And hello again, everybody. A few minutes ago, you just heard my voice, and you've probably had far, far too much of that today, but we are actually going to give you another hour and a half of, hopefully not so much my voice, but our returning co-host to the show, Verbal, to continue a topic that we started episode 162, actually, I believe. Is that right?
Yes, that's correct.
And this is episode 164, the second episode of today's doubleheader. For those of you listening to us live on the stream, we hope you're enjoying three hours of all hacking goodness, and for those of you on the podcast, well, I guess it doesn't really matter if these were back-to-back when they aired live on September 12, 2006 or not, so I guess, yeah, you really don't care, do you?
So, since this is the second email of our doubleheader for this week, I kind of, actually, I think this is kind of cool, doing two episodes back-to-back, I think this is kind of a, I don't know, it feels like very much like a baseball, football, sports, you know, we're doing back-to-back episodes, we're pulling an all-nighter, I don't know, it sounds, it just feels kind of weird, we've never done this before, so it's actually kind of cool.
And since we're doing this...
Sports analogies you lost me, sorry.
What's that?
Sports analogies you lost me.
Yeah, you know, surprisingly, well, not surprisingly, they're lost on a lot of, a lot of hackers and geeks are not into sports, but, yeah, we won't, we won't insert any NASCAR jokes here, that was Duel's job to give me the NASCAR jokes.
The continual left turn.
Anyway, since we are on the second episode of the doubleheader, that means there's really no housekeeping this week, except verbal, unless you had something you wanted to bring up about the mentor program, how is that going?
Yeah, I want to talk about that a little bit.
Right now it's actually going really well.
I'm getting a steady stream of people asking to participate in the program, but right now we actually have a little imbalance of mentors and mentees.
We need about three or four more mentors, because I have some people waiting to be paired, so if you're listening to the show and you would like to donate your time to mentor someone, you know, whether it is just, you know, Linux or whether, you know, it's some programming or networking knowledge, whatever you feel you can offer.
Send me an email at mentorship.com and, you know, tell me, and, you know, it doesn't take too much time.
It's just like one or two hours a week, and you just basically have to help your mentee and, like, you know, guide them and answer questions for them.
And so, you know, if anyone has time, it would be greatly appreciated.
And you don't have to be, and correct me if I'm wrong here, you don't have to be, like, this master know-it-all of every topic in the world.
If you're a Java programmer, for example, for a living and that's what you're really good at, then you can certainly mentor somebody because people are wanting to learn that particular skill.
So you would absolutely be a great mentor.
Right.
I mean, the whole point of this program is to facilitate, like, the exchange of, you know, ideas and, like, helping each other learn.
So if you're good at one thing but you don't know anything about anything else, you know, that's fine.
Just, you know, teach someone what you know, and then in turn, someone else will teach you what they know.
Right, right.
And, you know, like you, I think you mentioned this a couple episodes ago, too, and I completely am with you on this is I'm looking forward to having someone else mentor me on topics that I'm not as familiar with.
So it's a great way to share some of the things you are familiar with and learn some of the things that you are not.
So it's definitely a cool program, and I don't know if we're going to have anything up by the time, maybe by the end of this upcoming week, we will have some pages up.
I don't want to put us on a deadline or put you on the spot here, but we are working on getting some, getting the site to be a little bit more interactive with the mentoring program so that people are able to kind of get some ideas, share information with each other, and kind of watch the progress of some of the teams as they go along.
So I think we're going to be working on that for this, the rest of this week.
So I'm sure we'll make an announcement on the show as well as in the forums about that when it happens.
Yeah, so what I wanted to do is to put up, like, a wiki or some other type of, you know, dynamic webpage where teams that are participating in this program will put up, like, their syllabus and, like, their progress.
So, you know, you can reference other people's information, and hopefully after a while we'll get a good collection of, like, coursework, you know, not coursework, but, like, a good collection of information for, like, oh, if, you know, if you want to learn, like, you know, some particular thing and you either don't have time or your schedule is, you know, really weird, then you can just go on that site and follow what someone else has already done, you know?
Right, and there's no point in answering the same questions multiple times, so maybe it'll turn into kind of a frequently asked questions repository of specific things.
Right, right, yeah, definitely, definitely.
But anyway, we'll see how that unfolds.
This is all something we're kind of trying to figure out the best way to do, so keep your eyes open for that.
And other than that, again, I don't have any housekeeping.
Did you have anything else, or was that it?
Yeah, I think that's it.
All right, so we do have some e-mail, though.
I split the e-mail up amongst the shows as I felt it was appropriate, and there's some e-mail this week that I thought would be good for us, so let's check that out.
Radio at BenRib.com
Okay, and our first e-mail this week comes from Bob.
Bob says, I use Gmail, but I'm also curious to know how secure Gmail is, and is there a better solution?
I like the ability of being able to check my e-mails from anywhere.
Well, I'll interrupt momentarily and say that pretty much any web mail client will give you the ability to access e-mails from anywhere.
And personally, I use Yahoo Mail, which has, by default now, SSL connections, so that's one alternative that I'm familiar with.
But to continue, he says, do I need software on my computer to encrypt e-mails, i.e. Thunderbird or Outlook, or can I do everything from the net?
If I must encrypt from a program on the computer, what's the best choice, meaning which encryption software and e-mail software are best?
Side note, I've only listened to episodes 1 and 2, and the latest, number 162, which is the one that Verbal and I did.
And I'd like to say that I have given some thought about the definition of a hacker.
I know you're not allowing more discussion about the term hacker, or perhaps you've talked about it in other shows, which we have.
And I'll find those in due time.
All in all, here's my two cents worth.
A hacker is anyone who analyzes systems for vulnerabilities.
What they do with these vulnerabilities defines them as either black or white.
I'm sure he means black hat or white hat.
And if you're too stoned to figure out what to do with the vulnerability, you're a gray hat hacker.
All right, well, thank you, Bob, for the e-mail.
Tell you what, Verbal, since this is kind of a follow-up on last week where you were asking me and posing to the audience,
you know, are you using secure e-mail and encryption and stuff like that.
Why don't you field this one a little bit?
Specifically, well, let's start with maybe the, his first question is,
do we need software on his computer to encrypt e-mail, such as Thunderbird or Outlook,
or can I do everything from the net?
Why don't we start with that?
Okay.
So, actually, I mean, first of all, he was saying, he was wondering how secure Gmail is, et cetera.
You said that Yahoo has SSL.
Do you know if that's SSL for the entire duration of the connection or just for the login?
I believe, yikes.
Actually, that's a good question.
And while you keep answering, I'm going to look that up.
Okay.
So the thing with Gmail is I think if, you know, if I'm wrong, please e-mail in and correct me.
But I think that when you log in, your password is encrypted and it's not transmitted over clear text.
But after you log in, I think everything else is done in clear text.
So if you, like, send an e-mail from Gmail without encrypting it or whatever,
then, you know, someone sniffing the wire will be able to see all the clear text things.
Okay.
Now, normally, let's say you're doing, like, Thunderbird or Outlook or whatever,
and you want to encrypt your e-mails, you can get some software like PGP or, I mean, sorry,
GNU PG or, like, PGP or something like that.
And then it will kind of be integrated into the app and it will do it for you.
You don't have to, you know, do it the getaway where you run the command line tool and you, you know,
put in the text and you get out, like, you know, an armored output where, you know,
then you copy and paste it.
Now, with Gmail, there are plug-ins that you can use to encrypt your e-mail.
If you just go to Google and search for, like, Gmail encryption,
you'll come up with multiple hits for encryption modules for Gmail.
Now, but the thing is, you mentioned that you wanted to not have to install programs, you know,
or do whatever and, like, you know, say you just wanted to check your e-mail at, like,
a local cafe or wherever there's public Internet access and have that encrypted.
That I don't think is possible because Gmail itself doesn't provide encryption.
So even if you did get one of those web-based encryption add-ons for Gmail,
you would have to download, say, a plug-in at the very least for, like, your Firefox,
and that'll do the encryption for you.
Now, when you get the plug-in, you might see a button, you know,
and, like, some UI integrated in your Gmail, but that is not, you know,
that's not going to be there if your browser doesn't have the plug-in.
So if you want to just go to some random place and check your e-mail over the web,
then I don't think you're going to be able to do that without installing any software.
Now, definitely installing a plug-in for Firefox is much easier than, you know,
say, you know, doing Thunderbird or whatever because, you know,
you just install the plug-in once and, you know, you don't have to worry about it.
Now, the other thing you can do if you truly want to, you know, be mobile in that sense
is you can store stuff on, like, a USB key.
Now, I know some public terminals don't let you plug in your USB stuff,
but most of them, you know, if it's, like, a place where you're supposed to be using the computer,
they'll let you plug in your USB drive because, you know,
maybe, like, they'll have a printer service available or whatever.
Now, if you do that, then you can install a program on your USB drive that'll do encryption for you.
Or maybe, you know, you can just install, I mean, they'll put a plug-in on the USB drive
and install it wherever you go.
But, you know, as for what you really want to do, like what you're asking,
I don't think that's possible.
Now, there are other alternatives for sending, you know, that do encryption.
I think one of them is called CryptMail.
I was going to suggest that.
But there are definitely web-only solutions for sending encrypted mail.
But the problem with those is, for some reason, even though it's all public keys
and, like, you know, it's a regular PHP standard, you have to, like, for some reason,
they only let you import and export keys to import in the same system.
Like, the two that I've tried does this, and I think it's because they want you to get other people
to use their email system.
But there should be no reason why, you know, you have to do that.
I didn't realize that that was the way it worked.
I thought that they offered just the encrypted using your public key and everything.
I didn't realize that you could only do that with other users.
I thought it would accept any, but I really don't know.
I did, however, look up, and Yahoo is exactly what we suspected,
and that is that it only encrypts, it only sends the password through SSL,
and then it goes back to an open connection.
So your actual email contents would be sent in clear text.
Yeah, so, yeah, most of them do that.
Right.
But Yahoo used to be that Yahoo even sent the password in clear text,
and they had a secure option, but you had to go out of your way
to go to the HTTPS URL to get to it, and now they do it by default.
So they've at least taken a step in the right direction.
But the problem is that when you're encrypting all this,
it adds a little extra overhead to every packet, basically.
It's going to be encrypted, which makes all the data a little bit larger.
And it's not a big deal when it's just one account or a handful of accounts,
but when you're a giant megalo corporation like Google, Gmail, or Yahoo Mail,
or MSN Hotmail, or whatever, it adds up pretty fast when you've got millions of users,
so it becomes a problem to encrypt everything.
However, that's one of the drawbacks of using these public free webmail things.
Now, you can always set one up yourself, verbal, as you're well aware.
You can always set up a webmail client of your own.
You can use, gosh, there's Squirrel Mail.
There's Horde, which I like.
There's just too many to name that you can set up and run if you have your own server,
and then you do have full control,
and you can certainly encrypt all traffic going to your mail server.
And that stands also if you're using, he mentioned in his email,
needing special software like Thunderbird or Outlook.
Well, those are just clients.
With any client, most of them support secured methods of transportation or transport of your data.
It's just properly configuring your server and setting it up to use it.
So there are certainly options available,
but you really have to have control of the server that you're interacting with,
and when you're using one of these Gmail or something like that,
then obviously you don't have that kind of control.
So the only other thing is what I think you kind of alluded to earlier is,
and I was going to suggest the same thing,
is a USB key and have your PGP key on it,
and encode or encrypt your individual email messages anywhere you go.
Yeah, there should be, I mean, I've not looked into this,
but it wouldn't surprise me if there was like a PGP online.
Like, you can just put in your key,
and then you can, you know, encrypt it on some web page,
and if it doesn't exist, someone should just write it,
because it'll be very useful, you know?
Yeah, I'm not sure.
Something doesn't feel like it's that simple about that, though.
I can't quite put my finger on it now on the spot,
but it sure would be handy.
Well, I mean, it's like you have PGP running on the box,
so, you know, it's just like a web interface where you have the text,
and you just pipe it to PGP,
and it spits back out the encrypted message to you.
I mean...
But you'd have to have your private key and your public key to be able to...
No, you would only need to do that
if you want the website to decrypt your message for you,
not if you encrypt it.
So if you just need to encrypt an email to someone,
then you can just have their public key.
Now, if you wanted to sign it,
then, you know, you would have to give them your key.
Right, that's okay.
But, yeah, you know, if you just want to encrypt someone,
you just need their public key, and then you're all set.
Yeah, for that, it seems like there probably already is a website.
If anybody knows of any, of course, email us, radio at binrev.com.
I would love to bring that up on the next episode,
because that would be very handy for our listeners and for myself as well.
Right, right.
So, now, at the end of the email,
you talked about the definition of a hacker,
and I don't want to spend too awful much time,
because we have done that on multiple episodes before,
but I think everybody's heard my rant of how I have a very,
not my rant, maybe so much my explanation,
that I have a very liberal definition,
liberal definition of the word hacker,
as, you know, anybody who really thinks outside of the lines,
who doesn't take no for an answer,
who does not accept limitations of any kind in anything.
So, to me, it's not even, you know,
people say hacker, you assume computer hacker,
but to me, hacker means anybody who thinks outside of the box
in any particular thing.
It just so happens that usually they do end up being computer people.
But did you have anything additional?
Did you have any thoughts on that, or?
Right, well, so Bob said in his email that, you know,
he was saying, like, someone who analyzes systems or vulnerabilities,
and, you know, depending on what they do with it,
they're either a black hat or a white hat.
You know, like, so my definition of a hacker,
if I did have one, because the other show, on 162,
I mentioned that I really don't like that word,
but if I had to, you know, give a definition,
it would definitely not be as liberal as yours.
But the thing is, you know,
I think Bob's definition is a little too, you know,
narrow for my liking, anyway.
You know, because it's like,
in his definition,
it's just people who deal with, you know,
system security, whether at the host level
or at the network level.
And, you know, security, as, you know,
I assume he's mentioning, right,
since he said vulnerabilities,
I'm assuming he's mentioning, like,
finding exploits, and then either patching them
or, you know, finding holes and exploiting them,
you know, it's like, which side of the fence are you on?
But I think there's more than that, you know?
Like, because I would, I normally would include
other fields, like coding,
like writing good and elegant and clever code
and, you know, being hacking.
Or, like, you know, even with, like, phone freaking,
which I know nothing about.
But, you know, from noting some of you guys
who are really into that, you know,
there's definitely an element of hacking in there,
you know, that mentality.
So, I mean, to me, it's more kind of like
a personality trait,
but I would limit it into, like,
the field of technology.
Like, I wouldn't, you know,
call some, like, writer of novels
who, like, does clever things with the pros a hacker.
No, and I agree with that.
Let me, just to clarify,
I'm not saying that a writer of clever pros
or whatever, to use your example,
makes them a hacker.
But I'm saying it has the fundamental hacking mindset,
the potential of that person.
They think like a hacker.
That doesn't, and that's not to say
that they are a hacker.
Again, really, the word hacker only comes in
when technology becomes involved.
Whether, again, it's freaking, computers,
programming, coding, scanning,
system level, whatever,
that's when the term hacker comes to describe them.
But people can have the same hacking mindset.
That's what I mean to say.
I would never call someone who's,
comes up with a new style of writing
really a hacker per se,
or somebody who comes up with a new,
well, let me ask you this, though,
just for argument's sake.
I didn't want to go into detail,
but what about somebody like, say,
a scientist who comes up with a new application of,
I don't know,
something that ends up being the building blocks
to quantum computing.
So they weren't directly involved in hacking,
but they came up and invented a science
that ended up turning to technology.
Well, I mean, see, that's the thing.
Like, there's these gray areas.
That's why I don't really like to talk about it
and, like, define it.
Because you can't really,
I don't think you can put, like,
exchange boundaries around what is and isn't a hacker.
You know, like, in your case,
you can definitely make arguments either way.
Right.
So it's like,
I don't have an opinion on that, you know?
Right, and actually,
I think that's a good point that you said,
is, you know,
defining it,
see, the thing is,
the media and writers
and everybody out there,
they like to have definitions.
That's another thing I hate about the business
of the, quote, unquote,
security industry and security professionals.
They want to make up all these terms
and labels
and make up all these specific things
that they can call something
just to have a term or a buzzword.
I hate buzzwords.
They've got to make up some textbook definition
so that they can memorize it
and, therefore, take an exam
and become certified in it.
So they have this need to define everything.
I'm defining it only because
people do question it
and it helps explain it,
but I agree with you 100%
that there's no absolute definition
of the word hacker.
So I think that's all we have to say on that.
Let's move on.
Again, we've beaten that horse dead
on this show over the three-plus years.
Wow, that sounds weird to say that.
Three-plus years we've been doing the show.
We have one more email this week.
This one comes from Prince Vegeta
who says,
Dear hackers,
about having a backup phone system.
I rely on my copper line
and my free VoIP connection.
If you subscribe to Internet and Cable TV,
you get free VoIP connection
with 600 minutes for calling locally,
RDS networks,
and 60 minutes for calling normal phones,
R-O-M Telecom,
the national phone company.
Recently, a mobile phone company
named Zapp, Z-A-P-P,
introduced a new kind of phone service
called Zapp FixTel.
In translation,
fixed means an old-fashioned phone
that you can't carry around with you,
but with a twist.
They provide you with a phone
that looks just like a normal copper-lined phone,
but without an antenna,
much like an old mobile phone.
Here's the catch.
It is mobile.
It has no cable.
You could take it with you to work,
excuse me,
you could take it to work,
and you could carry it around,
but that's not very practical
because it's too freaking big.
But in case of emergency,
this new type of hybrid phone
could prove useful
because it's a new service
and wouldn't get dosed
when all the subscribers decide
to use it at the same time.
So he is obviously,
or at least I'm thinking,
he's probably listening
to one of our recent episodes,
the one that was called
Technological Independence,
because on that show,
we talked about having backups
to all of the things
that we've come far too reliant on.
You know,
if your cable modem goes out,
are you going to be scrambling
or shit out of luck
because you can't check your email
or because you can't make a phone call
because your VoIP is out as well
if your power goes out
and things like that.
So that's very, very cool.
I think that's a really interesting setup,
and I actually did a little
looking into this,
and obviously in the email itself,
you could tell that this was,
when he mentioned the word translation,
this is obviously not something
from the United States.
So I did a little looking,
and this is actually in Romania.
So where we have a large number
of Romanian listeners,
by the way,
so shouts to Romania.
You okay over there?
Yeah, I'm fine.
All right,
just making sure you're not dying
on me on the phone.
Now, that would make great radio,
but I don't want you to die on the phone.
That would not be cool.
We'd have the highest ratings ever,
but come on now,
stick with me.
It's kind of cool that,
it's actually kind of weird
because usually what people are doing
is having their VoIP line
as their main line,
and then their copper
as their backup.
But in this case,
you're ordering,
or having the original copper line,
and they're giving you the bonus
of the VoIP internet connection,
which is kind of cool
with the number of minutes.
And I'm certain that people
are going to be using those minutes
for their free long distance
and stuff first,
and their mobile minutes,
or whatever,
however you want to call it.
And the copper,
I would imagine,
wouldn't come into play
until you've run out of those.
So I think that's kind of
a cool setup.
What do you think the chances
of that ever happening
in the United States are?
Well,
I don't think
people care that much
in the United States,
to be honest.
Because most people
have a cell phone anyway,
and people don't like
to think about that stuff
in the United States.
They're just like,
ah, well,
you have a phone.
I mean,
I have a phone,
it's fine.
Like, most people I know
don't even have a landline.
They all just have cell phones.
Yeah, I know some people
like that too.
Like, it's a different
cloud over here.
Yeah, you guys out
on the West Coast
are a little bit different.
No, I know a lot of people
that are in the same boat.
They only have a cell phone.
And quite honestly,
I was so happy
when I lived down
in Fort Lauderdale
down there,
in that area.
I think I spoke on the show
many times
that how much I hated
Bell South,
which is our local telco,
our baby Bell.
And they required me
to have phone service,
basic phone service,
to be able to get
high-speed internet DSL
through them.
And my cable company
didn't offer it yet.
So when the cable company
finally came along
to offer it,
yeah,
I dropped my phone service
completely
and was on cell only
for the longest time there.
So yeah,
it's absolutely,
but if you're going to
make long-distance calls
and you don't want to spend
the kind of money
you have to pay
for a cell phone these days,
I mean,
you're right.
Skype for long-distance calls.
Well, yeah,
you're assuming
computer people too.
But like you said,
it goes back to people
in the United States.
Americans,
they don't care a whole lot,
which is sad in a way.
Apathy is my biggest
pet peeve of all.
But do you think
they would suddenly care
if their cable company
or phone company
came out
and instead of these
bullshit fake-bundled services
where they save you
two dollars
if you bundle shit together,
you think if a company
came up
similar to what
this sounds like
that says,
listen,
we'll give you your cable
and we'll give you
a copper line
that's reliable
that you can count on
and we'll give you
VoIP minutes
that you can use
for your long-distance calls
cheap and easy.
That's certainly,
the capability
is certainly there.
There's absolutely
no reason why
a company
can't do that.
I mean,
let's take a cable company.
They can obviously offer
the high-bandwidth
cable modems.
They can obviously offer
VoIP,
and many of them do,
but they're looking
at profit.
They're not looking
at the best interest
of their customers.
That's the difference
between the United States
and a lot of other countries.
We are looking
at the bottom line
profit for the company,
and there's not necessarily
anything wrong with that.
There's nothing wrong
with making money exactly,
but you cross a certain line
where you're raping
your customers.
You're not looking out
for the best interest
of your customers.
If a company were
to pop up right now
and offer these things
at half the price,
I'll give you
cell phone coverage,
I'll give you
copper landline,
I'll give you
free unlimited long distance
via VoIP
and high-speed bandwidth
and cable television
all for $75.
You don't think
Americans would suddenly
get interested in that?
I think they'd jump
all over that.
Well, now,
the thing is,
okay,
so the number one thing
I think is,
does it cost less?
So the thing is,
the cost,
and then,
like,
the functionality
or the features
is a distant second.
So let's say someone
has some setup,
like they get cable
for cable internet
and TV,
and then they have
a phone line,
you know,
for whatever reason.
And if someone does that,
you know,
the question is
whether or not
it will be cheaper.
Right?
Right.
So in your scenario,
are you saying
that it will be
cheaper or not?
I'm not sure
I understand the question.
I'm saying that
right now,
my cable company
for the setup
that I just described
to you would cost
easily $150
to $200.
And I'm saying
that right now,
they could do that
for half the price.
it would be cheaper,
right?
I'm saying it.
If someone came in
and, you know,
replaced existing services.
Yes.
Right.
So, I mean,
if it's cheaper,
I think most people,
that's enough for them.
Right.
And, you know,
if you tell them
that they can do
the same thing
that they did before
but for cheaper,
then most people
would just do it
for that fact alone.
Right.
Exactly my point.
And in addition,
you know,
if you're trying to put out
additional functionality
and features,
like,
they might get excited
about that,
but, you know,
most people
are not going to care.
So, if it's cheaper,
people are going to switch.
No, yeah,
exactly my point
was the bottom line
is price.
Ironically,
and maybe that is
an American thing,
and maybe that is
an American thing,
that ironically,
the companies are looking
at trying to make
the most possible money
they can
and raping the customers
for every little dime
and the customers,
on the other hand,
are looking to save
every little dime.
So, yes,
the price matters
to the customers as well.
There is no in-between.
There's no compromise.
There's no happy medium
where the company says,
well, we're going to try
to give you
all these services
at a little bit
less price,
and American consumers
would say,
oh, well,
I'll take that.
You know,
it's worth it
if the company's trying,
if they're a good company,
if they're conscious
of their customers,
et cetera.
There's no balance.
There's no acceptable
middle ground.
So, it's two extremes
competing,
and Americans are going
to go for the absolute
cheapest price,
period.
That's why VoIP
has been slow to adopt,
is because Americans
are skeptical of it.
And then,
as word has gotten around
that VoIP is,
and I use this word
hesitantly,
reliable.
It's kind of reliable
compared to regular phone lines
or cell phones,
the same way.
All of a sudden,
when people start adopting them,
that bell curve
took a giant leap
in number of people
adopting them.
So,
once people realize
and start trusting this
and realize they can save money,
then it can happen.
Now,
the problem with the scenario
I gave,
and I know I'm spending
too far time on this,
but this is one of my
sore spots,
so I'm going to rant
a little bit about this,
is the simple fact
that the scenario
I mentioned
of a new company
coming in
and forming
and giving that same stuff
for $75,
$100 with all of this.
Could you imagine
all your utilities,
your phone,
not all of them,
of course,
your phone,
your cable television,
your cable internet,
high-speed internet,
and a copper phone line,
and your cell phone,
all of that
for $100,
which to me
would be freaking fantastic.
That'll never happen
because,
oh man,
I don't want to turn this
into a big government rant,
but it is.
The government won't allow
that company to come in
and exist
because they over-regulate
everything.
The United States
is a place
where people
rather have quantity
over quality,
right?
You know,
we would rather
have six cheeseburgers
for $3
than have like
an actual real meal.
Like,
you know what I'm saying?
Like,
with that mentality,
you know,
if something is crappy
or whatever,
just as long as they
market it decently
and they can convince you,
it will probably be
about the same,
and it costs less,
then people are going
to use it.
Like,
okay,
let me tell you
a quick story.
I was talking to my mom
the other day,
and,
you know,
since I do computers
for a living,
she asked me,
like,
okay,
she said,
there's some,
the cable company
is like telling us
about this new
phone service
that they're rolling out,
and,
you know,
it's cheaper
by $2,
and one of the features
is if the power
goes out,
your phone will still work,
and she's trying
to explain
all these things to me,
basically like reading
the brochure,
and I had no idea
what she was talking about,
and then after,
after like,
like 15 minutes,
I realized
she was talking
about VoIP,
right?
Right.
And,
you know,
and I was like,
well,
I don't know,
you already have a phone,
and it works,
whatever,
but,
you know,
so she switched
because it was $2 less,
and when the power
goes out,
you can still use
your VoIP service,
but the thing is,
like,
so I took,
you know,
so after that,
I hung up,
and I was like,
okay,
well,
I don't really care,
she can switch over
a VoIP,
you know,
it'll be cool,
because maybe I can like
set up an asterisk
on a better place
and mess around with it,
but,
then I realized,
like,
if you have a regular phone,
and your power goes out,
your phone still works,
because the phone company
gives you power,
so it's like,
these features,
like,
you don't even need to
have them be new
and real,
it's like,
just say things
that sound good,
and people will buy it,
like,
people don't think
about these things,
so just have as many
bullet points,
and make it cheaper,
and people will adopt it.
Well,
that's all about marketing,
yeah.
Well,
I'll tell you what,
I'm going to take off
my tinfoil hat now,
and let's get into
the actual main content
of the show,
shall we?
Let's do it.
Because we actually,
we actually kind of
left off episode 162,
we kind of ran out of time,
I do think it wasn't
such a bad stopping point,
though,
but I do think we need
to do a little bit
of a recap
of how we ended
that episode.
In that episode,
we were going to go
into a little bit
more detail about,
I guess we'll call it
secured communications,
for lack of a better term,
but basically,
we found a good
stopping point
after defining
tunneling,
and what tunneling is,
the concept of tunneling,
so,
and by the way,
I don't know if you're
in a good,
getting good reception
on the phone there,
or whatever,
but if you're,
you're kind of garbling
up a little bit,
but I'm going to let
you talk about,
can you give us like a,
obviously we don't
want to rehash
the whole last,
that episode,
but maybe give us
a quick recap
of tunneling concepts,
I think it's important
that we re-address
the stack,
and how tunneling works,
because it is going
to become relevant
in the rest of this
episode of the show,
so can you give them
a quick recap on that?
Yeah,
definitely.
Okay,
so let's do this.
Now,
for tunneling,
you basically,
okay,
so I don't want
to use the same word,
but basically you're
transporting packets
that you actually
want to send,
but you're disguising
them as another type
of packet.
So with the example
that I used last time
for DNS,
you know,
tunneling IP
over DNS,
you have this network
stack,
and all it is
is the order
that your headers
go on in a packet,
and it's a stack
because it's,
you know,
first in and last out.
Now,
what that means is
you have these
abstraction layers,
right?
So we talked about
the physical layer,
the link layer,
and then the,
you know,
the IP layer,
and then layer four,
which is transport.
Now,
when you send
a DNS packet,
you have a normal
DNS packet
would have those
four layers,
and then it would
have the actual
DNS content.
Now,
the DNS content
is a payload.
Now,
in certain situations,
like we're talking
about the application
of that,
you know,
airports and such,
they let you
transport DNS packets
openly.
So that means,
you know,
they don't really care
about the source
and destination address,
but it's more
about the port,
because the port
is to the firewall
is what defines,
you know,
this is a DNS packet,
you know,
because most firewalls
won't look in the
actual packet units
and all to make sure
that, you know,
it fits the DNS payload.
So what they do then,
I mean,
what you do then,
is you replace
the payload
with another type
of packet,
one that you actually
want to send.
So,
in your regular DNS packet,
you have those
four headers,
you know,
the regular headers
that you have,
then you have
your other packet,
but that packet
also has
its own headers,
you know,
that packet will have
its own IP layer
and its own,
you know,
transport layer
and whatever else
you have after that.
Now,
notice that
when you do
the tunneling
and you tack on
your own packet
behind the original
DNS packet,
you don't need
to put the physical
layer and link layer
and that's because
when the proxy
on the other side
gets that packet,
it's already
in the kernel
at that state.
So,
you don't need
the two lowest
physical layers,
you just need
the one that has
like the important
information
like the IP address
and then the port,
et cetera,
et cetera.
Now,
so what we're saying
is after you
tack that on,
after you tack
your own packet
onto the end
of the DNS packet
and use that
as a payload,
you send it
from your machine.
Now,
when you hit
the firewall
or whatever
security measures
have at the airport,
it's going to look
and say,
oh,
this is an IP packet
from someone,
you know,
with an IP
inside the network
and it's going
to go out
on,
you know,
court 53,
I think,
is DNS.
I don't remember.
I think it's not.
It's going to go
up to the port.
Now,
I need
to be able
to access
these DNS
to this.
Okay,
hold on,
verbal,
verbal.
Hold on just a second,
you're breaking up
really bad,
so I don't want to,
and it's kind of
an important part there,
so let's back up
just a little bit.
what you're doing here
is wrapping up
that packet.
Let's go back to there,
and are you getting
a good signal there?
You're on the cell,
right?
Yeah.
Okay,
let's back up
like five,
ten,
yeah,
let's back up
about ten or fifteen
seconds because you
went completely
garbled on us.
Maybe the feds
didn't like our
comments about
the,
yeah.
All right,
so back up
just a few seconds
and say that again.
Where do you
want me to start?
All right,
just,
let's go back
to you were
saying that you
do not need
the physical
layer information
because the
proxy server
is going to
handle that.
Okay,
now keep in mind
when you have
put on your
own packet,
you only need
a pair of three
and up.
You don't need
to put in
the physical
layer and
the link layer
because once
that encapsulated
packet gets
to the proxy
server on the
other side,
you know,
that packet
goes
from the
wire up
to the
OS kernel
already.
So once
it gets
to your
proxy
server,
you know,
you don't
need to
have the
hardware
addresses
and all
that stuff
because it's
supposedly
already processed
by the kernel.
So you only
need important
things like
the IP
addresses
and then
the port
numbers.
So when
someone,
you know,
when you're
a client
at the airport,
for example,
and you send
that packet
out,
what you,
you know,
the firewall
at the other
end is going
to look and
say,
okay,
this is the
IP packet
and then it's
going to look
at the port
and be like,
okay,
this is the
DNS port,
so I'm going
to allow it
because it
has to allow
other legitimate
users to have
access to DNS
so they can,
you know,
bring up their
freaking login
page or whatever.
Right.
You can't
realistically block
the DNS port.
Right.
So,
I mean,
most firewalls
at,
you know,
at mediocre
security places
will block
based on ports
and source IPs
and destination IPs.
Like,
it's not going
to go through
every packet
and look at
the payload
and validate
that,
you know,
it's a legitimate
DNS packet.
Right?
Right.
Unless they
have some kind
of packet shaping
and,
yeah,
most places
aren't doing
any of that
stuff.
Right.
Because,
I mean,
you know,
it takes
significantly more
hardware and
more resources
to look at
the application
layer of
every single
packet.
Like,
because you
have to run
processing on
it and you're
probably not
going to have
that code
in the kernel
then you have
to kick it
up the user
space.
Like,
they're not
going to do
that.
You know,
like,
maybe some
super fancy
place will
have it in
hardware,
like some
Cisco box
or whatever,
but,
like,
most establishments
are not going
to have that.
So,
if you can
tunnel with
the appropriate
port,
then you should
be all set.
Right.
And,
that's,
you know,
that's pretty
much the all,
you know,
the whole story
about tunneling
is you encapsulate
an existing
packet with
another.
Now,
the important
thing to
remember is
you have this
now funky
network stack
that no one
understands
except for
you,
right?
Well,
you and your
proxy server.
And what you
need to do is
choose,
have a proxy
server on the
other end
that understands
this so it
can proxy for
you and
decapsulate your
packet and send
out your actual
packet and get
whatever information
you need.
Right,
right.
And as long
as,
it's kind of
like,
this is probably
a terrible
metaphor,
but it's kind
of like when
you're a kid
and you had
that secret
code with
your friend
that only
he knew
what you
were saying
and what
to do
with it
or how
to interpret
it.
It's you
and your
proxy server
that are
the only
ones that
are going
to,
again,
if they have
the packet
shaping or
the,
like you
said,
maybe some
high-end
Cisco
device,
but those
are expensive
and people
don't have
them.
They could
really,
it is
plain text
and maybe
this is a
good segue
to talk
about some
other things
that are
related to
this,
is encrypting
or encrypted
communications,
which some
forms of
them work
similarly.
They are
forms of
tunneling.
Is that
an accurate
statement?
Yeah.
Specifically VPN
is what I'm
getting at.
When you
have VPNs,
right?
Right.
You're,
I mean,
okay,
so the idea
of a VPN,
which is a
virtual private
network,
is you have
boxes at
geographically,
you know,
separate locations.
I mean,
it doesn't even
have to be
geographically,
but it's like
you're on
different networks
and you want
them to appear
like they're on
the same network.
So,
I mean,
I'm sure
everyone is
familiar with
like use cases
of VPN.
Like if I'm
working from
home today,
then I want
a VPN
into my
work,
then from
their end
or from
someone else
that's in
the corporate
network,
my machine
looks like
it's supposed
to be there
and it's
plugged in
at some
place.
Right.
Now,
to do that,
right,
you can
implement
a form
of tunneling.
Now,
there's,
you know,
many existing
technologies
for this
and tunneling
is only
one of them,
but mostly
what happens
is there's
a level
of encryption
involved,
right?
You make
some sort
of connection
from yourself
and make
it to some
entry point
in the network
you want
to be a part
of,
right?
Now,
ideally,
to be secure,
that connection
is secure
because the whole
point is you
don't trust
whatever is,
you know,
in between you
and the place
you're trying
to VPN
into.
So,
usually,
the case
is the
internet,
right?
Now,
the first
thing you do,
every single
VPN has
some sort
of authentication
mechanism
at the entry
point to make
sure,
you know,
you have,
you're supposed
to be there.
So,
usually,
there's a firewall
that sits,
you know,
on the corporate
network
at the edge
and if
you want
a VPN
in,
then you
have to
authenticate
with the
firewalls.
So,
that stuff
is implemented
by like
Radius,
like AAA
Radius,
I'm sure
you've heard
of that,
and like
PAM,
the authentication
module stuff,
you know,
they use that
for everything.
Now,
so that takes
care of the
authentication.
Now,
if you've
ever used
a VPN
client before,
you know,
when you start
it and you
authenticate,
then you
kind of,
some magic
happens and
your box
now has
access to,
you know,
other addresses
inside the
corporate network.
Right.
And I'm going
to talk a little
bit about,
you know,
how that's
actually done.
Well,
yeah,
we've got to
address IP
authentication
and IP
resolution.
As far as,
Okay,
all right.
Definitely,
well,
let's just,
I'm sorry,
we want to,
I think we
should clarify
here that
there's a
before and
after.
You said it,
but let me
just simplify
here that,
or make a
clear point
anyway,
that before
you connect
to your
VPN,
you're going
to get
whatever IP
address has
been assigned
to you by
either your
dial-up
provider,
your cable
modem,
whatever.
You've got an
IP address in
their subnet.
And when you
establish this
VPN communication,
as Verbal said
earlier,
you're establishing
a handshake and
you're being
reassigned an IP
address because
you are now
looking on,
at least within
that VPN,
you are a
part of that
network where
the VPN resides,
which is why
the term virtual
private network,
and you're becoming
part of that
network.
And if you'll
check,
your IP address
is now resolving
to something
internal to the
network.
And it's very,
very common in
corporate environments,
which is probably
the way we're
going to emphasize
or talk about
this because
internally,
let's say you
have an internal,
I don't know,
an internal
documentation folder
where you store
all your official
documentation.
And the way that
you keep people
out of that,
one of the
security methods
you have in
there is IP
resolution,
IP authentication.
For only people
that come from
my local internet
where,
I don't know,
147.147.147.x,
anybody within that
has access to it,
or whatever your
address range,
of course I'm
making stuff up now,
but whatever your
address range is,
well when you're
VPNed in,
as far as the
network is concerned,
you are now
within that range
and you can access
all those internal
things even though
you are at home
VPNed into that
system.
So understand IP
authentication and
how that falls into
play of the whole
thing because you're
not really the same
computer anymore.
I don't know how to
put that into words.
Am I doing,
is it making sense?
Yeah, okay,
so maybe I'll be
more clear if I talk
about how that
actually happens and
like how the actual
packet is sent.
Okay.
Okay, so now normally
when you send a packet
from your computer and
you don't have a
tunnel, not,
sorry,
excuse me,
not a VPN,
you know,
configured,
you have your own
IP and you have
your own transport
layer,
you know,
if there is a
transport layer for
the protocol you're
using.
Now,
so don't worry
about the physical
link layer.
That just
sets a packet
out to your gateway.
Like that,
that is just
forgetting it
over the wire.
So all that
interesting routing
stuff happens
with the IP,
starting at the IP
layer.
Now,
when you are,
you know,
when you're
routing a packet,
you need the
source and destination
address so you
know where it's
going,
right?
Now,
when you do
that for your
computer,
it has a certain
IP address,
right?
Right.
Now,
when you're doing
that for a VPN,
not only,
so you have to
get your,
your packet
from your
computer to the
gateway over to
there,
all the way to
the other side,
right?
But the virtual
part comes in
because once it
gets to the
other side to
the VPN way,
the VPN looks
at that packet
and like
tunneling,
it takes away
all the other
stuff as the
IP and
later and
transport layer
of your original
packet.
And what you have
in there is a
whole new packet
and that second
IP and transport
layer,
header,
is,
contains your
IP for
you know,
your virtual
IP address.
Right.
And your,
you know,
whatever other
application you're
using.
Excellent.
Excellent
explanation.
So,
right.
Now,
the thing,
now,
on the other
side,
like what
actually happens
is you have a
virtual interface,
so I mean,
depending on the
OS and the
VPN client you're
using,
if you do like
IF config or
IP config in
Windows,
you'll see
different things.
But you still
have an IP
address on
your local
network,
but you'll
have a virtual
address that
has an IP,
whether they
displayed or not,
they have a
virtual IP
that is for
the VPN.
Now,
most clients
will do full
tunneling and
not split tunneling,
and I'll get
to that in a
second.
But most
VPN clients
will tunnel
all your
traffic over
the VPN.
So what they
do is your
computer has a
default interface
that it sends
stuff to,
and it'll send
it to the
virtual interface,
and that
virtual interface
will have
code that
is going to
put in
headers for
other,
you know,
for your
virtual identity
in the corporate
network or
whatever you're
VPNing into.
Then that
virtual interface
will link up
to the
physical
interface.
So once,
you know,
the virtual
interface is
done with
putting in,
you know,
the virtual
info on it,
that's a
valid packet,
but not for
your local
network.
When you
send it out
through the
physical,
like the
real interface,
then that
interface,
you know,
code in the
kernel will
tack on IP
headers and
other headers
for that
interface.
So when it
goes out,
you'll have
the, you
know,
encapsulated
packet.
Right,
and this
is basically
the VPN
server that
you're talking
here is very
much a parallel
to the
proxy server we
described in
tunneling on
that previous
episode and
earlier in this
episode.
They're both
doing the
similar things,
it's just that
you're not
necessarily tunneling
on the DNS
layer this time
or the DNS
packet types.
This is just
virtualizing the
whole process,
I guess.
Right.
It's an
encrypted proxy.
When you do
that, you
will obviously
use more
bandwidth because
you have extra
hackers.
But, you
know, so,
you know,
sometimes your
VPN is just
up and it's
slower, but,
you know,
that's why it's
happening.
Now, before
when I was
saying, like,
if you use
some program,
like VPN
clients, they'll
tunnel all your
connections.
Now,
Stank, have
you used any
VPN clients,
like, you
know, in
work or
whatever?
Absolutely.
I use them
on a daily
basis,
regularly.
What VPN
client do
you use?
Multiple
ones, and
I can't drop
too many
docs or
anything, but
in my line
of work, I
have to,
security is a
big aspect of
it, so
whatever different
clients use at
their different
sites is what
I use, so I
have to be
flexible to use
them.
But let's
go with
Cisco if you
want a specific
example or
something.
Right.
So, now,
when you use,
I mean, for
any of your
VPN clients,
does it
tunnel all
of your
traffic over
the VPN?
Well, and
actually, I
think that's a
good question for
everybody.
Every one of
them is different,
so I can't
really give you a
straight answer.
Some do, some
don't.
Right.
But I think this
is very excellent
and I think we
should emphasize
this that, well,
let me actually
ask the question
back to you.
Does it matter?
What is the
difference between
split or full
tunneling?
Okay, so the
explanation I had
before was for a
full tunneling.
So that means that
no matter what you
do, you know,
let's say I'm
tunneled into,
you know,
AOL.com because
I work there for
some reason,
which I don't
by the way.
God help you.
But let's, you
know, I tunnel in
there, then after I
do that, all of my
traffic, you know,
will go through the
corporate network.
Now, I might be
working at home and
I want to, you
know, check my
email, but I'm
also surfing child
porn or whatever,
you know, but all
of that stuff will
go through the
corporate network.
And if your
corporate network
has any type of
monitors, then
they'll see that.
So, you know, make
sure you're aware of
what kind of tunneling
is going on.
When you're surfing
for child porn.
Let's just back it
up to regular porn,
can we?
Oh, okay.
I'm just saying for
this sake of argument
because I don't work
at AOL.
It was funny.
I got you.
But I'm saying
this is all
fetitious.
Well, AOL and
child porn go hand
in hand.
I think we all know
that, but anyway.
Okay, so the other
thing is split
tunneling.
Now, for tunneling,
what happens is,
you know, if I'm at
my house and I turn
it on, all the
traffic that goes to
AOL subnets or,
you know, AOL.com
domain will be
tunneled over through
the connection, but
everything else will
go over my regular
local network
connection, whatever
that may be.
Right.
Now, when you do
that, like, that
might sound better
from, you know,
whatever point of
view that I was
coming from with the
porn and stuff and
the check and work
email.
But keep in mind,
when you do that,
you're kind of gapping
a bridge.
Like, you're creating,
your computer becomes a
bridge from the
outside internet and
the inside secure
corporate network.
Well, that doesn't
sound very secure.
That sounds like a
problem.
So that's why a lot
of places don't do
that.
Like, I mean, a lot
of solutions don't
allow you to do that
because, you know,
they're already in
enough trouble as it
is with people, you
know, taking their
laptops from work and
going home and, like,
browsing MySpace
forever and getting
malware and viruses
installed and coming
back to work and,
like, nothing happened
and then plugging into
the corporate network.
Right.
Now, I'm sorry,
go ahead.
Yeah, but split, I
mean, split tunneling
does have its, you
know, benefits, right?
Now, if you can, you
know, guarantee your
boxes secure or somehow
have separation of,
you know, permissions,
like, if for some
reason your email client
is jailed and, like,
that's the only thing
running that's using the
split tunneling, then,
like, yeah, whatever,
thing, you know?
Well, I mean,
there are pros and
cons to each, and you
just need to understand
them and decide what
solution works for you.
Yeah, and that comes
back, and it's why I
wanted to mention
earlier about the IP
authentication, because
it has to know what
you're trying to reach
and what IP block it's
in and what your
virtual IP block is,
and that's how it can
know whether it's
going to take you
through the VPN tunnel
or take you to the
outside internet through
your normal paths.
Right, exactly.
Now...
Well, I mean, actually...
Oh, sorry, go ahead.
I was just going to
throw out a couple
questions, if I can.
I don't want to stop
you if you're...
Like, for example...
No, no, go for it.
Yeah, all right, just
to clarify, if I'm on a
full tunneled VPN,
every single thing that
I browse, every...
Not even browse, every
single packet I send,
if I check my personal
POP3 mail account
through something, I go
browse some websites,
I chat with somebody
online, all of those
packets in a full
tunneling situation are
all going to go through
that VPN server,
correct?
Yes, that is correct.
Now, they are
encrypted, which is
great, but are they...
Well, actually, how
about this?
Let's play the
conspiracy theory here.
Can the administrator,
the server of that
VPN machine, can they
see and track all of
my traffic?
Yes, unless you
encrypt it.
But, like, let's say
you send an encrypted
email via Gmail, then
they won't be able to
see that, because that's
application layer
encryption.
Right, right, because
if I PGP encrypt it,
for example.
Right, they'll see that
you connected to Gmail,
and you executed some
command, and that you
probably, you know,
sent an email, but the
contents of the email
are encrypted, and you,
you know, they won't be
able to get that unless
they have the key.
All right, well, let's
go a step further here
and play what if.
What if I had a second
VPN server?
Can I chain them
together, and VPN into
box A, then box A has a
VPN connection set up to
box B.
Let's say that's up and
running constantly.
I connect to box A, which
then connects to box B, and
then box B is going to go
out and do whatever traffic
I want, receive it, send it
back to box A, and then
back to myself.
A, is that possible, and
B, are there any benefits
or reasons to do that?
Now, what, okay, so what
is box B, like what
networks are they in?
Now, are you saying, like,
your work is box B?
Let, yeah, let's say box
B is, um, all right, I'm
going to make up a totally
hypothetical situation.
Let's say box B is, um,
is, let's use AOL, for
example, and AOL, that's
their VPN box.
Uh, box A is, let's say
I'm a, um, security
consulting firm, and I
have a box that needs to
access all of the AOL
stuff so I can do my
security work.
That would be box A.
And me, my, sitting at
home with my laptop, I
want to VPN to box A so
that I can then
subsequently get into box
B. Let's say they don't
want me or don't allow me
to directly get into box
B. Yep.
Is that possible?
And if so, is there any
advantage or reason for
doing that?
Yeah, I mean, that is
possible, and people do do
that. Um, so what you're
saying, right, is that you
VPN into box A, right?
Right.
That's your consulting
company.
Right.
And you, you know, like
that, that kind of
permission, like, contract,
I guess you can say,
between yourself and the
company you work for is
one thing.
Now, box A, which is at
your consulting company,
box B, which is AOL.com,
for example, they will
have another thing set up.
You know, they'll have
another kind of, you know,
if they're doing some
project, they'll have their
own permissions set up and
everything, and that VPN,
right, is a different set of,
you know, I'm not getting
the right word here, but
that VPN is something
completely different than,
you know, the permissions
that you have with, from
you and your own company.
Right.
Right?
So then what ends up
happening is you tunnel
your packet to box A, and
then they rip off the
headers, you know, that
are, that went over the
internet, and then that
packet's floating around in
the corporate network, and
if it's destined to go to
AOL.com and box B, that
will be re-encapsulated, so
it will be sent from the
VPN link from your
consulting company onto
AOL.
All right, that's, that's
the word I wanted to hear.
Does it get, and I'm on,
this is an honest question,
I really don't know the
answer to this, does it
get re-encapsulated, or
does it get cumulatively
encapsulated?
Does it add that second
layer of encryption to an
already encrypted packet?
No, so from the
description that you gave
me, it doesn't accumulate
it.
It decrypts it first, so
you have your packet
floating around.
I see.
In your corporate
network, and then if, you
know, at some point it
needs to be encapsulated
again, then it will go
over again to, you know,
because like, what you
probably have is you'll
have two gateways, one
for authentication with
your, you know, working
from home people, and
another gateway for
AOL.com.
Now, you can set it up
so it does that.
Now, if you do that,
the routing will be a
little more complicated,
and I'm not sure if there
is a legitimate use case
for it, but you can do
that.
Well, I'm wondering if
they're encrypted
cumulatively, and I'm sure
there's probably some
business buzzword that I'm
supposed to know that I
don't, but if it re-encrypts.
You're basically daisy
chaining the proxies.
And I'm thinking that by
doing that, like the
first packet that goes to
my box, if it then gets
encrypted again before it
goes to the AOL box,
maybe they would not see
the original content.
They would only see the
secondary content because
the first one is still
encrypted, but you know
what?
I'm probably going a little
bit into weird scenarios
that would never happen in a
real-world environment, so
let's back up a little
bit.
There's one other thing I
wanted to talk about with
tunneling, if I may, that I
think our listeners might be
interested in, and it's
something that more people
might want to use, and it
kind of goes back to our
first example of the DNS
tunneling, and that is SSH
tunneling.
Would this be an appropriate
time to bring that up or
talk about that?
Okay, yeah.
I mean, so SSH tunneling is
an application level tunneling.
Now, with, you know, even with
VPN, you can VPN in layer
two, and you can also VPN in
from layer three.
Now, for using buzzwords,
right, VPNing in layer two is
what they use IPSec for that.
I'm sure you've heard of
IPSec.
Of course.
I think the noise, I'm sorry.
Layer hang in layer, yeah, okay,
I'm fine.
So, for IPSec, your IP address is
actually encrypted.
The actual, so this is the
tunneling mode that we, you know,
have been assuming the whole time.
So, you know how you're going to
end up having two IP headers,
right?
Right.
So, the first one, when it goes
from your box to the VPN gateway,
that is unencrypted.
It has to be.
Because, I mean, that goes over
the untrusted, you know,
untrusted internet or whatever.
Right.
But your second layer, your second
IP layer, that will be
encrypted, and only the VPN gateway
on the other side will be able to
decrypt that.
So, you know, people who are
sniffing, you know, people who are
sniffing are not going to be able
to see any addresses from your
corporate network, and, you know,
potentially, like, services you have,
et cetera, and open ports leaked out
into the public internet.
Right.
It's not just the payload that's
encrypted.
It's the entire packet, IP address
included.
Right.
Right, because, you know, because
it's like, you have, you know,
you're connecting to the VPN, and
we mentioned the mechanism, you
know, to actually get the packet
over there, but we didn't really
talk about, you know, the security
part, and, you know, that part is
pretty plain, because you just
encrypt it, you know, with AEFs or
whatever new fandangled encryption
algorithm you have.
Right.
Okay?
Yep.
Now, the other thing is you can
encrypt in a higher level, which is
you can use SSL.
Now, when you do that, only the
actual data is encrypted.
So, if I were sniffing your traffic
and you were using an SSL encryption,
then I would be able to see IP
addresses that are in the corporate
network and, like, what ports you're
sending to and stuff.
Right.
So, that's more appropriate for
web access type, when you just want
the contents encrypted.
Right.
So, right.
So, you know, that would be cool if
you're, like, connecting to a web
proxy or whatever.
Right.
Or, actually, what we were, started
off the episode when I was talking
about Yahoo Mail.
Right.
It goes through SSL to encrypt just
the password when I log in to be
protected so my password is not
sniffed.
But people can certainly still see
from the rest of the packet
information that I was going to
mail.yahoo.com or whatever the
server you're going to is.
That's still in plain text that could
be sniffed out of the air, but you
could never get the actual password.
Right.
Exactly.
So, it's a choice of how much
security do you need.
Right.
So, now, the other thing, so you're
asking about SSH tunneling, right?
Right.
And, I mean, people love that because
it's easy.
You know, everyone has SSH installed.
And, you know, there's a, the person,
you know, the group who develops it
really made it very versatile.
And, you know, it can do a lot of
things.
But keep in mind that when you do
SSH tunneling, that is an application
layer tunneling.
So, that's not even at layer 3 or
layer 4.
Like, you're tunneling in, you know,
the actual application layer.
So, what happens is you set up a
tunnel on, you know, the SSH.
So, you know how, when I was talking
about, you have, like, a virtual
interface on your computer that you
send all your packets to that you
want to go over the VPN?
And that virtual interface will, like,
put on the headers for you for, like,
your virtual identity.
And then it'll encrypt it.
And then that mesh will be put into,
you know, the actual header of, like,
your local network.
Right.
So, that, okay, so now, for SSH
tunneling, pretend that virtual interface
that does the encrypting, the adding of
the headers, imagine that is the entry
point for your SSH application.
So, when you do SSH tunneling, that is the
functionality that SSH is providing for you.
So, if, you know, I set, like, a forwarder
for my SSH, like, let's say I set a local
forward, and I, you know, SSH into some
gateway, and if I set a local forward in the
command options, then, you know, for, like,
okay, local port, like, you know, 31337 is
going to tunnel to, like, some other place.
And what happens is when I send packets to
that local port, it's going to instead go
through SSH, and SSH is going to encrypt
this for me, and now your, quote, quote,
VPN gateway is going to be the SSH server
on the other side.
And whatever you're sending is going to go
into the other side, and it's going to be
shot out in the direction that you specified
in your command line.
So, if you said, tunnel all my connections
and my packets from, you know, my, this
local port on my machine to, like, port, you
know, 80 on some remote machine, right,
that the SSH server can access, then the
SSH server on the other side is going to
tack on the appropriate headers, so your
packets will get routed to the correct
place remotely.
So, that's exactly what, you know, a VPN
does in a, you know, logical, from a logical
perspective, but it's at different layers, and it
uses different encryption schemes.
Right.
Now, are there other schemes or other
protocols besides IPsec and SSL?
Right, yeah.
So, I mean, there's a whole slew of them,
because the thing is, you know, all you have to do is
logically create a connection to the VPN gateway, and you need a mechanism to do the tunneling
and, like, the encapsulation for you, and you need a mechanism to encrypt the packet that's
your payload.
Now, there are many, you know, ways to do this, and some of them are, like, PPTP, which is a point-to-point
connection, and L2TP, which is a layer-2 tunneling protocol, and L3TP version 3, which is layer-3 tunneling,
and MPLS, to name a few.
But all of these is to, you know, establish, it's a tunneling protocol to establish connectivity
between you and the VPN gateway, right?
Because you need to have some sort of protocol that tells you, you know, how to, like, what kind of header
to have to identify this packet that you're sending with, you know, what you used to encrypt it on the other end,
and, like, what header order in the packet you expect to see and all that stuff.
Now, you don't really have to worry about that if you're not going to be, like,
develop rolling your own VPN implementation.
If you're just going to use something, then you don't need to know, you know, how, like, you know,
or which protocol it's using.
But if you want to, like, you know, hack it or reverse engineer it, then you definitely need to know
how that protocol operates.
And, you know, if you are, you know, for example, right, if you're using IPsec or some L2 tunneling thing,
then you're going to need to know that the IP address for the virtual network is not going to be exposed to you
and all that stuff, right?
Right.
And that's all, yeah.
So, I mean, one last thing that I want to throw out there is if you're using a VPN of any sort, you know,
make sure your, you know, your security on your box is really good that you're SSH-ing into or, I mean,
VPNing into because, I mean, your box is, like, on multiple networks at different times, right?
Right.
And, like, your box is pretty much a slut.
So you have to protect it or else, you know, if you just go to, like, Starbucks or whatever
and use the network there, you know, the security and the risk involved is much greater.
And if you bring that stuff back into wherever your VPNing is, then, you know,
you're screwing over everyone on that network.
So you'll give your box a venereal disease?
Is that what you're saying?
Yeah.
I mean, seriously, it's just like sex in a very boring way.
Wow.
That was a great way to end this segment there.
Actually, you know what?
I'm kind of looking over the notes here, and I actually – I want to go back to split tunneling.
We've got a few minutes.
I'll go back to split tunneling for a second.
Okay.
I think also – I think maybe another good example or a good application that might be worth mentioning.
Again, split tunneling is when you're only traffic going to a certain IP range
or a certain domain resolution, whatever you want to call it, is encrypted,
but everything else to the rest of the global interweb that doesn't need to go to that domain
is sent through whatever your standard is.
Yeah.
Now, isn't it, in fact, true that you may find yourself with the need to connect to a different IP-resolved address
from the same computer at the same time securely?
You mean, like, have two VPN connections?
That's what I'm getting at, yes.
So you can do that, and that does happen, but, like, most, if not all, of the VPN software out there
doesn't allow you to do that out of the box because it's complicated,
and your OS has to support, you know, that kind of tunneling.
Okay, actually, so a good example is to tell you what I'm doing or what I want to set up at my house
so you can get, you know, a better idea of what's involved.
Now, I have, okay, so there are a couple ways to log into my work.
One of them is I can SSH into some gateway they have, and then I can, you know, pipe everything through that.
Now, that's a good, you know, that's a decent way to do it, but it's annoying because every single, you know,
service I want to use, I have to tunnel it.
So it's like if I want to use some web page, I have to create a local tunnel on SSH,
and I have to, like, actually, you know, say in the command line, you know,
whatever I send to a local port, do that.
I have to set up the port.
All right, so you're saying that, I think I might have interrupted you there.
I think you were saying that it's kind of a pain because you have to tunnel,
when you do the SSH tunneling, you have to specify every individual port that you want to tunnel,
which is kind of a hassle, right?
Right, right.
So the other thing I can do is I can use the VPN client.
Now, if I use the VPN client and, you know, it's a full tunnel client, so it's not split.
So all of my traffic goes over, you know, the corporate network, and, you know,
that's not good for reasons I previously mentioned.
You know, so it's like if I want to, you know, play some music off my share from my computer,
I can't do that.
Now, what I want to do is to start split telling.
Now, there's a lot of ways to do this, but this is what I'm going to do.
Now, we can get a router, like a Dink, Elittle, Cisco, like 800 series router,
and we can get that to set up as a full tunnel.
So I plug that into the wall, and that router will create a VPN connection with my work.
And then if I plug in my box into, you know, one of those hub connections,
then I get a IP at work.
So that's fine.
But what I need to do to implement split tunneling is I have to tell my computer
and all the computers on my network that if I am looking for, you know,
a DNS like www.al.com, then to tunnel it to my work,
because that's where I work, supposedly.
Right.
And if it's not, then just go out the regular Internet.
But the problem is when you're doing that, you know, you can't say, like,
make sure you do it for all the names.
Like, you can't do aol.com because you have to, like, you have to pick a DNS to go to, first of all.
Like, if you have a private AOL DNS and they have, like, interweb names,
then you need to go through that one, like the AOL DNS.
But if it's not, then you don't want to send all your DNS queries automatically to the private one, the AOL DNS.
So you have to do it at the IP level.
So what you're going to do is have to find out what subnets AOL has for their work, you know,
people in your area or I guess in their whole corporate network.
You know, once you find that out, you need to tell your computer if, you know, if either I,
if I go to any of these IPs, then I need to go to this, or if not, go to the regular Internet.
But the thing is, if you type in a web page, like I was saying before, you know,
you do, like, some interweb thing for AOL, then you're not going to know where it is.
So you should also run your own DNS server that's going to, you know, do the splitting for you.
So that DNS server will have both public Internet domain names
and also be able to resolve, you know, specific interweb AOL domain names for you.
Now, so what I'm going to do is plug in my router that has a VPN connection into another router.
Okay?
So that router is, like, my normal access to the Internet.
So when I plug that in, I can then have the router say, like, okay, for all your DNS queries,
go to this guy.
So I have to run my own DNS router, DNS server.
Then once you get the IP address, sorry, give me one second.
Once you get the IP address, then your router will decide which interface to go out of,
the VPN one or the regular one.
Right.
And actually, I think that's even a little bit more detail.
What I was thinking more along the lines of, let's go back to, remember my scenario of daisy chaining
with machine A and machine B?
Right.
Let's say I'm that same consultant, and I work for a security company, machine A, and I also am being hired out to do pen testing
or some kind of security work for AOL, box B.
Yeah.
It is entirely possible for me to VPN to box A, because maybe I need to get on there and download tools from my job
or fill out some forms or whatever and need that secure access there.
But I'm also working on the AOL network, doing some scanning or doing some whatever,
and I need to be, have all that traffic also secured.
I can have two different software clients running on my box.
Now, I think you said earlier that most software clients will not support that easily.
Yeah, that's right.
But if you have two different software clients, for example, maybe I use a Cisco client to set up the VPN tunnel over to box A,
but then I use the Microsoft VPN client to tunnel into box B.
Is that a common scenario?
No, you can't.
Unfortunately, you can't do that, because if each VPN client is configured for full tunneling,
then what they're going to do is, you know, I mean, they might do it in slightly different ways,
but what they're going to do is configure their own virtual interface
and then set that in your computer as the default gateway for your local box and make all traffic go to it.
So if, let's say, you...
So one's going to take charge of the other.
One's going to override the other.
Right, yeah.
So one is going to just kick the other one down.
Now, you could write some software yourself, or I don't know if there exists any,
but you create the tunnels, but then in your box,
you have to be able to decide which way to route your packets, depending on what IPs they are.
So your box will have to be a router, and you have to turn on IP routing and make some rules and stuff.
Yeah, and it seems like a shame that more software clients don't support that or allow that.
I understand why, for reasons you've explained, but it's certainly not...
Like you said, you could write your own thing to do it,
but you would think they would write some support for that into some of these clients,
because I honestly don't see that as an unreasonable or unrealistic scenario.
The first one where it was daisy-channing, yeah, that's a little bit probably weird,
but this one, I can see many valid reasons and applications for doing that,
so I'm surprised more of them don't support that.
Well, I think the number one reason why they don't do that is because when that happens,
you're creating a rogue, like, connection point between two networks that you shouldn't be doing.
Well, that's a very good point. Yeah, you're right.
Right. So if one gets owned...
Yeah.
Yeah, so if I get owned through box B, suddenly box A is now vulnerable.
Yeah.
Yeah, that's an excellent point.
So I think for that reason, that's why they don't do that.
That's an excellent point.
But you know what I'm going to try?
Actually, I was thinking about this the other day,
and I haven't tried it yet, but I'm going to see if this works.
So I have a MacBook, and I run Windows XP on Parallels because I love Microsoft Office.
And what I'm going to try is run the VPN client from inside the VM,
and then maybe I think if I do that, the VM will be, you know,
just, like, connected by a VPN into wherever and the host class can use the network natively.
Yeah, that would be interesting.
Make sure we bring that up on a later show.
I'd like to know how that works out, how that comes out.
I'm going to try that as soon as I install a VPN client on the SOS.
Virtualization.
That's what happens for these things, like VMware or Parallels.
They have their own, like, virtual interfaces set up for, like, your network
because what they have to do is you can do the bridge network thing,
which is another application of tunneling where they have your packets
and your guest OS that you're sending tunneled to the regular Internet via your host OS.
Right?
So if they have that virtual interface set up already,
then the mechanism is there for both of them to play nicely.
So if I send VPN traffic through that virtual VMware interface or whatever,
then with the way they set it up, it shouldn't affect the host OS network connectivity at all.
Right, because it's, well, they're individual independent stacks.
They're two different unrelated things.
But you know what?
We're going to have to wrap up, I think.
We've got a few minutes to wrap up, but is there anything else that you can think of
that we should mention here before we wrap up?
No, I mean, I think that was the last thing.
I'm going to try that, and I'll get back to you.
Yeah, I think that's interesting.
Virtualization in general is something that a lot of people are starting to, I mean, originally, and I guess still the most popular application is for people who need to do a lot of testing or need to run a lot of several boxes on one machine or something like that.
It's very much, I guess, I guess a business need for it, I guess.
There's not many people using it on an individual level.
It's very useful for software application programming, stuff like that, when you want to do multi-environment testing and stuff.
But I think a lot of hackers are starting to realize the potential with this because each one of those, the way virtualization works is its own independent box, for lack of a better word, a virtual box.
And it allows you to do so much testing on your own system, which is – we could go into a whole thing about virtualization.
Maybe we should on an upcoming show, but I guess I'll just leave it at virtualization is very cool and something that I think people should really look into a lot.
And I am going to put that on our to-do list to talk about an episode about that and some of the applications of it.
I know Knott Theory swears by it now, and he uses it for almost everything, so maybe we'll get him on an episode to talk about it.
But, yeah, for now, I think we're going to wrap it up.
I think that was – I think this episode is going to be like a drinking game where every time we say the word packet, everybody in the IRC has to take a drink or something.
For cuddling.
Oh, yeah, every time we say packet, everybody has to take a shot or something because we – this was a very, very detail.
I hope we did a good job of balancing explaining it in such a way that it made sense and not just a bunch of techno babble.
I think we did a pretty good job.
I think I – at least as a listener listening to you, I think I was able to follow most of that.
So hopefully it comes across that well in the show.
Let's do some shouts this week, and I'll go ahead and start.
I'll go ahead and give a shout-out to Romania because we got that email earlier.
The entire country of Romania gets my shout-outs this week.
And to my good friend MC Frontalot, he just sent me some lyrics to a new upcoming song of his he's going to be releasing.
I don't know how soon, but that is surprisingly – I wish it was released because it would have been a great closing music this week.
It's very appropriate for this topic.
So shouts out to the front one, the frontingest one.
And what do you got for us this week?
I just want to give a shout-out to my new buddy, Venom.
And also, if you have any questions or comments on anything you heard tonight, you can email me directly at verbal at binrev.com.
Or you can email us at radio at binrev.com, which is the main address for feedback for the show.
Our site of the week is – well, actually, let's see.
We had a site of the week in the first episode, so maybe I should not do it.
Now, I'm going to give you two sites this week.
The second site of the week is powerlabs.org.
That's P-O-W-E-R-L-A-B-S.org.
It's some cool hardware hacking type projects and focusing specifically on how to power them and things like that.
So if you're into hardware hacking, not totally computer-related stuff, but just some hardware hacking in general,
building your own devices, building your own things, that's a pretty cool site to check out.
The closing music that we are going to use this week is from MC Chris.
I don't think I've ever used this one before.
It's called FTW for the win.
MC Chris, we're going to close it out.
And verbal, thank you for being on the show again this week.
No problem.
And we will tell everybody that we will see him next week.
Same hack time.
Same hack channel.
Biatch.
Tonight at the Alamo Dome, he gets happy-go-jacky on the big white guy like a donkey eating a waffle.
Sweet Sassy Molassi.
Get out the checkbook and pay Bram off with a rubdown as the Spurs beat the Heat.
86-79.
Stewart.
And see the name.
My kick is a cray.
Display wide range.
Shit for them heads.
You tell it like planes.
I'm Hanna to Lame.
Chemical craze.
I'm from Hunter Fades.
Around the four days.
Rockers, they play.
Eat free those names whenever I'm played.
My soul's on fire, so call me in the cage.
Dressing all back, so please call me Christine.
On it again, put others in shame.
Here I am.
I'm tired of like claiming a waffle of lanes.
I'm Mr. Ducky.
Lucky enough cause you cause wanna fuck me.
I'm out of jock.
You know, like sports.
I want to cry.
Just got divorced.
Like a drink beer and chill with my friends.
They turn and see me cause it's for the win.
Win!
And you cringe.
And you cringe for the win.
Dope and tease and disbelief.
MC, Rom, John, flip the beat.
Flip the bell, we fail the seat.
Kick us out, we fail the street.
Mike, magician, check the scene.
Don't take my dick, my masterpiece.
No, I feel the fast relief.
MC's there for magic heat.
Hit the beat for water, make the beat.
Why they inhale out of histamine.
Now, please fuck a slip of the crystal key.
Then try to be me, it's all kind of a treat.
Feel a fatigue, you're getting started.
Shit, the addiction, we're gonna get caught in.
Living this life till I'm nearly departing.
Now, when I win up, somebody fought it.
And you cringe.
And you cringe for the win.
John Stockton says, hey, look at me.
I'm a little teapot.
I'll go right up your dress.
But then Alden Pollenese says, I'm not going to pay a lot for this muffler.
But then Karl Malone says, sweet sassy molassie.
You are going to pay a lot.
And the cost is going to be prohibitive.
Jazz win, $99.93.
Sweet sassy molassie.
Yeah.
If you like it, don't steal it.