This is dedicated to all the hackers and the crackers, to the hackers and the crackers.
I see in binary, I speak source code, step on my toes, I'll post a million game pegs
of you in a fag bone, in your digital stance, getting firewalled ho, cause I'm riding the
net in my six foe.
I was a dick with my 56, now with my cable I'm able to get that stable, on the out, my
name is Ace and I'm a Leo, on the digital highway, my name is Neo and I'm a hero, in a flash
I'll screw you on burning dream cats, you need some ISO, let me through my hard drive
rifle, our exchange you could never stifle, and a digital hug, you just caught the love
bug, I bootlegged your CD, I caused a fight between Un and Jay-Z, your CG, it's all gonna
be free, whether we take it by force or we take it nicely, you feel that rattling your
bones, when I tell you we just hacked out Jones, and NASDAQ leaves you flat on your
back, cause I am he who loves to hack and crack, cause I am he who loves to hack and
crack, this is dedicated to the hackers and the crackers, serial codes, source codes, ISOs,
RAM, SIF, SIS, this is dedicated to the hackers and the crackers.
That's right, I'm back on Binary Revolution Radio episode number 148, I am Stank Dog, today
is May 16th, 2006, and I am here wrapping up season 3 of Binary Revolution Radio, coming
back to take over for a few episodes and see if I can still pull this off.
So far, I don't know how it's going, but we'll see if we can pick it up with this episode
with a returning friend of the show, someone who always, gosh, we go into an hour conversation
before the show and I always learn something from, and that is of course Desius, our good
friend from over at memestreams.net is back on the show with us, welcome my friend.
How's it going?
Going pretty good, going pretty good, I guess we'll find out at the end of the episode
here because this is going to be a pretty, a pretty, see the thing about the main topic
today and the main topic we're going to do is rainbow tables, is a very mathematically
challenging, is that a good way to put it?
It's extremely technical, but I think that there's a lot of people in the scene who, you
know, they just, they think it's cool to have these tools and try to, you know, they think
it's fun to break into stuff and, you know, I think that really what it's about is understanding
how, understanding why things work as opposed to, you know, simply being able to do them
or to run some program and so I think that, you know, this is a challenging topic perhaps,
but it's interesting at the same time and, you know, the whole point of this stuff is
to really delve into sort of deep technical subjects and kind of really understand them,
so I think it's good.
And we're going to do that, we're going to actually get into a little bit of the math
on here and by the way, that description you just gave, that's, you know, that's what
separates a hacker from a script kitty is using a tool and knowing how a tool works and knowing
what a tool is doing, but I digress on that subject.
So, yeah, we are actually going to touch on the math a little bit because I got a little
bit of it from reading a lot of these papers.
This is pretty complex stuff and that's why I thought you'd be the perfect person to come
on the show and help us out with this, so that's going to be our main topic later on.
Oh, and I should also thank you up front, anybody who's ordered magazines lately has noticed
that they got some extra stickers in there, they got the Industrial Mimetics stickers donated
by memestreams.net, if you're not already checking out that site, you are missing out,
so go check that out and if you're ordering magazines or if you bump into me at a BinRev
meeting or something along those lines, we've been handing those out there as well.
So, decorate your laptops up with some stickers and you'll be cool.
It's that easy, I mean people don't realize it's just that easy to be cool, put an Industrial
Mimetics sticker on your laptop, instant coolness.
All the girls will want to talk to you.
And people are busy shopping at Hot Tropic, is that the name of the place, Hot Tropic?
Man, it's not punk if there's a franchise fee.
Exactly.
It's like getting a dead Kennedy's toy with your Happy Meal.
You get a temporary tattoo kit.
Anyway, on that note, I guess we will go into some email.
And our first email this week comes from Eggman.
Eggman says, Hey Black.
Of course, he's referring to Black Ratchet, who has been hosting the show for Season 3.
Shouts out to him again for doing a great job.
Heard you and Stank talking about having Prawn on the bus via EVDO and thought you might get
a kick out of this.
And he sends a link.
I will put this in the show notes.
I did not tiny URL it because, yeah, it's been a while and I guess I suck at this job now.
In the old days, I would tiny URL that out.
But anyway, basically the Hawaiian bus system has started testing the usage of Wi-Fi on the
bus as a public service.
Nice service, powered by Sprint, so I assume it runs over EVDO.
I did a speed test and got around 300 kbps.
Anyway, nice show and asked Stank not to yell like that.
I do have neighbors.
Well, fuck your couch, first of all.
Fuck your neighbors.
EVDO, 300 kbps, that sounds accurate.
That is the kind of download speed you're going to get.
I'm interested to know how this works as far as how they're aiming this at the bus.
How is this thing stuck to the bus?
What's to stop somebody from, I mean, if you're at the bus stop, can you get these signals?
Or even just on the, I mean, how are they targeting these kind of things?
Are they putting antennas in the bus?
I really don't know enough about this, but I find it interesting.
I think that might be the case.
I know that a couple of the Silicon Valley companies, they run buses up to San Francisco
to pick people up to go to work because TREF is terrible there.
And they'll have, you know, a cellular connection in the bus,
and they'll have a Wi-Fi, you know, card, you know, in the bus.
And so people in the bus can connect to the wireless card in the bus
and use the Internet via the cellular link.
Well, what's in it for the cell phone companies?
Why is the cell phone company doing this?
The cell phone companies don't like it at all.
Oh, wow.
They were initially pretty unhappy about it.
But, you know, perhaps, you know, in this case, they've finally gotten the clue
and decided that, you know, if they don't deploy this sort of service,
that someone else will.
So I'm sure they're getting, in this case, these are municipal buses.
I'm sure that the city is paying for them.
Yeah, they're certainly getting money from somebody.
They're not going to do it, you know, for free.
They're not going to donate it.
But is there enough infrastructure in place with the cell phone towers to do this, though?
I mean, like, I guess on city buses, you're talking about a fairly small population of people still,
quite honestly.
There's not many people on a bus at any given time,
and maybe one of them, if any, is using it, one or two of them using it.
So it's probably not a huge traffic load compared to their regular customers that have EVDO cell phones.
But at some point, I mean, is EVDO an option?
And they're totally going kind of way away from this email.
Is EVDO, you think, a good option to cover, like, a city to offer free?
Because I know Philadelphia, I think, was one I read about in several communities
that are trying to cover the city with free access to the Internet.
Most of them I read about are Wi-Fi.
Do you think EVDO or something along those lines might be better?
Well, I mean, I think that Wi-Fi is the best option right now as a sort of, you know,
way to connect directly to people's laptops.
But don't backhaul it with Wi-Fi.
You can, but it's a lot of work.
Excuse me.
You can do sort of directional antenna and backhaul it with Wi-Fi,
but it makes more sense to backhaul it with something else.
I worked on a really interesting project a few years ago where we were looking at doing dense urban areas
where we did 802.11b as the connection to people's laptops,
and we had these devices on the roofs of buildings in the city,
and the devices themselves interconnected in a mesh using 802.11a.
Now you've got g, which gives you the speed of a on the frequency range of b.
And so things have changed a little bit.
But when we were working on this project, you know, b was, you know,
b is like 11 megabits per second, and a is something like, you know,
between 20 and 40 megabits per second depending upon how you have it configured.
So, you know, you could backhaul, you could build this sort of backbone between all these little 802.11b
b access points using 802.11a links that had more bandwidth.
And so I think that that's what makes sense.
You want to, maybe it's not 802.11a, maybe it's, you know, eVideo or Edge or something else
that you're using in the back end that's providing service through a little box
that essentially acts as a, you know, as a wireless access point and has an 802.11b card in it.
Hmm. Yeah, I guess that's true.
You could chain the technologies together in an interesting way, I guess.
What about, I tell you what, when I went up to Atlanta for InterZone a couple months ago,
there was TV, somehow TV was being streamed to the, I guess, trains or subway cars,
I don't know what you refer to them there, the MARTA cars.
There was actually a TV signal being fed to those,
and I found that interesting of how that was being done,
and I didn't even think about checking for a wireless signal in there.
I don't think they have them.
I don't know how they're pumping the TV to the trains either.
I'm not sure what they did there.
Yeah, that could be interesting there.
I noticed it, of course, when I first got on there.
I found it interesting, and especially when we were going through tunnels
and I was still, the signal didn't disappear completely
when we went underground or went under a building or anything like that.
So, had me wonder about that.
Was it real-time TV? Were you getting the news?
Yeah, I think it was, I don't remember what channel.
It was fixed on some news channel, though.
I don't remember if it was local or if it was a CNN.
Yeah, I don't remember too much, honestly.
Yeah, I'm not sure.
There's a couple companies that have popped up that are, you know,
sort of, they've got technology that's specifically designed for trains
to offer that kind of stuff, but I'm not exactly sure what they do.
Well, and I find all of those interesting.
Even, you know, a lot of the, well, not a lot.
A few of the plane airline companies are putting that on their planes.
I know Song, when I had my Song flight to Vegas last year for DEF CON,
that they had the TVs in the back of the plane,
and it was, I think it was powered by, I want to say, Dish Network,
or one of the, maybe it was DirecTV, I don't remember.
But, you know, I find that very interesting.
I mean, obviously they track the planes in the air, so they know where they're at,
but it still seems like a stretch to beam the signal to a terrestrial tower
and then back up to a plane.
Was the TV really real time?
It was, well, I'm sure there was some kind of lag or delay,
but I can't really compare it to anything, obviously.
But, no, it was like, you know, it was, I was watching news.
It wasn't coming off the videotape.
No, I was watching news that was from that day or from that hour.
I mean, it was recent, up-to-date stuff.
It was not recorded.
You know, one thing they might be doing is, they might be hauling, you know,
they'll transmit, you know, a couple copies of a program, you know,
and then people can pull it off of, you know, tape in the plane,
and while it's playing, it'll transmit another program, something like that.
Hmm.
You know, so they get a little staggered.
They can show you a news program that's really fresh if you're on a long flight,
but, you know, it's not, but you're not, you're not, you're not watching it live necessarily.
It's getting fed up there and then played.
Yeah, some, it was, I mean, it was pseudo live, I'm sure.
It was some kind of delay in there, but, you know, like when 8 o'clock came around,
the 8 o'clock shows came on, or, you know, the 11, like, for example,
I think Leno or something came on at 11 or 11.30 or whenever that damn show was supposed to come on.
So, it was giving the fairly live.
I don't know exactly what the, how it was getting handed off, but it was interesting anyway.
That, see, that kind of stuff, I, when I see, and when I see that kind of stuff, I, it's just the geek in me, I guess.
I want to know how that sort of stuff works.
It just pops into my head.
So, if anybody knows, by all means, email us, radio at binrev.com, and fill in some of the blanks for me there, guys.
One time I flew EVA Air, which is a Taiwanese airline,
and they had a camera underneath the landing, like, underneath the plane,
and you could sort of see the front landing gear,
and it was one of the channels on the TV in your chair.
And so, you know, at any point that you're flying along,
you could switch to this channel and see, and look down on Earth,
and as you were landing, it was a pretty wild experience to watch the landing through that camera
as if you were sort of strapped to the bottom of the plane.
Yeah, that's cool.
And I, you know what, now that you mention that,
there was one channel on there that was basically GPS.
It would tell you exactly where we were.
It showed the map of the states,
and it showed a little plane icon to show exactly how far we are,
and an estimate of how far, how much time it was left to go,
how many miles were left to go, and our coordinates and stuff like that.
So, there was some kind of GPS, obviously, going on there.
All right, anyway, let's move on to email number two from,
well, we're going to call them ESD, because we don't read real names on here.
ESD says,
Good afternoon.
I was just writing to say that I'm a loyal listener to the show.
I am not sure where to ask this question,
so I am coming to you guys with it.
Now, the email this week, let me break off for a second.
The email this week is very all over the place,
so I don't really have specific answers for this, quite honestly.
So, that's why we're both kind of just brainstorming here and thinking this through.
So, let's see, my question is,
is it possible to make your laptop self-destruct?
Say, if the feds were at your door,
and you were in danger of having your laptop snatched for evidence or something,
is there a preferably free or low-cost software package,
say, that would, upon a predefined keystroke,
wipe all data from the hard disk?
I guess I am asking if, first, has it been done,
and, second, if so, how was it done?
Because, heaven forbid, if someone snatched my computer,
there is some info that I would not want a person getting their hands on.
Thanks.
And this question, actually, is surprisingly common.
I mean, I think hackers, by general nature, are uber-paranoid people.
So, it is an interesting question,
and I guess, didn't Kevin Rose answer this with the thermite and Ramsey
and the broken or something like that?
Yeah, I think there was a talk at Outer Zone about using thermite to destroy a hard drive.
It was like a USB hard drive,
and if you plugged it into a computer that wasn't running the right kind of driver,
it would ignite this thermite, and it would eat the drive.
Kind of overkill, perhaps.
Yeah, wouldn't that eat more than the drive?
It was an entertaining presentation.
Yeah, that would eat more than the drive.
That would eat through the drive, and then whatever the drive was sitting on,
and then burn down the house that the drive was in.
It would go through the floor and just keep going.
Well, so let's say, joking aside now,
what, I mean, isn't the traditional, isn't the most,
I guess it's probably dangerous to even have this around,
but isn't probably the most reliable way to take a very strong magnet
and put up against your drives and just,
because disk drives are still magnetic storage.
You can buy a degaussing machine, and, you know, I mean, they sell industrial degaussers.
People have reasonable IT departments that, you know,
care about information security usually have degaussers
so that they can wipe drives from former employees or things that they're, you know,
like if you're taking computers off the line and you're putting them into,
you're sending them to a recycling center or you're going to resell them,
and you want to wipe your data off of them,
and so they'll have these things with big magnets,
and you flip the switch, and it just wipes the disk right out.
Yeah, now, the problem of having one of those nearby is,
as a train is going by behind you, it sounds like, is...
Sorry, there's a plane flying around.
...is if you accidentally flip that switch
and, you know, wipe out your data when you didn't want to.
You've got that innate danger,
so if you're that uber paranoid to keep that around, I don't know.
You might be too paranoid to have the degausser.
Yeah.
If one of your buddies comes over some night and thinks it's weird
and presses the button, that'll be it for your computer.
Oh, what's this do?
Yeah, you could also make your own electromagnetic pulse device.
Yeah, you could wipe out a lot more than the computer.
There, yeah, there are straightforward things that you could do in terms of,
you know, like PGP has, you know, a file shredder software that's really user-friendly,
and there are sort of raw, right, I think is a utility for Linux that does some pretty,
you know, sort of complete deletion and wiping of files.
And so, I mean, if you've got a utility like that and set up a script somewhere
where you can, you know, just click on something and it deletes stuff, you know.
And there are definitely several, there are several open source drive disk wiping utilities
that'll use the different, as a matter of fact,
isn't there a Diffie-Hellman standard for how many times you wipe over a drive?
Wasn't that something they also had their name attached to, 27?
I don't know if they had a standard for that,
but there is a federal government standard for that.
Yeah, there's several DLDs.
You know, the tool that I'm thinking of is not raw, right,
but it starts with R, and I don't remember what it's called.
There's one called R-Wipe, R-W-I-P-E.
Yeah, it's R-Wipe maybe is what I'm thinking of.
Yeah, that might be one.
There's a couple, there's several, there really are several of them.
If you go hit up SourceForge and look for drive wiping or what,
I actually have two of them on one of my machines that I like to keep the free disk space,
anything that's been written to, cache, file, stuff like that,
I have it wipe my free space once every week, overnight, kind of like a virus scanner.
You schedule it to run late night on the weekends or something,
or one day when you're not going to be using it.
And I can't remember, I know R-Wipe was one of them,
and I can't remember what the other one was called,
but like I said, there are several, and I just have it set up to wipe my free space.
So basically, that'll wipe out any of my temporary files.
It'll empty my temp directory, empty my cache from my browser and stuff like that.
It will delete any space that I've freed up recently.
So if I have, I don't know, I'm not going to go listing any files,
but if I had something on there questionable and moved it to a CD or something,
this will go behind it and wipe the remnants of it.
And I usually set it to run once every week with a 7-pass DOD standard,
which is a low, one of their lowest standards.
And then I think there's a 21-pass, I want to say,
that will really wipe it so that it's almost unrecoverable.
The 7's pretty darn good, too.
They'd really have to work to recover that.
But the 21 is like for top-secret drives, the DOD standard,
if they really want to wipe something of their own.
And you know what?
If they're happy with 21 wipes, I'm pretty happy with 21 wipes.
So I'm not sure if that exactly answers your question.
I mean, to me, there's not like a...
If you're asking for like an easy solution, as usual in hacking,
there is no magic button or no easy way to set this up.
But especially if they bust down the door
and you're caught with your dick in your hand, you're screwed.
There's nothing you can do that quick that you're going to be able to wipe it
unless you've got that decalcer switch right there in arm's length.
You know, and...
It's more like, if they showed up at your house because you did something,
they probably know what you did.
And if you wipe your computer because you press a button
and they figured out that's what you did,
they'll probably charge you with destroying evidence
or something to that effect as well.
Of course, depending on what you did, that might be a lesser charge than...
Yeah, it might be.
But we won't go there.
I might suggest maybe the button you want is your lawyer's speed dial number.
Yeah.
Yeah, yeah.
We're not going to endorse that, but anyway.
Now, unfortunately, I can't think of a...
I mean, those are some utilities, hopefully, that are helpful
in physical destruction of drives and stuff.
I mean, how about...
See, there's so much...
So many different types of forensics that they can do on drives now.
There's drive shaving.
There's so much stuff.
I mean, what about...
I mean, now we're getting, like, old school here.
What if you just took the drive...
Obviously, you couldn't do this, like, in an emergency situation he's describing.
But let's say you had a drive with, I don't know, you had virus code or pirated MP3s and
you're MPAA, you're worried about them or whatever.
How about taking it out and, say, catching it on fire?
Do you have any idea if that would be...
Or chopping it with an axe or just crushing it?
I mean...
There are data recovery services that attempt to help people whose drives have been physically
damaged.
And so, you know, I mean, I think that, you know, you're much better off with a software
solution or, you know, some sort of magnetic solution as opposed to attempting to burn it
or, you know, cut it up because, you know, those things are easier to recover.
It's a pain in the neck, but there are people who do that for a living.
Yeah, yeah.
So, software sounds like the way to go and it's probably easier in the grand scheme of
things anyway.
All right.
Our last email this week comes from the Apple Man.
Apple Man says, listening to 146 a few weeks late, but I'm sending you this email from my
MDA, the one with the slide-out keyboard.
From my experience, it really sucks.
You can't talk on Skype.
The battery lasts a day max, and the touchscreen gets way too dirty.
It's so bad, I already have to send it back to be repaired twice in six months.
It crashes all the time and needs to be reset whenever you want to use it.
Not theory suggested the MDA Pro, which is the one with the spin-around screen, which,
although big, is more powerful, has video calling and a huge battery, and, well, if you
get stuck outside of your house, dot, dot, dot.
Dot, okay, you left me hanging on that one, but I'm not sure what he was getting at with
the outside of your house.
The MDA Pro has built-in Wi-Fi, but it also has built-in Bluetooth, and I'm pretty sure
it had EDVO, high-speed, third-generation, high-speed cell network support.
So, if you get stuck outside of your house, you're still going to have access.
I'm not sure what he's getting at there.
Can I ask you what kind of phone you have, Desius?
I have a Sidekick, which I'm really happy with.
The thing that kind of sucks about it is that it doesn't, you can only write Java software
for it, and the Java software doesn't give you sort of rich access to the hardware.
So, it's not like a great phone for hacking, but it's a really usable phone.
The keyboard's really big.
It's great for instant messaging.
The software's well-designed, and, you know, there's nice things about it.
The calculator application that it comes with actually says 31337 on the icon for the calculator,
which I thought was a nice touch.
And there's an SSH client for it, and it can sit on IRC.
I think they're coming out with a Sidekick 2 soon, so if you're thinking of investing
in one of these things, then you might want to wait, because the Sidekick 2 will have
faster Internet access.
Well, the Sidekick 2 is actually out.
Well, sorry, the Sidekick 3 is what I'm thinking of.
I have a Sidekick 2.
But, you know, yeah, I'm pretty happy with it.
I've got a number of friends who have sort of Windows mobile devices, which are really
expensive, but they're very nice, and they're very programmable.
So if you want to write interesting sort of cell phone software, that's probably a better
environment for getting low-level access to the hardware.
Yeah, and I have the Trio 700, which I talked about on the show last week, the 700W, which
is the Windows-based.
And when it actually is not crashing, it actually is not so...
No, actually, that's a lie.
It sucks pretty hard.
So tell me about your Sidekick.
Do you bust out the Bedazzler and put little shiny jewels in, like, My Pretty Pony pictures?
It's a little, perhaps, cheeky.
You know, Paris Hilton has one of these things.
But, you know, it's fine.
It's very functional.
It works really well for what I need it for, which is to SMS and send instant messages.
And, you know, I don't...
I'm not such a fan of the ringtones and the different colored LEDs and things like that.
But, you know, I had a friend who had a Trio for a while, and he got it, and he didn't like
the Sidekick in the beginning because he was like, dude, I can't write good software for
that.
I want to play with my phone.
And, you know, just over time of, you know, seeing mine and, like, playing with it, he
decided it was better, particularly because the keyboard's really big.
Yeah.
As far as using functionality out of the box, I do think the Sidekick has been the best
one to do that.
But, yeah, development for it's kind of rough.
Getting anything published and made available for it's kind of rough.
Actually, this MDA Pro that this...
Who was it?
The Apple man here mentioned.
The MDA Pro is just an incredibly cool-looking phone.
It's kind of like, I think...
What is that new Microsoft?
Origami, I think they call it.
It's really...
It's not quite that, but it is kind of the biggest, I guess, PDA phone, most powerful
PDA phone, because it has the built-in Wi-Fi.
It has all the stuff that almost you'd expect with a laptop.
So, it's really cool that you can pretty much, if you're in the house, use your Wi-Fi.
If you're out of the house, use the EVDO network or whatever high-speed network it supports.
The problem is this thing is probably still two years away from a U.S. release.
I was waiting on this phone.
There were rumors that this phone was going to come out with T-Mobile or for T-Mobile,
and my contract was up on my last phone, which was just a Motorola...
Gosh, I don't remember.
It was a very watered-down CMS phone, contact management phone, with a little bit of contact application.
That's it.
So, I waited for this to come out, and when they finally announced their MDA,
it was actually what they announced it as just an MDA,
which is equivalent, I think, to an MDA 3 in other countries, the third in the series.
The MDA Pro is, I think, around the fifth generation.
So, the stuff that we're releasing here is a couple generations behind.
So, once they announced that the MDA was the one they released and it was not the MDA Pro after all,
I broke down and got the Trio 700.
And, again, I'm not happy with it, but it's the best solution for what I wanted,
to be able to get my email on the go, and I didn't want to get tied down to a Crackberry
because I wanted the other functionality that goes along with the Windows operating system,
and that is...
It's silly stuff.
I'm not really into the ringtones too much either,
but I like to be able to have Hack TV in my phone and maybe whip it out and show it off sometimes,
play a little Hack TV for somebody, or any video for that matter,
but play MP3s, stuff like that on it.
It's kind of a cool feature to have.
And other silly things like games or whatever you can put on it.
Just the fact that it goes back to what you said earlier, developing for it is much easier.
You could get yourself a video iPod.
You know, I've considered that.
I do a lot of traveling for work, and I started...
I did some comparisons, but some of the other, like the Arcos, I think,
makes a device that's similar, that had a lot more functionality,
and I think a lower price, a larger screen, better...
It just seemed to be better all the way around.
I did do some research on those, and I've kind of...
That was probably six months ago, so I probably am not up to date on that stuff.
Yeah.
But they'd be great, like, to take on the plane with me.
I could sit there and watch a movie.
You know, I take my laptop, of course, and I'll watch a DVD or something like that,
but it's not the same.
Not the same.
Anyway, so...
No, not at all.
Yeah, let's close up the mailbag here and move into a little bit of show and tell.
And actually, since we're on the topic of movies or TV,
I have been...
Now, the listeners who have listened to the show for...
Back when I did it for a couple years ago,
know that back then, I didn't have cable television.
I haven't had cable television for a long time.
I would just flip through the channels,
occasionally watch some regular prime time.
People know my obsession with American Idol, which was on Fox.
Shows like that.
Well, now that I'm up here, I moved recently,
and that's one of the reasons I unplugged for a while.
I moved, and I got cable television again, which is very cool.
Unfortunately, way too addictive, I think,
because I'm watching more TV than ever.
But thanks to the DVR, I can just set them up to record
and watch them on the weekends or whatever.
But one of the shows that I've been watching a lot recently is Lost.
Best show on TV, I think.
Such a...
I don't know, it's kind of a cock tease of a show.
They leave you hanging every week,
wondering what's going to happen next.
They're really bad about having lots of dangling plot lines.
They're like X-Men comic books.
They just leave so much stuff hanging out there
and make you wonder what the hell it was all about.
But on this last episode of Lost,
they did something that I thought was really cool.
Now, you don't watch Lost, right?
You're not a big TV guy.
Yeah, I mean, I watch a couple of shows.
I like Aqua Teen Hunger Force.
But I don't watch Lost.
Yeah, I don't see Aqua Teen Hunger Force doing something like this.
This was kind of a cool thing that...
All right, like, the long and short of the Lost is basically this ongoing drama
of these people trapped on this mysterious island.
That's the 10,000-foot overhead view.
So, they're trapped on this island,
and there's all these weird things that are happening,
and nobody seems to know why.
There's no logical reason, et cetera, et cetera.
Well, as the story develops,
they've kind of come across this...
See, I don't want to ruin too much of it either,
but let's...
There's some kind of experiment going on.
They're making...
They're finding things along the island
that is telling them that they have to do this.
They have to push these buttons.
They have to go here.
They're something steering them and leading them,
and basically it looks like it's some sort of social experiment
that's being played on them,
but they don't know by who, why,
whether it's still going on or it's old.
Well, they did something cool in this last episode,
and I don't know how many people caught it,
but during the commercials towards the end of the show,
they played a fake commercial,
and they didn't do it coming out of the show,
going into the commercials or coming back from it.
They've sandwiched it in between two real commercials,
like a Burger King on one end
and like a Ford on the other end,
in the middle of the commercials,
and it looked really real.
And the only reason you'd really even notice it
is if you recognize the name of the company
they were advertising,
you realize it was the name of the company
that was mentioned in the show.
So I just think this is a really cool thing,
and I'm going to throw this out there for some of the freaks.
I know they like phone numbers sometimes.
Basically, the commercial advertised a website
and advertised at the bottom a phone number
for more information.
And the phone number was 1-877.
It's an 8.
It's a 1-877-H-A-N-S-O-R-G,
which is the name of the company.
That's 877-426-7674.
So I thought that's really cool,
and I actually called the number once
just to see what it is,
and I'm not going to do it on the show.
I'm going to let people do that on their own
if they're interested in it or if they haven't already.
but it's just got some neat stuff
that's the kind of thing maybe we'd call on Freak Factor
if we ever get that going again
but I think it's kind of neat that we're moving more
towards interactive television
and this is something that I've been wanting for a long time
I think this one unfortunately is going to be
it's not going to be really interactive
it's more like just throwing people some more
stuff to play with and look at
and there's some discussion that it's related
to Sprite commercially somehow
which if that turns out to be the case
that'll really suck
but I think it's a cool idea
that I wish other shows and other places would do
and that's interacting more with your audience
and getting them involved
and I don't mean calling to vote for your favorite idol
after the show is over with
I mean actually having some kind of interactivity
where they reveal clues through the phone number
or through the website
that lead you to other things
that actually help enhance the storyline of the show
so anyway I just wanted to get that number out in the air
in case anybody wasn't aware of it
I thought that was kind of a cool thing
and other than that
something I've been doing
I'm sorry go ahead
I figure I'd drop in an anecdote
about that
I mean there
you know what I don't have an exhaustive
knowledge of this
there's probably a Wikipedia article on it
but there
you know is the odd
movie or television show
that drops a real phone number
for one reason or another
and one I remember
is Sneakers
and I didn't catch this
when it came out in the theater
but the scene
where they get busted
by the Secret Service
and they're asking River Phoenix
what he wants
or whatever
you know
and he says he wants
the Secret Service agent
girl's phone number
and she
you know
so she gives him
her phone number
the phone number she reads out
is a real phone number
and
like I said
I didn't catch it
when I saw it in the theater
and it was a long time
before I actually rented it
but when I rented it
I was like
wait a minute
that was a real number
so
so I called it
and it was this
this
this voicemail box
for some lady
who was obviously irate
about getting all these
phone calls
from these weird
computer geeks
and she goes on
about how
you know
she doesn't
you know
she doesn't take dates
and you know
this was some weird thing
that MGM
Universal Studios did
and you know
it's not her number
and you know
blah blah blah blah
it was kind of funny
I had no idea
what you'd get
if you called that number
today
and I
I really don't know
what
what was on it
originally
but
I thought it was
an interesting
bit of trivia
yeah
and you know
that's why
usually in movies
and TV shows
they reserve 555
555 is not
a usable number
anytime you hear
something on a TV show
they may have
a legitimate area code
like you'll hear
I don't know
Law and Order
which is in New York
you'll hear them say
2-1-2-5-5-5
and then a number
but 555 is not
a valid exchange
so it's never
you know
those are never
real numbers
and I thought
that was just
generally accepted
I guess they slipped up
on that one
huh
oh that poor woman
must have been
now
something
you know
this is a
sort of
nostalgic conversation
sometimes
some of the numbers
in 555
are real numbers
obviously 555-1212
is always a real number
but sometimes
there's other stuff
in there as well
and it's usually
kind of in neat
but you know
there's a lot of
dead air
between
in between
random things
that might exist
in that space
it would be an
interesting
interesting scan
to see what people
would find
in some of those
555 exchanges
I mean yeah
you're right
1212 is an
obvious one
so yeah
maybe there is
other interesting
stuff after all
it's pretty much
generally
I don't know
if it's common
knowledge
but it's pretty
much accepted
that if you're
going to do a show
you just make up
555-whatever
and it's assumed
to be not in use
but you never know
yeah I mean
it's not going to be
it's connected
with the consumer
you're going to
get connected
to some weird
phone company system
if the number
exists
you know
maybe it's a
you know
they put a
loop test
or something else
a toner in there
you know
sometimes there's
weird stuff in there
at least that's
my recollection
from like
a long long time ago
be very careful
with those numbers
I'll just leave
that alone
yes absolutely
and actually
this is another
kind of funny thing
another TV thing
that's hooked me
purely
the show is
utter garbage
it's called
Deal or No Deal
and I've been
watching this
well I don't
watch it regularly
it is garbage
but if I ever
am catching it on
I have to admit
that for some reason
it intrigues me
it addicts me
from a mathematical
standpoint
I grab
a notepad
and pen
and I write down
the combinations
and what this is
for those who don't know
it's basically
a game show
where they have
a bunch of
different dollar amounts
from I think
one penny
and then it jumps
to like one dollar
five dollars
ten dollars
and it jumps
in these big increments
up to a million dollars
and there are
I think
32 different numbers
there's 32 suitcases
you pick
and each one
has a dollar amount
in it
supposedly randomly
distributed each game
and resets
it's random
and to me
it's just a very
intriguing algorithm
behind it
because
your goal
is to end up
with a thousand dollar
suitcase somehow
but it's a process
of elimination
fundamentally
all you're going to do
is keep picking cases
and you're hoping
you're eliminating
small number amounts
and if you eliminate
all the small numbers
and you're left
with a million dollar case
that's your ultimate goal
right
but it's just so
I don't know
brilliant to me
that
I don't know
if irony is the right word
but the more
of the small
amount cases
you get rid of
you're left
with large cases
with large amounts
in it
and statistically
your odds
of picking a low number
go down
so you're inevitably
going to end up
picking the large numbers
and you're always
going to end up
in some average
dollar amount
over the long term
in any individual game
and I've written
I've written some articles
on statistics
and the lottery
and stuff for 2600
and statistics people
know that I'm very into that
I find all that stuff
interesting
this is very cool
there's probably
if you balance out
all the people
who have won it
you'd probably come up
with a pretty close average
and over the long term
a long history of the game
you'd probably find
everybody would
deviate towards that
median and middle point
I've had conversations
with friends about
should there be
a goal
that if you get
over the average amount
should you automatically
call it quits
should you automatically
say oh well
the deal that I've been
offered is
X number of dollars
so I should quit
and take that and run
so anyway
it's an intriguing algorithm
if you haven't
looked into that
there's actually
a really good
Wikipedia article on that
since you mentioned
Wikipedia
it's a really good
article on that
that links to
some of the algorithms
and stuff like that
and I've actually
done a lot of
work on it myself
trying to think
about how it works
and I've kind of
got the algorithm
I won't say cracked
but I've got it
down to pretty close
so I know exactly
how it's working
there's some kind
of weighting system
going on
and I just haven't
ironed out exactly
what the weight
is like
so it's one of those
things where I'm
totally reverse
engineering it
by writing down
the amounts
writing down
the offer that
comes in
and every time
that happens
if I can ever
find an algorithm
that works
it should work
universally
I don't know
why I find
that interesting
but I do
and it's a
complete waste
of time
that will never
ever get me
anything in the
world
but for some
reason
I find that
stuff interesting
so that's enough
for my hacking
stories for the
week I guess
what uh
it's been a while
since you've been
on the show
there buddy
what have you
been up to
I don't know
man
working on
projects
and uh
just uh
just chilling
yeah you and
I are in the
same boat
as far as
we have a few
projects that we
can't talk about
yep I got a lot
of uh
I got a lot
of stuff
you know
I don't know
hopefully uh
I'll get
opportunities to
talk about
some of the
stuff I've been
working on
over the
next few
months
but uh
uh
it's all uh
in the garage
under the uh
under sheets
right now
gotcha gotcha
well and now
we did find
Tom we met
up at uh
we met up
in Atlanta
at InnerZone
and I think
you mentioned
earlier that
you're trying
to make it
to Hope
uh
gonna try
definitely like
Manhattan
yep yeah
so I've already
booked for that
so I'll definitely
be there
so um
we're definitely
gonna have to
go uh
go hang out
downtown
Manhattan
that weekend
go get a drink
at night
some night
so um
alright well
there's some
uh
rumblings of
throwing
an industrial
mimetics
party
but uh
I don't
know uh
whether or not
that's gonna
come together
there's uh
there's some
uh there's some
things in the
works though
perhaps
well cool
definitely
definitely let
us know
so we can
tell the
listeners about
it um
I'm sure
there's lots
of people
listening that
are gonna
be there
so um
yeah
keep us
in the
loop
on that
um
I guess
now we
should go
into the
main topic
um
and this
could
let's see
we're 40
minutes in
here
a little
over 40
so we've
got some
we're gonna need
a little time
to go through
this
I'm gonna
go briefly
over some
of the
general
slash
easy stuff
and then
leave you
with the
hard stuff
all right
well hopefully
my explanations
will be
clear
this is one
of those
things where
if I
if this
was a
television
and I could
draw it
would be much
easier to
explain
exactly
we can do
a Hack TV
episode on
this
it might be
better
but
well we're
gonna go
and see
this comes
back to what
you said
earlier too
is I can
do so much
reading on
my own
and I have
the tools
and I've
played around
with them
and I got
a good
A I can
use them
and know
how they
work
obviously
I can do
the script
kitty
use the
tools
big deal
big whoop
there
but I did
read the
actual
white paper
I guess
on this
original
concept
and tried
to kind of
take it
from there
and I got
the very
very general
basis of it
but the
mathematics
behind it
is very
not obscure
I'm not sure
what a good
word is
actually
but we'll
come to that
in a minute
and basically
we're talking
about of course
rainbow tables
if I didn't
already say
that again
and rainbow
tables were
created by
and I hope
I pronounced
this correctly
the concept
is from
Dr.
Felipe
or Dr.
Ph-P-H
I-L-I-P-P-E
I guess that's
Felipe right
uh yeah
I guess
I don't know
Philip
Felipe
I'm sorry
if I'm
mangling
your name
and the
last one
is
O-E-C-H-S-L-I-N
Felipe
O-E-C-H-S-L-I-N
and from
the Swiss
Federal
Institute
of Technology
and that
actually was
based on
an original
idea from
even further
back a
cryptographer
that you're
very familiar
with
Martin
Hellman
of course
of Diffie
Hellman
fame
and also
the original
idea was
invented in
1980 by
my
Hellman
and some
other folks
whose names
I don't
remember right
now
and Hellman
is Diffie
Hellman
and then
it was
improved upon
by Ron
Ravast
who is
a professor
at MIT
and he's
the R
in RSA
and then
this
Felipe
guy
extended
Ravast's
ideas
and it's
really his
concept that
we call
a rainbow
table
and it's
really cool
but it's
a sort of
subset of
this generalized
concept of
a sort of
efficient way
to pre-compute
hashes or
ciphered texts
for cryptidial
and it really
is kind of
cool
and kind of
I mean a lot
of people think
you know the
internet age
we're inventing
new things
every day
and technology
is breaking
so quickly
I find it
interesting that
we're the
fundamental basis
of this
everybody thinks
this rainbow
table is some
new thing
that it's based
on actually
something from
1980 did you
say that was
worked on in the
late 70s to get
to that 1980
release
that I think
is incredible
and that's why
you know I
always mention
and find
interesting
mathematics
and I write
articles and
stuff on
statistics and
math is because
fundamentally
math is the
basis for so
many things
that we find
interesting today
it's very
unappreciated by
computer programmers
or computer
geeks or
hackers or
whatever if you
ask me I
think mathematics
is just the
key to
finding all of
this new stuff
especially when
it comes to
cryptography
yeah I mean I
think that if
you are a
computer person
I was a
when I was in
high school
you know I
was very into
computers but I
wasn't like the
most stellar
math student
and you know my
teachers used to
say you know
well you're never
going to accomplish
anything in
computers if you're
not good at math
and I said you
know I felt like
computers were
really a lot about
being creative
but the fact is
that I had a way
of thinking about
computer problems
that was very
logical
and when I
went to college
I did a huge
amount of math
and you know
basically learned
to love it
basically by
bringing it
from a fire
hose
but the thing
is that
you know I
found that
you know my
natural way of
thinking about
computer problems
was in a way
related to the
appropriate way
of how to
think about math
but math wasn't
presented to me
in the right way
I guess in school
you know they
didn't really
make it
interesting
and you know
there's this
language that
you use in
mathematics to
express mathematical
concepts and
you know I
never sort of
learned the
language or
learned to
express my
sort of logical
ideas in the
language of math
and so you know
once I learned the
language by force
I found it fit a
lot of the
thinking that I
was doing really
well but it
was just that it
was not something
that I was
motivated to
study until
and I mean I
think that for
computer people
cryptography is a
really great way to
get into math
because we you
know because we
think cryptography is
interesting you
know all these
computer security
protocols are
sort of rooted in
it and it's
neat and it's
kind of you know
you know spy
versus spy stuff
so you know it's
kind of sexy
you know and so
people you know
may spend time
you know reading
it because they
find it interesting
and find themselves
staring at these
complex equations
and say how do I
decipher that
what does that
mean and find
themselves or find
this becomes a
gateway for them
to really you
know studying you
know more basic
math concepts and
building up that
sort of vocabulary of
that language that
they use to express
equations in so
right and you
know a lot even
the people that I
know I know a lot
of people that claim
to be into
cryptography know
and all that you
know they know
that you know they
make statements like
oh RSA is better
than Shaw is better
than this or this
is used for that
but they don't
understand that the
mathematics upon
which they are based
which is something
that I don't know
me I just want to
know that kind of
stuff I find it
interesting maybe
that's a personality
quirk but again
I mean I think that
this that's like I
was saying in the
beginning that's what
this scene is about
and you know the
you know cryptography
is a field that
you can plunge
into that can
consume your whole
life there's no
limit to how deep
you can go with
this stuff how
challenging it can
become if you're
really interested in
it and so you know
if you you know
it's not I mean
it's if it's some
you know it's if
you get bored with
cryptography you're
you're you're not
looking at it in the
right way I think
well and let's
move into the
the application of
cryptography tonight
that we're talking
about which is
rainbow tables once
again and rainbow
tables a lot of
people and see I
actually posed this
question in IRC and
you get some pretty
responses like well
this is all it is it's
that simple what's to
talk about you know
there's not a lot of
detail well actually
there is because when
you talk about how
and why they work
that's where the
detail is and the
interesting part is to
me so kind of a
disclaimer a warning
some of this might
get kind of dry like
like Desi is referring
to on the radio it's
kind of hard to
illustrate on the
radio we're going to
give it our best shot
and see if we can't
explain it let's talk
about kind of an
overview of what it
is first of all this
is first of all let me
let me put a couple
facts out there to
keep in mind as we go
along first of all
this this is something
that only works for
hashing algorithms it's
something that is only
going to work for a
fixed an algorithm
that's going to
produce a fixed value
a fixed hash every
time a hash of course
being a a cipher text
representation of like
a password for example
when you create a
password it's going to
run it through this
algorithm and it's
going to generate a
hashed version of it
an obfuscated version
of it however you want
to refer to it and
some examples of
things like that are
like MD5 which is
message digest that's
one of the most common
ones SHA LM which is
Windows land manager or
NT passwords that's
really I think the
one thing that you
see most commonly
used by rainbow tables
most people will use
it for NT Windows NT
password but one of
the ones that I find
interesting was my SQL
actually uses a system
that can be this can be
used on so and there
are others besides that
the important thing to
understand about a
hash function is that
it's a one-way function
you take information it
goes through this
mathematical
manipulation and you
get junk out the other
side and it's very
difficult to if you have
the junk to come up to
figure out what the
thing that went in was to
begin with and so it
gives you the security
property and once you
send it through the junk
and out the other side
it's very difficult for
people to get back
one game that a friend of
mine and I played at a
conference once was to
take an MD5 hash of our
of our name and write it
on our badge and so if
you didn't know who we
were that MD5 hash wasn't
going to help you figure us
out you know because you
can't get back from that
hash to a nickname but if
you if you thought you knew
who we were you could take
the name that you thought
was our name and take the
MD5 hash of it and see if
it was the same as what
we've written on our
name tag and so we thought
that was kind of
interesting and did
anybody get it
no but you know whatever
we got drunk and you
know mostly forgot about
it but it was kind of a
neat idea
yeah that's pretty much
how the conference is
all right so so rainbow
table so those are some
some facts to think about
up up front the one way
is good excellent point
and what the rainbow
table does basically is
this is when you
traditionally think of
cracking a password the
first thing of course is
brute force and that is
an application of some
kind that's going to
simply throw combinations
at a hash password or any
kind of password for that
matter and try to just
brute force it usually by
having a dictionary file
handy where you're pulling
in common words it's one
of the reasons people always
say good password policies
use special characters
use mixed case use spaces
numbers letters mixed case
etc etc because if you're
using something that's a
common word from a
dictionary then dictionary
attacks can be very
successful against those
type words obviously well
when you have stronger
passwords and keep that
dictionary in mind we're
going to come back to that
in a second because
Desi has actually made a
really good point to me
before we started recording
but with the rainbow tables
when you've got a more
complex password you've got
so many possibilities to go
through especially if you're
just let's call it a random
let's say it's really a bunch
it's not even close to a it's
not like password 571 it's
actually p5j underscore if it's
really just weird stuff rainbow
tables can be more effective on
that type of password and the what
it is basically is doing all of
the work up front instead of
getting on a system and trying
to do a brute force attack right
then and there on the fly you're
doing all of the work up front to
generate what's called a rainbow
table and we're going to talk a
little bit about what that is but
think very large tables of
predetermined hashes and that that
is overly simplifying it but for now
keep that in mind you've got a bunch
of predetermined hashes and
obviously it's going to be huge
huge files I mean when you're
talking about how many possible
combinations of passwords they are
you're talking gigantic files
gigabytes and gigabytes of data
however depending on exactly how you
make them and the variables
involved which I'm going to talk
about next you can create a very
high percentage chance that almost
every combination of password can
be cracked depending on how big you
make your tables and how exhaustive
you set the variables to be now the
other factor in this is yes you're
doing all the work up front but it's
still a lot of freaking work you need
a lot of power to generate these
tables you're still doing work it's
just you're doing it up front to put
them in big files so that when it
comes time to actually crack passwords
you're using the memory of the
computer to parse through all these
huge tables to find what you're
looking for so I mentioned earlier
this works on on hashed passwords but
it will not work for any hash that's
been salted and do you want to kind of
explain what salting is sure well on a
unix machine but see a lot of times
hashes are used as follows you take
someone's password and you hash it and
you store it in the password file so that
way you don't have to store their actual
password in the password file and so
somebody sees the password file they
don't get everyone's password and then
when they log in the login process
takes their password and hashes it and
compares it against the hash that's in
the password file and if they're the
same you know it lets you in and so
unix machines you know have been doing
this since the 70s are there and they
you know they have a salted hash which
means that there's a couple of numbers
numbers that are appended to the to your
password before it goes through the
one-way hash function and that makes
things a little complex you know for you
know basically the password love for
instance the md5 hash of the password
love is always the same but if you add
the salt of a couple of characters then
you have you know maybe it's two
characters then you've got you know
you know 16 bits of entropy that you've
added in addition to whatever the
password is you know just a huge number
of different ways that the hash result
could turn out and so reno tables tend
to break down when you're when you're
talking about that much that much added
complexity so usually when people are
cracking salted hashes they they you know
they just kind of they do their
calculations on the fly using the salt
that was that appears in the password
file they generate a hash of their
dictionary and and compare the results
of that with what would appear to the
password file and check to see if they're
the same but you know Microsoft you know
when they when they when they it's really
not their fault actually uh the land
manager hash is older than that man
from the 80s or wherever the this net
bio stack came from uh you know but
that that hash is it doesn't is not
salted and so it's a lot weaker uh than
a than a unix password hash there you
know for each given password that
someone might have there's only one
possible uh result and so uh you know
it's possible to i mean it's uh when
you when you the real advantage of
rainbow tables is this um you know
because there's no salt you could take
the entire list of possible passwords
uh and you can hash them all and you
can have this database with every
possible hash result it would take you a
while to generate it but um you know
ultimately uh you know you could do it
and and the problem is that the that you
have this huge file uh that would just
take a massive massive amounts of space
uh and would take you a very long time
to search uh uh and it you know and of
course generating it also would take you
know extremely long period of time uh you
know on the order of years so so um you
know what you want to do is uh is is is cut
the time down a little bit and the way you
do that uh the way that rainbow tables
help you do that is by reducing the amount
of data that you have to search uh instead
of having to store every single possible
hash of every single possible password
you only have to store a small percentage
of them uh in memory and based on on those
results you can easily uh find um uh you
know the you know most of the hashes
regardless of the fact that that you
haven't stored um as much data it's sort
of like a trade-off between the amount of
memory that you have and the amount of
processing power that you have uh and uh
rainbow tables give you a really good sort
of balance between the two that lets you uh
lets you have a relatively small amount of
data but get your results relatively quickly
with you know a low amount of computation
and and you referred of course to the the
huge huge tables there are a couple
variables that determine that and make your
table size or define it now even on the
smallest scale um they're going to be big
tables we're talking i i would say probably
one 660 meg to fit on a cd table might
cover um a basic character set and the
character set is one of the variables on
creating these rainbow tables what
characters do you know are going to be in
the password certain um algorithms may or
may not allow certain types of letters is it
going to have and not only algorithms but
more more to the point password policies at
the company is are all the passwords
converted to uppercase windows style for
example are um the passwords going to
allow mixed case are they going to allow
numerics or they require numerics at the
company what their password policy is does
it require special characters well you
develop your rainbow tables using well i'm
going to simplify it to two important
things one the algorithm that you're going
to use what type of hash is it and let's
say it's a an md5 for an argument's sake
an md5 and then what character set are you
going to use are you going to use simply
26 characters for the 26 letters of the
alphabet you know that there's no chance
of numbers ever showing up let's say that
let's say you're building one for your
company to do password audits which is a
valid application for this you're a
security officer you want to make sure
that that your employees are using good
passwords or whatever which if you're
using a basic character set you're not
but it won't go there you want to do an
audit to make sure everybody's changing
their password or something every so
often you can create a rainbow table
based on just the character set of the
26 alphabetic characters and it's going
to make a pretty big file but not nearly as
big as if you also know that you require
them to put a number in their password if
they have love is their password and you
know it's an easy word to figure out and
it's um it's all alphabetic characters
then you make a smaller table there's no
point in checking for numbers if you know
it doesn't exist however if you their
password requires a number and it's love
14 then you add the numeric characters or
if it requires special characters or there's a
potential of special characters you want
to add those to the character set to you
that you use to build your table so love
underscore 14 exclamation point becomes a
more complex password and you have to
build larger and larger tables to account
for this and your success probability
falls into play here the smaller you make
the tables the lower percent chance the
lower space that you're making available
to use these passwords it's going to try to
smart do it as smartly as it can but
you're going to basically it's a law of
diminishing returns another statistical
term mathematical term your law of
diminishing returns is the smaller this
table is you're going to get a base
percentage chance of success let's say
it's you start with 50 percent chance of
success when it's a five gigs file I don't
know as you move towards 60 percent it's
not going to take another 10 gigs it may
take 12 gigs and then for you to get a
70 percent success rate it's going to
take even more so the closer you get
towards that 100 percent success rate the
larger your files are going to be so if
you go for absolute perfection a
character set that includes every special
character including a space people
forget about the space special characters
spaces numbers alpha huge character set a
complex algorithm and you want a hundred
percent success probability first of all I
don't know that you can actually get a
hundred percent I'll stay I'm not sure do
you know if that's if it's possible I
think it is you run into a little bit of
trouble at the edges with basically chains
merging you through that you can run into
some limitations in terms of the space you
can search but you know in general you can
get very close to that yeah so there comes a
point where you're saying you know what if I
can crack 97 percent which is a number I
see quite frequently or even 70 80 percent
whatever you're you're comfortable with
you generate that table and that's about
the success rate you're going to have in
cracking it now again if you go with
simpler character sets and lower file size
you can still get a higher success rate
for that lower file size and when you
increase both of those variables create
more tables you're getting a higher
percentage chance and the other thing
that's important to note is that these
tables are portable this is the other
really cool thing there's no point in
anybody ever recreating another rainbow
table if someone's and has created it
it's going to work universally we said
earlier in the beginning that that hash
that's generated with that algorithm is
going to be universal if I create the
password love on my machine and Decius
creates it on his machine using that
same algorithm with say Windows NT
password it's going to create the same
hash therefore the same tables are going
to work on both of our machines so if
you've ever been to maybe hacking
conferences or seen websites where you
can buy or download rainbow tables
that's absolutely fine understand the
character set that they've given you
you know don't don't download or buy or
whatever a CD that only has alpha
numeric alpha numeric and you know your
passwords have special characters you know
but then there's that trade-off the
size that comes in do you want to buy
everything on one DVD or you're going
to buy 20 DVDs how thorough do you want
to get so the portability is an important
thing and again the huge file size I
can't emphasize that enough you could
probably take 20 gigs if you wanted to
go I would say if you wanted to get 90%
success rate on a really full character
set it would take at least 20 gigs of
data to get you even I don't know 70% or
higher maybe as high as 90% I don't
even think you'd get that much out of
20 gigs so to put it in perspective in
the in the in the in the paper it depends
it depends totally on the hash in the
paper they were using the empty land
manager hash and they they were able to
crack 99% with with 1.5 megabits of data
or sort of gigabits 1.5 gigs of data so so
so you know when they they weren't
running you know sort of one of the
tools that's available they were they
wrote their own code to sort of prove
their concept but they you know they you
know 1.5 gigs is is you know pretty
manageable amount of space these days but
you know if you're if you're talking
about a different kind of hash that has
larger like a you know Shaw you know
512 hash I guess produces I think it
produces longer output you know that's
obviously going to take more space to
store and so you're going to end up with
bigger files yeah that's a good point
there yeah the length of the of the
hash that's generated is absolutely
another variable that I didn't even
think about you're absolutely right that's
that's a good point as well as that as
well as the length of the passwords in
question I mean you know if you NT lane
manager is a hard limit in terms of the
length of passwords but if you've got some
hashing algorithm and you're looking at
longer and longer potential passwords
that then that's going to require you
know more hashes be done and so that's
your table there all right well I'll tell
you what let's go into a little bit now
again this is kind of tough to do over
the radio but we'll wait till the plane
overhead passes but we're about it let's
see we've got about 10 or 15 more
minutes left and I I would like to
discuss the the math part of this now
understand that this is going to be kind
of difficult to illustrate so we're
going to do our best to see if we can
make this make sense but this is pretty
complex math again if you go back to the
original paper if you really want to do
some independent study do a search for
Dr. Felipe I hope I'm pronouncing that
right Oshlin he's gonna like rainbow
tables the first link you're going to
get off of Google will have a link to
this paper yeah it's you can find it
pretty easily but the I guess the two
important things to keep in mind when I
start are that that the whole point of
this is to reduce is to is you know
instead of storing a hash of every single
possible password I want to restore less
data than that and have to search less
data than that you know even if you
should tweak the settings out you know
with your rainbow table generator so
that you know you're generating huge
tables that take up a lot of space the
space that they your tables take up is a
fraction of the space that they would
take up if you were just storing ever
all of the hashes in the password space
that you're searching and so that's
really the power of this technique and
the second thing to keep in mind as we
said is that a hash is a one-way
function data goes in and it comes back
out junk and that junk is always going to be
the same if the input was the same the
output's going to be the same and so the
way it works is as follows you generate
these things called chains they're hash
chains and when you start with a potential
password for example and you hash it and
you get the result then you take that
result and you hash it again and so you
get the third result and you hash that
again and you get the fourth result and
you hash that again and get the fifth
result and so in theory each one of these
each one of these you have all these
functions chained up in a row and for
each one you have an input and an output
the input is a potential key that you
could be trying to that you could be
looking for a potential password and the
output is the hash that would be stored
for those for that password and so you
build these chains and you store in your
you know and these chains can be 10,000
hashes long for example and you build you
know you know tens of thousands or
hundreds of thousands of these chains and
but when you what you store to disk are
just the first and the last entry in each
chain so that's where you get your sort of
reduction in the in the space you have
this table that has you know for each
each one of these each one of these
functions of the chain is a is a password
and it's associated hash but all you have
to do is store the first and last one in
each chain and so the other say you know
you know 9,999 that you threw out or
98 that you threw out you don't have to
keep them on disk and you don't have to
search them and so that's really where
you're getting your your performance
enhancement from so let's say you're
trying to crack a password hash that that
you pulled off of a machine you've got
this hash and what you do is you make a
change starting with it you hash it and
then you take the result and you hash that
and you take the result and you hash that
and so in our in our example we did this
ten thousand times so you're going to do
it ten thousand times and then for each
of those ten thousand answers you're going
to search your your tables that you
stored and see if those that that
password appears in it for any of the
chains that you have as the last entry in
the chain and so if you if you think about
it when you when you get a match what
that means is maybe I'll frame things a
little bit more simply so that so that
it's easy to think about let's say each
one of the chains I originally generated
five function they iterated the function
five times so you've got you've got number
one or number number one and number five
stored in your in your database instead
of ten thousand let's and let's say
somewhere within that huge list of chains
there's a chain that when I when I generated
originally had the actual password that
I'm trying to crack in it and it was the
third one in the chain you know if you take
that password and you hash it you're going
to get a result which is going to generate
a result when it's hashed and so the last
one in that chain is going to show up in
my list if I take the password I pulled
off the machine or the hash that I pulled
off the machine and I start hashing it
over and over again because it's an
iterative function and it always reaches
the same result and so once I found a
match in the in the table for the for the
that matches one of the one of the
results of my iteratively hashing the
thing I'm trying to crack all I can
take the first you know because I saw
the first and the last entry in each
chain I can take the first entry in that
chain and start iteratively hashing it
until I get to the thing that I was
looking for and of course the value that
produced it is the password that may be
difficult to follow but that's really the
simplest possible way to explain it
all right I think actually that I think
that was very good actually I think
keeping it down with a small number of
five I think is a very good way to kind
of demonstrate this that you find that
last one and you can back you know that
you've narrowed it down that there's an
overlap there it could really help if you
try to do it on paper if you try to write
this down you take a number you hash it you
take it that result and hash it and make
a chain of five and and then you and
then you and then you pretend that you
pulled the third one in that chain off
of off of a computer and you make five
hashes of it you'll see that the fifth
one in your first list is the you know
the third one in your second list and so
you have a match and you can see that
based on the first one in the list the
first list you generated you could get
back to the third one so if you if you
just kind of if you just kind of lay it
out on paper and try it you know
hopefully it'll make sense I think that's
excellent I think that was a very I think
that was a great job in explaining and I
think that is understandable and also
just to kind of reiterate something you
said too is that you know that these
iterations are going to both work out the
same that they're going to come up to
the same conclusion because you're
reiterating your I don't know if that's
a proper way to say you're you're coming
up with the the iterative hash of the
hash before it and the one before it
which goes back to that original
password and as we said at the beginning
of this conversation because of the way
a hashing algorithm works it's going to
create the same hash so you're all
starting from the same place so the um
uh there's something that um I think
important to uh to explain there's two
things that I need to explain and I I'm
gonna I'm gonna uh sort of go backwards
here because I think that one of the
things I want to explain helps people
helps um you know you understand this a
little bit better uh when you um the
thing that I I you know I have kind of a
criticism of the use of of rainbow tables
um I know that is that that I I I you
most people have lame passwords uh they
have passwords that are based on dictionary
words uh and so if you've got this if you
think about this hash train when you take a
password like love and you md5 hash it
you're going to get a bunch of gobbledygook
and then if you hash that you're going
to get more gobbledygook and so if you
look at one of these hash chains even if
you started with something which could
reasonably be a password most of the
entries in the chain are going to be
gobbledygook that is highly unlikely to
be someone's real password uh and so you
know if you do this you know if you have
32,000 chains with uh you know uh
with uh with 10,000 entries like
eventually you know some of those things
are actually going to be dictionary
words uh but it's just sort of at random
that that happens it's kind of random
exactly and so uh if you were to take
a dictionary which had you know maybe
three hundred thousand dictionary words
in it uh and permutations of the words
and you were to hash all of them
chances are good that you would end up
with a with a search space that's
smaller than most uh than than your
typical uh uh rainbow table and the the
so the thing is that and and i mean you're
going to find you know eighty percent of
uh the passwords you'd expect to find in
the real world that way uh and so you
know where you get a real advantage out
of rainbow tables is when you're when
you're really trying to crack uh you
know very uh sophisticated passwords
um that might be the kind of gobbledygook
you're going to get out of reiterating
this hash function um so uh you know i
think that sheds a little bit of light
onto to how this thing actually works
but it also goes to say like i think
there's a lot of people who are who are
employing these tools who you know who um
you know could get away doing something
much less complex uh uh you know and and get
um you know a similar kind of result out
of it in terms of uh in terms of the uh you
know the effectiveness that it has in you
know finding bad passwords uh i guess the um
the other thing that i should explain is
that the the sort of algorithm that i just
that i just described to you is a very
simple simplified explanation and it's
really an explanation of the kinds of
things that uh that helman was talking
about uh and how many didn't coin the
term rainbow table to refer to his uh his
his uh innovation um and you know and then
revest built upon what helman did and uh
uh felipe built upon what revest did and
felipe uh uh his algorithm is what is
really referred to as rainbow tables but i
haven't dug into this deep enough to
really get to the difference between what
felipe is doing and what helman is doing
uh but basically there when you're
iterating through these hash functions you
don't just take the result of the hash and
hash it again in reality you also send it
through this thing called a reduction
function uh and the reduction function um uh in
in helman and revest's versions was always
the same and uh this created a real serious
problem with chains merging uh where
basically uh you know you start generating
a chain and eventually it sort of syncs up
with another chain that you generated
previously um and so in order to combat
that what felipe did was change the
reduction reduction function every single
time he iterated which um reduced the
probability of having chains merge uh and
so um he gets a lot of performance
advantages out of that but uh the uh you
know and so and so you have to have um in
order to really have a rainbow table quote
unquote you have to have a reduction
function that changes at each generation
but uh you know getting into the details of
what a reduction function is and how it
plays in is you know sort of information
overload for this radio show
um the other thing that i want to point
out is that when when helman was thinking
about this stuff originally he wasn't
trying to crack passwords uh and in fact
like i think helman would have strongly
advised the folks that were designing some
of these authentication systems to use
assaulted hashes so that um they were
still you know well outside the the reach
of uh uh you know rainbow table that you
could generate on a you might imagine
generating on a pc uh but um you know what
what he was trying to do is he was trying
to crack encrypted files and you can use
rainbow tables to do that and the scenario
you know a lot of files have the exact same
header uh you know maybe information
within the file is different the first you
know maybe n bytes of the file are going
to be the same regardless of of what's in
it uh and you know a lot of times this
happens just kind of through force of
habit like how many c++ source files have
you seen that start with a slash and then
a bunch of asterisks of uh you know a lot
you so so if you if you took that sort of
header and you assume that's going to be
the front of a lot of files that might be
encrypted that i want to decrypt then what
i can do is instead of doing a hash in my
when i'm generating my rainbow table i take
that text and uh and i uh and i and i
say that's encrypted with a key and then i
take the output of that death encryption and
use it as the key for the next death
encryption and i do that iteratively
instead of hashing the hash uh and you
know what i end up doing is getting a
rainbow table for a file a particular
header encrypted with every possible death
death key and so if i have an encrypted
file that starts with that header i can
check uh my rainbow table uh and uh you
know for that header and um hopefully find
the key and then i can encrypt the file
and so uh you know if you if you were to
generate you know you know a huge collection
of these deaths uh uh rainbow tables then
you could uh then uh you know with a large
number of sort of common headers uh and
you were trying to uh uh uh crack um open a
file and you could guess uh the first few
characters of that file uh you might be
able to uh decrypt the whole thing this
way uh so um i think that's uh i think
that's a pretty interesting uh aspect to
this too that you don't see a lot of
people uh talking about necessarily
right right well i tell you what we're
running kind of low here so uh the one
other thing i want to do and if there's
anything else you wanted to talk about i
wanted to at least throw some of the
tools out there so that people do want to
follow up and play around with this on
their own and kind of see if they can
understand it better just from playing
with the tools that are out there is
there anything else you wanted to cover
before we move on to that
uh no i'm done yeah i think that i think
it's a great i really like the the and i
agree agree completely with the point of
the dictionary attack um and it kind of
goes back to what i was saying earlier
about the plain character sets if you're
just using new alpha alphabetic characters
you know it's probably dictionary words
most likely then yeah it's probably not
going to pay off for you to build a
rainbow table for something like that
however i think more people are still
going to use it because of the
universality of it i don't know if
that's a word universality that if you
make you know get that 97 99 or whatever
for 1.5 gigs a lot of people might just
go with it for ease of use it may it's
not going to be the most efficient there
are better ways but it will still
probably work so i don't see that i see
people still using it that way um some
of the tools of course um you know one
of the the obvious one is rainbow crack
um but there's another one out there
called oph crack which is very good
uh there's a windows tool called uh win
rt gen which i think the original was
called rt gen which rainbow tables
generator there's a win rt gen that i
like a lot i think it's really cool and
it's a great tool to download and
understand what we're talking about
with the character sets and the
algorithms you can actually see that on
the fly and it will do some estimates
and calculations change some of those
variables and watch how your
percentage of success drops as opposed
to how many files you have to create to
make better success better success rate
excuse me um in addition to that
because once again the universality of
boy i hope that's a word i'm totally
using it the the files are universal
and they're going to work no matter
which computer they were generated on
because the way hashing works
they can be done online there are a
lot of companies now i don't know if
companies there are a lot of people
that are charging that if you send them
the hash they'll run it through their
rainbow tables to their website or
whatever and charge you a price for it
and and do the work for you so there
are a lot of um places i've seen
popping up lately to do it online what
i would like to see and i'll throw
this out to the community i would
really think it would be cool if
somebody out there who had a really
big box were to make that kind of
service publicly available i think you'd
get a lot of hits i think a lot of
people would be interested in that if
you were to take a big several hundred
gig or multiple hard drives store a
bunch of very large rainbow tables a
lot of them have already been
created like i said you can find the
ones that are already done and there
are people out there sharing them and
make them put them on the website
not so much for download because it
kill your bandwidth downloading
gigabytes of tables but maybe a way
that people could submit hashes and
have the work done have it queued up
and have it mailed back to them or
something along those lines i think
that would make a very cool community
project but there are some people
that are doing it now is pay sites and
a lot of the security tools cane and
able i know has built in right click
for um to submit a hash as well so a
lot of the security tools are going
that route to give another option
instead of just a brute force
dictionary attack they're offering
this and i even saw i don't think
there's any i don't think it hasn't
been started yet but i saw a project
has been created for a distributed tool
for rainbow table generation because as
we said it also takes a lot of power
and time to generate these up front so
that might be a neat distributed project
so uh that wraps it up for rainbow
tables at least as far as we're going
to get into them on this show um and
truthfully if anybody does find them
more interesting and wants to go
further this is the point where they
really need to take the initiative and
go out there and really read because it
does get so much more complex i mean i've
had trouble wrapping my head around a
lot of it and that's why i thank you
desius for helping me understand it
better as well as our listeners because
it is something that you know i like to
understand not only what it's doing but
why and how it's doing it and i do feel
like i've i've gained that out of this
episode so hopefully the listeners have
too um as we wrap it up um only reminder
i have is that this friday our BinRev
meeting so if you have a BinRev meeting
nearby or if you want to start one
contact us um but BinRev meetings this
Friday and i'll kick it over to you for
any shouts if you want to say give
shouts out to anybody i'll let you go
with that well i'll shout out to uh to
rattle and uh and acidous uh who uh who
may be out there uh uh listening to the
show and uh i think for uh for having me
on again i always like uh uh get the
opportunity to talk about this kind of
stuff so uh um and we and we love having
you we love having on the show and i think
this will be i'm pretty sure this will be
a very popular show i think a lot of
people are going to learn from this
because most people stop after they see
how it works or what it what it does i
should say and now they're going to know
a lot more about how it works so um and
i yeah totally acidous um virgil i spoke
to an email not too long ago so it's good
to talk to him again um and we're actually
i guess under announcements maybe next
week we'll announce more detail but i've
been working with emmanuel to try to put
together some events for hope so once we
get some of that ironed out we might have
a few cool surprise events going on at
hope um so let's see site of the week
uh i have a site out there we have a we
have a little project site we created
that seemed to be in demand um it's called
hacker events.org all one word hacker e-v-e-n-t-s
dot org and it's nothing but i threw up an
open source calendar client on there people
can go submit um events that are upcoming
there's so many uh local cons smaller cons
now meetings etc that i thought it'd be
kind of useful to have one central calendar
anybody can submit so if you have a local
linux user group meeting put it on there
i've already put on the 2600 meetings for
the rest of the year bin rev meetings
defcon meetings etc etc i put on hope
defcon all the conferences that were
announced at the time when i was creating
it all on that calendar so you kind of
look ahead and see make your plans around
where you want to go etc etc if you have
any feedback on the show radio at bin rev dot
com that's the only place that we're going
to read emails on the air if you want
them anything else you send it to i get
people send stuff to my personal account
or something um i'll read them i don't
know that i'll always get back to you
because i get a lot of email but radio at
bin rev dot com will always be read by
one of us and possibly read on the air so
make sure you send it there only um our
closing music tonight is it's a track
called code monkey which is pretty much
what my job is one of my favorite words
i use on the show i am a code monkey the
song is called code monkey it's by
jonathan coolton calton c-o-u-l-t-o-n
and the website is jonathan calton dot com
so google for it if you can't find it and
that's it desius once again thank you for
being on the show we're probably a couple
minutes over so i guess in between coughs
here we will tell everybody that we will
see them next week same hack time
same hack channel we're both coughing and
trying to get it out next week later
code monkey get up get coffee code monkey
go to job code monkey have boring meeting
with boring manager rob rob say code monkey
very diligent but his output stink
is code not functional or elegant what do code monkey think code monkey think maybe manager want to write god damn login page himself code monkey not say it out loud code monkey not crazy just proud code monkey like fritos code monkey like dab of mountain dew code monkey very simple man
but they've worn fuzzy secret heart
code monkey like you
code monkey hang around at front desk till your sweater looks nice
code monkey even better look nice
code monkey off or buy your soda bring your cup bring your ice
code monkey have long walk back to cuticle he sits down for the soda cause soda make you fat
you busy with the telephone
no time for chat
Code Monkey have long walks
back to Cue the Girl
he sits down with his hand to work
Code Monkey not thinking
so straight, Code Monkey
not feeling so great
Code Monkey like Fritos
Code Monkey like
Tab and Mountain Dew
Code Monkey very simple man
big, warm, fuzzy
secret heart
Code Monkey like you
lots
Code Monkey
have every reason
to get out this place
Code Monkey
just keep on working
see your soft pretty face
much rather
wake up, eat a coffee cake
take bath, take nap
this job
fulfilling in creative way
such a load of crap
Code Monkey thinks
someday he have everything
even pretty girl like you
Code Monkey just waiting
for now
Code Monkey says
someday, somehow
Code Monkey like Fritos
Code Monkey like Tab
and Mountain Dew
Code Monkey very simple man
big, warm, fuzzy
secret heart
Code Monkey like you
Code Monkey like he
someone who thinks is amerieszka
and miss you
a lot of