This is dedicated to all the hackers and the crackers, to the hackers and the crackers.
I see in binary, I speak source code, step on my toes, I'll post a million jpegs of you
and a fag pwned.
In your digital stance, getting firewalled ho, cause I'm riding the net in my six-fold.
I was a dick with my 56, now with my cable I'm able to get that stable.
On the out, my name is Ace and I'm a Leo. On the digital highway, my name is Neo and I'm a hero.
In a flash, I'll screw you on burning Dreamcast. You need some ISO? Let me through my hard drive rifle.
Our exchange you could never stifle. In a digital hug, you just caught the love bug.
I bootlegged your CD, I caused a fight between Un and Jay-Z.
Your CG, it's all gonna be free, whether we take it by force or we take it nicely.
You feel that rattle in your bones? When I tell you we just hacked out Jones.
And NASDAQ leaves your fight on your back, cause I am he who loves to hack and crack.
Cause I am he who loves to hack and crack.
This is dedicated to the hackers and the crudents.
Serial codes, source codes, ISOs, RANs, SIPs, SIPs.
This is dedicated to the hackers and the crack.
Hello, everybody, and welcome to Binary Revolution Radio, episode number 165.
I am StankDawg, joining you again this week, September 19th, 2006.
Another Tuesday filled with hacking goodness.
And an episode that started almost like a huddle in a football game,
but I guess that's some behind-the-scenes jokes for my co-host and I this week.
Savant, welcome back to the show, my friend.
Hey, man, thanks for having me. Good to be here.
And this show is going to be, I think, I don't know,
I'm gonna try not to go way, way, way off the handle,
but you all know I'm going to fail.
So I'm just gonna pre-warn you that I'm probably,
this episode will have naughty language.
It is rated TVMA or whatever the hell.
Let's see, if we were a television show, it would be TVMA.
If it was a movie, probably be R.
I don't think, well, I might be X.
It depends on if I take my pants off or not.
You haven't yet?
Not yet.
Crap, I thought I put that in the show notes.
We always do the show pantsless.
All right, give me two seconds.
Crap, all right.
Okay, we're good.
We didn't hear the zip.
It's not sexy if we don't hear the zip.
Okay, hold on.
Yeah, that's what I'm talking about.
All right, now we're locking through Daughters.
It's rated X.
Bow chicka bow wow.
All right.
Actually, holy, I just realized we're only four episodes away from episode 169.
How perverse, how perverse am I?
Where's my mind?
Well, anyway, let's stick to the hacking topics this week
and save the prawn for a future episode.
Let's see.
Housekeeping this week.
A couple things, actually.
First of all, Dock Droppers.
Dock Droppers is currently being upgraded.
We are trying to upgrade the Media Wiki to the newest version.
Set it up in a little test area so that we can bang away at it
and make sure that it's stable and all that good stuff.
But in the process, we broke Dock Droppers.
So right now, the site is readable.
It's up and works and everything.
But the registration, login type things are disabled.
And adding new documents is currently not working either.
I think we fucksored the database just a little bit.
So we are in the process of working on that.
So bear with us a little bit there.
And let's see.
The other thing I had is that, oh, yes.
A big, actually, this is something that's been a problem for us
for like the last month or more.
Somehow we got flagged.
Actually, this has been several months.
But one particular one's been dragging on for several months.
Most of them we got addressed earlier.
And that is the fact that we got picked up as a spam relay
and added to a bunch of these different spammer lists.
And what happens when that happens is mail servers across the global interweb
now check this spam list or these multiple, one of these many
or many of these spam lists to see if we are a known spammer.
And if so, we'll block email from us.
And somehow we got listed onto those damn things.
So we went through the process of having ourselves removed.
Several of them.
It was a pretty straightforward process, pretty easy.
But one particular one, and I think it was Spam House, H-A-U-S,
I think was the one we were having problems with,
was not making it easy for us to get off of their list.
When you try to get off – the problem is not even with us.
The problem is – and you know what, Samant, I'm sure you know a lot about this.
I'm sure you've seen this a lot too.
But our hosting company has a different name for our server.
It gives us one of those random, you know, 617.us.whatever that they call the server.
And we're – you know, the binrev.net server is using the same IP address.
It's in their IP address block range.
And if anything –
When it does the reverse lookup.
Yeah, and if anything does the reverse lookup on there, and they have us listed as that site,
and that's why they've blocked us because it's seeing two different things
and thinks that we're spoofing and all kinds of weird stuff that's – yeah, I'm not going to go into here.
But the problem with that is that when we go in and try to email the confirmation message
to prove that we're really not a spammer, it goes to that weird b1742bingo.us address, which is not us.
So we can't get the confirmation email to verify and reply to, et cetera, et cetera.
So tried to work with our hosting company about that, and they were not responsive.
So we had to do a little hackery, and when I say we, I mean Nick84 saving the day once again.
That guy is so great, by the way.
We were – I was talking to Nick recently, and it's – I had – it was – it's kind of shocking
how long we've actually known each other.
So Nick has always been a good friend of the show, so I'm going to give early shouts out to Nick84
for helping us out with that particular problem as well as many, many others.
So I guess that is it.
Nick, did you have anything you wanted to talk about in housekeeping?
I know it's kind of not exactly appropriate, I guess.
When is the last time you were on the show?
You were on the show with Black Ratchet.
I know for – you did the DEF CON wrap-up.
In Madison, I did the post-HOPE wrap-up.
Or the HOPE – I'm sorry, the HOPE wrap-up, right?
Uh-huh.
And how long ago was that?
Well, gosh, let's see.
So I want to say about a month and a half ago, maybe two months ago.
All right, man.
We've got to get you on the show more often.
How about that?
Yeah, yeah.
I'd love that.
All right.
Well, let's go ahead and end the housekeeping and slip into a little e-mail.
All right.
Our first e-mail this week.
Damn it.
I said all right again.
That's my – I always start the show off saying all right.
And most people don't know that because I edited it out, but it's like this bad habit.
And now I'm coming into the e-mail saying all right.
So all right, I suck at this radio thing after our fourth season we're into now, and I still
don't have this thing mastered.
But hey, what are you going to do?
Hey, it's free.
Don't complain, fuckers.
All right.
I'm grateful.
Do you realize I just had a conversation with myself?
Yeah, yeah.
I was going to let you go with it.
I was going to see if you're going to start arguing.
I am so mental.
I don't even know where to begin.
I'm having a lack of sleep.
I have terrible hacker's insomnia, which I've discussed many times, and I'm low on sleep.
But anyway, e-mail.
First thing, we had quite a bit of e-mail from last week's episode.
We did our – again, I thought last week was a really cool week.
We did a lot of BinRev firsts last week.
We did our first ever back-to-back episodes, doubleheader, two episodes in a row, three
full hours of hacking goodness.
And I don't know.
I think that was my – that was like a Barney Fife voice I did there, but –
Little Hattie Grenadio, everybody.
How we doing?
Oh, what do you think?
That's like Barney Fife meets Dean Cinture.
I do the worst impressions, but you know what?
I never stop.
I keep doing them anyway.
I don't care.
Whatever.
Go away, Andy.
Oh, wait a minute.
That wasn't even – that wasn't even Gomer.
That was the other guy.
That was Gomer.
Wait a minute here.
He's got to ruin some boxes.
How did I get Gomer Pyle into fucking Andy Griffith's show?
How does the fucking – he get into Mayberry.
I don't know where the hell I'm going on anyway.
So back-to-back episodes, which was really cool.
It's the first time we'd ever done that, so that was pretty interesting.
Also, the first time that we actually had a co-host live in studio there with me.
Normally, we're on the phone like we are now because we have that whole – I don't know how many thousand miles in between you and I.
What are we talking about, like three?
I think we're completely as far apart as we can humanly be, almost, in the continental United States.
Almost.
Technology.
Exactly.
Isn't it wonderful?
Yeah.
So that was also kind of cool last week and had to do a little sound adjustments on the fly.
So hopefully, we are back to normal this week on the sound quality.
I just want to thank you real fast for working with me on my Pacific Coast schedule.
I know it's a little later over there and I appreciate you working on that to get me on the show.
Are you kidding?
I'd love to have you on the show.
And I knew for this particular topic that we both have a good time talking about this because it's something we're both pretty familiar with.
Plus, you know, the thing is I'm old now.
I just had the birthday last week, so I'm kind of getting up there in age.
So I don't know if I can stay up late with you young folks anymore.
Thanks.
Are you serious?
You're repeating yourself, man.
Got to keep those things in mind.
So I'm not repeating myself.
My memory is perfectly fine.
No, you're not.
I've been fucking with you.
I know.
So I had a birthday last week and now I'm not quite able to stay up as long as I used to.
Wait a minute.
Did I just say that?
All right.
So the jokes are getting pretty bad here, so let's move on with the show.
God, if the jokes get any worse, people might mistake me for Black Ratchet.
Oh, oh, no, he didn't.
Oh, no, he did not.
Just, yes, I did.
Yes, I did.
Of course, that makes you strong.
You realize that, right?
Yeah.
It's the East Coast, West Coast.
East Coast, West Coast.
The same dynamic we got going on there.
All right.
So anyway, so we had a lot of email feedback from that doubleheader episode, so we're only
going to do some of those tonight.
So if you don't hear your email on the episode tonight, probably be on next week's episode
where we're hoping to get Verbal back on the show.
And some of those specifically talked about topics that I think would be better, that he
could better address because they're follow-ups to his episode and to Quine's episode.
So bear with us, and we'll get caught up on emails.
Second of all, and all right, I'm already a little sleep-happy, punch-drunk, whatever
you want to call it tonight anyway, but I've got to throw a rant on top of this because
I'm really kind of pissed off about this one particular email.
So, Savant, you might want to pull the phone away from your ear a second.
I'm actually going to slide back away from the microphone because I might start getting
pissed off about this.
I'm already pissed off about this.
All right, so here's the thing.
We have our standard email address, radioatbinrev.com, as you heard in the theme song, where people
should send feedback for the show, you know, or ideally feedback on previous episodes, suggestions
for the show, comments, any ideas you may want us to get out there, you know, content, specifically
things related to the show.
Well, I've been getting this one piece of email.
I'm calling it spam.
It's not really like a mass mailing kind of spam that goes out to a lot of people, but
it's still spam, in my opinion, anyway, and please let me explain.
It's an email from this company, and I'm going to keep them nameless because you'll see why.
They want this publicity or whatever.
So I'm going to keep them nameless.
But basically, they send me this email wanting me to review and possibly purchase, I'm sure,
their piece of IPTV hardware.
So basically, it's one of those network appliance type deals, customized for streaming internet
television shows or something along those lines.
So I'm calling it spam because they don't personalize it to me.
If this was like something they sent specifically to me and said, listen, we'll send you one to
review on the show.
We really want your opinion.
We listen to the show.
We're fans of the show.
Whatever.
It's not like that.
It's canned, not obviously, but I suspect what they've done is they've gone out and
got a bunch of email addresses of internet TV shows, such as Hack TV, for example, if
we want to call that an internet TV show.
I don't like all these buzzwords and definitions either.
But I think they went out there and got a list of addresses of people that run these
kind of shows and podcasts more specifically, et cetera, et cetera, and gathered them all up
and started emailing all these individual people thinking, I don't know, what is your, I
mean, I don't know that this is like, what's that word they call it, advertising?
Targeted?
No, not subliminal, but viral, viral marketing.
I don't think it's a viral marketing thing.
I think they're just targeting.
I think that is a better word.
Targeted.
They're not targeted by a bot or automatically.
I think they're manually targeted emails or they're hitting people that they think are
more likely to be interested in this, people running an internet television show.
So whether it's done manually or it's done by some script, some bot out there farming,
collecting a bunch of email addresses and mass mailing it out, hoping for a .05% response
rate, or whether they're targeting to people manually and sending it out.
I've gotten it on multiple occasions, also a symptom of spam, also a definition of spam.
Multiple times I've gotten, they're not always the same.
They're a little bit different every time.
Sometimes it's wanting to let me know that they've released this new thing.
Sometimes it's wanting to do or want me to do a review of the thing for the show, for
a show.
And they can send it out to the show because if they're targeting to people who have shows,
they can get away with that.
So it's never stank.
We want you to review this on BinRev Radio.
It's, hey, insert name here.
We were wondering if you would review this on your show, quote unquote your show.
So it's kind of general, but it's kind of targeted.
Am I making any sense at all?
Yeah, you make perfect sense.
I'm rambling a little bit.
Well, all right, here's the thing that just pisses me off, quite frankly.
Do they not know what this show's about?
Do they not know what the fuck Hack TV is?
I mean, is Hack TV, I mean, do they really think that Hack TV is who they want to fucking
advertise to?
Are we about advertising?
Have we ever been about advertising anything like this?
I mean, I'll review.
If people want to send me something because they want to hear an honest opinion, and I
got to take a little sip of drink here because I'm straining my throat, if they really want
me to review something, I will be glad to.
If you want to send me one, I will review it, or I will have one of the other guys in
DDP, will all of us get together, or anybody, you know, will do some reviews of it.
We'll give an honest review of it.
If it sucks, we're going to say it sucks.
If you're confident enough, you want to take that risk, sure, send it to me.
But I don't think they're going to send me one of these to review.
Keep in mind, this is Hack TV, this is Hack Radio, Binary Revolution Radio, DDP Hack Radio,
whatever.
They want to send us this device.
They want to sell us, they're marketing this device, IPTV, hardware, streaming, whatever
the fuck, which lists on their site for, are you ready for this?
For the low, low price of, quote, under $70,000 US fucking dollars.
Okay, the fucking...
The fucking is not in the quote.
I added that, but are you fucking kidding me?
Holy batshit, $70,000 fucking dollars?
You have got to be fucking kidding me.
Did you really send me a goddamn email trying to sell me something for $70,000?
You're out of your fucking mind?
That's the stupidest thing I've ever fucking heard in my life.
You've got to be completely fucking retarded to try to sell me, the guy who does this fucking
radio show with a $7.95 Lab Tech fucking microphone and a speakerphone, a $70,000 piece of equipment.
You have got your dick in your own ass if you think I'm going to buy this.
That is the stupidest thing I've ever heard of in my life.
Have you seen Hack TV?
Do I sound like...
Look at me.
I'm wearing a fucking t-shirt and a baseball cap.
Do I look like I could afford $70,000 for a fucking device like that?
And it says under $70,000.
Well, guess what?
If this may be $69,900 under $70,000, if I can get it for $100,000, then yeah, maybe I'll consider it.
But it better be a whole hell...
I don't think under $70,000 means they're going to sell it to me for $50,000.
That's fucking a-redonkulous.
I can't believe that they have sent me this multiple times.
Like, I ignored it once.
Spam it.
Fine.
Send me spam one fucking time.
But this is ridiculous.
And then here's the other funny thing.
And this kind of will...
We got some email to do.
This kind of might segue into the show.
And doing a little bit of research...
I'm actually out of breath.
I'm so angry.
My face is red right now.
I did a little research from this spam.
Working backwards.
Doing a little searching.
And I found out that they did get a bunch of podcasters to do this shit.
What the fuck is wrong with you people?
You're...
They're not only podcasters.
I saw a review on, like, some computer help coast AM, coast to coast, some bullshit like
that, that did this...
I mean, how are they suckering these people in our house?
How fucking hard up for material are you?
I mean, listen.
I'm not one to talk.
We've had some times where our material was not our A game.
You know, we've had some episodes that flopped pretty hard.
But I've never been so fucking hard up for material that I'm going to review a fucking
spam on the air, for God's sakes.
That is pathetic.
So, anybody...
I mean, all of you out there, anyone out there right now that did this, if you reviewed this
on your show, you are...
You sicken me.
How stupid are you that you fall for this kind of spam and that you get sucked into this?
Anybody who's done a show on this, you guys got pwned and you don't even know it.
You don't even realize it.
You're going to review something that none of your listeners could probably afford.
Seventy grand.
Seriously.
Seventy thousand U.S. dollars.
How many of your listeners to your pissant podcast, like this one, don't get me wrong,
how many of our listeners, either A, could afford it, or B, are willing to pay that much
for this piece of crap?
Do you really think I'm making enough money on Hack TV to afford that?
I don't...
I don't even know what else to say.
And the other thing that's so funny about this is that podcasters, and these people
doing these shows that are probably getting the spam, are replying to it.
I make jokes on the time about what kind of idiot responds to spam.
Who buys this Viagra?
Who's actually subscribing to the animal goat sea porn, whatever the hell they're advertising
all the time?
People don't respond to that, do they?
Fucking yes!
Say they respond to it!
And if people...
If you fucking dumbass podcasters out there keep responding to this shit, it's never going
to go away.
And I'm sorry, if you're running a podcast, you should be smarter than that.
But actually, I guess not.
First of all, for the record, I maintain that I am not a podcaster.
I don't give a fuck what people say.
Yes, we have a podcast to distribute the show, but we've been doing the show long before podcasting
ever existed.
We do a radio show.
If you've downloaded through the podcast, that's great.
But all these people that jumped on the podcasting bandwagon with the whole iPod podcaster, which
has no fucking relationship anyway...
All right, you know what?
Savant, can you try to calm the people down?
I've got to take a drink.
I'm actually sweating.
I'm feeling...
Well, I mean, like, I hear what you're saying, and I want to agree with you, but damn, IPTV
looks really, really appealing.
So, I mean, I was going to save up and buy a BMW, but IPTV just sounds so much more...
I mean, I can watch TV any time I want.
They should make something up, like a TV recorder, a TV potion, something, you know?
A device that, like, records shows.
I wonder why no one's thought of that yet.
Yeah, you know what?
We're in the wrong business.
That's it.
You know, I tell you what.
Let's do this.
I'll split it in half with you.
$35,000 each.
All right.
That sounds fair.
Okay?
I get it on weekends.
I know a couple open mail relays that we could use.
All right.
Well, speaking of mail...
I think I can get it back under control now that I've wasted half the fucking show on
that.
I'm sorry, but I...
You don't know how long I've been holding that in.
Seriously, they've been emailing me that for months and, like...
Not, like, frequently, but, like, once every month, I get something along those lines from
these people.
And I ignore one or two of them, and it's like, guys, take a hint.
You know?
What the fuck?
Anyway, let's do some real email this week.
We actually got some.
And let me try to switch and use my indoor voice.
My charming, charming radio voice.
I'm the worst radio voice ever.
All right.
So...
Oh, I'm still catching my breath, damn it.
All right.
So our first email comes from NeuroLogic.
NeuroLogic says,
Hi, I have been a long-time listener since episode one.
Ooh, nice.
I listened to episode 162, and I was on the floor laughing.
My advice to Verbal is, when you see a girl and you are interested from experience, just
approach her anyway, and be safe to know she isn't going to kill and eat your family.
Well, that depends on the girl now.
Be careful.
Give a nice smile and not a cheesy one, and give compliments.
Even if you just give a compliment, at least you would make someone's day.
It's either she'll be interested or not, and if it doesn't work out, there are always
other women out there.
Anyway, keep up the great work.
Ah, so see, now we're back on a nice topic.
See, the show's nice and friendly again, temporarily, until we get to our main topic again later.
So Verbal's adventures in his search for love, the quest for love on the interweb, or actually
not necessarily on the interweb, but will continue in future episodes.
We will probably do a little bit about that in some upcoming episodes, and give you some
status reports.
But frankly, I'll be happy if he just doesn't get arrested for stalking someone.
I'll consider that a success if that happens.
Hey, hey, what you consider a stalker, I consider an internet detective.
Right, or what do they call it, covert amateur porn?
Yeah, there you go.
We can, you can label it whatever you want, but you know.
You know, I've got a little advice for Verbal too, while we're on the subject real fast.
Go for it.
Man, don't ever, ever underestimate the overwhelming, compelling power of honesty, of compliments,
but more importantly, of alcohol.
Oh, yeah.
Always, you always have that.
That's your, that's always your fail safe, right?
That's always your...
Alcohol is your wingman, Rebels.
Hook it up.
There you go.
She doesn't know if it's a, you know, what do they call them, a Shirley Temple, or whatever
the hell they are without alcohol.
I don't even know, man.
Is that a California thing?
Something.
You know, what is it, like a, no, it's a Virgin Mary is like a Bloody Mary without alcohol.
Just order two, and just let the bartender at 20, and say, hey man, couldn't you just
say that there's like 20% alcohol in this?
She doesn't have to know, and you end up looking like a stud, and meanwhile, she's getting
more agreeable.
There you go.
Disclaimer, I'm not actually a sexual coercion offender.
Yeah, right.
Not according to those pictures I saw at Hope.
But anyway...
Hey man, they signed a relief.
All right, let's go on to our next email for this week.
Okay, I'll leave that one alone.
Please.
Our next email comes from Mirror Shades, who says, hi guys, I am listening to episode 164
and thought I'd share a thought or two.
Regarding a web-based service that would allow you to enter someone's public key and a message
to be encrypted, keep this in mind.
You would be submitting the plain text of your message to the people running the service.
Assuming their intentions are noble, this may not present a problem.
However, since you would never really know what they do with all that plain text, I would
tend to mistrust them.
Think of it this way.
How would you feel, or excuse me, would you feel comfortable encrypting your own credit
card, social security number, and naked picture of your wife, girlfriend with such a service?
Basically, any system for which you do not maintain complete oversight should not be fully
trusted.
Next section deals with beating a dead horse.
Feel free to ignore it if you'd like.
No, I'm actually going to read this.
Regarding the term hacker, my own thoughts were published in 2600 a couple issues ago.
Going back to your definition, though, I can identify at least one non-computer hacker.
Alton Brown hosted the TV show Good Eats that airs on the Food Network in the United States.
If you've never seen this guy in action, it's worth watching an episode.
Yes, it's a cooking show.
It is, however, very different from other cooking shows.
In short, here's what I think makes him a hacker.
One, he has a brilliant understanding of the details of his subject matter.
Check.
Two, he uses the tools available to him in often unconventional ways for unexpected results.
Check.
And number three, he teaches others.
I wish that were true in all cases for hackers, but frankly, it's not.
But it is cool that he does that.
So, I'll give that one a check.
Nice job with the show.
Keep up the good work.
All right.
Mirror Shades, thank you very much.
And, Savant, I think you can certainly back me up on this, that that's absolutely a valid point.
If I didn't mention it last episode, let me clearly state it now.
That, yeah, you can't trust anything unless you're running it yourself.
And even then, you could have been owned and you may not be able to trust your own box, but generally speaking.
Well, who is the target of these so-called, you know, self-packaged encryption suites?
If you're smart enough or you're dealing with information that's sensitive enough to need to encrypt it, are you too fucking stupid to Google how to use GPG?
There's tutorials for every available operating system.
Are you really that lazy?
And if you are, you probably deserve to get owned.
Yeah, and I was going to say, maybe the keyword's not stupid but lazy.
I think it's probably more apt the case.
So, yeah, well, but just to reemphasize the point of, yeah, if you're doing this, you're trusting someone else's box, you don't know what they're doing with it.
Maybe they're saving and logging everything.
You don't know that they're valid.
They could be a .org.
They could have all these disclaimers saying, we swear, seriously, guys, we don't keep your information.
Meanwhile, it's all in the database somewhere.
You have no idea about that, so be careful trusting anything like that to somebody you don't know.
If you're not running your own box from start to finish with everything along the way of what you're doing, you're always at the mercy of someone else, and you have to extend some level of trust anyway to another person.
So always keep that in the back of your mind.
Do I trust this person enough for X, Y, Z?
Like his example, would you send your credit card number to another?
You might feel comfortable just encrypting a general email with nothing, but would you really encrypt your credit card with those people?
Do you trust them that much?
What about naked pictures of your mom?
That kind of thing?
I think he said girlfriend and wife, but whatever.
You get the point.
And I know if I didn't mention it last week, I definitely should have, so thank you for bringing that up.
This is definitely on point.
But I do know that I mentioned it, we did an episode about proxy servers a while back, and I know for sure I mentioned it in that and emphasized it quite a bit.
If you don't know who runs that proxy, you don't know if you can trust them.
That could be a honeypot, and there are rumors of government honeypot proxies out there.
And a honeypot, of course, can be anything.
It could be a proxy server that's logging stuff.
It could be an email server.
It could be any number of things, you know, so yes, that absolutely holds true in this scenario of trust.
Who do you trust?
Who don't you trust?
So definitely a good point.
And I think the rest of your email pretty much speaks for itself.
So I don't know.
Sabat, anything to add to that?
I mean.
Well, it's the same concept as if you're going down to Mexico and you're trusting someone to, you know, go hook up three kilos of cocaine for you or something.
Would you trust someone you don't know, have never seen before, have never spoken to before?
Or, I mean, to a lesser extent, even just some random guy on the street?
No, you wouldn't.
Common sense says don't fucking do it.
You wouldn't walk up to some random person in a concert and say, hey, man, you want to buy some drugs?
Because they might be a cop.
You should just always assume that someone is after you.
Not to sound like a tinfoil hat theorist, but you just can't be too safe.
Yeah, and that's why I always import my balloon, my drug-filled balloon cocaine myself.
Because I know.
Or with people whose kids you've got in your basement, because those are the only ones you can really trust to do the right thing.
Exactly.
All right, let's see.
How about, let's do, we got, let's do a couple more emails.
Let's do an email here from Tim.
Tim says, oh my goodness, BinRev Radio rocks.
I listened to episode 162.
It was amazing leet.
Amazing leet.
I like the, that's got a ring to it.
It's amazing leet.
Verbal bouncing shit off satellites, but he can't hack shit, according to Sammy.
Fuck verbal, but he gets email, and he says hi to the people.
So that's leet.
Verbal is leet.
BinRev motherfucking radio.
Does this guy have ADD?
What's going on here?
Fear.
Fear, anyways.
Okay, those are like sentences.
Fear, period.
Anyways, period.
It was nice to hear Stank swearing in the first line of the show.
Woo, that's what I listen for.
Hells yeah.
To be honest, when I downloaded it, I was figuring it would suck.
Verbal's voice rocks, though.
Don't be hatin'.
Oh yeah, and you suck at the online is gay.
Really?
Like, seriously?
Fear tubes.
Fear tubes is my favorite.
Fear tubes.
Oh yeah.
Yeah, and the NSA proposed a bill, yes, the NSA, allowing them to wiretap whoever they want without a court order.
Fear.
Why don't you talk about that stuff on the show?
Senator Arlen Specter sucks balls, dude.
You should inform the masses.
Use your media love to inform the masses.
I don't know how many masses we have, but...
Oh yeah, do an episode about telephony.
Oh, you've got to be kidding me with that, right?
Boy, you've got to listen to season three.
That's all I can say.
Um, I could listen to information about lead dial plans for hours.
Yeah, you got it.
Hours of lead dial plans, season three.
Uh, listening to people talk about open source software is ultra boring.
Ooh.
Oh, man, my heart.
Oh, pulled a knife out.
At least you talked about compression algorithms for like two seconds and 162.
It was rad.
Oh yeah, and crickets go...
Uh, okay.
Um...
How do you do this?
Alright, do it.
Cheek, cheek, cheek, cheek.
Ha ha ha ha ha ha.
What the fuck kind of crack-headed cricket was that?
He went on...
Cheek, cheek, cheek, cheek.
Ha ha ha ha.
That's like a fucking cricket on steroids.
What the fuck kind of crickets do you got out there on the west side?
They're the ones that live in the fear tubes.
Ha ha ha ha.
I guess so.
Shit.
Oh, well, not...
Better than I can do, but...
We...
Not cacaw, cacaw.
See, we were doing like raven voices about how there was, you know, like a...
A desert and a tumbleweed going by.
We were picturing nobody around, nobody's listening.
So we didn't mean to say the crickets go cacaw, cacaw.
Cacaw!
That was crows, man, but...
Like, seriously.
Okay, anyway, he's joking, and he knows we're joking with him.
Andrew Green is the man.
What else does he say here?
Just thought I'd let you know what I thought.
Keep up the good work, dudes.
Alright, Tim.
Thank you for the email.
That was pretty funny.
And joking aside, we do appreciate the email.
But let's kind of break this down.
Because the email was all over the place, let's be honest.
First of all, yes, verbal sucks at the online.
There's no doubt about that.
We know that.
Okay, so that aside.
The NSA, and that bill, and whoever the hell he mentioned, Arlen Specter, whatever.
The reason we don't go into that, or any topics along, even closely remotely related to that, is because we here at BinRev Radio have a no politics rule.
We focus on the technology, and we leave the politics to the politicians, and the pseudo-intellectuals, of course.
We don't do that on this show.
We do technology.
We do hacking.
We try to, anyway.
Sometimes, hey, sometimes we talk about, what were we talking about earlier?
How much I hate these IPTV spam mail.
Well, I guess that's technology, though.
Even that, I'm going to hold that that even fits into the format of our show.
But not politics, even remotely related politics.
I mean, occasionally we'll talk about some intellectual property, law, and things affecting downloading and file sharing and freedom.
But even when we do that, we keep it on a technological level of why it can't be stopped, why it's unrealistic to think or try these things.
So even then, we keep it grounded in the technology side of things.
So if you want to listen to bleeding-heart liberal propaganda disguised as hacking, then listen to WBAI in New York.
You can get that every week, a couple times a week, frankly.
If you want all hacking all the time, listen to Binary Revolution Radio on DDP Hack Radio.
See, I should just take that clip out as a promotional clip.
But see, that's like the catchphrase of the thing.
I should loop that and play it in between all the shows.
So, I guess that's really all that I have to say about that.
So, I'm probably going to get email for that comment.
But you know what?
Fuck it.
I believe it.
I honestly feel that way.
So, hey, whatever.
And I won't put you on the spot to agree or disagree.
I'll let you stay neutral in that whole thing.
And we'll move on to an email.
Cheek, cheek, cheek, cheek.
Caw.
Jake says, actually, why don't you read Jake's email for me?
And I'm going to take a little sip of some good sweet iced tea as I stall for you to get Jake's email up in front of you.
And then I hope you'll have it right about now.
All right.
So, this email comes from Jake.
It says, I wouldn't mind hearing more about Yarsinia.
I've never heard that before.
Episode 163 was a great episode.
It piqued my interest on a lot of programs that I've not heard before.
The show is great.
Keep up the good work.
Jake, thank you for your email.
I'm going to have to agree with you that I, myself, had not heard of Yarsinia until today.
But it looks pretty interesting.
Let me make sure I've got the thing open.
And I don't because I'm a noob.
Well, that was one of the tools that Quine talked about last week on one of our doubleheader episodes.
So, I will definitely put that on the list, Jake.
And I'm in the same boat, too.
I had not heard of that one either.
I was not familiar with Yarsinia.
So, I will put that on our list of topics.
So, Quine, if you're listening out there right now, you are hereby on notice.
So, be prepared to be on an upcoming episode of the show.
All right.
So, listen.
We're a good ways into the show.
And I think that's probably a good point.
Let's save the rest of the emails for next week's episode.
What do you say?
Sounds good.
All right.
So, that's going to do it for this week's email anyway.
We did get some good stuff.
Don't get me wrong.
If you didn't hear it, it's probably because I'm saving it for next week.
But, you know what?
After that little rant on spam that I had earlier, let's kind of keep the flow going, so to speak,
and stick with annoying email as our theme or topic or whatever for this episode.
And I think probably let's do a little talk about phishing.
Gosh, I love talking about phishing.
You never shut up about it.
I know.
And did the sarcasm actually come through in that statement?
Did you, the listener, feel the sarcasm when I said that?
See, I just don't get phishing is such a big deal.
I mean, I understand it affects.
I mean, it's a big deal as far as the effects that it has.
But, all right.
Well, I'll tell you what.
Let's start this way.
And I'll tell you what.
You help me out on a lot of this, okay?
All right, I'm with you.
Okay, why don't, let's define phishing, first of all, because I actually, even the word annoys me a little bit
because the way it's defined even these days is a little bit too narrow for me.
So, kind of define phishing first off.
I know most people probably already know this, but let's define it.
Okay, well, in simple terms, phishing is simply brand spoofing.
It is exploiting trust on a human level to try and use that trust to gain access to a system or to sensitive information
or to just other accounts that they can, phishers can, in some way, profit off of your ignorance.
According to Google, it is the act of tricking someone into giving them confidential information
or tricking them into doing something they normally wouldn't or shouldn't do.
For example, sending email to a user's fault to claim to be an established legitimate enterprise
or an attempt to scam the user into surrendering private information that would be used in identity theft.
That sounds like a pretty blanket definition.
I have no problems with that.
Yeah, actually, I stand corrected.
I think that actually is a fairly good definition.
I'm okay with that one.
But generally, one of my annoyances, and I think you'll back me up on this actually,
is I hate it when people refer to phishing as email.
Like, phishing is only an email thing.
Right.
And that is very, very common.
People say phishing, they think only an email that's trying to sucker you out of whatever.
Whether it's your account information, your credit card numbers, whatever.
Email is not about phishing.
And email has been around long before phishing, or long before, excuse me, phishing has been around
long before email phishing, really.
That was kind of like another evolution.
I mean, phishing over the phone has been around for a long, long, long, long time.
Even technologically, it predates email.
If you want to keep it on the cyber medium,
it generally is considered to have originated on the old AOL network back before mainstream
dial-up access really became popular.
And it was when people would sit in chat rooms and make their screen names look like the people
that were running AOL and would say, this is account rep 31337.
We need you to give us your password because there was a failure in the database or something
like that.
Right.
And back in the day, there was a surprising amount of victims.
I would say the ROI was operating where between 50% to 90% of AOL users.
Wow.
Yeah, actually, that is a good example.
I hadn't thought of that.
But I tell you what, I'll do you even one better.
Forget technology altogether.
There's nothing verbally from you going, if you go into a bar, you can simply phish for
information.
Hey, yeah, that's kind of a cool cash register you got over there.
Is that some kind of computerized thing?
You know, you can just phish for information.
It may not, first of all, I guess now that I think about it, I do have one little issue
with that definition.
It's not always about financial gain of any kind.
Sometimes it's just information.
You know, you can phish simply for information.
You can phish to get footprint information about a site.
I can call up and ask some secretary what version of your operating, what version of Windows
are you using.
I can phish just to get information and hang up and that's it.
It's part of a larger fishing expedition, an individual call trying to phish for information.
Are you trying to say that Kevin Mitnick is a fisher?
I think that's what you're trying to say.
I'm written between the lines.
Hmm.
Possibly in some cases, I guess.
But, I mean, I think anybody could be.
Anybody who's ever, yeah, anybody who's ever intentionally, now some are better than
others, you know, then social engineering comes into play as far as how effective your
phishing techniques are, but, yeah, I think you see what I'm getting at there, right?
Well, and here's a completely offline example that I think you might like.
Let's say you are a con person trying to get a job as a nanny somewhere, but you know that
you have a criminal record and don't have the references and no one's going to give you
this job and there's no fucking way that you're ever going to get any work.
So you, as an enterprising fisher, might then place an ad in Craigslist and the ad might
say, hey, I need a nanny.
We want someone who's qualified.
We get someone with valuable resources, someone we can trust.
And they basically just fill out an ad and wait for people to respond to that.
Then they take those resumes with all those references, change just the phone number of
who it's returned to, and then submit it to people who are looking for nannies so that
when the people looking for nannies call up on references, they say, hey, is StankDog any
good at taking care of kids because they have a reputable history.
But meanwhile, the people who are responding to the references are saying, oh, yeah, StankDog.
We've known StankDog for years.
You've taken care of our kids.
He hardly ever beats them.
He beats them when we ask them to.
And they've gained that trust.
And now the person whose faith they've associated with that identity is a trusted source and
has access to their children.
All right.
For the record, I don't beat kids.
I just starve them as punishment.
Oh, my mistake.
Yeah.
That must have been a typo.
But no, that's another good example.
Point being, it's a more broad example than most people probably think, at least most
technology professionals who want to call themselves phishing experts or whatever and
focus on e-mail.
It's bigger than e-mail.
I think we can agree on that, right?
Mm-hmm.
All right.
Now, here's my thing about phishing, and this is why I spit it out so sarcastically.
Why is phishing such a big deal?
No one actually falls for that shit, do they?
I mean, are people really buying into this stuff?
I can't tell if you're being literal or if you're being figurative.
I'm going to answer it honestly.
I mean, people, I guess we know that people are falling for this, right?
Well, I think it was P.T. Barnum who basically said, and I'm paraphrasing here, you know,
design me something that's idiot-proof and they'll design a better idiot.
No, no, no, I'm sorry.
Barnum said, a sucker's born every second.
Right.
And that's true.
That's a sucker born every minute.
It's especially relevant with technology.
I mean, you and I are getting up there in age.
We're starting to become some of the older guys kicking around the block.
Yeah.
And even now, like our parents may not be necessarily technologically savvy, but like it or not,
that's the way the world's moving.
Yeah.
And so even grandma's getting email now, and she hasn't been trained on the streets and
in the underground networks the way we have.
So there's a lot of things that we take for granted that, you know, especially the older
people who tend to be the primary targets.
Yeah.
And I have to shut up and admit that that is true.
It's where we are not the target.
That's why it's easy for me to say, yeah, what's the big fucking deal?
Nobody's dumb.
Well, it's not so much dumb enough.
It's just some people just don't know any better because they don't have the experience
that we do, that we take for granted.
I mean, we assume, you know, the younger generation beneath us, you know, I'm the older generation,
but the younger generation, you know, they grew up with computers every day of their lives.
I mean, honestly, you know, these are kids that have had laptops since they were a little
kid and games and computer.
We're, you know, I didn't grow, I didn't, we didn't even have computers until I got into
like middle school.
And even that was like, you know, not computers like we know it these days.
We didn't have the interweb and all that stuff.
So, you know, it is, it is somewhat your experience and, and knowing better, I guess, for lack of
a better word at this point.
So I'll give you that.
I can see that.
But even so, I mean, are people that gullible in general?
That's my other question, like, look at the spam that I sent earlier, that I ranted about
earlier.
People, I, I, I, I'm, I'm answering my own question here.
People aren't really that gullible, are they?
But people responded to that email.
Are people that stupid?
Well, it's stupid or rich.
I mean, is it, is it really a gullibility, is gullibility the reason?
Is that the issue?
Um, generally, yeah.
I mean, most people interview when we say, okay, now, why did you think that this was
a valid email?
Or why did you think that you suddenly had a Wells Fargo account that you didn't know
about or ever recall signing up for?
Most people respond, well, gosh, I just got taken up by the urgency of it and thought, well,
shit, if I don't sign in now, then my account's going to close.
Even though they don't stop to follow through and think, do I even have an account?
You don't have an account!
No.
Well, that's, oh my gosh, I'm just amazed that that's the answer that people give.
Well, okay, so, so, the Fishers, okay, and I'm going to just use these words because I'm
not going to argue about the definition of these words at this point.
What do, what do they gain for it?
I mean, what's in it for them?
I mean, obviously, accounts.
If you have a Wells Fargo account, you're dumb enough to give them access to it, then obviously
they can have access to your account and take your money out, withdraw, whatever, but what
if you don't have an account?
I mean, is this like spam?
Is there a relationship in spam?
I may be reaching here, so correct me on this.
Is this a relationship to spam where they're hoping that even if they only get .05 response
rate, they still consider it a success?
That's absolutely correct.
It's all about return on investment.
It costs next to nothing to send an email, especially considering the most never being
a symptom-compromised host in the first place, and all they have to do is run their email
harvesting scripts or their malware bot operational tools, just rake in the email addresses all
the live long day, and then turn around and spit the ride back out.
And if only 10 people out of that first 100,000 respond, well, that's still 10 new accounts
that they can sell.
Well, and people are really going in there.
And I'm asking a lot of these questions because I'm frankly, I am amazed that these stories
turn out to be true, because I know that you're telling me the truth from experience.
I mean, I would have difficulty believing this if someone else told me flat face, yes, I
gave my account number to somebody on email.
I would just stand there and look at them, and I'd call, I'd say, you know, you could come
up to me, a stranger, and say, yeah, I gave my account number to some guy in Nigeria last
week, I would look at you in your face, and I'd go, you're a fucking idiot, aren't you?
And then you'd slap him, I hope.
Yeah, I'd kick him in the nuts.
Hey, you know what?
Fishing should hurt.
It should physically hurt.
I think the punishment for being, if you get caught by a fissure, I think I should be
allowed to come to your house and punch you in the stomach.
That should be your punishment.
And you know what?
I bet you every fucking email you get after that, you're going to say, hmm, maybe.
Yeah, right.
You're going to learn to read HTML source code real quick, because you don't want to get
socked in the gut again.
Yeah, and you know what?
Let's keep that.
We're going to put that out there.
We're going to come back to the HTML source code topic.
Let's stick with the general, okay, like, what's, okay, obviously for accounts, access
to your accounts, therefore access to your money.
But it's not always financial.
Sometimes it's them getting access to your fucking MySpace so they can see your pictures
of you jacking off on a picture of Elmo or whatever the fuck you're into.
Dude, I don't know where I come up with these things off my head.
I really don't.
I had no plans of bringing Elmo into the show.
I don't know why I had to do, poor Elmo, he didn't do anything to me.
I'm sorry, Elmo.
Okay, jacking off on your pictures of Big Bird, whatever you're into.
It's not always financial.
I'm more of a Grover man myself.
What's that?
No, no, I said I'm more of a Grover man myself.
Super Grover for the win.
Oh, no, you did not just say for the win on my show.
Okay, well, we can edit that out, I hope.
You suck at the online.
Okay, go ahead.
I suck at the telephone.
Oh.
But, no, you're right.
A lot of the times it's also for personal identification information.
For example, some of these guys will turn right back around and use the identities that they've harvested
through malware or through phishing and set up other sites with them so that their credit
checks, when they use these stolen credit card numbers and all their docs will come back clean,
then they're more likely to get hosting on a site that's not on the RBL, the blacklist.
Yeah.
I mean, you know, majority of the time it does tend to be, at least we're talking about malware and email,
it tends to be about financial information.
Now, if you want to cross that bridge into real life, if we're talking about phishing people over the telephone
or even in person and just saying, wallet inspector, give me your wallet, you know.
Right.
Wallet inspector, what the fuck?
Oh, shit, that was funny.
Everything seems to be in order here.
I'll just take these.
That's good stuff.
Yeah, I mean, people fall for this shit.
I'm going to try that one.
Well, Inspector, you've got to try it at Disneyland.
That's where it's most likely to work.
Like I said, it's all about return on investment.
Hey, that's not far away.
I'll head down there.
And you know what?
But I'm laughing at that because that was pretty funny about it.
I was really laughing.
But I'm laughing at that because it's so ridiculous.
But to me, that's equally ridiculous to get these things saying, hey, we need your eBay account.
I don't have an eBay account.
Hey, we need your Wells Fargo.
What the fuck is Wells Fargo?
I don't have fucking Wells Fargo.
Do I look like I got Wells Fargo money?
I got fucking Bank of America money.
I don't have Wells Fargo money.
What the fuck?
Come on.
That's fuck you money.
I don't have that kind of money.
If I did, I'd buy that IPTV device for $70,000.
See how everything comes back in the show?
See what you did there, Stank?
That was good.
That was nice, right?
I'm going to write that down.
Oh, shit.
All right, and you know what, and another thing here is, I'm going to pose this as kind
of a side topic question.
Why is it that these things always end up coming from Nigeria?
Why is Nigeria specifically, that's the famous country that we see on a lot of this shit.
Why is Nigeria the big buzzword, big country that does this a lot?
Okay, well, that's actually a two-part answer to that question.
The 419.
The 419 is, I think a lot of what you're talking about is a reference to those, good evening,
I'm an ambassador from Nigeria.
We've got $5 billion in an account that we need to get to the U.S., blah, blah, blah.
While typically categorized as fishing, those are actually considered to be a completely different attack.
They're generally called just the 419 attack.
Right.
But more importantly, back to your question, I've not confirmed this, and I've tried my
damage the past couple days to get this, to get some relevant links, so that I'm not
talking completely out of my ass, but I'm told of it, Nigeria does not consider digital
evidence to be admissible in court.
Oh, that's very interesting.
And the majority of the country has such an anti-westerner perspective just from being
on that part of the planet that, number one, they generally don't consider what they do
to be morally wrong, and number two, the police tend to either be organized criminals or they're
bought off by O.C., or they just don't care because they themselves have no love for the
U.S.
Hmm.
Now, Nigeria is the most famous one, again, the 419, as you mentioned, for the area code
in Nigeria, is why they're called that, or the country code, excuse me.
Are there other countries?
Aren't there other countries?
Like, I heard, isn't there one on eBay that's more famous on eBay, even than Nigeria, there's
some, like, I don't know, fucking Latveria or some shit, I don't know, Dr. Doom, I don't
know what the hell.
Isn't there some...
Latvia.
Latvia?
Is that what it is, really?
Yep.
Yep, Latvia.
Country code LV.
LV.
So that's another one to be aware of.
Yeah, and interestingly enough, a lot of fishers are using a bank called the Parex Bank
out of Latvia to funnel through their money through and to launder the money, because
you can buy online through Parex Bank, previously paid credit card numbers, prepaid credit cards,
using credit card numbers, and they are less likely to submit to a U.S.-based subpoena
for that information.
So there's a whole lot of money flowing through Latvia.
Well, and see, there's another interesting thing I did not know.
See, I'm picking some things up on this, even though I still think it's pretty simplified.
All right, so actually, let's kind of go in that direction as far as...
Okay, let's...
I know all of our listeners are all brilliant, but let's assume we have some new listeners
today only that are complete fucking idiotic morons.
Let's do a little public service announcement and kind of give some of the signs of fishing.
We kind of just talked about...
That's why this is kind of a good segue, I guess.
We talked about, you know, the coming from Nigeria or Latvia.
What was it?
Latvia.
A-T-V-I-A.
Dr. Doom's from Latvia.
I think that's what I'm getting.
He totally is.
Yeah, so if you see one from one of those countries, that should at least throw off some warning
signs because they're known.
Now, not necessarily, but I would imagine who's really doing business in those countries.
What reason do you have to do business with those countries?
Let's be honest.
You know?
So, there's some other things that should be giving these away, and these are the things
that make me mad, and make me call people stupid fucking morons, because to me, these
should be obvious things, but they're not to everybody.
Like, if you're one of 50 recipients of an email, odds are it's not real.
It's not singled out to you if 50 other people got the same email, right?
Correct.
Or, if you get the same email from multiple different accounts.
I mean, the 419 scam, for example.
You know how many of those I've gotten in the past week?
Luckily, most of them get filtered, but, I mean, do people, are there people out there
that really see 14 Nigerian princes asking them for their help to smuggle this money out?
Do they really think that there are 14 Nigerian princes who all need their fucking help?
I mean, shouldn't the sheer number of those somehow set off any stop signs?
I mean, do you really believe you hit 27 fucking British lotteries at the same time?
I mean, what kind of luck do you have?
Read my article on hacking the lottery, for crying out loud.
I mean, come on.
What is...
These should be big warning signs.
Am I right?
You're totally right, and I'm not going to give out any names because of the non-disclosure
agreements, blah, blah, blah, but there's one gentleman that we've dealt with.
Normally, we don't deal with the company that I work at, but I'm not going to plug here
because that's lame, but one of the people that we've tried to help was this gentleman
who had fallen victim to a 419 scam, and so we started investigating, and we're going
through a credit history, and we're talking with him, and he tells us, well, you know,
I didn't think that this would happen again, but here we are, and I'm like, well, wait a minute.
You said a word that we don't like.
You said, again, you need to tell me that this has happened before.
Oh, yeah, I lost $10,000 to one of these guys, but you what?
And you went back for more?
Thank you.
May I please have another?
Yeah.
Oh, you've got to be kidding me.
No, it happens, and this is probably the same people who's responding, dear sir, let me tell
tell me about your IPTV application, because apparently they've got more fucking money
than they know what to do with.
You know, and to me, like, if you fall for it and lose your money or lose some money,
that's your punishment.
Yeah.
That's God's way of punishing you for being stupid.
It's a very hard and expensive lesson to learn.
I'm joking, of course.
Nobody deserves that.
I'm just joking, but damn it, sometimes don't you just feel like that?
Oh, my gosh.
Okay, and, okay, another big sign.
If it's filled with spelling mistakes and grammar mistakes, sometimes intentional to get around
the spam filters, but sometimes because they just speak broken English or whatever, do you
really think if this guy's a brilliant investor who makes millions of dollars and you have all
these testimonials from people that they can't spell or complete a proper sentence?
I mean, credibility, does credibility come into play?
It has to.
You know, I would hope so, and I want to believe so with every ounce of my being, but then again,
refer to the guy who fell for it twice in a row.
And, you know, actually, I kind of have a story.
I mean, I think I told this story a couple years ago on the show about somebody who came
to our, let's see, this was, I think, the Fort Lauderdale 2600 meeting.
We had a hire a hacker guy show up.
We have the hire a hacker people show up once in a while wanting us to do their dirty work
or whatever, and we had one guy come down.
We'll politely call him a very much older, an older gentleman who had sent money for some
offshore investment club, quote-unquote investment club.
First of all, offshore, warning sign, signal, beep, beep, ding, ding, ding, ding, watch the
fuck out.
All right?
That was one of our signals from earlier, right?
We already got that.
Sending money ahead of time.
Ding, ding, ding, ding, ding, warning.
Hello?
You sending money ahead of time for something for paybacks later on?
Hello?
Pyramid scheme?
Watch out.
Well, this guy came to the meeting because he sent money to this offshore, and then he
sent some more money to the offshore, and then he sent some more money, and he never got
anything back, and now he wants to go after them and chase these guys down.
He comes with this big portfolio, this manila folder with a bunch of printouts of websites
and email addresses and stuff like that, wanting us to go hunt this guy down.
This guy literally, he wanted us to physically, he was serious, he wanted us to physically go
find out where this guy was in the Bahamas.
He wanted us to track him down, phone number, address, and he wanted us to go down there and
collect.
Not only were we supposed to hack to find out where he's at, he wanted us to go collect
on this bitch, like we're the bouncers, which, you know what, sounds actually kind of interesting.
I was up for it, but, yeah, you know, I didn't have time.
Well, he sees somebody like this and you say, okay, where do I want to go vacation this month?
And then, oh yeah, the Bahamas, he's staying at the Doubletree Hotel or whatever the fuck
they have out there.
You know, if I was evil, if I really wanted to have been a dick, I would have said, sure,
I can find him for you.
I'll just need $5,000 cash up front.
Yeah.
He's going to fall for it, you dumb fuck.
Oh, just give me access to your bank account so I can pull out a nominal fee for amenities
along the way.
And, yeah, we'll go hunt him down for you.
And then I'll just call him.
Yeah, I'll call him once every week or so from the Bahamas or from Nigeria or where
the fuck I end up, saying, yeah, we're still hunting him down, everything's going well.
We need a little more money, though.
The account's running kind of low.
Yeah.
We're really close, really.
We're really close.
But we need another inner tube for the river, I mean, for the jeep.
Exactly.
For the jeep.
Yeah, we need some more guns mounted to the front of the car.
If we do get him, it'll be good.
Yeah, exactly.
Oh, we'll bring his head back on a spike.
We think that he's hanging out in Tomorrowland at Disney World.
We can't be sure, though, so we'll need to go check it out.
All right.
Oh, all right.
Well, you know what?
There's some other obvious tells for e-mail.
Broken images or links, if it's just sloppy.
Not necessarily, but it's, again, a warning flag, and it's a matter of putting all these together.
And that's a warning sign because these sites get taken down pretty fast, right?
Correct.
So by the time you actually read yours, the site's been taken down, and therefore all your images and stuff or whatnot are broke, are broken, so.
According to the FBI in our recent talks with them, the 90% of phishing return investment happens within the first 48 hours of the e-mail being sent.
After that, it's pretty much exponential decay.
They almost get nothing after three or four days.
Which goes back to what I kind of said earlier about the .05% or whatever.
They're happy if they just get a couple.
I mean, if they get one guy, and they sucker him out at $10, $20, $50 grand, that's a pretty big payday.
Yeah, definitely.
Especially in Nigeria, where our dollar is like $10 to $20 of theirs.
Oh, man.
You know how much whatever the fuck they cornmeal or shit they have down there.
Water.
Yeah, exactly.
That could go a long freaking way down there.
Let's see.
What's some other things that come to mind, like some other warning signs?
Like, if it's legitimate, they're probably not going to be on GeoCities, right?
Right.
You know, they're not going to be on some other free hosting whatever.
So, if you see anything from GeoCities or fucking MySpace, that's probably not legitimate.
Or, how about the TK sites?
Yeah, the TK, the CX, the .ro, the .ru.
The .lv, is that what you said?
Yeah, .lv.
Indonesia's gotten really popular with fishing.
I think they're one of the I-N-I-L, something like that.
Yeah, .cx.
I am so sure that your people are going to really give their money to the site that runs parallel with the GoatSea guy.
Right.
I mean, come on, people.
Seriously.
I mean, I don't know.
Again, our listeners, I like to think, know better.
All these things are just silly redundant to them.
But, for those of you who don't know any better, all of those things should send off some warnings and at least make you question it.
And, by all means, if you get ripped off, don't fall for it again.
If you get ripped off, what you need to do is unplug the network cable to the back of the computer, find a box in your closet, throw that shit back in there, and take it home because you're too fucking stupid to own a computer.
Yeah.
That's my technical advice.
That's a procedure.
There you go.
And, Giff Robert?
It's worth mentioning, though, that there's a lot of piss-ant script kiddies that are doing this and that are just looking for the ROI.
But there's also the really hardcore organized guys who do this as a living, and they tend to be funded by, you know, some guns out in Russia or Romania or wherever.
And they'll buy fuzzy domains, which is a domain that looks like the victim, like, looks close enough to where if you're only half-assed glancing at the status bar in the bottom of your browser, that it might look legit.
For example, updates.images.com.myspace.com slash boobs or some other app key or URL-encoded images, they'll set up something that looks close enough, like the original, that people will fall for it.
One of my favorite ones from MySpace is R-N-Y-space.
So the R and the N next to each other will look like an N.
That's leet, though.
I like that one.
That's pretty cool.
Or, like, I was thinking even simpler, like PayPal, P-A-Y-P-A-L-L with two L's.
People might not, that might not grab your attention.
And actually, since you mentioned it, I didn't even think about this as worth mentioning on the show, but this is a good point, is in your browser toolbar, a lot of the browsers now are incorporating anti-phishing technology, whatever that means.
It fucking flags the site as a phishing site.
I don't know if that's really worth buzz-wording it as anti-phishing technology, but.
It's snake oil.
Yeah.
But it works.
I mean, that's a good thing.
It is useful.
If you've got a big yellow bar in your browser in your URL window, that's a warning sign.
And, well, look, unfortunately, the heuristics aren't there enough to the point where the browser can say, oh, this is paypoll.com and not PayPal, so this is probably phishing.
Although, generally, too, and please correct me if I'm wrong, you can send email to the show, is they will then alert some sort of phishing incident response team of the URL of that site for later investigation.
But it's an after-the-fact sort of defense, so what's the point?
Well, and isn't there, isn't it like, I want to say Secunia or Netcraft, I think, that have.
Netcraft has one, yep.
Yeah, that it's more of a user-submitted thing, and if enough users say, hey, this site is a phishing site, it'll flag it for you.
But, again, that's reactive, not proactive.
It's hard to be proactive without having a lot of false negatives, which, again, that's a common technological hurdle, and especially with email and anything technologically related is reducing or eliminating false positives.
And it's just not completely possible.
No, it's the same as spam filters or any other anti-nuisance technology.
It works pretty well, but it doesn't work well enough.
And you have to think that if someone's stupid enough to fall for a PayPal phishing, they don't even have PayPal, then what good is more technology going to do than on the client side?
You can't upgrade ignorance.
No, but it sure as shit gets downgraded quite often.
Yeah, no lie.
You can throw more money at the problem, for sure.
Yeah, but, yeah.
It doesn't always take, does it?
Well, since we're kind of moving into more of the technological, boy, where the fuck am I getting my speech impediment from today?
Let's look at the technical standpoint, I guess.
I suck at the talking.
You suck at the verbal.
Oh, no.
No, that sounds dirty, sexual.
Yeah, no.
Let's not do it.
Let's not go there.
I won't drop the talk for anything.
Yeah, those pictures are supposed to be private, and I'd appreciate it if you keep them that way.
Okay.
But, yeah, technically speaking, again, I ask the question, what's the big fucking deal?
What is so complicated technically about this?
You get an email, right?
Okay, let's focus on the email phishing.
You get an email.
Like, the other stuff is, okay, let me back up and phrase my words correctly here.
I talked about non-email phishing, phone calls, face-to-face pulling of information.
That, to me, is more an art of social engineering.
It's convincing people, tricking people, convincing people by your actions and speaking to do something, to take some other action.
In email, you're doing that, but you have the added anchor, I guess, of people being able to look physically, I guess not physically, virtually, at your email, breaking it down.
Where did it come from? Are there typos and spelling mistakes?
You don't have typos when you're speaking.
Grammar helps, but even that, sometimes you intentionally want to use bad grammar if you're simulating someone from another country or someone young or someone whatever.
There's a lot of reasons you may intentionally want to do it.
But in email, you're laying a lot of, I don't know if evidence is the best word, but you're laying a lot of clues out there, like the things we mentioned earlier, that can give it away.
Anyway, so why is analyzing email phishing such a big deal?
What is complicated about it that I am missing?
Explain to me why it's a big deal to do a view source of the email.
What are we really going to get out of that that we don't already know?
I mean, you give me a piece of phishing email that you've gotten, I'll look at it for three minutes, I got it.
It's not that complex to me.
Am I oversimplifying?
I'm sure I'm oversimplifying it, but explain why.
Well, you're making an assumption that the majority of the people understand how the right-click button works, and this is some pretty new technology.
I mean, it hasn't been out a long time.
Well, Mac users still don't have it.
Yeah.
Yeah, Macs, well, you know, I'm not going to say anything about Mac users because a lot of my friends use it, moving right along.
But one thing that's worth mentioning, and it's kind of a sidetrack, is that the majority of successful phishing attacks, and I know you might have a problem with that term when I go into what I'm going to say, is it's all malware-related.
The majority of it, I would say upwards of 80%, is harvested as a result of O-Day exploits in the Internet Explorer browser that drop malware that doesn't grab keys, doesn't key log, because phishers don't really give a shit if you're chatting with your girlfriend over IM and having cyber sex or something.
What they're grabbing is the forms from your browser, so any type of post that you're making to Hotmail, to Yahoo, to PayPal, anywhere, all tends to be captured and then touched to a PHP script on some foreign server somewhere, and the majority of the people who get phished don't ever realize that they've done something wrong.
They can go their entire lives without ever actually opening an email and still get completely owned.
And usually it's through peer-to-peer networks, people who don't understand that britneyspears.mp3.exe is not, in fact, her latest single.
And the thing is that nothing happens.
You know, they double-click the binary, their window screen might refresh for a second.
If that, nothing happens, they go, huh, that's a better keep looking for Britney.
And they move right along.
That's weird.
That download didn't come down successfully.
Delete.
Too late.
Your own.
And they move right along.
That's really, actually, that's kind of interesting because I didn't poorly think of that angle as phishing.
But if you're intentionally putting out a file like that for the purpose of people getting it, that is absolutely a definition of phishing, going back to that global definition we did earlier, which is, again, why maybe some of my angst or some of my anger against it is because it's specifically targeted, I guess, now that I've analyzed it a little bit more on the show here,
is targeted towards the email phishing.
And that's the part that really seems to annoy me more.
Because you shouldn't fall for that so easily.
But the other good point you made along those same lines, or more related to that, was you're saying, I mean, are you getting, like a PHP script, you have to browse to a page to do that.
You have to actually activate, you have to go there out of your way to do that.
And if those flags that came through earlier that we talked about didn't trigger it for you, then, yeah, I don't have a lot of sympathy for you.
Now, but you said that they're using, like, some zero days.
Like, are you saying they're executing some script that runs automatically just by viewing the email in some cases?
Are you familiar with the WMF exploit?
Well, here, I'll just real quick, I'll go over it for all the folks who may not know.
It takes advantage of the way Windows handles certain types of media that it will just blindly trust and arbitrarily execute.
And this exploit takes advantage, I think it's a heap overflow, but it's irrelevant, and basically causes your computer to then, once you've got the exploit, to download a series of other tools.
And it's never just one, it's like cockroaches, they usually end up uploading about 10 to 12 different backdoors to your system, so that even if you get, you know, three to seven of them with outerwear or whatever, there's still a few hanging out in your system that just haven't been identified yet.
So, it really is not as simple as I'm trying to make it out to be.
Well, in some cases it is.
Sometimes it's as simple as viewing source, looking at it, and you see, oh, look, it's going to paypull.com instead of paypal.com.
Sometimes it is that easy, but not always is what you're saying.
Correct.
That's a good point.
I'm going to backtrack a little bit in regards to web-based phishing attacks or email-based phishing.
Another thing that we're seeing that makes it really hard to mitigate is this malware that people are getting installed on their computers via whatever method.
They also set up web servers and set up IRC networks, and they will update their local IP address to this malicious DNS server, so that even if they've got 40 of these web servers with phishing attacks that all go to the same place,
if 39 of them still get taken down, they've got that revolving door DNS that just says, okay, fine, and then switches over right to the next system.
And so at any given time, one URL could conceivably point to as many as 40 to 50 machines.
Right, and, you know, we could, at this point, maybe make a segue into another topic, specifically botnets.
I know it would be a good segue for that, but we're not going to have time to do that on this episode.
We're going to have to make that a topic for a future episode.
Absolutely.
But technically speaking, is there anything else to mention or that I'm oversimplifying or that needs to be clarified at this point?
Well, let's review it real fast.
Email-based, web-based, malware-based, being a moron.
No, I think that pretty much covers it.
Yeah, but 95 percent – tell me if my estimates are wrong.
95 percent of them – I would even say 99 percent of them, 98 percent of them, I'll say, come from being a moron.
Or I'll be polite, come from being a moron, or simply being uneducated or ignorant about scam or what's normal and what's not normal.
I can't be polite.
You're a fucking idiot.
I'm sorry.
I can't do it.
I try.
I mean, we're seeing a shift in trends that it's not so much just a tricky user base.
It's more of a – it's moving the malware.
There are more and more people, even grandmas, starting to realize that don't click the link from the e-mail login from the browser.
And so there's big money in custom malware operations where people will write – remember Netbus or Sub7, which was a remote-access Trojan that looked like a whack-a-mole game.
For sure.
And it would install, you know, you would open people CD-ROMs or whatever, close them, thing kind of concept.
It's just any time you're masquerading someone.
But I saw some interesting statistics on FlashDot not too long ago that basically said that 70 percent of people who were shown phishing e-mails and regular e-mails side-by-side were unable to discern the difference.
Nobody got them all correct.
Oh, get the fuck out of here.
You know, I got to find the link to that.
Give me – I was going to say, no, bullshit.
I'm calling bullshit on.
I'm calling shenanigans.
Bullshit.
Give me the URL.
We're going to put this in the show notes and in the forums.
I got to see that.
We're going to – all right, motherfuckers in the forums, we're going to put your asses to the test.
Put the shit out there.
Now, we're going to trust you to be honest with your answers.
I'm going to put a poll or something out there when we find this.
And let's see how many of our users fall for this.
And be honest.
I'll admit it if I fall for them.
I'm not going to fall for it.
I'll tell you right fucking now.
I'm not going to fall for this shit.
But I'll be open-minded, and I'll be honest if I do.
I will suck it up and admit I'm a fucking moron.
Hey, somebody's going to take that clip and loop it a million times.
I'm a fucking moron.
It's already a three-and-a-half-minute song on somebody's MySpace.
Yeah, I'm not having any luck pulling that link up right now.
We'll get that out there.
We'll get that out there after the show sometime because, yeah, that's – I'm amazed that that – no.
I'm not buying it.
Not for a second.
Anyway, we're kind of running out here.
So let's briefly touch on a couple little things.
And I really don't – can't spend too much time on this anyway because I don't know the answer.
But whose problem is this really?
I mean there's a lot of companies and people that spend a lot of money researching and investigating, email phishing.
Whose job is that?
I mean is it PayPal's problem if someone else in Nigeria is phishing using PayPal's name?
Is it PayPal's problem morally, legally?
I mean why should PayPal care?
Or do they?
Do they care?
I'm sure they do to some extent because their ass is hanging out the window on the matter.
Is it –
But it's not them.
Between you and me, is it their fault?
Fuck no.
Of course not.
Right.
If you're too stupid to –
Between you and me and the thousands of listeners.
I'm sorry, go ahead.
I'm sorry, I said between you, me, and the thousands of listeners, yes?
Yeah, yeah, we get it.
But I mean it's the same thing as if your kid's in Walmart and he pockets the newest G.I. Joe and walks out of there.
You know, and this is a bad example but I'm going to run with it.
Whose fault is it – who's got the onus and generally considered is the parent's responsibility because they should have educated them.
As PayPal or as a larger corporation, you pretty much can't trust users.
I mean that's the golden rule of security is never trust user input.
So – but at the end of the day, they've still got people in their public relations department and they've got their human resources and everybody else with their thumb up their butt trying to say, okay, well, whose fault is this?
Because you sure can't expect the users to get wiser.
It goes back to the part I'm saying there's always going to be another idiot born in another second.
Right, right.
Now, what about – I mean are there any cases that you know of?
Again, we may not know the answer to this and if somebody does, by all means email us.
Have there been any cases where a company, again PayPal for an example, has been sued by somebody who got phished by a third party or whatever?
I mean is there any – not judicial – is there any legal liability on behalf of PayPal?
Because, again, it's not their fault if some third party person pretends to whatever.
I mean to me it's not PayPal's fault.
However, to a certain extent they do have – they do have an obligation of some kind to at least put up warnings that says,
warning, PayPal will never ask for your email or ask for your password via email, etc., etc.
I mean have there been any cases – have there been any cases yet and do you think there ever will be if somebody's suing a company that didn't actually commit anything?
Because I'm worried that that's the direction in our legally sue-crazy country that we live in here in the United States these days.
Yeah, you took the words right out of my mouth.
There's not been a case that I know of, at least that is to say, that no one's made a big enough stink to get a lot of media attention.
But I expect that to change because, like you said, America is sue-crazy.
And I've seen people win wackier court cases.
I have to expect there to be an example in the near future where they will be found, at least to some level, legally liable
because maybe they didn't make their warning message in size 47 font and bright red.
Right.
Hopefully that won't happen to that extreme.
But I would not – you're right.
I wouldn't be surprised.
I'd be ashamed if anything.
But, yeah, we won't go too far in that direction, I guess.
The only other thing I kind of thought about mentioning, and I think we've already done it throughout the episode,
is some examples of this, like definitions of fishing not online versions, like we talked about, you know, phone calls or real-life fishing.
I mean, there's real-world fishing going on, like you said earlier about the wallet inspector, which was great.
But, yeah, there's people buying – there are people buying the Brooklyn Bridge every couple days, right?
I mean, these real-life fishing rip-offs, scams, whatever you want to call them, are happening.
I mean, there's – I see things on the news occasionally about these homeless people out in the street that are begging for money,
and they follow them, and they go home to their nice big house with their BMW in the driveway where they completely fished you into giving them money.
I mean, these are – these are fishing, right?
These are examples of fishing.
It's just that this is real world.
Or like the ones – I think this is a great one, a guy dressing like a valet that just stands in front of a restaurant,
and you hand him your keys, and he steals your car?
And he just walks out of your Ferrari or drives off.
Yeah, that's – those are real-life examples of fishing.
Am I wrong?
Yeah, that's absolutely correct.
Is there really any different – I mean, those are as ridiculous and stupid to me as some of the e-mail ones,
which is why I get so flustered about the whole thing.
But it's the same damn thing.
It really is to me.
They're both – they're all that stupid to me.
I see the zero-day.
Anyway, I'll admit that you've changed my opinion somewhat in that the zero-day exploits,
some people might not know any better.
You open an e-mail.
But see, again, that comes to a level of experience of the user and whatnot,
and I don't run any scripts or even have images displayed on any of my e-mail
because I know that kind of thing can happen.
First thing I'll do is I can see where it came from, see the subject line,
and does it sound fishy, like, hey, hot stuff?
Guess what?
Nobody, except for you, sends me e-mail that says, hey, hot stuff.
You said you weren't going to tell them about that on the show.
Don't worry.
I'll edit that out.
Trust me.
Okay, okay.
So if I see that in there, I immediately get, you know, flags go up, warnings go up.
Or if it does look realistic, like, you know, the ones that really annoy me
because it makes me have to at least look is, hey, you asked for this.
Or, you know, like the ones that use R-E colon, like they're replying to something you said.
But it has to be believable, like, R-E, here's that file, or something like that, you know?
Then you have to say, okay, well, there's a flag up,
but it could be Savant sending me a text file of something we talked about.
You know, it could be real.
But that's why then I'll go look at it and don't execute any scripts,
don't execute any attachments, for crying out loud.
And I guess we'll end this episode even, not only this segment, but this episode with, you know,
something we always come back to, and I'm not going to preach on it again,
but quite frankly, it comes back to generally being secure in your online activity.
Even if you are smart about your emails, have a spyware scanner.
Have a pop-up blocker.
Have an adware scanner.
Have an antivirus installed and updated, because they'll catch a lot of these zero days.
Yep.
If you update them frequently.
Don't use it on Explorer.
Yeah, there's another message.
Although, and I don't mean to diss Firefox, but they're having some problems lately with security.
Oh, yeah.
They've got issues.
But they're not high E, so I'm still going to push that out there.
So, yeah, I guess, you know what, I think that's about it.
I think we've said everything that needs to be said about fishing, probably more so, but I don't know.
I can't figure out.
Another thing is, there are people writing entire books on the subject.
You know, saying that you're an expert on fishing is, I think Strom said on an episode one time,
it's like being the tallest midget.
It's like, to me, you're saying that you're the smartest moron.
Well, that's great.
You're still a moron, you know.
You can be the most beautifully sculpted turd.
You can take a dump that looks like the Virgin Mary herself, but it's still a piece of shit to the rest of the world.
It really is.
Well, let me say this real fast.
You say the rest of the world, but I must point out that people who are writing these books on fishing are selling a lot of copies.
Well, and you know what?
I can't say much.
Government agencies and financial institutions are thanking them for it firsthand.
And I can't respond to that.
You're absolutely right.
I mean, all I can do is shut up in response, because obviously, there are people that want it.
So, most of the world...
There are other people falling for fish.
Maybe.
I'm going to end with this.
How's this for a mind fuck to end the show on?
Maybe.
Maybe those of you out there that are, I'm going to say, dumb enough to spend $40, $50, $100 or more on a book about fishing got fished your damn selves.
You've got an episode right here of an hour and a half long that tells you everything you ever wanted to know about fishing for free.
Downloadable from the site.
Maybe you got fished and suckered into buying a $40 book or more.
Anyway, I'll just throw that out there and leave that hanging.
Hopefully, I don't get you in any trouble for that.
But, you know, what are you going to do?
I'm honest on the show.
I admit, though, that there is some stuff that I picked up on here.
So, I'll admit that the need is out there.
It's just...
I guess what it comes down to is it's not for our listeners.
It's not for me and you.
It's for other people.
There you go.
And I choose to call them morons.
But that's just me.
You better hope they don't listen to the show.
You know what?
Fuck them if they do.
Yeah, fuck them.
Fuck you all.
Seriously.
You know, what are you going to do?
Fish me?
Come on.
Yeah, just disclaimer.
Don't actually fuck yourself.
Any or all injuries that you obtain while fucking yourself are no longer the responsibility of DDP,
Hack Radio, or anybody involved.
We will not be held liable.
All right.
Shout-outs for the week.
I'll go ahead and do mine so you can think about it.
Verbal.
Give shouts out to Verbal.
Hope he's feeling better.
Talked to him earlier.
And to everybody that's participating in the BinRev Mentorship Program.
And I'm sure you can second me on that one.
And what else you got?
Absolutely.
Well, I definitely want to give a shout-out again to Verbal.
The guy's been awesome.
He's been working with me in the BinRev Mentorship Program.
And we've been dialoguing a lot.
Good guy.
Also, Black Ratchet and I have been doing a lot of work together.
Venom on IRC.
Just wanted to say what's up.
But the biggest shout-out, go to the lead attacker I've ever heard of, Frederick P. Lackey.
Oh, man.
See?
You uttered his name out loud?
Man.
I'm not sure if people are ready for the Lacster.
I'm not sure if they're ready for the glory of Fred Lackey.
But you know what?
I'll second that because he's pretty fucking elite.
You cannot argue with his credentials.
The world fears.
So you've got to fear his mad skills.
So I'll second that.
Our site of the week this week is Geek Love Radio.
Oh, I'm going to throw some shouts out to Quine, too, by the way.
I mentioned his name earlier.
To geekloveradio.com.
Season 3 started yesterday.
So that is our site of the week.
Go check them out.
Our good friends DJ Mollusk over there and Sub-Zero in the Hazy.
Season 3 started yesterday on the 18th.
So go check them out.
Email us.
Feedback of any kind.
Radio at BinRev.com.
And the closing music, I'm sorry to do this to you.
It was going to be you singing I'm a Little Teapot.
But I actually found something else.
I know you can do it next time.
We'll hold out.
All right.
Tonight's closing music is from Bad Spella and MC Frontalot.
It's a new song called, and I'm going to mispronounce this,
and nerds everywhere are going to hate me for it,
Rhyme of the Nibelung.
Nibelung?
N-I-B-E-L-U-N-G.
I probably pronounced it wrong, so I guess I'm not a true nerd.
But whatever.
So that's going to do it.
Again, Savant, thank you for being on the show.
Thank you for having me.
A very full episode.
And we are going to close it up and tell everybody that we will see them next week.
Same hack time.
Same cheeky cheeky channel.
Oh, shit.
I've got it.
I did to go see the ring.
I thought it was probably a musical about hobbits.
Started out promisingly enough.
Little fella running around.
There were trees and stuff.
And there's shelter from the storm.
And a girl, it seems.
So the dialogue don't make no sense to me.
And the hubby come out.
He looks a little menacing.
Says he gonna eat you like a little piece of venison.
When it's a morning, I guess I'm confused.
Does the wife know the hero?
There seems to be clues.
There's a sword and a tree.
Why is a tree in the house?
Did she slip a man to make you?
How come sicky don't get out?
How come neither of them make you up the hills right now?
As for brothers, love and sisters, isn't this disallowed?
Isn't this kind of how bad fates come about?
I'm gonna need an intermission just to figure it out.
Now here come Papa.
He's the one I jacked.
Runehilda is the daughter with the armor on the rack.
Does he lack in discretion?
He backs up quick.
Daddy Voto never seemed to step to my prick.
She got him by the thick of the beard.
She's insistent.
But the subtitles thicker than I missed it.
Odin don't get to get his son killing dragons.
Still sounds like a job for the elder Baggins.
Ain't even alright to get his daughter to fix fights.
It's about to go to sleep in my seat.
Alright.
Cause the music's hella stupid.
It don't got no beats.
And that's the 22nd time I heard the light motif.
And I cite no grief.
But opera anthony's for the kind of people, yo.
Who listen to the CBC and sip on tea.
And read up on the paper.
Another intermission coming.
I'ma be the great escaper.
Sneaking out the lobby.
Got usher by an usher.
Showed me to my role and reminded me to usher.
Never settled in.
Waiting for the boredom to commence.
Definitely unprepared for what comes next.
When the strings set in.
And the horns come chasing.
It's kind of like, I got rewarded for my patience.
This is more like it.
This I could keep.
Ladies in helmets, you ride 18.
Moving down in my seat.
I'm rocking and squirming.
Even the most got over the fact that they're talking German.
I'm learning.
I might even have to come back.
Wonder if they sell a ticket for just the third act.
That's on the way out.
Did I follow?
I say sort of.
And I got to say, I'm glad that we're with the rings that there's an order.
I saw a lot of similarities, but I'm pretty sure that this was an adaptation of Star Wars.
I mean, you know, the twins and everything.
I'll probably go look it up on the internet.
You know, just to be sure.