This is dedicated to all the hackers and the crackers, to the hackers and the crackers.
I see in binary, I speak source code, step on my toes, I'll post a million jpegs of you
and a fag pwned.
In your digital stance, getting firewalled ho, cause I'm riding the net in my six-fold.
I was a dick with my 56, now with my cable I'm able to get that stable.
On the out, my name is Ace and I'm a Leo. On the digital highway, my name is Neo and I'm a hero.
In a flash, I'll screw you on burning Dreamcast. You need some ISO? Let me through my hard drive rifle.
Our exchange you could never stifle. In a digital hug, you just caught the love bug.
I bootlegged your CD, I caused a fight between Un and Jay-Z.
Your CG, it's all gonna be free, whether we take it by force or we take it nicely.
You feel that rattling your bones? When I tell you we just hacked out Jones.
And NASDAQ leaves you flat on your back, cause I am he who loves to hack and crack.
Cause I am he who loves to hack and crack.
This is dedicated to the hackers and the creepers.
Serial codes, source codes, ISOs, RANs, SIFs, SIFs.
This is dedicated to the hackers and...
Hello, everybody. Once again, you are listening to Binary Revolution Radio, episode number 170.
170 episodes of our weekly radio show about hacking, technology, and all the other fun related things that go along with it.
Today is, let's see, October 24th, 2006 is when this is airing.
And you know something? I'm gonna start off the show...
People who've listened to the show from the beginning or for a long time know that I have a tendency sometimes to get corny about things
and try to keep a whole positive outlook on hacking and what the quote-unquote community is all about.
And, I don't know, I kind of...
Maybe I'm sentimental or maybe I'm just...
I don't know, whatever I am.
But, I kind of have been having this little thought process lately of how much fun I've been having hacking again lately.
I've actually been getting some time to do things and getting back involved in projects and working with other people on projects.
And even better yet, you know, watching other people develop their projects and maybe helping out, giving advice, and watching the community put a lot of cool things out.
So, I mean, it seems to be meshing back together now.
There's not so much drama mixed in.
And it just kind of got me thinking and realizing that hacking is starting to be fun again.
I mean, I've said on the show many times before that hacking is about learning.
It's about educating yourself.
It's about educating others.
It's about laughing and having fun and enjoying things.
Because, you know, if you're out on a website and hacking away at something or researching something or trying tricks on things,
Hey, will this work?
Hey, I wonder if I can do that.
You know, you should be on the phone.
If you're not laughing out loud, calling somebody on the phone and going,
Yo, Not Theory, dude, check this out.
Look what I just found.
You know, hey, Bland and Quizzer, check this out.
You'll never believe what I found.
If you're not excited about what you're doing and you're not enjoying what you're doing
and you're not laughing and sharing with other people and having fun,
I guess that's the short answer, the short way to say it.
If you're not having fun while hacking, you're not doing it right.
You're doing something wrong because hacking is supposed to be fun.
It's supposed to be something you learn from and something that you enjoy doing.
If it's work and drama and fighting and arguing and putting people down
and all this attacking each other and negativity,
you're not hacking.
No matter what you think, no matter what you may do, you're not hacking.
It's just not what hacking is supposed to be all about.
And, you know, my co-host on the show this week, you know,
I think epitomizes that more than anyone I know.
You know, maybe that's why I'm kind of verklempt for this episode of the show
is because co-hosting the show with me is someone that I've been good friends with
for a long, long time in the hacking scene,
someone who I meet up with at conferences quite a few times a year.
We talk on the phone quite regularly.
Sometimes we'll go through little phases where we talk less than others.
But Dual Parallel is joining me on the show again today.
So Dual, and possibly, now correct me if I'm wrong,
we might possibly have an appearance by Mrs. Parallel as well.
Yeah, yeah, she's here right now.
We might get a bonus appearance, a bonus co-host on the episode.
Okay, I've got to say, that's like the fourth DTMF I've heard.
Are you like, is your like foot on the speakerphone?
What's going on?
No, no, my phone still sends random DTMF tones out every once in a while.
Are you serious? That's really cool.
I don't hear them.
What a great feature.
Yeah, I don't hear them.
Only people on the other line hear them.
But, yeah, I know they exist.
That's another one. What the hell?
I don't know.
I think it interprets.
No, I think it interprets the numbers.
I think it interprets my voice and turns them into touchstones.
Don't worry, call the ghost.
Stop that.
Uh-oh.
Okay, hold on, here.
Hi, Snake.
Welcome to the show, Mrs. Parallel. How are you?
I'm doing well. Thank you so much.
I know.
You're having me on today.
I know that we're keeping you away from your Yu-Gi-Oh! and your Pokemon.
Actually, it's Naruto, but that's okay.
Naruto, excuse me.
Yes.
But I actually, now see, I actually know who that one is.
I saw that on the DVD rack.
That's the head with the goggles and the orange vest or something, I think, right?
Yes.
Yes, I know who it is.
I've never watched it, but, you know, you Japanimation extremists.
It's Duel's fault.
I know.
He got me into it, so I just blame him for everything.
Well, yeah, that pretty much works around here, too.
That's a pastime.
It's Duel's fault.
It is Duel's fault.
Anyway, how about any housekeeping we want to do at the top of the show?
You got anything for us?
Me?
Yeah, you're on the show.
Housekeeping.
Any news you want to announce?
Any, uh, what kind of hacking have you been...
Any news, honey?
Remove me?
No.
No, nothing.
No, we don't have anything that we're announcing.
We've already been married.
No kids.
Nothing like that.
Okay, well, yeah, I think, um...
I don't know if we ever actually made that public information.
I think Mrs. Parallel infers the marriage at this point, right?
Oh, yeah, we got married quite some time, about two and a half years ago.
Yeah, yeah.
It's been a while.
I think most of the people in the community know who I am.
Well, and, you know, we've met up at...
I meet up with you as often as I meet up with Duel, because we were in Vegas this past year.
And we were in, where did we go, New York last...
Two years ago, was it?
Yes, that is correct.
I was there.
So, she's around and in the scene as well.
Maybe more than Duel.
I am.
I actually go to 2,600 meetings with them as well, so...
Do you really?
You didn't tell me.
I didn't know you started going to the meetings.
I do.
I go every so often.
It's actually a really nice group.
They welcome me, even though I'm not technical, per se, but I can hack in my own...
You use Linux.
I use Linux.
You use security.
I use scientific Linux.
Yeah, you use...
Of course, it's me too, but I use it.
Yeah, you have scientific Linux, although I hear you...
I do.
I hear you have a bad habit of putting the...
Closing the laptop without shutting it down.
Ooh, did he tell you that?
Oh, yeah.
Yeah, I bet everybody who's listening is probably cringing to that right now.
Yeah, I do.
I don't know what it is.
I'm...
Yeah, I'm not real technically savvy, so...
But I did use, what, Slackware?
Slackware, yeah.
Before I used scientific Linux, so that was...
He did all the command line, backend stuff.
I just clicked the buttons.
How about Ubuntu?
You know, I'm not familiar with Ubuntu.
Oh, I thought you tried that before.
I thought you...
I don't think so.
I don't think you put that distribution on my computer.
But I did...
What do you think?
I did break Gmail, though, trying to get an account there once.
You broke Gmail.
I broke Gmail, yeah.
So that's why he is the sysadmin for our household.
Ah, gotcha.
All righty.
Well, how about Mr. Parallel there?
Does he have any housekeeping you want to do?
Let me hand the phone over.
Hold on.
All right.
My wife broke Google.
It was awesome.
I know.
Google doesn't like any of us, I don't think, anymore.
But that's a rant for another day.
Okay, let's do a little housekeeping here and move on.
What, um...
Well, you got anything for housekeeping?
I mean, geez, it's been so long since you were on the show.
No, no.
Gosh.
I'm ready to roll.
All right.
Well, cool.
Let me do a couple little things.
Um, I have been making a lot.
I've been doing a lot of work in the forums, making a lot of forum upgrades lately.
Um, one of them was, uh, one of the smaller ones, really, was rearranging the meetings sub-forums.
We used to kind of thought that it'd be a cool thing if we gave everybody their own sub-forum for their meetings sites, so that way they could still stay in the main forums where people like to hang out and have their sites separate.
Well, I think that was just fracturing it too much.
It was causing it to be a little bit too chaotic and mixed up from here to there, so I cleaned all that up and just made one giant general meetings forum, so it's still active and we're still doing meetings.
There's still new ones coming up, uh, all the time, so there's nothing changing about it other than kind of rearranging the forums.
A little reorganization, if you will.
I also added some XML feeds.
We added, um, something I've been wanting to do for a long time and hadn't had the time to do it, uh, adding a lot of XML feeds from other sites into our forums.
They come in and they're just like forum posts, as though they were posted by a user.
Got a little engine that will pull that data in there, post them, allow people to reply to them, so you can get all these latest security headlines and news topics and then have a conversation about them.
How does this work?
Has anybody heard of this before?
I wonder if we can do this better.
What happens if we change this?
So it'll hopefully stimulate a little bit of conversation in the forum.
So we're going to keep it minimal, though.
I could, there's so many sites we could add that could really take up a lot of room, but we're going to keep it pretty, pretty minimized.
And the other big thing, and Duel, you'll probably would enjoy this one, I think, is we added a new forum, and it's called New Projects.
It's a new forum for people to come in and propose and work on projects with each other.
Now, because I get a lot of email from people saying, oh, I want to help out or I want to work on something, but I don't know what to do.
I don't know what to work on.
Can I help with this?
Do you need any help on that?
And, you know, we do, you know, ask for help on a lot of different things, and we do get a lot of help, but I thought it would be cool to add a forum out there.
And we had a few people request this via email as well, so it looks like the demand is there.
Where we can post project ideas, whether they're as simple as, hey, I'd like to see an article on this, or I want to write an article on this, can someone help me, or do some research, things like that.
So we put a forum out there so that people can get together and help come up with ideas for each other and help work with each other on doing things, whether it's as simple as an article, starting a new website that's helpful, writing a new application, anything, from coding down to research to whatever, all that kind of stuff is fair game in that forum.
So I'm looking forward to seeing what comes out of that.
That's a rule.
Yep, and I think that's all that I've got, so why don't we move into some email.
Yeah, we've got quite a bit of email this week, as it turns out.
I have one email we're going to start with from Doc Simmons.
Doc Simmons says...
Is that the guy who does, like, exercises and stuff and...
What?
What's that, you know, he's got the afro and he wears, like, little shorts and...
Uh, Richard Simmons?
Richard Simmons.
I'm sorry, wrong guy.
Sorry, sorry, sorry.
Okay, go on.
What's the name of the doctor from Back to the Future?
Back to the who?
Back to the Future.
Oh, what's that dude's name with the gigawatts?
Christopher, was it...
Oh, man.
Christopher, no, wait a minute, Lloyd?
Just Doc, because his name's Doc.
Just Doc?
Okay.
Well, it's something about it.
I don't know.
Richard Simmons, okay.
I'm sure this is not either one of those people.
How about that?
Yeah.
Doc Simmons says,
Dear BinRev Dudes,
I was listening to episode 165 on fishing.
Over the summer, I made a fishing page from MySpace.
I sent the link to maybe 30 people, telling them it was the, quote,
funniest MySpace ever, lolololol.
And about 13 people took the bait.
Then I posted the information on a forum and allowed people to go nuts.
The next morning, those 13 MySpace accounts were all covered in goat sea.
But here is the kicker.
I used Yahoo Pages to host the fishing site.
It had huge Yahoo ads all over, and it was totally shitty looking.
People are dumb.
Revenge is sweet.
Revenge is also very petty.
Can I get an amen on this one?
Well, it doesn't sound like revenge for what?
I mean, it just sounds like you kind of ran a test.
I mean...
Well, and that's just the thing, is if this was...
If these 30 people were, like, friends of his,
then, yeah, I mean, a joke is a joke, and I'm fine with all that.
You're not going to delete...
I think that's all it was.
Yeah, you wouldn't delete their stuff.
You wouldn't damage anything, you know.
You've got to be able to take a good joke, you know.
That's kind of funny.
But, I mean, when you're posting their docs in a forum somewhere for other people to come in,
and they're posting GoatSee, that's not a joke anymore.
Well, that was...
Did you say docs?
I mean, just...
Well, he posted their account, MySpace accounts, and user and password, obviously,
for people to come in and GoatSee it.
Oh.
And that's kind of lame.
Oh, okay.
I guess I get it now.
Yeah.
Okay.
Up until...
I mean, I'm not familiar with the whole MySpace thing, you know, on the inter-world webs and the computation machines, so...
Yeah.
It's definitely...
Maybe that's their punishment for using MySpace, possibly.
I don't know.
Well, plus this guy, he says he put up a phishing page with an F, like he, like, those reels and rods and, like, flies and stuff, so...
Yeah, and a couple places he's PH, and then other places F, so, I don't know.
Yeah.
Whatever.
But, yeah, posting the docs on the forum, or the docs being the users and password and the account, so that people could GoatSee it, that's when it crosses the line.
I mean, we don't allow that in our forums.
We have rules against DocDrop, and we don't allow people to do that, because it's...
That's not impressive, you know?
Playing the joke on somebody and getting their information and then go, ha-ha, look how easy it was, you got phished, I tricked you, here's your page,
back, end of joke.
That's how, you know, that part's fun.
That's funny, no problem with that.
But, putting up the GoatSee, I mean, what if that was a kid's page, or what if someone's kid's...
Oh, let me look at Mommy's MySpace, or whatever.
Yeah.
That's probably...
Alright, look, that was a stretch.
I realized that as I said it.
That was kind of dumb, but...
But, whatever.
Oh, hey, they can't all be winners.
Just make some grope fast, that's all.
Fast and hard.
That's right.
Oh, man.
Some kid's going to grow up and end up being traumatized for that.
But, yeah, that's just, to me, that's not impressive.
That doesn't really do much for me.
But, I guess, to turn some positive out of the whole thing, you know, we talked about it on the phishing episode,
there were clues that should have tipped you off to that being a phishing site.
I mean, you've got to look at the URL up there.
You've got to look for, you know, if it's got Yahoo ads or whatever it is on there.
make sure you're at the page you're supposed to be at.
Yeah.
You know, there's lots of anti-phishing plug-ins and toolbars and stuff that'll help.
Yeah, IE7 has something like that now, too.
I just installed it today, and it's, uh...
Yeah, something like that.
Yeah, that's kind of weird.
Yeah, I installed it last night, too.
So, yeah, he just, like, schooled some noobs, so...
Yeah, schooled some noobs.
Did you just say schooled some noobs?
I did. I did. I'm sorry.
Oh, my gosh.
All right, email number two this week comes from FreakMac.
FreakMac says, hey, stank, and co-pimp.
That would be you.
Yeah.
You stated last episode that there is no way to get a virtual machine to run faster than running natively.
In 99% of cases, this is true, but there is one case where it is not true.
Booting Windows XP in the Parallels virtual machine is faster than natively booting into Windows on a MacBook.
Now, let me stop for a second.
Now, Parallels is the name of a piece of software for Macintosh, Parallels Virtual Machine.
And the tiny URL to the article he's referring to is Y24N, as in Nancy, D, as in donkey, and L, as in lover.
Nancy donkey.
Nancy donkey lover.
That's the name of the show, yeah.
The Nancy donkey lover episode of Venera Radio.
Awesome.
Oh.
So, he says, I have no clue how the hell they do it, but there's even video on YouTube of the two booting side by side.
If you need to see it to believe it, I definitely didn't.
Keep up the kick-ass show.
Late.
So, yes, Freak Mac, I went to that site.
Thank you for the email, first of all.
I read the article, and yes, what you stated is true, that it boots faster using Parallels, but first of all, it was on a Mac.
So, you're throwing in a non, well, I'll say non-standard hardware, a different piece of hardware than what we generally were referring to.
We were pretty much talking about Intel, but anyway, besides that, you're talking about, the article was talking about, or had some benchmarking on different things.
Booting was faster, but everything else was quite a bit slower, if I recall, if it even functioned at all.
Some of the tests, they didn't run at all.
I think playing Quake 4 on there didn't even work because there was no DirectX support in parallel virtual machines.
So, what's your, you know, your statement of 99% of the cases, of course, nothing's ever 100% of the time, right?
Right.
Hesitantly.
So, I actually did ask Not Theory about this to see what he thought of it, too.
And he made me realize that, yeah, actually, there could be a very valid explanation for even that boot time being faster.
And CNET may not have even thought about this the more we talked about it.
But the way, what happens with these virtual machines is you can actually, if you already had the virtual machine existing and you create it for the first time, you can pause that virtual machine.
When you stop the virtual machine, it will basically stop and save itself where it's at.
Kind of like, think of it like when you do a hibernation of your Windows desktop, for example.
It hibernates.
All it's doing is going to write stuff off the disk.
When you pause that virtual machine, it's going to write all that stuff out to disk.
And then when you go back and reboot and have it come up back in that virtual machine, all it's really doing is reloading.
It's coming back out of hibernation, which even in the Windows world, everybody knows you come back out of hibernation faster.
That's the point of hibernation.
You come out faster because you're not doing a full boot from scratch.
It does save time.
And a virtual machine booting could very easily be explained because or if that's what happens.
So that could be a very valid explanation, and their benchmarks could be simply wrong because they didn't even realize they were doing that.
Interesting.
Does that make sense, right?
Sure.
So, and I kind of mentioned this briefly earlier.
Oh, I'm going to put you on the spot in just a second, by the way.
I just thought of something.
Don't belittle the fact that hardware and the drivers play a big role in this.
The virtual drivers for the hardware are going to be different.
So, one may work better than another, may be more efficiently written than another with.
So, the more, well, let's call it common hardware, for lack of a better word.
Like, for example, we're generally talking about Intel.
They're the predominant Intel AMD.
Common, large hardware manufacturers that are going to have better drivers, more developed drivers, newer drivers.
It's generally going to be a little bit better than some obscure thing where it's loading generic and loading a lot of memory overhead and a lot of other stuff.
So, when you start throwing in different types of hardware, like a MacBook, you know, that's also a factor in the whole thing.
Now, how big, I don't know.
You'd have to do a lot of studies on that.
But, to put you on the spot, like I was just saying, so it just popped into my head.
I'm going to put you on the spot and say what, and ask you what you think about Macintosh and Macintosh hardware and Apple as a company, I guess.
Yeah, so I'm a recent convert, I guess.
Oh, no.
We were in San Francisco not too long ago, and you pop out of Powell Street, and there it is.
You know, it's glowing, and the birds are chirping, and so I picked up a G4.
So, yeah, I guess this was, I don't know, six months ago.
It was a while ago, and it's just, I love it.
I love it that it's small.
I'm glad I got one before Intel.
Really?
It's an elegant operating system.
You know, it kind of reads your mind, and then there's Unix.
It's just great.
I spend most of my time with the shell.
Otherwise, I think 512 is not quiet enough for that.
512, you mean that?
I have enjoyed it immensely.
Now, is it, see, my thing is, is it doing anything, first of all, the OSX, OSX, no doubt,
I agree with, seems to be a really good operating system, very intuitive and all that, but you
said you're glad you got one before Intel came out.
I find that curious.
Can you explain, can you expand on that?
Why do you, why do you?
Well, there's a few reasons.
One, I think this one's a little smaller.
I know it's a little thicker, but I'd rather have it, you know, a smaller footprint, you
know.
Also, I know the, the screens are glossy, right?
I wouldn't, I wouldn't buy the, the expensive ones.
I'd probably buy a cheap, you know, the iBook or the i, for whatever.
I don't know what the new one's called.
And I know those, those screens are glossy, and I wouldn't want that.
Um, cause I'm definitely, I'm all over the place, inside, outside, whatever, so.
Right.
Um, and I just, I didn't want Intel, I just wanted a, you know, RPC.
And also, there's, you know, the software, it's mature.
There's just tons and tons of packages, you know.
I've got all the, you know, I've got Fink and ports, and there's so many things already
developed for it, it's, you know, uh, it's no brainer.
Yeah, software-wise, yeah.
But is it worth the price difference?
I mean, my biggest issue is, cause I want one myself to play with.
Nothing fancy, just a low-end machine.
And when those Mac minis came out, I was excited, cause I thought I'd be able to finally get
a low-end cheap machine, but they're still overpriced.
Yeah.
Especially for what they are.
Yeah, for the equivalent hardware, I mean, for the same $600 for the iMac, or Mini Mac,
or whatever, Mini Me, whatever they're called.
Right.
I could get a pretty doggone good PC.
Well, the thing is, they're, they seem to be well-engineered.
I mean, it's, it's held up.
It's been to Tokyo and back.
Um, except for a squeak and the arrow keys occasionally, it's just really solid.
And it's just, it's slick.
You know, there's a button underneath that you can press and light up the LEDs and tell
you where your battery is.
Battery life is great, by the way.
It's just, it's amazing.
Um, it's, I think it's worth it.
And they're not that, um, if you're gonna, you usually get what you pay for, and I think
if you can spend a little extra, I think it's worth it.
Get the, you know, get a low end with a little more memory, maybe.
You know, with my, I had some discounts.
I only paid $900 for this one, so.
Oh, my goodness.
Yeah.
What?
$900 for that?
What do you, what's wrong with that?
Oh, my gosh.
I could have bought two and, oh, my goodness.
What?
I, I'm not even willing to pay the $600 for the Mac Mini, whatever, and it doesn't even
come with anything.
But it's not a, it's not a laptop.
Oh, jeez.
Whatever, dude.
Trust me.
That is way, your money, everybody listen, your money is way better spent buying a low end
Mac notebook than buying some crap Dell.
High end, high end Intel notebook of some kind?
Whatever.
Dell, HP, whatever.
You know, you've got, now you've got the fast processors, just like all the Intel people,
so.
I, it's, you're, yeah, I think you're way better off.
Oh, my goodness.
Well, you're on your own on that one.
See, that's the hard thing for me, is I do like the design and the look of them.
I do like OS X.
I just wish they were a little cheaper.
Gosh.
Well, you know.
Proprietary company, they're the Sony, they're just like I feel about Sony.
Proprietary hardware, proprietary stuff that they put out, they don't want to play well
with others and cooperate and so.
Yeah, but Sony makes crap and so far, personally, I've found it to be high quality.
Wow, so they're one minor step up from Sony, but that's still, yeah.
Anyway, you can buy me one for Christmas, how about that?
Okie dokie.
Yeah, I'll be waiting, I'll be waiting by the mailbox for that.
Alright, so there you go, we'll get, every time we have, every time we talk about it
on the show, get everybody's opinion, there's inevitable hate mail that comes back from it.
So let's see what the feedback is from this one.
Sure.
Although you actually defended it, and I'm the one that's going to get hate mail this time,
but you know what, whatever.
Alright, our next email this week comes from Victor.
Victor says, hi Stan.
I guess that's Stank.
Where was that?
I think that's, I think that's the K next to the comma.
Is it vicious?
Oh, there we go.
Hi Stan.
No, Victor.
I'm still calling you Stan from now on.
I guess the comma and the K are next to each other.
No, you can't call me, you can't drop my docs, I mean.
Sorry Stan, I won't do that.
Alright, so, hi Stank.
Nice show, keep up the good work.
Just writing to ask, don't know, maybe I missed it, because I listened to this show.
Can I buy a period?
Hold on.
I'm going to edit this on the fly.
Hi Stank.
Nice show, keep up the good work.
I'm just writing to ask, I don't know, maybe I missed it, because I listened to the show
at my work, but what is not theory, I can't even fix this.
What is not theories, the not theories machines specs on which he's running all that virtual
stuff?
I'm so confused.
What are not theories machines specs on which he's running all the virtual stuff?
Okay.
Thanks and shouts from the UK.
Alright, Victor.
So, I did ask Not Theory about the specs.
I kind of figured that's what you were getting at there.
And Not Theory reports that his two laptops that he runs are both 1.00 gigahertz with 2
gigs of RAM each.
RAM is the big thing because you're shaving it off for each virtual interface that you have,
so more RAM is good.
And he has one Pentium D 3 gigahertz with 2.5 gigs of RAM, the desktop that he uses.
So, and he moves the images from one to the other, but mostly when I talk to him, he's
always on the go with the laptop stuff.
So, and he also even went on to say that generally what he's doing with his virtual machines is
assigning 512 RAM, 512 megabytes of RAM to each one of them.
That's what he's shaving off.
And sometimes if he's running a different Linux virtual machine that he'll even do less.
I think he said he was running Nopix or, was it Nopix or Kubuntu?
I think it was Nopix or something with only a 128 memory virtual machine.
But he said normally any Linux he'll just open up 256.
So, that's kind of a cool thing to know.
So, there you go.
And also, if nobody knew, those machines are just extensions of his ghost because not there
is a cadre of evil robots.
So, I don't know if anybody knew that.
Well, if they didn't, they know now.
Right.
He's like a superior being.
You'd think he'd get more done if he was an entire cadre of robots.
Oh, man.
I'm going to get paybacks from that one.
All right.
Next email this week.
Oh, where did I?
I lost my spot here from Sid Vicious.
Sid Vicious says, your powers of telepathy continue to amaze me.
Well, I know.
I amaze myself sometimes there, Sid.
It's hard being right and perfect all the time.
It really, sometimes I just, it's really hard.
All right.
He says, I was actually planning on writing in to ask you guys if you could do an ep on
virtualization and now I don't have to.
Yeah, that was not various powers.
And what was he, a cadre of what?
I think Archangel came out with that because he's there too.
A cadre of evil robots because it's just, he's just, it's nutty.
The dude's like, oh yeah, I'll like scrape all of Nampa and like parse it for your cell phone.
A million things at once.
In like 10 minutes.
What the hell?
Yep, he's juggling websites, writing programs, developing things.
Yeah, it's crazy.
A million things at once.
It can't just be, it's not a single human.
Well, that's why he's my internet boyfriend.
Sid Vicious goes on to say.
He's a good daddy.
One question I've always had about virtualized systems is about combating the performance
hit.
Seems to me that one way to get around the performance decrease would be to run your virtual machines
on a cluster.
Now, I don't really know all that much about clustering or virtualization, but it seems
like a logical step.
I've tried to find some info on the subject with little success, and everybody I've talked
to about it seems to think I'm crazy and it wouldn't work, but I just don't see why.
Wondering if you guys might have any input on the idea.
Anyhow, thanks for providing the great show and keep it up.
Talk to you later.
Sid, PS, shouts to everyone involved in the BinRev Mentorship Program.
It's a good thing.
And yes, the mentorship program is a good thing.
Anybody who doesn't know about it already or wants to get more involved, you can email
mentorship at binrev.com.
That's all one word, mentorship at binrev.com.
If you want to be a mentor or mentee, get involved in the program.
It's very, very cool.
Yeah.
Definitely props to Verbal.
Verbal's, yeah.
Verbal's doing a lot of stuff as well.
Juggling that and the IRC and everybody's doing a lot of stuff, man.
There's some amazing people in this community.
I'm sorry.
Was he talking about clustering for virtual machines or virtual clustering?
I believe he was talking about virtual machines on a cluster for the benefit of speeding it up
or getting better power behind it, which really isn't going to work.
And I did talk to NotTheory about this as well.
And you're trying to get a – first of all, his first question,
and I'm pretty sure that what he's asking in this is about the CPU benefit.
But NotTheory asked that question if you're referring to clustering for CPU benefit
or disk clustering.
So we'll address both here.
As far as the CPU benefit, there's not really much to be gained because virtualization is –
well, and the way we were talking about it and the way the majority of people use it
is from within Windows.
And you need to boot from a local drive.
So you're always going to have that bottleneck of having to boot from something.
You're going to be booting from your local drive.
I even asked NotTheory, you know, what about booting from a flash drive to speed it up
or booting from a bootable Linux distro like Nopix or something along those lines.
And it's still got the bottom line of starting the machine up at boot.
So you're not really going to do a whole lot with that.
And clustering it all off is not – you're just not going to gain that much benefit from it.
However, if you're talking about disk clustering, according to NotTheory,
that's something he sees quite frequently actually in the business world
where response time is critical in some cases.
It's very important to what they're doing.
It's very common for them to set up disk farms with just gigabytes and terabytes upon terabytes of hard drive.
And they will set up disk clustering while they'll do striping and use those disks in such a way
where they can increase the read-write performance and the throughput of data back to your virtual machines.
So you can get better performance out of them once they're up and running.
But as far as clustering to get some kind of increased speed or benefit from the CPU,
he seems to think, and it sounds right to me, that there's not much you're going to get out of doing that.
Interesting.
So there you go, and let's see.
How are we on time for this last email?
We're about 30-something minutes in here.
I'm going to read this quickly because I thought this was a pretty decent email.
And this email comes from Novin.
Novin says,
Hey there, Stank Dog.
I'm a big radio fan, but currently I'm on a three-month assignment to Indonesia.
You ever been to Indonesia?
No.
All right, which leaves me well out of range of any radio stations I can understand.
So I've been getting into internet radio in a big way and listening to a lot of shows.
Yours is definitely one of the best out there, interesting, informative, blah, blah, blah.
I only discovered you three weeks ago, and I've been steadily working my way back through your archives.
Your most recent show about virtualization intrigued me because recently I've been getting into virtualization in a big way.
I've just finished rolling out Kubuntu.
That's why I had Kubuntu in my head from earlier.
I've finished rolling out Kubuntu across an organization, and I had to configure and test a custom install and then train the users in the new OS.
There was no way I was touching my Gentoo install.
VMware let me do all of the above in a virtual environment on my laptop.
The snapshot feature let me make all kinds of crazy changes during training and then roll it back to a clean install for the next group, which is one of the things that we really emphasize as one of the coolest features.
He also goes on, he says, I also use it to keep copies of various client machines on my laptop, so when someone emails me with a problem, I can play around in my virtual environment that mirrors theirs.
Now, I don't think we mentioned that.
That's a good idea.
Figure out the best way to solve it and then log in and fix the problem with minimal disruption and risk to the production server.
I don't think we mentioned that at all.
I didn't think about that.
That is a really good application.
Minimizing risk is a good thing.
Absolutely, and it's going to tie in very much to our topic tonight, isn't it?
Mm-hmm.
Our main topic.
Let's see.
He goes on to say, and of course, it's handy to keep a Windows install for testing applications before recommending them to clients.
A side effect is this, is that I can keep some games in there that run better under VMware than Wine.
Wait a minute.
Didn't Wine just change its name, by the way?
Today, guys.
Or maybe that's just for the games.
I'm not sure.
Oh, okay.
Under VMware than Wine.
And when playing, I can just suspend the machine and, quote, pause the game at any stage or point.
Then a few days later, I can resume my game.
That's pretty neat.
In the time it takes for a machine to resume.
That's really cool.
That is kind of cool.
Much quicker than booting up and loading a program.
And actually, that's further support for what we mentioned earlier about quicker boot time.
Exactly what he's saying here.
So, as far as performance, there is a bit of overhead, but it is generally manageable.
My laptop has a core duo 1.8 gigahertz CPU, 1 gig of RAM, and a 7,200 RPM hard disk.
I can run two virtual machines, Kubuntu and Win 2000, and a few apps on the core system, Gen 2, comfortably.
The biggest bottleneck would be the hard disk.
RAM usage is managed well, and the CPU is taxed far less than you would expect.
Well, I'm glad I did read this, because that also defends what we said earlier about the hard disk being the bottleneck,
and disk clustering and disk farming could, of course, speed that up.
Mm-hmm.
By the way, Microsoft's Vista licensing for virtual machines is going to change things significantly.
Home Basic and Home Premium will not be licensed at all for virtual machines.
Nothing technically stops you, except maybe an update to their SPP?
Don't know.
But you are breaking the license by doing it.
As for the other versions, you can only transfer the license once.
So if you install in a VM and later wipe it and reinstall, you are now stuck.
Doing it again breaks the license.
Developers with an MSDN subscription can run unlimited virtual machines for development purposes
with only a single license, and data centers have their own rules that I'm not clear on.
So once again, Microsoft shaft their users by killing the potential to legally take advantage
of a great new technology.
Yay.
Yeah.
Well, I've got MSDN, so fuck the rest of you.
I love VMware Workstation and think it is definitely worth the money.
However, if you are cheap, VMware player is okay, but you can't create the range of virtual machines
and images.
One solution is to install QEMU, an open source virtual solution you didn't mention, and create
machines and images you can then use in VM player, which has much better performance.
I know I've rambled on.
This is a long email, and I would expect you to read it all, but maybe all out loud, but
maybe something I've said would be of use or interest to your listeners.
Keep rocking.
Well, I definitely read it all, obviously, because there was a good email.
Okay, what was it?
That was only like six minutes or so, so it wasn't so bad, and it did have good stuff in
there.
That was a very good email.
And, shouts to Indonesia.
I don't know.
I still get a kick out of getting emails from weird and, well, weird places, meaning non-U.S.
places, places I'll never tell.
If it's weird, they'll come from the U.S.
Yeah, I was going to say, not weird in a negative way.
Weird meaning places I never expected to receive email from.
That's what I mean.
All right.
Well, Mr. Parallel, can I call you Dool?
You may.
Okay.
Dool, what are we going to talk about on the show tonight?
Stan, we're going to talk about, oh, crap.
You know what?
I want to close my door real quick.
Why?
You're naked?
No, we're going to, as we mentioned earlier, we're going to talk about risk and analyzing
risk.
In terms of physical security.
Well, ultimately, it's stemming from physical security, but you can apply it to many things.
Okay.
Explain.
Well, overall, let me look at my time real quick.
So, overall, this is really kind of the tail end of systems engineering, right?
When you need to, for physical security systems, for example, you need to determine the objectives
of the physical protection system.
What is it going to do?
So, you've got to design it, and then you've got to evaluate it.
If I may, right up front, I want to reference a great book, probably the definitive book,
The Design and Evaluation of Physical Protection Systems by M.L. Garcia.
It really, it's the Bible, okay?
So, referencing that, go by it, and you'll know exactly what I'm talking about.
So, again, we're talking systems engineering, basic steps, right?
It seems very, very simple.
Now, at the end of that evaluation, one of the things you need to do is assess risk, right?
You need to analyze the risk, and then, okay, find out what's acceptable, and find out what
you can do with the resources you have to mitigate risk.
And that's what we're going to be talking about tonight.
There's going to be an equation, okay?
It's not a hard one, but we're going to be as technical as possible.
Oh, man, there's going to be, is there going to be a quiz?
Yes.
Will this be on the test?
Yes, there will be.
Yeah, it won't be bad, though.
Okay.
You'll be able to live.
You'll probably be able to find these.
I want to, first, let's begin, and again, since it is, this is about security, right,
which is near and dear to the hearts of hackers.
Let's define security.
You can go to Wikipedia, and I think it does an all right job, but I don't think it's really
exactly correct.
But security is the protection against malevolent acts, right, perpetrated by humans, bad humans,
okay?
That's what security is, period.
What about evil robots?
What's that?
What about evil robots?
Well, yeah, well, ooh, see, robots can't actually harm humans, but they can follow their,
I'm not sure.
We'll have to look into that.
I don't know.
What about iRobot?
Don't mean me?
I haven't seen that.
I don't want that crap.
So, security has nothing to do with safety.
Safety is separate, right?
I think Wikipedia actually says something about safety.
That's not correct.
Safety is, you know, is trying to, you know, stop harm from, you know, natural disasters
and accidents, right?
That's safety.
Security is protection, right, or, you know, or designing systems to protect against malevolent
acts from malevolent humans.
That is security.
So, that's out of the way.
Interesting.
Interesting separation.
I've never heard the term separated like that before.
That's new to me.
There's the, oh, well, yeah, and everyone, if that's new to you, change your thinking right
now and change the thinking of those around you, right?
If you've got a security guard and he's, you know, let's say he's at one of your horrible
big box stores and he's going out and collecting carts, no, he's a security guard.
He should be doing security, not whatever the hell that is, right?
That's the same thing.
You need to separate security from safety.
They are not the same.
So, make sure you spread that.
Make sure you use that at your work as well.
So, now, we've got a good definition of what security is.
Let's talk about risk.
Risk is a metric, right?
It is a way to measure something.
And it is a metric that combines, well, essentially, the likelihood of a malevolent act and the consequence
of that act to, and also, here, we'll be using the effectiveness of the physical protection system
or the system in general, whatever you're doing, whatever you're using to protect against the act.
And then, using that metric, you can evaluate your resources and use them to the best cost benefit, meaning, where can I use my money most wisely?
Money, time, people, whatever it is, resources, right?
To get the maximum reduction in risk.
Did that make sense?
It did, but, um...
We're going to...
We'll definitely expand on it.
Okay.
Did you have a question?
Well, I'm just kind of thinking that it seems like...
And...
Correct me if I'm wrong here.
I probably am.
But it just seems like that sometimes you can't measure risk.
I mean, it's like...
I don't know.
Sometimes it feels like an intangible thing that you can't say, oh, well, the risk factor is 5 out of 10 or so.
I mean, maybe in some cases you can.
Right.
And there's probably ways to do that, but is there...
Okay, is there such a thing as an unforeseen risk?
That's...
Snake, you brought up an amazingly good point.
Hey, it happens every once in a while.
I'm going to have to stop the show and go buy a lottery ticket real quick.
Right.
You're right.
It is subjective.
And it's...
You can't...
You can't exactly say the risk is this.
Well, you can, and you're going to try to.
You're going to try to quantify it.
Right.
But right now it's not.
There's no, like, you know, universal risk table.
So, you know, the risk of somebody tossing a brick from my window and clunking me in the head and stealing my baby Escalade.
Well, that's...
See, that risk is higher for me.
What's that?
I said, see, that's where...
Subjective is the best way.
That's a good way of describing it.
All the crap that I was trying to say.
Subjective is the best word because I'm more likely to get hit in the head with a brick than you are because people don't like me.
So, subjective to me...
I like you, Stan.
It's got it.
Oh, I love you, too.
Internet Boyfriend, number two.
And you know what?
You're a good-looking man.
Record that, bitches.
That's going to be remixed into a song, too.
But I love you, too.
Anyway.
It's very subjective.
So, your goal is to objectify it.
You want to make it...
You want to be able to quantify risk, right, in a meaningful way.
Okay.
So, if you've got something that's just, it's so nebulous, well, there's got to be ways that you can, you know, define, and we'll talk about this, define your system, test your system, get some performance numbers, right?
Because performance testing, that's how you're going to get actual numbers, right, that will feed and that will become the effectiveness, that will feed in this risk equation.
It will actually get you a number, something solid, something to work from, right?
So, it's not so nebulous.
Right.
So, that's what we're going to talk about.
And it's really...
And it's not that difficult.
I mean, yes and no.
I mean, to get experts in whatever field, you know, if you've got some big facility, if you've got some, you know, huge network that you need to secure, you know,
you're going to need experts in this and that, and it's, no, it's not easy, but wrapping your mind around this topic shouldn't be too hard,
especially when I think, you know, all the listeners are already thinking this way, you know?
I'm sure they are.
You know, even if they haven't, you know, put pen to paper or, you know, or, you know, literally spoken about it,
they've probably thought about it, you know, just in their everyday lives, you know?
Right.
Well, and just on the surface, it certainly is, you know, it's not a difficult concept to grasp and it needs to be done,
but I also know that it's not exactly easy.
I mean, there are, like, all these equations and stuff that are out there that will help you try to do this, right?
Yeah, and that's the thing.
There's a lot of, right, so, again, it's not hard to grasp.
It's not a hard concept to grasp, but it needs to be formalized.
And there are lots of, you can go on the web, you can get a lot of books,
and there are lots of ways people say, oh, here's this consequence, you know, here's a, I'm sorry,
here's a risk matrix, I want to fill the consequence matrix, you know, here's this equation,
here's how you do this, we call it this.
And really, it's just like the security safety thing.
They're all just kind of, they sort of know what they're talking about, but, you know,
and that's a good try, good job, you know, but there's a little, there's a little more to it.
That's why I referenced Garcia's book that really is definitive.
And this equation that we'll talk about comes from that book.
It's been in use for decades.
It is effective, and it's straightforward, right?
The definitions, the foundation is there, the definitions are there.
The numbers will work.
So let's, if I may, let's roll, you know, let's get into it now, and we'll start showing you how to assess risk.
All right, I'm going to sit back and take notes, and you go ahead, and you're going to drive here.
I'm going to stand back and just listen.
Yeah, well, please, you know, please ask questions.
You know, if something's not clear, please let me know.
So, again, we're talking about system, overall, we're talking about system engineering.
And you need to, of course, determine the objectives of your system.
You need to then design that system, and then you need to evaluate it.
And in that evaluation phase, you're going to want to assess risk, right, and then reduce that risk as best you can.
So, given a system, the first thing you need to do, of course, is define that system.
You need to characterize it, if you will, right?
What kind of network do I have?
What kind of connectivity is there?
Who has access to it, right?
What kind of computers are there?
What software is running?
You need to know everything about it that you can, and not just what people say exists, because often that is not the case, right?
Right.
People may say, well, we don't have a Halon problem here.
But you know that the Halon alarm goes off, you know, twice a month, and then eventually people don't pay attention to it.
And I guess that's actually a safety issue.
I do.
Yeah, exactly.
And that's the only reason I brought that up.
That's probably safety, too.
I shouldn't be talking about that.
Let's talk about a door alarm.
Let's say this one door, right, to the knock, it's alarmed, and, you know, it goes off all the time.
And eventually, you know, it's supposed to work.
And we say it works.
And we check a box and say it works.
Fine, because, you know, it goes off.
But really, nobody pays attention to it.
And eventually it turns off.
And there's no effectiveness there.
You need to know what really goes on in the system.
Okay?
Does that make sense?
Yeah, absolutely.
Yeah, but actually I do have a question or maybe a clarification.
When you say system, and even in your examples, so far you've referred to computers and software.
But a system is not necessarily computer even or technology even.
It can be a system of security as it applies to people living in an apartment.
Yeah, I mean anything.
Really, right?
Or is that?
And I may be a little misleading because doing all of this in the cyber realm is a little different.
It's a lot different, actually.
Right.
That's a big problem, and it's still being worked on to this day because it's so different.
You know, there's no delay.
You know, it's really, it's a hard problem.
But when I mention computers and networks and stuff, something is it, because I'm assuming most of your listeners are familiar with that.
Right, right, absolutely.
So we're going to stick with that.
We're going to focus on that for the rest of the.
Yeah, I would say so.
We're probably like the physical, excuse me, like the physical protection, you know, of a data center, let's say.
Okay.
So that's what, so we'll kind of use that example.
All right, good.
So, where all your cismans, cismans are nurse mode, you know, that's what we'll talk about.
So you need to, you have to characterize the facility.
You have to know exactly what's going on, what really happens, you know.
That door, if somebody says, yeah, well, that door, it's always locked and only I have the key.
Well, you know what, he kind of gave a key to this guy because he has to come in and work on this box.
But it's just, it's only once in a while and it's just him.
Or the locksmith.
You know, so they don't work it down.
No, that's, you need to know that.
Well, the locksmith, the locksmith might have a master key or the building managers.
You've got to think outside of the.
Absolutely.
And that's, and what's really important is that you must go and talk to people.
You've got to, you've got to get on site, get hands on and talk to the experts.
Those are the people who are actually doing the work.
Okay.
You need to go and talk to people.
You need to find out exactly what's going on.
You need to characterize that facility to the utmost.
Next, you need to, and this is, this is, you know, this is a difficult problem.
But there are resources that can help you.
And that is defining the threat, right?
So what am I, you know, what am I worried about?
Or better yet, who am I worried about?
You've got to determine who, you know, what the adversary is going to look like.
Who's going to do bad things to you?
So if you've got a data center, you're probably worried about insiders.
That's a, that's a big problem and another, and another show unto itself.
But that's what you need to do.
You need to define, okay, what's my threat?
Who am I going to, or at what level am I going to protect against?
All right.
If you're a small ISP or, you know, you're a little SELEC, are you going to worry about a nation state going after you?
Probably not.
You're probably not worried about Titan Reign.
Okay.
Um, you know, if you're, um...
Wait a minute, worried about what?
Uh, Titan Reign, the Chinese hackers.
Oh!
Time Magazine, you ever heard of that?
Ah, I...
Read up.
I hadn't forgotten.
Yeah, if nobody's read of, if you guys haven't read about Titan Reign, look into it, it's really interesting.
There's, they're, China's doing a lot of stuff, let's just say that.
Yeah.
Yeah, I think it was in time, I think it was in time.
Um, so, if you're a bank, you've probably got a more sophisticated adversary, you know, maybe organized crime, right?
You, you know, who knows?
You've, you've got to, you've got to protect against, you know, a lot of people want money, so you've got to protect against a higher level adversary.
Um, if you're just a Joe Schmo and you need to protect your, you know, your boxes in your house, well, you know, sturdy doors, good locks, maybe an alarm system is not really going to do much good for you, but, you know, what's your adversary?
Common criminal.
So you need to define that threat, so you can determine the effectiveness, once you determine the effectiveness of your system, you can say, okay, given this threat, I need to protect this.
Here's a protection I have, I can use this much money to change my, you know, level of protection, not my level of protection, because my threat is, is, you know, this sophisticated, so.
You must define your threat.
And then finally, define, uh, the target, or identify the target.
What are they going to attack?
Um, what's important?
What's most important?
Um, what, what's, as far as risk goes, what's acceptable if it's lost, right?
Right.
If your NTP server goes down, eh, you know, that may be, actually, that may be really bad, but, you know, if DNS goes down, that's really bad.
So, what are you going to protect?
Well, is it, is a, is it a factor at all, the cost of replacement of something?
Like, if you lost a server, or if you lost, something was stolen, the cost to replace?
Absolutely, in fact, and that's, we'll, we'll talk about that when, when, uh, we get to mitigation, you know, insurance.
All right, I'm jumping the gun here.
Let's, I'm sorry?
I said I was jumping the gun there, I guess.
Well, no, that's, that's, that's good to point out, because, and, and that's why you're, that's why you're identifying the, the targets.
That's right, identifying the valuable assets.
So, when you get to that point, you say, well, we can just replace it.
And that risk is acceptable.
So, you have to, you have to know that up front, right?
When you're, when you're defining the system, when you're determining the objective, you need to know that when you get to that point.
So, that's why this is the legwork.
This is the, you know, not the most, not, not the hardest work, not, you know, the most work, but this is the, you know, building the foundation.
What, what kind of time frame does it take to do this part?
It depends on the system.
Ah, of course.
If it's, if it's nationwide, long time, right?
If we're talking infrastructure.
Right, right.
Who knows?
Yeah.
You know, but if you're talking, you know, you're renting a, a room downtown with your Astro servers, you know.
Right.
Not long.
All right.
So, whatever case by case basis.
Right.
So, now you've got all of these things and you need to design the system.
Okay, I've got this stuff.
I'm going to design the system.
Here's the money I've got.
Here's the best technology I've got.
I've looked into it as best I can.
Hopefully, you're designing things before it's built, right?
You're not kind of adding on to stuff.
And we're, and we're not going to talk about the specific things when you design the system being detection delay and response.
There's actually an article in a really good magazine called VR that you can check out and it talks about those.
You need to design that system.
And then once it's designed, once you've got it, you need to evaluate it.
Now, there are, there are tools.
There are worksheets, you know, like spreadsheets, Excel, spreadsheets.
Of course, there are books, you know, there are guides that can help you in assessing your physical protection system and use them.
Check them out.
Make sure, you know, make sure they've got good pedigree.
Make sure they make sense.
Make sure they know the difference between safety and security.
Make sure they're not just, you know, looking into your pencil and checking off a box because that's not what it's about.
But I bet that's very common, though.
It is.
Yeah, I bet that's true.
It really is.
And knowing these things, here's the thing, you know, everybody that's listening, you know, actually,
BINREV in general is going to give you, is going to, you know, enable you, empower you in this way.
But knowing these things is going to, you know, give you that leg up.
It's going to give you, you know, that extra sophistication when you're going to an interview
or when you're dealing with people who are, you know, trying to sell you their security product
or when you're trying to secure anything from your box at home to a knock, right?
This, you know, and BINREV does that, again, in general.
But this right here, just knowing these things will help you as well.
Well, I know right now, I mean, if I ever am in a situation where I need a vendor to come in
and do a security assessment for me, you know, one of the questions I'll ask in the interview
or up front is, you know, explain to me the difference between security and safety.
And if they can't do that, thanks, God bless, good night, bye-bye.
You know, I mean, so I'm getting a lot out of this.
Absolutely.
There's already a lot of good information.
I'm going to try to shut up because we've got, like, I don't know, 20-some more minutes to go,
and I'm getting interested in this.
I'm getting more and more interested in this as I hear.
I'm glad.
You know, to be sure, there are systems integrators out there who can, you know,
who can, you know, make the systems work together because, you know, obviously they can.
You know, if you can leverage the other, that's a definite positive.
But you must realize security is separate.
Security is important.
Security is not just a cost or it will cost you, right?
It is a cost, obviously, but it's not a – it shouldn't be a – and it is.
I know, you know, people who are making the decisions and have the money, man, I've got to pay for security.
This sucks because nothing's ever happened.
You don't see a direct, immediate benefit from it is the common thing.
You can't go and say, I need you to budget me X number of dollars from the business standpoint, you know,
and I've seen this happen before.
Sorry to jump in on this, but –
No, it's fine.
So many times I've seen it happen where they just will not justify the budget for you to pay for – I've even seen, you know,
requests for a simple backup server or extra hard drives and stuff turned down because, you know, we don't need that.
We're not going to get any benefit from that.
We can't justify spending that money on a disk farm of some kind because they can't see an immediate benefit.
However, you know, six months down the road, and I'm telling you this from actual experience, when you're – someone accidentally drops a table space and you lose half your database that was sitting there
and you don't have good backups of it somewhere, you don't realize the cost that it will take to try to recover, if you can recover, the data.
I mean, I was in – I can't go into too much detail, but I was in a situation where it was so bad that they ended up having to send the hard drive off
because there were no good backups to one of those data recovery, and that is not cheap.
So that's a factor and a way of measuring, you know, to go back to the metrics of the thing, measuring what is the potential cost of recovering from situations like this
versus what you would have spent on it.
And that's the way you have to sell this from a business standpoint to upper management and to the higher-ups in your company.
You have to show them, yes, we're asking for this much money now so that we don't have to ask for this much money later.
Right.
Yeah, you're not going to get profit from this, but it's necessary.
And then here is where security can leverage safety, and this is the safety of your data from an accident, right?
Right.
Or, again, security leveraging that from an insider wiping your database.
Well, I've got secure off-site backups now, so way to go, ass.
I've got this shit, and you're in jail.
Yeah.
Yeah, absolutely.
And you've got to convince people of that.
You've got to sell.
You've really got to sell this because it's important, you know.
Good security is important.
So you've determined the objectives of the physical protection system.
You've designed it.
You've implemented it.
Hopefully you've done this before implementation.
And now you need to evaluate it.
And I'm going to drop the risk equation right on you right now.
Uh-oh.
So we can reference this throughout the rest of the talk here.
So the risk equation is, oh, and what should I do about that?
Yeah, is this going to translate over the radio well, though?
Yeah, it's not big.
It's not bad.
It's really not bad at all.
Okay.
And I'll talk about the terms and their definitions, and actually that'll help you, because you'll
see other definitions when you look into this.
Risk, R, equals P sub A, which is the probability of attack, times, and there's actually
a parenthesis here, one minus P sub I, which is the probability of interruption.
That's going to be the effectiveness of the system, close paren, times consequence.
Okay.
So again, risk equals P A, times paren, one minus P I, probability of interruption, close paren,
times consequence, C, which is C. So you'll often hear, here we're using probability of attack,
and that is, you'll often hear likelihood, right?
You'll hear that in safety as well, the likelihood of an event.
here that in safety as well the likelihood of an event okay but it's just it's the probability that
you will be attacked um consequences um oh what term is used i guess consequences pretty much used
uh no there's something else oh crap what do they use consequences um repercussions um severity
okay often you'll see severity you know and again that's maybe it's tied more to safety what's the
severity of the event you know katrina's really bad that's a one all of these terms
uh are quantified from zero to one oh okay okay so everything you're probably it's their
probabilities right your consequences from zero to one zero meaning uh it doesn't matter
one meaning the worst thing that can happen okay and your effectiveness um there's actually
the probability of interruption that's that's the the the probability that that uh any node
in the physical protection system will stop an adversary and or i'm sorry not stop an adversary
but will um you know interrupt detect and tell somebody hey something bad is going on
at that point in this attack timeline and that is again a probability um and there are more
there are actually more terms in there but we're simplifying it to that r equals pa
times quantity of one minus pi and can i and i actually i've dealt with some equations like this so if
the this is just kind of a personal tip that i've always used is
in measurements like this to me and maybe to the listeners it's easier for me to think of these now
let me hear me out before you i know you're gonna say this is wrong but i like to think of some of
these as percentages now i know it's i know it's zero to one but quite honestly if you're at a
0.995 which is very very high you know very possible it's going to happen versus say let's well
actually let's go back to 0.5 which is in the middle well that's a 50 percent the way i like to think
but only in my head so it's a lot of times it's easier for me personally to think of things in
terms of percentages in my head the only reason you do with the 0 to 1 on paper is for the mathematics
involved so that you can actually do these multipliers through each other within reasonable
numbers so that the multipliers don't have this this uh i don't know over bloated effect by staying
with numbers within a certain range between 0 and 1 it makes the math more applicable it makes you able
to again better measure these things but if it's easier for you to think of it you know if it's
easier to visualize this in your head when you hear about something that has a 0.05 it's really
only a five percent chance that it might happen right absolutely no that's absolutely correct yeah
they're just they are percentages yeah they're the one that's a percentage so yeah and that's and
that's how you'll talk to people about it well that you know the the consequence of this events is you
know it's 90 that's a real bad right that's that's you know um so we've got our equation and did that
that translate i hope it did i think so it's real straight again i'll get one more time just just in
case i'll literally talk about you know literally here are the characters r equals pa
paren one minus pi close paren time c
and that's actually real world yes you'll see that on any time anytime you have a security assessment
you're going to see that yes and that's that's actually simplified so if you're gonna and that's
fine depending on your system but there are other there are other terms there as well
but i thought that is that's enough that that should go over radio all right sounds good okay so we've
got we've got a risk equation now we need to start measuring risk so how do you do that uh you've got
to assess your system effectiveness and the best way to do that is by performance testing and just like
characterizing your facility yeah don't just take the word of the vendors right you're going to have
to go and actually determine how it works how effective uh it is in its in its implementation
uh you've got a sensor it will you know detect a six foot human walking um you know 85 of the time well
uh you know and i'm not talking about what kind of sensor it is but you know so you have the sensor is
at 85 in day at night when it's warm when it's cold you know when it's when it's 10 feet off the ground
when it's eight feet off the ground how is it implemented um and then how is it how effective is
it in that implementation so you've got to determine that um and the best way is to and i'm not you know
going to go into statistics because i don't know off my head you know i'd have to go back and look at
my college textbooks i guess um you've got a performance test you've got to you know walk
past that sensor 30 times and see how well it works with some confidence well and that that actually
brings something else to mind too isn't part of this um and it goes back to what you said earlier about
taking their word for who's got the keys to the thing or that something goes off all the time and
it's not a problem or we've only got this software installed we don't have anything else yeah
there's actually inherently some auditing part of this job where you have to actually verify
improve all this you otherwise it's like you said i think you said this in the beginning you used the
term checking check marks on a clipboard or something you're just going down a checklist on a clipboard
just oh really that's what you've got check check check you're not really doing so much the
analysis you're just taking their word for it you have to actually do some auditing and test a lot of
this stuff yourself inherently to the process is that right that's a really good point it's amazing
how much you will learn about your system it's amazing how much even you know customers will come to
us and it's just going through the process not even getting to the point where we're making the
calculations and talking about mitigation you get just going through the process and they've they learn
so much you know they have people you know people not talking to other people in the organization you
know people finding out what really app managers finding out what really goes on you know not you know
some may be bad not all the time but absolutely you you learn so much you learn so much it's it's amazing
what a good process can do cool so this is so what we're what we're talking about now you've got your
physical you've got your you know you know what kind of facility you're dealing with you've got your threat
you know what's important in in in your system um now you need to find the effectiveness of that system
so you go and you're near testing you find okay this really works yes this door locks automatically every time
um that's going to feed that's going to be your pi so in your equation you've got your you've got your
pi now right and that's and that is going to be again it's simplified um boy yeah it's kind of tough
to translate into radio i know yeah um i guess right because it's and i know everybody's thinking well
there's lots of sensors there's lots of layers of security well yeah and again this
is this this equation is simplified um i guess the the best way i can explain it is that you want
to determine um what's what's that that pi that probably did an eruption what's going to be the
effectiveness of that system from that adversary right and then use that as that number and use that
from your tests right get that number from your tests and i'll leave it at that that is a simplification
hopefully not an oversimplification um well there is like like i'm kind of thinking in the back of my
head that's fine to test let's use your sensor example you can walk past it and test it all you
want test it in the daytime nighttime all that stuff that you said and let's say you come up with
0.85 you said 85 percent early you come up with a 0.85 but that's just the one individual sensor and
there are layers of security that's a sensor on the first corner of the hallway and you have to walk
down three hallways to get to the data center right so it's actually pi is actually a product of the
probabilities of detection of each of those sensors of each you know node in that physical protection
system so yeah we can do that so basically you're going to be multiplying all those numbers exactly
so it may be 85 individually one at a time each one has an 85 percent chance but the chance to be
making it through all three of them is a lot not is a lot harder right so there we go it's there's a
little so that so that kind of fills you in that kind of gets the rest of your system thank you very
much yeah um so that i understand what you mean by oversimplifying it but we have to do that for
radio and i i think our listeners understand that yeah and i hope and i hope it's not painful
too reading off an equation on radio it's got to be just horrible radio too well so so thank you
for putting so okay so now you've got your pi so in that risk equation uh so now you've got r equals
pa one minus pi times c pa times one minus pi times c you've got your pi you've got that term
that's the effectiveness of your system the probability of attack this is a really easy one
if you want to just assume that you're going to be attacked you can make that a one right and as you
probably you should if you're going to talk about risk you might as well say okay well let's you
know let's say we are well it depends on the threat what is that threat level red or whatever they call
it uh that's no that's that's a that's called a joke um so uh and and i was i was when i mentioned
thread and about resources um this is where that comes into play when you want to determine the
probability of attack okay you've got your threat now what's what's the possibility right what's
the probability that they are going to you know hit my facility um how are you going to know that
okay you can look at crime statistics you can talk to the cops um i guess if you've got some
national infrastructure you can you know they've got intelligence obviously they you know they've
they've they've got ways to quantify that uh but you know for most of the real world it's it's not
any you know it's not an easy problem um so again you've got you've got some tools there are crime
stats you can look at you can talk to cops you can talk to you can talk to security companies there
are you know there are private security companies who know what's going on um
um pi's maybe i don't know but there are ways to find out okay what's you know is this a good area
or not am i going to get whacked you know or again you could just say okay i'm going to assume that this
is going to happen and move on with your equation from there so you can use a pa of one that actually
makes it it's called conditional meaning that yes i am going to be attacked and it essentially drops out
so then you'd have r equals uh one minus pi times c um consequence that's the last uh term to figure
out you've got your target and this this will bring in what you mentioned earlier right here stank um
or well or we will after this i should say um you've got your target you've got a really it's just a
hyper important server uh if this you know if somebody comes in and you know beats it to death
with a baseball bat like office space um that's the worst thing that can happen to my company right
and that's how you need to determine this right what's the worst thing that can happen to whoever
this customer this company you what's the worst thing that can happen me the worst thing that can
happen if anything happened to my wife oh maybe oh that's just so precious um so you need to determine
that and again it's like like you said snake percentage so if somebody going gangsta on your
server is the worst thing that can happen that's a one okay and that essentially drops out as well
um probably it's not what you're going to be most people probably won't be working with a one
you're probably going to have graded consequences for multiple targets right so would you have a
different equation for each target or uh yeah yeah you would you would you would have uh what's the risk
you um is it an overall measurement of overall security for like your entire data center or site or is it
like what is the overall uh uh ratio or the overall measurement of our data center versus the overall
measurement of let's say of somebody of losing your servers in your data center or overall uh
possibility of losing your telephone lines leading into your data center are those two separate
things i mean one's going to affect the other but all right they're two totally different
targets how do i how do i explain this uh and that's a great great question um and you know
i've done it a lot how do you explain it um and i've done it well well it seems like they would stack
like um the one the the chance of it affecting your phone lines coming into your building is definitely
going to take down your data center so the data center would incorporate that however the phone one would
be separate it doesn't incorporate the other data center risks like that it might be catch on fire
inside of there no it's got its own separate risks like a like a tractor running a over the telephone
pole and knocking it out and you lose communications it's other it seems like there's independent ones
yet they are at the same time can be intertwined sometimes okay and let me and i've got my easy out
and that is it depends on the system right so and it's all those it's all those things you mentioned
and they're all bad guys it's a bad guy with a tractor and it's an arson causing the fire wow true it
depends on the system so and giving a week and we let's and let me think of let me let me make up an
example here okay um if you do have um if your you know your team your your trunks coming in are important
and they've got their own security right even if it is being underground and it's you know or in a locked
vault whatever it is um you would calculate the risk of somebody attacking that right right um
um and then if you've got uh let's say your
and that's and that's problem because it's a little it's kind of nebulous getting into the cyber
stuff like your connectivity right the risk of your connectivity wow
well i mean i'm envisioning you know like you're in a big office building in new york or well just an
office building anywhere and right the building controls the the incoming phone lines and all the
trunks and stuff is separate and independent from your data center on the 12th floor right which
has its own card swiping and its own physical security and its own you know right and they
are interdependent and then it is part of of calculating the overall system risk and you can do
that uh i wouldn't i wouldn't recommend that right now let's just talk about let's let's look at some
simple systems and let's look at um uh let's look at calculating the risk for for your target or
targets right whether it is your your pop or this important server or the room that's in the data center
because you've got you've got you know undoubtedly you've got some servers that are more important
than others and what are the risks you know how do you protect how do you use your resources to
protect those individual servers well as well as using your resources to protect the entire room
well let's we'll simplify that right now well okay let's let's protect the room first right and if you
want to you know then just break it down right now interdependencies um you know off-site systems and how
that affects your risk uh we we won't deal with that right now okay is that is that okay is that uh yeah
well it's yeah i think i know what you're saying yeah it's it's going to it's that's that is absolutely
a systems engineering problem and that's way more than i've prepared for and way more for a radio show
right now we want to right because that's you know well there's a lot of decisions to be made
there yeah from a lot of different people that's hence you know if you're going to protect an
infrastructure it's a great question right well and it's not one we can finish up in these last five
minutes so so we'll back off that one more advanced yeah all right so where do we go here with the last
five minutes what how do we how do we summarize all this how do we wrap all this up well that's
so you've got whatever right whatever system you have whether it's protecting a server or protecting
a room right so you're so you've you've got uh uh the probability of attack right you've got your
system effectiveness and you've got your consequence right right um and that's going to get you risk
risk so now again let's let's say protecting the perimeter of this data center the integrity of
this data center um given given those terms you calculate risk now you have okay the you know the
risk of this bad guy coming in and and and lighting fire to this place and setting off the halon alarms
is this amount all right so now you need to use that number use the the the work you did up front um
characterizing facility determining all the things signing the system and then using the resources that
you have to uh improve security how do i how do i say this you want you want to get the best cost benefit
out of your resources so if you can spend a small amount of money and get a large increase in security
right to essentially decreasing risk you want to do that and that's what risk enables you to do well
that you calculate the risk right of the of uh i guess this kind of goes back to your question
all right let me yeah actually i think i think maybe i have a a good i'll try let me you tell me if this
is what you're if this is a good example let's say like my example earlier of two different areas of
attack two different risks that you're looking at the risk of um your phone connection to the building
going out which therefore disrupts your business versus the chance that your server
uh an employee breaks into your server uh an employee breaks into your server and erases the data off of
it okay two different things well the if you can stop the first of those examples if you can say
if you can lower the risk of your phone lines being cut off by simply putting a five dollar lock on
the door to the room you have to determine that using that ratio versus spending fifty thousand dollars to
add a card swipe system on that lab to allow certain employees in and out of it or not you got
to make a decision of how to spend that money to best lower the risk of all of the possibilities that
you have in front of you perfect is that right is that good i mean if you can spend a five dollars
to and that'll lower your overall risk of a lot of different things or actually lower your risk
on two or three different things since they're interrelated that that's the decision and that's why you do the
analysis to figure out how best to apply your budget and your resources to lower the overall risk
by addressing the ones that are most severe with the best application of funds available
absolutely that's perfect well said i just pulled that right out of my ass
that's great and that's what it is you know and and and as far as as far as you know the boundaries of
your system you know where where where to calculate risk and where to spend money you know that's
that's going to be again it's going to be right it's subjective say that and it is my on and i'll
take it right now you know you that's you know that's what you're going to have to determine that's
what you're going to when you go out and you get that pi right you you calculate you go through
whether it is from the lines coming in all the way to the the one server you know you need to determine
that and where you know you can you you can you can put all of it all into one big giant system
and calculate i've got this one risk number for my whole you know when right you know that's you
know yeah well yeah you can do that but i don't recommend it yeah it's a case-by-case basis like you
said of what's the best and i think that's the best way to wrap the whole thing up because we're
we're not going to leave ourselves much time here to close out is i mean is that really it's gone
already okay it's going that quick man yeah and i hope you know and i know it's oversimplified
if anything familiarization with the terms is going to be is going to be powerful for you and knowing
okay this is generally how this is this is what risk is about and this is how i can calculate it
you know and and try it out on a simple system right try it out on something you know your your
your computers in your home try it all right well and um and again a lot of the terminology
and stuff that is something you should at least be aware of and know about even if you don't do
one yourself or don't find yourself in the position you at least have that knowledge now to know what
you're looking for in an assessment if somebody else does it you'll be able to spot the flaws and
you'll know you're not going to get screwed because you know more about what they're doing now and
what to expect from them so you'll know absolutely this is a primer this is going to get you ready
there's a lot more to this way more way more than i know so but this this should this should help
everyone all right well let's jump into some shouts here to close out the show um i'll stall and go
first a little bit i of course i'm going to give shouts to everybody in the ddp kind of that friendship
thing earlier you know i gotta i gotta bring up i gotta give shouts to a acidus to a lonka good friends of
mine i mean so many people and you know i'm going to give shouts to the moderating team because i
don't do that nearly enough and right now as you're listening to this i'm actually out of town
again for work i'm quite frequently out of town and they're running the site they're running the
forums and everything so big shouts to them they're doing such a great job and i i lean on them so much
so i appreciate everything that they're doing and i'll cross into your shots with one i know you'll
back me up on and that's our good friend bland inquisitor oh yeah the bland inquizzle nizzle
nipple flipple that's awesome what else you got oh yeah i want to give shouts to mrs parallel oh yeah
and uh you threw me for a loop she came into the like i'm in the middle of the stuff she came into the
room kind of a little disarming don't even don't oh so yeah big shouts to my wife thank you for
and uh i'd like to uh give shouts to you stank i love you stank you i think you do so much uh for the
community uh you probably don't get thanked enough also uh big shouts to uh shouts to um uh hacksaw pink
dugan uh uh who he already did that yeah not during notice and uh white sword and vh slip and the phoenix
crew logic and uh just so many people the scene you know the scene really is uh good you know
there's a there's some bad things and bad things that have happened and bad people but for the most
part it is um uh just like i don't mean this in a religious fashion but like but the biblical way
it's there's good you know there's a good in a man's heart or evil the this you know the community
the hacking community is good and getting better i think yeah i agree and getting better our site of
the week this week is about us.org it's a wiki page that has lots of information about different
websites out there kind of got some who is stuff it's got some summary screenshots alexa information
nice little place to go uh find out about websites and dual is a noob.com dual is a noob.com
uh japan japan.com uh is it japan.com oh there's yeah tokyo.tools.com
i'm sorry tokyo already but you know i just i still like it though i don't pin my site
you know so hey what the hell take advantage and hopefully there's something there that
somebody might be able to use that's that's my only goal the picture of the tokyo chicks is worth it
for me yeah yeah email us uh for feedback of any kind to radio at binrev.com closing music this
week is mc lars a track called hurricane fresh i don't think i've used this before but if i did
you're going to hear it again and dual my friend thank you for being on the show yes i love you too
thanks thanks and tell everybody that we're going to see him next week same hack time
stay back channel
oh snap you know this track is fly so get crunked up and don't ask why post rap post bunk post
Don't ask why
Post rap, post punk, post Kurt Cobain
Post cool modi, post house of pain
Chuck D told me that I had to be me
So I bought the public enemy CD
A Rick one track in MP3
Till Lars Ulrich came after me
I said it's me, your last nephew
He said no way, that can't be true
I kicked him with my Converse shoe
All the way to Timbuktu
A wolf and Ulrich, sad but true
He lived there for a year or two
He mastered puppetry alone
Just as for Sean Fanning clones
Now that's fresh, now that's switch, let's switch
Get fresh, now that's fresh, let's switch
I get fresh, now that's fresh, let's switch
Get fresh, now that's fresh
Now that's fresh, now that's fresh
Now that's fresh, now that's fresh, let's switch
I get fresh, now that's fresh, let's switch
I get fresh, now that's fresh
My dad's named Bob, he toured with me
When a UK licenses put out my CD
I got Matpots from the BBC
But hip-hop heads still don't get me
So I take a chance, I ride with it, so what
I like Chris Brown and Beyonce's butt
Whatever your race, all friends drew you
And rent to Spike Lee, Netflix too
And I still wrap shows and try to dance
Still rock Simpsons underpants
And I still like Rush and Dr. Drake
I still keep bumpin' N.W.A.
I get fresh on the mic like I'm elpin' on duty
So burn the Cisco to the ground and baby shake that booty
I attack the track like a Steve Seagal movie
3D fresh, not 2D fruity
Now that's fresh, now that's fresh, that's fresh, get fresh
Now that's fresh, that's fresh, I get fresh
Now that's fresh, that's fresh, get fresh
Now that's fresh, now that's fresh
Now that's fresh, that's fresh, get fresh
Now that's fresh, that's fresh, I get fresh
Now that's fresh, that's fresh, get fresh
Now that's fresh, oh five
So live, I've been doin' this for years
Makin' money cause I'm funny with this music of the spheres
And I dance, hey watch me dance
Goofy MCs can't be me, even if they had the chance
Pandora, have you seen Persephone?
Hey these rapies got me goin' like KR's O&E
Why's that? I don't know, MCs act if they don't know
I poison this track with a scorpion flow
Because I rock the mic, like a hurricane
Because I rock the mic, hurricane fresh
Now that's fresh, now that's fresh, that's fresh, get fresh
Now that's fresh, let's fish, I get fresh
Now that's fresh, now that's fresh
Now that's fresh, let's fish get fresh
Now that's fresh, let's get fresh
Now that's fresh, now that's fresh
Now that's fresh, let's fish, get fresh
Make it fresh, make it fresh, get it fresh
Come on, hurricane fresh
Fresh, fresh, fresh, fresh, fresh, fresh, fresh