This is dedicated to all the hackers and the crackers, to the hackers and the crackers.
I see in binary, I speak source code, step on my toes, I'll post a million jpegs of you
and a fag pwned.
In your digital stance, getting firewalled ho, cause I'm riding the net in my six-fold.
I was a dick with my 56, now with my cable I'm able to get that stable.
On the out, my name is Ace and I'm a Leo. On the digital highway, my name is Neo and I'm a hero.
In a flash, I'll screw you on burning Dreamcast. You need some ISO? Let me through my hard drive rifle.
Our exchange you could never stifle. In a digital hug, you just caught the love bug.
I bootlegged your CD, I caused a fight between Un and Jay-Z.
Your CG, it's all gonna be free, whether we take it by force or we take it nicely.
You feel that rattling your bones? When I tell you we just hacked out Jones.
And NASDAQ leaves you flat on your back, cause I am he who loves to hack and crack.
Cause I am he who loves to hack and crack.
This is dedicated to the hackers and the crudents.
Serial codes, source codes, ISOs, RANs, SIFs, SIFs.
This is dedicated to the hackers and the crack.
Hello everybody and welcome to Binary Revolution Radio.
Back once again this week for episode number 186.
This episode is coming to you on February 13th, 2007.
I am Stank Dog back with you again this week and probably for another few weeks coming up.
And I am actually very happy to have on the show this week a new first-time co-host.
But someone I've been corresponding with via email here recently.
And someone whose work that I have read for several months now.
And that person is, of course, Scott Baranato.
Who is a senior editor and writer for CSO and CIO Magazine.
So Scott, welcome to the show.
Thanks for having me. I'm looking forward to it.
Now, I mentioned that I've been reading some of your work for a while now.
Mostly through CSO Magazine.
CIO Magazine, excuse me, CSI would be a completely different topic.
CIO Magazine as well.
But how long have you been writing, actually, about security and about technology?
Well, I started with the technology.
I've been at the technology for about 10 or 12 years.
I sort of cut my teeth in grad journalism school on technology.
I got a technology beat in Washington right as Netscape went public.
I was actually in Washington when that happened, writing about it for kind of mid-sized newspapers around the country.
That was part of my grad program.
So I was kind of right place, right time.
And then I spent a few years at PC Week picking up some fun beats.
And that's where I started with security.
And then from PC Week went to CIO Magazine.
CIO, I wrote almost exclusively about security after a while.
And was part of the team that launched CSO Magazine at CXO Media, the company,
which was dedicated, obviously, to security, those topics.
So it's been about four years now with CSO as sort of my primary responsibility.
And actually, I read several of those magazines.
Actually, isn't PC Week, that's E-Week now, right?
That's correct.
It had switched over right as I was leaving there, actually.
So I was burnt out on the new stuff.
I covered the Microsoft trial.
I covered the early days of the viruses.
And when you do that at a weekly, which is really daily deadlines, it kind of kills you after a while.
And I had aspirations of doing feature writing, which I've been able to do at CIO and CSO.
Yeah, and actually, since you mentioned that, that's kind of a good point for me to mention,
that I just got my new issue of CSO Magazine like three or four days ago from this episode.
And you have the cover story in that one, the copper, the metal story.
I've got to tell you, it was a really great story to research and write, a really fun story.
I hope you Lerscheners get to take a chance to look at it because it's something that you sort of never see coming.
And when I started researching it, I couldn't believe, you know, what I was hearing out there.
And essentially what happened was China needs a lot of metal, and we have a lot of metal here.
And what's happened is there's been sort of all sorts of little gangs of people here stealing metal to sell it to scrap yards,
and then the scrap yards in turn sell it to China.
And you've ended up with this epidemic of copper theft around the country.
And it seems to map very closely to where there's crystal meth problems for reasons that in the story become clear but are quite surprising.
And it's really an incredible story about just what's going on out there.
You have no idea until you start reading the stories about where people are going to steal copper and what they're doing to get their hands on it.
Well, and I think we mentioned on an episode, very briefly, just passively on an episode,
because I had seen something about there's a problem, I guess, with people.
I think it was nickels and pennies specifically where the value of, for sure, the penny,
and I think the nickel is included, where the value of the metal in the coin is worth more than the actual coin itself.
And the government was having to have some sort of crackdown where they say,
remind people that destroying currency is a federal offense.
You know, let us waste money to make money that's not worth the money we're making.
But it's a federal offense for you to destroy it.
I mean, there's actually people melting them down, right?
Yeah, the economics are amazing.
Now, you have to remember, copper, about five years ago, was about 65 cents a pound.
And that was sort of historically low.
And then China started buying it up, and people weren't making enough to replace what China was buying.
And last year, it got so high, up to just about $4 a pound on the London Metals Exchange,
that it started to become more expensive to produce coinage than what the coins were worth.
So, for example, it cost about a penny and a half to make a penny,
which means every penny you make, you lose money.
And, you know, people have been trying to get rid of pennies for decades and decades.
And for the life of me, I can't figure out why we don't have them, but why we haven't done that.
But what people don't realize is that, you know, nickels, quarters,
these coins are almost all copper underneath what you see on top,
which is usually a thin layer of nickel or some other metal.
So, there's lots of copper to be melted down in money.
And, yeah, people are melting it down to sell it as sort of raw material.
Well, yeah, it like goes back to the old days where people were grave robbing
to get the gold teeth and stuff and melt them down.
I mean, that's kind of...
Isn't it...
Come on now, it's a little bit silly.
It costs a penny and a half to make a penny.
How...
Yeah, now it's...
Only the American government could pull that off.
You know, the arguments have been made ad nauseum.
If you start doing research on it for eliminating the penny, it has no value.
And, interestingly, one of the things they think keeps it around is retail companies
and marketing because the penny allows them to charge $2.99,
which sounds a lot better than $3, actually.
Wow, that's...
I believe it's the reason that people are reticent to get rid of the penny
because then advertising is going to have to sort of just round up
and then they can't say $2.99 because they can't make that change,
so they'd have to say $3.
Yeah, that's really interesting.
I never thought about that at all.
That's very...
That's a neat little kind of social engineering tactic there.
It does make people think differently when they see $2.99 versus $3 or whatever.
That's going to kill Walmart, who tries to shave every little penny off.
Well, think about that.
Walmart, you know, is a pretty large company with pretty large influence,
so think about that for a little while.
Yeah, we've talked about those big Walmart-type corporations on the show before
and the power that some of these people wield.
And, actually, we might come into some of that later on in the show.
But, anyway, let's actually go ahead and move on.
We have some incredible, some really, really good email, I think, this week
that I want to get into.
So, why don't we take a second here and move into the mailbag.
Okay, and our first email this week comes from our good friend Iron Geek,
long-time listener and supporter of the show, Iron Geek,
writes in to us to say,
Hi, Stanky Wanky.
See, that's a little, you know, that's a little, what's the word?
Yeah, I was worried about what I should call you on the show,
but now I'm not so worried anymore.
Yeah, what's a term of endearment, we'll say.
And co-host, and that would be you.
I was listening to episode 185 on ads,
and I thought I'd throw in a few comments.
My experience as a publisher with various ad services has been as follows.
AdSense.
They won't run ads with me and won't tell me exactly why either.
I know it's because of my quote-unquote hacking content,
but they seem to have a huge double standard on this
as they do run ads with other publishers of similar material.
I'm going to read the whole email and then come back.
I'm tempted to jump in right there, but I'm going to keep going.
For, let's see, what was the next one he has is Canoodle,
K-A-N-O-O-D-L-E, if you want to search for that.
They were okay for a bit, but for some reason their ads stopped showing up on my site
and emails to Canoodle asking why got no response.
Well, that's not a good sign.
It speaks volumes, I guess, about their customer service.
But, you know, one experience, maybe that was just a bad day or something,
or it got lost.
I'll chalk that one up.
So if anybody else has some Canoodle experience, by all means,
write in and let us know.
Third on his list is Yahoo, who never got back to him on getting into their beta.
And the last one that he singles out here is Adbrite.
I've been using them for about six months, and I'm having good luck.
I wish their ads were better targeted like AdSense seems to do.
Adbrite seems to serve ads based on keywords I use to describe my site
as opposed to ones that were spidered by a search engine.
On the bright side, Adbrite doesn't give a darn about the content I have
or where I put the ads.
A downside is that their control panel does not automatically use SSL
in all of the places it should.
Just authentication unless you tell it explicitly in the URL.
Thanks for the show, Iron Geek.
Well, I tell you what, Scott, I have some things to say about this,
so I'm going to go ahead and start and jump in and interrupt me
if you disagree or have something on this.
But Google AdSense, first of all, has a lot of people have had problems with this.
They pulled a fast one on a lot of different people
by canceling their accounts without ever saying a word.
They're just saying, we have canceled your account.
They don't give you any reason.
They don't give you any explanation.
That being said, however, we know that hacking is against their terms of service.
It's against the terms of service for all of these things for the most part.
They're going to put in their legalese, for lack of a better word.
They're going to put these type of topics in there to cover themselves.
The issue is how hard are they going to actually enforce them.
Are they putting it in there just so they have that back door to get out of something
if something does become a problem?
Or are they going to be real anal retentive and absolutely anything even close to the word hacking,
whatever they think the word hacking means, something that they're going to ban?
So, again, I'm not going to get on a big soapbox,
but Binary Revolution is about that exact topic.
So I'm sorry you were going to say?
Yeah, no, those legal disclaimers are always so broad that they can do something like that.
They can just sort of by fiat make a judgment call like that.
But you have to wonder when you apply a blunt instrument like that.
You're going to get some of the people you're targeting,
but you're going to get a lot more kind of caught up in that too.
Yeah, and I look at these legalese sometimes,
and I like the ones that say, instead of saying quote-unquote hacking,
which it is a vague term, it really is, and everybody's got a different definition.
I like the ones that I read.
I read them that says no illegal activity.
That's a much more clear definition to me.
Because hacking is just curiosity and stuff like that.
Hacking is innocent the majority of the time.
That's something we're going to talk about a little later too,
is at what point does research end and hacking begin and cracking and all of that.
So it's not a very good term for a legal document, that's for sure.
Yeah, exactly.
But, again, we're not naive here.
We didn't just fall off the turnip truck.
We know that they're going to put that hacking rule in there.
And you just hope that one day, over time, more people will take it out,
and they will further define illegal activity.
And they single out spam a lot.
They single out porn a lot.
You can't have a prawn server.
A lot of companies will have clear rules about that.
But hacking is just such a vague term.
Well, hopefully we'll continue to change minds about that.
But that's definitely a long-term process.
The other thing, too, and I don't know if you'll agree with me on this,
but from my standpoint, hackers spend a lot of money.
Hackers really do buy a lot of technology, some of them.
Some of them don't.
But, you know, I have my Arcos device.
I travel for a lot.
I've got frequent flyer miles on every airline you can imagine.
I buy every gadget that comes out, new computers.
I spend a lot of money.
You would think from a business standpoint you wouldn't single out clientele like that
that are known to spend money and buy a lot of technology.
If anything, you would want that.
Well, it's funny.
You know, when you think about it, you look at a company like Google,
which is so big now, and a company like Apple.
It's another one I've had experiences with recently.
You reach a certain level of success and, in fact, sort of public phenomenon.
And it's bizarre how the sort of rules of commerce get inverted,
and suddenly you can sort of pick and choose who you want your customers to be
because you're just kind of swimming in money, you know.
Well, exactly.
And customer service goes away and all those things go away.
So who knows, really?
But, you know, what I wonder is if they're thinking, you know,
that people who are technically savvy, hackers, crackers, what have you,
are blocking ads anyway and that they're part of the sort of ad blocking phenomenon.
And that's something you're worried about.
I don't know.
From a browsing standpoint, yeah, most hackers,
most technically savvy people, if you use a more broad term,
probably are blocking the ads.
But as far as serving them up on our sites to other hackers,
well, I guess, yeah, we're serving them to other hackers who might be blocking them.
But at the same time, the ones that do see them may be more likely to buy stuff.
I mean, you're going to have a higher click per action
where you pay for each action or sale that results out of it if you're using that.
That seems like a good method for that particular audience.
But I don't know.
The other thing is you would have to assume that as business people they've done some research on this.
And maybe I'm just way off.
Maybe they do know for a fact that generally the hacker community or technological savvy community
doesn't click on ads as much.
And I don't realize that.
It seems to me they would, but maybe I'm way off on that.
I'd like to know if there were some studies.
I might have to do a little after-show research on that.
For me, the thing I would think is, as a general, the bigger the company, the less customer-centric.
And it's not a conspiracy or anything.
It's just that's what happens to big companies.
They kind of lose focus with what made them a ton of money.
Exactly.
And especially once they go public,
and then suddenly you're answering to shareholders whose bottom line is profit.
That changes a lot of things.
It makes a lot of decisions, too.
Actually, and you know what, as a quick aside here,
a good story about that or a good anecdote that I've heard about that was actually about Walmart.
It kind of blew my mind one day that Walmart had crossed this line of how much power they had.
Typically, the way grocery stores and other places work that carry food items is
because they give the different vendors so much shelf space to sell their product.
That's right.
You know?
Walmart was the first company that got so big and changed the scale,
the playing field of the whole thing,
where the vendors actually had to bid and pay money to get shelf space on Walmart's shelves.
Frito-Lay, Coca-Cola, the Pepsi, the cola companies are paying money to get shelf space
or to get more shelf space and try to push out the other companies so they're buying more shelf space.
They're actually bidding against each other, which, of course, plays to Walmart's favor.
And they've got the power to do that because you want your stuff in those Walmart shelves
because they're so big.
It's really changed the playing field.
And think of the effect of that is that the companies with more money at their disposal,
which are generally larger companies, are going to win those biddings.
So you have fewer and fewer companies and less and less competition represented on the shelf.
Yeah, and we probably could go into a whole Walmart episode at this point.
Yeah, we could go on and on.
I guess we should probably reel it back in because Walmart has really –
that was just the tip of the iceberg, and now they've changed a lot of other things.
And, yeah, there's been documentaries done on that and articles written on that,
so we'll let them speak for themselves.
But, again, back to this topic of – well, I guess we started with Google AdSense,
but the whole hacking terms of service, you know, you still have that mindset
that we're out there to rape, pillage, and steal and all that kind of good stuff,
and it's going to take time to change it.
But to me – and I'm probably oversimplifying, I'll admit that –
but to me, why can't it just simply be you catch someone trying to commit click fraud,
you ban them, and possibly more.
You know, if they commit a crime, if they break the law, they break the rules,
whatever you want to call it, or all of the above, period, ban them.
End of story, file charges, cross that line, whatever you want to do, it's that simple.
But banning people from Google AdSense or other services because of something they might do,
I mean, that's kind of a George Orwell kind of feeling there.
That's a little bit too Orwellian, you know, or was it – there was a movie.
I never actually saw it.
Was it Minority Report or something where they were –
Yeah, that was the Tom Cruise vehicle, right, Steven Spielberg?
Yeah, something – maybe I'm messing up my movies now.
Maybe I'm pulling a savant here.
But the one where they were saying, in the future, we know you're going to commit this crime,
so we're going to arrest you now.
Yeah, that was the movie.
And, you know, again, we're going to talk about this a little bit later when it comes to disclosure
because, you know, we recently interviewed Eric McCarty,
who was, you know, recently pled guilty to breaking into the USC website.
We'll talk a little bit about that later.
And his contention is just that, that he was found guilty of, you know, doing something with –
basically his ability to do it is what made him guilty.
Yeah, I love fear.
So that's his contention, and we can talk a little bit about that later too.
Yeah, yeah, and that is a common cry is, you know, they want to throw the book at things they don't understand or fear,
so they'll, you know, kind of go a little overboard.
We got – oh, man, I'm getting on a soapbox here.
We got drug dealers that are back out in the street, you know, the next day,
but we're going to bust some, you know, kid or some person who didn't really –
anyway, I'm not going there.
Let's back up for a second.
Next email.
Yeah, let's see.
Let's see.
Oh, double standards.
I wanted to talk to double standards, and this also ties into large companies getting too big
and abusing their power or whatever.
And as far as double standards, well, there's a site called Hackaday, hackaday.com, which is a blog.
It's one of the Jason Calacanis slave labor sites that I've had issues with for a long time.
Somebody who makes multi-millions of dollars by putting ads on other people's work and paying them peanuts.
But anyway, I'll back off of that.
I don't want to get you in any trouble there.
But this is a hacking site.
Hackaday has different – it's a blog with new posts every day, and it's definitely clearly hacking.
It's in the title.
Google, but not only does Google allow them to have ads on there, and not only do they support and let them do that,
but they allow them to break their rules.
We talked about in the last episode that you're only allowed to have three ads per page.
Well, unless you're one of these larger companies where you can make it worth their while,
a multimillion-dollar company, you can give them more ads, make them more money.
Oh, well, you're allowed to break the three ads per page limit.
So they can pick and choose who they want to enforce their rules to.
So I don't know.
That kind of defeats the point of rules to a certain extent, I guess.
But, hey, you know what?
Google is a phenomenon.
Yeah.
They're going to be the force to reckon with.
We talk about this a lot in our office, how it sort of happened.
We saw Microsoft's waning influence coming for a while, but it really picked up pace the last couple of years,
and Google is just everywhere.
Yeah, and Google is making some mistakes right now, but that's probably another topic for another show, too.
I think that YouTube buyout was the stupidest move I've ever seen in my life.
But, anyway.
That's definitely a whole other topic.
Yeah, well, I mean, basically that's a site that's – well, yeah, never mind.
So, yeah, do no evil.
That's the whole thing that Google is founded on.
Yeah, I'm sorry, but that's BS.
Yes.
And as far as the Yahoo beta, I actually have been involved in the Yahoo program for a long, long time.
I jumped on really early when they first announced it.
I had to wait like a month or two, but once I got in there, it was great.
I have to say I really, really enjoyed it.
I put ads on only a couple of our sites.
They are hacking-related sites, my hacking blog, the digitaldogpound.org blog that we have,
and over on hacktv.com, which is our video show, our TV show, which is clearly hacking-related material.
And they have not canceled me all this time.
So they're perfectly legitimate.
I'm not doing any click fraud.
I'm not doing any fancy stuff.
So, again, a hacker on hacking content-related sites, but I'm not doing anything wrong.
I'm not breaking any law.
So this is what I kind of like to see.
My click-through ratio is like 0.3 to 0.5, somewhere in that range, which is very normal for a site of my size.
And they're allowing me right now, knowing my content, to continue operating.
Now, they can at any time, of course, just like we mentioned earlier.
In their rules, it does probably forbid quote-unquote hacking or something to that effect.
So far, they've let me go.
They're not choosing to be as anal retentive about it or enforce it as strongly as Google was.
So at any point, though, I realized I could get an email from them saying, hey, we're canceling your account.
You have hacking whatever on your site.
So, so far, though, they seem to – either they haven't noticed or they actually can differentiate between hacking and illegal activity
and realize that they're not synonyms.
They're not synonymous with each other.
So, you know, so far so good.
Well, it'll be interesting to watch.
This comes down to that sort of net neutrality thing is, you know, how these different companies react to their business partners
because this is – you know, suddenly they're making value judgments, you know.
The ISPs for so many years were just sort of plumbing, you know, just let every bit go through.
And you guys worry about what's good and what's bad.
So it'll be interesting to see how this plays out.
We might have to have you on another upcoming show to talk about net neutrality
because we actually have not done a full show about that.
So we try to stay away from kind of quote-unquote political topics, but that's not really – it's political,
but it affects the hacking community as well as the entire Internet community.
So we might have to do an episode on that.
Okay.
As far as the others he mentioned, I have not tried those, so thanks for sending information about those.
AdBright and Canoodle I've never tried before.
I'm not really into it to make money.
I'm doing it more for the fact that I wanted to learn how they worked and see what they do,
and, you know, I find it interesting.
That may be changing now with our server costs rising, but that's a whole other topic also.
So let's move on to another email.
Boy, we're really falling behind now.
So let's see.
The next email is from rhnnet, who says,
Hello, host and co-host, in a very creative way.
I like that.
I was listening to episode 185.
Stank was complaining the lack of GUIs for GPG.
There are, in fact, many.
On Linux, I use KGPG, tinyurl.com, 2-K-F-O-M-L.
So if anybody wants to check that out, we've had several people email us, some others as well,
so that's very cool to know that there are some out there.
On Windows, I use WinPT, or Windows Privacy Tools, which is at tinyurl.com slash 3C28PM.
Unfortunately, it's not as good as KGPG, but it gets the job done.
It's gone out of development, so if someone wants it, they should contact the developer.
Programs are GPL.
I'm reading it fast forward to try to catch up here.
And actually, this next part is the part that I wanted to talk about, and that's, he says,
Another topic on the show was click fraud.
I was thinking about data the browser sends to the site, browser, resolution, color, JavaScript status, referring page, etc.
Are these factors looked at when deciding on click fraud?
What if the clock skew was measured and compared over time to aid in catching click fraud?
Just an idea.
Thanks for the show.
So, RHNNet, thank you for the email.
Yes, I'm going to quickly run through this, if I may, Scott.
Yeah.
Because this is kind of…
I'm going to step back.
Yeah, it's kind of…
Well, it's technical, but it's not too technical, so I'm going to try to choose my words carefully here.
First of all, any pattern can be traced, and it's important to realize that.
Any pattern, that's why they call them patterns, and we explained this on the last episode in regards to click fraud
and writing a script to automatically click on ads, which is what everybody thinks is the way to go, and they can write this.
Well, there are many, many, many, many, many, many ways to get caught doing this.
It comes back to a term that I used, not that I made up or anything, but a term that popped into my head was…
I had given that presentation called The Art of Electronic Deduction that I gave at Interzone and Hope last year.
And the term I used then is very applicable now, and that is a preponderance of evidence.
So all of these things that you just mentioned in the email, lots of people can have the same screen resolution.
You know, there are common default resolutions.
Many people are using the same browser, even the same versions of browsers.
So none of those things by themselves can individually target anybody or find anything, the operating system or any of these other common elements.
But these can be used to build a profile, to create a preponderance of evidence, and that is kind of a legal term, but the concept fits here.
By combining all those things together, you can absolutely create a pattern.
The data itself can be data mined, and this is exactly what data warehousing, the whole concept of data warehousing is and data mining.
You can go out there and data mine and pull out these transactions, which in this case are visits to your site or clicks through on your ads or whatever, that have multiple data elements in that record.
They have multiple data elements in common.
If they have several with the same screen resolution, that's not such a big deal.
But if they also did use the same browser and the same OS, then you're getting a little closer.
Now, that's still a little vague because those are common things.
But when you start adding other patterns in there, you're never going to be able to tell 100% truth.
Well, you may be able to, but you can get it so that you're pretty close and that any pattern is going to draw attention to you and probably get you busted for it.
So it's really not worth it for what you're going to get out of it.
And the reason why is this.
It's something that Natis mentioned on the last show.
And probably the biggest point from that show, and I don't think we emphasized it enough when Natis brought it up,
let's just say, for argument's sake, that you do script everything right.
You write a script that has a random timer so that you don't have a regular pattern of click timing.
You know, if you hit every 10 minutes, you're busted.
You know, they're going to find that easily.
So let's say you have a random pattern where it clicks every 5 minutes plus or minus 20 more minutes.
So it fluctuates a big range of fluctuation there.
You use proxies.
You change and update your proxies frequently.
You maybe even shuffle some in and out of your list.
You write another script that makes the proxies mix up so they don't see hits coming from that same proxy server and over and over
because proxies can be easily blocked.
You randomize your agent string, the OS.
All that stuff can be modified.
You can modify all that stuff and randomize it.
But you're still going to get busted.
And here's the reason why.
It's what Natis said.
There's going to be an anomaly in the statistics.
Natis explained on that episode that your bot is basically clicking on an ad every single time it hits the page.
So if you click on every single ad that comes up on the page every single time, your click-through ratio is going to be 100%.
And that's pretty unusual.
That's going to draw some attention.
That is an anomaly.
It doesn't work that way.
Like I said earlier, my click-through ratio is 0.3, 0.5, somewhere in that range,
which means basically four clicks out of every 1,000 impressions that we deliver.
So every 1,000 times the ad is shown.
On normal traffic, you're going to get about four people that click through like that.
Now, it can fluctuate as much as 10 out of those 1,000, and it's not completely anomalous.
But if you suddenly mix in a script that's going to be adding one click for one impression that it makes,
let's say your bot only hits it 100 visits, which is not a lot.
And you had 1,000 impressions in the example used earlier, so you just added 100 more clicks to that.
So basically you're going to bring your math to, instead of four clicks out of 1,000,
you're 104 clicks out of 1,100.
So basically you just added a few more clicks onto your normal traffic.
So basically I'm not using an example of 100% because that's kind of ridiculous.
This is more realistic.
104 clicks out of 1,100 impressions.
If you do the math, you've got a click-through ratio there of 10.5% persistently.
And if you don't think that that's going to draw immediate attention to you, you are sadly mistaken.
So making that small of a change is going to get you noticed, and it really only got you 100 clicks.
That's not going to make you any money anyway.
So what I'm trying to get across here, what I'm saying is if you have some delusions
that you're going to write a script that's going to go out there and hit ads and make you a lot of money,
you're not.
I will say, in my opinion, theoretically, you could write a script that you could sneak in there,
keep that click-through ratio lower but higher than it would normally be,
and probably not get noticed so much.
But you know what?
You're going to make a dollar or two.
Is it really worth going federal, pound me in the prison to make an extra couple of bucks?
Get rich not that quick.
Yeah, it's exactly, you know, it's, yeah, it's a lot harder than a lot.
I mean, this is a very common thing.
I've heard so many hackers talk about this and think that it can be done easily, and it really can't.
So, yeah.
So this seems to speak to the sort of division of understanding, too.
A lot of the people who are getting caught doing this are doing it just like you say,
and having 10%, 20% hit rates.
And it's just, for anybody investigating, those are the low-hanging fruit.
They're just plucking them, sort of saying, sorry, Charlie, you know, it's way too easy.
Well, and also, you know, it crosses that line, and again, soapbox, whatever you want to call it,
it crosses that line where, you know, you're not a hacker anymore.
When your intent is to go out there and commit click fraud to make a lot of money,
that's a whole different scenario.
You've crossed a different line, and, you know, that's not hacking.
You've left the realm of hacking when you cross that line.
So, anyway, we'll rein back from that as well,
because that's certainly something we've beaten to death on this show.
Next email, and I'm trying to really speed up here.
Next email, I'm not even going to read the full email,
but I'll just mention the spirit of what it is,
is basically we got an email from Matt,
who was saying he was having some problem with the audio quality,
where he's getting high-pitched squealing and stuff like that.
He did follow up later and say that he did find out that it was actually,
with the player on his end, handling the low bitrate files that we put out.
So, I just wanted to mention on the air that when we mix and record and edit all these shows together,
I definitely listen to them before I send them out.
I can only speak for myself, of course.
I don't know about the other guys.
But when I do it, I listen to it.
I make sure that the sound quality is there,
and I'm not going to send it out if it's bad,
or I'll send it out as best as I can, I should say.
But for the most part, I listen to everything ahead of time.
So, if you ever do have any audio problems on the show,
tweak your settings a little bit.
There might be background noises that are in my recording from the room,
maybe the ceiling fan I forgot to turn off or something like that,
or the computer next to my speaker phone is putting out a hum or something like that.
So, you can usually tweak that for the most part on your end and make it go away easily.
And the other thing he mentioned in his response at the very end was
that it would be nice to have an AUG feed.
So, yeah, we've wanted to do an AUG feed from day one.
Back then, we didn't have the disk space on that server.
So, now that we just switched over to a new server,
that is coming back up as a topic of discussion.
So, we may see if we can make that happen at some point.
But we've got 186 episodes to go back through and re-encode from the Masters,
which is going to take quite a bit of time.
So, yes, we want to do it, but bear with us.
I don't know how soon we can make that happen.
You know what?
And let's see, Scott, I think maybe what we should do here
is kind of jump ahead into the main topic.
And I had a couple more emails I wanted to talk about,
but I want to make sure we have time to talk.
So, I'm going to put these other emails off until next episode
and kind of segue into our main topics of the evening.
And the main topic is going to be disclosure.
That's going to be our main topic of the evening.
But before we do, if I may, let's talk about the article.
See, I contacted you for a specific reason.
I read a lot of magazines, a lot of trade magazines.
I have mentioned I subscribe to over 50 magazines a month that I sit and read all the time.
So, this article caught my eye.
And there's a reason I singled you out to have you on the show.
Not to get all weird and corny or anything here, but the reason that I noticed it.
And this article, by the way, which I should have given a tiny URL to,
but you can go to CSOonline.com and do a search for the title.
It's called The Bad Guys Get Smarter.
And this is an article by Mr. Baranato here who talked about a few interesting topics
that I'd like to go into here.
But the reason that it caught my eye is because throughout the flow of the whole article,
even the title of the article, The Bad Guys Get Smarter, not The Hackers Get Smarter.
And if anybody listening, if there are any other writers out there listening,
if there's any security professionals listening,
if there's anybody out there who thinks that people don't catch and notice this kind of thing,
I'm here to tell you we do.
You know, I read these articles and I see the word hacker thrown around and demonized quite a bit.
So, it catches my eye when I read this article.
And with a couple exceptions towards the end, which were very minor,
there are several parts of this article where you could have easily said,
hackers do this and hackers would seek to have a bank employee with data's unwillingly logged.
But you didn't use the word hacker.
You used the word attack or attacker very, very consistently.
That's the reason I invited you to have you on the show.
And I'm glad that you actually followed up.
You could have easily dismissed the email.
So, first of all, I appreciate you coming on the show to talk about this topic.
Now, let's talk about this particular article, if you will, since you obviously wrote it.
I'm going to shut up a little bit and let you talk about it.
Because the first topic in here, advanced phishing.
We've done phishing on the show quite a bit.
But what you found out here in your research was a new type of phishing technique, if you will, that's going about.
So, can you talk about that a little bit?
Sure, absolutely.
And, you know, it's interesting you say that, you know, we're trying to use bad guy, attacker, malicious hacker sometimes.
You know, part of it's the writing game is you don't want to use the same word over and over again.
But I think part of it, too, is this transition away from kind of, you know, which has been going on for a long time now,
but this kind of sort of tinkering kind of damage from attacks to really targeted, really devastating financially attacks.
It's actually easier sometimes to write about it in terms of bad guys because it's so clear that's what they are.
This isn't a defaced website, in other words, you know.
Right.
These are people going for money at a bank.
Right.
But I appreciate your having me.
I'm glad you noticed that.
We do try as hard as we can.
We don't always succeed to distinguish.
And this particular one caught our eyes because we're journalists, and this was about journalism.
It actually came to me from the CISO at the bank, which I can't name.
He's a source of mine.
He's a friend of mine.
Of course.
Who emailed me one morning and said, I'm in a world of hurt, and here's why.
And he sent me the screenshot, which you'll see with the email.
And essentially what happened was an attacker got the rolls for his company's emails.
Whether they just figured out the naming convention for the emails and then found a bunch of names of employees who worked there,
it seems like they had a little bit more intelligence than that and were able to send one-off emails to these different employees,
essentially posing as a reporter, which is what I do, and saying it says something to the extent of,
I'm a reporter for the financial news, I've heard your company lost customer records and that you commented on it in a story,
and I'm following up on that.
Here's a link to the story.
Could you give me a call?
Regards, Gordon Riley.
Well, what's interesting about this for us is this is an email that, you know, not verbatim,
but, you know, almost, you know, sort of structurally, I send out almost every day.
You know, I'm talking to hundreds of people all the time for all different stories,
and when we need somebody to comment that we don't know well or somebody inside,
we're trying to get around PR or whatever,
and we'll send an email that says, I'd love to talk to you.
Here's a link to what I wrote or what's been written.
Could you give me a call?
Regards, Scott Baranato.
It's so well-crafted.
The English is so perfectly on the nose, even though the email doesn't come from the U.S., it turns out,
and the link is so innocuous-looking that they've engineered this thing beautifully to get the person to click,
and, in fact, I can't remember the exact number, but 70 people, anyway, within the bank clicked on it.
You know, from the fact that it wasn't a blast email, there's no way for a spam filter to pick up on it.
Right.
That it's the English is right, and the social engineering of scaring someone by saying,
hey, your bank lost customer records, you know.
I noticed this, and I noticed you were quoted in an article.
You know, if you're on the receiving end of that, think about your reaction a little bit.
Right.
You know, you're reading through this thinking, first of all, oh, my God, my bank lost customer records.
And, second, somebody quoted me in an article.
What?
I'm going to want to look at that article that that person's talking to.
Right.
So he sent this email to us, and we were just, you know,
there's always that sort of dual impression of sort of being horrified and also impressed at the same time.
We felt like this was a step up in the social engineering game and worth looking at.
Well, it's obviously, you know, it's a perfect description, the word targeted.
I mean, you don't get any better targeted than what they did.
They targeted.
They had their specific victims in mind, and they targeted them,
and they did their research, obviously, to find out the employees' names.
Most big companies or banks or any other large company or even small companies,
they can have about pages on there that tell some of the employee names and some of the people to contact.
Or they may have a list on the website of phone numbers and employees and stuff like that.
And if you know the naming convention of how they do it, is it, you know,
first initial dot last name at whatever dot com?
It's kind of easy.
It's, you know, footprinting a company like that is something that's very, very easily done.
And so it's obvious that they singled out and targeted them directly.
But there's also, from the social engineering of how would you react if you got this,
I think there's another one in there that's kind of maybe not as obvious is,
yeah, you get the email saying that you may have been quoted,
which is, you know, might spur you to check it out going, wait a minute, what's that about?
Believe it or not, I do think that there might have been a couple people that also thought,
hey, wow, I can be on TV, I can be in the newspapers, a vanity effect.
There's no question for me, you know, from a journalist's point of view, you know,
there are different types of sources.
There are ones who are reluctant, obviously, depending on the nature of the situation as well.
But there are certain people you talk to who are so enamored of the idea of being interviewed.
Yeah.
And there's nothing wrong with that, you know.
Sometimes they have very good things to say, sometimes they don't.
Sometimes people keep coming back to you wanting to be quoted over and over,
and you don't want them to.
But there is a small, you know, a subset of the population that is so enamored of the idea
that somebody wants to hear what they have to say about this situation.
And you see this all the time on the TV news, right, in broadcast news.
Oh, yeah.
Which I consider a whole different form of journalism.
But you'll see people, you know, the next-door neighbor who wants to get on saying,
you know, he seemed like such a nice guy, that kind of thing.
So, absolutely, there is a sense that if you're going to send that to, say, 70 people inside the bank,
200 people inside the bank, some group of that people is going to want to comment for a published story.
The specter of publication is appealing to some people.
Absolutely.
Yeah.
Well, and let's jump ahead to the next one here.
And another advanced form of attack here, a new form of attack,
is using instant messaging as a distributed network.
Now, what exactly are we talking about here?
Well, this is more of a game of economics and statistics.
If you can get into instant messaging, which, you know, we found some people had,
and get enough handles, IM handles, whatever, I don't know what they're called these days,
what the kids call them.
Yeah.
Get enough people.
You can find ways to sneak in, interrupt conversations with very innocuous-looking messages.
You can, in some cases, even make it look like a friend or a buddy of the person who's chatting has chimed in
and said, hey, check out this link.
Now, this really goes way beyond in terms of social engineering in the sense that if I put this person on my buddy list
and they're saying, hey, check out this link or this picture or whatever, I have no reason to distrust that.
I'm thinking, you know, StankDog sent me a quick message.
He's in a brush.
Check out this link.
I want you to look at it.
I'm going to have no reservation about clicking on that.
But even if you can't get the buddy's name, if you can do, in the AOL network,
I think there's 2 million chat members or something.
Right.
And, you know, I'm not trying to be unkind or judgmental,
but a good portion of the AOL instant message crowd is probably less technical, correct?
They're dumb.
You can say that.
Go ahead.
I'll say it.
I can't say that.
I'll say it.
Certainly it's a network where they're going to have less technical users.
True.
They're going to be able to, even if it's a stranger jumping in saying, check out this link,
and you have no reason to trust it.
But, you know, given you have 2 million IM handles at your, you know, disposal,
this is the old phishing idea, which is if you send it to enough people,
even if you get a .01% hit rate, you're going to get the job done.
Well, and that's the whole spammer concept.
The other thing that allows is once, say, you get into one of those,
say you send out 100,000, you get a few.
Once you get your bot or whatever you're delivering into one of those,
they can start spreading it amongst their friends and so on and so forth.
So it's really clever, and it's, you know,
it's the old story of highly distributed networks being highly dangerous
if they're exploited the right way.
Well, and if they're going to the, you know,
and then perpetuating themselves once they've been hit one person,
and then you spread out to their friends, and then you spread out,
that's very viral by nature.
So it is definitely an advancement.
Actually, there's one more I want to talk about here and then go into our main topic.
It's actually on the sidebar here because I love the term,
and the term was spearfishing, which I think is really, really a great term
and very memorable.
Now, what is spearfishing?
Well, just think of it as the most specified form of fishing possible.
You know, if you think of spearfishing with the F instead of the PH, right,
you're out there with a big pointed object, and what are you trying to do?
You're trying to get one fish, and you're not casting a net at all.
Right.
You know, you're literally trying to get one fish.
So in spearfishing, it could be as simple as getting an email off the web like mine,
which is pasted everywhere, and concocting a scheme which you think will both
through technical and social skills get me to do something I don't want to,
like cross-site request forgery or something else.
Right.
And one of the reasons this sort of started popping up more, I think,
is because the net casting was getting harder and harder,
and you had to be more and more sophisticated to pull it off.
But this requires a different kind of sophistication on the attacker's part,
and that is you have to be a con man, essentially.
You have to know what's going to make me not suspicious,
what's going to make me want to, you know, compel to action.
And it's a very different model for fishing, but has shown some success.
The case of the advanced fishing we highlighted with the bank,
some people might call that spearfishing.
You know, I think a better example would be that somebody sent the VP of, you know,
marketing or something at that bank something,
where he got access to the roles of customer roles in some way through that interaction with that one person.
But think of it just like literally spearfishing, which is you're not casting a net at all.
You're trying to kill one fish.
Yeah, and that's why I think it's such a brilliant term,
because we all, you know, fishing we're familiar with,
and fishing is very similar in the mindset of spam where you just cast that net, you know,
and that's the metaphor everyone uses.
You're just sending out as many as possible and hoping that one or two idiots out there fall for it
or get back to you, you know, as opposed to spearfishing where you're singling out a person.
And I think the word that's going to come up here,
and I think this is probably the summary of the whole, not only this article and these topics,
but the direction that I think things are going these days is targeted attacks.
People are not changing.
It's a whole 180 degree change from the traditional way of spamming and fishing.
They're completely changing and saying, you know what,
I'm not going to go for hoping that I get, you know,
some little old lady who doesn't understand email and take advantage of her,
which is a very common story and a very sad story.
Instead, they are focusing and saying, listen,
I see this person on eBay just bought a new big screen color TV.
They've obviously got money.
I'm going to focus and do a little research on them
and see if I can't trick them into sending me some of that money or the TV
or whatever the case may be.
So I love the terminology.
And really quickly before we move on,
it makes sense when you think about it in terms of sort of economics
and how sort of criminal enterprises develop.
When you have the net casting sort of thing, it's very inefficient,
and things have been moving toward efficiency for a long time.
And what happens is the cat and mouse of attack type, defense type,
attack type, defense type, kind of, it's sort of like an arms race.
It dials up what you have to invest in order to get your return.
And from the criminal's perspective, you have to invest more in time and energy
and infrastructure and whatever else to get the same return.
What targeting allows you to do, what social engineering allows you to do,
is change that efficiency equation.
If I can spend all that time I was wasting, building up my infrastructure to cast my net,
targeting, I'm going to get a more efficient return.
I'm going to get a bigger return for the same amount of effort.
And it's sort of, in a way, basic economics.
It's kind of fun to look at from that perspective.
Yeah, so the summary, you know, is that these aren't necessarily new attacks.
These are just more sophisticated forms of existing and known terms and attacks, you know.
So, you know, always be skeptical of just about everything on the global interweb that you see.
It's not all true.
See, every time I get those instant messages, the reason I don't go on any of those I am things anymore,
all these times I get the instant messages saying, hey, big boy, my webcam is up.
I mean, are you telling me those aren't real?
These aren't like random hot women that want me for me?
They're spam?
That couldn't possibly be true, right?
It's my sparkling...
It's hard to believe sometimes.
You see some of them.
It's hard to believe, you know, people fall for it.
But they do.
I can't explain it.
Obviously, they do.
All right, well, we are, let's see, we're about 50 minutes into the show.
We've probably got another 20 to 30 minutes left to finish up with our main topic.
And this kind of segues into it is, you know, a different way of looking at things.
And, you know, these fishers that are doing this kind of stuff, that's a whole different, you know,
there's people researching that and looking into that because that's a very clear-cut attack.
It's intent, you know, the word criminal, I think, can very easily define that.
I can't think of any offhand, any situations where there'd be a legitimate reason to try to fish somebody other than maybe a prank or something like that.
There is nothing.
Yeah, so let's kind of shift gears here and talk about disclosure because there are some cases where you may find,
and this is kind of, I guess this is not going away from phishing altogether,
but let's talk about from a hacker standpoint, one of the issues that we deal with is we get labeled and lumped in with fishers
and spammers and attackers and criminals all the time.
And we're kind of used to it and we don't like it, but we deal with it.
And one of the problems is because some of the stuff that we find interesting and that we're into from a technological standpoint
can be used in such a way or can be used by criminals or can be used to attack,
even though we don't necessarily do it to attack or we're not interested in that aspect.
We'll find a flaw or an exploit or a vulnerability and that's what the hackers, that's what hackers do a lot of the times
is they like to take things apart, figure out how they work, and we might find an exploit or a problem or something like that.
So what we wanted to talk about today, since we have both of us on the phone and we both, you know, kind of have different,
well, maybe we do and maybe we don't have different viewpoints of this, talk about disclosure.
Disclosure, and first of all, what is disclosure?
I mean, if I come across some CSO online website or something like that and I find a bug or something that I put in a certain code
and a search thing and it comes back and it gives me the home phone number of the company, the boss of the whole company
or something like that.
So that's obviously not a good thing, right?
And I'm making that up, of course.
There's no such thing on there.
That's right.
Let's make that clear.
Yeah, just to make up an example, let's say I'm surfing on the website.
One of our listeners is reading this article on the website, which I encourage them to do,
and they do stumble across this.
What do you do?
How do you disclose something like that?
Or actually, first question really should be, should you disclose this?
Should you tell anybody about that or should you just keep your mouth shut?
Well, I've got to jump in and say this is probably the number one issue that I think will be dominating conversations both sort of in your circles
and then, frankly, my reader circles to an extent in the coming years because it is really getting interesting and kind of very fuzzy very quickly on the web.
As you know, you have package applications and then you have sort of websites, which are, in a sense, applications.
And how they operate and how they operate and the code underneath them is so different.
And sort of how you build it and maintain it is so different that nobody really knows from what we can tell
and what this story's sort of position is that nobody really knows how you go about finding and disclosing vulnerabilities on the web.
And an important point here is that, I think, is that, you know, all generalizations are bad.
That's the old joke.
But, you know, a good amount of websites have flaws in them.
But here's where it gets tricky is when you have websites that are dynamic, that change, that have tabs on them,
that have Java injected into them on purpose, you know, the state of the website changes, you know, almost minute to minute, day to day, certainly.
And flaws kind of come out, you know, outcrop and then kind of, you know, sort of like outcroppings of rock.
They'll kind of break the surface and then go back down, seduction.
And they kind of come and go.
And, you know, is that a vulnerability?
Is that just the state of websites?
I don't know the answer to that.
I don't think a lot of people know the answer to that.
And what everybody's struggling with now is what is a vulnerability, number one?
And if I find what I think is a vulnerability on the web, what is my responsibility?
What, you know, what's going to get me in trouble?
Nobody really knows.
And we have a couple of really interesting cases that this story was focused on, which highlight this problem.
You know, you say you have a sort of an opinion on it or a sort of a position.
I don't know.
You know, I'm sort of, I'm rudderless on it.
And that's sort of where I'm supposed to be as a reporter.
But I don't think anything's been resolved at all.
No, and that's just the thing.
I'm, you know, I can try to stay neutral in it for the most part.
And I have my personal opinion, which I'm not trying to, I would not try to force out there to everyone else.
I might give some advice on what my opinion is.
But everybody has, like I've had, of course, this conversation happens at our hacker meetings and conferences all the time.
And it's especially further blurred now because we actually have a security industry that we didn't have five years ago.
You know, there was no such thing as chief security officers, you know, not until fairly recently or at least not as widespread as they are.
We didn't have security teams.
We didn't have security in the mindset.
One, I would debate that possibly because of disclosure we've made that happen and created a whole industry.
But that's kind of a stretch.
We'll back away from that.
But more to the point is we have that now.
And how do you work with this new entity such as it is, us as hackers or as security professionals who are hired to do research and they find vulnerabilities as paid employees or whatever.
However, how do you disclose something in a responsible manner or can you, I guess?
I mean, to be really impartial, can you do such a thing?
Because I'll go ahead and tell you up front, my opinion up front, my personal thing is for the most part, I keep my mouth shut.
I'm just not going to say a word to anybody because the dangers, the risks are too much for me.
I'm sorry if your boss of CSO Online, if I accidentally found out his personal phone number was in a certain weird search thing, I'm not going to call him and tell him.
I'm not going to email him.
I'm not going to contact anybody.
I'm going to keep my mouth shut because I'm not the one that drops this guy's docs and contacts him and freaks him out.
And then I'm the one that's like, hey, how dare you?
What are you doing?
There's no way I would reveal that.
That's where the heat and the energy is.
Now, we talked about this a little bit earlier.
What is the intent there?
You're on the site.
You notice this.
You don't do anything with it.
What's the intent there?
Now, if you go and call me or somebody and say, hey, look, you've got this flaw in your site, I'm going to email you how I came about it.
And this is sort of what happened in the Eric McCarty USD case, which we can talk about a little bit.
You send me that sort of proof of exploit, I guess you could call it, or just proof of flaw.
Right.
We will send a proof of concept code usually if it's something code-based.
There you go.
Yeah.
I now have Exhibit A, right?
You know, regardless of your intent, I can say, hey, look, he hacked my site and here's the code.
I'm sorry.
He cracked my site and here's the code.
And I'm going to throw, you know, depending on how big a company I am, I'm going to throw a ton of lawyers at this because you don't need much to sue someone.
You might need a lot to win a suit against someone.
Or defend a suit.
You don't need much to sue someone.
You need a lot to defend a suit too, and that's the other thing that really sucks to be on the opposite end of it is you get sued by somebody.
You know, a lot of us, you know, a lot of people don't have the money to defend themselves, and all of a sudden we've got this big company or whatever coming after us.
And, you know, what do we get, a public defender, if that?
Yeah, and here's sort of, here's how the back and forth goes.
A defendant in that case, like McCarty, says, you know, I wasn't doing anything wrong.
I had no malicious intent.
Right, and intent is a very, very important word in this whole process.
Intent is going to be the key to the whole thing.
And now the other side says it doesn't matter.
You did it, period.
You know, it's sort of like saying, you know, you're on the inside of a bank, but you haven't stolen anything yet.
And you say, look, I wasn't going to steal anything.
The door was unlocked.
I thought the place was open or something.
And the other side says it doesn't matter.
You've done it.
It doesn't matter whether or not you've completed what we think you were going to do.
You had malicious intent as far as we're concerned.
And the other side sort of comes back and says, the other side sort of comes back and says,
I can't help it if you didn't lock your door, you know, to the jewelry store.
It's not my fault you built a bad website with all these flaws in it that expose your personal information.
And by the way, shouldn't you be locking that up?
That's sort of the sort of overview of how the arguments go back and forth.
And I'm not saying any side is right, but that's what you see happening.
Now, what's scary about the McCarty case, I think, to lawyers like Jennifer Granik at Stanford is...
Good friend of ours.
Yeah.
What's scary about that case is he pled guilty.
And, you know, according to his side of the story, he wouldn't have if he had the resources to defend himself,
which is scary enough, which is sort of saying if you have enough money and enough lawyers,
you can, you know, sort of scare someone into fleeing.
But also that his claim is he contacted them, they kind of blew it off, so he publicized.
He sort of was doing the shame thing, trying to shame them into, you know, cleaning up their act.
Right.
And that what he was eventually pled guilty to was taking seven records that he had taken sort of upon their request.
They had said, prove it to us that you can do this.
So he did.
That is so wrong on so many levels.
You know, this is McCarty's contention.
And he's pled guilty, so it's hard for him to come back and say, but this is, you know, really what happened.
I'm not sort of taking his side or the other side.
I'm just saying his side of the story is, you know, it's sort of like saying to someone, you know,
you think you can break into my store?
And they're like, yeah, I think you can.
I think I can.
And then you do it, and they come in the store and say, you know, you're under arrest for breaking into my store.
That's sort of his contention.
But that's how hard it's going to be to figure this problem out.
Right.
And see, that really is just, that's a contract.
That's an established, okay, we want you to prove it to us.
They're giving explicit permission for him to do it.
And then for him to have to plead guilty because he couldn't afford to defend himself afterwards,
that's just such a horrible situation.
And that's why what I said earlier is I try to keep my mouth shut because I don't want to be in that situation.
I want to help, you know, and my intent would be to say, hey, you've got a vulnerability.
I can not only show you how to do it and prove it to you, but maybe I can even help you fix it.
But I'm not even going to try to do that.
You're not alone, and this is sort of the nexus of the name of the story that Chilling affected.
You know, it's hard to blame anybody for backing off.
You know, I don't want to have to go through what Eric McCarty went through because I was finding flaws,
even though I didn't have any intent to do anything with them.
It's not worth it.
And that's completely understandable.
So, but then the Chilling effect is, so what happens?
Who's left looking for flaws on websites?
It's people who aren't concerned with whether or not they're going to jail.
People who are actually there to exploit criminal elements, attackers.
It can turn into a really bad situation quickly because code is inherently flawed on websites,
and you need some kind of vetting process because clearly companies aren't vetting themselves
because all you have to do is look.
You know, we mentioned this in the story.
A hacker named Arsenake started posting cross-site scripting flaws on sites on a discussion thread,
but hundreds and hundreds and thousands of sites, they're not closing their sites up.
So there needs to be some kind of audit going on to protect the information on those sites,
and it's not going on.
And the more people who are scared to do that auditing,
the more likely the person who finds the flaws has a lot worse intentions than the research community or the hackers, say.
Yeah, and I think there are people getting together to try to come up with some standards on how to handle this type of thing.
But everybody has to be on board from both sides, and I think that's unfortunately sort of an impossibility.
Even if we were to come up with some sort of standard, like I've heard standards like one month,
you'll notify somebody of a flaw or a vulnerability, give them one month to fix it,
or six months, or there's been different things thrown around before you release it publicly or not.
But you know what, let's kind of step back a little bit, and let's talk about,
and let's kind of go through a list of some of the things that hackers think about in our audience if they're in this situation.
So let's kind of go back to a generic.
Let's not focus on that particular incident.
Let's just go back and think to yourself, first of all, should you or should you not contact them,
and the pros and cons of doing that.
And now that we've got a story behind it, we can kind of apply it.
The pros, obviously, would be, yes, if you're intent or you're helping to fix a security problem
or do the right thing or something like that, or maybe even further, maybe, I don't know,
compensation, maybe a reward, or just even recognition or something like that as a security researcher,
things like that.
Those could be the pros.
And one-off consulting.
Yeah, but at the same time, the very, very, very big con is exactly what you just said,
is you could get sued or busted and thrown into jail for it or sued for money and all this kind of stuff,
which is an enormous risk.
So are any of those pros enough to outweigh the cons?
And each scenario, each case that you're in, like I have to weigh to myself, well, you know, if I,
like, for example, if somebody found a flaw in binrev in our site, I have said out there many times,
I'm very approachable about that.
I'd rather find out about it from someone so that I can fix it so that someone else doesn't come along
with worse and malicious intent and wipe the site out or delete things out of it.
So I'm more approachable.
I don't know about CSO online.
I don't know how approachable, and I'm sorry to keep using that example.
I guess it's just fresh on the mind or something.
But, or going to any site, would you feel more – what I'm saying is it's different to approach a company
like, say, Microsoft versus Joe Bob's Computer Repair Center.
You've got two different –
You just don't know how any given company or organization is going to react.
And, frankly, how people within that organization will react, you might get a very favorable response
from a security department who understands the stakes.
Right.
And that security department might be trumped by somebody else, a marketing department,
who has, you know, a little piece of script up there they want to keep up there that's making the site vulnerable.
Cases we've heard of that.
You know, our snake's experience is pretty telling.
He put, you know, thousands of pretty basic cross-site scripting flaws and the concept code with them on his site,
and the reactions to that range from, we're going to shut your site down,
to thank you very much, we're going to fix that right away.
So you just have no idea.
And that uncertainty, like you said, is a real, real big, you know, dissuader.
Right.
And, you know, you have to, if you find something like this, you're going to have to make that decision for yourself.
So if you feel comfortable with a site, like I have, myself, there are some things that I've never told a soul,
that I've never reported because I don't think that particular site or company or software manufacturer or whatever would accept it very well.
So I've just kept it to myself.
There are other cases where I absolutely have contacted people because I kind of got an impression from the site that these people would be open and approachable
and wouldn't be, you know, make a big deal out of it.
So case-by-case basis from my experience.
But no matter what that case-by-case basis is or how lenient or strict or overboard you think they might go,
no matter what the bottom line is, the risk doesn't change.
So always keep that in mind.
And actually, you kind of moved into the next segment I wanted to talk about too, which is kind of a view from the other side.
Companies that get approached by this, you know, will usually panic for the most part.
They're not going to like it, obviously, because of just the nature of it.
But then again, it depends on who you contact.
I mean, there are so many things and so many people involved that it could be a different scenario depending on who you contact and how you contact them.
That's right.
And, you know, there's a temporal element here too where in one of the anecdotes we use in the story about a case at Purdue University,
sometimes it might seem like it's working out just fine.
You disclose, they say thank you, they fix the flaw.
But then something happens like at Purdue, then the site got hacked anyway and the police got involved.
And suddenly the police or some lawyers or somebody are asking for names.
And even if it's months later or something, how does that person who reacted fine when you disclosed it to them one-to-one,
how do they react when suddenly an authority figure, a lawyer or the police are saying,
we need to know who told you about this flaw.
And suddenly, you know, they're put in a position of basically turning you in.
So it's not a risk that just sort of goes away if they say, great, thanks for telling me.
I'll try to get that fixed.
Right. And you've got to think, why would the company react that way?
I mean, obviously there's a lot of factors from their standpoint.
They don't want to be hacked.
They don't want to have a vulnerability because, well, first of all, there's bad publicity and the embarrassment that could come from it.
You know, when somebody does get hacked or they do lose private information, get their laptop stolen with everybody's social security numbers,
whatever the case may be, all these things that happen can be embarrassing and bad publicity for them.
But, you know, I've got to say –
or that it's not going to happen to them.
That's sort of the old, you know, you don't really understand security until it affects you kind of thing.
But a lot of companies are still operating on that principle.
Yeah, and I have that here in the show notes too.
It's the old cliche of ignorance is bliss.
You know, they'd rather just bury their head in the sand and pretend it's not there.
So actually, we're running kind of low here.
We've probably got maybe 10 minutes or less here.
Let's shoot through a couple things.
I actually want to put out some – because there's no clear-cut answer on this,
I'd actually like to dispense a little bit of advice to our listeners who might find themselves in this situation
and see if we can at least make some positive suggestions to people so that we are able to still help solve some of these things and problems we find.
First of all, keeping in mind everything we said and the risk that you're taking.
If you do make the decision that you want to notify somebody about it, where do you go?
What do you do?
Who do you contact?
And we just kind of talked about it.
I would say, first of all, start with all the common email addresses,
and that would be like webmaster at and whatever the site is.
A lot of places have security at, abuse at, admin or administrator at.
So I would email several of those.
I'm going to come back to this in a second about – well, actually, I guess I'll go ahead and do it now.
When I say contact them, I'm going to recommend to you that you don't do it from your email account
or your home computer or anything that can be traced back to you.
Submit it anonymously.
There are lots of anonymous emailers out there.
And even if you use those, don't do it from home.
You know, you can – even if you use proxy service, I'm not safe, feel comfortable, feel safe doing that.
Go out to a public section.
Go out and use a network that's not directly tied back to you.
And that way, you're doing the right thing by helping them and notifying them,
but you're taking – you're not getting as much of a risk in contacting them.
So to continue on with the concept of contacting, you contact those common email addresses.
Look and see – and we kind of referred to this earlier – do they have an about page
that lists some contact information.
Some sites are even cool enough that they'll say, if you find a security problem
or if you'd like to report a problem, here's how you contact us.
Some of them will actually welcome it, and that should give you a sign to be maybe a little more comfortable
in contacting them with them.
If those don't work, you can always look up the who is information for the site,
which will tell you all the technical contacts.
So you might want to contact them.
And then the next question is, and we kind of alluded to this earlier too,
is let's say you don't get any response from any of those or they all bounce back to you
or you can't find a person to contact.
Usually the CIOs, the CEOs, the big managers, the higher-up executives,
you can usually find their information pretty well.
It's public information, stockholder, all that kind of stuff.
It's pretty easy.
Is there ever any reason you would ever want to contact them about something like this?
And I think half of our audience just went, hell no, really loud.
Yeah.
And I have to agree with that.
Yeah, from my perspective, that's a really difficult thing.
I would say the higher up the chain you decide to go or you think you might have to go,
the less effective an anonymous email is going to be.
True.
They're just not going to, you know, they're dealing with not only real threats
but fake threats all the time.
That's a good point, yeah.
Unless you're sending them an email with some documentation,
which, again, we talked about earlier, if you're sending the concept code,
you're sending Exhibit A in the trial.
Right, right.
You know, and regardless of your intentions, malicious or not,
you know, these guys don't even read their own email.
So, you know, an anonymous email, if it gets through the spam filter,
it just probably isn't going to resonate with them would be my sense.
And I'm not saying do it or don't do it.
I'm just sort of thinking out loud here.
No, and that's exactly what we're doing.
Sort of the higher up the chain you go, the more you're going to have to put yourself out there.
Absolutely, absolutely.
So, yeah, the repercussions are that they're not going to react the same way
because they don't understand it.
Also, just as a funny aside note, believe it or not,
it's very, very common for high-up executives to have secretaries
that print their email out for them and give them to them
because none of them use computers or even have email that they check themselves.
But just a little aside comment there.
So, yeah, I would warn against elevating anything to that level
unless you want black helicopters and vans outside of your house all the time.
And the last thing I wanted to mention is if you don't get a response from anybody,
nobody responds to you, do you resort to public disclosure?
And this, again, is the story that happened earlier.
I just want to say there are mailing lists out there like Security Focus,
plenty of websites.
There are hacking magazines like 2600 or even our own FinRev magazine.
There's websites like DocDroppers.org or your own blog,
as I think the example you mentioned earlier that people can post this on.
But, again, like you just said, Exhibit A, I want to put out a legal warning.
I'm not a lawyer or anything, but don't perform any illegal activities
and then post confidential or personal information publicly.
You know, even if they ask you to do it like they did to this guy's case,
that one even backfired on him and that was private.
You can guarantee that if you post any of that publicly,
you're definitely not going to get the same kind of response you might have gotten
if you'd gone to them privately.
So be aware of what you're getting into when you get into public disclosure as well.
So only release enough detail maybe to prompt them or embarrassment factor,
like you said earlier.
As a last resort, if you do want to do that,
just release enough detail to maybe prompt them into action.
And, again, your motivation being hopefully that it will make their security better
or help them with their site.
But intent is such a gray area and so hard to define.
That's the biggest, I think, word in this whole conversation.
I think that's the most important word of the whole conversation.
Absolutely.
The question of intent is so murky right now.
There's just no understanding it legally from a legal perspective,
as Jennifer Granik will tell you, I think.
Yeah, and Jennifer Granik, someone I've spoke to before,
has been very helpful in our community and very helpful with me personally
with some stuff that I had to deal with and some friends had to deal with.
But I find it interesting here, and I'm just going to throw this out totally out of the notes here.
They're just, I find it interesting that we have things like,
and I hate, gosh, I'm almost tempted not to make this analogy,
but I'm going to do it anyway.
They're completely unrelated.
But isn't it interesting that we have such thing as murder one,
murder two, manslaughter, involuntary.
We have all these levels of crimes and very heinous crimes.
But we don't have that for hacking.
You know, the difference between all these different types of murder is the intent.
You can have involuntary manslaughter.
You can have accidental.
You can have all these scenarios, and there are laws,
and there are punishments that are appropriate to those laws.
However, in this world, we don't have accidental hacking.
We don't have accidental vulnerability.
You know, we don't have like a level.
You get the book thrown at you.
There is no happy between.
So maybe the problem isn't so much working out standards and accepted things
between the hacking and security community and the business community.
Maybe the change that we would all need that would solve the problem isn't so much that relationship.
Maybe it is something that we need to have happen in our legal,
excuse me, our judicial system to be able to account for these new scenarios.
I mean, this is a new world.
We are in a whole new, this is the global interweb, and the game has changed.
The playing field has changed, and our judicial system might need to adapt with it to have the solution.
I hate to go there and sort of compare it there, but I understand what you're saying,
and I think Jennifer Granik, you know, when I talked to her,
one of the things she did say is we need some kind of specific tiered definition of access,
penetration, you know, malicious use, all of these different things.
Because, you know, you talk about sort of murder, manplotter, those differences, those are on a violent scale.
I think with economic crimes, which, you know, hacking, you know, hacking for profit would be considered,
it's always been based on how much you steal, right?
You know, grand larceny versus larceny.
Right.
That kind of thing.
It's harder to quantify sometimes when TJX companies lose, you know, several million transactions
or several hundred thousand transaction records.
It's harder to sort of say whether that's sort of grand larceny versus larceny.
So what you end up with is this big soup of it's all bad, you know.
Right.
And certainly some kind of tiered legal definition is going to be necessary.
But as you know, I think they're struggling with that.
And one of the reasons is, you know, what is the vulnerability on the web?
Well, but those things, I think that's a very good, that's also another good analogy is to larceny,
grand larceny, grand theft auto, minor petty theft, that sort of thing.
I think that is, but the difference here is that is after a crime has actually taken place.
So where do you draw the line of someone who, like, let's go back to the example of the article
and the research you did, this guy notified somebody of a vulnerability
and then was asked to provide proof of it.
He never got any level of money, so it wouldn't come to that scale.
There's got to be something below there that says he didn't cross the line.
Right, that's where you cross the line, and he didn't do that.
It doesn't sound like.
So there's got to be a tiered scale beneath the actual theft part of the whole thing.
There's got to be something in there that says, you know, what is minor
and what is, you know, some intent based in there.
And, yeah, I admit also it's not something that's easy
or something that we're going to solve on this radio show,
especially with, like, three minutes left on it, but.
And that's sort of what I was saying at the beginning is why I think this is for the next few years
is going to dominate the conversation because, you know,
not only are you dealing with people's intent and sort of fuzzing the line there,
but you're fuzzing the line of the definition of vulnerability, you know,
because websites interacting with browsers, which are all configured differently
and changing all the time, are going to create situations.
And is that a vulnerability when you can get through that?
And, you know, what is intended use of a website, that kind of thing.
These are very hard questions, both technical and legal, that just haven't been answered yet.
Yeah, and they're not simple questions.
And I think we all need to respect the fact that it is going to take time.
And we do want to further that.
And that, again, binary revolution.
We realize it's going to take time to make changes, and we're going to try to do that.
And we've been around for several years.
I think we've made breakthroughs.
You know, you never saw books on the shelves called Hacking This or How to Hack That
or Hack Proofing Your System.
You never had security officers.
You never had security acknowledgement like we do nowadays.
So I think we are making progress.
I think we are kind of taking back the name and all that kind of good stuff.
So I think we're moving in the right direction, but it's certainly still a long way to go.
And it is ever-changing, so it's not something that we're ever going to see a finish line or anything.
It's going to be an ongoing process.
So to kind of summarize here, and again, I'm not a lawyer.
Scott's not a lawyer.
We are just kind of brainstorming here to see if we can – exactly.
And see if we can just maybe educate people and let people think for themselves
and kind of maybe throw something out there that somebody will hear
and prompt them to some action to solve some of this.
But I still want to come back to say, you know, the best-case scenario is stufu.
Just keep your mouth shut.
Don't say anything to anybody.
It's really not going to be worth the risk.
That would be my number one advice if somebody asks me about something.
If you're going to go to that extra level, you can listen to the show and hear some of the things we talked about.
But I want to emphasize that it's really too dangerous in most cases.
You try to do the right thing, but – and here's another thing.
I think you briefly mentioned this earlier, but the other thing that you have to worry about is let's say you do cross that line
and contact them about it.
They never respond to you.
They never hear anything, so you drop it.
But six months down the road, an actual criminal, an attacker, goes out there, uses the technique that you talked about,
and breaks into their website.
They start investigating, and suddenly you're the prime suspect.
Right, because they're saying you – and we talk about this in the story a little bit.
We try to use analogies.
It's hard.
But if you know your neighbor's door is unlocked and you get up on your roof and you yell that to the neighborhood,
is that disclosing a vulnerability?
Is that actually increasing his chance of getting robbed, and are you somehow responsible for that?
And then, well, what if you get to the roof and say his door is unlocked and he's not home every Thursday at 2 p.m.?
And you don't just say his door is unlocked.
So at what point is it stating a fact versus irresponsible disclosure?
Yeah, response –
Nobody knows.
There's lots to consider.
Yeah, and that – I'm sorry.
I was going to say I'm glad you used that word.
Responsible disclosure is what we're talking about here.
We condone responsible disclosure.
Excuse me.
I condone responsible disclosure.
I'll rephrase that.
I condone no points of view at all.
Exactly.
So other than that, I mean, let's kind of wrap up the show here.
If you had anything else to put out there, the only other thing is I want to say –
and we say this on the show a lot, so I know it's repetitive, but don't go looking for trouble.
That's the other thing.
You know, if you're out there playing around – I know hackers like to tinker.
It's like we find a site that's like, oh, I've never seen a site that can do this before.
Let me figure out how it works.
Oh, look what I can do.
Oh, they screwed this up.
You know, that's all well and good that you're playing around, you're experimenting and all that kind of stuff.
But there's a certain line that you cross, and there's some conscience that comes in,
and I know everybody has different levels, but different lines in different places.
Just be really careful that if you do find something, you find a vulnerability, do not use it.
Don't go out there and apply it and do something bad with it.
Don't cross that line because you're leaving the hacker world and entering the criminal world.
You're leaving the hacker world and going into something totally different.
And please don't use the name of hacking for that.
You know, the one thing I say all the time, hacking is about construction, not destruction.
So always keep that in mind and know when you're crossing that line.
Just because it's insecure, it's not yours.
It's not your playground.
It's not your box.
Take it and install it on your box at home and hack your own system.
That's great.
But don't cross that line where you're infringing on other people's property, intellectual or otherwise.
So I guess we're going to kind of wrap up the show here, Scott.
Great.
We always end up with some shouts at the end of the show.
I'm going to go ahead and give shouts to everybody at CSO Magazine.
I do get this every month, and I like reading it.
I get every issue sent to my door, so I do like reading it.
And I'm looking forward to this feature article that you have in there this time,
so I'll be reading that probably after we're done with the show.
Give some shouts out to Mubix.
I've been talking to him with some stuff lately,
so hopefully he and I will be meeting up sometime soon.
And to FiberOptic, it's really good to see him back around and active in the scene lately,
so shouts to him as well.
And to you, Mr. B, anything you want to give shouts out, some coworkers, whatever?
I would love to give a couple.
One would be to your listeners, you know.
And if they want to contact me, please feel free.
I love getting emails from folks who are out there dealing with this stuff,
thinking about this stuff.
Basically, as a reporter, the more people I can talk to, the better.
So it's always good to hear what people are really thinking,
because sometimes we can get sort of locked into, you know,
sort of conventional wisdom and all of that.
And I just wanted to give shouts to those folks.
And feel free to email me.
I'll give StankDog my email, and he can throw it on the website if he wants.
And, you know, it's also on our website, CSOonline.com.
Also, shouts to the entire CSO team for, you know, obviously what I think is a stellar magazine.
We've got Derek, we've got Michael, we've got Sarah, we've got Kendra, we've got Steve, a couple others.
But shouts to those guys as well.
Yep, and I second that.
And if you do want to contact us, of course, anything about the show, radio at BinRev.com,
and I will be glad to forward anything on.
Frankly, you're not really a hacker worth a grain of salt if you can't really find the guy's email address.
Yeah, I know.
Let's be honest.
I mean, it's not to throw you under the bus or anything, but come on.
You're not really a reporter worth a grain of salt if you can't find it either.
Exactly, exactly.
So, and yeah, I'm going to be, I'm going to sell out and make our site of the week CSOonline.com
because the other thing I like is the articles are out there to read.
You know, you can go out there and read these articles that we're talking about.
And that's cool because that, again, is the whole hacker spirit, is the sharing of information, the free flow of information.
So there's nothing wrong.
I like buying the magazine and having it in my hands as well.
I just prefer that format.
But it's also nice if somebody wants to read just an individual article, they can go to the site and look it up.
So that's very cool as well.
And our closing music tonight is another song from Chronomicon.
It's called Enter the Dragon.
So I hope you enjoy that.
And Mr. B, Mr. Baranato, thank you for being on the show.
I do sincerely appreciate it.
And we might have to get back together and do another episode sometime in the future.
I've got tons of topics that we can talk about.
So look forward to possibly working with you.
It was a lot of fun.
Cool.
All right, well, we are going to wrap it up this week.
But, again, thanks to everyone who sent the email.
I'll catch up on some of the other ones I missed later on.
But until then, we will see everybody next week.
Same hack time.
Same hack channel.
See you next week.