[00:00.000 --> 00:01.740] I'll give it to you a billion and first time. [00:02.860 --> 00:06.000] At midnight, Steele will be in Tesla, not Love Long. [00:06.220 --> 00:06.980] Lovelace. [00:07.320 --> 00:07.400] Yay. [00:10.100 --> 00:11.200] It's late, all right? [00:12.220 --> 00:13.040] It's... Difficulties there. [00:13.280 --> 00:20.080] So, what I'm going to be talking about today is mapping the public telephone system. [00:20.260 --> 00:21.900] Basically, going through, finding devices. [00:22.240 --> 00:25.680] And a lot's changed since the ToneLoc days and whatnot. [00:25.840 --> 00:28.180] Nowadays, of course, we have VoIP and things of that nature. [00:30.200 --> 00:32.180] To get this started, my name is Beave. [00:32.540 --> 00:34.860] I founded a little group called Telephreak. [00:35.020 --> 00:36.740] We're a bunch of VoIP kind of hobbyist guys. [00:37.120 --> 00:37.560] Thank you. [00:39.340 --> 00:42.060] And done a couple of books on the subject. [00:42.580 --> 00:45.800] I also run a thing called the Open VMS Death Row Cluster. [00:46.000 --> 00:49.560] Because I like old operating systems and I find them fun. [00:51.100 --> 00:56.760] And actually, I just released a new piece of software called Sagan, which is more log analysis and correlation. [00:56.760 --> 00:58.160] It has nothing to do with this talk. [00:58.380 --> 00:59.740] But if you get a chance, check it out. [01:02.840 --> 01:09.620] And originally, my partner in crime on this type of work is a guy named Jay Falcon. [01:10.840 --> 01:15.100] And unfortunately, he couldn't make it, so I have not Jay Falcon up here today. [01:15.100 --> 01:20.940] And they kind of look similar, plus or minus, say, 100 pounds, I'd say. [01:21.640 --> 01:23.400] So, he's... yes, yes. [01:23.680 --> 01:26.800] So, but anyway, so he couldn't make it due to family issues and whatnot. [01:27.040 --> 01:29.620] And I understand that, so I'm kind of doing it solo. [01:33.140 --> 01:33.780] All right. [01:34.340 --> 01:35.880] Who can identify these devices? [01:37.300 --> 01:38.020] Very good. [01:38.720 --> 01:43.020] I had a feeling this audience might be able to identify it. [01:43.020 --> 01:45.160] Now, who knows what these are? [01:45.280 --> 01:47.060] All right. [01:47.300 --> 01:47.960] Old school modems. [01:48.160 --> 01:50.980] I'm kind of recapping from the talk that I did two years ago. [01:51.300 --> 01:58.680] So, a lot of people believe that with these devices, the two devices don't work together. [01:58.880 --> 02:04.760] Like, you can't do modem over VoIP or you have to do it and have really shitty connections and it just doesn't work all that well. [02:04.980 --> 02:05.720] Actually, you can. [02:05.920 --> 02:07.360] It's fairly easy to do. [02:07.860 --> 02:14.520] A couple of... just, as I said, a really quick kind of brief overview is you have to use uncompressed codec. [02:14.660 --> 02:18.800] You can't use anything like GSM or G729, so you want to use something like MULaw. [02:19.020 --> 02:26.460] The provider that you're using, you need to have good, decent latency between and preferably not dropping every other packet. [02:27.860 --> 02:31.300] This makes... you can actually achieve really high speed rates. [02:31.560 --> 02:35.720] You know, up to even, believe it or not, 33.6 and whatnot if you call that high speed. [02:37.160 --> 02:42.500] Oh, and some devices like the PAP2 that we were just talking about actually have a setup. [02:42.620 --> 02:48.780] They actually use it for faxes where you dial... on your modem you type ATDT to dial the phone number. [02:48.780 --> 02:58.960] But if you append a star 99 and then wait for another dial to them, it'll throw the PAP2 into a mode that enables it to work with things like fax machines and stuff like that. [02:59.180 --> 03:01.660] So, you can use that with the modem as well. [03:01.800 --> 03:06.560] It disables things like echo cancellation and stuff like that that kind of screw up the modem. [03:11.420 --> 03:13.880] So, I'm sorry, I'm having a look around the corner here. [03:15.940 --> 03:19.600] Okay, so the interesting thing that you can do with VoIP is... [03:19.600 --> 03:25.280] You know, back in the day, whenever I was a kid, I was war dialing a whole lot and finding nifty things. [03:25.540 --> 03:29.360] But you're kind of like... you're isolated to your local calling area. [03:29.500 --> 03:30.460] This is no longer the case. [03:30.600 --> 03:35.580] So, if you want to dial Iran 9,000 times, it's not an issue. [03:35.980 --> 03:45.540] The one tip is though, being a free American and wanting to remain that way, use a European provider for those kind of things. [03:45.760 --> 03:52.080] Because if, you know, the telephone company flags you for dialing Iran 9,000 times, you'd get questioned. [03:55.380 --> 03:58.880] You're not tied to a physical POTS line like you were back then. [03:59.100 --> 04:03.380] Back then, you know, you had to buy your phone number, you know, phone line and everything. [04:03.380 --> 04:07.780] And you were physically tied to that so people would, you know, back in the day, like... [04:08.180 --> 04:13.880] Especially when, you know, star 69 and stuff like that would call you back and be like, why the hell are you calling me? [04:14.020 --> 04:16.600] You're no longer tied to any of that, you know, kind of stuff. [04:16.660 --> 04:19.440] So you can do it a little bit more anonymously, sort of. [04:21.240 --> 04:29.360] And you can also do things like spoof your caller ID so that the remote target that you're calling doesn't actually know who the heck you are. [04:30.780 --> 04:31.880] And it's super cheap. [04:32.400 --> 04:34.380] And also keep in mind, if you're, say, dialing... [04:34.380 --> 04:37.180] Well, actually, the exception to this rule is Iran, actually, ironically. [04:37.420 --> 04:43.600] But when you dial 10,000 numbers, you're not paying for every single call that you're making. [04:43.780 --> 04:47.440] You're only paying for when the call supervises or when a call is answered. [04:47.720 --> 04:52.460] Unfortunately, in Iran, it supervises all the time, so you spend a lot of money. [04:54.500 --> 05:02.800] Oh, and another thing, too, is that since you can spoof the caller ID, you know, the person, your target doesn't know that it's, you know, particularly you. [05:03.300 --> 05:11.820] And in some cases, on certain providers, you can actually spoof the ANI, which I'm sure you guys have read about where kids have decided that it would be a great thing. [05:11.920 --> 05:21.700] It's called swatting to spoof the caller ID and the ANI of somebody and say, I'm in a hostage situation, and laugh when the police show up, ha-ha, with guns. [05:21.800 --> 05:22.380] That's not cool. [05:22.780 --> 05:23.860] Don't do that shit. [05:28.220 --> 05:32.160] So, you're not... you can now dial around the world, thousands of phone numbers. [05:32.340 --> 05:35.380] So, the common question that I always get is, what do you find? [05:35.480 --> 05:36.780] You find all kinds of stuff. [05:36.840 --> 05:40.840] I think last time we showed, like, building management stuff in England. [05:41.420 --> 05:47.020] We do, you know, we find routers, we find legacy gear, lots of legacy gear, things of that nature. [05:48.940 --> 05:58.280] And other things that you can do with it, too, is, you know, since you have it lying around, you can dial into maybe even old, like, Russian BBSs or something like that, just for fun to see what's going on. [05:58.600 --> 06:03.160] And you can, you know, dial into FidoNet or nodes or whatever. [06:07.340 --> 06:12.880] So, basically, this whole thing, it ends up that you can scan a big area and it's super, super cheap to do. [06:15.620 --> 06:18.980] Now, remember how we were just talking about the modems and everything, right? [06:19.420 --> 06:21.820] Well, nowadays, things have changed a little bit. [06:22.780 --> 06:23.980] Because we can forget those. [06:24.120 --> 06:28.060] Because now we can do a lot of the stuff that modems actually aren't technically very good at. [06:28.520 --> 06:31.700] Modems are really good at identifying carriers and stuff like that. [06:31.820 --> 06:38.360] But when you try to identify tones or anything, you kind of have to do this trickery with the physical modem itself. [06:38.360 --> 06:47.120] Well, now with VoIP, I can take the audio from the call and analyze it and look for different things. [06:47.480 --> 06:54.200] So, like, for instance, back in the old days, whenever you were war dialing, you might want to look for just carriers, but then you might want to go back and look for fax machines. [06:54.380 --> 06:57.560] Well, then you would have to flip the modem into a different mode to go back through. [06:57.660 --> 07:00.680] So, now you're having to dial twice the same set. [07:00.840 --> 07:02.480] Well, you don't have to do that with software. [07:02.640 --> 07:05.600] You can just have it go through and, you know, automatically analyze it. [07:05.600 --> 07:09.080] So, but the other thing, too, is you don't want to completely throw away the modem. [07:09.200 --> 07:20.260] Because while you can do all the scanning and everything is done in software, you still need the modem right now, as it stands, to, you know, plug in and see if that carrier is really active or whatnot. [07:26.670 --> 07:28.910] So, anyways, I can't really read that slide. [07:29.050 --> 07:31.450] But anyway, so, the... [07:31.890 --> 07:33.550] So, all this stuff can be done in software. [07:37.400 --> 07:40.360] Oh, and another thing that we're trying to do is actually get rid of the modem altogether. [07:40.360 --> 07:46.480] There are projects like Span DSP, which implement modem technology actually in software. [07:46.680 --> 07:49.080] So, you're actually doing it, you know, from the CPU standpoint. [07:49.380 --> 07:53.660] And then if we ever get all that stuff working, then you won't even need that physical piece of hardware. [07:55.800 --> 07:57.480] Now, it should be pointed out. [07:57.620 --> 08:00.080] I mean, I joke about, you know, dialing Iran. [08:00.500 --> 08:03.100] And I personally would never, ever do such a thing. [08:03.100 --> 08:07.080] And these tools are always used for legal purposes and yada. [08:07.680 --> 08:09.280] But, you know. [08:11.620 --> 08:17.240] So, right now, there's two typical tools that are being used in this kind of stuff. [08:17.300 --> 08:20.720] And one of them is developed by HD Moore from the Metasploit project. [08:21.300 --> 08:23.340] And that's pretty much all you have to say about that. [08:23.480 --> 08:24.520] I mean, the guy's an animal. [08:24.680 --> 08:25.260] He's awesome. [08:25.260 --> 08:29.740] And his has a pretty nice kind of a GUI front end to it. [08:30.260 --> 08:32.260] And then the other tool, of course, is my tool. [08:32.960 --> 08:37.860] It's just called iWar, which they basically do a lot of the same things, just a little bit of a different way. [08:37.980 --> 08:39.980] His is, you know, more GUI based. [08:40.440 --> 08:44.260] Mine does maybe a few other things that maybe his doesn't do quite yet. [08:44.600 --> 08:45.520] And vice versa. [08:45.740 --> 08:47.460] But they're both awesome and they both work well. [08:50.790 --> 08:55.490] And you'll notice in that last slide, it was talking about how it was multi-threaded. [08:55.490 --> 08:58.870] This means that you can, say, dial these 50 phone numbers. [08:59.110 --> 09:01.930] You know, start 50 threads to dial 50 phone numbers at a time. [09:02.070 --> 09:04.310] So you can really blaze through an exchange. [09:04.890 --> 09:09.790] So these are just your basic setup shots of how Warbox works. [09:09.930 --> 09:11.610] As you can see, it's very straightforward, very simple. [09:11.930 --> 09:13.650] You enter in your range and whatnot. [09:13.930 --> 09:29.070] And what he also added in was like where you could make nice little presentations and get reporting and whatnot about, you know, bar graphs and, you know, the signal analysis and whatnot of the actual phone calls that took place. [09:31.110 --> 09:32.690] Which is kind of cool, you know. [09:33.570 --> 09:36.550] I personally am not that interested in looking at the pictures. [09:36.630 --> 09:37.970] I just want to know if there's a modem there. [09:39.510 --> 09:42.070] But it is pretty cool and it makes very nice reports. [09:42.070 --> 09:49.590] So if you're doing like a security audit or something like that, you can use this kind of output for the managers who will be like, wow, pretty pictures. [09:54.640 --> 09:58.340] So since we're doing this all in software, you can detect multiple things. [09:58.520 --> 10:00.020] I mean, you can detect dial tones. [10:00.360 --> 10:03.780] This is the area where the modems really had kind of a problem. [10:03.940 --> 10:07.220] It was like you could do a little trickery to get modems to do certain things. [10:07.320 --> 10:10.060] But now you can do it really, really accurately all in software. [10:11.740 --> 10:13.400] And it's all multi-threaded. [10:13.540 --> 10:22.180] So if your VoIP provider allows you to do 10 channels at a time, you can suck up all 10 channels and make 10 calls at a time. [10:22.860 --> 10:41.060] And what this means is as HD was testing, that if you have a block of 10,000 phone numbers that you want to scan for interesting equipment, being telco gear or your modems and whatever else that you might find interesting, with I think it was 50 channels, [10:41.200 --> 10:43.780] you can scan out 10,000 numbers in about a three-hour period. [10:44.380 --> 10:47.400] Where that, you know, back in the day would have taken weeks. [10:50.220 --> 10:56.100] And down at the bottom, we're using fast Fourier transforms for the signal analysis. [10:56.420 --> 11:01.160] So when we get the audio in, we actually, you know, that's a particular library that we're using. [11:01.160 --> 11:02.440] It's called KISS FFT. [11:09.160 --> 11:11.400] Okay, so here's iWAR working. [11:11.560 --> 11:18.100] Now, this particular video, you'll notice, and I'll talk about this a little bit more, up at the top left-hand corner where you see CNAME LOOKUP. [11:20.240 --> 11:21.900] I'll get into a little bit later. [11:22.180 --> 11:24.240] A lot of you probably already know what that is. [11:25.240 --> 11:29.360] And this is 30 threads with a one-second delay between dialing. [11:29.360 --> 11:37.600] So, you know, it's, it'll take a little while because obviously it's setting up 30 phone calls and you've got to wait for those calls for something to happen. [11:39.100 --> 11:42.840] And then we color code all the calls based on what we found. [11:43.020 --> 11:50.100] So, green being, you know, a modem carrier and blue with a black background as a tone and whatnot. [11:51.460 --> 11:52.840] So, it doesn't work that bad. [11:53.000 --> 11:53.660] That's okay. [11:54.180 --> 11:57.040] But, the CNAME lookups kind of slow things down a little bit. [11:59.860 --> 12:04.020] So, now we're going to do a different type of scan, but we're going to do it a little bit faster. [12:04.140 --> 12:08.900] We're going to use 50 threads, no time delay, and we're not going to do any CNAME lookups. [12:09.140 --> 12:13.260] Which, as I said, for people who don't know what I'm talking about, the CNAME stuff, I'll get into in a minute. [12:14.860 --> 12:18.860] So, as you see, it kind of starts out, you know, it's, it's, it's moving along. [12:20.780 --> 12:22.820] But, again, so you're waiting on the remote side. [12:22.940 --> 12:23.500] That's what we're doing. [12:29.620 --> 12:31.120] So, we got some tones here. [12:33.220 --> 12:37.660] And, in this case, actually, this is running against an asterisk server that I have set up. [12:37.860 --> 12:42.060] So, it's actually, the asterisk server is playing back different types of tones and whatnot. [12:42.240 --> 12:46.620] So, don't go home thinking that there's a modem at a particular phone number up here, because there's not... [12:50.310 --> 12:52.230] Oh, okay, yes, that's an excellent idea. [12:53.830 --> 12:54.490] Thank you. [12:55.130 --> 12:55.570] Thanks. [12:56.630 --> 12:59.490] So, now, if we get on the second screen here... [13:03.390 --> 13:07.970] And you can also see down at the bottom where it's doing the analysis and dumping out the output. [13:14.570 --> 13:17.370] So, now we can roll through and exchange pretty quickly. [13:18.050 --> 13:18.910] That's the idea. [13:21.730 --> 13:26.030] Now, as I said, we do some other tricks as well with the CNAME lookup and stuff like that. [13:26.030 --> 13:32.670] So, if we find a modem, we might have a CNAME record so that we can say, oh, that's owned by XYZ Law Firm or whatever. [13:33.710 --> 13:36.350] You can still use, with the iWAR, the traditional hardware. [13:36.350 --> 13:39.530] If you want to use a modem and do it the old school way, that's fine. [13:39.530 --> 13:47.010] Or, if you have a modem that's connected to a network, like you telnet to a certain port to get to a modem, you can still use that type of stuff. [13:48.210 --> 13:55.910] And you can also take the data that you got from iWAR and export it and put it into the WAR box so you can create those nice reports and whatnot. [13:56.230 --> 13:58.830] So, managers are happy. [13:59.610 --> 14:02.910] So, basically the way that iWAR works, we start up... [14:02.910 --> 14:05.250] The main engine starts up, that's where the console is. [14:05.250 --> 14:12.750] And then he starts a thread from a thing called Mother Forker, which is kind of a homage to my dad's days at Burroughs Corporation. [14:12.950 --> 14:14.530] They had a Mother Forker process. [14:15.110 --> 14:22.250] And then all the children become forking children and they all run out and do their bidding and then report back to the mother, like, what's going on. [14:22.750 --> 14:27.250] And then, whenever they find something, they report it back and all the communications is done through FIFO. [14:28.210 --> 14:33.230] So, there's communications between the thread and the main engine, so they can kind of communicate with each other. [14:34.150 --> 14:34.510] And... [14:36.110 --> 14:38.430] Yeah, and so, we start up each dialer. [14:38.470 --> 14:40.330] I don't really care what kind of dialer it is. [14:40.350 --> 14:41.710] In this case, we're using VoIP. [14:41.910 --> 14:47.370] But in the future, whenever, you know, we have all the serial stuff worked out, it's all going to work the same way. [14:47.450 --> 14:50.230] So, it's like multi... yeah, multi-process kind of environment. [14:52.270 --> 14:56.090] So, and the way that we do tone detection is a little bit different than WAR box. [14:56.090 --> 15:06.750] I mean, he actually does... HD did set up, like, kind of a configuration file where you can go in and put in your characteristics of equipment that you might be looking for. [15:07.670 --> 15:10.030] And I believe all of his stuff is in a Ruby. [15:10.490 --> 15:13.290] And on this, we just made, like, a simple text file. [15:13.370 --> 15:14.710] It's a configuration file. [15:14.910 --> 15:23.850] So, as you can see, the first part, the delimiters being the pipe symbol, is just a human readable what is it. [15:25.030 --> 15:31.810] The second part is what to tell the main engine, like, how I found it, what I found. [15:32.110 --> 15:41.110] And then, the other part is how many samples to... how many samples to grab before you consider it, what, you know, what it says that it might be. [15:41.110 --> 15:47.930] So, for instance, you know, we found a lot of places where you get a lot of false positives, because it would come back and say, oh, I found a modem here. [15:48.110 --> 15:51.690] But then you would go back and call it, and then a lady with a really high-pitched voice would answer. [15:51.870 --> 15:53.350] And you'd just say, oh, well, damn. [15:53.990 --> 15:59.730] So, you want to grab, like, multiple samples, then you have the other part with the .1, that's your tolerance for level. [15:59.950 --> 16:03.150] Because we are dealing with analog kind of stuff. [16:03.310 --> 16:10.750] So, even though it might... supposed to be 2,250 hertz, it might be at, you know, 2,249.8. [16:10.890 --> 16:12.390] So, you got to take that in consideration. [16:12.630 --> 16:16.230] And then the last part are the frequencies that you're looking for within that sample. [16:21.540 --> 16:23.920] So, anyway, so it's still kind of like a work in progress. [16:23.920 --> 16:26.000] It's something that I work on, on the side. [16:26.180 --> 16:27.580] I don't get really paid to do it. [16:28.100 --> 16:32.520] So, but I've pretty much taken the old iWar code and just zapped it. [16:32.660 --> 16:37.220] And then started over, because whenever I originally started writing it, things were much simpler. [16:37.660 --> 16:41.180] And it was kind of like just dial one full number at a time. [16:41.600 --> 16:47.180] And I even added in VoIP into it, but it doesn't really make much sense if you can only dial one full number at a time. [16:47.180 --> 16:48.760] It's kind of... makes it kind of useless. [16:49.340 --> 16:52.720] So, and then also the code's a lot easier to maintain. [16:52.900 --> 16:59.240] Believe it or not, I mean, you would think that using like p-threads and doing it multi-threaded, that it'd actually become more complex. [16:59.380 --> 17:02.280] In actuality, it ends up being a lot easier. [17:05.020 --> 17:10.500] Now, one thing that this talk is kind of about is about how to do this. [17:10.680 --> 17:12.140] I mean, it's one thing to pick out a block. [17:12.320 --> 17:13.640] Let's say you're doing an audit. [17:13.780 --> 17:14.680] We'll call it that. [17:15.980 --> 17:18.620] And you have a particular target that you're looking at. [17:19.300 --> 17:25.200] Before you just like start throwing phone numbers at it and hoping to find something, you need to kind of do a little bit of recon. [17:25.500 --> 17:28.840] And you can do a lot of this before you even get started. [17:29.220 --> 17:32.720] So, and you want to fly as under the radar as possible. [17:32.860 --> 17:37.560] You don't really want your ISP to figure out that you're doing this, because they'll shut you off. [17:37.620 --> 17:41.400] And then you'll be looking for yet another, not ISP, but VoIP provider. [17:42.480 --> 17:47.160] So, we use things like where we randomly, you know, random dial numbers. [17:47.380 --> 17:48.100] We don't do it sequential. [17:48.800 --> 17:50.020] And random times in between. [17:50.180 --> 17:52.940] So, it doesn't look as obvious, you know, from the get-go. [17:53.200 --> 18:00.540] And then we do use little tricks like, again, whenever I do this, I'm really actually not trying to harass thousands of people. [18:01.340 --> 18:04.700] So, what I'll do is I'll spoof the caller ID as a fax machine. [18:04.900 --> 18:07.440] So, whenever they get it on their caller ID, they call it back. [18:07.440 --> 18:10.880] And then they'll say, oh, somebody just mis-dialed a fax number. [18:11.080 --> 18:12.240] And this kind of like, let it slide. [18:12.480 --> 18:25.540] And then one patch that I actually even had in there, but never really released for reasons I'll go into, was that whenever it would call, and then when the call would supervise, they'd see something answer on the other side, it would play an audio recording. [18:25.920 --> 18:31.940] Which, basically, the audio recording would wait for, like, just a second, and then say, oh, I'm sorry, I've dialed the wrong phone number. [18:32.020 --> 18:32.560] I apologize. [18:32.960 --> 18:33.780] And then hang up. [18:34.000 --> 18:41.540] And then that way, you know, people pick up and they're like, you know, they hear that, and then, you know, you're trying to be as under the radar as you possibly can. [18:41.940 --> 18:50.400] And the reason that I never released that patch is because I was talking to a friend of mine, and he said, yeah, man, telemarketers are going to love this shit. [18:50.400 --> 18:53.160] And then I was like, God, I f*cking hate these people. [18:53.660 --> 18:54.380] Why do I... [18:54.380 --> 18:56.780] And then I had another friend, I was like, well, that's not really your problem. [18:56.820 --> 18:59.740] I mean, if it gets used for bad things, I mean, so what? [19:00.820 --> 19:01.660] So, I don't know. [19:01.780 --> 19:06.740] I may release that portion, and it wouldn't be very hard to add in if somebody else ended up wanting to do it. [19:07.720 --> 19:10.420] So, again, so, know your target. [19:10.720 --> 19:25.480] So, I've used in some audits where we've found the phone number and then used Google Street View to find out businesses that are in the area to see if they're in the same prefix and, you know, so I can kind of get a layout of the way the numbering systems work. [19:26.720 --> 19:28.560] Or, I mean, there's tons of resources. [19:29.660 --> 19:34.500] Bellsmind.net being one of them, where you can go to and get lots of information about your target. [19:34.620 --> 19:37.740] So, you can just plug in the phone number, and then you see down at the bottom, also serves. [19:37.980 --> 19:41.520] And so, you can start collecting this data before you start dialing. [19:41.620 --> 19:47.920] You know that there's other prefixes that this company might have a phone number in that might be useful to you. [19:48.040 --> 19:59.140] Like, while you didn't find a modem, like, or whatever you're looking for, within, say, an up-down of 200 numbers, well, you might want to look in these other prefixes as well, because there could be something there. [20:04.880 --> 20:06.260] And I think I just said all that. [20:08.120 --> 20:11.940] So, now, this kind of goes back on the CNAME thing. [20:11.940 --> 20:18.780] So, we can kind of actually start scanning and looking for information without dialing a phone number with the CNAME stuff. [20:18.920 --> 20:21.140] Does anybody have a decent idea of how to do this? [20:22.120 --> 20:22.480] Shoot. [20:27.270 --> 20:27.630] Exactly. [20:27.930 --> 20:33.070] There's services and whatnot, and you can actually use the telco system as well. [20:33.350 --> 20:34.070] But, yeah, you're right. [20:34.170 --> 20:34.730] There's a ton of them. [20:35.690 --> 20:40.290] So, you can kind of scan out and see who owns the phone number before you even pick up, which can be useful. [20:40.490 --> 20:44.650] Like, for instance, I had a target that I was looking at, and I could scan through it. [20:44.730 --> 20:47.090] Then I could see, oh, these law firms start happening here. [20:47.170 --> 20:48.830] Well, I don't really need to dial those guys. [20:49.030 --> 20:50.750] And I know about where the block is. [20:50.930 --> 20:51.350] You know what I mean? [20:54.810 --> 20:56.090] So, we'll do... [20:56.090 --> 20:57.910] Actually, this is known as back-spoofing. [20:57.930 --> 20:59.110] That's like what you were talking about. [21:00.650 --> 21:02.710] Where you can use CNAME databases. [21:02.750 --> 21:04.930] This is one that Jay Falcon likes to do. [21:05.230 --> 21:05.630] It's actually... [21:05.630 --> 21:09.850] He likes to use the actual phone network's data, because he finds... [21:09.850 --> 21:12.190] Usually, with CNAME data, it can kind of come and go. [21:12.190 --> 21:16.990] So CNAME, for those of you that don't know, is whenever you dial a phone number... [21:16.990 --> 21:18.990] Oh, it's Mr. Rodent and Sid. [21:21.030 --> 21:27.870] Whenever you dial a phone number, on your caller ID display, of course, comes up the phone number of the person who's calling you. [21:28.010 --> 21:31.530] But then it also comes up with the name and information of the person who's calling you. [21:31.610 --> 21:33.390] XYZ Law Firm or whatever. [21:33.790 --> 21:34.210] Judy. [21:34.550 --> 21:35.030] Whatever. [21:35.030 --> 21:35.910] Whoever it might be. [21:36.710 --> 21:43.110] The idea here is that you make a call out, but you spoof the caller ID of your target. [21:43.370 --> 21:48.530] And then you call yourself on a phone number that will recognize the caller ID information. [21:48.870 --> 21:56.990] So basically, a call goes out and gets spoofed, but whenever it comes back in, it does a CNAME lookup at the telco level and passes you the information of who holds that phone number. [21:57.110 --> 21:57.970] And it's called backspoofing. [21:58.510 --> 22:08.150] And Jay Falcon has a habit of doing this, of like spoofing thousands of numbers and calling himself to find out what the CNAME information is. [22:10.410 --> 22:17.270] So basically, what you need is a provider that you can dial out on through VoIP that will let you spoof the phone number. [22:17.390 --> 22:23.110] And then you have asterisk on the other side or something of the likes get the call. [22:23.250 --> 22:28.130] But the interesting thing is whenever it gets the call in, you never actually answer the call. [22:28.250 --> 22:29.710] You just want that caller ID data. [22:29.870 --> 22:32.790] So then you play back either a congestion or just hang up on it. [22:32.930 --> 22:36.910] So really, the cost of you doing this is exactly zero dollars. [22:37.350 --> 22:44.390] Now, the problem is that a lot of carriers don't like you doing this because they have to pay what they call a dip fee when they're a VoIP provider. [22:44.390 --> 22:47.790] So they pay like a couple of cents every time if they do that. [22:47.910 --> 22:51.470] And if you're doing this across thousands of numbers, they get pissed. [22:51.730 --> 22:54.770] And then you don't dial through them anymore. [22:57.550 --> 23:05.030] So then Jay Falcon sits down and he says, I'm just going to back spoof Malibu because I'll bet you interesting people live there. [23:05.530 --> 23:07.970] So he calls me one day. [23:08.110 --> 23:09.630] He says, do you want to call Mel Brooks today? [23:09.830 --> 23:10.550] Because I have his... [23:10.550 --> 23:12.770] And he's got a list of... [23:12.770 --> 23:14.590] And he just does this shit. [23:15.270 --> 23:27.530] And so as you can see, you know, if you want to call Bob Newhart, you know, of course, I've kind of roughed it out because I didn't want Luke Skywalker to get lots of calls because of this talk. [23:28.570 --> 23:29.610] But you can also... [23:29.610 --> 23:30.330] So this is like... [23:30.330 --> 23:35.150] He's doing the back spoofing, getting the information directly from the telco in this case. [23:35.250 --> 23:38.490] You can tell he's a child of the 80s by those that are like... [23:38.490 --> 23:40.030] Oh, yes, yes. [23:40.810 --> 23:43.010] Yes, he was saying he's a child of the 80s. [23:43.130 --> 23:43.290] Yeah. [23:44.650 --> 23:48.430] Yeah, there's all kinds of fun stuff that he... [23:48.430 --> 23:50.850] It certainly makes for fun phone calls on Telephreak. [23:51.130 --> 23:51.430] Yes. [23:51.470 --> 23:56.830] Actually, he's been good about that, about like saying, hey, let's call Luke Skywalker. [23:56.830 --> 23:57.630] I'm wasted. [23:57.970 --> 23:59.750] You know, he doesn't do stuff like that. [23:59.890 --> 24:01.390] So actually, he's pretty good about it. [24:02.350 --> 24:07.850] So, you know, and he backs with the entire Malibu area and it took him like forever to do. [24:07.850 --> 24:16.310] And now he has it like in an SQL database and he can just go in there where the person's name is like this and then like look him up and if he doesn't like him, I guess call him. [24:16.430 --> 24:16.670] I don't know. [24:18.830 --> 24:19.270] But... [24:19.270 --> 24:19.770] And... [24:20.470 --> 24:28.370] Doing this method of spoofing the call out and have it calling a DID and then looking up a CNAME is usually you get the best results from. [24:28.810 --> 24:33.110] But as was pointed out earlier, there are other companies that actually sell the service. [24:33.290 --> 24:39.690] And the reason is, there's a lot of VoIP providers that will pass the caller ID information, but not the CNAME, not the name of the owner. [24:40.090 --> 24:47.370] So these little companies have started up and they will actually allow you to query their database and look up phone numbers. [24:47.530 --> 24:49.910] And they're called CNAME lookup databases. [24:50.210 --> 24:51.710] And one of them is bulk CNAME. [24:51.930 --> 24:53.470] So you pay them like... [24:53.470 --> 24:55.750] And the idea is that, you know, if you're legally... [24:56.650 --> 24:57.310] I mean... [24:57.310 --> 25:04.690] If you're using it the way it's properly supposed to be used is that, you know, then you can have on your caller ID display that Bob Smith called you and whatever. [25:05.590 --> 25:06.030] Now... [25:06.910 --> 25:07.350] So... [25:07.350 --> 25:09.130] But it's a little bit more expensive. [25:09.410 --> 25:11.610] So you got to pay $10 to get onto a service. [25:11.750 --> 25:14.030] And that's about a thousand lookups. [25:14.210 --> 25:15.830] But you can look them up really fast. [25:16.070 --> 25:16.570] Of course. [25:16.670 --> 25:17.090] Because it's all... [25:17.090 --> 25:22.750] And you can write a Perl routine in five lines of code to do a CNAME lookup of Malibu. [25:22.850 --> 25:27.470] And actually, what he was doing was doing it telco and then doing it through CNAME. [25:27.470 --> 25:32.490] He was, like, cross-referencing different databases and then probably calling them to make sure it's really... [25:33.870 --> 25:34.310] But... [25:34.310 --> 25:37.830] But the CNAME databases, they work pretty good depending on the ones that you pick out. [25:38.110 --> 25:45.510] Some of them are kind of, like, fake CNAME databases in that the data that they have isn't, like, related to, like, what the telco has. [25:45.690 --> 25:48.590] They're just, like, pulling various data off the Internet. [25:48.830 --> 25:50.550] And those typically aren't as good. [25:50.790 --> 25:52.930] But, like, bulk CNAME seems to work pretty well. [25:53.090 --> 25:54.150] Your results may vary. [25:56.830 --> 26:00.730] So, this is, like, using, you know, one of the CNAME lookups. [26:00.890 --> 26:05.110] So, we got it through one method and now we'll just, like, go there and query it directly. [26:05.430 --> 26:06.830] And as you can see, it just comes back. [26:06.950 --> 26:07.730] Mark Hamill, thank you. [26:16.040 --> 26:17.940] Yeah, so, the results are usually pretty good. [26:18.620 --> 26:20.480] The CNAME lookup, you'll notice in the video. [26:20.700 --> 26:24.260] So, now you kind of understand what's going on in the video where it was doing the... [26:24.260 --> 26:26.380] I told you to remember the CNAME lookup in the corner. [26:26.380 --> 26:31.820] Before Irowar even dials the phone number, he does a CNAME lookup through, like, one of these databases. [26:31.860 --> 26:34.660] So, he goes out and says, who owns this phone number? [26:34.880 --> 26:37.960] And then the CNAME database comes back and says, it's Mark Hamill. [26:38.120 --> 26:43.080] Then we can put that into our logs and have more data about, like, who owns that or whatnot. [26:43.220 --> 26:52.740] Or if I find a modem carrier and it's not the guy or the company that I'm interested in, then I can either skip it or, like, you know, look at it later. [26:55.620 --> 26:58.080] But, yeah, it's really easy to do, actually. [26:59.940 --> 27:11.980] So, this gives you all kinds of information on the ranges and what numbers to call and where the fruit might lie for the, you know, the information that you're looking for, basically. [27:13.180 --> 27:19.740] I find, yeah, and sometimes it can produce, make it so that you have to dial less numbers to get the information that you want. [27:19.740 --> 27:23.600] Sometimes it is being more as you're doing that recon and trying to figure out stuff. [27:24.580 --> 27:28.640] And I usually, as I said, I try to do this, like, real consciously. [27:28.640 --> 27:32.740] So, if I know I'm going after a business and they're in a business area, I pick out the times. [27:32.780 --> 27:34.840] Like, I'll say, okay, well, they close at six. [27:35.220 --> 27:37.860] So, I'll start my scanning, you know, at seven. [27:38.100 --> 27:39.300] Because I don't want them... [27:39.300 --> 27:43.200] For one, I don't want them to notice that all their phones are ringing at any particular point. [27:43.700 --> 27:45.080] And go, well, that's strange. [27:45.080 --> 27:46.500] Maybe we should call the phone company. [27:46.540 --> 27:47.160] I don't want that. [27:47.340 --> 27:48.980] So, if they're not there, it's even better. [27:48.980 --> 27:51.600] And if it's, like, residential, I'll try not to do it at, like, 3 a.m. [27:51.600 --> 27:53.880] because then you're pissing off lots of people. [28:00.360 --> 28:02.020] Okay, so, but there's some... [28:02.020 --> 28:04.400] The way that we're doing it, it works fairly well. [28:04.520 --> 28:06.520] But there's some legal problems with it. [28:07.560 --> 28:14.580] I'm sure a lot of you guys are familiar with one-party and two-party recording and laws that regard around that. [28:14.760 --> 28:23.020] And so, like, both what me and HD are doing, and we've kind of seen this as a problem, is that when you make the call, you're making an audio recording, then you're analyzing the audio recording. [28:23.760 --> 28:27.780] Which means, basically, you can only use iWAR in certain states. [28:28.300 --> 28:28.460] You know? [28:31.280 --> 28:34.160] And we've been trying to think of ways to get around that. [28:34.300 --> 28:40.160] There's one way, I mean, that would be obvious, is to do it all in real time. [28:40.480 --> 28:43.860] But actually, that's a little bit more tricky from a code standpoint. [28:44.200 --> 28:44.700] And FFTs. [28:46.000 --> 28:49.400] And FFTs in real time are a lot more trouble to deal with. [28:50.360 --> 29:01.840] Another thing that I thought of, and I mean, maybe you guys would have a good idea on this, is that instead of writing it out to the drive, I just store it in a memory location, and then, you know, have the FFT analyze it that way. [29:02.320 --> 29:04.240] Probably still be considered recording, though. [29:04.540 --> 29:05.040] You know what I mean? [29:05.560 --> 29:11.980] So, basically, the only way that you have around it is probably by doing it in real time, which is kind of a pain in the ass. [29:13.100 --> 29:14.680] You know, and then there's also... [29:14.680 --> 29:15.240] Oh, I'm sorry, go ahead. [29:33.900 --> 29:34.260] Right. [29:34.480 --> 29:34.840] Right. [29:43.320 --> 29:45.240] Yeah, see, that's the problem. [29:45.700 --> 29:46.740] See, that way... [29:46.740 --> 29:51.220] So, basically, what he was saying is that even storing it in RAM is still considered a copy of it. [29:51.380 --> 29:53.360] And probably, therefore... [29:53.360 --> 29:54.460] You're killing Sid. [29:54.620 --> 29:55.080] What are you doing? [29:57.200 --> 29:58.640] So, probably, therefore... [29:58.640 --> 30:00.460] Probably still considered illegal. [30:00.460 --> 30:02.790] You'd probably still be considered, you know... [30:02.790 --> 30:06.740] But then there's some places, like, you know, you could add in a tone every five seconds or whatever. [30:07.680 --> 30:08.160] And... [30:08.160 --> 30:10.440] Or just don't tell anybody you're doing this shit in the first place. [30:12.700 --> 30:13.180] And... [30:13.180 --> 30:14.280] I have a question for you. [30:14.360 --> 30:14.560] Shoot. [30:17.460 --> 30:17.940] Okay. [30:19.100 --> 30:19.580] Okay. [30:21.520 --> 30:32.220] If your call has been originated through or from a one-party state, or the server who lives a one-party state, like, my first state... [30:32.220 --> 30:34.280] No, yeah, actually, that's... [30:35.280 --> 30:36.200] Isn't that... [30:36.200 --> 30:51.140] I think it's going to be your local jurisdiction, even if you're taking iWar and it's running in a server in Nevada, by me executing it from, say, Florida, I think it's going to be the Florida laws, which is a two-party state, even though Nevada... [30:51.140 --> 30:53.100] Actually, Nevada's now a two-party state, too, isn't it? [30:53.220 --> 30:53.500] Nevada? [30:53.840 --> 30:54.520] Nevada's one-party. [30:54.520 --> 30:54.960] Yeah, they did... [30:54.960 --> 30:56.440] We found that out at DEFCON, remember? [30:56.680 --> 30:57.040] Oh, man. [30:58.460 --> 30:59.180] Another story. [30:59.460 --> 31:00.600] How could I forget DEFCON? [31:01.380 --> 31:01.760] What's that? [31:02.000 --> 31:03.000] How could I forget DEFCON? [31:03.220 --> 31:03.520] Yeah, I know. [31:07.400 --> 31:07.760] Yeah. [31:07.900 --> 31:13.880] If you go to something like bulk's name, that website, or some of those other websites, you're just like a very, versus if you use the backscrew. [31:14.380 --> 31:14.740] Yes. [31:14.940 --> 31:19.480] So I noticed a lot of those websites, whatever from, like, targets. [31:19.860 --> 31:20.240] Right, right. [31:20.620 --> 31:23.500] Or they'll get it from somewhere, and they won't update it all the time. [31:23.920 --> 31:25.980] Or versus if you do the backscrew thing, [31:29.910 --> 31:30.750] I think, let's say... [31:30.750 --> 31:31.370] With the... [31:31.370 --> 31:31.890] Yeah, yeah. [31:33.470 --> 31:35.070] So they're getting... [31:35.490 --> 31:35.890] Exactly. [31:36.230 --> 31:37.150] That's the reason I was saying... [31:37.150 --> 31:38.310] He was saying basically that... [31:38.310 --> 31:41.750] I mean, basically your point was that the best data is actually coming from the telco side. [31:41.890 --> 31:43.090] And that was actually kind of my point. [31:43.210 --> 31:49.650] I mean, these CNAME services are really nice in that you can do it really fast, where if you're doing the backscrew thing, the old-fashioned way, it's kind of slow. [31:49.950 --> 31:52.050] But that's where your best data is. [31:52.210 --> 31:52.530] You know? [31:52.870 --> 31:58.650] If a number has been changed in a couple of weeks, the CNAME database that you're hitting isn't going to know about it. [31:58.650 --> 31:59.290] You know? [31:59.550 --> 32:02.370] But the telco has already updated it and whatnot and got it. [32:02.390 --> 32:06.450] So what's cool is, you can go get some point providers, maybe one says, we use Verizon's call ID database. [32:07.390 --> 32:07.790] Right. [32:08.930 --> 32:09.410] Right, right. [32:09.510 --> 32:11.190] Then you compare those results. [32:11.750 --> 32:12.150] Exactly. [32:12.950 --> 32:16.560] And you get a branded phone number. [32:16.760 --> 32:19.240] I mean, within 48 hours, it will be updated in one of those... [32:19.240 --> 32:19.660] Yeah, yeah. [32:20.060 --> 32:25.700] I've not seen it happen quite that fast, but I've seen it happen pretty fast, where the caller ID information gets updated pretty quickly. [32:27.620 --> 32:28.020] Yeah. [32:28.020 --> 32:28.760] So... [32:28.760 --> 32:29.840] Did I skip this one? [32:31.580 --> 32:32.920] So those are some... [32:32.920 --> 32:35.800] Yeah, so the legality things, and if anybody... [32:35.800 --> 32:37.540] I mean, the RAM idea was just one idea. [32:37.660 --> 32:39.520] If anybody else has any other ideas... [32:39.520 --> 32:43.460] Most states do, you record a few beep tones every 10 seconds. [32:43.800 --> 32:46.540] So, use the beep tone every 10 seconds. [32:47.040 --> 32:47.780] Right, right. [32:47.860 --> 32:51.320] Actually, I thought it was five seconds, but 10 seconds might be the way it is in some places. [32:51.320 --> 32:52.520] It doesn't really matter. [32:53.620 --> 32:55.640] Yeah, so that's also another part about it, too. [32:55.640 --> 32:58.700] So if you throw in the beep tone, will that cover you legally? [32:59.220 --> 32:59.900] I don't know. [33:00.400 --> 33:00.600] It might... [33:00.600 --> 33:01.060] It's not in your state. [33:01.200 --> 33:02.640] I know that's the way it was in California. [33:02.940 --> 33:03.140] Right. [33:03.240 --> 33:06.300] I'm pretty sure that's the way it's in your own state. [33:06.500 --> 33:07.020] Right, right. [33:07.360 --> 33:07.740] Oh, go ahead. [33:14.030 --> 33:15.910] Yeah, actually, I kind of remember that patch. [33:15.910 --> 33:20.810] He was saying, why not just have it say, right when they pick up, this call may be recorded for quality assurance. [33:21.150 --> 33:22.070] Yeah, what I've read, it's... [33:22.070 --> 33:24.410] And it would be just for quality assurance. [33:25.070 --> 33:26.790] Would that actually be a violation? [33:32.490 --> 33:33.790] Oh, on the do not call listing? [33:34.050 --> 33:37.050] Well, actually, it's a violation all the way around just doing the shit. [33:37.410 --> 33:39.470] So, I mean, it's not... [33:40.030 --> 33:45.630] I mean, I'm not trying to, like, push, like, my product on anybody. [33:45.810 --> 33:47.130] I mean, like, over the phone. [33:47.350 --> 33:50.410] I mean, I'm just calling and saying, what answered, you know? [34:02.480 --> 34:03.920] Are you talking about seeing stuff? [34:16.820 --> 34:21.840] No, I could barely hear a lot of it, but something about finding SIP proxies and stuff like that. [34:22.620 --> 34:25.640] That's kind of outside of the scope of what iWAR does anyway. [34:26.440 --> 34:34.680] There are actually a lot of tools for, you know, like, what's the one that I always see hitting our network on 5060? [34:35.960 --> 34:37.440] It's some VoIP scanner. [34:37.640 --> 34:42.640] I think his question is if there was any commercial products that you see out there for pen-testers doing... [34:42.640 --> 34:43.120] Oh, oh, oh, okay. [34:43.200 --> 34:43.480] I'm sorry. [34:43.680 --> 34:44.960] My hearing's terrible. [34:46.020 --> 34:47.320] There actually are some. [34:47.440 --> 34:54.980] They're incredibly expensive, and which I find just kind of ridiculous, because there are some that... [34:54.980 --> 34:58.440] But they usually go in, like, the thousands of dollar range, and they... [34:58.440 --> 35:00.180] But they can handle, like, multiple modems. [35:00.300 --> 35:03.980] But nine times out of ten, the pen-testers I talk to are like, oh, yeah, I've got to scan this area. [35:04.160 --> 35:08.940] They're, like, loading up either iWAR or they're loading ToneLoc in a DOS box, you know? [35:09.080 --> 35:13.440] And just running it that way, because they're like, f*ck, man, this ToneLoc still rocks, you know, even to this day. [35:15.320 --> 35:18.780] So these are some of the places you can find out more information. [35:18.780 --> 35:20.100] Of course, Telephreak.org. [35:20.220 --> 35:23.460] We run a kind of a big voice bridge, a voice conference. [35:23.620 --> 35:27.160] People get on from all over the world and chit-chat about technology and stuff like that. [35:27.320 --> 35:31.360] And then we also run, like, old-school BBSs and stuff like that. [35:31.480 --> 35:39.340] And I'm not sure how much time I have left, but I could show a little bit of video about, like, stuff that we find on these adventures, if anybody's interested. [35:40.720 --> 35:41.080] Huh? [35:42.100 --> 35:43.720] Oh, okay. [35:43.840 --> 35:44.660] No, that's plenty of time. [35:45.560 --> 35:46.180] Of course. [35:46.420 --> 35:47.380] It's gonna be difficult. [35:49.000 --> 35:50.700] Because they have to do it kind of weird. [35:54.400 --> 35:55.680] For whatever reason. [36:00.100 --> 36:01.180] Any duration? [36:01.640 --> 36:03.160] Any duration? [36:03.460 --> 36:04.120] How do you mean? [36:07.100 --> 36:09.400] No, it's just recording in general. [36:09.500 --> 36:12.460] It doesn't matter how long the actual recording takes place for. [36:18.320 --> 36:19.800] Do you have anything to say? [36:20.460 --> 36:25.940] Well, I did want to say that there's three requirements that have to be fulfilled in a two-party state. [36:26.140 --> 36:30.340] It's either the beep or the verbal warning or recording stating it. [36:30.440 --> 36:31.820] Then that way you can get away with it. [36:31.820 --> 36:37.300] But there is no time limit or any, you know, watermark there to get away with it. [36:37.840 --> 36:39.280] It's any type of recording. [36:39.580 --> 36:42.180] I mean, the other gentleman was saying just one packet. [36:42.180 --> 36:45.900] So, I mean, if that's, you know, that could be milliseconds of the recording. [36:45.900 --> 36:49.620] They say that that's, you know, not following the regulation. [36:51.760 --> 36:52.300] Thank you. [36:52.540 --> 36:53.060] Yeah, here we go. [36:53.780 --> 36:56.420] No, I don't think that, there is no specification for that. [36:56.580 --> 36:58.120] It's, yeah, you just have to meet those requirements. [36:58.140 --> 36:59.220] Otherwise, you're breaking the law. [37:00.780 --> 37:01.400] There you go. [37:01.540 --> 37:02.180] That'd be a lot easier. [37:04.300 --> 37:04.980] Oh, thank you. [37:06.480 --> 37:06.940] What's that? [37:08.280 --> 37:08.940] Thank God. [37:09.080 --> 37:10.000] It's a computer beef. [37:10.540 --> 37:10.940] I know. [37:11.660 --> 37:12.340] Worst presentation. [37:12.340 --> 37:12.620] Okay. [37:12.900 --> 37:13.240] Yes. [37:13.400 --> 37:14.000] As usual. [37:14.800 --> 37:15.460] So, let's see. [37:15.540 --> 37:19.600] Let's look at, let's look at something in, say, Russia. [37:24.160 --> 37:27.740] And then, here, I might want to move it up a little bit. [37:32.340 --> 37:38.800] So, this is, we were bored and we decided to call around the Kremlin a lot. [37:40.620 --> 37:43.800] And this is just like, you know, you find all kinds of fun, interesting things. [37:44.740 --> 37:49.000] I'm actually going to let you guys guess at what this is, if it ever comes up here. [37:50.780 --> 37:51.680] Did it connect? [37:52.400 --> 37:53.120] There it is. [37:57.230 --> 38:00.150] What do you, what do you think this device might be? [38:02.170 --> 38:03.350] Any, any ideas? [38:04.270 --> 38:05.210] Cisco router. [38:05.210 --> 38:05.230] Cisco router. [38:05.530 --> 38:05.690] Yes. [38:06.930 --> 38:07.130] Now. [38:07.790 --> 38:08.430] Yeah, exactly. [38:09.690 --> 38:10.130] Now. [38:13.800 --> 38:16.720] And if you're wondering about the location on this. [38:19.360 --> 38:20.260] Let's see here. [38:24.270 --> 38:26.250] See, that interface isn't being used. [38:28.090 --> 38:29.290] And, oh, there it is. [38:30.950 --> 38:31.830] There's our... [38:31.830 --> 38:37.810] And so, you find a lot of stuff like this, where you'll dial in and it'll be a router and to saying, hello, tell me what to do. [38:37.930 --> 38:38.830] And you're like, are you kidding me? [38:38.970 --> 38:39.330] Really? [38:39.970 --> 38:43.130] You, you just, you just want your network to... [38:43.130 --> 38:44.130] This is silly. [38:44.890 --> 38:47.730] So, that's like one, just a brief example. [38:50.110 --> 38:50.790] Let's see. [38:52.730 --> 38:53.170] Yes. [38:53.510 --> 38:53.950] Yeah. [38:56.250 --> 38:59.370] And, I also do, I don't do it as much anymore. [38:59.370 --> 39:02.690] I used to do a lot of stuff with, uh, uh, X.25 networks. [39:02.870 --> 39:05.010] It's always been kind of a fascination of mine. [39:05.190 --> 39:07.790] And these are like really strange networks for anybody. [39:08.350 --> 39:13.270] Uh, the last talk, I think we talked a lot about X.25, so I won't go too, uh, detailed into it. [39:13.570 --> 39:16.190] But, um, like, let's say, here. [39:17.370 --> 39:24.250] Let's say you found this, and you gotta tell me what it is again. [39:26.910 --> 39:28.210] It should be pretty obvious. [39:35.960 --> 39:36.640] Is it going? [39:38.340 --> 39:39.020] There we go. [39:39.380 --> 39:39.880] So, what is it? [39:39.960 --> 39:42.560] It's obviously, probably an HP-UX box. [39:42.900 --> 39:43.480] Now, where is it? [39:43.580 --> 39:44.460] Where do you... [39:44.460 --> 39:45.160] What... [39:45.160 --> 39:47.500] See, this is probably being served from a terminal server. [39:47.800 --> 39:51.500] So, whenever you connect it on the port, it just makes basically like a Telenet connection. [39:51.720 --> 39:57.800] I have actually seen situations where you'll connect it, because you see it at the very top, trying, on port, you know, you can see the port there. [39:58.060 --> 40:01.680] And I have seen situations where they forgot to disable the escape key. [40:02.000 --> 40:06.480] So, whenever you call in, it makes a connection, then you can escape back to the terminal server. [40:06.480 --> 40:09.440] Which usually has default passwords left in place. [40:09.940 --> 40:11.940] And of course, this is only during penetration testing. [40:12.660 --> 40:12.980] But... [40:12.980 --> 40:13.780] So, did you see that? [40:13.860 --> 40:16.300] You saw the IP address that was associated with it. [40:17.420 --> 40:17.860] Right. [40:22.840 --> 40:24.800] So, it could be... [40:33.170 --> 40:39.310] It might be a part of the 754th Electronic Systems Group, U.S. Military. [40:41.430 --> 40:46.370] So, you know, if judging by the information that I'm getting back from the dial-up, that is correct. [40:47.350 --> 40:47.790] So... [40:54.200 --> 40:54.980] All right. [40:56.480 --> 40:58.220] And let's see what else we have here. [41:01.300 --> 41:01.740] OSPAC. [41:03.980 --> 41:06.220] Or do you see any up here that you're interested in? [41:07.820 --> 41:11.360] Oh, British Telecommunications, BT, they're a big provider. [41:11.660 --> 41:15.480] This is actually their X.25 network that you can connect up to. [41:16.860 --> 41:18.480] And it's used a lot in... [41:19.000 --> 41:20.780] Well, actually, it's probably not used as much anymore. [41:20.800 --> 41:23.880] But it was used a lot for, like, banking applications and stuff like that. [41:24.440 --> 41:25.660] And that's another thing that's fun. [41:26.280 --> 41:26.640] There's... [41:26.640 --> 41:26.900] Oh, wait. [41:26.960 --> 41:27.740] I know what I'm going to show. [41:29.240 --> 41:30.160] There's this great... [41:30.160 --> 41:32.920] Russia has the best X.25 networks. [41:34.660 --> 41:35.080] Um... [41:35.080 --> 41:36.320] With just... [41:36.760 --> 41:38.000] Stuff all over it. [41:39.960 --> 41:40.380] Um... [41:40.380 --> 41:42.160] If no... [41:42.160 --> 41:43.100] Cisco, Russia. [41:48.910 --> 41:49.450] Let's see. [41:49.570 --> 41:50.870] But I don't see that video in here. [41:51.090 --> 41:52.130] So, if there's... [41:52.130 --> 41:52.550] What's that? [41:53.630 --> 41:55.330] Yeah, it's actually called R-O-L. [41:56.010 --> 41:56.430] Um... [41:56.430 --> 41:56.950] The file name. [41:57.750 --> 41:58.110] Bottom line? [41:58.350 --> 41:58.730] Bottom line? [41:59.010 --> 41:59.590] Oh, yeah, yeah, yeah. [41:59.630 --> 42:00.250] I see it down there. [42:01.370 --> 42:01.790] Um... [42:01.790 --> 42:02.890] I don't remember if it's one or two. [42:03.570 --> 42:05.830] This will be a harder one for you guys, I think. [42:06.210 --> 42:07.530] Can you tell me what type of... [42:07.530 --> 42:07.970] If... [42:07.970 --> 42:08.710] If it's... [42:08.710 --> 42:08.970] Oh, yeah. [42:10.030 --> 42:11.930] I guess both of them are empty, more than likely. [42:13.450 --> 42:13.770] Yeah. [42:13.990 --> 42:14.810] I'm sorry about that. [42:15.430 --> 42:16.970] Well, anyways, we had, um... [42:17.370 --> 42:19.170] I guess it didn't get copied over, but... [42:19.170 --> 42:20.810] On the Russian network, you can go on. [42:20.910 --> 42:22.930] And we would find, like, Motorola Vanguards. [42:23.050 --> 42:23.650] Do you remember those? [42:23.830 --> 42:25.270] They're, like, these old routers. [42:25.370 --> 42:26.270] And they have menu systems. [42:26.870 --> 42:28.230] And basically, uh... [42:28.230 --> 42:30.010] That you would go on, and it'd say password. [42:30.270 --> 42:32.330] And then you'd say, Well, I don't really want to be on this thing. [42:32.370 --> 42:32.910] And just hit enter. [42:33.070 --> 42:34.230] And then it'd say, okay, thank you. [42:34.490 --> 42:35.270] That was correct. [42:36.250 --> 42:36.590] Um... [42:36.590 --> 42:38.350] How would you like me to... [42:38.350 --> 42:39.610] What would you like me to do? [42:39.670 --> 42:40.110] Kind of thing. [42:41.230 --> 42:41.910] But, um... [42:41.910 --> 42:43.190] You're gonna tell him about, uh... [42:43.190 --> 42:46.030] War dialing, like, Buckingham Palace and Iran and... [42:46.030 --> 42:47.380] Yeah, I actually, um... [42:47.930 --> 42:48.010] Uh... [42:48.010 --> 42:50.450] My friend Jay Falcon, who is gonna be assisting. [42:51.130 --> 42:51.470] Um... [42:51.470 --> 42:51.830] He... [42:51.830 --> 42:52.590] He has this thing. [42:52.670 --> 42:53.190] He called me. [42:53.210 --> 42:54.270] It was the 4th of July. [42:54.990 --> 42:57.850] And, you know, just casually, I was like, What are you doing today? [42:57.950 --> 42:59.650] He's like, you know, just hanging out with family. [43:00.150 --> 43:01.710] War dialing Buckingham Palace. [43:02.270 --> 43:03.110] And I was like, why? [43:03.310 --> 43:04.790] He's like, dude, it's the f*cking 4th of July. [43:04.790 --> 43:06.830] It's like, what you do on the 4th. [43:07.010 --> 43:08.050] I was like, really? [43:08.570 --> 43:08.970] That's... [43:08.970 --> 43:11.550] Well, you gotta let the queen know we haven't forgotten about it. [43:11.690 --> 43:11.770] Right. [43:11.770 --> 43:15.490] And actually, last time we did show a building management system that we did find, uh... [43:15.490 --> 43:16.870] Well, he found, uh... [43:16.870 --> 43:17.870] While war dialing that area. [43:18.970 --> 43:20.750] And I believe somebody said to us, uh... [43:20.750 --> 43:23.310] Could we turn up the temperature on the throne? [43:23.870 --> 43:24.930] So, uh... [43:24.930 --> 43:25.650] But... [43:25.650 --> 43:29.070] It was a kind of, you know, building management systems are kind of unique things to see as well. [43:29.650 --> 43:30.210] But, um... [43:30.210 --> 43:31.230] I think it's pretty much... [43:31.230 --> 43:32.570] What about Iran and... [43:32.570 --> 43:33.790] Yeah, he's... [43:33.790 --> 43:34.710] He dials... [43:34.710 --> 43:37.770] And he's an equal opportunity harasser, I guess you could say. [43:37.770 --> 43:42.430] Okay, so he'll dial, like, 10,000 numbers in Iran, but then he always goes after Israel as well. [43:42.470 --> 43:44.270] Because he kind of feels bad that he's picking on Iran. [43:44.510 --> 43:47.070] So then he'll war dial Israel 10,000 times. [43:47.170 --> 43:50.450] And he thinks it's like, somehow he's balancing his karma out or something. [43:50.610 --> 43:50.970] I don't know. [43:52.690 --> 43:53.090] So... [43:53.090 --> 43:54.130] But, um... [43:54.130 --> 43:55.830] Do you guys have any other questions or anything? [43:57.950 --> 43:58.990] Because I think I'm... [43:58.990 --> 44:00.350] I'm about out of material. [44:01.030 --> 44:01.850] Are you out of beer yet? [44:02.130 --> 44:02.530] No. [44:04.190 --> 44:04.690] What's that? [44:07.590 --> 44:09.010] Oh, for the recordings? [44:09.490 --> 44:09.950] Wow. [44:10.090 --> 44:10.750] That's a good question. [44:11.010 --> 44:14.430] So you mean, like, if you're war dialing Russia and your recordings? [44:14.870 --> 44:15.830] Actually, I don't know. [44:16.230 --> 44:16.810] I don't know. [44:16.870 --> 44:18.050] I've never really looked into that. [44:18.790 --> 44:19.250] Um... [44:19.250 --> 44:20.870] I guess it probably wouldn't matter. [44:22.130 --> 44:22.590] Um... [44:22.590 --> 44:25.670] So therefore, make sure you dial war dial outside the country. [44:25.810 --> 44:27.570] I guess is the moral of the story. [44:28.090 --> 44:28.210] Yeah. [44:35.320 --> 44:35.920] I know. [44:36.040 --> 44:36.440] It's like... [44:36.440 --> 44:40.180] The hit rate I'm finding interesting stuff is always the same. [44:40.880 --> 44:41.240] It's... [44:41.240 --> 44:42.340] So, Alaska... [44:42.340 --> 44:44.440] Like, I don't think I've actually done a lot with Alaska. [44:44.680 --> 44:45.480] I bet you Jay Falcon has. [44:45.520 --> 44:46.180] He used to live there. [44:46.360 --> 44:49.340] He was actually busted in Operation Sun Devil back in the day. [44:49.740 --> 44:50.660] But, um... [44:50.660 --> 44:51.620] He, uh... [44:51.620 --> 44:55.820] He might have gone through there and probably have a better answer, but it's a pretty low success rate. [44:55.900 --> 44:58.500] You're looking for really, you know... [44:59.000 --> 44:59.360] Really... [44:59.360 --> 45:01.840] Not a lot of people connect up stuff that way. [45:01.960 --> 45:05.400] And some of the stuff that you find, they don't even know it's still connected up that way. [45:05.760 --> 45:06.120] Like... [45:06.120 --> 45:06.960] They're like, holy shit. [45:06.960 --> 45:10.600] With this POTS line, it's connected to this modem and we didn't even know it was here, kind of thing. [45:10.780 --> 45:11.680] So, you see that a lot. [45:11.900 --> 45:12.220] Oh, go ahead. [45:12.920 --> 45:13.200] So, [45:21.950 --> 45:22.690] he was in Austin, Texas. [45:22.810 --> 45:23.150] Oh, yeah. [45:23.410 --> 45:23.510] Yeah. [45:23.590 --> 45:24.790] He said... [45:28.690 --> 45:29.470] Yeah, yeah, yeah. [45:29.770 --> 45:30.090] That's... [45:30.090 --> 45:31.770] That's pretty much the way we roll as well. [45:31.910 --> 45:33.070] We use, uh... [45:33.070 --> 45:34.070] A lot of, uh... [45:34.070 --> 45:36.030] Not so much Canada, but European providers. [45:36.210 --> 45:38.750] But, basically, he was saying that HG Moore, uh... [45:38.750 --> 45:40.050] Goes to a provider through Canada. [45:40.370 --> 45:41.310] He dials out of... [45:41.310 --> 45:41.750] What is it? [45:41.810 --> 45:42.990] Austin, Texas or whatever. [45:43.630 --> 45:44.790] And then goes and then hits... [45:45.290 --> 45:45.410] Right. [45:45.690 --> 45:48.670] And by that point, it's so convoluted, nobody's gonna come after you. [45:48.750 --> 45:53.610] I mean, the Russian mob might come after me if they find out I'm looking at their routers. [45:53.990 --> 45:55.270] Or somebody might be. [45:55.450 --> 45:56.070] But, um... [45:56.070 --> 45:56.770] I'm not worried about... [45:57.550 --> 45:57.990] Uh... [45:57.990 --> 45:59.210] I don't really worry about that. [45:59.330 --> 45:59.850] Especially overseas. [46:00.110 --> 46:02.330] And I just do overseas stuff because I usually find it more interesting. [46:02.990 --> 46:04.770] I mean, you find, um... [46:04.770 --> 46:06.650] And, as I said, like, places like Iran. [46:06.850 --> 46:09.050] I mean, you don't know what the hell you're gonna find. [46:09.250 --> 46:09.550] You know? [46:09.710 --> 46:11.190] We found, like, uh... [46:11.190 --> 46:11.990] The system was... [46:11.990 --> 46:14.330] It identified itself as an encrypted fax machine. [46:14.630 --> 46:15.850] But it was a modem carrier. [46:16.030 --> 46:17.230] And I was like, oh, this is great. [46:17.310 --> 46:19.350] Let's play with this for a little while, you know? [46:19.990 --> 46:20.350] Um... [46:20.350 --> 46:20.530] Go ahead. [46:20.670 --> 46:22.410] I was gonna back up that claim, actually. [46:22.610 --> 46:25.010] I've been kicked off two American VoIP providers. [46:25.050 --> 46:25.750] Only two? [46:25.750 --> 46:25.850] Only two? [46:25.970 --> 46:28.450] You've only been kicked off two American VoIP providers? [46:28.530 --> 46:31.530] I had the same community VoIP providers for the past six years. [46:32.410 --> 46:32.770] Yeah. [46:32.950 --> 46:35.130] It just largely depends because a lot of these... [46:35.130 --> 46:36.770] Some carriers just won't even notice. [46:37.230 --> 46:37.770] But, like, when... [46:37.770 --> 46:43.730] I think when Jay Falcon was back-spoofing all Malibu, I think he said he went through, like, three or four providers. [46:44.030 --> 46:44.510] Because they were... [46:44.510 --> 46:46.570] He was, like, dipping in and they were, like... [46:46.570 --> 46:47.850] You know, and he would argue with them. [46:48.350 --> 46:49.490] And he's like, come on, man. [46:50.550 --> 46:51.250] I still got... [46:51.250 --> 46:52.870] I still got $20 with you guys. [46:52.990 --> 46:54.310] And they're like, we'll give you back your $20. [46:54.870 --> 46:57.230] Just never touch our shit ever again. [46:58.050 --> 46:59.110] They'd, you know, call me up. [46:59.310 --> 47:00.290] Well, I got kicked off again. [47:05.110 --> 47:05.790] Yeah, you are. [47:05.870 --> 47:08.990] But, actually, at that point, you're just worried about, like, you know, the VoIP... [47:08.990 --> 47:14.630] You're just trying to go under the wire of the VoIP provider so you don't lose your $20 for doing this silly stuff. [47:15.410 --> 47:15.770] So... [47:15.770 --> 47:15.970] Anyway. [47:16.130 --> 47:16.330] Go ahead. [47:26.720 --> 47:27.500] Oh, of course. [47:27.760 --> 47:28.040] Yeah. [47:28.820 --> 47:33.100] Well, I mean, I think the new part is, is people like, you know, HD and whatnot. [47:33.640 --> 47:35.260] Because you said, what is new to this? [47:35.420 --> 47:36.140] I believe it was the first part. [47:36.160 --> 47:37.900] I said, if someone is new to this. [47:38.040 --> 47:38.480] Oh, oh. [47:38.520 --> 47:39.720] If someone is new to this. [47:40.540 --> 47:41.840] What should they avoid doing? [47:41.840 --> 47:45.000] Like, what do people think that you do? [47:45.060 --> 47:46.840] The most common one that... [47:46.840 --> 47:53.780] I've seen guys who will take, like, especially iWar, and then plug it into their phone line and say, let's ward out of the White House. [47:53.980 --> 47:54.360] And then... [47:54.360 --> 47:56.180] And then they're like, why... [47:56.180 --> 47:58.460] You know, you see... [47:58.460 --> 48:01.260] Because they're reading, like, 1985 text files. [48:01.420 --> 48:02.040] And this was, like... [48:02.040 --> 48:03.000] That was the way to do it. [48:03.320 --> 48:08.240] And now with VoIP and whatnot, you can kind of create a little bit more anonymity. [48:08.400 --> 48:11.320] And a lot of these guys don't have... [48:11.320 --> 48:13.140] don't realize about how to go about doing that. [48:13.360 --> 48:13.760] You know what I mean? [48:13.860 --> 48:17.880] Like, setting up an asterisk box or dealing with a VoIP provider because they've just never done it before. [48:18.480 --> 48:20.540] So, I mean, that's, like, the biggest one. [48:20.720 --> 48:26.780] I did have a friend of mine, actually, naming this new release of iWar that should be out in probably a couple of weeks. [48:27.600 --> 48:30.220] It's called Savant's Cat Dials 911. [48:30.600 --> 48:35.080] And the reason it's called that is my friend Savant, who I've known for years, he was using this software. [48:36.380 --> 48:39.500] And we were still doing a lot of CVS updates. [48:39.500 --> 48:41.980] And so he was, like, working with new code and whatnot. [48:42.500 --> 48:44.020] And there's evidently a bug. [48:44.360 --> 48:47.120] So he's fired up iWar, and it was going on. [48:47.300 --> 48:48.420] And it was going on. [48:48.500 --> 48:50.000] And he was leaving his house. [48:50.040 --> 48:54.000] And as he left his house, police cars went flying by him. [48:54.800 --> 48:57.220] And he was kind of like, wow, that's weird. [48:57.980 --> 48:59.960] Maybe I'll turn around and go home and see what's going on. [49:00.040 --> 49:01.980] Maybe, you know, my wife or something's having... [49:01.980 --> 49:04.620] So he goes back home, and the police are in his yard. [49:04.780 --> 49:05.200] And they're like... [49:05.200 --> 49:06.080] And he's like, what the hell are you doing? [49:06.160 --> 49:10.240] And he's like, well, you were calling 911 a thousand times. [49:10.240 --> 49:11.520] And we got worried about you. [49:11.660 --> 49:12.860] And he literally told... [49:12.860 --> 49:14.300] And he didn't get in any trouble for this. [49:14.400 --> 49:14.860] Thank God. [49:14.860 --> 49:16.280] I felt so freaking bad. [49:17.200 --> 49:21.120] But he told the police, the cat sometimes plays with the phone. [49:22.060 --> 49:24.240] So it was probably the cat. [49:24.680 --> 49:26.240] So then I was like, well... [49:26.240 --> 49:26.980] And then he told me that story. [49:27.040 --> 49:27.640] I felt so bad. [49:27.680 --> 49:29.360] I was like, well, Savant's Cat Dials 911. [49:29.360 --> 49:31.980] So that's what it's going to be named. [49:32.500 --> 49:33.120] This code release. [49:34.260 --> 49:34.660] So... [49:34.660 --> 49:35.340] All right. [49:45.700 --> 49:48.840] Actually, in most cases, the question was, am I using... [49:48.840 --> 49:53.580] is iWar or Warbox going directly through the provider? [49:53.700 --> 49:55.740] Or are you doing it off of an asterisk server or whatnot? [49:55.940 --> 49:58.080] I typically like to do it off of an asterisk server. [49:58.380 --> 50:04.100] As you know, a lot of these, like both of our pieces of software only support IEX2, that protocol. [50:05.000 --> 50:09.140] So if you want to use a SIP carrier, the software doesn't natively support it yet. [50:10.660 --> 50:12.080] But that's going to be coming around. [50:12.880 --> 50:14.380] But I like to go through... [50:14.380 --> 50:15.660] I find it works better, too. [50:15.780 --> 50:16.600] Both of our software. [50:16.700 --> 50:23.360] For some reason, when you try to use it directly with a provider and fire up 50 channels, it's like the channels get all stuck. [50:23.540 --> 50:26.380] But if I have an asterisk server sitting in between, it's like flawless. [50:26.580 --> 50:27.120] It works great. [50:27.720 --> 50:29.140] So that's pretty much that. [50:30.540 --> 50:31.000] All right. [50:31.120 --> 50:31.220] Cool. [50:32.040 --> 50:34.760] Well, I think he was flashing the thing anyway, so... [50:36.500 --> 50:37.120] No, okay. [50:37.360 --> 50:40.740] Well, I'm out of stuff, so... [50:40.740 --> 50:41.220] Thank you. [50:41.620 --> 50:42.220] You're welcome. [50:42.900 --> 50:43.560] Yes, go ahead. [50:49.140 --> 50:50.480] No, actually it's not. [50:50.540 --> 50:52.740] It's not related to the phone book data at all. [50:52.920 --> 50:54.960] It's actually tied to the phone number. [50:55.080 --> 51:01.320] So for instance, you know, you probably couldn't go and look at Mark Hamill, you know, in the Malibu phone directory. [51:01.320 --> 51:08.320] It's actually data that's being supplied from the telecom, from the telecom provider, so to speak. [51:08.500 --> 51:12.860] So it doesn't really matter if they have their phone number as listed as, you know, private or whatever. [51:13.180 --> 51:17.520] If you can still look up that information, you can still, you know, get the number, so to speak. [51:19.040 --> 51:19.480] But... [51:24.660 --> 51:25.080] Right. [51:25.700 --> 51:26.260] He was... [51:26.260 --> 51:31.320] In that particular list, what he was doing is cross-referencing it amongst multiple databases. [51:31.860 --> 51:38.200] So he was doing one was bulk CNAME, and then one was actually the telco data, and he was referencing it across like... [51:38.200 --> 51:39.260] Actually, there was more to it. [51:39.320 --> 51:41.080] There was like four different providers. [51:41.240 --> 51:44.720] So he was hitting it and saying, that says Mark Hamill, for instance. [51:45.220 --> 51:49.940] Let's see what bulk CNAME says, to kind of get a correlation to say, is this really the number that I think it is, kind of thing. [52:05.080 --> 52:05.720] Right, right. [52:06.000 --> 52:06.960] Actually, that's the one thing. [52:07.120 --> 52:07.640] Usually, yeah. [52:07.880 --> 52:11.320] I mean, until, I guess, recently, you typically didn't... [52:11.320 --> 52:13.860] Cell phones were the worst, because you didn't get that kind of data. [52:14.200 --> 52:15.800] You wouldn't get the CNAME kind of stuff. [52:16.200 --> 52:17.380] You know, just be Bob's phone... [52:17.380 --> 52:18.620] Well, just the phone number. [52:18.740 --> 52:19.220] That's it. [52:20.160 --> 52:24.840] These guys, you know, a lot of these phone numbers that we were showing, these are like their office line kind of stuff. [52:25.100 --> 52:31.100] They usually have like somebody to screen, you know, to make sure assholes like me aren't calling them. [52:31.180 --> 52:31.460] To [52:56.360 --> 52:58.420] HL or something. [53:04.880 --> 53:05.300] No, no. [53:05.480 --> 53:06.700] And you're building it on your own. [53:07.160 --> 53:08.360] Yeah, you're building it on your own. [53:10.060 --> 53:10.680] Right, right. [53:12.720 --> 53:13.420] Then it's a, yeah. [53:29.930 --> 53:30.650] That's a... [53:30.650 --> 53:30.970] Okay. [53:32.010 --> 53:32.690] I got to... [53:32.690 --> 53:36.530] If you guys want to talk more about this, with Beeb, you can always find them on Telephreak.org. [53:36.610 --> 53:37.650] You can call into the bridge. [53:37.790 --> 53:40.930] And you can also get on IRC.2600.net, pound Telephreak. [53:41.090 --> 53:45.430] And you can always, usually sometimes find Beeb out there and get them talking about this again. [53:46.790 --> 53:47.150] That's... [53:47.150 --> 53:47.710] Yes, true. [53:47.950 --> 53:49.110] But thank you very much, guys. [53:49.330 --> 53:50.250] Thanks for coming out. [53:50.490 --> 53:50.950] Thank you. [53:50.950 --> 53:51.110] There you go. [53:51.150 --> 53:51.230] REP jus. [53:51.530 --> 53:51.650] Thanks. [53:51.650 --> 53:51.950] Thank you.