:54.840 --> 12:55.820]  This is a cool little command.
[12:55.960 --> 12:59.260]  What it does, it says, I don't care what code's there.
[12:59.720 --> 13:01.180]  I don't care what it is.
[13:01.380 --> 13:02.980]  Just slap on brand new code.
[13:03.680 --> 13:06.440]  For most viruses, it's like, virus gone.
[13:07.780 --> 13:08.400]  End of story.
[13:08.600 --> 13:08.920]  Game over.
[13:09.040 --> 13:09.440]  Thanks for playing.
[13:12.260 --> 13:13.000]  I can't hear you.
[13:15.360 --> 13:15.800]  That's...
[13:15.800 --> 13:16.960]  Don't rush me.
[13:17.020 --> 13:19.020]  He's saying, it doesn't work with the monkey, you know, B virus.
[13:19.440 --> 13:20.060]  You're right.
[13:20.200 --> 13:20.700]  It doesn't.
[13:21.240 --> 13:22.060]  You know why?
[13:22.320 --> 13:25.420]  Because the monkey encrypts the fat partition information.
[13:25.820 --> 13:27.560]  Actually, that's not true.
[13:27.820 --> 13:28.440]  It does work.
[13:28.500 --> 13:29.220]  It works perfectly.
[13:29.440 --> 13:30.460]  It replaces the code.
[13:30.600 --> 13:33.160]  You just can't get anything back out of the drive.
[13:33.340 --> 13:36.420]  You might as well just type in FDISK and leave it to that.
[13:38.180 --> 13:42.780]  What the anti-virus companies did for monkey is they actually created something called a simulator.
[13:43.460 --> 13:45.400]  And now this was a really great idea.
[13:45.860 --> 13:51.480]  What it does is, the simulator runs and says, hey, I'm going to hit another drive.
[13:52.300 --> 13:55.900]  And it's going to initiate the duplication process of the virus.
[13:55.900 --> 13:59.720]  But it's going to run it into a quote unquote sandbox type situation.
[14:00.840 --> 14:04.020]  So what happens is, the monkey goes, hey, I'm going to replicate myself.
[14:04.200 --> 14:06.040]  And then it sits there and it watches the code.
[14:06.180 --> 14:07.960]  And it looks for the de-encrypt key.
[14:08.220 --> 14:18.120]  The moment it sees the de-encrypt key, it stops the process, uses the key to decrypt the partition information, and it gets rid of the virus.
[14:18.120 --> 14:20.880]  And I was like, that's cool.
[14:21.380 --> 14:22.640]  All right, who messed with the thing?
[14:25.160 --> 14:26.700]  All right, who's banging the box?
[14:29.440 --> 14:30.180]  All right.
[14:31.840 --> 14:32.380]  Damn them.
[14:33.080 --> 14:33.380]  All right.
[14:34.180 --> 14:39.740]  The types of boot sector viruses, we have stealth, polymorphic, and encrypting, or any combination of these.
[14:39.920 --> 14:44.900]  The boot sector virus can actually incorporate several, one, or all of these situations.
[14:44.900 --> 14:47.560]  These are the most popular combinations.
[14:51.310 --> 14:51.810]  All right.
[14:51.990 --> 14:53.070]  A stealth boot sector virus.
[14:53.210 --> 14:54.090]  I'm not going to read verbatim.
[14:54.930 --> 14:56.030]  Go ahead and read it if you want a bit.
[14:56.170 --> 14:59.450]  Basically what a stealth does, is it hides itself into upper memory blocks.
[15:00.350 --> 15:06.210]  This is why just having an anti-virus software on your system, doesn't necessarily mean that you're clean and cool.
[15:06.630 --> 15:10.650]  Because if it's a stealth virus, it hides itself in your anti-virus software.
[15:12.290 --> 15:21.130]  So, for those of you guys who've actually had a system running for several years, been doing your email stuff, borrowing discs from your friends, and then you're going, you know what, I should get an anti-virus software.
[15:21.230 --> 15:25.050]  And you put it on your system and you install it, and you don't see anything going, all right, cool, I'm clean.
[15:27.010 --> 15:27.690]  Not necessarily.
[15:28.970 --> 15:31.230]  I know, because this actually happened to me.
[15:33.630 --> 15:36.770]  I actually was butsing around my system.
[15:36.930 --> 15:39.450]  I had a system that I used to use for like experimenting and all that crap.
[15:40.490 --> 15:45.390]  And I said, all right, let's throw some anti-virus software on there, you know, because I'm actually starting to really use the system more.
[15:45.570 --> 15:47.690]  I was like, all right, cool, collected, no problem.
[15:47.690 --> 15:51.390]  And all of a sudden, one day, boom, I was like, what the hell is this?
[15:51.870 --> 15:56.850]  And I'm like, God, man, what's this like, you know, where's this, you know, a slut thing on my screen?
[15:56.970 --> 15:58.270]  Where'd this come from, you know?
[15:59.470 --> 16:01.910]  And I was like, well, all right, you know, let me boot up.
[16:02.030 --> 16:03.710]  And it's like, boom, god damn, I got a virus.
[16:03.930 --> 16:04.850]  Where the hell did that come from?
[16:05.470 --> 16:06.650]  And how come I didn't detect it?
[16:06.770 --> 16:08.310]  Well, because it was a stealth virus.
[16:10.190 --> 16:11.630]  It's actually, it's kind of funny.
[16:11.870 --> 16:20.690]  The two viruses I actually got hit with, although one of them didn't actually activate, I actually ended up with Michelangelo virus on my system years and years and years ago.
[16:22.030 --> 16:25.070]  And it's like, hey, look, it's the Michelangelo virus.
[16:25.130 --> 16:30.590]  I was actually looking at my boot sector, you know, and checking out the different sectors.
[16:31.390 --> 16:32.250]  Now, this is something you can do.
[16:33.050 --> 16:41.230]  Norton Utilities had this really great utility, I think they still do, where you can actually, you know, it's a drive editor, where you can actually look at all the different sectors of your boot sector.
[16:41.810 --> 16:51.430]  Well, the thing is, if you looked at your MBR, and you see the code and all that stuff information, and you start going through the different sectors, and you see that same code someplace else, there's a problem here.
[16:51.650 --> 16:53.970]  And that's how I discovered I had the Michelangelo virus.
[16:54.190 --> 16:55.590]  It's like, wait a minute.
[16:57.290 --> 16:58.250]  This is not right.
[16:58.890 --> 16:59.970]  This is very wrong.
[17:00.230 --> 17:02.730]  And I was like, all right, let's boot up and scan.
[17:02.830 --> 17:04.090]  Boom, hey, it's Michelangelo virus.
[17:04.390 --> 17:06.030]  Hey, I should keep this.
[17:06.590 --> 17:08.170]  Put it on a diskette and put it in a file.
[17:08.810 --> 17:14.130]  The second virus I actually got hit by... Anyone use Amigas in the old days?
[17:16.010 --> 17:16.850]  My brothers.
[17:17.010 --> 17:17.490]  You guys rock.
[17:18.070 --> 17:19.350]  A little note about Amigas.
[17:19.710 --> 17:23.850]  Back in the Amiga days, we had things that were like MP3s called mod files.
[17:24.050 --> 17:24.730]  They were better.
[17:24.890 --> 17:26.210]  They were written by people like us.
[17:26.710 --> 17:28.890]  And smaller than damn MP3s.
[17:28.890 --> 17:32.730]  But I actually got hit with a virus called the SCA virus.
[17:33.790 --> 17:36.710]  So they were working around on my Amigas, just, you know, butsing around.
[17:36.830 --> 17:37.770]  Woohoo, having fun.
[17:37.930 --> 17:40.950]  Hey, more mod files downloading shit all over the BBSs and stuff.
[17:41.570 --> 17:45.590]  And all of a sudden, the next thing you know is like, the screen starts flashing at me.
[17:45.670 --> 17:48.170]  I get this bar that says, something amazing has happened.
[17:48.290 --> 17:49.870]  I'm going, the hell is this?
[17:49.990 --> 17:51.430]  He goes, your computer's alive.
[17:51.430 --> 17:52.890]  I'm like, what the?
[17:53.190 --> 17:55.370]  He goes, and it's infected with a virus.
[17:55.570 --> 17:56.630]  And he's like, ah, shit.
[17:57.050 --> 17:58.330]  And I was like, yes, yay, boom.
[17:59.910 --> 18:01.090]  And the whole thing crashed.
[18:01.190 --> 18:02.630]  I was like, son of a man.
[18:03.370 --> 18:09.370]  And it was actually, I bought the disc from, you know, a virus software store which had a whole bunch of shareware discs.
[18:10.070 --> 18:10.850]  Bad idea.
[18:11.210 --> 18:11.690]  Bad idea.
[18:11.910 --> 18:14.670]  So I went back there and bought a shareware antivirus disc.
[18:17.410 --> 18:19.090]  I wasn't the smartest man back there.
[18:19.090 --> 18:20.830]  I was like, hey, I was a kid.
[18:21.070 --> 18:21.290]  What the hell?
[18:22.270 --> 18:22.790]  Alright.
[18:24.270 --> 18:25.130]  Polymorphic viruses.
[18:25.750 --> 18:27.070]  These are really cool.
[18:28.230 --> 18:32.830]  But the polymorphic viruses are, they change the code each time they replicate.
[18:33.350 --> 18:39.410]  And it makes it incredibly difficult for an antivirus software program to track them down.
[18:39.510 --> 18:45.150]  Because the way the antivirus programs work with their data files is they work on specific signatures, looking for specific things.
[18:45.430 --> 18:47.790]  So if you keep changing the code on them, it makes it hard.
[18:51.230 --> 18:53.690]  Once again, we're going back to the simulator thing here.
[18:53.970 --> 18:58.670]  Once it is actually detected because it only changes itself into so many different factors.
[18:59.230 --> 19:03.550]  Alright, so what they have to do is they have to take the whole string and actually put that into the data file.
[19:04.090 --> 19:08.430]  And once again, what they do is they take the simulator and they run the simulator to get rid of this.
[19:08.430 --> 19:14.110]  And they go through the whole code key process and then they remove the polymorphic viruses.
[19:14.930 --> 19:18.630]  Now, the polymorphic viruses that are also stealth just makes it even more difficult.
[19:20.390 --> 19:22.570]  Alright, encrypting boot sector viruses.
[19:22.930 --> 19:27.390]  The encrypting viruses will encrypt data or themselves, making it more difficult to remove.
[19:27.690 --> 19:35.450]  They also make it impossible to recover data without the virus to be in effect to receive your data.
[19:35.450 --> 19:38.890]  You know, like the monkey virus, which is the boot sector faction.
[19:41.470 --> 19:45.070]  Now, see, when I say it's impossible, that's not necessarily true.
[19:45.130 --> 19:46.910]  You can actually get your data back.
[19:47.810 --> 19:50.050]  It's just a major pain in the butt.
[19:50.370 --> 19:54.970]  And I would pretty much say that about 90% of the population has absolutely no clue on how to do this.
[19:56.010 --> 20:01.650]  So the virus writers really look forward to this and say, no, alright, I'm going to write something that's really nasty and I'll throw it out there.
[20:02.990 --> 20:08.050]  I wasn't actually going to start this talk off because sometimes what I usually do is...
[20:08.050 --> 20:13.170]  And please, honestly, do not raise your hand when I state these statements here, okay?
[20:14.290 --> 20:17.530]  Because I got to tell you, this is actually my first trip to New York.
[20:17.810 --> 20:19.350]  And this place fucking rocks.
[20:19.670 --> 20:20.870]  I love this place.
[20:20.870 --> 20:24.630]  This is now, next to Las Vegas, this is my favorite place to come.
[20:24.790 --> 20:25.970]  I'm going to come back more and more.
[20:26.130 --> 20:27.250]  This is such a great place.
[20:30.010 --> 20:33.410]  I've gotten less sleep here than any place else, including Las Vegas, man.
[20:33.590 --> 20:35.910]  This is like, man, this place has a pulse from hell.
[20:36.050 --> 20:36.570]  This is so cool.
[20:36.890 --> 20:38.110]  So I didn't want to do this to you guys.
[20:38.210 --> 20:40.550]  What I normally do is I sit there and say, hey, how are you guys going?
[20:40.650 --> 20:41.470]  Hey, I'm Rob Lupo.
[20:41.550 --> 20:42.010]  Yeah, yeah, yeah, yeah.
[20:42.190 --> 20:45.930]  I say, just out of curiosity, has anyone out there ever written viruses?
[20:45.990 --> 20:47.990]  Don't raise your hand, guys, because I like you guys.
[20:47.990 --> 20:51.890]  And I would always get a couple of people raising their hand like the guy right back there.
[20:53.270 --> 21:00.150]  And then I say, okay, now how many federal officers in the audience are now keeping track of the people who just raised their hand?
[21:00.650 --> 21:03.010]  And then I get like a couple of hands like, ha, ha, ha.
[21:03.210 --> 21:07.270]  And I go, hey, now how many hackers are keeping note of who the federal officers are?
[21:10.790 --> 21:16.250]  But I don't want to bust any virus writers because I've already talked to lots of you guys at this conference.
[21:16.410 --> 21:18.390]  And you guys are like, oh, yeah, I wrote a couple of viruses.
[21:18.410 --> 21:21.110]  And I said, man, you guys are just far too cool.
[21:22.210 --> 21:22.510]  All right.
[21:23.870 --> 21:24.350]  Next one.
[21:27.760 --> 21:29.740]  All right, we're going to talk about file infectors here.
[21:31.060 --> 21:35.860]  Now, the file infector virus will attach the code to the beginning and end of the executable file.
[21:38.660 --> 21:42.680]  Now, you really don't see a lot of quote-unquote file infectors anymore.
[21:43.000 --> 21:44.360]  Not as much as there used to be.
[21:44.740 --> 21:49.020]  It used to be that bootstackers accounted for over 80% of the viruses out in the wild.
[21:49.500 --> 21:51.040]  And that's not immature anymore.
[21:52.360 --> 21:53.760]  But you still do see these.
[21:53.860 --> 21:55.860]  So it's important to actually understand how they work.
[22:01.230 --> 22:01.710]  Okay.
[22:02.290 --> 22:02.690]  All right.
[22:04.770 --> 22:16.590]  What happens is the very beginning of the code that the virus infects on the file, will actually tell the execution to go to the very, very end to the beginning of the virus code.
[22:16.770 --> 22:18.070]  The virus code will load into memory.
[22:18.210 --> 22:20.930]  Then the end of the file will actually point to the true file.
[22:21.770 --> 22:24.550]  Filing infectors are very, very easy to keep track of.
[22:24.770 --> 22:30.390]  If you start noticing that your file starts growing in size and it's an executable, there's obviously something wrong.
[22:30.810 --> 22:39.470]  What we used to do is we used to do things called a binary compare on specific important files or executables and directories that we used all the time.
[22:40.310 --> 22:45.370]  And every once in a while I just run this and if there's any difference in the two files, then I knew something was wrong.
[22:47.790 --> 22:48.510]  All right.
[22:49.130 --> 22:50.790]  These are definitely one of my favorites.
[22:50.970 --> 22:52.190]  They're called multipartite viruses.
[22:52.510 --> 22:53.250]  These were so cool.
[22:53.670 --> 22:57.590]  Not only do they infect boot sector viruses, but they infect files also.
[22:57.830 --> 23:01.130]  It makes the replication of this virus really, really easy.
[23:01.970 --> 23:06.050]  The multipartite virus will infect both the boot sector and files.
[23:06.050 --> 23:13.910]  The problem increases the spreading capabilities of the virus by disk, email, or any other way to move a file.
[23:14.650 --> 23:19.370]  Back in the days of Sneakernet, when everybody was moving floppy disks, these things were just rampant.
[23:19.510 --> 23:21.370]  Because everybody had a diskette in their drive.
[23:21.390 --> 23:24.090]  The moment you executed the code, it infected your drive.
[23:25.070 --> 23:34.110]  Also, for boot sector viruses, the way it was easy enough to actually infect a diskette was all you had to do is put a diskette in the drive and do DIR A colon.
[23:34.110 --> 23:34.710]  Boom!
[23:34.930 --> 23:35.470]  The drive's infected.
[23:36.390 --> 23:37.490]  And you can actually...
[23:37.990 --> 23:38.350]  Now...
[23:38.350 --> 23:40.550]  Has anyone actually purposely infected a floppy disk?
[23:40.730 --> 23:41.390]  Go ahead and raise your hands.
[23:41.570 --> 23:42.170]  This is...
[23:42.170 --> 23:42.390]  Okay.
[23:42.830 --> 23:50.850]  Now, for those two people who just raised their hands, have you noticed that when you actually put a diskette in the drive A and you do a directory to drive A, it goes...
[23:51.410 --> 23:52.330]  And it runs up.
[23:52.470 --> 23:53.930]  And you're like, okay, cool, and then you get your directory.
[23:54.710 --> 24:01.290]  Now, if you have a virus loaded in memory and you put a diskette in the drive, you go, directory A colon, it goes...
[24:01.850 --> 24:03.030]  And you're going, oh!
[24:03.030 --> 24:04.310]  Totally different sound.
[24:04.690 --> 24:06.430]  It's just like, hash, bam, bam, bam, bam.
[24:06.630 --> 24:07.890]  Forces the boot sector on you.
[24:16.330 --> 24:18.270]  I've actually not run across a virus.
[24:18.390 --> 24:21.930]  Has anyone actually run across a virus that actually periodically checks for a disk in the drive?
[24:22.470 --> 24:22.770]  Anybody?
[24:23.270 --> 24:24.810]  I don't think I've ever heard of one.
[24:24.990 --> 24:26.690]  And the reason why is it would be too obvious.
[24:27.450 --> 24:31.790]  You know, if you put a disk in the drive and you're not doing anything, all of a sudden your drive starts running and you go, what the hell is that?
[24:31.790 --> 24:34.710]  You know, so I don't know of actually anyone.
[24:34.910 --> 24:37.550]  And if someone actually finds one, unless we know, that would rock.
[24:38.490 --> 24:38.570]  What?
[24:38.890 --> 24:39.250]  Windows.
[24:41.010 --> 24:42.390]  The biggest virus ever written.
[24:46.090 --> 24:46.950]  Okay, you're cool.
[24:47.070 --> 24:47.450]  I like you.
[24:49.510 --> 24:51.810]  I actually almost had a virus named after me.
[24:53.110 --> 24:54.410]  No, it wasn't named a virus.
[24:55.210 --> 24:58.810]  What happened was I was doing some research on computer viruses for a corporation.
[24:58.810 --> 25:01.450]  That was an antivirus corporation.
[25:02.290 --> 25:07.710]  And we thought we had found, believe it or not, a new strain of the New York boot virus.
[25:08.070 --> 25:09.050]  How ironic.
[25:10.550 --> 25:19.190]  What it was was that the virus itself actually geeked itself because viruses are written to infect specific diskettes.
[25:19.810 --> 25:25.590]  And this was the version of the New York boot that we were actually checking and decompiling.
[25:26.530 --> 25:31.050]  It was actually written for 360k disks and 720k disks.
[25:31.350 --> 25:32.990]  Does anybody even remember those diskettes?
[25:33.990 --> 25:34.350]  Yeah.
[25:34.790 --> 25:34.890]  See?
[25:35.250 --> 25:37.310]  Everybody else is like, they make them that small.
[25:37.310 --> 25:38.210]  Yeah.
[25:39.330 --> 25:45.410]  And what happened was that someone actually took a 360k disk and formatted it for a 1.2.
[25:45.990 --> 25:48.590]  Forced to formatted it for a 1.2.
[25:49.270 --> 25:52.270]  Which really screwed up the boot sector of the diskette.
[25:52.450 --> 25:52.930]  It worked.
[25:53.250 --> 25:54.430]  The diskette worked.
[25:54.930 --> 25:56.890]  But the disk was not designed for that.
[25:57.130 --> 25:59.090]  And so it keep the boot sector of it.
[25:59.730 --> 26:04.170]  And so what happens is, this disk was purposely infected with the New York boot to study it.
[26:04.850 --> 26:09.190]  Well, the virus got really confused and actually put it to different sectors that we had never seen before.
[26:10.170 --> 26:13.250]  So they're like, hey, you guys found, you know, I was working with this guy named John.
[26:13.350 --> 26:16.010]  He goes, you guys found a new, you know, version of the New York boot.
[26:16.090 --> 26:19.610]  So we're going to name it New York JR for John and Rob.
[26:19.970 --> 26:20.950]  And I was like, all right.
[26:21.570 --> 26:22.690]  And then we found out what it was.
[26:22.770 --> 26:23.510]  And they said, oh, never mind.
[26:23.610 --> 26:24.050]  We're not going to do that.
[26:24.050 --> 26:26.170]  And I went, oh, man, come on.
[26:26.370 --> 26:27.470]  It still counts, doesn't it?
[26:28.970 --> 26:29.490]  Nope.
[26:30.410 --> 26:31.310]  All right, macro viruses.
[26:31.690 --> 26:34.050]  Has anyone actually been hit by a macro virus?
[26:34.230 --> 26:34.530]  Raise your hand.
[26:35.570 --> 26:37.070]  It's nothing to be ashamed of.
[26:37.270 --> 26:39.230]  Everybody gets hit by a virus from time to time.
[26:39.670 --> 26:40.870]  Okay, macro viruses.
[26:42.450 --> 26:59.050]  The problem I have with today's operating systems, without naming specific names, is, you know, this quote-unquote fill-in-the-blank operating system is, they made it too easy for people to, excuse me, frankness here, why?
[26:59.270 --> 27:01.170]  Yeah, like I'm going to shock anybody after the CDC.
[27:02.050 --> 27:05.290]  It's like, it's too easy to fuck with your system, guys.
[27:05.550 --> 27:06.890]  It's just too easy.
[27:07.650 --> 27:08.230]  All right?
[27:08.410 --> 27:09.890]  They opened everything up.
[27:10.430 --> 27:16.330]  You know, it's like, hey, let's make it really cool with these Excel spreadsheets and, you know, and these other things here.
[27:16.490 --> 27:19.570]  And Word will let you create your own macros to make it easier.
[27:19.750 --> 27:21.950]  It's like, people sat there like, hey, you know what?
[27:22.230 --> 27:24.670]  This is a little operating, you know, this is a little programming language here.
[27:25.190 --> 27:25.870]  Gee, I wonder.
[27:26.330 --> 27:27.350]  Yeah, look at that.
[27:27.830 --> 27:28.470]  Look at that.
[27:29.330 --> 27:30.950]  Hey, yeah.
[27:32.750 --> 27:33.310]  Who's your daddy?
[27:34.810 --> 27:39.110]  It's like, Jesus Christ, man.
[27:39.250 --> 27:42.070]  It's like, first you get, like, the rainbow, you know, macro virus.
[27:42.070 --> 27:44.570]  Anybody get touched by the rainbow macro virus?
[27:45.070 --> 27:46.870]  Yeah, it was really no big deal.
[27:47.010 --> 27:48.550]  It's like, someone was like, hey, I wonder if this worked.
[27:48.930 --> 27:49.890]  Yeah, right, it worked.
[27:50.470 --> 27:54.530]  And the next thing you know, it's just, you know, let's open the floodgates, all right.
[27:55.310 --> 27:56.470]  Whoosh, macro viruses.
[27:56.710 --> 27:58.830]  And you're like going, Jesus Christ, people.
[27:59.390 --> 27:59.790]  Question.
[28:03.960 --> 28:04.360]  What?
[28:04.600 --> 28:05.260]  Cross-platform?
[28:07.380 --> 28:08.180]  Well, sorta.
[28:08.980 --> 28:16.300]  Cross-platform would actually indicate that the same operating system, or not the same operating, but the same application has to be on things.
[28:16.580 --> 28:20.360]  So, you can go from PC to Mac with the same application, sorta.
[28:21.140 --> 28:21.660]  You know, it depends.
[28:21.760 --> 28:23.380]  Some of the earlier ones, yes.
[28:25.400 --> 28:26.680]  Some of the earlier ones, yes.
[28:27.020 --> 28:29.360]  Some of the more complicated ones, no.
[28:30.960 --> 28:37.240]  Like, some of the macro viruses will actually make specific calls that are only available into a specific operating system.
[28:38.340 --> 28:40.080]  And those don't exist on Macs.
[28:41.100 --> 28:45.220]  Can anyone tell me why there's aren't a whole slew of Mac viruses?
[28:46.360 --> 28:48.900]  Yeah, the guy in the red shirt is answering all the damn questions.
[28:50.400 --> 28:51.440]  Too hard to program.
[28:52.180 --> 28:52.360]  Yeah.
[28:52.780 --> 28:53.120]  And?
[28:54.040 --> 28:55.780]  That's part of the answer.
[28:57.580 --> 28:58.100]  What?
[28:58.100 --> 28:59.660]  There's only four known Mac viruses.
[28:59.660 --> 29:01.380]  There's only four known Mac viruses.
[29:01.600 --> 29:02.080]  But why?
[29:05.550 --> 29:06.050]  No.
[29:06.690 --> 29:07.930]  I would argue that.
[29:08.130 --> 29:08.950]  That's a different discussion.
[29:09.130 --> 29:12.290]  We'll sit down and we'll figure out why I think Macs blow.
[29:12.750 --> 29:14.310]  Steve Jobs wrote all the four viruses.
[29:14.590 --> 29:16.670]  Yeah, Steve Jobs wrote all the four viruses.
[29:16.910 --> 29:16.950]  No.
[29:17.730 --> 29:22.810]  Basically, in a nutshell, it's because it's not the most popular PC in the market.
[29:23.330 --> 29:23.810]  Okay?
[29:24.210 --> 29:26.570]  For every one Mac, there's 20 PCs.
[29:27.110 --> 29:30.130]  So virus writers are going to write for the A quote-unquote.
[29:30.250 --> 29:31.230]  Now listen very carefully.
[29:31.430 --> 29:39.250]  If you get anything on this talk, think about this very, very carefully before you sit there and say, I want Linux to be the operating system of choice for everybody in the whole world.
[29:39.390 --> 29:40.850]  Which would be really, really cool.
[29:41.030 --> 29:50.250]  But the reason why there's thousands and thousands of viruses out there for Windows platforms is because it's the most popular damn operating system in the world.
[29:51.530 --> 29:58.750]  So a virus writer is going to write for the most popular application and the most popular operating system.
[29:58.970 --> 29:59.290]  Why?
[29:59.610 --> 30:01.170]  Because of the rule of the viruses.
[30:01.370 --> 30:02.710]  They have to replicate.
[30:03.670 --> 30:05.270]  If they don't replicate, they're useless.
[30:06.110 --> 30:15.010]  So the moment Linux becomes, or FreeBSD becomes the operating system on everybody's desktop, you're going to see a slew of viruses out there.
[30:15.010 --> 30:17.710]  Except for it's Unix.
[30:18.270 --> 30:19.710]  Which is a different story.
[30:19.930 --> 30:22.550]  Because in Unix, everything is a file.
[30:22.990 --> 30:23.250]  Correct?
[30:23.730 --> 30:24.090]  Yes?
[30:26.090 --> 30:30.330]  But inherently in Unix, it's not inherently executable.
[30:32.270 --> 30:37.390]  So maybe it's a good idea to go towards Linux and the Unix operating system.
[30:37.490 --> 30:38.890]  Because it's much more difficult.
[30:38.890 --> 30:43.490]  Who can tell me, aside from the guy in the red shirt, how many Unix viruses are known out in the wild?
[30:47.990 --> 30:48.450]  Two.
[30:48.610 --> 30:49.970]  Two real Unix viruses.
[30:51.490 --> 30:52.510]  Would you agree with that?
[30:53.310 --> 30:53.390]  Yes.
[30:54.250 --> 30:54.710]  Marble.
[30:55.230 --> 30:55.690]  Huh?
[30:58.210 --> 30:58.670]  What?
[31:00.330 --> 31:00.790]  Yeah.
[31:00.790 --> 31:02.430]  One that AT&T made yet.
[31:02.970 --> 31:05.530]  There's very, very, very few Unix viruses.
[31:05.790 --> 31:06.690]  Oh, thank you for the lights.
[31:07.530 --> 31:12.350]  And the reason for that is, Unix is very difficult to actually write viruses for.
[31:13.650 --> 31:24.170]  But, with today's technology, with the people out there who have the better programming skills, the fact that they make the kernel open to everybody, which is like...
[31:24.170 --> 31:25.390]  I mean, it's a double-edged sword, people.
[31:25.450 --> 31:26.530]  You've got to think of it this way.
[31:27.350 --> 31:38.290]  If the kernel is open source, and everybody knows, you know, everything about the ins and outs of the kernel, that's awesome for us, you know, who are trying to customize our boxes and play with it and get the knowledge.
[31:38.790 --> 31:41.770]  But it's also awesome for the people who are trying to destruct your box.
[31:42.530 --> 31:44.090]  You know, so these are things to think about.
[31:44.830 --> 31:47.270]  So let's move on from macro viruses, because I hate them.
[31:48.190 --> 31:50.650]  All right, we're going to talk about fakes and false alarms.
[31:51.850 --> 31:52.050]  All right.
[31:53.110 --> 31:58.910]  Okay, who here, raise a hand, did not get a letter warning you about the good times?
[32:00.750 --> 32:05.210]  Ooh, maybe two, three people did not get a letter warning you about the good times virus.
[32:05.890 --> 32:07.410]  Now, here's the cool thing here.
[32:07.590 --> 32:08.310]  It was harmless.
[32:08.490 --> 32:09.230]  It was a fake.
[32:09.410 --> 32:10.230]  But you know what?
[32:10.530 --> 32:11.830]  You still got hit with the virus.
[32:12.210 --> 32:12.590]  Why?
[32:12.770 --> 32:15.670]  Because that stupid damn email replicated itself all over the world.
[32:16.170 --> 32:17.110]  Chewed up bandwidth.
[32:18.070 --> 32:20.070]  In my opinion, it was still a virus.
[32:22.190 --> 32:23.370]  Fakes and false alarms.
[32:23.630 --> 32:31.630]  If you get a notification, a good clear sign that it could be a fake or false alarm says, read this immediately with huge explanation points.
[32:31.850 --> 32:34.330]  Like, come on, quickly, read this.
[32:34.550 --> 32:37.510]  And anything that tells you that if you get this letter, delete it immediately.
[32:37.650 --> 32:40.130]  Because if you open it and read it, it's going to destroy your hard drive.
[32:40.950 --> 32:43.010]  You know, you need to go look it up.
[32:43.150 --> 32:44.870]  Go to Network Associates.
[32:44.910 --> 32:45.530]  Go to Norton.
[32:45.770 --> 32:46.690]  Go to Trent Micro.
[32:46.930 --> 32:47.850]  Go to Fprod.
[32:47.850 --> 32:49.830]  They have great lists.
[32:50.270 --> 32:51.730]  Absolutely fantastic lists.
[32:51.910 --> 32:53.410]  Telling you about fakes and frauds.
[32:53.490 --> 32:55.790]  And what is actually active in the wild right now.
[32:57.850 --> 32:58.230]  Okay.
[32:58.590 --> 32:59.950]  We're not actually going to go to the conclusion here.
[33:00.030 --> 33:01.650]  We're going to talk about VBS scripts.
[33:03.070 --> 33:03.390]  Alright.
[33:03.470 --> 33:03.970]  Show of hands.
[33:04.150 --> 33:06.230]  Who here actually got hit by the I Love You virus?
[33:08.530 --> 33:08.930]  Okay.
[33:09.690 --> 33:12.990]  Who here worked at a company that actually got hit by the I Love You virus?
[33:13.410 --> 33:14.190]  Oh, yeah.
[33:14.890 --> 33:14.990]  Yeah.
[33:15.290 --> 33:16.610]  Saying, now you know who your daddy is.
[33:16.830 --> 33:17.010]  Yeah.
[33:18.110 --> 33:18.510]  Okay.
[33:21.170 --> 33:23.050]  This was an interesting situation.
[33:24.710 --> 33:27.730]  Once again, we're stuck with an operating system that gives you all kinds of freedom.
[33:30.650 --> 33:32.990]  Now people are sitting there going, hey, let's make VBS scripts.
[33:33.230 --> 33:36.510]  The problem we have right now is lights, turn them off.
[33:37.850 --> 33:38.510]  Thank you.
[33:39.530 --> 33:39.810]  Alright.
[33:39.810 --> 33:44.810]  The problem we have now, people, is that anybody can write a virus.
[33:45.090 --> 33:47.550]  This is not old school people anymore writing this stuff.
[33:47.810 --> 33:50.630]  They've moved on to better things like six-figure salaries and shit.
[33:51.270 --> 33:51.390]  Okay.
[33:52.330 --> 33:55.490]  Now we have 15-year-olds are going, hey, I know BASIC.
[33:55.850 --> 33:56.830]  Hey, it's VBS.
[33:57.270 --> 34:00.070]  Hey, I'll just do something like totally fuck with someone's system.
[34:00.310 --> 34:02.830]  And then somebody will get a hold of that code and say, hey, you know what?
[34:02.890 --> 34:04.010]  You didn't know how to make these calls.
[34:04.150 --> 34:05.130]  I'll just modify a little bit.
[34:05.270 --> 34:09.790]  And the next thing you know, you're creating these little VBS scripts that you attach to email.
[34:09.790 --> 34:11.030]  It's like, hey, check this out.
[34:11.670 --> 34:11.830]  You know?
[34:12.950 --> 34:14.810]  It's like, hey, this is better than elf bullying.
[34:15.030 --> 34:15.790]  Come on, try this.
[34:15.950 --> 34:16.770]  And I was like, ah, shit.
[34:16.910 --> 34:18.490]  And the next thing you know, it's geeking people's systems.
[34:21.770 --> 34:23.110]  If you've done this, stop.
[34:24.810 --> 34:25.230]  You know?
[34:25.390 --> 34:26.690]  You're not impressing anybody.
[34:26.690 --> 34:27.590]  You know?
[34:27.730 --> 34:30.270]  My opinion of virus writers is your shit.
[34:31.570 --> 34:31.990]  Okay?
[34:32.150 --> 34:35.190]  That's not going to make me real popular with some of the people in this room here.
[34:36.030 --> 34:37.430]  You're not helping anybody.
[34:37.430 --> 34:38.830]  You're not helping a cause.
[34:39.050 --> 34:40.530]  You're not impressing anybody.
[34:40.530 --> 34:42.450]  All you're doing is pissing people off.
[34:43.030 --> 34:43.390]  Stop.
[34:44.690 --> 34:45.870]  Just fucking stop.
[34:46.870 --> 34:47.830]  It's not going to make a difference.
[34:48.270 --> 34:48.990]  They're still going to do it.
[34:49.530 --> 34:50.750]  They're still going to do it.
[34:51.230 --> 34:55.370]  Because the only people you're going to impress is the script kitty sitting next to you going, Oh, dude, you're a hacker elite.
[34:55.550 --> 34:55.690]  Woo.
[34:56.610 --> 34:57.330]  It's like...
[34:57.330 --> 34:59.610]  Larissa is going, you fucking suck.
[34:59.710 --> 34:59.890]  Okay?
[35:00.510 --> 35:01.230]  You just do.
[35:02.070 --> 35:02.590]  All right?
[35:03.370 --> 35:08.790]  Also, keep in mind that when you deface someone's web page, you're not doing a lot of harm to that.
[35:08.830 --> 35:13.590]  Because if anyone has a clue or knows anything about web development, you actually keep a backup of your page.
[35:13.690 --> 35:15.330]  Someone defaces the front page, whoopee.
[35:15.430 --> 35:15.650]  Boom.
[35:15.830 --> 35:17.190]  Five minutes later, you have the front up there.
[35:17.450 --> 35:18.470]  Lock it down a little bit.
[35:18.570 --> 35:18.710]  Boom.
[35:18.770 --> 35:19.310]  You're up and running.
[35:19.510 --> 35:20.610]  You create a virus.
[35:20.750 --> 35:23.570]  You're actually causing monumental harm to people's systems.
[35:24.450 --> 35:24.810]  Okay?
[35:25.010 --> 35:26.670]  You're costing people money.
[35:26.990 --> 35:31.030]  You can actually be charged for the hourly rate that people are not able to work.
[35:31.690 --> 35:33.450]  You start creating large viruses.
[35:33.690 --> 35:34.850]  That's going to get expensive.
[35:35.210 --> 35:37.130]  You're going to do real time.
[35:37.970 --> 35:38.770]  Real time.
[35:39.790 --> 35:40.190]  Okay?
[35:40.590 --> 35:42.890]  With some guy named Bubba, who says, I'll take a condom.
[35:45.790 --> 35:46.990]  This is not fun.
[35:48.010 --> 35:48.510]  All right?
[35:48.570 --> 35:49.850]  You're not going to impress anybody.
[35:50.290 --> 35:54.770]  Unless you're a cute little kid with the guy behind you going, say, you're looking fine in those jeans.
[35:56.290 --> 35:56.630]  All right?
[35:56.870 --> 35:58.390]  Damn, you got a pretty mouth.
[35:58.730 --> 36:00.470]  This is not where you want to be, guys.
[36:00.470 --> 36:03.630]  If you're smart, start using it for something more productive.
[36:04.690 --> 36:04.890]  Great.
[36:05.130 --> 36:06.010]  Look at exploits.
[36:06.530 --> 36:07.090]  You know?
[36:07.790 --> 36:12.610]  Speaking of exploits, let's talk about BO2K and the CDC.
[36:13.710 --> 36:14.950]  Anybody here from the CDC?
[36:16.470 --> 36:17.210]  Too bad.
[36:17.430 --> 36:17.810]  Too bad.
[36:18.810 --> 36:20.370]  Because I'm going to surprise you here.
[36:20.370 --> 36:22.750]  I think the people from the CDC are fucking heroes.
[36:23.130 --> 36:23.610]  Okay?
[36:24.150 --> 36:25.170]  They fucking rock.
[36:26.170 --> 36:27.090]  Go ahead and applaud.
[36:30.810 --> 36:31.370]  Okay?
[36:32.670 --> 36:34.970]  Bat orifice, in my opinion, is not a virus.
[36:36.570 --> 36:39.930]  It's a wake-up call to the exploits of an operating system.
[36:40.230 --> 36:40.690]  Okay?
[36:41.390 --> 36:44.490]  We're going to release it, and you better fix it.
[36:45.430 --> 36:45.930]  All right?
[36:46.230 --> 36:47.270]  I know people of the CDC.
[36:47.570 --> 36:48.270]  I hang out with them.
[36:48.390 --> 36:49.850]  I mean, they're very, very cool people.
[36:50.110 --> 36:52.950]  They're also some of the most brilliant individuals I've ever met in my life.
[36:53.190 --> 36:57.590]  I hang out with Death Veggie, DilDog, Kingpin, Pond.
[36:57.770 --> 36:58.990]  These guys are brilliant.
[36:59.210 --> 37:00.590]  Absolutely brilliant individuals.
[37:01.110 --> 37:03.810]  I mean, I totally, totally take my hat off to these guys.
[37:04.290 --> 37:04.410]  Okay?
[37:05.270 --> 37:09.430]  Just, man, just fucking put a picture up, light a candle, fan down a couple times.
[37:09.510 --> 37:09.810]  You're cool.
[37:10.450 --> 37:11.350]  These guys are great.
[37:12.510 --> 37:13.270]  Writing exploits?
[37:13.410 --> 37:14.230]  Not a problem.
[37:14.550 --> 37:15.970]  If you can do it, do it.
[37:16.350 --> 37:18.370]  Force people to make the systems more secure.
[37:18.670 --> 37:19.230]  Do it.
[37:20.190 --> 37:22.430]  But don't do it, like, in a way...
[37:22.430 --> 37:25.410]  I mean, see, back-up is just to replicate itself through everybody's system.
[37:25.570 --> 37:25.710]  Right?
[37:26.290 --> 37:28.670]  It's like, if you download it and you use it, you've done it.
[37:29.810 --> 37:32.730]  I've actually used it as an administration tool, like they claim.
[37:33.250 --> 37:34.290]  I've actually done that.
[37:34.430 --> 37:38.290]  And I was like, well, you know, sure to hell, it beats the hell out of PC anywhere.
[37:40.030 --> 37:41.230]  And it's faster, too.
[37:46.750 --> 37:50.390]  And on top of that, I can actually see them on their webcam going, eh, that's not working.
[37:53.190 --> 38:01.550]  But the problem we have now is that we have made it too easy for people to corrupt and destroy your systems.
[38:03.370 --> 38:08.010]  I'm going to give you my view of the future right now of computer viruses.
[38:09.190 --> 38:14.010]  At this point right now, dealing with the I love you viruses and the different variants and the different viruses are out there.
[38:14.090 --> 38:22.890]  And the fact that 600, up to 600 brand new viruses are showing up every month, we are only seeing the tip of the iceberg right now, guys.
[38:23.450 --> 38:26.590]  You really need to educate yourself on protecting your system.
[38:27.050 --> 38:29.150]  I mean, really, really need to educate it.
[38:29.350 --> 38:36.610]  Because everybody in the world right now who works with a computer is staring right into this monster huge fan.
[38:36.610 --> 38:40.050]  And there's a truckload of shit standing right over it, just tipping over.
[38:42.010 --> 38:46.190]  And if you think I'm joking, just wait and watch.
[38:47.010 --> 38:52.210]  Because it's only a matter of time before you're going to start losing everything on your systems.
[38:52.470 --> 38:54.430]  And there's really going to be no way to stop it.
[38:55.610 --> 39:00.610]  Know your system, know how it works, and inform other people.
[39:00.970 --> 39:01.450]  Thanks.
[39:09.580 --> 39:11.040]  Alright, let's go ahead and ask some questions.
[39:17.440 --> 39:24.600]  Alright, the question here is if I can actually pick one anti-virus application for WinIntel platform, what would I pick?
[39:27.000 --> 39:30.740]  Okay, I am not endorsed by any anti-virus software companies.
[39:30.940 --> 39:32.060]  I'm going to point that out right now.
[39:32.260 --> 39:34.780]  I'm not paid, I don't get any royalties, period.
[39:35.760 --> 39:38.720]  I would recommend two things for your systems.
[39:40.180 --> 39:42.320]  I'm actually a big fan of F-Prod.
[39:44.500 --> 39:47.480]  I know F-Prod has problems and it geeks every once in a while.
[39:47.740 --> 40:00.300]  But the reason why I'm a big fan of F-Prod is that unlike every other anti-virus product out there that uses one scanning engine over a DAT file, F-Prod uses three different scanning engines to detect viruses and look for hostile code.
[40:00.780 --> 40:02.640]  Okay, that gives you two more chances, guys.
[40:03.540 --> 40:19.020]  The second application that I would choose to go in conjunction, not instead, but in conjunction with your anti-virus software, regardless of what it is, is Fingan's Serpent Shield product.
[40:20.060 --> 40:24.380]  Now, it's a really, really cool product and they impressed me when I was at the RSA conference.
[40:25.240 --> 40:33.160]  Basically, what it does is, any time you execute any code, it runs it in its own little, like, DMZ sandbox.
[40:34.240 --> 40:39.100]  And it looks for hostile code, registry hits, kernel hits, whatever.
[40:39.600 --> 40:43.280]  And then what it does is, boom, hey, this is trying to be hostile to the system.
[40:43.400 --> 40:44.220]  I'm going to kill it right away.
[40:44.760 --> 40:46.140]  It's a backup software.
[40:46.300 --> 40:47.460]  It's not used instead.
[40:47.720 --> 40:48.740]  It's used in conjunction.
[40:49.640 --> 40:57.860]  When the iluvuvirus hit, Fingan software, when set up correctly, was the only thing that was actually protecting some systems.
[40:58.200 --> 41:03.560]  Because the anti-virus software company still needs time to actually develop the DAT files to help protect your system.
[41:04.240 --> 41:08.360]  Fingan said, I'm sorry, we're not just going to be taking any initial basic scripts right now.
[41:08.520 --> 41:11.300]  It protects against ActiveX and JavaScript, too.
[41:11.480 --> 41:12.420]  It's a great little product.
[41:13.700 --> 41:26.320]  Also, the thing I liked about F-PROD was, two hours after the iluvuvirus hit the United States, F-PROD had a tested fix for it and actually traced it back to country of origin.
[41:27.360 --> 41:28.240]  That's impressive.
[41:31.160 --> 41:32.200]  AVP is pretty good.
[41:32.520 --> 41:33.160]  It's not bad.
[41:34.080 --> 41:38.940]  There's a publication that's from the UK called the Virus Bulletin Board.
[41:39.040 --> 41:40.380]  Anyone read it or seen it?
[41:40.980 --> 41:41.460]  Okay.
[41:42.380 --> 41:42.760]  Read it.
[41:43.500 --> 41:44.420]  Get into it.
[41:44.580 --> 41:46.280]  It's expensive.
[41:46.700 --> 41:47.600]  Go to the website.
[41:47.980 --> 41:49.720]  Do a thing on Virus Bulletin Board.
[41:50.200 --> 41:50.900]  Virus Bulletin.
[41:51.400 --> 41:52.360]  Get a subscription.
[41:52.660 --> 41:53.880]  Like I said, it's expensive.
[41:54.220 --> 41:58.560]  But as soon as I get in the mailman, I lock myself in my office.
[41:58.560 --> 41:59.880]  I just read it cover to cover.
[42:00.100 --> 42:01.780]  It's got a lot of great information.
[42:01.780 --> 42:05.240]  There's a couple of people on the board of directors that I don't particularly like.
[42:05.620 --> 42:09.360]  And one of them is this person who actually speaks at these conventions.
[42:09.740 --> 42:13.060]  And I just think she's a snob and we won't mention any names.
[42:15.000 --> 42:16.500]  The zine is very, very good.
[42:16.640 --> 42:17.500]  It's a very, very good thing.
[42:17.700 --> 42:19.560]  Just go to the websites and start reading about it.
[42:20.420 --> 42:21.320]  AVP is good.
[42:22.080 --> 42:23.560]  Actually, it's interesting.
[42:23.720 --> 42:29.060]  Norton on the last one just got the 100% award from them.
[42:29.300 --> 42:32.280]  Although they pointed out as like, okay, you know, this was a fluke.
[42:32.480 --> 42:33.240]  But, you know.
[42:34.180 --> 42:36.520]  I mean, even Norton, if you update the DAP files.
[42:36.860 --> 42:39.060]  Okay, I'm going to tell you guys right now your biggest mistake.
[42:39.360 --> 42:42.260]  That I'd say about 90% of you guys do right now.
[42:42.560 --> 42:46.520]  Is you'll put an anti-virus product on your system and you'll never update the DAP file.
[42:46.680 --> 42:48.360]  Or you'll do it once every other month.
[42:48.520 --> 42:50.220]  Or when you think it's necessary.
[42:50.880 --> 42:51.080]  Okay?
[42:52.220 --> 42:54.300]  That's like sitting there going, hey, I just bought a new car.
[42:54.600 --> 42:56.200]  I'll change the oil eventually.
[42:56.560 --> 42:57.140]  You know.
[42:57.140 --> 42:58.820]  When I think I need to do it.
[42:59.140 --> 43:00.540]  But see, by then it's too late.
[43:01.880 --> 43:03.520]  I have F-Prod on my system.
[43:03.820 --> 43:06.000]  And I have it update the DAT file daily.
[43:06.700 --> 43:08.880]  Because F-Prod does daily updates.
[43:09.560 --> 43:13.320]  So every single day, it goes to the network, downloads, updates my system.
[43:13.580 --> 43:15.020]  And I try to stay myself protected.
[43:15.360 --> 43:15.860]  Any other questions?
[43:20.570 --> 43:22.850]  What language is most commonly used to write virus?
[43:24.110 --> 43:25.850]  Well, right now it's Visual Basic.
[43:28.630 --> 43:29.070]  Yeah.
[43:29.690 --> 43:31.650]  And I know some viruses that are written in C.
[43:32.430 --> 43:33.230]  Mostly assembly.
[43:34.070 --> 43:35.030]  But see, that's old school.
[43:35.370 --> 43:36.810]  Most of the people are like, assembly?
[43:37.250 --> 43:38.470]  I don't know how to do assembly.
[43:39.110 --> 43:40.890]  It's like, yeah, because you don't know anything.
[43:41.990 --> 43:42.710]  Any questions?
[43:42.930 --> 43:43.150]  Anymore?
[43:43.610 --> 43:43.950]  Right there.
[43:48.990 --> 43:50.130]  That's exactly right.
[43:50.850 --> 43:57.410]  His statement was, it's very difficult to write a Unix virus because you can't always count on binary compatibility.
[43:57.810 --> 43:58.690]  Yes, that's right.
[43:59.290 --> 44:00.930]  You know, don't use the default kernel, guys.
[44:01.390 --> 44:02.730]  Compile your own, you know?
[44:03.010 --> 44:05.870]  Not each Unix box is going to be set up exactly the same way.
[44:06.030 --> 44:17.050]  So if you don't have, you know, also with the different flavors of Unix out there, it may kick your butt on Linux, but it won't work worth a shit on Solaris or FreeBSD, you know?
[44:17.250 --> 44:18.110]  And you're absolutely right.
[44:18.230 --> 44:19.150]  It makes it a lot more difficult.
[44:20.810 --> 44:21.210]  What?
[44:21.910 --> 44:22.490]  Oh, yeah.
[44:22.730 --> 44:23.910]  And you're dealing also with permissions.
[44:23.910 --> 44:35.690]  But of course, you know, I actually know someone who is actually working on a Unix virus that uses water abilities to actually get root and change permissions and then infect the system.
[44:36.050 --> 44:36.870]  Question back there?
[44:45.310 --> 44:46.710]  I really can't hear you.
[44:46.790 --> 44:47.510]  Can you come a little bit closer?
[44:48.010 --> 44:48.430]  Or scream?
[44:48.430 --> 44:50.910]  Is it a thing that you can project, man?
[44:51.210 --> 44:51.590]  It's like...
[44:51.950 --> 44:52.390]  Look!
[44:52.690 --> 44:53.970]  Across the room!
[44:55.190 --> 45:04.130]  Can you say something about antiviral software that will mimic what an antibody system, what an immune system does?
[45:04.350 --> 45:05.190]  You know, via the water?
[45:05.490 --> 45:05.950]  Or the water?
[45:06.790 --> 45:08.050]  Oh, God, I don't know.
[45:10.050 --> 45:17.650]  Okay, I mean, it's like... Alright, imagine that you get a virus that attacks your heart and kills you.
[45:18.230 --> 45:21.250]  Okay, that would be the I love you virus.
[45:22.270 --> 45:23.050]  Third strain.
[45:24.370 --> 45:26.710]  I'm not exactly sure what you were asking from me here.
[45:26.950 --> 45:29.730]  It was like... Yes, okay.
[45:30.030 --> 45:34.970]  Actually, see, it used to be that people wrote viruses because they were really interested.
[45:34.970 --> 45:44.950]  And honestly, guys, if you want to write a virus on your system and not release it to the world because you're interested in, like, artificial intelligence and you want to, you know, investigate, you know, the internals, you know, knock yourself out.
[45:45.210 --> 45:47.230]  Just don't hit anybody with it.
[45:47.310 --> 45:48.790]  Don't make it a nasty payload.
[45:51.350 --> 45:53.910]  So, I mean, I don't know if I'm answering your question, man.
[45:54.010 --> 45:56.530]  Why don't you catch me after the talk and I'll sit down and talk with you about it.
[45:56.750 --> 45:57.250]  You right there.
[46:08.610 --> 46:10.270]  What's true or myth in what?
[46:11.510 --> 46:12.910]  Oh, in virus viruses.
[46:14.310 --> 46:24.810]  There are several viruses out there, like the anti-CMOS virus, they actually will change, like, the time state or they'll start modifying the CMOS to geek your system.
[46:26.090 --> 46:27.450]  There are several of them out there.
[46:27.570 --> 46:29.010]  They're really, really easy to get rid of.
[46:30.550 --> 46:31.970]  Really not much of a big deal.
[46:32.170 --> 46:33.370]  They're also very old.
[46:33.570 --> 46:34.970]  I don't know of any actual new ones.
[46:35.070 --> 46:37.290]  If there are new ones out there, I'll probably find out about them eventually.
[46:39.290 --> 46:40.150]  Yes, sir.
[46:40.230 --> 46:43.230]  Are there any actual viruses that do damage to hardware?
[46:43.730 --> 46:48.450]  Okay, the question here is, are there any actual viruses that do actual damage to hardware?
[46:50.210 --> 47:07.950]  About ten years ago, when I was first getting into the virus scene and doing my research and stuff, I would always, always hear stories like, Oh, man, I got this virus and they gave me this really nasty screen and all of a sudden the smoke came out of my system and it fried my hard drive on my motherboard and the power supply.
[47:09.890 --> 47:12.590]  I don't know of a single one because I've never ever seen one.
[47:13.290 --> 47:17.330]  I mean, it's like, my brother saw an alien and came down and gave him some Chicklets.
[47:17.650 --> 47:21.870]  And I know it's true because he rarely lies when he's drunk and shit.
[47:22.110 --> 47:26.270]  So, you know, and it's like, I think it's fluff because I've never heard of it.
[47:26.490 --> 47:33.650]  I know there's a possibility of actually overclocking CPUs by code and stuff like that and maybe doing damage that way.
[47:33.650 --> 47:39.790]  But honestly, the way CPUs are designed nowadays is they're deciding to shut down before they get too hot to mount.
[47:40.310 --> 47:41.730]  So, I don't think there's a real risk.
[47:45.290 --> 47:46.850]  Yeah, that's actually very true.
[47:46.970 --> 47:51.970]  You can actually set the heads of the hard drive through code where they actually spin around and smash themselves.
[47:52.250 --> 47:53.970]  Although, on the new hard drives, no.
[47:54.850 --> 47:57.690]  On the older hard drives, the Winchester drives, that was very, very true.
[47:57.690 --> 48:06.510]  You can actually, when they had the park statement, I knew of some viruses that attempted to actually park while it was running, which would actually go .
[48:06.510 --> 48:08.710]  You know, questions?
[48:09.890 --> 48:11.870]  Any viruses for Star Office?
[48:12.730 --> 48:15.830]  Any viruses known on Star Office?
[48:16.010 --> 48:16.870]  On Star Office?
[48:17.490 --> 48:18.990]  I don't know of a single one.
[48:19.470 --> 48:20.810]  I don't know of a single one.
[48:22.730 --> 48:23.330]  There's anybody?
[48:23.750 --> 48:26.930]  Anyone actually, you know, raise your hand if you actually know of a virus for Star Office.
[48:28.350 --> 48:29.230]  I don't think so.
[48:37.250 --> 48:41.250]  Actually, come up here and use the microphone because this is actually longer than like a two sentence.
[48:45.190 --> 48:53.730]  Progenic recently released a story about how virus companies were dumbfounded by a virus that supposedly replicated itself by just opening emails.
[48:54.030 --> 48:55.610]  And I was wondering if you had anything to say about that.
[48:58.130 --> 49:01.130]  Well, that's kind of what the I Love You virus did.
[49:01.690 --> 49:02.690]  It's in the email.
[49:03.130 --> 49:04.450]  Oh, actually, in the email.
[49:04.730 --> 49:05.350]  You know what?
[49:05.490 --> 49:07.630]  I've heard stories about that and I've talked to a couple of people.
[49:07.930 --> 49:11.130]  I know a guy named Dimitri who works for Network Associates.
[49:12.770 --> 49:15.650]  I used to know Igor over there too, but he moved on.
[49:15.910 --> 49:20.070]  I know a lot of these people who are like really, really in the scene working in these companies.
[49:20.470 --> 49:27.370]  And I've asked about situations like that where, you know, about the viruses that were, if you open up the email, you get the virus.
[49:27.370 --> 49:30.970]  And they said they know of one that does that.
[49:31.710 --> 49:31.950]  One.
[49:32.870 --> 49:36.630]  And it only works on a specific version of Outlook.
[49:36.850 --> 49:40.450]  On a specific version of Outlook, which I don't think anyone has anymore.
[49:41.110 --> 49:41.390]  You know?
[49:43.370 --> 49:44.950]  And that's the only thing I know about it.
[49:50.940 --> 49:53.060]  Do you plot where the virus company
[49:56.580 --> 49:57.080]  has happened?
[49:57.280 --> 49:58.440]  No, it doesn't happen.
[49:58.860 --> 50:00.920]  I can flat out tell you right now.
[50:01.240 --> 50:02.560]  It does not happen.
[50:04.000 --> 50:10.020]  No virus company ever, ever wrote a virus internally to release to the wild.
[50:10.400 --> 50:12.560]  I can confirm that with multiple sources.
[50:12.960 --> 50:14.480]  I will argue that to the day I die.
[50:14.760 --> 50:16.880]  And if you think about it, it's perfectly logic.
[50:17.300 --> 50:17.740]  Why?
[50:18.020 --> 50:22.240]  Because if anything happened, they actually got traced back to them.
[50:22.240 --> 50:31.760]  Like I said, Eptoc was able to trace back within two hours of it, of I Love You hitting the country, back to the country of origin, actually back into the area where the virus came from.
[50:31.960 --> 50:35.400]  I think they actually know exactly where the first email got sent out from it.
[50:36.760 --> 50:44.600]  If anything got traced back to that company, the lawsuit would be so immense and the criminal charges would be so overwhelming.
[50:44.600 --> 50:48.860]  It would not be worth a mere 30,000 or 40,000 more sales.
[50:49.160 --> 50:58.560]  Also, keep in mind that when one company updates the DAT files, every company updates the DAT files almost at the same time.
[50:58.720 --> 51:00.240]  Once, maybe an hour or two sooner.
[51:00.980 --> 51:01.080]  Okay?
[51:01.760 --> 51:03.200]  Doesn't make any logical sense.
[51:04.020 --> 51:13.520]  That poor supply is only in viruses that are released in the wild, but many of these 300 a day viruses aren't going to be released in the wild.
[51:13.800 --> 51:17.620]  And maybe there were just slight variations of existing ones, you know?
[51:17.820 --> 51:23.660]  He says, you know, we're talking about the fact that some of these are never released in the wild in their variants.
[51:23.820 --> 51:24.840]  You're absolutely right.
[51:25.440 --> 51:32.400]  A good example is almost, I'd say, a huge chunk of the boot sector viruses are all based on the stoned virus, you know?
[51:32.400 --> 51:33.460]  And you're right.
[51:33.680 --> 51:37.280]  Most of these viruses don't get brought out into the wild.
[51:37.460 --> 51:37.620]  Why?
[51:37.920 --> 51:39.200]  Because they're not written well.
[51:39.320 --> 51:40.440]  They don't replicate very well.
[51:41.240 --> 51:49.380]  And the thing is, they get these viruses sent to them on diskettes or via email, via package, by people saying, hey, this showed up on my system.
[51:49.560 --> 51:54.400]  And they may affect a very small state, but it's like the 80-20 rule, you know?
[51:54.400 --> 51:57.940]  80% of the people aren't going to see it, who cares, you know?
[51:58.880 --> 52:06.520]  But, yeah, chances are you will only see maybe two or three of the viruses on the top ten list in the wild, ever.
[52:07.980 --> 52:08.260]  Yes?
[52:15.860 --> 52:17.640]  You need to speak a lot louder.
[52:17.640 --> 52:18.300]  Sorry.
[52:26.440 --> 52:30.840]  You can create a blue screen crash in Windows with a single line of HTML.
[52:31.260 --> 52:31.460]  Yeah.
[52:31.700 --> 52:34.920]  I can create a blue screen crash in Windows doing almost anything I want.
[52:35.300 --> 52:36.800]  Hey, just running the operating system.
[52:38.160 --> 52:39.600]  Um, I don't know.
[52:39.760 --> 52:40.140]  Probably.
[52:40.460 --> 52:40.940]  Probably.
[52:41.340 --> 52:47.620]  Because, I mean, well, I mean, NT, I mean, you know, the funny thing is, guys, is I'm an actual MCSE.
[52:48.440 --> 52:48.900]  You know?
[52:49.140 --> 52:50.780]  And people are like, well, why did you become an MCSE?
[52:50.900 --> 52:55.860]  I said, A, it was three weeks off of work.
[52:55.940 --> 53:00.300]  They were paying for all my expenses, paying for my hotel, and it added five grand to my salary.
[53:00.700 --> 53:01.500]  Shit, why not?
[53:01.880 --> 53:02.340]  You know?
[53:02.740 --> 53:03.520]  The tests were easy.
[53:03.660 --> 53:05.200]  It was like, oh, God, those are worthless.
[53:05.360 --> 53:08.260]  I'm like, no, it gets me more money, so who cares?
[53:08.740 --> 53:12.200]  And I'm actually, believe it or not, you guys are going to boo me.
[53:12.460 --> 53:13.660]  You guys are going to boo me.
[53:13.940 --> 53:15.700]  It's like, I actually like NT.
[53:19.440 --> 53:20.560]  Yeah, yeah, I know.
[53:21.060 --> 53:23.880]  You Unix hardcore guys are going, NT sucks.
[53:24.240 --> 53:25.260]  You know what I like about NT?
[53:25.520 --> 53:26.480]  NT is pretty cool.
[53:26.780 --> 53:28.580]  I mean, there's some really neat factors about NT.
[53:29.920 --> 53:33.460]  Actually, I'm going to give you some information that people thought was impossible regarding NT.
[53:33.820 --> 53:42.920]  It used to be believed that it was absolutely, possibly impossible to infect an NT formatted with NTFS with a boot sector virus.
[53:43.540 --> 53:44.340]  Anybody hear that?
[53:44.620 --> 53:44.820]  Ever?
[53:45.960 --> 53:46.360]  Okay.
[53:46.740 --> 53:47.760]  I proved it wrong.
[53:48.360 --> 53:54.380]  I actually infected an NT system completely formatted, not with a DOS partition for boot.
[53:54.600 --> 53:58.480]  The whole thing NTFS formatted with a boot sector virus.
[53:58.660 --> 54:00.040]  I wanted to test and see if it could be done.
[54:00.840 --> 54:02.780]  And I'm actually going to tell you how you can do it.
[54:05.520 --> 54:08.580]  What I did is, you have to understand how NT works.
[54:08.720 --> 54:13.150]  NT does not allow real mode access, period, under any circumstances.
[54:14.340 --> 54:15.120]  Plus one.
[54:15.740 --> 54:16.080]  Okay?
[54:16.820 --> 54:20.200]  You can say whatever the hell you want about NT, but dammit, that's a really good plus.
[54:20.700 --> 54:21.440]  Anybody agree?
[54:22.740 --> 54:23.240]  Okay.
[54:24.740 --> 54:25.240]  Good.
[54:25.240 --> 54:26.460]  Everybody else is like, no.
[54:26.680 --> 54:27.560]  And she's still so cheap.
[54:30.180 --> 54:33.480]  So I'm thinking, you know, the drive is there.
[54:33.600 --> 54:34.300]  The boot sector is there.
[54:34.400 --> 54:36.960]  There's got to be a way to infect that system.
[54:37.500 --> 54:43.920]  And the only time that system is vulnerable is really during the boot process of the system.
[54:45.560 --> 54:47.360]  Even then, I couldn't do it.
[54:47.480 --> 54:56.980]  Because if you take a DOS formatted diskette infected with a boot sector virus, and you put it in your drive and you boot up so it reads off the drive A first, logically it should infect.
[54:57.300 --> 54:57.680]  No.
[54:57.940 --> 54:59.520]  It's NTFS formatted.
[54:59.700 --> 55:02.820]  Because it's NTFS formatted, it's an invisible drive.
[55:03.060 --> 55:04.840]  According to DOS, it doesn't exist.
[55:05.080 --> 55:05.680]  It's not there.
[55:05.680 --> 55:06.860]  NTFS.
[55:09.850 --> 55:11.150]  You're getting ahead of me.
[55:11.470 --> 55:12.230]  But you're right.
[55:12.870 --> 55:20.810]  What you do is you create an NT boot disk that translates NTFS and lets you see the drive.
[55:21.190 --> 55:27.990]  This is an emergency boot disk used to get your information off the drive in case of an actual operating system failure.
[55:29.630 --> 55:33.550]  That diskette itself is not formatted with NTFS.
[55:33.910 --> 55:35.370]  It's a DOS diskette.
[55:36.010 --> 55:39.310]  And that disk can be infected with a boot sector virus.
[55:40.610 --> 55:43.490]  But that disk in the drive booted up.
[55:43.750 --> 55:45.470]  And now it sees that drive.
[55:46.570 --> 55:51.590]  And now, you ain't never using that operating system again.
[55:51.590 --> 55:53.610]  I did it and the whole thing went boom.
[55:54.050 --> 55:55.730]  And I went, wow, damn, it worked.
[55:55.930 --> 55:58.050]  And I was like, oh, shit, I had data on there I needed.
[55:58.310 --> 55:58.730]  Oh, man.
[56:00.190 --> 56:01.850]  I was like, oh, well.
[56:02.230 --> 56:03.450]  Easy come, easy loss.
[56:03.550 --> 56:04.010]  No big deal.
[56:04.010 --> 56:05.710]  But I was like, oh, great.
[56:05.850 --> 56:07.650]  I lost my two MP3s I actually had.
[56:07.830 --> 56:07.950]  Ooh.
[56:08.850 --> 56:09.330]  You know?
[56:10.510 --> 56:11.310]  But, yeah.
[56:11.930 --> 56:14.430]  I actually proved that it was completely possible.
[56:15.830 --> 56:17.210]  Which the NTFS does.
[56:18.050 --> 56:26.330]  And then if you actually want to learn how to create one of those diskettes, just do a scan on the internet for like an anti-emergency boot disk, you'll find all kinds of papers written up on it.
[56:26.890 --> 56:27.370]  Yeah.
[56:27.370 --> 56:27.810]  Any other questions?
[56:29.770 --> 56:30.390]  Yes, sir.
[56:30.730 --> 56:31.510]  You mentioned before
[56:44.560 --> 56:52.120]  the client, what if there were any kind of stuff like to blast the BIOS to the corrupt version of the BIOS and the BIOS?
[56:54.120 --> 56:54.600]  Yeah.
[56:55.280 --> 56:56.080]  That's actually a good point.
[56:56.600 --> 57:03.680]  His question basically is, you know, I don't believe that it's easy for him to cause actual hardware damage.
[57:03.760 --> 57:08.040]  And his thing is, well, what about viruses that actually do corrupt versions of the BIOS and all that stuff?
[57:08.960 --> 57:09.420]  Yeah.
[57:09.420 --> 57:09.520]  Yeah.
[57:09.800 --> 57:13.060]  I mean, and like I said before, there are viruses that actually corrupt CMOS.
[57:13.220 --> 57:15.820]  But they don't physically harm the drive.
[57:18.260 --> 57:28.660]  Now, I know of a single virus that actually not only does it actually screw up your CMOS, but it changes the admin passwords on your CMOS2.
[57:30.860 --> 57:33.180]  If you don't have them, it creates it for you.
[57:34.240 --> 57:36.160]  And they're going, okay, I'll just change this.
[57:36.160 --> 57:38.620]  And you're like, oh, shit, I can't get in to change my CMOS.
[57:38.760 --> 57:39.680]  And it's all geeked.
[57:39.720 --> 57:42.260]  And your drives aren't working correctly and everything is like, oh, man.
[57:42.500 --> 57:51.060]  And then from there, what you do is you actually have to sit there and like, you know, flash the, you know, the BIOS and the, you know, or upload a new e-prong, you know.
[57:51.420 --> 57:52.320]  It's no big deal.
[57:52.360 --> 57:53.500]  It's just really annoying.
[57:54.100 --> 57:55.080]  You're CMOS jumper.
[57:55.400 --> 57:55.720]  Yeah.
[57:56.200 --> 57:57.320]  It's like, boom, CMOS jumper.
[57:57.560 --> 57:57.740]  Thank you.
[57:57.860 --> 57:58.120]  Game over.
[57:58.220 --> 57:58.600]  Thanks for playing.
[57:59.740 --> 58:06.460]  Actually, on my older 486 motherboard that I run my pre-PSG boxes on, it's the screwdriver shorting out the battery.
[58:07.740 --> 58:08.300]  All right.
[58:08.460 --> 58:08.580]  Good.
[58:08.720 --> 58:09.240]  CMOS over.
[58:09.360 --> 58:09.700]  Game over.
[58:09.840 --> 58:10.400]  Let's go, you know.
[58:10.780 --> 58:11.260]  You had a question.
[58:16.690 --> 58:17.430]  You got to speak up.
[58:17.570 --> 58:18.070]  You got to speak up.
[58:18.950 --> 58:19.770]  Come on, man.
[58:19.770 --> 58:23.130]  It's like, you're not in a small little cubicle anymore.
[58:23.290 --> 58:24.390]  You know, I'm talking to your BIOS.
[58:24.670 --> 58:25.150]  Speak.
[58:50.610 --> 58:51.090]  Okay.
[58:51.430 --> 58:53.830]  I can actually give you an account of something I've done.
[58:54.350 --> 58:56.490]  I was actually upgrading my BIOS.
[58:56.610 --> 58:59.190]  And in the process of upgrading my BIOS, I had a power failure.
[59:00.030 --> 59:04.610]  Oh, and by the way, UPS systems are your best damn friend.
[59:04.850 --> 59:05.350]  Get one.
[59:05.510 --> 59:07.030]  One for every damn system.
[59:08.010 --> 59:10.270]  I got a battery backup on my fish tank.
[59:12.290 --> 59:13.170]  No, I'm serious.
[59:13.350 --> 59:15.010]  I have a battery backup on my fish tank.
[59:15.250 --> 59:16.490]  It's like, I don't want my fish to die.
[59:16.630 --> 59:19.170]  It runs the little bubble things in my jets and in my sump.
[59:19.710 --> 59:26.430]  I have a reef tank, a hundred gallon reef tank, that's worth about $8,000 worth of corals of fish.
[59:26.670 --> 59:27.890]  I ain't losing that for shit.
[59:28.030 --> 59:29.410]  I got my best UPS.
[59:29.650 --> 59:31.250]  Not on my systems, on my fish tank.
[59:32.170 --> 59:40.190]  So, in the process of upgrading my BIOS before I got my UPS, and they're not that expensive anymore, I had a power failure.
[59:40.650 --> 59:41.550]  So, I'm riding the bill with my BIOS.
[59:41.650 --> 59:44.330]  I'm like, alright, I've done my BIOS, and I'm going to be able to read off my CD-ROM.
[59:44.450 --> 59:45.850]  I'm like, woohoo, yadda, yadda, yadda, yadda.
[59:46.070 --> 59:48.950]  And I was like, boom, I went, mother slang, pass bucket.
[59:49.230 --> 59:50.010]  Ah, shit.
[59:50.850 --> 59:51.410]  And you know what?
[59:51.570 --> 59:52.950]  I'm going, maybe it didn't happen.
[59:53.050 --> 59:53.950]  Maybe the power came on.
[59:54.030 --> 59:55.650]  It was like...
[59:56.290 --> 59:57.070]  You press the button.
[59:57.070 --> 59:59.470]  I'm like, jee-dee-dee-dee-dee-dee-dee-dee.
[59:59.890 --> 01:00:04.510]  And it was like, ah, man, I am so hos of right now.
[01:00:04.610 --> 01:00:05.090]  Shit, what do I do?
[01:00:05.170 --> 01:00:05.470]  What do I do?
[01:00:05.950 --> 01:00:13.810]  And, um, it was actually geeked to the point where I couldn't just, like, you know, the ROM was half-burned.
[01:00:14.390 --> 01:00:29.450]  I just called up the manufacturer of the motherboard, told my version, told the numbers on the motherboard, and said, hey, look, by the way, I'm going to be on the social engineering panel later on today, so you'll understand this.
[01:00:29.530 --> 01:00:31.590]  I'm like, hey, dude, you know, I'm writing a little bit of a deadline.
[01:00:31.710 --> 01:00:32.470]  I just had a power failure.
[01:00:32.610 --> 01:00:33.370]  I was afraid of the BIOS.
[01:00:33.470 --> 01:00:34.710]  I really need it for this project.
[01:00:34.830 --> 01:00:38.950]  If I don't get working by tomorrow evening, I am dead in the water.
[01:00:38.950 --> 01:00:40.330]  I'm going to lose my fucking job.
[01:00:40.630 --> 01:00:41.510]  You've got to help me out.
[01:00:41.670 --> 01:00:44.050]  I had a BIOS 8 a.m.
[01:00:44.170 --> 01:00:46.410]  next morning, man, in a little package.
[01:00:46.470 --> 01:00:48.110]  FedEx went, hi, here.
[01:00:48.390 --> 01:00:50.230]  I was excited, like, yeah.
[01:00:52.270 --> 01:00:53.590]  Pull up the screwdriver, pop.
[01:00:58.360 --> 01:01:03.240]  And, of course, this BIOS came with the latest version, too, so I was like, hey, you ain't going to be doing that software shit right now.
[01:01:03.420 --> 01:01:06.020]  And a lot of the BIOS is actually making me move the jumper, too, but, you know.
[01:01:06.220 --> 01:01:08.720]  So, yeah, it's not that hard, guys.
[01:01:13.100 --> 01:01:15.980]  No, it was another flash jet, so I could upgrade it later on.
[01:01:16.180 --> 01:01:18.860]  It was just, you know, a brand that's making a new one with the latest version.
[01:01:19.500 --> 01:01:19.820]  Yeah.
[01:01:20.420 --> 01:01:23.320]  A little note, we didn't have any in stock, so we had to burn this one for you.
[01:01:23.320 --> 01:01:24.200]  And I was like...
[01:01:25.420 --> 01:01:26.660]  All right, any other questions?
[01:01:29.080 --> 01:01:29.600]  Anybody?
[01:01:30.720 --> 01:01:32.180]  Well, thank you very much.
[01:01:32.180 --> 01:01:32.260]  I'm bummed through.