[00:00.060 --> 00:01.220]  Are we here?
[00:02.020 --> 00:02.740]  We're here.
[00:02.920 --> 00:03.040]  Good.
[00:04.060 --> 00:09.040]  Alright, it's 1700 and the open slot has been filled by StankDawg and the Art of Electronic Deduction.
[00:09.640 --> 00:13.420]  This is HOPE 6.
[00:13.700 --> 00:17.840]  We have one announcement.
[00:19.120 --> 00:21.460]  Dusty Corners of the Web has been cancelled permanently.
[00:21.720 --> 00:23.520]  It is not coming back to my knowledge.
[00:23.740 --> 00:30.040]  There will be a presentation at 1230 tonight by members of the Chaos Computer Club called Biometrics and Science.
[00:31.360 --> 00:34.180]  If you are interested in that presentation, it will be at 1230.
[00:34.320 --> 00:35.180]  There was a flight delay.
[00:36.100 --> 00:40.420]  StankDawg has graciously agreed to inform and entertain during this time.
[00:40.920 --> 00:41.940]  So, I'll leave that to him.
[00:43.060 --> 00:44.080]  Well, we're going to try our best.
[00:48.700 --> 00:52.400]  Okay, so, welcome to HOPE 6, everyone.
[00:52.720 --> 00:53.700]  Having a good time so far?
[00:54.920 --> 00:55.240]  Alright.
[00:55.660 --> 00:56.460]  See, that's what I need.
[00:56.540 --> 00:56.860]  Here we go.
[00:57.060 --> 01:00.620]  We've got a small crowd here, so everybody's got to pitch in, you know, help out with this.
[01:01.320 --> 01:05.020]  Actually, this is a presentation, I'll tell you up front, it's going to be very fun.
[01:05.160 --> 01:07.260]  I am going to be calling on people from the audience to help out.
[01:07.670 --> 01:18.670]  It's very... it's something that everybody in here can do, and it's nothing deeply technical, but it's a very fun presentation, and it might put some things together that you maybe never thought about before, or never looked at in this way before.
[01:18.860 --> 01:23.080]  So, kind of keep that in mind, and it's going to be very fun and light-hearted, hopefully funny in some parts.
[01:23.840 --> 01:28.000]  And I guess to start off, the first thing would be to define what is electronic deduction.
[01:28.580 --> 01:29.380]  I don't know, I made it up.
[01:29.660 --> 01:30.760]  Nothing important.
[01:31.300 --> 01:49.920]  But it's basically looking at... it can be anything from screenshots, content, I guess would be the better word, focusing on content, and what kind of patterns or interesting things can you find from something like a screenshot, something like metadata inside of a files.
[01:50.360 --> 01:53.380]  We could do a whole talk, several hours of talks on metadata.
[01:53.380 --> 01:55.400]  We're going to touch on a little bit of that in the second half.
[01:55.980 --> 02:02.740]  But the first half of it, we're going to focus on looking at screenshots, shoulder surfing, things along those lines of what you can actually find out.
[02:03.260 --> 02:05.560]  Probably a lot more than people maybe realize.
[02:05.920 --> 02:10.520]  So, it is a form of footprinting, if you want to look at it like that.
[02:10.620 --> 02:15.640]  If you're shoulder surfing, you're looking at somebody's desk in their office, you can find out very quickly.
[02:15.800 --> 02:17.380]  You look at someone's laptop in here.
[02:17.560 --> 02:18.880]  Watch over your shoulder, everybody, right?
[02:19.440 --> 02:21.320]  You, I see you looking over somebody's shoulder.
[02:23.080 --> 02:24.880]  Seeing what kind of stuff they've got installed.
[02:25.100 --> 02:26.800]  It tells you a lot about who they are as a user.
[02:27.340 --> 02:32.620]  And finding different patterns and discovering software that they use or different websites.
[02:33.720 --> 02:35.020]  So, yeah, it sounds pretty simple.
[02:35.120 --> 02:36.560]  Yeah, it's common sense hacking.
[02:36.560 --> 02:42.560]  As Fubster, one of the guys from our forums at binrev.com, pimp pimp, has referred to it.
[02:42.600 --> 02:43.320]  And it very much is.
[02:43.460 --> 02:44.240]  It's common sense hacking.
[02:44.380 --> 02:46.520]  And you're going to find out that it is something everybody can do.
[02:46.520 --> 02:48.520]  But put a process to it.
[02:48.700 --> 02:51.820]  Of sitting down and thinking, well, what exactly does this mean?
[02:51.920 --> 02:54.860]  Sure, I see that they've got this application installed.
[02:54.860 --> 02:56.080]  But what does that really mean?
[02:56.300 --> 02:58.260]  So, what if they've got something installed?
[02:58.860 --> 03:01.360]  The level of depth is where it comes into play.
[03:01.480 --> 03:03.720]  The depth of how much experience you have.
[03:03.880 --> 03:05.520]  How many software packages you've seen.
[03:06.480 --> 03:08.240]  I've got some screenshots coming up.
[03:08.460 --> 03:10.280]  I've given this at a couple different meetings.
[03:10.700 --> 03:13.960]  And every time I give it, someone points out something new that I didn't even see.
[03:14.160 --> 03:20.040]  So, it's all about the experience that you have and what you recognize and what you put together to kind of come up with.
[03:21.100 --> 03:26.980]  And obviously, if you have physical access and time available to sit there and really pound away at it, you can find a whole lot more.
[03:27.100 --> 03:29.460]  That's when you can start looking at metadata and things like that.
[03:30.440 --> 03:32.080]  So, yes, this is very simple.
[03:32.280 --> 03:34.400]  And what is the goal of doing this?
[03:34.540 --> 03:41.740]  Well, besides just being funny, kind of owning, dropping the docs or whatever you want to refer to it as, try to build a case.
[03:42.000 --> 03:43.760]  Think of it, you know, go into Batman mode.
[03:43.900 --> 03:45.220]  Pretend you got your utility belt.
[03:45.760 --> 03:51.740]  Start putting all this stuff together and build a case like, I'm going to prove that this laptop belongs to this person.
[03:51.900 --> 04:07.000]  Or, if you want an actual truthful application of when this might come in handy, if you do get busted, which hopefully nobody will do that, you can use these kind of things to say, look, I can't use Microsoft Office because I run Linux.
[04:07.020 --> 04:09.580]  Or, I can't use XYZ because I run...
[04:09.580 --> 04:15.300]  You know, you can use these things to say, listen, I can prove that's not a screenshot of my computer because I don't have that.
[04:15.500 --> 04:16.880]  You know, you can have that kind of stuff.
[04:18.800 --> 04:21.740]  But, none of these individually will stand on their own.
[04:22.850 --> 04:26.740]  They're all circumstantial evidence, if you want to think of it.
[04:26.740 --> 04:30.000]  So, don't think that this is going to stand up in court as some kind of defense for anything.
[04:30.680 --> 04:39.700]  But, you can build a case of a sequence of events and a lot of different things that will prove that something is or is not, or probably is or probably is not.
[04:39.760 --> 04:43.940]  You can never... I won't say never come to 100% conclusion, but you can get pretty close.
[04:44.650 --> 04:46.940]  So, coincidental evidence by itself is useless.
[04:46.960 --> 04:49.640]  So, what if this person uses Microsoft Office?
[04:49.640 --> 04:51.060]  So do a million other people.
[04:51.060 --> 04:53.500]  That doesn't really narrow it down or prove anything.
[04:59.100 --> 05:00.100]  Let's check.
[05:00.400 --> 05:00.680]  There?
[05:00.860 --> 05:01.280]  There we go.
[05:01.700 --> 05:03.020]  I guess I can't move around here.
[05:03.160 --> 05:03.360]  Okay.
[05:03.920 --> 05:07.980]  But, building a collection of coincidental evidence can help build a case.
[05:09.240 --> 05:17.000]  And this is kind of overkill, but I wanted to illustrate it to kind of make sure that the point gets across, is if you wanted to actually chart this and make this a process.
[05:17.000 --> 05:25.120]  And in security field, they like to make processes and steps and stages and measure everything, which is, you know, not exactly the hacker way to do things.
[05:25.260 --> 05:28.760]  But, to visualize it, think of different types of users.
[05:28.860 --> 05:30.040]  And I just made up a few here.
[05:30.140 --> 05:32.180]  You know, you can see... I hope everybody can see okay.
[05:32.720 --> 05:35.720]  Student, gamer, a home user, a business user, a hacker.
[05:36.240 --> 05:37.520]  Just, again, made up examples.
[05:38.440 --> 05:42.260]  And I just used a 1 to 10 scale, positive and negative, starting in the center.
[05:42.660 --> 05:49.080]  And based on what you might find on someone's computer, you can kind of build a case for one or the other user.
[05:49.480 --> 06:02.460]  So, for example, if you find a computer that has accounting software installed on it, Microsoft Office, Outlook as their client, things like that, that's gonna raise the percentage of the likelihood of it being a business user.
[06:02.660 --> 06:04.320]  Home users use some of those things, too.
[06:04.600 --> 06:05.360]  So do students.
[06:05.520 --> 06:10.960]  But a gamer having an accounting software, a hacker having accounting software, kind of lowers that probability.
[06:11.560 --> 06:17.920]  So, kind of keep that process in mind as you see some of these and think what kind of person this is and what kind of category they might fall into.
[06:20.540 --> 06:24.220]  Ah, I said at the very beginning, for those of you who just came in, this will be interactive.
[06:24.520 --> 06:25.540]  So, I'm gonna be...
[06:25.540 --> 06:26.880]  And it's easy, trust me.
[06:26.880 --> 06:29.600]  And this is a very simple, nice example to start with.
[06:30.300 --> 06:33.660]  First of all, I mean, what operating system is this person using?
[06:36.930 --> 06:38.250]  Come on, I didn't stomp the whole room.
[06:38.330 --> 06:39.350]  Windows XP, obviously.
[06:39.570 --> 06:40.130]  We know that.
[06:40.410 --> 06:41.630]  Well, actually, not necessarily.
[06:41.770 --> 06:44.370]  Of course, people can skin things and there's different windowing systems.
[06:44.490 --> 06:45.130]  You can trick people.
[06:45.210 --> 06:46.650]  But that's pretty obviously Windows XP.
[06:46.770 --> 06:47.630]  We all can tell that.
[06:48.950 --> 06:50.430]  And you can tell what kind of hardware.
[06:50.730 --> 06:54.870]  Anybody ever really think about telling the hardware from what you might see as simple as a taskbar?
[06:55.210 --> 06:56.710]  We're not even looking at a whole screenshot.
[06:56.710 --> 06:58.090]  We're looking at just a taskbar.
[06:58.890 --> 07:00.770]  You know it's a laptop because...
[07:01.670 --> 07:02.350]  There you go.
[07:02.430 --> 07:03.570]  So, you can put these things together.
[07:04.650 --> 07:06.730]  What else can you tell about a laptop?
[07:06.810 --> 07:07.750]  It's plugged in, obviously.
[07:07.990 --> 07:08.970]  You see the AC power.
[07:09.690 --> 07:10.590]  So, it's plugged in.
[07:10.610 --> 07:11.810]  What about the speaker icon?
[07:13.090 --> 07:14.170]  You notice that's muted?
[07:16.650 --> 07:18.370]  So, somebody muted their speakers.
[07:18.570 --> 07:20.070]  That doesn't happen accidentally.
[07:20.590 --> 07:22.270]  I mean, these are the little things.
[07:22.490 --> 07:25.190]  Think, why would somebody mute their speakers?
[07:25.190 --> 07:26.350]  There's got to be a reason for that.
[07:26.490 --> 07:28.030]  A gamer is not going to mute their speakers.
[07:28.750 --> 07:30.090]  Kind of silly defeats the point.
[07:31.290 --> 07:31.870]  Right there.
[07:32.410 --> 07:35.050]  This, and this man right here wins the no prize.
[07:37.590 --> 07:39.690]  This screenshot, I'll tell you, was from...
[07:39.690 --> 07:43.030]  I don't know if it was this laptop, but one of my other laptops in an airport.
[07:43.390 --> 07:45.150]  And I didn't want to disturb the people around me.
[07:45.250 --> 07:50.210]  And I didn't want it to play my vulgar language from Binary Revolution Radio tonight at 11 o'clock in this room.
[07:50.210 --> 07:50.730]  Be there.
[07:51.150 --> 07:51.450]  Thank you.
[07:52.810 --> 07:53.290]  So, yes.
[07:53.450 --> 07:53.930]  There's absolutely...
[07:53.930 --> 07:57.770]  So, see how you kind of start with one thing and kind of build up to what it actually means?
[07:59.050 --> 08:02.590]  The software that's being used, you can see the icon in the center.
[08:02.790 --> 08:04.050]  Everybody recognize that probably?
[08:04.350 --> 08:04.670]  Yeah.
[08:04.970 --> 08:05.870]  Microsoft Outlook.
[08:06.230 --> 08:07.570]  What about the one next to it?
[08:07.570 --> 08:09.270]  Now, this is one of my favorite examples.
[08:09.270 --> 08:10.710]  The one right to the left of that.
[08:11.250 --> 08:11.650]  Trillion.
[08:12.750 --> 08:13.150]  Trillion.
[08:13.250 --> 08:13.390]  Whoops.
[08:13.710 --> 08:14.030]  Trillion.
[08:14.910 --> 08:19.910]  Not only is that trillion, there's actually something else you can pull out of that little icon.
[08:19.910 --> 08:22.310]  There's more information in that little icon, believe it or not.
[08:22.370 --> 08:23.410]  It's not the professional one.
[08:23.530 --> 08:24.150]  It's the free version.
[08:24.230 --> 08:26.010]  Well, I don't...
[08:26.010 --> 08:26.830]  I honestly don't know that.
[08:26.910 --> 08:27.150]  That's...
[08:27.150 --> 08:27.870]  I never heard that before.
[08:28.270 --> 08:29.010]  That's a good one.
[08:30.670 --> 08:31.030]  Um...
[08:31.030 --> 08:31.670]  Does anybody...
[08:31.670 --> 08:33.630]  Is anybody very familiar with Trillion right here?
[08:33.850 --> 08:35.550]  Do you log on to AOL and MSN?
[08:36.450 --> 08:37.170]  Trillion, of course...
[08:37.170 --> 08:38.350]  Actually, let me back up.
[08:38.430 --> 08:38.590]  Yes.
[08:38.710 --> 08:39.650]  If I back up...
[08:39.650 --> 08:42.670]  For those of you who don't know Trillion, I'm assuming everybody does, but let me back up.
[08:42.710 --> 08:51.690]  Trillion is a chat client that will communicate with AOL Messenger, whatever that thing's called, MSN Messenger, Yahoo Messenger, et cetera, et cetera.
[08:51.810 --> 08:52.770]  All of them in one place.
[08:52.990 --> 08:54.990]  But the icon...
[08:55.510 --> 08:55.910]  Right.
[08:56.170 --> 08:59.330]  So there's two circles there, whatever that icon.
[09:00.010 --> 09:05.410]  If you're connected to all of the available networks, let's say you have an AOL and an MSN and a Yahoo.
[09:05.750 --> 09:09.290]  If you're connected to all of them, both of those bubbles light up yellow.
[09:10.390 --> 09:15.930]  And this one, you can see that only the top one is lit up, which means they're not connected to all of the possible networks that are available.
[09:16.170 --> 09:16.970]  What does that mean?
[09:17.090 --> 09:17.650]  Maybe nothing.
[09:17.890 --> 09:21.930]  But this is what we call building that case, building that preponderance of evidence.
[09:22.330 --> 09:27.990]  So how many people actually knew that each little icon is not just, this is the software they're using.
[09:28.090 --> 09:30.530]  There's actually a lot more information in a lot of them.
[09:31.830 --> 09:32.270]  So...
[09:32.270 --> 09:34.670]  And also, go outside of the icons.
[09:34.690 --> 09:37.590]  As you see under other, you can see the network icon is showing.
[09:37.970 --> 09:39.870]  They're connected to a network somewhere, obviously.
[09:39.870 --> 09:41.410]  You know, that tells you a little bit more.
[09:42.530 --> 09:42.930]  Um...
[09:42.930 --> 09:43.290]  I'm sorry?
[09:45.370 --> 09:47.110]  Yeah, actually, very good point.
[09:47.230 --> 09:47.530]  Absolutely.
[09:47.990 --> 09:48.390]  And...
[09:48.950 --> 09:53.470]  Again, this is gonna fall under the, might be important, might not be, but the timestamp.
[09:54.010 --> 09:56.090]  The timestamp on this was 337.
[09:56.950 --> 10:00.450]  We're gonna see if the timestamp is what's on the clock on the wall.
[10:01.270 --> 10:01.670]  Or...
[10:01.670 --> 10:02.530]  Or what about...
[10:02.530 --> 10:02.810]  Think...
[10:02.810 --> 10:03.210]  What about this?
[10:03.310 --> 10:04.710]  What if that timestamp didn't say 13?
[10:04.790 --> 10:06.330]  What if it said 1537?
[10:07.150 --> 10:07.510]  Military.
[10:07.710 --> 10:08.590]  Somebody's doing military.
[10:08.590 --> 10:09.190]  Why would...
[10:09.190 --> 10:11.310]  You know, what kind of person would use military time?
[10:11.810 --> 10:12.250]  You know?
[10:12.410 --> 10:12.630]  Just...
[10:12.630 --> 10:13.430]  Just things like that.
[10:13.990 --> 10:14.850]  Some people might.
[10:14.930 --> 10:16.190]  Some people might have reasons to do.
[10:18.150 --> 10:18.510]  Um...
[10:18.510 --> 10:19.170]  So...
[10:19.170 --> 10:20.470]  And actually, that's a little Easter egg.
[10:20.550 --> 10:23.210]  And if anybody knows that, you can come up to me afterwards.
[10:23.510 --> 10:25.290]  337 has some significance to us.
[10:26.070 --> 10:28.210]  Not one 337, but 337.
[10:29.230 --> 10:32.110]  If you look on your phone keypad, you'll figure that out, maybe.
[10:32.770 --> 10:33.550]  Alright, so...
[10:33.550 --> 10:34.730]  First one, I kinda walked through.
[10:34.810 --> 10:37.170]  This one, I'm gonna kinda throw out and let everybody play along with this.
[10:37.170 --> 10:39.450]  Again, first of all, operating system.
[10:40.430 --> 10:41.350]  Windows XP.
[10:41.490 --> 10:41.890]  There you go.
[10:42.550 --> 10:43.810]  Uh, what kind of hardware do you see?
[10:44.130 --> 10:45.090]  Wireless network.
[10:45.410 --> 10:46.370]  Wireless network.
[10:47.690 --> 10:48.710]  That's not connected.
[10:49.590 --> 10:50.070]  That's not connected.
[10:50.550 --> 10:50.970]  Right.
[10:52.210 --> 10:52.490]  Right.
[10:52.930 --> 10:53.290]  Right.
[10:54.450 --> 10:55.810]  It's running on battery power.
[10:55.950 --> 10:56.730]  It is not plugged in.
[10:56.950 --> 10:57.370]  Good point.
[10:57.550 --> 10:57.710]  Yep.
[11:03.520 --> 11:06.640]  Well, actually, I'm gonna go with that.
[11:06.640 --> 11:07.120]  That is not.
[11:07.300 --> 11:09.360]  But you're on the right track of something else here.
[11:10.100 --> 11:10.460]  That...
[11:10.980 --> 11:11.680]  That is actually...
[11:12.440 --> 11:18.380]  And if anybody here is very familiar with Dell, that's the application that'll ship with all the Dells for their built-in internal card.
[11:19.660 --> 11:21.200]  And, I purposely did this.
[11:21.260 --> 11:22.620]  This is very, very...
[11:22.620 --> 11:22.960]  You probably...
[11:22.960 --> 11:25.580]  I don't even know if you can see it well on the overhead out here, but...
[11:26.200 --> 11:28.000]  You might notice that the wallpaper...
[11:28.000 --> 11:29.860]  I purposely clipped off some of the wallpaper.
[11:31.460 --> 11:31.780]  That...
[11:31.780 --> 11:32.680]  Yeah, you guys can't see.
[11:32.820 --> 11:34.920]  But, from the wallpaper you can learn a lot as well.
[11:35.020 --> 11:36.540]  This is actually the default Dell wallpaper.
[11:37.400 --> 11:40.700]  This is a brand new laptop I was setting up for work.
[11:42.060 --> 11:43.180]  And, if you know...
[11:43.180 --> 11:49.140]  Again, if you're familiar with Dell and a lot of people roll them out at their jobs or whatever, you can recognize a lot of the Dell things that come along with it.
[11:49.140 --> 11:50.260]  I was gonna say...
[11:52.110 --> 11:52.870]  Oh, yeah.
[11:53.050 --> 11:54.690]  See, we'll jump straight to software.
[11:54.810 --> 11:55.410]  That's a great one.
[11:55.530 --> 11:56.990]  The icon on the far left.
[11:57.770 --> 11:58.570]  Does that...
[11:58.570 --> 12:03.330]  Now, building with our case that we're building up here, does that fall in line with what I just said?
[12:03.330 --> 12:04.390]  A new laptop.
[12:04.390 --> 12:08.570]  It's been pre-installed with Outlook, but they haven't activated it yet.
[12:08.910 --> 12:09.890]  So, see, we're building...
[12:09.890 --> 12:10.970]  Okay, this is a new laptop.
[12:11.270 --> 12:11.630]  You know?
[12:11.730 --> 12:16.590]  So, you're getting a case of exactly what kind of user, who the person using this is.
[12:17.310 --> 12:19.570]  I'm gonna pull out my watch here.
[12:21.550 --> 12:22.930]  So, what other software do you see on there?
[12:27.210 --> 12:28.090]  Very obscure one.
[12:28.190 --> 12:28.450]  That's a good one.
[12:28.450 --> 12:29.770]  Anybody else pick that one up?
[12:30.310 --> 12:33.390]  Do you know what a download manager, what the goal of a download manager is?
[12:34.590 --> 12:46.530]  Download manager, in most cases, and in this case, which helps build a profile of this user, is if you're downloading something on an unstable network and it crashes halfway through, you don't want to have to start all over again.
[12:46.670 --> 12:48.650]  You want it to automatically pick up where it left off.
[12:48.650 --> 12:52.290]  Or you want it to open up multiple channels and try to pull it faster, et cetera, et cetera.
[12:53.470 --> 12:56.770]  So, what kind of person would need such a thing?
[12:57.050 --> 12:57.370]  You know?
[12:57.390 --> 12:58.710]  It might be a where's puppy.
[12:58.850 --> 12:59.030]  I don't know.
[12:59.110 --> 13:00.530]  It could be...
[13:00.530 --> 13:02.290]  Probably a business person who works at home.
[13:03.130 --> 13:03.630]  Right there.
[13:03.670 --> 13:04.070]  You got it.
[13:04.290 --> 13:05.290]  I'll sit in my...
[13:05.290 --> 13:06.550]  This, again, is from my laptop.
[13:06.690 --> 13:07.330]  I'll go ahead and tell you now.
[13:07.330 --> 13:08.850]  We're putting that case together that shows.
[13:09.170 --> 13:11.770]  This was from a laptop that I was setting up for work.
[13:11.770 --> 13:14.950]  I was sitting at home watching TV in my living room on my wireless.
[13:15.190 --> 13:17.030]  And I was downloading all the updates and everything.
[13:17.130 --> 13:17.790]  And I didn't want to lose them.
[13:17.850 --> 13:19.350]  So, that's one of the first things I installed on here.
[13:19.590 --> 13:20.830]  One other icon right there.
[13:21.030 --> 13:22.070]  Second one from the left.
[13:23.690 --> 13:24.590]  Again, Dell.
[13:24.790 --> 13:26.610]  If you recognize the Dell, that comes with...
[13:26.610 --> 13:29.630]  That's that damn annoying Dell alert that you...
[13:30.130 --> 13:32.610]  I won't even go into a rant on that thing.
[13:34.330 --> 13:35.690]  Sound, obviously, the speakers.
[13:35.810 --> 13:36.410]  Microsoft Money.
[13:36.990 --> 13:39.150]  Microsoft Money came pre-installed as well.
[13:39.350 --> 13:39.930]  But if...
[13:39.930 --> 13:44.490]  We already know this is a pre-installed system, but Money's kind of a more indication of more of a home user, wouldn't it be?
[13:45.190 --> 13:47.150]  A business isn't really going to use Microsoft Money.
[13:47.430 --> 13:50.050]  They're going to use some more professional accounting package of some kind.
[13:50.130 --> 13:52.830]  So, Microsoft Money could be a student, maybe, something like that.
[13:52.930 --> 13:57.310]  But, I mean, out of this room of hackers, how many of you have Microsoft Money installed?
[13:58.490 --> 13:58.830]  Yeah.
[13:59.050 --> 14:01.190]  So, you can eliminate certain groups of people.
[14:01.190 --> 14:03.710]  And that's, again, the point of the whole presentation.
[14:03.710 --> 14:05.990]  So, the conclusion, I've already kind of told you.
[14:06.150 --> 14:12.810]  Again, the timestamp in this case, not a whole lot of significance, but it tells you what time I took the screenshot, obviously.
[14:14.010 --> 14:15.510]  But, yeah, it's a pretty good case.
[14:15.610 --> 14:18.810]  And everybody sees all the evidence is there of what I described.
[14:18.810 --> 14:21.390]  This is me sitting there installing a brand-new computer.
[14:21.550 --> 14:22.330]  Can you also tell the
[14:26.610 --> 14:26.830]  difference?
[14:28.670 --> 14:29.030]  I...
[14:29.030 --> 14:30.490]  Well, that's a temporary.
[14:30.650 --> 14:32.870]  Yes, that's absolutely a good point.
[14:32.870 --> 14:35.470]  In this case, it was just temporary because I was playing around with it.
[14:35.830 --> 14:39.170]  But, yeah, since that can be easily turned off and on, yeah.
[14:39.330 --> 14:41.970]  But it's absolutely one of those things you list.
[14:42.170 --> 14:47.750]  When I go back to that slide I showed at the beginning of making that case, that could be maybe a plus one or a minus one.
[14:47.830 --> 14:52.690]  And kind of build all those and go in that direction until you get a good profile of where you're going.
[14:53.210 --> 14:56.610]  Now, this isn't just for the taskbar, obviously.
[14:56.610 --> 14:59.290]  This can be used for anything you see on the screen.
[14:59.430 --> 15:02.410]  And this one, again, Windows XP, obviously.
[15:02.930 --> 15:04.190]  But what programs do you see?
[15:04.270 --> 15:04.670]  Can anybody...
[15:04.670 --> 15:06.790]  I don't know if you guys can see that, especially maybe in the back.
[15:07.250 --> 15:09.450]  So, maybe somebody up front can kind of help us out here.
[15:09.590 --> 15:14.490]  But some programs on there that maybe stand out as different.
[15:14.630 --> 15:16.550]  Like Microsoft Office isn't exactly different.
[15:16.550 --> 15:19.130]  But, for example, you probably see on here...
[15:19.130 --> 15:19.850]  Power Toys.
[15:20.130 --> 15:20.950]  Power Toys.
[15:21.130 --> 15:23.070]  Okay, what kind of person has Power Toys installed?
[15:23.390 --> 15:24.890]  You know?
[15:25.350 --> 15:26.970]  A power user of some kind.
[15:27.170 --> 15:31.690]  That's not something that, you know, the receptionist is going to have installed on her computer or something like that.
[15:33.150 --> 15:33.950]  You see...
[15:34.810 --> 15:36.430]  Okay, how about Nero 7?
[15:38.290 --> 15:40.470]  Why would you have that installed if you don't have a CD burner?
[15:40.530 --> 15:42.790]  You just got a clue about hardware from the software once again.
[15:43.070 --> 15:43.870]  What does it mean?
[15:43.870 --> 15:46.570]  Again, maybe nothing, but keep it in context.
[15:47.430 --> 15:47.870]  Um...
[15:47.870 --> 15:48.210]  iTunes.
[15:48.610 --> 15:49.490]  Do you see iTunes there?
[15:50.110 --> 15:50.310]  Yeah.
[15:51.110 --> 15:52.170]  Possibly they have an iPod?
[15:53.010 --> 15:53.410]  Yeah.
[15:54.150 --> 15:54.590]  Maybe?
[15:54.850 --> 15:55.750]  Actually, probably not.
[15:55.930 --> 15:57.050]  It comes with...
[15:57.050 --> 15:58.210]  What's it called now?
[15:58.290 --> 15:58.790]  That's what I...
[15:58.790 --> 15:59.450]  That's exactly...
[15:59.450 --> 16:01.130]  That was my trick question.
[16:01.170 --> 16:02.150]  I've got it in the notes here.
[16:02.290 --> 16:03.650]  That's a total red herring.
[16:03.770 --> 16:05.470]  That's why you want to enumerate all of them.
[16:05.570 --> 16:06.930]  Don't depend on any one thing.
[16:07.130 --> 16:09.010]  When you install that stupid...
[16:09.010 --> 16:09.590]  QuickTime.
[16:09.770 --> 16:12.310]  QuickTime, it automatically puts that iTunes in there now.
[16:12.310 --> 16:14.250]  So, ah, see, that's a tricky one right there.
[16:16.270 --> 16:16.590]  Um...
[16:16.590 --> 16:17.250]  How about...
[16:17.250 --> 16:17.910]  Let's see, what else?
[16:18.070 --> 16:20.450]  I don't want to spend too much time on it, but, um...
[16:20.830 --> 16:21.870]  Palm thing at the bottom.
[16:22.090 --> 16:23.310]  Palm thing at the bottom, right.
[16:23.570 --> 16:32.710]  Now, as far as I know, that doesn't installed by default with anything, but it probably means somebody has some sort of Palm device that they use with their laptop.
[16:36.930 --> 16:37.930]  And they...
[16:37.930 --> 16:41.630]  Obviously, we know that that comes with, um, Windows XP.
[16:41.910 --> 16:50.750]  You can use the built-in command line or Internet Explorer or, you know, any browser will support FTP, but this person went above and beyond to get an FTP program for some reason.
[16:50.750 --> 16:52.990]  You want to see what order they installed things in.
[16:54.790 --> 16:56.030]  Actually, I'd never heard that.
[16:56.090 --> 16:56.670]  That's a good point.
[16:56.790 --> 16:57.450]  Yeah, absolutely.
[16:57.990 --> 16:58.350]  Absolutely.
[16:58.430 --> 17:01.010]  Because they're completely by default order.
[17:01.990 --> 17:05.270]  Of course, you can go in and alphabetize them and sort them or whatever.
[17:05.390 --> 17:06.610]  But yeah, in this case, I did not do that.
[17:06.670 --> 17:07.810]  That's a very good point.
[17:07.850 --> 17:08.550]  I didn't catch that.
[17:09.230 --> 17:09.950]  They've got...
[17:09.950 --> 17:11.290]  This person might be paranoid.
[17:12.090 --> 17:14.170]  They've got a couple of antivirus on there.
[17:18.960 --> 17:19.280]  Um...
[17:19.280 --> 17:20.940]  Man, you guys are throwing out all kinds of stuff.
[17:24.840 --> 17:26.400]  Oh, man, you guys are so...
[17:26.400 --> 17:26.760]  I don't even...
[17:26.760 --> 17:27.800]  You guys could give the presentation.
[17:27.800 --> 17:28.540]  You're doing great.
[17:28.540 --> 17:29.200]  You're naming...
[17:29.200 --> 17:30.920]  Every one of these little things, like...
[17:33.360 --> 17:34.340]  Throw them on the desktop.
[17:34.520 --> 17:35.080]  That's me.
[17:35.340 --> 17:35.880]  Move it later.
[17:36.200 --> 17:37.360]  Put it on the desktop for now.
[17:37.600 --> 17:38.720]  But not only that, if...
[17:38.720 --> 17:43.540]  And again, I know people can't read some of the file names, but if you can look, you can see, like, the...
[17:44.760 --> 17:46.620]  At the very top, there's an MP3 file.
[17:47.280 --> 17:47.440]  Yeah.
[17:48.060 --> 17:49.100]  Does anybody know that icon?
[17:49.280 --> 17:50.160]  What it's associated with?
[17:50.720 --> 17:50.740]  Winamp.
[17:50.740 --> 17:50.940]  Winamp.
[17:51.600 --> 17:52.860]  Everybody recognizes that, probably.
[17:52.980 --> 17:56.460]  They probably have a Winamp recreational link.
[17:56.600 --> 17:57.100]  Got it.
[17:57.440 --> 18:01.400]  I was going to say the icon is a check piece, but I think it's typically the owner account.
[18:01.560 --> 18:03.980]  The first account has a computer, so it's all done.
[18:04.640 --> 18:05.000]  Maybe.
[18:05.200 --> 18:06.460]  That's actually random.
[18:06.780 --> 18:08.420]  It'll randomly assign you something when you...
[18:08.420 --> 18:08.540]  Yeah.
[18:08.780 --> 18:10.400]  So, that could be anything.
[18:11.440 --> 18:12.160]  Look at the...
[18:12.160 --> 18:13.620]  And again, I know some of you can't see the file.
[18:13.620 --> 18:16.880]  The file names, but the file names on a couple of those MP3s.
[18:18.300 --> 18:19.560]  You may not recognize it.
[18:19.640 --> 18:21.760]  DJ Snyder space something there.
[18:23.030 --> 18:23.740]  F Bill.
[18:23.900 --> 18:24.760]  F Bill Radio.
[18:25.400 --> 18:26.100]  Anybody know?
[18:27.180 --> 18:32.520]  May not know what that is from looking at the screenshot, but you can go and search for it later on your search engine of choice.
[18:32.700 --> 18:33.640]  We won't mention the G word.
[18:34.490 --> 18:36.800]  Whatever your search engine of choice is, and find out.
[18:36.940 --> 18:39.880]  And now you're building not only a profile of the computer, but even more of the person.
[18:39.880 --> 18:41.140]  They're into this type of music.
[18:41.400 --> 18:43.240]  They listen to these particular shows.
[18:43.580 --> 18:44.080]  What if...
[18:44.080 --> 18:45.540]  You can get a screen name right there, too.
[18:45.740 --> 18:45.980]  Yeah.
[18:46.180 --> 18:46.860]  Well, yeah.
[18:47.800 --> 18:48.860]  That gives it away, too.
[18:49.120 --> 18:52.540]  But, I mean, I could make up a screen name with your handle on it just as easily.
[18:52.660 --> 18:53.380]  That's not, you know...
[18:53.750 --> 18:54.280]  But, yeah.
[18:54.420 --> 18:54.780]  Absolutely.
[18:54.920 --> 18:55.660]  There's so many things.
[18:55.760 --> 18:57.760]  Some of them are more obvious than others like that, of course.
[18:58.180 --> 18:59.400]  I put another little...
[18:59.400 --> 19:07.040]  Not an Easter egg, but if you notice in the bottom right, I have a window open in my taskbar that's G, Miss, and then Art of Deduction, which is the name of the presentation.
[19:07.540 --> 19:10.620]  So, G Drive, that's not something that's normally mapped by default.
[19:10.740 --> 19:12.060]  You've got a lot of drives if you're up to G.
[19:12.320 --> 19:17.500]  So, this is probably on maybe an external card or mapped to a drive on a network somewhere.
[19:17.960 --> 19:18.940]  You know, just little things.
[19:18.980 --> 19:23.100]  Now you've built up somebody who has network access, who's a power user, who has all these things installed.
[19:33.940 --> 19:34.300]  Right.
[19:36.120 --> 19:36.480]  Absolutely.
[19:37.720 --> 19:39.700]  Well, and like, and I don't know if...
[19:39.700 --> 19:43.480]  This is maybe a little obscure, but Windows Explorer, if you notice, is on my...
[19:43.480 --> 19:47.800]  Anything above that line, you see there's four things.
[19:47.920 --> 19:51.420]  Mozilla Firefox, Thunderbird, Media Player, and Windows Explorer.
[19:51.680 --> 19:53.360]  Windows Explorer doesn't go on there by default.
[19:53.900 --> 19:55.640]  Somebody went out of their way to put that there.
[19:55.940 --> 19:59.360]  So, in my case, I go browse my files directly a lot, so I put that there.
[19:59.420 --> 20:01.060]  But what if you would have seen that accounting software?
[20:01.940 --> 20:04.200]  Somebody's using this almost exclusively for...
[20:04.200 --> 20:07.200]  They use it so much that they're gonna put it right up at the top where it doesn't move.
[20:07.460 --> 20:10.120]  The ones below the line rotate based on use.
[20:10.740 --> 20:11.020]  So...
[20:18.410 --> 20:20.930]  Hey, and what kind of user might use Notepad?
[20:25.630 --> 20:25.990]  Well...
[20:26.470 --> 20:36.410]  And actually, here's another thing I didn't really think about, but you guys are giving me ideas too, is if you look through a lot of these applications, you're seeing quite a few pieces of different shareware, open source software and stuff.
[20:36.410 --> 20:39.830]  So this person obviously gets around and knows how to get what they want.
[20:39.990 --> 20:40.290]  So...
[20:40.290 --> 20:42.490]  Yeah, I mean, we could sit here and there's a ton...
[20:42.490 --> 20:45.750]  Do you see how this kind of build up and how fun and putting all these things together?
[20:46.210 --> 20:48.810]  So we're gonna move on to a couple others here.
[20:49.090 --> 20:50.330]  How about your browser window?
[20:50.510 --> 20:51.150]  And we're gonna go...
[20:51.150 --> 20:53.250]  We're gonna start going through these a little bit more quickly, because you get...
[20:53.250 --> 20:54.490]  Everybody's obviously gotten the point.
[20:54.570 --> 20:55.330]  I mean, you guys are beating me.
[20:55.430 --> 20:56.630]  You're giving me stuff I didn't find before.
[20:56.810 --> 20:57.110]  So...
[20:57.110 --> 20:59.010]  So you guys have probably got this down.
[20:59.410 --> 21:01.470]  But there's also some fun things in here.
[21:01.970 --> 21:04.490]  First of all, the browser and operating system that is being used.
[21:04.570 --> 21:06.810]  We know some browsers don't work on certain operating systems.
[21:06.950 --> 21:08.150]  So that helps isolate it.
[21:09.290 --> 21:09.730]  But...
[21:09.730 --> 21:11.530]  This person isn't that tech savvy.
[21:11.650 --> 21:13.350]  Otherwise they wouldn't have all those toolbars.
[21:13.510 --> 21:13.650]  Yeah.
[21:16.050 --> 21:16.430]  Unless...
[21:18.930 --> 21:19.370]  Unless...
[21:19.370 --> 21:19.690]  Unless...
[21:20.870 --> 21:23.970]  Unless they were purposely setting up a screenshot for this presentation.
[21:27.070 --> 21:27.550]  Um...
[21:29.450 --> 21:30.150]  Branded browser.
[21:30.750 --> 21:31.810]  It's a branded browser.
[21:32.110 --> 21:32.250]  Branded browser, brand that.
[21:32.350 --> 21:33.170]  Branded browser, brand that.
[21:33.170 --> 21:34.190]  Branded by Comcast.
[21:34.330 --> 21:37.010]  So we know what cable network this person uses, their cable modem.
[21:37.130 --> 21:39.170]  Probably a hacker, is it got BinRev on his toolbar.
[21:39.530 --> 21:40.010]  Man!
[21:40.670 --> 21:42.770]  Doesn't everybody have BinRev on their toolbar?
[21:43.870 --> 21:44.350]  No?
[21:44.570 --> 21:45.250]  Not yet?
[21:47.450 --> 21:48.410]  BinRev.com.
[21:48.510 --> 21:48.970]  Check it out.
[21:49.170 --> 21:52.090]  You can download this presentation from my site, stankdawg.com.
[21:52.090 --> 21:57.870]  All the stuff, all the articles I've had in 2600, sorry, side note advertising, Doc Droppers, et cetera, et cetera.
[21:58.010 --> 21:58.510]  I'm sorry, go ahead.
[22:01.770 --> 22:01.950]  Yeah.
[22:03.990 --> 22:05.770]  Kind of squished this.
[22:08.510 --> 22:09.510]  Squished this all down.
[22:09.990 --> 22:13.310]  Here's a couple other little things besides, yeah, you see the links and the plug-ins.
[22:14.410 --> 22:15.870]  Take a look at, for example...
[22:17.570 --> 22:21.030]  Yeah, you know, wow, that's really good.
[22:21.150 --> 22:22.670]  Yeah, that's absolutely right.
[22:25.090 --> 22:25.930]  Notice how many...
[22:25.930 --> 22:27.490]  Okay, so let's look at the individual toolbars.
[22:27.590 --> 22:31.030]  And this is where at the very beginning I said the more experience you have and the more things you recognize.
[22:32.010 --> 22:35.590]  The Google toolbar, if you have some experience with it, you see it's got the pop-up blocker.
[22:35.790 --> 22:38.230]  And it's blocked a lot of stuff.
[22:38.470 --> 22:39.310]  See, I caught myself there.
[22:39.410 --> 22:40.130]  A lot of stuff.
[22:41.130 --> 22:42.770]  So they've had it installed for a while.
[22:43.090 --> 22:44.350]  You know, this isn't a new computer.
[22:44.410 --> 22:46.670]  So somebody can't say, oh, no, I just installed this.
[22:46.750 --> 22:48.270]  Oh, no, you've had it for a while.
[22:49.190 --> 22:51.530]  Either that or you're going to a lot of prawn sites with pop-up.
[22:52.870 --> 22:53.770]  That's not me, though.
[22:55.310 --> 22:58.090]  They let the tools install themselves in their own bars.
[22:58.210 --> 22:59.870]  Otherwise, that would be more organized.
[23:00.630 --> 23:03.690]  You probably have a lot of spyware and adware.
[23:04.430 --> 23:06.950]  They're paranoid of spyware and adware, absolutely.
[23:07.470 --> 23:10.570]  Look over on the far right-hand side of the Google toolbar.
[23:10.730 --> 23:11.350]  You see Snagit.
[23:11.350 --> 23:13.770]  Does anybody know what Snagit software is?
[23:14.270 --> 23:15.610]  Screen capturing software.
[23:16.670 --> 23:17.970]  So this person has a reason to do that.
[23:18.090 --> 23:23.410]  Maybe they make screen captures of videos, recordings for something like, I don't know, hacktv.org.
[23:23.890 --> 23:24.230]  Pimp, pimp.
[23:24.350 --> 23:26.650]  Boy, I'm getting a lot of publicity in here.
[23:28.950 --> 23:29.690]  Product placement.
[23:29.810 --> 23:30.110]  That's the word.
[23:30.210 --> 23:31.530]  I was struggling for the word there.
[23:31.650 --> 23:32.230]  Product placement.
[23:32.230 --> 23:37.690]  The Yahoo toolbar actually gives you a little bit more focused target.
[23:37.830 --> 23:39.250]  This is actually some useful stuff here.
[23:39.770 --> 23:40.690]  And again, it's experience.
[23:40.850 --> 23:43.110]  You know what comes with default with the Yahoo toolbar.
[23:43.430 --> 23:47.470]  By default with Yahoo, it doesn't put these things over here like fantasy sports.
[23:47.750 --> 23:51.070]  This user gets into fantasy sports for some reason.
[23:51.230 --> 23:54.050]  And that kind of narrows it down to a lot of people, especially in hackers.
[23:54.690 --> 23:57.390]  Am I the only fantasy sports here in the hacking community?
[23:57.610 --> 23:57.690]  Okay.
[23:58.050 --> 23:58.790]  Okay, one more.
[23:59.030 --> 24:00.870]  So that narrows it down a lot as well.
[24:00.870 --> 24:03.550]  So, again, a lot of stuff.
[24:03.850 --> 24:05.890]  Actually, a couple more obscure ones just for the heck of it.
[24:05.950 --> 24:08.450]  In the very top, there's...
[24:08.450 --> 24:10.110]  You see the...
[24:10.110 --> 24:11.330]  Gosh, I need a laser pointer.
[24:11.730 --> 24:16.810]  The very top there, the ones on the far right, looks like the AOL icon guy there.
[24:16.910 --> 24:18.010]  And there's a couple other between us.
[24:18.010 --> 24:18.950]  Anybody recognize those?
[24:19.710 --> 24:21.570]  You use a lot of Instagram from that.
[24:21.670 --> 24:22.470]  Yeah, they probably...
[24:22.470 --> 24:23.750]  Yep, they've got MSN on there.
[24:23.970 --> 24:25.910]  The little dollar sign right there.
[24:26.570 --> 24:27.290]  Party poker.
[24:28.070 --> 24:28.470]  No?
[24:28.990 --> 24:31.110]  So this is somebody who's online playing poker.
[24:31.690 --> 24:33.210]  Someone has trillion and...
[24:33.210 --> 24:33.570]  Which...
[24:33.570 --> 24:34.370]  And that narrows it down.
[24:35.210 --> 24:37.110]  Yeah, and well, you know, and put...
[24:37.110 --> 24:39.270]  Now that we've got this big footprint, now let's step back again.
[24:39.310 --> 24:40.550]  Let's do the analysis part of it.
[24:40.670 --> 24:45.650]  We can kind of tell what type of user it is, but we've got enough in just this one to really pinpoint.
[24:45.650 --> 24:49.510]  We know this person has a Yahoo account because they've got a Yahoo toolbar.
[24:49.650 --> 24:50.950]  They've probably got a Google account.
[24:51.570 --> 24:52.110]  Maybe not.
[24:52.170 --> 24:53.990]  It's not required for the Google toolbar, I don't think.
[24:54.090 --> 24:55.310]  Anybody correct me on that?
[24:55.310 --> 24:55.550]  I don't know.
[24:55.870 --> 24:56.130]  Okay.
[24:56.530 --> 25:02.050]  But for the Yahoo account, for you to have those custom links and stuff in there, you have to have a Yahoo account for that.
[25:02.210 --> 25:03.410]  So you've put all that together.
[25:03.410 --> 25:05.470]  You know they've got a party poker account.
[25:05.570 --> 25:06.650]  They play partypoker.net.
[25:06.730 --> 25:08.050]  So you've got all of these things.
[25:08.170 --> 25:09.350]  You've really pinpointed it down.
[25:09.490 --> 25:18.630]  If you were a detective trying to find this for real and trying to pinpoint, get the information from party poker, find it from Yahoo, put it all together, you're not going to get...
[25:18.630 --> 25:20.450]  You're going to get a pretty good handful of people.
[25:20.450 --> 25:29.530]  Knowing they're going to partypoker.com also narrows down what states they're in, because like in Washington State, it's now a federal offense to do online poker and whatnot.
[25:29.690 --> 25:29.930]  Yeah.
[25:30.670 --> 25:32.510]  See, you guys are giving me all kinds of...
[25:32.510 --> 25:35.170]  Every time I give, there's so much that no...
[25:35.170 --> 25:35.750]  You know, it's great.
[25:35.890 --> 25:36.530]  Keep coming.
[25:36.650 --> 25:37.130]  Keep them coming.
[25:37.590 --> 25:45.950]  I just wanted to mention that there's like two or three instant messaging services, and then all combined with like the mail is easily accessible.
[25:46.810 --> 25:49.650]  And then you can also see that there's a spell trigger attached.
[25:49.790 --> 25:52.450]  This person writes a lot to a lot of different people.
[25:55.700 --> 25:56.860]  Well, thank you.
[26:00.290 --> 26:00.890]  All right.
[26:01.110 --> 26:03.390]  So again, this is another one.
[26:04.310 --> 26:06.970]  Very quickly through this, because let me see how I am on time here.
[26:07.350 --> 26:08.370]  No, we're okay.
[26:09.510 --> 26:15.870]  Very quickly through this one, different browser, but still looks like Windows XP using Firefox.
[26:16.170 --> 26:17.890]  It even says multiple Firefox on there.
[26:19.290 --> 26:20.510]  Again, notice the links.
[26:20.710 --> 26:22.250]  You see the bin rev link on there.
[26:22.990 --> 26:25.330]  There's a couple other interesting things in these links.
[26:25.550 --> 26:33.970]  Now, we're getting very precise and very detailed, but I want everybody to back up and think of the overview that you're looking for specific things that you can build that case on.
[26:34.110 --> 26:36.510]  And then we're using examples to illustrate them.
[26:38.190 --> 26:40.170]  IMDB, that's an interesting link to have.
[26:40.730 --> 26:42.330]  They have three different search engines.
[26:42.470 --> 26:51.110]  It's someone who doesn't have any allegiance to one particular search engine, the big G, somebody who actually wants to mix up their searches for whatever reason.
[26:54.370 --> 26:56.390]  Tiny URL is an interesting thing to have.
[26:58.630 --> 27:03.410]  There's two on here that are really... the very next one that says, post to Meme Stream.
[27:03.590 --> 27:05.310]  Does anybody here familiar with Meme Streams?
[27:06.290 --> 27:17.450]  A good friend of mine, Decius and Rattle run a site Meme Streams, which is a social bookmarking site, kind of like Slashdot, things along those lines, based on a memetics engine.
[27:19.070 --> 27:24.770]  But that's a post to... I can go to a web page that I find interesting and click that button.
[27:24.890 --> 27:29.750]  It's a little JavaScript applet that will post that entry to my particular blog on the site.
[27:29.970 --> 27:32.230]  So this person must have a Meme Streams account.
[27:32.610 --> 27:34.630]  We've narrowed it down quite a bit once again.
[27:34.630 --> 27:41.510]  And, let's see, Wayback Machine, the very last one that says, press it, does anybody recognize that?
[27:41.650 --> 27:43.490]  I'm hoping somebody will get this one.
[27:44.670 --> 27:45.370]  Press it.
[27:47.530 --> 27:48.390]  Who said that?
[27:49.250 --> 27:50.330]  WordPress, there we go.
[27:50.810 --> 27:57.250]  WordPress, that is, same thing, if you... it's a little Java thing that will post an entry to your blog.
[27:57.590 --> 28:01.010]  And, you're not posting entries to other people's blogs, are you?
[28:01.010 --> 28:10.630]  Well, I guess in some cases you can, but mostly you're posting to your own blog, so it says right there, digital doll cut off or whatever, so that's my site.
[28:10.750 --> 28:13.570]  I've pretty much... this one pretty much nails it down to who it is again.
[28:14.450 --> 28:27.050]  Also, this person likes to navigate... they don't have a set list of sites, they have stumble upon, which is just something that goes to random sites that people have rated or not.
[28:27.550 --> 28:33.950]  So this person likes to see what's out there, he's interested in more than just what he's doing with the laptop.
[28:34.230 --> 28:34.510]  Right.
[28:35.110 --> 28:40.390]  And, if you know the stumble upon toolbar, when you do go to a site, you can post comments and things like that.
[28:40.650 --> 28:48.190]  If it's a site you've been to and added a comment, the entries on that will change, the colors will change, and you'll know that this person has been to this particular site before.
[28:48.350 --> 28:50.030]  But you haven't voted whether you liked it or not.
[28:50.030 --> 28:50.450]  Right.
[28:50.750 --> 28:50.790]  Right.
[28:50.930 --> 28:51.310]  And this...
[28:51.310 --> 28:54.170]  Yeah, this was just put on again for the screenshot.
[28:55.690 --> 28:56.050]  So...
[28:59.340 --> 28:59.700]  Yeah.
[28:59.820 --> 29:00.140]  Yep.
[29:00.760 --> 29:01.120]  Yep.
[29:01.300 --> 29:01.660]  Absolutely.
[29:02.700 --> 29:04.420]  StankDawg at gmail.com, if anybody cared.
[29:07.440 --> 29:08.840]  Again, I'll briefly go through this one.
[29:09.200 --> 29:09.560]  IRC...
[29:09.560 --> 29:12.140]  Everybody's getting the point, so I'm really going to speed up through a couple more of these.
[29:13.640 --> 29:14.720]  You know they're using...
[29:14.720 --> 29:15.480]  What client?
[29:15.620 --> 29:16.640]  They're using Merck, obviously.
[29:16.640 --> 29:21.200]  But you can see in that screenshot, you can tell what username I was using, what I was logged in as.
[29:21.280 --> 29:22.700]  So this is more like your shoulder surfing.
[29:22.960 --> 29:24.760]  You want to find out who they're logged in as.
[29:24.840 --> 29:25.480]  You see so-and-so.
[29:25.560 --> 29:26.160]  Is that so-and-so?
[29:26.240 --> 29:26.620]  What are they doing?
[29:26.820 --> 29:27.780]  There you see their username.
[29:28.020 --> 29:29.940]  You can see what server they're connected to.
[29:30.080 --> 29:31.500]  This is our BinRev server.
[29:31.580 --> 29:32.580]  You can see what channel they're in.
[29:32.720 --> 29:35.300]  I just chopped this off because it's pretty self-explanatory.
[29:35.600 --> 29:37.680]  What usernames, anything else like that.
[29:37.860 --> 29:41.400]  You can get a timestamp on this as well, depending on what the topic is.
[29:41.460 --> 29:45.460]  You see the topic of the channel is BinRev Radio 134 this Tuesday.
[29:46.600 --> 29:49.660]  So, 134 with Mark Spencer, what time frame was that?
[29:49.800 --> 29:54.120]  That was, you know, we're going to be doing 157 tonight at 11 o'clock.
[29:54.260 --> 29:56.100]  So, you know, 20-some episodes ago.
[29:56.220 --> 29:58.680]  So you can get a time frame of exactly when the screenshot was taken as well.
[29:58.780 --> 30:01.060]  If that wasn't there, well, you're on down that still.
[30:01.220 --> 30:02.760]  If they read some code, you're on down that anymore.
[30:02.880 --> 30:03.640]  Not anymore, right.
[30:04.220 --> 30:05.300]  Instant messenger clients.
[30:05.840 --> 30:10.060]  These are just replies from the first Google image search.
[30:10.520 --> 30:11.240]  All these...
[30:11.720 --> 30:13.480]  And look at all the plain usernames.
[30:13.600 --> 30:14.340]  People take screenshots.
[30:14.860 --> 30:17.480]  I mean, I could harass any one of these people if I wanted to be a jerk.
[30:17.620 --> 30:20.640]  I mean, they're posting their usernames, all their list of all their buddies.
[30:22.420 --> 30:25.300]  You know, let's think of, you know, the bad things can happen with that.
[30:25.380 --> 30:26.720]  You can go impersonate any of these people.
[30:26.820 --> 30:28.740]  You can pretend to be, oh, I'm a friend of so-and-so.
[30:28.920 --> 30:29.620]  Yeah, you know, et cetera.
[30:29.860 --> 30:32.740]  It could be dangerous to have some of that kind of stuff out there.
[30:32.740 --> 30:34.740]  But you can learn a lot of stuff from it.
[30:35.240 --> 30:35.600]  Did I do that?
[32:24.460 --> 32:27.860]  What if you actually got physical access to some of the files?
[32:28.060 --> 32:28.360]  Any better?
[32:28.780 --> 32:29.920]  What, do I have to eat the thing?
[32:30.400 --> 32:30.820]  Hello?
[32:32.660 --> 32:33.240]  Check, check.
[32:33.460 --> 32:33.760]  Any better?
[32:33.880 --> 32:33.980]  Okay.
[32:34.920 --> 32:37.460]  So, what if you actually got physical access to some of the files?
[32:37.620 --> 32:41.280]  Even if it was for temporarily getting access, grab some files, pull them off.
[32:41.600 --> 32:42.840]  Well, you look at the metadata.
[32:43.180 --> 32:46.880]  And again, a lot of people probably know about metadata, so I'm going to skim through this quickly.
[32:47.040 --> 32:50.680]  But metadata is actually data about data.
[32:50.800 --> 32:53.440]  That's the Wikipedia definition, and I think it's a great definition.
[32:53.580 --> 32:54.660]  Very simple and to the point.
[32:55.440 --> 32:56.860]  Data about data.
[32:56.860 --> 32:58.980]  So, what kind of files use metadata?
[32:59.460 --> 33:02.720]  Image files, document files, music, could be anything really.
[33:03.460 --> 33:06.940]  It's all in the file specifications and what the file contains.
[33:07.720 --> 33:09.820]  And what kind of data do they attach?
[33:10.000 --> 33:18.180]  For example, ID3 I think is a great example of this because you're going to put the author, the title, the genre, all these other, there's a lot of stuff in that ID3 tag.
[33:18.320 --> 33:19.260]  That's a form of metadata.
[33:19.480 --> 33:22.980]  It's data about the rest of the data, about that MP3 file.
[33:23.580 --> 33:25.600]  So, metadata can be really, really cool.
[33:25.600 --> 33:26.820]  XML is the rock.
[33:26.900 --> 33:27.540]  So, it's awesome.
[33:27.700 --> 33:30.380]  It's a great way to export and import data.
[33:31.980 --> 33:33.360]  And here's a really good example.
[33:33.500 --> 33:34.320]  This is a fun story.
[33:34.460 --> 33:47.180]  This is two good friends of mine, Acidus and Virgil, who did a presentation at Interzone 2 a couple of years back, the Blackboard case, where they presented some vulnerabilities in Blackboard software.
[33:47.400 --> 33:49.200]  And you can go do the research on that.
[33:49.460 --> 33:51.260]  It probably would be too in-depth to go into it here.
[33:51.260 --> 33:55.820]  But basically, they got a cease and desist because Blackboard didn't want this information released.
[33:56.560 --> 33:59.800]  Well, the cease and desist was sent in Microsoft Word format.
[34:00.760 --> 34:02.160]  So, I took the file.
[34:02.380 --> 34:03.660]  This was several years ago.
[34:03.800 --> 34:04.860]  So, I took the file.
[34:05.100 --> 34:06.040]  I opened it up.
[34:06.100 --> 34:07.260]  And I see this comment in there.
[34:07.300 --> 34:08.300]  And I don't know if anybody can read it.
[34:08.340 --> 34:11.280]  But it says, this section gets us nowhere.
[34:11.280 --> 34:12.760]  We're airing our dirty laundry.
[34:13.020 --> 34:15.260]  And this supports the notion that we picked on two kids.
[34:15.380 --> 34:16.120]  They don't have spell check.
[34:16.220 --> 34:17.000]  They couldn't spell picked right.
[34:17.200 --> 34:19.140]  We claim things and they deny them.
[34:19.640 --> 34:22.020]  Way to embed embarrassing stuff in there.
[34:22.140 --> 34:23.040]  And I have the...
[34:23.940 --> 34:25.160]  We won't call that XML.
[34:25.320 --> 34:27.620]  That's Microsoft's bastardized XML.
[34:27.940 --> 34:28.720]  We won't go there.
[34:29.280 --> 34:32.460]  To show that that's actually embedded in that data.
[34:33.180 --> 34:36.800]  And I can go in there and look at the properties of that document file.
[34:36.860 --> 34:37.960]  And I can tell the author.
[34:39.260 --> 34:40.580]  This was the second revision.
[34:40.720 --> 34:41.920]  So, probably the secretary typed it.
[34:41.980 --> 34:42.640]  Handed it to the lawyer.
[34:42.740 --> 34:43.600]  He added his little comments.
[34:43.720 --> 34:44.800]  And then made a fool of himself.
[34:45.040 --> 34:46.280]  I can tell the company name.
[34:46.420 --> 34:48.160]  Hope they don't come after me now because of that.
[34:49.000 --> 34:50.240]  But it's public information.
[34:50.400 --> 34:51.060]  It's out there on Google.
[34:51.180 --> 34:51.900]  You can find it anywhere.
[34:52.300 --> 34:53.440]  Tells the date that it's created.
[34:53.520 --> 34:55.060]  They can't deny that they didn't say this.
[34:55.180 --> 34:56.920]  They can't deny that this isn't a file from them.
[34:57.140 --> 34:58.600]  It's right there in plain text.
[34:58.640 --> 35:01.380]  And it's not really much they can say to deny it.
[35:04.920 --> 35:05.520]  True.
[35:05.820 --> 35:05.980]  True.
[35:06.140 --> 35:08.140]  You can artificially change metadata.
[35:08.540 --> 35:14.720]  But you can get into deeper levels of forensics to prove real actual dates.
[35:15.080 --> 35:15.680]  And things like that.
[35:15.920 --> 35:16.740]  That's totally...
[35:16.740 --> 35:19.600]  Could be a whole presentation in and of itself.
[35:19.880 --> 35:22.660]  But it's pretty damning evidence.
[35:22.820 --> 35:23.700]  We'll put it like that.
[35:24.160 --> 35:36.540]  Actually, stacks of the remediate data actually went against the prosecuting attorney that they were doing.
[35:37.180 --> 35:38.480]  Because they didn't realize,
[35:43.230 --> 35:45.010]  you know, just opened it up by taking a viewer.
[35:50.530 --> 35:58.070]  Even if you don't turn trains tracking or whatever that thing is on, every time you pass something back and forth, Microsoft is logging all that stuff.
[35:58.070 --> 36:00.590]  Microsoft Office doc format or whatever.
[36:00.770 --> 36:02.810]  I don't know how terminology to explain it.
[36:02.930 --> 36:04.050]  But it logs all that stuff.
[36:04.190 --> 36:05.190]  And here's a neat little trick.
[36:05.290 --> 36:06.090]  If you ever find...
[36:06.090 --> 36:07.650]  I found this with someone at work one time before.
[36:08.170 --> 36:11.650]  They had this file that was about three or four pages long, but it was ten megs.
[36:12.230 --> 36:14.030]  And they're asking me, why is this file so big?
[36:14.070 --> 36:15.250]  It's only a couple pages long.
[36:16.210 --> 36:18.970]  So, copy and paste that text out, put it in a new file, send it back.
[36:19.070 --> 36:19.350]  Here it is.
[36:19.510 --> 36:19.950]  It's cleaned up.
[36:20.070 --> 36:24.370]  And then I, you know, look to see what's really in the file that's taking up this ten megs because it's data.
[36:24.510 --> 36:29.670]  It's not, you know, it's all these undoes and all these iterations of stuff they had done in the past.
[36:29.850 --> 36:33.170]  So, lots of stuff that's kept in the document.
[36:33.350 --> 36:36.150]  And there are tools out there if you're worried or concerned about that.
[36:36.190 --> 36:36.910]  You should always go through.
[36:37.050 --> 36:37.790]  There's tools you can download.
[36:37.950 --> 36:42.850]  I think even Microsoft caved in and made one that will strip a lot of that metadata out for privacy reasons.
[36:44.890 --> 36:45.430]  Let's see.
[36:45.690 --> 36:48.490]  EXIF properties in Windows XP.
[36:48.650 --> 36:49.590]  The screenshot we have here.
[36:49.710 --> 36:50.710]  Metadata in photos.
[36:51.370 --> 36:52.610]  Again, you're building a case.
[36:52.770 --> 36:54.210]  So, I'm not going to spend too much time on this.
[36:54.310 --> 36:55.970]  But you can see the equipment make.
[36:57.010 --> 36:58.210]  It's stamped in there by default.
[36:58.330 --> 36:58.990]  The camera model.
[36:59.210 --> 37:00.910]  That's the type of camera the person used.
[37:01.130 --> 37:10.890]  So, if someone can't claim they didn't take this picture of that picture, you got some nasty prawn and they come pounding on your doors and you're not going to say you didn't take it.
[37:10.990 --> 37:11.970]  If you've got the camera model.
[37:12.130 --> 37:12.550]  It's dated.
[37:12.730 --> 37:13.350]  It's time stamped.
[37:14.010 --> 37:16.210]  Notice at the bottom there's author and keywords.
[37:16.390 --> 37:17.050]  Those are optional.
[37:17.370 --> 37:22.150]  But if somebody actually put those in and synced it with their camera, it's going to stamp that in there as well.
[37:22.290 --> 37:23.470]  And now you've really damned yourself.
[37:23.990 --> 37:25.230]  But the other funny thing.
[37:25.390 --> 37:26.190]  I'll throw this out.
[37:26.270 --> 37:27.950]  I'm not going to give any examples of this.
[37:28.450 --> 37:29.690]  But another funny thing.
[37:29.810 --> 37:30.650]  I did find some.
[37:32.290 --> 37:39.630]  You go to someone's site and find they've got pictures of their vacation and their kids sledding in the winter and smiles.
[37:40.450 --> 37:46.630]  And then somewhere else they've got those private pictures with their wife that they put on some site they didn't think anybody would ever find.
[37:46.850 --> 37:52.550]  But coming from the same time frame, same camera type, same author tagged in there.
[37:52.730 --> 37:55.050]  You can get yourself in some embarrassing situations.
[37:56.470 --> 37:58.030]  So, again, date, time, pinpoint.
[37:58.610 --> 37:59.410]  Some of the general...
[37:59.410 --> 38:01.190]  Again, circumstantial evidence.
[38:02.010 --> 38:03.950]  But never give them any more information.
[38:03.950 --> 38:06.650]  And this is something that I talk about on the radio show a lot.
[38:06.730 --> 38:08.970]  Never voluntarily give more information than you have to.
[38:09.210 --> 38:10.570]  Those things are blank by default.
[38:10.750 --> 38:11.770]  Don't put in your author name.
[38:12.190 --> 38:16.450]  You don't really have any reason to unless you're a professional photographer, you want to copyright it or something like that.
[38:17.290 --> 38:19.570]  But you should be making creative comments.
[38:19.670 --> 38:21.010]  Now here's one example that I made up.
[38:21.570 --> 38:26.790]  One other thing that's kept in metadata is thumbnails sometimes.
[38:27.210 --> 38:29.110]  So, this is a good example.
[38:29.210 --> 38:32.610]  My very good friend Elonka, who I'm going to bump into here in a week or two.
[38:33.130 --> 38:34.070]  Good friend Elonka.
[38:34.190 --> 38:37.470]  This is a picture of her from Phreaknic conference down in the southeast.
[38:38.310 --> 38:39.410]  Thumbnail of the image.
[38:39.490 --> 38:40.790]  Now you see the image name up there.
[38:43.010 --> 38:43.450]  IMG0102001.
[38:43.610 --> 38:46.370]  And it tells all of the properties of that image.
[38:47.350 --> 38:50.250]  Well, notice that thumbnail in the bottom right corner.
[38:50.250 --> 38:52.190]  That's embedded in the metadata.
[38:52.350 --> 38:53.830]  That is part of the image.
[38:54.390 --> 38:54.810]  Okay.
[38:55.430 --> 38:56.890]  Now we're going to go to the next screen.
[38:57.490 --> 38:59.450]  I open this up and I edit it.
[38:59.710 --> 39:02.030]  And I, my graphic skills are the suck sore.
[39:02.230 --> 39:06.290]  So, all I could do was type a big white box over there that says we love Elonka.
[39:07.050 --> 39:08.070]  But I did save it.
[39:08.150 --> 39:08.650]  That is an edit.
[39:08.750 --> 39:09.610]  That's a change to the picture.
[39:09.850 --> 39:12.010]  The thumbnail does not get updated.
[39:12.630 --> 39:17.310]  Especially in older applications, it does not update that metadata and update new versions of Photoshop.
[39:17.310 --> 39:20.290]  They added that feature in there when they realized what was happening.
[39:21.190 --> 39:23.490]  And, is everyone in the room above 18?
[39:23.670 --> 39:25.150]  There's a famous example I'll go to.
[39:28.190 --> 39:29.990]  Actually, I'll do how to find metadata.
[39:30.690 --> 39:32.050]  Native support in the OS.
[39:32.230 --> 39:35.330]  So, you saw some of those screenshots I was doing were just right clicking properties.
[39:35.570 --> 39:37.830]  Or application specific like ID3 tags.
[39:37.950 --> 39:39.450]  And there are several tools out there.
[39:39.650 --> 39:43.010]  There's these Java libraries if you actually wanted to do it from the programming side of things.
[39:43.010 --> 39:45.030]  There's some other tools you can download.
[39:46.390 --> 39:49.670]  Or you can actually go in and hex edit the data itself.
[39:49.830 --> 39:51.670]  And you'll see earlier you saw the...
[39:51.670 --> 39:51.890]  Let's see.
[39:51.950 --> 39:52.590]  Can I go backwards?
[39:52.850 --> 39:53.050]  Yeah.
[39:53.770 --> 39:55.330]  You saw the camera name there.
[39:55.410 --> 39:56.510]  Eastman, Kodak, etc.
[39:57.990 --> 39:58.350]  CX7430.
[39:58.690 --> 40:01.570]  Well, you don't have to use the properties of the limits of the operating system.
[40:01.710 --> 40:02.970]  Open that thing up in a hex editor.
[40:03.590 --> 40:04.570]  Hex editor of choice.
[40:04.730 --> 40:05.970]  And you can actually see the data there.
[40:06.050 --> 40:07.830]  You see in the bottom it says Eastman Kodak Company.
[40:08.190 --> 40:09.530]  It's in a little bit different format.
[40:09.530 --> 40:13.270]  You got the end of line markers and control characters and things like that in there.
[40:13.430 --> 40:14.630]  But you can see that data.
[40:15.430 --> 40:15.750]  So, yeah.
[40:15.910 --> 40:16.570]  Kat Schwartz.
[40:16.890 --> 40:18.090]  Famous example of this.
[40:18.910 --> 40:21.410]  I didn't know who this was to be honest with you because I didn't have cable.
[40:21.770 --> 40:24.810]  But apparently this was a host of tech TV show.
[40:24.990 --> 40:25.830]  Some tech TV show.
[40:26.530 --> 40:29.010]  And she put these two pictures up on her page.
[40:30.430 --> 40:34.650]  And, you know, looking all sultry and seductive and all that good stuff.
[40:35.450 --> 40:37.970]  And, you know, should you be worried about something like this?
[40:38.130 --> 40:39.930]  Well, these are private pictures.
[40:40.090 --> 40:43.490]  And as I said earlier, there's a thumbnail that's kept in those images.
[40:43.830 --> 40:45.350]  So, even with you edit it.
[40:45.550 --> 40:48.790]  Like, for example, you only wanted to show off the eyes or something like that.
[40:49.750 --> 40:51.170]  And forget to update that.
[40:52.010 --> 40:52.370]  Okay.
[40:52.390 --> 40:53.070]  I had to edit.
[40:53.190 --> 40:55.690]  I had to edit the naughty bits because I didn't know.
[40:55.870 --> 40:56.950]  You know, I didn't want to get in any trouble.
[40:58.110 --> 40:59.870]  But you notice these are a little grainy.
[40:59.870 --> 41:04.250]  Because these were thumbnails that were expressed or expanded.
[41:04.410 --> 41:05.490]  I don't know what the proper term would be.
[41:05.710 --> 41:07.070]  They were pulled out of those thumbnails.
[41:07.210 --> 41:08.950]  So, they're not as high quality as the other pictures.
[41:09.270 --> 41:09.750]  But, yeah.
[41:09.870 --> 41:11.590]  You trim those pictures and don't do the update.
[41:11.710 --> 41:11.970]  Then, yeah.
[41:12.050 --> 41:14.070]  You can get yourself in an embarrassing situation.
[41:14.330 --> 41:14.850]  And she did.
[41:14.930 --> 41:16.590]  Of course, she has nothing to be embarrassed about if you ask me.
[41:16.670 --> 41:18.190]  But we'll go on from there.
[41:20.150 --> 41:20.710]  Well, what else?
[41:20.790 --> 41:21.330]  Let me see.
[41:21.450 --> 41:22.250]  I want to speed up here.
[41:22.290 --> 41:23.130]  I don't want to miss anything.
[41:24.850 --> 41:25.130]  Microsoft.
[41:25.330 --> 41:26.590]  This is another great example.
[41:26.650 --> 41:27.630]  One of my favorite examples.
[41:30.130 --> 41:31.430]  Microsoft busted in piracy.
[41:32.090 --> 41:33.110]  They had an excuse.
[41:33.270 --> 41:34.470]  But we'll get to that in a second.
[41:34.910 --> 41:35.710]  And you can open this up.
[41:35.850 --> 41:36.490]  While I talk.
[41:36.630 --> 41:37.590]  If anybody is using XP.
[41:37.670 --> 41:38.370]  You can open it up right now.
[41:38.450 --> 41:39.410]  There's a path at the bottom.
[41:39.890 --> 41:41.010]  You can browse to that.
[41:41.150 --> 41:42.130]  And look at these files.
[41:42.270 --> 41:44.130]  And you will see it on your laptops right now.
[41:44.230 --> 41:45.330]  You can have evidence of this.
[41:46.630 --> 41:48.510]  This is one of the WAV files.
[41:48.610 --> 41:49.890]  One of their sound files in their help.
[41:50.270 --> 41:51.770]  And if you go into the WAV file.
[41:51.890 --> 41:52.790]  Do a hex edit on it.
[41:52.790 --> 41:54.650]  You see this little tag at the very end.
[41:55.310 --> 41:57.030]  And some of you might not recognize it.
[41:57.030 --> 41:57.670]  It's kind of obscure.
[41:57.810 --> 41:58.610]  But Deep Zone.
[41:59.950 --> 42:01.650]  ISFT SoundForge 4.5.
[42:01.770 --> 42:04.250]  Well we know what editing program they used to create these WAV files.
[42:04.370 --> 42:06.220]  It was SoundForge version 4.5.
[42:07.190 --> 42:10.050]  But the key here is the word Deep Zone.
[42:10.990 --> 42:12.850]  Deep Zone is the name of a cracker.
[42:13.350 --> 42:16.910]  This is a cracked version of SoundForge 4.5.
[42:16.910 --> 42:19.290]  And it's in every copy of Windows XP.
[42:21.230 --> 42:25.190]  So Microsoft's excuse was we outsourced the sound production to another company.
[42:25.330 --> 42:26.170]  We didn't do that.
[42:26.650 --> 42:27.990]  But they can't deny it.
[42:28.050 --> 42:29.290]  They can't say, no, we didn't use...
[42:29.290 --> 42:30.090]  Yeah, you did.
[42:31.130 --> 42:34.050]  So when he did the crack, it would add that to the files.
[42:34.330 --> 42:35.850]  So here's the last example.
[42:36.070 --> 42:37.130]  So the first two were kind of funny.
[42:37.190 --> 42:39.050]  This was a little bit more serious and a little bit more scary.
[42:39.290 --> 42:41.350]  And a little bit maybe more close to home for some people.
[42:41.350 --> 42:43.690]  And this is great because it's a fairly recent example.
[42:44.630 --> 42:47.190]  Keep in mind the legalities, especially for defense.
[42:47.490 --> 42:50.170]  There was an interview in the Washington Post, as you see dated there.
[42:50.230 --> 42:53.550]  And you can certainly reference this and verify that it's all true.
[42:54.610 --> 42:55.670]  And it had...
[42:55.670 --> 42:57.690]  Well, they did an interview with this guy.
[42:57.890 --> 42:59.310]  I don't know how you pronounce his name.
[42:59.450 --> 43:02.510]  If it's 0x80 or off by 80, offset 80, whatever.
[43:04.250 --> 43:06.010]  And I did an interview with him.
[43:06.550 --> 43:08.570]  And it had IPTC information.
[43:08.790 --> 43:10.630]  Now, IPTC is another form of metadata.
[43:10.630 --> 43:14.590]  It's an optional form of metadata that's used by the Associated Press.
[43:14.950 --> 43:17.370]  Because they have these giant databases of all these photos.
[43:17.550 --> 43:19.290]  These stock photos that they use for their stories.
[43:19.550 --> 43:20.790]  And they mix them all up.
[43:21.210 --> 43:27.310]  Well, they add all this optional extra data into their photos.
[43:29.090 --> 43:35.350]  So they're doing a story on this 0x80 guy who was running botnets.
[43:35.530 --> 43:39.110]  Bragging about how many millions of dollars he'd made from scamming people out of money.
[43:39.590 --> 43:40.910]  All this fraud that he's committed.
[43:41.090 --> 43:43.770]  They did an interview and kept him truly all this anonymous stuff.
[43:44.470 --> 43:44.810]  Oh!
[43:44.990 --> 43:49.670]  But they accidentally put the city and the state in the IPTC information.
[43:50.430 --> 43:51.290]  So, okay.
[43:51.470 --> 43:51.970]  Well, okay.
[43:52.110 --> 43:52.230]  Fine.
[43:52.330 --> 43:53.690]  You narrowed it down to a city.
[43:53.810 --> 43:55.850]  If it was New York City, you'd have a little problem.
[43:55.950 --> 43:57.430]  This is Roland, Oklahoma.
[43:59.690 --> 44:01.710]  So, a little bit more extra research.
[44:01.890 --> 44:03.510]  Again, get your utility belts.
[44:03.610 --> 44:04.390]  Go Batman on them.
[44:05.010 --> 44:08.190]  And actually, a lot of this was detective work from people on Slashdot.
[44:08.790 --> 44:11.030]  The article itself gives you a lot of clues.
[44:11.350 --> 44:13.330]  You know that this person was 21 years old.
[44:13.430 --> 44:15.370]  That he had blonde hair covering his eyebrows.
[44:15.470 --> 44:16.790]  That he's skinny, et cetera, et cetera.
[44:17.030 --> 44:18.590]  You've narrowed him down physically quite a bit.
[44:18.670 --> 44:20.870]  You know that he smokes and that he even prefers marble.
[44:20.870 --> 44:22.810]  Well, they, you know, get details on the story.
[44:22.990 --> 44:24.190]  You know, hard-hitting journalism there.
[44:25.290 --> 44:26.990]  Lives with his parents in a brick rambler.
[44:27.330 --> 44:29.430]  Mother is a real extreme Christian.
[44:29.770 --> 44:31.310]  Dog, southern accent, et cetera.
[44:31.550 --> 44:32.650]  He's a high school dropout.
[44:33.290 --> 44:36.150]  Well, you know, in a town like that, how many high schools could they have?
[44:36.330 --> 44:37.930]  And how many people dropped out, you know?
[44:38.490 --> 44:40.570]  You know he was an AOL customer seven years ago.
[44:40.950 --> 44:41.970]  Eh, sorry about that.
[44:43.070 --> 44:47.370]  And that he even says that he lives near a used car, a lot of gas station, convenience store, and a strip club.
[44:48.090 --> 44:50.090]  Well, you take that a step further.
[44:50.530 --> 44:51.890]  Mix all of that together.
[44:52.470 --> 44:55.990]  Well, fact, Rowland, Oklahoma has a total population of around 3,000 people.
[44:57.070 --> 44:58.710]  3,000 you've already narrowed it down to.
[44:58.930 --> 45:02.710]  Remember that preponderance of evidence to build down and narrow down to find the person you're looking for?
[45:03.450 --> 45:07.230]  Probably went to either Rowland or Muldrow High School, the only two high schools in the area.
[45:07.650 --> 45:08.090]  You know?
[45:08.490 --> 45:11.630]  Pretty straightforward that that's going to be pretty accurate.
[45:12.170 --> 45:17.590]  Citydata.com reports that there were only about 40 people in that town that were that age in the year 2000.
[45:17.590 --> 45:20.510]  Do a little math and figure out what age he was in 2000.
[45:20.970 --> 45:22.050]  Only about 40 people.
[45:22.170 --> 45:24.130]  You've narrowed it down to 40 possible people now.
[45:24.690 --> 45:34.870]  And the fact that he told where he lives, Google Maps will give you the coordinates, that he's somewhere between that strip club, that convenience store, and that used car lot, somewhere at those coordinates.
[45:34.870 --> 45:38.510]  And you can actually go and Google Map the whole thing.
[45:38.950 --> 45:47.910]  So, kind of scary that here you are giving an anonymous interview, and there's presentations that have been done at HOPE in the past that you should definitely check out about how to talk to the media.
[45:47.930 --> 45:49.670]  And be careful you don't give them stuff like this.
[45:49.750 --> 45:50.270]  And don't...
[45:50.270 --> 45:53.750]  Especially if you're running a botnet ripping people off, don't be a retard anyway.
[45:53.850 --> 45:54.590]  They'll be stupid.
[45:55.010 --> 45:56.050]  What a moron.
[45:56.130 --> 45:56.770]  But I won't...
[45:56.770 --> 45:57.150]  Anyway.
[45:57.570 --> 46:01.430]  So, before we wrap it up, what kind of profile did you make about me?
[46:01.430 --> 46:02.970]  You've been watching this whole thing.
[46:03.130 --> 46:04.190]  So, now I'm going to stand back.
[46:05.190 --> 46:05.430]  What...
[46:05.430 --> 46:06.290]  First of all...
[46:06.290 --> 46:07.150]  Kind of cheated here.
[46:07.210 --> 46:08.790]  What kind of laptop am I using?
[46:08.970 --> 46:09.430]  A Dell.
[46:10.710 --> 46:12.850]  What software did I use to make this presentation?
[46:13.130 --> 46:14.410]  This template is pretty common.
[46:17.170 --> 46:17.570]  PowerPoint.
[46:17.910 --> 46:18.790]  PowerPoint I heard somewhere.
[46:19.730 --> 46:23.070]  Obviously, if I use PowerPoint, I'm running what operating system?
[46:24.070 --> 46:25.610]  Put all this stuff together about me.
[46:25.930 --> 46:28.650]  Did I admit that I used some other things earlier during the presentation?
[46:28.650 --> 46:30.610]  That I had a Google account, for example.
[46:30.870 --> 46:31.590]  Yahoo accounts.
[46:31.850 --> 46:32.410]  Fantasy sport.
[46:32.590 --> 46:33.690]  I gave you a lot of stuff.
[46:33.870 --> 46:36.790]  I don't know if anybody was keeping all that in inventory as we went along.
[46:36.970 --> 46:39.610]  But I gave you a lot of information about me just from presenting.
[46:40.070 --> 46:41.530]  Just from showing a lot of this stuff.
[46:41.750 --> 46:42.890]  What websites I frequent.
[46:43.070 --> 46:44.150]  What ones I post to.
[46:44.190 --> 46:45.430]  I have an account at Meme Streams.
[46:45.890 --> 46:46.690]  Party poker.
[46:47.190 --> 46:47.870]  Things like that.
[46:48.050 --> 46:53.090]  So, you can get a pretty accurate profile from me just from this presentation today.
[46:53.350 --> 46:55.070]  So, that's about it.
[46:55.430 --> 46:58.450]  Give shouts out to the Digital Dog Pound, several of them over here.
[46:59.030 --> 47:01.370]  You can go to digitaldawgpound.org, which is the blog.
[47:01.550 --> 47:02.850]  Like I haven't already pimped the sites enough.
[47:03.090 --> 47:03.910]  Stankdawg.com.
[47:04.030 --> 47:05.330]  You can download this presentation.
[47:05.690 --> 47:06.690]  All of the presentations.
[47:06.690 --> 47:07.270]  I've given it.
[47:07.330 --> 47:07.510]  HOPE.
[47:07.650 --> 47:08.010]  DEFCON.
[47:08.210 --> 47:09.670]  All of them you can download from there.
[47:09.750 --> 47:10.710]  All of the articles I've had.
[47:10.810 --> 47:12.130]  All from stankdawg.com.
[47:12.830 --> 47:13.750]  And binrev.com.
[47:13.890 --> 47:15.110]  We've mentioned great forums.
[47:15.350 --> 47:17.070]  Lots of cool people there.
[47:17.170 --> 47:18.030]  Lots of stuff to learn.
[47:18.130 --> 47:18.930]  Binrev.com.
[47:18.990 --> 47:19.470]  The addiction.
[47:20.290 --> 47:21.770]  And to my local BinRev meetings.
[47:21.910 --> 47:22.590]  This presentation.
[47:22.790 --> 47:23.830]  And this is to everybody.
[47:23.830 --> 47:25.010]  This presentation.
[47:25.650 --> 47:29.110]  That very first image that you saw of the little task bar.
[47:29.590 --> 47:31.530]  Was me flying for work.
[47:31.950 --> 47:32.870]  And I looked at my task bar.
[47:32.970 --> 47:33.930]  And I went, wow, that's kind of cool.
[47:34.030 --> 47:35.230]  That little trillion thing down there.
[47:35.330 --> 47:35.390]  You know.
[47:35.450 --> 47:37.890]  I'm like, I wonder if my guys at my meeting would recognize that.
[47:38.410 --> 47:39.970]  That's how this presentation started.
[47:40.210 --> 47:42.410]  This whole thing started off as just that little screenshot.
[47:42.630 --> 47:43.670]  And we're like, oh, that's kind of neat.
[47:43.710 --> 47:44.730]  I wonder what else we can come up with.
[47:45.070 --> 47:48.310]  So I went to the meeting thinking, oh, this would just be a silly little side note.
[47:48.350 --> 47:49.710]  And we all started looking around.
[47:49.810 --> 47:50.670]  Hey, what else could we find?
[47:50.710 --> 47:51.270]  What else could we find?
[47:51.330 --> 47:53.170]  So I actually put together several other screenshots.
[47:53.510 --> 47:55.410]  Put it together into the 15 minute thing.
[47:55.610 --> 47:58.010]  Now we've got a full presentation looking at metadata.
[47:58.230 --> 48:00.590]  And all of the information that you can find out.
[48:00.590 --> 48:02.370]  Again, I made up the term electronic deduction.
[48:02.370 --> 48:04.610]  But it seems fitting of all this stuff.
[48:04.730 --> 48:09.370]  But any of you, even these little things that you find interesting, other people are going to find interesting or fun.
[48:09.470 --> 48:10.530]  I mean, this was kind of fun.
[48:10.650 --> 48:12.210]  I mean, did anybody learn anything from this?
[48:12.250 --> 48:13.510]  There's a lot of new stuff in here, right?
[48:13.510 --> 48:15.850]  I mean, it's nothing that was above anyone's head.
[48:16.090 --> 48:17.630]  You know, it's all stuff that you've known before.
[48:17.710 --> 48:23.470]  But kind of putting it together in such a way that it's like, wow, that's kind of cool that I can isolate stuff like that.
[48:23.710 --> 48:29.490]  So yeah, give presentations at your local BinRev meetings, at your local 2600 meetings, whatever you call them.
[48:29.510 --> 48:30.110]  It doesn't matter.
[48:30.610 --> 48:32.230]  Meeting with people, making little presentations.
[48:32.230 --> 48:34.930]  You never know what you might get out of it.
[48:35.330 --> 48:37.330]  So I've got a couple minutes.
[48:37.330 --> 48:42.550]  So if you can tear away from the spinning monkey, the mesmerization of...
[48:42.890 --> 48:46.610]  If you have any questions, we've got maybe five minutes left, three or four minutes left.
[48:46.750 --> 48:48.930]  So I'd be happy to answer anything if I can.
[48:49.030 --> 48:51.210]  But I may have my questions for some of you guys out there.
[48:51.270 --> 48:52.550]  You guys are giving me lots of good stuff.
[48:52.730 --> 48:53.810]  So, I'm sorry?
[48:56.050 --> 48:58.510]  That was actually off of your blog, wasn't it?
[48:58.890 --> 48:59.070]  No?
[48:59.410 --> 48:59.930]  Oh, sorry.
[49:01.810 --> 49:02.530]  Oh, okay.
[49:04.270 --> 49:05.670]  So, anything else?
[49:07.750 --> 49:08.430]  Yeah, man.
[49:08.530 --> 49:15.110]  Just regarding some of the exit data, I think if you take a JPEG into Photoshop and edit it...
[49:15.110 --> 49:16.050]  Thank you.
[49:16.550 --> 49:24.810]  And then check out, like if you open up the JPEG in edit plus, which I think you were using to look at the source.
[49:26.290 --> 49:28.470]  Photoshop also puts in some data about...
[49:28.470 --> 49:30.870]  I'm pretty sure there's a time in there when it was edited.
[49:31.210 --> 49:34.590]  And then that original EXIF data was still there when the photo was taken.
[49:35.490 --> 49:40.630]  So, you can also check for photo manipulations that way if no thumbnail was saved.
[49:40.890 --> 49:43.530]  That's how a lot of those Photoshop things get debunked.
[49:43.530 --> 49:43.710]  Yeah.
[49:43.850 --> 49:48.930]  It will also put metadata in and it will say when it was edited, what software was edited with.
[49:49.110 --> 49:51.270]  So, another way of checking if photos have been edited.
[49:51.350 --> 49:51.410]  Very cool.
[49:51.530 --> 49:51.830]  Very cool.
[49:54.750 --> 49:55.710]  Yeah, right there.
[49:56.050 --> 49:56.230]  Oh.
[49:56.650 --> 50:00.050]  Yeah, you said there was ways of telling if somebody was messing with the metadata.
[50:00.330 --> 50:03.430]  Like if somebody used like an XF writer or something like that.
[50:03.430 --> 50:06.630]  Yeah, you made it sound like there's ways that you could kind of prove that.
[50:06.730 --> 50:07.350]  How would you do that?
[50:07.510 --> 50:09.430]  Well, you can change...
[50:10.030 --> 50:10.550]  I mean, that's really...
[50:11.430 --> 50:14.170]  I'll probably come down and talk afterwards because you can get into a lot of it.
[50:14.210 --> 50:15.650]  And that's not my area of expertise.
[50:15.950 --> 50:18.350]  But there are forensics things that can go through there.
[50:18.510 --> 50:22.930]  And mostly what he's describing is what I was thinking of was just going back and there are iterations.
[50:23.050 --> 50:26.790]  Kind of like what I described with the Microsoft document, how it keeps a lot of that stuff in there.
[50:26.930 --> 50:33.610]  But there are applications custom designed that will do that, that they sell to law enforcement and security and stuff like that, that will rip it out.
[50:34.090 --> 50:37.110]  Or, like he said, edit plus is what I use and I can go through...
[50:37.110 --> 50:37.750]  Good eye, by the way.
[50:37.790 --> 50:38.390]  That was a good catch.
[50:39.050 --> 50:41.090]  There's a presentation on those tools Sunday.
[50:41.930 --> 50:42.330]  What's that?
[50:42.430 --> 50:43.870]  There's a presentation on those tools Sunday.
[50:44.470 --> 50:44.770]  Great.
[50:44.970 --> 50:45.450]  So there you go.
[50:45.530 --> 50:46.090]  Come back Sunday.
[50:46.090 --> 50:46.410]  What time?
[50:49.450 --> 50:51.290]  Oh, also, tonight...
[50:51.290 --> 50:57.550]  For some people who came in here towards the end tonight, 11 o'clock, Binary Revolution Radio season four, episode number one.
[50:57.670 --> 50:57.990]  Come back.
[50:58.110 --> 50:58.950]  We'll have some more fun.
[50:59.310 --> 51:01.870]  Probably be a lot more colorful language at that one.
[51:01.910 --> 51:04.690]  This one was a little bit more low key because I was trying to get some points across.
[51:05.050 --> 51:05.730]  We're going to have fun for that.
[51:05.850 --> 51:06.410]  No, no, come, come.
[51:07.830 --> 51:13.210]  And Black Ratchet doing Phone Phreaking 101 tomorrow at 12 o'clock in this very room.
[51:13.310 --> 51:14.410]  Make sure you come check that out.
[51:15.370 --> 51:16.010]  Okay, right here.
[51:16.150 --> 51:18.670]  I was just going to expand upon that point about the forensics.
[51:18.670 --> 51:23.090]  Basically, what you do is you go back and you track with the computer that the person used.
[51:23.270 --> 51:26.050]  You look at file access times, file created times.
[51:26.350 --> 51:33.110]  If they access it over a network, you've got that data on the servers and that kind of thing as far as the forensic tracking of it.
[51:33.510 --> 51:33.830]  Right.
[51:34.810 --> 51:35.670]  Yeah, and there's...
[51:37.570 --> 51:40.970]  I don't like the way Microsoft does that turn tracking on.
[51:41.310 --> 51:42.390]  It's tracking anyway.
[51:42.830 --> 51:47.270]  You know, that's just kind of like this way to say, oh, yeah, turn tracking on to make it easier for you to follow other people.
[51:47.270 --> 51:50.190]  But just keeping a lot of that old metadata on its own anyway.
[51:51.050 --> 51:53.150]  And, yeah, okay, we've got to cut off here.
[51:53.330 --> 51:54.170]  So, anyway.
[51:54.890 --> 51:55.750]  Thank you very much.
[51:56.070 --> 51:56.690]  Short notice.
[51:56.850 --> 51:57.190]  I'm sorry.
[51:57.570 --> 51:59.930]  If you're here to see the other one, is it going to be cancelled?
[52:01.690 --> 52:03.090]  The original one is cancelled?
[52:03.330 --> 52:04.350]  That was supposed to be here?
[52:04.950 --> 52:05.270]  Yeah.
[52:05.510 --> 52:10.290]  So that one has been cancelled, but there is still a presentation coming up at 12.30 tonight after our show.
[52:10.370 --> 52:11.350]  So come back and check that out.
[52:11.390 --> 52:12.790]  And thanks again for your time.
[52:13.310 --> 52:13.850]  It's, it's just fun!